1/*
2 * Copyright (c) 2004 Apple Computer, Inc.
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 * 3. Neither the name of Apple Computer, Inc. ("Apple") nor the names of
14 * its contributors may be used to endorse or promote products derived
15 * from this software without specific prior written permission.
16 *
17 * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND
18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20 * ARE DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR
21 * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
25 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
26 * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
27 * POSSIBILITY OF SUCH DAMAGE.
28 *
| 1/*
2 * Copyright (c) 2004 Apple Computer, Inc.
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 * 3. Neither the name of Apple Computer, Inc. ("Apple") nor the names of
14 * its contributors may be used to endorse or promote products derived
15 * from this software without specific prior written permission.
16 *
17 * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND
18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20 * ARE DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR
21 * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
25 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
26 * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
27 * POSSIBILITY OF SUCH DAMAGE.
28 *
|
29 * $P4: //depot/projects/trustedbsd/openbsm/libbsm/bsm_notify.c#11 $
| 29 * $P4: //depot/projects/trustedbsd/openbsm/libbsm/bsm_notify.c#12 $
|
30 */
31
32/*
33 * Based on sample code from Marc Majka.
34 */
35#include <sys/types.h>
36
37#include <config/config.h>
38#ifdef HAVE_FULL_QUEUE_H
39#include <sys/queue.h>
40#else /* !HAVE_FULL_QUEUE_H */
41#include <compat/queue.h>
42#endif /* !HAVE_FULL_QUEUE_H */
43
44#include <bsm/audit_internal.h>
45#include <bsm/libbsm.h>
46
47#include <errno.h>
| 30 */
31
32/*
33 * Based on sample code from Marc Majka.
34 */
35#include <sys/types.h>
36
37#include <config/config.h>
38#ifdef HAVE_FULL_QUEUE_H
39#include <sys/queue.h>
40#else /* !HAVE_FULL_QUEUE_H */
41#include <compat/queue.h>
42#endif /* !HAVE_FULL_QUEUE_H */
43
44#include <bsm/audit_internal.h>
45#include <bsm/libbsm.h>
46
47#include <errno.h>
|
48#include <stdint.h>
| 48#include <inttypes.h>
|
49#include <stdarg.h>
50#include <string.h>
51#include <syslog.h>
52
53
54#ifdef __APPLE__
55#include <notify.h>
56/* If 1, assumes a kernel that sends the right notification. */
57#define AUDIT_NOTIFICATION_ENABLED 1
58
59#if AUDIT_NOTIFICATION_ENABLED
60static int token = 0;
61#endif /* AUDIT_NOTIFICATION_ENABLED */
62
63static long au_cond = AUC_UNSET; /* <bsm/audit.h> */
64
65uint32_t
66au_notify_initialize(void)
67{
68#if AUDIT_NOTIFICATION_ENABLED
69 uint32_t status, ignore_first;
70
71 status = notify_register_check(__BSM_INTERNAL_NOTIFY_KEY, &token);
72 if (status != NOTIFY_STATUS_OK)
73 return (status);
74 status = notify_check(token, &ignore_first);
75 if (status != NOTIFY_STATUS_OK)
76 return (status);
77#endif
78
79 if (auditon(A_GETCOND, &au_cond, sizeof(long)) < 0) {
80 syslog(LOG_ERR, "Initial audit status check failed (%s)",
81 strerror(errno));
82 if (errno == ENOSYS) /* auditon() unimplemented. */
83 return (AU_UNIMPL);
84 return (NOTIFY_STATUS_FAILED); /* Is there a better code? */
85 }
86 return (NOTIFY_STATUS_OK);
87}
88
89int
90au_notify_terminate(void)
91{
92
93#if AUDIT_NOTIFICATION_ENABLED
94 return ((notify_cancel(token) == NOTIFY_STATUS_OK) ? 0 : -1);
95#else
96 return (0);
97#endif
98}
99
100/*
101 * On error of any notify(3) call, reset 'au_cond' to ensure we re-run
102 * au_notify_initialize() next time 'round--but assume auditing is on. This
103 * is a slight performance hit if auditing is off, but at least the system
104 * will behave correctly. The notification calls are unlikely to fail,
105 * anyway.
106 */
107int
108au_get_state(void)
109{
110#if AUDIT_NOTIFICATION_ENABLED
111 uint32_t did_notify;
112#endif
113 int status;
114
115 /*
116 * Don't make the client initialize this set of routines, but take the
117 * slight performance hit by checking ourselves every time.
