1/*-
2 * Copyright (c) 1999-2009 Apple Inc.
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1.  Redistributions of source code must retain the above copyright
9 *     notice, this list of conditions and the following disclaimer.
10 * 2.  Redistributions in binary form must reproduce the above copyright
11 *     notice, this list of conditions and the following disclaimer in the
12 *     documentation and/or other materials provided with the distribution.
13 * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
14 *     its contributors may be used to endorse or promote products derived
15 *     from this software without specific prior written permission.
16 *
17 * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND
18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20 * ARE DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR
21 * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
25 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
26 * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
27 * POSSIBILITY OF SUCH DAMAGE.
28 *
29 * $FreeBSD$
30 */
31
32/*
33 * This include file contains function prototypes and type definitions used
34 * within the audit implementation.
35 */
36
37#ifndef _SECURITY_AUDIT_PRIVATE_H_
38#define	_SECURITY_AUDIT_PRIVATE_H_
39
40#ifndef _KERNEL
41#error "no user-serviceable parts inside"
42#endif
43
44#include <sys/caprights.h>
45#include <sys/ipc.h>
46#include <sys/socket.h>
47#include <sys/ucred.h>
48
49#ifdef MALLOC_DECLARE
50MALLOC_DECLARE(M_AUDITBSM);
51MALLOC_DECLARE(M_AUDITDATA);
52MALLOC_DECLARE(M_AUDITPATH);
53MALLOC_DECLARE(M_AUDITTEXT);
54MALLOC_DECLARE(M_AUDITGIDSET);
55#endif
56
57/*
58 * Audit control variables that are usually set/read via system calls and
59 * used to control various aspects of auditing.
60 */
61extern struct au_qctrl		audit_qctrl;
62extern struct audit_fstat	audit_fstat;
63extern struct au_mask		audit_nae_mask;
64extern int			audit_panic_on_write_fail;
65extern int			audit_fail_stop;
66extern int			audit_argv;
67extern int			audit_arge;
68
69/*
70 * Success/failure conditions for the conversion of a kernel audit record to
71 * BSM format.
72 */
73#define	BSM_SUCCESS	0
74#define	BSM_FAILURE	1
75#define	BSM_NOAUDIT	2
76
77/*
78 * Defines for the kernel audit record k_ar_commit field.  Flags are set to
79 * indicate what sort of record it is, and which preselection mechanism
80 * selected it.
81 */
82#define	AR_COMMIT_KERNEL	0x00000001U
83#define	AR_COMMIT_USER		0x00000010U
84
85#define	AR_PRESELECT_TRAIL	0x00001000U
86#define	AR_PRESELECT_PIPE	0x00002000U
87
88#define	AR_PRESELECT_USER_TRAIL	0x00004000U
89#define	AR_PRESELECT_USER_PIPE	0x00008000U
90
91/*
92 * Audit data is generated as a stream of struct audit_record structures,
93 * linked by struct kaudit_record, and contain storage for possible audit so
94 * that it will not need to be allocated during the processing of a system
95 * call, both improving efficiency and avoiding sleeping at untimely moments.
96 * This structure is converted to BSM format before being written to disk.
97 */
98struct vnode_au_info {
99	mode_t	vn_mode;
100	uid_t	vn_uid;
101	gid_t	vn_gid;
102	dev_t	vn_dev;
103	long	vn_fsid;
104	long	vn_fileid;
105	long	vn_gen;
106};
107
108struct groupset {
109	gid_t	*gidset;
110	u_int	 gidset_size;
111};
112
113struct socket_au_info {
114	int		so_domain;
115	int		so_type;
116	int		so_protocol;
117	in_addr_t	so_raddr;	/* Remote address if INET socket. */
118	in_addr_t	so_laddr;	/* Local address if INET socket. */
119	u_short		so_rport;	/* Remote port. */
120	u_short		so_lport;	/* Local port. */
121};
122
123/*
124 * The following is used for A_OLDSETQCTRL and AU_OLDGETQCTRL and a 64-bit
125 * userland.
