xref: /illumos-gate/usr/src/cmd/auditreduce/auditrt.h (revision b5c366f4)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  *
25  * Copyright 2018 Nexenta Systems, Inc.  All rights reserved.
26  */
27 
28 #ifndef _AUDITRT_H
29 #define	_AUDITRT_H
30 
31 #ifdef	__cplusplus
32 extern "C" {
33 #endif
34 
35 /*
36  * Auditreduce data structures.
37  */
38 
39 /*
40  * File Control Block
41  * Controls a single file.
42  * These are held by the pcb's in audit_pcbs[] in a linked list.
43  * There is one fcb for each file controlled by the pcb,
44  * and all of the files in a list have the same suffix in their names.
45  */
46 struct audit_fcb {
47 	struct audit_fcb *fcb_next;	/* ptr to next fcb in list */
48 	int	fcb_flags;	/* flags - see below */
49 	time_t	fcb_start;	/* start time from filename */
50 	time_t	fcb_end;	/* end time from filename */
51 	char	*fcb_suffix;	/* ptr to suffix in fcb_file */
52 	char	*fcb_name;	/* ptr to name in fcb_file */
53 	char	fcb_file[1];	/* full path and name string */
54 };
55 
56 typedef struct audit_fcb audit_fcb_t;
57 
58 /*
59  * Flags for fcb_flags.
60  */
61 #define	FF_NOTTERM	0x01	/* file is "not_terminated" */
62 #define	FF_DELETE	0x02	/* we may delete this file if requested */
63 
64 /*
65  * Process Control Block
66  * A pcb comes in two types:
67  * It controls either:
68  *
69  * 1.	A single group of pcbs (processes that are lower on the process tree).
70  *	These are the pcb's that the process tree is built from.
71  *	These are allocated as needed while the process tree is	being built.
72  *
73  * 2.	A single group of files (fcbs).
74  *	All of the files in one pcb have the same suffix in their filename.
75  *	They are controlled by the leaf nodes of the process tree.
76  *	They are found in audit_pcbs[].
77  *	They are initially setup by process_fileopt() when the files to be
78  *	processes are gathered together. Then they are parsed out to
79  *	the leaf nodes by mfork().
80  *	A particular leaf node's range of audit_pcbs[] is determined
81  *	in the call to mfork() by the lo and hi paramters.
82  */
83 struct audit_pcb {
84 	struct audit_pcb *pcb_below;	/* ptr to group of pcb's */
85 	struct audit_pcb *pcb_next;	/* ptr to next - for list in mproc() */
86 	int	pcb_procno;	/* subprocess # */
87 	int	pcb_nrecs;	/* how many records read (current pcb/file) */
88 	int	pcb_nprecs;	/* how many records put (current pcb/file) */
89 	int	pcb_flags;	/* flags - see below */
90 	int	pcb_count;	/* count of active pcb's */
91 	int	pcb_lo;		/* low index for pcb's */
92 	int	pcb_hi;		/* hi index for pcb's */
93 	int	pcb_size;	/* size of current record buffer */
94 	time_t	pcb_time;	/* time of current record */
95 	time_t	pcb_otime;	/* time of previous record */
96 	char	*pcb_rec;	/* ptr to current record buffer */
97 	char	*pcb_suffix;	/* ptr to suffix name (string) */
98 	audit_fcb_t *pcb_first;	/* ptr to first fcb_ */
99 	audit_fcb_t *pcb_last;	/* ptr to last fcb_ */
100 	audit_fcb_t *pcb_cur;	/* ptr to current fcb_ */
101 	audit_fcb_t *pcb_dfirst; /* ptr to first fcb_ for deleting */
102 	audit_fcb_t *pcb_dlast;	/* ptr to last fcb_ for deleting */
103 	FILE	 *pcb_fpr;	/* read stream */
104 	FILE	 *pcb_fpw;	/* write stream */
105 };
106 
107 typedef struct audit_pcb audit_pcb_t;
108 
109 /*
110  * Flags for pcb_flags
111  */
112 #define	PF_ROOT		0x01	/* current pcb is the root of process tree */
113 #define	PF_LEAF		0x02	/* current pcb is a leaf of process tree */
114 #define	PF_USEFILE	0x04	/* current pcb uses files as input, not pipes */
115 
116 /*
117  * Message selection options
118  */
119 #define	M_AFTER		0x0001	/* 'a' after a time */
120 #define	M_BEFORE	0x0002	/* 'b' before a time */
121 #define	M_CLASS		0x0004	/* 'c' event class */
122 #define	M_GROUPE 	0x0008	/* 'f' effective group-id */
123 #define	M_GROUPR 	0x0010	/* 'g' real group-id */
124 #define	M_OBJECT	0x0020	/* 'o' object */
125 #define	M_SUBJECT	0x0040	/* 'j' subject */
126 #define	M_TYPE		0x0080	/* 'm' event type */
127 #define	M_USERA		0x0100	/* 'u' audit user */
128 #define	M_USERE		0x0200	/* 'e' effective user */
129 #define	M_USERR		0x0400	/* 'r' real user */
130 #define	M_LABEL		0x0800	/* 'l' mandatory label range */
131 #define	M_ZONENAME	0x1000	/* 'z' zone name */
132 #define	M_SID		0x2000	/* 's' session ID */
133 #define	M_SORF		0x4000	/* success or failure of event */
134 #define	M_TID		0x8000	/* 't' terminal ID */
135 /*
136  * object types
137  */
138 
139 /* XXX Why is this a bit map?  There can be only one M_OBJECT. */
140 
141 #define	OBJ_LP		0x00001  /* 'o' lp object */
142 #define	OBJ_MSG		0x00002  /* 'o' msgq object */
143 #define	OBJ_PATH	0x00004  /* 'o' file system object */
144 #define	OBJ_PROC	0x00008  /* 'o' process object */
145 #define	OBJ_SEM		0x00010  /* 'o' semaphore object */
