1/*- 2 * Copyright (c) 1999-2009 Apple Inc. 3 * All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 3. Neither the name of Apple Inc. ("Apple") nor the names of 14 * its contributors may be used to endorse or promote products derived 15 * from this software without specific prior written permission. 16 * 17 * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND 18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 20 * ARE DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR 21 * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 25 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING 26 * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 27 * POSSIBILITY OF SUCH DAMAGE. 28 */ 29/* 30 * NOTICE: This file was modified by SPARTA, Inc. in 2005 to introduce 31 * support for mandatory and extensible security protections. This notice 32 * is included in support of clause 2.2 (b) of the Apple Public License, 33 * Version 2.0. 34 */ 35 36/* 37 * This include file contains function prototypes and type definitions used 38 * within the audit implementation. 39 */ 40 41#ifndef _SECURITY_AUDIT_PRIVATE_H_ 42#define _SECURITY_AUDIT_PRIVATE_H_ 43 44#if defined(_KERNEL) || defined(KERNEL) 45 46#if CONFIG_MACF 47#include <sys/queue.h> 48#include <security/mac_framework.h> 49#endif 50 51#include <sys/ipc.h> 52#include <sys/proc_internal.h> /* for PID_MAX */ 53#include <sys/socket.h> 54#include <sys/ucred.h> 55 56#ifdef MALLOC_DECLARE 57MALLOC_DECLARE(M_AUDITBSM); 58MALLOC_DECLARE(M_AUDITDATA); 59MALLOC_DECLARE(M_AUDITPATH); 60MALLOC_DECLARE(M_AUDITTEXT); 61#endif 62 63/* 64 * Audit control variables that are usually set/read via system calls and 65 * used to control various aspects of auditing. 66 */ 67extern struct au_qctrl audit_qctrl; 68extern struct audit_fstat audit_fstat; 69extern struct au_mask audit_nae_mask; 70extern int audit_panic_on_write_fail; 71extern int audit_fail_stop; 72extern int audit_argv; 73extern int audit_arge; 74 75/* 76 * Kernel mask that is used to check to see if system calls need to be audited. 77 */ 78extern au_class_t audit_kevent_mask; 79 80/* 81 * The macro used to check to see if the system calls need to be auditing. 82 * This will pessimisticly set the audit syscalls flag if the audit kevent 83 * mask has not been created yet. User code should build the event/class 84 * mapping table before setting preselection masks to avoid this. 85 */ 86#define AUDIT_CHECK_IF_KEVENTS_MASK(m) do { \ 87 if ((m).am_success || (m).am_failure) \ 88 if (!audit_kevent_mask || \ 89 (audit_kevent_mask & (m).am_success) || \ 90 (audit_kevent_mask & (m).am_failure)) \ 91 audit_syscalls = 1; \ 92} while (0) 93 94/* 95 * Success/failure conditions for the conversion of a kernel audit record to 96 * BSM format. 97 */ 98#define BSM_SUCCESS 0 99#define BSM_FAILURE 1 100#define BSM_NOAUDIT 2 101 102/* 103 * Defines for the kernel audit record k_ar_commit field. Flags are set to 104 * indicate what sort of record it is, and which preselection mechanism 105 * selected it. 106 */ 107#define AR_COMMIT_KERNEL 0x00000001U 108#define AR_COMMIT_USER 0x00000010U 109 110#define AR_PRESELECT_TRAIL 0x00001000U 111#define AR_PRESELECT_PIPE 0x00002000U 112 113#define AR_PRESELECT_USER_TRAIL 0x00004000U 114#define AR_PRESELECT_USER_PIPE 0x00008000U 115 116#define AR_PRESELECT_FILTER 0x00010000U 117 118#define AR_DRAIN_QUEUE 0x80000000U 119 120/* 121 * Audit data is generated as a stream of struct audit_record structures, 122 * linked by struct kaudit_record, and contain storage for possible audit so 123 * that it will not need to be allocated during the processing of a system 124 * call, both improving efficiency and avoiding sleeping at untimely moments. 