34 */
35
36#include <sys/types.h>
37#include <sys/dirent.h>
38#include <sys/mman.h>
39#include <sys/queue.h>
40#include <sys/stat.h>
41#include <sys/wait.h>
42
43#include <bsm/audit.h>
44#include <bsm/audit_uevents.h>
45#include <bsm/libbsm.h>
46
47#include <err.h>
48#include <errno.h>
49#include <fcntl.h>
50#include <grp.h>
51#include <stdio.h>
52#include <stdlib.h>
53#include <time.h>
54#include <unistd.h>
55#include <signal.h>
56#include <string.h>
57#include <syslog.h>
58
59#include "auditd.h"
60
61#define NA_EVENT_STR_SIZE 25
62#define POL_STR_SIZE 128
63
64static int ret, minval;
65static char *lastfile = NULL;
66static int allhardcount = 0;
67static int triggerfd = 0;
68static int sigchlds, sigchlds_handled;
69static int sighups, sighups_handled;
70static int sigterms, sigterms_handled;
71
72static TAILQ_HEAD(, dir_ent) dir_q;
73
74static int config_audit_controls(void);
75
76/*
77 * Error starting auditd
78 */
79static void
80fail_exit(void)
81{
82
83 audit_warn_nostart();
84 exit(1);
85}
86
87/*
88 * Free our local list of directory names.
89 */
90static void
91free_dir_q(void)
92{
93 struct dir_ent *dirent;
94
95 while ((dirent = TAILQ_FIRST(&dir_q))) {
96 TAILQ_REMOVE(&dir_q, dirent, dirs);
97 free(dirent->dirname);
98 free(dirent);
99 }
100}
101
102/*
103 * Generate the timestamp string.
104 */
105static int
106getTSstr(char *buf, int len)
107{
108 struct timeval ts;
109 struct timezone tzp;
110 time_t tt;
111
112 if (gettimeofday(&ts, &tzp) != 0)
113 return (-1);
114 tt = (time_t)ts.tv_sec;
115 if (!strftime(buf, len, "%Y%m%d%H%M%S", gmtime(&tt)))
116 return (-1);
117 return (0);
118}
119
120/*
121 * Concat the directory name to the given file name.
122 * XXX We should affix the hostname also
123 */
124static char *
125affixdir(char *name, struct dir_ent *dirent)
126{
127 char *fn;
128 char *curdir;
129 const char *sep = "/";
130
131 curdir = dirent->dirname;
132 syslog(LOG_DEBUG, "dir = %s", dirent->dirname);
133
134 fn = malloc(strlen(curdir) + strlen(sep) + (2 * POSTFIX_LEN) + 1);
135 if (fn == NULL)
136 return (NULL);
137 strcpy(fn, curdir);
138 strcat(fn, sep);
139 strcat(fn, name);
140 return (fn);
141}
142
143/*
144 * Close the previous audit trail file.
145 */
146static int
147close_lastfile(char *TS)
148{
149 char *ptr;
150 char *oldname;
151
152 if (lastfile != NULL) {
153 oldname = (char *)malloc(strlen(lastfile) + 1);
154 if (oldname == NULL)
155 return (-1);
156 strcpy(oldname, lastfile);
157
158 /* Rename the last file -- append timestamp. */
159 if ((ptr = strstr(lastfile, NOT_TERMINATED)) != NULL) {
160 *ptr = '.';
161 strcpy(ptr+1, TS);
162 if (rename(oldname, lastfile) != 0)
163 syslog(LOG_ERR,
164 "Could not rename %s to %s: %m", oldname,
165 lastfile);
166 else {
167 syslog(LOG_INFO, "renamed %s to %s",
168 oldname, lastfile);
169 audit_warn_closefile(lastfile);
170 }
171 }
172 free(lastfile);
173 free(oldname);
174 lastfile = NULL;
175 }
176 return (0);
177}
178
179/*
180 * Create the new audit file with appropriate permissions and ownership. Try
181 * to clean up if something goes wrong.
182 */
183static int
184#ifdef AUDIT_REVIEW_GROUP
185open_trail(const char *fname, uid_t uid, gid_t gid)
186#else
187open_trail(const char *fname)
188#endif
189{
190 int error, fd;
191
192 fd = open(fname, O_RDONLY | O_CREAT, S_IRUSR | S_IRGRP);
193 if (fd < 0)
194 return (-1);
195#ifdef AUDIT_REVIEW_GROUP
196 if (fchown(fd, uid, gid) < 0) {
197 error = errno;
198 close(fd);
199 (void)unlink(fname);
200 errno = error;
201 return (-1);
202 }
203#endif
204 return (fd);
205}
206
207/*
208 * Create the new file name, swap with existing audit file.
209 */
210static int
211swap_audit_file(void)
212{
213 char timestr[2 * POSTFIX_LEN];
214 char *fn;
215 char TS[POSTFIX_LEN];
216 struct dir_ent *dirent;
217#ifdef AUDIT_REVIEW_GROUP
218 struct group *grp;
219 gid_t gid;
220 uid_t uid;
221#endif
222 int error, fd;
223
224 if (getTSstr(TS, POSTFIX_LEN) != 0)
225 return (-1);
226
227 strcpy(timestr, TS);
228 strcat(timestr, NOT_TERMINATED);
229
230#ifdef AUDIT_REVIEW_GROUP
231 /*
232 * XXXRW: Currently, this code falls back to the daemon gid, which is
233 * likely the wheel group. Is there a better way to deal with this?
234 */
235 grp = getgrnam(AUDIT_REVIEW_GROUP);
236 if (grp == NULL) {
237 syslog(LOG_INFO,
238 "Audit review group '%s' not available, using daemon gid",
239 AUDIT_REVIEW_GROUP);
240 gid = -1;
241 } else
242 gid = grp->gr_gid;
243 uid = getuid();
244#endif
245
246 /* Try until we succeed. */
247 while ((dirent = TAILQ_FIRST(&dir_q))) {
248 if ((fn = affixdir(timestr, dirent)) == NULL) {
249 syslog(LOG_INFO, "Failed to swap log at time %s",
250 timestr);
251 return (-1);
252 }
253
254 /*
255 * Create and open the file; then close and pass to the
256 * kernel if all went well.
257 */
258 syslog(LOG_INFO, "New audit file is %s", fn);
259#ifdef AUDIT_REVIEW_GROUP
260 fd = open_trail(fn, uid, gid);
261#else
262 fd = open_trail(fn);
263#endif
264 if (fd < 0)
265 warn("open(%s)", fn);
266 if (fd >= 0) {
267 error = auditctl(fn);
268 if (error) {
269 syslog(LOG_ERR,
270 "auditctl failed setting log file! : %s",
271 strerror(errno));
272 close(fd);
273 } else {
274 /* Success. */
275 close_lastfile(TS);
276 lastfile = fn;
277 close(fd);
278 return (0);
279 }
280 }
281
282 /*
283 * Tell the administrator about lack of permissions for dir.
284 */
285 audit_warn_getacdir(dirent->dirname);
286
287 /* Try again with a different directory. */
288 TAILQ_REMOVE(&dir_q, dirent, dirs);
289 free(dirent->dirname);
290 free(dirent);
291 }
292 syslog(LOG_ERR, "Log directories exhausted");
293 return (-1);
294}
295
296/*
297 * Read the audit_control file contents.
