Home | History | Annotate | Download | only in praudit
      1 /*
      2  * CDDL HEADER START
      3  *
      4  * The contents of this file are subject to the terms of the
      5  * Common Development and Distribution License (the "License").
      6  * You may not use this file except in compliance with the License.
      7  *
      8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
      9  * or http://www.opensolaris.org/os/licensing.
     10  * See the License for the specific language governing permissions
     11  * and limitations under the License.
     12  *
     13  * When distributing Covered Code, include this CDDL HEADER in each
     14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
     15  * If applicable, add the following below this CDDL HEADER, with the
     16  * fields enclosed by brackets "[]" replaced with your own identifying
     17  * information: Portions Copyright [yyyy] [name of copyright owner]
     18  *
     19  * CDDL HEADER END
     20  */
     21 /*
     22  * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
     23  * Use is subject to license terms.
     24  */
     25 
     26 #pragma ident	"%Z%%M%	%I%	%E% SMI"
     27 
     28 /*
     29  * Solaris Audit Token Table.
     30  */
     31 
     32 #include <locale.h>
     33 
     34 #include <stdio.h>
     35 #include <stdlib.h>
     36 #include <string.h>
     37 #include <bsm/audit.h>
     38 #include <bsm/audit_record.h>
     39 #include <bsm/libbsm.h>
     40 
     41 #include "praudit.h"
     42 #include "toktable.h"
     43 
     44 token_desc_t tokentable[MAXTAG + 1];
     45 
     46 #define	table_init(i, n, f, t) \
     47 	tokentable[(int)(i)].t_name = (n); \
     48 	tokentable[(int)(i)].t_tagname = (n); \
     49 	tokentable[(int)(i)].func = (f); \
     50 	tokentable[(int)(i)].t_type = (t);
     51 
     52 /* table_initx is for entries which need name different from tagname */
     53 #define	table_initx(i, n, tn, f, t) \
     54 	tokentable[(int)(i)].t_name = (n); \
     55 	tokentable[(int)(i)].t_tagname = (tn); \
     56 	tokentable[(int)(i)].func = (f); \
     57 	tokentable[(int)(i)].t_type = (t);
     58 
     59 /*
     60  * Initialize the table of tokens & other tags.
     61  */
     62 void
     63 init_tokens(void)
     64 {
     65 	/*
     66 	 * TRANSLATION_NOTE
     67 	 * These names refer to different type of audit tokens.
     68 	 * To gain a better understanding of each token, read
     69 	 * System Administration Guide: Security Services >> Solaris Auditing
     70 	 * at http://docs.sun.com.
     71 	 */
     72 
     73 	(void) gettext("file");	/* to force out the translation note */
     74 
     75 	/*
     76 	 * Control token types
     77 	 */
     78 
     79 	table_init(AUT_INVALID, (char *)0, NOFUNC, T_UNKNOWN);
     80 	table_init(AUT_OTHER_FILE32, "file", file_token, T_EXTENDED);
     81 	table_init(AUT_OHEADER, "old_header", NOFUNC, T_EXTENDED);
