audit_worker.c revision 180709
1272343Sngie/* 2272343Sngie * Copyright (c) 1999-2005 Apple Inc. 3272343Sngie * Copyright (c) 2006-2008 Robert N. M. Watson 4272343Sngie * All rights reserved. 5272343Sngie * 6272343Sngie * Redistribution and use in source and binary forms, with or without 7272343Sngie * modification, are permitted provided that the following conditions 8272343Sngie * are met: 9272343Sngie * 1. Redistributions of source code must retain the above copyright 10272343Sngie * notice, this list of conditions and the following disclaimer. 11272343Sngie * 2. Redistributions in binary form must reproduce the above copyright 12272343Sngie * notice, this list of conditions and the following disclaimer in the 13272343Sngie * documentation and/or other materials provided with the distribution. 14272343Sngie * 3. Neither the name of Apple Inc. ("Apple") nor the names of 15272343Sngie * its contributors may be used to endorse or promote products derived 16272343Sngie * from this software without specific prior written permission. 17272343Sngie * 18272343Sngie * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND 19272343Sngie * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 20272343Sngie * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 21272343Sngie * ARE DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR 22272343Sngie * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 23272343Sngie * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 24272343Sngie * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 25272343Sngie * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 26272343Sngie * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING 27272343Sngie * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 28272343Sngie * POSSIBILITY OF SUCH DAMAGE. 29272343Sngie */ 30272343Sngie 31272343Sngie#include <sys/cdefs.h> 32272343Sngie__FBSDID("$FreeBSD: head/sys/security/audit/audit_worker.c 180709 2008-07-22 16:44:48Z rwatson $"); 33272343Sngie 34272343Sngie#include <sys/param.h> 35272343Sngie#include <sys/condvar.h> 36272343Sngie#include <sys/conf.h> 37272343Sngie#include <sys/file.h> 38272343Sngie#include <sys/filedesc.h> 39272343Sngie#include <sys/fcntl.h> 40272343Sngie#include <sys/ipc.h> 41272343Sngie#include <sys/kernel.h> 42272343Sngie#include <sys/kthread.h> 43272343Sngie#include <sys/malloc.h> 44272343Sngie#include <sys/mount.h> 45272343Sngie#include <sys/namei.h> 46272343Sngie#include <sys/proc.h> 47272343Sngie#include <sys/queue.h> 48272343Sngie#include <sys/socket.h> 49272343Sngie#include <sys/socketvar.h> 50272343Sngie#include <sys/protosw.h> 51272343Sngie#include <sys/domain.h> 52272343Sngie#include <sys/sx.h> 53272343Sngie#include <sys/sysproto.h> 54272343Sngie#include <sys/sysent.h> 55272343Sngie#include <sys/systm.h> 56272343Sngie#include <sys/ucred.h> 57272343Sngie#include <sys/uio.h> 58272343Sngie#include <sys/un.h> 59272343Sngie#include <sys/unistd.h> 60272343Sngie#include <sys/vnode.h> 61272343Sngie 62272343Sngie#include <bsm/audit.h> 63272343Sngie#include <bsm/audit_internal.h> 64272343Sngie#include <bsm/audit_kevents.h> 65272343Sngie 66272343Sngie#include <netinet/in.h> 67272343Sngie#include <netinet/in_pcb.h> 68272343Sngie 69272343Sngie#include <security/audit/audit.h> 70272343Sngie#include <security/audit/audit_private.h> 71272343Sngie 72272343Sngie#include <vm/uma.h> 73272343Sngie 74272343Sngie/* 75272343Sngie * Worker thread that will schedule disk I/O, etc. 76272343Sngie */ 77272343Sngiestatic struct proc *audit_thread; 78272343Sngie 79272343Sngie/* 80272343Sngie * audit_cred and audit_vp are the stored credential and vnode to use for 81272343Sngie * active audit trail. They are protected by audit_worker_sx, which will be 82272343Sngie * held across all I/O and all rotation to prevent them from being