cmd/auditrecord/auditrecord.pl

#!/usr/perl5/bin/perl
#
# CDDL HEADER START
#
# The contents of this file are subject to the terms of the
# Common Development and Distribution License (the "License").
# You may not use this file except in compliance with the License.
#
# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
# or http://www.opensolaris.org/os/licensing.
# See the License for the specific language governing permissions
# and limitations under the License.
#
# When distributing Covered Code, include this CDDL HEADER in each
# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
# If applicable, add the following below this CDDL HEADER, with the
# fields enclosed by brackets "[]" replaced with your own identifying
# information: Portions Copyright [yyyy] [name of copyright owner]
#
# CDDL HEADER END
#
#
# Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
# Use is subject to license terms.
#

# auditrecord - display one or more audit records

require 5.8.4;
use strict;
use warnings;

our (%opt, $parse, $callFilter, $debug,
    %attr, %event, %class, %skipClass, %token, %noteAlias,
    $title, $note, $name, $col1, $col2, $col3, $skip);

use Getopt::Std;
use locale;
use POSIX qw(locale_h);
use Sun::Solaris::Utils qw(gettext textdomain);
use Sun::Solaris::BSM::_BSMparse;

setlocale(LC_ALL, "");
textdomain(TEXT_DOMAIN);

if (!getopts('adhe:c:i:p:s:', \%opt) || @ARGV) {
	my $errString =
	    gettext("$0 takes no arguments other than switches.\n");
	print STDERR $errString if (@ARGV);
	usage();
	exit (1);
}

unless ($opt{a} || $opt{c} || $opt{e} || $opt{h} || $opt{i} ||
	$opt{p} || $opt{s}) {
	usage();
	exit (1);
}

my %options;
$options{'classFilter'} = $opt{c};   # filter on this class
$debug			= $opt{d};   # debug mode on
$options{'eventFilter'} = $opt{e};   # filter on this event
my $html		= $opt{h};   # output in html format
$options{'idFilter'}	= $opt{i};   # filter on this id
$callFilter		= $opt{p};   # filter on this program name
$callFilter		= $opt{s} if ($opt{s}); # filter on this system call

if (defined($callFilter)) {
	$callFilter = qr/\b$callFilter\b/;
} else {
	$callFilter = qr//;
}
$parse = new Sun::Solaris::BSM::_BSMparse($debug, \%options);

my ($attr, $token, $skipClass, $noteAlias) = $parse->readAttr();
%attr  = %$attr;
%token = %$token;
%noteAlias = %$noteAlias;
%skipClass = %$skipClass;

%class = %{$parse->readClass()};
%event = %{$parse->readEvent()};

# the calls to readControl and readUser are for debug; they are not
# needed for generation of record formats.  'ignore' means if there
# is no permission to read the file, don't die, just soldier on.

# $error is L10N'd by $parse

if ($debug) {
	my ($cnt, $error);

	# verify audit_control content
	($cnt, $error) = $parse->readControl('ignore');
	print STDERR $error if ($cnt);

	# verify audit_user content
	($cnt, $error) = $parse->readUser('ignore');
	print STDERR $error if ($cnt);

	# check audit_event, audit_display_attr
	($cnt, $error) = $parse->ckAttrEvent();
	print STDERR $error if ($cnt);
}

# check for invalid class to -c option if supplied
if (defined $options{'classFilter'}) {
	my $invalidClass = gettext('Invalid class %s supplied.');
	my $isInvalidClass = 0;
	foreach (split(/\s*,\s*/, $options{'classFilter'})) {
		unless (exists $class{$_}) {
			printf STDERR "$invalidClass\n", $_;
			$isInvalidClass = 1;
		}
	}
	exit (1) if $isInvalidClass;
}

if ($html) {
	writeHTML();
} else {
	writeASCII();
}

exit (0);