     82 	table_init(AUT_TRAILER, "trailer", trailer_token, T_UNKNOWN);
     83 	table_initx(AUT_HEADER32, "header", "record",
     84 	    header_token, T_EXTENDED);
     85 	table_initx(AUT_HEADER32_EX, "header", "record",
     86 	    header32_ex_token, T_EXTENDED);
     87 
     88 	/*
     89 	 * Data token types
     90 	 */
     91 
     92 	table_init(AUT_DATA, "arbitrary", arbitrary_data_token, T_EXTENDED);
     93 	table_init(AUT_FMRI, "fmri", fmri_token, T_ELEMENT);
     94 	table_init(AUT_IPC, "IPC", s5_IPC_token, T_ENCLOSED);
     95 	table_init(AUT_PATH, "path", path_token, T_ELEMENT);
     96 	table_init(AUT_XATPATH, "path_attr", path_attr_token, T_ELEMENT);
     97 	table_init(AUT_SUBJECT32, "subject", subject32_token, T_ENCLOSED);
     98 	table_init(AUT_PROCESS32, "process", process32_token, T_ENCLOSED);
     99 	table_init(AUT_RETURN32, "return", return_value32_token, T_ENCLOSED);
    100 	table_init(AUT_TEXT, "text", text_token, T_ELEMENT);
    101 	table_init(AUT_OPAQUE, "opaque", opaque_token, T_ELEMENT);
    102 	table_initx(AUT_IN_ADDR, "ip address", "ip_address",
    103 	    ip_addr_token, T_ELEMENT);
    104 	table_init(AUT_IP, "ip", ip_token, T_ENCLOSED);
    105 	table_initx(AUT_IPORT, "ip port", "ip_port",
    106 	    iport_token, T_ELEMENT);
    107 	table_init(AUT_ARG32, "argument", argument32_token, T_ENCLOSED);
    108 	table_initx(AUT_SOCKET, "socket", "old_socket",
    109 	    socket_token, T_ENCLOSED);
    110 	table_init(AUT_SEQ, "sequence", sequence_token, T_ENCLOSED);
    111 	table_init(AUT_ZONENAME, "zone", zonename_token, T_ENCLOSED);
    112 
    113 	/*
    114 	 * Modifier token types
    115 	 */
    116 
    117 	table_init(AUT_ACL, "acl", acl_token, T_ENCLOSED);
    118 	table_init(AUT_ACE, "acl", ace_token, T_ENCLOSED);
    119 	table_init(AUT_ATTR, "attribute", attribute_token, T_ENCLOSED);
    120 	table_init(AUT_IPC_PERM, "IPC_perm", s5_IPC_perm_token, T_ENCLOSED);
    121 	table_init(AUT_GROUPS, "group", group_token, T_ELEMENT);
    122 	table_initx(AUT_LABEL, "sensitivity label", "sensitivity_label",
    123 	    label_token, T_ELEMENT);
    124 	table_init(AUT_PRIV, "privilege", privilege_token, T_EXTENDED);
    125 	table_initx(AUT_UPRIV, "use of privilege", "use_of_privilege",
    126 	    useofpriv_token, T_EXTENDED);
    127 	table_init(AUT_LIAISON, "liaison", liaison_token, T_ELEMENT);
    128 	table_init(AUT_NEWGROUPS, "group", newgroup_token, T_ELEMENT);
    129 	table_init(AUT_EXEC_ARGS, "exec_args", exec_args_token, T_ELEMENT);
    130 	table_init(AUT_EXEC_ENV, "exec_env", exec_env_token, T_ELEMENT);
    131 	table_init(AUT_ATTR32, "attribute", attribute32_token, T_ENCLOSED);
    132 	table_initx(AUT_UAUTH, "use of authorization",
    133 	    "use_of_authorization", useofauth_token, T_ELEMENT);
    134 	table_init(AUT_TID, "tid", tid_token, T_EXTENDED);
    135 
    136 	/*
    137 	 * X windows token types
    138 	 */
