1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright 2008 Sun Microsystems, Inc. All rights reserved. 23 * Use is subject to license terms. 24 */ 25 26 /* 27 * This file contains the audit hook support code for auditing. 28 */ 29 30 #include <sys/types.h> 31 #include <sys/proc.h> 32 #include <sys/vnode.h> 33 #include <sys/vfs.h> 34 #include <sys/file.h> 35 #include <sys/user.h> 36 #include <sys/stropts.h> 37 #include <sys/systm.h> 38 #include <sys/pathname.h> 39 #include <sys/syscall.h> 40 #include <sys/fcntl.h> 41 #include <sys/ipc_impl.h> 42 #include <sys/msg_impl.h> 43 #include <sys/sem_impl.h> 44 #include <sys/shm_impl.h> 45 #include <sys/kmem.h> /* for KM_SLEEP */ 46 #include <sys/socket.h> 47 #include <sys/cmn_err.h> /* snprintf... */ 48 #include <sys/debug.h> 49 #include <sys/thread.h> 50 #include <netinet/in.h> 51 #include <c2/audit.h> /* needs to be included before user.h */ 52 #include <c2/audit_kernel.h> /* for M_DONTWAIT */ 53 #include <c2/audit_kevents.h> 54 #include <c2/audit_record.h> 55 #include <sys/strsubr.h> 56 #include <sys/tihdr.h> 57 #include <sys/tiuser.h> 58 #include <sys/timod.h> 59 #include <sys/model.h> /* for model_t */ 60 #include <sys/disp.h> /* for servicing_interrupt() */ 61 #include <sys/devpolicy.h> 62 #include <sys/crypto/ioctladmin.h> 63 #include <sys/cred_impl.h> 64 #include <inet/kssl/kssl.h> 65 #include <net/pfpolicy.h> 66 67 static void add_return_token(caddr_t *, unsigned int scid, int err, int rval); 68 69 static void audit_pathbuild(struct pathname *pnp); 70 71 /* 72 * ROUTINE: AUDIT_NEWPROC 73 * PURPOSE: initialize the child p_audit_data structure 74 * CALLBY: GETPROC 75 * NOTE: All threads for the parent process are locked at this point. 76 * We are essentially running singled threaded for this reason. 77 * GETPROC is called when system creates a new process. 78 * By the time AUDIT_NEWPROC is called, the child proc 79 * structure has already been initialized. What we need 80 * to do is to allocate the child p_audit_data and 81 * initialize it with the content of current parent process. 82 */ 83 84 void 85 audit_newproc(struct proc *cp) /* initialized child proc structure */ 86 { 87 p_audit_data_t *pad; /* child process audit data */ 88 p_audit_data_t *opad; /* parent process audit data */ 89 90 pad = kmem_cache_alloc(au_pad_cache, KM_SLEEP); 91 92 P2A(cp) = pad; 93 94 opad = P2A(curproc); 95 96 /* 97 * copy the audit data. Note that all threads of current 98 * process have been "held". Thus there is no race condition 99 * here with mutiple threads trying to alter the cwrd 100 * structure (such as releasing it). 101 * 102 * The audit context in the cred is "duplicated" for the new 103 * proc by elsewhere crhold'ing the parent's cred which it shares. 104 * 105 * We still want to hold things since auditon() [A_SETUMASK, 106 * A_SETSMASK] could be walking through the processes to 107 * update things. 108 */ 109 mutex_enter(&opad->pad_lock); /* lock opad structure during copy */ 110 pad->pad_data = opad->pad_data; /* copy parent's process audit data */ 111 au_pathhold(pad->pad_root); 112 au_pathhold(pad->pad_cwd); 113 mutex_exit(&opad->pad_lock); /* current proc will keep cwrd open */ 114 115 /* 116 * finish auditing of parent here so that it will be done 117 * before child has a chance to run. We include the child 118 * pid since the return value in the return token is a dummy 119 * one and contains no useful information (it is included to 120 * make the audit record structure consistant). 121 * 122 * tad_flag is set if auditing is on 123 */ 124 if (((t_audit_data_t *)T2A(curthread))->tad_flag) 125 au_uwrite(au_to_arg32(0, "child PID", (uint32_t)cp->p_pid)); 126 127 /* 128 * finish up audit record generation here because child process 129 * is set to run before parent process. We distinguish here 130 * between FORK, FORK1, or VFORK by the saved system call ID. 131 */ 132 audit_finish(0, ((t_audit_data_t *)T2A(curthread))->tad_scid, 0, 0); 133 } 134 135 /* 136 * ROUTINE: AUDIT_PFREE 137 * PURPOSE: deallocate the per-process udit data structure 138 * CALLBY: EXIT 139 * FORK_FAIL 140 * NOTE: all lwp except current one have stopped in SEXITLWPS 141 * why we are single threaded? 