audit_private.h revision 330897 
1/*-
2 * SPDX-License-Identifier: BSD-3-Clause
3 *
4 * Copyright (c) 1999-2009 Apple Inc.
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1.  Redistributions of source code must retain the above copyright
11 *     notice, this list of conditions and the following disclaimer.
12 * 2.  Redistributions in binary form must reproduce the above copyright
13 *     notice, this list of conditions and the following disclaimer in the
14 *     documentation and/or other materials provided with the distribution.
15 * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
16 *     its contributors may be used to endorse or promote products derived
17 *     from this software without specific prior written permission.
18 *
19 * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND
20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22 * ARE DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR
23 * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
27 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
28 * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
29 * POSSIBILITY OF SUCH DAMAGE.
30 *
31 * $FreeBSD: stable/11/sys/security/audit/audit_private.h 330897 2018-03-14 03:19:51Z eadler $
32 */
33
34/*
35 * This include file contains function prototypes and type definitions used
36 * within the audit implementation.
37 */
38
39#ifndef _SECURITY_AUDIT_PRIVATE_H_
40#define	_SECURITY_AUDIT_PRIVATE_H_
41
42#ifndef _KERNEL
43#error "no user-serviceable parts inside"
44#endif
45
46#include <sys/caprights.h>
47#include <sys/ipc.h>
48#include <sys/socket.h>
49#include <sys/ucred.h>
50
51#ifdef MALLOC_DECLARE
52MALLOC_DECLARE(M_AUDITBSM);
53MALLOC_DECLARE(M_AUDITDATA);
54MALLOC_DECLARE(M_AUDITPATH);
55MALLOC_DECLARE(M_AUDITTEXT);
56MALLOC_DECLARE(M_AUDITGIDSET);
57#endif
58
59/*
60 * Audit control variables that are usually set/read via system calls and
61 * used to control various aspects of auditing.
62 */
63extern struct au_qctrl		audit_qctrl;
64extern struct audit_fstat	audit_fstat;
65extern struct au_mask		audit_nae_mask;
66extern int			audit_panic_on_write_fail;
67extern int			audit_fail_stop;
68extern int			audit_argv;
69extern int			audit_arge;
70
71/*
72 * Success/failure conditions for the conversion of a kernel audit record to
73 * BSM format.
74 */
75#define	BSM_SUCCESS	0
76#define	BSM_FAILURE	1
77#define	BSM_NOAUDIT	2
78
79/*
80 * Defines for the kernel audit record k_ar_commit field.  Flags are set to
81 * indicate what sort of record it is, and which preselection mechanism
82 * selected it.
83 */
84#define	AR_COMMIT_KERNEL	0x00000001U
85#define	AR_COMMIT_USER		0x00000010U
86
87#define	AR_PRESELECT_TRAIL	0x00001000U
88#define	AR_PRESELECT_PIPE	0x00002000U
89
90#define	AR_PRESELECT_USER_TRAIL	0x00004000U
91#define	AR_PRESELECT_USER_PIPE	0x00008000U
92
93/*
94 * Audit data is generated as a stream of struct audit_record structures,
95 * linked by struct kaudit_record, and contain storage for possible audit so
96 * that it will not need to be allocated during the processing of a system
97 * call, both improving efficiency and avoiding sleeping at untimely moments.
98 * This structure is converted to BSM format before being written to disk.
99 */
100struct vnode_au_info {
101	mode_t	vn_mode;
102	uid_t	vn_uid;
103	gid_t	vn_gid;
104	dev_t	vn_dev;
105	long	vn_fsid;
106	long	vn_fileid;
107	long	vn_gen;
108};
109
110struct groupset {
111	gid_t	*gidset;
112	u_int	 gidset_size;
113};
114
115struct socket_au_info {
116	int		so_domain;
117	int		so_type;
118	int		so_protocol;
119	in_addr_t	so_raddr;	/* Remote address if INET socket. */
120	in_addr_t	so_laddr;	/* Local address if INET socket. */
121	u_short		so_rport;	/* Remote port. */
122	u_short		so_lport;	/* Local port. */
123};
124
125/*
126 * The following is used for A_OLDSETQCTRL and AU_OLDGETQCTRL and a 64-bit
127 * userland.
