38 39#include <sys/types.h> 40#include <sys/endian.h> 41#include <sys/queue.h> 42#include <sys/socket.h> 43#include <sys/time.h> 44 45#include <sys/ipc.h> 46#include <sys/libkern.h> 47#include <sys/malloc.h> 48#include <sys/un.h> 49 50#include <netinet/in.h> 51#include <netinet/in_systm.h> 52#include <netinet/ip.h> 53 54 55#include <bsm/audit.h> 56#include <bsm/audit_internal.h> 57#include <bsm/audit_record.h> 58#include <security/audit/audit.h> 59#include <security/audit/audit_private.h> 60 61#define GET_TOKEN_AREA(t, dptr, length) do { \ 62 t = malloc(sizeof(token_t), M_AUDITBSM, M_WAITOK); \ 63 t->t_data = malloc(length, M_AUDITBSM, M_WAITOK | M_ZERO); \ 64 t->len = length; \ 65 dptr = t->t_data; \ 66} while (0) 67 68/* 69 * token ID 1 byte 70 * argument # 1 byte 71 * argument value 4 bytes/8 bytes (32-bit/64-bit value) 72 * text length 2 bytes 73 * text N bytes + 1 terminating NULL byte 74 */ 75token_t * 76au_to_arg32(char n, const char *text, u_int32_t v) 77{ 78 token_t *t; 79 u_char *dptr = NULL; 80 u_int16_t textlen; 81 82 textlen = strlen(text); 83 textlen += 1; 84 85 GET_TOKEN_AREA(t, dptr, 2 * sizeof(u_char) + sizeof(u_int32_t) + 86 sizeof(u_int16_t) + textlen); 87 88 ADD_U_CHAR(dptr, AUT_ARG32); 89 ADD_U_CHAR(dptr, n); 90 ADD_U_INT32(dptr, v); 91 ADD_U_INT16(dptr, textlen); 92 ADD_STRING(dptr, text, textlen); 93 94 return (t); 95} 96 97token_t * 98au_to_arg64(char n, const char *text, u_int64_t v) 99{ 100 token_t *t; 101 u_char *dptr = NULL; 102 u_int16_t textlen; 103 104 textlen = strlen(text); 105 textlen += 1; 106 107 GET_TOKEN_AREA(t, dptr, 2 * sizeof(u_char) + sizeof(u_int64_t) + 108 sizeof(u_int16_t) + textlen); 109 110 ADD_U_CHAR(dptr, AUT_ARG64); 111 ADD_U_CHAR(dptr, n); 112 ADD_U_INT64(dptr, v); 113 ADD_U_INT16(dptr, textlen); 114 ADD_STRING(dptr, text, textlen); 115 116 return (t); 117} 118 119token_t * 120au_to_arg(char n, const char *text, u_int32_t v) 121{ 122 123 return (au_to_arg32(n, text, v)); 124} 125 126#if defined(_KERNEL) || defined(KERNEL) 127/* 128 * token ID 1 byte 129 * file access mode 4 bytes 130 * owner user ID 4 bytes 131 * owner group ID 4 bytes 132 * file system ID 4 bytes 133 * node ID 8 bytes 134 * device 4 bytes/8 bytes (32-bit/64-bit) 135 */ 136token_t * 137au_to_attr32(struct vnode_au_info *vni) 138{ 139 token_t *t; 140 u_char *dptr = NULL; 141 u_int16_t pad0_16 = 0; 142 u_int32_t pad0_32 = 0; 143 144 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 2 * sizeof(u_int16_t) + 145 3 * sizeof(u_int32_t) + sizeof(u_int64_t) + sizeof(u_int32_t)); 146 147 ADD_U_CHAR(dptr, AUT_ATTR32); 148 149 /* 150 * BSD defines the size for the file mode as 2 bytes; BSM defines 4 151 * so pad with 0. 152 * 153 * XXXRW: Possibly should be conditionally compiled. 154 * 155 * XXXRW: Should any conversions take place on the mode? 156 */ 157 ADD_U_INT16(dptr, pad0_16); 158 ADD_U_INT16(dptr, vni->vn_mode); 159 160 ADD_U_INT32(dptr, vni->vn_uid); 161 ADD_U_INT32(dptr, vni->vn_gid); 162 ADD_U_INT32(dptr, vni->vn_fsid); 163 164 /* 165 * Some systems use 32-bit file ID's, others use 64-bit file IDs. 166 * Attempt to handle both, and let the compiler sort it out. If we 167 * could pick this out at compile-time, it would be better, so as to 168 * avoid the else case below. 169 */ 170 if (sizeof(vni->vn_fileid) == sizeof(uint32_t)) { 171 ADD_U_INT32(dptr, pad0_32); 172 ADD_U_INT32(dptr, vni->vn_fileid); 173 } else if (sizeof(vni->vn_fileid) == sizeof(uint64_t)) 174 ADD_U_INT64(dptr, vni->vn_fileid); 175 else 176 ADD_U_INT64(dptr, 0LL); 177 178 ADD_U_INT32(dptr, vni->vn_dev); 179 180 return (t); 181} 182 183token_t * 184au_to_attr64(struct vnode_au_info *vni) 185{ 186 token_t *t; 187 u_char *dptr = NULL; 188 u_int16_t pad0_16 = 0; 189 u_int32_t pad0_32 = 0; 190 191 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 2 * sizeof(u_int16_t) + 192 3 * sizeof(u_int32_t) + sizeof(u_int64_t) * 2); 193 194 ADD_U_CHAR(dptr, AUT_ATTR64); 195 196 /* 197 * BSD defines the size for the file mode as 2 bytes; BSM defines 4 198 * so pad with 0. 199 * 200 * XXXRW: Possibly should be conditionally compiled. 201 * 202 * XXXRW: Should any conversions take place on the mode? 203 */ 204 ADD_U_INT16(dptr, pad0_16); 205 ADD_U_INT16(dptr, vni->vn_mode); 206 207 ADD_U_INT32(dptr, vni->vn_uid); 208 ADD_U_INT32(dptr, vni->vn_gid); 209 ADD_U_INT32(dptr, vni->vn_fsid); 210 211 /* 212 * Some systems use 32-bit file ID's, other's use 64-bit file IDs. 213 * Attempt to handle both, and let the compiler sort it out. If we 214 * could pick this out at compile-time, it would be better, so as to 215 * avoid the else case below. 216 */ 217 if (sizeof(vni->vn_fileid) == sizeof(uint32_t)) { 218 ADD_U_INT32(dptr, pad0_32); 219 ADD_U_INT32(dptr, vni->vn_fileid); 220 } else if (sizeof(vni->vn_fileid) == sizeof(uint64_t)) 221 ADD_U_INT64(dptr, vni->vn_fileid); 222 else 223 ADD_U_INT64(dptr, 0LL); 224 225 ADD_U_INT64(dptr, vni->vn_dev); 226 227 return (t); 228} 229 230token_t * 231au_to_attr(struct vnode_au_info *vni) 232{ 233 234 return (au_to_attr32(vni)); 235} 236#endif /* !(defined(_KERNEL) || defined(KERNEL) */ 237 238/* 239 * token ID 1 byte 240 * how to print 1 byte 241 * basic unit 1 byte 242 * unit count 1 byte 243 * data items (depends on basic unit) 244 */ 245token_t * 246au_to_data(char unit_print, char unit_type, char unit_count, const char *p) 247{ 248 token_t *t; 249 u_char *dptr = NULL; 250 size_t datasize, totdata; 251 252 /* Determine the size of the basic unit. */ 253 switch (unit_type) { 254 case AUR_BYTE: 255 /* case AUR_CHAR: */ 256 datasize = AUR_BYTE_SIZE; 257 break; 258 259 case AUR_SHORT: 260 datasize = AUR_SHORT_SIZE; 261 break; 262 263 case AUR_INT32: 264 /* case AUR_INT: */ 265 datasize = AUR_INT32_SIZE; 266 break; 267 268 case AUR_INT64: 269 datasize = AUR_INT64_SIZE; 270 break; 271 272 default: 273 return (NULL); 274 } 275 276 totdata = datasize * unit_count; 277 278 GET_TOKEN_AREA(t, dptr, 4 * sizeof(u_char) + totdata); 279 280 /* 281 * XXXRW: We should be byte-swapping each data item for multi-byte 282 * types. 283 */ 284 ADD_U_CHAR(dptr, AUT_DATA); 285 ADD_U_CHAR(dptr, unit_print); 286 ADD_U_CHAR(dptr, unit_type); 287 ADD_U_CHAR(dptr, unit_count); 288 ADD_MEM(dptr, p, totdata); 289 290 return (t); 291} 292 293 294/* 295 * token ID 1 byte 296 * status 4 bytes 297 * return value 4 bytes 298 */ 299token_t * 300au_to_exit(int retval, int err) 301{ 302 token_t *t; 303 u_char *dptr = NULL; 304 305 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 2 * sizeof(u_int32_t)); 306 307 ADD_U_CHAR(dptr, AUT_EXIT); 308 ADD_U_INT32(dptr, err); 309 ADD_U_INT32(dptr, retval); 310 311 return (t); 312} 313 314/* 315 */ 316token_t * 317au_to_groups(int *groups) 318{ 319 320 return (au_to_newgroups(AUDIT_MAX_GROUPS, (gid_t *)groups)); 321} 322 323/* 324 * token ID 1 byte 325 * number groups 2 bytes 326 * group list count * 4 bytes 327 */ 328token_t * 329au_to_newgroups(u_int16_t n, gid_t *groups) 330{ 331 token_t *t; 332 u_char *dptr = NULL; 333 int i; 334 335 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t) + 336 n * sizeof(u_int32_t)); 337 338 ADD_U_CHAR(dptr, AUT_NEWGROUPS); 339 ADD_U_INT16(dptr, n); 340 for (i = 0; i < n; i++) 341 ADD_U_INT32(dptr, groups[i]); 342 343 return (t); 344} 345 346/* 347 * token ID 1 byte 348 * internet address 4 bytes 349 */ 350token_t * 351au_to_in_addr(struct in_addr *internet_addr) 352{ 353 token_t *t; 354 u_char *dptr = NULL; 355 356 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(uint32_t)); 357 358 ADD_U_CHAR(dptr, AUT_IN_ADDR); 359 ADD_MEM(dptr, &internet_addr->s_addr, sizeof(uint32_t)); 360 361 return (t); 362} 363 364/* 365 * token ID 1 byte 366 * address type/length 4 bytes 367 * address 16 bytes 368 */ 369token_t * 370au_to_in_addr_ex(struct in6_addr *internet_addr) 371{ 372 token_t *t; 373 u_char *dptr = NULL; 374 u_int32_t type = AU_IPv6; 375 376 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 5 * sizeof(uint32_t)); 377 378 ADD_U_CHAR(dptr, AUT_IN_ADDR_EX); 379 ADD_U_INT32(dptr, type); 380 ADD_MEM(dptr, internet_addr, 4 * sizeof(uint32_t)); 381 382 return (t); 383} 384 385/* 386 * token ID 1 byte 387 * ip header 20 bytes 388 * 389 * The IP header should be submitted in network byte order. 390 */ 391token_t * 392au_to_ip(struct ip *ip) 393{ 394 token_t *t; 395 u_char *dptr = NULL; 396 397 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(struct ip)); 398 399 ADD_U_CHAR(dptr, AUT_IP); 400 ADD_MEM(dptr, ip, sizeof(struct ip)); 401 402 return (t); 403} 404 405/* 406 * token ID 1 byte 407 * object ID type 1 byte 408 * object ID 4 bytes 409 */ 410token_t * 411au_to_ipc(char type, int id) 412{ 413 token_t *t; 414 u_char *dptr = NULL; 415 416 GET_TOKEN_AREA(t, dptr, 2 * sizeof(u_char) + sizeof(u_int32_t)); 417 418 ADD_U_CHAR(dptr, AUT_IPC); 419 ADD_U_CHAR(dptr, type); 420 ADD_U_INT32(dptr, id); 421 422 return (t); 423} 424 425/* 426 * token ID 1 byte 427 * owner user ID 4 bytes 428 * owner group ID 4 bytes 429 * creator user ID 4 bytes 430 * creator group ID 4 bytes 431 * access mode 4 bytes 432 * slot sequence # 4 bytes 433 * key 4 bytes 434 */ 435token_t * 436au_to_ipc_perm(struct ipc_perm *perm) 437{ 438 token_t *t; 439 u_char *dptr = NULL; 440 u_int16_t pad0 = 0; 441 442 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 12 * sizeof(u_int16_t) + 443 sizeof(u_int32_t)); 444 445 ADD_U_CHAR(dptr, AUT_IPC_PERM); 446 447 /* 448 * Systems vary significantly in what types they use in struct 449 * ipc_perm; at least a few still use 16-bit uid's and gid's, so 450 * allow for that, as BSM define 32-bit values here. 451 * Some systems define the sizes for ipc_perm members as 2 bytes; 452 * BSM defines 4 so pad with 0. 