298 */
299static int
300read_control_file(void)
301{
302 char cur_dir[MAXNAMLEN];
303 struct dir_ent *dirent;
304 au_qctrl_t qctrl;
305
306 /*
307 * Clear old values. Force a re-read of the file the next time.
308 */
309 free_dir_q();
310 endac();
311
312 /*
313 * Read the list of directories into a local linked list.
314 *
315 * XXX We should use the reentrant interfaces once they are
316 * available.
317 */
318 while (getacdir(cur_dir, MAXNAMLEN) >= 0) {
319 dirent = (struct dir_ent *) malloc(sizeof(struct dir_ent));
320 if (dirent == NULL)
321 return (-1);
322 dirent->softlim = 0;
323 dirent->dirname = (char *) malloc(MAXNAMLEN);
324 if (dirent->dirname == NULL) {
325 free(dirent);
326 return (-1);
327 }
328 strcpy(dirent->dirname, cur_dir);
329 TAILQ_INSERT_TAIL(&dir_q, dirent, dirs);
330 }
331
332 allhardcount = 0;
333 if (swap_audit_file() == -1) {
334 syslog(LOG_ERR, "Could not swap audit file");
335 /*
336 * XXX Faulty directory listing? - user should be given
337 * XXX an opportunity to change the audit_control file
338 * XXX switch to a reduced mode of auditing?
339 */
340 return (-1);
341 }
342
343 /*
344 * XXX There are synchronization problems here
345 * XXX what should we do if a trigger for the earlier limit
346 * XXX is generated here?
347 */
348 if (0 == (ret = getacmin(&minval))) {
349 syslog(LOG_DEBUG, "min free = %d", minval);
350 if (auditon(A_GETQCTRL, &qctrl, sizeof(qctrl)) != 0) {
351 syslog(LOG_ERR,
352 "could not get audit queue settings");
353 return (-1);
354 }
355 qctrl.aq_minfree = minval;
356 if (auditon(A_SETQCTRL, &qctrl, sizeof(qctrl)) != 0) {
357 syslog(LOG_ERR,
358 "could not set audit queue settings");
359 return (-1);
360 }
361 }
362
363 return (0);
364}
365
366/*
367 * Close all log files, control files, and tell the audit system.
368 */
369static int
370close_all(void)
371{
372 struct auditinfo ai;
373 int err_ret = 0;
374 char TS[POSTFIX_LEN];
375 int aufd;
376 token_t *tok;
377 long cond;
378
379 /* Generate an audit record. */
380 if ((aufd = au_open()) == -1)
381 syslog(LOG_ERR, "Could not create audit shutdown event.");
382 else {
383 if ((tok = au_to_text("auditd::Audit shutdown")) != NULL)
384 au_write(aufd, tok);
385 /*
386 * XXX we need to implement extended subject tokens so we can
387 * effectively represent terminal lines with this token type.
388 */
389 bzero(&ai, sizeof(ai));
390 if ((tok = au_to_subject32(getuid(), geteuid(), getegid(),
391 getuid(), getgid(), getpid(), getpid(), &ai.ai_termid))
392 != NULL)
393 au_write(aufd, tok);
394 if ((tok = au_to_return32(0, 0)) != NULL)
395 au_write(aufd, tok);
396 if (au_close(aufd, 1, AUE_audit_shutdown) == -1)
397 syslog(LOG_ERR,
398 "Could not close audit shutdown event.");
399 }
400
401 /* Flush contents. */
402 cond = AUC_DISABLED;
403 err_ret = auditon(A_SETCOND, &cond, sizeof(cond));
404 if (err_ret != 0) {
405 syslog(LOG_ERR, "Disabling audit failed! : %s",
406 strerror(errno));
407 err_ret = 1;
408 }
409 if (getTSstr(TS, POSTFIX_LEN) == 0)
410 close_lastfile(TS);
411 if (lastfile != NULL)
412 free(lastfile);
413
414 free_dir_q();
415 if ((remove(AUDITD_PIDFILE) == -1) || err_ret) {
416 syslog(LOG_ERR, "Could not unregister");
417 audit_warn_postsigterm();
418 return (1);
419 }
420 endac();
421
422 if (close(triggerfd) != 0)
423 syslog(LOG_ERR, "Error closing control file");
424 syslog(LOG_INFO, "Finished");
425 return (0);
426}
427
428/*
429 * When we get a signal, we are often not at a clean point. So, little can
430 * be done in the signal handler itself. Instead, we send a message to the
431 * main servicing loop to do proper handling from a non-signal-handler
432 * context.
433 */
434static void
435relay_signal(int signal)
436{
437
438 if (signal == SIGHUP)
439 sighups++;
440 if (signal == SIGTERM)
441 sigterms++;
442 if (signal == SIGCHLD)
443 sigchlds++;
444}
445
446/*
447 * Registering the daemon.
448 */
449static int
450register_daemon(void)
451{
452 FILE * pidfile;
453 int fd;
454 pid_t pid;
455
456 /* Set up the signal hander. */
457 if (signal(SIGTERM, relay_signal) == SIG_ERR) {
458 syslog(LOG_ERR,
459 "Could not set signal handler for SIGTERM");
460 fail_exit();
461 }
462 if (signal(SIGCHLD, relay_signal) == SIG_ERR) {
463 syslog(LOG_ERR,
464 "Could not set signal handler for SIGCHLD");
465 fail_exit();
466 }
467 if (signal(SIGHUP, relay_signal) == SIG_ERR) {
468 syslog(LOG_ERR,
469 "Could not set signal handler for SIGHUP");
470 fail_exit();
471 }
472
473 if ((pidfile = fopen(AUDITD_PIDFILE, "a")) == NULL) {
474 syslog(LOG_ERR, "Could not open PID file");
475 audit_warn_tmpfile();
476 return (-1);
477 }
478
479 /* Attempt to lock the pid file; if a lock is present, exit. */
480 fd = fileno(pidfile);
481 if (flock(fd, LOCK_EX | LOCK_NB) < 0) {
482 syslog(LOG_ERR,
483 "PID file is locked (is another auditd running?).");
484 audit_warn_ebusy();
485 return (-1);
486 }
487
488 pid = getpid();
489 ftruncate(fd, 0);
490 if (fprintf(pidfile, "%u\n", pid) < 0) {
491 /* Should not start the daemon. */
492 fail_exit();
493 }
494
495 fflush(pidfile);
496 return (0);
497}
498
499/*
500 * Handle the audit trigger event.
501 *
502 * We suppress (ignore) duplicated triggers in close succession in order to
503 * try to avoid thrashing-like behavior. However, not all triggers can be
504 * ignored, as triggers generally represent edge triggers, not level
505 * triggers, and won't be retransmitted if the condition persists. Of
506 * specific concern is the rotate trigger -- if one is dropped, then it will
507 * not be retransmitted, and the log file will grow in an unbounded fashion.
