134#define POL_STR_SIZE 128 135 136 137/* 138 * Look up and return the error string for the given audit error code. 139 */ 140const char * 141auditd_strerror(int errcode) 142{ 143 int idx = -errcode; 144 145 if (idx < 0 || idx > (int)MAXERRCODE) 146 return ("Invalid auditd error code"); 147 148 return (auditd_errmsg[idx]); 149} 150 151 152/* 153 * Free our local list of directory names and init list 154 */ 155static void 156free_dir_q(void) 157{ 158 struct dir_ent *d1, *d2; 159 160 d1 = TAILQ_FIRST(&dir_q); 161 while (d1 != NULL) { 162 d2 = TAILQ_NEXT(d1, dirs); 163 free(d1->dirname); 164 free(d1); 165 d1 = d2; 166 } 167 TAILQ_INIT(&dir_q); 168} 169 170/* 171 * Concat the directory name to the given file name. 172 * XXX We should affix the hostname also 173 */ 174static char * 175affixdir(char *name, struct dir_ent *dirent) 176{ 177 char *fn = NULL; 178 179 /* 180 * Sanity check on file name. 181 */ 182 if (strlen(name) != (FILENAME_LEN - 1)) { 183 errno = EINVAL; 184 return (NULL); 185 } 186 187 /* 188 * If the host is set then also add the hostname to the filename. 189 */ 190 if (auditd_hostlen != -1) 191 asprintf(&fn, "%s/%s.%s", dirent->dirname, name, auditd_host); 192 else 193 asprintf(&fn, "%s/%s", dirent->dirname, name); 194 return (fn); 195} 196 197/* 198 * Insert the directory entry in the list by the way they are ordered in 199 * audit_control(5). Move the entries that are over the soft and hard limits 200 * toward the tail. 201 */ 202static void 203insert_orderly(struct dir_ent *denew) 204{ 205 struct dir_ent *dep; 206 207 TAILQ_FOREACH(dep, &dir_q, dirs) { 208 if (dep->softlim == 1 && denew->softlim == 0) { 209 TAILQ_INSERT_BEFORE(dep, denew, dirs); 210 return; 211 } 212 if (dep->hardlim == 1 && denew->hardlim == 0) { 213 TAILQ_INSERT_BEFORE(dep, denew, dirs); 214 return; 215 } 216 } 217 TAILQ_INSERT_TAIL(&dir_q, denew, dirs); 218} 219 220/* 221 * Get the host from audit_control(5) and set it in the audit kernel 222 * information. Return: 223 * ADE_NOERR on success. 224 * ADE_PARSE error parsing audit_control(5). 225 * ADE_AUDITON error getting/setting auditon(2) value. 226 * ADE_GETADDR error getting address info for host. 227 * ADE_ADDRFAM un-supported address family. 228 */ 229int 230auditd_set_host(void) 231{ 232 struct sockaddr_in6 *sin6; 233 struct sockaddr_in *sin; 234 struct addrinfo *res; 235 struct auditinfo_addr aia; 236 int error, ret = ADE_NOERR; 237 238 if (getachost(auditd_host, sizeof(auditd_host)) != 0) { 239 ret = ADE_PARSE; 240 241 /* 242 * To maintain reverse compatability with older audit_control 243 * files, simply drop a warning if the host parameter has not 244 * been set. However, we will explicitly disable the 245 * generation of extended audit header by passing in a zeroed 246 * termid structure. 247 */ 248 bzero(&aia, sizeof(aia)); 249 aia.ai_termid.at_type = AU_IPv4; 250 error = audit_set_kaudit(&aia, sizeof(aia)); 251 if (error < 0 && errno != ENOSYS) 252 ret = ADE_AUDITON; 253 return (ret); 254 } 255 auditd_hostlen = strlen(auditd_host); 256 error = getaddrinfo(auditd_host, NULL, NULL, &res); 257 if (error) 258 return (ADE_GETADDR); 259 switch (res->ai_family) { 260 case PF_INET6: 261 sin6 = (struct sockaddr_in6 *) res->ai_addr; 262 bcopy(&sin6->sin6_addr.s6_addr, 263 &aia.ai_termid.at_addr[0], sizeof(struct in6_addr)); 264 aia.ai_termid.at_type = AU_IPv6; 265 break; 266 267 case PF_INET: 268 sin = (struct sockaddr_in *) res->ai_addr; 269 bcopy(&sin->sin_addr.s_addr, 270 &aia.ai_termid.at_addr[0], sizeof(struct in_addr)); 271 aia.ai_termid.at_type = AU_IPv4; 272 break; 273 274 default: 275 /* Un-supported address family in host parameter. */ 276 errno = EAFNOSUPPORT; 277 return (ADE_ADDRFAM); 278 } 279 280 if (audit_set_kaudit(&aia, sizeof(aia)) < 0) 281 ret = ADE_AUDITON; 282 283 return (ret); 284} 285 286/* 287 * Get the min percentage of free blocks from audit_control(5) and that 288 * value in the kernel. Return: 289 * ADE_NOERR on success, 290 * ADE_PARSE error parsing audit_control(5), 291 * ADE_AUDITON error getting/setting auditon(2) value. 292 */ 293int 294auditd_set_minfree(void) 295{ 296 au_qctrl_t qctrl; 297 298 if (getacmin(&auditd_minval) != 0) 299 return (ADE_PARSE); 300 301 if (audit_get_qctrl(&qctrl, sizeof(qctrl)) != 0) 302 return (ADE_AUDITON); 303 304 if (qctrl.aq_minfree != auditd_minval) { 305 qctrl.aq_minfree = auditd_minval; 306 if (audit_set_qctrl(&qctrl, sizeof(qctrl)) != 0) 307 return (ADE_AUDITON); 308 } 309 310 return (0); 311} 312 313/* 314 * Convert a trailname into a timestamp (seconds). Return 0 if the conversion 315 * was successful. 316 */ 317static int 318trailname_to_tstamp(char *fn, time_t *tstamp) 319{ 320 struct tm tm; 321 char ts[TIMESTAMP_LEN]; 322 char *p; 323 324 *tstamp = 0; 325 326 /* 327 * Get the ending time stamp. 328 */ 329 if ((p = strchr(fn, '.')) == NULL) 330 return (1); 331 strlcpy(ts, ++p, TIMESTAMP_LEN); 332 if (strlen(ts) != POSTFIX_LEN) 333 return (1); 334 335 bzero(&tm, sizeof(tm)); 336 337 /* seconds (0-60) */ 338 p = ts + POSTFIX_LEN - 2; 339 tm.tm_sec = atol(p); 340 if (tm.tm_sec < 0 || tm.tm_sec > 60) 341 return (1); 342 343 /* minutes (0-59) */ 344 *p = '\0'; p -= 2; 345 tm.tm_min = atol(p); 346 if (tm.tm_min < 0 || tm.tm_min > 59) 347 return (1); 348 349 /* hours (0 - 23) */ 350 *p = '\0'; p -= 2; 351 tm.tm_hour = atol(p); 352 if (tm.tm_hour < 0 || tm.tm_hour > 23) 353 return (1); 354 355 /* day of month (1-31) */ 356 *p = '\0'; p -= 2; 357 tm.tm_mday = atol(p); 358 if (tm.tm_mday < 1 || tm.tm_mday > 31) 359 return (1); 360 361 /* month (0 - 11) */ 362 *p = '\0'; p -= 2; 363 tm.tm_mon = atol(p) - 1; 364 if (tm.tm_mon < 0 || tm.tm_mon > 11) 365 return (1); 366 367 /* year (year - 1900) */ 368 *p = '\0'; p -= 4; 369 tm.tm_year = atol(p) - 1900; 370 if (tm.tm_year < 0) 371 return (1); 372 373 *tstamp = timegm(&tm); 374 375 return (0); 376} 377 378/* 379 * Remove audit trails files according to the expiration conditions. Returns: 380 * ADE_NOERR on success or there is nothing to do. 381 * ADE_PARSE if error parsing audit_control(5). 382 * ADE_NOMEM if could not allocate memory. 383 * ADE_EXPIRE if there was an unespected error. 384 */ 385int 386auditd_expire_trails(int (*warn_expired)(char *)) 387{ 388 int andflg, ret = ADE_NOERR; 389 size_t expire_size, total_size = 0L; 390 time_t expire_age, oldest_time, current_time = time(NULL); 391 struct dir_ent *traildir; 392 struct audit_trail *at; 393 char *afnp, *pn; 394 TAILQ_HEAD(au_trls_head, audit_trail) head = 395 TAILQ_HEAD_INITIALIZER(head); 396 struct stat stbuf; 397 char activefn[MAXPATHLEN]; 398 399 /* 400 * Read the expiration conditions. If no conditions then return no 401 * error. 