453 * 454 * XXXRW: Possibly shoulid be conditionally compiled, and more cases 455 * need to be handled. 456 */ 457 if (sizeof(perm->uid) != sizeof(u_int32_t)) { 458 ADD_U_INT16(dptr, pad0); 459 ADD_U_INT16(dptr, perm->uid); 460 ADD_U_INT16(dptr, pad0); 461 ADD_U_INT16(dptr, perm->gid); 462 ADD_U_INT16(dptr, pad0); 463 ADD_U_INT16(dptr, perm->cuid); 464 ADD_U_INT16(dptr, pad0); 465 ADD_U_INT16(dptr, perm->cgid); 466 } else { 467 ADD_U_INT32(dptr, perm->uid); 468 ADD_U_INT32(dptr, perm->gid); 469 ADD_U_INT32(dptr, perm->cuid); 470 ADD_U_INT32(dptr, perm->cgid); 471 } 472 473 ADD_U_INT16(dptr, pad0); 474 ADD_U_INT16(dptr, perm->mode); 475 476 ADD_U_INT16(dptr, pad0); 477 478 ADD_U_INT16(dptr, perm->seq); 479 480 ADD_U_INT32(dptr, perm->key); 481 482 return (t); 483} 484 485/* 486 * token ID 1 byte 487 * port IP address 2 bytes 488 */ 489token_t * 490au_to_iport(u_int16_t iport) 491{ 492 token_t *t; 493 u_char *dptr = NULL; 494 495 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t)); 496 497 ADD_U_CHAR(dptr, AUT_IPORT); 498 ADD_U_INT16(dptr, iport); 499 500 return (t); 501} 502 503/* 504 * token ID 1 byte 505 * size 2 bytes 506 * data size bytes 507 */ 508token_t * 509au_to_opaque(const char *data, u_int16_t bytes) 510{ 511 token_t *t; 512 u_char *dptr = NULL; 513 514 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t) + bytes); 515 516 ADD_U_CHAR(dptr, AUT_OPAQUE); 517 ADD_U_INT16(dptr, bytes); 518 ADD_MEM(dptr, data, bytes); 519 520 return (t); 521} 522 523/* 524 * token ID 1 byte 525 * seconds of time 4 bytes 526 * milliseconds of time 4 bytes 527 * file name len 2 bytes 528 * file pathname N bytes + 1 terminating NULL byte 529 */ 530token_t * 531au_to_file(const char *file, struct timeval tm) 532{ 533 token_t *t; 534 u_char *dptr = NULL; 535 u_int16_t filelen; 536 u_int32_t timems; 537 538 filelen = strlen(file); 539 filelen += 1; 540 541 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 2 * sizeof(u_int32_t) + 542 sizeof(u_int16_t) + filelen); 543 544 timems = tm.tv_usec/1000; 545 546 ADD_U_CHAR(dptr, AUT_OTHER_FILE32); 547 ADD_U_INT32(dptr, tm.tv_sec); 548 ADD_U_INT32(dptr, timems); /* We need time in ms. */ 549 ADD_U_INT16(dptr, filelen); 550 ADD_STRING(dptr, file, filelen); 551 552 return (t); 553} 554 555/* 556 * token ID 1 byte 557 * text length 2 bytes 558 * text N bytes + 1 terminating NULL byte 559 */ 560token_t * 561au_to_text(const char *text) 562{ 563 token_t *t; 564 u_char *dptr = NULL; 565 u_int16_t textlen; 566 567 textlen = strlen(text); 568 textlen += 1; 569 570 /* XXXRW: Should validate length against token size limit. */ 571 572 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t) + textlen); 573 574 ADD_U_CHAR(dptr, AUT_TEXT); 575 ADD_U_INT16(dptr, textlen); 576 ADD_STRING(dptr, text, textlen); 577 578 return (t); 579} 580 581/* 582 * token ID 1 byte 583 * path length 2 bytes 584 * path N bytes + 1 terminating NULL byte 585 */ 586token_t * 587au_to_path(const char *text) 588{ 589 token_t *t; 590 u_char *dptr = NULL; 591 u_int16_t textlen; 592 593 textlen = strlen(text); 594 textlen += 1; 595 596 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t) + textlen); 597 598 ADD_U_CHAR(dptr, AUT_PATH); 599 ADD_U_INT16(dptr, textlen); 600 ADD_STRING(dptr, text, textlen); 601 602 return (t); 603} 604 605/* 606 * token ID 1 byte 607 * audit ID 4 bytes 608 * effective user ID 4 bytes 609 * effective group ID 4 bytes 610 * real user ID 4 bytes 611 * real group ID 4 bytes 612 * process ID 4 bytes 613 * session ID 4 bytes 614 * terminal ID 615 * port ID 4 bytes/8 bytes (32-bit/64-bit value) 616 * machine address 4 bytes 617 */ 618token_t * 619au_to_process32(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid, gid_t rgid, 620 pid_t pid, au_asid_t sid, au_tid_t *tid) 621{ 622 token_t *t; 623 u_char *dptr = NULL; 624 625 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 9 * sizeof(u_int32_t)); 626 627 ADD_U_CHAR(dptr, AUT_PROCESS32); 628 ADD_U_INT32(dptr, auid); 629 ADD_U_INT32(dptr, euid); 630 ADD_U_INT32(dptr, egid); 631 ADD_U_INT32(dptr, ruid); 632 ADD_U_INT32(dptr, rgid); 633 ADD_U_INT32(dptr, pid); 634 ADD_U_INT32(dptr, sid); 635 ADD_U_INT32(dptr, tid->port); 636 637 /* 638 * Note: Solaris will write out IPv6 addresses here as a 32-bit 639 * address type and 16 bytes of address, but for IPv4 addresses it 640 * simply writes the 4-byte address directly. We support only IPv4 641 * addresses for process32 tokens. 642 */ 643 ADD_MEM(dptr, &tid->machine, sizeof(u_int32_t)); 644 645 return (t); 646} 647 648token_t * 649au_to_process64(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid, gid_t rgid, 650 pid_t pid, au_asid_t sid, au_tid_t *tid) 651{ 652 token_t *t; 653 u_char *dptr = NULL; 654 655 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 8 * sizeof(u_int32_t) + 656 sizeof(u_int64_t)); 657 658 ADD_U_CHAR(dptr, AUT_PROCESS64); 659 ADD_U_INT32(dptr, auid); 660 ADD_U_INT32(dptr, euid); 661 ADD_U_INT32(dptr, egid); 662 ADD_U_INT32(dptr, ruid); 663 ADD_U_INT32(dptr, rgid); 664 ADD_U_INT32(dptr, pid); 665 ADD_U_INT32(dptr, sid); 666 ADD_U_INT64(dptr, tid->port); 667 668 /* 669 * Note: Solaris will write out IPv6 addresses here as a 32-bit 670 * address type and 16 bytes of address, but for IPv4 addresses it 671 * simply writes the 4-byte address directly. We support only IPv4 672 * addresses for process64 tokens. 673 */ 674 ADD_MEM(dptr, &tid->machine, sizeof(u_int32_t)); 675 676 return (t); 677} 678 679token_t * 680au_to_process(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid, gid_t rgid, 681 pid_t pid, au_asid_t sid, au_tid_t *tid) 682{ 683 684 return (au_to_process32(auid, euid, egid, ruid, rgid, pid, sid, 685 tid)); 686} 687 688/* 689 * token ID 1 byte 690 * audit ID 4 bytes 691 * effective user ID 4 bytes 692 * effective group ID 4 bytes 693 * real user ID 4 bytes 694 * real group ID 4 bytes 695 * process ID 4 bytes 696 * session ID 4 bytes 697 * terminal ID 698 * port ID 4 bytes/8 bytes (32-bit/64-bit value) 699 * address type-len 4 bytes 700 * machine address 16 bytes 701 */ 702token_t * 703au_to_process32_ex(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid, 704 gid_t rgid, pid_t pid, au_asid_t sid, au_tid_addr_t *tid) 705{ 706 token_t *t; 707 u_char *dptr = NULL; 708 709 KASSERT((tid->at_type == AU_IPv4) || (tid->at_type == AU_IPv6), 710 ("au_to_process32_ex: type %u", (unsigned int)tid->at_type)); 711 if (tid->at_type == AU_IPv4) 712 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 713 10 * sizeof(u_int32_t)); 714 else 715 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 716 13 * sizeof(u_int32_t)); 717 718 ADD_U_CHAR(dptr, AUT_PROCESS32_EX); 719 ADD_U_INT32(dptr, auid); 720 ADD_U_INT32(dptr, euid); 721 ADD_U_INT32(dptr, egid); 722 ADD_U_INT32(dptr, ruid); 723 ADD_U_INT32(dptr, rgid); 724 ADD_U_INT32(dptr, pid); 725 ADD_U_INT32(dptr, sid); 726 ADD_U_INT32(dptr, tid->at_port); 727 ADD_U_INT32(dptr, tid->at_type); 728 ADD_MEM(dptr, &tid->at_addr[0], sizeof(u_int32_t)); 729 if (tid->at_type == AU_IPv6) { 730 ADD_MEM(dptr, &tid->at_addr[1], sizeof(u_int32_t)); 731 ADD_MEM(dptr, &tid->at_addr[2], sizeof(u_int32_t)); 732 ADD_MEM(dptr, &tid->at_addr[3], sizeof(u_int32_t)); 733 } 734 735 return (t); 736} 737 738token_t * 739au_to_process64_ex(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid, 740 gid_t rgid, pid_t pid, au_asid_t sid, au_tid_addr_t *tid) 741{ 742 token_t *t; 743 u_char *dptr = NULL; 744 745 if (tid->at_type == AU_IPv4) 746 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 747 7 * sizeof(u_int32_t) + sizeof(u_int64_t) + 748 2 * sizeof(u_int32_t)); 749 else if (tid->at_type == AU_IPv6) 750 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 751 7 * sizeof(u_int32_t) + sizeof(u_int64_t) + 752 5 * sizeof(u_int32_t)); 753 else 754 panic("au_to_process64_ex: invalidate at_type (%d)", 755 tid->at_type); 756 757 ADD_U_CHAR(dptr, AUT_PROCESS64_EX); 758 ADD_U_INT32(dptr, auid); 759 ADD_U_INT32(dptr, euid); 760 ADD_U_INT32(dptr, egid); 761 ADD_U_INT32(dptr, ruid); 762 ADD_U_INT32(dptr, rgid); 763 ADD_U_INT32(dptr, pid); 764 ADD_U_INT32(dptr, sid); 765 ADD_U_INT64(dptr, tid->at_port); 766 ADD_U_INT32(dptr, tid->at_type); 767 ADD_MEM(dptr, &tid->at_addr[0], sizeof(u_int32_t)); 768 if (tid->at_type == AU_IPv6) { 769 ADD_MEM(dptr, &tid->at_addr[1], sizeof(u_int32_t)); 770 ADD_MEM(dptr, &tid->at_addr[2], sizeof(u_int32_t)); 771 ADD_MEM(dptr, &tid->at_addr[3], sizeof(u_int32_t)); 772 } 773 774 return (t); 775} 776 777token_t * 778au_to_process_ex(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid, 779 gid_t rgid, pid_t pid, au_asid_t sid, au_tid_addr_t *tid) 780{ 781 782 return (au_to_process32_ex(auid, euid, egid, ruid, rgid, pid, sid, 783 tid)); 784} 785 786/* 787 * token ID 1 byte 788 * error status 1 byte 789 * return value 4 bytes/8 bytes (32-bit/64-bit value) 790 */ 791token_t * 792au_to_return32(char status, u_int32_t ret) 793{ 794 token_t *t; 795 u_char *dptr = NULL; 796 797 GET_TOKEN_AREA(t, dptr, 2 * sizeof(u_char) + sizeof(u_int32_t)); 798 799 ADD_U_CHAR(dptr, AUT_RETURN32); 800 ADD_U_CHAR(dptr, status); 801 ADD_U_INT32(dptr, ret); 802 803 return (t); 804} 805 806token_t * 807au_to_return64(char status, u_int64_t ret) 808{ 809 token_t *t; 810 u_char *dptr = NULL; 811 812 GET_TOKEN_AREA(t, dptr, 2 * sizeof(u_char) + sizeof(u_int64_t)); 813 814 ADD_U_CHAR(dptr, AUT_RETURN64); 815 