508 */
509#define DUPLICATE_INTERVAL 30
510static void
511handle_audit_trigger(int trigger)
512{
513 static int last_trigger, last_warning;
514 static time_t last_time;
515 struct dir_ent *dirent;
516 struct timeval ts;
517 struct timezone tzp;
518 time_t tt;
519
520 /*
521 * Suppress duplicate messages from the kernel within the specified
522 * interval.
523 */
524 if (gettimeofday(&ts, &tzp) == 0) {
525 tt = (time_t)ts.tv_sec;
526 switch (trigger) {
527 case AUDIT_TRIGGER_LOW_SPACE:
528 case AUDIT_TRIGGER_NO_SPACE:
529 /*
530 * Triggers we can suppress. Of course, we also need
531 * to rate limit the warnings, so apply the same
532 * interval limit on syslog messages.
533 */
534 if ((trigger == last_trigger) &&
535 (tt < (last_time + DUPLICATE_INTERVAL))) {
536 if (tt >= (last_warning + DUPLICATE_INTERVAL))
537 syslog(LOG_INFO,
538 "Suppressing duplicate trigger %d",
539 trigger);
540 return;
541 }
542 last_warning = tt;
543 break;
544
545 case AUDIT_TRIGGER_ROTATE_KERNEL:
546 case AUDIT_TRIGGER_ROTATE_USER:
547 case AUDIT_TRIGGER_READ_FILE:
548 /*
549 * Triggers that we cannot suppress.
550 */
551 break;
552 }
553
554 /*
555 * Only update last_trigger after aborting due to a duplicate
556 * trigger, not before, or we will never allow that trigger
557 * again.
558 */
559 last_trigger = trigger;
560 last_time = tt;
561 }
562
563 /*
564 * Message processing is done here.
565 */
566 dirent = TAILQ_FIRST(&dir_q);
567 switch(trigger) {
568 case AUDIT_TRIGGER_LOW_SPACE:
569 syslog(LOG_INFO, "Got low space trigger");
570 if (dirent && (dirent->softlim != 1)) {
571 TAILQ_REMOVE(&dir_q, dirent, dirs);
572 /* Add this node to the end of the list. */
573 TAILQ_INSERT_TAIL(&dir_q, dirent, dirs);
574 audit_warn_soft(dirent->dirname);
575 dirent->softlim = 1;
576
577 if (TAILQ_NEXT(TAILQ_FIRST(&dir_q), dirs) != NULL &&
578 swap_audit_file() == -1)
579 syslog(LOG_ERR, "Error swapping audit file");
580
581 /*
582 * Check if the next dir has already reached its soft
583 * limit.
584 */
585 dirent = TAILQ_FIRST(&dir_q);
586 if (dirent->softlim == 1) {
587 /* All dirs have reached their soft limit. */
588 audit_warn_allsoft();
589 }
590 } else {
591 /*
592 * Continue auditing to the current file. Also
593 * generate an allsoft warning.
594 *
595 * XXX do we want to do this ?
596 */
597 audit_warn_allsoft();
598 }
599 break;
600
601 case AUDIT_TRIGGER_NO_SPACE:
602 syslog(LOG_INFO, "Got no space trigger");
603
604 /* Delete current dir, go on to next. */
605 TAILQ_REMOVE(&dir_q, dirent, dirs);
606 audit_warn_hard(dirent->dirname);
607 free(dirent->dirname);
608 free(dirent);
609
610 if (swap_audit_file() == -1)
611 syslog(LOG_ERR, "Error swapping audit file");
612
613 /* We are out of log directories. */
614 audit_warn_allhard(++allhardcount);
615 break;
616
617 case AUDIT_TRIGGER_ROTATE_KERNEL:
618 case AUDIT_TRIGGER_ROTATE_USER:
619 /*
620 * Create a new file and swap with the one being used in
621 * kernel
622 */
623 syslog(LOG_INFO, "Got open new trigger from %s", trigger ==
624 AUDIT_TRIGGER_ROTATE_KERNEL ? "kernel" : "user");
625 if (swap_audit_file() == -1)
626 syslog(LOG_ERR, "Error swapping audit file");
627 break;
628
629 case AUDIT_TRIGGER_READ_FILE:
630 syslog(LOG_INFO, "Got read file trigger");
631 if (read_control_file() == -1)
632 syslog(LOG_ERR, "Error in audit control file");
633 if (config_audit_controls() == -1)
634 syslog(LOG_ERR, "Error setting audit controls");
635 break;
636
637 default:
638 syslog(LOG_ERR, "Got unknown trigger %d", trigger);
639 break;
640 }
641}
642
643static void
644handle_sighup(void)
645{
646
647 sighups_handled = sighups;
648 config_audit_controls();
649}
650
651/*
652 * Reap our children.
653 */
654static void
655reap_children(void)
656{
657 pid_t child;
658 int wstatus;
659
660 while ((child = waitpid(-1, &wstatus, WNOHANG)) > 0) {
661 if (!wstatus)
662 continue;
663 syslog(LOG_INFO, "warn process [pid=%d] %s %d.", child,
664 ((WIFEXITED(wstatus)) ? "exited with non-zero status" :
665 "exited as a result of signal"),
666 ((WIFEXITED(wstatus)) ? WEXITSTATUS(wstatus) :
667 WTERMSIG(wstatus)));
668 }
669}
670
671static void
672handle_sigchld(void)
673{
674
675 sigchlds_handled = sigchlds;
676 reap_children();
677}
678
679/*
680 * Read the control file for triggers/signals and handle appropriately.
681 */
682static int
683wait_for_events(void)
684{
685 int num;
686 unsigned int trigger;
687
688 for (;;) {
689 num = read(triggerfd, &trigger, sizeof(trigger));
690 if ((num == -1) && (errno != EINTR)) {
691 syslog(LOG_ERR, "%s: error %d", __FUNCTION__, errno);
692 return (-1);
693 }
694 if (sigterms != sigterms_handled) {
695 syslog(LOG_DEBUG, "%s: SIGTERM", __FUNCTION__);
696 break;
697 }
698 if (sigchlds != sigchlds_handled)
699 handle_sigchld();
700 if (sighups != sighups_handled) {
701 syslog(LOG_DEBUG, "%s: SIGHUP", __FUNCTION__);
702 handle_sighup();
703 }
704 if ((num == -1) && (errno == EINTR))
705 continue;
706 if (num == 0) {
707 syslog(LOG_ERR, "%s: read EOF", __FUNCTION__);
708 return (-1);
709 }
710 if (trigger == AUDIT_TRIGGER_CLOSE_AND_DIE)
711 break;
712 else
713 handle_audit_trigger(trigger);
714 }
715 return (close_all());
716}
717
718/*
719 * Configure the audit controls in the kernel: the event to class mapping,
720 * kernel preselection mask, etc.
721 */
722static int
723config_audit_controls(void)
724{
725 au_event_ent_t ev, *evp;
726 au_evclass_map_t evc_map;
727 au_mask_t aumask;
728 int ctr = 0;
729 char naeventstr[NA_EVENT_STR_SIZE];
730 char polstr[POL_STR_SIZE];
731 long policy;
732 au_fstat_t au_fstat;
733 size_t filesz;
734
735 /*
736 * Process the audit event file, obtaining a class mapping for each
737 * event, and send that mapping into the kernel.