402 */ 403 if (getacexpire(&andflg, &expire_age, &expire_size) < 0) 404 return (ADE_PARSE); 405 if (!expire_age && !expire_size) 406 return (ADE_NOERR); 407 408 /* 409 * Read the 'current' trail file name. Trim off directory path. 410 */ 411 activefn[0] = '\0'; 412 readlink(AUDIT_CURRENT_LINK, activefn, MAXPATHLEN - 1); 413 if ((afnp = strrchr(activefn, '/')) != NULL) 414 afnp++; 415 416 417 /* 418 * Build tail queue of the trail files. 419 */ 420 TAILQ_FOREACH(traildir, &dir_q, dirs) { 421 DIR *dirp; 422 struct dirent *dp; 423 424 dirp = opendir(traildir->dirname); 425 while ((dp = readdir(dirp)) != NULL) { 426 time_t tstamp = 0; 427 struct audit_trail *new; 428 429 /* 430 * Quickly filter non-trail files. 431 */ 432 if (dp->d_namlen != (FILENAME_LEN - 1) || 433#ifdef DT_REG 434 dp->d_type != DT_REG || 435#endif 436 dp->d_name[POSTFIX_LEN] != '.') 437 continue; 438 439 if (asprintf(&pn, "%s/%s", traildir->dirname, 440 dp->d_name) < 0) { 441 ret = ADE_NOMEM; 442 break; 443 } 444 445 if (stat(pn, &stbuf) < 0 || !S_ISREG(stbuf.st_mode)) { 446 free(pn); 447 continue; 448 } 449 450 total_size += stbuf.st_size; 451 452 /* 453 * If this is the 'current' audit trail then 454 * don't add it to the tail queue. 455 */ 456 if (NULL != afnp && 457 strncmp(dp->d_name, afnp, FILENAME_LEN) == 0) { 458 free(pn); 459 continue; 460 } 461 462 /* 463 * Get the ending time stamp encoded in the trail 464 * name. If we can't read it or if it is older 465 * than Jan 1, 2000 then use the mtime. 466 */ 467 if (trailname_to_tstamp(dp->d_name, &tstamp) != 0 || 468 tstamp < JAN_01_2000) 469 tstamp = stbuf.st_mtime; 470 471 /* 472 * If the time stamp is older than Jan 1, 2000 then 473 * update the mtime of the trail file to the current 474 * time. This is so we don't prematurely remove a trail 475 * file that was created while the system clock reset 476 * to the * "beginning of time" but later the system 477 * clock is set to the correct current time. 478 */ 479 if (current_time >= JAN_01_2000 && 480 tstamp < JAN_01_2000) { 481 struct timeval tv[2]; 482 483 tstamp = stbuf.st_mtime = current_time; 484 TIMESPEC_TO_TIMEVAL(&tv[0], 485 &stbuf.st_atimespec); 486 TIMESPEC_TO_TIMEVAL(&tv[1], 487 &stbuf.st_mtimespec); 488 utimes(pn, tv); 489 } 490 491 /* 492 * Allocate and populate the new entry. 493 */ 494 new = malloc(sizeof(*new)); 495 if (NULL == new) { 496 free(pn); 497 ret = ADE_NOMEM; 498 break; 499 } 500 new->at_time = tstamp; 501 new->at_size = stbuf.st_size; 502 new->at_path = pn; 503 504 /* 505 * Check to see if we have a new head. Otherwise, 506 * walk the tailq from the tail first and do a simple 507 * insertion sort. 508 */ 509 if (TAILQ_EMPTY(&head) || 510 (new->at_time <= TAILQ_FIRST(&head)->at_time)) { 511 TAILQ_INSERT_HEAD(&head, new, at_trls); 512 continue; 513 } 514 515 TAILQ_FOREACH_REVERSE(at, &head, au_trls_head, at_trls) 516 if (new->at_time >= at->at_time) { 517 TAILQ_INSERT_AFTER(&head, at, new, 518 at_trls); 519 break; 520 } 521 522 } 523 } 524 525 oldest_time = current_time - expire_age; 526 527 /* 528 * Expire trail files, oldest (mtime) first, if the given 529 * conditions are met. 530 */ 531 at = TAILQ_FIRST(&head); 532 while (NULL != at) { 533 struct audit_trail *at_next = TAILQ_NEXT(at, at_trls); 534 535 if (andflg) { 536 if ((expire_size && total_size > expire_size) && 537 (expire_age && at->at_time < oldest_time)) { 538 if (warn_expired) 539 (*warn_expired)(at->at_path); 540 if (unlink(at->at_path) < 0) 541 ret = ADE_EXPIRE; 542 total_size -= at->at_size; 543 } 544 } else { 545 if ((expire_size && total_size > expire_size) || 546 (expire_age && at->at_time < oldest_time)) { 547 if (warn_expired) 548 (*warn_expired)(at->at_path); 549 if (unlink(at->at_path) < 0) 550 ret = ADE_EXPIRE; 551 total_size -= at->at_size; 552 } 553 } 554 555 free(at->at_path); 556 free(at); 557 at = at_next; 558 } 559 560 return (ret); 561} 562 563/* 564 * Parses the "dir" entry in audit_control(5) into an ordered list. Also, will 565 * set the minfree and host values if not already set. Arguments include 566 * function pointers to audit_warn functions for soft and hard limits. Returns: 567 * ADE_NOERR on success, 568 * ADE_PARSE error parsing audit_control(5), 569 * ADE_AUDITON error getting/setting auditon(2) value, 570 * ADE_NOMEM error allocating memory, 571 * ADE_SOFTLIM if all the directories are over the soft limit, 572 * ADE_HARDLIM if all the directories are over the hard limit, 573 */ 574int 575auditd_read_dirs(int (*warn_soft)(char *), int (*warn_hard)(char *)) 576{ 577 char cur_dir[MAXNAMLEN]; 578 struct dir_ent *dirent; 579 struct statfs sfs; 580 int err; 581 char soft, hard; 582 int tcnt = 0; 583 int scnt = 0; 584 int hcnt = 0; 585 586 if (auditd_minval == -1 && (err = auditd_set_minfree()) != 0) 587 return (err); 588 589 if (auditd_hostlen == -1) 590 auditd_set_host(); 591 592 /* 593 * Init directory q. Force a re-read of the file the next time. 594 */ 595 free_dir_q(); 596 endac(); 597 598 /* 599 * Read the list of directories into an ordered linked list 600 * admin's preference, then those over soft limit and, finally, 601 * those over the hard limit. 602 * 603 * XXX We should use the reentrant interfaces once they are 604 * available. 605 */ 606 while (getacdir(cur_dir, MAXNAMLEN) >= 0) { 607 if (statfs(cur_dir, &sfs) < 0) 608 continue; /* XXX should warn */ 609 soft = (sfs.f_bfree < (sfs.f_blocks / (100 / auditd_minval))) ? 610 1 : 0; 611 hard = (sfs.f_bfree < AUDIT_HARD_LIMIT_FREE_BLOCKS) ? 1 : 0; 612 if (soft) { 613 if (warn_soft) 614 (*warn_soft)(cur_dir); 615 scnt++; 616 } 617 if (hard) { 618 if (warn_hard) 619 (*warn_hard)(cur_dir); 620 hcnt++; 621 } 622 dirent = (struct dir_ent *) malloc(sizeof(struct dir_ent)); 623 if (dirent == NULL) 624 return (ADE_NOMEM); 625 dirent->softlim = soft; 626 dirent->hardlim = hard; 627 dirent->dirname = (char *) malloc(MAXNAMLEN); 628 if (dirent->dirname == NULL) { 629 free(dirent); 630 return (ADE_NOMEM); 631 } 632 strlcpy(dirent->dirname, cur_dir, MAXNAMLEN); 633 insert_orderly(dirent); 634 tcnt++; 635 } 636 637 if (hcnt == tcnt) 638 return (ADE_HARDLIM); 639 if (scnt == tcnt) 640 return (ADE_SOFTLIM); 641 return (0); 642} 643 644void 645auditd_close_dirs(void) 646{ 647 free_dir_q(); 648 auditd_minval = -1; 649 auditd_hostlen = -1; 650} 651 652 653/* 654 * Process the audit event file, obtaining a class mapping for each event, and 655 * set that mapping into the kernel. Return: 656 * n number of event mappings that were successfully processed, 657 * ADE_NOMEM if there was an error allocating memory. 