1 /* 2 * Copyright (c) 1999-2009 Apple Inc. 3 * All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 3. Neither the name of Apple Inc. ("Apple") nor the names of 14 * its contributors may be used to endorse or promote products derived 15 * from this software without specific prior written permission. 16 * 17 * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND 18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 20 * ARE DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR 21 * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 25 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING 26 * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 27 * POSSIBILITY OF SUCH DAMAGE. 28 */ 29 30 #include <sys/cdefs.h> 31 __FBSDID("$FreeBSD$"); 32 33 #include <sys/param.h> 34 #include <sys/vnode.h> 35 #include <sys/ipc.h> 36 #include <sys/lock.h> 37 #include <sys/malloc.h> 38 #include <sys/mutex.h> 39 #include <sys/socket.h> 40 #include <sys/extattr.h> 41 #include <sys/fcntl.h> 42 #include <sys/user.h> 43 #include <sys/systm.h> 44 45 #include <bsm/audit.h> 46 #include <bsm/audit_internal.h> 47 #include <bsm/audit_record.h> 48 #include <bsm/audit_kevents.h> 49 50 #include <security/audit/audit.h> 51 #include <security/audit/audit_private.h> 52 53 #include <netinet/in_systm.h> 54 #include <netinet/in.h> 55 #include <netinet/ip.h> 56 57 MALLOC_DEFINE(M_AUDITBSM, "audit_bsm", "Audit BSM data"); 58 59 static void audit_sys_auditon(struct audit_record *ar, 60 struct au_record *rec); 61 62 /* 63 * Initialize the BSM auditing subsystem. 64 */ 65 void 66 kau_init(void) 67 { 68 69 au_evclassmap_init(); 70 } 71 72 /* 73 * This call reserves memory for the audit record. Memory must be guaranteed 74 * before any auditable event can be generated. The au_record structure 75 * maintains a reference to the memory allocated above and also the list of 76 * tokens associated with this record. 77 */ 78 static struct au_record * 79 kau_open(void) 80 { 81 struct au_record *rec; 82 83 rec = malloc(sizeof(*rec), M_AUDITBSM, M_WAITOK); 84 rec->data = NULL; 85 TAILQ_INIT(&rec->token_q); 86 rec->len = 0; 87 rec->used = 1; 88 89 return (rec); 90 } 91 92 /* 93 * Store the token with the record descriptor. 94 */ 95 static void 96 kau_write(struct au_record *rec, struct au_token *tok) 97 { 98 99 KASSERT(tok != NULL, ("kau_write: tok == NULL")); 100 101 TAILQ_INSERT_TAIL(&rec->token_q, tok, tokens); 102 rec->len += tok->len; 103 } 104 105 /* 106 * Close out the audit record by adding the header token, identifying any 107 * missing tokens. Write out the tokens to the record memory. 108 */ 109 static void 110 kau_close(struct au_record *rec, struct timespec *ctime, short event) 111 { 112 u_char *dptr; 113 size_t tot_rec_size; 114 token_t *cur, *hdr, *trail; 115 struct timeval tm; 116 size_t hdrsize; 117 struct auditinfo_addr ak; 118 struct in6_addr *ap; 119 120 audit_get_kinfo(&ak); 121 hdrsize = 0; 122 switch (ak.ai_termid.at_type) { 123 case AU_IPv4: 124 hdrsize = (ak.ai_termid.at_addr[0] == INADDR_ANY) ? 125 AUDIT_HEADER_SIZE : AUDIT_HEADER_EX_SIZE(&ak); 126 break; 127 case AU_IPv6: 128 ap = (struct in6_addr *)&ak.ai_termid.at_addr[0]; 129 hdrsize = (IN6_IS_ADDR_UNSPECIFIED(ap)) ? AUDIT_HEADER_SIZE : 130 AUDIT_HEADER_EX_SIZE(&ak); 131 break; 132 default: 133 panic("kau_close: invalid address family"); 134 } 135 tot_rec_size = rec->len + hdrsize + AUDIT_TRAILER_SIZE; 136 rec->data = malloc(tot_rec_size, M_AUDITBSM, M_WAITOK | M_ZERO); 137 138 tm.tv_usec = ctime->tv_nsec / 1000; 139 tm.tv_sec = ctime->tv_sec; 140 if (hdrsize != AUDIT_HEADER_SIZE) 141 hdr = au_to_header32_ex_tm(tot_rec_size, event, 0, tm, &ak); 142 else 143 hdr = au_to_header32_tm(tot_rec_size, event, 0, tm); 144 TAILQ_INSERT_HEAD(&rec->token_q, hdr, tokens); 145 146 trail = au_to_trailer(tot_rec_size); 147 TAILQ_INSERT_TAIL(&rec->token_q, trail, tokens); 148 149 rec->len = tot_rec_size; 150 dptr = rec->data; 151 TAILQ_FOREACH(cur, &rec->token_q, tokens) { 152 memcpy(dptr, cur->t_data, cur->len); 153 dptr += cur->len; 154 } 155 } 156 157 /* 158 * Free a BSM audit record by releasing all the tokens and clearing the audit 159 * record information. 160 */ 161 void 162 kau_free(struct au_record *rec) 163 { 164 struct au_token *tok; 165 166 /* Free the token list. */ 167 while ((tok = TAILQ_FIRST(&rec->token_q))) { 168 TAILQ_REMOVE(&rec->token_q, tok, tokens); 169 free(tok->t_data, M_AUDITBSM); 170 free(tok, M_AUDITBSM); 171 } 172 173 rec->used = 0; 174 rec->len = 0; 175 free(rec->data, M_AUDITBSM); 176 free(rec, M_AUDITBSM); 177 } 178 179 /* 180 * XXX: May want turn some (or all) of these macros into functions in order 181 * to reduce the generated code size. 182 * 183 * XXXAUDIT: These macros assume that 'kar', 'ar', 'rec', and 'tok' in the 184 * caller are OK with this. 185 */ 186 #define ATFD1_TOKENS(argnum) do { \ 187 if (ARG_IS_VALID(kar, ARG_ATFD1)) { \ 188 tok = au_to_arg32(argnum, "at fd 1", ar->ar_arg_atfd1); \ 189 kau_write(rec, tok); \ 190 } \ 191 } while (0) 192 193 #define ATFD2_TOKENS(argnum) do { \ 194 if (ARG_IS_VALID(kar, ARG_ATFD2)) { \ 195 tok = au_to_arg32(argnum, "at fd 2", ar->ar_arg_atfd2); \ 196 kau_write(rec, tok); \ 197 } \ 198 } while (0) 199 200 #define UPATH1_TOKENS do { \ 201 if (ARG_IS_VALID(kar, ARG_UPATH1)) { \ 202 tok = au_to_path(ar->ar_arg_upath1); \ 203 kau_write(rec, tok); \ 204 } \ 205 } while (0) 206 207 #define UPATH2_TOKENS do { \ 208 if (ARG_IS_VALID(kar, ARG_UPATH2)) { \ 209 tok = au_to_path(ar->ar_arg_upath2); \ 210 kau_write(rec, tok); \ 211 } \ 212 } while (0) 213 214 #define VNODE1_TOKENS do { \ 215 if (ARG_IS_VALID(kar, ARG_ATFD)) { \ 