security/audit/audit_pipe.c

173 #define	AUDIT_PIPE_LOCK(ap)		mtx_lock(&(ap)->ap_mtx)
174 #define	AUDIT_PIPE_LOCK_ASSERT(ap)	mtx_assert(&(ap)->ap_mtx, MA_OWNED)
175 #define	AUDIT_PIPE_LOCK_DESTROY(ap)	mtx_destroy(&(ap)->ap_mtx)
176 #define	AUDIT_PIPE_LOCK_INIT(ap)	mtx_init(&(ap)->ap_mtx, \
178 #define	AUDIT_PIPE_UNLOCK(ap)		mtx_unlock(&(ap)->ap_mtx)
179 #define	AUDIT_PIPE_MTX(ap)		(&(ap)->ap_mtx)
181 #define	AUDIT_PIPE_SX_LOCK_DESTROY(ap)	slck_destroy(&(ap)->ap_sx)
182 #define	AUDIT_PIPE_SX_LOCK_INIT(ap)	slck_init(&(ap)->ap_sx, "audit_pipe_sx")
183 #define	AUDIT_PIPE_SX_XLOCK_ASSERT(ap)	slck_assert(&(ap)->ap_sx, SA_XLOCKED)
184 #define	AUDIT_PIPE_SX_XLOCK_SIG(ap)	slck_lock_sig(&(ap)->ap_sx)
185 #define	AUDIT_PIPE_SX_XUNLOCK(ap)	slck_unlock(&(ap)->ap_sx)
269 audit_pipe_preselect_find(struct audit_pipe *ap, au_id_t auid)
273 	AUDIT_PIPE_LOCK_ASSERT(ap);
275 	TAILQ_FOREACH(app, &ap->ap_preselect_list, app_list) {
286 audit_pipe_preselect_get(struct audit_pipe *ap, au_id_t auid,
292 	AUDIT_PIPE_LOCK(ap);
293 	app = audit_pipe_preselect_find(ap, auid);
299 	AUDIT_PIPE_UNLOCK(ap);
308 audit_pipe_preselect_set(struct audit_pipe *ap, au_id_t auid, au_mask_t mask)
317 	AUDIT_PIPE_LOCK(ap);
318 	app = audit_pipe_preselect_find(ap, auid);
323 		TAILQ_INSERT_TAIL(&ap->ap_preselect_list, app, app_list);
326 	AUDIT_PIPE_UNLOCK(ap);
335 audit_pipe_preselect_delete(struct audit_pipe *ap, au_id_t auid)
340 	AUDIT_PIPE_LOCK(ap);
341 	app = audit_pipe_preselect_find(ap, auid);
343 		TAILQ_REMOVE(&ap->ap_preselect_list, app, app_list);
347 	AUDIT_PIPE_UNLOCK(ap);
357 audit_pipe_preselect_flush_locked(struct audit_pipe *ap)
361 	AUDIT_PIPE_LOCK_ASSERT(ap);
363 	while ((app = TAILQ_FIRST(&ap->ap_preselect_list)) != NULL) {
364 		TAILQ_REMOVE(&ap->ap_preselect_list, app, app_list);
370 audit_pipe_preselect_flush(struct audit_pipe *ap)
373 	AUDIT_PIPE_LOCK(ap);
374 	audit_pipe_preselect_flush_locked(ap);
375 	AUDIT_PIPE_UNLOCK(ap);
389 audit_pipe_preselect_check(struct audit_pipe *ap, au_id_t auid,
394 	AUDIT_PIPE_LOCK_ASSERT(ap);
396 	switch (ap->ap_preselect_mode) {
401 		app = audit_pipe_preselect_find(ap, auid);
405 				    &ap->ap_preselect_naflags, sorf));
408 				    &ap->ap_preselect_flags, sorf));
415 		    ap->ap_preselect_mode);
429 	struct audit_pipe *ap;
436 	TAILQ_FOREACH(ap, &audit_pipe_list, ap_list) {
437 		 AUDIT_PIPE_LOCK(ap);
438 		if (audit_pipe_preselect_check(ap, auid, event, class, sorf,
