bsm_mask.c revision 155131
1155131Srwatson/* 2155131Srwatson * Copyright (c) 2004 Apple Computer, Inc. 3155131Srwatson * Copyright (c) 2005 Robert N. M. Watson 4155131Srwatson * All rights reserved. 5155131Srwatson * 6155131Srwatson * Redistribution and use in source and binary forms, with or without 7155131Srwatson * modification, are permitted provided that the following conditions 8155131Srwatson * are met: 9155131Srwatson * 1. Redistributions of source code must retain the above copyright 10155131Srwatson * notice, this list of conditions and the following disclaimer. 11155131Srwatson * 2. Redistributions in binary form must reproduce the above copyright 12155131Srwatson * notice, this list of conditions and the following disclaimer in the 13155131Srwatson * documentation and/or other materials provided with the distribution. 14155131Srwatson * 3. Neither the name of Apple Computer, Inc. ("Apple") nor the names of 15155131Srwatson * its contributors may be used to endorse or promote products derived 16155131Srwatson * from this software without specific prior written permission. 17155131Srwatson * 18155131Srwatson * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND 19155131Srwatson * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 20155131Srwatson * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 21155131Srwatson * ARE DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR 22155131Srwatson * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 23155131Srwatson * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 24155131Srwatson * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 25155131Srwatson * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 26155131Srwatson * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING 27155131Srwatson * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 28155131Srwatson * POSSIBILITY OF SUCH DAMAGE. 29155131Srwatson * 30155131Srwatson * $P4: //depot/projects/trustedbsd/openbsm/libbsm/bsm_mask.c#11 $ 31155131Srwatson */ 32155131Srwatson 33155131Srwatson#include <sys/types.h> 34155131Srwatson#include <sys/queue.h> 35155131Srwatson 36155131Srwatson#include <bsm/libbsm.h> 37155131Srwatson 38155131Srwatson#include <pthread.h> 39155131Srwatson#include <stdlib.h> 40155131Srwatson#include <string.h> 41155131Srwatson 42155131Srwatson/* MT-Safe */ 43155131Srwatsonstatic pthread_mutex_t mutex = PTHREAD_MUTEX_INITIALIZER; 44155131Srwatsonstatic int firsttime = 1; 45155131Srwatson 46155131Srwatson/* 47155131Srwatson * XXX ev_cache, once created, sticks around until the calling program exits. 48155131Srwatson * This may or may not be a problem as far as absolute memory usage goes, but 49155131Srwatson * at least there don't appear to be any leaks in using the cache. 50155131Srwatson * 51155131Srwatson * XXXRW: Note that despite (mutex), load_event_table() could race with 52155131Srwatson * other consumers of the getauevents() API. 53155131Srwatson */ 54155131Srwatsonstruct audit_event_map { 55155131Srwatson char ev_name[AU_EVENT_NAME_MAX]; 56155131Srwatson char ev_desc[AU_EVENT_DESC_MAX]; 57155131Srwatson struct au_event_ent ev; 58155131Srwatson LIST_ENTRY(audit_event_map) ev_list; 59155131Srwatson}; 60155131Srwatsonstatic LIST_HEAD(, audit_event_map) ev_cache; 61155131Srwatson 62155131Srwatsonstatic struct audit_event_map * 63155131Srwatsonaudit_event_map_alloc(void) 64155131Srwatson{ 65155131Srwatson struct audit_event_map *aemp; 66155131Srwatson 67155131Srwatson aemp = malloc(sizeof(*aemp)); 68155131Srwatson if (aemp == NULL) 69155131Srwatson return (aemp); 70155131Srwatson bzero(aemp, sizeof(*aemp)); 71155131Srwatson aemp->ev.ae_name = aemp->ev_name; 72155131Srwatson aemp->ev.ae_desc = aemp->ev_desc; 73155131Srwatson return (aemp); 74155131Srwatson} 75155131Srwatson 76155131Srwatsonstatic void 77155131Srwatsonaudit_event_map_free(struct audit_event_map *aemp) 78155131Srwatson{ 79155131Srwatson 80155131Srwatson free(aemp); 81155131Srwatson} 82155131Srwatson 83155131Srwatson/* 84155131Srwatson * When reading into the cache fails, we need to flush the entire cache to 85155131Srwatson * prevent it from containing some but not all records. 