17c478bd9Sstevel@tonic-gate /* 27c478bd9Sstevel@tonic-gate * CDDL HEADER START 37c478bd9Sstevel@tonic-gate * 47c478bd9Sstevel@tonic-gate * The contents of this file are subject to the terms of the 545916cd2Sjpk * Common Development and Distribution License (the "License"). 645916cd2Sjpk * You may not use this file except in compliance with the License. 77c478bd9Sstevel@tonic-gate * 87c478bd9Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 97c478bd9Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing. 107c478bd9Sstevel@tonic-gate * See the License for the specific language governing permissions 117c478bd9Sstevel@tonic-gate * and limitations under the License. 127c478bd9Sstevel@tonic-gate * 137c478bd9Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each 147c478bd9Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 157c478bd9Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the 167c478bd9Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying 177c478bd9Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner] 187c478bd9Sstevel@tonic-gate * 197c478bd9Sstevel@tonic-gate * CDDL HEADER END 207c478bd9Sstevel@tonic-gate */ 217c478bd9Sstevel@tonic-gate /* 22*d0fa49b7STony Nguyen * Copyright 2008 Sun Microsystems, Inc. All rights reserved. 237c478bd9Sstevel@tonic-gate * Use is subject to license terms. 247c478bd9Sstevel@tonic-gate */ 257c478bd9Sstevel@tonic-gate 267c478bd9Sstevel@tonic-gate 277c478bd9Sstevel@tonic-gate /* 287c478bd9Sstevel@tonic-gate * auditconfig - set and display audit parameters 297c478bd9Sstevel@tonic-gate */ 307c478bd9Sstevel@tonic-gate 317c478bd9Sstevel@tonic-gate #include <locale.h> 327c478bd9Sstevel@tonic-gate #include <sys/types.h> 337c478bd9Sstevel@tonic-gate #include <ctype.h> 347c478bd9Sstevel@tonic-gate #include <stdlib.h> 357c478bd9Sstevel@tonic-gate #include <stdarg.h> 367c478bd9Sstevel@tonic-gate #include <unistd.h> 377c478bd9Sstevel@tonic-gate #include <errno.h> 387c478bd9Sstevel@tonic-gate #include <sys/param.h> 397c478bd9Sstevel@tonic-gate #include <stdio.h> 407c478bd9Sstevel@tonic-gate #include <string.h> 417c478bd9Sstevel@tonic-gate #include <strings.h> 427c478bd9Sstevel@tonic-gate #include <nlist.h> 437c478bd9Sstevel@tonic-gate #include <fcntl.h> 447c478bd9Sstevel@tonic-gate #include <sys/socket.h> 457c478bd9Sstevel@tonic-gate #include <netdb.h> 467c478bd9Sstevel@tonic-gate #include <netinet/in.h> 477c478bd9Sstevel@tonic-gate #include <arpa/inet.h> 487c478bd9Sstevel@tonic-gate #include <sys/mkdev.h> 497c478bd9Sstevel@tonic-gate #include <sys/param.h> 507c478bd9Sstevel@tonic-gate #include <pwd.h> 517c478bd9Sstevel@tonic-gate #include <libintl.h> 527c478bd9Sstevel@tonic-gate #include <zone.h> 537c478bd9Sstevel@tonic-gate 549e3700dfSgww #include <tsol/label.h> 557c478bd9Sstevel@tonic-gate #include <bsm/audit.h> 567c478bd9Sstevel@tonic-gate #include <bsm/audit_record.h> 577c478bd9Sstevel@tonic-gate #include <bsm/libbsm.h> 587c478bd9Sstevel@tonic-gate 597c478bd9Sstevel@tonic-gate #if !defined(TEXT_DOMAIN) 607c478bd9Sstevel@tonic-gate #define TEXT_DOMAIN "SUNW_OST_OSCMD" 617c478bd9Sstevel@tonic-gate #endif 627c478bd9Sstevel@tonic-gate 639e3700dfSgww enum commands { 649e3700dfSgww AC_ARG_AUDIT, 659e3700dfSgww AC_ARG_ACONF, 669e3700dfSgww AC_ARG_CHKCONF, 679e3700dfSgww AC_ARG_CHKACONF, 689e3700dfSgww AC_ARG_CONF, 699e3700dfSgww AC_ARG_GETASID, 709e3700dfSgww AC_ARG_GETAUDIT, 719e3700dfSgww AC_ARG_GETAUID, 729e3700dfSgww AC_ARG_GETCAR, 739e3700dfSgww AC_ARG_GETCLASS, 749e3700dfSgww AC_ARG_GETCOND, 759e3700dfSgww AC_ARG_GETCWD, 769e3700dfSgww AC_ARG_GETESTATE, 779e3700dfSgww AC_ARG_GETFSIZE, 789e3700dfSgww AC_ARG_GETKAUDIT, 799e3700dfSgww AC_ARG_GETKMASK, 809e3700dfSgww AC_ARG_GETPINFO, 819e3700dfSgww AC_ARG_GETPOLICY, 829e3700dfSgww AC_ARG_GETQBUFSZ, 839e3700dfSgww AC_ARG_GETQCTRL, 849e3700dfSgww AC_ARG_GETQDELAY, 859e3700dfSgww AC_ARG_GETQHIWATER, 869e3700dfSgww AC_ARG_GETQLOWATER, 879e3700dfSgww AC_ARG_GETSTAT, 889e3700dfSgww AC_ARG_GETTERMID, 899e3700dfSgww AC_ARG_LSEVENT, 909e3700dfSgww AC_ARG_LSPOLICY, 919e3700dfSgww AC_ARG_SETASID, 929e3700dfSgww AC_ARG_SETAUDIT, 939e3700dfSgww AC_ARG_SETAUID, 949e3700dfSgww AC_ARG_SETCLASS, 959e3700dfSgww AC_ARG_SETFSIZE, 969e3700dfSgww AC_ARG_SETKAUDIT, 979e3700dfSgww AC_ARG_SETKMASK, 989e3700dfSgww AC_ARG_SETPMASK, 999e3700dfSgww AC_ARG_SETPOLICY, 1009e3700dfSgww AC_ARG_SETSMASK, 1019e3700dfSgww AC_ARG_SETSTAT, 1029e3700dfSgww AC_ARG_SETQBUFSZ, 1039e3700dfSgww AC_ARG_SETQCTRL, 1049e3700dfSgww AC_ARG_SETQDELAY, 1059e3700dfSgww AC_ARG_SETQHIWATER, 1069e3700dfSgww AC_ARG_SETQLOWATER, 1079e3700dfSgww AC_ARG_SETUMASK 1089e3700dfSgww }; 1097c478bd9Sstevel@tonic-gate 1107c478bd9Sstevel@tonic-gate #define AC_KERN_EVENT 0 1117c478bd9Sstevel@tonic-gate #define AC_USER_EVENT 1 1127c478bd9Sstevel@tonic-gate 1137c478bd9Sstevel@tonic-gate #define NONE(s) (!strlen(s) ? gettext("none") : s) 1147c478bd9Sstevel@tonic-gate 1157c478bd9Sstevel@tonic-gate #define ALL_POLICIES (AUDIT_AHLT|\ 1167c478bd9Sstevel@tonic-gate AUDIT_ARGE|\ 1177c478bd9Sstevel@tonic-gate AUDIT_ARGV|\ 1187c478bd9Sstevel@tonic-gate AUDIT_CNT|\ 1197c478bd9Sstevel@tonic-gate AUDIT_GROUP|\ 1207c478bd9Sstevel@tonic-gate AUDIT_WINDATA|\ 1217c478bd9Sstevel@tonic-gate AUDIT_SEQ|\ 1227c478bd9Sstevel@tonic-gate AUDIT_TRAIL|\ 1237c478bd9Sstevel@tonic-gate AUDIT_PATH|\ 1247c478bd9Sstevel@tonic-gate AUDIT_PUBLIC|\ 1257c478bd9Sstevel@tonic-gate AUDIT_ZONENAME|\ 12645916cd2Sjpk AUDIT_PERZONE|\ 12745916cd2Sjpk AUDIT_WINDATA_DOWN|\ 12845916cd2Sjpk AUDIT_WINDATA_UP) 1297c478bd9Sstevel@tonic-gate 1307c478bd9Sstevel@tonic-gate #define NO_POLICIES (0) 1317c478bd9Sstevel@tonic-gate 1327c478bd9Sstevel@tonic-gate #define ONEK 1024 1337c478bd9Sstevel@tonic-gate 1347c478bd9Sstevel@tonic-gate /* 1357c478bd9Sstevel@tonic-gate * remove this after the audit.h is fixed 1367c478bd9Sstevel@tonic-gate */ 1377c478bd9Sstevel@tonic-gate 1387c478bd9Sstevel@tonic-gate struct arg_entry { 1399e3700dfSgww char *arg_str; 1409e3700dfSgww char *arg_opts; 1419e3700dfSgww enum commands auditconfig_cmd; 1427c478bd9Sstevel@tonic-gate }; 1437c478bd9Sstevel@tonic-gate 1447c478bd9Sstevel@tonic-gate struct policy_entry { 1457c478bd9Sstevel@tonic-gate char *policy_str; 1467c478bd9Sstevel@tonic-gate uint_t policy_mask; 1477c478bd9Sstevel@tonic-gate char *policy_desc; 1487c478bd9Sstevel@tonic-gate }; 1497c478bd9Sstevel@tonic-gate 1507c478bd9Sstevel@tonic-gate static struct arg_entry arg_table[] = { 1517c478bd9Sstevel@tonic-gate { "-aconf", "", AC_ARG_ACONF}, 1527c478bd9Sstevel@tonic-gate { "-audit", "event sorf retval string", AC_ARG_AUDIT}, 1537c478bd9Sstevel@tonic-gate { "-chkaconf", "", AC_ARG_CHKACONF}, 1547c478bd9Sstevel@tonic-gate { "-chkconf", "", AC_ARG_CHKCONF}, 1557c478bd9Sstevel@tonic-gate { "-conf", "", AC_ARG_CONF}, 1567c478bd9Sstevel@tonic-gate { "-getasid", "", AC_ARG_GETASID}, 1577c478bd9Sstevel@tonic-gate { "-getaudit", "", AC_ARG_GETAUDIT}, 1587c478bd9Sstevel@tonic-gate { "-getauid", "", AC_ARG_GETAUID}, 1597c478bd9Sstevel@tonic-gate { "-getcar", "", AC_ARG_GETCAR}, 1609e3700dfSgww { "-getclass", "event", AC_ARG_GETCLASS}, 1617c478bd9Sstevel@tonic-gate { "-getcond", "", AC_ARG_GETCOND}, 1627c478bd9Sstevel@tonic-gate { "-getcwd", "", AC_ARG_GETCWD}, 1637c478bd9Sstevel@tonic-gate { "-getestate", "event", AC_ARG_GETESTATE}, 1647c478bd9Sstevel@tonic-gate { "-getfsize", "", AC_ARG_GETFSIZE}, 1657c478bd9Sstevel@tonic-gate { "-getkaudit", "", AC_ARG_GETKAUDIT}, 1667c478bd9Sstevel@tonic-gate { "-getkmask", "", AC_ARG_GETKMASK}, 1679e3700dfSgww { "-getpinfo", "pid", AC_ARG_GETPINFO}, 1687c478bd9Sstevel@tonic-gate { "-getpolicy", "", AC_ARG_GETPOLICY}, 1697c478bd9Sstevel@tonic-gate { "-getqbufsz", "", AC_ARG_GETQBUFSZ}, 1707c478bd9Sstevel@tonic-gate { "-getqctrl", "", AC_ARG_GETQCTRL}, 1717c478bd9Sstevel@tonic-gate { "-getqdelay", "", AC_ARG_GETQDELAY}, 1727c478bd9Sstevel@tonic-gate { "-getqhiwater", "", AC_ARG_GETQHIWATER}, 1737c478bd9Sstevel@tonic-gate { "-getqlowater", "", AC_ARG_GETQLOWATER}, 1747c478bd9Sstevel@tonic-gate { "-getstat", "", AC_ARG_GETSTAT}, 1757c478bd9Sstevel@tonic-gate { "-gettid", "", AC_ARG_GETTERMID}, 1767c478bd9Sstevel@tonic-gate { "-lsevent", "", AC_ARG_LSEVENT}, 1777c478bd9Sstevel@tonic-gate { "-lspolicy", "", AC_ARG_LSPOLICY}, 1787c478bd9Sstevel@tonic-gate { "-setasid", "asid [cmd]", AC_ARG_SETASID}, 1799e3700dfSgww { "-setaudit", "auid audit_flags termid asid [cmd]", 1807c478bd9Sstevel@tonic-gate AC_ARG_SETAUDIT}, 1817c478bd9Sstevel@tonic-gate { "-setauid", "auid [cmd]", AC_ARG_SETAUID}, 1827c478bd9Sstevel@tonic-gate { "-setclass", "event audit_flags", AC_ARG_SETCLASS}, 1837c478bd9Sstevel@tonic-gate { "-setfsize", "filesize", AC_ARG_SETFSIZE}, 1847c478bd9Sstevel@tonic-gate { "-setkaudit", "type IP_address", AC_ARG_SETKAUDIT}, 1857c478bd9Sstevel@tonic-gate { "-setkmask", "audit_flags", AC_ARG_SETKMASK}, 1869e3700dfSgww { "-setpmask", "pid audit_flags", AC_ARG_SETPMASK}, 1879e3700dfSgww { "-setpolicy", "[+|-]policy_flags", AC_ARG_SETPOLICY}, 1887c478bd9Sstevel@tonic-gate { "-setqbufsz", "bufsz", AC_ARG_SETQBUFSZ}, 1897c478bd9Sstevel@tonic-gate { "-setqctrl", "hiwater lowater bufsz delay", AC_ARG_SETQCTRL}, 1907c478bd9Sstevel@tonic-gate { "-setqdelay", "delay", AC_ARG_SETQDELAY}, 1917c478bd9Sstevel@tonic-gate { "-setqhiwater", "hiwater", AC_ARG_SETQHIWATER}, 1927c478bd9Sstevel@tonic-gate { "-setqlowater", "lowater", AC_ARG_SETQLOWATER}, 1937c478bd9Sstevel@tonic-gate { "-setsmask", "asid audit_flags", AC_ARG_SETSMASK}, 1947c478bd9Sstevel@tonic-gate { "-setstat", "", AC_ARG_SETSTAT}, 1957c478bd9Sstevel@tonic-gate { "-setumask", "user audit_flags", AC_ARG_SETUMASK}, 1967c478bd9Sstevel@tonic-gate }; 1977c478bd9Sstevel@tonic-gate 1987c478bd9Sstevel@tonic-gate #define ARG_TBL_SZ (sizeof (arg_table) / sizeof (struct arg_entry)) 1997c478bd9Sstevel@tonic-gate 2007c478bd9Sstevel@tonic-gate static struct policy_entry policy_table[] = { 2019e3700dfSgww {"ahlt", AUDIT_AHLT, "halt machine if it can not record an " 2029e3700dfSgww "async event"}, 2039e3700dfSgww {"all", ALL_POLICIES, "all policies"}, 2049e3700dfSgww {"arge", AUDIT_ARGE, "include exec environment args in audit recs"}, 2059e3700dfSgww {"argv", AUDIT_ARGV, "include exec command line args in audit recs"}, 2069e3700dfSgww {"cnt", AUDIT_CNT, "when no more space, drop recs and keep a cnt"}, 2079e3700dfSgww {"group", AUDIT_GROUP, "include supplementary groups in audit recs"}, 2089e3700dfSgww {"none", NO_POLICIES, "no policies"}, 2099e3700dfSgww {"path", AUDIT_PATH, "allow multiple paths per event"}, 2109e3700dfSgww {"perzone", AUDIT_PERZONE, "use a separate queue and auditd per " 2119e3700dfSgww "zone"}, 2129e3700dfSgww {"public", AUDIT_PUBLIC, "audit public files"}, 2139e3700dfSgww {"seq", AUDIT_SEQ, "include a sequence number in audit recs"}, 2149e3700dfSgww {"trail", AUDIT_TRAIL, "include trailer token in audit recs"}, 2159e3700dfSgww {"windata_down", AUDIT_WINDATA_DOWN, "include downgraded window " 2169e3700dfSgww "information in audit recs"}, 2179e3700dfSgww {"windata_up", AUDIT_WINDATA_UP, "include upgraded window " 2189e3700dfSgww "information in audit recs"}, 2199e3700dfSgww {"zonename", AUDIT_ZONENAME, "generate zonename token"} 2209e3700dfSgww }; 2217c478bd9Sstevel@tonic-gate 2227c478bd9Sstevel@tonic-gate #define POLICY_TBL_SZ (sizeof (policy_table) / sizeof (struct policy_entry)) 2237c478bd9Sstevel@tonic-gate 2249e3700dfSgww static char *progname = "auditconfig"; 2259e3700dfSgww 2269e3700dfSgww static au_event_ent_t *egetauevnam(char *event_name); 2279e3700dfSgww static au_event_ent_t *egetauevnum(au_event_t event_number); 2289e3700dfSgww static int arg_ent_compare(const void *aep1, const void *aep2); 2299e3700dfSgww static char *cond2str(void); 2309e3700dfSgww static int policy2str(uint_t policy, char *policy_str, size_t len); 2319e3700dfSgww static int str2type(char *s, uint_t *type); 2329e3700dfSgww static int str2policy(char *policy_str, uint_t *policy_mask); 2339e3700dfSgww static int str2ipaddr(char *s, uint32_t *addr, uint32_t type); 2349e3700dfSgww static int strisflags(char *s); 2359e3700dfSgww static int strisipaddr(char *s); 2369e3700dfSgww static int strisnum(char *s); 2379e3700dfSgww static struct arg_entry *get_arg_ent(char *arg_str); 2389e3700dfSgww static struct policy_entry *get_policy_ent(char *policy); 2399e3700dfSgww static uid_t get_user_id(char *user); 2409e3700dfSgww static void chk_event_num(int etype, au_event_t event); 2419e3700dfSgww static void chk_event_str(int etype, char *event_str); 2429e3700dfSgww static void chk_retval(char *retval_str); 2439e3700dfSgww static void chk_sorf(char *sorf_str); 2449e3700dfSgww static void do_aconf(void); 2459e3700dfSgww static void do_args(char **argv); 2469e3700dfSgww static void do_audit(char *, char, int, char *); 2479e3700dfSgww static void do_chkaconf(void); 2489e3700dfSgww static void do_chkconf(void); 2499e3700dfSgww static void do_conf(void); 2509e3700dfSgww static void do_getasid(void); 2519e3700dfSgww static void do_getaudit(void); 2529e3700dfSgww static void do_getkaudit(void); 2539e3700dfSgww static void do_setkaudit(char *t, char *s); 2549e3700dfSgww static void do_getauid(void); 2559e3700dfSgww static void do_getcar(void); 2569e3700dfSgww static void do_getclass(char *event_str); 2579e3700dfSgww static void do_getcond(void); 2589e3700dfSgww static void do_getcwd(void); 2599e3700dfSgww static void do_getkmask(void); 2609e3700dfSgww static void do_getpinfo(char *pid_str); 2619e3700dfSgww static void do_getpolicy(void); 2629e3700dfSgww static void do_getqbufsz(void); 2639e3700dfSgww static void do_getqctrl(void); 2649e3700dfSgww static void do_getqdelay(void); 2659e3700dfSgww static void do_getqhiwater(void); 2669e3700dfSgww static void do_getqlowater(void); 