security/audit/audit_arg.c

107 audit_arg_addr(struct kaudit_record *ar, user_addr_t addr)
111 	ar->k_ar.ar_arg_addr = addr;
117 		ARG_SET_VALID(ar, ARG_ADDR64);
119 		ARG_SET_VALID(ar, ARG_ADDR32);
123 audit_arg_exit(struct kaudit_record *ar, int status, int retval)
126 	ar->k_ar.ar_arg_exitstatus = status;
127 	ar->k_ar.ar_arg_exitretval = retval;
128 	ARG_SET_VALID(ar, ARG_EXIT);
132 audit_arg_len(struct kaudit_record *ar, user_size_t len)
135 	ar->k_ar.ar_arg_len = len;
136 	ARG_SET_VALID(ar, ARG_LEN);
140 audit_arg_fd(struct kaudit_record *ar, int fd)
143 	ar->k_ar.ar_arg_fd = fd;
144 	ARG_SET_VALID(ar, ARG_FD);
148 audit_arg_fflags(struct kaudit_record *ar, int fflags)
151 	ar->k_ar.ar_arg_fflags = fflags;
152 	ARG_SET_VALID(ar, ARG_FFLAGS);
156 audit_arg_gid(struct kaudit_record *ar, gid_t gid)
159 	ar->k_ar.ar_arg_gid = gid;
160 	ARG_SET_VALID(ar, ARG_GID);
164 audit_arg_uid(struct kaudit_record *ar, uid_t uid)
167 	ar->k_ar.ar_arg_uid = uid;
168 	ARG_SET_VALID(ar, ARG_UID);
172 audit_arg_egid(struct kaudit_record *ar, gid_t egid)
175 	ar->k_ar.ar_arg_egid = egid;
176 	ARG_SET_VALID(ar, ARG_EGID);
180 audit_arg_euid(struct kaudit_record *ar, uid_t euid)
183 	ar->k_ar.ar_arg_euid = euid;
184 	ARG_SET_VALID(ar, ARG_EUID);
188 audit_arg_rgid(struct kaudit_record *ar, gid_t rgid)
191 	ar->k_ar.ar_arg_rgid = rgid;
192 	ARG_SET_VALID(ar, ARG_RGID);
196 audit_arg_ruid(struct kaudit_record *ar, uid_t ruid)
199 	ar->k_ar.ar_arg_ruid = ruid;
200 	ARG_SET_VALID(ar, ARG_RUID);
204 audit_arg_sgid(struct kaudit_record *ar, gid_t sgid)
207 	ar->k_ar.ar_arg_sgid = sgid;
208 	ARG_SET_VALID(ar, ARG_SGID);
212 audit_arg_suid(struct kaudit_record *ar, uid_t suid)
215 	ar->k_ar.ar_arg_suid = suid;
216 	ARG_SET_VALID(ar, ARG_SUID);
220 audit_arg_groupset(struct kaudit_record *ar, gid_t *gidset, u_int gidset_size)
225 		ar->k_ar.ar_arg_groups.gidset[i] = gidset[i];
226 	ar->k_ar.ar_arg_groups.gidset_size = gidset_size;
227 	ARG_SET_VALID(ar, ARG_GROUPSET);
231 audit_arg_login(struct kaudit_record *ar, char *login)
234 	strlcpy(ar->k_ar.ar_arg_login, login, MAXLOGNAME);
235 	ARG_SET_VALID(ar, ARG_LOGIN);
239 audit_arg_ctlname(struct kaudit_record *ar, int *name, int namelen)
242 	bcopy(name, &ar->k_ar.ar_arg_ctlname, namelen * sizeof(int));
243 	ar->k_ar.ar_arg_len = namelen;
244 	ARG_SET_VALID(ar, ARG_CTLNAME | ARG_LEN);
248 audit_arg_mask(struct kaudit_record *ar, int mask)
251 	ar->k_ar.ar_arg_mask = mask;
252 	ARG_SET_VALID(ar, ARG_MASK);
256 audit_arg_mode(struct kaudit_record *ar, mode_t mode)
259 	ar->k_ar.ar_arg_mode = mode;
260 	ARG_SET_VALID(ar, ARG_MODE);
264 audit_arg_value32(struct kaudit_record *ar, uint32_t value32)
267 	ar->k_ar.ar_arg_value32 = value32;
268 	ARG_SET_VALID(ar, ARG_VALUE32);
272 audit_arg_value64(struct kaudit_record *ar, uint64_t value64)