658 */ 659int 660auditd_set_evcmap(void) 661{ 662 au_event_ent_t ev, *evp; 663 au_evclass_map_t evc_map; 664 int ctr = 0; 665 666 667 /* 668 * XXX There's a risk here that the BSM library will return NULL 669 * for an event when it can't properly map it to a class. In that 670 * case, we will not process any events beyond the one that failed, 671 * but should. We need a way to get a count of the events. 672 */ 673 ev.ae_name = (char *)malloc(AU_EVENT_NAME_MAX); 674 ev.ae_desc = (char *)malloc(AU_EVENT_DESC_MAX); 675 if ((ev.ae_name == NULL) || (ev.ae_desc == NULL)) { 676 if (ev.ae_name != NULL) 677 free(ev.ae_name); 678 return (ADE_NOMEM); 679 } 680 681 /* 682 * XXXRW: Currently we have no way to remove mappings from the kernel 683 * when they are removed from the file-based mappings. 684 */ 685 evp = &ev; 686 setauevent(); 687 while ((evp = getauevent_r(evp)) != NULL) { 688 evc_map.ec_number = evp->ae_number; 689 evc_map.ec_class = evp->ae_class; 690 if (audit_set_class(&evc_map, sizeof(evc_map)) == 0) 691 ctr++; 692 } 693 endauevent(); 694 free(ev.ae_name); 695 free(ev.ae_desc); 696 697 return (ctr); 698} 699 700/* 701 * Get the non-attributable event string and set the kernel mask. Return: 702 * ADE_NOERR on success, 703 * ADE_PARSE error parsing audit_control(5), 704 * ADE_AUDITON error setting the mask using auditon(2). 705 */ 706int 707auditd_set_namask(void) 708{ 709 au_mask_t aumask; 710 char naeventstr[NA_EVENT_STR_SIZE]; 711 712 if ((getacna(naeventstr, NA_EVENT_STR_SIZE) != 0) || 713 (getauditflagsbin(naeventstr, &aumask) != 0)) 714 return (ADE_PARSE); 715 716 if (audit_set_kmask(&aumask, sizeof(aumask)) != 0) 717 return (ADE_AUDITON); 718 719 return (ADE_NOERR); 720} 721 722/* 723 * Set the audit control policy if a policy is configured in audit_control(5), 724 * implement the policy. However, if one isn't defined or if there is an error 725 * parsing the control file, set AUDIT_CNT to avoid leaving the system in a 726 * fragile state. Return: 727 * ADE_NOERR on success, 728 * ADE_PARSE error parsing audit_control(5), 729 * ADE_AUDITON error setting policy using auditon(2). 730 */ 731int 732auditd_set_policy(void) 733{ 734 int policy; 735 char polstr[POL_STR_SIZE]; 736 737 if ((getacpol(polstr, POL_STR_SIZE) != 0) || 738 (au_strtopol(polstr, &policy) != 0)) { 739 policy = AUDIT_CNT; 740 if (audit_set_policy(&policy) != 0) 741 return (ADE_AUDITON); 742 return (ADE_PARSE); 743 } 744 745 if (audit_set_policy(&policy) != 0) 746 return (ADE_AUDITON); 747 748 return (ADE_NOERR); 749} 750 751/* 752 * Set trail rotation size. Return: 753 * ADE_NOERR on success, 754 * ADE_PARSE error parsing audit_control(5), 755 * ADE_AUDITON error setting file size using auditon(2). 756 */ 757int 758auditd_set_fsize(void) 759{ 760 size_t filesz; 761 au_fstat_t au_fstat; 762 763 /* 764 * Set trail rotation size. 765 */ 766 if (getacfilesz(&filesz) != 0) 767 return (ADE_PARSE); 768 769 bzero(&au_fstat, sizeof(au_fstat)); 770 au_fstat.af_filesz = filesz; 771 if (audit_set_fsize(&au_fstat, sizeof(au_fstat)) != 0) 772 return (ADE_AUDITON); 773 774 return (ADE_NOERR); 775} 776 777/* 778 * Create the new audit file with appropriate permissions and ownership. Try 779 * to clean up if something goes wrong. 780 */ 781static int 782open_trail(char *fname, gid_t gid) 783{ 784 int error, fd; 785 786 fd = open(fname, O_RDONLY | O_CREAT, S_IRUSR | S_IRGRP); 787 if (fd < 0) 788 return (-1); 789 if (fchown(fd, -1, gid) < 0) { 790 error = errno; 791 close(fd); 792 (void)unlink(fname); 793 errno = error; 794 return (-1); 795 } 796 return (fd); 797} 798 799/* 800 * Create the new audit trail file, swap with existing audit file. Arguments 801 * include timestamp for the filename, a pointer to a string for returning the 802 * new file name, GID for trail file, and audit_warn function pointer for 803 * 'getacdir()' errors. Returns: 804 * ADE_NOERR on success, 805 * ADE_STRERR if the file name string could not be created, 806 * ADE_SWAPERR if the audit trail file could not be swapped, 807 * ADE_ACTL if the auditctl(2) call failed but file swap still 808 * successful. 809 * ADE_ACTLERR if the auditctl(2) call failed and file swap failed. 810 * ADE_SYMLINK if symlink(2) failed updating the current link. 811 */ 812int 813auditd_swap_trail(char *TS, char **newfile, gid_t gid, 814 int (*warn_getacdir)(char *)) 815{ 816 char timestr[FILENAME_LEN]; 817 char *fn; 818 struct dir_ent *dirent; 819 int fd; 820 int error; 821 int saverrno = 0; 822 823 if (strlen(TS) != (TIMESTAMP_LEN - 1) || 824 snprintf(timestr, FILENAME_LEN, "%s.%s", TS, NOT_TERMINATED) < 0) { 825 errno = EINVAL; 826 return (ADE_STRERR); 827 } 828 829 /* Try until we succeed. */ 830 TAILQ_FOREACH(dirent, &dir_q, dirs) { 831 if (dirent->hardlim) 832 continue; 833 if ((fn = affixdir(timestr, dirent)) == NULL) 834 return (ADE_STRERR); 835 836 /* 837 * Create and open the file; then close and pass to the 838 * kernel if all went well. 839 */ 840 fd = open_trail(fn, gid); 841 if (fd >= 0) { 842 error = auditctl(fn); 843 if (error) { 844 /* 845 * auditctl failed setting log file. 846 * Try again. 847 */ 848 saverrno = errno; 849 close(fd); 850 } else { 851 /* Success. */ 852 *newfile = fn; 853 close(fd); 854 if (error) 855 return (error); 856 if (saverrno) { 857 /* 858 * auditctl() failed but still 859 * successful. Return errno and "soft" 860 * error. 861 */ 862 errno = saverrno; 863 return (ADE_ACTL); 864 } 865 return (ADE_NOERR); 866 } 867 } 868 869 /* 870 * Tell the administrator about lack of permissions for dir. 871 */ 872 if (warn_getacdir != NULL) 873 (*warn_getacdir)(dirent->dirname); 874 } 875 if (saverrno) { 876 errno = saverrno; 877 return (ADE_ACTLERR); 878 } else 879 return (ADE_SWAPERR); 880} 881 882/* 883 * Mask calling process from being audited. Returns: 884 * ADE_NOERR on success, 885 * ADE_SETAUDIT if setaudit(2) fails. 886 */ 887#ifdef __APPLE__ 888int 889auditd_prevent_audit(void) 890{ 891 auditinfo_addr_t aia; 892 893 /* 894 * To prevent event feedback cycles and avoid audit becoming stalled if 895 * auditing is suspended we mask this processes events from being 896 * audited. We allow the uid, tid, and mask fields to be implicitly 897 * set to zero, but do set the audit session ID to the PID. 898 * 899 * XXXRW: Is there more to it than this? 900 */ 901 bzero(&aia, sizeof(aia)); 902 aia.ai_asid = AU_ASSIGN_ASID; 903 aia.ai_termid.at_type = AU_IPv4; 904 if (setaudit_addr(&aia, sizeof(aia)) != 0) 905 return (ADE_SETAUDIT); 906 return (ADE_NOERR); 907} 908#else 909int 910auditd_prevent_audit(void) 911{ 912 auditinfo_t ai; 913 914 /* 915 * To prevent event feedback cycles and avoid audit becoming stalled if 916 * auditing is suspended we mask this processes events from being 917 * audited. We allow the uid, tid, and mask fields to be implicitly 918 * set to zero, but do set the audit session ID to the PID. 919 * 920 * XXXRW: Is there more to it than this? 921 */ 922 bzero(&ai, sizeof(ai)); 923 ai.ai_asid = getpid(); 924 if (setaudit(&ai) != 0) 925 return (ADE_SETAUDIT); 926 return (ADE_NOERR); 927} 928#endif /* __APPLE__ */ 929 930/* 931 * Generate and submit audit record for audit startup or shutdown. The event 932 * argument can be AUE_audit_recovery, AUE_audit_startup or 933 * AUE_audit_shutdown. The path argument will add a path token, if not NULL. 934 * Returns: 935 * AUE_NOERR on success, 936 * ADE_NOMEM if memory allocation fails, 937 * ADE_AU_OPEN if au_open(3) fails, 938 * ADE_AU_CLOSE if au_close(3) fails. 