ADD_U_CHAR(dptr, status); 816 ADD_U_INT64(dptr, ret); 817 818 return (t); 819} 820 821token_t * 822au_to_return(char status, u_int32_t ret) 823{ 824 825 return (au_to_return32(status, ret)); 826} 827 828/* 829 * token ID 1 byte 830 * sequence number 4 bytes 831 */ 832token_t * 833au_to_seq(long audit_count) 834{ 835 token_t *t; 836 u_char *dptr = NULL; 837 838 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int32_t)); 839 840 ADD_U_CHAR(dptr, AUT_SEQ); 841 ADD_U_INT32(dptr, audit_count); 842 843 return (t); 844} 845 846/* 847 * token ID 1 byte 848 * socket domain 2 bytes 849 * socket type 2 bytes 850 * address type 2 byte 851 * local port 2 bytes 852 * local address 4 bytes/16 bytes (IPv4/IPv6 address) 853 * remote port 2 bytes 854 * remote address 4 bytes/16 bytes (IPv4/IPv6 address) 855 * 856 * Domain and type arguments to this routine are assumed to already have been 857 * converted to the BSM constant space, so we don't do that here. 858 */ 859token_t * 860au_to_socket_ex(u_short so_domain, u_short so_type, 861 struct sockaddr *sa_local, struct sockaddr *sa_remote) 862{ 863 token_t *t; 864 u_char *dptr = NULL; 865 struct sockaddr_in *sin; 866 struct sockaddr_in6 *sin6; 867 868 if (so_domain == AF_INET) 869 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 870 5 * sizeof(u_int16_t) + 2 * sizeof(u_int32_t)); 871 else if (so_domain == AF_INET6) 872 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 873 5 * sizeof(u_int16_t) + 8 * sizeof(u_int32_t)); 874 else 875 return (NULL); 876 877 ADD_U_CHAR(dptr, AUT_SOCKET_EX); 878 ADD_U_INT16(dptr, au_domain_to_bsm(so_domain)); 879 ADD_U_INT16(dptr, au_socket_type_to_bsm(so_type)); 880 if (so_domain == AF_INET) { 881 ADD_U_INT16(dptr, AU_IPv4); 882 sin = (struct sockaddr_in *)sa_local; 883 ADD_MEM(dptr, &sin->sin_port, sizeof(uint16_t)); 884 ADD_MEM(dptr, &sin->sin_addr.s_addr, sizeof(uint32_t)); 885 sin = (struct sockaddr_in *)sa_remote; 886 ADD_MEM(dptr, &sin->sin_port, sizeof(uint16_t)); 887 ADD_MEM(dptr, &sin->sin_addr.s_addr, sizeof(uint32_t)); 888 } else { 889 ADD_U_INT16(dptr, AU_IPv6); 890 sin6 = (struct sockaddr_in6 *)sa_local; 891 ADD_MEM(dptr, &sin6->sin6_port, sizeof(uint16_t)); 892 ADD_MEM(dptr, &sin6->sin6_addr, 4 * sizeof(uint32_t)); 893 sin6 = (struct sockaddr_in6 *)sa_remote; 894 ADD_MEM(dptr, &sin6->sin6_port, sizeof(uint16_t)); 895 ADD_MEM(dptr, &sin6->sin6_addr, 4 * sizeof(uint32_t)); 896 } 897 898 return (t); 899} 900 901/* 902 * Kernel-specific version of the above function. 903 * 904 * XXXRW: Should now use au_to_socket_ex() here. 905 */ 906#ifdef _KERNEL 907token_t * 908kau_to_socket(struct socket_au_info *soi) 909{ 910 token_t *t; 911 u_char *dptr; 912 u_int16_t so_type; 913 914 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 2 * sizeof(u_int16_t) + 915 sizeof(u_int32_t) + sizeof(u_int16_t) + sizeof(u_int32_t)); 916 917 ADD_U_CHAR(dptr, AUT_SOCKET); 918 /* Coerce the socket type into a short value */ 919 so_type = soi->so_type; 920 ADD_U_INT16(dptr, so_type); 921 ADD_U_INT16(dptr, soi->so_lport); 922 ADD_U_INT32(dptr, soi->so_laddr); 923 ADD_U_INT16(dptr, soi->so_rport); 924 ADD_U_INT32(dptr, soi->so_raddr); 925 926 return (t); 927} 928#endif 929 930/* 931 * token ID 1 byte 932 * socket family 2 bytes
| 38 39#include <sys/types.h> 40#include <sys/endian.h> 41#include <sys/queue.h> 42#include <sys/socket.h> 43#include <sys/time.h> 44 45#include <sys/ipc.h> 46#include <sys/libkern.h> 47#include <sys/malloc.h> 48#include <sys/un.h> 49 50#include <netinet/in.h> 51#include <netinet/in_systm.h> 52#include <netinet/ip.h> 53 54 55#include <bsm/audit.h> 56#include <bsm/audit_internal.h> 57#include <bsm/audit_record.h> 58#include <security/audit/audit.h> 59#include <security/audit/audit_private.h> 60 61#define GET_TOKEN_AREA(t, dptr, length) do { \ 62 t = malloc(sizeof(token_t), M_AUDITBSM, M_WAITOK); \ 63 t->t_data = malloc(length, M_AUDITBSM, M_WAITOK | M_ZERO); \ 64 t->len = length; \ 65 dptr = t->t_data; \ 66} while (0) 67 68/* 69 * token ID 1 byte 70 * argument # 1 byte 71 * argument value 4 bytes/8 bytes (32-bit/64-bit value) 72 * text length 2 bytes 73 * text N bytes + 1 terminating NULL byte 74 */ 75token_t * 76au_to_arg32(char n, const char *text, u_int32_t v) 77{ 78 token_t *t; 79 u_char *dptr = NULL; 80 u_int16_t textlen; 81 82 textlen = strlen(text); 83 textlen += 1; 84 85 GET_TOKEN_AREA(t, dptr, 2 * sizeof(u_char) + sizeof(u_int32_t) + 86 sizeof(u_int16_t) + textlen); 87 88 ADD_U_CHAR(dptr, AUT_ARG32); 89 ADD_U_CHAR(dptr, n); 90 ADD_U_INT32(dptr, v); 91 ADD_U_INT16(dptr, textlen); 92 ADD_STRING(dptr, text, textlen); 93 94 return (t); 95} 96 97token_t * 98au_to_arg64(char n, const char *text, u_int64_t v) 99{ 100 token_t *t; 101 u_char *dptr = NULL; 102 u_int16_t textlen; 103 104 textlen = strlen(text); 105 textlen += 1; 106 107 GET_TOKEN_AREA(t, dptr, 2 * sizeof(u_char) + sizeof(u_int64_t) + 108 sizeof(u_int16_t) + textlen); 109 110 ADD_U_CHAR(dptr, AUT_ARG64); 111 ADD_U_CHAR(dptr, n); 112 ADD_U_INT64(dptr, v); 113 ADD_U_INT16(dptr, textlen); 114 ADD_STRING(dptr, text, textlen); 115 116 return (t); 117} 118 119token_t * 120au_to_arg(char n, const char *text, u_int32_t v) 121{ 122 123 return (au_to_arg32(n, text, v)); 124} 125 126#if defined(_KERNEL) || defined(KERNEL) 127/* 128 * token ID 1 byte 129 * file access mode 4 bytes 130 * owner user ID 4 bytes 131 * owner group ID 4 bytes 132 * file system ID 4 bytes 133 * node ID 8 bytes 134 * device 4 bytes/8 bytes (32-bit/64-bit) 135 */ 136token_t * 137au_to_attr32(struct vnode_au_info *vni) 138{ 139 token_t *t; 140 u_char *dptr = NULL; 141 u_int16_t pad0_16 = 0; 142 u_int32_t pad0_32 = 0; 143 144 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 2 * sizeof(u_int16_t) + 145 3 * sizeof(u_int32_t) + sizeof(u_int64_t) + sizeof(u_int32_t)); 146 147 ADD_U_CHAR(dptr, AUT_ATTR32); 148 149 /* 150 * BSD defines the size for the file mode as 2 bytes; BSM defines 4 151 * so pad with 0. 152 * 153 * XXXRW: Possibly should be conditionally compiled. 154 * 155 * XXXRW: Should any conversions take place on the mode? 156 */ 157 ADD_U_INT16(dptr, pad0_16); 158 ADD_U_INT16(dptr, vni->vn_mode); 159 160 ADD_U_INT32(dptr, vni->vn_uid); 161 ADD_U_INT32(dptr, vni->vn_gid); 162 ADD_U_INT32(dptr, vni->vn_fsid); 163 164 /* 165 * Some systems use 32-bit file ID's, others use 64-bit file IDs. 166 * Attempt to handle both, and let the compiler sort it out. If we 167 * could pick this out at compile-time, it would be better, so as to 168 * avoid the else case below. 169 */ 170 if (sizeof(vni->vn_fileid) == sizeof(uint32_t)) { 171 ADD_U_INT32(dptr, pad0_32); 172 ADD_U_INT32(dptr, vni->vn_fileid); 173 } else if (sizeof(vni->vn_fileid) == sizeof(uint64_t)) 174 ADD_U_INT64(dptr, vni->vn_fileid); 175 else 176 ADD_U_INT64(dptr, 0LL); 177 178 ADD_U_INT32(dptr, vni->vn_dev); 179 180 return (t); 181} 182 183token_t * 184au_to_attr64(struct vnode_au_info *vni) 185{ 186 token_t *t; 187 u_char *dptr = NULL; 188 u_int16_t pad0_16 = 0; 189 u_int32_t pad0_32 = 0; 190 191 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 2 * sizeof(u_int16_t) + 192 3 * sizeof(u_int32_t) + sizeof(u_int64_t) * 2); 193 194 ADD_U_CHAR(dptr, AUT_ATTR64); 195 196 /* 197 * BSD defines the size for the file mode as 2 bytes; BSM defines 4 198 * so pad with 0. 199 * 200 * XXXRW: Possibly should be conditionally compiled. 201 * 202 * XXXRW: Should any conversions take place on the mode? 203 */ 204 ADD_U_INT16(dptr, pad0_16); 205 ADD_U_INT16(dptr, vni->vn_mode); 206 207 ADD_U_INT32(dptr, vni->vn_uid); 208 ADD_U_INT32(dptr, vni->vn_gid); 209 ADD_U_INT32(dptr, vni->vn_fsid); 210 211 /* 212 * Some systems use 32-bit file ID's, other's use 64-bit file IDs. 213 * Attempt to handle both, and let the compiler sort it out. If we 214 * could pick this out at compile-time, it would be better, so as to 215 * avoid the else case below. 216 */ 217 if (sizeof(vni->vn_fileid) == sizeof(uint32_t)) { 218 ADD_U_INT32(dptr, pad0_32); 219 ADD_U_INT32(dptr, vni->vn_fileid); 220 } else if (sizeof(vni->vn_fileid) == sizeof(uint64_t)) 221 ADD_U_INT64(dptr, vni->vn_fileid); 222 else 223 ADD_U_INT64(dptr, 0LL); 224 225 ADD_U_INT64(dptr, vni->vn_dev); 226 227 return (t); 228} 229 230token_t * 231au_to_attr(struct vnode_au_info *vni) 232{ 233 234 return (au_to_attr32(vni)); 235} 236#endif /* !(defined(_KERNEL) || defined(KERNEL) */ 237 238/* 239 * token ID 1 byte 240 * how to print 1 byte 241 * basic unit 1 byte 242 * unit count 1 byte 243 * data items (depends on basic unit) 244 */ 245token_t * 246au_to_data(char unit_print, char unit_type, char unit_count, const char *p) 247{ 248 token_t *t; 249 u_char *dptr = NULL; 250 size_t datasize, totdata; 251 252 /* Determine the size of the basic unit. */ 253 switch (unit_type) { 254 case AUR_BYTE: 255 /* case AUR_CHAR: */ 256 datasize = AUR_BYTE_SIZE; 257 break; 258 259 case AUR_SHORT: 260 datasize = AUR_SHORT_SIZE; 261 break; 262 263 case AUR_INT32: 264 /* case AUR_INT: */ 265 datasize = AUR_INT32_SIZE; 266 break; 267 268 case AUR_INT64: 269 datasize = AUR_INT64_SIZE; 270 break; 271 272 default: 273 return (NULL); 274 } 275 276 totdata = datasize * unit_count; 277 278 GET_TOKEN_AREA(t, dptr, 4 * sizeof(u_char) + totdata); 279 280 /* 281 * XXXRW: We should be byte-swapping each data item for multi-byte 282 * types. 