audit_bsm.c revision 172915
1/* 2 * Copyright (c) 1999-2005 Apple Computer, Inc. 3 * All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 3. Neither the name of Apple Computer, Inc. ("Apple") nor the names of 14 * its contributors may be used to endorse or promote products derived 15 * from this software without specific prior written permission. 16 * 17 * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND 18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 20 * ARE DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR 21 * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 25 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING 26 * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 27 * POSSIBILITY OF SUCH DAMAGE. 28 * 29 * $FreeBSD: head/sys/security/audit/audit_bsm.c 172915 2007-10-24 00:05:52Z csjp $ 30 */ 31 32#include <sys/param.h> 33#include <sys/vnode.h> 34#include <sys/ipc.h> 35#include <sys/lock.h> 36#include <sys/malloc.h> 37#include <sys/mutex.h> 38#include <sys/socket.h> 39#include <sys/extattr.h> 40#include <sys/fcntl.h> 41#include <sys/user.h> 42#include <sys/systm.h> 43 44#include <bsm/audit.h> 45#include <bsm/audit_internal.h> 46#include <bsm/audit_record.h> 47#include <bsm/audit_kevents.h> 48 49#include <security/audit/audit.h> 50#include <security/audit/audit_private.h> 51 52#include <netinet/in_systm.h> 53#include <netinet/in.h> 54#include <netinet/ip.h> 55 56MALLOC_DEFINE(M_AUDITBSM, "audit_bsm", "Audit BSM data"); 57 58static void audit_sys_auditon(struct audit_record *ar, 59 struct au_record *rec); 60 61/* 62 * Initialize the BSM auditing subsystem. 63 */ 64void 65kau_init(void) 66{ 67 68 au_evclassmap_init(); 69} 70 71/* 72 * This call reserves memory for the audit record. Memory must be guaranteed 73 * before any auditable event can be generated. The au_record structure 74 * maintains a reference to the memory allocated above and also the list of 75 * tokens associated with this record 76 */ 77static struct au_record * 78kau_open(void) 79{ 80 struct au_record *rec; 81 82 rec = malloc(sizeof(*rec), M_AUDITBSM, M_WAITOK); 83 rec->data = NULL; 84 TAILQ_INIT(&rec->token_q); 85 rec->len = 0; 86 rec->used = 1; 87 88 return (rec); 89} 90 91/* 92 * Store the token with the record descriptor. 93 */ 94static void 95kau_write(struct au_record *rec, struct au_token *tok) 96{ 97 98 KASSERT(tok != NULL, ("kau_write: tok == NULL")); 99 100 TAILQ_INSERT_TAIL(&rec->token_q, tok, tokens); 101 rec->len += tok->len; 102} 103 104/* 105 * Close out the audit record by adding the header token, identifying any 106 * missing tokens. Write out the tokens to the record memory. 107 */ 108static void 109kau_close(struct au_record *rec, struct timespec *ctime, short event) 110{ 111 u_char *dptr; 112 size_t tot_rec_size; 113 token_t *cur, *hdr, *trail; 114 struct timeval tm; 115 116 tot_rec_size = rec->len + AUDIT_HEADER_SIZE + AUDIT_TRAILER_SIZE; 117 rec->data = malloc(tot_rec_size, M_AUDITBSM, M_WAITOK | M_ZERO); 118 119 tm.tv_usec = ctime->tv_nsec / 1000; 120 tm.tv_sec = ctime->tv_sec; 121 hdr = au_to_header32_tm(tot_rec_size, event, 0, tm); 122 TAILQ_INSERT_HEAD(&rec->token_q, hdr, tokens); 123 124 trail = au_to_trailer(tot_rec_size); 125 TAILQ_INSERT_TAIL(&rec->token_q, trail, tokens); 126 127 rec->len = tot_rec_size; 128 dptr = rec->data; 129 TAILQ_FOREACH(cur, &rec->token_q, tokens) { 130 memcpy(dptr, cur->t_data, cur->len); 131 dptr += cur->len; 132 } 133} 134 135/* 136 * Free a BSM audit record by releasing all the tokens and clearing the audit 137 * record information. 138 */ 139void 140kau_free(struct au_record *rec) 141{ 142 struct au_token *tok; 143 144 /* Free the token list. */ 145 while ((tok = TAILQ_FIRST(&rec->token_q))) { 146 TAILQ_REMOVE(&rec->token_q, tok, tokens); 147 free(tok->t_data, M_AUDITBSM); 148 free(tok, M_AUDITBSM); 149 } 150 151 rec->used = 0; 152 rec->len = 0; 153 free(rec->data, M_AUDITBSM); 154 free(rec, M_AUDITBSM); 155} 156 157/* 158 * XXX: May want turn some (or all) of these macros into functions in order 159 * to reduce the generated code sized. 