audit_bsm.c revision 243727
1/* 2 * Copyright (c) 1999-2009 Apple Inc. 3 * All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 3. Neither the name of Apple Inc. ("Apple") nor the names of 14 * its contributors may be used to endorse or promote products derived 15 * from this software without specific prior written permission. 16 * 17 * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND 18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 20 * ARE DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR 21 * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 25 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING 26 * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 27 * POSSIBILITY OF SUCH DAMAGE. 28 */ 29 30#include <sys/cdefs.h> 31__FBSDID("$FreeBSD: head/sys/security/audit/audit_bsm.c 243727 2012-11-30 23:21:55Z pjd $"); 32 33#include <sys/param.h> 34#include <sys/vnode.h> 35#include <sys/ipc.h> 36#include <sys/lock.h> 37#include <sys/malloc.h> 38#include <sys/mutex.h> 39#include <sys/socket.h> 40#include <sys/extattr.h> 41#include <sys/fcntl.h> 42#include <sys/user.h> 43#include <sys/systm.h> 44 45#include <bsm/audit.h> 46#include <bsm/audit_internal.h> 47#include <bsm/audit_record.h> 48#include <bsm/audit_kevents.h> 49 50#include <security/audit/audit.h> 51#include <security/audit/audit_private.h> 52 53#include <netinet/in_systm.h> 54#include <netinet/in.h> 55#include <netinet/ip.h> 56 57MALLOC_DEFINE(M_AUDITBSM, "audit_bsm", "Audit BSM data"); 58 59static void audit_sys_auditon(struct audit_record *ar, 60 struct au_record *rec); 61 62/* 63 * Initialize the BSM auditing subsystem. 64 */ 65void 66kau_init(void) 67{ 68 69 au_evclassmap_init(); 70} 71 72/* 73 * This call reserves memory for the audit record. Memory must be guaranteed 74 * before any auditable event can be generated. The au_record structure 75 * maintains a reference to the memory allocated above and also the list of 76 * tokens associated with this record. 77 */ 78static struct au_record * 79kau_open(void) 80{ 81 struct au_record *rec; 82 83 rec = malloc(sizeof(*rec), M_AUDITBSM, M_WAITOK); 84 rec->data = NULL; 85 TAILQ_INIT(&rec->token_q); 86 rec->len = 0; 87 rec->used = 1; 88 89 return (rec); 90} 91 92/* 93 * Store the token with the record descriptor. 94 */ 95static void 96kau_write(struct au_record *rec, struct au_token *tok) 97{ 98 99 KASSERT(tok != NULL, ("kau_write: tok == NULL")); 100 101 TAILQ_INSERT_TAIL(&rec->token_q, tok, tokens); 102 rec->len += tok->len; 103} 104 105/* 106 * Close out the audit record by adding the header token, identifying any 107 * missing tokens. Write out the tokens to the record memory. 108 */ 109static void 110kau_close(struct au_record *rec, struct timespec *ctime, short event) 111{ 112 u_char *dptr; 113 size_t tot_rec_size; 114 token_t *cur, *hdr, *trail; 115 struct timeval tm; 116 size_t hdrsize; 117 struct auditinfo_addr ak; 118 struct in6_addr *ap; 119 120 audit_get_kinfo(&ak); 121 hdrsize = 0; 122 switch (ak.ai_termid.at_type) { 123 case AU_IPv4: 124 hdrsize = (ak.ai_termid.at_addr[0] == INADDR_ANY) ? 125 AUDIT_HEADER_SIZE : AUDIT_HEADER_EX_SIZE(&ak); 126 break; 127 case AU_IPv6: 128 ap = (struct in6_addr *)&ak.ai_termid.at_addr[0]; 129 hdrsize = (IN6_IS_ADDR_UNSPECIFIED(ap)) ? AUDIT_HEADER_SIZE : 130 AUDIT_HEADER_EX_SIZE(&ak); 131 break; 132 default: 133 panic("kau_close: invalid address family"); 134 } 135 tot_rec_size = rec->len + hdrsize + AUDIT_TRAILER_SIZE; 136 rec->data = malloc(tot_rec_size, M_AUDITBSM, M_WAITOK | M_ZERO); 137 138 tm.tv_usec = ctime->tv_nsec / 1000; 139 tm.tv_sec = ctime->tv_sec; 140 if (hdrsize != AUDIT_HEADER_SIZE) 141 hdr = au_to_header32_ex_tm(tot_rec_size, event, 0, tm, &ak); 142 else 143 hdr = au_to_header32_tm(tot_rec_size, event, 0, tm); 144 TAILQ_INSERT_HEAD(&rec->token_q, hdr, tokens); 145 146 trail = au_to_trailer(tot_rec_size); 147 TAILQ_INSERT_TAIL(&rec->token_q, trail, tokens); 148 149 rec->len = tot_rec_size; 150 dptr = rec->data; 151 TAILQ_FOREACH(cur, &rec->token_q, tokens) { 152 memcpy(dptr, cur->t_data, cur->len); 153 dptr += cur->len; 154 } 155} 156 157/* 158 * Free a BSM audit record by releasing all the tokens and clearing the audit 159 * record information. 160 */ 161void 162kau_free(struct au_record *rec) 163{ 164 struct au_token *tok; 165 166 /* Free the token list. */ 167 while ((tok = TAILQ_FIRST(&rec->token_q))) { 168 TAILQ_REMOVE(&rec->token_q, tok, tokens); 169 free(tok->t_data, M_AUDITBSM); 170 free(tok, M_AUDITBSM); 171 } 172 173 rec->used = 0; 174 rec->len = 0; 175 free(rec->data, M_AUDITBSM); 176 free(rec, M_AUDITBSM); 177} 178 179/* 180 * XXX: May want turn some (or all) of these macros into functions in order 181 * to reduce the generated code size. 182 * 183 * XXXAUDIT: These macros assume that 'kar', 'ar', 'rec', and 'tok' in the 184 * caller are OK with this. 185 */ 186#define ATFD1_TOKENS(argnum) do { \ 187 if (ARG_IS_VALID(kar, ARG_ATFD1)) { \ 188 tok = au_to_arg32(argnum, "at fd 1", ar->ar_arg_atfd1); \ 189 kau_write(rec, tok); \ 190 } \ 191} while (0) 192 193#define ATFD2_TOKENS(argnum) do { \ 194 if (ARG_IS_VALID(kar, ARG_ATFD2)) { \ 195 tok = au_to_arg32(argnum, "at fd 2", ar->ar_arg_atfd2); \ 196 kau_write(rec, tok); \ 197 } \ 198} while (0) 199 200#define UPATH1_TOKENS do { \ 201 if (ARG_IS_VALID(kar, ARG_UPATH1)) { \ 202 tok = au_to_path(ar->ar_arg_upath1); \ 203 kau_write(rec, tok); \ 204 } \ 205} while (0) 206 207#define UPATH2_TOKENS do { \ 208 if (ARG_IS_VALID(kar, ARG_UPATH2)) { \ 