128 */
129struct au_qctrl64 {
130	u_int64_t	aq64_hiwater;
131	u_int64_t	aq64_lowater;
132	u_int64_t	aq64_bufsz;
133	u_int64_t	aq64_delay;
134	u_int64_t	aq64_minfree;
135};
136typedef	struct au_qctrl64	au_qctrl64_t;
137
138union auditon_udata {
139	char			*au_path;
140	int			au_cond;
141	int			au_flags;
142	int			au_policy;
143	int			au_trigger;
144	int64_t			au_cond64;
145	int64_t			au_policy64;
146	au_evclass_map_t	au_evclass;
147	au_mask_t		au_mask;
148	auditinfo_t		au_auinfo;
149	auditpinfo_t		au_aupinfo;
150	auditpinfo_addr_t	au_aupinfo_addr;
151	au_qctrl_t		au_qctrl;
152	au_qctrl64_t		au_qctrl64;
153	au_stat_t		au_stat;
154	au_fstat_t		au_fstat;
155	auditinfo_addr_t	au_kau_info;
156};
157
158struct posix_ipc_perm {
159	uid_t	pipc_uid;
160	gid_t	pipc_gid;
161	mode_t	pipc_mode;
162};
163
164struct audit_record {
165	/* Audit record header. */
166	u_int32_t		ar_magic;
167	int			ar_event;
168	int			ar_retval; /* value returned to the process */
169	int			ar_errno;  /* return status of system call */
170	struct timespec		ar_starttime;
171	struct timespec		ar_endtime;
172	u_int64_t		ar_valid_arg;  /* Bitmask of valid arguments */
173
174	/* Audit subject information. */
175	struct xucred		ar_subj_cred;
176	uid_t			ar_subj_ruid;
177	gid_t			ar_subj_rgid;
178	gid_t			ar_subj_egid;
179	uid_t			ar_subj_auid; /* Audit user ID */
180	pid_t			ar_subj_asid; /* Audit session ID */
181	pid_t			ar_subj_pid;
182	struct au_tid		ar_subj_term;
183	struct au_tid_addr	ar_subj_term_addr;
184	struct au_mask		ar_subj_amask;
185
186	/* Operation arguments. */
187	uid_t			ar_arg_euid;
188	uid_t			ar_arg_ruid;
189	uid_t			ar_arg_suid;
190	gid_t			ar_arg_egid;
191	gid_t			ar_arg_rgid;
192	gid_t			ar_arg_sgid;
193	pid_t			ar_arg_pid;
194	pid_t			ar_arg_asid;
195	struct au_tid		ar_arg_termid;
196	struct au_tid_addr	ar_arg_termid_addr;
197	uid_t			ar_arg_uid;
198	uid_t			ar_arg_auid;
199	gid_t			ar_arg_gid;
200	struct groupset		ar_arg_groups;
201	int			ar_arg_fd;
202	int			ar_arg_atfd1;
203	int			ar_arg_atfd2;
204	int			ar_arg_fflags;
205	mode_t			ar_arg_mode;
206	int			ar_arg_dev;
207	long			ar_arg_value;
208	void			*ar_arg_addr;
209	int			ar_arg_len;
210	int			ar_arg_mask;
211	u_int			ar_arg_signum;
212	char			ar_arg_login[MAXLOGNAME];
213	int			ar_arg_ctlname[CTL_MAXNAME];
214	struct socket_au_info	ar_arg_sockinfo;
215	char			*ar_arg_upath1;
216	char			*ar_arg_upath2;
217	char			*ar_arg_text;
218	struct au_mask		ar_arg_amask;
219	struct vnode_au_info	ar_arg_vnode1;
220	struct vnode_au_info	ar_arg_vnode2;
221	int			ar_arg_cmd;
222	int			ar_arg_svipc_cmd;
223	struct ipc_perm		ar_arg_svipc_perm;
224	int			ar_arg_svipc_id;
225	void			*ar_arg_svipc_addr;
226	struct posix_ipc_perm	ar_arg_pipc_perm;
227	union auditon_udata	ar_arg_auditon;
228	char			*ar_arg_argv;
229	int			ar_arg_argc;
230	char			*ar_arg_envv;
231	int			ar_arg_envc;
232	int			ar_arg_exitstatus;
233	int			ar_arg_exitretval;
234	struct sockaddr_storage ar_arg_sockaddr;
235	cap_rights_t		ar_arg_rights;
236	uint32_t		ar_arg_fcntl_rights;
237	char			ar_jailname[MAXHOSTNAMELEN];
238};
239
240/*
241 * Arguments in the audit record are initially not defined; flags are set to
242 * indicate if they are present so they can be included in the audit log
243 * stream only if defined.