738 *
739 * XXX There's a risk here that the BSM library will return NULL
740 * for an event when it can't properly map it to a class. In that
741 * case, we will not process any events beyond the one that failed,
742 * but should. We need a way to get a count of the events.
743 */
744 ev.ae_name = (char *)malloc(AU_EVENT_NAME_MAX);
745 ev.ae_desc = (char *)malloc(AU_EVENT_DESC_MAX);
746 if ((ev.ae_name == NULL) || (ev.ae_desc == NULL)) {
747 if (ev.ae_name != NULL)
748 free(ev.ae_name);
749 syslog(LOG_ERR,
750 "Memory allocation error when configuring audit controls.");
751 return (-1);
752 }
753
754 /*
755 * XXXRW: Currently we have no way to remove mappings from the kernel
756 * when they are removed from the file-based mappings.
757 */
758 evp = &ev;
759 setauevent();
760 while ((evp = getauevent_r(evp)) != NULL) {
761 evc_map.ec_number = evp->ae_number;
762 evc_map.ec_class = evp->ae_class;
763 if (auditon(A_SETCLASS, &evc_map, sizeof(au_evclass_map_t))
764 != 0)
765 syslog(LOG_ERR,
766 "Failed to register class mapping for event %s",
767 evp->ae_name);
768 else
769 ctr++;
770 }
771 endauevent();
772 free(ev.ae_name);
773 free(ev.ae_desc);
774 if (ctr == 0)
775 syslog(LOG_ERR, "No events to class mappings registered.");
776 else
777 syslog(LOG_DEBUG, "Registered %d event to class mappings.",
778 ctr);
779
780 /*
781 * Get the non-attributable event string and set the kernel mask from
782 * that.
783 */
784 if ((getacna(naeventstr, NA_EVENT_STR_SIZE) == 0) &&
785 (getauditflagsbin(naeventstr, &aumask) == 0)) {
786 if (auditon(A_SETKMASK, &aumask, sizeof(au_mask_t)))
787 syslog(LOG_ERR,
788 "Failed to register non-attributable event mask.");
789 else
790 syslog(LOG_DEBUG,
791 "Registered non-attributable event mask.");
792 } else
793 syslog(LOG_ERR,
794 "Failed to obtain non-attributable event mask.");
795
796 /*
797 * If a policy is configured in audit_control(5), implement the
798 * policy. However, if one isn't defined, set AUDIT_CNT to avoid
799 * leaving the system in a fragile state.
800 */
801 if ((getacpol(polstr, POL_STR_SIZE) == 0) &&
802 (au_strtopol(polstr, &policy) == 0)) {
803 if (auditon(A_SETPOLICY, &policy, sizeof(policy)))
804 syslog(LOG_ERR, "Failed to set audit policy: %m");
805 } else {
806 syslog(LOG_ERR, "Failed to obtain policy flags: %m");
807 policy = AUDIT_CNT;
808 if (auditon(A_SETPOLICY, &policy, sizeof(policy)))
809 syslog(LOG_ERR,
810 "Failed to set default audit policy: %m");
811 }
812
813 /*
814 * Set trail rotation size.
815 */
816 if (getacfilesz(&filesz) == 0) {
817 bzero(&au_fstat, sizeof(au_fstat));
818 au_fstat.af_filesz = filesz;
819 if (auditon(A_SETFSIZE, &au_fstat, sizeof(au_fstat)) < 0)
820 syslog(LOG_ERR, "Failed to set filesz: %m");
821 } else
822 syslog(LOG_ERR, "Failed to obtain filesz: %m");
823
824 return (0);
825}
826
827static void
828setup(void)
829{
830 struct auditinfo ai;
831 auditinfo_t auinfo;
832 int aufd;
833 token_t *tok;
834
835 if ((triggerfd = open(AUDIT_TRIGGER_FILE, O_RDONLY, 0)) < 0) {
836 syslog(LOG_ERR, "Error opening trigger file");
837 fail_exit();
838 }
839
840 /*
841 * To provide event feedback cycles and avoid auditd becoming
842 * stalled if auditing is suspended, auditd and its children run
843 * without their events being audited. We allow the uid, tid, and
844 * mask fields to be implicitly set to zero, but do set the pid. We
845 * run this after opening the trigger device to avoid configuring
846 * audit state without audit present in the system.
847 *
848 * XXXRW: Is there more to it than this?
849 */
850 bzero(&auinfo, sizeof(auinfo));
851 auinfo.ai_asid = getpid();
852 if (setaudit(&auinfo) == -1) {
853 syslog(LOG_ERR, "Error setting audit stat");
854 fail_exit();
855 }
856
857 TAILQ_INIT(&dir_q);
858 if (read_control_file() == -1) {
859 syslog(LOG_ERR, "Error reading control file");
860 fail_exit();
861 }
862
863 /* Generate an audit record. */
864 if ((aufd = au_open()) == -1)
865 syslog(LOG_ERR, "Could not create audit startup event.");
866 else {
867 /*
868 * XXXCSJP Perhaps we want more robust audit records for
869 * audit start up and shutdown. This might include capturing
870 * failures to initialize the audit subsystem?
871 */
872 bzero(&ai, sizeof(ai));
873 if ((tok = au_to_subject32(getuid(), geteuid(), getegid(),
874 getuid(), getgid(), getpid(), getpid(), &ai.ai_termid))
875 != NULL)
876 au_write(aufd, tok);
877 if ((tok = au_to_text("auditd::Audit startup")) != NULL)
878 au_write(aufd, tok);
879 if ((tok = au_to_return32(0, 0)) != NULL)
880 au_write(aufd, tok);
881 if (au_close(aufd, 1, AUE_audit_startup) == -1)
882 syslog(LOG_ERR,
883 "Could not close audit startup event.");
884 }
885
886 if (config_audit_controls() == 0)
887 syslog(LOG_INFO, "Audit controls init successful");
888 else
889 syslog(LOG_ERR, "Audit controls init failed");
890}
891
892int
893main(int argc, char **argv)
894{
895 int ch;
896 int debug = 0;
897 int rc;
898
899 while ((ch = getopt(argc, argv, "d")) != -1) {
900 switch(ch) {
901 case 'd':
902 /* Debug option. */
903 debug = 1;
904 break;
905
906 case '?':
907 default:
908 (void)fprintf(stderr,
909 "usage: auditd [-d] \n");
910 exit(1);
911 }
912 }
913
914#ifdef LOG_SECURITY
915 openlog("auditd", LOG_CONS | LOG_PID, LOG_SECURITY);
916#else
917 openlog("auditd", LOG_CONS | LOG_PID, LOG_AUTH);
918#endif
919 syslog(LOG_INFO, "starting...");
920
921 if (debug == 0 && daemon(0, 0) == -1) {
922 syslog(LOG_ERR, "Failed to daemonize");
923 exit(1);
924 }
925
926 if (register_daemon() == -1) {
927 syslog(LOG_ERR, "Could not register as daemon");
928 exit(1);
929 }
930
931 setup();
932
933 rc = wait_for_events();
934 syslog(LOG_INFO, "auditd exiting.");
935
936 exit(rc);
937}
| 30 */
31
32#include <sys/types.h>
33#include <sys/dirent.h>
34#include <sys/mman.h>
35#include <sys/queue.h>
36#include <sys/stat.h>
37#include <sys/wait.h>
38
39#include <bsm/audit.h>
40#include <bsm/audit_uevents.h>
41#include <bsm/libbsm.h>
42
43#include <err.h>
44#include <errno.h>
45#include <fcntl.h>
46#include <grp.h>
47#include <stdio.h>
48#include <stdlib.h>
49#include <time.h>
50#include <unistd.h>
51#include <signal.h>
52#include <string.h>
53#include <syslog.h>
54
55#include "auditd.h"
56
57#define NA_EVENT_STR_SIZE 25
58#define POL_STR_SIZE 128
59
60static int ret, minval;
61static char *lastfile = NULL;
62static int allhardcount = 0;
63static int triggerfd = 0;
64static int sigchlds, sigchlds_handled;
65static int sighups, sighups_handled;
66static int sigterms, sigterms_handled;
67
68static TAILQ_HEAD(, dir_ent) dir_q;
69
70static int config_audit_controls(void);
71
72/*
73 * Error starting auditd
74 */
75static void
76fail_exit(void)
77{
78
79 audit_warn_nostart();
80 exit(1);
81}
82
83/*
84 * Free our local list of directory names.