209 tok = au_to_path(ar->ar_arg_upath2); \ 210 kau_write(rec, tok); \ 211 } \ 212} while (0) 213 214#define VNODE1_TOKENS do { \ 215 if (ARG_IS_VALID(kar, ARG_ATFD)) { \ 216 tok = au_to_arg32(1, "at fd", ar->ar_arg_atfd); \ 217 kau_write(rec, tok); \ 218 } \ 219 if (ARG_IS_VALID(kar, ARG_VNODE1)) { \ 220 tok = au_to_attr32(&ar->ar_arg_vnode1); \ 221 kau_write(rec, tok); \ 222 } \ 223} while (0) 224 225#define UPATH1_VNODE1_TOKENS do { \ 226 if (ARG_IS_VALID(kar, ARG_UPATH1)) { \ 227 UPATH1_TOKENS; \ 228 } \ 229 if (ARG_IS_VALID(kar, ARG_VNODE1)) { \ 230 tok = au_to_attr32(&ar->ar_arg_vnode1); \ 231 kau_write(rec, tok); \ 232 } \ 233} while (0) 234 235#define VNODE2_TOKENS do { \ 236 if (ARG_IS_VALID(kar, ARG_VNODE2)) { \ 237 tok = au_to_attr32(&ar->ar_arg_vnode2); \ 238 kau_write(rec, tok); \ 239 } \ 240} while (0) 241 242#define FD_VNODE1_TOKENS do { \ 243 if (ARG_IS_VALID(kar, ARG_VNODE1)) { \ 244 if (ARG_IS_VALID(kar, ARG_FD)) { \ 245 tok = au_to_arg32(1, "fd", ar->ar_arg_fd); \ 246 kau_write(rec, tok); \ 247 } \ 248 tok = au_to_attr32(&ar->ar_arg_vnode1); \ 249 kau_write(rec, tok); \ 250 } else { \ 251 if (ARG_IS_VALID(kar, ARG_FD)) { \ 252 tok = au_to_arg32(1, "non-file: fd", \ 253 ar->ar_arg_fd); \ 254 kau_write(rec, tok); \ 255 } \ 256 } \ 257} while (0) 258 259#define PROCESS_PID_TOKENS(argn) do { \ 260 if ((ar->ar_arg_pid > 0) /* Reference a single process */ \ 261 && (ARG_IS_VALID(kar, ARG_PROCESS))) { \ 262 tok = au_to_process32_ex(ar->ar_arg_auid, \ 263 ar->ar_arg_euid, ar->ar_arg_egid, \ 264 ar->ar_arg_ruid, ar->ar_arg_rgid, \ 265 ar->ar_arg_pid, ar->ar_arg_asid, \ 266 &ar->ar_arg_termid_addr); \ 267 kau_write(rec, tok); \ 268 } else if (ARG_IS_VALID(kar, ARG_PID)) { \ 269 tok = au_to_arg32(argn, "process", ar->ar_arg_pid); \ 270 kau_write(rec, tok); \ 271 } \ 272} while (0) 273 274#define EXTATTR_TOKENS(namespace_argnum) do { \ 275 if (ARG_IS_VALID(kar, ARG_VALUE)) { \ 276 switch (ar->ar_arg_value) { \ 277 case EXTATTR_NAMESPACE_USER: \ 278 tok = au_to_text(EXTATTR_NAMESPACE_USER_STRING);\ 279 break; \ 280 case EXTATTR_NAMESPACE_SYSTEM: \ 281 tok = au_to_text(EXTATTR_NAMESPACE_SYSTEM_STRING);\ 282 break; \ 283 default: \ 284 tok = au_to_arg32((namespace_argnum), \ 285 "attrnamespace", ar->ar_arg_value); \ 286 break; \ 287 } \ 288 kau_write(rec, tok); \ 289 } \ 290 /* attrname is in the text field */ \ 291 if (ARG_IS_VALID(kar, ARG_TEXT)) { \ 292 tok = au_to_text(ar->ar_arg_text); \ 293 kau_write(rec, tok); \ 294 } \ 295} while (0) 296 297/* 298 * Not all pointer arguments to system calls are of interest, but in some 299 * cases they reflect delegation of rights, such as mmap(2) followed by 300 * minherit(2) before execve(2), so do the best we can. 301 */ 302#define ADDR_TOKEN(argnum, argname) do { \ 303 if (ARG_IS_VALID(kar, ARG_ADDR)) { \ 304 if (sizeof(void *) == sizeof(uint32_t)) \ 305 tok = au_to_arg32((argnum), (argname), \ 306 (uint32_t)(uintptr_t)ar->ar_arg_addr); \ 307 else \ 308 tok = au_to_arg64((argnum), (argname), \ 309 (uint64_t)(uintptr_t)ar->ar_arg_addr); \ 310 kau_write(rec, tok); \ 311 } \ 312} while (0) 313 314 315/* 316 * Implement auditing for the auditon() system call. The audit tokens that 317 * are generated depend on the command that was sent into the auditon() 318 * system call. 319 */ 320static void 321audit_sys_auditon(struct audit_record *ar, struct au_record *rec) 322{ 323 struct au_token *tok; 324 325 tok = au_to_arg32(3, "length", ar->ar_arg_len); 326 kau_write(rec, tok); 327 switch (ar->ar_arg_cmd) { 328 case A_OLDSETPOLICY: 329 if ((size_t)ar->ar_arg_len == sizeof(int64_t)) { 330 tok = au_to_arg64(2, "policy", 331 ar->ar_arg_auditon.au_policy64); 332 kau_write(rec, tok); 333 break; 334 } 335 /* FALLTHROUGH */ 336 337 case A_SETPOLICY: 338 tok = au_to_arg32(2, "policy", ar->ar_arg_auditon.au_policy); 339 kau_write(rec, tok); 340 break; 341 342 case A_SETKMASK: 343 tok = au_to_arg32(2, "setkmask:as_success", 344 ar->ar_arg_auditon.au_mask.am_success); 345 kau_write(rec, tok); 346 tok = au_to_arg32(2, "setkmask:as_failure", 347 ar->ar_arg_auditon.au_mask.am_failure); 348 kau_write(rec, tok); 349 break; 350 351 case A_OLDSETQCTRL: 352 if ((size_t)ar->ar_arg_len == sizeof(au_qctrl64_t)) { 353 tok = au_to_arg64(2, "setqctrl:aq_hiwater", 354 ar->ar_arg_auditon.au_qctrl64.aq64_hiwater); 355 kau_write(rec, tok); 356 tok = au_to_arg64(2, "setqctrl:aq_lowater", 357 ar->ar_arg_auditon.au_qctrl64.aq64_lowater); 358 kau_write(rec, tok); 359 tok = au_to_arg64(2, "setqctrl:aq_bufsz", 360 ar->ar_arg_auditon.au_qctrl64.aq64_bufsz); 361 kau_write(rec, tok); 362 tok = au_to_arg64(2, "setqctrl:aq_delay", 363 ar->ar_arg_auditon.au_qctrl64.aq64_delay); 364 kau_write(rec, tok); 365 tok = au_to_arg64(2, "setqctrl:aq_minfree", 366 ar->ar_arg_auditon.au_qctrl64.aq64_minfree); 367 kau_write(rec, tok); 368 break; 369 } 370 /* FALLTHROUGH */ 371 372 case A_SETQCTRL: 373 tok = au_to_arg32(2, "setqctrl:aq_hiwater", 374 ar->ar_arg_auditon.au_qctrl.aq_hiwater); 375 kau_write(rec, tok); 376 tok = au_to_arg32(2, "setqctrl:aq_lowater", 377 ar->ar_arg_auditon.au_qctrl.aq_lowater); 378 kau_write(rec, tok); 379 tok = au_to_arg32(2, "setqctrl:aq_bufsz", 380 ar->ar_arg_auditon.au_qctrl.aq_bufsz); 381 kau_write(rec, tok); 382 tok = au_to_arg32(2, "setqctrl:aq_delay", 383 ar->ar_arg_auditon.au_qctrl.aq_delay); 384 kau_write(rec, tok); 385 tok = au_to_arg32(2, "setqctrl:aq_minfree", 386 ar->ar_arg_auditon.au_qctrl.aq_minfree); 387 kau_write(rec, tok); 388 break; 389 390 case A_SETUMASK: 