275 	ar->k_ar.ar_arg_value64 = value64;
276 	ARG_SET_VALID(ar, ARG_VALUE64);
280 audit_arg_owner(struct kaudit_record *ar, uid_t uid, gid_t gid)
283 	ar->k_ar.ar_arg_uid = uid;
284 	ar->k_ar.ar_arg_gid = gid;
285 	ARG_SET_VALID(ar, ARG_UID | ARG_GID);
289 audit_arg_pid(struct kaudit_record *ar, pid_t pid)
292 	ar->k_ar.ar_arg_pid = pid;
293 	ARG_SET_VALID(ar, ARG_PID);
297 audit_arg_process(struct kaudit_record *ar, proc_t p)
307 	ar->k_ar.ar_arg_auid = my_cred->cr_audit.as_aia_p->ai_auid;
308 	ar->k_ar.ar_arg_asid = my_cred->cr_audit.as_aia_p->ai_asid;
310 	    &ar->k_ar.ar_arg_termid_addr, sizeof(au_tid_addr_t));
311 	ar->k_ar.ar_arg_euid = kauth_cred_getuid(my_cred);
312 	ar->k_ar.ar_arg_egid = kauth_cred_getgid(my_cred);
313 	ar->k_ar.ar_arg_ruid = kauth_cred_getruid(my_cred);
314 	ar->k_ar.ar_arg_rgid = kauth_cred_getrgid(my_cred);
316 	ar->k_ar.ar_arg_pid = p->p_pid;
317 	ARG_SET_VALID(ar, ARG_AUID | ARG_EUID | ARG_EGID | ARG_RUID |
322 audit_arg_signum(struct kaudit_record *ar, u_int signum)
325 	ar->k_ar.ar_arg_signum = signum;
326 	ARG_SET_VALID(ar, ARG_SIGNUM);
330 audit_arg_socket(struct kaudit_record *ar, int sodomain, int sotype,
334 	ar->k_ar.ar_arg_sockinfo.sai_domain = sodomain;
335 	ar->k_ar.ar_arg_sockinfo.sai_type = sotype;
336 	ar->k_ar.ar_arg_sockinfo.sai_protocol = soprotocol;
337 	ARG_SET_VALID(ar, ARG_SOCKINFO);
348 audit_arg_sockaddr(struct kaudit_record *ar, struct vnode *cwd_vp,
360 	bcopy(sa, &ar->k_ar.ar_arg_sockaddr, sa->sa_len);
363 		ARG_SET_VALID(ar, ARG_SADDRINET);
367 		ARG_SET_VALID(ar, ARG_SADDRINET6);
381 				audit_arg_upath(ar, cwd_vp, path, ARG_UPATH1);
383 				audit_arg_upath(ar, cwd_vp, sun->sun_path,
387 		ARG_SET_VALID(ar, ARG_SADDRUNIX);
394 audit_arg_auid(struct kaudit_record *ar, uid_t auid)
397 	ar->k_ar.ar_arg_auid = auid;
398 	ARG_SET_VALID(ar, ARG_AUID);
402 audit_arg_auditinfo(struct kaudit_record *ar, struct auditinfo *au_info)
405 	ar->k_ar.ar_arg_auid = au_info->ai_auid;
406 	ar->k_ar.ar_arg_asid = au_info->ai_asid;
407 	ar->k_ar.ar_arg_amask.am_success = au_info->ai_mask.am_success;
408 	ar->k_ar.ar_arg_amask.am_failure = au_info->ai_mask.am_failure;
409 	ar->k_ar.ar_arg_termid.port = au_info->ai_termid.port;
410 	ar->k_ar.ar_arg_termid.machine = au_info->ai_termid.machine;
411 	ARG_SET_VALID(ar, ARG_AUID | ARG_ASID | ARG_AMASK | ARG_TERMID);
415 audit_arg_auditinfo_addr(struct kaudit_record *ar,
419 	ar->k_ar.ar_arg_auid = au_info->ai_auid;
420 	ar->k_ar.ar_arg_asid = au_info->ai_asid;
421 	ar->k_ar.ar_arg_amask.am_success = au_info->ai_mask.am_success;
422 	ar->k_ar.ar_arg_amask.am_failure = au_info->ai_mask.am_failure;
423 	ar->k_ar.ar_arg_termid_addr.at_type = au_info->ai_termid.at_type;
424 	ar->k_ar.ar_arg_termid_addr.at_port = au_info->ai_termid.at_port;