# writeASCII -- collect what's been read from various sources and
# output the formatted audit records

sub writeASCII {
	my $label;

	my $errString;

	foreach $label (sort(keys(%event))) {
		my $description;
		my @case;

		my ($id, $class, $eventDescription) = @{$event{$label}};

		our ($title, $note, $name, $col1, $col2, $col3);

		my ($skipThisClass, $mask) = classToMask($class, $label);

		next if ($skipThisClass);

		$mask = sprintf("0x%08X", $mask);

		($name, $description, $title, $skip, @case) =
			getAttributes($label, $eventDescription);

		next if ($name eq 'undefined');

		next unless $description =~ $callFilter;

		$~ = 'nameLine';
		write;

		$note = $skip;
		$~ = 'wrapped1';
		while ($note) {
			write;
		}
		next if ($skip);

		$~ = 'threeColumns';
		($col1, $col2, $col3) = getCallInfo($id, $name, $description);
		my @col1 = split(/\s*;\s*/, $col1);
		my @col2 = split(/\s*;\s*/, $col2);
		my @col3 = split(/\s*;\s*/, $col3);
		my $rows = $#col1;
		$rows = $#col2 if ($#col2 > $rows);
		$rows = $#col3 if ($#col3 > $rows);
		for (my $i = 0; $i <= $rows; $i++) {
			$col1 = defined ($col1[$i]) ? $col1[$i] : '';
			$col2 = defined ($col2[$i]) ? $col2[$i] : '';
			$col3 = defined ($col3[$i]) ? 'See ' . $col3[$i] : '';
			write;
		}
		$col1 = 'event ID';
		$col2 = $id;
		$col3 = $label;
		write;

		$col1 = 'class';
		$col2 = $class;
		$col3 = "($mask)";
		write;

		my $haveFormat = 0;
		my $caseElement;

		foreach $caseElement (@case) {
			# $note1 is the "case" description
			# $note2 is a "note"
			my ($note1, $format, $comment, $note2) = @$caseElement;

			$note = $note1;
			$~ = 'wrapped1';
			while ($note) {
				write;
			}
			unless (defined($format)) {
				$errString = gettext(
				    "missing format field: %s");
				printf STDERR ("$errString\n", $label);
				next;
			}
			unless ($format eq 'none') {
				$haveFormat = 1;

				my $list = getFormatList($format, $id);

				my @format  = split(/\s*:\s*/, $list);
				my @comment = split(/\s*:\s*/, $comment);

				my $item;

				foreach $item (@format) {
					$~ = 'twoColumns';
					($col1, $col2) =
					    getFormatLine($item, $label,
					    @comment);
					write;
					$~ = "col2Wrapped";
					while ($col2) {
						write;
					}
				}
			}
			$note2 = $noteAlias{$note2} if ($noteAlias{$note2});
			if ($note2) {
				$note = $note2;
				$~ = 'space';
				write;
				$~ = 'wrapped1';
				while ($note) {
					write;
				}
			}
		}
		unless ($haveFormat) {
			$~ = 'wrapped1';
			$note = gettext('No format information available');
			write;
		}
	}
}

# writeHTML -- collect what's been read from various sources
# and output the formatted audit records
#

sub writeHTML {
	my $label;

	my $description;
	my @case;

	my $docTitle = gettext("Audit Record Formats");

	print qq{
<!doctype html PUBLIC "-//IETF//DTD HTML//EN">
<html>
<head>
  <title>$docTitle</title>
  <META http-equiv="Content-Style-Type" content="text/css">
</head>

<body TEXT="#000000" BGCOLOR="#F0F0F0">
	};

	my $tableRows = 0;	# work around Netscape large table bug
	startTable();		# by generating multiple tables

	foreach $label (sort(keys(%event))) {
		my ($id, $class, $eventDescription) = @{$event{$label}};

		our ($title, $name, $note, $col1, $col2, $col3);

		my ($skipThisClass, $mask) = classToMask($class, $label);

		next if ($skipThisClass);

		$mask = sprintf("0x%08X", $mask);

		my $description;

		($name, $description, $title, $skip, @case) =
			getAttributes($label, $eventDescription);

		next if ($name eq 'undefined');

		next unless $description =~ $callFilter;