125 * This structure is converted to BSM format before being written to disk. 126 */ 127struct vnode_au_info { 128 mode_t vn_mode; 129 uid_t vn_uid; 130 gid_t vn_gid; 131 dev_t vn_dev; 132 long vn_fsid; 133 long vn_fileid; 134 long vn_gen; 135}; 136 137struct groupset { 138 gid_t gidset[NGROUPS]; 139 u_int gidset_size; 140}; 141 142struct socket_au_info { 143 int sai_domain; 144 int sai_type; 145 int sai_protocol; 146 147 /* Foreign (remote) address/port. */ 148 struct sockaddr_storage sai_faddr; 149 150 /* Local address/port. */ 151 struct sockaddr_storage sai_laddr; 152}; 153 154/* 155 * The following is used for A_OLDSETQCTRL and A_OLDGETQCTRL and a 64-bit 156 * userland. 157 */ 158struct au_qctrl64 { 159 u_int64_t aq64_hiwater; 160 u_int64_t aq64_lowater; 161 u_int64_t aq64_bufsz; 162 u_int64_t aq64_delay; 163 int64_t aq64_minfree; 164}; 165typedef struct au_qctrl64 au_qctrl64_t; 166 167union auditon_udata { 168 char *au_path; 169 int au_cond; 170 int au_policy; 171 int64_t au_cond64; 172 int64_t au_policy64; 173 int au_trigger; 174 au_evclass_map_t au_evclass; 175 au_mask_t au_mask; 176 au_asflgs_t au_flags; 177 auditinfo_t au_auinfo; 178 auditpinfo_t au_aupinfo; 179 auditpinfo_addr_t au_aupinfo_addr; 180 au_qctrl_t au_qctrl; 181 au_qctrl64_t au_qctrl64; 182 au_stat_t au_stat; 183 au_fstat_t au_fstat; 184 auditinfo_addr_t au_kau_info; 185}; 186 187struct posix_ipc_perm { 188 uid_t pipc_uid; 189 gid_t pipc_gid; 190 mode_t pipc_mode; 191}; 192 193struct audit_record { 194 /* Audit record header. */ 195 u_int32_t ar_magic; 196 int ar_event; 197 int ar_retval; /* value returned to the process */ 198 int ar_errno; /* return status of system call */ 199 struct timespec ar_starttime; 200 struct timespec ar_endtime; 201 u_int64_t ar_valid_arg; /* Bitmask of valid arguments */ 202 203 /* Audit subject information. */ 204 struct xucred ar_subj_cred; 205 uid_t ar_subj_ruid; 206 gid_t ar_subj_rgid; 207 gid_t ar_subj_egid; 208 uid_t ar_subj_auid; /* Audit user ID */ 209 pid_t ar_subj_asid; /* Audit session ID */ 210 pid_t ar_subj_pid; 211 struct au_tid ar_subj_term; 212 struct au_tid_addr ar_subj_term_addr; 213 struct au_mask ar_subj_amask; 214 215 /* Operation arguments. */ 216 uid_t ar_arg_euid; 217 uid_t ar_arg_ruid; 218 uid_t ar_arg_suid; 219 gid_t ar_arg_egid; 220 gid_t ar_arg_rgid; 221 gid_t ar_arg_sgid; 222 pid_t ar_arg_pid; 223 pid_t ar_arg_asid; 224 struct au_tid ar_arg_termid; 225 struct au_tid_addr ar_arg_termid_addr; 226 uid_t ar_arg_uid; 227 uid_t ar_arg_auid; 228 gid_t ar_arg_gid; 229 struct groupset ar_arg_groups; 230 int ar_arg_fd; 231 int ar_arg_fflags; 232 mode_t ar_arg_mode; 233 uint32_t ar_arg_value32; 234 uint64_t ar_arg_value64; 235 user_addr_t ar_arg_addr; 236 user_size_t ar_arg_len; 237 int ar_arg_mask; 238 u_int ar_arg_signum; 239 char ar_arg_login[MAXLOGNAME]; 240 int ar_arg_ctlname[CTL_MAXNAME]; 241 struct socket_au_info ar_arg_sockinfo; 242 char *ar_arg_upath1; 243 char *ar_arg_upath2; 244 char *ar_arg_kpath1; /* darwin-only */ 245 char *ar_arg_kpath2; /* darwin-only */ 246#if CONFIG_MACF 247 char *ar_vnode1_mac_labels; 248 char *ar_vnode2_mac_labels; 249 char *ar_cred_mac_labels; 250 char *ar_arg_mac_string; 251#endif 252 char *ar_arg_text; 253 void *ar_arg_opaque; /* darwin-only */ 254 void *ar_arg_data; /* darwin-only */ 255 u_int16_t