audit_private.h revision 245573 
1/*-
2 * Copyright (c) 1999-2009 Apple Inc.
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1.  Redistributions of source code must retain the above copyright
9 *     notice, this list of conditions and the following disclaimer.
10 * 2.  Redistributions in binary form must reproduce the above copyright
11 *     notice, this list of conditions and the following disclaimer in the
12 *     documentation and/or other materials provided with the distribution.
13 * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
14 *     its contributors may be used to endorse or promote products derived
15 *     from this software without specific prior written permission.
16 *
17 * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND
18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20 * ARE DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR
21 * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
25 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
26 * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
27 * POSSIBILITY OF SUCH DAMAGE.
28 *
29 * $FreeBSD: head/sys/security/audit/audit_private.h 245573 2013-01-17 21:02:53Z csjp $
30 */
31
32/*
33 * This include file contains function prototypes and type definitions used
34 * within the audit implementation.
35 */
36
37#ifndef _SECURITY_AUDIT_PRIVATE_H_
38#define	_SECURITY_AUDIT_PRIVATE_H_
39
40#ifndef _KERNEL
41#error "no user-serviceable parts inside"
42#endif
43
44#include <sys/ipc.h>
45#include <sys/socket.h>
46#include <sys/ucred.h>
47
48#ifdef MALLOC_DECLARE
49MALLOC_DECLARE(M_AUDITBSM);
50MALLOC_DECLARE(M_AUDITDATA);
51MALLOC_DECLARE(M_AUDITPATH);
52MALLOC_DECLARE(M_AUDITTEXT);
53MALLOC_DECLARE(M_AUDITGIDSET);
54#endif
55
56/*
57 * Audit control variables that are usually set/read via system calls and
58 * used to control various aspects of auditing.
59 */
60extern struct au_qctrl		audit_qctrl;
61extern struct audit_fstat	audit_fstat;
62extern struct au_mask		audit_nae_mask;
63extern int			audit_panic_on_write_fail;
64extern int			audit_fail_stop;
65extern int			audit_argv;
66extern int			audit_arge;
67
68/*
69 * Success/failure conditions for the conversion of a kernel audit record to
70 * BSM format.
71 */
72#define	BSM_SUCCESS	0
73#define	BSM_FAILURE	1
74#define	BSM_NOAUDIT	2
75
76/*
77 * Defines for the kernel audit record k_ar_commit field.  Flags are set to
78 * indicate what sort of record it is, and which preselection mechanism
79 * selected it.
80 */
81#define	AR_COMMIT_KERNEL	0x00000001U
82#define	AR_COMMIT_USER		0x00000010U
83
84#define	AR_PRESELECT_TRAIL	0x00001000U
85#define	AR_PRESELECT_PIPE	0x00002000U
86
87#define	AR_PRESELECT_USER_TRAIL	0x00004000U
88#define	AR_PRESELECT_USER_PIPE	0x00008000U
89
90/*
91 * Audit data is generated as a stream of struct audit_record structures,
92 * linked by struct kaudit_record, and contain storage for possible audit so
93 * that it will not need to be allocated during the processing of a system
94 * call, both improving efficiency and avoiding sleeping at untimely moments.
95 * This structure is converted to BSM format before being written to disk.
96 */
97struct vnode_au_info {
98	mode_t	vn_mode;
99	uid_t	vn_uid;
100	gid_t	vn_gid;
101	dev_t	vn_dev;
102	long	vn_fsid;
103	long	vn_fileid;
104	long	vn_gen;
105};
106
107struct groupset {
108	gid_t	*gidset;
109	u_int	 gidset_size;
110};
111
112struct socket_au_info {
113	int		so_domain;
114	int		so_type;
115	int		so_protocol;
116	in_addr_t	so_raddr;	/* Remote address if INET socket. */
117	in_addr_t	so_laddr;	/* Local address if INET socket. */
118	u_short		so_rport;	/* Remote port. */
119	u_short		so_lport;	/* Local port. */
120};
121
122/*
123 * The following is used for A_OLDSETQCTRL and AU_OLDGETQCTRL and a 64-bit
124 * userland.