391 tok = au_to_arg32(2, "setumask:as_success", 392 ar->ar_arg_auditon.au_auinfo.ai_mask.am_success); 393 kau_write(rec, tok); 394 tok = au_to_arg32(2, "setumask:as_failure", 395 ar->ar_arg_auditon.au_auinfo.ai_mask.am_failure); 396 kau_write(rec, tok); 397 break; 398 399 case A_SETSMASK: 400 tok = au_to_arg32(2, "setsmask:as_success", 401 ar->ar_arg_auditon.au_auinfo.ai_mask.am_success); 402 kau_write(rec, tok); 403 tok = au_to_arg32(2, "setsmask:as_failure", 404 ar->ar_arg_auditon.au_auinfo.ai_mask.am_failure); 405 kau_write(rec, tok); 406 break; 407 408 case A_OLDSETCOND: 409 if ((size_t)ar->ar_arg_len == sizeof(int64_t)) { 410 tok = au_to_arg64(2, "setcond", 411 ar->ar_arg_auditon.au_cond64); 412 kau_write(rec, tok); 413 break; 414 } 415 /* FALLTHROUGH */ 416 417 case A_SETCOND: 418 tok = au_to_arg32(2, "setcond", ar->ar_arg_auditon.au_cond); 419 kau_write(rec, tok); 420 break; 421 422 case A_SETCLASS: 423 kau_write(rec, tok); 424 tok = au_to_arg32(2, "setclass:ec_event", 425 ar->ar_arg_auditon.au_evclass.ec_number); 426 kau_write(rec, tok); 427 tok = au_to_arg32(2, "setclass:ec_class", 428 ar->ar_arg_auditon.au_evclass.ec_class); 429 kau_write(rec, tok); 430 break; 431 432 case A_SETPMASK: 433 tok = au_to_arg32(2, "setpmask:as_success", 434 ar->ar_arg_auditon.au_aupinfo.ap_mask.am_success); 435 kau_write(rec, tok); 436 tok = au_to_arg32(2, "setpmask:as_failure", 437 ar->ar_arg_auditon.au_aupinfo.ap_mask.am_failure); 438 kau_write(rec, tok); 439 break; 440 441 case A_SETFSIZE: 442 tok = au_to_arg32(2, "setfsize:filesize", 443 ar->ar_arg_auditon.au_fstat.af_filesz); 444 kau_write(rec, tok); 445 break; 446 447 default: 448 break; 449 } 450} 451 452/* 453 * Convert an internal kernel audit record to a BSM record and return a 454 * success/failure indicator. The BSM record is passed as an out parameter to 455 * this function. 456 * 457 * Return conditions: 458 * BSM_SUCCESS: The BSM record is valid 459 * BSM_FAILURE: Failure; the BSM record is NULL. 460 * BSM_NOAUDIT: The event is not auditable for BSM; the BSM record is NULL. 461 */ 462int 463kaudit_to_bsm(struct kaudit_record *kar, struct au_record **pau) 464{ 465 struct au_token *tok, *subj_tok; 466 struct au_record *rec; 467 au_tid_t tid; 468 struct audit_record *ar; 469 int ctr; 470 471 KASSERT(kar != NULL, ("kaudit_to_bsm: kar == NULL")); 472 473 *pau = NULL; 474 ar = &kar->k_ar; 475 rec = kau_open(); 476 477 /* 478 * Create the subject token. 479 */ 480 switch (ar->ar_subj_term_addr.at_type) { 481 case AU_IPv4: 482 tid.port = ar->ar_subj_term_addr.at_port; 483 tid.machine = ar->ar_subj_term_addr.at_addr[0]; 484 subj_tok = au_to_subject32(ar->ar_subj_auid, /* audit ID */ 485 ar->ar_subj_cred.cr_uid, /* eff uid */ 486 ar->ar_subj_egid, /* eff group id */ 487 ar->ar_subj_ruid, /* real uid */ 488 ar->ar_subj_rgid, /* real group id */ 489 ar->ar_subj_pid, /* process id */ 490 ar->ar_subj_asid, /* session ID */ 491 &tid); 492 break; 493 case AU_IPv6: 494 subj_tok = au_to_subject32_ex(ar->ar_subj_auid, 495 ar->ar_subj_cred.cr_uid, 496 ar->ar_subj_egid, 497 ar->ar_subj_ruid, 498 ar->ar_subj_rgid, 499 ar->ar_subj_pid, 500 ar->ar_subj_asid, 501 &ar->ar_subj_term_addr); 502 break; 503 default: 504 bzero(&tid, sizeof(tid)); 505 subj_tok = au_to_subject32(ar->ar_subj_auid, 506 ar->ar_subj_cred.cr_uid, 507 ar->ar_subj_egid, 508 ar->ar_subj_ruid, 509 ar->ar_subj_rgid, 510 ar->ar_subj_pid, 511 ar->ar_subj_asid, 512 &tid); 513 } 514 515 /* 516 * The logic inside each case fills in the tokens required for the 517 * event, except for the header, trailer, and return tokens. The 518 * header and trailer tokens are added by the kau_close() function. 519 * The return token is added outside of the switch statement. 520 */ 521 switch(ar->ar_event) { 522 case AUE_ACCEPT: 523 case AUE_BIND: 524 case AUE_LISTEN: 525 case AUE_CONNECT: 526 case AUE_RECV: 527 case AUE_RECVFROM: 528 case AUE_RECVMSG: 529 case AUE_SEND: 530 case AUE_SENDFILE: 531 case AUE_SENDMSG: 532 case AUE_SENDTO: 533 /* 534 * Socket-related events. 535 */ 536 if (ARG_IS_VALID(kar, ARG_FD)) { 537 tok = au_to_arg32(1, "fd", ar->ar_arg_fd); 538 kau_write(rec, tok); 539 } 540 if (ARG_IS_VALID(kar, ARG_SADDRINET)) { 541 tok = au_to_sock_inet((struct sockaddr_in *) 542 &ar->ar_arg_sockaddr); 543 kau_write(rec, tok); 544 } 545 if (ARG_IS_VALID(kar, ARG_SADDRUNIX)) { 546 tok = au_to_sock_unix((struct sockaddr_un *) 547 &ar->ar_arg_sockaddr); 548 kau_write(rec, tok); 549 UPATH1_TOKENS; 550 } 551 /* XXX Need to handle ARG_SADDRINET6 */ 552 break; 553 554 case AUE_SOCKET: 555 case AUE_SOCKETPAIR: 556 if (ARG_IS_VALID(kar, ARG_SOCKINFO)) { 557 tok = au_to_arg32(1, "domain", 558 ar->ar_arg_sockinfo.so_domain); 559 kau_write(rec, tok); 560 tok = au_to_arg32(2, "type", 561 ar->ar_arg_sockinfo.so_type); 562 kau_write(rec, tok); 563 tok = au_to_arg32(3, "protocol", 564 ar->ar_arg_sockinfo.so_protocol); 565 kau_write(rec, tok); 566 } 567 break; 568 569 case AUE_SETSOCKOPT: 570 case AUE_SHUTDOWN: 571 if (ARG_IS_VALID(kar, ARG_FD)) { 572 tok = au_to_arg32(1, "fd", ar->ar_arg_fd); 573 kau_write(rec, tok); 574 } 575 break; 576 577 case AUE_ACCT: 578 if (ARG_IS_VALID(kar, ARG_UPATH1)) { 579 UPATH1_VNODE1_TOKENS; 580 } else { 581 tok = au_to_arg32(1, "accounting off", 0); 582 kau_write(rec, tok); 583 } 584 break; 585 586 case AUE_SETAUID: 587 if (ARG_IS_VALID(kar, ARG_AUID)) { 588 tok = au_to_arg32(2, "setauid", ar->ar_arg_auid); 589 kau_write(rec, tok); 590 } 591 break; 592 593 case AUE_SETAUDIT: 594 if (ARG_IS_VALID(kar, ARG_AUID) && 595 ARG_IS_VALID(kar, ARG_ASID) && 596 ARG_IS_VALID(kar, ARG_AMASK) && 597 ARG_IS_VALID(kar, ARG_TERMID)) { 598 tok = au_to_arg32(1, "setaudit:auid", 599 ar->ar_arg_auid); 600 kau_write(rec, tok); 601 tok = au_to_arg32(1, "setaudit:port", 602 ar->ar_arg_termid.port); 603 kau_write(rec, tok); 604 tok = au_to_arg32(1, "setaudit:machine", 605 ar->ar_arg_termid.machine); 606 kau_write(rec, tok); 607 tok = au_to_arg32(1, "setaudit:as_success", 608 ar->ar_arg_amask.am_success); 609 kau_write(rec, tok); 610 tok = au_to_arg32(1, "setaudit:as_failure", 611 ar->ar_arg_amask.am_failure); 612 kau_write(rec, tok); 613 tok = au_to_arg32(1, "setaudit:asid", 614 ar->ar_arg_asid); 615 kau_write(rec, tok); 616 } 617 break; 618 619 case AUE_SETAUDIT_ADDR: 620 if (ARG_IS_VALID(kar, ARG_AUID) && 621 ARG_IS_VALID(kar, ARG_ASID) && 622 ARG_IS_VALID(kar, ARG_AMASK) && 623 ARG_IS_VALID(kar, ARG_TERMID_ADDR)) { 624 tok = au_to_arg32(1, "setaudit_addr:auid", 625 ar->ar_arg_auid); 626 kau_write(rec, tok); 627 tok = au_to_arg32(1, "setaudit_addr:as_success", 628 ar->ar_arg_amask.am_success); 629 kau_write(rec, tok); 630 tok = au_to_arg32(1, "setaudit_addr:as_failure", 631 ar->ar_arg_amask.am_failure); 632 kau_write(rec, tok); 633 tok = au_to_arg32(1, "setaudit_addr:asid", 634 ar->ar_arg_asid); 635 kau_write(rec, tok); 636 tok = au_to_arg32(1, "setaudit_addr:type", 637 ar->ar_arg_termid_addr.at_type); 638 kau_write(rec, tok); 639 tok = au_to_arg32(1, "setaudit_addr:port", 640 ar->ar_arg_termid_addr.at_port); 641 kau_write(rec, tok); 642 if (ar->ar_arg_termid_addr.at_type == AU_IPv6) 643 tok = au_to_in_addr_ex((struct in6_addr *) 644 &ar->ar_arg_termid_addr.at_addr[0]); 645 if (ar->ar_arg_termid_addr.at_type == AU_IPv4) 646 tok = au_to_in_addr((struct in_addr *) 647 &ar->ar_arg_termid_addr.at_addr[0]); 648 kau_write(rec, tok); 649 } 650 break; 651 652 case AUE_AUDITON: 653 /* 654 * For AUDITON commands without own event, audit the cmd. 655 */ 656 if (ARG_IS_VALID(kar, ARG_CMD)) { 657 tok = au_to_arg32(1, "cmd", ar->ar_arg_cmd); 658 kau_write(rec, tok); 659 } 660 /* FALLTHROUGH */ 661 662 case AUE_AUDITON_GETCAR: 663 case AUE_AUDITON_GETCLASS: 664 case AUE_AUDITON_GETCOND: 665 case AUE_AUDITON_GETCWD: 666 case AUE_AUDITON_GETKMASK: 667 case AUE_AUDITON_GETSTAT: 668 case AUE_AUDITON_GPOLICY: 669 case AUE_AUDITON_GQCTRL: 670 case AUE_AUDITON_SETCLASS: 671 case AUE_AUDITON_SETCOND: 672 case AUE_AUDITON_SETKMASK: 673 case AUE_AUDITON_SETSMASK: 674 case AUE_AUDITON_SETSTAT: 675 case AUE_AUDITON_SETUMASK: 676 case AUE_AUDITON_SPOLICY: 677 case AUE_AUDITON_SQCTRL: 678 if (ARG_IS_VALID(kar, ARG_AUDITON)) 679 audit_sys_auditon(ar, rec); 680 break; 681 682 case AUE_AUDITCTL: 683 UPATH1_VNODE1_TOKENS; 684 break; 685 686 case AUE_EXIT: 687 if (ARG_IS_VALID(kar, ARG_EXIT)) { 688 tok = au_to_exit(ar->ar_arg_exitretval, 689 ar->ar_arg_exitstatus); 690 kau_write(rec, tok); 691 } 692 break; 693 694 case AUE_ADJTIME: 695 case AUE_CLOCK_SETTIME: 696 case AUE_AUDIT: 697 case AUE_DUP2: 698 case AUE_GETAUDIT: 699 case AUE_GETAUDIT_ADDR: 700 case AUE_GETAUID: 701 case AUE_GETCWD: 702 case AUE_GETFSSTAT: 703 case AUE_GETRESUID: 704 case AUE_GETRESGID: 705 case AUE_KQUEUE: 706 case AUE_MODLOAD: 707 case AUE_MODUNLOAD: 708 case AUE_MSGSYS: 709 case AUE_NTP_ADJTIME: 710 case AUE_PIPE: 711 case AUE_POSIX_OPENPT: 712 case AUE_PROFILE: 713 case AUE_RTPRIO: 714 case AUE_SEMSYS: 715 case AUE_SHMSYS: 716 case AUE_SETPGRP: 717 case AUE_SETRLIMIT: 718 case AUE_SETSID: 719 case AUE_SETTIMEOFDAY: 720 case AUE_SYSARCH: 721 722 /* 723 * Header, subject, and return tokens added at end. 724 */ 725 break; 726 727 case AUE_CHDIR: 728 case AUE_CHROOT: 729 case AUE_FSTATAT: 730 case AUE_FUTIMESAT: 731 case AUE_GETATTRLIST: 732 case AUE_JAIL: 733 case AUE_LUTIMES: 734 case AUE_NFS_GETFH: 735 case AUE_LSTAT: 736 case AUE_LPATHCONF: 737 case AUE_PATHCONF: 738 case AUE_READLINK: 739 case AUE_READLINKAT: 740 case AUE_REVOKE: 741 case AUE_RMDIR: 742 case AUE_SEARCHFS: 743 case AUE_SETATTRLIST: 744 case AUE_STAT: 745 case AUE_STATFS: 746 case AUE_SWAPON: 747 case AUE_SWAPOFF: 748 case AUE_TRUNCATE: 749 case AUE_UNDELETE: 750 case AUE_UNLINK: 751 case AUE_UNLINKAT: 752 case AUE_UTIMES: 753 ATFD1_TOKENS(1); 754 UPATH1_VNODE1_TOKENS; 755 break; 756 757 case AUE_ACCESS: 758 case AUE_EACCESS: 759 case AUE_FACCESSAT: 760 ATFD1_TOKENS(1); 761 UPATH1_VNODE1_TOKENS; 762 if (ARG_IS_VALID(kar, ARG_VALUE)) { 763 tok = au_to_arg32(2, "mode", ar->ar_arg_value); 764 kau_write(rec, tok); 765 } 766 break; 767 768 case AUE_FHSTATFS: 769 case AUE_FHOPEN: 770 case AUE_FHSTAT: 771 /* XXXRW: Need to audit vnode argument. */ 772 break; 773 774 case AUE_CHFLAGS: 775 case AUE_LCHFLAGS: 776 if (ARG_IS_VALID(kar, ARG_FFLAGS)) { 777 tok = au_to_arg32(2, "flags", ar->ar_arg_fflags); 778 kau_write(rec, tok); 779 } 780 UPATH1_VNODE1_TOKENS; 781 break; 782 783 case AUE_CHMOD: 784 case AUE_LCHMOD: 785 if (ARG_IS_VALID(kar, ARG_MODE)) { 786 tok = au_to_arg32(2, "new file mode", 787 ar->ar_arg_mode); 788 kau_write(rec, tok); 789 } 790 UPATH1_VNODE1_TOKENS; 791 break; 792 793 case AUE_FCHMODAT: 794 ATFD1_TOKENS(1); 795 if (ARG_IS_VALID(kar, ARG_MODE)) { 796 tok = au_to_arg32(3, "new file mode", 797 ar->ar_arg_mode); 798 kau_write(rec, tok); 799 } 800 UPATH1_VNODE1_TOKENS; 801 break; 802 803 case AUE_CHOWN: 804 case AUE_LCHOWN: 805 if (ARG_IS_VALID(kar, ARG_UID)) { 806 tok = au_to_arg32(2, "new file uid", ar->ar_arg_uid); 807 kau_write(rec, tok); 808 } 809 if (ARG_IS_VALID(kar, ARG_GID)) { 