216 tok = au_to_arg32(1, "at fd", ar->ar_arg_atfd); \ 217 kau_write(rec, tok); \ 218 } \ 219 if (ARG_IS_VALID(kar, ARG_VNODE1)) { \ 220 tok = au_to_attr32(&ar->ar_arg_vnode1); \ 221 kau_write(rec, tok); \ 222 } \ 223 } while (0) 224 225 #define UPATH1_VNODE1_TOKENS do { \ 226 UPATH1_TOKENS; \ 227 if (ARG_IS_VALID(kar, ARG_VNODE1)) { \ 228 tok = au_to_attr32(&ar->ar_arg_vnode1); \ 229 kau_write(rec, tok); \ 230 } \ 231 } while (0) 232 233 #define VNODE2_TOKENS do { \ 234 if (ARG_IS_VALID(kar, ARG_VNODE2)) { \ 235 tok = au_to_attr32(&ar->ar_arg_vnode2); \ 236 kau_write(rec, tok); \ 237 } \ 238 } while (0) 239 240 #define FD_VNODE1_TOKENS do { \ 241 if (ARG_IS_VALID(kar, ARG_VNODE1)) { \ 242 if (ARG_IS_VALID(kar, ARG_FD)) { \ 243 tok = au_to_arg32(1, "fd", ar->ar_arg_fd); \ 244 kau_write(rec, tok); \ 245 } \ 246 tok = au_to_attr32(&ar->ar_arg_vnode1); \ 247 kau_write(rec, tok); \ 248 } else { \ 249 if (ARG_IS_VALID(kar, ARG_FD)) { \ 250 tok = au_to_arg32(1, "non-file: fd", \ 251 ar->ar_arg_fd); \ 252 kau_write(rec, tok); \ 253 } \ 254 } \ 255 } while (0) 256 257 #define PROCESS_PID_TOKENS(argn) do { \ 258 if ((ar->ar_arg_pid > 0) /* Reference a single process */ \ 259 && (ARG_IS_VALID(kar, ARG_PROCESS))) { \ 260 tok = au_to_process32_ex(ar->ar_arg_auid, \ 261 ar->ar_arg_euid, ar->ar_arg_egid, \ 262 ar->ar_arg_ruid, ar->ar_arg_rgid, \ 263 ar->ar_arg_pid, ar->ar_arg_asid, \ 264 &ar->ar_arg_termid_addr); \ 265 kau_write(rec, tok); \ 266 } else if (ARG_IS_VALID(kar, ARG_PID)) { \ 267 tok = au_to_arg32(argn, "process", ar->ar_arg_pid); \ 268 kau_write(rec, tok); \ 269 } \ 270 } while (0) 271 272 #define EXTATTR_TOKENS(namespace_argnum) do { \ 273 if (ARG_IS_VALID(kar, ARG_VALUE)) { \ 274 switch (ar->ar_arg_value) { \ 275 case EXTATTR_NAMESPACE_USER: \ 276 tok = au_to_text(EXTATTR_NAMESPACE_USER_STRING);\ 277 break; \ 278 case EXTATTR_NAMESPACE_SYSTEM: \ 279 tok = au_to_text(EXTATTR_NAMESPACE_SYSTEM_STRING);\ 280 break; \ 281 default: \ 282 tok = au_to_arg32((namespace_argnum), \ 283 "attrnamespace", ar->ar_arg_value); \ 284 break; \ 285 } \ 286 kau_write(rec, tok); \ 287 } \ 288 /* attrname is in the text field */ \ 289 if (ARG_IS_VALID(kar, ARG_TEXT)) { \ 290 tok = au_to_text(ar->ar_arg_text); \ 291 kau_write(rec, tok); \ 292 } \ 293 } while (0) 294 295 /* 296 * Not all pointer arguments to system calls are of interest, but in some 297 * cases they reflect delegation of rights, such as mmap(2) followed by 298 * minherit(2) before execve(2), so do the best we can. 299 */ 300 #define ADDR_TOKEN(argnum, argname) do { \ 301 if (ARG_IS_VALID(kar, ARG_ADDR)) { \ 302 if (sizeof(void *) == sizeof(uint32_t)) \ 303 tok = au_to_arg32((argnum), (argname), \ 304 (uint32_t)(uintptr_t)ar->ar_arg_addr); \ 305 else \ 306 tok = au_to_arg64((argnum), (argname), \ 307 (uint64_t)(uintptr_t)ar->ar_arg_addr); \ 308 kau_write(rec, tok); \ 309 } \ 310 } while (0) 311 312 313 /* 314 * Implement auditing for the auditon() system call. The audit tokens that 315 * are generated depend on the command that was sent into the auditon() 316 * system call. 317 */ 318 static void 319 audit_sys_auditon(struct audit_record *ar, struct au_record *rec) 320 { 321 struct au_token *tok; 322 323 tok = au_to_arg32(3, "length", ar->ar_arg_len); 324 kau_write(rec, tok); 325 switch (ar->ar_arg_cmd) { 326 case A_OLDSETPOLICY: 327 if ((size_t)ar->ar_arg_len == sizeof(int64_t)) { 328 tok = au_to_arg64(2, "policy", 329 ar->ar_arg_auditon.au_policy64); 330 kau_write(rec, tok); 331 break; 332 } 333 /* FALLTHROUGH */ 334 335 case A_SETPOLICY: 336 tok = au_to_arg32(2, "policy", ar->ar_arg_auditon.au_policy); 337 kau_write(rec, tok); 338 break; 339 340 case A_SETKMASK: 341 tok = au_to_arg32(2, "setkmask:as_success", 342 ar->ar_arg_auditon.au_mask.am_success); 343 kau_write(rec, tok); 344 tok = au_to_arg32(2, "setkmask:as_failure", 345 ar->ar_arg_auditon.au_mask.am_failure); 346 kau_write(rec, tok); 347 break; 348 349 case A_OLDSETQCTRL: 350 if ((size_t)ar->ar_arg_len == sizeof(au_qctrl64_t)) { 351 tok = au_to_arg64(2, "setqctrl:aq_hiwater", 352 ar->ar_arg_auditon.au_qctrl64.aq64_hiwater); 353 kau_write(rec, tok); 354 tok = au_to_arg64(2, "setqctrl:aq_lowater", 355 ar->ar_arg_auditon.au_qctrl64.aq64_lowater); 356 kau_write(rec, tok); 357 tok = au_to_arg64(2, "setqctrl:aq_bufsz", 358 ar->ar_arg_auditon.au_qctrl64.aq64_bufsz); 359 kau_write(rec, tok); 360 tok = au_to_arg64(2, "setqctrl:aq_delay", 361 ar->ar_arg_auditon.au_qctrl64.aq64_delay); 362 kau_write(rec, tok); 363 tok = au_to_arg64(2, "setqctrl:aq_minfree", 364 ar->ar_arg_auditon.au_qctrl64.aq64_minfree); 365 kau_write(rec, tok); 366 break; 367 } 368 /* FALLTHROUGH */ 369 370 case A_SETQCTRL: 371 tok = au_to_arg32(2, "setqctrl:aq_hiwater", 372 ar->ar_arg_auditon.au_qctrl.aq_hiwater); 373 kau_write(rec, tok); 374 tok = au_to_arg32(2, "setqctrl:aq_lowater", 375 ar->ar_arg_auditon.au_qctrl.aq_lowater); 376 kau_write(rec, tok); 377 tok = au_to_arg32(2, "setqctrl:aq_bufsz", 378 ar->ar_arg_auditon.au_qctrl.aq_bufsz); 379 kau_write(rec, tok); 380 tok = au_to_arg32(2, "setqctrl:aq_delay", 381 ar->ar_arg_auditon.au_qctrl.aq_delay); 382 kau_write(rec, tok); 383 tok = au_to_arg32(2, "setqctrl:aq_minfree", 384 ar->ar_arg_auditon.au_qctrl.aq_minfree); 385 kau_write(rec, tok); 386 break; 387 388 case A_SETUMASK: 389 tok = au_to_arg32(2, "setumask:as_success", 390 ar->ar_arg_auditon.au_auinfo.ai_mask.am_success); 391 kau_write(rec, tok); 392 tok = au_to_arg32(2, "setumask:as_failure", 393 ar->ar_arg_auditon.au_auinfo.ai_mask.am_failure); 394 kau_write(rec, tok); 395 break; 396 397 case A_SETSMASK: 398 tok = au_to_arg32(2, "setsmask:as_success", 