85 */
86static void
87free_dir_q(void)
88{
89 struct dir_ent *dirent;
90
91 while ((dirent = TAILQ_FIRST(&dir_q))) {
92 TAILQ_REMOVE(&dir_q, dirent, dirs);
93 free(dirent->dirname);
94 free(dirent);
95 }
96}
97
98/*
99 * Generate the timestamp string.
100 */
101static int
102getTSstr(char *buf, int len)
103{
104 struct timeval ts;
105 struct timezone tzp;
106 time_t tt;
107
108 if (gettimeofday(&ts, &tzp) != 0)
109 return (-1);
110 tt = (time_t)ts.tv_sec;
111 if (!strftime(buf, len, "%Y%m%d%H%M%S", gmtime(&tt)))
112 return (-1);
113 return (0);
114}
115
116/*
117 * Concat the directory name to the given file name.
118 * XXX We should affix the hostname also
119 */
120static char *
121affixdir(char *name, struct dir_ent *dirent)
122{
123 char *fn;
124 char *curdir;
125 const char *sep = "/";
126
127 curdir = dirent->dirname;
128 syslog(LOG_DEBUG, "dir = %s", dirent->dirname);
129
130 fn = malloc(strlen(curdir) + strlen(sep) + (2 * POSTFIX_LEN) + 1);
131 if (fn == NULL)
132 return (NULL);
133 strcpy(fn, curdir);
134 strcat(fn, sep);
135 strcat(fn, name);
136 return (fn);
137}
138
139/*
140 * Close the previous audit trail file.
141 */
142static int
143close_lastfile(char *TS)
144{
145 char *ptr;
146 char *oldname;
147
148 if (lastfile != NULL) {
149 oldname = (char *)malloc(strlen(lastfile) + 1);
150 if (oldname == NULL)
151 return (-1);
152 strcpy(oldname, lastfile);
153
154 /* Rename the last file -- append timestamp. */
155 if ((ptr = strstr(lastfile, NOT_TERMINATED)) != NULL) {
156 *ptr = '.';
157 strcpy(ptr+1, TS);
158 if (rename(oldname, lastfile) != 0)
159 syslog(LOG_ERR,
160 "Could not rename %s to %s: %m", oldname,
161 lastfile);
162 else {
163 syslog(LOG_INFO, "renamed %s to %s",
164 oldname, lastfile);
165 audit_warn_closefile(lastfile);
166 }
167 }
168 free(lastfile);
169 free(oldname);
170 lastfile = NULL;
171 }
172 return (0);
173}
174
175/*
176 * Create the new audit file with appropriate permissions and ownership. Try
177 * to clean up if something goes wrong.
178 */
179static int
180#ifdef AUDIT_REVIEW_GROUP
181open_trail(const char *fname, uid_t uid, gid_t gid)
182#else
183open_trail(const char *fname)
184#endif
185{
186 int error, fd;
187
188 fd = open(fname, O_RDONLY | O_CREAT, S_IRUSR | S_IRGRP);
189 if (fd < 0)
190 return (-1);
191#ifdef AUDIT_REVIEW_GROUP
192 if (fchown(fd, uid, gid) < 0) {
193 error = errno;
194 close(fd);
195 (void)unlink(fname);
196 errno = error;
197 return (-1);
198 }
199#endif
200 return (fd);
201}
202
203/*
204 * Create the new file name, swap with existing audit file.
205 */
206static int
207swap_audit_file(void)
208{
209 char timestr[2 * POSTFIX_LEN];
210 char *fn;
211 char TS[POSTFIX_LEN];
212 struct dir_ent *dirent;
213#ifdef AUDIT_REVIEW_GROUP
214 struct group *grp;
215 gid_t gid;
216 uid_t uid;
217#endif
218 int error, fd;
219
220 if (getTSstr(TS, POSTFIX_LEN) != 0)
221 return (-1);
222
223 strcpy(timestr, TS);
224 strcat(timestr, NOT_TERMINATED);
225
226#ifdef AUDIT_REVIEW_GROUP
227 /*
228 * XXXRW: Currently, this code falls back to the daemon gid, which is
229 * likely the wheel group. Is there a better way to deal with this?
230 */
231 grp = getgrnam(AUDIT_REVIEW_GROUP);
232 if (grp == NULL) {
233 syslog(LOG_INFO,
234 "Audit review group '%s' not available, using daemon gid",
235 AUDIT_REVIEW_GROUP);
236 gid = -1;
237 } else
238 gid = grp->gr_gid;
239 uid = getuid();
240#endif
241
242 /* Try until we succeed. */
243 while ((dirent = TAILQ_FIRST(&dir_q))) {
244 if ((fn = affixdir(timestr, dirent)) == NULL) {
245 syslog(LOG_INFO, "Failed to swap log at time %s",
246 timestr);
247 return (-1);
248 }
249
250 /*
251 * Create and open the file; then close and pass to the
252 * kernel if all went well.
253 */
254 syslog(LOG_INFO, "New audit file is %s", fn);
255#ifdef AUDIT_REVIEW_GROUP
256 fd = open_trail(fn, uid, gid);
257#else
258 fd = open_trail(fn);
259#endif
260 if (fd < 0)
261 warn("open(%s)", fn);
262 if (fd >= 0) {
263 error = auditctl(fn);
264 if (error) {
265 syslog(LOG_ERR,
266 "auditctl failed setting log file! : %s",
267 strerror(errno));
268 close(fd);
269 } else {
270 /* Success. */
271 close_lastfile(TS);
272 lastfile = fn;
273 close(fd);
274 return (0);
275 }
276 }
277
278 /*
279 * Tell the administrator about lack of permissions for dir.
280 */
281 audit_warn_getacdir(dirent->dirname);
282
283 /* Try again with a different directory. */
284 TAILQ_REMOVE(&dir_q, dirent, dirs);
285 free(dirent->dirname);
286 free(dirent);
287 }
288 syslog(LOG_ERR, "Log directories exhausted");
289 return (-1);
290}
291
292/*
293 * Read the audit_control file contents.