939 */ 940int 941auditd_gen_record(int event, char *path) 942{ 943 int aufd; 944 uid_t uid; 945 pid_t pid; 946 char *autext = NULL; 947 token_t *tok; 948 struct auditinfo_addr aia; 949 950 if (event == AUE_audit_startup) 951 asprintf(&autext, "%s::Audit startup", getprogname()); 952 else if (event == AUE_audit_shutdown) 953 asprintf(&autext, "%s::Audit shutdown", getprogname()); 954 else if (event == AUE_audit_recovery) 955 asprintf(&autext, "%s::Audit recovery", getprogname()); 956 else 957 return (ADE_INVAL); 958 if (autext == NULL) 959 return (ADE_NOMEM); 960 961 if ((aufd = au_open()) == -1) { 962 free(autext); 963 return (ADE_AU_OPEN); 964 } 965 bzero(&aia, sizeof(aia)); 966 uid = getuid(); pid = getpid(); 967 if ((tok = au_to_subject32_ex(uid, geteuid(), getegid(), uid, getgid(), 968 pid, pid, &aia.ai_termid)) != NULL) 969 au_write(aufd, tok); 970 if ((tok = au_to_text(autext)) != NULL) 971 au_write(aufd, tok); 972 free(autext); 973 if (path != NULL && (tok = au_to_path(path)) != NULL) 974 au_write(aufd, tok); 975 if ((tok = au_to_return32(0, 0)) != NULL) 976 au_write(aufd, tok); 977 if (au_close(aufd, 1, event) == -1) 978 return (ADE_AU_CLOSE); 979 980 return (ADE_NOERR); 981} 982 983/* 984 * Check for a 'current' symlink and do crash recovery, if needed. Create a new 985 * 'current' symlink. The argument 'curfile' is the file the 'current' symlink 986 * should point to. Returns: 987 * ADE_NOERR on success, 988 * ADE_AU_OPEN if au_open(3) fails, 989 * ADE_AU_CLOSE if au_close(3) fails. 990 * ADE_RENAME if error renaming audit trail file, 991 * ADE_READLINK if error reading the 'current' link, 992 * ADE_SYMLINK if error creating 'current' link. 993 */ 994int 995auditd_new_curlink(char *curfile) 996{ 997 int len, err; 998 char *ptr; 999 char *path = NULL; 1000 struct stat sb; 1001 char recoveredname[MAXPATHLEN]; 1002 char newname[MAXPATHLEN]; 1003 1004 /* 1005 * Check to see if audit was shutdown properly. If not, clean up, 1006 * recover previous audit trail file, and generate audit record. 1007 */ 1008 len = readlink(AUDIT_CURRENT_LINK, recoveredname, MAXPATHLEN - 1); 1009 if (len > 0) { 1010 /* 'current' exist but is it pointing at a valid file? */ 1011 recoveredname[len++] = '\0'; 1012 if (stat(recoveredname, &sb) == 0) { 1013 /* Yes, rename it to a crash recovery file. */ 1014 strlcpy(newname, recoveredname, MAXPATHLEN); 1015 1016 if ((ptr = strstr(newname, NOT_TERMINATED)) != NULL) { 1017 memcpy(ptr, CRASH_RECOVERY, POSTFIX_LEN); 1018 if (rename(recoveredname, newname) != 0) 1019 return (ADE_RENAME); 1020 } else 1021 return (ADE_STRERR); 1022 1023 path = newname; 1024 } 1025 1026 /* 'current' symlink is (now) invalid so remove it. */ 1027 (void) unlink(AUDIT_CURRENT_LINK); 1028 1029 /* Note the crash recovery in current audit trail */ 1030 err = auditd_gen_record(AUE_audit_recovery, path); 1031 if (err) 1032 return (err); 1033 } 1034 1035 if (len < 0 && errno != ENOENT) 1036 return (ADE_READLINK); 1037 1038 if (symlink(curfile, AUDIT_CURRENT_LINK) != 0) 1039 return (ADE_SYMLINK); 1040 1041 return (0); 1042} 1043 1044/* 1045 * Do just what we need to quickly start auditing. Assume no system logging or 1046 * notify. Return: 1047 * 0 on success, 1048 * -1 on failure. 1049 */ 1050int 1051audit_quick_start(void) 1052{ 1053 int err; 1054 char *newfile = NULL; 1055 time_t tt; 1056 char TS[TIMESTAMP_LEN]; 1057 int ret = 0; 1058 1059 /* 1060 * Mask auditing of this process. 1061 */ 1062 if (auditd_prevent_audit() != 0) 1063 return (-1); 1064 1065 /* 1066 * Read audit_control and get log directories. 1067 */ 1068 err = auditd_read_dirs(NULL, NULL); 1069 if (err != ADE_NOERR && err != ADE_SOFTLIM) 1070 return (-1); 1071 1072 /* 1073 * Create a new audit trail log. 1074 */ 1075 if (getTSstr(tt, TS, TIMESTAMP_LEN) != 0) 1076 return (-1); 1077 err = auditd_swap_trail(TS, &newfile, getgid(), NULL); 1078 if (err != ADE_NOERR && err != ADE_ACTL) { 1079 ret = -1; 1080 goto out; 1081 } 1082 1083 /* 1084 * Add the current symlink and recover from crash, if needed. 1085 */ 1086 if (auditd_new_curlink(newfile) != 0) { 1087 ret = -1; 1088 goto out; 1089 } 1090 1091 /* 1092 * At this point auditing has started so generate audit start-up record. 1093 */ 1094 if (auditd_gen_record(AUE_audit_startup, NULL) != 0) { 1095 ret = -1; 1096 goto out; 1097 } 1098 1099 /* 1100 * Configure the audit controls. 1101 */ 1102 (void) auditd_set_evcmap(); 1103 (void) auditd_set_namask(); 1104 (void) auditd_set_policy(); 1105 (void) auditd_set_fsize(); 1106 (void) auditd_set_minfree(); 1107 (void) auditd_set_host(); 1108 1109out: 1110 if (newfile != NULL) 1111 free(newfile); 1112 1113 return (ret); 1114} 1115 1116/* 1117 * Shut down auditing quickly. Assumes that is only called on system shutdown. 1118 * Returns: 1119 * 0 on success, 1120 * -1 on failure. 1121 */ 1122int 1123audit_quick_stop(void) 1124{ 1125 int len; 1126 int cond; 1127 char *ptr; 1128 time_t tt; 1129 char oldname[MAXPATHLEN]; 1130 char newname[MAXPATHLEN]; 1131 char TS[TIMESTAMP_LEN]; 1132 1133 /* 1134 * Auditing already disabled? 1135 */ 1136 if (audit_get_cond(&cond) != 0) 1137 return (-1); 1138 if (cond == AUC_NOAUDIT) 1139 return (0); 1140 1141 /* 1142 * Generate audit shutdown record. 1143 */ 1144 (void) auditd_gen_record(AUE_audit_shutdown, NULL); 1145 1146 /* 1147 * Shutdown auditing in the kernel. 1148 */ 1149 cond = AUC_DISABLED; 1150 if (audit_set_cond(&cond) != 0) 1151 return (-1); 1152#ifdef __BSM_INTERNAL_NOTIFY_KEY 1153 notify_post(__BSM_INTERNAL_NOTIFY_KEY); 1154#endif 1155 1156 /* 1157 * Rename last audit trail and remove 'current' link. 1158 */ 1159 len = readlink(AUDIT_CURRENT_LINK, oldname, MAXPATHLEN - 1); 1160 if (len < 0) 1161 return (-1); 1162 oldname[len++] = '\0'; 1163 1164 if (getTSstr(tt, TS, TIMESTAMP_LEN) != 0) 1165 return (-1); 1166 1167 strlcpy(newname, oldname, len); 1168 1169 if ((ptr = strstr(newname, NOT_TERMINATED)) != NULL) { 1170 memcpy(ptr, TS, POSTFIX_LEN); 1171 if (rename(oldname, newname) != 0) 1172 return (-1); 1173 } else 1174 return (-1); 1175 1176 (void) unlink(AUDIT_CURRENT_LINK); 1177 1178 return (0); 1179}