244 */
245#define	ARG_EUID		0x0000000000000001ULL
246#define	ARG_RUID		0x0000000000000002ULL
247#define	ARG_SUID		0x0000000000000004ULL
248#define	ARG_EGID		0x0000000000000008ULL
249#define	ARG_RGID		0x0000000000000010ULL
250#define	ARG_SGID		0x0000000000000020ULL
251#define	ARG_PID			0x0000000000000040ULL
252#define	ARG_UID			0x0000000000000080ULL
253#define	ARG_AUID		0x0000000000000100ULL
254#define	ARG_GID			0x0000000000000200ULL
255#define	ARG_FD			0x0000000000000400ULL
256#define	ARG_POSIX_IPC_PERM	0x0000000000000800ULL
257#define	ARG_FFLAGS		0x0000000000001000ULL
258#define	ARG_MODE		0x0000000000002000ULL
259#define	ARG_DEV			0x0000000000004000ULL
260#define	ARG_ADDR		0x0000000000008000ULL
261#define	ARG_LEN			0x0000000000010000ULL
262#define	ARG_MASK		0x0000000000020000ULL
263#define	ARG_SIGNUM		0x0000000000040000ULL
264#define	ARG_LOGIN		0x0000000000080000ULL
265#define	ARG_SADDRINET		0x0000000000100000ULL
266#define	ARG_SADDRINET6		0x0000000000200000ULL
267#define	ARG_SADDRUNIX		0x0000000000400000ULL
268#define	ARG_TERMID_ADDR		0x0000000000400000ULL
269#define	ARG_UNUSED2		0x0000000001000000ULL
270#define	ARG_UPATH1		0x0000000002000000ULL
271#define	ARG_UPATH2		0x0000000004000000ULL
272#define	ARG_TEXT		0x0000000008000000ULL
273#define	ARG_VNODE1		0x0000000010000000ULL
274#define	ARG_VNODE2		0x0000000020000000ULL
275#define	ARG_SVIPC_CMD		0x0000000040000000ULL
276#define	ARG_SVIPC_PERM		0x0000000080000000ULL
277#define	ARG_SVIPC_ID		0x0000000100000000ULL
278#define	ARG_SVIPC_ADDR		0x0000000200000000ULL
279#define	ARG_GROUPSET		0x0000000400000000ULL
280#define	ARG_CMD			0x0000000800000000ULL
281#define	ARG_SOCKINFO		0x0000001000000000ULL
282#define	ARG_ASID		0x0000002000000000ULL
283#define	ARG_TERMID		0x0000004000000000ULL
284#define	ARG_AUDITON		0x0000008000000000ULL
285#define	ARG_VALUE		0x0000010000000000ULL
286#define	ARG_AMASK		0x0000020000000000ULL
287#define	ARG_CTLNAME		0x0000040000000000ULL
288#define	ARG_PROCESS		0x0000080000000000ULL
289#define	ARG_MACHPORT1		0x0000100000000000ULL
290#define	ARG_MACHPORT2		0x0000200000000000ULL
291#define	ARG_EXIT		0x0000400000000000ULL
292#define	ARG_IOVECSTR		0x0000800000000000ULL
293#define	ARG_ARGV		0x0001000000000000ULL
294#define	ARG_ENVV		0x0002000000000000ULL
295#define	ARG_ATFD1		0x0004000000000000ULL
296#define	ARG_ATFD2		0x0008000000000000ULL
297#define	ARG_RIGHTS		0x0010000000000000ULL
298#define	ARG_FCNTL_RIGHTS	0x0020000000000000ULL
299#define	ARG_NONE		0x0000000000000000ULL
300#define	ARG_ALL			0xFFFFFFFFFFFFFFFFULL
301
302#define	ARG_IS_VALID(kar, arg)	((kar)->k_ar.ar_valid_arg & (arg))
303#define	ARG_SET_VALID(kar, arg) do {					\
304	(kar)->k_ar.ar_valid_arg |= (arg);				\
305} while (0)
306#define	ARG_CLEAR_VALID(kar, arg) do {					\
307	(kar)->k_ar.ar_valid_arg &= ~(arg);				\
308} while (0)
309
310/*
311 * In-kernel version of audit record; the basic record plus queue meta-data.
312 * This record can also have a pointer set to some opaque data that will be
313 * passed through to the audit writing mechanism.