2679e3700dfSgww static void do_getstat(void); 2689e3700dfSgww static void do_gettermid(void); 2699e3700dfSgww static void do_lsevent(void); 2709e3700dfSgww static void do_lspolicy(void); 2719e3700dfSgww static void do_setasid(char *sid_str, char **argv); 2729e3700dfSgww static void do_setaudit(char *user_str, char *mask_str, char *tid_str, 2739e3700dfSgww char *sid_str, char **argv); 2749e3700dfSgww static void do_setauid(char *user, char **argv); 2759e3700dfSgww static void do_setclass(char *event_str, char *audit_flags); 2769e3700dfSgww static void do_setkmask(char *audit_flags); 2779e3700dfSgww static void do_setpmask(char *pid_str, char *audit_flags); 2789e3700dfSgww static void do_setsmask(char *asid_str, char *audit_flags); 2799e3700dfSgww static void do_setumask(char *auid_str, char *audit_flags); 2809e3700dfSgww static void do_setpolicy(char *policy_str); 2819e3700dfSgww static void do_setqbufsz(char *bufsz); 2829e3700dfSgww static void do_setqctrl(char *hiwater, char *lowater, char *bufsz, char *delay); 2839e3700dfSgww static void do_setqdelay(char *delay); 2849e3700dfSgww static void do_setqhiwater(char *hiwater); 2859e3700dfSgww static void do_setqlowater(char *lowater); 2869e3700dfSgww static void do_setstat(void); 2879e3700dfSgww static void do_getfsize(void); 2889e3700dfSgww static void do_setfsize(char *size); 2899e3700dfSgww static void str2mask(char *mask_str, au_mask_t *mp); 2909e3700dfSgww static void str2tid(char *tid_str, au_tid_addr_t *tp); 2919e3700dfSgww static void strsplit(char *s, char *p1, char *p2, char c); 2929e3700dfSgww 2939e3700dfSgww static void eauditon(int cmd, caddr_t data, int length); 2949e3700dfSgww static void egetaudit(auditinfo_addr_t *ai, int size); 2959e3700dfSgww static void egetkaudit(auditinfo_addr_t *ai, int size); 2969e3700dfSgww static void esetkaudit(auditinfo_addr_t *ai, int size); 2979e3700dfSgww static void egetauditflagsbin(char *auditflags, au_mask_t *pmask); 2989e3700dfSgww static void egetauid(au_id_t *auid); 2999e3700dfSgww static void esetaudit(auditinfo_addr_t *ai, int size); 3009e3700dfSgww static void esetauid(au_id_t *auid); 3019e3700dfSgww static void execit(char **argv); 3029e3700dfSgww static void exit_error(char *fmt, ...); 3039e3700dfSgww static void exit_usage(int status); 3049e3700dfSgww static void parse_args(char **argv); 3059e3700dfSgww static void print_asid(au_asid_t asid); 3069e3700dfSgww static void print_auid(au_id_t auid); 3079e3700dfSgww static void print_mask(char *desc, au_mask_t *pmp); 3089e3700dfSgww static void print_tid_ex(au_tid_addr_t *tidp); 3097c478bd9Sstevel@tonic-gate 3107c478bd9Sstevel@tonic-gate int 3119e3700dfSgww main(int argc, char **argv) 3127c478bd9Sstevel@tonic-gate { 3137c478bd9Sstevel@tonic-gate (void) setlocale(LC_ALL, ""); 3147c478bd9Sstevel@tonic-gate (void) textdomain(TEXT_DOMAIN); 3157c478bd9Sstevel@tonic-gate 3167c478bd9Sstevel@tonic-gate if (argc == 1) { 3177c478bd9Sstevel@tonic-gate exit_usage(0); 3187c478bd9Sstevel@tonic-gate exit(0); 3197c478bd9Sstevel@tonic-gate } 3207c478bd9Sstevel@tonic-gate 3217c478bd9Sstevel@tonic-gate if (argc == 2 && 3227c478bd9Sstevel@tonic-gate (argv[1][0] == '?' || 3237c478bd9Sstevel@tonic-gate strcmp(argv[1], "-h") == 0 || 3247c478bd9Sstevel@tonic-gate strcmp(argv[1], "-?") == 0)) 3257c478bd9Sstevel@tonic-gate exit_usage(0); 3267c478bd9Sstevel@tonic-gate 3277c478bd9Sstevel@tonic-gate parse_args(argv); 3287c478bd9Sstevel@tonic-gate do_args(argv); 3297c478bd9Sstevel@tonic-gate 3307c478bd9Sstevel@tonic-gate return (0); 3317c478bd9Sstevel@tonic-gate } 3327c478bd9Sstevel@tonic-gate 3337c478bd9Sstevel@tonic-gate /* 3347c478bd9Sstevel@tonic-gate * parse_args() 3357c478bd9Sstevel@tonic-gate * Desc: Checks command line argument syntax. 3367c478bd9Sstevel@tonic-gate * Inputs: Command line argv; 3377c478bd9Sstevel@tonic-gate * Returns: If a syntax error is detected, a usage message is printed 3387c478bd9Sstevel@tonic-gate * and exit() is called. If a syntax error is not detected, 3397c478bd9Sstevel@tonic-gate * parse_args() returns without a value. 3407c478bd9Sstevel@tonic-gate */ 3417c478bd9Sstevel@tonic-gate static void 3427c478bd9Sstevel@tonic-gate parse_args(char **argv) 3437c478bd9Sstevel@tonic-gate { 3447c478bd9Sstevel@tonic-gate struct arg_entry *ae; 3457c478bd9Sstevel@tonic-gate 3469e3700dfSgww au_mask_t mask; 3477c478bd9Sstevel@tonic-gate uint_t type; 3487c478bd9Sstevel@tonic-gate uint_t addr[4]; 3497c478bd9Sstevel@tonic-gate 3507c478bd9Sstevel@tonic-gate for (++argv; *argv; argv++) { 3519e3700dfSgww if ((ae = get_arg_ent(*argv)) == NULL) { 3527c478bd9Sstevel@tonic-gate exit_usage(1); 3537c478bd9Sstevel@tonic-gate } 3547c478bd9Sstevel@tonic-gate 3557c478bd9Sstevel@tonic-gate switch (ae->auditconfig_cmd) { 3567c478bd9Sstevel@tonic-gate 3577c478bd9Sstevel@tonic-gate case AC_ARG_AUDIT: 3587c478bd9Sstevel@tonic-gate ++argv; 3597c478bd9Sstevel@tonic-gate if (!*argv) 3607c478bd9Sstevel@tonic-gate exit_usage(1); 3617c478bd9Sstevel@tonic-gate if (strisnum(*argv)) { 3627c478bd9Sstevel@tonic-gate chk_event_num(AC_USER_EVENT, 3637c478bd9Sstevel@tonic-gate (au_event_t)atol(*argv)); 3649e3700dfSgww } else { 3657c478bd9Sstevel@tonic-gate chk_event_str(AC_USER_EVENT, *argv); 3669e3700dfSgww } 3677c478bd9Sstevel@tonic-gate ++argv; 3687c478bd9Sstevel@tonic-gate if (!*argv) 3697c478bd9Sstevel@tonic-gate exit_usage(1); 3707c478bd9Sstevel@tonic-gate chk_sorf(*argv); 3717c478bd9Sstevel@tonic-gate ++argv; 3727c478bd9Sstevel@tonic-gate if (!*argv) 3737c478bd9Sstevel@tonic-gate exit_usage(1); 3747c478bd9Sstevel@tonic-gate chk_retval(*argv); 3757c478bd9Sstevel@tonic-gate ++argv; 3767c478bd9Sstevel@tonic-gate if (!*argv) 3777c478bd9Sstevel@tonic-gate exit_usage(1); 3787c478bd9Sstevel@tonic-gate break; 3797c478bd9Sstevel@tonic-gate 3807c478bd9Sstevel@tonic-gate case AC_ARG_CHKCONF: 3817c478bd9Sstevel@tonic-gate case AC_ARG_CONF: 3827c478bd9Sstevel@tonic-gate case AC_ARG_ACONF: 3837c478bd9Sstevel@tonic-gate case AC_ARG_CHKACONF: 3847c478bd9Sstevel@tonic-gate case AC_ARG_GETASID: 3857c478bd9Sstevel@tonic-gate case AC_ARG_GETAUID: 3867c478bd9Sstevel@tonic-gate case AC_ARG_GETAUDIT: 3877c478bd9Sstevel@tonic-gate case AC_ARG_GETKAUDIT: 3887c478bd9Sstevel@tonic-gate break; 3897c478bd9Sstevel@tonic-gate 3907c478bd9Sstevel@tonic-gate case AC_ARG_GETCLASS: 3917c478bd9Sstevel@tonic-gate case AC_ARG_GETESTATE: 3927c478bd9Sstevel@tonic-gate ++argv; 3937c478bd9Sstevel@tonic-gate if (!*argv) 3947c478bd9Sstevel@tonic-gate exit_usage(1); 3959e3700dfSgww if (strisnum(*argv)) { 3967c478bd9Sstevel@tonic-gate chk_event_num(AC_KERN_EVENT, 3979e3700dfSgww (au_event_t)atol(*argv)); 3989e3700dfSgww } else { 3997c478bd9Sstevel@tonic-gate chk_event_str(AC_KERN_EVENT, *argv); 4009e3700dfSgww } 4017c478bd9Sstevel@tonic-gate break; 4027c478bd9Sstevel@tonic-gate 4037c478bd9Sstevel@tonic-gate case AC_ARG_GETCAR: 4047c478bd9Sstevel@tonic-gate case AC_ARG_GETCOND: 4057c478bd9Sstevel@tonic-gate case AC_ARG_GETCWD: 4067c478bd9Sstevel@tonic-gate case AC_ARG_GETKMASK: 4077c478bd9Sstevel@tonic-gate case AC_ARG_GETPOLICY: 4087c478bd9Sstevel@tonic-gate case AC_ARG_GETQBUFSZ: 4097c478bd9Sstevel@tonic-gate case AC_ARG_GETQCTRL: 4107c478bd9Sstevel@tonic-gate case AC_ARG_GETQDELAY: 4117c478bd9Sstevel@tonic-gate case AC_ARG_GETQHIWATER: 4127c478bd9Sstevel@tonic-gate case AC_ARG_GETQLOWATER: 4137c478bd9Sstevel@tonic-gate case AC_ARG_GETSTAT: 4147c478bd9Sstevel@tonic-gate case AC_ARG_GETTERMID: 4157c478bd9Sstevel@tonic-gate case AC_ARG_LSEVENT: 4167c478bd9Sstevel@tonic-gate case AC_ARG_LSPOLICY: 4177c478bd9Sstevel@tonic-gate break; 4187c478bd9Sstevel@tonic-gate 4197c478bd9Sstevel@tonic-gate case AC_ARG_SETASID: 4207c478bd9Sstevel@tonic-gate case AC_ARG_SETAUID: 4217c478bd9Sstevel@tonic-gate case AC_ARG_SETAUDIT: 4227c478bd9Sstevel@tonic-gate ++argv; 4237c478bd9Sstevel@tonic-gate if (!*argv) 4247c478bd9Sstevel@tonic-gate exit_usage(1); 4257c478bd9Sstevel@tonic-gate 4267c478bd9Sstevel@tonic-gate while (*argv) 4277c478bd9Sstevel@tonic-gate ++argv; 4287c478bd9Sstevel@tonic-gate --argv; 4297c478bd9Sstevel@tonic-gate 4307c478bd9Sstevel@tonic-gate break; 4317c478bd9Sstevel@tonic-gate 4327c478bd9Sstevel@tonic-gate case AC_ARG_SETKAUDIT: 4337c478bd9Sstevel@tonic-gate ++argv; 4347c478bd9Sstevel@tonic-gate if (!*argv) 4357c478bd9Sstevel@tonic-gate exit_usage(1); 4367c478bd9Sstevel@tonic-gate if (str2type (*argv, &type)) 4377c478bd9Sstevel@tonic-gate exit_error(gettext( 4387c478bd9Sstevel@tonic-gate "Invalid IP address type specified.")); 4397c478bd9Sstevel@tonic-gate ++argv; 4407c478bd9Sstevel@tonic-gate if (!*argv) 4417c478bd9Sstevel@tonic-gate exit_usage(1); 4427c478bd9Sstevel@tonic-gate 4437c478bd9Sstevel@tonic-gate if (str2ipaddr(*argv, addr, type)) 4447c478bd9Sstevel@tonic-gate exit_error(gettext( 4457c478bd9Sstevel@tonic-gate "Invalid IP address specified.")); 4467c478bd9Sstevel@tonic-gate break; 4477c478bd9Sstevel@tonic-gate 4487c478bd9Sstevel@tonic-gate case AC_ARG_SETCLASS: 4497c478bd9Sstevel@tonic-gate ++argv; 4507c478bd9Sstevel@tonic-gate if (!*argv) 4517c478bd9Sstevel@tonic-gate exit_usage(1); 4527c478bd9Sstevel@tonic-gate if (strisnum(*argv)) 4537c478bd9Sstevel@tonic-gate chk_event_num(AC_KERN_EVENT, 4547c478bd9Sstevel@tonic-gate (au_event_t)atol(*argv)); 4557c478bd9Sstevel@tonic-gate else 4567c478bd9Sstevel@tonic-gate chk_event_str(AC_KERN_EVENT, *argv); 4577c478bd9Sstevel@tonic-gate ++argv; 4587c478bd9Sstevel@tonic-gate if (!*argv) 4597c478bd9Sstevel@tonic-gate exit_usage(1); 4609e3700dfSgww str2mask(*argv, &mask); 4617c478bd9Sstevel@tonic-gate break; 4627c478bd9Sstevel@tonic-gate 4637c478bd9Sstevel@tonic-gate case AC_ARG_SETKMASK: 4647c478bd9Sstevel@tonic-gate ++argv; 4657c478bd9Sstevel@tonic-gate if (!*argv) 4667c478bd9Sstevel@tonic-gate exit_usage(1); 4679e3700dfSgww str2mask(*argv, &mask); 4687c478bd9Sstevel@tonic-gate break; 4697c478bd9Sstevel@tonic-gate 4707c478bd9Sstevel@tonic-gate case AC_ARG_SETPOLICY: 4717c478bd9Sstevel@tonic-gate ++argv; 4727c478bd9Sstevel@tonic-gate if (!*argv) 4737c478bd9Sstevel@tonic-gate exit_usage(1); 4747c478bd9Sstevel@tonic-gate break; 4757c478bd9Sstevel@tonic-gate 4767c478bd9Sstevel@tonic-gate case AC_ARG_SETSTAT: 4777c478bd9Sstevel@tonic-gate break; 4787c478bd9Sstevel@tonic-gate 4797c478bd9Sstevel@tonic-gate case AC_ARG_GETPINFO: 4807c478bd9Sstevel@tonic-gate ++argv; 4817c478bd9Sstevel@tonic-gate if (!*argv) 4827c478bd9Sstevel@tonic-gate exit_usage(1); 4837c478bd9Sstevel@tonic-gate break; 4847c478bd9Sstevel@tonic-gate 4857c478bd9Sstevel@tonic-gate case AC_ARG_SETPMASK: 4867c478bd9Sstevel@tonic-gate ++argv; 4877c478bd9Sstevel@tonic-gate if (!*argv) 4887c478bd9Sstevel@tonic-gate exit_usage(1); 4897c478bd9Sstevel@tonic-gate ++argv; 4907c478bd9Sstevel@tonic-gate if (!*argv) 4917c478bd9Sstevel@tonic-gate exit_usage(1); 4929e3700dfSgww str2mask(*argv, &mask); 4937c478bd9Sstevel@tonic-gate break; 4947c478bd9Sstevel@tonic-gate 4957c478bd9Sstevel@tonic-gate case AC_ARG_SETQBUFSZ: 4967c478bd9Sstevel@tonic-gate ++argv; 4977c478bd9Sstevel@tonic-gate if (!*argv) 4987c478bd9Sstevel@tonic-gate exit_usage(1); 4997c478bd9Sstevel@tonic-gate if (!strisnum(*argv)) 5007c478bd9Sstevel@tonic-gate exit_error(gettext("Invalid bufsz specified.")); 5017c478bd9Sstevel@tonic-gate break; 5027c478bd9Sstevel@tonic-gate 5037c478bd9Sstevel@tonic-gate case AC_ARG_SETQCTRL: 5047c478bd9Sstevel@tonic-gate ++argv; 5057c478bd9Sstevel@tonic-gate if (!*argv) 5067c478bd9Sstevel@tonic-gate exit_usage(1); 5077c478bd9Sstevel@tonic-gate if (!strisnum(*argv)) 5087c478bd9Sstevel@tonic-gate exit_error(gettext( 5097c478bd9Sstevel@tonic-gate "Invalid hiwater specified.")); 5107c478bd9Sstevel@tonic-gate ++argv; 5117c478bd9Sstevel@tonic-gate if (!*argv) 5127c478bd9Sstevel@tonic-gate exit_usage(1); 5137c478bd9Sstevel@tonic-gate if (!strisnum(*argv)) 5147c478bd9Sstevel@tonic-gate exit_error(gettext( 5157c478bd9Sstevel@tonic-gate gettext("Invalid lowater specified."))); 5167c478bd9Sstevel@tonic-gate ++argv; 5177c478bd9Sstevel@tonic-gate if (!*argv) 5187c478bd9Sstevel@tonic-gate exit_usage(1); 5197c478bd9Sstevel@tonic-gate if (!strisnum(*argv)) 5207c478bd9Sstevel@tonic-gate exit_error(gettext("Invalid bufsz specified.")); 5217c478bd9Sstevel@tonic-gate ++argv; 5227c478bd9Sstevel@tonic-gate if (!*argv) 5237c478bd9Sstevel@tonic-gate exit_usage(1); 5247c478bd9Sstevel@tonic-gate if (!strisnum(*argv)) 5257c478bd9Sstevel@tonic-gate exit_error(gettext("Invalid delay specified.")); 5267c478bd9Sstevel@tonic-gate break; 5277c478bd9Sstevel@tonic-gate 5287c478bd9Sstevel@tonic-gate case AC_ARG_SETQDELAY: 5297c478bd9Sstevel@tonic-gate ++argv; 5307c478bd9Sstevel@tonic-gate if (!*argv) 5317c478bd9Sstevel@tonic-gate exit_usage(1); 5327c478bd9Sstevel@tonic-gate if (!strisnum(*argv)) 5337c478bd9Sstevel@tonic-gate exit_error(gettext("Invalid delay specified.")); 5347c478bd9Sstevel@tonic-gate break; 5357c478bd9Sstevel@tonic-gate 5367c478bd9Sstevel@tonic-gate case AC_ARG_SETQHIWATER: 5377c478bd9Sstevel@tonic-gate ++argv; 5387c478bd9Sstevel@tonic-gate if (!*argv) 5397c478bd9Sstevel@tonic-gate exit_usage(1); 5409e3700dfSgww if (!strisnum(*argv)) { 5417c478bd9Sstevel@tonic-gate exit_error(gettext( 5429e3700dfSgww "Invalid hiwater specified.")); 5439e3700dfSgww } 5447c478bd9Sstevel@tonic-gate break; 5457c478bd9Sstevel@tonic-gate 5467c478bd9Sstevel@tonic-gate case AC_ARG_SETQLOWATER: 5477c478bd9Sstevel@tonic-gate ++argv; 5487c478bd9Sstevel@tonic-gate if (!*argv) 5497c478bd9Sstevel@tonic-gate exit_usage(1); 5509e3700dfSgww if (!strisnum(*argv)) { 5517c478bd9Sstevel@tonic-gate exit_error(gettext( 5529e3700dfSgww "Invalid lowater specified.")); 5539e3700dfSgww } 5547c478bd9Sstevel@tonic-gate break; 5557c478bd9Sstevel@tonic-gate 5567c478bd9Sstevel@tonic-gate case AC_ARG_SETSMASK: 5577c478bd9Sstevel@tonic-gate case AC_ARG_SETUMASK: 5587c478bd9Sstevel@tonic-gate ++argv; 5597c478bd9Sstevel@tonic-gate if (!