160 * 161 * XXXAUDIT: These macros assume that 'kar', 'ar', 'rec', and 'tok' in the 162 * caller are OK with this. 163 */ 164#define UPATH1_TOKENS do { \ 165 if (ARG_IS_VALID(kar, ARG_UPATH1)) { \ 166 tok = au_to_path(ar->ar_arg_upath1); \ 167 kau_write(rec, tok); \ 168 } \ 169} while (0) 170 171#define UPATH2_TOKENS do { \ 172 if (ARG_IS_VALID(kar, ARG_UPATH2)) { \ 173 tok = au_to_path(ar->ar_arg_upath2); \ 174 kau_write(rec, tok); \ 175 } \ 176} while (0) 177 178#define VNODE1_TOKENS do { \ 179 if (ARG_IS_VALID(kar, ARG_VNODE1)) { \ 180 tok = au_to_attr32(&ar->ar_arg_vnode1); \ 181 kau_write(rec, tok); \ 182 } \ 183} while (0) 184 185#define UPATH1_VNODE1_TOKENS do { \ 186 if (ARG_IS_VALID(kar, ARG_UPATH1)) { \ 187 UPATH1_TOKENS; \ 188 } \ 189 if (ARG_IS_VALID(kar, ARG_VNODE1)) { \ 190 tok = au_to_attr32(&ar->ar_arg_vnode1); \ 191 kau_write(rec, tok); \ 192 } \ 193} while (0) 194 195#define VNODE2_TOKENS do { \ 196 if (ARG_IS_VALID(kar, ARG_VNODE2)) { \ 197 tok = au_to_attr32(&ar->ar_arg_vnode2); \ 198 kau_write(rec, tok); \ 199 } \ 200} while (0) 201 202#define FD_VNODE1_TOKENS do { \ 203 if (ARG_IS_VALID(kar, ARG_VNODE1)) { \ 204 if (ARG_IS_VALID(kar, ARG_FD)) { \ 205 tok = au_to_arg32(1, "fd", ar->ar_arg_fd); \ 206 kau_write(rec, tok); \ 207 } \ 208 tok = au_to_attr32(&ar->ar_arg_vnode1); \ 209 kau_write(rec, tok); \ 210 } else { \ 211 if (ARG_IS_VALID(kar, ARG_FD)) { \ 212 tok = au_to_arg32(1, "non-file: fd", \ 213 ar->ar_arg_fd); \ 214 kau_write(rec, tok); \ 215 } \ 216 } \ 217} while (0) 218 219#define PROCESS_PID_TOKENS(argn) do { \ 220 if ((ar->ar_arg_pid > 0) /* Reference a single process */ \ 221 && (ARG_IS_VALID(kar, ARG_PROCESS))) { \ 222 tok = au_to_process32_ex(ar->ar_arg_auid, \ 223 ar->ar_arg_euid, ar->ar_arg_egid, \ 224 ar->ar_arg_ruid, ar->ar_arg_rgid, \ 225 ar->ar_arg_pid, ar->ar_arg_asid, \ 226 &ar->ar_arg_termid_addr); \ 227 kau_write(rec, tok); \ 228 } else if (ARG_IS_VALID(kar, ARG_PID)) { \ 229 tok = au_to_arg32(argn, "process", ar->ar_arg_pid); \ 230 kau_write(rec, tok); \ 231 } \ 232} while (0) \ 233 234#define EXTATTR_TOKENS do { \ 235 if (ARG_IS_VALID(kar, ARG_VALUE)) { \ 236 switch (ar->ar_arg_value) { \ 237 case EXTATTR_NAMESPACE_USER: \ 238 tok = au_to_text(EXTATTR_NAMESPACE_USER_STRING);\ 239 break; \ 240 case EXTATTR_NAMESPACE_SYSTEM: \ 241 tok = au_to_text(EXTATTR_NAMESPACE_SYSTEM_STRING);\ 242 break; \ 243 default: \ 244 tok = au_to_arg32(3, "attrnamespace", \ 245 ar->ar_arg_value); \ 246 break; \ 247 } \ 248 kau_write(rec, tok); \ 249 } \ 250 /* attrname is in the text field */ \ 251 if (ARG_IS_VALID(kar, ARG_TEXT)) { \ 252 tok = au_to_text(ar->ar_arg_text); \ 253 kau_write(rec, tok); \ 254 } \ 255} while (0) 256 257/* 258 * Implement auditing for the auditon() system call. The audit tokens that 259 * are generated depend on the command that was sent into the auditon() 260 * system call. 261 */ 262static void 263audit_sys_auditon(struct audit_record *ar, struct au_record *rec) 264{ 265 struct au_token *tok; 266 267 switch (ar->ar_arg_cmd) { 268 case A_SETPOLICY: 269 if (sizeof(ar->ar_arg_auditon.au_flags) > 4) 270 tok = au_to_arg64(1, "policy", 271 ar->ar_arg_auditon.au_flags); 272 else 273 tok = au_to_arg32(1, "policy", 274 ar->ar_arg_auditon.au_flags); 275 kau_write(rec, tok); 276 break; 277 278 case A_SETKMASK: 279 tok = au_to_arg32(2, "setkmask:as_success", 280 ar->ar_arg_auditon.au_mask.am_success); 281 kau_write(rec, tok); 282 tok = au_to_arg32(2, "setkmask:as_failure", 283 ar->ar_arg_auditon.au_mask.am_failure); 284 kau_write(rec, tok); 285 break; 286 287 case A_SETQCTRL: 288 tok = au_to_arg32(3, "setqctrl:aq_hiwater", 289 ar->ar_arg_auditon.au_qctrl.aq_hiwater); 290 kau_write(rec, tok); 291 tok = au_to_arg32(3, "setqctrl:aq_lowater", 292 ar->ar_arg_auditon.au_qctrl.aq_lowater); 293 kau_write(rec, tok); 294 tok = au_to_arg32(3, "setqctrl:aq_bufsz", 295 ar->ar_arg_auditon.au_qctrl.aq_bufsz); 296 kau_write(rec, tok); 297 tok = au_to_arg32(3, "setqctrl:aq_delay", 298 ar->ar_arg_auditon.au_qctrl.aq_delay); 299 kau_write(rec, tok); 300 tok = au_to_arg32(3, "setqctrl:aq_minfree", 301 ar->ar_arg_auditon.au_qctrl.aq_minfree); 302 kau_write(rec, tok); 303 break; 304 305 case A_SETUMASK: 306 tok = au_to_arg32(3, "setumask:as_success", 307 ar->ar_arg_auditon.au_auinfo.ai_mask.am_success); 308 kau_write(rec, tok); 309 tok = au_to_arg32(3, "setumask:as_failure", 310 ar->ar_arg_auditon.au_auinfo.ai_mask.am_failure); 311 kau_write(rec, tok); 312 break; 313 314 case A_SETSMASK: 315 tok = au_to_arg32(3, "setsmask:as_success", 316 ar->ar_arg_auditon.au_auinfo.ai_mask.am_success); 317 kau_write(rec, tok); 318 tok = au_to_arg32(3, "setsmask:as_failure", 319 ar->ar_arg_auditon.au_auinfo.ai_mask.am_failure); 320 kau_write(rec, tok); 321 break; 322 323 case A_SETCOND: 324 if (sizeof(ar->ar_arg_auditon.au_cond) > 4) 325 tok = au_to_arg64(3, "setcond", 326 ar->ar_arg_auditon.au_cond); 327 else 328 tok = au_to_arg32(3, "setcond", 329 ar->ar_arg_auditon.au_cond); 330 kau_write(rec, tok); 331 break; 332 333 case A_SETCLASS: 334 tok = au_to_arg32(2, "setclass:ec_event", 335 ar->ar_arg_auditon.au_evclass.ec_number); 336 kau_write(rec, tok); 337 tok = au_to_arg32(3, "setclass:ec_class", 338 ar->ar_arg_auditon.au_evclass.ec_class); 339 kau_write(rec, tok); 340 break; 341 342 case A_SETPMASK: 343 tok = au_to_arg32(2, "setpmask:as_success", 344 ar->ar_arg_auditon.au_aupinfo.ap_mask.am_success); 345 kau_write(rec, tok); 346 tok = au_to_arg32(2, "setpmask:as_failure", 347 ar->ar_arg_auditon.au_aupinfo.ap_mask.am_failure); 348 kau_write(rec, tok); 349 break; 350 351 case A_SETFSIZE: 352 tok = au_to_arg32(2, "setfsize:filesize", 353 ar->ar_arg_auditon.au_fstat.af_filesz); 354 kau_write(rec, tok); 355 break; 356 357 default: 358 break; 359 } 360} 361 362/* 363 * Convert an internal kernel audit record to a BSM record and return a 364 * success/failure indicator. The BSM record is passed as an out parameter to 365 * this function. 