    139 	table_initx(AUT_XATOM, "X atom", "X_atom", xatom_token, T_ELEMENT);
    140 	table_initx(AUT_XOBJ, "X object", "X_object", NOFUNC, T_UNKNOWN);
    141 	table_initx(AUT_XPROTO, "X protocol", "X_protocol", NOFUNC, T_UNKNOWN);
    142 	table_initx(AUT_XSELECT, "X selection", "X_selection",
    143 	    xselect_token, T_ELEMENT);
    144 	table_initx(AUT_XCOLORMAP, "X color map", "X_color_map",
    145 	    xcolormap_token, T_ENCLOSED);
    146 	table_initx(AUT_XCURSOR, "X cursor", "X_cursor",
    147 	    xcursor_token, T_ENCLOSED);
    148 	table_initx(AUT_XFONT, "X font", "X_font", xfont_token, T_ENCLOSED);
    149 	table_initx(AUT_XGC, "X graphic context", "X_graphic_context",
    150 	    xgc_token, T_ENCLOSED);
    151 	table_initx(AUT_XPIXMAP, "X pixmap", "X_pixmap",
    152 	    xpixmap_token, T_ENCLOSED);
    153 	table_initx(AUT_XPROPERTY, "X property", "X_property",
    154 	    xproperty_token, T_EXTENDED);
    155 	table_initx(AUT_XWINDOW, "X window", "X_window",
    156 	    xwindow_token, T_ENCLOSED);
    157 	table_initx(AUT_XCLIENT, "X client", "X_client",
    158 	    xclient_token, T_ELEMENT);
    159 
    160 	/*
    161 	 * Command token types
    162 	 */
    163 
    164 	table_init(AUT_CMD, "cmd", cmd_token, T_ELEMENT);
    165 	table_init(AUT_EXIT, "exit", exit_token, T_ENCLOSED);
    166 
    167 	/*
    168 	 * Miscellaneous token types
    169 	 */
    170 
    171 	table_init(AUT_HOST, "host", host_token, T_ELEMENT);
    172 
    173 	/*
    174 	 * Solaris64 token types
    175 	 */
    176 
    177 	table_init(AUT_ARG64, "argument", argument64_token, T_ENCLOSED);
    178 	table_init(AUT_RETURN64, "return", return_value64_token, T_ENCLOSED);
    179 	table_init(AUT_ATTR64, "attribute", attribute64_token, T_ENCLOSED);
    180 	table_initx(AUT_HEADER64, "header", "record",
    181 	    header64_token, T_EXTENDED);
    182 	table_init(AUT_SUBJECT64, "subject", subject64_token, T_ENCLOSED);
    183 	table_init(AUT_PROCESS64, "process", process64_token, T_ENCLOSED);
    184 	table_init(AUT_OTHER_FILE64, "file", file64_token, T_EXTENDED);
    185 
    186 	/*
    187 	 * Extended network address token types
    188 	 */
    189 
    190 	table_initx(AUT_HEADER64_EX, "header", "record",
    191 	    header64_ex_token, T_EXTENDED);
    192 	table_init(AUT_SUBJECT32_EX, "subject", subject32_ex_token, T_ENCLOSED);
    193 	table_init(AUT_PROCESS32_EX, "process", process32_ex_token, T_ENCLOSED);
    194 	table_init(AUT_SUBJECT64_EX, "subject", subject64_ex_token, T_ENCLOSED);
    195 	table_init(AUT_PROCESS64_EX, "process", process64_ex_token, T_ENCLOSED);
    196 	table_initx(AUT_IN_ADDR_EX, "ip address", "ip_address",
    197 	    ip_addr_ex_token, T_ELEMENT);
    198 	table_init(AUT_SOCKET_EX, "socket", socket_ex_token, T_ENCLOSED);
    199 
    200 #ifdef _PRAUDIT
    201 	/*
    202 	 * Done with tokens above here. Now do remaining tags.
    203 	 */
    204 	table_init(TAG_AUID, "audit-uid", pa_pw_uid, T_ATTRIBUTE);