| 134#define POL_STR_SIZE 128 135 136 137/* 138 * Look up and return the error string for the given audit error code. 139 */ 140const char * 141auditd_strerror(int errcode) 142{ 143 int idx = -errcode; 144 145 if (idx < 0 || idx > (int)MAXERRCODE) 146 return ("Invalid auditd error code"); 147 148 return (auditd_errmsg[idx]); 149} 150 151 152/* 153 * Free our local list of directory names and init list 154 */ 155static void 156free_dir_q(void) 157{ 158 struct dir_ent *d1, *d2; 159 160 d1 = TAILQ_FIRST(&dir_q); 161 while (d1 != NULL) { 162 d2 = TAILQ_NEXT(d1, dirs); 163 free(d1->dirname); 164 free(d1); 165 d1 = d2; 166 } 167 TAILQ_INIT(&dir_q); 168} 169 170/* 171 * Concat the directory name to the given file name. 172 * XXX We should affix the hostname also 173 */ 174static char * 175affixdir(char *name, struct dir_ent *dirent) 176{ 177 char *fn = NULL; 178 179 /* 180 * Sanity check on file name. 181 */ 182 if (strlen(name) != (FILENAME_LEN - 1)) { 183 errno = EINVAL; 184 return (NULL); 185 } 186 187 /* 188 * If the host is set then also add the hostname to the filename. 189 */ 190 if (auditd_hostlen != -1) 191 asprintf(&fn, "%s/%s.%s", dirent->dirname, name, auditd_host); 192 else 193 asprintf(&fn, "%s/%s", dirent->dirname, name); 194 return (fn); 195} 196 197/* 198 * Insert the directory entry in the list by the way they are ordered in 199 * audit_control(5). Move the entries that are over the soft and hard limits 200 * toward the tail. 201 */ 202static void 203insert_orderly(struct dir_ent *denew) 204{ 205 struct dir_ent *dep; 206 207 TAILQ_FOREACH(dep, &dir_q, dirs) { 208 if (dep->softlim == 1 && denew->softlim == 0) { 209 TAILQ_INSERT_BEFORE(dep, denew, dirs); 210 return; 211 } 212 if (dep->hardlim == 1 && denew->hardlim == 0) { 213 TAILQ_INSERT_BEFORE(dep, denew, dirs); 214 return; 215 } 216 } 217 TAILQ_INSERT_TAIL(&dir_q, denew, dirs); 218} 219 220/* 221 * Get the host from audit_control(5) and set it in the audit kernel 222 * information. Return: 223 * ADE_NOERR on success. 224 * ADE_PARSE error parsing audit_control(5). 225 * ADE_AUDITON error getting/setting auditon(2) value. 226 * ADE_GETADDR error getting address info for host. 227 * ADE_ADDRFAM un-supported address family. 228 */ 229int 230auditd_set_host(void) 231{ 232 struct sockaddr_in6 *sin6; 233 struct sockaddr_in *sin; 234 struct addrinfo *res; 235 struct auditinfo_addr aia; 236 int error, ret = ADE_NOERR; 237 238 if (getachost(auditd_host, sizeof(auditd_host)) != 0) { 239 ret = ADE_PARSE; 240 241 /* 242 * To maintain reverse compatability with older audit_control 243 * files, simply drop a warning if the host parameter has not 244 * been set. However, we will explicitly disable the 245 * generation of extended audit header by passing in a zeroed 246 * termid structure. 247 */ 248 bzero(&aia, sizeof(aia)); 249 aia.ai_termid.at_type = AU_IPv4; 250 error = audit_set_kaudit(&aia, sizeof(aia)); 251 if (error < 0 && errno != ENOSYS) 252 ret = ADE_AUDITON; 253 return (ret); 254 } 255 auditd_hostlen = strlen(auditd_host); 256 error = getaddrinfo(auditd_host, NULL, NULL, &res); 257 if (error) 258 return (ADE_GETADDR); 259 switch (res->ai_family) { 260 case PF_INET6: 261 sin6 = (struct sockaddr_in6 *) res->ai_addr; 262 bcopy(&sin6->sin6_addr.s6_addr, 263 &aia.ai_termid.at_addr[0], sizeof(struct in6_addr)); 264 aia.ai_termid.at_type = AU_IPv6; 265 break; 266 267 case PF_INET: 268 sin = (struct sockaddr_in *) res->ai_addr; 269 bcopy(&sin->sin_addr.s_addr, 270 &aia.ai_termid.at_addr[0], sizeof(struct in_addr)); 271 aia.ai_termid.at_type = AU_IPv4; 272 break; 273 274 default: 275 /* Un-supported address family in host parameter. */ 276 errno = EAFNOSUPPORT; 277 return (ADE_ADDRFAM); 278 } 279 280 if (audit_set_kaudit(&aia, sizeof(aia)) < 0) 281 ret = ADE_AUDITON; 282 283 return (ret); 284} 285 286/* 287 * Get the min percentage of free blocks from audit_control(5) and that 288 * value in the kernel. Return: 289 * ADE_NOERR on success, 290 * ADE_PARSE error parsing audit_control(5), 291 * ADE_AUDITON error getting/setting auditon(2) value. 292 */ 293int 294auditd_set_minfree(void) 295{ 296 au_qctrl_t qctrl; 297 298 if (getacmin(&auditd_minval) != 0) 299 return (ADE_PARSE); 300 301 if (audit_get_qctrl(&qctrl, sizeof(qctrl)) != 0) 302 return (ADE_AUDITON); 303 304 if (qctrl.aq_minfree != auditd_minval) { 305 qctrl.aq_minfree = auditd_minval; 306 if (audit_set_qctrl(&qctrl, sizeof(qctrl)) != 0) 307 return (ADE_AUDITON); 308 } 309 310 return (0); 311} 312 313/* 314 * Convert a trailname into a timestamp (seconds). Return 0 if the conversion 315 * was successful. 316 */ 317static int 318trailname_to_tstamp(char *fn, time_t *tstamp) 319{ 320 struct tm tm; 321 char ts[TIMESTAMP_LEN]; 322 char *p; 323 324 *tstamp = 0; 325 326 /* 327 * Get the ending time stamp. 328 */ 329 if ((p = strchr(fn, '.')) == NULL) 330 return (1); 331 strlcpy(ts, ++p, TIMESTAMP_LEN); 332 if (strlen(ts) != POSTFIX_LEN) 333 return (1); 334 335 bzero(&tm, sizeof(tm)); 336 337 /* seconds (0-60) */ 338 p = ts + POSTFIX_LEN - 2; 339 tm.tm_sec = atol(p); 340 if (tm.tm_sec < 0 || tm.tm_sec > 60) 341 return (1); 342 343 /* minutes (0-59) */ 344 *p = '\0'; p -= 2; 345 tm.tm_min = atol(p); 346 if (tm.tm_min < 0 || tm.tm_min > 59) 347 return (1); 348 349 /* hours (0 - 23) */ 350 *p = '\0'; p -= 2; 351 tm.tm_hour = atol(p); 352 if (tm.tm_hour < 0 || tm.tm_hour > 23) 353 return (1); 354 355 /* day of month (1-31) */ 356 *p = '\0'; p -= 2; 357 tm.tm_mday = atol(p); 358 if (tm.tm_mday < 1 || tm.tm_mday > 31) 359 return (1); 360 361 /* month (0 - 11) */ 362 *p = '\0'; p -= 2; 363 tm.tm_mon = atol(p) - 1; 364 if (tm.tm_mon < 0 || tm.tm_mon > 11) 365 return (1); 366 367 /* year (year - 1900) */ 368 *p = '\0'; p -= 4; 369 tm.tm_year = atol(p) - 1900; 370 if (tm.tm_year < 0) 371 return (1); 372 373 *tstamp = timegm(&tm); 374 375 return (0); 376} 377 378/* 379 * Remove audit trails files according to the expiration conditions. Returns: 380 * ADE_NOERR on success or there is nothing to do. 381 * ADE_PARSE if error parsing audit_control(5). 382 * ADE_NOMEM if could not allocate memory. 383 * ADE_EXPIRE if there was an unespected error. 384 */ 385int 386auditd_expire_trails(int (*warn_expired)(char *)) 387{ 388 int andflg, ret = ADE_NOERR; 389 size_t expire_size, total_size = 0L; 390 time_t expire_age, oldest_time, current_time = time(NULL); 391 struct dir_ent *traildir; 392 struct audit_trail *at; 393 char *afnp, *pn; 394 TAILQ_HEAD(au_trls_head, audit_trail) head = 395 TAILQ_HEAD_INITIALIZER(head); 396 struct stat stbuf; 397 char activefn[MAXPATHLEN]; 398 399 /* 400 * Read the expiration conditions. If no conditions then return no 401 * error. 