283 */ 284 ADD_U_CHAR(dptr, AUT_DATA); 285 ADD_U_CHAR(dptr, unit_print); 286 ADD_U_CHAR(dptr, unit_type); 287 ADD_U_CHAR(dptr, unit_count); 288 ADD_MEM(dptr, p, totdata); 289 290 return (t); 291} 292 293 294/* 295 * token ID 1 byte 296 * status 4 bytes 297 * return value 4 bytes 298 */ 299token_t * 300au_to_exit(int retval, int err) 301{ 302 token_t *t; 303 u_char *dptr = NULL; 304 305 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 2 * sizeof(u_int32_t)); 306 307 ADD_U_CHAR(dptr, AUT_EXIT); 308 ADD_U_INT32(dptr, err); 309 ADD_U_INT32(dptr, retval); 310 311 return (t); 312} 313 314/* 315 */ 316token_t * 317au_to_groups(int *groups) 318{ 319 320 return (au_to_newgroups(AUDIT_MAX_GROUPS, (gid_t *)groups)); 321} 322 323/* 324 * token ID 1 byte 325 * number groups 2 bytes 326 * group list count * 4 bytes 327 */ 328token_t * 329au_to_newgroups(u_int16_t n, gid_t *groups) 330{ 331 token_t *t; 332 u_char *dptr = NULL; 333 int i; 334 335 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t) + 336 n * sizeof(u_int32_t)); 337 338 ADD_U_CHAR(dptr, AUT_NEWGROUPS); 339 ADD_U_INT16(dptr, n); 340 for (i = 0; i < n; i++) 341 ADD_U_INT32(dptr, groups[i]); 342 343 return (t); 344} 345 346/* 347 * token ID 1 byte 348 * internet address 4 bytes 349 */ 350token_t * 351au_to_in_addr(struct in_addr *internet_addr) 352{ 353 token_t *t; 354 u_char *dptr = NULL; 355 356 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(uint32_t)); 357 358 ADD_U_CHAR(dptr, AUT_IN_ADDR); 359 ADD_MEM(dptr, &internet_addr->s_addr, sizeof(uint32_t)); 360 361 return (t); 362} 363 364/* 365 * token ID 1 byte 366 * address type/length 4 bytes 367 * address 16 bytes 368 */ 369token_t * 370au_to_in_addr_ex(struct in6_addr *internet_addr) 371{ 372 token_t *t; 373 u_char *dptr = NULL; 374 u_int32_t type = AU_IPv6; 375 376 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 5 * sizeof(uint32_t)); 377 378 ADD_U_CHAR(dptr, AUT_IN_ADDR_EX); 379 ADD_U_INT32(dptr, type); 380 ADD_MEM(dptr, internet_addr, 4 * sizeof(uint32_t)); 381 382 return (t); 383} 384 385/* 386 * token ID 1 byte 387 * ip header 20 bytes 388 * 389 * The IP header should be submitted in network byte order. 390 */ 391token_t * 392au_to_ip(struct ip *ip) 393{ 394 token_t *t; 395 u_char *dptr = NULL; 396 397 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(struct ip)); 398 399 ADD_U_CHAR(dptr, AUT_IP); 400 ADD_MEM(dptr, ip, sizeof(struct ip)); 401 402 return (t); 403} 404 405/* 406 * token ID 1 byte 407 * object ID type 1 byte 408 * object ID 4 bytes 409 */ 410token_t * 411au_to_ipc(char type, int id) 412{ 413 token_t *t; 414 u_char *dptr = NULL; 415 416 GET_TOKEN_AREA(t, dptr, 2 * sizeof(u_char) + sizeof(u_int32_t)); 417 418 ADD_U_CHAR(dptr, AUT_IPC); 419 ADD_U_CHAR(dptr, type); 420 ADD_U_INT32(dptr, id); 421 422 return (t); 423} 424 425/* 426 * token ID 1 byte 427 * owner user ID 4 bytes 428 * owner group ID 4 bytes 429 * creator user ID 4 bytes 430 * creator group ID 4 bytes 431 * access mode 4 bytes 432 * slot sequence # 4 bytes 433 * key 4 bytes 434 */ 435token_t * 436au_to_ipc_perm(struct ipc_perm *perm) 437{ 438 token_t *t; 439 u_char *dptr = NULL; 440 u_int16_t pad0 = 0; 441 442 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 12 * sizeof(u_int16_t) + 443 sizeof(u_int32_t)); 444 445 ADD_U_CHAR(dptr, AUT_IPC_PERM); 446 447 /* 448 * Systems vary significantly in what types they use in struct 449 * ipc_perm; at least a few still use 16-bit uid's and gid's, so 450 * allow for that, as BSM define 32-bit values here. 451 * Some systems define the sizes for ipc_perm members as 2 bytes; 452 * BSM defines 4 so pad with 0. 453 * 454 * XXXRW: Possibly shoulid be conditionally compiled, and more cases 455 * need to be handled. 456 */ 457 if (sizeof(perm->uid) != sizeof(u_int32_t)) { 458 ADD_U_INT16(dptr, pad0); 459 ADD_U_INT16(dptr, perm->uid); 460 ADD_U_INT16(dptr, pad0); 461 ADD_U_INT16(dptr, perm->gid); 462 ADD_U_INT16(dptr, pad0); 463 ADD_U_INT16(dptr, perm->cuid); 464 ADD_U_INT16(dptr, pad0); 465 ADD_U_INT16(dptr, perm->cgid); 466 } else { 467 ADD_U_INT32(dptr, perm->uid); 468 ADD_U_INT32(dptr, perm->gid); 469 ADD_U_INT32(dptr, perm->cuid); 470 ADD_U_INT32(dptr, perm->cgid); 471 } 472 473 ADD_U_INT16(dptr, pad0); 474 ADD_U_INT16(dptr, perm->mode); 475 476 ADD_U_INT16(dptr, pad0); 477 478 ADD_U_INT16(dptr, perm->seq); 479 480 ADD_U_INT32(dptr, perm->key); 481 482 return (t); 483} 484 485/* 486 * token ID 1 byte 487 * port IP address 2 bytes 488 */ 489token_t * 490au_to_iport(u_int16_t iport) 491{ 492 token_t *t; 493 u_char *dptr = NULL; 494 495 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t)); 496 497 ADD_U_CHAR(dptr, AUT_IPORT); 498 ADD_U_INT16(dptr, iport); 499 500 return (t); 501} 502 503/* 504 * token ID 1 byte 505 * size 2 bytes 506 * data size bytes 507 */ 508token_t * 509au_to_opaque(const char *data, u_int16_t bytes) 510{ 511 token_t *t; 512 u_char *dptr = NULL; 513 514 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t) + bytes); 515 516 ADD_U_CHAR(dptr, AUT_OPAQUE); 517 ADD_U_INT16(dptr, bytes); 518 ADD_MEM(dptr, data, bytes); 519 520 return (t); 521} 522 523/* 524 * token ID 1 byte 525 * seconds of time 4 bytes 526 * milliseconds of time 4 bytes 527 * file name len 2 bytes 528 * file pathname N bytes + 1 terminating NULL byte 529 */ 530token_t * 531au_to_file(const char *file, struct timeval tm) 532{ 533 token_t *t; 534 u_char *dptr = NULL; 535 u_int16_t filelen; 536 u_int32_t timems; 537 538 filelen = strlen(file); 539 filelen += 1; 540 541 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 2 * sizeof(u_int32_t) + 542 sizeof(u_int16_t) + filelen); 543 544 timems = tm.tv_usec/1000; 545 546 ADD_U_CHAR(dptr, AUT_OTHER_FILE32); 547 ADD_U_INT32(dptr, tm.tv_sec); 548 ADD_U_INT32(dptr, timems); /* We need time in ms. */ 549 ADD_U_INT16(dptr, filelen); 550 ADD_STRING(dptr, file, filelen); 551 552 return (t); 553} 554 555/* 556 * token ID 1 byte 557 * text length 2 bytes 558 * text N bytes + 1 terminating NULL byte 559 */ 560token_t * 561au_to_text(const char *text) 562{ 563 token_t *t; 564 u_char *dptr = NULL; 565 u_int16_t textlen; 566 567 textlen = strlen(text); 568 textlen += 1; 569 570 /* XXXRW: Should validate length against token size limit. */ 571 572 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t) + textlen); 573 574 ADD_U_CHAR(dptr, AUT_TEXT); 575 ADD_U_INT16(dptr, textlen); 576 ADD_STRING(dptr, text, textlen); 577 578 return (t); 579} 580 581/* 582 * token ID 1 byte 583 * path length 2 bytes 584 * path N bytes + 1 terminating NULL byte 585 */ 586token_t * 587au_to_path(const char *text) 588{ 589 token_t *t; 590 u_char *dptr = NULL; 591 u_int16_t textlen; 592 593 textlen = strlen(text); 594 textlen += 1; 595 596 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t) + textlen); 597 598 ADD_U_CHAR(dptr, AUT_PATH); 599 ADD_U_INT16(dptr, textlen); 600 ADD_STRING(dptr, text, textlen); 601 602 return (t); 603} 604 605/* 606 * token ID 1 byte 607 * audit ID 4 bytes 608 * effective user ID 4 bytes 609 * effective group ID 4 bytes 610 * real user ID 4 bytes 611 * real group ID 4 bytes 612 * process ID 4 bytes 613 * session ID 4 bytes 614 * terminal ID 615 * port ID 4 bytes/8 bytes (32-bit/64-bit value) 616 * machine address 4 bytes 617 */ 618token_t * 619au_to_process32(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid, gid_t rgid, 620 pid_t pid, au_asid_t sid, au_tid_t *tid) 621{ 622 token_t *t; 623 u_char *dptr = NULL; 624 625 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 9 * sizeof(u_int32_t)); 626 627 ADD_U_CHAR(dptr, AUT_PROCESS32); 628 ADD_U_INT32(dptr, auid); 629 ADD_U_INT32(dptr, euid); 630 ADD_U_INT32(dptr, egid); 631 ADD_U_INT32(dptr, ruid); 632 ADD_U_INT32(dptr, rgid); 633 ADD_U_INT32(dptr, pid); 634 ADD_U_INT32(dptr, sid); 635 ADD_U_INT32(dptr, tid->port); 636 637 /* 638 * Note: Solaris will write out IPv6 addresses here as a 32-bit 639 * address type and 16 bytes of address, but for IPv4 addresses it 640 * simply writes the 4-byte address directly. We support only IPv4 641 * addresses for process32 tokens. 642 */ 643 ADD_MEM(dptr, &tid->machine, sizeof(u_int32_t)); 644 645 return (t); 646} 647 648token_t * 649au_to_process64(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid, gid_t rgid, 650 pid_t pid, au_asid_t sid, au_tid_t *tid) 651{ 652 token_t *t; 653 u_char *dptr = NULL; 654 655 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 8 * sizeof(u_int32_t) + 656 sizeof(u_int64_t)); 657 658 ADD_U_CHAR(dptr, AUT_PROCESS64); 659 ADD_U_INT32(dptr, auid); 660 ADD_U_INT32(dptr, euid); 661 ADD_U_INT32(dptr, egid); 662 ADD_U_INT32(dptr, ruid); 663 ADD_U_INT32(dptr, rgid); 664 ADD_U_INT32(dptr, pid); 665 ADD_U_INT32(dptr, sid); 666 ADD_U_INT64(dptr, tid->port); 667 668 /* 669 * Note: Solaris will write out IPv6 addresses here as a 32-bit 670 * address type and 16 bytes of address, but for IPv4 addresses it 671 * simply writes the 4-byte address directly. We support only IPv4 672 * addresses for process64 tokens. 