audit.h revision 170196
1155192Srwatson/* 2155192Srwatson * Copyright (c) 1999-2005 Apple Computer, Inc. 3155192Srwatson * All rights reserved. 4155192Srwatson * 5155192Srwatson * Redistribution and use in source and binary forms, with or without 6155192Srwatson * modification, are permitted provided that the following conditions 7155192Srwatson * are met: 8155192Srwatson * 1. Redistributions of source code must retain the above copyright 9155192Srwatson * notice, this list of conditions and the following disclaimer. 10155192Srwatson * 2. Redistributions in binary form must reproduce the above copyright 11155192Srwatson * notice, this list of conditions and the following disclaimer in the 12155192Srwatson * documentation and/or other materials provided with the distribution. 13155192Srwatson * 3. Neither the name of Apple Computer, Inc. ("Apple") nor the names of 14155192Srwatson * its contributors may be used to endorse or promote products derived 15155192Srwatson * from this software without specific prior written permission. 16155192Srwatson * 17155192Srwatson * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND 18155192Srwatson * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 19155192Srwatson * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 20155192Srwatson * ARE DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR 21155192Srwatson * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 22155192Srwatson * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 23155192Srwatson * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 24155192Srwatson * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 25155192Srwatson * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING 26155192Srwatson * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 27155192Srwatson * POSSIBILITY OF SUCH DAMAGE. 28155192Srwatson * 29155192Srwatson * $FreeBSD: head/sys/security/audit/audit.h 170196 2007-06-01 21:58:59Z rwatson $ 30155192Srwatson */ 31155192Srwatson 32155192Srwatson/* 33155192Srwatson * This header includes function prototypes and type definitions that are 34155192Srwatson * necessary for the kernel as a whole to interact with the audit subsystem. 35155192Srwatson */ 36155192Srwatson 37156882Srwatson#ifndef _SECURITY_AUDIT_KERNEL_H_ 38156882Srwatson#define _SEUCRITY_AUDIT_KERNEL_H_ 39155192Srwatson 40155192Srwatson#ifndef _KERNEL 41155192Srwatson#error "no user-serviceable parts inside" 42155192Srwatson#endif 43155192Srwatson 44155192Srwatson#include <bsm/audit.h> 45155192Srwatson 46155192Srwatson#include <sys/file.h> 47155192Srwatson#include <sys/sysctl.h> 48155192Srwatson 49155192Srwatson/* 50155192Srwatson * Audit subsystem condition flags. The audit_enabled flag is set and 51170196Srwatson * removed automatically as a result of configuring log files, and can be 52170196Srwatson * observed but should not be directly manipulated. The audit suspension 53170196Srwatson * flag permits audit to be temporarily disabled without reconfiguring the 54170196Srwatson * audit target. 55155192Srwatson */ 56155192Srwatsonextern int audit_enabled; 57155192Srwatsonextern int audit_suspended; 58155192Srwatson 59155192Srwatson/* 60155192Srwatson * Define the masks for the audited arguments. 61155192Srwatson * 62155192Srwatson * XXXRW: These need to remain in audit.h for now because our vnode and name 63155192Srwatson * lookup audit calls rely on passing in flags to indicate which name or 64155192Srwatson * vnode is being logged. These should move to audit_private.h when that is 65155192Srwatson * fixed. 