1/* 2 * Copyright (c) 2004 Apple Computer, Inc. All Rights Reserved. 3 * 4 * The contents of this file constitute Original Code as defined in and are 5 * subject to the Apple Public Source License Version 1.2 (the 'License'). 6 * You may not use this file except in compliance with the License. Please obtain 7 * a copy of the License at http://www.apple.com/publicsource and read it before 8 * using this file. 9 * 10 * This Original Code and all software distributed under the License are 11 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS 12 * OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, INCLUDING WITHOUT 13 * LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR 14 * PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. Please see the License for the 15 * specific language governing rights and limitations under the License. 16 */ 17 18 19#ifndef _H_CCAUDIT 20#define _H_CCAUDIT 21 22#include <security_utilities/utilities.h> 23#include <mach/message.h> // audit_token_t 24#include <bsm/audit.h> // au_tid_t, etc. 25#include <bsm/audit_kevents.h> // AUE_NULL 26 27namespace Security { 28namespace CommonCriteria { 29 30class AuditToken; 31 32 33/* 34 * For the most part, we won't have a machine ID to initialize the 35 * au_tid_t's machine field. There's no machine ID in the audit token, 36 * for example, since MIG is localhost-only. 37 */ 38class TerminalId: public PodWrapper<TerminalId, au_tid_t> 39{ 40 public: 41 TerminalId(); 42 TerminalId(const TerminalId &t) { set(t); } 43 TerminalId(const au_tid_t &tid) { set(tid); } 44 ~TerminalId() { } 45 46 void set(const au_tid_t &tid) { port = tid.port; machine = tid.machine; } 47}; 48 49/* 50 * audit_token_t provides all the info required for Common Criteria-mandated 51 * auditing. It's defined in <mach/mach_types.defs>. Its values are filled 52 * in by the kernel during a Mach RPC and it should be treated as read-only 53 * thereafter. 54 */ 55class AuditToken { 56 public: 57 AuditToken(const audit_token_t &token); 58 ~AuditToken() { } 59 60 audit_token_t auditToken() const { return mAuditToken; } 61 uid_t auditId() const { return mAuditId; } 62 uid_t euid() const { return mEuid; } 63 gid_t egid() const { return mEgid; } 64 uid_t ruid() const { return mRuid; } 65 gid_t rgid() const { return mRgid; } 66 pid_t pid() const { return mPid; } 67 au_asid_t sessionId() const { return mSessionId; } 68 const au_tid_t &terminalId() const { return mTerminalId; } 69 70 private: 71 audit_token_t mAuditToken; 72 uid_t mAuditId; 73 uid_t mEuid; 74 gid_t mEgid; 75 uid_t mRuid; 76 gid_t mRgid; 77 pid_t mPid; // of client 78 au_asid_t mSessionId; 79 TerminalId mTerminalId; 80}; 81 82 83/* 84 * The (new) audit information structure 85 */ 86class AuditInfo : public PodWrapper<AuditInfo, auditinfo_addr_t> { 87public: 88 void get(); 89 void get(au_asid_t session); 90 void getPid(pid_t pid); 91 void set(); 92 void create(uint64_t flags, uid_t auid = AU_DEFAUDITID); 93 94 uid_t uid() const { return this->ai_auid; } 95 uint64_t flags() const { return this->ai_flags; } 96 au_asid_t sessionId() const { return this->ai_asid; } 97 98 static AuditInfo current() { AuditInfo info; info.get(); return info; } 99}; 100 101 102// XXX/gh 3926739 103// 104// NB: Qualify all uses of these names with the namespace (CommonCriteria). 105// Existing source code already follows this convention. 106enum ExternalErrors 107{ 108 errNone = 0, 109 errInvalidCredential = 1111, // try to make easier to find in log 110 errUserCanceled, 111 errTooManyTries, 112 errAuthDenied, // "Auth" --> authorization; named to 113 // avoid conflict with the C symbol 114 // errAuthorizationDenied already in 115 // use 116 errEndOfExternalErrors // sentry/placeholder 117}; 118 119 120 121class AuditMask 122{ 123 public: 124 AuditMask(unsigned int s = AUE_NULL, unsigned int f = AUE_NULL) 125 { 126 mMask.am_success = s; mMask.am_failure = f; 127 } 128 ~AuditMask() { } 129 const au_mask_t &get(void) const { return mMask; } 130 131 private: 132 au_mask_t mMask; 133}; 134 135 136// audit session state for the current process; only used by Server 137class AuditSession 138{ 139 public: 140 AuditSession(au_id_t auid, au_asid_t sid) 141 : mAuditId(auid), mSessionId(sid) { } 142 ~AuditSession() { } 143 144 // set audit info for this process in kernel 145 void registerSession(void); 146 147 void auditId(au_id_t auid) { mAuditId = auid; } 148 void eventMask(AuditMask &mask) { mEventMask = mask; } 149 void terminalId(TerminalId &tid) { mTerminalId = tid; } 150 void sessionId(au_asid_t sid) { mSessionId = sid; } 151 152 au_id_t auditId(void) { return mAuditId; } 153 AuditMask &eventMask(void) { return mEventMask; } 154 TerminalId &terminalId(void) { return mTerminalId; } 155 au_asid_t sessionId(void) { return mSessionId; } 156 157 private: 158 au_id_t mAuditId; 159 AuditMask mEventMask; 160 TerminalId mTerminalId; 161 au_asid_t mSessionId; 162}; 163 164// 165// For submitting audit records. Not general-purpose: no ability to 166// submit arbitrary BSM tokens, for example. However, the SecurityServer 167// has only limited auditing requirements under Common Criteria. 168// 169class AuditRecord 170{ 171 public: 172 AuditRecord(const AuditToken &auditToken) 173 : mAuditToken(auditToken) { } 174 AuditRecord(const audit_token_t &auditToken) 175 : mAuditToken(auditToken) { } 176 ~AuditRecord() { } 177 178 // returnCode == 0 --> success; nonzero returnCode --> failure 179 void submit(const short event_code, const int returnCode, 180 const char *msg = NULL); 181 182 private: 183 AuditToken mAuditToken; 184}; 185 186} // end namespace CommonCriteria 187} // end namespace Security 188 189#endif // _H_CCAUDIT 190