86155131Srwatson */ 87155131Srwatsonstatic void 88155131Srwatsonflush_cache(void) 89155131Srwatson{ 90155131Srwatson struct audit_event_map *aemp; 91155131Srwatson 92155131Srwatson /* XXX: Would assert 'mutex'. */ 93155131Srwatson 94155131Srwatson while ((aemp = LIST_FIRST(&ev_cache)) != NULL) { 95155131Srwatson LIST_REMOVE(aemp, ev_list); 96155131Srwatson audit_event_map_free(aemp); 97155131Srwatson } 98155131Srwatson} 99155131Srwatson 100155131Srwatsonstatic int 101155131Srwatsonload_event_table(void) 102155131Srwatson{ 103155131Srwatson struct audit_event_map *aemp; 104155131Srwatson struct au_event_ent *ep; 105155131Srwatson 106155131Srwatson /* 107155131Srwatson * XXX: Would assert 'mutex'. 108155131Srwatson * Loading of the cache happens only once; dont check if cache is 109155131Srwatson * already loaded. 110155131Srwatson */ 111155131Srwatson LIST_INIT(&ev_cache); 112155131Srwatson setauevent(); /* Rewind to beginning of entries. */ 113155131Srwatson do { 114155131Srwatson aemp = audit_event_map_alloc(); 115155131Srwatson if (aemp == NULL) { 116155131Srwatson flush_cache(); 117155131Srwatson return (-1); 118155131Srwatson } 119155131Srwatson ep = getauevent_r(&aemp->ev); 120155131Srwatson if (ep != NULL) 121155131Srwatson LIST_INSERT_HEAD(&ev_cache, aemp, ev_list); 122155131Srwatson else 123155131Srwatson audit_event_map_free(aemp); 124155131Srwatson } while (ep != NULL); 125155131Srwatson return (1); 126155131Srwatson} 127155131Srwatson 128155131Srwatson/* 129155131Srwatson * Read the event with the matching event number from the cache. 130155131Srwatson */ 131155131Srwatsonstatic struct au_event_ent * 132155131Srwatsonread_from_cache(au_event_t event) 133155131Srwatson{ 134155131Srwatson struct audit_event_map *elem; 135155131Srwatson 136155131Srwatson /* XXX: Would assert 'mutex'. */ 137155131Srwatson 138155131Srwatson LIST_FOREACH(elem, &ev_cache, ev_list) { 139155131Srwatson if (elem->ev.ae_number == event) 140155131Srwatson return (&elem->ev); 141155131Srwatson } 142155131Srwatson 143155131Srwatson return (NULL); 144155131Srwatson} 145155131Srwatson 146155131Srwatson/* 147155131Srwatson * Check if the audit event is preselected against the preselection mask. 148155131Srwatson */ 149155131Srwatsonint 150155131Srwatsonau_preselect(au_event_t event, au_mask_t *mask_p, int sorf, int flag) 151155131Srwatson{ 152155131Srwatson struct au_event_ent *ev; 153155131Srwatson au_class_t effmask = 0; 154155131Srwatson 155155131Srwatson if (mask_p == NULL) 156155131Srwatson return (-1); 157155131Srwatson 158155131Srwatson 159155131Srwatson pthread_mutex_lock(&mutex); 160155131Srwatson if (firsttime) { 161155131Srwatson firsttime = 0; 162155131Srwatson if ( -1 == load_event_table()) { 163155131Srwatson pthread_mutex_unlock(&mutex); 164155131Srwatson return (-1); 165155131Srwatson } 166155131Srwatson } 167155131Srwatson switch (flag) { 168155131Srwatson case AU_PRS_REREAD: 169155131Srwatson flush_cache(); 170155131Srwatson if (load_event_table() == -1) { 171155131Srwatson pthread_mutex_unlock(&mutex); 172155131Srwatson return (-1); 173155131Srwatson } 174155131Srwatson ev = read_from_cache(event); 175155131Srwatson break; 176155131Srwatson case AU_PRS_USECACHE: 177155131Srwatson ev = read_from_cache(event); 178155131Srwatson break; 179155131Srwatson default: 180155131Srwatson ev = NULL; 181155131Srwatson } 182155131Srwatson if (ev == NULL) { 183155131Srwatson pthread_mutex_unlock(&mutex); 184155131Srwatson return (-1); 185155131Srwatson } 186155131Srwatson if (sorf & AU_PRS_SUCCESS) 187155131Srwatson effmask |= (mask_p->am_success & ev->ae_class); 188155131Srwatson if (sorf & AU_PRS_FAILURE) 189155131Srwatson effmask |= (mask_p->am_failure & ev->ae_class); 190155131Srwatson pthread_mutex_unlock(&mutex); 191155131Srwatson if (effmask != 0) 192155131Srwatson return (1); 193155131Srwatson return (0); 194155131Srwatson} 195