118 */
119 if (au_cond == AUC_UNSET) {
120 status = au_notify_initialize();
121 if (status != NOTIFY_STATUS_OK) {
122 if (status == AU_UNIMPL)
123 return (AU_UNIMPL);
124 return (AUC_AUDITING);
125 } else
126 return (au_cond);
127 }
128#if AUDIT_NOTIFICATION_ENABLED
129 status = notify_check(token, &did_notify);
130 if (status != NOTIFY_STATUS_OK) {
131 au_cond = AUC_UNSET;
132 return (AUC_AUDITING);
133 }
134
135 if (did_notify == 0)
136 return (au_cond);
137#endif
138
139 if (auditon(A_GETCOND, &au_cond, sizeof(long)) < 0) {
140 /* XXX Reset au_cond to AUC_UNSET? */
141 syslog(LOG_ERR, "Audit status check failed (%s)",
142 strerror(errno));
143 if (errno == ENOSYS) /* Function unimplemented. */
144 return (AU_UNIMPL);
145 return (errno);
146 }
147
148 switch (au_cond) {
149 case AUC_NOAUDIT: /* Auditing suspended. */
150 case AUC_DISABLED: /* Auditing shut off. */
151 return (AUC_NOAUDIT);
152
153 case AUC_UNSET: /* Uninitialized; shouldn't get here. */
154 case AUC_AUDITING: /* Audit on. */
155 default:
156 return (AUC_AUDITING);
157 }
158}
159#endif /* !__APPLE__ */
160
161int
162cannot_audit(int val __unused)
163{
164#ifdef __APPLE__
165 return (!(au_get_state() == AUC_AUDITING));
166#else
167 unsigned long au_cond;
168
169 if (auditon(A_GETCOND, &au_cond, sizeof(long)) < 0) {
170 if (errno != ENOSYS) {
171 syslog(LOG_ERR, "Audit status check failed (%s)",
172 strerror(errno));
173 }
174 return (1);
175 }
176 if (au_cond == AUC_NOAUDIT || au_cond == AUC_DISABLED)
177 return (1);
178 return (0);
179#endif /* !__APPLE__ */
180}
| 49#include <stdarg.h>
50#include <string.h>
51#include <syslog.h>
52
53
54#ifdef __APPLE__
55#include <notify.h>
56/* If 1, assumes a kernel that sends the right notification. */
57#define AUDIT_NOTIFICATION_ENABLED 1
58
59#if AUDIT_NOTIFICATION_ENABLED
60static int token = 0;
61#endif /* AUDIT_NOTIFICATION_ENABLED */
62
63static long au_cond = AUC_UNSET; /* <bsm/audit.h> */
64
65uint32_t
66au_notify_initialize(void)
67{
68#if AUDIT_NOTIFICATION_ENABLED
69 uint32_t status, ignore_first;
70
71 status = notify_register_check(__BSM_INTERNAL_NOTIFY_KEY, &token);
72 if (status != NOTIFY_STATUS_OK)
73 return (status);
74 status = notify_check(token, &ignore_first);
75 if (status != NOTIFY_STATUS_OK)
76 return (status);
77#endif
78
79 if (auditon(A_GETCOND, &au_cond, sizeof(long)) < 0) {
80 syslog(LOG_ERR, "Initial audit status check failed (%s)",
81 strerror(errno));
82 if (errno == ENOSYS) /* auditon() unimplemented. */
83 return (AU_UNIMPL);
84 return (NOTIFY_STATUS_FAILED); /* Is there a better code? */
85 }
86 return (NOTIFY_STATUS_OK);
87}
88
89int
90au_notify_terminate(void)
91{
92
93#if AUDIT_NOTIFICATION_ENABLED
94 return ((notify_cancel(token) == NOTIFY_STATUS_OK) ? 0 : -1);
95#else
96 return (0);
97#endif
98}
99
100/*
101 * On error of any notify(3) call, reset 'au_cond' to ensure we re-run
102 * au_notify_initialize() next time 'round--but assume auditing is on. This
103 * is a slight performance hit if auditing is off, but at least the system
104 * will behave correctly. The notification calls are unlikely to fail,
105 * anyway.
106 */
107int
108au_get_state(void)
109{
110#if AUDIT_NOTIFICATION_ENABLED
111 uint32_t did_notify;
112#endif
113 int status;
114
115 /*
116 * Don't make the client initialize this set of routines, but take the
117 * slight performance hit by checking ourselves every time.
118 */
119 if (au_cond == AUC_UNSET) {
120 status = au_notify_initialize();
121 if (status != NOTIFY_STATUS_OK) {
122 if (status == AU_UNIMPL)
123 return (AU_UNIMPL);
124 return (AUC_AUDITING);
125 } else
126 return (au_cond);
127 }
128#if AUDIT_NOTIFICATION_ENABLED
129 status = notify_check(token, &did_notify);
130 if (status != NOTIFY_STATUS_OK) {
131 au_cond = AUC_UNSET;
132 return (AUC_AUDITING);
133 }
134
135 if (did_notify == 0)
136 return (au_cond);
137#endif
138
139 if (auditon(A_GETCOND, &au_cond, sizeof(long)) < 0) {
140 /* XXX Reset au_cond to AUC_UNSET? */
141 syslog(LOG_ERR, "Audit status check failed (%s)",
142 strerror(errno));
143 if (errno == ENOSYS) /* Function unimplemented. */
144 return (AU_UNIMPL);
145 return (errno);
146 }
147
148 switch (au_cond) {
149 case AUC_NOAUDIT: /* Auditing suspended. */
150 case AUC_DISABLED: /* Auditing shut off. */
151 return (AUC_NOAUDIT);
152
153 case AUC_UNSET: /* Uninitialized; shouldn't get here. */
154 case AUC_AUDITING: /* Audit on. */
155 default:
156 return (AUC_AUDITING);
157 }
158}
159#endif /* !__APPLE__ */
160
161int
162cannot_audit(int val __unused)
163{
164#ifdef __APPLE__
165 return (!(au_get_state() == AUC_AUDITING));
166#else
167 unsigned long au_cond;
168
169 if (auditon(A_GETCOND, &au_cond, sizeof(long)) < 0) {
170 if (errno != ENOSYS) {
171 syslog(LOG_ERR, "Audit status check failed (%s)",
172 strerror(errno));
173 }
174 return (1);
175 }
176 if (au_cond == AUC_NOAUDIT || au_cond == AUC_DISABLED)
177 return (1);
178 return (0);
179#endif /* !__APPLE__ */
180}
|