142 * . all lwp except current one have stopped in SEXITLWPS. 143 */ 144 void 145 audit_pfree(struct proc *p) /* proc structure to be freed */ 146 147 { /* AUDIT_PFREE */ 148 149 p_audit_data_t *pad; 150 151 pad = P2A(p); 152 153 /* better be a per process audit data structure */ 154 ASSERT(pad != (p_audit_data_t *)0); 155 156 if (pad == pad0) { 157 return; 158 } 159 160 /* deallocate all auditing resources for this process */ 161 au_pathrele(pad->pad_root); 162 au_pathrele(pad->pad_cwd); 163 164 /* 165 * Since the pad structure is completely overwritten after alloc, 166 * we don't bother to clear it. 167 */ 168 169 kmem_cache_free(au_pad_cache, pad); 170 } 171 172 /* 173 * ROUTINE: AUDIT_THREAD_CREATE 174 * PURPOSE: allocate per-process thread audit data structure 175 * CALLBY: THREAD_CREATE 176 * NOTE: This is called just after *t was bzero'd. 177 * We are single threaded in this routine. 178 * TODO: 179 * QUESTION: 180 */ 181 182 void 183 audit_thread_create(kthread_id_t t) 184 { 185 t_audit_data_t *tad; /* per-thread audit data */ 186 187 tad = kmem_zalloc(sizeof (struct t_audit_data), KM_SLEEP); 188 189 T2A(t) = tad; /* set up thread audit data ptr */ 190 tad->tad_thread = t; /* back ptr to thread: DEBUG */ 191 } 192 193 /* 194 * ROUTINE: AUDIT_THREAD_FREE 195 * PURPOSE: free the per-thread audit data structure 196 * CALLBY: THREAD_FREE 197 * NOTE: most thread data is clear after return 198 */ 199 void 200 audit_thread_free(kthread_t *t) 201 { 202 t_audit_data_t *tad; 203 au_defer_info_t *attr; 204 205 tad = T2A(t); 206 207 /* thread audit data must still be set */ 208 209 if (tad == tad0) { 210 return; 211 } 212 213 if (tad == NULL) { 214 return; 215 } 216 217 t->t_audit_data = 0; 218 219 /* must not have any audit record residual */ 220 ASSERT(tad->tad_ad == NULL); 221 222 /* saved path must be empty */ 223 ASSERT(tad->tad_aupath == NULL); 224 225 if (tad->tad_atpath) 226 au_pathrele(tad->tad_atpath); 227 228 attr = tad->tad_defer_head; 229 while (attr != NULL) { 230 au_defer_info_t *tmp_attr = attr; 231 232 au_free_rec(attr->audi_ad); 233 234 attr = attr->audi_next; 235 kmem_free(tmp_attr, sizeof (au_defer_info_t)); 236 } 237 238 kmem_free(tad, sizeof (*tad)); 239 } 240 241 /* 242 * ROUTINE: AUDIT_SAVEPATH 243 * PURPOSE: 244 * CALLBY: LOOKUPPN 245 * 246 * NOTE: We have reached the end of a path in fs/lookup.c. 247 * We get two pieces of information here: 248 * the vnode of the last component (vp) and 249 * the status of the last access (flag). 250 * TODO: 251 * QUESTION: 252 */ 253 254 /*ARGSUSED*/ 255 int 256 audit_savepath( 257 struct pathname *pnp, /* pathname to lookup */ 258 struct vnode *vp, /* vnode of the last component */ 259 int flag, /* status of the last access */ 260 cred_t *cr) /* cred of requestor */ 261 { 262 263 t_audit_data_t *tad; /* current thread */ 264 au_kcontext_t *kctx = GET_KCTX_PZ; 265 266 tad = U2A(u); 267 268 /* 269 * this event being audited or do we need path information 270 * later? This might be for a chdir/chroot or open (add path 271 * to file pointer. If the path has already been found for an 272 * open/creat then we don't need to process the path. 273 * 274 * S2E_SP (PAD_SAVPATH) flag comes from audit_s2e[].au_ctrl. Used with 275 * chroot, chdir, open, creat system call processing. It determines 276 * if audit_savepath() will discard the path or we need it later. 277 * PAD_PATHFND means path already included in this audit record. It 278 * is used in cases where multiple path lookups are done per 279 * system call. The policy flag, AUDIT_PATH, controls if multiple 280 * paths are allowed. 281 * S2E_NPT (PAD_NOPATH) flag comes from audit_s2e[].au_ctrl. Used with 282 * exit processing to inhibit any paths that may be added due to 283 * closes. 284 */ 285 if ((tad->tad_flag == 0 && !(tad->tad_ctrl & PAD_SAVPATH)) || 286 ((tad->tad_ctrl & PAD_PATHFND) && 287 !