440 			AUDIT_PIPE_UNLOCK(ap);
444 		AUDIT_PIPE_UNLOCK(ap);
456 audit_pipe_append(struct audit_pipe *ap, void *record, u_int record_len)
460 	AUDIT_PIPE_LOCK_ASSERT(ap);
462 	if (ap->ap_qlen >= ap->ap_qlimit) {
463 		ap->ap_drops++;
470 		ap->ap_drops++;
478 		ap->ap_drops++;
486 	TAILQ_INSERT_TAIL(&ap->ap_queue, ape, ape_queue);
487 	ap->ap_inserts++;
488 	ap->ap_qlen++;
489 	ap->ap_qbyteslen += ape->ape_record_len;
490 	selwakeup(&ap->ap_selinfo);
491 	if (ap->ap_flags & AUDIT_PIPE_ASYNC)
492 		pgsigio(ap->ap_sigio, SIGIO);
494 	selwakeuppri(&ap->ap_selinfo, PSOCK);
495 	KNOTE_LOCKED(&ap->ap_selinfo.si_note, 0);
496 	if (ap->ap_flags & AUDIT_PIPE_ASYNC)
497 		pgsigio(&ap->ap_sigio, SIGIO, 0);
499 	cv_broadcast(&ap->ap_cv);
510 	struct audit_pipe *ap;
519 	TAILQ_FOREACH(ap, &audit_pipe_list, ap_list) {
520 		AUDIT_PIPE_LOCK(ap);
521 		if (audit_pipe_preselect_check(ap, auid, event, class, sorf,
523 			audit_pipe_append(ap, record, record_len);
524 		AUDIT_PIPE_UNLOCK(ap);
543 	struct audit_pipe *ap;
552 	TAILQ_FOREACH(ap, &audit_pipe_list, ap_list) {
553 		AUDIT_PIPE_LOCK(ap);
554 		audit_pipe_append(ap, record, record_len);
555 		AUDIT_PIPE_UNLOCK(ap);
570 	struct audit_pipe *ap;
574 	ap = malloc(sizeof(*ap), M_AUDIT_PIPE, M_WAITOK | M_ZERO);
575 	if (ap == NULL)
578 	ap->ap_qlimit = AUDIT_PIPE_QLIMIT_DEFAULT;
579 	TAILQ_INIT(&ap->ap_queue);
581 	knlist_init(&ap->ap_selinfo.si_note, AUDIT_PIPE_MTX(ap), NULL, NULL,
584 	AUDIT_PIPE_LOCK_INIT(ap);
585 	AUDIT_PIPE_SX_LOCK_INIT(ap);
586 	cv_init(&ap->ap_cv, "audit_pipe");
595 	bzero(&ap->ap_preselect_flags, sizeof(ap->ap_preselect_flags));
596 	bzero(&ap->ap_preselect_naflags, sizeof(ap->ap_preselect_naflags));
597 	TAILQ_INIT(&ap->ap_preselect_list);
598 	ap->ap_preselect_mode = AUDITPIPE_PRESELECT_MODE_TRAIL;
603 	TAILQ_INSERT_HEAD(&audit_pipe_list, ap, ap_list);
607 	return (ap);
614 audit_pipe_flush(struct audit_pipe *ap)
618 	AUDIT_PIPE_LOCK_ASSERT(ap);
620 	while ((ape = TAILQ_FIRST(&ap->ap_queue)) != NULL) {
621 		TAILQ_REMOVE(&ap->ap_queue, ape, ape_queue);
622 		ap->ap_qbyteslen -= ape->ape_record_len;
624 		ap->ap_qlen--;
626 	ap->ap_qoffset = 0;
628 	KASSERT(ap->ap_qlen == 0, ("audit_pipe_free: ap_qbyteslen"));
629 	KASSERT(ap->ap_qbyteslen == 0, ("audit_pipe_flush: ap_qbyteslen"));
639 audit_pipe_free(struct audit_pipe *ap)
643 	AUDIT_PIPE_LOCK_ASSERT(ap);