125 */
126struct au_qctrl64 {
127	u_int64_t	aq64_hiwater;
128	u_int64_t	aq64_lowater;
129	u_int64_t	aq64_bufsz;
130	u_int64_t	aq64_delay;
131	u_int64_t	aq64_minfree;
132};
133typedef	struct au_qctrl64	au_qctrl64_t;
134
135union auditon_udata {
136	char			*au_path;
137	int			au_cond;
138	int			au_flags;
139	int			au_policy;
140	int			au_trigger;
141	int64_t			au_cond64;
142	int64_t			au_policy64;
143	au_evclass_map_t	au_evclass;
144	au_mask_t		au_mask;
145	auditinfo_t		au_auinfo;
146	auditpinfo_t		au_aupinfo;
147	auditpinfo_addr_t	au_aupinfo_addr;
148	au_qctrl_t		au_qctrl;
149	au_qctrl64_t		au_qctrl64;
150	au_stat_t		au_stat;
151	au_fstat_t		au_fstat;
152	auditinfo_addr_t	au_kau_info;
153};
154
155struct posix_ipc_perm {
156	uid_t	pipc_uid;
157	gid_t	pipc_gid;
158	mode_t	pipc_mode;
159};
160
161struct audit_record {
162	/* Audit record header. */
163	u_int32_t		ar_magic;
164	int			ar_event;
165	int			ar_retval; /* value returned to the process */
166	int			ar_errno;  /* return status of system call */
167	struct timespec		ar_starttime;
168	struct timespec		ar_endtime;
169	u_int64_t		ar_valid_arg;  /* Bitmask of valid arguments */
170
171	/* Audit subject information. */
172	struct xucred		ar_subj_cred;
173	uid_t			ar_subj_ruid;
174	gid_t			ar_subj_rgid;
175	gid_t			ar_subj_egid;
176	uid_t			ar_subj_auid; /* Audit user ID */
177	pid_t			ar_subj_asid; /* Audit session ID */
178	pid_t			ar_subj_pid;
179	struct au_tid		ar_subj_term;
180	struct au_tid_addr	ar_subj_term_addr;
181	struct au_mask		ar_subj_amask;
182
183	/* Operation arguments. */
184	uid_t			ar_arg_euid;
185	uid_t			ar_arg_ruid;
186	uid_t			ar_arg_suid;
187	gid_t			ar_arg_egid;
188	gid_t			ar_arg_rgid;
189	gid_t			ar_arg_sgid;
190	pid_t			ar_arg_pid;
191	pid_t			ar_arg_asid;
192	struct au_tid		ar_arg_termid;
193	struct au_tid_addr	ar_arg_termid_addr;
194	uid_t			ar_arg_uid;
195	uid_t			ar_arg_auid;
196	gid_t			ar_arg_gid;
197	struct groupset		ar_arg_groups;
198	int			ar_arg_fd;
199	int			ar_arg_atfd1;
200	int			ar_arg_atfd2;
201	int			ar_arg_fflags;
202	mode_t			ar_arg_mode;
203	int			ar_arg_dev;
204	long			ar_arg_value;
205	void *			ar_arg_addr;
206	int			ar_arg_len;
207	int			ar_arg_mask;
208	u_int			ar_arg_signum;
209	char			ar_arg_login[MAXLOGNAME];
210	int			ar_arg_ctlname[CTL_MAXNAME];
211	struct socket_au_info	ar_arg_sockinfo;
212	char			*ar_arg_upath1;
213	char			*ar_arg_upath2;
214	char			*ar_arg_text;
215	struct au_mask		ar_arg_amask;
216	struct vnode_au_info	ar_arg_vnode1;
217	struct vnode_au_info	ar_arg_vnode2;
218	int			ar_arg_cmd;
219	int			ar_arg_svipc_cmd;
220	struct ipc_perm		ar_arg_svipc_perm;
221	int			ar_arg_svipc_id;
222	void *			ar_arg_svipc_addr;
223	struct posix_ipc_perm	ar_arg_pipc_perm;
224	union auditon_udata	ar_arg_auditon;
225	char			*ar_arg_argv;
226	int			ar_arg_argc;
227	char			*ar_arg_envv;
228	int			ar_arg_envc;
229	int			ar_arg_exitstatus;
230	int			ar_arg_exitretval;
231	struct sockaddr_storage ar_arg_sockaddr;
232	cap_rights_t		ar_arg_rights;
233	char			ar_jailname[MAXHOSTNAMELEN];
234};
235
236/*
237 * Arguments in the audit record are initially not defined; flags are set to
238 * indicate if they are present so they can be included in the audit log
239 * stream only if defined.
