audit.c revision 185573
1185573Srwatson/*- 2185573Srwatson * Copyright (c) 2005-2008 Apple Inc. 3155131Srwatson * All rights reserved. 4155131Srwatson * 5155131Srwatson * Redistribution and use in source and binary forms, with or without 6155131Srwatson * modification, are permitted provided that the following conditions 7155131Srwatson * are met: 8155131Srwatson * 9155131Srwatson * 1. Redistributions of source code must retain the above copyright 10155131Srwatson * notice, this list of conditions and the following disclaimer. 11155131Srwatson * 2. Redistributions in binary form must reproduce the above copyright 12155131Srwatson * notice, this list of conditions and the following disclaimer in the 13155131Srwatson * documentation and/or other materials provided with the distribution. 14185573Srwatson * 3. Neither the name of Apple Inc. ("Apple") nor the names of 15155131Srwatson * its contributors may be used to endorse or promote products derived 16155131Srwatson * from this software without specific prior written permission. 17155131Srwatson * 18155131Srwatson * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY 19155131Srwatson * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED 20155131Srwatson * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE 21155131Srwatson * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY 22155131Srwatson * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES 23155131Srwatson * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 24155131Srwatson * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND 25155131Srwatson * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 26155131Srwatson * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 27155131Srwatson * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 28155131Srwatson * 29185573Srwatson * $P4: //depot/projects/trustedbsd/openbsm/bin/audit/audit.c#11 $ 30155131Srwatson */ 31155131Srwatson/* 32155131Srwatson * Program to trigger the audit daemon with a message that is either: 33155131Srwatson * - Open a new audit log file 34155131Srwatson * - Read the audit control file and take action on it 35155131Srwatson * - Close the audit log file and exit 36155131Srwatson * 37155131Srwatson */ 38155131Srwatson 39155518Srwatson#include <sys/types.h> 40185573Srwatson#include <config/config.h> 41185573Srwatson#ifdef HAVE_FULL_QUEUE_H 42155131Srwatson#include <sys/queue.h> 43185573Srwatson#else /* !HAVE_FULL_QUEUE_H */ 44185573Srwatson#include <compat/queue.h> 45185573Srwatson#endif /* !HAVE_FULL_QUEUE_H */ 46155131Srwatson#include <sys/uio.h> 47155131Srwatson 48156283Srwatson#include <bsm/libbsm.h> 49155131Srwatson 50155131Srwatson#include <fcntl.h> 51155131Srwatson#include <stdio.h> 52155131Srwatson#include <stdlib.h> 53155131Srwatson#include <unistd.h> 54155131Srwatson 55185573Srwatson 56185573Srwatsonstatic int send_trigger(unsigned int); 57185573Srwatson 58185573Srwatson#ifdef USE_MACH_IPC 59185573Srwatson#include <mach/mach.h> 60185573Srwatson#include <servers/netname.h> 61185573Srwatson#include <mach/message.h> 62185573Srwatson#include <mach/port.h> 63185573Srwatson#include <mach/mach_error.h> 64185573Srwatson#include <mach/host_special_ports.h> 65185573Srwatson#include <servers/bootstrap.h> 66185573Srwatson 67185573Srwatson#include "auditd_control_user.h" 68185573Srwatson 69185573Srwatsonstatic int 70185573Srwatsonsend_trigger(unsigned int trigger) 71185573Srwatson{ 72185573Srwatson mach_port_t serverPort; 73185573Srwatson kern_return_t error; 74185573Srwatson 75185573Srwatson error = host_get_audit_control_port(mach_host_self(), &serverPort); 76185573Srwatson if (error != KERN_SUCCESS) { 77185573Srwatson mach_error("Cannot get auditd_control Mach port: ", error); 78185573Srwatson return (-1); 79185573Srwatson } 80185573Srwatson 81185573Srwatson error = auditd_control(serverPort, trigger); 82185573Srwatson if (error != KERN_SUCCESS) { 83185573Srwatson mach_error("Error sending trigger: ", error); 84185573Srwatson return (-1); 85185573Srwatson } 86185573Srwatson 87185573Srwatson return (0); 88185573Srwatson} 89185573Srwatson 90185573Srwatson#else /* ! USE_MACH_IPC */ 91185573Srwatson 92185573Srwatsonstatic int 93185573Srwatsonsend_trigger(unsigned int trigger) 94185573Srwatson{ 95185573Srwatson int error; 96185573Srwatson 97185573Srwatson error = auditon(A_SENDTRIGGER, &trigger, sizeof(trigger)); 98185573Srwatson if (error != 0) { 99185573Srwatson perror("Error sending trigger"); 100185573Srwatson return (-1); 101185573Srwatson } 102185573Srwatson 103185573Srwatson return (0); 104185573Srwatson} 105185573Srwatson#endif /* ! USE_MACH_IPC */ 106185573Srwatson 107155131Srwatsonstatic void 108155131Srwatsonusage(void) 109155131Srwatson{ 110155131Srwatson 111155131Srwatson (void)fprintf(stderr, "Usage: audit -n | -s | -t \n"); 112155131Srwatson exit(-1); 113155131Srwatson} 114155131Srwatson 115155131Srwatson/* 116155131Srwatson * Main routine to process command line options. 117155131Srwatson */ 118155131Srwatsonint 119155131Srwatsonmain(int argc, char **argv) 120155131Srwatson{ 121155364Srwatson int ch; 122155131Srwatson unsigned int trigger = 0; 123155131Srwatson 124155131Srwatson if (argc != 2) 125155131Srwatson usage(); 126155131Srwatson 127155131Srwatson while ((ch = getopt(argc, argv, "nst")) != -1) { 128155131Srwatson switch(ch) { 129155131Srwatson 130155131Srwatson case 'n': 131162503Srwatson trigger = AUDIT_TRIGGER_ROTATE_USER; 132155131Srwatson break; 133155131Srwatson 134155131Srwatson case 's': 135155131Srwatson trigger = AUDIT_TRIGGER_READ_FILE; 136155131Srwatson break; 137155131Srwatson 138155131Srwatson case 't': 139155131Srwatson trigger = AUDIT_TRIGGER_CLOSE_AND_DIE; 140155131Srwatson break; 141155131Srwatson 142155131Srwatson case '?': 143155131Srwatson default: 144155131Srwatson usage(); 145155131Srwatson break; 146155131Srwatson } 147155131Srwatson } 148185573Srwatson if (send_trigger(trigger) < 0) 149155131Srwatson exit(-1); 150185573Srwatson 151185573Srwatson printf("Trigger sent.\n"); 152185573Srwatson exit (0); 153155131Srwatson} 154