645 	audit_pipe_preselect_flush_locked(ap);
646 	audit_pipe_flush(ap);
647 	cv_destroy(&ap->ap_cv);
648 	AUDIT_PIPE_SX_LOCK_DESTROY(ap);
649 	AUDIT_PIPE_LOCK_DESTROY(ap);
651 	knlist_destroy(&ap->ap_selinfo.si_note);
653 	TAILQ_REMOVE(&audit_pipe_list, ap, ap_list);
654 	free(ap, M_AUDIT_PIPE);
692 	struct audit_pipe *ap;
700 	ap = audit_pipe_dtab[u];
701 	if (ap == NULL) {
702 		ap = audit_pipe_alloc();
703 		if (ap == NULL) {
707 		audit_pipe_dtab[u] = ap;
709 		KASSERT(ap->ap_open, ("audit_pipe_open: ap && !ap_open"));
713 	ap->ap_open = 1;
716 	fsetown(td->td_proc->p_pid, &ap->ap_sigio);
728 	struct audit_pipe *ap;
732 	ap = audit_pipe_dtab[u];
733 	KASSERT(ap != NULL, ("audit_pipe_close: ap == NULL"));
734 	KASSERT(ap->ap_open, ("audit_pipe_close: !ap_open"));
737 	funsetown(&ap->ap_sigio);
740 	AUDIT_PIPE_LOCK(ap);
741 	ap->ap_open = 0;
742 	audit_pipe_free(ap);
757 	struct audit_pipe *ap;
762 	ap = audit_pipe_dtab[minor(dev)];
763 	KASSERT(ap != NULL, ("audit_pipe_ioctl: ap == NULL"));
772 		AUDIT_PIPE_LOCK(ap);
774 			ap->ap_flags |= AUDIT_PIPE_NBIO;
776 			ap->ap_flags &= ~AUDIT_PIPE_NBIO;
777 		AUDIT_PIPE_UNLOCK(ap);
782 		AUDIT_PIPE_LOCK(ap);
783 		*(int *)data = ap->ap_qbyteslen - ap->ap_qoffset;
784 		AUDIT_PIPE_UNLOCK(ap);
789 		AUDIT_PIPE_LOCK(ap);
791 			ap->ap_flags |= AUDIT_PIPE_ASYNC;
793 			ap->ap_flags &= ~AUDIT_PIPE_ASYNC;
794 		AUDIT_PIPE_UNLOCK(ap);
800 		error = fsetown(*(int *)data, &ap->ap_sigio);
804 		*(int *)data = fgetown(&ap->ap_sigio);
810 		*(u_int *)data = ap->ap_qlen;
815 		*(u_int *)data = ap->ap_qlimit;
823 			ap->ap_qlimit = *(u_int *)data;
840 		AUDIT_PIPE_LOCK(ap);
842 		*maskp = ap->ap_preselect_flags;
843 		AUDIT_PIPE_UNLOCK(ap);
848 		AUDIT_PIPE_LOCK(ap);
850 		ap->ap_preselect_flags = *maskp;
851 		AUDIT_CHECK_IF_KEVENTS_MASK(ap->ap_preselect_flags);
852 		AUDIT_PIPE_UNLOCK(ap);
857 		AUDIT_PIPE_LOCK(ap);
859 		*maskp = ap->ap_preselect_naflags;
860 		AUDIT_PIPE_UNLOCK(ap);
865 		AUDIT_PIPE_LOCK(ap);
867 		ap->ap_preselect_naflags = *maskp;
868 		AUDIT_CHECK_IF_KEVENTS_MASK(ap->ap_preselect_naflags);
869 		AUDIT_PIPE_UNLOCK(ap);
875 		error = audit_pipe_preselect_get(ap, aip->aip_auid,
881 		audit_pipe_preselect_set(ap, aip->aip_auid, aip->aip_mask);
887 		error = audit_pipe_preselect_delete(ap, auid);
891 		audit_pipe_preselect_flush(ap);
896 		AUDIT_PIPE_LOCK(ap);
897 		*(int *)data = ap->ap_preselect_mode;
898 		AUDIT_PIPE_UNLOCK(ap);