399 ar->ar_arg_auditon.au_auinfo.ai_mask.am_success); 400 kau_write(rec, tok); 401 tok = au_to_arg32(2, "setsmask:as_failure", 402 ar->ar_arg_auditon.au_auinfo.ai_mask.am_failure); 403 kau_write(rec, tok); 404 break; 405 406 case A_OLDSETCOND: 407 if ((size_t)ar->ar_arg_len == sizeof(int64_t)) { 408 tok = au_to_arg64(2, "setcond", 409 ar->ar_arg_auditon.au_cond64); 410 kau_write(rec, tok); 411 break; 412 } 413 /* FALLTHROUGH */ 414 415 case A_SETCOND: 416 tok = au_to_arg32(2, "setcond", ar->ar_arg_auditon.au_cond); 417 kau_write(rec, tok); 418 break; 419 420 case A_SETCLASS: 421 kau_write(rec, tok); 422 tok = au_to_arg32(2, "setclass:ec_event", 423 ar->ar_arg_auditon.au_evclass.ec_number); 424 kau_write(rec, tok); 425 tok = au_to_arg32(2, "setclass:ec_class", 426 ar->ar_arg_auditon.au_evclass.ec_class); 427 kau_write(rec, tok); 428 break; 429 430 case A_SETPMASK: 431 tok = au_to_arg32(2, "setpmask:as_success", 432 ar->ar_arg_auditon.au_aupinfo.ap_mask.am_success); 433 kau_write(rec, tok); 434 tok = au_to_arg32(2, "setpmask:as_failure", 435 ar->ar_arg_auditon.au_aupinfo.ap_mask.am_failure); 436 kau_write(rec, tok); 437 break; 438 439 case A_SETFSIZE: 440 tok = au_to_arg32(2, "setfsize:filesize", 441 ar->ar_arg_auditon.au_fstat.af_filesz); 442 kau_write(rec, tok); 443 break; 444 445 default: 446 break; 447 } 448 } 449 450 /* 451 * Convert an internal kernel audit record to a BSM record and return a 452 * success/failure indicator. The BSM record is passed as an out parameter to 453 * this function. 454 * 455 * Return conditions: 456 * BSM_SUCCESS: The BSM record is valid 457 * BSM_FAILURE: Failure; the BSM record is NULL. 458 * BSM_NOAUDIT: The event is not auditable for BSM; the BSM record is NULL. 459 */ 460 int 461 kaudit_to_bsm(struct kaudit_record *kar, struct au_record **pau) 462 { 463 struct au_token *tok, *subj_tok, *jail_tok; 464 struct au_record *rec; 465 au_tid_t tid; 466 struct audit_record *ar; 467 int ctr; 468 469 KASSERT(kar != NULL, ("kaudit_to_bsm: kar == NULL")); 470 471 *pau = NULL; 472 ar = &kar->k_ar; 473 rec = kau_open(); 474 475 /* 476 * Create the subject token. If this credential was jailed be sure to 477 * generate a zonename token. 478 */ 479 if (ar->ar_jailname[0] != '\0') 480 jail_tok = au_to_zonename(ar->ar_jailname); 481 else 482 jail_tok = NULL; 483 switch (ar->ar_subj_term_addr.at_type) { 484 case AU_IPv4: 485 tid.port = ar->ar_subj_term_addr.at_port; 486 tid.machine = ar->ar_subj_term_addr.at_addr[0]; 487 subj_tok = au_to_subject32(ar->ar_subj_auid, /* audit ID */ 488 ar->ar_subj_cred.cr_uid, /* eff uid */ 489 ar->ar_subj_egid, /* eff group id */ 490 ar->ar_subj_ruid, /* real uid */ 491 ar->ar_subj_rgid, /* real group id */ 492 ar->ar_subj_pid, /* process id */ 493 ar->ar_subj_asid, /* session ID */ 494 &tid); 495 break; 496 case AU_IPv6: 497 subj_tok = au_to_subject32_ex(ar->ar_subj_auid, 498 ar->ar_subj_cred.cr_uid, 499 ar->ar_subj_egid, 500 ar->ar_subj_ruid, 501 ar->ar_subj_rgid, 502 ar->ar_subj_pid, 503 ar->ar_subj_asid, 504 &ar->ar_subj_term_addr); 505 break; 506 default: 507 bzero(&tid, sizeof(tid)); 508 subj_tok = au_to_subject32(ar->ar_subj_auid, 509 ar->ar_subj_cred.cr_uid, 510 ar->ar_subj_egid, 511 ar->ar_subj_ruid, 512 ar->ar_subj_rgid, 513 ar->ar_subj_pid, 514 ar->ar_subj_asid, 515 &tid); 516 } 517 518 /* 519 * The logic inside each case fills in the tokens required for the 520 * event, except for the header, trailer, and return tokens. The 521 * header and trailer tokens are added by the kau_close() function. 522 * The return token is added outside of the switch statement. 523 */ 524 switch(ar->ar_event) { 525 case AUE_ACCEPT: 526 case AUE_BIND: 527 case AUE_LISTEN: 528 case AUE_CONNECT: 529 case AUE_RECV: 530 case AUE_RECVFROM: 531 case AUE_RECVMSG: 532 case AUE_SEND: 533 case AUE_SENDFILE: 534 case AUE_SENDMSG: 535 case AUE_SENDTO: 536 /* 537 * Socket-related events. 538 */ 539 if (ARG_IS_VALID(kar, ARG_FD)) { 540 tok = au_to_arg32(1, "fd", ar->ar_arg_fd); 541 kau_write(rec, tok); 542 } 543 if (ARG_IS_VALID(kar, ARG_SADDRINET)) { 544 tok = au_to_sock_inet((struct sockaddr_in *) 545 &ar->ar_arg_sockaddr); 546 kau_write(rec, tok); 547 } 548 if (ARG_IS_VALID(kar, ARG_SADDRUNIX)) { 549 tok = au_to_sock_unix((struct sockaddr_un *) 550 &ar->ar_arg_sockaddr); 551 kau_write(rec, tok); 552 UPATH1_TOKENS; 553 } 554 /* XXX Need to handle ARG_SADDRINET6 */ 555 break; 556 557 case AUE_BINDAT: 558 case AUE_CONNECTAT: 559 ATFD1_TOKENS(1); 560 if (ARG_IS_VALID(kar, ARG_FD)) { 561 tok = au_to_arg32(2, "fd", ar->ar_arg_fd); 562 kau_write(rec, tok); 563 } 564 if (ARG_IS_VALID(kar, ARG_SADDRUNIX)) { 565 tok = au_to_sock_unix((struct sockaddr_un *) 566 &ar->ar_arg_sockaddr); 567 kau_write(rec, tok); 568 UPATH1_TOKENS; 569 } 570 break; 571 572 case AUE_SOCKET: 573 case AUE_SOCKETPAIR: 574 if (ARG_IS_VALID(kar, ARG_SOCKINFO)) { 575 tok = au_to_arg32(1, "domain", 576 ar->ar_arg_sockinfo.so_domain); 577 kau_write(rec, tok); 578 tok = au_to_arg32(2, "type", 579 ar->ar_arg_sockinfo.so_type); 580 kau_write(rec, tok); 581 tok = au_to_arg32(3, "protocol", 582 ar->ar_arg_sockinfo.so_protocol); 583 kau_write(rec, tok); 584 } 585 break; 586 587 case AUE_SETSOCKOPT: 588 case AUE_SHUTDOWN: 589 if (ARG_IS_VALID(kar, ARG_FD)) { 590 tok = au_to_arg32(1, "fd", ar->ar_arg_fd); 591 kau_write(rec, tok); 592 } 593 break; 594 595 case AUE_ACCT: 596 if (ARG_IS_VALID(kar, ARG_UPATH1)) { 597 UPATH1_VNODE1_TOKENS; 598 } else { 599 tok = au_to_arg32(1, "accounting off", 0); 600 kau_write(rec, tok); 601 } 602 break; 603 604 case AUE_SETAUID: 605 if (ARG_IS_VALID(kar, ARG_AUID)) { 606 tok = au_to_arg32(2, "setauid", ar->ar_arg_auid); 607 kau_write(rec, tok); 608 } 609 break; 610 611 case AUE_SETAUDIT: 612 if (ARG_IS_VALID(kar, ARG_AUID) && 613 ARG_IS_VALID(kar, ARG_ASID) && 614 ARG_IS_VALID(kar, ARG_AMASK) && 615 ARG_IS_VALID(kar, ARG_TERMID)) { 616 tok = au_to_arg32(1, "setaudit:auid", 617 ar->ar_arg_auid); 618 kau_write(rec, tok); 619 tok = au_to_arg32(1, "setaudit:port", 620 ar->ar_arg_termid.port); 621 kau_write(rec, tok); 622 tok = au_to_arg32(1, "setaudit:machine", 623 ar->ar_arg_termid.machine); 624 kau_write(rec, tok); 625 tok = au_to_arg32(1, "setaudit:as_success", 626 ar->ar_arg_amask.am_success); 627 kau_write(rec, tok); 628 tok = au_to_arg32(1, "setaudit:as_failure", 629 ar->ar_arg_amask.am_failure); 630 kau_write(rec, tok); 631 tok = au_to_arg32(1, "setaudit:asid", 632 ar->ar_arg_asid); 633 kau_write(rec, tok); 634 } 635 break; 636 637 case AUE_SETAUDIT_ADDR: 638 if (ARG_IS_VALID(kar, ARG_AUID) && 639 ARG_IS_VALID(kar, ARG_ASID) && 640 ARG_IS_VALID(kar, ARG_AMASK) && 641 ARG_IS_VALID(kar, ARG_TERMID_ADDR)) { 642 tok = au_to_arg32(1, "setaudit_addr:auid", 643 ar->ar_arg_auid); 644 kau_write(rec, tok); 645 tok = au_to_arg32(1, "setaudit_addr:as_success", 646 ar->ar_arg_amask.am_success); 647 kau_write(rec, tok); 648 tok = au_to_arg32(1, "setaudit_addr:as_failure", 649 ar->ar_arg_amask.am_failure); 650 kau_write(rec, tok); 651 tok = au_to_arg32(1, "setaudit_addr:asid", 652 ar->ar_arg_asid); 653 kau_write(rec, tok); 654 tok = au_to_arg32(1, "setaudit_addr:type", 655 ar->ar_arg_termid_addr.at_type); 656 kau_write(rec, tok); 657 tok = au_to_arg32(1, "setaudit_addr:port", 658 ar->ar_arg_termid_addr.at_port); 659 kau_write(rec, tok); 660 if (ar->ar_arg_termid_addr.at_type == AU_IPv6) 661 tok = au_to_in_addr_ex((struct in6_addr *) 662 &ar->ar_arg_termid_addr.at_addr[0]); 663 if (ar->ar_arg_termid_addr.at_type == AU_IPv4) 664 tok = au_to_in_addr((struct in_addr *) 665 &ar->ar_arg_termid_addr.at_addr[0]); 666 kau_write(rec, tok); 667 } 668 break; 669 670 case AUE_AUDITON: 671 /* 672 * For AUDITON commands without own event, audit the cmd. 673 */ 674 if (ARG_IS_VALID(kar, ARG_CMD)) { 675 tok = au_to_arg32(1, "cmd", ar->ar_arg_cmd); 676 kau_write(rec, tok); 677 } 678 /* FALLTHROUGH */ 679 680 case AUE_AUDITON_GETCAR: 681 case AUE_AUDITON_GETCLASS: 682 case AUE_AUDITON_GETCOND: 683 case AUE_AUDITON_GETCWD: 684 case AUE_AUDITON_GETKMASK: 685 case AUE_AUDITON_GETSTAT: 686 case AUE_AUDITON_GPOLICY: 687 case AUE_AUDITON_GQCTRL: 688 case AUE_AUDITON_SETCLASS: 689 case AUE_AUDITON_SETCOND: 690 case AUE_AUDITON_SETKMASK: 691 case AUE_AUDITON_SETSMASK: 692 case AUE_AUDITON_SETSTAT: 693 case AUE_AUDITON_SETUMASK: 694 case AUE_AUDITON_SPOLICY: 695 case AUE_AUDITON_SQCTRL: 696 if (ARG_IS_VALID(kar, ARG_AUDITON)) 697 audit_sys_auditon(ar, rec); 698 break; 699 700 case AUE_AUDITCTL: 701 UPATH1_VNODE1_TOKENS; 702 break; 703 704 case AUE_EXIT: 705 if (ARG_IS_VALID(kar, ARG_EXIT)) { 706 tok = au_to_exit(ar->ar_arg_exitretval, 707 ar->ar_arg_exitstatus); 708 kau_write(rec, tok); 709 } 710 break; 711 712 case AUE_ADJTIME: 713 case AUE_CLOCK_SETTIME: 714 case AUE_AUDIT: 715 case AUE_DUP2: 716 case AUE_GETAUDIT: 717 case AUE_GETAUDIT_ADDR: 718 case AUE_GETAUID: 719 case AUE_GETCWD: 720 case AUE_GETFSSTAT: 721 case AUE_GETRESUID: 722 case AUE_GETRESGID: 723 case AUE_KQUEUE: 724 case AUE_MODLOAD: 725 case AUE_MODUNLOAD: 726 case AUE_MSGSYS: 727 case AUE_NTP_ADJTIME: 728 case AUE_PIPE: 729 case AUE_POSIX_OPENPT: 730 case AUE_PROFILE: 731 case AUE_RTPRIO: 732 case AUE_SEMSYS: 733 case AUE_SHMSYS: 734 case AUE_SETPGRP: 735 case AUE_SETRLIMIT: 736 case AUE_SETSID: 737 case AUE_SETTIMEOFDAY: 738 case AUE_SYSARCH: 739 740 /* 741 * Header, subject, and return tokens added at end. 742 */ 743 break; 744 745 case AUE_CHDIR: 746 case AUE_CHROOT: 747 case AUE_FSTATAT: 748 case AUE_FUTIMESAT: 749 case AUE_GETATTRLIST: 750 case AUE_JAIL: 751 case AUE_LUTIMES: 752 case AUE_NFS_GETFH: 753 case AUE_LSTAT: 754 case AUE_LPATHCONF: 755 case AUE_PATHCONF: 756 case AUE_READLINK: 757 case AUE_READLINKAT: 758 case AUE_REVOKE: 759 case AUE_RMDIR: 760 case AUE_SEARCHFS: 761 case AUE_SETATTRLIST: 762 case AUE_STAT: 763 case AUE_STATFS: 764 case AUE_SWAPON: 765 case AUE_SWAPOFF: 766 case AUE_TRUNCATE: 767 case AUE_UNDELETE: 768 case AUE_UNLINK: 769 case AUE_UNLINKAT: 770 case AUE_UTIMES: 771 ATFD1_TOKENS(1); 772 UPATH1_VNODE1_TOKENS; 773 break; 774 775 case AUE_ACCESS: 776 case AUE_EACCESS: 777 case AUE_FACCESSAT: 778 ATFD1_TOKENS(1); 779 UPATH1_VNODE1_TOKENS; 780 if (ARG_IS_VALID(kar, ARG_VALUE)) { 781 tok = au_to_arg32(2, "mode", ar->ar_arg_value); 782 kau_write(rec, tok); 783 } 784 break; 785 786 case AUE_FHSTATFS: 787 case AUE_FHOPEN: 788 case AUE_FHSTAT: 789 /* XXXRW: Need to audit vnode argument. */ 790 break; 791 792 case AUE_CHFLAGS: 793 case AUE_LCHFLAGS: 794 if (ARG_IS_VALID(kar, ARG_FFLAGS)) { 795 tok = au_to_arg32(2, "flags", ar->ar_arg_fflags); 796 kau_write(rec, tok); 797 } 798 UPATH1_VNODE1_TOKENS; 799 break; 800 801 case AUE_CHMOD: 802 case AUE_LCHMOD: 803 if (ARG_IS_VALID(kar, ARG_MODE)) { 804 tok = au_to_arg32(2, "new file mode", 805 ar->ar_arg_mode); 806 kau_write(rec, tok); 807 } 808 UPATH1_VNODE1_TOKENS; 809 break; 810 811 case AUE_FCHMODAT: 812 ATFD1_TOKENS(1); 813 if (ARG_IS_VALID(kar, ARG_MODE)) { 814 tok = au_to_arg32(3, "new file mode", 815 ar->ar_arg_mode); 816 kau_write(rec, tok); 817 } 818 UPATH1_VNODE1_TOKENS; 819 break; 820 821 case AUE_CHOWN: 822 case AUE_LCHOWN: 823 if (ARG_IS_VALID(kar, ARG_UID)) { 824 tok = au_to_arg32(2, "new file uid", ar->ar_arg_uid); 825 kau_write(rec, tok); 826 } 827 if (ARG_IS_VALID(kar, ARG_GID)) { 