673 */ 674 ADD_MEM(dptr, &tid->machine, sizeof(u_int32_t)); 675 676 return (t); 677} 678 679token_t * 680au_to_process(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid, gid_t rgid, 681 pid_t pid, au_asid_t sid, au_tid_t *tid) 682{ 683 684 return (au_to_process32(auid, euid, egid, ruid, rgid, pid, sid, 685 tid)); 686} 687 688/* 689 * token ID 1 byte 690 * audit ID 4 bytes 691 * effective user ID 4 bytes 692 * effective group ID 4 bytes 693 * real user ID 4 bytes 694 * real group ID 4 bytes 695 * process ID 4 bytes 696 * session ID 4 bytes 697 * terminal ID 698 * port ID 4 bytes/8 bytes (32-bit/64-bit value) 699 * address type-len 4 bytes 700 * machine address 16 bytes 701 */ 702token_t * 703au_to_process32_ex(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid, 704 gid_t rgid, pid_t pid, au_asid_t sid, au_tid_addr_t *tid) 705{ 706 token_t *t; 707 u_char *dptr = NULL; 708 709 KASSERT((tid->at_type == AU_IPv4) || (tid->at_type == AU_IPv6), 710 ("au_to_process32_ex: type %u", (unsigned int)tid->at_type)); 711 if (tid->at_type == AU_IPv4) 712 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 713 10 * sizeof(u_int32_t)); 714 else 715 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 716 13 * sizeof(u_int32_t)); 717 718 ADD_U_CHAR(dptr, AUT_PROCESS32_EX); 719 ADD_U_INT32(dptr, auid); 720 ADD_U_INT32(dptr, euid); 721 ADD_U_INT32(dptr, egid); 722 ADD_U_INT32(dptr, ruid); 723 ADD_U_INT32(dptr, rgid); 724 ADD_U_INT32(dptr, pid); 725 ADD_U_INT32(dptr, sid); 726 ADD_U_INT32(dptr, tid->at_port); 727 ADD_U_INT32(dptr, tid->at_type); 728 ADD_MEM(dptr, &tid->at_addr[0], sizeof(u_int32_t)); 729 if (tid->at_type == AU_IPv6) { 730 ADD_MEM(dptr, &tid->at_addr[1], sizeof(u_int32_t)); 731 ADD_MEM(dptr, &tid->at_addr[2], sizeof(u_int32_t)); 732 ADD_MEM(dptr, &tid->at_addr[3], sizeof(u_int32_t)); 733 } 734 735 return (t); 736} 737 738token_t * 739au_to_process64_ex(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid, 740 gid_t rgid, pid_t pid, au_asid_t sid, au_tid_addr_t *tid) 741{ 742 token_t *t; 743 u_char *dptr = NULL; 744 745 if (tid->at_type == AU_IPv4) 746 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 747 7 * sizeof(u_int32_t) + sizeof(u_int64_t) + 748 2 * sizeof(u_int32_t)); 749 else if (tid->at_type == AU_IPv6) 750 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 751 7 * sizeof(u_int32_t) + sizeof(u_int64_t) + 752 5 * sizeof(u_int32_t)); 753 else 754 panic("au_to_process64_ex: invalidate at_type (%d)", 755 tid->at_type); 756 757 ADD_U_CHAR(dptr, AUT_PROCESS64_EX); 758 ADD_U_INT32(dptr, auid); 759 ADD_U_INT32(dptr, euid); 760 ADD_U_INT32(dptr, egid); 761 ADD_U_INT32(dptr, ruid); 762 ADD_U_INT32(dptr, rgid); 763 ADD_U_INT32(dptr, pid); 764 ADD_U_INT32(dptr, sid); 765 ADD_U_INT64(dptr, tid->at_port); 766 ADD_U_INT32(dptr, tid->at_type); 767 ADD_MEM(dptr, &tid->at_addr[0], sizeof(u_int32_t)); 768 if (tid->at_type == AU_IPv6) { 769 ADD_MEM(dptr, &tid->at_addr[1], sizeof(u_int32_t)); 770 ADD_MEM(dptr, &tid->at_addr[2], sizeof(u_int32_t)); 771 ADD_MEM(dptr, &tid->at_addr[3], sizeof(u_int32_t)); 772 } 773 774 return (t); 775} 776 777token_t * 778au_to_process_ex(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid, 779 gid_t rgid, pid_t pid, au_asid_t sid, au_tid_addr_t *tid) 780{ 781 782 return (au_to_process32_ex(auid, euid, egid, ruid, rgid, pid, sid, 783 tid)); 784} 785 786/* 787 * token ID 1 byte 788 * error status 1 byte 789 * return value 4 bytes/8 bytes (32-bit/64-bit value) 790 */ 791token_t * 792au_to_return32(char status, u_int32_t ret) 793{ 794 token_t *t; 795 u_char *dptr = NULL; 796 797 GET_TOKEN_AREA(t, dptr, 2 * sizeof(u_char) + sizeof(u_int32_t)); 798 799 ADD_U_CHAR(dptr, AUT_RETURN32); 800 ADD_U_CHAR(dptr, status); 801 ADD_U_INT32(dptr, ret); 802 803 return (t); 804} 805 806token_t * 807au_to_return64(char status, u_int64_t ret) 808{ 809 token_t *t; 810 u_char *dptr = NULL; 811 812 GET_TOKEN_AREA(t, dptr, 2 * sizeof(u_char) + sizeof(u_int64_t)); 813 814 ADD_U_CHAR(dptr, AUT_RETURN64); 815 ADD_U_CHAR(dptr, status); 816 ADD_U_INT64(dptr, ret); 817 818 return (t); 819} 820 821token_t * 822au_to_return(char status, u_int32_t ret) 823{ 824 825 return (au_to_return32(status, ret)); 826} 827 828/* 829 * token ID 1 byte 830 * sequence number 4 bytes 831 */ 832token_t * 833au_to_seq(long audit_count) 834{ 835 token_t *t; 836 u_char *dptr = NULL; 837 838 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int32_t)); 839 840 ADD_U_CHAR(dptr, AUT_SEQ); 841 ADD_U_INT32(dptr, audit_count); 842 843 return (t); 844} 845 846/* 847 * token ID 1 byte 848 * socket domain 2 bytes 849 * socket type 2 bytes 850 * address type 2 byte 851 * local port 2 bytes 852 * local address 4 bytes/16 bytes (IPv4/IPv6 address) 853 * remote port 2 bytes 854 * remote address 4 bytes/16 bytes (IPv4/IPv6 address) 855 * 856 * Domain and type arguments to this routine are assumed to already have been 857 * converted to the BSM constant space, so we don't do that here. 858 */ 859token_t * 860au_to_socket_ex(u_short so_domain, u_short so_type, 861 struct sockaddr *sa_local, struct sockaddr *sa_remote) 862{ 863 token_t *t; 864 u_char *dptr = NULL; 865 struct sockaddr_in *sin; 866 struct sockaddr_in6 *sin6; 867 868 if (so_domain == AF_INET) 869 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 870 5 * sizeof(u_int16_t) + 2 * sizeof(u_int32_t)); 871 else if (so_domain == AF_INET6) 872 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 873 5 * sizeof(u_int16_t) + 8 * sizeof(u_int32_t)); 874 else 875 return (NULL); 876 877 ADD_U_CHAR(dptr, AUT_SOCKET_EX); 878 ADD_U_INT16(dptr, au_domain_to_bsm(so_domain)); 879 ADD_U_INT16(dptr, au_socket_type_to_bsm(so_type)); 880 if (so_domain == AF_INET) { 881 ADD_U_INT16(dptr, AU_IPv4); 882 sin = (struct sockaddr_in *)sa_local; 883 ADD_MEM(dptr, &sin->sin_port, sizeof(uint16_t)); 884 ADD_MEM(dptr, &sin->sin_addr.s_addr, sizeof(uint32_t)); 885 sin = (struct sockaddr_in *)sa_remote; 886 ADD_MEM(dptr, &sin->sin_port, sizeof(uint16_t)); 887 ADD_MEM(dptr, &sin->sin_addr.s_addr, sizeof(uint32_t)); 888 } else { 889 ADD_U_INT16(dptr, AU_IPv6); 890 sin6 = (struct sockaddr_in6 *)sa_local; 891 ADD_MEM(dptr, &sin6->sin6_port, sizeof(uint16_t)); 892 ADD_MEM(dptr, &sin6->sin6_addr, 4 * sizeof(uint32_t)); 893 sin6 = (struct sockaddr_in6 *)sa_remote; 894 ADD_MEM(dptr, &sin6->sin6_port, sizeof(uint16_t)); 895 ADD_MEM(dptr, &sin6->sin6_addr, 4 * sizeof(uint32_t)); 896 } 897 898 return (t); 899} 900 901/* 902 * Kernel-specific version of the above function. 903 * 904 * XXXRW: Should now use au_to_socket_ex() here. 905 */ 906#ifdef _KERNEL 907token_t * 908kau_to_socket(struct socket_au_info *soi) 909{ 910 token_t *t; 911 u_char *dptr; 912 u_int16_t so_type; 913 914 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 2 * sizeof(u_int16_t) + 915 sizeof(u_int32_t) + sizeof(u_int16_t) + sizeof(u_int32_t)); 916 917 ADD_U_CHAR(dptr, AUT_SOCKET); 918 /* Coerce the socket type into a short value */ 919 so_type = soi->so_type; 920 ADD_U_INT16(dptr, so_type); 921 ADD_U_INT16(dptr, soi->so_lport); 922 ADD_U_INT32(dptr, soi->so_laddr); 923 ADD_U_INT16(dptr, soi->so_rport); 924 ADD_U_INT32(dptr, soi->so_raddr); 925 926 return (t); 927} 928#endif 929 930/* 931 * token ID 1 byte 932 * socket family 2 bytes
|
934 */ 935token_t * 936au_to_sock_unix(struct sockaddr_un *so) 937{ 938 token_t *t; 939 u_char *dptr; 940 941 GET_TOKEN_AREA(t, dptr, 3 * sizeof(u_char) + strlen(so->sun_path) + 1); 942 943 ADD_U_CHAR(dptr, AUT_SOCKUNIX); 944 /* BSM token has two bytes for family */ 945 ADD_U_CHAR(dptr, 0); 946 ADD_U_CHAR(dptr, so->sun_family); 947 ADD_STRING(dptr, so->sun_path, strlen(so->sun_path) + 1); 948 949 return (t); 950} 951 952/* 953 * token ID 1 byte 954 * socket family 2 bytes 955 * local port 2 bytes 956 * socket address 4 bytes 957 */ 958token_t * 959au_to_sock_inet32(struct sockaddr_in *so) 960{ 961 token_t *t; 962 u_char *dptr = NULL; 963 uint16_t family; 964 965 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 2 * sizeof(uint16_t) + 966 sizeof(uint32_t)); 967 968 ADD_U_CHAR(dptr, AUT_SOCKINET32); 969 /* 970 * BSM defines the family field as 16 bits, but many operating 971 * systems have an 8-bit sin_family field. Extend to 16 bits before 972 * writing into the token. Assume that both the port and the address 973 * in the sockaddr_in are already in network byte order, but family 974 * is in local byte order. 975 * 976 * XXXRW: Should a name space conversion be taking place on the value 977 * of sin_family? 978 */ 979 family = so->sin_family; 980 ADD_U_INT16(dptr, family); 981 ADD_MEM(dptr, &so->sin_port, sizeof(uint16_t)); 982 ADD_MEM(dptr, &so->sin_addr.s_addr, sizeof(uint32_t)); 983 984 return (t); 985} 986 987token_t * 988au_to_sock_inet128(struct sockaddr_in6 *so) 989{ 990 token_t *t; 991 u_char *dptr = NULL; 992 993 GET_TOKEN_AREA(t, dptr, 3 * sizeof(u_char) + sizeof(u_int16_t) + 994 4 * sizeof(u_int32_t)); 995 996 ADD_U_CHAR(dptr, AUT_SOCKINET128); 997 /* 998 * In BSD, sin6_family is one octet, but BSM defines the token to 999 * store two. So we copy in a 0 first. XXXRW: Possibly should be 1000 * conditionally compiled. 