294 */
295static int
296read_control_file(void)
297{
298 char cur_dir[MAXNAMLEN];
299 struct dir_ent *dirent;
300 au_qctrl_t qctrl;
301
302 /*
303 * Clear old values. Force a re-read of the file the next time.
304 */
305 free_dir_q();
306 endac();
307
308 /*
309 * Read the list of directories into a local linked list.
310 *
311 * XXX We should use the reentrant interfaces once they are
312 * available.
313 */
314 while (getacdir(cur_dir, MAXNAMLEN) >= 0) {
315 dirent = (struct dir_ent *) malloc(sizeof(struct dir_ent));
316 if (dirent == NULL)
317 return (-1);
318 dirent->softlim = 0;
319 dirent->dirname = (char *) malloc(MAXNAMLEN);
320 if (dirent->dirname == NULL) {
321 free(dirent);
322 return (-1);
323 }
324 strcpy(dirent->dirname, cur_dir);
325 TAILQ_INSERT_TAIL(&dir_q, dirent, dirs);
326 }
327
328 allhardcount = 0;
329 if (swap_audit_file() == -1) {
330 syslog(LOG_ERR, "Could not swap audit file");
331 /*
332 * XXX Faulty directory listing? - user should be given
333 * XXX an opportunity to change the audit_control file
334 * XXX switch to a reduced mode of auditing?
335 */
336 return (-1);
337 }
338
339 /*
340 * XXX There are synchronization problems here
341 * XXX what should we do if a trigger for the earlier limit
342 * XXX is generated here?
343 */
344 if (0 == (ret = getacmin(&minval))) {
345 syslog(LOG_DEBUG, "min free = %d", minval);
346 if (auditon(A_GETQCTRL, &qctrl, sizeof(qctrl)) != 0) {
347 syslog(LOG_ERR,
348 "could not get audit queue settings");
349 return (-1);
350 }
351 qctrl.aq_minfree = minval;
352 if (auditon(A_SETQCTRL, &qctrl, sizeof(qctrl)) != 0) {
353 syslog(LOG_ERR,
354 "could not set audit queue settings");
355 return (-1);
356 }
357 }
358
359 return (0);
360}
361
362/*
363 * Close all log files, control files, and tell the audit system.
364 */
365static int
366close_all(void)
367{
368 struct auditinfo ai;
369 int err_ret = 0;
370 char TS[POSTFIX_LEN];
371 int aufd;
372 token_t *tok;
373 long cond;
374
375 /* Generate an audit record. */
376 if ((aufd = au_open()) == -1)
377 syslog(LOG_ERR, "Could not create audit shutdown event.");
378 else {
379 if ((tok = au_to_text("auditd::Audit shutdown")) != NULL)
380 au_write(aufd, tok);
381 /*
382 * XXX we need to implement extended subject tokens so we can
383 * effectively represent terminal lines with this token type.
384 */
385 bzero(&ai, sizeof(ai));
386 if ((tok = au_to_subject32(getuid(), geteuid(), getegid(),
387 getuid(), getgid(), getpid(), getpid(), &ai.ai_termid))
388 != NULL)
389 au_write(aufd, tok);
390 if ((tok = au_to_return32(0, 0)) != NULL)
391 au_write(aufd, tok);
392 if (au_close(aufd, 1, AUE_audit_shutdown) == -1)
393 syslog(LOG_ERR,
394 "Could not close audit shutdown event.");
395 }
396
397 /* Flush contents. */
398 cond = AUC_DISABLED;
399 err_ret = auditon(A_SETCOND, &cond, sizeof(cond));
400 if (err_ret != 0) {
401 syslog(LOG_ERR, "Disabling audit failed! : %s",
402 strerror(errno));
403 err_ret = 1;
404 }
405 if (getTSstr(TS, POSTFIX_LEN) == 0)
406 close_lastfile(TS);
407 if (lastfile != NULL)
408 free(lastfile);
409
410 free_dir_q();
411 if ((remove(AUDITD_PIDFILE) == -1) || err_ret) {
412 syslog(LOG_ERR, "Could not unregister");
413 audit_warn_postsigterm();
414 return (1);
415 }
416 endac();
417
418 if (close(triggerfd) != 0)
419 syslog(LOG_ERR, "Error closing control file");
420 syslog(LOG_INFO, "Finished");
421 return (0);
422}
423
424/*
425 * When we get a signal, we are often not at a clean point. So, little can
426 * be done in the signal handler itself. Instead, we send a message to the
427 * main servicing loop to do proper handling from a non-signal-handler
428 * context.
429 */
430static void
431relay_signal(int signal)
432{
433
434 if (signal == SIGHUP)
435 sighups++;
436 if (signal == SIGTERM)
437 sigterms++;
438 if (signal == SIGCHLD)
439 sigchlds++;
440}
441
442/*
443 * Registering the daemon.
444 */
445static int
446register_daemon(void)
447{
448 FILE * pidfile;
449 int fd;
450 pid_t pid;
451
452 /* Set up the signal hander. */
453 if (signal(SIGTERM, relay_signal) == SIG_ERR) {
454 syslog(LOG_ERR,
455 "Could not set signal handler for SIGTERM");
456 fail_exit();
457 }
458 if (signal(SIGCHLD, relay_signal) == SIG_ERR) {
459 syslog(LOG_ERR,
460 "Could not set signal handler for SIGCHLD");
461 fail_exit();
462 }
463 if (signal(SIGHUP, relay_signal) == SIG_ERR) {
464 syslog(LOG_ERR,
465 "Could not set signal handler for SIGHUP");
466 fail_exit();
467 }
468
469 if ((pidfile = fopen(AUDITD_PIDFILE, "a")) == NULL) {
470 syslog(LOG_ERR, "Could not open PID file");
471 audit_warn_tmpfile();
472 return (-1);
473 }
474
475 /* Attempt to lock the pid file; if a lock is present, exit. */
476 fd = fileno(pidfile);
477 if (flock(fd, LOCK_EX | LOCK_NB) < 0) {
478 syslog(LOG_ERR,
479 "PID file is locked (is another auditd running?).");
480 audit_warn_ebusy();
481 return (-1);
482 }
483
484 pid = getpid();
485 ftruncate(fd, 0);
486 if (fprintf(pidfile, "%u\n", pid) < 0) {
487 /* Should not start the daemon. */
488 fail_exit();
489 }
490
491 fflush(pidfile);
492 return (0);
493}
494
495/*
496 * Handle the audit trigger event.
497 *
498 * We suppress (ignore) duplicated triggers in close succession in order to
499 * try to avoid thrashing-like behavior. However, not all triggers can be
500 * ignored, as triggers generally represent edge triggers, not level
501 * triggers, and won't be retransmitted if the condition persists. Of
502 * specific concern is the rotate trigger -- if one is dropped, then it will
503 * not be retransmitted, and the log file will grow in an unbounded fashion.
