Deleted Added
sdiff udiff text old ( 155131 ) new ( 155364 )
full compact
auditd.c (155131) auditd.c (155364)
1/*
2 * Copyright (c) 2004 Apple Computer, Inc.
3 * All rights reserved.
4 *
5 * @APPLE_BSD_LICENSE_HEADER_START@
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions

--- 16 unchanged lines hidden (view full) ---

25 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
26 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
27 * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
28 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
29 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
30 *
31 * @APPLE_BSD_LICENSE_HEADER_END@
32 *
1/*
2 * Copyright (c) 2004 Apple Computer, Inc.
3 * All rights reserved.
4 *
5 * @APPLE_BSD_LICENSE_HEADER_START@
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions

--- 16 unchanged lines hidden (view full) ---

25 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
26 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
27 * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
28 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
29 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
30 *
31 * @APPLE_BSD_LICENSE_HEADER_END@
32 *
33 * $P4: //depot/projects/trustedbsd/openbsm/bin/auditd/auditd.c#8 $
33 * $P4: //depot/projects/trustedbsd/openbsm/bin/auditd/auditd.c#11 $
34 */
35
36#include <sys/dirent.h>
37#include <sys/mman.h>
38#include <sys/queue.h>
39#include <sys/stat.h>
40#include <sys/types.h>
41#include <sys/wait.h>
42
43#include <bsm/audit.h>
44#include <bsm/audit_uevents.h>
45#include <bsm/libbsm.h>
46
47#include <errno.h>
48#include <fcntl.h>
34 */
35
36#include <sys/dirent.h>
37#include <sys/mman.h>
38#include <sys/queue.h>
39#include <sys/stat.h>
40#include <sys/types.h>
41#include <sys/wait.h>
42
43#include <bsm/audit.h>
44#include <bsm/audit_uevents.h>
45#include <bsm/libbsm.h>
46
47#include <errno.h>
48#include <fcntl.h>
49#include <grp.h>
49#include <stdio.h>
50#include <stdlib.h>
51#include <time.h>
52#include <unistd.h>
53#include <signal.h>
54#include <string.h>
55#include <syslog.h>
56

--- 109 unchanged lines hidden (view full) ---

166 free(lastfile);
167 free(oldname);
168 lastfile = NULL;
169 }
170 return (0);
171}
172
173/*
50#include <stdio.h>
51#include <stdlib.h>
52#include <time.h>
53#include <unistd.h>
54#include <signal.h>
55#include <string.h>
56#include <syslog.h>
57