314 */
315struct kaudit_record {
316	struct audit_record		 k_ar;
317	u_int32_t			 k_ar_commit;
318	void				*k_udata;	/* User data. */
319	u_int				 k_ulen;	/* User data length. */
320	struct uthread			*k_uthread;	/* Audited thread. */
321	TAILQ_ENTRY(kaudit_record)	 k_q;
322};
323TAILQ_HEAD(kaudit_queue, kaudit_record);
324
325/*
326 * Functions to manage the allocation, release, and commit of kernel audit
327 * records.
328 */
329void			 audit_abort(struct kaudit_record *ar);
330void			 audit_commit(struct kaudit_record *ar, int error,
331			    int retval);
332struct kaudit_record	*audit_new(int event, struct thread *td);
333
334/*
335 * Functions relating to the conversion of internal kernel audit records to
336 * the BSM file format.
337 */
338struct au_record;
339int	 kaudit_to_bsm(struct kaudit_record *kar, struct au_record **pau);
340int	 bsm_rec_verify(void *rec);
341
342/*
343 * Kernel versions of the libbsm audit record functions.
344 */
345void	 kau_free(struct au_record *rec);
346void	 kau_init(void);
347
348/*
349 * Return values for pre-selection and post-selection decisions.
350 */
351#define	AU_PRS_SUCCESS	1
352#define	AU_PRS_FAILURE	2
353#define	AU_PRS_BOTH	(AU_PRS_SUCCESS|AU_PRS_FAILURE)
354
355/*
356 * Data structures relating to the kernel audit queue.  Ideally, these might
357 * be abstracted so that only accessor methods are exposed.
358 */
359extern struct mtx		audit_mtx;
360extern struct cv		audit_watermark_cv;
361extern struct cv		audit_worker_cv;
362extern struct kaudit_queue	audit_q;
363extern int			audit_q_len;
364extern int			audit_pre_q_len;
365extern int			audit_in_failure;
366
367/*
368 * Flags to use on audit files when opening and closing.
369 */
370#define	AUDIT_OPEN_FLAGS	(FWRITE | O_APPEND)
371#define	AUDIT_CLOSE_FLAGS	(FWRITE | O_APPEND)
372
373#include <sys/fcntl.h>
374#include <sys/kernel.h>
375#include <sys/malloc.h>
376
377/*
378 * Some of the BSM tokenizer functions take different parameters in the
379 * kernel implementations in order to save the copying of large kernel data
380 * structures.  The prototypes of these functions are declared here.
381 */
382token_t		*kau_to_socket(struct socket_au_info *soi);
383
384/*
385 * audit_klib prototypes
386 */
387int		 au_preselect(au_event_t event, au_class_t class,
388		    au_mask_t *mask_p, int sorf);
389void		 au_evclassmap_init(void);
390void		 au_evclassmap_insert(au_event_t event, au_class_t class);
391au_class_t	 au_event_class(au_event_t event);
392au_event_t	 audit_ctlname_to_sysctlevent(int name[], uint64_t valid_arg);
393au_event_t	 audit_flags_and_error_to_openevent(int oflags, int error);
394au_event_t	 audit_flags_and_error_to_openatevent(int oflags, int error);
395au_event_t	 audit_msgctl_to_event(int cmd);
396au_event_t	 audit_semctl_to_event(int cmr);
397void		 audit_canon_path(struct thread *td, int dirfd, char *path,
398		    char *cpath);
399au_event_t	 auditon_command_event(int cmd);
400
401/*
402 * Audit trigger events notify user space of kernel audit conditions
403 * asynchronously.
404 */
405void		 audit_trigger_init(void);
406int		 audit_send_trigger(unsigned int trigger);
407
408/*
409 * Accessor functions to manage global audit state.
410 */
411void	 audit_set_kinfo(struct auditinfo_addr *);
412void	 audit_get_kinfo(struct auditinfo_addr *);
413
414/*
415 * General audit related functions.
416 */
417struct kaudit_record	*currecord(void);
418void			 audit_free(struct kaudit_record *ar);
419void			 audit_shutdown(void *arg, int howto);
420void			 audit_rotate_vnode(struct ucred *cred,
421			    struct vnode *vp);
422void			 audit_worker_init(void);
423
424/*
425 * Audit pipe functions.
426 */
427int	 audit_pipe_preselect(au_id_t auid, au_event_t event,
428	    au_class_t class, int sorf, int trail_select);
429void	 audit_pipe_submit(au_id_t auid, au_event_t event, au_class_t class,
430	    int sorf, int trail_select, void *record, u_int record_len);
431void	 audit_pipe_submit_user(void *record, u_int record_len);
432
433#endif /* ! _SECURITY_AUDIT_PRIVATE_H_ */
434