828 tok = au_to_arg32(3, "new file gid", ar->ar_arg_gid); 829 kau_write(rec, tok); 830 } 831 UPATH1_VNODE1_TOKENS; 832 break; 833 834 case AUE_FCHOWNAT: 835 ATFD1_TOKENS(1); 836 if (ARG_IS_VALID(kar, ARG_UID)) { 837 tok = au_to_arg32(3, "new file uid", ar->ar_arg_uid); 838 kau_write(rec, tok); 839 } 840 if (ARG_IS_VALID(kar, ARG_GID)) { 841 tok = au_to_arg32(4, "new file gid", ar->ar_arg_gid); 842 kau_write(rec, tok); 843 } 844 UPATH1_VNODE1_TOKENS; 845 break; 846 847 case AUE_EXCHANGEDATA: 848 UPATH1_VNODE1_TOKENS; 849 UPATH2_TOKENS; 850 break; 851 852 case AUE_CLOSE: 853 if (ARG_IS_VALID(kar, ARG_FD)) { 854 tok = au_to_arg32(1, "fd", ar->ar_arg_fd); 855 kau_write(rec, tok); 856 } 857 UPATH1_VNODE1_TOKENS; 858 break; 859 860 case AUE_CLOSEFROM: 861 if (ARG_IS_VALID(kar, ARG_FD)) { 862 tok = au_to_arg32(1, "fd", ar->ar_arg_fd); 863 kau_write(rec, tok); 864 } 865 break; 866 867 case AUE_CORE: 868 if (ARG_IS_VALID(kar, ARG_SIGNUM)) { 869 tok = au_to_arg32(1, "signal", ar->ar_arg_signum); 870 kau_write(rec, tok); 871 } 872 UPATH1_VNODE1_TOKENS; 873 break; 874 875 case AUE_EXTATTRCTL: 876 UPATH1_VNODE1_TOKENS; 877 if (ARG_IS_VALID(kar, ARG_CMD)) { 878 tok = au_to_arg32(2, "cmd", ar->ar_arg_cmd); 879 kau_write(rec, tok); 880 } 881 /* extattrctl(2) filename parameter is in upath2/vnode2 */ 882 UPATH2_TOKENS; 883 VNODE2_TOKENS; 884 EXTATTR_TOKENS(4); 885 break; 886 887 case AUE_EXTATTR_GET_FILE: 888 case AUE_EXTATTR_SET_FILE: 889 case AUE_EXTATTR_LIST_FILE: 890 case AUE_EXTATTR_DELETE_FILE: 891 case AUE_EXTATTR_GET_LINK: 892 case AUE_EXTATTR_SET_LINK: 893 case AUE_EXTATTR_LIST_LINK: 894 case AUE_EXTATTR_DELETE_LINK: 895 UPATH1_VNODE1_TOKENS; 896 EXTATTR_TOKENS(2); 897 break; 898 899 case AUE_EXTATTR_GET_FD: 900 case AUE_EXTATTR_SET_FD: 901 case AUE_EXTATTR_LIST_FD: 902 case AUE_EXTATTR_DELETE_FD: 903 if (ARG_IS_VALID(kar, ARG_FD)) { 904 tok = au_to_arg32(2, "fd", ar->ar_arg_fd); 905 kau_write(rec, tok); 906 } 907 EXTATTR_TOKENS(2); 908 break; 909 910 case AUE_FEXECVE: 911 if (ARG_IS_VALID(kar, ARG_FD)) { 912 tok = au_to_arg32(1, "fd", ar->ar_arg_fd); 913 kau_write(rec, tok); 914 } 915 /* FALLTHROUGH */ 916 917 case AUE_EXECVE: 918 case AUE_MAC_EXECVE: 919 if (ARG_IS_VALID(kar, ARG_ARGV)) { 920 tok = au_to_exec_args(ar->ar_arg_argv, 921 ar->ar_arg_argc); 922 kau_write(rec, tok); 923 } 924 if (ARG_IS_VALID(kar, ARG_ENVV)) { 925 tok = au_to_exec_env(ar->ar_arg_envv, 926 ar->ar_arg_envc); 927 kau_write(rec, tok); 928 } 929 UPATH1_VNODE1_TOKENS; 930 break; 931 932 case AUE_FCHMOD: 933 if (ARG_IS_VALID(kar, ARG_MODE)) { 934 tok = au_to_arg32(2, "new file mode", 935 ar->ar_arg_mode); 936 kau_write(rec, tok); 937 } 938 FD_VNODE1_TOKENS; 939 break; 940 941 /* 942 * XXXRW: Some of these need to handle non-vnode cases as well. 943 */ 944 case AUE_FCHDIR: 945 case AUE_FPATHCONF: 946 case AUE_FSTAT: 947 case AUE_FSTATFS: 948 case AUE_FSYNC: 949 case AUE_FTRUNCATE: 950 case AUE_FUTIMES: 951 case AUE_GETDIRENTRIES: 952 case AUE_GETDIRENTRIESATTR: 953 case AUE_LSEEK: 954 case AUE_POLL: 955 case AUE_READ: 956 case AUE_READV: 957 case AUE_WRITE: 958 case AUE_WRITEV: 959 FD_VNODE1_TOKENS; 960 break; 961 962 case AUE_FCHOWN: 963 if (ARG_IS_VALID(kar, ARG_UID)) { 964 tok = au_to_arg32(2, "new file uid", ar->ar_arg_uid); 965 kau_write(rec, tok); 966 } 967 if (ARG_IS_VALID(kar, ARG_GID)) { 968 tok = au_to_arg32(3, "new file gid", ar->ar_arg_gid); 969 kau_write(rec, tok); 970 } 971 FD_VNODE1_TOKENS; 972 break; 973 974 case AUE_FCNTL: 975 if (ARG_IS_VALID(kar, ARG_CMD)) { 976 tok = au_to_arg32(2, "cmd", 977 au_fcntl_cmd_to_bsm(ar->ar_arg_cmd)); 978 kau_write(rec, tok); 979 } 980 if (ar->ar_arg_cmd == F_GETLK || ar->ar_arg_cmd == F_SETLK || 981 ar->ar_arg_cmd == F_SETLKW) { 982 FD_VNODE1_TOKENS; 983 } 984 break; 985 986 case AUE_FCHFLAGS: 987 if (ARG_IS_VALID(kar, ARG_FFLAGS)) { 988 tok = au_to_arg32(2, "flags", ar->ar_arg_fflags); 989 kau_write(rec, tok); 990 } 991 FD_VNODE1_TOKENS; 992 break; 993 994 case AUE_FLOCK: 995 if (ARG_IS_VALID(kar, ARG_CMD)) { 996 tok = au_to_arg32(2, "operation", ar->ar_arg_cmd); 997 kau_write(rec, tok); 998 } 999 FD_VNODE1_TOKENS; 1000 break; 1001 1002 case AUE_RFORK: 1003 if (ARG_IS_VALID(kar, ARG_FFLAGS)) { 1004 tok = au_to_arg32(1, "flags", ar->ar_arg_fflags); 1005 kau_write(rec, tok); 1006 } 1007 /* FALLTHROUGH */ 1008 1009 case AUE_FORK: 1010 case AUE_VFORK: 1011 if (ARG_IS_VALID(kar, ARG_PID)) { 1012 tok = au_to_arg32(0, "child PID", ar->ar_arg_pid); 1013 kau_write(rec, tok); 1014 } 1015 break; 1016 1017 case AUE_IOCTL: 1018 if (ARG_IS_VALID(kar, ARG_CMD)) { 1019 tok = au_to_arg32(2, "cmd", ar->ar_arg_cmd); 1020 kau_write(rec, tok); 1021 } 1022 if (ARG_IS_VALID(kar, ARG_VNODE1)) 1023 FD_VNODE1_TOKENS; 1024 else { 1025 if (ARG_IS_VALID(kar, ARG_SOCKINFO)) { 1026 tok = kau_to_socket(&ar->ar_arg_sockinfo); 1027 kau_write(rec, tok); 1028 } else { 1029 if (ARG_IS_VALID(kar, ARG_FD)) { 1030 tok = au_to_arg32(1, "fd", 1031 ar->ar_arg_fd); 1032 kau_write(rec, tok); 1033 } 1034 } 1035 } 1036 break; 1037 1038 case AUE_KILL: 1039 case AUE_KILLPG: 1040 if (ARG_IS_VALID(kar, ARG_SIGNUM)) { 1041 tok = au_to_arg32(2, "signal", ar->ar_arg_signum); 1042 kau_write(rec, tok); 1043 } 1044 PROCESS_PID_TOKENS(1); 1045 break; 1046 1047 case AUE_KTRACE: 1048 if (ARG_IS_VALID(kar, ARG_CMD)) { 1049 tok = au_to_arg32(2, "ops", ar->ar_arg_cmd); 1050 kau_write(rec, tok); 1051 } 1052 if (ARG_IS_VALID(kar, ARG_VALUE)) { 1053 tok = au_to_arg32(3, "trpoints", ar->ar_arg_value); 1054 kau_write(rec, tok); 1055 } 1056 PROCESS_PID_TOKENS(4); 1057 UPATH1_VNODE1_TOKENS; 1058 break; 1059 1060 case AUE_LINK: 1061 case AUE_LINKAT: 1062 case