1001 */ 1002 ADD_U_CHAR(dptr, 0); 1003 ADD_U_CHAR(dptr, so->sin6_family); 1004 1005 ADD_U_INT16(dptr, so->sin6_port); 1006 ADD_MEM(dptr, &so->sin6_addr, 4 * sizeof(uint32_t)); 1007 1008 return (t); 1009} 1010 1011token_t * 1012au_to_sock_inet(struct sockaddr_in *so) 1013{ 1014 1015 return (au_to_sock_inet32(so)); 1016} 1017 1018/* 1019 * token ID 1 byte 1020 * audit ID 4 bytes 1021 * effective user ID 4 bytes 1022 * effective group ID 4 bytes 1023 * real user ID 4 bytes 1024 * real group ID 4 bytes 1025 * process ID 4 bytes 1026 * session ID 4 bytes 1027 * terminal ID 1028 * port ID 4 bytes/8 bytes (32-bit/64-bit value) 1029 * machine address 4 bytes 1030 */ 1031token_t * 1032au_to_subject32(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid, gid_t rgid, 1033 pid_t pid, au_asid_t sid, au_tid_t *tid) 1034{ 1035 token_t *t; 1036 u_char *dptr = NULL; 1037 1038 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 9 * sizeof(u_int32_t)); 1039 1040 ADD_U_CHAR(dptr, AUT_SUBJECT32); 1041 ADD_U_INT32(dptr, auid); 1042 ADD_U_INT32(dptr, euid); 1043 ADD_U_INT32(dptr, egid); 1044 ADD_U_INT32(dptr, ruid); 1045 ADD_U_INT32(dptr, rgid); 1046 ADD_U_INT32(dptr, pid); 1047 ADD_U_INT32(dptr, sid); 1048 ADD_U_INT32(dptr, tid->port); 1049 ADD_MEM(dptr, &tid->machine, sizeof(u_int32_t)); 1050 1051 return (t); 1052} 1053 1054token_t * 1055au_to_subject64(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid, gid_t rgid, 1056 pid_t pid, au_asid_t sid, au_tid_t *tid) 1057{ 1058 token_t *t; 1059 u_char *dptr = NULL; 1060 1061 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 7 * sizeof(u_int32_t) + 1062 sizeof(u_int64_t) + sizeof(u_int32_t)); 1063 1064 ADD_U_CHAR(dptr, AUT_SUBJECT64); 1065 ADD_U_INT32(dptr, auid); 1066 ADD_U_INT32(dptr, euid); 1067 ADD_U_INT32(dptr, egid); 1068 ADD_U_INT32(dptr, ruid); 1069 ADD_U_INT32(dptr, rgid); 1070 ADD_U_INT32(dptr, pid); 1071 ADD_U_INT32(dptr, sid); 1072 ADD_U_INT64(dptr, tid->port); 1073 ADD_MEM(dptr, &tid->machine, sizeof(u_int32_t)); 1074 1075 return (t); 1076} 1077 1078token_t * 1079au_to_subject(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid, gid_t rgid, 1080 pid_t pid, au_asid_t sid, au_tid_t *tid) 1081{ 1082 1083 return (au_to_subject32(auid, euid, egid, ruid, rgid, pid, sid, 1084 tid)); 1085} 1086 1087/* 1088 * token ID 1 byte 1089 * audit ID 4 bytes 1090 * effective user ID 4 bytes 1091 * effective group ID 4 bytes 1092 * real user ID 4 bytes 1093 * real group ID 4 bytes 1094 * process ID 4 bytes 1095 * session ID 4 bytes 1096 * terminal ID 1097 * port ID 4 bytes/8 bytes (32-bit/64-bit value) 1098 * address type/length 4 bytes 1099 * machine address 16 bytes 1100 */ 1101token_t * 1102au_to_subject32_ex(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid, 1103 gid_t rgid, pid_t pid, au_asid_t sid, au_tid_addr_t *tid) 1104{ 1105 token_t *t; 1106 u_char *dptr = NULL; 1107 1108 KASSERT((tid->at_type == AU_IPv4) || (tid->at_type == AU_IPv6), 1109 ("au_to_subject32_ex: type %u", (unsigned int)tid->at_type)); 1110 1111 if (tid->at_type == AU_IPv4) 1112 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 10 * 1113 sizeof(u_int32_t)); 1114 else 1115 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 13 * 1116 sizeof(u_int32_t)); 1117 1118 ADD_U_CHAR(dptr, AUT_SUBJECT32_EX); 1119 ADD_U_INT32(dptr, auid); 1120 ADD_U_INT32(dptr, euid); 1121 ADD_U_INT32(dptr, egid); 1122 ADD_U_INT32(dptr, ruid); 1123 ADD_U_INT32(dptr, rgid); 1124 ADD_U_INT32(dptr, pid); 1125 ADD_U_INT32(dptr, sid); 1126 ADD_U_INT32(dptr, tid->at_port); 1127 ADD_U_INT32(dptr, tid->at_type); 1128 if (tid->at_type == AU_IPv6) 1129 ADD_MEM(dptr, &tid->at_addr[0], 4 * sizeof(u_int32_t)); 1130 else 1131 ADD_MEM(dptr, &tid->at_addr[0], sizeof(u_int32_t)); 1132 1133 return (t); 1134} 1135 1136token_t * 1137au_to_subject64_ex(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid, 1138 gid_t rgid, pid_t pid, au_asid_t sid, au_tid_addr_t *tid) 1139{ 1140 token_t *t; 1141 u_char *dptr = NULL; 1142 1143 KASSERT((tid->at_type == AU_IPv4) || (tid->at_type == AU_IPv6), 1144 ("au_to_subject64_ex: type %u", (unsigned int)tid->at_type)); 1145 1146 if (tid->at_type == AU_IPv4) 1147 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 1148 7 * sizeof(u_int32_t) + sizeof(u_int64_t) + 1149 2 * sizeof(u_int32_t)); 1150 else 1151 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 1152 7 * sizeof(u_int32_t) + sizeof(u_int64_t) + 1153 5 * sizeof(u_int32_t)); 1154 1155 ADD_U_CHAR(dptr, AUT_SUBJECT64_EX); 1156 ADD_U_INT32(dptr, auid); 1157 ADD_U_INT32(dptr, euid); 1158 ADD_U_INT32(dptr, egid); 1159 ADD_U_INT32(dptr, ruid); 1160 ADD_U_INT32(dptr, rgid); 1161 ADD_U_INT32(dptr, pid); 1162 ADD_U_INT32(dptr, sid); 1163 ADD_U_INT64(dptr, tid->at_port); 1164 ADD_U_INT32(dptr, tid->at_type); 1165 if (tid->at_type == AU_IPv6) 1166 ADD_MEM(dptr, &tid->at_addr[0], 4 * sizeof(u_int32_t)); 1167 else 1168 ADD_MEM(dptr, &tid->at_addr[0], sizeof(u_int32_t)); 1169 1170 return (t); 1171} 1172 1173token_t * 1174au_to_subject_ex(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid, 1175 gid_t rgid, pid_t pid, au_asid_t sid, au_tid_addr_t *tid) 1176{ 1177 1178 return (au_to_subject32_ex(auid, euid, egid, ruid, rgid, pid, sid, 1179 tid)); 1180} 1181 1182#if !defined(_KERNEL) && !defined(KERNEL) && defined(HAVE_AUDIT_SYSCALLS) 1183/* 1184 * Collects audit information for the current process and creates a subject 1185 * token from it. 1186 */ 1187token_t * 1188au_to_me(void) 1189{ 1190 auditinfo_t auinfo;
| 934 */ 935token_t * 936au_to_sock_unix(struct sockaddr_un *so) 937{ 938 token_t *t; 939 u_char *dptr; 940 941 GET_TOKEN_AREA(t, dptr, 3 * sizeof(u_char) + strlen(so->sun_path) + 1); 942 943 ADD_U_CHAR(dptr, AUT_SOCKUNIX); 944 /* BSM token has two bytes for family */ 945 ADD_U_CHAR(dptr, 0); 946 ADD_U_CHAR(dptr, so->sun_family); 947 ADD_STRING(dptr, so->sun_path, strlen(so->sun_path) + 1); 948 949 return (t); 950} 951 952/* 953 * token ID 1 byte 954 * socket family 2 bytes 955 * local port 2 bytes 956 * socket address 4 bytes 957 */ 958token_t * 959au_to_sock_inet32(struct sockaddr_in *so) 960{ 961 token_t *t; 962 u_char *dptr = NULL; 963 uint16_t family; 964 965 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 2 * sizeof(uint16_t) + 966 sizeof(uint32_t)); 967 968 ADD_U_CHAR(dptr, AUT_SOCKINET32); 969 /* 970 * BSM defines the family field as 16 bits, but many operating 971 * systems have an 8-bit sin_family field. Extend to 16 bits before 972 * writing into the token. Assume that both the port and the address 973 * in the sockaddr_in are already in network byte order, but family 974 * is in local byte order. 975 * 976 * XXXRW: Should a name space conversion be taking place on the value 977 * of sin_family? 978 */ 979 family = so->sin_family; 980 ADD_U_INT16(dptr, family); 981 ADD_MEM(dptr, &so->sin_port, sizeof(uint16_t)); 982 ADD_MEM(dptr, &so->sin_addr.s_addr, sizeof(uint32_t)); 983 984 return (t); 985} 986 987token_t * 988au_to_sock_inet128(struct sockaddr_in6 *so) 989{ 990 token_t *t; 991 u_char *dptr = NULL; 992 993 GET_TOKEN_AREA(t, dptr, 3 * sizeof(u_char) + sizeof(u_int16_t) + 994 4 * sizeof(u_int32_t)); 995 996 ADD_U_CHAR(dptr, AUT_SOCKINET128); 997 /* 998 * In BSD, sin6_family is one octet, but BSM defines the token to 999 * store two. So we copy in a 0 first. XXXRW: Possibly should be 1000 * conditionally compiled. 1001 */ 1002 ADD_U_CHAR(dptr, 0); 1003 ADD_U_CHAR(dptr, so->sin6_family); 1004 1005 ADD_U_INT16(dptr, so->sin6_port); 1006 ADD_MEM(dptr, &so->sin6_addr, 4 * sizeof(uint32_t)); 1007 1008 return (t); 1009} 1010 1011token_t * 1012au_to_sock_inet(struct sockaddr_in *so) 1013{ 1014 1015 return (au_to_sock_inet32(so)); 1016} 1017 1018/* 1019 * token ID 1 byte 1020 * audit ID 4 bytes 1021 * effective user ID 4 bytes 1022 * effective group ID 4 bytes 1023 * real user ID 4 bytes 1024 * real group ID 4 bytes 1025 * process ID 4 bytes 1026 * session ID 4 bytes 1027 * terminal ID 1028 * port ID 4 bytes/8 bytes (32-bit/64-bit value) 1029 * machine address 4 bytes 1030 */ 1031token_t * 1032au_to_subject32(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid, gid_t rgid, 1033 pid_t pid, au_asid_t sid, au_tid_t *tid) 1034{ 1035 token_t *t; 1036 u_char *dptr = NULL; 1037 1038 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 9 * sizeof(u_int32_t)); 1039 1040 ADD_U_CHAR(dptr, AUT_SUBJECT32); 1041 ADD_U_INT32(dptr, auid); 1042 ADD_U_INT32(dptr, euid); 1043 ADD_U_INT32(dptr, egid); 1044 ADD_U_INT32(dptr, ruid); 1045 ADD_U_INT32(dptr, rgid); 1046 ADD_U_INT32(dptr, pid); 1047 ADD_U_INT32(dptr, sid); 1048 ADD_U_INT32(dptr, tid->port); 1049 ADD_MEM(dptr, &tid->machine, sizeof(u_int32_t)); 1050 1051 return (t); 1052} 1053 1054token_t * 1055au_to_subject64(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid, gid_t rgid, 1056 pid_t pid, au_asid_t sid, au_tid_t *tid) 1057{ 1058 token_t *t; 1059 u_char *dptr = NULL; 1060 1061 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 7 * sizeof(u_int32_t) + 1062 sizeof(u_int64_t) + sizeof(u_int32_t)); 1063 1064 ADD_U_CHAR(dptr, AUT_SUBJECT64); 1065 ADD_U_INT32(dptr, auid); 1066 ADD_U_INT32(dptr, euid); 1067 ADD_U_INT32(dptr, egid); 1068 ADD_U_INT32(dptr, ruid); 1069 ADD_U_INT32(dptr, rgid); 1070 ADD_U_INT32(dptr, pid); 1071 ADD_U_INT32(dptr, sid); 1072 ADD_U_INT64(dptr, tid->port); 1073 ADD_MEM(dptr, &tid->machine, sizeof(u_int32_t)); 1074 1075 return (t); 1076} 1077 1078token_t * 1079au_to_subject(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid, gid_t rgid, 1080 pid_t pid, au_asid_t sid, au_tid_t *tid) 1081{ 1082 1083 return (au_to_subject32(auid, euid, egid, ruid, rgid, pid, sid, 1084 tid)); 1085} 1086 1087/* 1088 * token ID 1 byte 1089 * audit ID 4 bytes 1090 * effective user ID 4 bytes 1091 * effective group ID 4 bytes 1092 * real user ID 4 bytes 1093 * real group ID 4 bytes 1094 * process ID 4 bytes 1095 * session ID 4 bytes 1096 * terminal ID 1097 * port ID 4 bytes/8 bytes (32-bit/64-bit value) 1098 * address type/length 4 bytes 1099 * machine address 16 bytes 1100 */ 1101token_t * 1102au_to_subject32_ex(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid, 1103 gid_t rgid, pid_t pid, au_asid_t sid, au_tid_addr_t *tid) 1104{ 1105 token_t *t; 1106 u_char *dptr = NULL; 1107 1108 KASSERT((tid->at_type == AU_IPv4) || (tid->at_type == AU_IPv6), 1109 ("au_to_subject32_ex: type %u", (unsigned int)tid->at_type)); 1110 1111 if (tid->at_type == AU_IPv4) 1112 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 10 * 1113 sizeof(u_int32_t)); 1114 else 1115 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 13 * 1116 sizeof(u_int32_t)); 1117 1118 ADD_U_CHAR(dptr, AUT_SUBJECT32_EX); 1119 ADD_U_INT32(dptr, auid); 