66155192Srwatson */ 67161970Srwatson#define ARG_EUID 0x0000000000000001ULL 68161970Srwatson#define ARG_RUID 0x0000000000000002ULL 69161970Srwatson#define ARG_SUID 0x0000000000000004ULL 70161970Srwatson#define ARG_EGID 0x0000000000000008ULL 71161970Srwatson#define ARG_RGID 0x0000000000000010ULL 72161970Srwatson#define ARG_SGID 0x0000000000000020ULL 73161970Srwatson#define ARG_PID 0x0000000000000040ULL 74161970Srwatson#define ARG_UID 0x0000000000000080ULL 75161970Srwatson#define ARG_AUID 0x0000000000000100ULL 76161970Srwatson#define ARG_GID 0x0000000000000200ULL 77161970Srwatson#define ARG_FD 0x0000000000000400ULL 78161970Srwatson#define ARG_POSIX_IPC_PERM 0x0000000000000800ULL 79161970Srwatson#define ARG_FFLAGS 0x0000000000001000ULL 80161970Srwatson#define ARG_MODE 0x0000000000002000ULL 81161970Srwatson#define ARG_DEV 0x0000000000004000ULL 82161970Srwatson#define ARG_ADDR 0x0000000000008000ULL 83161970Srwatson#define ARG_LEN 0x0000000000010000ULL 84161970Srwatson#define ARG_MASK 0x0000000000020000ULL 85161970Srwatson#define ARG_SIGNUM 0x0000000000040000ULL 86161970Srwatson#define ARG_LOGIN 0x0000000000080000ULL 87161970Srwatson#define ARG_SADDRINET 0x0000000000100000ULL 88161970Srwatson#define ARG_SADDRINET6 0x0000000000200000ULL 89161970Srwatson#define ARG_SADDRUNIX 0x0000000000400000ULL 90168688Scsjp#define ARG_TERMID_ADDR 0x0000000000400000ULL 91161970Srwatson#define ARG_UNUSED2 0x0000000001000000ULL 92161970Srwatson#define ARG_UPATH1 0x0000000002000000ULL 93161970Srwatson#define ARG_UPATH2 0x0000000004000000ULL 94161970Srwatson#define ARG_TEXT 0x0000000008000000ULL 95161970Srwatson#define ARG_VNODE1 0x0000000010000000ULL 96161970Srwatson#define ARG_VNODE2 0x0000000020000000ULL 97161970Srwatson#define ARG_SVIPC_CMD 0x0000000040000000ULL 98161970Srwatson#define ARG_SVIPC_PERM 0x0000000080000000ULL 99161970Srwatson#define ARG_SVIPC_ID 0x0000000100000000ULL 100161970Srwatson#define ARG_SVIPC_ADDR 0x0000000200000000ULL 101161970Srwatson#define ARG_GROUPSET 0x0000000400000000ULL 102161970Srwatson#define ARG_CMD 0x0000000800000000ULL 103161970Srwatson#define ARG_SOCKINFO 0x0000001000000000ULL 104161970Srwatson#define ARG_ASID 0x0000002000000000ULL 105161970Srwatson#define ARG_TERMID 0x0000004000000000ULL 106161970Srwatson#define ARG_AUDITON 0x0000008000000000ULL 107161970Srwatson#define ARG_VALUE 0x0000010000000000ULL 108161970Srwatson#define ARG_AMASK 0x0000020000000000ULL 109161970Srwatson#define ARG_CTLNAME 0x0000040000000000ULL 110161970Srwatson#define ARG_PROCESS 0x0000080000000000ULL 111161970Srwatson#define ARG_MACHPORT1 0x0000100000000000ULL 112161970Srwatson#define ARG_MACHPORT2 0x0000200000000000ULL 113155192Srwatson#define ARG_EXIT 0x0000400000000000ULL 114161813Swsalamon#define ARG_IOVECSTR 0x0000800000000000ULL 115161813Swsalamon#define ARG_ARGV 0x0001000000000000ULL 116161813Swsalamon#define ARG_ENVV 0x0002000000000000ULL 117161970Srwatson#define ARG_NONE 0x0000000000000000ULL 118161970Srwatson#define ARG_ALL 0xFFFFFFFFFFFFFFFFULL 119155192Srwatson 120156889Srwatsonvoid audit_syscall_enter(unsigned short code, struct thread *td); 121156889Srwatsonvoid audit_syscall_exit(int error, struct thread *td); 122155192Srwatson 123155192Srwatson/* 124170196Srwatson * The remaining kernel functions are conditionally compiled in as they are 125170196Srwatson * wrapped by a macro, and the macro should be the only place in the source 126170196Srwatson * tree where these functions are referenced. 127155192Srwatson */ 128155192Srwatson#ifdef AUDIT 129155192Srwatsonstruct ipc_perm; 130155192Srwatsonstruct sockaddr; 131155192Srwatsonunion auditon_udata; 132156889Srwatsonvoid audit_arg_addr(void * addr); 133156889Srwatsonvoid audit_arg_exit(int status, int retval); 134156889Srwatsonvoid audit_arg_len(int len); 135156889Srwatsonvoid audit_arg_fd(int fd); 136156889Srwatsonvoid audit_arg_fflags(int fflags); 137156889Srwatsonvoid audit_arg_gid(gid_t gid); 138156889Srwatsonvoid audit_arg_uid(uid_t uid); 139156889Srwatsonvoid audit_arg_egid(gid_t egid); 140156889Srwatsonvoid audit_arg_euid(uid_t euid); 141156889Srwatsonvoid audit_arg_rgid(gid_t rgid); 142156889Srwatsonvoid audit_arg_ruid(uid_t ruid); 143156889Srwatsonvoid audit_arg_sgid(gid_t sgid); 144156889Srwatsonvoid audit_arg_suid(uid_t suid); 145156889Srwatsonvoid audit_arg_groupset(gid_t *gidset, u_int gidset_size); 146156889Srwatsonvoid audit_arg_login(char *login); 147156889Srwatsonvoid audit_arg_ctlname(int *name, int namelen); 148156889Srwatsonvoid audit_arg_mask(int mask); 