126 */
127struct au_qctrl64 {
128	u_int64_t	aq64_hiwater;
129	u_int64_t	aq64_lowater;
130	u_int64_t	aq64_bufsz;
131	u_int64_t	aq64_delay;
132	u_int64_t	aq64_minfree;
133};
134typedef	struct au_qctrl64	au_qctrl64_t;
135
136union auditon_udata {
137	char			*au_path;
138	int			au_cond;
139	int			au_flags;
140	int			au_policy;
141	int			au_trigger;
142	int64_t			au_cond64;
143	int64_t			au_policy64;
144	au_evclass_map_t	au_evclass;
145	au_mask_t		au_mask;
146	auditinfo_t		au_auinfo;
147	auditpinfo_t		au_aupinfo;
148	auditpinfo_addr_t	au_aupinfo_addr;
149	au_qctrl_t		au_qctrl;
150	au_qctrl64_t		au_qctrl64;
151	au_stat_t		au_stat;
152	au_fstat_t		au_fstat;
153	auditinfo_addr_t	au_kau_info;
154};
155
156struct posix_ipc_perm {
157	uid_t	pipc_uid;
158	gid_t	pipc_gid;
159	mode_t	pipc_mode;
160};
161
162struct audit_record {
163	/* Audit record header. */
164	u_int32_t		ar_magic;
165	int			ar_event;
166	int			ar_retval; /* value returned to the process */
167	int			ar_errno;  /* return status of system call */
168	struct timespec		ar_starttime;
169	struct timespec		ar_endtime;
170	u_int64_t		ar_valid_arg;  /* Bitmask of valid arguments */
171
172	/* Audit subject information. */
173	struct xucred		ar_subj_cred;
174	uid_t			ar_subj_ruid;
175	gid_t			ar_subj_rgid;
176	gid_t			ar_subj_egid;
177	uid_t			ar_subj_auid; /* Audit user ID */
178	pid_t			ar_subj_asid; /* Audit session ID */
179	pid_t			ar_subj_pid;
180	struct au_tid		ar_subj_term;
181	struct au_tid_addr	ar_subj_term_addr;
182	struct au_mask		ar_subj_amask;
183
184	/* Operation arguments. */
185	uid_t			ar_arg_euid;
186	uid_t			ar_arg_ruid;
187	uid_t			ar_arg_suid;
188	gid_t			ar_arg_egid;
189	gid_t			ar_arg_rgid;
190	gid_t			ar_arg_sgid;
191	pid_t			ar_arg_pid;
192	pid_t			ar_arg_asid;
193	struct au_tid		ar_arg_termid;
194	struct au_tid_addr	ar_arg_termid_addr;
195	uid_t			ar_arg_uid;
196	uid_t			ar_arg_auid;
197	gid_t			ar_arg_gid;
198	struct groupset		ar_arg_groups;
199	int			ar_arg_fd;
200	int			ar_arg_atfd1;
201	int			ar_arg_atfd2;
202	int			ar_arg_fflags;
203	mode_t			ar_arg_mode;
204	int			ar_arg_dev;
205	long			ar_arg_value;
206	void			*ar_arg_addr;
207	int			ar_arg_len;
208	int			ar_arg_mask;
209	u_int			ar_arg_signum;
210	char			ar_arg_login[MAXLOGNAME];
211	int			ar_arg_ctlname[CTL_MAXNAME];
212	struct socket_au_info	ar_arg_sockinfo;
213	char			*ar_arg_upath1;
214	char			*ar_arg_upath2;
215	char			*ar_arg_text;
216	struct au_mask		ar_arg_amask;
217	struct vnode_au_info	ar_arg_vnode1;
218	struct vnode_au_info	ar_arg_vnode2;
219	int			ar_arg_cmd;
220	int			ar_arg_svipc_cmd;
221	struct ipc_perm		ar_arg_svipc_perm;
222	int			ar_arg_svipc_id;
223	void			*ar_arg_svipc_addr;
224	struct posix_ipc_perm	ar_arg_pipc_perm;
225	union auditon_udata	ar_arg_auditon;
226	char			*ar_arg_argv;
227	int			ar_arg_argc;
228	char			*ar_arg_envv;
229	int			ar_arg_envc;
230	int			ar_arg_exitstatus;
231	int			ar_arg_exitretval;
232	struct sockaddr_storage ar_arg_sockaddr;
233	cap_rights_t		ar_arg_rights;
234	uint32_t		ar_arg_fcntl_rights;
235	char			ar_jailname[MAXHOSTNAMELEN];
236};
237
238/*
239 * Arguments in the audit record are initially not defined; flags are set to
240 * indicate if they are present so they can be included in the audit log
241 * stream only if defined.