(kctx->auk_policy & AUDIT_PATH)) || 288 (tad->tad_ctrl & PAD_NOPATH)) { 289 return (0); 290 } 291 292 tad->tad_ctrl |= PAD_NOPATH; /* prevent possible reentry */ 293 294 audit_pathbuild(pnp); 295 tad->tad_vn = vp; 296 297 /* 298 * are we auditing only if error, or if it is not open or create 299 * otherwise audit_setf will do it 300 */ 301 302 if (tad->tad_flag) { 303 if (flag && (tad->tad_scid == SYS_open || 304 tad->tad_scid == SYS_open64 || 305 tad->tad_scid == SYS_creat || 306 tad->tad_scid == SYS_creat64 || 307 tad->tad_scid == SYS_fsat)) { 308 tad->tad_ctrl |= PAD_TRUE_CREATE; 309 } 310 311 /* add token to audit record for this name */ 312 au_uwrite(au_to_path(tad->tad_aupath)); 313 314 /* add the attributes of the object */ 315 if (vp) { 316 /* 317 * only capture attributes when there is no error 318 * lookup will not return the vnode of the failing 319 * component. 320 * 321 * if there was a lookup error, then don't add 322 * attribute. if lookup in vn_create(), 323 * then don't add attribute, 324 * it will be added at end of vn_create(). 325 */ 326 if (!flag && !(tad->tad_ctrl & PAD_NOATTRB)) 327 audit_attributes(vp); 328 } 329 } 330 331 /* free up space if we're not going to save path (open, crate) */ 332 if ((tad->tad_ctrl & PAD_SAVPATH) == 0) { 333 if (tad->tad_aupath != NULL) { 334 au_pathrele(tad->tad_aupath); 335 tad->tad_aupath = NULL; 336 tad->tad_vn = NULL; 337 } 338 } 339 if (tad->tad_ctrl & PAD_MLD) 340 tad->tad_ctrl |= PAD_PATHFND; 341 342 tad->tad_ctrl &= ~PAD_NOPATH; /* restore */ 343 return (0); 344 } 345 346 static void 347 audit_pathbuild(struct pathname *pnp) 348 { 349 char *pp; /* pointer to path */ 350 int len; /* length of incoming segment */ 351 int newsect; /* path requires a new section */ 352 struct audit_path *pfxapp; /* prefix for path */ 353 struct audit_path *newapp; /* new audit_path */ 354 t_audit_data_t *tad; /* current thread */ 355 p_audit_data_t *pad; /* current process */ 356 357 tad = U2A(u); 358 ASSERT(tad != NULL); 359 pad = P2A(curproc); 360 ASSERT(pad != NULL); 361 362 len = (pnp->pn_path - pnp->pn_buf) + 1; /* +1 for terminator */ 363 ASSERT(len > 0); 364 365 /* adjust for path prefix: tad_aupath, ATPATH, CRD, or CWD */ 366 mutex_enter(&pad->pad_lock); 367 if (tad->tad_aupath != NULL) { 368 pfxapp = tad->tad_aupath; 369 } else if (tad->tad_scid == SYS_fsat && pnp->pn_buf[0] != '/') { 370 ASSERT(tad->tad_atpath != NULL); 371 pfxapp = tad->tad_atpath; 372 } else if (tad->tad_ctrl & PAD_ABSPATH) { 373 pfxapp = pad->pad_root; 374 } else { 375 pfxapp = pad->pad_cwd; 376 } 377 au_pathhold(pfxapp); 378 mutex_exit(&pad->pad_lock); 379 380 /* get an expanded buffer to hold the anchored path */ 381 newsect = tad->tad_ctrl & PAD_ATPATH; 382 newapp = au_pathdup(pfxapp, newsect, len); 383 au_pathrele(pfxapp); 384 385 pp = newapp->audp_sect[newapp->audp_cnt] - len; 386 if (!newsect) { 387 /* overlay previous NUL terminator */ 388 *(pp - 1) = '/'; 389 } 390 391 /* now add string of processed path */ 392 bcopy(pnp->pn_buf, pp, len); 393 pp[len - 1] = '\0'; 394 395 /* perform path simplification as necessary */ 396 audit_fixpath(newapp, len); 397 398 if (tad->tad_aupath) 399 au_pathrele(tad->tad_aupath); 400 tad->tad_aupath = newapp; 401 402 /* for case where multiple lookups in one syscall (rename) */ 403 tad->tad_ctrl &= ~(PAD_ABSPATH | PAD_ATPATH); 404 } 405 406 407 408 /*ARGSUSED*/ 409 410 /* 411 * ROUTINE: AUDIT_ADDCOMPONENT 412 * PURPOSE: extend the path by the component accepted 413 * CALLBY: LOOKUPPN 414 * NOTE: This function is called only when there is an error in 415 * parsing a path component 416 * TODO: Add the error component to audit record 417 * QUESTION: what is this for 418 */ 419 420 void 421 audit_addcomponent(struct pathname *pnp) 422 { 423 au_kcontext_t *kctx = GET_KCTX_PZ; 424 t_audit_data_t *tad; 425 426 tad = U2A(u); 427 /* 428 * S2E_SP (PAD_SAVPATH) flag comes from audit_s2e[].au_ctrl. Used with 429 * chroot, chdir, open, creat system call processing. It determines 430 * if audit_savepath() will discard the path or we need it later. 431 * PAD_PATHFND means path already included in this audit record. It 432 * is used in cases where multiple path lookups are done per 433 * system call. The policy flag, AUDIT_PATH, controls if multiple 434 * paths are allowed. 