366 * 367 * Return conditions: 368 * BSM_SUCCESS: The BSM record is valid 369 * BSM_FAILURE: Failure; the BSM record is NULL. 370 * BSM_NOAUDIT: The event is not auditable for BSM; the BSM record is NULL. 371 */ 372int 373kaudit_to_bsm(struct kaudit_record *kar, struct au_record **pau) 374{ 375 struct au_token *tok, *subj_tok; 376 struct au_record *rec; 377 au_tid_t tid; 378 struct audit_record *ar; 379 int ctr; 380 381 KASSERT(kar != NULL, ("kaudit_to_bsm: kar == NULL")); 382 383 *pau = NULL; 384 ar = &kar->k_ar; 385 rec = kau_open(); 386 387 /* Create the subject token */ 388 switch (ar->ar_subj_term_addr.at_type) { 389 case AU_IPv4: 390 tid.port = ar->ar_subj_term_addr.at_port; 391 tid.machine = ar->ar_subj_term_addr.at_addr[0]; 392 subj_tok = au_to_subject32(ar->ar_subj_auid, /* audit ID */ 393 ar->ar_subj_cred.cr_uid, /* eff uid */ 394 ar->ar_subj_egid, /* eff group id */ 395 ar->ar_subj_ruid, /* real uid */ 396 ar->ar_subj_rgid, /* real group id */ 397 ar->ar_subj_pid, /* process id */ 398 ar->ar_subj_asid, /* session ID */ 399 &tid); 400 break; 401 case AU_IPv6: 402 subj_tok = au_to_subject32_ex(ar->ar_subj_auid, 403 ar->ar_subj_cred.cr_uid, 404 ar->ar_subj_egid, 405 ar->ar_subj_ruid, 406 ar->ar_subj_rgid, 407 ar->ar_subj_pid, 408 ar->ar_subj_asid, 409 &ar->ar_subj_term_addr); 410 break; 411 default: 412 bzero(&tid, sizeof(tid)); 413 subj_tok = au_to_subject32(ar->ar_subj_auid, 414 ar->ar_subj_cred.cr_uid, 415 ar->ar_subj_egid, 416 ar->ar_subj_ruid, 417 ar->ar_subj_rgid, 418 ar->ar_subj_pid, 419 ar->ar_subj_asid, 420 &tid); 421 } 422 423 /* 424 * The logic inside each case fills in the tokens required for the 425 * event, except for the header, trailer, and return tokens. The 426 * header and trailer tokens are added by the kau_close() function. 427 * The return token is added outside of the switch statement. 428 */ 429 switch(ar->ar_event) { 430 case AUE_ACCEPT: 431 case AUE_BIND: 432 case AUE_CONNECT: 433 case AUE_RECV: 434 case AUE_RECVFROM: 435 case AUE_RECVMSG: 436 case AUE_SEND: 437 case AUE_SENDFILE: 438 case AUE_SENDMSG: 439 case AUE_SENDTO: 440 /* 441 * Socket-related events. 442 */ 443 if (ARG_IS_VALID(kar, ARG_FD)) { 444 tok = au_to_arg32(1, "fd", ar->ar_arg_fd); 445 kau_write(rec, tok); 446 } 447 if (ARG_IS_VALID(kar, ARG_SADDRINET)) { 448 tok = au_to_sock_inet((struct sockaddr_in *) 449 &ar->ar_arg_sockaddr); 450 kau_write(rec, tok); 451 } 452 if (ARG_IS_VALID(kar, ARG_SADDRUNIX)) { 453 tok = au_to_sock_unix((struct sockaddr_un *) 454 &ar->ar_arg_sockaddr); 455 kau_write(rec, tok); 456 UPATH1_TOKENS; 457 } 458 /* XXX Need to handle ARG_SADDRINET6 */ 459 break; 460 461 case AUE_SOCKET: 462 case AUE_SOCKETPAIR: 463 if (ARG_IS_VALID(kar, ARG_SOCKINFO)) { 464 tok = au_to_arg32(1,"domain", 465 ar->ar_arg_sockinfo.so_domain); 466 kau_write(rec, tok); 467 tok = au_to_arg32(2,"type", 468 ar->ar_arg_sockinfo.so_type); 469 kau_write(rec, tok); 470 tok = au_to_arg32(3,"protocol", 471 ar->ar_arg_sockinfo.so_protocol); 472 kau_write(rec, tok); 473 } 474 break; 475 476 case AUE_SETSOCKOPT: 477 case AUE_SHUTDOWN: 478 if (ARG_IS_VALID(kar, ARG_FD)) { 479 tok = au_to_arg32(1, "fd", ar->ar_arg_fd); 480 kau_write(rec, tok); 481 } 482 break; 483 484 case AUE_ACCT: 485 if (ARG_IS_VALID(kar, ARG_UPATH1)) { 486 UPATH1_VNODE1_TOKENS; 487 } else { 488 tok = au_to_arg32(1, "accounting off", 0); 489 kau_write(rec, tok); 490 } 491 break; 492 493 case AUE_SETAUID: 494 if (ARG_IS_VALID(kar, ARG_AUID)) { 495 tok = au_to_arg32(2, "setauid", ar->ar_arg_auid); 496 kau_write(rec, tok); 497 } 498 break; 499 500 case AUE_SETAUDIT: 501 if (ARG_IS_VALID(kar, ARG_AUID) && 502 ARG_IS_VALID(kar, ARG_ASID) && 503 ARG_IS_VALID(kar, ARG_AMASK) && 504 ARG_IS_VALID(kar, ARG_TERMID)) { 505 tok = au_to_arg32(1, "setaudit:auid", 506 ar->ar_arg_auid); 507 kau_write(rec, tok); 508 tok = au_to_arg32(1, "setaudit:port", 509 ar->ar_arg_termid.port); 510 kau_write(rec, tok); 511 tok = au_to_arg32(1, "setaudit:machine", 512 ar->ar_arg_termid.machine); 513 kau_write(rec, tok); 514 tok = au_to_arg32(1, "setaudit:as_success", 515 ar->ar_arg_amask.am_success); 516 kau_write(rec, tok); 517 tok = au_to_arg32(1, "setaudit:as_failure", 518 ar->ar_arg_amask.am_failure); 519 kau_write(rec, tok); 520 tok = au_to_arg32(1, "setaudit:asid", 521 ar->ar_arg_asid); 522 kau_write(rec, tok); 