    205 	table_init(TAG_UID, "uid", pa_pw_uid, T_ATTRIBUTE);
    206 	table_init(TAG_GID, "gid", pa_gr_uid, T_ATTRIBUTE);
    207 	table_init(TAG_RUID, "ruid", pa_pw_uid, T_ATTRIBUTE);
    208 	table_init(TAG_RGID, "rgid", pa_gr_uid, T_ATTRIBUTE);
    209 
    210 	table_init(TAG_PID, "pid", pa_adr_u_int32, T_ATTRIBUTE);
    211 	table_init(TAG_SID, "sid", pa_adr_u_int32, T_ATTRIBUTE);
    212 
    213 	table_init(TAG_TID32, "tid", pa_tid32, T_ATTRIBUTE);
    214 	table_init(TAG_TID64, "tid", pa_tid64, T_ATTRIBUTE);
    215 	table_init(TAG_TID32_EX, "tid", pa_tid32_ex, T_ATTRIBUTE);
    216 	table_init(TAG_TID64_EX, "tid", pa_tid64_ex, T_ATTRIBUTE);
    217 	table_init(TAG_TID_TYPE, "type", NOFUNC, T_ATTRIBUTE);
    218 	table_init(TAG_IP, "ipadr", NOFUNC, T_ENCLOSED);
    219 	table_init(TAG_IP_LOCAL, "local-port", pa_adr_u_short, T_ATTRIBUTE);
    220 	table_init(TAG_IP_REMOTE, "remote-port", pa_adr_u_short, T_ATTRIBUTE);
    221 	table_init(TAG_IP_ADR, "host", pa_ip_addr, T_ATTRIBUTE);
    222 
    223 	table_initx(TAG_EVMOD, "event-modifier", "modifier",
    224 	    pa_event_modifier, T_ATTRIBUTE);
    225 	table_initx(TAG_EVTYPE, "event-type", "event",
    226 	    pa_event_type, T_ATTRIBUTE);
    227 	table_initx(TAG_TOKVERS, "token-version", "version",
    228 	    pa_adr_byte, T_ATTRIBUTE);
    229 
    230 	table_init(TAG_ISO, "iso8601", NOFUNC, T_ATTRIBUTE);
    231 
    232 	table_init(TAG_ERRVAL, "errval", NOFUNC, T_ATTRIBUTE);
    233 	table_init(TAG_RETVAL, "retval", pa_adr_int32, T_ATTRIBUTE);
    234 
    235 	table_init(TAG_SETTYPE, "set-type", pa_adr_string, T_ATTRIBUTE);
    236 	/* Sub-element of groups & newgroups token: */
    237 	table_init(TAG_GROUPID, "gid", pa_gr_uid, T_ELEMENT);
    238 
    239 	table_init(TAG_XID, "xid", pa_xid, T_ATTRIBUTE);
    240 	table_init(TAG_XCUID, "xcreator-uid", pa_pw_uid, T_ATTRIBUTE);
    241 
    242 	table_init(TAG_XSELTEXT, "x_sel_text", pa_adr_string, T_ELEMENT);
    243 	table_init(TAG_XSELTYPE, "x_sel_type", pa_adr_string, T_ELEMENT);
    244 	table_init(TAG_XSELDATA, "x_sel_data", pa_adr_string, T_ELEMENT);
    245 
    246 	table_init(TAG_ARGNUM, "arg-num", pa_adr_byte, T_ATTRIBUTE);
    247 	table_init(TAG_ARGVAL32, "value", pa_adr_int32hex, T_ATTRIBUTE);
    248 	table_init(TAG_ARGVAL64, "value", pa_adr_int64hex, T_ATTRIBUTE);
    249 	table_init(TAG_ARGDESC, "desc", pa_adr_string, T_ATTRIBUTE);
    250 
    251 	table_init(TAG_MODE, "mode", pa_mode, T_ATTRIBUTE);
    252 	table_init(TAG_FSID, "fsid", pa_adr_int32, T_ATTRIBUTE);
    253 	table_init(TAG_NODEID32, "nodeid", pa_adr_int32, T_ATTRIBUTE);
    254 	table_init(TAG_NODEID64, "nodeid", pa_adr_int64, T_ATTRIBUTE);
    255 	table_init(TAG_DEVICE32, "device", pa_adr_u_int32, T_ATTRIBUTE);
    256 	table_init(TAG_DEVICE64, "device", pa_adr_u_int64, T_ATTRIBUTE);
    257 
    258 	table_init(TAG_SEQNUM, "seq-num", pa_adr_u_int32, T_ATTRIBUTE);
