security/audit/audit_bsm_token.c

59 #define GET_TOKEN_AREA(t, dptr, length) do {				\
63 	dptr = t->t_data;						\
77 	u_char *dptr = NULL;
83 	GET_TOKEN_AREA(t, dptr, 2 * sizeof(u_char) + sizeof(u_int32_t) +
86 	ADD_U_CHAR(dptr, AUT_ARG32);
87 	ADD_U_CHAR(dptr, n);
88 	ADD_U_INT32(dptr, v);
89 	ADD_U_INT16(dptr, textlen);
90 	ADD_STRING(dptr, text, textlen);
99 	u_char *dptr = NULL;
105 	GET_TOKEN_AREA(t, dptr, 2 * sizeof(u_char) + sizeof(u_int64_t) +
108 	ADD_U_CHAR(dptr, AUT_ARG64);
109 	ADD_U_CHAR(dptr, n);
110 	ADD_U_INT64(dptr, v);
111 	ADD_U_INT16(dptr, textlen);
112 	ADD_STRING(dptr, text, textlen);
138 	u_char *dptr = NULL;
142 	GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 2 * sizeof(u_int16_t) +
145 	ADD_U_CHAR(dptr, AUT_ATTR32);
151 	ADD_U_INT16(dptr, pad0_16);
152 	ADD_U_INT16(dptr, vni->vn_mode);
154 	ADD_U_INT32(dptr, vni->vn_uid);
155 	ADD_U_INT32(dptr, vni->vn_gid);
156 	ADD_U_INT32(dptr, vni->vn_fsid);
165 		ADD_U_INT32(dptr, pad0_32);
166 		ADD_U_INT32(dptr, vni->vn_fileid);
168 		ADD_U_INT64(dptr, vni->vn_fileid);
170 		ADD_U_INT64(dptr, 0LL);
172 	ADD_U_INT32(dptr, vni->vn_dev);
181 	u_char *dptr = NULL;
185 	GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 2 * sizeof(u_int16_t) +
188 	ADD_U_CHAR(dptr, AUT_ATTR64);
194 	ADD_U_INT16(dptr, pad0_16);
195 	ADD_U_INT16(dptr, vni->vn_mode);
197 	ADD_U_INT32(dptr, vni->vn_uid);
198 	ADD_U_INT32(dptr, vni->vn_gid);
199 	ADD_U_INT32(dptr, vni->vn_fsid);
208 		ADD_U_INT32(dptr, pad0_32);
209 		ADD_U_INT32(dptr, vni->vn_fileid);
211 		ADD_U_INT64(dptr, vni->vn_fileid);
213 		ADD_U_INT64(dptr, 0LL);
215 	ADD_U_INT64(dptr, vni->vn_dev);
239 	u_char *dptr = NULL;
270 	GET_TOKEN_AREA(t, dptr, 4 * sizeof(u_char) + totdata);
272 	ADD_U_CHAR(dptr, AUT_DATA);
273 	ADD_U_CHAR(dptr, unit_print);
274 	ADD_U_CHAR(dptr, unit_type);
275 	ADD_U_CHAR(dptr, unit_count);
276 	ADD_MEM(dptr, p, totdata);
290 	u_char *dptr = NULL;
292 	GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 2 * sizeof(u_int32_t));
294 	ADD_U_CHAR(dptr, AUT_EXIT);
295 	ADD_U_INT32(dptr, err);
296 	ADD_U_INT32(dptr, retval);
319 	u_char *dptr = NULL;
322 	GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t) +
325 	ADD_U_CHAR(dptr, AUT_NEWGROUPS);
326 	ADD_U_INT16(dptr, n);
328 		ADD_U_INT32(dptr, groups[i]);
341 	u_char *dptr = NULL;
343 	GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(uint32_t));
345 	ADD_U_CHAR(dptr, AUT_IN_ADDR);
346 	ADD_MEM(dptr, &internet_addr->s_addr, sizeof(uint32_t));
360 	u_char *dptr = NULL;
363 	GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 5 * sizeof(uint32_t));
365 	ADD_U_CHAR(dptr, AUT_IN_ADDR_EX);
366 	ADD_U_INT32(dptr, type);
367 	ADD_MEM(dptr, internet_addr, 4 * sizeof(uint32_t));