AUE_RENAME: 1063 case AUE_RENAMEAT: 1064 ATFD1_TOKENS(1); 1065 UPATH1_VNODE1_TOKENS; 1066 ATFD2_TOKENS(3); 1067 UPATH2_TOKENS; 1068 break; 1069 1070 case AUE_LOADSHFILE: 1071 ADDR_TOKEN(4, "base addr"); 1072 UPATH1_VNODE1_TOKENS; 1073 break; 1074 1075 case AUE_MKDIR: 1076 case AUE_MKDIRAT: 1077 case AUE_MKFIFO: 1078 case AUE_MKFIFOAT: 1079 ATFD1_TOKENS(1); 1080 if (ARG_IS_VALID(kar, ARG_MODE)) { 1081 tok = au_to_arg32(2, "mode", ar->ar_arg_mode); 1082 kau_write(rec, tok); 1083 } 1084 UPATH1_VNODE1_TOKENS; 1085 break; 1086 1087 case AUE_MKNOD: 1088 case AUE_MKNODAT: 1089 ATFD1_TOKENS(1); 1090 if (ARG_IS_VALID(kar, ARG_MODE)) { 1091 tok = au_to_arg32(2, "mode", ar->ar_arg_mode); 1092 kau_write(rec, tok); 1093 } 1094 if (ARG_IS_VALID(kar, ARG_DEV)) { 1095 tok = au_to_arg32(3, "dev", ar->ar_arg_dev); 1096 kau_write(rec, tok); 1097 } 1098 UPATH1_VNODE1_TOKENS; 1099 break; 1100 1101 case AUE_MMAP: 1102 case AUE_MUNMAP: 1103 case AUE_MPROTECT: 1104 case AUE_MLOCK: 1105 case AUE_MUNLOCK: 1106 case AUE_MINHERIT: 1107 ADDR_TOKEN(1, "addr"); 1108 if (ARG_IS_VALID(kar, ARG_LEN)) { 1109 tok = au_to_arg32(2, "len", ar->ar_arg_len); 1110 kau_write(rec, tok); 1111 } 1112 if (ar->ar_event == AUE_MMAP) 1113 FD_VNODE1_TOKENS; 1114 if (ar->ar_event == AUE_MPROTECT) { 1115 if (ARG_IS_VALID(kar, ARG_VALUE)) { 1116 tok = au_to_arg32(3, "protection", 1117 ar->ar_arg_value); 1118 kau_write(rec, tok); 1119 } 1120 } 1121 if (ar->ar_event == AUE_MINHERIT) { 1122 if (ARG_IS_VALID(kar, ARG_VALUE)) { 1123 tok = au_to_arg32(3, "inherit", 1124 ar->ar_arg_value); 1125 kau_write(rec, tok); 1126 } 1127 } 1128 break; 1129 1130 case AUE_MOUNT: 1131 case AUE_NMOUNT: 1132 /* XXX Need to handle NFS mounts */ 1133 if (ARG_IS_VALID(kar, ARG_FFLAGS)) { 1134 tok = au_to_arg32(3, "flags", ar->ar_arg_fflags); 1135 kau_write(rec, tok); 1136 } 1137 if (ARG_IS_VALID(kar, ARG_TEXT)) { 1138 tok = au_to_text(ar->ar_arg_text); 1139 kau_write(rec, tok); 1140 } 1141 /* FALLTHROUGH */ 1142 1143 case AUE_NFS_SVC: 1144 if (ARG_IS_VALID(kar, ARG_CMD)) { 1145 tok = au_to_arg32(1, "flags", ar->ar_arg_cmd); 1146 kau_write(rec, tok); 1147 } 1148 break; 1149 1150 case AUE_UMOUNT: 1151 if (ARG_IS_VALID(kar, ARG_VALUE)) { 1152 tok = au_to_arg32(2, "flags", ar->ar_arg_value); 1153 kau_write(rec, tok); 1154 } 1155 UPATH1_VNODE1_TOKENS; 1156 if (ARG_IS_VALID(kar, ARG_TEXT)) { 1157 tok = au_to_text(ar->ar_arg_text); 1158 kau_write(rec, tok); 1159 } 1160 break; 1161 1162 case AUE_MSGCTL: 1163 ar->ar_event = audit_msgctl_to_event(ar->ar_arg_svipc_cmd); 1164 /* Fall through */ 1165 1166 case AUE_MSGRCV: 1167 case AUE_MSGSND: 1168 tok = au_to_arg32(1, "msg ID", ar->ar_arg_svipc_id); 1169 kau_write(rec, tok); 1170 if (ar->ar_errno != EINVAL) { 1171 tok = au_to_ipc(AT_IPC_MSG, ar->ar_arg_svipc_id); 1172 kau_write(rec, tok); 1173 } 1174 break; 1175 1176 case AUE_MSGGET: 1177 if (ar->ar_errno == 0) { 1178 if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) { 1179 tok = au_to_ipc(AT_IPC_MSG, 1180 ar->ar_arg_svipc_id); 1181 kau_write(rec, tok); 1182 } 1183 } 1184 break; 1185 1186 case AUE_RESETSHFILE: 1187 ADDR_TOKEN(1, "base addr"); 1188 break; 1189 1190 case AUE_OPEN_RC: 1191 case AUE_OPEN_RTC: 1192 case AUE_OPEN_RWC: 1193 case AUE_OPEN_RWTC: 1194 case AUE_OPEN_WC: 1195 case AUE_OPEN_WTC: 1196 case AUE_CREAT: 1197 if (ARG_IS_VALID(kar, ARG_MODE)) { 1198 tok = au_to_arg32(3, "mode", ar->ar_arg_mode); 1199 kau_write(rec, tok); 1200 } 1201 /* FALLTHROUGH */ 1202 1203 case AUE_OPEN_R: 1204 case AUE_OPEN_RT: 1205 case AUE_OPEN_RW: 1206 case AUE_OPEN_RWT: 1207 case AUE_OPEN_W: 1208 case AUE_OPEN_WT: 1209 if (ARG_IS_VALID(kar, ARG_FFLAGS)) { 1210 tok = au_to_arg32(2, "flags", ar->ar_arg_fflags); 1211 kau_write(rec, tok); 1212 } 1213 UPATH1_VNODE1_TOKENS; 1214 break; 1215 1216 case AUE_OPENAT_RC: 1217 case AUE_OPENAT_RTC: 1218 case AUE_OPENAT_RWC: 1219 case AUE_OPENAT_RWTC: 1220 case AUE_OPENAT_WC: 1221 case AUE_OPENAT_WTC: 1222 if (ARG_IS_VALID(kar, ARG_MODE)) { 1223 tok = au_to_arg32(3, "mode", ar->ar_arg_mode); 1224 kau_write(rec, tok); 1225 } 1226 /* FALLTHROUGH */ 1227 1228 case AUE_OPENAT_R: 1229 case AUE_OPENAT_RT: 1230 case AUE_OPENAT_RW: 1231 case AUE_OPENAT_RWT: 1232 case AUE_OPENAT_W: 1233 case AUE_OPENAT_WT: 1234 if (ARG_IS_VALID(kar, ARG_FFLAGS)) { 1235 tok = au_to_arg32(2, "flags", ar->ar_arg_fflags); 1236 kau_write(rec, tok); 1237 } 1238 ATFD1_TOKENS(1); 1239 UPATH1_VNODE1_TOKENS; 1240 break; 1241 1242 case AUE_PTRACE: 1243 if (ARG_IS_VALID(kar, ARG_CMD)) { 1244 tok = au_to_arg32(1, "request", ar->ar_arg_cmd); 1245 kau_write(rec, tok); 1246 } 1247 if (ARG_IS_VALID(kar, ARG_VALUE)) { 1248 tok = au_to_arg32(4, "data", ar->ar_arg_value); 1249 kau_write(rec, tok); 1250 } 1251 PROCESS_PID_TOKENS(2); 1252 break; 1253 1254 case AUE_QUOTACTL: 1255 if (ARG_IS_VALID(kar, ARG_CMD)) { 1256 tok = au_to_arg32(2, "command", ar->ar_arg_cmd); 1257 kau_write(rec, tok); 1258 } 1259 if (ARG_IS_VALID(kar, ARG_UID)) { 1260 tok = au_to_arg32(3, "uid", ar->ar_arg_uid); 1261 kau_write(rec, tok); 1262 } 1263 if (ARG_IS_VALID(kar, ARG_GID)) { 1264 tok = au_to_arg32(3, "gid", ar->ar_arg_gid); 1265 kau_write(rec, tok); 1266 } 1267 UPATH1_VNODE1_TOKENS; 1268 break; 1269 1270 case AUE_REBOOT: 1271 if (ARG_IS_VALID(kar, ARG_CMD)) { 1272 tok = au_to_arg32(1, "howto", ar->ar_arg_cmd); 1273 kau_write(rec, tok); 1274 } 1275 break; 1276 1277 case AUE_SEMCTL: 1278 ar->ar_event = audit_semctl_to_event(ar->ar_arg_svipc_cmd); 1279 /* Fall through */ 1280 1281 case AUE_SEMOP: 1282 if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) { 1283 tok = au_to_arg32(1, "sem ID", ar->ar_arg_svipc_id); 1284 kau_write(rec, tok); 