810 tok = au_to_arg32(3, "new file gid", ar->ar_arg_gid); 811 kau_write(rec, tok); 812 } 813 UPATH1_VNODE1_TOKENS; 814 break; 815 816 case AUE_FCHOWNAT: 817 ATFD1_TOKENS(1); 818 if (ARG_IS_VALID(kar, ARG_UID)) { 819 tok = au_to_arg32(3, "new file uid", ar->ar_arg_uid); 820 kau_write(rec, tok); 821 } 822 if (ARG_IS_VALID(kar, ARG_GID)) { 823 tok = au_to_arg32(4, "new file gid", ar->ar_arg_gid); 824 kau_write(rec, tok); 825 } 826 UPATH1_VNODE1_TOKENS; 827 break; 828 829 case AUE_EXCHANGEDATA: 830 UPATH1_VNODE1_TOKENS; 831 UPATH2_TOKENS; 832 break; 833 834 case AUE_CLOSE: 835 if (ARG_IS_VALID(kar, ARG_FD)) { 836 tok = au_to_arg32(1, "fd", ar->ar_arg_fd); 837 kau_write(rec, tok); 838 } 839 UPATH1_VNODE1_TOKENS; 840 break; 841 842 case AUE_CLOSEFROM: 843 if (ARG_IS_VALID(kar, ARG_FD)) { 844 tok = au_to_arg32(1, "fd", ar->ar_arg_fd); 845 kau_write(rec, tok); 846 } 847 break; 848 849 case AUE_CORE: 850 if (ARG_IS_VALID(kar, ARG_SIGNUM)) { 851 tok = au_to_arg32(1, "signal", ar->ar_arg_signum); 852 kau_write(rec, tok); 853 } 854 UPATH1_VNODE1_TOKENS; 855 break; 856 857 case AUE_EXTATTRCTL: 858 UPATH1_VNODE1_TOKENS; 859 if (ARG_IS_VALID(kar, ARG_CMD)) { 860 tok = au_to_arg32(2, "cmd", ar->ar_arg_cmd); 861 kau_write(rec, tok); 862 } 863 /* extattrctl(2) filename parameter is in upath2/vnode2 */ 864 UPATH2_TOKENS; 865 VNODE2_TOKENS; 866 EXTATTR_TOKENS(4); 867 break; 868 869 case AUE_EXTATTR_GET_FILE: 870 case AUE_EXTATTR_SET_FILE: 871 case AUE_EXTATTR_LIST_FILE: 872 case AUE_EXTATTR_DELETE_FILE: 873 case AUE_EXTATTR_GET_LINK: 874 case AUE_EXTATTR_SET_LINK: 875 case AUE_EXTATTR_LIST_LINK: 876 case AUE_EXTATTR_DELETE_LINK: 877 UPATH1_VNODE1_TOKENS; 878 EXTATTR_TOKENS(2); 879 break; 880 881 case AUE_EXTATTR_GET_FD: 882 case AUE_EXTATTR_SET_FD: 883 case AUE_EXTATTR_LIST_FD: 884 case AUE_EXTATTR_DELETE_FD: 885 if (ARG_IS_VALID(kar, ARG_FD)) { 886 tok = au_to_arg32(2, "fd", ar->ar_arg_fd); 887 kau_write(rec, tok); 888 } 889 EXTATTR_TOKENS(2); 890 break; 891 892 case AUE_FEXECVE: 893 if (ARG_IS_VALID(kar, ARG_FD)) { 894 tok = au_to_arg32(1, "fd", ar->ar_arg_fd); 895 kau_write(rec, tok); 896 } 897 /* FALLTHROUGH */ 898 899 case AUE_EXECVE: 900 case AUE_MAC_EXECVE: 901 if (ARG_IS_VALID(kar, ARG_ARGV)) { 902 tok = au_to_exec_args(ar->ar_arg_argv, 903 ar->ar_arg_argc); 904 kau_write(rec, tok); 905 } 906 if (ARG_IS_VALID(kar, ARG_ENVV)) { 907 tok = au_to_exec_env(ar->ar_arg_envv, 908 ar->ar_arg_envc); 909 kau_write(rec, tok); 910 } 911 UPATH1_VNODE1_TOKENS; 912 break; 913 914 case AUE_FCHMOD: 915 if (ARG_IS_VALID(kar, ARG_MODE)) { 916 tok = au_to_arg32(2, "new file mode", 917 ar->ar_arg_mode); 918 kau_write(rec, tok); 919 } 920 FD_VNODE1_TOKENS; 921 break; 922 923 /* 924 * XXXRW: Some of these need to handle non-vnode cases as well. 925 */ 926 case AUE_FCHDIR: 927 case AUE_FPATHCONF: 928 case AUE_FSTAT: 929 case AUE_FSTATFS: 930 case AUE_FSYNC: 931 case AUE_FTRUNCATE: 932 case AUE_FUTIMES: 933 case AUE_GETDIRENTRIES: 934 case AUE_GETDIRENTRIESATTR: 935 case AUE_LSEEK: 936 case AUE_POLL: 937 case AUE_READ: 938 case AUE_READV: 939 case AUE_WRITE: 940 case AUE_WRITEV: 941 FD_VNODE1_TOKENS; 942 break; 943 944 case AUE_FCHOWN: 945 if (ARG_IS_VALID(kar, ARG_UID)) { 946 tok = au_to_arg32(2, "new file uid", ar->ar_arg_uid); 947 kau_write(rec, tok); 948 } 949 if (ARG_IS_VALID(kar, ARG_GID)) { 950 tok = au_to_arg32(3, "new file gid", ar->ar_arg_gid); 951 kau_write(rec, tok); 952 } 953 FD_VNODE1_TOKENS; 954 break; 955 956 case AUE_FCNTL: 957 if (ARG_IS_VALID(kar, ARG_CMD)) { 958 tok = au_to_arg32(2, "cmd", 959 au_fcntl_cmd_to_bsm(ar->ar_arg_cmd)); 960 kau_write(rec, tok); 961 } 962 if (ar->ar_arg_cmd == F_GETLK || ar->ar_arg_cmd == F_SETLK || 963 ar->ar_arg_cmd == F_SETLKW) { 964 FD_VNODE1_TOKENS; 965 } 966 break; 967 968 case AUE_FCHFLAGS: 969 if (ARG_IS_VALID(kar, ARG_FFLAGS)) { 970 tok = au_to_arg32(2, "flags", ar->ar_arg_fflags); 971 kau_write(rec, tok); 972 } 973 FD_VNODE1_TOKENS; 974 break; 975 976 case AUE_FLOCK: 977 if (ARG_IS_VALID(kar, ARG_CMD)) { 978 tok = au_to_arg32(2, "operation", ar->ar_arg_cmd); 979 kau_write(rec, tok); 980 } 981 FD_VNODE1_TOKENS; 982 break; 983 984 case AUE_RFORK: 985 if (ARG_IS_VALID(kar, ARG_FFLAGS)) { 986 tok = au_to_arg32(1, "flags", ar->ar_arg_fflags); 987 kau_write(rec, tok); 988 } 989 /* FALLTHROUGH */ 990 991 case AUE_FORK: 992 case AUE_VFORK: 993 if (ARG_IS_VALID(kar, ARG_PID)) { 994 tok = au_to_arg32(0, "child PID", ar->ar_arg_pid); 995 kau_write(rec, tok); 996 } 997 break; 998 999 case AUE_IOCTL: 1000 if (ARG_IS_VALID(kar, ARG_CMD)) { 1001 tok = au_to_arg32(2, "cmd", ar->ar_arg_cmd); 1002 kau_write(rec, tok); 1003 } 1004 if (ARG_IS_VALID(kar, ARG_VNODE1)) 1005 FD_VNODE1_TOKENS; 1006 else { 1007 if (ARG_IS_VALID(kar, ARG_SOCKINFO)) { 1008 tok = kau_to_socket(&ar->ar_arg_sockinfo); 1009 kau_write(rec, tok); 1010 } else { 1011 if (ARG_IS_VALID(kar, ARG_FD)) { 1012 tok = au_to_arg32(1, "fd", 1013 ar->ar_arg_fd); 1014 kau_write(rec, tok); 1015 } 1016 } 1017 } 1018 break; 1019 1020 case AUE_KILL: 1021 case AUE_KILLPG: 1022 if (ARG_IS_VALID(kar, ARG_SIGNUM)) { 1023 tok = au_to_arg32(2, "signal", ar->ar_arg_signum); 1024 kau_write(rec, tok); 1025 } 1026 PROCESS_PID_TOKENS(1); 1027 break; 1028 1029 case AUE_KTRACE: 1030 if (ARG_IS_VALID(kar, ARG_CMD)) { 1031 tok = au_to_arg32(2, "ops", ar->ar_arg_cmd); 1032 kau_write(rec, tok); 1033 } 1034 if (ARG_IS_VALID(kar, ARG_VALUE)) { 1035 tok = au_to_arg32(3, "trpoints", ar->ar_arg_value); 1036 kau_write(rec, tok); 1037 } 1038 PROCESS_PID_TOKENS(4); 