382 	u_char *dptr = NULL;
384 	GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(struct ip));
386 	ADD_U_CHAR(dptr, AUT_IP);
387 	ADD_MEM(dptr, ip, sizeof(struct ip));
401 	u_char *dptr = NULL;
403 	GET_TOKEN_AREA(t, dptr, 2 * sizeof(u_char) + sizeof(u_int32_t));
405 	ADD_U_CHAR(dptr, AUT_IPC);
406 	ADD_U_CHAR(dptr, type);
407 	ADD_U_INT32(dptr, id);
426 	u_char *dptr = NULL;
432 	GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 12 * sizeof(u_int16_t) +
435 	ADD_U_CHAR(dptr, AUT_IPC_PERM);
441 	ADD_U_INT32(dptr, perm->uid);
442 	ADD_U_INT32(dptr, perm->gid);
443 	ADD_U_INT32(dptr, perm->cuid);
444 	ADD_U_INT32(dptr, perm->cgid);
446 	ADD_U_INT16(dptr, pad0);
447 	ADD_U_INT16(dptr, perm->mode);
449 	ADD_U_INT16(dptr, pad0);
450 	ADD_U_INT16(dptr, perm->_seq);
452 	ADD_U_INT16(dptr, pad0);
453 	ADD_U_INT16(dptr, perm->_key);
466 	u_char *dptr = NULL;
468 	GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t));
470 	ADD_U_CHAR(dptr, AUT_IPORT);
471 	ADD_U_INT16(dptr, iport);
485 	u_char *dptr = NULL;
487 	GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t) + bytes);
489 	ADD_U_CHAR(dptr, AUT_OPAQUE);
490 	ADD_U_INT16(dptr, bytes);
491 	ADD_MEM(dptr, data, bytes);
507 	u_char *dptr = NULL;
514 	GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 2 * sizeof(u_int32_t) +
519 	ADD_U_CHAR(dptr, AUT_OTHER_FILE32);
520 	ADD_U_INT32(dptr, tm.tv_sec);
521 	ADD_U_INT32(dptr, timems);	/* We need time in ms. */
522 	ADD_U_INT16(dptr, filelen);
523 	ADD_STRING(dptr, file, filelen);
537 	u_char *dptr = NULL;
543 	GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t) + textlen);
545 	ADD_U_CHAR(dptr, AUT_TEXT);
546 	ADD_U_INT16(dptr, textlen);
547 	ADD_STRING(dptr, text, textlen);
561 	u_char *dptr = NULL;
567 	GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t) + textlen);
569 	ADD_U_CHAR(dptr, AUT_PATH);
570 	ADD_U_INT16(dptr, textlen);
571 	ADD_STRING(dptr, text, textlen);
594 	u_char *dptr = NULL;
596 	GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 9 * sizeof(u_int32_t));
598 	ADD_U_CHAR(dptr, AUT_PROCESS32);
599 	ADD_U_INT32(dptr, auid);
600 	ADD_U_INT32(dptr, euid);
601 	ADD_U_INT32(dptr, egid);
602 	ADD_U_INT32(dptr, ruid);
603 	ADD_U_INT32(dptr, rgid);
604 	ADD_U_INT32(dptr, pid);
605 	ADD_U_INT32(dptr, sid);
606 	ADD_U_INT32(dptr, tid->port);
607 	ADD_MEM(dptr, &tid->machine, sizeof(u_int32_t));
617 	u_char *dptr = NULL;
619 	GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 8 * sizeof(u_int32_t) +
622 	ADD_U_CHAR(dptr, AUT_PROCESS64);
623 	ADD_U_INT32(dptr, auid);
624 	ADD_U_INT32(dptr, euid);
625 	ADD_U_INT32(dptr, egid);
626 	ADD_U_INT32(dptr, ruid);
627 	ADD_U_INT32(dptr, rgid);
628 	ADD_U_INT32(dptr, pid);
629 	ADD_U_INT32(dptr, sid);