replaced 83272343Sngie * (rotated) while in use. The audit_file_rotate_wait flag is set when the 84272343Sngie * kernel has delivered a trigger to auditd to rotate the trail, and is 85272343Sngie * cleared when the next rotation takes place. It is also protected by 86272343Sngie * audit_worker_sx. 87272343Sngie */ 88272343Sngiestatic int audit_file_rotate_wait; 89272343Sngiestatic struct sx audit_worker_sx; 90272343Sngiestatic struct ucred *audit_cred; 91272343Sngiestatic struct vnode *audit_vp; 92272343Sngie 93272343Sngie/* 94272343Sngie * Write an audit record to a file, performed as the last stage after both 95272343Sngie * preselection and BSM conversion. Both space management and write failures 96272343Sngie * are handled in this function. 97272343Sngie * 98272343Sngie * No attempt is made to deal with possible failure to deliver a trigger to 99272343Sngie * the audit daemon, since the message is asynchronous anyway. 100272343Sngie */ 101272343Sngiestatic void 102272343Sngieaudit_record_write(struct vnode *vp, struct ucred *cred, void *data, 103272343Sngie size_t len) 104272343Sngie{ 105272343Sngie static struct timeval last_lowspace_trigger; 106272343Sngie static struct timeval last_fail; 107272343Sngie static int cur_lowspace_trigger; 108272343Sngie struct statfs *mnt_stat; 109272343Sngie int error, vfslocked; 110272343Sngie static int cur_fail; 111272343Sngie struct vattr vattr; 112272343Sngie long temp; 113272343Sngie 114272343Sngie sx_assert(&audit_worker_sx, SA_LOCKED); /* audit_file_rotate_wait. */ 115272343Sngie 116272343Sngie if (vp == NULL) 117272343Sngie return; 118272343Sngie 119272343Sngie mnt_stat = &vp->v_mount->mnt_stat; 120272343Sngie vfslocked = VFS_LOCK_GIANT(vp->v_mount); 121272343Sngie 122272343Sngie /* 123272343Sngie * First, gather statistics on the audit log file and file system so 124272343Sngie * that we know how we're doing on space. Consider failure of these 125272343Sngie * operations to indicate a future inability to write to the file. 126272343Sngie */ 127272343Sngie error = VFS_STATFS(vp->v_mount, mnt_stat, curthread); 128272343Sngie if (error) 129272343Sngie goto fail; 130272343Sngie vn_lock(vp, LK_EXCLUSIVE | LK_RETRY); 131272343Sngie error = VOP_GETATTR(vp, &vattr, cred, curthread); 132272343Sngie VOP_UNLOCK(vp, 0); 133272343Sngie if (error) 134272343Sngie goto fail; 135272343Sngie audit_fstat.af_currsz = vattr.va_size; 136272343Sngie 137272343Sngie /* 138272343Sngie * We handle four different space-related limits: 139272343Sngie * 140272343Sngie * - A fixed (hard) limit on the minimum free blocks we require on 141272343Sngie * the file system, and results in record loss, a trigger, and 142272343Sngie * possible fail stop due to violating invariants. 143272343Sngie * 144272343Sngie * - An administrative (soft) limit, which when fallen below, results 145272343Sngie * in the kernel notifying the audit daemon of low space. 146272343Sngie * 147272343Sngie * - An audit trail size limit, which when gone above, results in the 148272343Sngie * kernel notifying the audit daemon that rotation is desired. 149272343Sngie * 150272343Sngie * - The total depth of the kernel audit record exceeding free space, 151272343Sngie * which can lead to possible fail stop (with drain), in order to 152272343Sngie * prevent violating invariants. Failure here doesn't halt 153272343Sngie * immediately, but prevents new records from being generated. 