1039 UPATH1_VNODE1_TOKENS; 1040 break; 1041 1042 case AUE_LINK: 1043 case AUE_LINKAT: 1044 case AUE_RENAME: 1045 case AUE_RENAMEAT: 1046 ATFD1_TOKENS(1); 1047 UPATH1_VNODE1_TOKENS; 1048 ATFD2_TOKENS(3); 1049 UPATH2_TOKENS; 1050 break; 1051 1052 case AUE_LOADSHFILE: 1053 ADDR_TOKEN(4, "base addr"); 1054 UPATH1_VNODE1_TOKENS; 1055 break; 1056 1057 case AUE_MKDIR: 1058 case AUE_MKDIRAT: 1059 case AUE_MKFIFO: 1060 case AUE_MKFIFOAT: 1061 ATFD1_TOKENS(1); 1062 if (ARG_IS_VALID(kar, ARG_MODE)) { 1063 tok = au_to_arg32(2, "mode", ar->ar_arg_mode); 1064 kau_write(rec, tok); 1065 } 1066 UPATH1_VNODE1_TOKENS; 1067 break; 1068 1069 case AUE_MKNOD: 1070 case AUE_MKNODAT: 1071 ATFD1_TOKENS(1); 1072 if (ARG_IS_VALID(kar, ARG_MODE)) { 1073 tok = au_to_arg32(2, "mode", ar->ar_arg_mode); 1074 kau_write(rec, tok); 1075 } 1076 if (ARG_IS_VALID(kar, ARG_DEV)) { 1077 tok = au_to_arg32(3, "dev", ar->ar_arg_dev); 1078 kau_write(rec, tok); 1079 } 1080 UPATH1_VNODE1_TOKENS; 1081 break; 1082 1083 case AUE_MMAP: 1084 case AUE_MUNMAP: 1085 case AUE_MPROTECT: 1086 case AUE_MLOCK: 1087 case AUE_MUNLOCK: 1088 case AUE_MINHERIT: 1089 ADDR_TOKEN(1, "addr"); 1090 if (ARG_IS_VALID(kar, ARG_LEN)) { 1091 tok = au_to_arg32(2, "len", ar->ar_arg_len); 1092 kau_write(rec, tok); 1093 } 1094 if (ar->ar_event == AUE_MMAP) 1095 FD_VNODE1_TOKENS; 1096 if (ar->ar_event == AUE_MPROTECT) { 1097 if (ARG_IS_VALID(kar, ARG_VALUE)) { 1098 tok = au_to_arg32(3, "protection", 1099 ar->ar_arg_value); 1100 kau_write(rec, tok); 1101 } 1102 } 1103 if (ar->ar_event == AUE_MINHERIT) { 1104 if (ARG_IS_VALID(kar, ARG_VALUE)) { 1105 tok = au_to_arg32(3, "inherit", 1106 ar->ar_arg_value); 1107 kau_write(rec, tok); 1108 } 1109 } 1110 break; 1111 1112 case AUE_MOUNT: 1113 case AUE_NMOUNT: 1114 /* XXX Need to handle NFS mounts */ 1115 if (ARG_IS_VALID(kar, ARG_FFLAGS)) { 1116 tok = au_to_arg32(3, "flags", ar->ar_arg_fflags); 1117 kau_write(rec, tok); 1118 } 1119 if (ARG_IS_VALID(kar, ARG_TEXT)) { 1120 tok = au_to_text(ar->ar_arg_text); 1121 kau_write(rec, tok); 1122 } 1123 /* FALLTHROUGH */ 1124 1125 case AUE_NFS_SVC: 1126 if (ARG_IS_VALID(kar, ARG_CMD)) { 1127 tok = au_to_arg32(1, "flags", ar->ar_arg_cmd); 1128 kau_write(rec, tok); 1129 } 1130 break; 1131 1132 case AUE_UMOUNT: 1133 if (ARG_IS_VALID(kar, ARG_VALUE)) { 1134 tok = au_to_arg32(2, "flags", ar->ar_arg_value); 1135 kau_write(rec, tok); 1136 } 1137 UPATH1_VNODE1_TOKENS; 1138 if (ARG_IS_VALID(kar, ARG_TEXT)) { 1139 tok = au_to_text(ar->ar_arg_text); 1140 kau_write(rec, tok); 1141 } 1142 break; 1143 1144 case AUE_MSGCTL: 1145 ar->ar_event = audit_msgctl_to_event(ar->ar_arg_svipc_cmd); 1146 /* Fall through */ 1147 1148 case AUE_MSGRCV: 1149 case AUE_MSGSND: 1150 tok = au_to_arg32(1, "msg ID", ar->ar_arg_svipc_id); 1151 kau_write(rec, tok); 1152 if (ar->ar_errno != EINVAL) { 1153 tok = au_to_ipc(AT_IPC_MSG, ar->ar_arg_svipc_id); 1154 kau_write(rec, tok); 1155 } 1156 break; 1157 1158 case AUE_MSGGET: 1159 if (ar->ar_errno == 0) { 1160 if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) { 1161 tok = au_to_ipc(AT_IPC_MSG, 1162 ar->ar_arg_svipc_id); 1163 kau_write(rec, tok); 1164 } 1165 } 1166 break; 1167 1168 case AUE_RESETSHFILE: 1169 ADDR_TOKEN(1, "base addr"); 1170 break; 1171 1172 case AUE_OPEN_RC: 1173 case AUE_OPEN_RTC: 1174 case AUE_OPEN_RWC: 1175 case AUE_OPEN_RWTC: 1176 case AUE_OPEN_WC: 1177 case AUE_OPEN_WTC: 1178 case AUE_CREAT: 1179 if (ARG_IS_VALID(kar, ARG_MODE)) { 1180 tok = au_to_arg32(3, "mode", ar->ar_arg_mode); 1181 kau_write(rec, tok); 1182 } 1183 /* FALLTHROUGH */ 1184 1185 case AUE_OPEN_R: 1186 case AUE_OPEN_RT: 1187 case AUE_OPEN_RW: 1188 case AUE_OPEN_RWT: 1189 case AUE_OPEN_W: 1190 case AUE_OPEN_WT: 1191 if (ARG_IS_VALID(kar, ARG_FFLAGS)) { 1192 tok = au_to_arg32(2, "flags", ar->ar_arg_fflags); 1193 kau_write(rec, tok); 1194 } 1195 UPATH1_VNODE1_TOKENS; 1196 break; 1197 1198 case AUE_OPENAT_RC: 1199 case AUE_OPENAT_RTC: 1200 case AUE_OPENAT_RWC: 1201 case AUE_OPENAT_RWTC: 1202 case AUE_OPENAT_WC: 1203 case AUE_OPENAT_WTC: 1204 if (ARG_IS_VALID(kar, ARG_MODE)) { 1205 tok = au_to_arg32(3, "mode", ar->ar_arg_mode); 1206 kau_write(rec, tok); 1207 } 1208 /* FALLTHROUGH */ 1209 1210 case AUE_OPENAT_R: 1211 case AUE_OPENAT_RT: 1212 case AUE_OPENAT_RW: 1213 case AUE_OPENAT_RWT: 1214 case AUE_OPENAT_W: 1215 case AUE_OPENAT_WT: 1216 if (ARG_IS_VALID(kar, ARG_FFLAGS)) { 1217 tok = au_to_arg32(2, "flags", ar->ar_arg_fflags); 1218 kau_write(rec, tok); 1219 } 1220 ATFD1_TOKENS(1); 1221 UPATH1_VNODE1_TOKENS; 1222 break; 1223 1224 case AUE_PTRACE: 1225 if (ARG_IS_VALID(kar, ARG_CMD)) { 1226 tok = au_to_arg32(1, "request", ar->ar_arg_cmd); 1227 kau_write(rec, tok); 1228 } 1229 if (ARG_IS_VALID(kar, ARG_VALUE)) { 1230 tok = au_to_arg32(4, "data", ar->ar_arg_value); 1231 kau_write(rec, tok); 1232 } 1233 PROCESS_PID_TOKENS(2); 1234 break; 1235 1236 case AUE_QUOTACTL: 1237 if (ARG_IS_VALID(kar, ARG_CMD)) { 1238 tok = au_to_arg32(2, "command", ar->ar_arg_cmd); 1239 kau_write(rec, tok); 1240 } 1241 if (ARG_IS_VALID(kar, ARG_UID)) { 1242 tok = au_to_arg32(3, "uid", ar->ar_arg_uid); 1243 kau_write(rec, tok); 1244 } 1245 if (ARG_IS_VALID(kar, ARG_GID)) { 1246 tok = au_to_arg32(3, "gid", ar->ar_arg_gid); 1247 kau_write(rec, tok); 1248 } 1249 UPATH1_VNODE1_TOKENS; 1250 break; 1251 1252 case AUE_REBOOT: 1253 if (ARG_IS_VALID(kar, ARG_CMD)) { 1254 tok = au_to_arg32(1, "howto", ar->ar_arg_cmd); 1255 kau_write(rec, tok); 1256 } 1257 break; 1258 1259 case AUE_SEMCTL: 1260 ar->ar_event = audit_semctl_to_event(ar->ar_arg_svipc_cmd); 1261 /* Fall through */ 1262 1263 case AUE_SEMOP: 1264 if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) { 1265 tok = au_to_arg32(1, "sem ID", ar->ar_arg_svipc_id); 1266 kau_write(rec, tok); 1267 if (ar->ar_errno != EINVAL) { 1268 tok = au_to_ipc(AT_IPC_SEM, 1269 ar->ar_arg_svipc_id); 1270 kau_write(rec, tok); 1271 } 1272 } 1273 break; 1274 1275 case AUE_SEMGET: 1276 if (ar->ar_errno == 0) { 1277 if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) { 1278 tok = au_to_ipc(AT_IPC_SEM, 1279 ar->ar_arg_svipc_id); 1280 kau_write(rec, tok); 1281 } 1282 } 1283 break; 1284 1285 case AUE_SETEGID: 1286 if (ARG_IS_VALID(kar, ARG_EGID)) { 1287 tok = au_to_arg32(1, "egid", ar->ar_arg_egid); 1288 kau_write(rec, tok); 1289 } 1290 break; 1291 1292 case AUE_SETEUID: 1293 if (ARG_IS_VALID(kar, ARG_EUID)) { 1294 tok = au_to_arg32(1, "euid", ar->ar_arg_euid); 1295 kau_write(rec, tok); 1296 } 1297 break; 1298 1299 case AUE_SETREGID: 1300 if (ARG_IS_VALID(kar, ARG_RGID)) { 1301 tok = au_to_arg32(1, "rgid", ar->ar_arg_rgid); 1302 kau_write(rec, tok); 1303 } 1304 if (ARG_IS_VALID(kar, ARG_EGID)) { 1305 tok = au_to_arg32(2, "egid", ar->ar_arg_egid); 1306 kau_write(rec, tok); 1307 } 1308 break; 1309 1310 case AUE_SETREUID: 1311 if (ARG_IS_VALID(kar, ARG_RUID)) { 1312 tok = au_to_arg32(1, "ruid", ar->ar_arg_ruid); 1313 kau_write(rec, tok); 1314 } 1315 if (ARG_IS_VALID(kar, ARG_EUID)) { 1316 tok = au_to_arg32(2, "euid", ar->ar_arg_euid); 1317 kau_write(rec, tok); 1318 } 1319 break; 1320 1321 case AUE_SETRESGID: 1322 if (ARG_IS_VALID(kar, ARG_RGID)) { 1323 tok = au_to_arg32(1, "rgid", ar->ar_arg_rgid); 1324 kau_write(rec, tok); 1325 } 1326 if (ARG_IS_VALID(kar, ARG_EGID)) { 1327 tok = au_to_arg32(2, "egid", ar->ar_arg_egid); 1328 kau_write(rec, tok); 1329 } 1330 if (ARG_IS_VALID(kar, ARG_SGID)) { 1331 tok = au_to_arg32(3, "sgid", ar->ar_arg_sgid); 1332 kau_write(rec, tok); 1333 } 1334 break; 1335 1336 case AUE_SETRESUID: 1337 if (ARG_IS_VALID(kar, ARG_RUID)) { 1338 tok = au_to_arg32(1, "ruid", ar->ar_arg_ruid); 1339 kau_write(rec, tok); 1340 } 1341 if (ARG_IS_VALID(kar, ARG_EUID)) { 1342 tok = au_to_arg32(2, "euid", ar->ar_arg_euid); 1343 kau_write(rec, tok); 1344 } 1345 if (ARG_IS_VALID(kar, ARG_SUID)) { 1346 tok = au_to_arg32(3, "suid", ar->ar_arg_suid); 1347 kau_write(rec, tok); 1348 } 1349 break; 1350 1351 case AUE_SETGID: 1352 if (ARG_IS_VALID(kar, ARG_GID)) { 1353 tok = au_to_arg32(1, "gid", ar->ar_arg_gid); 1354 kau_write(rec, tok); 1355 } 1356 break; 1357 1358 case AUE_SETUID: 1359 if (ARG_IS_VALID(kar, ARG_UID)) { 1360 tok = au_to_arg32(1, "uid", ar->ar_arg_uid); 1361 kau_write(rec, tok); 1362 } 1363 break; 1364 1365 case AUE_SETGROUPS: 1366 if (ARG_IS_VALID(kar, ARG_GROUPSET)) { 1367 for(ctr = 0; ctr < ar->ar_arg_groups.gidset_size; ctr++) 1368 { 1369 tok = au_to_arg32(1, "setgroups", 1370 ar->ar_arg_groups.gidset[ctr]); 1371 kau_write(rec, tok); 1372 } 1373 } 1374 break; 1375 1376 case AUE_SETLOGIN: 1377 if (ARG_IS_VALID(kar, ARG_TEXT)) { 1378 tok = au_to_text(ar->ar_arg_text); 1379 kau_write(rec, tok); 1380 } 1381 break; 1382 1383 case AUE_SETPRIORITY: 1384 if (ARG_IS_VALID(kar, ARG_CMD)) { 1385 tok = au_to_arg32(1, "which", ar->ar_arg_cmd); 1386 kau_write(rec, tok); 1387 } 1388 if (ARG_IS_VALID(kar, ARG_UID)) { 1389 tok = au_to_arg32(2, "who", ar->ar_arg_uid); 1390 kau_write(rec, tok); 1391 } 1392 PROCESS_PID_TOKENS(2); 1393 if (ARG_IS_VALID(kar, ARG_VALUE)) { 1394 tok = au_to_arg32(3, "priority", ar->ar_arg_value); 1395 kau_write(rec, tok); 1396 } 1397 break; 1398 1399 case AUE_SETPRIVEXEC: 1400 if (ARG_IS_VALID(kar, ARG_VALUE)) { 1401 tok = au_to_arg32(1, "flag", ar->ar_arg_value); 1402 kau_write(rec, tok); 1403 } 1404 break; 1405 1406 /* AUE_SHMAT, AUE_SHMCTL, AUE_SHMDT and AUE_SHMGET are SysV IPC */ 1407 case AUE_SHMAT: 1408 if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) { 1409 tok = au_to_arg32(1, "shmid", ar->ar_arg_svipc_id); 1410 kau_write(rec, tok); 1411 /* XXXAUDIT: Does having the ipc token make sense? */ 1412 tok = au_to_ipc(AT_IPC_SHM, ar->ar_arg_svipc_id); 1413 kau_write(rec, tok); 1414 } 1415 if (ARG_IS_VALID(kar, ARG_SVIPC_ADDR)) { 1416 tok = au_to_arg32(2, "shmaddr", 1417 (int)(uintptr_t)ar->ar_arg_svipc_addr); 1418 kau_write(rec, tok); 1419 } 1420 if (ARG_IS_VALID(kar, ARG_SVIPC_PERM)) { 1421 tok = au_to_ipc_perm(&ar->ar_arg_svipc_perm); 1422 kau_write(rec, tok); 1423 } 1424 break; 1425 1426 case AUE_SHMCTL: 1427 if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) { 1428 tok = au_to_arg32(1, "shmid", ar->ar_arg_svipc_id); 1429 kau_write(rec, tok); 1430 /* XXXAUDIT: Does having the ipc token make sense? */ 1431 tok = au_to_ipc(AT_IPC_SHM, ar->ar_arg_svipc_id); 1432 kau_write(rec, tok); 1433 } 1434 switch (ar->ar_arg_svipc_cmd) { 1435 case IPC_STAT: 1436 ar->ar_event = AUE_SHMCTL_STAT; 1437 break; 1438 case IPC_RMID: 1439 ar->ar_event = AUE_SHMCTL_RMID; 1440 break; 1441 case IPC_SET: 1442 ar->ar_event = AUE_SHMCTL_SET; 1443 if (ARG_IS_VALID(kar, ARG_SVIPC_PERM)) { 1444 tok = au_to_ipc_perm(&ar->ar_arg_svipc_perm); 1445 kau_write(rec, tok); 1446 } 1447 break; 1448 default: 1449 break; /* We will audit a bad command */ 1450 } 1451 break; 1452 1453 case AUE_SHMDT: 1454 if (ARG_IS_VALID(kar, ARG_SVIPC_ADDR)) { 1455 tok = au_to_arg32(1, "shmaddr", 1456 (int)(uintptr_t)ar->ar_arg_svipc_addr); 1457 kau_write(rec, tok); 1458 } 1459 break; 1460 1461 case AUE_SHMGET: 1462 /* This is unusual; the return value is in an argument token */ 1463 