*argv) 5607c478bd9Sstevel@tonic-gate exit_usage(1); 5617c478bd9Sstevel@tonic-gate ++argv; 5627c478bd9Sstevel@tonic-gate if (!*argv) 5637c478bd9Sstevel@tonic-gate exit_usage(1); 5649e3700dfSgww str2mask(*argv, &mask); 5657c478bd9Sstevel@tonic-gate break; 5667c478bd9Sstevel@tonic-gate 5677c478bd9Sstevel@tonic-gate case AC_ARG_GETFSIZE: 5687c478bd9Sstevel@tonic-gate break; 5697c478bd9Sstevel@tonic-gate 5707c478bd9Sstevel@tonic-gate case AC_ARG_SETFSIZE: 5717c478bd9Sstevel@tonic-gate ++argv; 5727c478bd9Sstevel@tonic-gate if (!*argv) 5737c478bd9Sstevel@tonic-gate exit_usage(1); 5749e3700dfSgww if (!strisnum(*argv)) { 5757c478bd9Sstevel@tonic-gate exit_error(gettext( 5769e3700dfSgww "Invalid hiwater specified.")); 5779e3700dfSgww } 5787c478bd9Sstevel@tonic-gate break; 5797c478bd9Sstevel@tonic-gate 5807c478bd9Sstevel@tonic-gate default: 5817c478bd9Sstevel@tonic-gate exit_error(gettext("Internal error #1.")); 5827c478bd9Sstevel@tonic-gate break; 5837c478bd9Sstevel@tonic-gate } 5847c478bd9Sstevel@tonic-gate } 5857c478bd9Sstevel@tonic-gate } 5867c478bd9Sstevel@tonic-gate 5877c478bd9Sstevel@tonic-gate 5887c478bd9Sstevel@tonic-gate /* 5897c478bd9Sstevel@tonic-gate * do_args() 5907c478bd9Sstevel@tonic-gate * Desc: Do command line arguments in the order in which they appear. 5917c478bd9Sstevel@tonic-gate */ 5927c478bd9Sstevel@tonic-gate static void 5939e3700dfSgww do_args(char **argv) 5947c478bd9Sstevel@tonic-gate { 5957c478bd9Sstevel@tonic-gate struct arg_entry *ae; 5967c478bd9Sstevel@tonic-gate 5977c478bd9Sstevel@tonic-gate for (++argv; *argv; argv++) { 5987c478bd9Sstevel@tonic-gate ae = get_arg_ent(*argv); 5997c478bd9Sstevel@tonic-gate 6007c478bd9Sstevel@tonic-gate switch (ae->auditconfig_cmd) { 6017c478bd9Sstevel@tonic-gate 6027c478bd9Sstevel@tonic-gate case AC_ARG_AUDIT: 6037c478bd9Sstevel@tonic-gate { 6047c478bd9Sstevel@tonic-gate char sorf; 6057c478bd9Sstevel@tonic-gate int retval; 6067c478bd9Sstevel@tonic-gate char *event_name; 6077c478bd9Sstevel@tonic-gate char *audit_str; 6087c478bd9Sstevel@tonic-gate 6097c478bd9Sstevel@tonic-gate ++argv; 6107c478bd9Sstevel@tonic-gate event_name = *argv; 6117c478bd9Sstevel@tonic-gate ++argv; 6127c478bd9Sstevel@tonic-gate sorf = (char)atoi(*argv); 6137c478bd9Sstevel@tonic-gate ++argv; 6147c478bd9Sstevel@tonic-gate retval = atoi(*argv); 6157c478bd9Sstevel@tonic-gate ++argv; 6167c478bd9Sstevel@tonic-gate audit_str = *argv; 6177c478bd9Sstevel@tonic-gate do_audit(event_name, sorf, retval, audit_str); 6187c478bd9Sstevel@tonic-gate } 6197c478bd9Sstevel@tonic-gate break; 6207c478bd9Sstevel@tonic-gate 6217c478bd9Sstevel@tonic-gate case AC_ARG_CHKCONF: 6227c478bd9Sstevel@tonic-gate do_chkconf(); 6237c478bd9Sstevel@tonic-gate break; 6247c478bd9Sstevel@tonic-gate 6257c478bd9Sstevel@tonic-gate case AC_ARG_CONF: 6267c478bd9Sstevel@tonic-gate do_conf(); 6277c478bd9Sstevel@tonic-gate break; 6287c478bd9Sstevel@tonic-gate 6297c478bd9Sstevel@tonic-gate case AC_ARG_CHKACONF: 6307c478bd9Sstevel@tonic-gate do_chkaconf(); 6317c478bd9Sstevel@tonic-gate break; 6327c478bd9Sstevel@tonic-gate 6337c478bd9Sstevel@tonic-gate case AC_ARG_ACONF: 6347c478bd9Sstevel@tonic-gate do_aconf(); 6357c478bd9Sstevel@tonic-gate break; 6367c478bd9Sstevel@tonic-gate 6377c478bd9Sstevel@tonic-gate case AC_ARG_GETASID: 6387c478bd9Sstevel@tonic-gate do_getasid(); 6397c478bd9Sstevel@tonic-gate break; 6407c478bd9Sstevel@tonic-gate 6417c478bd9Sstevel@tonic-gate case AC_ARG_GETAUID: 6427c478bd9Sstevel@tonic-gate do_getauid(); 6437c478bd9Sstevel@tonic-gate break; 6447c478bd9Sstevel@tonic-gate 6457c478bd9Sstevel@tonic-gate case AC_ARG_GETAUDIT: 6467c478bd9Sstevel@tonic-gate do_getaudit(); 6477c478bd9Sstevel@tonic-gate break; 6487c478bd9Sstevel@tonic-gate 6497c478bd9Sstevel@tonic-gate case AC_ARG_GETKAUDIT: 6507c478bd9Sstevel@tonic-gate do_getkaudit(); 6517c478bd9Sstevel@tonic-gate break; 6527c478bd9Sstevel@tonic-gate 6537c478bd9Sstevel@tonic-gate case AC_ARG_GETCLASS: 6547c478bd9Sstevel@tonic-gate case AC_ARG_GETESTATE: 6557c478bd9Sstevel@tonic-gate ++argv; 6567c478bd9Sstevel@tonic-gate do_getclass(*argv); 6577c478bd9Sstevel@tonic-gate break; 6587c478bd9Sstevel@tonic-gate 6597c478bd9Sstevel@tonic-gate case AC_ARG_GETCAR: 6607c478bd9Sstevel@tonic-gate do_getcar(); 6617c478bd9Sstevel@tonic-gate break; 6627c478bd9Sstevel@tonic-gate 6637c478bd9Sstevel@tonic-gate case AC_ARG_GETCOND: 6647c478bd9Sstevel@tonic-gate do_getcond(); 6657c478bd9Sstevel@tonic-gate break; 6667c478bd9Sstevel@tonic-gate 6677c478bd9Sstevel@tonic-gate case AC_ARG_GETCWD: 6687c478bd9Sstevel@tonic-gate do_getcwd(); 6697c478bd9Sstevel@tonic-gate break; 6707c478bd9Sstevel@tonic-gate 6717c478bd9Sstevel@tonic-gate case AC_ARG_GETKMASK: 6727c478bd9Sstevel@tonic-gate do_getkmask(); 6737c478bd9Sstevel@tonic-gate break; 6747c478bd9Sstevel@tonic-gate 6757c478bd9Sstevel@tonic-gate case AC_ARG_GETPOLICY: 6767c478bd9Sstevel@tonic-gate do_getpolicy(); 6777c478bd9Sstevel@tonic-gate break; 6787c478bd9Sstevel@tonic-gate 6797c478bd9Sstevel@tonic-gate case AC_ARG_GETQBUFSZ: 6807c478bd9Sstevel@tonic-gate do_getqbufsz(); 6817c478bd9Sstevel@tonic-gate break; 6827c478bd9Sstevel@tonic-gate 6837c478bd9Sstevel@tonic-gate case AC_ARG_GETQCTRL: 6847c478bd9Sstevel@tonic-gate do_getqctrl(); 6857c478bd9Sstevel@tonic-gate break; 6867c478bd9Sstevel@tonic-gate 6877c478bd9Sstevel@tonic-gate case AC_ARG_GETQDELAY: 6887c478bd9Sstevel@tonic-gate do_getqdelay(); 6897c478bd9Sstevel@tonic-gate break; 6907c478bd9Sstevel@tonic-gate 6917c478bd9Sstevel@tonic-gate case AC_ARG_GETQHIWATER: 6927c478bd9Sstevel@tonic-gate do_getqhiwater(); 6937c478bd9Sstevel@tonic-gate break; 6947c478bd9Sstevel@tonic-gate 6957c478bd9Sstevel@tonic-gate case AC_ARG_GETQLOWATER: 6967c478bd9Sstevel@tonic-gate do_getqlowater(); 6977c478bd9Sstevel@tonic-gate break; 6987c478bd9Sstevel@tonic-gate 6997c478bd9Sstevel@tonic-gate case AC_ARG_GETSTAT: 7007c478bd9Sstevel@tonic-gate do_getstat(); 7017c478bd9Sstevel@tonic-gate break; 7027c478bd9Sstevel@tonic-gate 7037c478bd9Sstevel@tonic-gate case AC_ARG_GETTERMID: 7047c478bd9Sstevel@tonic-gate do_gettermid(); 7057c478bd9Sstevel@tonic-gate break; 7067c478bd9Sstevel@tonic-gate 7077c478bd9Sstevel@tonic-gate case AC_ARG_LSEVENT: 7087c478bd9Sstevel@tonic-gate do_lsevent(); 7097c478bd9Sstevel@tonic-gate break; 7107c478bd9Sstevel@tonic-gate 7117c478bd9Sstevel@tonic-gate case AC_ARG_LSPOLICY: 7127c478bd9Sstevel@tonic-gate do_lspolicy(); 7137c478bd9Sstevel@tonic-gate break; 7147c478bd9Sstevel@tonic-gate 7157c478bd9Sstevel@tonic-gate case AC_ARG_SETASID: 7167c478bd9Sstevel@tonic-gate { 7177c478bd9Sstevel@tonic-gate char *sid_str; 7187c478bd9Sstevel@tonic-gate 7197c478bd9Sstevel@tonic-gate ++argv; 7207c478bd9Sstevel@tonic-gate sid_str = *argv; 7217c478bd9Sstevel@tonic-gate ++argv; 7227c478bd9Sstevel@tonic-gate do_setasid(sid_str, argv); 7237c478bd9Sstevel@tonic-gate } 7247c478bd9Sstevel@tonic-gate break; 7257c478bd9Sstevel@tonic-gate 7267c478bd9Sstevel@tonic-gate case AC_ARG_SETAUID: 7277c478bd9Sstevel@tonic-gate { 7287c478bd9Sstevel@tonic-gate char *user; 7297c478bd9Sstevel@tonic-gate 7307c478bd9Sstevel@tonic-gate ++argv; 7317c478bd9Sstevel@tonic-gate user = *argv; 7327c478bd9Sstevel@tonic-gate ++argv; 7337c478bd9Sstevel@tonic-gate do_setauid(user, argv); 7347c478bd9Sstevel@tonic-gate } 7357c478bd9Sstevel@tonic-gate break; 7367c478bd9Sstevel@tonic-gate 7377c478bd9Sstevel@tonic-gate case AC_ARG_SETAUDIT: 7387c478bd9Sstevel@tonic-gate { 7397c478bd9Sstevel@tonic-gate char *user_str; 7407c478bd9Sstevel@tonic-gate char *mask_str; 7417c478bd9Sstevel@tonic-gate char *tid_str; 7427c478bd9Sstevel@tonic-gate char *sid_str; 7437c478bd9Sstevel@tonic-gate 7447c478bd9Sstevel@tonic-gate ++argv; 7457c478bd9Sstevel@tonic-gate user_str = *argv; 7467c478bd9Sstevel@tonic-gate ++argv; 7477c478bd9Sstevel@tonic-gate mask_str = *argv; 7487c478bd9Sstevel@tonic-gate ++argv; 7497c478bd9Sstevel@tonic-gate tid_str = *argv; 7507c478bd9Sstevel@tonic-gate ++argv; 7517c478bd9Sstevel@tonic-gate sid_str = *argv; 7527c478bd9Sstevel@tonic-gate ++argv; 7537c478bd9Sstevel@tonic-gate do_setaudit(user_str, mask_str, 7547c478bd9Sstevel@tonic-gate tid_str, sid_str, argv); 7557c478bd9Sstevel@tonic-gate } 7567c478bd9Sstevel@tonic-gate break; 7577c478bd9Sstevel@tonic-gate 7587c478bd9Sstevel@tonic-gate case AC_ARG_SETKAUDIT: 7597c478bd9Sstevel@tonic-gate { 7607c478bd9Sstevel@tonic-gate char *address_type, *address; 7617c478bd9Sstevel@tonic-gate 7627c478bd9Sstevel@tonic-gate ++argv; address_type = *argv; 7637c478bd9Sstevel@tonic-gate ++argv; address = *argv; 7647c478bd9Sstevel@tonic-gate do_setkaudit(address_type, address); 7657c478bd9Sstevel@tonic-gate } 7667c478bd9Sstevel@tonic-gate break; 7677c478bd9Sstevel@tonic-gate 7687c478bd9Sstevel@tonic-gate case AC_ARG_SETCLASS: 7697c478bd9Sstevel@tonic-gate { 7707c478bd9Sstevel@tonic-gate char *event_str, *audit_flags; 7717c478bd9Sstevel@tonic-gate 7727c478bd9Sstevel@tonic-gate ++argv; event_str = *argv; 7737c478bd9Sstevel@tonic-gate ++argv; audit_flags = *argv; 7747c478bd9Sstevel@tonic-gate do_setclass(event_str, audit_flags); 7757c478bd9Sstevel@tonic-gate } 7767c478bd9Sstevel@tonic-gate break; 7777c478bd9Sstevel@tonic-gate 7787c478bd9Sstevel@tonic-gate case AC_ARG_SETKMASK: 7797c478bd9Sstevel@tonic-gate ++argv; 7807c478bd9Sstevel@tonic-gate do_setkmask(*argv); 7817c478bd9Sstevel@tonic-gate break; 7827c478bd9Sstevel@tonic-gate 7837c478bd9Sstevel@tonic-gate case AC_ARG_SETPOLICY: 7847c478bd9Sstevel@tonic-gate ++argv; 7857c478bd9Sstevel@tonic-gate do_setpolicy(*argv); 7867c478bd9Sstevel@tonic-gate break; 7877c478bd9Sstevel@tonic-gate 7887c478bd9Sstevel@tonic-gate case AC_ARG_GETPINFO: 7897c478bd9Sstevel@tonic-gate { 7907c478bd9Sstevel@tonic-gate char *pid_str; 7917c478bd9Sstevel@tonic-gate 7927c478bd9Sstevel@tonic-gate ++argv; 7937c478bd9Sstevel@tonic-gate pid_str = *argv; 7947c478bd9Sstevel@tonic-gate do_getpinfo(pid_str); 7957c478bd9Sstevel@tonic-gate } 7967c478bd9Sstevel@tonic-gate break; 7977c478bd9Sstevel@tonic-gate 7987c478bd9Sstevel@tonic-gate case AC_ARG_SETPMASK: 7997c478bd9Sstevel@tonic-gate { 8007c478bd9Sstevel@tonic-gate char *pid_str; 8017c478bd9Sstevel@tonic-gate char *audit_flags; 8027c478bd9Sstevel@tonic-gate 8037c478bd9Sstevel@tonic-gate ++argv; 8047c478bd9Sstevel@tonic-gate pid_str = *argv; 8057c478bd9Sstevel@tonic-gate ++argv; 8067c478bd9Sstevel@tonic-gate audit_flags = *argv; 8077c478bd9Sstevel@tonic-gate do_setpmask(pid_str, audit_flags); 8087c478bd9Sstevel@tonic-gate } 8097c478bd9Sstevel@tonic-gate break; 8107c478bd9Sstevel@tonic-gate 8117c478bd9Sstevel@tonic-gate case AC_ARG_SETSTAT: 8127c478bd9Sstevel@tonic-gate do_setstat(); 8137c478bd9Sstevel@tonic-gate break; 8147c478bd9Sstevel@tonic-gate 8157c478bd9Sstevel@tonic-gate case AC_ARG_SETQBUFSZ: 8167c478bd9Sstevel@tonic-gate ++argv; 8177c478bd9Sstevel@tonic-gate do_setqbufsz(*argv); 8187c478bd9Sstevel@tonic-gate break; 8197c478bd9Sstevel@tonic-gate 8207c478bd9Sstevel@tonic-gate case AC_ARG_SETQCTRL: 8217c478bd9Sstevel@tonic-gate { 8227c478bd9Sstevel@tonic-gate char *hiwater, *lowater, *bufsz, *delay; 8237c478bd9Sstevel@tonic-gate 8247c478bd9Sstevel@tonic-gate ++argv; hiwater = *argv; 8257c478bd9Sstevel@tonic-gate ++argv; lowater = *argv; 8267c478bd9Sstevel@tonic-gate ++argv; bufsz = *argv; 8277c478bd9Sstevel@tonic-gate ++argv; delay = *argv; 8287c478bd9Sstevel@tonic-gate do_setqctrl(hiwater, lowater, bufsz, delay); 8297c478bd9Sstevel@tonic-gate } 8307c478bd9Sstevel@tonic-gate break; 8317c478bd9Sstevel@tonic-gate case AC_ARG_SETQDELAY: 8327c478bd9Sstevel@tonic-gate ++argv; 8337c478bd9Sstevel@tonic-gate do_setqdelay(*argv); 8347c478bd9Sstevel@tonic-gate break; 8357c478bd9Sstevel@tonic-gate 8367c478bd9Sstevel@tonic-gate case AC_ARG_SETQHIWATER: 8377c478bd9Sstevel@tonic-gate ++argv; 8387c478bd9Sstevel@tonic-gate do_setqhiwater(*argv); 8397c478bd9Sstevel@tonic-gate break; 8407c478bd9Sstevel@tonic-gate 8417c478bd9Sstevel@tonic-gate case AC_ARG_SETQLOWATER: 8427c478bd9Sstevel@tonic-gate ++argv; 8437c478bd9Sstevel@tonic-gate do_setqlowater(*argv); 8447c478bd9Sstevel@tonic-gate break; 8457c478bd9Sstevel@tonic-gate 8467c478bd9Sstevel@tonic-gate case AC_ARG_SETSMASK: 8477c478bd9Sstevel@tonic-gate { 8487c478bd9Sstevel@tonic-gate char *asid_str; 8497c478bd9Sstevel@tonic-gate char *audit_flags; 8507c478bd9Sstevel@tonic-gate 8517c478bd9Sstevel@tonic-gate ++argv; 8527c478bd9Sstevel@tonic-gate asid_str = *argv; 8537c478bd9Sstevel@tonic-gate ++argv; 8547c478bd9Sstevel@tonic-gate audit_flags = *argv; 8557c478bd9Sstevel@tonic-gate do_setsmask(asid_str, audit_flags); 8567c478bd9Sstevel@tonic-gate } 8577c478bd9Sstevel@tonic-gate break; 8587c478bd9Sstevel@tonic-gate case AC_ARG_SETUMASK: 8597c478bd9Sstevel@tonic-gate { 8607c478bd9Sstevel@tonic-gate char *auid_str; 8617c478bd9Sstevel@tonic-gate char *audit_flags; 8627c478bd9Sstevel@tonic-gate 8637c478bd9Sstevel@tonic-gate ++argv; 8647c478bd9Sstevel@tonic-gate auid_str = *argv; 8657c478bd9Sstevel@tonic-gate ++argv; 8667c478bd9Sstevel@tonic-gate audit_flags = *argv; 8677c478bd9Sstevel@tonic-gate do_setumask(auid_str, audit_flags); 8687c478bd9Sstevel@tonic-gate } 8697c478bd9Sstevel@tonic-gate break; 8707c478bd9Sstevel@tonic-gate case AC_ARG_GETFSIZE: 8717c478bd9Sstevel@tonic-gate do_getfsize(); 8727c478bd9Sstevel@tonic-gate break; 8737c478bd9Sstevel@tonic-gate case AC_ARG_SETFSIZE: 8747c478bd9Sstevel@tonic-gate ++argv; 8757c478bd9Sstevel@tonic-gate do_setfsize(*argv); 8767c478bd9Sstevel@tonic-gate break; 8777c478bd9Sstevel@tonic-gate 8787c478bd9Sstevel@tonic-gate default: 8797c478bd9Sstevel@tonic-gate exit_error(gettext("Internal error #2.")); 8807c478bd9Sstevel@tonic-gate break; 8817c478bd9Sstevel@tonic-gate } 8827c478bd9Sstevel@tonic-gate } 8837c478bd9Sstevel@tonic-gate } 8847c478bd9Sstevel@tonic-gate 8857c478bd9Sstevel@tonic-gate /* 8867c478bd9Sstevel@tonic-gate * The returned value is for the global zone unless AUDIT_PERZONE is 8877c478bd9Sstevel@tonic-gate * set. 8887c478bd9Sstevel@tonic-gate */ 8897c478bd9Sstevel@tonic-gate 8907c478bd9Sstevel@tonic-gate static void 8919e3700dfSgww do_chkconf(void) 8927c478bd9Sstevel@tonic-gate { 8937c478bd9Sstevel@tonic-gate register au_event_ent_t *evp; 8947c478bd9Sstevel@tonic-gate au_mask_t pmask; 8957c478bd9Sstevel@tonic-gate char conf_aflags[256]; 8967c478bd9Sstevel@tonic-gate char run_aflags[256]; 8977c478bd9Sstevel@tonic-gate au_stat_t as; 8987c478bd9Sstevel@tonic-gate int class; 8997c478bd9Sstevel@tonic-gate int len; 9007c478bd9Sstevel@tonic-gate struct au_evclass_map cmap; 9017c478bd9Sstevel@tonic-gate 9027c478bd9Sstevel@tonic-gate pmask.am_success = pmask.am_failure = 0; 9037c478bd9Sstevel@tonic-gate eauditon(A_GETSTAT, (caddr_t)&as, 0); 9047c478bd9Sstevel@tonic-gate 9057c478bd9Sstevel@tonic-gate setauevent(); 9069e3700dfSgww if (getauevent() == NULL) { 9077c478bd9Sstevel@tonic-gate (void) exit_error(gettext( 9089e3700dfSgww "NO AUDIT EVENTS: Could not read %s\n."), AUDITEVENTFILE); 9097c478bd9Sstevel@tonic-gate } 9107c478bd9Sstevel@tonic-gate 9117c478bd9Sstevel@tonic-gate setauevent(); 9129e3700dfSgww while ((evp = getauevent()) != NULL) { 9137c478bd9Sstevel@tonic-gate cmap.ec_number = evp->ae_number; 9147c478bd9Sstevel@tonic-gate len = sizeof (struct au_evclass_map); 9159e3700dfSgww if (evp->ae_number <= as.as_numevent) { 9167c478bd9Sstevel@tonic-gate if (auditon(A_GETCLASS, (caddr_t)&cmap, len) == -1) { 917*d0fa49b7STony Nguyen (void) printf("%s(%hu):%s", 9189e3700dfSgww evp->ae_name, evp->ae_number, 9199e3700dfSgww gettext("UNKNOWN EVENT: Could not get " 9209e3700dfSgww "class for event. Configuration may " 9219e3700dfSgww "be bad.