--- 109 unchanged lines hidden (view full) ---

167 free(lastfile);
168 free(oldname);
169 lastfile = NULL;
170 }
171 return (0);
172}
173
174/*
175 * Create the new audit file with appropriate permissions and ownership. Try
176 * to clean up if something goes wrong.
177 */
178static int
179#ifdef AUDIT_REVIEW_GROUP
180open_trail(const char *fname, uid_t uid, gid_t gid)
181#else
182open_trail(const char *fname)
183#endif
184{
185 int error, fd;
186
187 fd = open(fname, O_RDONLY | O_CREAT, S_IRUSR | S_IRGRP);
188 if (fd < 0)
189 return (-1);
190#ifdef AUDIT_REVIEW_GROUP
191 if (fchown(fd, uid, gid) < 0) {
192 error = errno;
193 close(fd);
194 (void)unlink(fname);
195 errno = error;
196 return (-1);
197 }
198#endif
199 return (fd);
200}
201
202/*
174 * Create the new file name, swap with existing audit file.
175 */
176static int
177swap_audit_file(void)
178{
179 char timestr[2 * POSTFIX_LEN];
180 char *fn;
181 char TS[POSTFIX_LEN];
182 struct dir_ent *dirent;
203 * Create the new file name, swap with existing audit file.
204 */
205static int
206swap_audit_file(void)
207{
208 char timestr[2 * POSTFIX_LEN];
209 char *fn;
210 char TS[POSTFIX_LEN];
211 struct dir_ent *dirent;
183 int fd;
212#ifdef AUDIT_REVIEW_GROUP
213 struct group *grp;
214 gid_t gid;
215 uid_t uid;
216#endif
217 int error, fd;
184
185 if (getTSstr(TS, POSTFIX_LEN) != 0)
186 return (-1);
187
188 strcpy(timestr, TS);
189 strcat(timestr, NOT_TERMINATED);
190
218
219 if (getTSstr(TS, POSTFIX_LEN) != 0)
220 return (-1);
221
222 strcpy(timestr, TS);
223 strcat(timestr, NOT_TERMINATED);
224
225#ifdef AUDIT_REVIEW_GROUP
226 /*
227 * XXXRW: Currently, this code falls back to the daemon gid, which is
228 * likely the wheel group. Is there a better way to deal with this?
229 */
230 grp = getgrnam(AUDIT_REVIEW_GROUP);
231 if (grp == NULL) {
232 syslog(LOG_INFO,
233 "Audit review group '%s' not available, using daemon gid",
234 AUDIT_REVIEW_GROUP);
235 gid = -1;
236 } else
237 gid = grp->gr_gid;
238 uid = getuid();
239#endif
240
191 /* Try until we succeed. */
192 while ((dirent = TAILQ_FIRST(&dir_q))) {
193 if ((fn = affixdir(timestr, dirent)) == NULL) {
194 syslog(LOG_INFO, "Failed to swap log at time %s\n",
195 timestr);
196 return (-1);
197 }
198
199 /*
200 * Create and open the file; then close and pass to the
201 * kernel if all went well.
202 */
203 syslog(LOG_INFO, "New audit file is %s\n", fn);
241 /* Try until we succeed. */
242 while ((dirent = TAILQ_FIRST(&dir_q))) {
243 if ((fn = affixdir(timestr, dirent)) == NULL) {
244 syslog(LOG_INFO, "Failed to swap log at time %s\n",
245 timestr);
246 return (-1);
247 }
248
249 /*
250 * Create and open the file; then close and pass to the
251 * kernel if all went well.
252 */
253 syslog(LOG_INFO, "New audit file is %s\n", fn);
204 fd = open(fn, O_RDONLY | O_CREAT, S_IRUSR | S_IRGRP);
254#ifdef AUDIT_REVIEW_GROUP
255 fd = open_trail(fn, uid, gid);
256#else
257 fd = open_trail(fn);
258#endif
205 if (fd < 0)
259 if (fd < 0)
206 perror("File open");
207 else if (auditctl(fn) != 0) {
208 syslog(LOG_ERR,
209 "auditctl failed setting log file! : %s\n",
210 strerror(errno));
211 close(fd);
212 } else {
213 /* Success. */
214 close_lastfile(TS);
215 lastfile = fn;
216 close(fd);
217 return (0);
260 warn("open(%s)", fn);
261 if (fd >= 0) {
262 error = auditctl(fn);
263 if (error) {
264 syslog(LOG_ERR,
265 "auditctl failed setting log file! : %s\n",
266 strerror(errno));
267 close(fd);
268 } else {
269 /* Success. */
270 close_lastfile(TS);
271 lastfile = fn;
272 close(fd);
273 return (0);
274 }
218 }
219
220 /*
221 * Tell the administrator about lack of permissions for dir.
222 */
223 audit_warn_getacdir(dirent->dirname);
224
225 /* Try again with a different directory. */

--- 477 unchanged lines hidden (view full) ---

703 syslog(LOG_INFO, "Audit controls init successful\n");
704 else
705 syslog(LOG_INFO, "Audit controls init failed\n");
706}
707
708int
709main(int argc, char **argv)
710{
275 }
276
277 /*
278 * Tell the administrator about lack of permissions for dir.
279 */
280 audit_warn_getacdir(dirent->dirname);
281
282 /* Try again with a different directory. */

--- 477 unchanged lines hidden (view full) ---

760 syslog(LOG_INFO, "Audit controls init successful\n");
761 else
762 syslog(LOG_INFO, "Audit controls init failed\n");
763}
764
765int
766main(int argc, char **argv)
767{
711 char ch;
768 int ch;
712 int debug = 0;
713 int rc;
714
715 global_flags |= AUDIT_CNT;
716 while ((ch = getopt(argc, argv, "dhs")) != -1) {
717 switch(ch) {
718 case 'd':
719 /* Debug option. */

--- 41 unchanged lines hidden --- 		769 int debug = 0;
770 int rc;
771
772 global_flags |= AUDIT_CNT;
773 while ((ch = getopt(argc, argv, "dhs")) != -1) {
774 switch(ch) {
775 case 'd':
776 /* Debug option. */

--- 41 unchanged lines hidden ---