504 */
505#define DUPLICATE_INTERVAL 30
506static void
507handle_audit_trigger(int trigger)
508{
509 static int last_trigger, last_warning;
510 static time_t last_time;
511 struct dir_ent *dirent;
512 struct timeval ts;
513 struct timezone tzp;
514 time_t tt;
515
516 /*
517 * Suppress duplicate messages from the kernel within the specified
518 * interval.
519 */
520 if (gettimeofday(&ts, &tzp) == 0) {
521 tt = (time_t)ts.tv_sec;
522 switch (trigger) {
523 case AUDIT_TRIGGER_LOW_SPACE:
524 case AUDIT_TRIGGER_NO_SPACE:
525 /*
526 * Triggers we can suppress. Of course, we also need
527 * to rate limit the warnings, so apply the same
528 * interval limit on syslog messages.
529 */
530 if ((trigger == last_trigger) &&
531 (tt < (last_time + DUPLICATE_INTERVAL))) {
532 if (tt >= (last_warning + DUPLICATE_INTERVAL))
533 syslog(LOG_INFO,
534 "Suppressing duplicate trigger %d",
535 trigger);
536 return;
537 }
538 last_warning = tt;
539 break;
540
541 case AUDIT_TRIGGER_ROTATE_KERNEL:
542 case AUDIT_TRIGGER_ROTATE_USER:
543 case AUDIT_TRIGGER_READ_FILE:
544 /*
545 * Triggers that we cannot suppress.
546 */
547 break;
548 }
549
550 /*
551 * Only update last_trigger after aborting due to a duplicate
552 * trigger, not before, or we will never allow that trigger
553 * again.
554 */
555 last_trigger = trigger;
556 last_time = tt;
557 }
558
559 /*
560 * Message processing is done here.
561 */
562 dirent = TAILQ_FIRST(&dir_q);
563 switch(trigger) {
564 case AUDIT_TRIGGER_LOW_SPACE:
565 syslog(LOG_INFO, "Got low space trigger");
566 if (dirent && (dirent->softlim != 1)) {
567 TAILQ_REMOVE(&dir_q, dirent, dirs);
568 /* Add this node to the end of the list. */
569 TAILQ_INSERT_TAIL(&dir_q, dirent, dirs);
570 audit_warn_soft(dirent->dirname);
571 dirent->softlim = 1;
572
573 if (TAILQ_NEXT(TAILQ_FIRST(&dir_q), dirs) != NULL &&
574 swap_audit_file() == -1)
575 syslog(LOG_ERR, "Error swapping audit file");
576
577 /*
578 * Check if the next dir has already reached its soft
579 * limit.
580 */
581 dirent = TAILQ_FIRST(&dir_q);
582 if (dirent->softlim == 1) {
583 /* All dirs have reached their soft limit. */
584 audit_warn_allsoft();
585 }
586 } else {
587 /*
588 * Continue auditing to the current file. Also
589 * generate an allsoft warning.
590 *
591 * XXX do we want to do this ?
592 */
593 audit_warn_allsoft();
594 }
595 break;
596
597 case AUDIT_TRIGGER_NO_SPACE:
598 syslog(LOG_INFO, "Got no space trigger");
599
600 /* Delete current dir, go on to next. */
601 TAILQ_REMOVE(&dir_q, dirent, dirs);
602 audit_warn_hard(dirent->dirname);
603 free(dirent->dirname);
604 free(dirent);
605
606 if (swap_audit_file() == -1)
607 syslog(LOG_ERR, "Error swapping audit file");
608
609 /* We are out of log directories. */
610 audit_warn_allhard(++allhardcount);
611 break;
612
613 case AUDIT_TRIGGER_ROTATE_KERNEL:
614 case AUDIT_TRIGGER_ROTATE_USER:
615 /*
616 * Create a new file and swap with the one being used in
617 * kernel
618 */
619 syslog(LOG_INFO, "Got open new trigger from %s", trigger ==
620 AUDIT_TRIGGER_ROTATE_KERNEL ? "kernel" : "user");
621 if (swap_audit_file() == -1)
622 syslog(LOG_ERR, "Error swapping audit file");
623 break;
624
625 case AUDIT_TRIGGER_READ_FILE:
626 syslog(LOG_INFO, "Got read file trigger");
627 if (read_control_file() == -1)
628 syslog(LOG_ERR, "Error in audit control file");
629 if (config_audit_controls() == -1)
630 syslog(LOG_ERR, "Error setting audit controls");
631 break;
632
633 default:
634 syslog(LOG_ERR, "Got unknown trigger %d", trigger);
635 break;
636 }
637}
638
639static void
640handle_sighup(void)
641{
642
643 sighups_handled = sighups;
644 config_audit_controls();
645}
646
647/*
648 * Reap our children.
649 */
650static void
651reap_children(void)
652{
653 pid_t child;
654 int wstatus;
655
656 while ((child = waitpid(-1, &wstatus, WNOHANG)) > 0) {
657 if (!wstatus)
658 continue;
659 syslog(LOG_INFO, "warn process [pid=%d] %s %d.", child,
660 ((WIFEXITED(wstatus)) ? "exited with non-zero status" :
661 "exited as a result of signal"),
662 ((WIFEXITED(wstatus)) ? WEXITSTATUS(wstatus) :
663 WTERMSIG(wstatus)));
664 }
665}
666
667static void
668handle_sigchld(void)
669{
670
671 sigchlds_handled = sigchlds;
672 reap_children();
673}
674
675/*
676 * Read the control file for triggers/signals and handle appropriately.
677 */
678static int
679wait_for_events(void)
680{
681 int num;
682 unsigned int trigger;
683
684 for (;;) {
685 num = read(triggerfd, &trigger, sizeof(trigger));
686 if ((num == -1) && (errno != EINTR)) {
687 syslog(LOG_ERR, "%s: error %d", __FUNCTION__, errno);
688 return (-1);
689 }
690 if (sigterms != sigterms_handled) {
691 syslog(LOG_DEBUG, "%s: SIGTERM", __FUNCTION__);
692 break;
693 }
694 if (sigchlds != sigchlds_handled)
695 handle_sigchld();
696 if (sighups != sighups_handled) {
697 syslog(LOG_DEBUG, "%s: SIGHUP", __FUNCTION__);
698 handle_sighup();
699 }
700 if ((num == -1) && (errno == EINTR))
701 continue;
702 if (num == 0) {
703 syslog(LOG_ERR, "%s: read EOF", __FUNCTION__);
704 return (-1);
705 }
706 if (trigger == AUDIT_TRIGGER_CLOSE_AND_DIE)
707 break;
708 else
709 handle_audit_trigger(trigger);
710 }
711 return (close_all());
712}
713
714/*
715 * Configure the audit controls in the kernel: the event to class mapping,
716 * kernel preselection mask, etc.
717 */
718static int
719config_audit_controls(void)
720{
721 au_event_ent_t ev, *evp;
722 au_evclass_map_t evc_map;
723 au_mask_t aumask;
724 int ctr = 0;
725 char naeventstr[NA_EVENT_STR_SIZE];
726 char polstr[POL_STR_SIZE];
727 long policy;
728 au_fstat_t au_fstat;
729 size_t filesz;
730
731 /*
732 * Process the audit event file, obtaining a class mapping for each
733 * event, and send that mapping into the kernel.