		$tableRows++;
		if ($tableRows > 50) {
			endTable();
			startTable();
			$tableRows = 0;
		}

		my ($callType, $callName);
		($callType, $callName, $description) =
			getCallInfo($id, $name, $description);
		$description =~ s/\s*;\s*/<br>/g;

		my $titleName = $title;
		if ($callName) {
			$titleName = $callName;
		}
		$titleName =~ s/\s*;\s*/<br>/g;
		$titleName = '&nbsp;' if ($titleName eq $title);

		print qq{
  <tr bgcolor="#C0C0C0">
    <td>$label</td>
    <td>$id</td>
    <td>$class</td>
    <td>$mask</td>
  </tr>
  <tr>
    <td colspan=2>$titleName</td>
    <td colspan=2>$description</td>
  </tr>
  <tr>
    <td colspan=4>
      <pre>
};

		$note = $skip;
		$~ = 'wrapped2';
		while ($note) {
			write;
		}
		next if ($skip);

		my $haveFormat = 0;
		my $caseElement;

		foreach $caseElement (@case) {
			my ($note1, $format, $comment, $note2) = @$caseElement;

			$note = $note1;
			$~ = 'wrapped2';
			while ($note) {
				write;
			}
			unless (defined($format)) {
				my $errString = gettext(
				    "Missing format field: %s\n");
				printf STDERR ($errString, $label);
				next;
			}
			unless ($format eq 'none') {
				$haveFormat = 1;

				my $list = getFormatList($format, $id);

				my @format  = split(/\s*:\s*/, $list);
				my @comment = split(/\s*:\s*/, $comment);
				my $item;

				$~ = 'twoColumns';
				foreach $item (@format) {
					($col1, $col2) =
					    getFormatLine($item, $label,
					    @comment);
					write;
				}
			}
			if ($note2) {
				$note2 = $noteAlias{$note2} if ($noteAlias{$note2});
				$note = $note2;
				$~ = 'space';
				write;
				$~ = 'wrapped2';
				while ($note) {
					write;
				}
			}
		}
		unless ($haveFormat) {
			$~ = 'wrapped2';
			$note = 'No format information available';
			write;
		}
		print q{
      </pre>
    </td/>
  </tr>
		};
	}
	endTable();
}

sub startTable {

	print q{
<table border=1>
  <tr bgcolor="#C0C0C0">
    <th>Event Name</th>
    <th>Event ID</th>
    <th>Event Class</th>
    <th>Mask</th>
  </tr>
  <tr>
    <th colspan=2>Call Name</th>
    <th colspan=2>Reference</th>
  <tr>
  <tr>
    <th colspan=4>Format</th>
  </tr>
	};
}

sub endTable {

	print q{
</table>
</body>
</html>
	};
}

# classToMask: One, given a class list, it calculates the mask; Two,
# it checks to see if every item on the class list is marked for
# skipping, and if so, sets a flag.

sub classToMask {
	my $classList = shift;
	my $label = shift;
	my $mask = 0;

	my @classes = split(/\s*,\s*/, $classList);
	my $skipThisClass = 0;

	my $thisClass;
	foreach $thisClass (@classes) {
		unless (defined($class{$thisClass})) {
			my $errString = gettext(
			    "%s not found in audit_class.  Omitting %s\n");
			$errString = sprintf($errString, $thisClass,
			    $label);
			print STDERR $errString if ($debug);
			next;
		}
		$skipThisClass = 1 if ($skipClass{$thisClass});
		$mask |=  $class{$thisClass};
	}
	return ($skipThisClass, $mask);
}