1285 if (ar->ar_errno != EINVAL) { 1286 tok = au_to_ipc(AT_IPC_SEM, 1287 ar->ar_arg_svipc_id); 1288 kau_write(rec, tok); 1289 } 1290 } 1291 break; 1292 1293 case AUE_SEMGET: 1294 if (ar->ar_errno == 0) { 1295 if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) { 1296 tok = au_to_ipc(AT_IPC_SEM, 1297 ar->ar_arg_svipc_id); 1298 kau_write(rec, tok); 1299 } 1300 } 1301 break; 1302 1303 case AUE_SETEGID: 1304 if (ARG_IS_VALID(kar, ARG_EGID)) { 1305 tok = au_to_arg32(1, "egid", ar->ar_arg_egid); 1306 kau_write(rec, tok); 1307 } 1308 break; 1309 1310 case AUE_SETEUID: 1311 if (ARG_IS_VALID(kar, ARG_EUID)) { 1312 tok = au_to_arg32(1, "euid", ar->ar_arg_euid); 1313 kau_write(rec, tok); 1314 } 1315 break; 1316 1317 case AUE_SETREGID: 1318 if (ARG_IS_VALID(kar, ARG_RGID)) { 1319 tok = au_to_arg32(1, "rgid", ar->ar_arg_rgid); 1320 kau_write(rec, tok); 1321 } 1322 if (ARG_IS_VALID(kar, ARG_EGID)) { 1323 tok = au_to_arg32(2, "egid", ar->ar_arg_egid); 1324 kau_write(rec, tok); 1325 } 1326 break; 1327 1328 case AUE_SETREUID: 1329 if (ARG_IS_VALID(kar, ARG_RUID)) { 1330 tok = au_to_arg32(1, "ruid", ar->ar_arg_ruid); 1331 kau_write(rec, tok); 1332 } 1333 if (ARG_IS_VALID(kar, ARG_EUID)) { 1334 tok = au_to_arg32(2, "euid", ar->ar_arg_euid); 1335 kau_write(rec, tok); 1336 } 1337 break; 1338 1339 case AUE_SETRESGID: 1340 if (ARG_IS_VALID(kar, ARG_RGID)) { 1341 tok = au_to_arg32(1, "rgid", ar->ar_arg_rgid); 1342 kau_write(rec, tok); 1343 } 1344 if (ARG_IS_VALID(kar, ARG_EGID)) { 1345 tok = au_to_arg32(2, "egid", ar->ar_arg_egid); 1346 kau_write(rec, tok); 1347 } 1348 if (ARG_IS_VALID(kar, ARG_SGID)) { 1349 tok = au_to_arg32(3, "sgid", ar->ar_arg_sgid); 1350 kau_write(rec, tok); 1351 } 1352 break; 1353 1354 case AUE_SETRESUID: 1355 if (ARG_IS_VALID(kar, ARG_RUID)) { 1356 tok = au_to_arg32(1, "ruid", ar->ar_arg_ruid); 1357 kau_write(rec, tok); 1358 } 1359 if (ARG_IS_VALID(kar, ARG_EUID)) { 1360 tok = au_to_arg32(2, "euid", ar->ar_arg_euid); 1361 kau_write(rec, tok); 1362 } 1363 if (ARG_IS_VALID(kar, ARG_SUID)) { 1364 tok = au_to_arg32(3, "suid", ar->ar_arg_suid); 1365 kau_write(rec, tok); 1366 } 1367 break; 1368 1369 case AUE_SETGID: 1370 if (ARG_IS_VALID(kar, ARG_GID)) { 1371 tok = au_to_arg32(1, "gid", ar->ar_arg_gid); 1372 kau_write(rec, tok); 1373 } 1374 break; 1375 1376 case AUE_SETUID: 1377 if (ARG_IS_VALID(kar, ARG_UID)) { 1378 tok = au_to_arg32(1, "uid", ar->ar_arg_uid); 1379 kau_write(rec, tok); 1380 } 1381 break; 1382 1383 case AUE_SETGROUPS: 1384 if (ARG_IS_VALID(kar, ARG_GROUPSET)) { 1385 for(ctr = 0; ctr < ar->ar_arg_groups.gidset_size; ctr++) 1386 { 1387 tok = au_to_arg32(1, "setgroups", 1388 ar->ar_arg_groups.gidset[ctr]); 1389 kau_write(rec, tok); 1390 } 1391 } 1392 break; 1393 1394 case AUE_SETLOGIN: 1395 if (ARG_IS_VALID(kar, ARG_TEXT)) { 1396 tok = au_to_text(ar->ar_arg_text); 1397 kau_write(rec, tok); 1398 } 1399 break; 1400 1401 case AUE_SETPRIORITY: 1402 if (ARG_IS_VALID(kar, ARG_CMD)) { 1403 tok = au_to_arg32(1, "which", ar->ar_arg_cmd); 1404 kau_write(rec, tok); 1405 } 1406 if (ARG_IS_VALID(kar, ARG_UID)) { 1407 tok = au_to_arg32(2, "who", ar->ar_arg_uid); 1408 kau_write(rec, tok); 1409 } 1410 PROCESS_PID_TOKENS(2); 1411 if (ARG_IS_VALID(kar, ARG_VALUE)) { 1412 tok = au_to_arg32(3, "priority", ar->ar_arg_value); 1413 kau_write(rec, tok); 1414 } 1415 break; 1416 1417 case AUE_SETPRIVEXEC: 1418 if (ARG_IS_VALID(kar, ARG_VALUE)) { 1419 tok = au_to_arg32(1, "flag", ar->ar_arg_value); 1420 kau_write(rec, tok); 1421 } 1422 break; 1423 1424 /* AUE_SHMAT, AUE_SHMCTL, AUE_SHMDT and AUE_SHMGET are SysV IPC */ 1425 case AUE_SHMAT: 1426 if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) { 1427 tok = au_to_arg32(1, "shmid", ar->ar_arg_svipc_id); 1428 kau_write(rec, tok); 1429 /* XXXAUDIT: Does having the ipc token make sense? */ 1430 tok = au_to_ipc(AT_IPC_SHM, ar->ar_arg_svipc_id); 1431 kau_write(rec, tok); 1432 } 1433 if (ARG_IS_VALID(kar, ARG_SVIPC_ADDR)) { 1434 tok = au_to_arg32(2, "shmaddr", 1435 (int)(uintptr_t)ar->ar_arg_svipc_addr); 1436 kau_write(rec, tok); 1437 } 1438 if (ARG_IS_VALID(kar, ARG_SVIPC_PERM)) { 1439 tok = au_to_ipc_perm(&ar->ar_arg_svipc_perm); 1440 kau_write(rec, tok); 1441 } 1442 break; 1443 1444 case AUE_SHMCTL: 1445 if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) { 1446 tok = au_to_arg32(1, "shmid", ar->ar_arg_svipc_id); 1447 kau_write(rec, tok); 1448 /* XXXAUDIT: Does having the ipc token make sense? */ 1449 tok = au_to_ipc(AT_IPC_SHM, ar->ar_arg_svipc_id); 1450 kau_write(rec, tok); 1451 } 1452 switch (ar->ar_arg_svipc_cmd) { 1453 case IPC_STAT: 1454 ar->ar_event = AUE_SHMCTL_STAT; 1455 break; 1456 case IPC_RMID: 1457 ar->ar_event = AUE_SHMCTL_RMID; 1458 break; 1459 case IPC_SET: 1460 ar->ar_event = AUE_SHMCTL_SET; 1461 if (ARG_IS_VALID(kar, ARG_SVIPC_PERM)) { 1462 tok = au_to_ipc_perm(&ar->ar_arg_svipc_perm); 1463 kau_write(rec, tok); 1464 } 1465 break; 1466 default: 1467 break; /* We will audit a bad command */ 1468 } 1469 break; 1470 1471 case AUE_SHMDT: 1472 if (ARG_IS_VALID(kar, ARG_SVIPC_ADDR)) { 1473 tok = au_to_arg32(1, "shmaddr", 1474 (int)(uintptr_t)ar->ar_arg_svipc_addr); 1475 kau_write(rec, tok); 1476 } 1477 break; 1478 1479 case AUE_SHMGET: 1480 /* This is unusual; the return value is in an argument token */ 1481 if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) { 1482 tok = au_to_arg32(0, "shmid", ar->ar_arg_svipc_id); 1483 kau_write(rec, tok); 1484 tok = au_to_ipc(AT_IPC_SHM, ar->ar_arg_svipc_id); 1485 kau_write(rec, tok); 1486 } 1487 if (ARG_IS_VALID(kar, ARG_SVIPC_PERM)) { 1488 tok = au_to_ipc_perm(&ar->ar_arg_svipc_perm); 1489 kau_write(rec, tok); 