1120 ADD_U_INT32(dptr, euid); 1121 ADD_U_INT32(dptr, egid); 1122 ADD_U_INT32(dptr, ruid); 1123 ADD_U_INT32(dptr, rgid); 1124 ADD_U_INT32(dptr, pid); 1125 ADD_U_INT32(dptr, sid); 1126 ADD_U_INT32(dptr, tid->at_port); 1127 ADD_U_INT32(dptr, tid->at_type); 1128 if (tid->at_type == AU_IPv6) 1129 ADD_MEM(dptr, &tid->at_addr[0], 4 * sizeof(u_int32_t)); 1130 else 1131 ADD_MEM(dptr, &tid->at_addr[0], sizeof(u_int32_t)); 1132 1133 return (t); 1134} 1135 1136token_t * 1137au_to_subject64_ex(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid, 1138 gid_t rgid, pid_t pid, au_asid_t sid, au_tid_addr_t *tid) 1139{ 1140 token_t *t; 1141 u_char *dptr = NULL; 1142 1143 KASSERT((tid->at_type == AU_IPv4) || (tid->at_type == AU_IPv6), 1144 ("au_to_subject64_ex: type %u", (unsigned int)tid->at_type)); 1145 1146 if (tid->at_type == AU_IPv4) 1147 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 1148 7 * sizeof(u_int32_t) + sizeof(u_int64_t) + 1149 2 * sizeof(u_int32_t)); 1150 else 1151 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 1152 7 * sizeof(u_int32_t) + sizeof(u_int64_t) + 1153 5 * sizeof(u_int32_t)); 1154 1155 ADD_U_CHAR(dptr, AUT_SUBJECT64_EX); 1156 ADD_U_INT32(dptr, auid); 1157 ADD_U_INT32(dptr, euid); 1158 ADD_U_INT32(dptr, egid); 1159 ADD_U_INT32(dptr, ruid); 1160 ADD_U_INT32(dptr, rgid); 1161 ADD_U_INT32(dptr, pid); 1162 ADD_U_INT32(dptr, sid); 1163 ADD_U_INT64(dptr, tid->at_port); 1164 ADD_U_INT32(dptr, tid->at_type); 1165 if (tid->at_type == AU_IPv6) 1166 ADD_MEM(dptr, &tid->at_addr[0], 4 * sizeof(u_int32_t)); 1167 else 1168 ADD_MEM(dptr, &tid->at_addr[0], sizeof(u_int32_t)); 1169 1170 return (t); 1171} 1172 1173token_t * 1174au_to_subject_ex(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid, 1175 gid_t rgid, pid_t pid, au_asid_t sid, au_tid_addr_t *tid) 1176{ 1177 1178 return (au_to_subject32_ex(auid, euid, egid, ruid, rgid, pid, sid, 1179 tid)); 1180} 1181 1182#if !defined(_KERNEL) && !defined(KERNEL) && defined(HAVE_AUDIT_SYSCALLS) 1183/* 1184 * Collects audit information for the current process and creates a subject 1185 * token from it. 1186 */ 1187token_t * 1188au_to_me(void) 1189{ 1190 auditinfo_t auinfo;
|
1197} 1198#endif 1199 1200#if defined(_KERNEL) || defined(KERNEL) 1201static token_t * 1202au_to_exec_strings(char *strs, int count, u_char type) 1203{ 1204 token_t *t; 1205 u_char *dptr = NULL; 1206 u_int32_t totlen; 1207 int ctr; 1208 char *p; 1209 1210 totlen = 0; 1211 ctr = count; 1212 p = strs; 1213 while (ctr-- > 0) { 1214 totlen += strlen(p) + 1; 1215 p = strs + totlen; 1216 } 1217 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int32_t) + totlen); 1218 ADD_U_CHAR(dptr, type); 1219 ADD_U_INT32(dptr, count); 1220 ADD_STRING(dptr, strs, totlen); 1221 1222 return (t); 1223} 1224 1225/* 1226 * token ID 1 byte 1227 * count 4 bytes 1228 * text count null-terminated strings 1229 */ 1230token_t * 1231au_to_exec_args(char *args, int argc) 1232{ 1233 1234 return (au_to_exec_strings(args, argc, AUT_EXEC_ARGS)); 1235} 1236 1237/* 1238 * token ID 1 byte 1239 * count 4 bytes 1240 * text count null-terminated strings 1241 */ 1242token_t * 1243au_to_exec_env(char *envs, int envc) 1244{ 1245 1246 return (au_to_exec_strings(envs, envc, AUT_EXEC_ENV)); 1247} 1248#else 1249/* 1250 * token ID 1 byte 1251 * count 4 bytes 1252 * text count null-terminated strings 1253 */ 1254token_t * 1255au_to_exec_args(char **argv) 1256{ 1257 token_t *t; 1258 u_char *dptr = NULL; 1259 const char *nextarg; 1260 int i, count = 0; 1261 size_t totlen = 0; 1262 1263 nextarg = *argv; 1264 1265 while (nextarg != NULL) { 1266 int nextlen; 1267 1268 nextlen = strlen(nextarg); 1269 totlen += nextlen + 1; 1270 count++; 1271 nextarg = *(argv + count); 1272 } 1273 1274 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int32_t) + totlen); 1275 1276 ADD_U_CHAR(dptr, AUT_EXEC_ARGS); 1277 ADD_U_INT32(dptr, count); 1278 1279 for (i = 0; i < count; i++) { 1280 nextarg = *(argv + i); 1281 ADD_MEM(dptr, nextarg, strlen(nextarg) + 1); 1282 } 1283 1284 return (t); 1285} 1286 1287/* 1288 * token ID 1 byte 1289 * count 4 bytes 1290 * text count null-terminated strings 1291 */ 1292token_t * 1293au_to_exec_env(char **envp) 1294{ 1295 token_t *t; 1296 u_char *dptr = NULL; 1297 int i, count = 0; 1298 size_t totlen = 0; 1299 const char *nextenv; 1300 1301 nextenv = *envp; 1302 1303 while (nextenv != NULL) { 1304 int nextlen; 1305 1306 nextlen = strlen(nextenv); 1307 totlen += nextlen + 1; 1308 count++; 1309 nextenv = *(envp + count); 1310 } 1311 1312 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int32_t) + totlen); 1313 1314 ADD_U_CHAR(dptr, AUT_EXEC_ENV); 1315 ADD_U_INT32(dptr, count); 1316 1317 for (i = 0; i < count; i++) { 1318 nextenv = *(envp + i); 1319 ADD_MEM(dptr, nextenv, strlen(nextenv) + 1); 1320 } 1321 1322 return (t); 1323} 1324#endif 1325 1326/* 1327 * token ID 1 byte 1328 * zonename length 2 bytes 1329 * zonename N bytes + 1 terminating NULL byte 1330 */ 1331token_t * 1332au_to_zonename(const char *zonename) 1333{ 1334 u_char *dptr = NULL; 1335 u_int16_t textlen; 1336 token_t *t; 1337 1338 textlen = strlen(zonename) + 1; 1339 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t) + textlen); 1340 1341 ADD_U_CHAR(dptr, AUT_ZONENAME); 1342 ADD_U_INT16(dptr, textlen); 1343 ADD_STRING(dptr, zonename, textlen); 1344 return (t); 1345} 1346 1347/* 1348 * token ID 1 byte 1349 * record byte count 4 bytes 1350 * version # 1 byte [2] 1351 * event type 2 bytes 1352 * event modifier 2 bytes 1353 * seconds of time 4 bytes/8 bytes (32-bit/64-bit value) 1354 * milliseconds of time 4 bytes/8 bytes (32-bit/64-bit value) 1355 */ 1356token_t * 1357au_to_header32_tm(int rec_size, au_event_t e_type, au_emod_t e_mod, 1358 struct timeval tm) 1359{ 1360 token_t *t; 1361 u_char *dptr = NULL; 1362 u_int32_t timems; 1363 1364 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int32_t) + 1365 sizeof(u_char) + 2 * sizeof(u_int16_t) + 2 * sizeof(u_int32_t)); 1366 1367 ADD_U_CHAR(dptr, AUT_HEADER32); 1368 ADD_U_INT32(dptr, rec_size); 1369 ADD_U_CHAR(dptr, AUDIT_HEADER_VERSION_OPENBSM); 1370 ADD_U_INT16(dptr, e_type); 1371 ADD_U_INT16(dptr, e_mod); 1372 1373 timems = tm.tv_usec/1000; 1374 /* Add the timestamp */ 1375 ADD_U_INT32(dptr, tm.tv_sec); 1376 ADD_U_INT32(dptr, timems); /* We need time in ms. */ 1377 1378 return (t); 1379} 1380 1381/* 1382 * token ID 1 byte 1383 * record byte count 4 bytes 1384 * version # 1 byte [2] 1385 * event type 2 bytes 1386 * event modifier 2 bytes 1387 * address type/length 4 bytes 1388 * machine address 4 bytes/16 bytes (IPv4/IPv6 address) 1389 * seconds of time 4 bytes/8 bytes (32-bit/64-bit value) 1390 * milliseconds of time 4 bytes/8 bytes (32-bit/64-bit value) 1391 */ 1392token_t * 1393au_to_header32_ex_tm(int rec_size, au_event_t e_type, au_emod_t e_mod, 1394 struct timeval tm, struct auditinfo_addr *aia) 1395{ 1396 token_t *t; 1397 u_char *dptr = NULL; 1398 u_int32_t timems; 1399 au_tid_addr_t *tid; 1400 1401 tid = &aia->ai_termid; 1402 KASSERT(tid->at_type == AU_IPv4 || tid->at_type == AU_IPv6, 1403 ("au_to_header32_ex_tm: invalid address family")); 1404 1405 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int32_t) + 1406 sizeof(u_char) + 2 * sizeof(u_int16_t) + 3 * 1407 sizeof(u_int32_t) + tid->at_type); 1408 1409 ADD_U_CHAR(dptr, AUT_HEADER32_EX); 1410 ADD_U_INT32(dptr, rec_size); 1411 ADD_U_CHAR(dptr, AUDIT_HEADER_VERSION_OPENBSM); 1412 ADD_U_INT16(dptr, e_type); 1413 ADD_U_INT16(dptr, e_mod); 1414 1415 ADD_U_INT32(dptr, tid->at_type); 1416 if (tid->at_type == AU_IPv6) 1417 ADD_MEM(dptr, &tid->at_addr[0], 4 * sizeof(u_int32_t)); 1418 else 1419 ADD_MEM(dptr, &tid->at_addr[0], sizeof(u_int32_t)); 1420 timems = tm.tv_usec/1000; 1421 /* Add the timestamp */ 1422 ADD_U_INT32(dptr, tm.tv_sec); 1423 ADD_U_INT32(dptr, timems); /* We need time in ms. */ 1424 1425 return (t); 1426} 1427 1428token_t * 1429au_to_header64_tm(int rec_size, au_event_t e_type, au_emod_t e_mod, 1430 struct timeval tm) 1431{ 1432 token_t *t; 1433 u_char *dptr = NULL; 1434 u_int32_t timems; 1435 1436 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int32_t) + 1437 sizeof(u_char) + 2 * sizeof(u_int16_t) + 2 * sizeof(u_int64_t)); 1438 1439 ADD_U_CHAR(dptr, AUT_HEADER64); 1440 ADD_U_INT32(dptr, rec_size); 1441 ADD_U_CHAR(dptr, AUDIT_HEADER_VERSION_OPENBSM); 1442 ADD_U_INT16(dptr, e_type); 1443 ADD_U_INT16(dptr, e_mod); 1444 1445 timems = tm.tv_usec/1000; 1446 /* Add the timestamp */ 1447 ADD_U_INT64(dptr, tm.tv_sec); 1448 ADD_U_INT64(dptr, timems); /* We need time in ms. */ 1449 1450 return (t); 1451} 1452 1453#if !defined(KERNEL) && !defined(_KERNEL) 1454#ifdef HAVE_AUDIT_SYSCALLS 1455token_t * 1456au_to_header32_ex(int rec_size, au_event_t e_type, au_emod_t e_mod) 1457{ 1458 struct timeval tm; 1459 struct auditinfo_addr aia; 1460 1461 if (gettimeofday(&tm, NULL) == -1) 1462 return (NULL); 1463 if (audit_get_kaudit(&aia, sizeof(aia)) != 0) { 1464 if (errno != ENOSYS) 1465 return (NULL); 1466 return (au_to_header32_tm(rec_size, e_type, e_mod, tm)); 1467 } 1468 return (au_to_header32_ex_tm(rec_size, e_type, e_mod, tm, &aia)); 1469} 1470#endif /* HAVE_AUDIT_SYSCALLS */ 1471 1472token_t * 1473au_to_header32(int rec_size, au_event_t e_type, au_emod_t e_mod) 1474{ 1475 struct timeval tm; 1476 1477 if (gettimeofday(&tm, NULL) == -1) 1478 return (NULL); 1479 return (au_to_header32_tm(rec_size, e_type, e_mod, tm)); 1480} 1481 1482token_t * 1483au_to_header64(__unused int rec_size, __unused au_event_t e_type, 1484 __unused au_emod_t e_mod) 1485{ 1486 struct timeval tm; 1487 1488 if (gettimeofday(&tm, NULL) == -1) 1489 return (NULL); 1490 return (au_to_header64_tm(rec_size, e_type, e_mod, tm)); 1491} 1492 1493token_t * 1494au_to_header(int rec_size, au_event_t e_type, au_emod_t e_mod) 1495{ 1496 1497 return (au_to_header32(rec_size, e_type, e_mod)); 1498} 1499 1500#ifdef HAVE_AUDIT_SYSCALLS 1501token_t * 1502au_to_header_ex(int rec_size, au_event_t e_type, au_emod_t e_mod) 1503{ 1504 1505 return (au_to_header32_ex(rec_size, e_type, e_mod)); 1506} 1507#endif /* HAVE_AUDIT_SYSCALLS */ 1508#endif /* !defined(KERNEL) && !defined(_KERNEL) */ 1509 1510/* 1511 * token ID 1 byte 1512 * trailer magic number 2 bytes 1513 * record byte count 4 bytes 1514 */ 1515token_t * 1516au_to_trailer(int rec_size) 1517{ 1518 token_t *t; 1519 u_char *dptr = NULL; 1520 u_int16_t magic = AUT_TRAILER_MAGIC; 1521 1522 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t) + 1523 sizeof(u_int32_t)); 1524 1525 ADD_U_CHAR(dptr, AUT_TRAILER); 1526 ADD_U_INT16(dptr, magic); 1527 ADD_U_INT32(dptr, rec_size); 1528 1529 return (t); 1530}
