1/* 2 * Copyright (c) 2009-2010 Apple Inc. All Rights Reserved. 3 * 4 * @APPLE_LICENSE_HEADER_START@ 5 * 6 * This file contains Original Code and/or Modifications of Original Code 7 * as defined in and that are subject to the Apple Public Source License 8 * Version 2.0 (the 'License'). You may not use this file except in 9 * compliance with the License. Please obtain a copy of the License at 10 * http://www.opensource.apple.com/apsl/ and read it before using this 11 * file. 12 * 13 * The Original Code and all software distributed under the License are 14 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER 15 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, 16 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, 17 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. 18 * Please see the License for the specific language governing rights and 19 * limitations under the License. 20 * 21 * @APPLE_LICENSE_HEADER_END@ 22 */ 23 24 25// 26// auditevents - monitor and act upon audit subsystem events 27// 28#include "auditevents.h" 29#include "dtrace.h" 30#include <security_utilities/logging.h> 31#include "self.h" 32 33using namespace UnixPlusPlus; 34using namespace MachPlusPlus; 35 36 37AuditMonitor::AuditMonitor(Port relay) 38 : mRelay(relay) 39{ 40} 41 42AuditMonitor::~AuditMonitor() 43{ 44} 45 46 47// 48// Endlessly retrieve session events and dispatch them. 49// (The current version of MachServer cannot receive FileDesc-based events, 50// so we need a monitor thread for this.) 51// 52void AuditMonitor::action() 53{ 54 au_sdev_handle_t *dev = au_sdev_open(AU_SDEVF_ALLSESSIONS); 55 int event; 56 auditinfo_addr_t aia; 57 58 if (NULL == dev) { 59 Syslog::error("This is bad, man. I've got bad vibes here. Could not open %s: %d", AUDIT_SDEV_PATH, errno); 60 return; 61 } 62 63 for (;;) { 64 if (0 != au_sdev_read_aia(dev, &event, &aia)) { 65 Syslog::error("au_sdev_read_aia failed: %d\n", errno); 66 continue; 67 } 68 SECURITYD_SESSION_NOTIFY(aia.ai_asid, event, aia.ai_auid); 69 if (kern_return_t rc = self_client_handleSession(mRelay, mach_task_self(), event, aia.ai_asid)) 70 Syslog::error("self-send failed (mach error %d)", rc); 71 } 72} 73