630 	ADD_U_INT64(dptr, tid->port);
631 	ADD_MEM(dptr, &tid->machine, sizeof(u_int32_t));
664 	u_char *dptr = NULL;
669 		GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 13 *
672 		GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 10 *
675 	ADD_U_CHAR(dptr, AUT_PROCESS32_EX);
676 	ADD_U_INT32(dptr, auid);
677 	ADD_U_INT32(dptr, euid);
678 	ADD_U_INT32(dptr, egid);
679 	ADD_U_INT32(dptr, ruid);
680 	ADD_U_INT32(dptr, rgid);
681 	ADD_U_INT32(dptr, pid);
682 	ADD_U_INT32(dptr, sid);
683 	ADD_U_INT32(dptr, tid->at_port);
684 	ADD_U_INT32(dptr, tid->at_type);
686 		ADD_MEM(dptr, &tid->at_addr[0], 4 * sizeof(u_int32_t));
688 		ADD_MEM(dptr, &tid->at_addr[0], sizeof(u_int32_t));
698 	u_char *dptr = NULL;
701 		GET_TOKEN_AREA(t, dptr, sizeof(u_char) +
705 		GET_TOKEN_AREA(t, dptr, sizeof(u_char) +
712 	ADD_U_CHAR(dptr, AUT_PROCESS64_EX);
713 	ADD_U_INT32(dptr, auid);
714 	ADD_U_INT32(dptr, euid);
715 	ADD_U_INT32(dptr, egid);
716 	ADD_U_INT32(dptr, ruid);
717 	ADD_U_INT32(dptr, rgid);
718 	ADD_U_INT32(dptr, pid);
719 	ADD_U_INT32(dptr, sid);
720 	ADD_U_INT64(dptr, tid->at_port);
721 	ADD_U_INT32(dptr, tid->at_type);
722 	ADD_MEM(dptr, &tid->at_addr[0], sizeof(u_int32_t));
724 		ADD_MEM(dptr, &tid->at_addr[1], sizeof(u_int32_t));
725 		ADD_MEM(dptr, &tid->at_addr[2], sizeof(u_int32_t));
726 		ADD_MEM(dptr, &tid->at_addr[3], sizeof(u_int32_t));
750 	u_char *dptr = NULL;
752 	GET_TOKEN_AREA(t, dptr, 2 * sizeof(u_char) + sizeof(u_int32_t));
754 	ADD_U_CHAR(dptr, AUT_RETURN32);
755 	ADD_U_CHAR(dptr, status);
756 	ADD_U_INT32(dptr, ret);
765 	u_char *dptr = NULL;
767 	GET_TOKEN_AREA(t, dptr, 2 * sizeof(u_char) + sizeof(u_int64_t));
769 	ADD_U_CHAR(dptr, AUT_RETURN64);
770 	ADD_U_CHAR(dptr, status);
771 	ADD_U_INT64(dptr, ret);
791 	u_char *dptr = NULL;
793 	GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int32_t));
795 	ADD_U_CHAR(dptr, AUT_SEQ);
796 	ADD_U_INT32(dptr, (u_int32_t) audit_count);
816 	u_char *dptr = NULL;
821 		GET_TOKEN_AREA(t, dptr, sizeof(u_char) +
824 		GET_TOKEN_AREA(t, dptr, sizeof(u_char) +
829 	ADD_U_CHAR(dptr, AUT_SOCKET_EX);
830 	ADD_U_INT16(dptr, au_domain_to_bsm(so_domain));
831 	ADD_U_INT16(dptr, au_socket_type_to_bsm(so_type));
833 		ADD_U_INT16(dptr, AU_IPv4);
835 		ADD_MEM(dptr,  &sin->sin_port, sizeof(uint16_t));
836 		ADD_MEM(dptr, &sin->sin_addr.s_addr, sizeof(uint32_t));
838 		ADD_MEM(dptr, &sin->sin_port, sizeof(uint16_t));
839 		ADD_MEM(dptr, &sin->sin_addr.s_addr, sizeof(uint32_t));
841 		ADD_U_INT16(dptr, AU_IPv6);
843 		ADD_MEM(dptr, &sin6->sin6_port, sizeof(uint16_t));
844 		ADD_MEM(dptr, &sin6->sin6_addr, 4 * sizeof(uint32_t));
846 		ADD_MEM(dptr, &sin6->sin6_port, sizeof(uint16_t));
847 		ADD_MEM(dptr, &sin6->sin6_addr, 4 * sizeof(uint32_t));