425 	ar->k_ar.ar_arg_termid_addr.at_addr[0] = au_info->ai_termid.at_addr[0];
426 	ar->k_ar.ar_arg_termid_addr.at_addr[1] = au_info->ai_termid.at_addr[1];
427 	ar->k_ar.ar_arg_termid_addr.at_addr[2] = au_info->ai_termid.at_addr[2];
428 	ar->k_ar.ar_arg_termid_addr.at_addr[3] = au_info->ai_termid.at_addr[3];
429 	ARG_SET_VALID(ar, ARG_AUID | ARG_ASID | ARG_AMASK | ARG_TERMID_ADDR);
433 audit_arg_text(struct kaudit_record *ar, char *text)
439 	ar->k_ar.ar_valid_arg &= (ARG_ALL ^ ARG_TEXT);
443 	if (ar->k_ar.ar_arg_text == NULL)
444 		ar->k_ar.ar_arg_text = malloc(MAXPATHLEN, M_AUDITTEXT,
447 	strncpy(ar->k_ar.ar_arg_text, text, MAXPATHLEN);
448 	ARG_SET_VALID(ar, ARG_TEXT);
452 audit_arg_opaque(struct kaudit_record *ar, void *data, size_t size)
461 	if (ar->k_ar.ar_arg_opaque == NULL)
462 		ar->k_ar.ar_arg_opaque = malloc(size, M_AUDITDATA, M_WAITOK);
466 	memcpy(ar->k_ar.ar_arg_opaque, data, size);
467 	ar->k_ar.ar_arg_opq_size = (u_int16_t) size;
468 	ARG_SET_VALID(ar, ARG_OPAQUE);
472 audit_arg_data(struct kaudit_record *ar, void *data, size_t size, size_t number)
488 	if (ar->k_ar.ar_arg_data == NULL)
489 		ar->k_ar.ar_arg_data = malloc(sz, M_AUDITDATA, M_WAITOK);
493 	memcpy(ar->k_ar.ar_arg_data, data, sz);
497 		ar->k_ar.ar_arg_data_type = AUR_BYTE;
501 		ar->k_ar.ar_arg_data_type = AUR_SHORT;
505 		ar->k_ar.ar_arg_data_type = AUR_INT32;
509 		ar->k_ar.ar_arg_data_type = AUR_INT64;
513 		free(ar->k_ar.ar_arg_data, M_AUDITDATA);
514 		ar->k_ar.ar_arg_data = NULL;
518 	ar->k_ar.ar_arg_data_count = (u_char)number;
520 	ARG_SET_VALID(ar, ARG_DATA);
524 audit_arg_cmd(struct kaudit_record *ar, int cmd)
527 	ar->k_ar.ar_arg_cmd = cmd;
528 	ARG_SET_VALID(ar, ARG_CMD);
532 audit_arg_svipc_cmd(struct kaudit_record *ar, int cmd)
535 	ar->k_ar.ar_arg_svipc_cmd = cmd;
536 	ARG_SET_VALID(ar, ARG_SVIPC_CMD);
540 audit_arg_svipc_perm(struct kaudit_record *ar, struct ipc_perm *perm)
543 	bcopy(perm, &ar->k_ar.ar_arg_svipc_perm,
544 	    sizeof(ar->k_ar.ar_arg_svipc_perm));
545 	ARG_SET_VALID(ar, ARG_SVIPC_PERM);
549 audit_arg_svipc_id(struct kaudit_record *ar, int id)
552 	ar->k_ar.ar_arg_svipc_id = id;
553 	ARG_SET_VALID(ar, ARG_SVIPC_ID);
557 audit_arg_svipc_addr(struct kaudit_record *ar, user_addr_t addr)
560 	ar->k_ar.ar_arg_svipc_addr = addr;
561 	ARG_SET_VALID(ar, ARG_SVIPC_ADDR);
565 audit_arg_posix_ipc_perm(struct kaudit_record *ar, uid_t uid, gid_t gid,
569 	ar->k_ar.ar_arg_pipc_perm.pipc_uid = uid;
570 	ar->k_ar.ar_arg_pipc_perm.pipc_gid = gid;
571 	ar->k_ar.ar_arg_pipc_perm.pipc_mode = mode;
572 	ARG_SET_VALID(ar, ARG_POSIX_IPC_PERM);
576 audit_arg_auditon(struct kaudit_record *ar, union auditon_udata *udata)
579 	bcopy((void *)udata, &ar->k_ar.ar_arg_auditon,
580 	    sizeof(ar->k_ar.ar_arg_auditon));
581 	ARG_SET_VALID(ar, ARG_AUDITON);