435 * S2E_NPT (PAD_NOPATH) flag comes from audit_s2e[].au_ctrl. Used with 436 * exit processing to inhibit any paths that may be added due to 437 * closes. 438 */ 439 if ((tad->tad_flag == 0 && !(tad->tad_ctrl & PAD_SAVPATH)) || 440 ((tad->tad_ctrl & PAD_PATHFND) && 441 !(kctx->auk_policy & AUDIT_PATH)) || 442 (tad->tad_ctrl & PAD_NOPATH)) { 443 return; 444 } 445 446 return; 447 448 } /* AUDIT_ADDCOMPONENT */ 449 450 451 452 453 454 455 456 457 /* 458 * ROUTINE: AUDIT_ANCHORPATH 459 * PURPOSE: 460 * CALLBY: LOOKUPPN 461 * NOTE: 462 * anchor path at "/". We have seen a symbolic link or entering for the 463 * first time we will throw away any saved path if path is anchored. 464 * 465 * flag = 0, path is relative. 466 * flag = 1, path is absolute. Free any saved path and set flag to PAD_ABSPATH. 467 * 468 * If the (new) path is absolute, then we have to throw away whatever we have 469 * already accumulated since it is being superseded by new path which is 470 * anchored at the root. 471 * Note that if the path is relative, this function does nothing 472 * TODO: 473 * QUESTION: 474 */ 475 /*ARGSUSED*/ 476 void 477 audit_anchorpath(struct pathname *pnp, int flag) 478 { 479 au_kcontext_t *kctx = GET_KCTX_PZ; 480 t_audit_data_t *tad; 481 482 tad = U2A(u); 483 484 /* 485 * this event being audited or do we need path information 486 * later? This might be for a chdir/chroot or open (add path 487 * to file pointer. If the path has already been found for an 488 * open/creat then we don't need to process the path. 489 * 490 * S2E_SP (PAD_SAVPATH) flag comes from audit_s2e[].au_ctrl. Used with 491 * chroot, chdir, open, creat system call processing. It determines 492 * if audit_savepath() will discard the path or we need it later. 493 * PAD_PATHFND means path already included in this audit record. It 494 * is used in cases where multiple path lookups are done per 495 * system call. The policy flag, AUDIT_PATH, controls if multiple 496 * paths are allowed. 497 * S2E_NPT (PAD_NOPATH) flag comes from audit_s2e[].au_ctrl. Used with 498 * exit processing to inhibit any paths that may be added due to 499 * closes. 500 */ 501 if ((tad->tad_flag == 0 && !(tad->tad_ctrl & PAD_SAVPATH)) || 502 ((tad->tad_ctrl & PAD_PATHFND) && 503 !(kctx->auk_policy & AUDIT_PATH)) || 504 (tad->tad_ctrl & PAD_NOPATH)) { 505 return; 506 } 507 508 if (flag) { 509 tad->tad_ctrl |= PAD_ABSPATH; 510 if (tad->tad_aupath != NULL) { 511 au_pathrele(tad->tad_aupath); 512 tad->tad_aupath = NULL; 513 tad->tad_vn = NULL; 514 } 515 } 516 } 517 518 519 /* 520 * symbolic link. Save previous components. 521 * 522 * the path seen so far looks like this 523 * 524 * +-----------------------+----------------+ 525 * | path processed so far | remaining path | 526 * +-----------------------+----------------+ 527 * \-----------------------/ 528 * save this string if 529 * symbolic link relative 530 * (but don't include symlink component) 531 */ 532 533 /*ARGSUSED*/ 534 535 536 /* 537 * ROUTINE: AUDIT_SYMLINK 538 * PURPOSE: 539 * CALLBY: LOOKUPPN 540 * NOTE: 541 * TODO: 542 * QUESTION: 543 */ 544 void 545 audit_symlink(struct pathname *pnp, struct pathname *sympath) 546 { 547 char *sp; /* saved initial pp */ 548 char *cp; /* start of symlink path */ 549 uint_t len_path; /* processed path before symlink */ 550 t_audit_data_t *tad; 551 au_kcontext_t *kctx = GET_KCTX_PZ; 552 553 tad = U2A(u); 554 555 /* 556 * this event being audited or do we need path information 557 * later? This might be for a chdir/chroot or open (add path 558 * to file pointer. If the path has already been found for an 559 * open/creat then we don't need to process the path. 560 * 561 * S2E_SP (PAD_SAVPATH) flag comes from audit_s2e[].au_ctrl. Used with 562 * chroot, chdir, open, creat system call processing. It determines 563 * if audit_savepath() will discard the path or we need it later. 564 * PAD_PATHFND means path already included in this audit record. It 565 * is used in cases where multiple path lookups are done per 566 * system call. The policy flag, AUDIT_PATH, controls if multiple 567 * paths are allowed. 