146 #define	OBJ_SHM		0x00020  /* 'o' shared memory object */
147 #define	OBJ_SOCK	0x00040  /* 'o' socket object */
148 #define	OBJ_FGROUP	0x00080  /* 'o' file group */
149 #define	OBJ_FOWNER	0x00100  /* 'o' file owner */
150 #define	OBJ_MSGGROUP	0x00200	 /* 'o' msgq [c]group */
151 #define	OBJ_MSGOWNER	0x00400  /* 'o' msgq [c]owner */
152 #define	OBJ_PGROUP	0x00800  /* 'o' process [e]group */
153 #define	OBJ_POWNER	0x01000  /* 'o' process [e]owner */
154 #define	OBJ_SEMGROUP	0x02000  /* 'o' semaphore [c]group */
155 #define	OBJ_SEMOWNER	0x04000  /* 'o' semaphore [c]owner */
156 #define	OBJ_SHMGROUP	0x08000  /* 'o' shared memory [c]group */
157 #define	OBJ_SHMOWNER	0x10000  /* 'o' shared memory [c]owner */
158 #define	OBJ_FMRI	0x20000  /* 'o' fmri object */
159 #define	OBJ_USER	0x40000  /* 'o' user object */
160 #define	OBJ_WSID	0x80000  /* 'o' windows sid object */
161 
162 #define	SOCKFLG_MACHINE 0	/* search socket token by machine name */
163 #define	SOCKFLG_PORT    1	/* search socket token by port number */
164 
165 /*
166  * Global variables
167  */
168 extern unsigned short m_type;	/* 'm' message type */
169 extern gid_t	m_groupr;	/* 'g' real group-id */
170 extern gid_t	m_groupe;	/* 'f' effective group-id */
171 extern uid_t	m_usera;	/* 'u' audit user */
172 extern uid_t	m_userr;	/* 'r' real user */
173 extern uid_t	m_usere;	/* 'f' effective user */
174 extern au_asid_t m_sid;		/* 's' session-id */
175 extern time_t	m_after;	/* 'a' after a time */
176 extern time_t	m_before;	/* 'b' before a time */
177 extern audit_state_t mask;	/* used with m_class */
178 extern char	*zonename;	/* 'z' zonename */
179 
180 extern m_range_t *m_label;	/* 'l' mandatory label range */
181 extern int	flags;
182 extern int	checkflags;
183 extern int	socket_flag;
184 extern int	ip_type;
185 extern uchar_t	ip_ipv6[16];	/* ip ipv6 object identifier */
186 extern int	obj_flag;	/* 'o' object type */
187 extern int	obj_id;		/* object identifier */
188 extern gid_t	obj_group;	/* object group */
189 extern uid_t	obj_owner;	/* object owner */
190 extern int	subj_id; 	/* subject identifier */
191 extern char	ipc_type;	/* 'o' object type - tell what type of IPC */
192 extern scf_pattern_t fmri;	/* 'o' fmri value */
193 extern uid_t	obj_user;	/* 'o' user value */
194 
195 /*
196  * File selection options
197  */
198 extern char	*f_machine;	/* 'M' machine (suffix) type */
199 extern char	*f_root;	/* 'R' audit root */
200 extern char	*f_server;	/* 'S' server */
201 extern char	*f_outfile;	/* 'W' output file */
202 extern int	f_all;		/* 'A' all records from a file */
203 extern int	f_complete;	/* 'C' only completed files */
204 extern int	f_delete;	/* 'D' delete when done */
205 extern int	f_quiet;	/* 'Q' sshhhh! */
206 extern int	f_verbose;	/* 'V' verbose */
207 extern int	f_stdin;	/* '-' read from stdin */
208 extern int	f_cmdline;	/*	files specified on the command line */
209 extern int	new_mode;	/* 'N' new object selection mode */
210 
211 /*
212  * Error reporting
213  * Error_str is set whenever an error occurs to point to a string describing
214  * the error. When the error message is printed error_str is also
215  * printed to describe exactly what went wrong.
216  * Errbuf is used to build messages with variables in them.
217  */
218 extern char	*error_str;	/* current error message */
219 extern char	errbuf[];	/* buffer for building error message */
220 extern char	*ar;		/* => "auditreduce:" */
221 
222 /*
223  * Control blocks
224  * Audit_pcbs[] is an array of pcbs that control files directly.
225  * In the program's initialization phase it will gather all of the input
226  * files it needs to process. Each file will have one fcb allocated for it,
227  * and each fcb will belong to one pcb from audit_pcbs[]. All of the files
228  * in a single pcb will have the same suffix in their filenames. If the
229  * number of active pcbs in audit_pcbs[] is greater that the number of open
230  * files a single process can have then the program will need to fork
231  * subprocesses to handle all of the files.
232  */
233 extern audit_pcb_t *audit_pcbs;	/* file-holding pcb's */
234 extern int	pcbsize;	/* current size of audit_pcbs[] */
235 extern int	pcbnum;		/* total # of active pcbs in audit_pcbs[] */
236 
237 /*
238  * Time values
239  */
240 extern time_t f_start;		/* time of start rec for outfile */
241 extern time_t f_end;		/* time of end rec for outfile */
242 extern time_t time_now;		/* time program began */
243 
244 /*
245  * Counting vars
246  */
247 extern int	filenum;	/* number of files total */
248 
249 /*
250  * Global variable, class of current record being processed.
251  */
252 extern int	global_class;
253 
254 #ifdef	__cplusplus
255 }
256 #endif
257 
258 #endif /* _AUDITRT_H */
259