523 } 524 break; 525 526 case AUE_SETAUDIT_ADDR: 527 if (ARG_IS_VALID(kar, ARG_AUID) && 528 ARG_IS_VALID(kar, ARG_ASID) && 529 ARG_IS_VALID(kar, ARG_AMASK) && 530 ARG_IS_VALID(kar, ARG_TERMID_ADDR)) { 531 tok = au_to_arg32(1, "setaudit_addr:auid", 532 ar->ar_arg_auid); 533 kau_write(rec, tok); 534 tok = au_to_arg32(1, "setaudit_addr:as_success", 535 ar->ar_arg_amask.am_success); 536 kau_write(rec, tok); 537 tok = au_to_arg32(1, "setaudit_addr:as_failure", 538 ar->ar_arg_amask.am_failure); 539 kau_write(rec, tok); 540 tok = au_to_arg32(1, "setaudit_addr:asid", 541 ar->ar_arg_asid); 542 kau_write(rec, tok); 543 tok = au_to_arg32(1, "setaudit_addr:type", 544 ar->ar_arg_termid_addr.at_type); 545 kau_write(rec, tok); 546 tok = au_to_arg32(1, "setaudit_addr:port", 547 ar->ar_arg_termid_addr.at_port); 548 kau_write(rec, tok); 549 if (ar->ar_arg_termid_addr.at_type == AU_IPv6) 550 tok = au_to_in_addr_ex((struct in6_addr *) 551 &ar->ar_arg_termid_addr.at_addr[0]); 552 if (ar->ar_arg_termid_addr.at_type == AU_IPv4) 553 tok = au_to_in_addr((struct in_addr *) 554 &ar->ar_arg_termid_addr.at_addr[0]); 555 kau_write(rec, tok); 556 } 557 break; 558 559 case AUE_AUDITON: 560 /* 561 * For AUDITON commands without own event, audit the cmd. 562 */ 563 if (ARG_IS_VALID(kar, ARG_CMD)) { 564 tok = au_to_arg32(1, "cmd", ar->ar_arg_cmd); 565 kau_write(rec, tok); 566 } 567 /* fall thru */ 568 569 case AUE_AUDITON_GETCAR: 570 case AUE_AUDITON_GETCLASS: 571 case AUE_AUDITON_GETCOND: 572 case AUE_AUDITON_GETCWD: 573 case AUE_AUDITON_GETKMASK: 574 case AUE_AUDITON_GETSTAT: 575 case AUE_AUDITON_GPOLICY: 576 case AUE_AUDITON_GQCTRL: 577 case AUE_AUDITON_SETCLASS: 578 case AUE_AUDITON_SETCOND: 579 case AUE_AUDITON_SETKMASK: 580 case AUE_AUDITON_SETSMASK: 581 case AUE_AUDITON_SETSTAT: 582 case AUE_AUDITON_SETUMASK: 583 case AUE_AUDITON_SPOLICY: 584 case AUE_AUDITON_SQCTRL: 585 if (ARG_IS_VALID(kar, ARG_AUDITON)) 586 audit_sys_auditon(ar, rec); 587 break; 588 589 case AUE_AUDITCTL: 590 UPATH1_VNODE1_TOKENS; 591 break; 592 593 case AUE_EXIT: 594 if (ARG_IS_VALID(kar, ARG_EXIT)) { 595 tok = au_to_exit(ar->ar_arg_exitretval, 596 ar->ar_arg_exitstatus); 597 kau_write(rec, tok); 598 } 599 break; 600 601 case AUE_ADJTIME: 602 case AUE_CLOCK_SETTIME: 603 case AUE_AUDIT: 604 case AUE_DUP2: 605 case AUE_GETAUDIT: 606 case AUE_GETAUDIT_ADDR: 607 case AUE_GETAUID: 608 case AUE_GETCWD: 609 case AUE_GETFSSTAT: 610 case AUE_GETRESUID: 611 case AUE_GETRESGID: 612 case AUE_KQUEUE: 613 case AUE_LSEEK: 614 case AUE_MODLOAD: 615 case AUE_MODUNLOAD: 616 case AUE_MSGSYS: 617 case AUE_NFS_SVC: 618 case AUE_NTP_ADJTIME: 619 case AUE_PIPE: 620 case AUE_PROFILE: 621 case AUE_RTPRIO: 622 case AUE_SEMSYS: 623 case AUE_SHMSYS: 624 case AUE_SETPGRP: 625 case AUE_SETRLIMIT: 626 case AUE_SETSID: 627 case AUE_SETTIMEOFDAY: 628 case AUE_SYSARCH: 629 630 /* 631 * Header, subject, and return tokens added at end. 632 */ 633 break; 634 635 case AUE_MKFIFO: 636 if (ARG_IS_VALID(kar, ARG_MODE)) { 637 tok = au_to_arg32(2, "mode", ar->ar_arg_mode); 638 kau_write(rec, tok); 639 } 640 /* fall through */ 641 case AUE_ACCESS: 642 case AUE_CHDIR: 643 case AUE_CHROOT: 644 case AUE_EACCESS: 645 case AUE_GETATTRLIST: 646 case AUE_JAIL: 647 case AUE_LUTIMES: 648 case AUE_NFS_GETFH: 649 case AUE_LSTAT: 650 case AUE_PATHCONF: 651 case AUE_READLINK: 652 case AUE_REVOKE: 653 case AUE_RMDIR: 654 case AUE_SEARCHFS: 655 case AUE_SETATTRLIST: 656 case AUE_STAT: 657 case AUE_STATFS: 658 case AUE_SWAPON: 659 case AUE_SWAPOFF: 660 case AUE_TRUNCATE: 661 case AUE_UNDELETE: 662 case AUE_UNLINK: 663 case AUE_UTIMES: 664 UPATH1_VNODE1_TOKENS; 665 break; 666 667 case AUE_FHSTATFS: 668 case AUE_FHOPEN: 669 case AUE_FHSTAT: 670 /* XXXRW: Need to audit vnode argument. */ 671 break; 672 673 case AUE_CHFLAGS: 674 case AUE_LCHFLAGS: 675 if (ARG_IS_VALID(kar, ARG_FFLAGS)) { 676 tok = au_to_arg32(2, "flags", ar->ar_arg_fflags); 677 kau_write(rec, tok); 678 } 679 UPATH1_VNODE1_TOKENS; 680 break; 681 682 case AUE_CHMOD: 683 case AUE_LCHMOD: 684 if (ARG_IS_VALID(kar, ARG_MODE)) { 685 tok = au_to_arg32(2, "new file mode", 686 ar->ar_arg_mode); 687 kau_write(rec, tok); 688 } 689 UPATH1_VNODE1_TOKENS; 690 break; 691 692 case AUE_CHOWN: 693 case AUE_LCHOWN: 694 if (ARG_IS_VALID(kar, ARG_UID)) { 695 tok = au_to_arg32(2, "new file uid", ar->ar_arg_uid); 696 kau_write(rec, tok); 697 } 698 if (ARG_IS_VALID(kar, ARG_GID)) { 699 tok = au_to_arg32(3, "new file gid", ar->ar_arg_gid); 700 kau_write(rec, tok); 701 } 702 UPATH1_VNODE1_TOKENS; 703 break; 704 705 case AUE_EXCHANGEDATA: 706 UPATH1_VNODE1_TOKENS; 707 UPATH2_TOKENS; 708 break; 709 710 case AUE_CLOSE: 711 if (ARG_IS_VALID(kar, ARG_FD)) { 712 tok = au_to_arg32(2, "fd", ar->ar_arg_fd); 713 kau_write(rec, tok); 714 } 715 UPATH1_VNODE1_TOKENS; 716 