240 */
241#define	ARG_EUID		0x0000000000000001ULL
242#define	ARG_RUID		0x0000000000000002ULL
243#define	ARG_SUID		0x0000000000000004ULL
244#define	ARG_EGID		0x0000000000000008ULL
245#define	ARG_RGID		0x0000000000000010ULL
246#define	ARG_SGID		0x0000000000000020ULL
247#define	ARG_PID			0x0000000000000040ULL
248#define	ARG_UID			0x0000000000000080ULL
249#define	ARG_AUID		0x0000000000000100ULL
250#define	ARG_GID			0x0000000000000200ULL
251#define	ARG_FD			0x0000000000000400ULL
252#define	ARG_POSIX_IPC_PERM	0x0000000000000800ULL
253#define	ARG_FFLAGS		0x0000000000001000ULL
254#define	ARG_MODE		0x0000000000002000ULL
255#define	ARG_DEV			0x0000000000004000ULL
256#define	ARG_ADDR		0x0000000000008000ULL
257#define	ARG_LEN			0x0000000000010000ULL
258#define	ARG_MASK		0x0000000000020000ULL
259#define	ARG_SIGNUM		0x0000000000040000ULL
260#define	ARG_LOGIN		0x0000000000080000ULL
261#define	ARG_SADDRINET		0x0000000000100000ULL
262#define	ARG_SADDRINET6		0x0000000000200000ULL
263#define	ARG_SADDRUNIX		0x0000000000400000ULL
264#define	ARG_TERMID_ADDR		0x0000000000400000ULL
265#define	ARG_UNUSED2		0x0000000001000000ULL
266#define	ARG_UPATH1		0x0000000002000000ULL
267#define	ARG_UPATH2		0x0000000004000000ULL
268#define	ARG_TEXT		0x0000000008000000ULL
269#define	ARG_VNODE1		0x0000000010000000ULL
270#define	ARG_VNODE2		0x0000000020000000ULL
271#define	ARG_SVIPC_CMD		0x0000000040000000ULL
272#define	ARG_SVIPC_PERM		0x0000000080000000ULL
273#define	ARG_SVIPC_ID		0x0000000100000000ULL
274#define	ARG_SVIPC_ADDR		0x0000000200000000ULL
275#define	ARG_GROUPSET		0x0000000400000000ULL
276#define	ARG_CMD			0x0000000800000000ULL
277#define	ARG_SOCKINFO		0x0000001000000000ULL
278#define	ARG_ASID		0x0000002000000000ULL
279#define	ARG_TERMID		0x0000004000000000ULL
280#define	ARG_AUDITON		0x0000008000000000ULL
281#define	ARG_VALUE		0x0000010000000000ULL
282#define	ARG_AMASK		0x0000020000000000ULL
283#define	ARG_CTLNAME		0x0000040000000000ULL
284#define	ARG_PROCESS		0x0000080000000000ULL
285#define	ARG_MACHPORT1		0x0000100000000000ULL
286#define	ARG_MACHPORT2		0x0000200000000000ULL
287#define	ARG_EXIT		0x0000400000000000ULL
288#define	ARG_IOVECSTR		0x0000800000000000ULL
289#define	ARG_ARGV		0x0001000000000000ULL
290#define	ARG_ENVV		0x0002000000000000ULL
291#define	ARG_ATFD1		0x0004000000000000ULL
292#define	ARG_ATFD2		0x0008000000000000ULL
293#define	ARG_RIGHTS		0x0010000000000000ULL
294#define	ARG_NONE		0x0000000000000000ULL
295#define	ARG_ALL			0xFFFFFFFFFFFFFFFFULL
296
297#define	ARG_IS_VALID(kar, arg)	((kar)->k_ar.ar_valid_arg & (arg))
298#define	ARG_SET_VALID(kar, arg) do {					\
299	(kar)->k_ar.ar_valid_arg |= (arg);				\
300} while (0)
301#define	ARG_CLEAR_VALID(kar, arg) do {					\
302	(kar)->k_ar.ar_valid_arg &= ~(arg);				\
303} while (0)
304
305/*
306 * In-kernel version of audit record; the basic record plus queue meta-data.
307 * This record can also have a pointer set to some opaque data that will be
308 * passed through to the audit writing mechanism.
309 */
310struct kaudit_record {
311	struct audit_record		 k_ar;
312	u_int32_t			 k_ar_commit;
313	void				*k_udata;	/* User data. */
314	u_int				 k_ulen;	/* User data length. */
315	struct uthread			*k_uthread;	/* Audited thread. */
316	TAILQ_ENTRY(kaudit_record)	 k_q;
317};
318TAILQ_HEAD(kaudit_queue, kaudit_record);
319
320/*
321 * Functions to manage the allocation, release, and commit of kernel audit
322 * records.