# getAttributes: Combine fields from %event and %attr; a description
# in the attribute file overrides a description from audit_event

sub getAttributes {
	my $label = shift;
	my $desc = shift;	# description from audit_event

	my ($description, $title, $skip, @case);

	my $errString = gettext("%s not found in attribute file.");
	my $name = gettext("undefined");

	if (defined($attr{$label})) {
		($name, $description, $title, $skip, @case) = @{$attr{$label}};
		if ($description eq 'none') {
			if ($desc eq 'blank') {
				$description = '';
			} else {
				$description = $desc;
			}
		}
		$name = '' if ($name eq 'none');
		$title = $name if (($title eq 'none') || (!defined($title)));
	} else {
		printf STDERR ("$errString\n", $label) if ($debug);
	}
	return ($name, $description, $title, $skip, @case);
}

# getCallInfo: the system call or program name for an audit record can
# usually be derived from the event name; %attr provides exceptions to
# this rule

sub getCallInfo {
	my $id = shift;
	my $name = shift;
	my $desc = shift;

	my $callType;
	my $callName;
	my $description;

	if ($name) {
		if ($id < 6000) {
			$callType = 'system call';
		} else {
			$callType = 'program';
		}
		($callName) = split(/\s*:\s*/, $name);
	} else {
		$callType = '';
		$callName = '';
	}
	$description = '';
	$description = "$desc" if ($desc);

	return ($callType, $callName, $description);
}

# getFormatList: determine the order and details of kernel vs user
# audit records.  If the first token is "head" then the token list
# is explicit, otherwise the header, subject and return are implied.

sub getFormatList {
	my $format = shift;
	my $id = shift;

	my $list;

	if ($format =~ /^head:/) {
		$list = $format;
	}
	elsif ($format eq 'kernel') {
		$list = $parse->{'kernelDefault'};
		$list =~ s/insert://;
	} elsif ($format eq 'user') {
		$list = $parse->{'userDefault'};
		$list =~ s/insert://;
	} elsif ($id < 6000) {
		$list = $parse->{'kernelDefault'};
		$list =~ s/insert/$format/;
	} else {
		$list = $parse->{'userDefault'};
		$list =~ s/insert/$format/;
	}
	return ($list);
}

# getFormatLine: the arguments from the attribute 'format' are
# expanded to their printable form and also paired with a comment if
# one exists

sub getFormatLine {
	my $arg = shift;
	my $label = shift;
	my @comment = @_;

	my $isOption = 0;

	my ($token, $comment);

	my $cmt = -1;
	if ($arg =~ s/(\D*)(\d+)$/$1/) {  # trailing digits select a comment
		$cmt = $2 - 1;
	}
	$isOption = 1 if ($arg =~ s/^\[(.+)\]$/$1/);

	if (defined($token{$arg})) {	# expand abbreviated name to token
		$token = $token{$arg};
	} else {
		$token = $arg;		# no abbreviation found
	}
	$token = '['.$token.']' if ($isOption);

	if ($cmt > -1) {
		unless(defined($comment[$cmt])) {
			my $errString = gettext(
			    "missing comment for %s %s token %d\n");
			printf STDERR ($errString, $label, $token,
			    $cmt);
			$comment = gettext('missing comment field');
		} else {
			$comment = $comment[$cmt];
			$comment =~ s/&colon;/:/g;	#':' is a delimiter
		}
	} else {
		$comment = '';
	}
	unless (defined($token) && defined($comment)) {
		my $errString = gettext("attribute format/comment error for %s\n");
		printf STDERR ($errString, $label);
	}
	return ($token, $comment);
}

sub usage {
	print "$0 [ -d ] [ -h ] {[ -a ] | [ -e event ] |\n";
	print "\t[ -c class ] | [-i id ] | [ -p program ] |\n";
	print "\t[ -s syscall ]}\n";
}

format nameLine =

@<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
$title
.

format threeColumns =
  @<<<<<<<<<< @<<<<<<<<<<<<<<<<<<< @<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
$col1, $col2, $col3
.

format twoColumns =
      @<<<<<<<<<<<<<<<<<<<<<<<<<<< ^<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
$col1, $col2
.
format col2Wrapped =
				   ^<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
$col2
.

format space =

.

format wrapped1 =
    ^<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
$note
.

format wrapped2 =
^<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
$note
.