568 * S2E_NPT (PAD_NOPATH) flag comes from audit_s2e[].au_ctrl. Used with 569 * exit processing to inhibit any paths that may be added due to 570 * closes. 571 */ 572 if ((tad->tad_flag == 0 && 573 !(tad->tad_ctrl & PAD_SAVPATH)) || 574 ((tad->tad_ctrl & PAD_PATHFND) && 575 !(kctx->auk_policy & AUDIT_PATH)) || 576 (tad->tad_ctrl & PAD_NOPATH)) { 577 return; 578 } 579 580 /* 581 * if symbolic link is anchored at / then do nothing. 582 * When we cycle back to begin: in lookuppn() we will 583 * call audit_anchorpath() with a flag indicating if the 584 * path is anchored at / or is relative. We will release 585 * any saved path at that point. 586 * 587 * Note In the event that an error occurs in pn_combine then 588 * we want to remain pointing at the component that caused the 589 * path to overflow the pnp structure. 590 */ 591 if (sympath->pn_buf[0] == '/') 592 return; 593 594 /* backup over last component */ 595 sp = cp = pnp->pn_path; 596 while (*--cp != '/' && cp > pnp->pn_buf) 597 ; 598 599 len_path = cp - pnp->pn_buf; 600 601 /* is there anything to save? */ 602 if (len_path) { 603 pnp->pn_path = pnp->pn_buf; 604 audit_pathbuild(pnp); 605 pnp->pn_path = sp; 606 } 607 } 608 609 /* 610 * file_is_public : determine whether events for the file (corresponding to 611 * the specified file attr) should be audited or ignored. 612 * 613 * returns: 1 - if audit policy and file attributes indicate that 614 * file is effectively public. read events for 615 * the file should not be audited. 616 * 0 - otherwise 617 * 618 * The required attributes to be considered a public object are: 619 * - owned by root, AND 620 * - world-readable (permissions for other include read), AND 621 * - NOT world-writeable (permissions for other don't 622 * include write) 623 * (mode doesn't need to be checked for symlinks) 624 */ 625 int 626 file_is_public(struct vattr *attr) 627 { 628 au_kcontext_t *kctx = GET_KCTX_PZ; 629 630 if (!(kctx->auk_policy & AUDIT_PUBLIC) && (attr->va_uid == 0) && 631 ((attr->va_type == VLNK) || 632 ((attr->va_mode & (VREAD>>6)) != 0) && 633 ((attr->va_mode & (VWRITE>>6)) == 0))) { 634 return (1); 635 } 636 return (0); 637 } 638 639 640 /* 641 * ROUTINE: AUDIT_ATTRIBUTES 642 * PURPOSE: Audit the attributes so we can tell why the error occurred 643 * CALLBY: AUDIT_SAVEPATH 644 * AUDIT_VNCREATE_FINISH 645 * AUS_FCHOWN...audit_event.c...audit_path.c 646 * NOTE: 647 * TODO: 648 * QUESTION: 649 */ 650 void 651 audit_attributes(struct vnode *vp) 652 { 653 struct vattr attr; 654 struct t_audit_data *tad; 655 656 tad = U2A(u); 657 658 if (vp) { 659 attr.va_mask = AT_ALL; 660 if (VOP_GETATTR(vp, &attr, 0, CRED(), NULL) != 0) 661 return; 662 663 if (file_is_public(&attr) && (tad->tad_ctrl & PAD_PUBLIC_EV)) { 664 /* 665 * This is a public object and a "public" event 666 * (i.e., read only) -- either by definition 667 * (e.g., stat, access...) or by virtue of write access 668 * not being requested (e.g. mmap). 669 * Flag it in the tad to prevent this audit at the end. 670 */ 671 tad->tad_ctrl |= PAD_NOAUDIT; 672 } else { 673 au_uwrite(au_to_attr(&attr)); 674 audit_sec_attributes(&(u_ad), vp); 675 } 676 } 677 } 678 679 680 /* 681 * ROUTINE: AUDIT_FALLOC 682 * PURPOSE: allocating a new file structure 683 * CALLBY: FALLOC 684 * NOTE: file structure already initialized 685 * TODO: 686 * QUESTION: 687 */ 688 689 void 690 audit_falloc(struct file *fp) 691 { /* AUDIT_FALLOC */ 692 693 f_audit_data_t *fad; 694 695 /* allocate per file audit structure if there a'int any */ 696 ASSERT(F2A(fp) == NULL); 697 698 fad = kmem_zalloc(sizeof (struct f_audit_data), KM_SLEEP); 699 700 F2A(fp) = fad; 701 702 fad->fad_thread = curthread; /* file audit data back ptr; DEBUG */ 703 } 704 705 /* 706 * ROUTINE: AUDIT_UNFALLOC 707 * PURPOSE: deallocate file audit data structure 708 * CALLBY: CLOSEF 709 * UNFALLOC 710 * NOTE: 711 * TODO: 712 * QUESTION: 713 */ 714 715 void 716 audit_unfalloc(struct file *fp) 717 { 718 f_audit_data_t *fad; 719 720 fad = F2A(fp); 721 722 if (!fad) { 723 return; 724 } 725 if (fad->fad_aupath != NULL) { 726 au_pathrele(fad->fad_aupath); 727 } 728 fp->f_audit_data = 0; 729 kmem_free(fad, sizeof (struct f_audit_data)); 730 } 731 732 /* 733 * ROUTINE: AUDIT_EXIT 734 * PURPOSE: 735 * CALLBY: EXIT 736 * NOTE: 737 * TODO: 738 * QUESTION: why cmw code as offset by 2 but not here 739 */ 740 /* ARGSUSED */ 741 void 742 audit_exit(int code, int what) 743 { 744 struct t_audit_data *tad; 745 tad = U2A(u); 746 747 /* 748 * tad_scid will be set by audit_start even if we are not auditing 749 * the event. 