402 */ 403 if (getacexpire(&andflg, &expire_age, &expire_size) < 0) 404 return (ADE_PARSE); 405 if (!expire_age && !expire_size) 406 return (ADE_NOERR); 407 408 /* 409 * Read the 'current' trail file name. Trim off directory path. 410 */ 411 activefn[0] = '\0'; 412 readlink(AUDIT_CURRENT_LINK, activefn, MAXPATHLEN - 1); 413 if ((afnp = strrchr(activefn, '/')) != NULL) 414 afnp++; 415 416 417 /* 418 * Build tail queue of the trail files. 419 */ 420 TAILQ_FOREACH(traildir, &dir_q, dirs) { 421 DIR *dirp; 422 struct dirent *dp; 423 424 dirp = opendir(traildir->dirname); 425 while ((dp = readdir(dirp)) != NULL) { 426 time_t tstamp = 0; 427 struct audit_trail *new; 428 429 /* 430 * Quickly filter non-trail files. 431 */ 432 if (dp->d_namlen != (FILENAME_LEN - 1) || 433#ifdef DT_REG 434 dp->d_type != DT_REG || 435#endif 436 dp->d_name[POSTFIX_LEN] != '.') 437 continue; 438 439 if (asprintf(&pn, "%s/%s", traildir->dirname, 440 dp->d_name) < 0) { 441 ret = ADE_NOMEM; 442 break; 443 } 444 445 if (stat(pn, &stbuf) < 0 || !S_ISREG(stbuf.st_mode)) { 446 free(pn); 447 continue; 448 } 449 450 total_size += stbuf.st_size; 451 452 /* 453 * If this is the 'current' audit trail then 454 * don't add it to the tail queue. 455 */ 456 if (NULL != afnp && 457 strncmp(dp->d_name, afnp, FILENAME_LEN) == 0) { 458 free(pn); 459 continue; 460 } 461 462 /* 463 * Get the ending time stamp encoded in the trail 464 * name. If we can't read it or if it is older 465 * than Jan 1, 2000 then use the mtime. 466 */ 467 if (trailname_to_tstamp(dp->d_name, &tstamp) != 0 || 468 tstamp < JAN_01_2000) 469 tstamp = stbuf.st_mtime; 470 471 /* 472 * If the time stamp is older than Jan 1, 2000 then 473 * update the mtime of the trail file to the current 474 * time. This is so we don't prematurely remove a trail 475 * file that was created while the system clock reset 476 * to the * "beginning of time" but later the system 477 * clock is set to the correct current time. 478 */ 479 if (current_time >= JAN_01_2000 && 480 tstamp < JAN_01_2000) { 481 struct timeval tv[2]; 482 483 tstamp = stbuf.st_mtime = current_time; 484 TIMESPEC_TO_TIMEVAL(&tv[0], 485 &stbuf.st_atimespec); 486 TIMESPEC_TO_TIMEVAL(&tv[1], 487 &stbuf.st_mtimespec); 488 utimes(pn, tv); 489 } 490 491 /* 492 * Allocate and populate the new entry. 493 */ 494 new = malloc(sizeof(*new)); 495 if (NULL == new) { 496 free(pn); 497 ret = ADE_NOMEM; 498 break; 499 } 500 new->at_time = tstamp; 501 new->at_size = stbuf.st_size; 502 new->at_path = pn; 503 504 /* 505 * Check to see if we have a new head. Otherwise, 506 * walk the tailq from the tail first and do a simple 507 * insertion sort. 508 */ 509 if (TAILQ_EMPTY(&head) || 510 (new->at_time <= TAILQ_FIRST(&head)->at_time)) { 511 TAILQ_INSERT_HEAD(&head, new, at_trls); 512 continue; 513 } 514 515 TAILQ_FOREACH_REVERSE(at, &head, au_trls_head, at_trls) 516 if (new->at_time >= at->at_time) { 517 TAILQ_INSERT_AFTER(&head, at, new, 518 at_trls); 519 break; 520 } 521 522 } 523 } 524 525 oldest_time = current_time - expire_age; 526 527 /* 528 * Expire trail files, oldest (mtime) first, if the given 529 * conditions are met. 530 */ 531 at = TAILQ_FIRST(&head); 532 while (NULL != at) { 533 struct audit_trail *at_next = TAILQ_NEXT(at, at_trls); 534 535 if (andflg) { 536 if ((expire_size && total_size > expire_size) && 537 (expire_age && at->at_time < oldest_time)) { 538 if (warn_expired) 539 (*warn_expired)(at->at_path); 540 if (unlink(at->at_path) < 0) 541 ret = ADE_EXPIRE; 542 total_size -= at->at_size; 543 } 544 } else { 545 if ((expire_size && total_size > expire_size) || 546 (expire_age && at->at_time < oldest_time)) { 547 if (warn_expired) 548 (*warn_expired)(at->at_path); 549 if (unlink(at->at_path) < 0) 550 ret = ADE_EXPIRE; 551 total_size -= at->at_size; 552 } 553 } 554 555 free(at->at_path); 556 free(at); 557 at = at_next; 558 } 559 560 return (ret); 561} 562 563/* 564 * Parses the "dir" entry in audit_control(5) into an ordered list. Also, will 565 * set the minfree and host values if not already set. Arguments include 566 * function pointers to audit_warn functions for soft and hard limits. Returns: 567 * ADE_NOERR on success, 568 * ADE_PARSE error parsing audit_control(5), 569 * ADE_AUDITON error getting/setting auditon(2) value, 570 * ADE_NOMEM error allocating memory, 571 * ADE_SOFTLIM if all the directories are over the soft limit, 572 * ADE_HARDLIM if all the directories are over the hard limit, 573 */ 574int 575auditd_read_dirs(int (*warn_soft)(char *), int (*warn_hard)(char *)) 576{ 577 char cur_dir[MAXNAMLEN]; 578 struct dir_ent *dirent; 579 struct statfs sfs; 580 int err; 581 char soft, hard; 582 int tcnt = 0; 583 int scnt = 0; 584 int hcnt = 0; 585 586 if (auditd_minval == -1 && (err = auditd_set_minfree()) != 0) 587 return (err); 588 589 if (auditd_hostlen == -1) 590 auditd_set_host(); 591 592 /* 593 * Init directory q. Force a re-read of the file the next time. 594 */ 595 free_dir_q(); 596 endac(); 597 598 /* 599 * Read the list of directories into an ordered linked list 600 * admin's preference, then those over soft limit and, finally, 601 * those over the hard limit. 602 * 603 * XXX We should use the reentrant interfaces once they are 604 * available. 605 */ 606 while (getacdir(cur_dir, MAXNAMLEN) >= 0) { 607 if (statfs(cur_dir, &sfs) < 0) 608 continue; /* XXX should warn */ 609 soft = (sfs.f_bfree < (sfs.f_blocks / (100 / auditd_minval))) ? 610 1 : 0; 611 hard = (sfs.f_bfree < AUDIT_HARD_LIMIT_FREE_BLOCKS) ? 1 : 0; 612 if (soft) { 613 if (warn_soft) 614 (*warn_soft)(cur_dir); 615 scnt++; 616 } 617 if (hard) { 618 if (warn_hard) 619 (*warn_hard)(cur_dir); 620 hcnt++; 621 } 622 dirent = (struct dir_ent *) malloc(sizeof(struct dir_ent)); 623 if (dirent == NULL) 624 return (ADE_NOMEM); 625 dirent->softlim = soft; 626 dirent->hardlim = hard; 627 dirent->dirname = (char *) malloc(MAXNAMLEN); 628 if (dirent->dirname == NULL) { 629 free(dirent); 630 return (ADE_NOMEM); 631 } 632 strlcpy(dirent->dirname, cur_dir, MAXNAMLEN); 633 insert_orderly(dirent); 634 tcnt++; 635 } 636 637 if (hcnt == tcnt) 638 return (ADE_HARDLIM); 639 if (scnt == tcnt) 640 return (ADE_SOFTLIM); 641 return (0); 642} 643 644void 645auditd_close_dirs(void) 646{ 647 free_dir_q(); 648 auditd_minval = -1; 649 auditd_hostlen = -1; 650} 651 652 653/* 654 * Process the audit event file, obtaining a class mapping for each event, and 655 * set that mapping into the kernel. Return: 656 * n number of event mappings that were successfully processed, 657 * ADE_NOMEM if there was an error allocating memory. 