\n")); 9227c478bd9Sstevel@tonic-gate } else { 9237c478bd9Sstevel@tonic-gate class = cmap.ec_class; 9247c478bd9Sstevel@tonic-gate if (class != evp->ae_class) { 9257c478bd9Sstevel@tonic-gate conf_aflags[0] = run_aflags[0] = '\0'; 9267c478bd9Sstevel@tonic-gate pmask.am_success = class; 9277c478bd9Sstevel@tonic-gate pmask.am_failure = class; 9287c478bd9Sstevel@tonic-gate (void) getauditflagschar(run_aflags, 9297c478bd9Sstevel@tonic-gate &pmask, 0); 9307c478bd9Sstevel@tonic-gate pmask.am_success = evp->ae_class; 9317c478bd9Sstevel@tonic-gate pmask.am_failure = evp->ae_class; 9327c478bd9Sstevel@tonic-gate (void) getauditflagschar(conf_aflags, 9337c478bd9Sstevel@tonic-gate &pmask, 0); 9347c478bd9Sstevel@tonic-gate 9357c478bd9Sstevel@tonic-gate (void) printf(gettext( 936*d0fa49b7STony Nguyen "%s(%hu): CLASS MISMATCH: " 9379e3700dfSgww "runtime class (%s) != " 9389e3700dfSgww "configured class (%s)\n"), 9399e3700dfSgww evp->ae_name, evp->ae_number, 9409e3700dfSgww NONE(run_aflags), 9419e3700dfSgww NONE(conf_aflags)); 9427c478bd9Sstevel@tonic-gate } 9437c478bd9Sstevel@tonic-gate } 9449e3700dfSgww } 9457c478bd9Sstevel@tonic-gate } 9467c478bd9Sstevel@tonic-gate endauevent(); 9477c478bd9Sstevel@tonic-gate } 9487c478bd9Sstevel@tonic-gate 9497c478bd9Sstevel@tonic-gate /* 9507c478bd9Sstevel@tonic-gate * The returned value is for the global zone unless AUDIT_PERZONE is 9517c478bd9Sstevel@tonic-gate * set. 9527c478bd9Sstevel@tonic-gate */ 9537c478bd9Sstevel@tonic-gate static void 9549e3700dfSgww do_conf(void) 9557c478bd9Sstevel@tonic-gate { 9567c478bd9Sstevel@tonic-gate register au_event_ent_t *evp; 9577c478bd9Sstevel@tonic-gate register int i; 9587c478bd9Sstevel@tonic-gate au_evclass_map_t ec; 9597c478bd9Sstevel@tonic-gate au_stat_t as; 9607c478bd9Sstevel@tonic-gate 9617c478bd9Sstevel@tonic-gate eauditon(A_GETSTAT, (caddr_t)&as, 0); 9627c478bd9Sstevel@tonic-gate 9637c478bd9Sstevel@tonic-gate i = 0; 9647c478bd9Sstevel@tonic-gate setauevent(); 9659e3700dfSgww while ((evp = getauevent()) != NULL) { 9667c478bd9Sstevel@tonic-gate if (evp->ae_number <= as.as_numevent) { 9677c478bd9Sstevel@tonic-gate ++i; 9687c478bd9Sstevel@tonic-gate ec.ec_number = evp->ae_number; 9697c478bd9Sstevel@tonic-gate ec.ec_class = evp->ae_class; 9707c478bd9Sstevel@tonic-gate eauditon(A_SETCLASS, (caddr_t)&ec, (int)sizeof (ec)); 9717c478bd9Sstevel@tonic-gate } 9727c478bd9Sstevel@tonic-gate } 9737c478bd9Sstevel@tonic-gate endauevent(); 9747c478bd9Sstevel@tonic-gate (void) printf(gettext("Configured %d kernel events.\n"), i); 9757c478bd9Sstevel@tonic-gate 9767c478bd9Sstevel@tonic-gate } 9777c478bd9Sstevel@tonic-gate 9787c478bd9Sstevel@tonic-gate /* 9797c478bd9Sstevel@tonic-gate * The returned value is for the global zone unless AUDIT_PERZONE is 9807c478bd9Sstevel@tonic-gate * set. 9817c478bd9Sstevel@tonic-gate */ 9827c478bd9Sstevel@tonic-gate 9837c478bd9Sstevel@tonic-gate static void 9849e3700dfSgww do_chkaconf(void) 9857c478bd9Sstevel@tonic-gate { 9867c478bd9Sstevel@tonic-gate char buf[1024]; 9877c478bd9Sstevel@tonic-gate au_mask_t pmask, kmask; 9887c478bd9Sstevel@tonic-gate 9897c478bd9Sstevel@tonic-gate if (getacna(buf, sizeof (buf)) < 0) { 9907c478bd9Sstevel@tonic-gate (void) fprintf(stderr, 9917c478bd9Sstevel@tonic-gate gettext("bad non-attributable flags in audit_control\n")); 9927c478bd9Sstevel@tonic-gate exit(1); 9937c478bd9Sstevel@tonic-gate } 9947c478bd9Sstevel@tonic-gate 9957c478bd9Sstevel@tonic-gate if (getauditflagsbin(buf, &pmask) < 0) { 9967c478bd9Sstevel@tonic-gate (void) fprintf(stderr, 9977c478bd9Sstevel@tonic-gate gettext("bad audit flag value encountered\n")); 9987c478bd9Sstevel@tonic-gate exit(1); 9997c478bd9Sstevel@tonic-gate } 10007c478bd9Sstevel@tonic-gate 10017c478bd9Sstevel@tonic-gate eauditon(A_GETKMASK, (caddr_t)&kmask, (int)sizeof (kmask)); 10027c478bd9Sstevel@tonic-gate 10037c478bd9Sstevel@tonic-gate if ((pmask.am_success != kmask.am_success) || 10047c478bd9Sstevel@tonic-gate (pmask.am_failure != kmask.am_failure)) { 10057c478bd9Sstevel@tonic-gate char kbuf[2048]; 10067c478bd9Sstevel@tonic-gate if (getauditflagschar(kbuf, &kmask, 0) < 0) { 10077c478bd9Sstevel@tonic-gate (void) fprintf(stderr, 10087c478bd9Sstevel@tonic-gate gettext("bad kernel non-attributable mask\n")); 10097c478bd9Sstevel@tonic-gate exit(1); 10107c478bd9Sstevel@tonic-gate } 10117c478bd9Sstevel@tonic-gate (void) printf(gettext("non-attributable event mismatch ")); 10127c478bd9Sstevel@tonic-gate (void) printf(gettext("audit_control(%s) kernel(%s)\n"), 10139e3700dfSgww buf, kbuf); 10147c478bd9Sstevel@tonic-gate } 10157c478bd9Sstevel@tonic-gate } 10167c478bd9Sstevel@tonic-gate 10177c478bd9Sstevel@tonic-gate /* 10187c478bd9Sstevel@tonic-gate * The returned value is for the global zone unless AUDIT_PERZONE is 10197c478bd9Sstevel@tonic-gate * set. 10207c478bd9Sstevel@tonic-gate */ 10217c478bd9Sstevel@tonic-gate 10227c478bd9Sstevel@tonic-gate static void 10239e3700dfSgww do_aconf(void) 10247c478bd9Sstevel@tonic-gate { 10257c478bd9Sstevel@tonic-gate char buf[2048]; 10267c478bd9Sstevel@tonic-gate au_mask_t pmask; 10277c478bd9Sstevel@tonic-gate 10287c478bd9Sstevel@tonic-gate if (getacna(buf, sizeof (buf)) < 0) { 10297c478bd9Sstevel@tonic-gate (void) fprintf(stderr, 10307c478bd9Sstevel@tonic-gate gettext("bad non-attributable flags in audit_control\n")); 10317c478bd9Sstevel@tonic-gate exit(1); 10327c478bd9Sstevel@tonic-gate } 10337c478bd9Sstevel@tonic-gate 10347c478bd9Sstevel@tonic-gate if (getauditflagsbin(buf, &pmask) < 0) { 10357c478bd9Sstevel@tonic-gate (void) fprintf(stderr, 10367c478bd9Sstevel@tonic-gate gettext("bad audit flag value encountered\n")); 10377c478bd9Sstevel@tonic-gate exit(1); 10387c478bd9Sstevel@tonic-gate } 10397c478bd9Sstevel@tonic-gate 10407c478bd9Sstevel@tonic-gate eauditon(A_SETKMASK, (caddr_t)&pmask, (int)sizeof (pmask)); 10417c478bd9Sstevel@tonic-gate (void) printf(gettext("Configured non-attributable events.\n")); 10427c478bd9Sstevel@tonic-gate } 10437c478bd9Sstevel@tonic-gate 10447c478bd9Sstevel@tonic-gate static void 10459e3700dfSgww do_audit(char *event, char sorf, int retval, char *audit_str) 10467c478bd9Sstevel@tonic-gate { 10477c478bd9Sstevel@tonic-gate int rtn; 10487c478bd9Sstevel@tonic-gate int rd; 10497c478bd9Sstevel@tonic-gate au_event_t event_num; 10507c478bd9Sstevel@tonic-gate au_event_ent_t *evp; 10517c478bd9Sstevel@tonic-gate auditinfo_addr_t ai; 10527c478bd9Sstevel@tonic-gate token_t *tokp; 10537c478bd9Sstevel@tonic-gate 10547c478bd9Sstevel@tonic-gate egetaudit(&ai, sizeof (ai)); 10557c478bd9Sstevel@tonic-gate 10567c478bd9Sstevel@tonic-gate if (strisnum(event)) { 10577c478bd9Sstevel@tonic-gate event_num = (au_event_t)atoi(event); 10587c478bd9Sstevel@tonic-gate evp = egetauevnum(event_num); 10599e3700dfSgww } else { 10607c478bd9Sstevel@tonic-gate evp = egetauevnam(event); 10619e3700dfSgww } 10627c478bd9Sstevel@tonic-gate 10637c478bd9Sstevel@tonic-gate rtn = au_preselect(evp->ae_number, &ai.ai_mask, (int)sorf, 10649e3700dfSgww AU_PRS_USECACHE); 10657c478bd9Sstevel@tonic-gate 10669e3700dfSgww if (rtn == -1) { 1067*d0fa49b7STony Nguyen exit_error("%s\n%s %hu\n", 10689e3700dfSgww gettext("Check audit event configuration."), 10699e3700dfSgww gettext("Could not get audit class for event number"), 10709e3700dfSgww evp->ae_number); 10719e3700dfSgww } 10727c478bd9Sstevel@tonic-gate 10737c478bd9Sstevel@tonic-gate /* record is preselected */ 10747c478bd9Sstevel@tonic-gate if (rtn == 1) { 10759e3700dfSgww if ((rd = au_open()) == -1) { 10769e3700dfSgww exit_error(gettext("Could not get and audit record " 10779e3700dfSgww "descriptor\n")); 10789e3700dfSgww } 10799e3700dfSgww if ((tokp = au_to_me()) == NULL) { 10809e3700dfSgww exit_error(gettext("Could not allocate subject " 10819e3700dfSgww "token\n")); 10829e3700dfSgww } 10839e3700dfSgww if (au_write(rd, tokp) == -1) { 10849e3700dfSgww exit_error(gettext("Could not construct subject " 10859e3700dfSgww "token of audit record\n")); 10869e3700dfSgww } 10879e3700dfSgww if (is_system_labeled()) { 10889e3700dfSgww if ((tokp = au_to_mylabel()) == NULL) { 10899e3700dfSgww exit_error(gettext("Could not allocate " 10909e3700dfSgww "label token\n")); 10919e3700dfSgww } 10929e3700dfSgww if (au_write(rd, tokp) == -1) { 10939e3700dfSgww exit_error(gettext("Could not construct " 10949e3700dfSgww "label token of audit record\n")); 10959e3700dfSgww } 109645916cd2Sjpk } 109745916cd2Sjpk 10989e3700dfSgww if ((tokp = au_to_text(audit_str)) == NULL) 10997c478bd9Sstevel@tonic-gate exit_error(gettext("Could not allocate text token\n")); 11007c478bd9Sstevel@tonic-gate if (au_write(rd, tokp) == -1) 11019e3700dfSgww exit_error(gettext("Could not construct text token of " 11029e3700dfSgww "audit record\n")); 11037c478bd9Sstevel@tonic-gate #ifdef _LP64 11049e3700dfSgww if ((tokp = au_to_return64(sorf, retval)) == NULL) 11057c478bd9Sstevel@tonic-gate #else 11069e3700dfSgww if ((tokp = au_to_return32(sorf, retval)) == NULL) 11077c478bd9Sstevel@tonic-gate #endif 11089e3700dfSgww exit_error(gettext("Could not allocate return " 11099e3700dfSgww "token\n")); 11109e3700dfSgww if (au_write(rd, tokp) == -1) { 11119e3700dfSgww exit_error(gettext("Could not construct return token " 11129e3700dfSgww "of audit record\n")); 11139e3700dfSgww } 11149e3700dfSgww if (au_close(rd, 1, evp->ae_number) == -1) { 11159e3700dfSgww exit_error(gettext("Could not write audit record: " 11169e3700dfSgww "%s\n"), strerror(errno)); 11179e3700dfSgww } 11187c478bd9Sstevel@tonic-gate } 11197c478bd9Sstevel@tonic-gate } 11207c478bd9Sstevel@tonic-gate 11217c478bd9Sstevel@tonic-gate static void 11229e3700dfSgww do_getauid(void) 11237c478bd9Sstevel@tonic-gate { 11247c478bd9Sstevel@tonic-gate au_id_t auid; 11257c478bd9Sstevel@tonic-gate 11267c478bd9Sstevel@tonic-gate egetauid(&auid); 11277c478bd9Sstevel@tonic-gate print_auid(auid); 11287c478bd9Sstevel@tonic-gate } 11297c478bd9Sstevel@tonic-gate 11307c478bd9Sstevel@tonic-gate static void 11319e3700dfSgww do_getaudit(void) 11327c478bd9Sstevel@tonic-gate { 11337c478bd9Sstevel@tonic-gate auditinfo_addr_t ai; 11347c478bd9Sstevel@tonic-gate 11357c478bd9Sstevel@tonic-gate egetaudit(&ai, sizeof (ai)); 11367c478bd9Sstevel@tonic-gate print_auid(ai.ai_auid); 11377c478bd9Sstevel@tonic-gate print_mask(gettext("process preselection mask"), &ai.ai_mask); 11387c478bd9Sstevel@tonic-gate print_tid_ex(&ai.ai_termid); 11397c478bd9Sstevel@tonic-gate print_asid(ai.ai_asid); 11407c478bd9Sstevel@tonic-gate } 11417c478bd9Sstevel@tonic-gate 11427c478bd9Sstevel@tonic-gate static void 11439e3700dfSgww do_getkaudit(void) 11447c478bd9Sstevel@tonic-gate { 11457c478bd9Sstevel@tonic-gate auditinfo_addr_t ai; 11467c478bd9Sstevel@tonic-gate 11477c478bd9Sstevel@tonic-gate egetkaudit(&ai, sizeof (ai)); 11487c478bd9Sstevel@tonic-gate print_auid(ai.ai_auid); 11497c478bd9Sstevel@tonic-gate print_mask(gettext("process preselection mask"), &ai.ai_mask); 11507c478bd9Sstevel@tonic-gate print_tid_ex(&ai.ai_termid); 11517c478bd9Sstevel@tonic-gate print_asid(ai.ai_asid); 11527c478bd9Sstevel@tonic-gate } 11537c478bd9Sstevel@tonic-gate 11547c478bd9Sstevel@tonic-gate /* 11557c478bd9Sstevel@tonic-gate * per zone if AUDIT_PERZONE set, else only in global zone. 11567c478bd9Sstevel@tonic-gate */ 11577c478bd9Sstevel@tonic-gate 11587c478bd9Sstevel@tonic-gate static void 11599e3700dfSgww do_setkaudit(char *t, char *s) 11607c478bd9Sstevel@tonic-gate { 11617c478bd9Sstevel@tonic-gate uint_t type; 11627c478bd9Sstevel@tonic-gate auditinfo_addr_t ai; 11637c478bd9Sstevel@tonic-gate 11647c478bd9Sstevel@tonic-gate egetkaudit(&ai, sizeof (ai)); 11657c478bd9Sstevel@tonic-gate (void) str2type(t, &type); 11667c478bd9Sstevel@tonic-gate (void) str2ipaddr(s, &ai.ai_termid.at_addr[0], type); 11677c478bd9Sstevel@tonic-gate ai.ai_termid.at_type = type; 