149156889Srwatsonvoid audit_arg_mode(mode_t mode); 150156889Srwatsonvoid audit_arg_dev(int dev); 151156889Srwatsonvoid audit_arg_value(long value); 152156889Srwatsonvoid audit_arg_owner(uid_t uid, gid_t gid); 153156889Srwatsonvoid audit_arg_pid(pid_t pid); 154156889Srwatsonvoid audit_arg_process(struct proc *p); 155156889Srwatsonvoid audit_arg_signum(u_int signum); 156156889Srwatsonvoid audit_arg_socket(int sodomain, int sotype, int soprotocol); 157160086Srwatsonvoid audit_arg_sockaddr(struct thread *td, struct sockaddr *sa); 158156889Srwatsonvoid audit_arg_auid(uid_t auid); 159156889Srwatsonvoid audit_arg_auditinfo(struct auditinfo *au_info); 160156889Srwatsonvoid audit_arg_upath(struct thread *td, char *upath, u_int64_t flags); 161156889Srwatsonvoid audit_arg_vnode(struct vnode *vp, u_int64_t flags); 162156889Srwatsonvoid audit_arg_text(char *text); 163156889Srwatsonvoid audit_arg_cmd(int cmd); 164156889Srwatsonvoid audit_arg_svipc_cmd(int cmd); 165156889Srwatsonvoid audit_arg_svipc_perm(struct ipc_perm *perm); 166156889Srwatsonvoid audit_arg_svipc_id(int id); 167156889Srwatsonvoid audit_arg_svipc_addr(void *addr); 168156889Srwatsonvoid audit_arg_posix_ipc_perm(uid_t uid, gid_t gid, mode_t mode); 169156889Srwatsonvoid audit_arg_auditon(union auditon_udata *udata); 170156889Srwatsonvoid audit_arg_file(struct proc *p, struct file *fp); 171161813Swsalamonvoid audit_arg_argv(char *argv, int argc, int length); 172161813Swsalamonvoid audit_arg_envv(char *envv, int envc, int length); 173156889Srwatsonvoid audit_sysclose(struct thread *td, int fd); 174156889Srwatsonvoid audit_proc_alloc(struct proc *p); 175156889Srwatsonvoid audit_proc_kproc0(struct proc *p); 176156889Srwatsonvoid audit_proc_init(struct proc *p); 177156889Srwatsonvoid audit_proc_fork(struct proc *parent, struct proc *child); 178156889Srwatsonvoid audit_proc_free(struct proc *p); 179156889Srwatsonvoid audit_thread_alloc(struct thread *td); 180156889Srwatsonvoid audit_thread_free(struct thread *td); 181155192Srwatson 182155192Srwatson/* 183155192Srwatson * Define a macro to wrap the audit_arg_* calls by checking the global 184155192Srwatson * audit_enabled flag before performing the actual call. 185155192Srwatson */ 186155192Srwatson#define AUDIT_ARG(op, args...) do { \ 187155192Srwatson if (audit_enabled) \ 188155192Srwatson audit_arg_ ## op (args); \ 189156889Srwatson} while (0) 190155192Srwatson 191161970Srwatson#define AUDIT_SYSCALL_ENTER(code, td) do { \ 192155192Srwatson if (audit_enabled) { \ 193155192Srwatson audit_syscall_enter(code, td); \ 194155192Srwatson } \ 195156889Srwatson} while (0) 196155192Srwatson 197155192Srwatson/* 198155192Srwatson * Wrap the audit_syscall_exit() function so that it is called only when 199170196Srwatson * auditing is enabled, or we have a audit record on the thread. It is 200155192Srwatson * possible that an audit record was begun before auditing was turned off. 201155192Srwatson */ 202161970Srwatson#define AUDIT_SYSCALL_EXIT(error, td) do { \ 203155192Srwatson if (audit_enabled | (td->td_ar != NULL)) \ 204155192Srwatson audit_syscall_exit(error, td); \ 205156889Srwatson} while (0) 206155192Srwatson 207155192Srwatson/* 208155192Srwatson * A Macro to wrap the audit_sysclose() function. 209155192Srwatson */ 210155192Srwatson#define AUDIT_SYSCLOSE(td, fd) do { \ 211155192Srwatson if (audit_enabled) \ 212155192Srwatson audit_sysclose(td, fd); \ 213156889Srwatson} while (0) 214155192Srwatson 215155192Srwatson#else /* !AUDIT */ 216155192Srwatson 217161970Srwatson#define AUDIT_ARG(op, args...) do { \ 218156889Srwatson} while (0) 219155192Srwatson 220161970Srwatson#define AUDIT_SYSCALL_ENTER(code, td) do { \ 221156889Srwatson} while (0) 222155192Srwatson 223161970Srwatson#define AUDIT_SYSCALL_EXIT(error, td) do { \ 224156889Srwatson} while (0) 225155192Srwatson 226155192Srwatson#define AUDIT_SYSCLOSE(p, fd) do { \ 227156889Srwatson} while (0) 228155192Srwatson 229155192Srwatson#endif /* AUDIT */ 230155192Srwatson 231156882Srwatson#endif /* !_SECURITY_AUDIT_KERNEL_H_ */ 232