658 */ 659int 660auditd_set_evcmap(void) 661{ 662 au_event_ent_t ev, *evp; 663 au_evclass_map_t evc_map; 664 int ctr = 0; 665 666 667 /* 668 * XXX There's a risk here that the BSM library will return NULL 669 * for an event when it can't properly map it to a class. In that 670 * case, we will not process any events beyond the one that failed, 671 * but should. We need a way to get a count of the events. 672 */ 673 ev.ae_name = (char *)malloc(AU_EVENT_NAME_MAX); 674 ev.ae_desc = (char *)malloc(AU_EVENT_DESC_MAX); 675 if ((ev.ae_name == NULL) || (ev.ae_desc == NULL)) { 676 if (ev.ae_name != NULL) 677 free(ev.ae_name); 678 return (ADE_NOMEM); 679 } 680 681 /* 682 * XXXRW: Currently we have no way to remove mappings from the kernel 683 * when they are removed from the file-based mappings. 684 */ 685 evp = &ev; 686 setauevent(); 687 while ((evp = getauevent_r(evp)) != NULL) { 688 evc_map.ec_number = evp->ae_number; 689 evc_map.ec_class = evp->ae_class; 690 if (audit_set_class(&evc_map, sizeof(evc_map)) == 0) 691 ctr++; 692 } 693 endauevent(); 694 free(ev.ae_name); 695 free(ev.ae_desc); 696 697 return (ctr); 698} 699 700/* 701 * Get the non-attributable event string and set the kernel mask. Return: 702 * ADE_NOERR on success, 703 * ADE_PARSE error parsing audit_control(5), 704 * ADE_AUDITON error setting the mask using auditon(2). 705 */ 706int 707auditd_set_namask(void) 708{ 709 au_mask_t aumask; 710 char naeventstr[NA_EVENT_STR_SIZE]; 711 712 if ((getacna(naeventstr, NA_EVENT_STR_SIZE) != 0) || 713 (getauditflagsbin(naeventstr, &aumask) != 0)) 714 return (ADE_PARSE); 715 716 if (audit_set_kmask(&aumask, sizeof(aumask)) != 0) 717 return (ADE_AUDITON); 718 719 return (ADE_NOERR); 720} 721 722/* 723 * Set the audit control policy if a policy is configured in audit_control(5), 724 * implement the policy. However, if one isn't defined or if there is an error 725 * parsing the control file, set AUDIT_CNT to avoid leaving the system in a 726 * fragile state. Return: 727 * ADE_NOERR on success, 728 * ADE_PARSE error parsing audit_control(5), 729 * ADE_AUDITON error setting policy using auditon(2). 730 */ 731int 732auditd_set_policy(void) 733{ 734 int policy; 735 char polstr[POL_STR_SIZE]; 736 737 if ((getacpol(polstr, POL_STR_SIZE) != 0) || 738 (au_strtopol(polstr, &policy) != 0)) { 739 policy = AUDIT_CNT; 740 if (audit_set_policy(&policy) != 0) 741 return (ADE_AUDITON); 742 return (ADE_PARSE); 743 } 744 745 if (audit_set_policy(&policy) != 0) 746 return (ADE_AUDITON); 747 748 return (ADE_NOERR); 749} 750 751/* 752 * Set trail rotation size. Return: 753 * ADE_NOERR on success, 754 * ADE_PARSE error parsing audit_control(5), 755 * ADE_AUDITON error setting file size using auditon(2). 756 */ 757int 758auditd_set_fsize(void) 759{ 760 size_t filesz; 761 au_fstat_t au_fstat; 762 763 /* 764 * Set trail rotation size. 765 */ 766 if (getacfilesz(&filesz) != 0) 767 return (ADE_PARSE); 768 769 bzero(&au_fstat, sizeof(au_fstat)); 770 au_fstat.af_filesz = filesz; 771 if (audit_set_fsize(&au_fstat, sizeof(au_fstat)) != 0) 772 return (ADE_AUDITON); 773 774 return (ADE_NOERR); 775} 776 777/* 778 * Create the new audit file with appropriate permissions and ownership. Try 779 * to clean up if something goes wrong. 780 */ 781static int 782open_trail(char *fname, gid_t gid) 783{ 784 int error, fd; 785 786 fd = open(fname, O_RDONLY | O_CREAT, S_IRUSR | S_IRGRP); 787 if (fd < 0) 788 return (-1); 789 if (fchown(fd, -1, gid) < 0) { 790 error = errno; 791 close(fd); 792 (void)unlink(fname); 793 errno = error; 794 return (-1); 795 } 796 return (fd); 797} 798 799/* 800 * Create the new audit trail file, swap with existing audit file. Arguments 801 * include timestamp for the filename, a pointer to a string for returning the 802 * new file name, GID for trail file, and audit_warn function pointer for 803 * 'getacdir()' errors. Returns: 804 * ADE_NOERR on success, 805 * ADE_STRERR if the file name string could not be created, 806 * ADE_SWAPERR if the audit trail file could not be swapped, 807 * ADE_ACTL if the auditctl(2) call failed but file swap still 808 * successful. 809 * ADE_ACTLERR if the auditctl(2) call failed and file swap failed. 810 * ADE_SYMLINK if symlink(2) failed updating the current link. 811 */ 812int 813auditd_swap_trail(char *TS, char **newfile, gid_t gid, 814 int (*warn_getacdir)(char *)) 815{ 816 char timestr[FILENAME_LEN]; 817 char *fn; 818 struct dir_ent *dirent; 819 int fd; 820 int error; 821 int saverrno = 0; 822 823 if (strlen(TS) != (TIMESTAMP_LEN - 1) || 824 snprintf(timestr, FILENAME_LEN, "%s.%s", TS, NOT_TERMINATED) < 0) { 825 errno = EINVAL; 826 return (ADE_STRERR); 827 } 828 829 /* Try until we succeed. */ 830 TAILQ_FOREACH(dirent, &dir_q, dirs) { 831 if (dirent->hardlim) 832 continue; 833 if ((fn = affixdir(timestr, dirent)) == NULL) 834 return (ADE_STRERR); 835 836 /* 837 * Create and open the file; then close and pass to the 838 * kernel if all went well. 839 */ 840 fd = open_trail(fn, gid); 841 if (fd >= 0) { 842 error = auditctl(fn); 843 if (error) { 844 /* 845 * auditctl failed setting log file. 846 * Try again. 847 */ 848 saverrno = errno; 849 close(fd); 850 } else { 851 /* Success. */ 852 *newfile = fn; 853 close(fd); 854 if (error) 855 return (error); 856 if (saverrno) { 857 /* 858 * auditctl() failed but still 859 * successful. Return errno and "soft" 860 * error. 861 */ 862 errno = saverrno; 863 return (ADE_ACTL); 864 } 865 return (ADE_NOERR); 866 } 867 } 868 869 /* 870 * Tell the administrator about lack of permissions for dir. 871 */ 872 if (warn_getacdir != NULL) 873 (*warn_getacdir)(dirent->dirname); 874 } 875 if (saverrno) { 876 errno = saverrno; 877 return (ADE_ACTLERR); 878 } else 879 return (ADE_SWAPERR); 880} 881 882/* 883 * Mask calling process from being audited. Returns: 884 * ADE_NOERR on success, 885 * ADE_SETAUDIT if setaudit(2) fails. 886 */ 887#ifdef __APPLE__ 888int 889auditd_prevent_audit(void) 890{ 891 auditinfo_addr_t aia; 892 893 /* 894 * To prevent event feedback cycles and avoid audit becoming stalled if 895 * auditing is suspended we mask this processes events from being 896 * audited. We allow the uid, tid, and mask fields to be implicitly 897 * set to zero, but do set the audit session ID to the PID. 898 * 899 * XXXRW: Is there more to it than this? 900 */ 901 bzero(&aia, sizeof(aia)); 902 aia.ai_asid = AU_ASSIGN_ASID; 903 aia.ai_termid.at_type = AU_IPv4; 904 if (setaudit_addr(&aia, sizeof(aia)) != 0) 905 return (ADE_SETAUDIT); 906 return (ADE_NOERR); 907} 908#else 909int 910auditd_prevent_audit(void) 911{ 912 auditinfo_t ai; 913 914 /* 915 * To prevent event feedback cycles and avoid audit becoming stalled if 916 * auditing is suspended we mask this processes events from being 917 * audited. We allow the uid, tid, and mask fields to be implicitly 918 * set to zero, but do set the audit session ID to the PID. 919 * 920 * XXXRW: Is there more to it than this? 921 */ 922 bzero(&ai, sizeof(ai)); 923 ai.ai_asid = getpid(); 924 if (setaudit(&ai) != 0) 925 return (ADE_SETAUDIT); 926 return (ADE_NOERR); 927} 928#endif /* __APPLE__ */ 929 930/* 931 * Generate and submit audit record for audit startup or shutdown. The event 932 * argument can be AUE_audit_recovery, AUE_audit_startup or 933 * AUE_audit_shutdown. The path argument will add a path token, if not NULL. 934 * Returns: 935 * AUE_NOERR on success, 936 * ADE_NOMEM if memory allocation fails, 937 * ADE_AU_OPEN if au_open(3) fails, 938 * ADE_AU_CLOSE if au_close(3) fails. 