if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) { 1464 tok = au_to_arg32(0, "shmid", ar->ar_arg_svipc_id); 1465 kau_write(rec, tok); 1466 tok = au_to_ipc(AT_IPC_SHM, ar->ar_arg_svipc_id); 1467 kau_write(rec, tok); 1468 } 1469 if (ARG_IS_VALID(kar, ARG_SVIPC_PERM)) { 1470 tok = au_to_ipc_perm(&ar->ar_arg_svipc_perm); 1471 kau_write(rec, tok); 1472 } 1473 break; 1474 1475 /* AUE_SHMOPEN, AUE_SHMUNLINK, AUE_SEMOPEN, AUE_SEMCLOSE 1476 * and AUE_SEMUNLINK are Posix IPC */ 1477 case AUE_SHMOPEN: 1478 if (ARG_IS_VALID(kar, ARG_SVIPC_ADDR)) { 1479 tok = au_to_arg32(2, "flags", ar->ar_arg_fflags); 1480 kau_write(rec, tok); 1481 } 1482 if (ARG_IS_VALID(kar, ARG_MODE)) { 1483 tok = au_to_arg32(3, "mode", ar->ar_arg_mode); 1484 kau_write(rec, tok); 1485 } 1486 /* FALLTHROUGH */ 1487 1488 case AUE_SHMUNLINK: 1489 if (ARG_IS_VALID(kar, ARG_TEXT)) { 1490 tok = au_to_text(ar->ar_arg_text); 1491 kau_write(rec, tok); 1492 } 1493 if (ARG_IS_VALID(kar, ARG_POSIX_IPC_PERM)) { 1494 struct ipc_perm perm; 1495 1496 perm.uid = ar->ar_arg_pipc_perm.pipc_uid; 1497 perm.gid = ar->ar_arg_pipc_perm.pipc_gid; 1498 perm.cuid = ar->ar_arg_pipc_perm.pipc_uid; 1499 perm.cgid = ar->ar_arg_pipc_perm.pipc_gid; 1500 perm.mode = ar->ar_arg_pipc_perm.pipc_mode; 1501 perm.seq = 0; 1502 perm.key = 0; 1503 tok = au_to_ipc_perm(&perm); 1504 kau_write(rec, tok); 1505 } 1506 break; 1507 1508 case AUE_SEMOPEN: 1509 if (ARG_IS_VALID(kar, ARG_FFLAGS)) { 1510 tok = au_to_arg32(2, "flags", ar->ar_arg_fflags); 1511 kau_write(rec, tok); 1512 } 1513 if (ARG_IS_VALID(kar, ARG_MODE)) { 1514 tok = au_to_arg32(3, "mode", ar->ar_arg_mode); 1515 kau_write(rec, tok); 1516 } 1517 if (ARG_IS_VALID(kar, ARG_VALUE)) { 1518 tok = au_to_arg32(4, "value", ar->ar_arg_value); 1519 kau_write(rec, tok); 1520 } 1521 /* FALLTHROUGH */ 1522 1523 case AUE_SEMUNLINK: 1524 if (ARG_IS_VALID(kar, ARG_TEXT)) { 1525 tok = au_to_text(ar->ar_arg_text); 1526 kau_write(rec, tok); 1527 } 1528 if (ARG_IS_VALID(kar, ARG_POSIX_IPC_PERM)) { 1529 struct ipc_perm perm; 1530 1531 perm.uid = ar->ar_arg_pipc_perm.pipc_uid; 1532 perm.gid = ar->ar_arg_pipc_perm.pipc_gid; 1533 perm.cuid = ar->ar_arg_pipc_perm.pipc_uid; 1534 perm.cgid = ar->ar_arg_pipc_perm.pipc_gid; 1535 perm.mode = ar->ar_arg_pipc_perm.pipc_mode; 1536 perm.seq = 0; 1537 perm.key = 0; 1538 tok = au_to_ipc_perm(&perm); 1539 kau_write(rec, tok); 1540 } 1541 break; 1542 1543 case AUE_SEMCLOSE: 1544 if (ARG_IS_VALID(kar, ARG_FD)) { 1545 tok = au_to_arg32(1, "sem", ar->ar_arg_fd); 1546 kau_write(rec, tok); 1547 } 1548 break; 1549 1550 case AUE_SYMLINK: 1551 case AUE_SYMLINKAT: 1552 if (ARG_IS_VALID(kar, ARG_TEXT)) { 1553 tok = au_to_text(ar->ar_arg_text); 1554 kau_write(rec, tok); 1555 } 1556 ATFD1_TOKENS(1); 1557 UPATH1_VNODE1_TOKENS; 1558 break; 1559 1560 case AUE_SYSCTL: 1561 case AUE_SYSCTL_NONADMIN: 1562 if (ARG_IS_VALID(kar, ARG_CTLNAME | ARG_LEN)) { 1563 for (ctr = 0; ctr < ar->ar_arg_len; ctr++) { 1564 tok = au_to_arg32(1, "name", 1565 ar->ar_arg_ctlname[ctr]); 1566 kau_write(rec, tok); 1567 } 1568 } 1569 if (ARG_IS_VALID(kar, ARG_VALUE)) { 1570 tok = au_to_arg32(5, "newval", ar->ar_arg_value); 1571 kau_write(rec, tok); 1572 } 1573 if (ARG_IS_VALID(kar, ARG_TEXT)) { 1574 tok = au_to_text(ar->ar_arg_text); 1575 kau_write(rec, tok); 1576 } 1577 break; 1578 1579 case AUE_UMASK: 1580 if (ARG_IS_VALID(kar, ARG_MASK)) { 1581 tok = au_to_arg32(1, "new mask", ar->ar_arg_mask); 1582 kau_write(rec, tok); 1583 } 1584 tok = au_to_arg32(0, "prev mask", ar->ar_retval); 1585 kau_write(rec, tok); 1586 break; 1587 1588 case AUE_WAIT4: 1589 PROCESS_PID_TOKENS(1); 1590 if (ARG_IS_VALID(kar, ARG_VALUE)) { 1591 tok = au_to_arg32(3, "options", ar->ar_arg_value); 1592 kau_write(rec, tok); 1593 } 1594 break; 1595 1596 case AUE_CAP_NEW: 1597 /* 1598 * XXXRW/XXXJA: Would be nice to audit socket/etc information. 1599 */ 1600 FD_VNODE1_TOKENS; 1601 if (ARG_IS_VALID(kar, ARG_RIGHTS)) { 1602 tok = au_to_arg64(2, "rights", ar->ar_arg_rights); 1603 kau_write(rec, tok); 1604 } 1605 break; 1606 1607 case AUE_CAP_GETRIGHTS: 1608 if (ARG_IS_VALID(kar, ARG_FD)) { 1609 tok = au_to_arg32(1, "fd", ar->ar_arg_fd); 1610 kau_write(rec, tok); 1611 } 1612 break; 1613 1614 case AUE_CAP_ENTER: 1615 case AUE_CAP_GETMODE: 1616 break; 1617 1618 case AUE_NULL: 1619 default: 1620 printf("BSM conversion requested for unknown event %d\n", 1621 ar->ar_event); 1622 1623 /* 1624 * Write the subject token so it is properly freed here. 1625 */ 1626 kau_write(rec, subj_tok); 1627 kau_free(rec); 1628 return (BSM_NOAUDIT); 1629 } 1630 1631 kau_write(rec, subj_tok); 1632 tok = au_to_return32(au_errno_to_bsm(ar->ar_errno), ar->ar_retval); 1633 kau_write(rec, tok); /* Every record gets a return token */ 1634 1635 kau_close(rec, &ar->ar_endtime, ar->ar_event); 1636 1637 *pau = rec; 1638 return (BSM_SUCCESS); 1639} 1640 1641/* 1642 * Verify that a record is a valid BSM record. This verification is simple 1643 * now, but may be expanded on sometime in the future. Return 1 if the 1644 * record is good, 0 otherwise. 1645 */ 1646int 1647bsm_rec_verify(void *rec) 1648{ 1649 char c = *(char *)rec; 1650 1651 /* 1652 * Check the token ID of the first token; it has to be a header 1653 * token. 1654 * 1655 * XXXAUDIT There needs to be a token structure to map a token. 1656 * XXXAUDIT 'Shouldn't be simply looking at the first char. 1657 */ 1658 if ((c != AUT_HEADER32) && (c != AUT_HEADER32_EX) && 1659 (c != AUT_HEADER64) && (c != AUT_HEADER64_EX)) 1660 return (0); 1661 return (1); 1662} 1663