break; 717 718 case AUE_EXTATTRCTL: 719 UPATH1_VNODE1_TOKENS; 720 if (ARG_IS_VALID(kar, ARG_CMD)) { 721 tok = au_to_arg32(2, "cmd", ar->ar_arg_cmd); 722 kau_write(rec, tok); 723 } 724 /* extattrctl(2) filename parameter is in upath2/vnode2 */ 725 UPATH2_TOKENS; 726 VNODE2_TOKENS; 727 EXTATTR_TOKENS; 728 break; 729 730 case AUE_EXTATTR_GET_FILE: 731 case AUE_EXTATTR_SET_FILE: 732 case AUE_EXTATTR_LIST_FILE: 733 case AUE_EXTATTR_DELETE_FILE: 734 case AUE_EXTATTR_GET_LINK: 735 case AUE_EXTATTR_SET_LINK: 736 case AUE_EXTATTR_LIST_LINK: 737 case AUE_EXTATTR_DELETE_LINK: 738 UPATH1_VNODE1_TOKENS; 739 EXTATTR_TOKENS; 740 break; 741 742 case AUE_EXTATTR_GET_FD: 743 case AUE_EXTATTR_SET_FD: 744 case AUE_EXTATTR_LIST_FD: 745 case AUE_EXTATTR_DELETE_FD: 746 if (ARG_IS_VALID(kar, ARG_FD)) { 747 tok = au_to_arg32(2, "fd", ar->ar_arg_fd); 748 kau_write(rec, tok); 749 } 750 EXTATTR_TOKENS; 751 break; 752 753 case AUE_EXECVE: 754 if (ARG_IS_VALID(kar, ARG_ARGV)) { 755 tok = au_to_exec_args(ar->ar_arg_argv, 756 ar->ar_arg_argc); 757 kau_write(rec, tok); 758 } 759 if (ARG_IS_VALID(kar, ARG_ENVV)) { 760 tok = au_to_exec_env(ar->ar_arg_envv, 761 ar->ar_arg_envc); 762 kau_write(rec, tok); 763 } 764 UPATH1_VNODE1_TOKENS; 765 break; 766 767 case AUE_FCHMOD: 768 if (ARG_IS_VALID(kar, ARG_MODE)) { 769 tok = au_to_arg32(2, "new file mode", 770 ar->ar_arg_mode); 771 kau_write(rec, tok); 772 } 773 FD_VNODE1_TOKENS; 774 break; 775 776 /* 777 * XXXRW: Some of these need to handle non-vnode cases as well. 778 */ 779 case AUE_FCHDIR: 780 case AUE_FPATHCONF: 781 case AUE_FSTAT: 782 case AUE_FSTATFS: 783 case AUE_FSYNC: 784 case AUE_FTRUNCATE: 785 case AUE_FUTIMES: 786 case AUE_GETDIRENTRIES: 787 case AUE_GETDIRENTRIESATTR: 788 case AUE_POLL: 789 case AUE_READ: 790 case AUE_READV: 791 case AUE_WRITE: 792 case AUE_WRITEV: 793 FD_VNODE1_TOKENS; 794 break; 795 796 case AUE_FCHOWN: 797 if (ARG_IS_VALID(kar, ARG_UID)) { 798 tok = au_to_arg32(2, "new file uid", ar->ar_arg_uid); 799 kau_write(rec, tok); 800 } 801 if (ARG_IS_VALID(kar, ARG_GID)) { 802 tok = au_to_arg32(3, "new file gid", ar->ar_arg_gid); 803 kau_write(rec, tok); 804 } 805 FD_VNODE1_TOKENS; 806 break; 807 808 case AUE_FCNTL: 809 if (ar->ar_arg_cmd == F_GETLK || ar->ar_arg_cmd == F_SETLK || 810 ar->ar_arg_cmd == F_SETLKW) { 811 if (ARG_IS_VALID(kar, ARG_CMD)) { 812 tok = au_to_arg32(2, "cmd", ar->ar_arg_cmd); 813 kau_write(rec, tok); 814 } 815 FD_VNODE1_TOKENS; 816 } 817 break; 818 819 case AUE_FCHFLAGS: 820 if (ARG_IS_VALID(kar, ARG_FFLAGS)) { 821 tok = au_to_arg32(2, "flags", ar->ar_arg_fflags); 822 kau_write(rec, tok); 823 } 824 FD_VNODE1_TOKENS; 825 break; 826 827 case AUE_FLOCK: 828 if (ARG_IS_VALID(kar, ARG_CMD)) { 829 tok = au_to_arg32(2, "operation", ar->ar_arg_cmd); 830 kau_write(rec, tok); 831 } 832 FD_VNODE1_TOKENS; 833 break; 834 835 case AUE_RFORK: 836 if (ARG_IS_VALID(kar, ARG_FFLAGS)) { 837 tok = au_to_arg32(1, "flags", ar->ar_arg_fflags); 838 kau_write(rec, tok); 839 } 840 /* fall through */ 841 case AUE_FORK: 842 case AUE_VFORK: 843 if (ARG_IS_VALID(kar, ARG_PID)) { 844 tok = au_to_arg32(0, "child PID", ar->ar_arg_pid); 845 kau_write(rec, tok); 846 } 847 break; 848 849 case AUE_IOCTL: 850 if (ARG_IS_VALID(kar, ARG_CMD)) { 851 tok = au_to_arg32(2, "cmd", ar->ar_arg_cmd); 852 kau_write(rec, tok); 853 } 854 if (ARG_IS_VALID(kar, ARG_ADDR)) { 855 tok = au_to_arg32(1, "arg", 856 (u_int32_t)(uintptr_t)ar->ar_arg_addr); 857 kau_write(rec, tok); 858 } 859 if (ARG_IS_VALID(kar, ARG_VNODE1)) 860 FD_VNODE1_TOKENS; 861 else { 862 if (ARG_IS_VALID(kar, ARG_SOCKINFO)) { 863 tok = kau_to_socket(&ar->ar_arg_sockinfo); 864 kau_write(rec, tok); 865 } else { 866 if (ARG_IS_VALID(kar, ARG_FD)) { 867 tok = au_to_arg32(1, "fd", 868 ar->ar_arg_fd); 869 kau_write(rec, tok); 870 } 871 } 872 } 873 break; 874 875 case AUE_KILL: 876 case AUE_KILLPG: 877 if (ARG_IS_VALID(kar, ARG_SIGNUM)) { 878 tok = au_to_arg32(2, "signal", ar->ar_arg_signum); 879 kau_write(rec, tok); 880 } 881 PROCESS_PID_TOKENS(1); 882 break; 883 884 case AUE_KTRACE: 885 if (ARG_IS_VALID(kar, ARG_CMD)) { 886 tok = au_to_arg32(2, "ops", ar->ar_arg_cmd); 887 kau_write(rec, tok); 888 } 889 if (ARG_IS_VALID(kar, ARG_VALUE)) { 890 tok = au_to_arg32(3, "trpoints", ar->ar_arg_value); 891 kau_write(rec, tok); 892 } 893 PROCESS_PID_TOKENS(4); 894 UPATH1_VNODE1_TOKENS; 895 break; 896 897 case AUE_LINK: 898 case AUE_RENAME: 899 UPATH1_VNODE1_TOKENS; 900 UPATH2_TOKENS; 901 break; 902 903 case AUE_LOADSHFILE: 904 if (ARG_IS_VALID(kar, ARG_ADDR)) { 905 tok = au_to_arg32(4, "base addr", 906 (u_int32_t)(uintptr_t)ar->ar_arg_addr); 907 kau_write(rec, tok); 908 } 909 UPATH1_VNODE1_TOKENS; 910 break; 911 912 case AUE_MKDIR: 913 if (ARG_IS_VALID(kar, ARG_MODE)) { 914 tok = au_to_arg32(2, "mode", ar->ar_arg_mode); 915 kau_write(rec, tok); 