154272343Sngie * 155272343Sngie * Possibly, the last of these should be handled differently, always 156272343Sngie * allowing a full queue to be lost, rather than trying to prevent 157272343Sngie * loss. 158272343Sngie * 159272343Sngie * First, handle the hard limit, which generates a trigger and may 160272343Sngie * fail stop. This is handled in the same manner as ENOSPC from 161272343Sngie * VOP_WRITE, and results in record loss. 162272343Sngie */ 163272343Sngie if (mnt_stat->f_bfree < AUDIT_HARD_LIMIT_FREE_BLOCKS) { 164272343Sngie error = ENOSPC; 165272343Sngie goto fail_enospc; 166272343Sngie } 167272343Sngie 168272343Sngie /* 169272343Sngie * Second, handle falling below the soft limit, if defined; we send 170272343Sngie * the daemon a trigger and continue processing the record. Triggers 171272343Sngie * are limited to 1/sec. 172272343Sngie */ 173272343Sngie if (audit_qctrl.aq_minfree != 0) { 174272343Sngie temp = mnt_stat->f_blocks / (100 / audit_qctrl.aq_minfree); 175272343Sngie if (mnt_stat->f_bfree < temp) { 176272343Sngie if (ppsratecheck(&last_lowspace_trigger, 177272343Sngie &cur_lowspace_trigger, 1)) { 178272343Sngie (void)audit_send_trigger( 179272343Sngie AUDIT_TRIGGER_LOW_SPACE); 180272343Sngie printf("Warning: disk space low (< %d%% free) " 181272343Sngie "on audit log file-system\n", 182272343Sngie audit_qctrl.aq_minfree); 183272343Sngie } 184272343Sngie } 185272343Sngie } 186272343Sngie 187272343Sngie /* 188272343Sngie * If the current file is getting full, generate a rotation trigger 189272343Sngie * to the daemon. This is only approximate, which is fine as more 190272343Sngie * records may be generated before the daemon rotates the file. 191272343Sngie */ 192272343Sngie if ((audit_fstat.af_filesz != 0) && (audit_file_rotate_wait == 0) && 193272343Sngie (vattr.va_size >= audit_fstat.af_filesz)) { 194272343Sngie sx_assert(&audit_worker_sx, SA_XLOCKED); 195272343Sngie 196272343Sngie audit_file_rotate_wait = 1; 197272343Sngie (void)audit_send_trigger(AUDIT_TRIGGER_ROTATE_KERNEL); 198272343Sngie } 199272343Sngie 200272343Sngie /* 201272343Sngie * If the estimated amount of audit data in the audit event queue 202272343Sngie * (plus records allocated but not yet queued) has reached the amount 203272343Sngie * of free space on the disk, then we need to go into an audit fail 204272343Sngie * stop state, in which we do not permit the allocation/committing of 205272343Sngie * any new audit records. We continue to process records but don't 206272343Sngie * allow any activities that might generate new records. In the 207272343Sngie * future, we might want to detect when space is available again and 208272343Sngie * allow operation to continue, but this behavior is sufficient to 209272343Sngie * meet fail stop requirements in CAPP. 210272343Sngie */ 211272343Sngie if (audit_fail_stop) { 212272343Sngie if ((unsigned long)((audit_q_len + audit_pre_q_len + 1) * 213272343Sngie MAX_AUDIT_RECORD_SIZE) / mnt_stat->f_bsize >= 214272343Sngie (unsigned long)(mnt_stat->f_bfree)) { 215272343Sngie if (ppsratecheck(&last_fail, &cur_fail, 1)) 216272343Sngie printf("audit_record_write: free space " 217272343Sngie "below size of audit queue, failing " 218272343Sngie "stop\n"); 219272343Sngie audit_in_failure = 1; 220272343Sngie } else if (audit_in_failure) { 221272343Sngie /* 222272343Sngie * Note: if we want to handle recovery, this is the 223272343Sngie * spot to do it: unset audit_in_failure, and issue a 224272343Sngie * wakeup on the cv. 225272343Sngie */ 226272343Sngie } 227272343Sngie } 228272343Sngie 229272343Sngie error = vn_rdwr(UIO_WRITE, vp, data, len, (off_t)0, UIO_SYSSPACE, 230272343Sngie IO_APPEND|IO_UNIT, cred, NULL, NULL, curthread); 231272343Sngie if (error == ENOSPC) 232272343Sngie goto fail_enospc; 233272343Sngie else if (error) 234272343Sngie goto fail; 235272343Sngie 236272343Sngie /* 237272343Sngie * Catch completion of a queue drain here; if we're draining and the 238272343Sngie * queue is now empty, fail stop. That audit_fail_stop is implicitly 239272343Sngie * true, since audit_in_failure can only be set of audit_fail_stop is 240272343Sngie * set. 241272343Sngie * 242272343Sngie * Note: if we handle recovery from audit_in_failure, then we need to 243272343Sngie * make panic here conditional. 