11687c478bd9Sstevel@tonic-gate esetkaudit(&ai, sizeof (ai)); 11697c478bd9Sstevel@tonic-gate } 11707c478bd9Sstevel@tonic-gate 11717c478bd9Sstevel@tonic-gate /* 11727c478bd9Sstevel@tonic-gate * returns zone-relative root 11737c478bd9Sstevel@tonic-gate */ 11747c478bd9Sstevel@tonic-gate 11757c478bd9Sstevel@tonic-gate static void 11769e3700dfSgww do_getcar(void) 11777c478bd9Sstevel@tonic-gate { 11787c478bd9Sstevel@tonic-gate char path[MAXPATHLEN]; 11797c478bd9Sstevel@tonic-gate 11807c478bd9Sstevel@tonic-gate eauditon(A_GETCAR, (caddr_t)path, (int)sizeof (path)); 11817c478bd9Sstevel@tonic-gate (void) printf(gettext("current active root = %s\n"), path); 11827c478bd9Sstevel@tonic-gate } 11837c478bd9Sstevel@tonic-gate 11847c478bd9Sstevel@tonic-gate /* 11857c478bd9Sstevel@tonic-gate * The returned value is for the global zone unless AUDIT_PERZONE is 11867c478bd9Sstevel@tonic-gate * set. 11877c478bd9Sstevel@tonic-gate */ 11887c478bd9Sstevel@tonic-gate 11897c478bd9Sstevel@tonic-gate static void 11909e3700dfSgww do_getclass(char *event_str) 11917c478bd9Sstevel@tonic-gate { 11927c478bd9Sstevel@tonic-gate au_evclass_map_t ec; 11937c478bd9Sstevel@tonic-gate au_event_ent_t *evp; 11947c478bd9Sstevel@tonic-gate au_event_t event_number; 11957c478bd9Sstevel@tonic-gate char *event_name; 11967c478bd9Sstevel@tonic-gate 11977c478bd9Sstevel@tonic-gate if (strisnum(event_str)) { 11987c478bd9Sstevel@tonic-gate event_number = atol(event_str); 11999e3700dfSgww if ((evp = egetauevnum(event_number)) != NULL) { 12007c478bd9Sstevel@tonic-gate event_number = evp->ae_number; 12017c478bd9Sstevel@tonic-gate event_name = evp->ae_name; 12029e3700dfSgww } else { 12037c478bd9Sstevel@tonic-gate event_name = gettext("unknown"); 12049e3700dfSgww } 12057c478bd9Sstevel@tonic-gate } else { 12067c478bd9Sstevel@tonic-gate event_name = event_str; 12079e3700dfSgww if ((evp = egetauevnam(event_str)) != NULL) { 12087c478bd9Sstevel@tonic-gate event_number = evp->ae_number; 12099e3700dfSgww } 12107c478bd9Sstevel@tonic-gate } 12117c478bd9Sstevel@tonic-gate 12127c478bd9Sstevel@tonic-gate ec.ec_number = event_number; 12137c478bd9Sstevel@tonic-gate eauditon(A_GETCLASS, (caddr_t)&ec, 0); 12147c478bd9Sstevel@tonic-gate 1215*d0fa49b7STony Nguyen (void) printf(gettext("audit class mask for event %s(%hu) = 0x%x\n"), 12169e3700dfSgww event_name, event_number, ec.ec_class); 12177c478bd9Sstevel@tonic-gate } 12187c478bd9Sstevel@tonic-gate 12197c478bd9Sstevel@tonic-gate /* 12207c478bd9Sstevel@tonic-gate * The returned value is for the global zone unless AUDIT_PERZONE is 12217c478bd9Sstevel@tonic-gate * set. (AUC_DISABLED is always global, the other states are per zone 12227c478bd9Sstevel@tonic-gate * if AUDIT_PERZONE is set) 12237c478bd9Sstevel@tonic-gate */ 12247c478bd9Sstevel@tonic-gate 12257c478bd9Sstevel@tonic-gate static void 12269e3700dfSgww do_getcond(void) 12277c478bd9Sstevel@tonic-gate { 12289e3700dfSgww (void) printf(gettext("audit condition = %s\n"), cond2str()); 12297c478bd9Sstevel@tonic-gate } 12307c478bd9Sstevel@tonic-gate 12317c478bd9Sstevel@tonic-gate /* 12327c478bd9Sstevel@tonic-gate * returned path is relative to zone root 12337c478bd9Sstevel@tonic-gate */ 12347c478bd9Sstevel@tonic-gate 12357c478bd9Sstevel@tonic-gate static void 12369e3700dfSgww do_getcwd(void) 12377c478bd9Sstevel@tonic-gate { 12387c478bd9Sstevel@tonic-gate char path[MAXPATHLEN]; 12397c478bd9Sstevel@tonic-gate 12407c478bd9Sstevel@tonic-gate eauditon(A_GETCWD, (caddr_t)path, (int)sizeof (path)); 12417c478bd9Sstevel@tonic-gate (void) printf(gettext("current working directory = %s\n"), path); 12427c478bd9Sstevel@tonic-gate } 12437c478bd9Sstevel@tonic-gate 12447c478bd9Sstevel@tonic-gate /* 12457c478bd9Sstevel@tonic-gate * The returned value is for the global zone unless AUDIT_PERZONE is 12467c478bd9Sstevel@tonic-gate * set. 12477c478bd9Sstevel@tonic-gate */ 12487c478bd9Sstevel@tonic-gate 12497c478bd9Sstevel@tonic-gate static void 12509e3700dfSgww do_getkmask(void) 12517c478bd9Sstevel@tonic-gate { 12527c478bd9Sstevel@tonic-gate au_mask_t pmask; 12537c478bd9Sstevel@tonic-gate 12547c478bd9Sstevel@tonic-gate eauditon(A_GETKMASK, (caddr_t)&pmask, (int)sizeof (pmask)); 12557c478bd9Sstevel@tonic-gate print_mask(gettext("audit flags for non-attributable events"), &pmask); 12567c478bd9Sstevel@tonic-gate } 12577c478bd9Sstevel@tonic-gate 12587c478bd9Sstevel@tonic-gate /* 12597c478bd9Sstevel@tonic-gate * The returned value is for the global zone unless AUDIT_PERZONE is 12607c478bd9Sstevel@tonic-gate * set. (some policies can only be set from the global zone, but all 12617c478bd9Sstevel@tonic-gate * can be read from anywhere.) 12627c478bd9Sstevel@tonic-gate */ 12637c478bd9Sstevel@tonic-gate 12647c478bd9Sstevel@tonic-gate static void 12659e3700dfSgww do_getpolicy(void) 12667c478bd9Sstevel@tonic-gate { 12677c478bd9Sstevel@tonic-gate char policy_str[1024]; 12687c478bd9Sstevel@tonic-gate uint_t policy; 12697c478bd9Sstevel@tonic-gate 12707c478bd9Sstevel@tonic-gate eauditon(A_GETPOLICY, (caddr_t)&policy, 0); 12717c478bd9Sstevel@tonic-gate (void) policy2str(policy, policy_str, sizeof (policy_str)); 12727c478bd9Sstevel@tonic-gate (void) printf(gettext("audit policies = %s\n"), policy_str); 12737c478bd9Sstevel@tonic-gate } 12747c478bd9Sstevel@tonic-gate 12757c478bd9Sstevel@tonic-gate static void 12769e3700dfSgww do_getpinfo(char *pid_str) 12777c478bd9Sstevel@tonic-gate { 12787c478bd9Sstevel@tonic-gate struct auditpinfo_addr ap; 12797c478bd9Sstevel@tonic-gate 12807c478bd9Sstevel@tonic-gate if (strisnum(pid_str)) 12817c478bd9Sstevel@tonic-gate ap.ap_pid = (pid_t)atoi(pid_str); 12827c478bd9Sstevel@tonic-gate else 12837c478bd9Sstevel@tonic-gate exit_usage(1); 12847c478bd9Sstevel@tonic-gate 12857c478bd9Sstevel@tonic-gate eauditon(A_GETPINFO_ADDR, (caddr_t)&ap, sizeof (ap)); 12867c478bd9Sstevel@tonic-gate 12877c478bd9Sstevel@tonic-gate print_auid(ap.ap_auid); 12887c478bd9Sstevel@tonic-gate print_mask(gettext("process preselection mask"), &(ap.ap_mask)); 12897c478bd9Sstevel@tonic-gate print_tid_ex(&(ap.ap_termid)); 12907c478bd9Sstevel@tonic-gate print_asid(ap.ap_asid); 12917c478bd9Sstevel@tonic-gate } 12927c478bd9Sstevel@tonic-gate 12937c478bd9Sstevel@tonic-gate /* 12947c478bd9Sstevel@tonic-gate * The returned value is for the global zone unless AUDIT_PERZONE is 12957c478bd9Sstevel@tonic-gate * set. 12967c478bd9Sstevel@tonic-gate */ 12977c478bd9Sstevel@tonic-gate 12987c478bd9Sstevel@tonic-gate static void 12999e3700dfSgww do_getqbufsz(void) 13007c478bd9Sstevel@tonic-gate { 13017c478bd9Sstevel@tonic-gate struct au_qctrl qctrl; 13027c478bd9Sstevel@tonic-gate 13037c478bd9Sstevel@tonic-gate eauditon(A_GETQCTRL, (caddr_t)&qctrl, 0); 13047c478bd9Sstevel@tonic-gate (void) printf(gettext("audit queue buffer size (bytes) = %ld\n"), 13057c478bd9Sstevel@tonic-gate qctrl.aq_bufsz); 13067c478bd9Sstevel@tonic-gate } 13077c478bd9Sstevel@tonic-gate 13087c478bd9Sstevel@tonic-gate /* 13097c478bd9Sstevel@tonic-gate * The returned value is for the global zone unless AUDIT_PERZONE is 13107c478bd9Sstevel@tonic-gate * set. 13117c478bd9Sstevel@tonic-gate */ 13127c478bd9Sstevel@tonic-gate 13137c478bd9Sstevel@tonic-gate static void 13149e3700dfSgww do_getqctrl(void) 13157c478bd9Sstevel@tonic-gate { 13167c478bd9Sstevel@tonic-gate struct au_qctrl qctrl; 13177c478bd9Sstevel@tonic-gate 13187c478bd9Sstevel@tonic-gate eauditon(A_GETQCTRL, (caddr_t)&qctrl, 0); 13197c478bd9Sstevel@tonic-gate (void) printf(gettext("audit queue hiwater mark (records) = %ld\n"), 13209e3700dfSgww qctrl.aq_hiwater); 13217c478bd9Sstevel@tonic-gate (void) printf(gettext("audit queue lowater mark (records) = %ld\n"), 13229e3700dfSgww qctrl.aq_lowater); 13237c478bd9Sstevel@tonic-gate (void) printf(gettext("audit queue buffer size (bytes) = %ld\n"), 13249e3700dfSgww qctrl.aq_bufsz); 13257c478bd9Sstevel@tonic-gate (void) printf(gettext("audit queue delay (ticks) = %ld\n"), 13269e3700dfSgww qctrl.aq_delay); 13277c478bd9Sstevel@tonic-gate } 13287c478bd9Sstevel@tonic-gate 13297c478bd9Sstevel@tonic-gate /* 13307c478bd9Sstevel@tonic-gate * The returned value is for the global zone unless AUDIT_PERZONE is 13317c478bd9Sstevel@tonic-gate * set. 13327c478bd9Sstevel@tonic-gate */ 13337c478bd9Sstevel@tonic-gate 13347c478bd9Sstevel@tonic-gate static void 13359e3700dfSgww do_getqdelay(void) 13367c478bd9Sstevel@tonic-gate { 13377c478bd9Sstevel@tonic-gate struct au_qctrl qctrl; 13387c478bd9Sstevel@tonic-gate 13397c478bd9Sstevel@tonic-gate eauditon(A_GETQCTRL, (caddr_t)&qctrl, 0); 13407c478bd9Sstevel@tonic-gate (void) printf(gettext("audit queue delay (ticks) = %ld\n"), 13419e3700dfSgww qctrl.aq_delay); 13427c478bd9Sstevel@tonic-gate } 13437c478bd9Sstevel@tonic-gate 13447c478bd9Sstevel@tonic-gate /* 13457c478bd9Sstevel@tonic-gate * The returned value is for the global zone unless AUDIT_PERZONE is 13467c478bd9Sstevel@tonic-gate * set. 13477c478bd9Sstevel@tonic-gate */ 13487c478bd9Sstevel@tonic-gate 13497c478bd9Sstevel@tonic-gate static void 13509e3700dfSgww do_getqhiwater(void) 13517c478bd9Sstevel@tonic-gate { 13527c478bd9Sstevel@tonic-gate struct au_qctrl qctrl; 13537c478bd9Sstevel@tonic-gate 13547c478bd9Sstevel@tonic-gate eauditon(A_GETQCTRL, (caddr_t)&qctrl, 0); 13557c478bd9Sstevel@tonic-gate (void) printf(gettext("audit queue hiwater mark (records) = %ld\n"), 13569e3700dfSgww qctrl.aq_hiwater); 13577c478bd9Sstevel@tonic-gate } 13587c478bd9Sstevel@tonic-gate 13597c478bd9Sstevel@tonic-gate /* 13607c478bd9Sstevel@tonic-gate * The returned value is for the global zone unless AUDIT_PERZONE is 13617c478bd9Sstevel@tonic-gate * set. 13627c478bd9Sstevel@tonic-gate */ 13637c478bd9Sstevel@tonic-gate 13647c478bd9Sstevel@tonic-gate static void 13659e3700dfSgww do_getqlowater(void) 13667c478bd9Sstevel@tonic-gate { 13677c478bd9Sstevel@tonic-gate struct au_qctrl qctrl; 13687c478bd9Sstevel@tonic-gate 13697c478bd9Sstevel@tonic-gate eauditon(A_GETQCTRL, (caddr_t)&qctrl, 0); 13707c478bd9Sstevel@tonic-gate (void) printf(gettext("audit queue lowater mark (records) = %ld\n"), 13717c478bd9Sstevel@tonic-gate qctrl.aq_lowater); 13727c478bd9Sstevel@tonic-gate } 13737c478bd9Sstevel@tonic-gate 13747c478bd9Sstevel@tonic-gate static void 13759e3700dfSgww do_getasid(void) 13767c478bd9Sstevel@tonic-gate { 13777c478bd9Sstevel@tonic-gate auditinfo_addr_t ai; 13787c478bd9Sstevel@tonic-gate 13797c478bd9Sstevel@tonic-gate if (getaudit_addr(&ai, sizeof (ai))) { 13807c478bd9Sstevel@tonic-gate exit_error(gettext("getaudit_addr(2) failed")); 13817c478bd9Sstevel@tonic-gate } 13827c478bd9Sstevel@tonic-gate print_asid(ai.ai_asid); 13837c478bd9Sstevel@tonic-gate } 13847c478bd9Sstevel@tonic-gate 13857c478bd9Sstevel@tonic-gate /* 13867c478bd9Sstevel@tonic-gate * The stats are for the entire system unless AUDIT_PERZONE is set. 13877c478bd9Sstevel@tonic-gate */ 13887c478bd9Sstevel@tonic-gate 13897c478bd9Sstevel@tonic-gate static void 13909e3700dfSgww do_getstat(void) 13917c478bd9Sstevel@tonic-gate { 13927c478bd9Sstevel@tonic-gate au_stat_t as; 13939e3700dfSgww int offset[12]; /* used to line the header up correctly */ 13949e3700dfSgww char buf[512]; 13957c478bd9Sstevel@tonic-gate 13967c478bd9Sstevel@tonic-gate eauditon(A_GETSTAT, (caddr_t)&as, 0); 13979e3700dfSgww (void) sprintf(buf, "%4lu %n%4lu %n%4lu %n%4lu %n%4lu %n%4lu %n%4lu " 13989e3700dfSgww "%n%4lu %n%4lu %n%4lu %n%4lu %n%4lu%n", 13999e3700dfSgww (ulong_t)as.as_generated, &(offset[0]), 14009e3700dfSgww (ulong_t)as.as_nonattrib, &(offset[1]), 14019e3700dfSgww (ulong_t)as.as_kernel, &(offset[2]), 14029e3700dfSgww (ulong_t)as.as_audit, &(offset[3]), 14039e3700dfSgww (ulong_t)as.as_auditctl, &(offset[4]), 14049e3700dfSgww (ulong_t)as.as_enqueue, &(offset[5]), 14059e3700dfSgww (ulong_t)as.as_written, &(offset[6]), 14069e3700dfSgww (ulong_t)as.as_wblocked, &(offset[7]), 14079e3700dfSgww (ulong_t)as.as_rblocked, &(offset[8]), 14089e3700dfSgww (ulong_t)as.as_dropped, &(offset[9]), 14099e3700dfSgww (ulong_t)as.as_totalsize / ONEK, &(offset[10]), 14109e3700dfSgww (ulong_t)as.as_memused / ONEK, &(offset[11])); 14119e3700dfSgww 14129e3700dfSgww /* 14139e3700dfSgww * TRANSLATION_NOTE 14149e3700dfSgww * Print a properly aligned header. 