750 */ 751 if (tad->tad_scid == SYS_exit) { 752 /* 753 * if we are auditing the exit system call, then complete 754 * audit record generation (no return from system call). 755 */ 756 if (tad->tad_flag && tad->tad_event == AUE_EXIT) 757 audit_finish(0, SYS_exit, 0, 0); 758 return; 759 } 760 761 /* 762 * Anyone auditing the system call that was aborted? 763 */ 764 if (tad->tad_flag) { 765 au_uwrite(au_to_text("event aborted")); 766 audit_finish(0, tad->tad_scid, 0, 0); 767 } 768 769 /* 770 * Generate an audit record for process exit if preselected. 771 */ 772 (void) audit_start(0, SYS_exit, 0, 0); 773 audit_finish(0, SYS_exit, 0, 0); 774 } 775 776 /* 777 * ROUTINE: AUDIT_CORE_START 778 * PURPOSE: 779 * CALLBY: PSIG 780 * NOTE: 781 * TODO: 782 */ 783 void 784 audit_core_start(int sig) 785 { 786 au_event_t event; 787 au_state_t estate; 788 t_audit_data_t *tad; 789 au_kcontext_t *kctx; 790 791 tad = U2A(u); 792 793 ASSERT(tad != (t_audit_data_t *)0); 794 795 ASSERT(tad->tad_scid == 0); 796 ASSERT(tad->tad_event == 0); 797 ASSERT(tad->tad_evmod == 0); 798 ASSERT(tad->tad_ctrl == 0); 799 ASSERT(tad->tad_flag == 0); 800 ASSERT(tad->tad_aupath == NULL); 801 802 kctx = GET_KCTX_PZ; 803 804 /* get basic event for system call */ 805 event = AUE_CORE; 806 estate = kctx->auk_ets[event]; 807 808 if ((tad->tad_flag = auditme(kctx, tad, estate)) == 0) 809 return; 810 811 /* reset the flags for non-user attributable events */ 812 tad->tad_ctrl = PAD_CORE; 813 tad->tad_scid = 0; 814 815 /* if auditing not enabled, then don't generate an audit record */ 816 817 if (!((kctx->auk_auditstate == AUC_AUDITING || 818 kctx->auk_auditstate == AUC_INIT_AUDIT) || 819 kctx->auk_auditstate == AUC_NOSPACE)) { 820 tad->tad_flag = 0; 821 tad->tad_ctrl = 0; 822 return; 823 } 824 825 tad->tad_event = event; 826 tad->tad_evmod = 0; 827 828 ASSERT(tad->tad_ad == NULL); 829 830 au_write(&(u_ad), au_to_arg32(1, "signal", (uint32_t)sig)); 831 } 832 833 /* 834 * ROUTINE: AUDIT_CORE_FINISH 835 * PURPOSE: 836 * CALLBY: PSIG 837 * NOTE: 838 * TODO: 839 * QUESTION: 840 */ 841 842 /*ARGSUSED*/ 843 void 844 audit_core_finish(int code) 845 { 846 int flag; 847 t_audit_data_t *tad; 848 au_kcontext_t *kctx; 849 850 tad = U2A(u); 851 852 ASSERT(tad != (t_audit_data_t *)0); 853 854 if ((flag = tad->tad_flag) == 0) { 855 tad->tad_event = 0; 856 tad->tad_evmod = 0; 857 tad->tad_ctrl = 0; 858 ASSERT(tad->tad_aupath == NULL); 859 return; 860 } 861 tad->tad_flag = 0; 862 863 kctx = GET_KCTX_PZ; 864 865 /* kludge for error 0, should use `code==CLD_DUMPED' instead */ 866 if (flag = audit_success(kctx, tad, 0, NULL)) { 867 cred_t *cr = CRED(); 868 const auditinfo_addr_t *ainfo = crgetauinfo(cr); 869 870 ASSERT(ainfo != NULL); 871 872 /* 873 * Add subject information (no locks since our private copy of 874 * credential 875 */ 876 AUDIT_SETSUBJ(&(u_ad), cr, ainfo, kctx); 877 878 /* Add a return token (should use f argument) */ 879 add_return_token((caddr_t *)&(u_ad), tad->tad_scid, 0, 0); 880 881 AS_INC(as_generated, 1, kctx); 882 AS_INC(as_kernel, 1, kctx); 883 } 884 885 /* Close up everything */ 886 au_close(kctx, &(u_ad), flag, tad->tad_event, tad->tad_evmod); 887 888 /* free up any space remaining with the path's */ 889 if (tad->tad_aupath != NULL) { 890 au_pathrele(tad->tad_aupath); 891 tad->tad_aupath = NULL; 892 tad->tad_vn = NULL; 893 } 894 tad->tad_event = 0; 895 tad->tad_evmod = 0; 896 tad->tad_ctrl = 0; 897 } 898 899 /*ARGSUSED*/ 900 void 901 audit_stropen(struct vnode *vp, dev_t *devp, int flag, cred_t *crp) 902 { 903 } 904 905 /*ARGSUSED*/ 906 void 907 audit_strclose(struct vnode *vp, int