323 */
324void			 audit_abort(struct kaudit_record *ar);
325void			 audit_commit(struct kaudit_record *ar, int error,
326			    int retval);
327struct kaudit_record	*audit_new(int event, struct thread *td);
328
329/*
330 * Functions relating to the conversion of internal kernel audit records to
331 * the BSM file format.
332 */
333struct au_record;
334int	 kaudit_to_bsm(struct kaudit_record *kar, struct au_record **pau);
335int	 bsm_rec_verify(void *rec);
336
337/*
338 * Kernel versions of the libbsm audit record functions.
339 */
340void	 kau_free(struct au_record *rec);
341void	 kau_init(void);
342
343/*
344 * Return values for pre-selection and post-selection decisions.
345 */
346#define	AU_PRS_SUCCESS	1
347#define	AU_PRS_FAILURE	2
348#define	AU_PRS_BOTH	(AU_PRS_SUCCESS|AU_PRS_FAILURE)
349
350/*
351 * Data structures relating to the kernel audit queue.  Ideally, these might
352 * be abstracted so that only accessor methods are exposed.
353 */
354extern struct mtx		audit_mtx;
355extern struct cv		audit_watermark_cv;
356extern struct cv		audit_worker_cv;
357extern struct kaudit_queue	audit_q;
358extern int			audit_q_len;
359extern int			audit_pre_q_len;
360extern int			audit_in_failure;
361
362/*
363 * Flags to use on audit files when opening and closing.
364 */
365#define	AUDIT_OPEN_FLAGS	(FWRITE | O_APPEND)
366#define	AUDIT_CLOSE_FLAGS	(FWRITE | O_APPEND)
367
368#include <sys/fcntl.h>
369#include <sys/kernel.h>
370#include <sys/malloc.h>
371
372/*
373 * Some of the BSM tokenizer functions take different parameters in the
374 * kernel implementations in order to save the copying of large kernel data
375 * structures.  The prototypes of these functions are declared here.
376 */
377token_t		*kau_to_socket(struct socket_au_info *soi);
378
379/*
380 * audit_klib prototypes
381 */
382int		 au_preselect(au_event_t event, au_class_t class,
383		    au_mask_t *mask_p, int sorf);
384void		 au_evclassmap_init(void);
385void		 au_evclassmap_insert(au_event_t event, au_class_t class);
386au_class_t	 au_event_class(au_event_t event);
387au_event_t	 audit_ctlname_to_sysctlevent(int name[], uint64_t valid_arg);
388au_event_t	 audit_flags_and_error_to_openevent(int oflags, int error);
389au_event_t	 audit_flags_and_error_to_openatevent(int oflags, int error);
390au_event_t	 audit_msgctl_to_event(int cmd);
391au_event_t	 audit_semctl_to_event(int cmr);
392void		 audit_canon_path(struct thread *td, int dirfd, char *path,
393		    char *cpath);
394au_event_t	 auditon_command_event(int cmd);
395
396/*
397 * Audit trigger events notify user space of kernel audit conditions
398 * asynchronously.
399 */
400void		 audit_trigger_init(void);
401int		 audit_send_trigger(unsigned int trigger);
402
403/*
404 * Accessor functions to manage global audit state.
405 */
406void	 audit_set_kinfo(struct auditinfo_addr *);
407void	 audit_get_kinfo(struct auditinfo_addr *);
408
409/*
410 * General audit related functions.
411 */
412struct kaudit_record	*currecord(void);
413void			 audit_free(struct kaudit_record *ar);
414void			 audit_shutdown(void *arg, int howto);
415void			 audit_rotate_vnode(struct ucred *cred,
416			    struct vnode *vp);
417void			 audit_worker_init(void);
418
419/*
420 * Audit pipe functions.
421 */
422int	 audit_pipe_preselect(au_id_t auid, au_event_t event,
423	    au_class_t class, int sorf, int trail_select);
424void	 audit_pipe_submit(au_id_t auid, au_event_t event, au_class_t class,
425	    int sorf, int trail_select, void *record, u_int record_len);
426void	 audit_pipe_submit_user(void *record, u_int record_len);
427
428#endif /* ! _SECURITY_AUDIT_PRIVATE_H_ */
429