14159e3700dfSgww */ 14169e3700dfSgww (void) printf("%*s %*s %*s %*s %*s %*s %*s %*s %*s %*s %*s %*s\n", 14179e3700dfSgww offset[0] - 1, gettext("gen"), 14189e3700dfSgww offset[1] - offset[0] -1, gettext("nona"), 14199e3700dfSgww offset[2] - offset[1] -1, gettext("kern"), 14209e3700dfSgww offset[3] - offset[2] -1, gettext("aud"), 14219e3700dfSgww offset[4] - offset[3] -1, gettext("ctl"), 14229e3700dfSgww offset[5] - offset[4] -1, gettext("enq"), 14239e3700dfSgww offset[6] - offset[5] -1, gettext("wrtn"), 14249e3700dfSgww offset[7] - offset[6] -1, gettext("wblk"), 14259e3700dfSgww offset[8] - offset[7] -1, gettext("rblk"), 14269e3700dfSgww offset[9] - offset[8] -1, gettext("drop"), 14279e3700dfSgww offset[10] - offset[9] -1, gettext("tot"), 14289e3700dfSgww offset[11] - offset[10], gettext("mem")); 14299e3700dfSgww 14309e3700dfSgww (void) printf("%s\n", buf); 14317c478bd9Sstevel@tonic-gate } 14327c478bd9Sstevel@tonic-gate 14337c478bd9Sstevel@tonic-gate static void 14349e3700dfSgww do_gettermid(void) 14357c478bd9Sstevel@tonic-gate { 14367c478bd9Sstevel@tonic-gate auditinfo_addr_t ai; 14377c478bd9Sstevel@tonic-gate 14387c478bd9Sstevel@tonic-gate if (getaudit_addr(&ai, sizeof (ai))) { 14397c478bd9Sstevel@tonic-gate exit_error(gettext("getaudit_addr(2) failed")); 14407c478bd9Sstevel@tonic-gate } 14417c478bd9Sstevel@tonic-gate print_tid_ex(&ai.ai_termid); 14427c478bd9Sstevel@tonic-gate } 14437c478bd9Sstevel@tonic-gate 14447c478bd9Sstevel@tonic-gate /* 14457c478bd9Sstevel@tonic-gate * The returned value is for the global zone unless AUDIT_PERZONE is 14467c478bd9Sstevel@tonic-gate * set. 14477c478bd9Sstevel@tonic-gate */ 14487c478bd9Sstevel@tonic-gate 14497c478bd9Sstevel@tonic-gate static void 14509e3700dfSgww do_getfsize(void) 14517c478bd9Sstevel@tonic-gate { 14527c478bd9Sstevel@tonic-gate au_fstat_t fstat; 14537c478bd9Sstevel@tonic-gate 14547c478bd9Sstevel@tonic-gate eauditon(A_GETFSIZE, (caddr_t)&fstat, 0); 14557c478bd9Sstevel@tonic-gate (void) printf(gettext("Maximum file size %d, current file size %d\n"), 14569e3700dfSgww fstat.af_filesz, fstat.af_currsz); 14577c478bd9Sstevel@tonic-gate } 14587c478bd9Sstevel@tonic-gate 14597c478bd9Sstevel@tonic-gate /* 14607c478bd9Sstevel@tonic-gate * The returned value is for the global zone unless AUDIT_PERZONE is 14617c478bd9Sstevel@tonic-gate * set. 14627c478bd9Sstevel@tonic-gate */ 14637c478bd9Sstevel@tonic-gate 14647c478bd9Sstevel@tonic-gate static void 14659e3700dfSgww do_lsevent(void) 14667c478bd9Sstevel@tonic-gate { 14677c478bd9Sstevel@tonic-gate register au_event_ent_t *evp; 14687c478bd9Sstevel@tonic-gate au_mask_t pmask; 14697c478bd9Sstevel@tonic-gate char auflags[256]; 14707c478bd9Sstevel@tonic-gate 14717c478bd9Sstevel@tonic-gate setauevent(); 14729e3700dfSgww if (getauevent() == NULL) { 14737c478bd9Sstevel@tonic-gate (void) exit_error(gettext( 14749e3700dfSgww "NO AUDIT EVENTS: Could not read %s\n."), AUDITEVENTFILE); 14757c478bd9Sstevel@tonic-gate } 14767c478bd9Sstevel@tonic-gate 14777c478bd9Sstevel@tonic-gate setauevent(); 14789e3700dfSgww while ((evp = getauevent()) != NULL) { 14797c478bd9Sstevel@tonic-gate pmask.am_success = pmask.am_failure = evp->ae_class; 14807c478bd9Sstevel@tonic-gate if (getauditflagschar(auflags, &pmask, 0) == -1) 14817c478bd9Sstevel@tonic-gate (void) strcpy(auflags, "unknown"); 1482*d0fa49b7STony Nguyen (void) printf("%-30s %5hu %s %s\n", 14839e3700dfSgww evp->ae_name, evp->ae_number, auflags, evp->ae_desc); 14847c478bd9Sstevel@tonic-gate } 14857c478bd9Sstevel@tonic-gate endauevent(); 14867c478bd9Sstevel@tonic-gate } 14877c478bd9Sstevel@tonic-gate 14887c478bd9Sstevel@tonic-gate /* 14897c478bd9Sstevel@tonic-gate * The returned value is for the global zone unless AUDIT_PERZONE is 14907c478bd9Sstevel@tonic-gate * set. 14917c478bd9Sstevel@tonic-gate */ 14927c478bd9Sstevel@tonic-gate 14937c478bd9Sstevel@tonic-gate static void 14949e3700dfSgww do_lspolicy(void) 14957c478bd9Sstevel@tonic-gate { 14967c478bd9Sstevel@tonic-gate int i; 14977c478bd9Sstevel@tonic-gate 14987c478bd9Sstevel@tonic-gate /* 14997c478bd9Sstevel@tonic-gate * TRANSLATION_NOTE 15007c478bd9Sstevel@tonic-gate * Print a properly aligned header. 15017c478bd9Sstevel@tonic-gate */ 15027c478bd9Sstevel@tonic-gate (void) printf(gettext("policy string description:\n")); 150345916cd2Sjpk for (i = 0; i < POLICY_TBL_SZ; i++) { 150445916cd2Sjpk (void) printf("%-17s%s\n", policy_table[i].policy_str, 150545916cd2Sjpk gettext(policy_table[i].policy_desc)); 150645916cd2Sjpk } 15077c478bd9Sstevel@tonic-gate } 15087c478bd9Sstevel@tonic-gate 15097c478bd9Sstevel@tonic-gate static void 15109e3700dfSgww do_setasid(char *sid_str, char **argv) 15117c478bd9Sstevel@tonic-gate { 15127c478bd9Sstevel@tonic-gate struct auditinfo_addr ai; 15137c478bd9Sstevel@tonic-gate 15147c478bd9Sstevel@tonic-gate if (getaudit_addr(&ai, sizeof (ai))) { 15157c478bd9Sstevel@tonic-gate exit_error(gettext("getaudit_addr(2) failed")); 15167c478bd9Sstevel@tonic-gate } 15177c478bd9Sstevel@tonic-gate ai.ai_asid = (au_asid_t)atol(sid_str); 15187c478bd9Sstevel@tonic-gate if (setaudit_addr(&ai, sizeof (ai))) { 15197c478bd9Sstevel@tonic-gate exit_error(gettext("setaudit_addr(2) failed")); 15207c478bd9Sstevel@tonic-gate } 15217c478bd9Sstevel@tonic-gate execit(argv); 15227c478bd9Sstevel@tonic-gate } 15237c478bd9Sstevel@tonic-gate 15247c478bd9Sstevel@tonic-gate static void 15259e3700dfSgww do_setaudit(char *user_str, char *mask_str, char *tid_str, char *sid_str, 15269e3700dfSgww char **argv) 15277c478bd9Sstevel@tonic-gate { 15287c478bd9Sstevel@tonic-gate auditinfo_addr_t ai; 15297c478bd9Sstevel@tonic-gate 15307c478bd9Sstevel@tonic-gate ai.ai_auid = (au_id_t)get_user_id(user_str); 15317c478bd9Sstevel@tonic-gate str2mask(mask_str, &ai.ai_mask), 15327c478bd9Sstevel@tonic-gate str2tid(tid_str, &ai.ai_termid); 15337c478bd9Sstevel@tonic-gate ai.ai_asid = (au_asid_t)atol(sid_str); 15347c478bd9Sstevel@tonic-gate 15357c478bd9Sstevel@tonic-gate esetaudit(&ai, sizeof (ai)); 15367c478bd9Sstevel@tonic-gate execit(argv); 15377c478bd9Sstevel@tonic-gate } 15387c478bd9Sstevel@tonic-gate 15397c478bd9Sstevel@tonic-gate static void 15409e3700dfSgww do_setauid(char *user, char **argv) 15417c478bd9Sstevel@tonic-gate { 15427c478bd9Sstevel@tonic-gate au_id_t auid; 15437c478bd9Sstevel@tonic-gate 15447c478bd9Sstevel@tonic-gate auid = get_user_id(user); 15457c478bd9Sstevel@tonic-gate esetauid(&auid); 15467c478bd9Sstevel@tonic-gate execit(argv); 15477c478bd9Sstevel@tonic-gate } 15487c478bd9Sstevel@tonic-gate 15497c478bd9Sstevel@tonic-gate static void 15509e3700dfSgww do_setpmask(char *pid_str, char *audit_flags) 15517c478bd9Sstevel@tonic-gate { 15527c478bd9Sstevel@tonic-gate struct auditpinfo ap; 15537c478bd9Sstevel@tonic-gate 15547c478bd9Sstevel@tonic-gate if (strisnum(pid_str)) 15557c478bd9Sstevel@tonic-gate ap.ap_pid = (pid_t)atoi(pid_str); 15567c478bd9Sstevel@tonic-gate else 15577c478bd9Sstevel@tonic-gate exit_usage(1); 15587c478bd9Sstevel@tonic-gate 15597c478bd9Sstevel@tonic-gate str2mask(audit_flags, &ap.ap_mask); 15607c478bd9Sstevel@tonic-gate 15617c478bd9Sstevel@tonic-gate eauditon(A_SETPMASK, (caddr_t)&ap, (int)sizeof (ap)); 15627c478bd9Sstevel@tonic-gate } 15637c478bd9Sstevel@tonic-gate 15647c478bd9Sstevel@tonic-gate static void 15659e3700dfSgww do_setsmask(char *asid_str, char *audit_flags) 15667c478bd9Sstevel@tonic-gate { 15677c478bd9Sstevel@tonic-gate struct auditinfo ainfo; 15687c478bd9Sstevel@tonic-gate 15697c478bd9Sstevel@tonic-gate if (strisnum(asid_str)) 1570*d0fa49b7STony Nguyen ainfo.ai_asid = (au_asid_t)atoi(asid_str); 15717c478bd9Sstevel@tonic-gate else 15727c478bd9Sstevel@tonic-gate exit_usage(1); 15737c478bd9Sstevel@tonic-gate 15747c478bd9Sstevel@tonic-gate str2mask(audit_flags, &ainfo.ai_mask); 15757c478bd9Sstevel@tonic-gate 15767c478bd9Sstevel@tonic-gate eauditon(A_SETSMASK, (caddr_t)&ainfo, (int)sizeof (ainfo)); 15777c478bd9Sstevel@tonic-gate } 15787c478bd9Sstevel@tonic-gate 15797c478bd9Sstevel@tonic-gate static void 15809e3700dfSgww do_setumask(char *auid_str, char *audit_flags) 15817c478bd9Sstevel@tonic-gate { 15827c478bd9Sstevel@tonic-gate struct auditinfo ainfo; 15837c478bd9Sstevel@tonic-gate 15847c478bd9Sstevel@tonic-gate if (strisnum(auid_str)) 1585*d0fa49b7STony Nguyen ainfo.ai_auid = (au_id_t)atoi(auid_str); 15867c478bd9Sstevel@tonic-gate else 15877c478bd9Sstevel@tonic-gate exit_usage(1); 15887c478bd9Sstevel@tonic-gate 15897c478bd9Sstevel@tonic-gate str2mask(audit_flags, &ainfo.ai_mask); 15907c478bd9Sstevel@tonic-gate 15917c478bd9Sstevel@tonic-gate eauditon(A_SETUMASK, (caddr_t)&ainfo, (int)sizeof (ainfo)); 15927c478bd9Sstevel@tonic-gate } 15937c478bd9Sstevel@tonic-gate 15947c478bd9Sstevel@tonic-gate /* 15957c478bd9Sstevel@tonic-gate * local zone use is valid if AUDIT_PERZONE is set, otherwise the 15967c478bd9Sstevel@tonic-gate * syscall returns EPERM. 15977c478bd9Sstevel@tonic-gate */ 15987c478bd9Sstevel@tonic-gate 15997c478bd9Sstevel@tonic-gate static void 16009e3700dfSgww do_setstat(void) 16017c478bd9Sstevel@tonic-gate { 16027c478bd9Sstevel@tonic-gate au_stat_t as; 16037c478bd9Sstevel@tonic-gate 16047c478bd9Sstevel@tonic-gate as.as_audit = (uint_t)-1; 16057c478bd9Sstevel@tonic-gate as.as_auditctl = (uint_t)-1; 16067c478bd9Sstevel@tonic-gate as.as_dropped = (uint_t)-1; 16077c478bd9Sstevel@tonic-gate as.as_enqueue = (uint_t)-1; 16087c478bd9Sstevel@tonic-gate as.as_generated = (uint_t)-1; 16097c478bd9Sstevel@tonic-gate as.as_kernel = (uint_t)-1; 16107c478bd9Sstevel@tonic-gate as.as_nonattrib = (uint_t)-1; 16117c478bd9Sstevel@tonic-gate as.as_rblocked = (uint_t)-1; 16127c478bd9Sstevel@tonic-gate as.as_totalsize = (uint_t)-1; 16137c478bd9Sstevel@tonic-gate as.as_wblocked = (uint_t)-1; 16147c478bd9Sstevel@tonic-gate as.as_written = (uint_t)-1; 16157c478bd9Sstevel@tonic-gate 16167c478bd9Sstevel@tonic-gate eauditon(A_SETSTAT, (caddr_t)&as, (int)sizeof (as)); 16179e3700dfSgww (void) printf("%s\n", gettext("audit stats reset")); 16187c478bd9Sstevel@tonic-gate } 16197c478bd9Sstevel@tonic-gate 16207c478bd9Sstevel@tonic-gate /* 16217c478bd9Sstevel@tonic-gate * AUDIT_PERZONE set: valid in all zones 16227c478bd9Sstevel@tonic-gate * AUDIT_PERZONE not set: valid in global zone only 16237c478bd9Sstevel@tonic-gate */ 16247c478bd9Sstevel@tonic-gate 16257c478bd9Sstevel@tonic-gate static void 16269e3700dfSgww do_setclass(char *event_str, char *audit_flags) 16277c478bd9Sstevel@tonic-gate { 16287c478bd9Sstevel@tonic-gate au_event_t event; 16297c478bd9Sstevel@tonic-gate int mask; 16307c478bd9Sstevel@tonic-gate au_mask_t pmask; 16317c478bd9Sstevel@tonic-gate au_evclass_map_t ec; 16327c478bd9Sstevel@tonic-gate au_event_ent_t *evp; 16337c478bd9Sstevel@tonic-gate 16347c478bd9Sstevel@tonic-gate if (strisnum(event_str)) 16357c478bd9Sstevel@tonic-gate event = (uint_t)atol(event_str); 16367c478bd9Sstevel@tonic-gate else { 16379e3700dfSgww if ((evp = egetauevnam(event_str)) != NULL) 16387c478bd9Sstevel@tonic-gate event = evp->ae_number; 16397c478bd9Sstevel@tonic-gate } 16407c478bd9Sstevel@tonic-gate 16417c478bd9Sstevel@tonic-gate if (strisnum(audit_flags)) 16427c478bd9Sstevel@tonic-gate mask = atoi(audit_flags); 16437c478bd9Sstevel@tonic-gate else { 16447c478bd9Sstevel@tonic-gate str2mask(audit_flags, &pmask); 16457c478bd9Sstevel@tonic-gate mask = pmask.am_success | pmask.am_failure; 16467c478bd9Sstevel@tonic-gate } 16477c478bd9Sstevel@tonic-gate 16487c478bd9Sstevel@tonic-gate ec.ec_number = event; 16497c478bd9Sstevel@tonic-gate ec.ec_class = mask; 16507c478bd9Sstevel@tonic-gate eauditon(A_SETCLASS, (caddr_t)&ec, (int)sizeof (ec)); 16517c478bd9Sstevel@tonic-gate } 16527c478bd9Sstevel@tonic-gate 16537c478bd9Sstevel@tonic-gate /* 16547c478bd9Sstevel@tonic-gate * AUDIT_PERZONE set: valid in all zones 16557c478bd9Sstevel@tonic-gate * AUDIT_PERZONE not set: valid in global zone only 16567c478bd9Sstevel@tonic-gate */ 16577c478bd9Sstevel@tonic-gate 16587c478bd9Sstevel@tonic-gate static void 16599e3700dfSgww do_setkmask(char *audit_flags) 16607c478bd9Sstevel@tonic-gate { 16617c478bd9Sstevel@tonic-gate au_mask_t pmask; 16627c478bd9Sstevel@tonic-gate 16637c478bd9Sstevel@tonic-gate str2mask(audit_flags, &pmask); 16647c478bd9Sstevel@tonic-gate eauditon(A_SETKMASK, (caddr_t)&pmask, (int)sizeof (pmask)); 16657c478bd9Sstevel@tonic-gate print_mask(gettext("audit flags for non-attributable events"), &pmask); 16667c478bd9Sstevel@tonic-gate } 16677c478bd9Sstevel@tonic-gate 16687c478bd9Sstevel@tonic-gate /* 16697c478bd9Sstevel@tonic-gate * ahlt and perzone are global zone only; the other policies are valid 16707c478bd9Sstevel@tonic-gate * in a local zone if AUDIT_PERZONE is set. The kernel insures that 16717c478bd9Sstevel@tonic-gate * a local zone can't change ahlt and perzone (EINVAL). 16727c478bd9Sstevel@tonic-gate */ 16737c478bd9Sstevel@tonic-gate 16747c478bd9Sstevel@tonic-gate static void 16759e3700dfSgww do_setpolicy(char *policy_str) 16767c478bd9Sstevel@tonic-gate { 16777c478bd9Sstevel@tonic-gate uint_t policy; 16787c478bd9Sstevel@tonic-gate 16797c478bd9Sstevel@tonic-gate switch (str2policy(policy_str, &policy)) { 16807c478bd9Sstevel@tonic-gate case 2: 16817c478bd9Sstevel@tonic-gate exit_error(gettext( 16827c478bd9Sstevel@tonic-gate "policy (%s) invalid in a local zone."), 16837c478bd9Sstevel@tonic-gate policy_str); 16847c478bd9Sstevel@tonic-gate break; 16857c478bd9Sstevel@tonic-gate default: 16867c478bd9Sstevel@tonic-gate exit_error(gettext( 16877c478bd9Sstevel@tonic-gate "Invalid policy (%s) specified."), 16887c478bd9Sstevel@tonic-gate policy_str); 16897c478bd9Sstevel@tonic-gate break; 16907c478bd9Sstevel@tonic-gate case 0: 16917c478bd9Sstevel@tonic-gate eauditon(A_SETPOLICY, (caddr_t)&policy, 0); 16927c478bd9Sstevel@tonic-gate break; 16937c478bd9Sstevel@tonic-gate } 16947c478bd9Sstevel@tonic-gate } 16957c478bd9Sstevel@tonic-gate 16967c478bd9Sstevel@tonic-gate /* 16977c478bd9Sstevel@tonic-gate * AUDIT_PERZONE set: valid in all zones 16987c478bd9Sstevel@tonic-gate * AUDIT_PERZONE not set: valid in global zone only 16997c478bd9Sstevel@tonic-gate */ 17007c478bd9Sstevel@tonic-gate 17017c478bd9Sstevel@tonic-gate static void 17029e3700dfSgww do_setqbufsz(char *bufsz) 17037c478bd9Sstevel@tonic-gate { 17047c478bd9Sstevel@tonic-gate struct au_qctrl qctrl; 17057c478bd9Sstevel@tonic-gate 17067c478bd9Sstevel@tonic-gate eauditon(A_GETQCTRL, (caddr_t)&qctrl, 0); 17077c478bd9Sstevel@tonic-gate qctrl.aq_bufsz = atol(bufsz); 17087c478bd9Sstevel@tonic-gate eauditon(A_SETQCTRL, (caddr_t)&qctrl, 0); 17097c478bd9Sstevel@tonic-gate } 17107c478bd9Sstevel@tonic-gate 17117c478bd9Sstevel@tonic-gate /* 17127c478bd9Sstevel@tonic-gate * AUDIT_PERZONE set: valid in all zones 17137c478bd9Sstevel@tonic-gate * AUDIT_PERZONE not set: valid in global zone only 17147c478bd9Sstevel@tonic-gate */ 17157c478bd9Sstevel@tonic-gate 17167c478bd9Sstevel@tonic-gate static void 17179e3700dfSgww do_setqctrl(char *hiwater, char *lowater, char *bufsz, char *delay) 17187c478bd9Sstevel@tonic-gate { 17197c478bd9Sstevel@tonic-gate struct au_qctrl qctrl; 17207c478bd9Sstevel@tonic-gate 17217c478bd9Sstevel@tonic-gate qctrl.aq_hiwater = atol(hiwater); 17227c478bd9Sstevel@tonic-gate qctrl.aq_lowater = atol(lowater); 17237c478bd9Sstevel@tonic-gate qctrl.aq_bufsz = atol(bufsz); 17247c478bd9Sstevel@tonic-gate qctrl.aq_delay = atol(delay); 17257c478bd9Sstevel@tonic-gate