flag, cred_t *crp) 908 { 909 } 910 911 /*ARGSUSED*/ 912 void 913 audit_strioctl(struct vnode *vp, int cmd, intptr_t arg, int flag, 914 int copyflag, cred_t *crp, int *rvalp) 915 { 916 } 917 918 919 /*ARGSUSED*/ 920 void 921 audit_strgetmsg(struct vnode *vp, struct strbuf *mctl, struct strbuf *mdata, 922 unsigned char *pri, int *flag, int fmode) 923 { 924 struct stdata *stp; 925 t_audit_data_t *tad = U2A(u); 926 927 ASSERT(tad != (t_audit_data_t *)0); 928 929 stp = vp->v_stream; 930 931 /* lock stdata from audit_sock */ 932 mutex_enter(&stp->sd_lock); 933 934 /* proceed ONLY if user is being audited */ 935 if (!tad->tad_flag) { 936 /* 937 * this is so we will not add audit data onto 938 * a thread that is not being audited. 939 */ 940 stp->sd_t_audit_data = NULL; 941 mutex_exit(&stp->sd_lock); 942 return; 943 } 944 945 stp->sd_t_audit_data = (caddr_t)curthread; 946 mutex_exit(&stp->sd_lock); 947 } 948 949 /*ARGSUSED*/ 950 void 951 audit_strputmsg(struct vnode *vp, struct strbuf *mctl, struct strbuf *mdata, 952 unsigned char pri, int flag, int fmode) 953 { 954 struct stdata *stp; 955 t_audit_data_t *tad = U2A(u); 956 957 ASSERT(tad != (t_audit_data_t *)0); 958 959 stp = vp->v_stream; 960 961 /* lock stdata from audit_sock */ 962 mutex_enter(&stp->sd_lock); 963 964 /* proceed ONLY if user is being audited */ 965 if (!tad->tad_flag) { 966 /* 967 * this is so we will not add audit data onto 968 * a thread that is not being audited. 969 */ 970 stp->sd_t_audit_data = NULL; 971 mutex_exit(&stp->sd_lock); 972 return; 973 } 974 975 stp->sd_t_audit_data = (caddr_t)curthread; 976 mutex_exit(&stp->sd_lock); 977 } 978 979 /* 980 * ROUTINE: AUDIT_CLOSEF 981 * PURPOSE: 982 * CALLBY: CLOSEF 983 * NOTE: 984 * release per file audit resources when file structure is being released. 985 * 986 * IMPORTANT NOTE: Since we generate an audit record here, we may sleep 987 * on the audit queue if it becomes full. This means 988 * audit_closef can not be called when f_count == 0. Since 989 * f_count == 0 indicates the file structure is free, another 990 * process could attempt to use the file while we were still 991 * asleep waiting on the audit queue. This would cause the 992 * per file audit data to be corrupted when we finally do 993 * wakeup. 994 * TODO: 995 * QUESTION: 996 */ 997 998 void 999 audit_closef(struct file *fp) 1000 { /* AUDIT_CLOSEF */ 1001 f_audit_data_t *fad; 1002 t_audit_data_t *tad; 1003 int success; 1004 au_state_t estate; 1005 struct vnode *vp; 1006 token_t *ad = NULL; 1007 struct vattr attr; 1008 au_emod_t evmod = 0; 1009 const auditinfo_addr_t *ainfo; 1010 int getattr_ret; 1011 cred_t *cr; 1012 au_kcontext_t *kctx = GET_KCTX_PZ; 1013 1014 fad = F2A(fp); 1015 estate = kctx->auk_ets[AUE_CLOSE]; 1016 tad = U2A(u); 1017 cr = CRED(); 1018 1019 /* audit record already generated by system call envelope */ 1020 if (tad->tad_event == AUE_CLOSE) { 1021 /* so close audit event will have bits set */ 1022 tad->tad_evmod |= (au_emod_t)fad->fad_flags; 1023 return; 1024 } 1025 1026 /* if auditing not enabled, then don't generate an audit record */ 1027 if (!((kctx->auk_auditstate == AUC_AUDITING || 1028 kctx->auk_auditstate == AUC_INIT_AUDIT) || 1029 kctx->auk_auditstate == AUC_NOSPACE)) 1030 return; 1031 1032 ainfo = crgetauinfo(cr); 1033 if (ainfo == NULL) 1034 return; 1035 1036 success = ainfo->ai_mask.as_success & estate; 1037 1038 /* not selected for this event */ 1039 if (success == 0) 1040 return; 1041 1042 /* 1043 * can't use audit_attributes here since we use a private audit area 1044 * to build the audit record instead of the one off the thread. 1045 */ 1046 if ((vp = fp->f_vnode) != NULL) { 1047 attr.va_mask = AT_ALL; 1048 getattr_ret = VOP_GETATTR(vp, &attr, 0, CRED(), NULL); 1049 } 1050 1051 /* 1052 * When write was not used and the file can be considered public, 1053 * then skip the audit. 