242 */
243#define	ARG_EUID		0x0000000000000001ULL
244#define	ARG_RUID		0x0000000000000002ULL
245#define	ARG_SUID		0x0000000000000004ULL
246#define	ARG_EGID		0x0000000000000008ULL
247#define	ARG_RGID		0x0000000000000010ULL
248#define	ARG_SGID		0x0000000000000020ULL
249#define	ARG_PID			0x0000000000000040ULL
250#define	ARG_UID			0x0000000000000080ULL
251#define	ARG_AUID		0x0000000000000100ULL
252#define	ARG_GID			0x0000000000000200ULL
253#define	ARG_FD			0x0000000000000400ULL
254#define	ARG_POSIX_IPC_PERM	0x0000000000000800ULL
255#define	ARG_FFLAGS		0x0000000000001000ULL
256#define	ARG_MODE		0x0000000000002000ULL
257#define	ARG_DEV			0x0000000000004000ULL
258#define	ARG_ADDR		0x0000000000008000ULL
259#define	ARG_LEN			0x0000000000010000ULL
260#define	ARG_MASK		0x0000000000020000ULL
261#define	ARG_SIGNUM		0x0000000000040000ULL
262#define	ARG_LOGIN		0x0000000000080000ULL
263#define	ARG_SADDRINET		0x0000000000100000ULL
264#define	ARG_SADDRINET6		0x0000000000200000ULL
265#define	ARG_SADDRUNIX		0x0000000000400000ULL
266#define	ARG_TERMID_ADDR		0x0000000000400000ULL
267#define	ARG_UNUSED2		0x0000000001000000ULL
268#define	ARG_UPATH1		0x0000000002000000ULL
269#define	ARG_UPATH2		0x0000000004000000ULL
270#define	ARG_TEXT		0x0000000008000000ULL
271#define	ARG_VNODE1		0x0000000010000000ULL
272#define	ARG_VNODE2		0x0000000020000000ULL
273#define	ARG_SVIPC_CMD		0x0000000040000000ULL
274#define	ARG_SVIPC_PERM		0x0000000080000000ULL
275#define	ARG_SVIPC_ID		0x0000000100000000ULL
276#define	ARG_SVIPC_ADDR		0x0000000200000000ULL
277#define	ARG_GROUPSET		0x0000000400000000ULL
278#define	ARG_CMD			0x0000000800000000ULL
279#define	ARG_SOCKINFO		0x0000001000000000ULL
280#define	ARG_ASID		0x0000002000000000ULL
281#define	ARG_TERMID		0x0000004000000000ULL
282#define	ARG_AUDITON		0x0000008000000000ULL
283#define	ARG_VALUE		0x0000010000000000ULL
284#define	ARG_AMASK		0x0000020000000000ULL
285#define	ARG_CTLNAME		0x0000040000000000ULL
286#define	ARG_PROCESS		0x0000080000000000ULL
287#define	ARG_MACHPORT1		0x0000100000000000ULL
288#define	ARG_MACHPORT2		0x0000200000000000ULL
289#define	ARG_EXIT		0x0000400000000000ULL
290#define	ARG_IOVECSTR		0x0000800000000000ULL
291#define	ARG_ARGV		0x0001000000000000ULL
292#define	ARG_ENVV		0x0002000000000000ULL
293#define	ARG_ATFD1		0x0004000000000000ULL
294#define	ARG_ATFD2		0x0008000000000000ULL
295#define	ARG_RIGHTS		0x0010000000000000ULL
296#define	ARG_FCNTL_RIGHTS	0x0020000000000000ULL
297#define	ARG_NONE		0x0000000000000000ULL
298#define	ARG_ALL			0xFFFFFFFFFFFFFFFFULL
299
300#define	ARG_IS_VALID(kar, arg)	((kar)->k_ar.ar_valid_arg & (arg))
301#define	ARG_SET_VALID(kar, arg) do {					\
302	(kar)->k_ar.ar_valid_arg |= (arg);				\
303} while (0)
304#define	ARG_CLEAR_VALID(kar, arg) do {					\
305	(kar)->k_ar.ar_valid_arg &= ~(arg);				\
306} while (0)
307
308/*
309 * In-kernel version of audit record; the basic record plus queue meta-data.
310 * This record can also have a pointer set to some opaque data that will be
311 * passed through to the audit writing mechanism.
312 */
313struct kaudit_record {
314	struct audit_record		 k_ar;
315	u_int32_t			 k_ar_commit;
316	void				*k_udata;	/* User data. */
317	u_int				 k_ulen;	/* User data length. */
318	struct uthread			*k_uthread;	/* Audited thread. */
319	TAILQ_ENTRY(kaudit_record)	 k_q;
320};
321TAILQ_HEAD(kaudit_queue, kaudit_record);
322
323/*
324 * Functions to manage the allocation, release, and commit of kernel audit
325 * records.