589 audit_arg_file(struct kaudit_record *ar, __unused proc_t p,
600 		audit_arg_vnpath_withref(ar,
609 			ar->k_ar.ar_arg_sockinfo.sai_type =
611 			ar->k_ar.ar_arg_sockinfo.sai_domain =
613 			ar->k_ar.ar_arg_sockinfo.sai_protocol =
617 			    &ar->k_ar.ar_arg_sockinfo.sai_faddr;
621 			    &ar->k_ar.ar_arg_sockinfo.sai_laddr;
624 			ARG_SET_VALID(ar, ARG_SOCKINFO);
629 			ar->k_ar.ar_arg_sockinfo.sai_type =
631 			ar->k_ar.ar_arg_sockinfo.sai_domain =
633 			ar->k_ar.ar_arg_sockinfo.sai_protocol =
637 			    &ar->k_ar.ar_arg_sockinfo.sai_faddr;
641 			    &ar->k_ar.ar_arg_sockinfo.sai_laddr;
644 			ARG_SET_VALID(ar, ARG_SOCKINFO);
669 audit_arg_upath(struct kaudit_record *ar, struct vnode *cwd_vp, char *upath, u_int64_t flag)
680 		pathp = &ar->k_ar.ar_arg_upath1;
682 		pathp = &ar->k_ar.ar_arg_upath2;
690 		ARG_SET_VALID(ar, flag);
716 audit_arg_vnpath(struct kaudit_record *ar, struct vnode *vp, u_int64_t flags)
741 		ar->k_ar.ar_valid_arg &= (ARG_ALL ^ ARG_KPATH1);
742 		ar->k_ar.ar_valid_arg &= (ARG_ALL ^ ARG_VNODE1);
743 		pathp = &ar->k_ar.ar_arg_kpath1;
744 		vnp = &ar->k_ar.ar_arg_vnode1;
746 		vnode_mac_labelp = &ar->k_ar.ar_vnode1_mac_labels;
749 		ar->k_ar.ar_valid_arg &= (ARG_ALL ^ ARG_KPATH2);
750 		ar->k_ar.ar_valid_arg &= (ARG_ALL ^ ARG_VNODE2);
751 		pathp = &ar->k_ar.ar_arg_kpath2;
752 		vnp = &ar->k_ar.ar_arg_vnode2;
754 		vnode_mac_labelp = &ar->k_ar.ar_vnode2_mac_labels;
771 			ARG_SET_VALID(ar, ARG_KPATH1);
773 			ARG_SET_VALID(ar, ARG_KPATH2);
815 		ARG_SET_VALID(ar, ARG_VNODE1);
817 		ARG_SET_VALID(ar, ARG_VNODE2);
821 audit_arg_vnpath_withref(struct kaudit_record *ar, struct vnode *vp, u_int64_t flags)
825 	audit_arg_vnpath(ar, vp, flags);
830 audit_arg_mach_port1(struct kaudit_record *ar, mach_port_name_t port)
833 	ar->k_ar.ar_arg_mach_port1 = port;
834 	ARG_SET_VALID(ar, ARG_MACHPORT1);
838 audit_arg_mach_port2(struct kaudit_record *ar, mach_port_name_t port)
841 	ar->k_ar.ar_arg_mach_port2 = port;
842 	ARG_SET_VALID(ar, ARG_MACHPORT2);
850 audit_arg_argv(struct kaudit_record *ar, char *argv, int argc, int length)
856 	if (ar->k_ar.ar_arg_argv == NULL)
857 		ar->k_ar.ar_arg_argv = malloc(length, M_AUDITTEXT, M_WAITOK);
858 	bcopy(argv, ar->k_ar.ar_arg_argv, length);
859 	ar->k_ar.ar_arg_argc = argc;
860 	ARG_SET_VALID(ar, ARG_ARGV);
867 audit_arg_envv(struct kaudit_record *ar, char *envv, int envc, int length)
873 	if (ar->k_ar.ar_arg_envv == NULL)
874 		ar->k_ar.ar_arg_envv = malloc(length, M_AUDITTEXT, M_WAITOK);
875 	bcopy(envv, ar->k_ar.ar_arg_envv, length);
876 	ar->k_ar.ar_arg_envc = envc;
877 	ARG_SET_VALID(ar, ARG_ENVV);
886 audit_sysclose(struct kaudit_record *ar, proc_t p, int fd)
893 	audit_arg_fd(ar, fd);
898 	audit_arg_vnpath_withref(ar, (struct vnode *)fp->f_fglob->fg_data,