ar_arg_opq_size; /* darwin-only */ 256 u_char ar_arg_data_type; /* darwin-only */ 257 u_char ar_arg_data_count; /* darwin-only */ 258 struct au_mask ar_arg_amask; 259 struct vnode_au_info ar_arg_vnode1; 260 struct vnode_au_info ar_arg_vnode2; 261 int ar_arg_cmd; 262 int ar_arg_svipc_cmd; 263 struct ipc_perm ar_arg_svipc_perm; 264 int ar_arg_svipc_id; 265 user_addr_t ar_arg_svipc_addr; 266 struct posix_ipc_perm ar_arg_pipc_perm; 267 mach_port_name_t ar_arg_mach_port1; /* darwin-only */ 268 mach_port_name_t ar_arg_mach_port2; /* darwin-only */ 269 union auditon_udata ar_arg_auditon; 270 char *ar_arg_argv; 271 int ar_arg_argc; 272 char *ar_arg_envv; 273 int ar_arg_envc; 274 int ar_arg_exitstatus; 275 int ar_arg_exitretval; 276 struct sockaddr_storage ar_arg_sockaddr; 277 278#if CONFIG_MACF 279 /* 280 * MAC security related fields added by MAC policies ar_forced_by_mac 281 * is 1 if mac_audit_check_preselect() forced this call to be audited, 282 * 0 otherwise. 283 */ 284 LIST_HEAD(mac_audit_record_list_t, mac_audit_record) *ar_mac_records; 285 int ar_forced_by_mac; 286#endif 287}; 288 289/* 290 * Arguments in the audit record are initially not defined; flags are set to 291 * indicate if they are present so they can be included in the audit log 292 * stream only if defined. 293 */ 294#define ARG_IS_VALID(kar, arg) ((kar)->k_ar.ar_valid_arg & (arg)) 295#define ARG_SET_VALID(kar, arg) do { \ 296 (kar)->k_ar.ar_valid_arg |= (arg); \ 297} while (0) 298 299/* 300 * Current thread macro. get_bsdthread_info() returns a void ptr for some 301 * reason. 302 */ 303#define curthread() ((struct uthread *)get_bsdthread_info(current_thread())) 304 305/* 306 * In-kernel version of audit record; the basic record plus queue meta-data. 307 * This record can also have a pointer set to some opaque data that will be 308 * passed through to the audit writing mechanism. 309 */ 310struct kaudit_record { 311 struct audit_record k_ar; 312 u_int32_t k_ar_commit; 313 void *k_udata; /* User data. */ 314 u_int k_ulen; /* User data length. */ 315 struct uthread *k_uthread; /* Audited thread. */ 316 TAILQ_ENTRY(kaudit_record) k_q; 317}; 318TAILQ_HEAD(kaudit_queue, kaudit_record); 319 320/* 321 * Functions to manage the allocation, release, and commit of kernel audit 322 * records. 323 */ 324void audit_abort(struct kaudit_record *ar); 325void audit_commit(struct kaudit_record *ar, int error, 326 int retval); 327struct kaudit_record *audit_new(int event, proc_t p, struct uthread *td); 328 329/* 330 * Functions relating to the conversion of internal kernel audit records to 331 * the BSM file format. 332 */ 333struct au_record; 334int kaudit_to_bsm(struct kaudit_record *kar, struct au_record **pau); 335int bsm_rec_verify(void *rec); 336 337/* 338 * Kernel versions of the libbsm audit record functions. 339 */ 340void kau_free(struct au_record *rec); 341void kau_init(void); 342 343/* 344 * Return values for pre-selection and post-selection decisions. 345 */ 346#define AU_PRS_SUCCESS 1 347#define AU_PRS_FAILURE 2 348#define AU_PRS_BOTH (AU_PRS_SUCCESS|AU_PRS_FAILURE) 349 350/* 351 * Data structures relating to the kernel audit queue. Ideally, these might 352 * be abstracted so that only accessor methods are exposed. 353 */ 354extern struct mtx audit_mtx; 355extern struct cv audit_watermark_cv; 356extern struct cv audit_worker_cv; 357extern struct cv audit_drain_cv; 358extern struct kaudit_queue audit_q; 359extern int audit_q_len; 360extern int audit_pre_q_len; 361extern int audit_in_failure; 362 363/* 364 * Flags to use on audit files when opening and closing. 