    259 	table_init(TAG_ZONENAME, "name", pa_adr_string, T_ATTRIBUTE);
    260 	table_init(TAG_ARGV, "argv", pa_cmd, T_ELEMENT);
    261 	table_init(TAG_ARGE, "arge", pa_cmd, T_ELEMENT);
    262 	table_init(TAG_ARG, "arg", pa_string, T_ELEMENT);
    263 	table_init(TAG_ENV, "env", pa_string, T_ELEMENT);
    264 	table_init(TAG_XAT, "xattr", pa_string, T_ELEMENT);
    265 
    266 	table_init(TAG_RESULT, "result", NOFUNC, T_ATTRIBUTE);
    267 	table_init(TAG_CUID, "creator-uid", pa_pw_uid, T_ATTRIBUTE);
    268 	table_init(TAG_CGID, "creator-gid", pa_gr_uid, T_ATTRIBUTE);
    269 	table_init(TAG_SEQ, "seq", pa_adr_u_int32, T_ATTRIBUTE);
    270 	table_init(TAG_KEY, "key", pa_adr_int32hex, T_ATTRIBUTE);
    271 
    272 	table_init(TAG_IPVERS, "version", pa_adr_charhex, T_ATTRIBUTE);
    273 	table_init(TAG_IPSERV, "service_type", pa_adr_charhex, T_ATTRIBUTE);
    274 	table_init(TAG_IPLEN, "len", pa_adr_short, T_ATTRIBUTE);
    275 	table_init(TAG_IPID, "id", pa_adr_u_short, T_ATTRIBUTE);
    276 	table_init(TAG_IPOFFS, "offset", pa_adr_u_short, T_ATTRIBUTE);
    277 	table_init(TAG_IPTTL, "time_to_live", pa_adr_charhex, T_ATTRIBUTE);
    278 	table_init(TAG_IPPROTO, "protocol", pa_adr_charhex, T_ATTRIBUTE);
    279 	table_init(TAG_IPCKSUM, "cksum", pa_adr_u_short, T_ATTRIBUTE);
    280 	table_init(TAG_IPSRC, "src_addr", pa_adr_int32hex, T_ATTRIBUTE);
    281 	table_init(TAG_IPDEST, "dest_addr", pa_adr_int32hex, T_ATTRIBUTE);
    282 
    283 	table_init(TAG_ACLTYPE, "type", NOFUNC, T_ATTRIBUTE);
    284 	table_init(TAG_ACLVAL, "value", NOFUNC, T_ATTRIBUTE);
    285 	table_init(TAG_ACEMASK, "access_mask", NOFUNC, T_ATTRIBUTE);
    286 	table_init(TAG_ACEFLAGS, "flags", NOFUNC, T_ATTRIBUTE);
    287 	table_init(TAG_ACETYPE, "type", NOFUNC, T_ATTRIBUTE);
    288 	table_init(TAG_ACEID, "id", NOFUNC, T_ATTRIBUTE);
    289 	table_init(TAG_SOCKTYPE, "type", pa_adr_shorthex, T_ATTRIBUTE);
    290 	table_init(TAG_SOCKPORT, "port", pa_adr_shorthex, T_ATTRIBUTE);
    291 	table_init(TAG_SOCKADDR, "addr", NOFUNC, T_ATTRIBUTE);
    292 
    293 	table_init(TAG_SOCKEXDOM, "sock_domain", pa_adr_shorthex, T_ATTRIBUTE);
    294 	table_init(TAG_SOCKEXTYPE, "sock_type", pa_adr_shorthex, T_ATTRIBUTE);
    295 	table_init(TAG_SOCKEXLPORT, "lport", NOFUNC, T_ATTRIBUTE);
    296 	table_init(TAG_SOCKEXLADDR, "laddr", NOFUNC, T_ATTRIBUTE);
    297 	table_init(TAG_SOCKEXFPORT, "fport", NOFUNC, T_ATTRIBUTE);
    298 	table_init(TAG_SOCKEXFADDR, "faddr", NOFUNC, T_ATTRIBUTE);
    299 
    300 	table_init(TAG_IPCTYPE, "ipc-type", NOFUNC, T_ATTRIBUTE);
    301 	table_init(TAG_IPCID, "ipc-id", pa_adr_int32, T_ATTRIBUTE);
    302 
    303 	table_init(TAG_ARBPRINT, "print", NOFUNC, T_ATTRIBUTE);
    304 	table_init(TAG_ARBTYPE, "type", NOFUNC, T_ATTRIBUTE);
    305 	table_init(TAG_ARBCOUNT, "count", NOFUNC, T_ATTRIBUTE);
    306 
    307 	table_init(TAG_HOSTID, "host", NOFUNC, T_ATTRIBUTE);
    308 #endif	/* _PRAUDIT */
    309 }
    310