eauditon(A_SETQCTRL, (caddr_t)&qctrl, 0); 17267c478bd9Sstevel@tonic-gate } 17277c478bd9Sstevel@tonic-gate 17287c478bd9Sstevel@tonic-gate /* 17297c478bd9Sstevel@tonic-gate * AUDIT_PERZONE set: valid in all zones 17307c478bd9Sstevel@tonic-gate * AUDIT_PERZONE not set: valid in global zone only 17317c478bd9Sstevel@tonic-gate */ 17327c478bd9Sstevel@tonic-gate 17337c478bd9Sstevel@tonic-gate static void 17349e3700dfSgww do_setqdelay(char *delay) 17357c478bd9Sstevel@tonic-gate { 17367c478bd9Sstevel@tonic-gate struct au_qctrl qctrl; 17377c478bd9Sstevel@tonic-gate 17387c478bd9Sstevel@tonic-gate eauditon(A_GETQCTRL, (caddr_t)&qctrl, 0); 17397c478bd9Sstevel@tonic-gate qctrl.aq_delay = atol(delay); 17407c478bd9Sstevel@tonic-gate eauditon(A_SETQCTRL, (caddr_t)&qctrl, 0); 17417c478bd9Sstevel@tonic-gate } 17427c478bd9Sstevel@tonic-gate 17437c478bd9Sstevel@tonic-gate /* 17447c478bd9Sstevel@tonic-gate * AUDIT_PERZONE set: valid in all zones 17457c478bd9Sstevel@tonic-gate * AUDIT_PERZONE not set: valid in global zone only 17467c478bd9Sstevel@tonic-gate */ 17477c478bd9Sstevel@tonic-gate 17487c478bd9Sstevel@tonic-gate static void 17499e3700dfSgww do_setqhiwater(char *hiwater) 17507c478bd9Sstevel@tonic-gate { 17517c478bd9Sstevel@tonic-gate struct au_qctrl qctrl; 17527c478bd9Sstevel@tonic-gate 17537c478bd9Sstevel@tonic-gate eauditon(A_GETQCTRL, (caddr_t)&qctrl, 0); 17547c478bd9Sstevel@tonic-gate qctrl.aq_hiwater = atol(hiwater); 17557c478bd9Sstevel@tonic-gate eauditon(A_SETQCTRL, (caddr_t)&qctrl, 0); 17567c478bd9Sstevel@tonic-gate } 17577c478bd9Sstevel@tonic-gate 17587c478bd9Sstevel@tonic-gate /* 17597c478bd9Sstevel@tonic-gate * AUDIT_PERZONE set: valid in all zones 17607c478bd9Sstevel@tonic-gate * AUDIT_PERZONE not set: valid in global zone only 17617c478bd9Sstevel@tonic-gate */ 17627c478bd9Sstevel@tonic-gate 17637c478bd9Sstevel@tonic-gate static void 17649e3700dfSgww do_setqlowater(char *lowater) 17657c478bd9Sstevel@tonic-gate { 17667c478bd9Sstevel@tonic-gate struct au_qctrl qctrl; 17677c478bd9Sstevel@tonic-gate 17687c478bd9Sstevel@tonic-gate eauditon(A_GETQCTRL, (caddr_t)&qctrl, 0); 17697c478bd9Sstevel@tonic-gate qctrl.aq_lowater = atol(lowater); 17707c478bd9Sstevel@tonic-gate eauditon(A_SETQCTRL, (caddr_t)&qctrl, 0); 17717c478bd9Sstevel@tonic-gate } 17727c478bd9Sstevel@tonic-gate 17737c478bd9Sstevel@tonic-gate /* 17747c478bd9Sstevel@tonic-gate * AUDIT_PERZONE set: valid in all zones 17757c478bd9Sstevel@tonic-gate * AUDIT_PERZONE not set: valid in global zone only 17767c478bd9Sstevel@tonic-gate */ 17777c478bd9Sstevel@tonic-gate 17787c478bd9Sstevel@tonic-gate static void 17799e3700dfSgww do_setfsize(char *size) 17807c478bd9Sstevel@tonic-gate { 17817c478bd9Sstevel@tonic-gate au_fstat_t fstat; 17827c478bd9Sstevel@tonic-gate 17837c478bd9Sstevel@tonic-gate fstat.af_filesz = atol(size); 17847c478bd9Sstevel@tonic-gate eauditon(A_SETFSIZE, (caddr_t)&fstat, 0); 17857c478bd9Sstevel@tonic-gate } 17867c478bd9Sstevel@tonic-gate 17877c478bd9Sstevel@tonic-gate static void 17889e3700dfSgww eauditon(int cmd, caddr_t data, int length) 17897c478bd9Sstevel@tonic-gate { 17907c478bd9Sstevel@tonic-gate if (auditon(cmd, data, length) == -1) 17917c478bd9Sstevel@tonic-gate exit_error(gettext("auditon(2) failed.")); 17927c478bd9Sstevel@tonic-gate } 17937c478bd9Sstevel@tonic-gate 17947c478bd9Sstevel@tonic-gate static void 17959e3700dfSgww egetauid(au_id_t *auid) 17967c478bd9Sstevel@tonic-gate { 17977c478bd9Sstevel@tonic-gate if (getauid(auid) == -1) 17987c478bd9Sstevel@tonic-gate exit_error(gettext("getauid(2) failed.")); 17997c478bd9Sstevel@tonic-gate } 18007c478bd9Sstevel@tonic-gate 18017c478bd9Sstevel@tonic-gate static void 18029e3700dfSgww egetaudit(auditinfo_addr_t *ai, int size) 18037c478bd9Sstevel@tonic-gate { 18047c478bd9Sstevel@tonic-gate if (getaudit_addr(ai, size) == -1) 18057c478bd9Sstevel@tonic-gate exit_error(gettext("getaudit_addr(2) failed.")); 18067c478bd9Sstevel@tonic-gate } 18077c478bd9Sstevel@tonic-gate 18087c478bd9Sstevel@tonic-gate static void 18099e3700dfSgww egetkaudit(auditinfo_addr_t *ai, int size) 18107c478bd9Sstevel@tonic-gate { 18117c478bd9Sstevel@tonic-gate if (auditon(A_GETKAUDIT, (char *)ai, size) < 0) 18127c478bd9Sstevel@tonic-gate exit_error(gettext("auditon: A_GETKAUDIT failed.")); 18137c478bd9Sstevel@tonic-gate } 18147c478bd9Sstevel@tonic-gate 18157c478bd9Sstevel@tonic-gate static void 18169e3700dfSgww esetkaudit(auditinfo_addr_t *ai, int size) 18177c478bd9Sstevel@tonic-gate { 18187c478bd9Sstevel@tonic-gate if (auditon(A_SETKAUDIT, (char *)ai, size) < 0) 18197c478bd9Sstevel@tonic-gate exit_error(gettext("auditon: A_SETKAUDIT failed.")); 18207c478bd9Sstevel@tonic-gate } 18217c478bd9Sstevel@tonic-gate 18227c478bd9Sstevel@tonic-gate static void 18239e3700dfSgww egetauditflagsbin(char *auditflags, au_mask_t *pmask) 18247c478bd9Sstevel@tonic-gate { 18257c478bd9Sstevel@tonic-gate pmask->am_success = pmask->am_failure = 0; 18267c478bd9Sstevel@tonic-gate 18277c478bd9Sstevel@tonic-gate if (strcmp(auditflags, "none") == 0) 18287c478bd9Sstevel@tonic-gate return; 18297c478bd9Sstevel@tonic-gate 18307c478bd9Sstevel@tonic-gate if (getauditflagsbin(auditflags, pmask) < 0) { 18317c478bd9Sstevel@tonic-gate exit_error(gettext("Could not get audit flags (%s)"), 18329e3700dfSgww auditflags); 18337c478bd9Sstevel@tonic-gate } 18347c478bd9Sstevel@tonic-gate } 18357c478bd9Sstevel@tonic-gate 18367c478bd9Sstevel@tonic-gate static au_event_ent_t * 18379e3700dfSgww egetauevnum(au_event_t event_number) 18387c478bd9Sstevel@tonic-gate { 18397c478bd9Sstevel@tonic-gate au_event_ent_t *evp; 18407c478bd9Sstevel@tonic-gate 18419e3700dfSgww if ((evp = getauevnum(event_number)) == NULL) { 1842*d0fa49b7STony Nguyen exit_error(gettext("Could not get audit event %hu"), 18439e3700dfSgww event_number); 18449e3700dfSgww } 18457c478bd9Sstevel@tonic-gate 18467c478bd9Sstevel@tonic-gate return (evp); 18477c478bd9Sstevel@tonic-gate } 18487c478bd9Sstevel@tonic-gate 18497c478bd9Sstevel@tonic-gate static au_event_ent_t * 18509e3700dfSgww egetauevnam(char *event_name) 18517c478bd9Sstevel@tonic-gate { 18527c478bd9Sstevel@tonic-gate register au_event_ent_t *evp; 18537c478bd9Sstevel@tonic-gate 18549e3700dfSgww if ((evp = getauevnam(event_name)) == NULL) 18557c478bd9Sstevel@tonic-gate exit_error(gettext("Could not get audit event %s"), event_name); 18567c478bd9Sstevel@tonic-gate 18577c478bd9Sstevel@tonic-gate return (evp); 18587c478bd9Sstevel@tonic-gate } 18597c478bd9Sstevel@tonic-gate 18607c478bd9Sstevel@tonic-gate static void 18619e3700dfSgww esetauid(au_id_t *auid) 18627c478bd9Sstevel@tonic-gate { 18637c478bd9Sstevel@tonic-gate if (setauid(auid) == -1) 18647c478bd9Sstevel@tonic-gate exit_error(gettext("setauid(2) failed.")); 18657c478bd9Sstevel@tonic-gate } 18667c478bd9Sstevel@tonic-gate 18677c478bd9Sstevel@tonic-gate static void 18689e3700dfSgww esetaudit(auditinfo_addr_t *ai, int size) 18697c478bd9Sstevel@tonic-gate { 18707c478bd9Sstevel@tonic-gate if (setaudit_addr(ai, size) == -1) 18717c478bd9Sstevel@tonic-gate exit_error(gettext("setaudit_addr(2) failed.")); 18727c478bd9Sstevel@tonic-gate } 18737c478bd9Sstevel@tonic-gate 18747c478bd9Sstevel@tonic-gate static uid_t 18759e3700dfSgww get_user_id(char *user) 18767c478bd9Sstevel@tonic-gate { 18777c478bd9Sstevel@tonic-gate struct passwd *pwd; 18787c478bd9Sstevel@tonic-gate uid_t uid; 18797c478bd9Sstevel@tonic-gate 18807c478bd9Sstevel@tonic-gate if (isdigit(*user)) { 18817c478bd9Sstevel@tonic-gate uid = atoi(user); 18829e3700dfSgww if ((pwd = getpwuid(uid)) == NULL) { 18837c478bd9Sstevel@tonic-gate exit_error(gettext("Invalid user: %s"), user); 18847c478bd9Sstevel@tonic-gate } 18857c478bd9Sstevel@tonic-gate } else { 18869e3700dfSgww if ((pwd = getpwnam(user)) == NULL) { 18877c478bd9Sstevel@tonic-gate exit_error(gettext("Invalid user: %s"), user); 18887c478bd9Sstevel@tonic-gate } 18897c478bd9Sstevel@tonic-gate } 18907c478bd9Sstevel@tonic-gate 18917c478bd9Sstevel@tonic-gate return (pwd->pw_uid); 18927c478bd9Sstevel@tonic-gate } 18937c478bd9Sstevel@tonic-gate 18947c478bd9Sstevel@tonic-gate /* 18957c478bd9Sstevel@tonic-gate * get_arg_ent() 18967c478bd9Sstevel@tonic-gate * Inputs: command line argument string 18977c478bd9Sstevel@tonic-gate * Returns ptr to policy_entry if found; null, if not found 18987c478bd9Sstevel@tonic-gate */ 18997c478bd9Sstevel@tonic-gate static struct arg_entry * 19009e3700dfSgww get_arg_ent(char *arg_str) 19017c478bd9Sstevel@tonic-gate { 19027c478bd9Sstevel@tonic-gate struct arg_entry key; 19037c478bd9Sstevel@tonic-gate 19047c478bd9Sstevel@tonic-gate key.arg_str = arg_str; 19057c478bd9Sstevel@tonic-gate 19069e3700dfSgww return ((struct arg_entry *)bsearch((char *)&key, (char *)arg_table, 19079e3700dfSgww ARG_TBL_SZ, sizeof (struct arg_entry), arg_ent_compare)); 19087c478bd9Sstevel@tonic-gate } 19097c478bd9Sstevel@tonic-gate 19107c478bd9Sstevel@tonic-gate /* 19117c478bd9Sstevel@tonic-gate * arg_ent_compare() 19127c478bd9Sstevel@tonic-gate * Compares two command line arguments to determine which is 19137c478bd9Sstevel@tonic-gate * lexicographically greater. 19147c478bd9Sstevel@tonic-gate * Inputs: two argument map table entry pointers 19157c478bd9Sstevel@tonic-gate * Returns: > 1: aep1->arg_str > aep2->arg_str 19167c478bd9Sstevel@tonic-gate * < 1: aep1->arg_str < aep2->arg_str 19177c478bd9Sstevel@tonic-gate * 0: aep1->arg_str = aep->arg_str2 19187c478bd9Sstevel@tonic-gate */ 19197c478bd9Sstevel@tonic-gate static int 19209e3700dfSgww arg_ent_compare(const void *aep1, const void *aep2) 19217c478bd9Sstevel@tonic-gate { 19229e3700dfSgww return (strcmp(((struct arg_entry *)aep1)->arg_str, 19239e3700dfSgww ((struct arg_entry *)aep2)->arg_str)); 19247c478bd9Sstevel@tonic-gate } 19257c478bd9Sstevel@tonic-gate 19267c478bd9Sstevel@tonic-gate /* 19277c478bd9Sstevel@tonic-gate * Convert mask of the following forms: 19287c478bd9Sstevel@tonic-gate * 19297c478bd9Sstevel@tonic-gate * audit_flags (ie. +lo,-ad,pc) 19307c478bd9Sstevel@tonic-gate * 0xffffffff,0xffffffff 19317c478bd9Sstevel@tonic-gate * ffffffff,ffffffff 19327c478bd9Sstevel@tonic-gate * 20,20 19337c478bd9Sstevel@tonic-gate */ 19347c478bd9Sstevel@tonic-gate static void 19359e3700dfSgww str2mask(char *mask_str, au_mask_t *mp) 19367c478bd9Sstevel@tonic-gate { 19377c478bd9Sstevel@tonic-gate 19387c478bd9Sstevel@tonic-gate char sp[256]; 19397c478bd9Sstevel@tonic-gate char fp[256]; 19407c478bd9Sstevel@tonic-gate 19417c478bd9Sstevel@tonic-gate mp->am_success = 0; 19427c478bd9Sstevel@tonic-gate mp->am_failure = 0; 19437c478bd9Sstevel@tonic-gate 19447c478bd9Sstevel@tonic-gate /* 19459e3700dfSgww * a mask of the form +aa,bb,cc,-dd or 19469e3700dfSgww * a mask of the form 0xffffffff,0xffffffff or 1,1 19477c478bd9Sstevel@tonic-gate */ 19487c478bd9Sstevel@tonic-gate if (strisflags(mask_str)) { 19497c478bd9Sstevel@tonic-gate egetauditflagsbin(mask_str, mp); 19507c478bd9Sstevel@tonic-gate } else { 19517c478bd9Sstevel@tonic-gate strsplit(mask_str, sp, fp, ','); 19527c478bd9Sstevel@tonic-gate 19539e3700dfSgww if (strlen(sp) > (size_t)2 && !strncasecmp(sp, "0x", 2)) { 19547c478bd9Sstevel@tonic-gate (void) sscanf(sp + 2, "%x", &mp->am_success); 19559e3700dfSgww } else { 19567c478bd9Sstevel@tonic-gate (void) sscanf(sp, "%u", &mp->am_success); 19579e3700dfSgww } 19587c478bd9Sstevel@tonic-gate 19599e3700dfSgww if (strlen(fp) > (size_t)2 && !strncasecmp(fp, "0x", 2)) { 19607c478bd9Sstevel@tonic-gate (void) sscanf(fp + 2, "%x", &mp->am_failure); 19619e3700dfSgww } else { 19627c478bd9Sstevel@tonic-gate (void) sscanf(fp, "%u", &mp->am_failure); 19639e3700dfSgww } 19647c478bd9Sstevel@tonic-gate } 19657c478bd9Sstevel@tonic-gate } 19667c478bd9Sstevel@tonic-gate 19677c478bd9Sstevel@tonic-gate /* 19687c478bd9Sstevel@tonic-gate * tid_str is major,minor,host -- host is a name or an ip address 19697c478bd9Sstevel@tonic-gate */ 19707c478bd9Sstevel@tonic-gate 19717c478bd9Sstevel@tonic-gate static void 19727c478bd9Sstevel@tonic-gate str2tid(char *tid_str, au_tid_addr_t *tp) 19737c478bd9Sstevel@tonic-gate { 19749e3700dfSgww char *major_str; 19759e3700dfSgww char *minor_str; 19769e3700dfSgww char *host_str = NULL; 19777c478bd9Sstevel@tonic-gate major_t major = 0; 19787c478bd9Sstevel@tonic-gate major_t minor = 0; 19797c478bd9Sstevel@tonic-gate dev_t dev = 0; 19807c478bd9Sstevel@tonic-gate struct hostent *phe; 19817c478bd9Sstevel@tonic-gate int err; 19827c478bd9Sstevel@tonic-gate uint32_t ibuf; 19837c478bd9Sstevel@tonic-gate uint32_t ibuf6[4]; 19847c478bd9Sstevel@tonic-gate 19857c478bd9Sstevel@tonic-gate tp->at_port = 0; 19867c478bd9Sstevel@tonic-gate tp->at_type = 0; 19877c478bd9Sstevel@tonic-gate bzero(tp->at_addr, 16); 19887c478bd9Sstevel@tonic-gate 19897c478bd9Sstevel@tonic-gate major_str = tid_str; 19907c478bd9Sstevel@tonic-gate if ((minor_str = strchr(tid_str, ',')) != NULL) { 19917c478bd9Sstevel@tonic-gate *minor_str = '\0'; 19927c478bd9Sstevel@tonic-gate minor_str++; 19937c478bd9Sstevel@tonic-gate } 19947c478bd9Sstevel@tonic-gate 19959e3700dfSgww if (minor_str) { 19967c478bd9Sstevel@tonic-gate if ((host_str = strchr(minor_str, ',')) != NULL) { 19977c478bd9Sstevel@tonic-gate *host_str = '\0'; 19987c478bd9Sstevel@tonic-gate host_str++; 19997c478bd9Sstevel@tonic-gate } 20009e3700dfSgww } 20017c478bd9Sstevel@tonic-gate 20027c478bd9Sstevel@tonic-gate if (major_str) 20037c478bd9Sstevel@tonic-gate major = (major_t)atoi(major_str); 20047c478bd9Sstevel@tonic-gate 20057c478bd9Sstevel@tonic-gate if (minor_str) 20067c478bd9Sstevel@tonic-gate minor = (minor_t)atoi(minor_str); 20077c478bd9Sstevel@tonic-gate 20087c478bd9Sstevel@tonic-gate if ((dev = makedev(major, minor)) != NODEV) 20097c478bd9Sstevel@tonic-gate tp->at_port = dev; 20107c478bd9Sstevel@tonic-gate 20117c478bd9Sstevel@tonic-gate