244272343Sngie */ 245272343Sngie if (audit_in_failure) { 246272343Sngie if (audit_q_len == 0 && audit_pre_q_len == 0) { 247272343Sngie VOP_LOCK(vp, LK_EXCLUSIVE | LK_RETRY); 248272343Sngie (void)VOP_FSYNC(vp, MNT_WAIT, curthread); 249272343Sngie VOP_UNLOCK(vp, 0); 250272343Sngie panic("Audit store overflow; record queue drained."); 251272343Sngie } 252272343Sngie } 253272343Sngie 254272343Sngie VFS_UNLOCK_GIANT(vfslocked); 255272343Sngie return; 256272343Sngie 257272343Sngiefail_enospc: 258272343Sngie /* 259272343Sngie * ENOSPC is considered a special case with respect to failures, as 260272343Sngie * this can reflect either our preemptive detection of insufficient 261272343Sngie * space, or ENOSPC returned by the vnode write call. 262272343Sngie */ 263272343Sngie if (audit_fail_stop) { 264 VOP_LOCK(vp, LK_EXCLUSIVE | LK_RETRY); 265 (void)VOP_FSYNC(vp, MNT_WAIT, curthread); 266 VOP_UNLOCK(vp, 0); 267 panic("Audit log space exhausted and fail-stop set."); 268 } 269 (void)audit_send_trigger(AUDIT_TRIGGER_NO_SPACE); 270 audit_suspended = 1; 271 272 /* FALLTHROUGH */ 273fail: 274 /* 275 * We have failed to write to the file, so the current record is 276 * lost, which may require an immediate system halt. 277 */ 278 if (audit_panic_on_write_fail) { 279 VOP_LOCK(vp, LK_EXCLUSIVE | LK_RETRY); 280 (void)VOP_FSYNC(vp, MNT_WAIT, curthread); 281 VOP_UNLOCK(vp, 0); 282 panic("audit_worker: write error %d\n", error); 283 } else if (ppsratecheck(&last_fail, &cur_fail, 1)) 284 printf("audit_worker: write error %d\n", error); 285 VFS_UNLOCK_GIANT(vfslocked); 286} 287 288/* 289 * Given a kernel audit record, process as required. Kernel audit records 290 * are converted to one, or possibly two, BSM records, depending on whether 291 * there is a user audit record present also. Kernel records need be 292 * converted to BSM before they can be written out. Both types will be 293 * written to disk, and audit pipes. 294 */ 295static void 296audit_worker_process_record(struct kaudit_record *ar) 297{ 298 struct au_record *bsm; 299 au_class_t class; 300 au_event_t event; 301 au_id_t auid; 302 int error, sorf; 303 int trail_locked; 304 305 /* 306 * We hold the audit_worker_sx lock over both writes, if there are 307 * two, so that the two records won't be split across a rotation and 308 * end up in two different trail files. 309 */ 310 if (((ar->k_ar_commit & AR_COMMIT_USER) && 311 (ar->k_ar_commit & AR_PRESELECT_USER_TRAIL)) || 312 (ar->k_ar_commit & AR_PRESELECT_TRAIL)) { 313 sx_xlock(&audit_worker_sx); 314 trail_locked = 1; 315 } else 316 trail_locked = 0; 317 318 /* 319 * First, handle the user record, if any: commit to the system trail 320 * and audit pipes as selected. 321 */ 322 if ((ar->k_ar_commit & AR_COMMIT_USER) && 323 (ar->k_ar_commit & AR_PRESELECT_USER_TRAIL)) { 324 sx_assert(&audit_worker_sx, SA_XLOCKED); 325 audit_record_write(audit_vp, audit_cred, ar->k_udata, 326 ar->k_ulen); 327 } 328 329 if ((ar->k_ar_commit & AR_COMMIT_USER) && 330 (ar->k_ar_commit & AR_PRESELECT_USER_PIPE)) 331 audit_pipe_submit_user(ar->k_udata, ar->k_ulen); 332 333 if (!(ar->k_ar_commit & AR_COMMIT_KERNEL) || 334 ((ar->k_ar_commit & AR_PRESELECT_PIPE) == 0 && 335 (ar->k_ar_commit & AR_PRESELECT_TRAIL) == 0)) 336 goto out; 337 338 auid = ar->k_ar.ar_subj_auid; 339 event = ar->k_ar.ar_event; 340 class = au_event_class(event); 341 if (ar->k_ar.ar_errno == 0) 342 sorf = AU_PRS_SUCCESS; 343 else 344 sorf = AU_PRS_FAILURE; 345 346 error = kaudit_to_bsm(ar, &bsm); 347 switch (error) { 348 case BSM_NOAUDIT: 349 goto out; 350 351 case BSM_FAILURE: 352 printf("audit_worker_process_record: BSM_FAILURE\n"); 353 goto out; 354 355 case BSM_SUCCESS: 356 break; 357 358 default: 359 panic("kaudit_to_bsm returned %d", error); 360 } 361 362 if (ar->k_ar_commit & AR_PRESELECT_TRAIL) { 363 sx_assert(&audit_worker_sx, SA_XLOCKED); 364 audit_record_write(audit_vp, audit_cred, bsm->data, bsm->len); 365 } 366 367 if (ar->k_ar_commit & AR_PRESELECT_PIPE) 368 audit_pipe_submit(auid, event, class, sorf, 369 ar->k_ar_commit & AR_PRESELECT_TRAIL, bsm->data, 370 bsm->len); 371 372 kau_free(bsm); 373out: 374 if (trail_locked) 375 sx_xunlock(&audit_worker_sx); 376} 377 378/* 379 * The audit_worker thread is responsible for watching the event queue, 380 * dequeueing records, converting them to BSM format, and committing them to 381 * disk. In order to minimize lock thrashing, records are dequeued in sets 382 * to a thread-local work queue. 383 * 384 * Note: this means that the effect bound on the size of the pending record 385 * queue is 2x the length of the global queue. 386 */ 387static void 388audit_worker(void *arg) 389{ 390 struct kaudit_queue ar_worklist; 391 struct kaudit_record *ar; 392 int lowater_signal; 393 394 TAILQ_INIT(&ar_worklist); 395 mtx_lock(&audit_mtx); 396 while (1) { 397 mtx_assert(&audit_mtx, MA_OWNED); 398 399 /* 400 * Wait for a record. 401 */ 402 while (TAILQ_EMPTY(&audit_q)) 403 cv_wait(&audit_worker_cv, &audit_mtx); 404 405 /* 406 * If there are records in the global audit record queue, 407 * transfer them to a thread-local queue and process them 408 * one by one. If we cross the low watermark threshold, 409 * signal any waiting processes that they may wake up and 410 * continue generating records. 411 */ 412 lowater_signal = 0; 413 while ((ar = TAILQ_FIRST(&audit_q))) { 414 TAILQ_REMOVE(&audit_q, ar, k_q); 415 audit_q_len--; 416 if (audit_q_len == audit_qctrl.aq_lowater) 417 lowater_signal++; 418 TAILQ_INSERT_TAIL(&ar_worklist, ar, k_q); 419 } 420 if (lowater_signal) 421 cv_broadcast(&audit_watermark_cv); 422 423 mtx_unlock(&audit_mtx); 424 while ((ar = TAILQ_FIRST(&ar_worklist))) { 425 TAILQ_REMOVE(&ar_worklist, ar, k_q); 426 audit_worker_process_record(ar); 427 audit_free(ar); 428 } 429 mtx_lock(&audit_mtx); 430 } 431} 432 433/* 434 * audit_rotate_vnode() is called by a user or kernel thread to configure or 435 * de-configure auditing on a vnode. The arguments are the replacement 436 * credential (referenced) and vnode (referenced and opened) to substitute 437 * for the current credential and vnode, if any. If either is set to NULL, 438 * both should be NULL, and this is used to indicate that audit is being 439 * disabled. Any previous cred/vnode will be closed and freed. We re-enable 440 * generating rotation requests to auditd. 441 */ 442void 443audit_rotate_vnode(struct ucred *cred, struct vnode *vp) 444{ 445 struct ucred *old_audit_cred; 446 struct vnode *old_audit_vp; 447 int vfslocked; 448 449 KASSERT((cred != NULL && vp != NULL) || (cred == NULL && vp == NULL), 450 ("audit_rotate_vnode: cred %p vp %p", cred, vp)); 451 452 /* 453 * Rotate the vnode/cred, and clear the rotate flag so that we will 454 * send a rotate trigger if the new file fills. 455 */ 456 sx_xlock(&audit_worker_sx); 457 old_audit_cred = audit_cred; 458 old_audit_vp = audit_vp; 459 audit_cred = cred; 460 audit_vp = vp; 461 audit_file_rotate_wait = 0; 462 audit_enabled = (audit_vp != NULL); 463 sx_xunlock(&audit_worker_sx); 464 465 /* 466 * If there was an old vnode/credential, close and free. 467 */ 468 if (old_audit_vp != NULL) { 469 vfslocked = VFS_LOCK_GIANT(old_audit_vp->v_mount); 470 vn_close(old_audit_vp, AUDIT_CLOSE_FLAGS, old_audit_cred, 471 curthread); 472 VFS_UNLOCK_GIANT(vfslocked); 473 crfree(old_audit_cred); 474 } 475} 476 477void 478audit_worker_init(void) 479{ 480 int error; 481 482 sx_init(&audit_worker_sx, "audit_worker_sx"); 483 error = kproc_create(audit_worker, NULL, &audit_thread, RFHIGHPID, 484 0, "audit"); 485 if (error) 486 panic("audit_worker_init: kproc_create returned %d", error); 487} 488