862 	u_char *dptr;
875 	GET_TOKEN_AREA(t, dptr, 3 * sizeof(u_char) + slen + 1);
877 	ADD_U_CHAR(dptr, AUT_SOCKUNIX);
879 	ADD_U_CHAR(dptr, 0);
880 	ADD_U_CHAR(dptr, so->sun_family);
882 		ADD_MEM(dptr, so->sun_path, slen);
883 	ADD_U_CHAR(dptr, '\0'); /* make the path a null-terminated string */
898 	u_char *dptr = NULL;
900 	GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 2 * sizeof(uint16_t) +
903 	ADD_U_CHAR(dptr, AUT_SOCKINET32);
909 	ADD_U_INT16(dptr, au_domain_to_bsm(so->sin_family));
910 	ADD_MEM(dptr, &so->sin_port, sizeof(uint16_t));
911 	ADD_MEM(dptr, &so->sin_addr.s_addr, sizeof(uint32_t));
926 	u_char *dptr = NULL;
928 	GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 2 * sizeof(u_int16_t) +
931 	ADD_U_CHAR(dptr, AUT_SOCKINET128);
932 	ADD_U_INT16(dptr, au_domain_to_bsm(so->sin6_family));
934 	ADD_U_INT16(dptr, so->sin6_port);
935 	ADD_MEM(dptr, &so->sin6_addr, 4 * sizeof(uint32_t));
965 	u_char *dptr = NULL;
967 	GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 9 * sizeof(u_int32_t));
969 	ADD_U_CHAR(dptr, AUT_SUBJECT32);
970 	ADD_U_INT32(dptr, auid);
971 	ADD_U_INT32(dptr, euid);
972 	ADD_U_INT32(dptr, egid);
973 	ADD_U_INT32(dptr, ruid);
974 	ADD_U_INT32(dptr, rgid);
975 	ADD_U_INT32(dptr, pid);
976 	ADD_U_INT32(dptr, sid);
977 	ADD_U_INT32(dptr, tid->port);
978 	ADD_MEM(dptr, &tid->machine, sizeof(u_int32_t));
988 	u_char *dptr = NULL;
990 	GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 7 * sizeof(u_int32_t) +
993 	ADD_U_CHAR(dptr, AUT_SUBJECT64);
994 	ADD_U_INT32(dptr, auid);
995 	ADD_U_INT32(dptr, euid);
996 	ADD_U_INT32(dptr, egid);
997 	ADD_U_INT32(dptr, ruid);
998 	ADD_U_INT32(dptr, rgid);
999 	ADD_U_INT32(dptr, pid);
1000 	ADD_U_INT32(dptr, sid);
1001 	ADD_U_INT64(dptr, tid->port);
1002 	ADD_MEM(dptr, &tid->machine, sizeof(u_int32_t));
1035 	u_char *dptr = NULL;
1040 		GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 13 *
1043 		GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 10 *
1046 	ADD_U_CHAR(dptr, AUT_SUBJECT32_EX);
1047 	ADD_U_INT32(dptr, auid);
1048 	ADD_U_INT32(dptr, euid);
1049 	ADD_U_INT32(dptr, egid);
1050 	ADD_U_INT32(dptr, ruid);
1051 	ADD_U_INT32(dptr, rgid);
1052 	ADD_U_INT32(dptr, pid);
1053 	ADD_U_INT32(dptr, sid);
1054 	ADD_U_INT32(dptr, tid->at_port);
1055 	ADD_U_INT32(dptr, tid->at_type);
1057 		ADD_MEM(dptr, &tid->at_addr[0], 4 * sizeof(u_int32_t));
1059 		ADD_MEM(dptr, &tid->at_addr[0], sizeof(u_int32_t));
1069 	u_char *dptr = NULL;
1072 		GET_TOKEN_AREA(t, dptr, sizeof(u_char) +
1076 		GET_TOKEN_AREA(t, dptr, sizeof(u_char) +
1083 	ADD_U_CHAR(dptr, AUT_SUBJECT64_EX);
1084 	ADD_U_INT32(dptr, auid);
1085 	ADD_U_INT32(dptr, euid);
1086 	ADD_U_INT32(dptr, egid);