1490 } 1491 break; 1492 1493 /* AUE_SHMOPEN, AUE_SHMUNLINK, AUE_SEMOPEN, AUE_SEMCLOSE 1494 * and AUE_SEMUNLINK are Posix IPC */ 1495 case AUE_SHMOPEN: 1496 if (ARG_IS_VALID(kar, ARG_SVIPC_ADDR)) { 1497 tok = au_to_arg32(2, "flags", ar->ar_arg_fflags); 1498 kau_write(rec, tok); 1499 } 1500 if (ARG_IS_VALID(kar, ARG_MODE)) { 1501 tok = au_to_arg32(3, "mode", ar->ar_arg_mode); 1502 kau_write(rec, tok); 1503 } 1504 /* FALLTHROUGH */ 1505 1506 case AUE_SHMUNLINK: 1507 if (ARG_IS_VALID(kar, ARG_TEXT)) { 1508 tok = au_to_text(ar->ar_arg_text); 1509 kau_write(rec, tok); 1510 } 1511 if (ARG_IS_VALID(kar, ARG_POSIX_IPC_PERM)) { 1512 struct ipc_perm perm; 1513 1514 perm.uid = ar->ar_arg_pipc_perm.pipc_uid; 1515 perm.gid = ar->ar_arg_pipc_perm.pipc_gid; 1516 perm.cuid = ar->ar_arg_pipc_perm.pipc_uid; 1517 perm.cgid = ar->ar_arg_pipc_perm.pipc_gid; 1518 perm.mode = ar->ar_arg_pipc_perm.pipc_mode; 1519 perm.seq = 0; 1520 perm.key = 0; 1521 tok = au_to_ipc_perm(&perm); 1522 kau_write(rec, tok); 1523 } 1524 break; 1525 1526 case AUE_SEMOPEN: 1527 if (ARG_IS_VALID(kar, ARG_FFLAGS)) { 1528 tok = au_to_arg32(2, "flags", ar->ar_arg_fflags); 1529 kau_write(rec, tok); 1530 } 1531 if (ARG_IS_VALID(kar, ARG_MODE)) { 1532 tok = au_to_arg32(3, "mode", ar->ar_arg_mode); 1533 kau_write(rec, tok); 1534 } 1535 if (ARG_IS_VALID(kar, ARG_VALUE)) { 1536 tok = au_to_arg32(4, "value", ar->ar_arg_value); 1537 kau_write(rec, tok); 1538 } 1539 /* FALLTHROUGH */ 1540 1541 case AUE_SEMUNLINK: 1542 if (ARG_IS_VALID(kar, ARG_TEXT)) { 1543 tok = au_to_text(ar->ar_arg_text); 1544 kau_write(rec, tok); 1545 } 1546 if (ARG_IS_VALID(kar, ARG_POSIX_IPC_PERM)) { 1547 struct ipc_perm perm; 1548 1549 perm.uid = ar->ar_arg_pipc_perm.pipc_uid; 1550 perm.gid = ar->ar_arg_pipc_perm.pipc_gid; 1551 perm.cuid = ar->ar_arg_pipc_perm.pipc_uid; 1552 perm.cgid = ar->ar_arg_pipc_perm.pipc_gid; 1553 perm.mode = ar->ar_arg_pipc_perm.pipc_mode; 1554 perm.seq = 0; 1555 perm.key = 0; 1556 tok = au_to_ipc_perm(&perm); 1557 kau_write(rec, tok); 1558 } 1559 break; 1560 1561 case AUE_SEMCLOSE: 1562 if (ARG_IS_VALID(kar, ARG_FD)) { 1563 tok = au_to_arg32(1, "sem", ar->ar_arg_fd); 1564 kau_write(rec, tok); 1565 } 1566 break; 1567 1568 case AUE_SYMLINK: 1569 case AUE_SYMLINKAT: 1570 if (ARG_IS_VALID(kar, ARG_TEXT)) { 1571 tok = au_to_text(ar->ar_arg_text); 1572 kau_write(rec, tok); 1573 } 1574 ATFD1_TOKENS(1); 1575 UPATH1_VNODE1_TOKENS; 1576 break; 1577 1578 case AUE_SYSCTL: 1579 case AUE_SYSCTL_NONADMIN: 1580 if (ARG_IS_VALID(kar, ARG_CTLNAME | ARG_LEN)) { 1581 for (ctr = 0; ctr < ar->ar_arg_len; ctr++) { 1582 tok = au_to_arg32(1, "name", 1583 ar->ar_arg_ctlname[ctr]); 1584 kau_write(rec, tok); 1585 } 1586 } 1587 if (ARG_IS_VALID(kar, ARG_VALUE)) { 1588 tok = au_to_arg32(5, "newval", ar->ar_arg_value); 1589 kau_write(rec, tok); 1590 } 1591 if (ARG_IS_VALID(kar, ARG_TEXT)) { 1592 tok = au_to_text(ar->ar_arg_text); 1593 kau_write(rec, tok); 1594 } 1595 break; 1596 1597 case AUE_UMASK: 1598 if (ARG_IS_VALID(kar, ARG_MASK)) { 1599 tok = au_to_arg32(1, "new mask", ar->ar_arg_mask); 1600 kau_write(rec, tok); 1601 } 1602 tok = au_to_arg32(0, "prev mask", ar->ar_retval); 1603 kau_write(rec, tok); 1604 break; 1605 1606 case AUE_WAIT4: 1607 PROCESS_PID_TOKENS(1); 1608 if (ARG_IS_VALID(kar, ARG_VALUE)) { 1609 tok = au_to_arg32(3, "options", ar->ar_arg_value); 1610 kau_write(rec, tok); 1611 } 1612 break; 1613 1614 case AUE_CAP_NEW: 1615 case AUE_CAP_RIGHTS_LIMIT: 1616 /* 1617 * XXXRW/XXXJA: Would be nice to audit socket/etc information. 1618 */ 1619 FD_VNODE1_TOKENS; 1620 if (ARG_IS_VALID(kar, ARG_RIGHTS)) { 1621 tok = au_to_arg64(2, "rights", ar->ar_arg_rights); 1622 kau_write(rec, tok); 1623 } 1624 break; 1625 1626 case AUE_CAP_FCNTLS_GET: 1627 case AUE_CAP_IOCTLS_GET: 1628 case AUE_CAP_IOCTLS_LIMIT: 1629 case AUE_CAP_RIGHTS_GET: 1630 if (ARG_IS_VALID(kar, ARG_FD)) { 1631 tok = au_to_arg32(1, "fd", ar->ar_arg_fd); 1632 kau_write(rec, tok); 1633 } 1634 break; 1635 1636 case AUE_CAP_FCNTLS_LIMIT: 1637 FD_VNODE1_TOKENS; 1638 if (ARG_IS_VALID(kar, ARG_FCNTL_RIGHTS)) { 1639 tok = au_to_arg32(2, "fcntlrights", 1640 ar->ar_arg_fcntl_rights); 1641 kau_write(rec, tok); 1642 } 1643 break; 1644 1645 case AUE_CAP_ENTER: 1646 case AUE_CAP_GETMODE: 1647 break; 1648 1649 case AUE_NULL: 1650 default: 1651 printf("BSM conversion requested for unknown event %d\n", 1652 ar->ar_event); 1653 1654 /* 1655 * Write the subject token so it is properly freed here. 1656 */ 1657 if (jail_tok != NULL) 1658 kau_write(rec, jail_tok); 1659 kau_write(rec, subj_tok); 1660 kau_free(rec); 1661 return (BSM_NOAUDIT); 1662 } 1663 1664 if (jail_tok != NULL) 1665 kau_write(rec, jail_tok); 1666 kau_write(rec, subj_tok); 1667 tok = au_to_return32(au_errno_to_bsm(ar->ar_errno), ar->ar_retval); 1668 kau_write(rec, tok); /* Every record gets a return token */ 1669 1670 kau_close(rec, &ar->ar_endtime, ar->ar_event); 1671 1672 *pau = rec; 1673 return (BSM_SUCCESS); 1674 } 1675 1676 /* 1677 * Verify that a record is a valid BSM record. This verification is simple 1678 * now, but may be expanded on sometime in the future. Return 1 if the 1679 * record is good, 0 otherwise. 1680 */ 1681 int 1682 bsm_rec_verify(void *rec) 1683 { 1684 char c = *(char *)rec; 1685 1686 /* 1687 * Check the token ID of the first token; it has to be a header 1688 * token. 1689 * 1690 * XXXAUDIT There needs to be a token structure to map a token. 1691 * XXXAUDIT 'Shouldn't be simply looking at the first char. 1692 */ 1693 if ((c != AUT_HEADER32) && (c != AUT_HEADER32_EX) && 1694 (c != AUT_HEADER64) && (c != AUT_HEADER64_EX)) 1695 return (0); 1696 return (1); 1697 } 1698