1/*-
2 * Copyright (c) 2004-2009 Apple Inc.
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1.  Redistributions of source code must retain the above copyright
9 *     notice, this list of conditions and the following disclaimer.
10 * 2.  Redistributions in binary form must reproduce the above copyright
11 *     notice, this list of conditions and the following disclaimer in the
12 *     documentation and/or other materials provided with the distribution.
13 * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
14 *     its contributors may be used to endorse or promote products derived
15 *     from this software without specific prior written permission.
16 *
17 * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND
18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20 * ARE DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR
21 * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
25 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
26 * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
27 * POSSIBILITY OF SUCH DAMAGE.
28 *
29 * $P4: //depot/projects/trustedbsd/openbsm/libbsm/bsm_notify.c#17 $
30 */
31
32/*
33 * Based on sample code from Marc Majka.
34 */
35#include <sys/types.h>
36
37#include <config/config.h>
38#ifdef HAVE_FULL_QUEUE_H
39#include <sys/queue.h>
40#else /* !HAVE_FULL_QUEUE_H */
41#include <compat/queue.h>
42#endif /* !HAVE_FULL_QUEUE_H */
43
44#include <bsm/audit_internal.h>
45#include <bsm/libbsm.h>
46
47#include <errno.h>
48#include <inttypes.h>
49#include <stdarg.h>
50#include <string.h>
51#include <syslog.h>
52
53
54#ifdef __APPLE__
55#include <notify.h>
56/* If 1, assumes a kernel that sends the right notification. */
57#define	AUDIT_NOTIFICATION_ENABLED	1
58
59#if AUDIT_NOTIFICATION_ENABLED
60static int	token = 0;
61#endif	/* AUDIT_NOTIFICATION_ENABLED */
62
63static int	au_cond = AUC_UNSET;	/* <bsm/audit.h> */
64
65uint32_t
66au_notify_initialize(void)
67{
68#if AUDIT_NOTIFICATION_ENABLED
69	uint32_t status;
70	int ignore_first;
71
72	status = notify_register_check(__BSM_INTERNAL_NOTIFY_KEY, &token);
73	if (status != NOTIFY_STATUS_OK)
74		return (status);
75	status = notify_check(token, &ignore_first);
76	if (status != NOTIFY_STATUS_OK)
77		return (status);
78#endif
79
80	if (audit_get_cond(&au_cond) != 0) {
81		syslog(LOG_ERR, "Initial audit status check failed (%s)",
82		    strerror(errno));
83		if (errno == ENOSYS)	/* auditon() unimplemented. */
84			return (AU_UNIMPL);
85		return (NOTIFY_STATUS_FAILED);	/* Is there a better code? */
86	}
87	return (NOTIFY_STATUS_OK);
88}
89
90int
91au_notify_terminate(void)
92{
93
94#if AUDIT_NOTIFICATION_ENABLED
95	return ((notify_cancel(token) == NOTIFY_STATUS_OK) ? 0 : -1);
96#else
97	return (0);
98#endif
99}
100
101/*
102 * On error of any notify(3) call, reset 'au_cond' to ensure we re-run
103 * au_notify_initialize() next time 'round--but assume auditing is on.  This
104 * is a slight performance hit if auditing is off, but at least the system
105 * will behave correctly.  The notification calls are unlikely to fail,
106 * anyway.
107 */
108int
109au_get_state(void)
110{
111#if AUDIT_NOTIFICATION_ENABLED
112	int did_notify;
113#endif
114	int status;
115
116	/*
117	 * Don't make the client initialize this set of routines, but take the
118	 * slight performance hit by checking ourselves every time.
119	 */
120	if (au_cond == AUC_UNSET) {
121		status = au_notify_initialize();
122		if (status != NOTIFY_STATUS_OK) {
123			if (status == AU_UNIMPL)
124				return (AU_UNIMPL);
125			return (AUC_AUDITING);
126		} else
127			return (au_cond);
128	}
129#if AUDIT_NOTIFICATION_ENABLED
130	status = notify_check(token, &did_notify);
131	if (status != NOTIFY_STATUS_OK) {
132		au_cond = AUC_UNSET;
133		return (AUC_AUDITING);
134	}
135
136	if (did_notify == 0)
137		return (au_cond);
138#endif
139
140	if (audit_get_cond(&au_cond) != 0) {
141		/* XXX Reset au_cond to AUC_UNSET? */
142		syslog(LOG_ERR, "Audit status check failed (%s)",
143		    strerror(errno));
144		if (errno == ENOSYS)	/* Function unimplemented. */
145			return (AU_UNIMPL);
146		return (errno);
147	}
148
149	switch (au_cond) {
150	case AUC_NOAUDIT:	/* Auditing suspended. */
151	case AUC_DISABLED:	/* Auditing shut off. */
152		return (AUC_NOAUDIT);
153
154	case AUC_UNSET:		/* Uninitialized; shouldn't get here. */
155	case AUC_AUDITING:	/* Audit on. */
156	default:
157		return (AUC_AUDITING);
158	}
159}
160#endif	/* !__APPLE__ */
161
162int
163cannot_audit(int val __unused)
164{
165#ifdef __APPLE__
166	return (!(au_get_state() == AUC_AUDITING));
167#else
168	int cond;
169
170	if (audit_get_cond(&cond) != 0) {
171		if (errno != ENOSYS) {
172			syslog(LOG_ERR, "Audit status check failed (%s)",
173			    strerror(errno));
174		}
175		return (1);
176	}
177	if (cond == AUC_NOAUDIT || cond == AUC_DISABLED)
178		return (1);
179	return (0);
180#endif	/* !__APPLE__ */
181}
182