1054 */ 1055 if ((getattr_ret == 0) && ((fp->f_flag & FWRITE) == 0)) { 1056 if (file_is_public(&attr)) { 1057 return; 1058 } 1059 } 1060 1061 evmod = (au_emod_t)fad->fad_flags; 1062 if (fad->fad_aupath != NULL) { 1063 au_write((caddr_t *)&(ad), au_to_path(fad->fad_aupath)); 1064 } else { 1065 #ifdef _LP64 1066 au_write((caddr_t *)&(ad), au_to_arg64( 1067 1, "no path: fp", (uint64_t)fp)); 1068 #else 1069 au_write((caddr_t *)&(ad), au_to_arg32( 1070 1, "no path: fp", (uint32_t)fp)); 1071 #endif 1072 } 1073 1074 if (getattr_ret == 0) { 1075 au_write((caddr_t *)&(ad), au_to_attr(&attr)); 1076 audit_sec_attributes((caddr_t *)&(ad), vp); 1077 } 1078 1079 /* Add subject information */ 1080 AUDIT_SETSUBJ((caddr_t *)&(ad), cr, ainfo, kctx); 1081 1082 /* add a return token */ 1083 add_return_token((caddr_t *)&(ad), tad->tad_scid, 0, 0); 1084 1085 AS_INC(as_generated, 1, kctx); 1086 AS_INC(as_kernel, 1, kctx); 1087 1088 /* 1089 * Close up everything 1090 * Note: path space recovery handled by normal system 1091 * call envelope if not at last close. 1092 * Note there is no failure at this point since 1093 * this represents closes due to exit of process, 1094 * thus we always indicate successful closes. 1095 */ 1096 au_close(kctx, (caddr_t *)&(ad), AU_OK | AU_DEFER, 1097 AUE_CLOSE, evmod); 1098 } 1099 1100 /* 1101 * ROUTINE: AUDIT_SET 1102 * PURPOSE: Audit the file path and file attributes. 1103 * CALLBY: SETF 1104 * NOTE: SETF associate a file pointer with user area's open files. 1105 * TODO: 1106 * call audit_finish directly ??? 1107 * QUESTION: 1108 */ 1109 1110 /*ARGSUSED*/ 1111 void 1112 audit_setf(file_t *fp, int fd) 1113 { 1114 f_audit_data_t *fad; 1115 t_audit_data_t *tad; 1116 1117 if (fp == NULL) 1118 return; 1119 1120 tad = T2A(curthread); 1121 fad = F2A(fp); 1122 1123 if (!(tad->tad_scid == SYS_open || tad->tad_scid == SYS_creat || 1124 tad->tad_scid == SYS_open64 || tad->tad_scid == SYS_creat64 || 1125 tad->tad_scid == SYS_fsat)) 1126 return; 1127 1128 /* no path */ 1129 if (tad->tad_aupath == 0) 1130 return; 1131 1132 /* 1133 * assign path information associated with file audit data 1134 * use tad hold 1135 */ 1136 fad->fad_aupath = tad->tad_aupath; 1137 tad->tad_aupath = NULL; 1138 tad->tad_vn = NULL; 1139 1140 if (!(tad->tad_ctrl & PAD_TRUE_CREATE)) { 1141 /* adjust event type */ 1142 switch (tad->tad_event) { 1143 case AUE_OPEN_RC: 1144 tad->tad_event = AUE_OPEN_R; 1145 tad->tad_ctrl |= PAD_PUBLIC_EV; 1146 break; 1147 case AUE_OPEN_RTC: 1148 tad->tad_event = AUE_OPEN_RT; 1149 break; 1150 case AUE_OPEN_WC: 1151 tad->tad_event = AUE_OPEN_W; 1152 break; 1153 case AUE_OPEN_WTC: 1154 tad->tad_event = AUE_OPEN_WT; 1155 break; 1156 case AUE_OPEN_RWC: 1157 tad->tad_event = AUE_OPEN_RW; 1158 break; 1159 case AUE_OPEN_RWTC: 1160 tad->tad_event = AUE_OPEN_RWT; 1161 break; 1162 default: 1163 break; 1164 } 1165 } 1166 } 1167 1168 1169 /* 1170 * ROUTINE: AUDIT_COPEN 1171 * PURPOSE: 1172 * CALLBY: COPEN 1173 * NOTE: 1174 * TODO: 1175 * QUESTION: 1176 */ 1177 /*ARGSUSED*/ 1178 void 1179 audit_copen(int fd, file_t *fp, vnode_t *vp) 1180 { 1181 } 1182 1183 void 1184 audit_ipc(int type, int id, void *vp) 1185 { 1186 /* if not auditing this event, then do nothing */ 1187 if (ad_flag == 0) 1188 return; 1189 1190 switch (type) { 1191 case AT_IPC_MSG: 1192 au_uwrite(au_to_ipc(AT_IPC_MSG, id)); 1193 au_uwrite(au_to_ipc_perm(&(((kmsqid_t *)vp)->msg_perm))); 1194 break; 1195 case AT_IPC_SEM: 1196 au_uwrite(au_to_ipc(AT_IPC_SEM, id)); 1197 au_uwrite(au_to_ipc_perm(&(((ksemid_t *)vp)->sem_perm))); 1198 break; 1199 case AT_IPC_SHM: 1200 au_uwrite(au_to_ipc(AT_IPC_SHM, id)); 1201 au_uwrite(au_to_ipc_perm(&(((kshmid_t *)vp)->shm_perm))); 1202 break; 1203 } 1204 } 1205 1206 void 1207 audit_ipcget(int type, void *vp) 1208 { 1209 /* if not auditing this event, then do nothing */ 1210 if (ad_flag == 0) 1211 return; 1212 1213 switch (type) { 1214 case NULL: 1215 au_uwrite(au_to_ipc_perm((struct kipc_perm *)vp)); 1216 break; 1217 case AT_IPC_MSG: 1218 au_uwrite(au_to_ipc_perm(&(((kmsqid_t *)vp)->msg_perm))); 1219 break; 1220 case AT_IPC_SEM: 1221 au_uwrite(au_to_ipc_perm(&(((ksemid_t *)vp)->sem_perm))); 1222 break; 1223 case AT_IPC_SHM: 1224 au_uwrite(au_to_ipc_perm(&(((kshmid_t *)vp)->shm_perm))); 1225 break; 1226 } 1227 } 1228 1229 /* 1230 * ROUTINE: AUDIT_REBOOT 1231 * PURPOSE: 1232 * CALLBY: 1233 <