916 } 917 UPATH1_VNODE1_TOKENS; 918 break; 919 920 case AUE_MKNOD: 921 if (ARG_IS_VALID(kar, ARG_MODE)) { 922 tok = au_to_arg32(2, "mode", ar->ar_arg_mode); 923 kau_write(rec, tok); 924 } 925 if (ARG_IS_VALID(kar, ARG_DEV)) { 926 tok = au_to_arg32(3, "dev", ar->ar_arg_dev); 927 kau_write(rec, tok); 928 } 929 UPATH1_VNODE1_TOKENS; 930 break; 931 932 case AUE_MMAP: 933 case AUE_MUNMAP: 934 case AUE_MPROTECT: 935 case AUE_MLOCK: 936 case AUE_MUNLOCK: 937 case AUE_MINHERIT: 938 if (ARG_IS_VALID(kar, ARG_ADDR)) { 939 tok = au_to_arg32(1, "addr", 940 (u_int32_t)(uintptr_t)ar->ar_arg_addr); 941 kau_write(rec, tok); 942 } 943 if (ARG_IS_VALID(kar, ARG_LEN)) { 944 tok = au_to_arg32(2, "len", ar->ar_arg_len); 945 kau_write(rec, tok); 946 } 947 if (ar->ar_event == AUE_MMAP) 948 FD_VNODE1_TOKENS; 949 if (ar->ar_event == AUE_MPROTECT) { 950 if (ARG_IS_VALID(kar, ARG_VALUE)) { 951 tok = au_to_arg32(3, "protection", 952 ar->ar_arg_value); 953 kau_write(rec, tok); 954 } 955 } 956 if (ar->ar_event == AUE_MINHERIT) { 957 if (ARG_IS_VALID(kar, ARG_VALUE)) { 958 tok = au_to_arg32(3, "inherit", 959 ar->ar_arg_value); 960 kau_write(rec, tok); 961 } 962 } 963 break; 964 965 case AUE_MOUNT: 966 case AUE_NMOUNT: 967 /* XXX Need to handle NFS mounts */ 968 if (ARG_IS_VALID(kar, ARG_FFLAGS)) { 969 tok = au_to_arg32(3, "flags", ar->ar_arg_fflags); 970 kau_write(rec, tok); 971 } 972 if (ARG_IS_VALID(kar, ARG_TEXT)) { 973 tok = au_to_text(ar->ar_arg_text); 974 kau_write(rec, tok); 975 } 976 /* fall through */ 977 978 case AUE_UMOUNT: 979 UPATH1_VNODE1_TOKENS; 980 break; 981 982 case AUE_MSGCTL: 983 ar->ar_event = msgctl_to_event(ar->ar_arg_svipc_cmd); 984 /* Fall through */ 985 986 case AUE_MSGRCV: 987 case AUE_MSGSND: 988 tok = au_to_arg32(1, "msg ID", ar->ar_arg_svipc_id); 989 kau_write(rec, tok); 990 if (ar->ar_errno != EINVAL) { 991 tok = au_to_ipc(AT_IPC_MSG, ar->ar_arg_svipc_id); 992 kau_write(rec, tok); 993 } 994 break; 995 996 case AUE_MSGGET: 997 if (ar->ar_errno == 0) { 998 if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) { 999 tok = au_to_ipc(AT_IPC_MSG, 1000 ar->ar_arg_svipc_id); 1001 kau_write(rec, tok); 1002 } 1003 } 1004 break; 1005 1006 case AUE_RESETSHFILE: 1007 if (ARG_IS_VALID(kar, ARG_ADDR)) { 1008 tok = au_to_arg32(1, "base addr", 1009 (u_int32_t)(uintptr_t)ar->ar_arg_addr); 1010 kau_write(rec, tok); 1011 } 1012 break; 1013 1014 case AUE_OPEN_RC: 1015 case AUE_OPEN_RTC: 1016 case AUE_OPEN_RWC: 1017 case AUE_OPEN_RWTC: 1018 case AUE_OPEN_WC: 1019 case AUE_OPEN_WTC: 1020 case AUE_CREAT: 1021 if (ARG_IS_VALID(kar, ARG_MODE)) { 1022 tok = au_to_arg32(3, "mode", ar->ar_arg_mode); 1023 kau_write(rec, tok); 1024 } 1025 /* fall through */ 1026 1027 case AUE_OPEN_R: 1028 case AUE_OPEN_RT: 1029 case AUE_OPEN_RW: 1030 case AUE_OPEN_RWT: 1031 case AUE_OPEN_W: 1032 case AUE_OPEN_WT: 1033 if (ARG_IS_VALID(kar, ARG_FFLAGS)) { 1034 tok = au_to_arg32(2, "flags", ar->ar_arg_fflags); 1035 kau_write(rec, tok); 1036 } 1037 UPATH1_VNODE1_TOKENS; 1038 break; 1039 1040 case AUE_PTRACE: 1041 if (ARG_IS_VALID(kar, ARG_CMD)) { 1042 tok = au_to_arg32(1, "request", ar->ar_arg_cmd); 1043 kau_write(rec, tok); 1044 } 1045 if (ARG_IS_VALID(kar, ARG_ADDR)) { 1046 tok = au_to_arg32(3, "addr", 1047 (u_int32_t)(uintptr_t)ar->ar_arg_addr); 1048 kau_write(rec, tok); 1049 } 1050 if (ARG_IS_VALID(kar, ARG_VALUE)) { 1051 tok = au_to_arg32(4, "data", ar->ar_arg_value); 1052 kau_write(rec, tok); 1053 } 1054 PROCESS_PID_TOKENS(2); 1055 break; 1056 1057 case AUE_QUOTACTL: 1058 if (ARG_IS_VALID(kar, ARG_CMD)) { 1059 tok = au_to_arg32(2, "command", ar->ar_arg_cmd); 1060 kau_write(rec, tok); 1061 } 1062 if (ARG_IS_VALID(kar, ARG_UID)) { 1063 tok = au_to_arg32(3, "uid", ar->ar_arg_uid); 1064 kau_write(rec, tok); 1065 } 1066 UPATH1_VNODE1_TOKENS; 1067 break; 1068 1069 case AUE_REBOOT: 1070 if (ARG_IS_VALID(kar, ARG_CMD)) { 1071 tok = au_to_arg32(1, "howto", ar->ar_arg_cmd); 1072 kau_write(rec, tok); 1073 } 1074 break; 1075 1076 case AUE_SEMCTL: 1077 ar->ar_event = semctl_to_event(ar->ar_arg_svipc_cmd); 1078 /* Fall through */ 1079 1080 case AUE_SEMOP: 1081 if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) { 1082 tok = au_to_arg32(1, "sem ID", ar->ar_arg_svipc_id); 1083 kau_write(rec, tok); 1084 if (ar->ar_errno != EINVAL) { 1085 tok = au_to_ipc(AT_IPC_SEM, 1086 ar->ar_arg_svipc_id); 1087 kau_write(rec, tok); 1088 } 1089 } 1090 break; 1091 1092 case AUE_SEMGET: 1093 if (ar->ar_errno == 0) { 1094 if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) { 1095 tok = au_to_ipc(AT_IPC_SEM, 1096 ar->ar_arg_svipc_id); 1097 kau_write(rec, tok); 1098 } 1099 } 1100 break; 1101 1102 case AUE_SETEGID: 1103 if (ARG_IS_VALID(kar, ARG_EGID)) { 1104 tok = au_to_arg32(1, "gid", ar->ar_arg_egid); 1105 kau_write(rec, tok); 1106 } 1107 break; 1108 