1087 	ADD_U_INT32(dptr, ruid);
1088 	ADD_U_INT32(dptr, rgid);
1089 	ADD_U_INT32(dptr, pid);
1090 	ADD_U_INT32(dptr, sid);
1091 	ADD_U_INT64(dptr, tid->at_port);
1092 	ADD_U_INT32(dptr, tid->at_type);
1094 		ADD_MEM(dptr, &tid->at_addr[0], 4 * sizeof(u_int32_t));
1096 		ADD_MEM(dptr, &tid->at_addr[0], sizeof(u_int32_t));
1133 	u_char *dptr = NULL;
1145 	GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int32_t) + totlen);
1146 	ADD_U_CHAR(dptr, type);
1147 	ADD_U_INT32(dptr, count);
1148 	ADD_STRING(dptr, strs, totlen);
1186 	u_char *dptr = NULL;
1203 	GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int32_t) + totlen);
1205 	ADD_U_CHAR(dptr, AUT_EXEC_ARGS);
1206 	ADD_U_INT32(dptr, count);
1210 		ADD_MEM(dptr, nextarg, strlen(nextarg) + 1);
1224 	u_char *dptr = NULL;
1230 	GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t) + textlen);
1231 	ADD_U_CHAR(dptr, AUT_ZONENAME);
1232 	ADD_U_INT16(dptr, textlen);
1233 	ADD_STRING(dptr, zonename, textlen);
1246 	u_char *dptr = NULL;
1262 	GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int32_t) + totlen);
1264 	ADD_U_CHAR(dptr, AUT_EXEC_ENV);
1265 	ADD_U_INT32(dptr, count);
1269 		ADD_MEM(dptr, nextenv, strlen(nextenv) + 1);
1292 	u_char *dptr = NULL;
1300 	GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int32_t) +
1304 	ADD_U_CHAR(dptr, AUT_HEADER32_EX);
1305 	ADD_U_INT32(dptr, rec_size);
1306 	ADD_U_CHAR(dptr, AUDIT_HEADER_VERSION_OPENBSM);
1307 	ADD_U_INT16(dptr, e_type);
1308 	ADD_U_INT16(dptr, e_mod);
1309 	ADD_U_INT32(dptr, tid->at_type);
1311 		ADD_MEM(dptr, &tid->at_addr[0], 4 * sizeof(u_int32_t));
1313 		ADD_MEM(dptr, &tid->at_addr[0], sizeof(u_int32_t));
1316 	ADD_U_INT32(dptr, tm.tv_sec);
1317 	ADD_U_INT32(dptr, timems);	/* We need time in ms. */
1335 	u_char *dptr = NULL;
1338 	GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int32_t) +
1341 	ADD_U_CHAR(dptr, AUT_HEADER32);
1342 	ADD_U_INT32(dptr, rec_size);
1343 	ADD_U_CHAR(dptr, AUDIT_HEADER_VERSION_OPENBSM);
1344 	ADD_U_INT16(dptr, e_type);
1345 	ADD_U_INT16(dptr, e_mod);
1349 	ADD_U_INT32(dptr, tm.tv_sec);
1350 	ADD_U_INT32(dptr, timems);	/* We need time in ms. */
1360 	u_char *dptr = NULL;
1363 	GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int32_t) +
1366 	ADD_U_CHAR(dptr, AUT_HEADER64);
1367 	ADD_U_INT32(dptr, rec_size);
1368 	ADD_U_CHAR(dptr, AUDIT_HEADER_VERSION_OPENBSM);
1369 	ADD_U_INT16(dptr, e_type);
1370 	ADD_U_INT16(dptr, e_mod);
1374 	ADD_U_INT64(dptr, tm.tv_sec);
1375 	ADD_U_INT64(dptr, timems);	/* We need time in ms. */
1389 	u_char *dptr = NULL;
1392 	GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t) +
1395 	ADD_U_CHAR(dptr, AUT_TRAILER);
1396 	ADD_U_INT16(dptr, magic);
1397 	ADD_U_INT32(dptr, rec_size);