907 			AUDIT_PIPE_LOCK(ap);
908 			ap->ap_preselect_mode = mode;
909 			AUDIT_PIPE_UNLOCK(ap);
919 		if (AUDIT_PIPE_SX_XLOCK_SIG(ap) != 0)
921 		AUDIT_PIPE_LOCK(ap);
922 		audit_pipe_flush(ap);
923 		AUDIT_PIPE_UNLOCK(ap);
924 		AUDIT_PIPE_SX_XUNLOCK(ap);
934 		*(u_int *)data = ap->ap_inserts;
939 		*(u_int *)data = ap->ap_reads;
944 		*(u_int *)data = ap->ap_drops;
967 	struct audit_pipe *ap;
971 	ap = audit_pipe_dtab[minor(dev)];
972 	KASSERT(ap != NULL, ("audit_pipe_read: ap == NULL"));
978 	if (AUDIT_PIPE_SX_XLOCK_SIG(ap) != 0)
980 	AUDIT_PIPE_LOCK(ap);
981 	while (TAILQ_EMPTY(&ap->ap_queue)) {
982 		if (ap->ap_flags & AUDIT_PIPE_NBIO) {
983 			AUDIT_PIPE_UNLOCK(ap);
984 			AUDIT_PIPE_SX_XUNLOCK(ap);
987 		error = cv_wait_sig(&ap->ap_cv, AUDIT_PIPE_MTX(ap));
989 			AUDIT_PIPE_UNLOCK(ap);
990 			AUDIT_PIPE_SX_XUNLOCK(ap);
1002 	ap->ap_reads++;
1003 	while ((ape = TAILQ_FIRST(&ap->ap_queue)) != NULL &&
1005 		AUDIT_PIPE_LOCK_ASSERT(ap);
1007 		KASSERT(ape->ape_record_len > ap->ap_qoffset,
1009 		toread = MIN(ape->ape_record_len - ap->ap_qoffset,
1011 		AUDIT_PIPE_UNLOCK(ap);
1012 		error = uiomove((char *)ape->ape_record + ap->ap_qoffset,
1015 			AUDIT_PIPE_SX_XUNLOCK(ap);
1023 		AUDIT_PIPE_LOCK(ap);
1024 		KASSERT(TAILQ_FIRST(&ap->ap_queue) == ape,
1026 		ap->ap_qoffset += toread;
1027 		KASSERT(ape->ape_record_len >= ap->ap_qoffset,
1029 		if (ap->ap_qoffset == ape->ape_record_len) {
1030 			TAILQ_REMOVE(&ap->ap_queue, ape, ape_queue);
1031 			ap->ap_qbyteslen -= ape->ape_record_len;
1033 			ap->ap_qlen--;
1034 			ap->ap_qoffset = 0;
1037 	AUDIT_PIPE_UNLOCK(ap);
1038 	AUDIT_PIPE_SX_XUNLOCK(ap);
1048 	struct audit_pipe *ap;
1052 	ap = audit_pipe_dtab[minor(dev)];
1053 	KASSERT(ap != NULL, ("audit_pipe_poll: ap == NULL"));
1056 		AUDIT_PIPE_LOCK(ap);
1057 		if (TAILQ_FIRST(&ap->ap_queue) != NULL)
1060 			selrecord(p, &ap->ap_selinfo, wql);
1061 		AUDIT_PIPE_UNLOCK(ap);
1073 	struct audit_pipe *ap;
1075 	ap = (struct audit_pipe *)kn->kn_hook;
1076 	KASSERT(ap != NULL, ("audit_pipe_kqread: ap == NULL"));
1077 	AUDIT_PIPE_LOCK_ASSERT(ap);
1079 	if (ap->ap_qlen != 0) {
1080 		kn->kn_data = ap->ap_qbyteslen - ap->ap_qoffset;
1094 	struct audit_pipe *ap;
1096 	ap = (struct audit_pipe *)kn->kn_hook;
1097 	KASSERT(ap != NULL, ("audit_pipe_kqdetach: ap == NULL"));
1099 	AUDIT_PIPE_LOCK(ap);
1100 	knlist_remove(&ap->ap_selinfo.si_note, kn, 1);
1101 	AUDIT_PIPE_UNLOCK(ap);