1109 case AUE_SETEUID: 1110 if (ARG_IS_VALID(kar, ARG_EUID)) { 1111 tok = au_to_arg32(1, "uid", ar->ar_arg_euid); 1112 kau_write(rec, tok); 1113 } 1114 break; 1115 1116 case AUE_SETREGID: 1117 if (ARG_IS_VALID(kar, ARG_RGID)) { 1118 tok = au_to_arg32(1, "rgid", ar->ar_arg_rgid); 1119 kau_write(rec, tok); 1120 } 1121 if (ARG_IS_VALID(kar, ARG_EGID)) { 1122 tok = au_to_arg32(2, "egid", ar->ar_arg_egid); 1123 kau_write(rec, tok); 1124 } 1125 break; 1126 1127 case AUE_SETREUID: 1128 if (ARG_IS_VALID(kar, ARG_RUID)) { 1129 tok = au_to_arg32(1, "ruid", ar->ar_arg_ruid); 1130 kau_write(rec, tok); 1131 } 1132 if (ARG_IS_VALID(kar, ARG_EUID)) { 1133 tok = au_to_arg32(2, "euid", ar->ar_arg_euid); 1134 kau_write(rec, tok); 1135 } 1136 break; 1137 1138 case AUE_SETRESGID: 1139 if (ARG_IS_VALID(kar, ARG_RGID)) { 1140 tok = au_to_arg32(1, "rgid", ar->ar_arg_rgid); 1141 kau_write(rec, tok); 1142 } 1143 if (ARG_IS_VALID(kar, ARG_EGID)) { 1144 tok = au_to_arg32(2, "egid", ar->ar_arg_egid); 1145 kau_write(rec, tok); 1146 } 1147 if (ARG_IS_VALID(kar, ARG_SGID)) { 1148 tok = au_to_arg32(3, "sgid", ar->ar_arg_sgid); 1149 kau_write(rec, tok); 1150 } 1151 break; 1152 1153 case AUE_SETRESUID: 1154 if (ARG_IS_VALID(kar, ARG_RUID)) { 1155 tok = au_to_arg32(1, "ruid", ar->ar_arg_ruid); 1156 kau_write(rec, tok); 1157 } 1158 if (ARG_IS_VALID(kar, ARG_EUID)) { 1159 tok = au_to_arg32(2, "euid", ar->ar_arg_euid); 1160 kau_write(rec, tok); 1161 } 1162 if (ARG_IS_VALID(kar, ARG_SUID)) { 1163 tok = au_to_arg32(3, "suid", ar->ar_arg_suid); 1164 kau_write(rec, tok); 1165 } 1166 break; 1167 1168 case AUE_SETGID: 1169 if (ARG_IS_VALID(kar, ARG_GID)) { 1170 tok = au_to_arg32(1, "gid", ar->ar_arg_gid); 1171 kau_write(rec, tok); 1172 } 1173 break; 1174 1175 case AUE_SETUID: 1176 if (ARG_IS_VALID(kar, ARG_UID)) { 1177 tok = au_to_arg32(1, "uid", ar->ar_arg_uid); 1178 kau_write(rec, tok); 1179 } 1180 break; 1181 1182 case AUE_SETGROUPS: 1183 if (ARG_IS_VALID(kar, ARG_GROUPSET)) { 1184 for(ctr = 0; ctr < ar->ar_arg_groups.gidset_size; ctr++) 1185 { 1186 tok = au_to_arg32(1, "setgroups", ar->ar_arg_groups.gidset[ctr]); 1187 kau_write(rec, tok); 1188 } 1189 } 1190 break; 1191 1192 case AUE_SETLOGIN: 1193 if (ARG_IS_VALID(kar, ARG_TEXT)) { 1194 tok = au_to_text(ar->ar_arg_text); 1195 kau_write(rec, tok); 1196 } 1197 break; 1198 1199 case AUE_SETPRIORITY: 1200 if (ARG_IS_VALID(kar, ARG_CMD)) { 1201 tok = au_to_arg32(1, "which", ar->ar_arg_cmd); 1202 kau_write(rec, tok); 1203 } 1204 if (ARG_IS_VALID(kar, ARG_UID)) { 1205 tok = au_to_arg32(2, "who", ar->ar_arg_uid); 1206 kau_write(rec, tok); 1207 } 1208 if (ARG_IS_VALID(kar, ARG_VALUE)) { 1209 tok = au_to_arg32(2, "priority", ar->ar_arg_value); 1210 kau_write(rec, tok); 1211 } 1212 break; 1213 1214 case AUE_SETPRIVEXEC: 1215 if (ARG_IS_VALID(kar, ARG_VALUE)) { 1216 tok = au_to_arg32(1, "flag", ar->ar_arg_value); 1217 kau_write(rec, tok); 1218 } 1219 break; 1220 1221 /* AUE_SHMAT, AUE_SHMCTL, AUE_SHMDT and AUE_SHMGET are SysV IPC */ 1222 case AUE_SHMAT: 1223 if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) { 1224 tok = au_to_arg32(1, "shmid", ar->ar_arg_svipc_id); 1225 kau_write(rec, tok); 1226 /* XXXAUDIT: Does having the ipc token make sense? */ 1227 tok = au_to_ipc(AT_IPC_SHM, ar->ar_arg_svipc_id); 1228 kau_write(rec, tok); 1229 } 1230 if (ARG_IS_VALID(kar, ARG_SVIPC_ADDR)) { 1231 tok = au_to_arg32(2, "shmaddr", 1232 (int)(uintptr_t)ar->ar_arg_svipc_addr); 1233 kau_write(rec, tok); 1234 } 1235 if (ARG_IS_VALID(kar, ARG_SVIPC_PERM)) { 1236 tok = au_to_ipc_perm(&ar->ar_arg_svipc_perm); 1237 kau_write(rec, tok); 1238 } 1239 break; 1240 1241 case AUE_SHMCTL: 1242 if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) { 1243 tok = au_to_arg32(1, "shmid", ar->ar_arg_svipc_id); 1244 kau_write(rec, tok); 1245 /* XXXAUDIT: Does having the ipc token make sense? */ 1246 tok = au_to_ipc(AT_IPC_SHM, ar->ar_arg_svipc_id); 1247 kau_write(rec, tok); 1248 } 1249 switch (ar->ar_arg_svipc_cmd) { 1250 case IPC_STAT: 1251 ar->ar_event = AUE_SHMCTL_STAT; 1252 break; 1253 case IPC_RMID: 1254 ar->ar_event = AUE_SHMCTL_RMID; 1255 break; 1256 case IPC_SET: 1257 ar->ar_event = AUE_SHMCTL_SET; 1258 if (ARG_IS_VALID(kar, ARG_SVIPC_PERM)) { 1259 tok = au_to_ipc_perm(&ar->ar_arg_svipc_perm); 1260 kau_write(rec, tok); 1261 } 1262 break; 1263 default: 1264 break; /* We will audit a bad command */ 1265 } 1266 break; 1267 1268 case AUE_SHMDT: 1269 if (ARG_IS_VALID(kar, ARG_SVIPC_ADDR)) { 1270 tok = au_to_arg32(1, "shmaddr", 1271 (int)(uintptr_t)ar->ar_arg_svipc_addr); 1272 kau_write(rec, tok); 1273 } 1274 break; 1275 1276 case AUE_SHMGET: 1277 /* This is unusual; the return value is in an argument token */ 1278 if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) { 1279 tok = au_to_arg32(0, "shmid", ar->ar_arg_svipc_id); 