939 */ 940int 941auditd_gen_record(int event, char *path) 942{ 943 int aufd; 944 uid_t uid; 945 pid_t pid; 946 char *autext = NULL; 947 token_t *tok; 948 struct auditinfo_addr aia; 949 950 if (event == AUE_audit_startup) 951 asprintf(&autext, "%s::Audit startup", getprogname()); 952 else if (event == AUE_audit_shutdown) 953 asprintf(&autext, "%s::Audit shutdown", getprogname()); 954 else if (event == AUE_audit_recovery) 955 asprintf(&autext, "%s::Audit recovery", getprogname()); 956 else 957 return (ADE_INVAL); 958 if (autext == NULL) 959 return (ADE_NOMEM); 960 961 if ((aufd = au_open()) == -1) { 962 free(autext); 963 return (ADE_AU_OPEN); 964 } 965 bzero(&aia, sizeof(aia)); 966 uid = getuid(); pid = getpid(); 967 if ((tok = au_to_subject32_ex(uid, geteuid(), getegid(), uid, getgid(), 968 pid, pid, &aia.ai_termid)) != NULL) 969 au_write(aufd, tok); 970 if ((tok = au_to_text(autext)) != NULL) 971 au_write(aufd, tok); 972 free(autext); 973 if (path != NULL && (tok = au_to_path(path)) != NULL) 974 au_write(aufd, tok); 975 if ((tok = au_to_return32(0, 0)) != NULL) 976 au_write(aufd, tok); 977 if (au_close(aufd, 1, event) == -1) 978 return (ADE_AU_CLOSE); 979 980 return (ADE_NOERR); 981} 982 983/* 984 * Check for a 'current' symlink and do crash recovery, if needed. Create a new 985 * 'current' symlink. The argument 'curfile' is the file the 'current' symlink 986 * should point to. Returns: 987 * ADE_NOERR on success, 988 * ADE_AU_OPEN if au_open(3) fails, 989 * ADE_AU_CLOSE if au_close(3) fails. 990 * ADE_RENAME if error renaming audit trail file, 991 * ADE_READLINK if error reading the 'current' link, 992 * ADE_SYMLINK if error creating 'current' link. 993 */ 994int 995auditd_new_curlink(char *curfile) 996{ 997 int len, err; 998 char *ptr; 999 char *path = NULL; 1000 struct stat sb; 1001 char recoveredname[MAXPATHLEN]; 1002 char newname[MAXPATHLEN]; 1003 1004 /* 1005 * Check to see if audit was shutdown properly. If not, clean up, 1006 * recover previous audit trail file, and generate audit record. 1007 */ 1008 len = readlink(AUDIT_CURRENT_LINK, recoveredname, MAXPATHLEN - 1); 1009 if (len > 0) { 1010 /* 'current' exist but is it pointing at a valid file? */ 1011 recoveredname[len++] = '\0'; 1012 if (stat(recoveredname, &sb) == 0) { 1013 /* Yes, rename it to a crash recovery file. */ 1014 strlcpy(newname, recoveredname, MAXPATHLEN); 1015 1016 if ((ptr = strstr(newname, NOT_TERMINATED)) != NULL) { 1017 memcpy(ptr, CRASH_RECOVERY, POSTFIX_LEN); 1018 if (rename(recoveredname, newname) != 0) 1019 return (ADE_RENAME); 1020 } else 1021 return (ADE_STRERR); 1022 1023 path = newname; 1024 } 1025 1026 /* 'current' symlink is (now) invalid so remove it. */ 1027 (void) unlink(AUDIT_CURRENT_LINK); 1028 1029 /* Note the crash recovery in current audit trail */ 1030 err = auditd_gen_record(AUE_audit_recovery, path); 1031 if (err) 1032 return (err); 1033 } 1034 1035 if (len < 0 && errno != ENOENT) 1036 return (ADE_READLINK); 1037 1038 if (symlink(curfile, AUDIT_CURRENT_LINK) != 0) 1039 return (ADE_SYMLINK); 1040 1041 return (0); 1042} 1043 1044/* 1045 * Do just what we need to quickly start auditing. Assume no system logging or 1046 * notify. Return: 1047 * 0 on success, 1048 * -1 on failure. 1049 */ 1050int 1051audit_quick_start(void) 1052{ 1053 int err; 1054 char *newfile = NULL; 1055 time_t tt; 1056 char TS[TIMESTAMP_LEN]; 1057 int ret = 0; 1058 1059 /* 1060 * Mask auditing of this process. 1061 */ 1062 if (auditd_prevent_audit() != 0) 1063 return (-1); 1064 1065 /* 1066 * Read audit_control and get log directories. 1067 */ 1068 err = auditd_read_dirs(NULL, NULL); 1069 if (err != ADE_NOERR && err != ADE_SOFTLIM) 1070 return (-1); 1071 1072 /* 1073 * Create a new audit trail log. 1074 */ 1075 if (getTSstr(tt, TS, TIMESTAMP_LEN) != 0) 1076 return (-1); 1077 err = auditd_swap_trail(TS, &newfile, getgid(), NULL); 1078 if (err != ADE_NOERR && err != ADE_ACTL) { 1079 ret = -1; 1080 goto out; 1081 } 1082 1083 /* 1084 * Add the current symlink and recover from crash, if needed. 1085 */ 1086 if (auditd_new_curlink(newfile) != 0) { 1087 ret = -1; 1088 goto out; 1089 } 1090 1091 /* 1092 * At this point auditing has started so generate audit start-up record. 1093 */ 1094 if (auditd_gen_record(AUE_audit_startup, NULL) != 0) { 1095 ret = -1; 1096 goto out; 1097 } 1098 1099 /* 1100 * Configure the audit controls. 1101 */ 1102 (void) auditd_set_evcmap(); 1103 (void) auditd_set_namask(); 1104 (void) auditd_set_policy(); 1105 (void) auditd_set_fsize(); 1106 (void) auditd_set_minfree(); 1107 (void) auditd_set_host(); 1108 1109out: 1110 if (newfile != NULL) 1111 free(newfile); 1112 1113 return (ret); 1114} 1115 1116/* 1117 * Shut down auditing quickly. Assumes that is only called on system shutdown. 1118 * Returns: 1119 * 0 on success, 1120 * -1 on failure. 1121 */ 1122int 1123audit_quick_stop(void) 1124{ 1125 int len; 1126 int cond; 1127 char *ptr; 1128 time_t tt; 1129 char oldname[MAXPATHLEN]; 1130 char newname[MAXPATHLEN]; 1131 char TS[TIMESTAMP_LEN]; 1132 1133 /* 1134 * Auditing already disabled? 1135 */ 1136 if (audit_get_cond(&cond) != 0) 1137 return (-1); 1138 if (cond == AUC_NOAUDIT) 1139 return (0); 1140 1141 /* 1142 * Generate audit shutdown record. 1143 */ 1144 (void) auditd_gen_record(AUE_audit_shutdown, NULL); 1145 1146 /* 1147 * Shutdown auditing in the kernel. 1148 */ 1149 cond = AUC_DISABLED; 1150 if (audit_set_cond(&cond) != 0) 1151 return (-1); 1152#ifdef __BSM_INTERNAL_NOTIFY_KEY 1153 notify_post(__BSM_INTERNAL_NOTIFY_KEY); 1154#endif 1155 1156 /* 1157 * Rename last audit trail and remove 'current' link. 1158 */ 1159 len = readlink(AUDIT_CURRENT_LINK, oldname, MAXPATHLEN - 1); 1160 if (len < 0) 1161 return (-1); 1162 oldname[len++] = '\0'; 1163 1164 if (getTSstr(tt, TS, TIMESTAMP_LEN) != 0) 1165 return (-1); 1166 1167 strlcpy(newname, oldname, len); 1168 1169 if ((ptr = strstr(newname, NOT_TERMINATED)) != NULL) { 1170 memcpy(ptr, TS, POSTFIX_LEN); 1171 if (rename(oldname, newname) != 0) 1172 return (-1); 1173 } else 1174 return (-1); 1175 1176 (void) unlink(AUDIT_CURRENT_LINK); 1177 1178 return (0); 1179}
|