| 1212} 1213#endif 1214 1215#if defined(_KERNEL) || defined(KERNEL) 1216static token_t * 1217au_to_exec_strings(char *strs, int count, u_char type) 1218{ 1219 token_t *t; 1220 u_char *dptr = NULL; 1221 u_int32_t totlen; 1222 int ctr; 1223 char *p; 1224 1225 totlen = 0; 1226 ctr = count; 1227 p = strs; 1228 while (ctr-- > 0) { 1229 totlen += strlen(p) + 1; 1230 p = strs + totlen; 1231 } 1232 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int32_t) + totlen); 1233 ADD_U_CHAR(dptr, type); 1234 ADD_U_INT32(dptr, count); 1235 ADD_STRING(dptr, strs, totlen); 1236 1237 return (t); 1238} 1239 1240/* 1241 * token ID 1 byte 1242 * count 4 bytes 1243 * text count null-terminated strings 1244 */ 1245token_t * 1246au_to_exec_args(char *args, int argc) 1247{ 1248 1249 return (au_to_exec_strings(args, argc, AUT_EXEC_ARGS)); 1250} 1251 1252/* 1253 * token ID 1 byte 1254 * count 4 bytes 1255 * text count null-terminated strings 1256 */ 1257token_t * 1258au_to_exec_env(char *envs, int envc) 1259{ 1260 1261 return (au_to_exec_strings(envs, envc, AUT_EXEC_ENV)); 1262} 1263#else 1264/* 1265 * token ID 1 byte 1266 * count 4 bytes 1267 * text count null-terminated strings 1268 */ 1269token_t * 1270au_to_exec_args(char **argv) 1271{ 1272 token_t *t; 1273 u_char *dptr = NULL; 1274 const char *nextarg; 1275 int i, count = 0; 1276 size_t totlen = 0; 1277 1278 nextarg = *argv; 1279 1280 while (nextarg != NULL) { 1281 int nextlen; 1282 1283 nextlen = strlen(nextarg); 1284 totlen += nextlen + 1; 1285 count++; 1286 nextarg = *(argv + count); 1287 } 1288 1289 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int32_t) + totlen); 1290 1291 ADD_U_CHAR(dptr, AUT_EXEC_ARGS); 1292 ADD_U_INT32(dptr, count); 1293 1294 for (i = 0; i < count; i++) { 1295 nextarg = *(argv + i); 1296 ADD_MEM(dptr, nextarg, strlen(nextarg) + 1); 1297 } 1298 1299 return (t); 1300} 1301 1302/* 1303 * token ID 1 byte 1304 * count 4 bytes 1305 * text count null-terminated strings 1306 */ 1307token_t * 1308au_to_exec_env(char **envp) 1309{ 1310 token_t *t; 1311 u_char *dptr = NULL; 1312 int i, count = 0; 1313 size_t totlen = 0; 1314 const char *nextenv; 1315 1316 nextenv = *envp; 1317 1318 while (nextenv != NULL) { 1319 int nextlen; 1320 1321 nextlen = strlen(nextenv); 1322 totlen += nextlen + 1; 1323 count++; 1324 nextenv = *(envp + count); 1325 } 1326 1327 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int32_t) + totlen); 1328 1329 ADD_U_CHAR(dptr, AUT_EXEC_ENV); 1330 ADD_U_INT32(dptr, count); 1331 1332 for (i = 0; i < count; i++) { 1333 nextenv = *(envp + i); 1334 ADD_MEM(dptr, nextenv, strlen(nextenv) + 1); 1335 } 1336 1337 return (t); 1338} 1339#endif 1340 1341/* 1342 * token ID 1 byte 1343 * zonename length 2 bytes 1344 * zonename N bytes + 1 terminating NULL byte 1345 */ 1346token_t * 1347au_to_zonename(const char *zonename) 1348{ 1349 u_char *dptr = NULL; 1350 u_int16_t textlen; 1351 token_t *t; 1352 1353 textlen = strlen(zonename) + 1; 1354 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t) + textlen); 1355 1356 ADD_U_CHAR(dptr, AUT_ZONENAME); 1357 ADD_U_INT16(dptr, textlen); 1358 ADD_STRING(dptr, zonename, textlen); 1359 return (t); 1360} 1361 1362/* 1363 * token ID 1 byte 1364 * record byte count 4 bytes 1365 * version # 1 byte [2] 1366 * event type 2 bytes 1367 * event modifier 2 bytes 1368 * seconds of time 4 bytes/8 bytes (32-bit/64-bit value) 1369 * milliseconds of time 4 bytes/8 bytes (32-bit/64-bit value) 1370 */ 1371token_t * 1372au_to_header32_tm(int rec_size, au_event_t e_type, au_emod_t e_mod, 1373 struct timeval tm) 1374{ 1375 token_t *t; 1376 u_char *dptr = NULL; 1377 u_int32_t timems; 1378 1379 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int32_t) + 1380 sizeof(u_char) + 2 * sizeof(u_int16_t) + 2 * sizeof(u_int32_t)); 1381 1382 ADD_U_CHAR(dptr, AUT_HEADER32); 1383 ADD_U_INT32(dptr, rec_size); 1384 ADD_U_CHAR(dptr, AUDIT_HEADER_VERSION_OPENBSM); 1385 ADD_U_INT16(dptr, e_type); 1386 ADD_U_INT16(dptr, e_mod); 1387 1388 timems = tm.tv_usec/1000; 1389 /* Add the timestamp */ 1390 ADD_U_INT32(dptr, tm.tv_sec); 1391 ADD_U_INT32(dptr, timems); /* We need time in ms. */ 1392 1393 return (t); 1394} 1395 1396/* 1397 * token ID 1 byte 1398 * record byte count 4 bytes 1399 * version # 1 byte [2] 1400 * event type 2 bytes 1401 * event modifier 2 bytes 1402 * address type/length 4 bytes 1403 * machine address 4 bytes/16 bytes (IPv4/IPv6 address) 1404 * seconds of time 4 bytes/8 bytes (32-bit/64-bit value) 1405 * milliseconds of time 4 bytes/8 bytes (32-bit/64-bit value) 1406 */ 1407token_t * 1408au_to_header32_ex_tm(int rec_size, au_event_t e_type, au_emod_t e_mod, 1409 struct timeval tm, struct auditinfo_addr *aia) 1410{ 1411 token_t *t; 1412 u_char *dptr = NULL; 1413 u_int32_t timems; 1414 au_tid_addr_t *tid; 1415 1416 tid = &aia->ai_termid; 1417 KASSERT(tid->at_type == AU_IPv4 || tid->at_type == AU_IPv6, 1418 ("au_to_header32_ex_tm: invalid address family")); 1419 1420 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int32_t) + 1421 sizeof(u_char) + 2 * sizeof(u_int16_t) + 3 * 1422 sizeof(u_int32_t) + tid->at_type); 1423 1424 ADD_U_CHAR(dptr, AUT_HEADER32_EX); 1425 ADD_U_INT32(dptr, rec_size); 1426 ADD_U_CHAR(dptr, AUDIT_HEADER_VERSION_OPENBSM); 1427 ADD_U_INT16(dptr, e_type); 1428 ADD_U_INT16(dptr, e_mod); 1429 1430 ADD_U_INT32(dptr, tid->at_type); 1431 if (tid->at_type == AU_IPv6) 1432 ADD_MEM(dptr, &tid->at_addr[0], 4 * sizeof(u_int32_t)); 1433 else 1434 ADD_MEM(dptr, &tid->at_addr[0], sizeof(u_int32_t)); 1435 timems = tm.tv_usec/1000; 1436 /* Add the timestamp */ 1437 ADD_U_INT32(dptr, tm.tv_sec); 1438 ADD_U_INT32(dptr, timems); /* We need time in ms. */ 1439 1440 return (t); 1441} 1442 1443token_t * 1444au_to_header64_tm(int rec_size, au_event_t e_type, au_emod_t e_mod, 1445 struct timeval tm) 1446{ 1447 token_t *t; 1448 u_char *dptr = NULL; 1449 u_int32_t timems; 1450 1451 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int32_t) + 1452 sizeof(u_char) + 2 * sizeof(u_int16_t) + 2 * sizeof(u_int64_t)); 1453 1454 ADD_U_CHAR(dptr, AUT_HEADER64); 1455 ADD_U_INT32(dptr, rec_size); 1456 ADD_U_CHAR(dptr, AUDIT_HEADER_VERSION_OPENBSM); 1457 ADD_U_INT16(dptr, e_type); 1458 ADD_U_INT16(dptr, e_mod); 1459 1460 timems = tm.tv_usec/1000; 1461 /* Add the timestamp */ 1462 ADD_U_INT64(dptr, tm.tv_sec); 1463 ADD_U_INT64(dptr, timems); /* We need time in ms. */ 1464 1465 return (t); 1466} 1467 1468#if !defined(KERNEL) && !defined(_KERNEL) 1469#ifdef HAVE_AUDIT_SYSCALLS 1470token_t * 1471au_to_header32_ex(int rec_size, au_event_t e_type, au_emod_t e_mod) 1472{ 1473 struct timeval tm; 1474 struct auditinfo_addr aia; 1475 1476 if (gettimeofday(&tm, NULL) == -1) 1477 return (NULL); 1478 if (audit_get_kaudit(&aia, sizeof(aia)) != 0) { 1479 if (errno != ENOSYS) 1480 return (NULL); 1481 return (au_to_header32_tm(rec_size, e_type, e_mod, tm)); 1482 } 1483 return (au_to_header32_ex_tm(rec_size, e_type, e_mod, tm, &aia)); 1484} 1485#endif /* HAVE_AUDIT_SYSCALLS */ 1486 1487token_t * 1488au_to_header32(int rec_size, au_event_t e_type, au_emod_t e_mod) 1489{ 1490 struct timeval tm; 1491 1492 if (gettimeofday(&tm, NULL) == -1) 1493 return (NULL); 1494 return (au_to_header32_tm(rec_size, e_type, e_mod, tm)); 1495} 1496 1497token_t * 1498au_to_header64(__unused int rec_size, __unused au_event_t e_type, 1499 __unused au_emod_t e_mod) 1500{ 1501 struct timeval tm; 1502 1503 if (gettimeofday(&tm, NULL) == -1) 1504 return (NULL); 1505 return (au_to_header64_tm(rec_size, e_type, e_mod, tm)); 1506} 1507 1508token_t * 1509au_to_header(int rec_size, au_event_t e_type, au_emod_t e_mod) 1510{ 1511 1512 return (au_to_header32(rec_size, e_type, e_mod)); 1513} 1514 1515#ifdef HAVE_AUDIT_SYSCALLS 1516token_t * 1517au_to_header_ex(int rec_size, au_event_t e_type, au_emod_t e_mod) 1518{ 1519 1520 return (au_to_header32_ex(rec_size, e_type, e_mod)); 1521} 1522#endif /* HAVE_AUDIT_SYSCALLS */ 1523#endif /* !defined(KERNEL) && !defined(_KERNEL) */ 1524 1525/* 1526 * token ID 1 byte 1527 * trailer magic number 2 bytes 1528 * record byte count 4 bytes 1529 */ 1530token_t * 1531au_to_trailer(int rec_size) 1532{ 1533 token_t *t; 1534 u_char *dptr = NULL; 1535 u_int16_t magic = AUT_TRAILER_MAGIC; 1536 1537 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t) + 1538 sizeof(u_int32_t)); 1539 1540 ADD_U_CHAR(dptr, AUT_TRAILER); 1541 ADD_U_INT16(dptr, magic); 1542 ADD_U_INT32(dptr, rec_size); 1543 1544 return (t); 1545}
|