734 *
735 * XXX There's a risk here that the BSM library will return NULL
736 * for an event when it can't properly map it to a class. In that
737 * case, we will not process any events beyond the one that failed,
738 * but should. We need a way to get a count of the events.
739 */
740 ev.ae_name = (char *)malloc(AU_EVENT_NAME_MAX);
741 ev.ae_desc = (char *)malloc(AU_EVENT_DESC_MAX);
742 if ((ev.ae_name == NULL) || (ev.ae_desc == NULL)) {
743 if (ev.ae_name != NULL)
744 free(ev.ae_name);
745 syslog(LOG_ERR,
746 "Memory allocation error when configuring audit controls.");
747 return (-1);
748 }
749
750 /*
751 * XXXRW: Currently we have no way to remove mappings from the kernel
752 * when they are removed from the file-based mappings.
753 */
754 evp = &ev;
755 setauevent();
756 while ((evp = getauevent_r(evp)) != NULL) {
757 evc_map.ec_number = evp->ae_number;
758 evc_map.ec_class = evp->ae_class;
759 if (auditon(A_SETCLASS, &evc_map, sizeof(au_evclass_map_t))
760 != 0)
761 syslog(LOG_ERR,
762 "Failed to register class mapping for event %s",
763 evp->ae_name);
764 else
765 ctr++;
766 }
767 endauevent();
768 free(ev.ae_name);
769 free(ev.ae_desc);
770 if (ctr == 0)
771 syslog(LOG_ERR, "No events to class mappings registered.");
772 else
773 syslog(LOG_DEBUG, "Registered %d event to class mappings.",
774 ctr);
775
776 /*
777 * Get the non-attributable event string and set the kernel mask from
778 * that.
779 */
780 if ((getacna(naeventstr, NA_EVENT_STR_SIZE) == 0) &&
781 (getauditflagsbin(naeventstr, &aumask) == 0)) {
782 if (auditon(A_SETKMASK, &aumask, sizeof(au_mask_t)))
783 syslog(LOG_ERR,
784 "Failed to register non-attributable event mask.");
785 else
786 syslog(LOG_DEBUG,
787 "Registered non-attributable event mask.");
788 } else
789 syslog(LOG_ERR,
790 "Failed to obtain non-attributable event mask.");
791
792 /*
793 * If a policy is configured in audit_control(5), implement the
794 * policy. However, if one isn't defined, set AUDIT_CNT to avoid
795 * leaving the system in a fragile state.
796 */
797 if ((getacpol(polstr, POL_STR_SIZE) == 0) &&
798 (au_strtopol(polstr, &policy) == 0)) {
799 if (auditon(A_SETPOLICY, &policy, sizeof(policy)))
800 syslog(LOG_ERR, "Failed to set audit policy: %m");
801 } else {
802 syslog(LOG_ERR, "Failed to obtain policy flags: %m");
803 policy = AUDIT_CNT;
804 if (auditon(A_SETPOLICY, &policy, sizeof(policy)))
805 syslog(LOG_ERR,
806 "Failed to set default audit policy: %m");
807 }
808
809 /*
810 * Set trail rotation size.
811 */
812 if (getacfilesz(&filesz) == 0) {
813 bzero(&au_fstat, sizeof(au_fstat));
814 au_fstat.af_filesz = filesz;
815 if (auditon(A_SETFSIZE, &au_fstat, sizeof(au_fstat)) < 0)
816 syslog(LOG_ERR, "Failed to set filesz: %m");
817 } else
818 syslog(LOG_ERR, "Failed to obtain filesz: %m");
819
820 return (0);
821}
822
823static void
824setup(void)
825{
826 struct auditinfo ai;
827 auditinfo_t auinfo;
828 int aufd;
829 token_t *tok;
830
831 if ((triggerfd = open(AUDIT_TRIGGER_FILE, O_RDONLY, 0)) < 0) {
832 syslog(LOG_ERR, "Error opening trigger file");
833 fail_exit();
834 }
835
836 /*
837 * To provide event feedback cycles and avoid auditd becoming
838 * stalled if auditing is suspended, auditd and its children run
839 * without their events being audited. We allow the uid, tid, and
840 * mask fields to be implicitly set to zero, but do set the pid. We
841 * run this after opening the trigger device to avoid configuring
842 * audit state without audit present in the system.
843 *
844 * XXXRW: Is there more to it than this?
845 */
846 bzero(&auinfo, sizeof(auinfo));
847 auinfo.ai_asid = getpid();
848 if (setaudit(&auinfo) == -1) {
849 syslog(LOG_ERR, "Error setting audit stat");
850 fail_exit();
851 }
852
853 TAILQ_INIT(&dir_q);
854 if (read_control_file() == -1) {
855 syslog(LOG_ERR, "Error reading control file");
856 fail_exit();
857 }
858
859 /* Generate an audit record. */
860 if ((aufd = au_open()) == -1)
861 syslog(LOG_ERR, "Could not create audit startup event.");
862 else {
863 /*
864 * XXXCSJP Perhaps we want more robust audit records for
865 * audit start up and shutdown. This might include capturing
866 * failures to initialize the audit subsystem?
867 */
868 bzero(&ai, sizeof(ai));
869 if ((tok = au_to_subject32(getuid(), geteuid(), getegid(),
870 getuid(), getgid(), getpid(), getpid(), &ai.ai_termid))
871 != NULL)
872 au_write(aufd, tok);
873 if ((tok = au_to_text("auditd::Audit startup")) != NULL)
874 au_write(aufd, tok);
875 if ((tok = au_to_return32(0, 0)) != NULL)
876 au_write(aufd, tok);
877 if (au_close(aufd, 1, AUE_audit_startup) == -1)
878 syslog(LOG_ERR,
879 "Could not close audit startup event.");
880 }
881
882 if (config_audit_controls() == 0)
883 syslog(LOG_INFO, "Audit controls init successful");
884 else
885 syslog(LOG_ERR, "Audit controls init failed");
886}
887
888int
889main(int argc, char **argv)
890{
891 int ch;
892 int debug = 0;
893 int rc;
894
895 while ((ch = getopt(argc, argv, "d")) != -1) {
896 switch(ch) {
897 case 'd':
898 /* Debug option. */
899 debug = 1;
900 break;
901
902 case '?':
903 default:
904 (void)fprintf(stderr,
905 "usage: auditd [-d] \n");
906 exit(1);
907 }
908 }
909
910#ifdef LOG_SECURITY
911 openlog("auditd", LOG_CONS | LOG_PID, LOG_SECURITY);
912#else
913 openlog("auditd", LOG_CONS | LOG_PID, LOG_AUTH);
914#endif
915 syslog(LOG_INFO, "starting...");
916
917 if (debug == 0 && daemon(0, 0) == -1) {
918 syslog(LOG_ERR, "Failed to daemonize");
919 exit(1);
920 }
921
922 if (register_daemon() == -1) {
923 syslog(LOG_ERR, "Could not register as daemon");
924 exit(1);
925 }
926
927 setup();
928
929 rc = wait_for_events();
930 syslog(LOG_INFO, "auditd exiting.");
931
932 exit(rc);
933}
|