365 */ 366#define AUDIT_OPEN_FLAGS (FWRITE | O_APPEND) 367#define AUDIT_CLOSE_FLAGS (FWRITE | O_APPEND) 368 369#include <sys/fcntl.h> 370#include <sys/kernel.h> 371#include <sys/malloc.h> 372 373/* 374 * Some of the BSM tokenizer functions take different parameters in the 375 * kernel implementations in order to save the copying of large kernel data 376 * structures. The prototypes of these functions are declared here. 377 */ 378token_t *kau_to_socket(struct socket_au_info *soi); 379 380/* 381 * audit_klib prototypes 382 */ 383int au_preselect(au_event_t event, au_class_t class, 384 au_mask_t *mask_p, int sorf); 385void au_evclassmap_init(void); 386void au_evclassmap_insert(au_event_t event, au_class_t class); 387au_class_t au_event_class(au_event_t event); 388au_event_t audit_ctlname_to_sysctlevent(int name[], uint64_t valid_arg); 389au_event_t audit_flags_and_error_to_openevent(int oflags, int error); 390au_event_t audit_flags_and_error_to_openextendedevent(int oflags, 391 int error); 392au_event_t audit_flags_and_error_to_openatevent(int oflags, 393 int error); 394au_event_t audit_flags_and_error_to_openbyidevent(int oflags, 395 int error); 396au_event_t audit_msgctl_to_event(int cmd); 397au_event_t audit_semctl_to_event(int cmr); 398int audit_canon_path(struct vnode *cwd_vp, char *path, 399 char *cpath); 400au_event_t auditon_command_event(int cmd); 401au_event_t audit_fcntl_command_event(int cmd, int oflags, int error); 402 403/* 404 * Audit trigger events notify user space of kernel audit conditions 405 * asynchronously. 406 */ 407int audit_send_trigger(unsigned int trigger); 408 409/* 410 * Accessor functions to manage global audit state. 411 */ 412void audit_set_kinfo(struct auditinfo_addr *); 413void audit_get_kinfo(struct auditinfo_addr *); 414 415/* 416 * General audit related functions. 417 */ 418struct kaudit_record *currecord(void); 419void audit_free(struct kaudit_record *ar); 420void audit_rotate_vnode(struct ucred *cred, 421 struct vnode *vp); 422void audit_worker_init(void); 423 424/* 425 * Audit pipe functions. 426 */ 427int audit_pipe_init(void); 428int audit_pipe_shutdown(void); 429int audit_pipe_preselect(au_id_t auid, au_event_t event, 430 au_class_t class, int sorf, int trail_select); 431void audit_pipe_submit(au_id_t auid, au_event_t event, au_class_t class, 432 int sorf, int trail_select, void *record, u_int record_len); 433void audit_pipe_submit_user(void *record, u_int record_len); 434 435/* 436 * Audit MAC prototypes. 437 */ 438void audit_mac_init(void); 439int audit_mac_new(proc_t p, struct kaudit_record *ar); 440void audit_mac_free(struct kaudit_record *ar); 441int audit_mac_syscall_enter(unsigned short code, proc_t p, 442 struct uthread *uthread, kauth_cred_t my_cred, au_event_t event); 443int audit_mac_syscall_exit(unsigned short code, struct uthread *uthread, 444 int error, int retval); 445 446/* 447 * Audit Session. 448 */ 449void audit_session_init(void); 450int audit_session_setaia(proc_t p, auditinfo_addr_t *aia_p); 451auditinfo_addr_t *audit_session_update(auditinfo_addr_t *new_aia); 452int audit_session_lookup(au_asid_t asid, auditinfo_addr_t *ret_aia); 453 454/* 455 * Kernel assigned audit session IDs start at PID_MAX + 1 and ends at 456 * ASSIGNED_ASID_MAX. 457 */ 458#define ASSIGNED_ASID_MIN (PID_MAX + 1) 459#define ASSIGNED_ASID_MAX (0xFFFFFFFF - 1) 460 461#endif /* defined(KERNEL) || defined(_KERNEL) */ 462 463#endif /* ! _SECURITY_AUDIT_PRIVATE_H_ */ 464