326 */
327void			 audit_abort(struct kaudit_record *ar);
328void			 audit_commit(struct kaudit_record *ar, int error,
329			    int retval);
330struct kaudit_record	*audit_new(int event, struct thread *td);
331
332/*
333 * Functions relating to the conversion of internal kernel audit records to
334 * the BSM file format.
335 */
336struct au_record;
337int	 kaudit_to_bsm(struct kaudit_record *kar, struct au_record **pau);
338int	 bsm_rec_verify(void *rec);
339
340/*
341 * Kernel versions of the libbsm audit record functions.
342 */
343void	 kau_free(struct au_record *rec);
344void	 kau_init(void);
345
346/*
347 * Return values for pre-selection and post-selection decisions.
348 */
349#define	AU_PRS_SUCCESS	1
350#define	AU_PRS_FAILURE	2
351#define	AU_PRS_BOTH	(AU_PRS_SUCCESS|AU_PRS_FAILURE)
352
353/*
354 * Data structures relating to the kernel audit queue.  Ideally, these might
355 * be abstracted so that only accessor methods are exposed.
356 */
357extern struct mtx		audit_mtx;
358extern struct cv		audit_watermark_cv;
359extern struct cv		audit_worker_cv;
360extern struct kaudit_queue	audit_q;
361extern int			audit_q_len;
362extern int			audit_pre_q_len;
363extern int			audit_in_failure;
364
365/*
366 * Flags to use on audit files when opening and closing.
367 */
368#define	AUDIT_OPEN_FLAGS	(FWRITE | O_APPEND)
369#define	AUDIT_CLOSE_FLAGS	(FWRITE | O_APPEND)
370
371#include <sys/fcntl.h>
372#include <sys/kernel.h>
373#include <sys/malloc.h>
374
375/*
376 * Some of the BSM tokenizer functions take different parameters in the
377 * kernel implementations in order to save the copying of large kernel data
378 * structures.  The prototypes of these functions are declared here.
379 */
380token_t		*kau_to_socket(struct socket_au_info *soi);
381
382/*
383 * audit_klib prototypes
384 */
385int		 au_preselect(au_event_t event, au_class_t class,
386		    au_mask_t *mask_p, int sorf);
387void		 au_evclassmap_init(void);
388void		 au_evclassmap_insert(au_event_t event, au_class_t class);
389au_class_t	 au_event_class(au_event_t event);
390au_event_t	 audit_ctlname_to_sysctlevent(int name[], uint64_t valid_arg);
391au_event_t	 audit_flags_and_error_to_openevent(int oflags, int error);
392au_event_t	 audit_flags_and_error_to_openatevent(int oflags, int error);
393au_event_t	 audit_msgctl_to_event(int cmd);
394au_event_t	 audit_semctl_to_event(int cmr);
395void		 audit_canon_path(struct thread *td, int dirfd, char *path,
396		    char *cpath);
397au_event_t	 auditon_command_event(int cmd);
398
399/*
400 * Audit trigger events notify user space of kernel audit conditions
401 * asynchronously.
402 */
403void		 audit_trigger_init(void);
404int		 audit_send_trigger(unsigned int trigger);
405
406/*
407 * Accessor functions to manage global audit state.
408 */
409void	 audit_set_kinfo(struct auditinfo_addr *);
410void	 audit_get_kinfo(struct auditinfo_addr *);
411
412/*
413 * General audit related functions.
414 */
415struct kaudit_record	*currecord(void);
416void			 audit_free(struct kaudit_record *ar);
417void			 audit_shutdown(void *arg, int howto);
418void			 audit_rotate_vnode(struct ucred *cred,
419			    struct vnode *vp);
420void			 audit_worker_init(void);
421
422/*
423 * Audit pipe functions.
424 */
425int	 audit_pipe_preselect(au_id_t auid, au_event_t event,
426	    au_class_t class, int sorf, int trail_select);
427void	 audit_pipe_submit(au_id_t auid, au_event_t event, au_class_t class,
428	    int sorf, int trail_select, void *record, u_int record_len);
429void	 audit_pipe_submit_user(void *record, u_int record_len);
430
431#endif /* ! _SECURITY_AUDIT_PRIVATE_H_ */
432