1280 kau_write(rec, tok); 1281 tok = au_to_ipc(AT_IPC_SHM, ar->ar_arg_svipc_id); 1282 kau_write(rec, tok); 1283 } 1284 if (ARG_IS_VALID(kar, ARG_SVIPC_PERM)) { 1285 tok = au_to_ipc_perm(&ar->ar_arg_svipc_perm); 1286 kau_write(rec, tok); 1287 } 1288 break; 1289 1290 /* AUE_SHMOPEN, AUE_SHMUNLINK, AUE_SEMOPEN, AUE_SEMCLOSE 1291 * and AUE_SEMUNLINK are Posix IPC */ 1292 case AUE_SHMOPEN: 1293 if (ARG_IS_VALID(kar, ARG_SVIPC_ADDR)) { 1294 tok = au_to_arg32(2, "flags", ar->ar_arg_fflags); 1295 kau_write(rec, tok); 1296 } 1297 if (ARG_IS_VALID(kar, ARG_MODE)) { 1298 tok = au_to_arg32(3, "mode", ar->ar_arg_mode); 1299 kau_write(rec, tok); 1300 } 1301 case AUE_SHMUNLINK: 1302 if (ARG_IS_VALID(kar, ARG_TEXT)) { 1303 tok = au_to_text(ar->ar_arg_text); 1304 kau_write(rec, tok); 1305 } 1306 if (ARG_IS_VALID(kar, ARG_POSIX_IPC_PERM)) { 1307 /* Create an ipc_perm token */ 1308 struct ipc_perm perm; 1309 perm.uid = ar->ar_arg_pipc_perm.pipc_uid; 1310 perm.gid = ar->ar_arg_pipc_perm.pipc_gid; 1311 perm.cuid = ar->ar_arg_pipc_perm.pipc_uid; 1312 perm.cgid = ar->ar_arg_pipc_perm.pipc_gid; 1313 perm.mode = ar->ar_arg_pipc_perm.pipc_mode; 1314 perm.seq = 0; 1315 perm.key = 0; 1316 tok = au_to_ipc_perm(&perm); 1317 kau_write(rec, tok); 1318 } 1319 break; 1320 1321 case AUE_SEMOPEN: 1322 if (ARG_IS_VALID(kar, ARG_FFLAGS)) { 1323 tok = au_to_arg32(2, "flags", ar->ar_arg_fflags); 1324 kau_write(rec, tok); 1325 } 1326 if (ARG_IS_VALID(kar, ARG_MODE)) { 1327 tok = au_to_arg32(3, "mode", ar->ar_arg_mode); 1328 kau_write(rec, tok); 1329 } 1330 if (ARG_IS_VALID(kar, ARG_VALUE)) { 1331 tok = au_to_arg32(4, "value", ar->ar_arg_value); 1332 kau_write(rec, tok); 1333 } 1334 /* fall through */ 1335 1336 case AUE_SEMUNLINK: 1337 if (ARG_IS_VALID(kar, ARG_TEXT)) { 1338 tok = au_to_text(ar->ar_arg_text); 1339 kau_write(rec, tok); 1340 } 1341 if (ARG_IS_VALID(kar, ARG_POSIX_IPC_PERM)) { 1342 /* Create an ipc_perm token */ 1343 struct ipc_perm perm; 1344 perm.uid = ar->ar_arg_pipc_perm.pipc_uid; 1345 perm.gid = ar->ar_arg_pipc_perm.pipc_gid; 1346 perm.cuid = ar->ar_arg_pipc_perm.pipc_uid; 1347 perm.cgid = ar->ar_arg_pipc_perm.pipc_gid; 1348 perm.mode = ar->ar_arg_pipc_perm.pipc_mode; 1349 perm.seq = 0; 1350 perm.key = 0; 1351 tok = au_to_ipc_perm(&perm); 1352 kau_write(rec, tok); 1353 } 1354 break; 1355 1356 case AUE_SEMCLOSE: 1357 if (ARG_IS_VALID(kar, ARG_FD)) { 1358 tok = au_to_arg32(1, "sem", ar->ar_arg_fd); 1359 kau_write(rec, tok); 1360 } 1361 break; 1362 1363 case AUE_SYMLINK: 1364 if (ARG_IS_VALID(kar, ARG_TEXT)) { 1365 tok = au_to_text(ar->ar_arg_text); 1366 kau_write(rec, tok); 1367 } 1368 UPATH1_VNODE1_TOKENS; 1369 break; 1370 1371 case AUE_SYSCTL: 1372 if (ARG_IS_VALID(kar, ARG_CTLNAME | ARG_LEN)) { 1373 for (ctr = 0; ctr < ar->ar_arg_len; ctr++) { 1374 tok = au_to_arg32(1, "name", 1375 ar->ar_arg_ctlname[ctr]); 1376 kau_write(rec, tok); 1377 } 1378 } 1379 if (ARG_IS_VALID(kar, ARG_VALUE)) { 1380 tok = au_to_arg32(5, "newval", ar->ar_arg_value); 1381 kau_write(rec, tok); 1382 } 1383 if (ARG_IS_VALID(kar, ARG_TEXT)) { 1384 tok = au_to_text(ar->ar_arg_text); 1385 kau_write(rec, tok); 1386 } 1387 break; 1388 1389 case AUE_UMASK: 1390 if (ARG_IS_VALID(kar, ARG_MASK)) { 1391 tok = au_to_arg32(1, "new mask", ar->ar_arg_mask); 1392 kau_write(rec, tok); 1393 } 1394 tok = au_to_arg32(0, "prev mask", ar->ar_retval); 1395 kau_write(rec, tok); 1396 break; 1397 1398 case AUE_WAIT4: 1399 if (ARG_IS_VALID(kar, ARG_PID)) { 1400 tok = au_to_arg32(0, "pid", ar->ar_arg_pid); 1401 kau_write(rec, tok); 1402 } 1403 break; 1404 1405 case AUE_NULL: 1406 default: 1407 printf("BSM conversion requested for unknown event %d\n", 1408 ar->ar_event); 1409 /* Write the subject token so it is properly freed here. */ 1410 kau_write(rec, subj_tok); 1411 kau_free(rec); 1412 return (BSM_NOAUDIT); 1413 } 1414 1415 kau_write(rec, subj_tok); 1416 tok = au_to_return32((char)ar->ar_errno, ar->ar_retval); 1417 kau_write(rec, tok); /* Every record gets a return token */ 1418 1419 kau_close(rec, &ar->ar_endtime, ar->ar_event); 1420 1421 *pau = rec; 1422 return (BSM_SUCCESS); 1423} 1424 1425/* 1426 * Verify that a record is a valid BSM record. This verification is simple 1427 * now, but may be expanded on sometime in the future. Return 1 if the 1428 * record is good, 0 otherwise. 1429 */ 1430int 1431bsm_rec_verify(void *rec) 1432{ 1433 char c = *(char *)rec; 1434 1435 /* 1436 * Check the token ID of the first token; it has to be a header 1437 * token. 1438 * 1439 * XXXAUDIT There needs to be a token structure to map a token. 1440 * XXXAUDIT 'Shouldn't be simply looking at the first char. 1441 */ 1442 if ((c != AUT_HEADER32) && (c != AUT_HEADER32_EX) && 1443 (c != AUT_HEADER64) && (c != AUT_HEADER64_EX)) 1444 return (0); 1445 return (1); 1446} 1447