if (host_str) { 20127c478bd9Sstevel@tonic-gate if (strisipaddr(host_str)) { 20139e3700dfSgww if (inet_pton(AF_INET, host_str, &ibuf)) { 20149e3700dfSgww tp->at_addr[0] = ibuf; 20159e3700dfSgww tp->at_type = AU_IPv4; 20169e3700dfSgww } else if (inet_pton(AF_INET6, host_str, ibuf6)) { 20179e3700dfSgww tp->at_addr[0] = ibuf6[0]; 20189e3700dfSgww tp->at_addr[1] = ibuf6[1]; 20199e3700dfSgww tp->at_addr[2] = ibuf6[2]; 20209e3700dfSgww tp->at_addr[3] = ibuf6[3]; 20219e3700dfSgww tp->at_type = AU_IPv6; 20229e3700dfSgww } 20237c478bd9Sstevel@tonic-gate } else { 20247c478bd9Sstevel@tonic-gate phe = getipnodebyname((const void *)host_str, 20259e3700dfSgww AF_INET, 0, &err); 20267c478bd9Sstevel@tonic-gate if (phe == 0) { 20277c478bd9Sstevel@tonic-gate phe = getipnodebyname((const void *)host_str, 20289e3700dfSgww AF_INET6, 0, &err); 20297c478bd9Sstevel@tonic-gate } 20307c478bd9Sstevel@tonic-gate 20317c478bd9Sstevel@tonic-gate if (phe != NULL) { 20327c478bd9Sstevel@tonic-gate if (phe->h_addrtype == AF_INET6) { 20337c478bd9Sstevel@tonic-gate /* address is IPv6 (128 bits) */ 20347c478bd9Sstevel@tonic-gate (void) memcpy(&tp->at_addr[0], 20359e3700dfSgww phe->h_addr_list[0], 16); 20367c478bd9Sstevel@tonic-gate tp->at_type = AU_IPv6; 20377c478bd9Sstevel@tonic-gate } else { 20387c478bd9Sstevel@tonic-gate /* address is IPv4 (32 bits) */ 20397c478bd9Sstevel@tonic-gate (void) memcpy(&tp->at_addr[0], 20409e3700dfSgww phe->h_addr_list[0], 4); 20417c478bd9Sstevel@tonic-gate tp->at_type = AU_IPv4; 20427c478bd9Sstevel@tonic-gate } 20437c478bd9Sstevel@tonic-gate freehostent(phe); 20447c478bd9Sstevel@tonic-gate } 20457c478bd9Sstevel@tonic-gate } 20467c478bd9Sstevel@tonic-gate } 20477c478bd9Sstevel@tonic-gate } 20487c478bd9Sstevel@tonic-gate 20499e3700dfSgww static char * 20509e3700dfSgww cond2str(void) 20517c478bd9Sstevel@tonic-gate { 20529e3700dfSgww uint_t cond; 20537c478bd9Sstevel@tonic-gate 20549e3700dfSgww eauditon(A_GETCOND, (caddr_t)&cond, (int)sizeof (cond)); 20557c478bd9Sstevel@tonic-gate 20569e3700dfSgww switch (cond) { 20577c478bd9Sstevel@tonic-gate 20589e3700dfSgww case AUC_AUDITING: 20599e3700dfSgww return ("auditing"); 20607c478bd9Sstevel@tonic-gate 20619e3700dfSgww case AUC_NOAUDIT: 20629e3700dfSgww case AUC_INIT_AUDIT: 20639e3700dfSgww return ("noaudit"); 20647c478bd9Sstevel@tonic-gate 20659e3700dfSgww case AUC_UNSET: 20669e3700dfSgww return ("unset"); 20679e3700dfSgww 20689e3700dfSgww case AUC_NOSPACE: 20699e3700dfSgww return ("nospace"); 20709e3700dfSgww 20719e3700dfSgww default: 20729e3700dfSgww return (""); 20739e3700dfSgww } 20747c478bd9Sstevel@tonic-gate } 20757c478bd9Sstevel@tonic-gate 20767c478bd9Sstevel@tonic-gate static struct policy_entry * 20779e3700dfSgww get_policy_ent(char *policy) 20787c478bd9Sstevel@tonic-gate { 20797c478bd9Sstevel@tonic-gate int i; 20807c478bd9Sstevel@tonic-gate 208145916cd2Sjpk for (i = 0; i < POLICY_TBL_SZ; i++) { 20829e3700dfSgww if (strcasecmp(policy, 20839e3700dfSgww policy_table[i].policy_str) == 0) { 20847c478bd9Sstevel@tonic-gate return (&policy_table[i]); 20859e3700dfSgww } 208645916cd2Sjpk } 20877c478bd9Sstevel@tonic-gate 20889e3700dfSgww return (NULL); 20897c478bd9Sstevel@tonic-gate } 20907c478bd9Sstevel@tonic-gate 20919e3700dfSgww /* 20929e3700dfSgww * exit = 0, success 20939e3700dfSgww * 1, error 20949e3700dfSgww * 2, bad zone 20959e3700dfSgww */ 20969e3700dfSgww 20977c478bd9Sstevel@tonic-gate static int 20987c478bd9Sstevel@tonic-gate str2policy(char *policy_str, uint_t *policy_mask) 20997c478bd9Sstevel@tonic-gate { 21007c478bd9Sstevel@tonic-gate char *buf; 21017c478bd9Sstevel@tonic-gate char *tok; 21027c478bd9Sstevel@tonic-gate char pfix; 21037c478bd9Sstevel@tonic-gate boolean_t is_all = 0; 21047c478bd9Sstevel@tonic-gate uint_t pm = 0; 21057c478bd9Sstevel@tonic-gate uint_t curp = 0; 21067c478bd9Sstevel@tonic-gate struct policy_entry *pep; 21077c478bd9Sstevel@tonic-gate 21087c478bd9Sstevel@tonic-gate pfix = *policy_str; 21097c478bd9Sstevel@tonic-gate 21107c478bd9Sstevel@tonic-gate if (pfix == '-' || pfix == '+' || pfix == '=') 21117c478bd9Sstevel@tonic-gate ++policy_str; 21127c478bd9Sstevel@tonic-gate 21137c478bd9Sstevel@tonic-gate if ((buf = strdup(policy_str)) == NULL) 21147c478bd9Sstevel@tonic-gate return (1); 21157c478bd9Sstevel@tonic-gate 21169e3700dfSgww for (tok = strtok(buf, ","); tok != NULL; tok = strtok(NULL, ",")) { 21177c478bd9Sstevel@tonic-gate if ((pep = get_policy_ent(tok)) == NULL) { 21187c478bd9Sstevel@tonic-gate return (1); 21197c478bd9Sstevel@tonic-gate } else { 21207c478bd9Sstevel@tonic-gate pm |= pep->policy_mask; 21219e3700dfSgww if (pep->policy_mask == ALL_POLICIES) { 21227c478bd9Sstevel@tonic-gate is_all = 1; 21239e3700dfSgww } 21247c478bd9Sstevel@tonic-gate } 21257c478bd9Sstevel@tonic-gate } 21267c478bd9Sstevel@tonic-gate free(buf); 21277c478bd9Sstevel@tonic-gate 21287c478bd9Sstevel@tonic-gate if (pfix == '-') { 21299e3700dfSgww if (!is_all && 21309e3700dfSgww (getzoneid() != GLOBAL_ZONEID) && 21319e3700dfSgww (pm & ~AUDIT_LOCAL)) { 21327c478bd9Sstevel@tonic-gate return (2); 21339e3700dfSgww } 21347c478bd9Sstevel@tonic-gate eauditon(A_GETPOLICY, (caddr_t)&curp, 0); 21357c478bd9Sstevel@tonic-gate if (getzoneid() != GLOBAL_ZONEID) 21367c478bd9Sstevel@tonic-gate curp &= AUDIT_LOCAL; 21377c478bd9Sstevel@tonic-gate *policy_mask = curp & ~pm; 21387c478bd9Sstevel@tonic-gate } else if (pfix == '+') { 21397c478bd9Sstevel@tonic-gate /* 21409e3700dfSgww * In a local zone, accept specifying "all", but not 21419e3700dfSgww * individually specifying global-zone only policies. 21429e3700dfSgww * Limit to all locally allowed, so system call doesn't 21439e3700dfSgww * fail. 21447c478bd9Sstevel@tonic-gate */ 21459e3700dfSgww if (!is_all && 21469e3700dfSgww (getzoneid() != GLOBAL_ZONEID) && 21479e3700dfSgww (pm & ~AUDIT_LOCAL)) { 21487c478bd9Sstevel@tonic-gate return (2); 21499e3700dfSgww } 21507c478bd9Sstevel@tonic-gate eauditon(A_GETPOLICY, (caddr_t)&curp, 0); 21517c478bd9Sstevel@tonic-gate if (getzoneid() != GLOBAL_ZONEID) { 21527c478bd9Sstevel@tonic-gate curp &= AUDIT_LOCAL; 21539e3700dfSgww if (is_all) { 21547c478bd9Sstevel@tonic-gate pm &= AUDIT_LOCAL; 21559e3700dfSgww } 21567c478bd9Sstevel@tonic-gate } 21577c478bd9Sstevel@tonic-gate *policy_mask = curp | pm; 21587c478bd9Sstevel@tonic-gate } else { 21599e3700dfSgww if (is_all && (getzoneid() != GLOBAL_ZONEID)) { 21607c478bd9Sstevel@tonic-gate pm &= AUDIT_LOCAL; 21619e3700dfSgww } 21627c478bd9Sstevel@tonic-gate *policy_mask = pm; 21637c478bd9Sstevel@tonic-gate } 21647c478bd9Sstevel@tonic-gate return (0); 21657c478bd9Sstevel@tonic-gate } 21667c478bd9Sstevel@tonic-gate 21677c478bd9Sstevel@tonic-gate static int 21689e3700dfSgww policy2str(uint_t policy, char *policy_str, size_t len) 21697c478bd9Sstevel@tonic-gate { 21707c478bd9Sstevel@tonic-gate int i, j; 21717c478bd9Sstevel@tonic-gate 21727c478bd9Sstevel@tonic-gate if (policy == ALL_POLICIES) { 21737c478bd9Sstevel@tonic-gate (void) strcpy(policy_str, "all"); 21747c478bd9Sstevel@tonic-gate return (1); 21757c478bd9Sstevel@tonic-gate } 21767c478bd9Sstevel@tonic-gate 21777c478bd9Sstevel@tonic-gate if (policy == NO_POLICIES) { 21787c478bd9Sstevel@tonic-gate (void) strcpy(policy_str, "none"); 21797c478bd9Sstevel@tonic-gate return (1); 21807c478bd9Sstevel@tonic-gate } 21817c478bd9Sstevel@tonic-gate 21827c478bd9Sstevel@tonic-gate *policy_str = '\0'; 21837c478bd9Sstevel@tonic-gate 218445916cd2Sjpk for (i = 0, j = 0; i < POLICY_TBL_SZ; i++) { 21857c478bd9Sstevel@tonic-gate if (policy & policy_table[i].policy_mask && 21867c478bd9Sstevel@tonic-gate policy_table[i].policy_mask != ALL_POLICIES) { 21879e3700dfSgww if (j++) { 21887c478bd9Sstevel@tonic-gate (void) strcat(policy_str, ","); 21899e3700dfSgww } 21909e3700dfSgww (void) strlcat(policy_str, policy_table[i].policy_str, 21919e3700dfSgww len); 21927c478bd9Sstevel@tonic-gate } 219345916cd2Sjpk } 21947c478bd9Sstevel@tonic-gate 21957c478bd9Sstevel@tonic-gate if (*policy_str) 21967c478bd9Sstevel@tonic-gate return (0); 21977c478bd9Sstevel@tonic-gate 21987c478bd9Sstevel@tonic-gate return (1); 21997c478bd9Sstevel@tonic-gate } 22007c478bd9Sstevel@tonic-gate 22017c478bd9Sstevel@tonic-gate 22027c478bd9Sstevel@tonic-gate static int 22039e3700dfSgww strisnum(char *s) 22047c478bd9Sstevel@tonic-gate { 22059e3700dfSgww if (s == NULL || !*s) 22067c478bd9Sstevel@tonic-gate return (0); 22077c478bd9Sstevel@tonic-gate 22087c478bd9Sstevel@tonic-gate for (; *s == '-' || *s == '+'; s++) 22097c478bd9Sstevel@tonic-gate 22107c478bd9Sstevel@tonic-gate if (!*s) 22117c478bd9Sstevel@tonic-gate return (0); 22127c478bd9Sstevel@tonic-gate 22137c478bd9Sstevel@tonic-gate for (; *s; s++) 22147c478bd9Sstevel@tonic-gate if (!isdigit(*s)) 22157c478bd9Sstevel@tonic-gate return (0); 22167c478bd9Sstevel@tonic-gate 22177c478bd9Sstevel@tonic-gate return (1); 22187c478bd9Sstevel@tonic-gate } 22197c478bd9Sstevel@tonic-gate 22207c478bd9Sstevel@tonic-gate static int 22219e3700dfSgww strisflags(char *s) 22227c478bd9Sstevel@tonic-gate { 22239e3700dfSgww if (s == NULL || !*s) 22247c478bd9Sstevel@tonic-gate return (0); 22257c478bd9Sstevel@tonic-gate 22267c478bd9Sstevel@tonic-gate for (; *s; s++) { 22277c478bd9Sstevel@tonic-gate if (!isalpha(*s) && 22289e3700dfSgww (*s != '+' && *s != '-' && *s != '^' && *s != ',')) 22297c478bd9Sstevel@tonic-gate return (0); 22307c478bd9Sstevel@tonic-gate } 22317c478bd9Sstevel@tonic-gate 22327c478bd9Sstevel@tonic-gate return (1); 22337c478bd9Sstevel@tonic-gate } 22347c478bd9Sstevel@tonic-gate 22357c478bd9Sstevel@tonic-gate static int 22369e3700dfSgww strisipaddr(char *s) 22377c478bd9Sstevel@tonic-gate { 22387c478bd9Sstevel@tonic-gate int dot = 0; 22397c478bd9Sstevel@tonic-gate int colon = 0; 22407c478bd9Sstevel@tonic-gate 22417c478bd9Sstevel@tonic-gate /* no string */ 22429e3700dfSgww if ((s == NULL) || (!*s)) 22437c478bd9Sstevel@tonic-gate return (0); 22447c478bd9Sstevel@tonic-gate 22457c478bd9Sstevel@tonic-gate for (; *s; s++) { 22467c478bd9Sstevel@tonic-gate if (!(isxdigit(*s) || *s != '.' || *s != ':')) 22477c478bd9Sstevel@tonic-gate return (0); 22489e3700dfSgww if (*s == '.') 22499e3700dfSgww dot++; 22509e3700dfSgww if (*s == ':') 22519e3700dfSgww colon++; 22527c478bd9Sstevel@tonic-gate } 22537c478bd9Sstevel@tonic-gate 22547c478bd9Sstevel@tonic-gate if (dot && colon) 22557c478bd9Sstevel@tonic-gate return (0); 22567c478bd9Sstevel@tonic-gate 22577c478bd9Sstevel@tonic-gate if (!dot && !colon) 22587c478bd9Sstevel@tonic-gate return (0); 22597c478bd9Sstevel@tonic-gate 22607c478bd9Sstevel@tonic-gate return (1); 22617c478bd9Sstevel@tonic-gate } 22627c478bd9Sstevel@tonic-gate 22637c478bd9Sstevel@tonic-gate static void 22649e3700dfSgww strsplit(char *s, char *p1, char *p2, char c) 22657c478bd9Sstevel@tonic-gate { 22667c478bd9Sstevel@tonic-gate *p1 = *p2 = '\0'; 22677c478bd9Sstevel@tonic-gate 22687c478bd9Sstevel@tonic-gate while (*s != '\0' && *s != c) 22697c478bd9Sstevel@tonic-gate *p1++ = *s++; 22707c478bd9Sstevel@tonic-gate *p1 = '\0'; 22717c478bd9Sstevel@tonic-gate s++; 22727c478bd9Sstevel@tonic-gate 22737c478bd9Sstevel@tonic-gate while (*s != '\0') 22747c478bd9Sstevel@tonic-gate *p2++ = *s++; 22757c478bd9Sstevel@tonic-gate *p2 = '\0'; 22767c478bd9Sstevel@tonic-gate } 22777c478bd9Sstevel@tonic-gate 22787c478bd9Sstevel@tonic-gate static void 22799e3700dfSgww chk_event_num(int etype, au_event_t event) 22807c478bd9Sstevel@tonic-gate { 22817c478bd9Sstevel@tonic-gate au_stat_t as; 22827c478bd9Sstevel@tonic-gate 22837c478bd9Sstevel@tonic-gate eauditon(A_GETSTAT, (caddr_t)&as, 0); 22847c478bd9Sstevel@tonic-gate 22857c478bd9Sstevel@tonic-gate if (etype == AC_KERN_EVENT) { 22867c478bd9Sstevel@tonic-gate if (event > as.as_numevent) { 22879e3700dfSgww exit_error(gettext("Invalid kernel audit event " 22889e3700dfSgww "number specified.\n" 2289*d0fa49b7STony Nguyen "\t%hu is outside allowable range 0-%d."), 22907c478bd9Sstevel@tonic-gate event, as.as_numevent); 22917c478bd9Sstevel@tonic-gate } 22929e3700dfSgww } else { 22939e3700dfSgww /* user event */ 22947c478bd9Sstevel@tonic-gate if (event <= as.as_numevent) { 22959e3700dfSgww exit_error(gettext("Invalid user level audit event " 2296*d0fa49b7STony Nguyen "number specified %hu."), event); 22977c478bd9Sstevel@tonic-gate } 22987c478bd9Sstevel@tonic-gate } 22997c478bd9Sstevel@tonic-gate } 23007c478bd9Sstevel@tonic-gate 23017c478bd9Sstevel@tonic-gate static void 23029e3700dfSgww chk_event_str(int etype, char *event_str) 23037c478bd9Sstevel@tonic-gate { 23047c478bd9Sstevel@tonic-gate au_event_ent_t *evp; 23057c478bd9Sstevel@tonic-gate au_stat_t as; 23067c478bd9Sstevel@tonic-gate 23077c478bd9Sstevel@tonic-gate eauditon(A_GETSTAT, (caddr_t)&as, 0); 23087c478bd9Sstevel@tonic-gate 23097c478bd9Sstevel@tonic-gate evp = egetauevnam(event_str); 23107c478bd9Sstevel@tonic-gate if (etype == AC_KERN_EVENT && (evp->ae_number > as.as_numevent)) { 23117c478bd9Sstevel@tonic-gate exit_error( 23127c478bd9Sstevel@tonic-gate gettext("Invalid kernel audit event string specified.\n" 23139e3700dfSgww "\t\"%s\" appears to be a user level event. " 23149e3700dfSgww "Check configuration."), event_str); 23157c478bd9Sstevel@tonic-gate } else if (etype == AC_USER_EVENT && 23169e3700dfSgww (evp->ae_number < as.as_numevent)) { 23177c478bd9Sstevel@tonic-gate exit_error( 23187c478bd9Sstevel@tonic-gate gettext("Invalid user audit event string specified.\n" 23199e3700dfSgww "\t\"%s\" appears to be a kernel event. " 23209e3700dfSgww "Check configuration."), event_str); 23217c478bd9Sstevel@tonic-gate } 23227c478bd9Sstevel@tonic-gate } 23237c478bd9Sstevel@tonic-gate 23247c478bd9Sstevel@tonic-gate static void 23259e3700dfSgww chk_sorf(char *sorf_str) 23267c478bd9Sstevel@tonic-gate { 23277c478bd9Sstevel@tonic-gate if (!strisnum(sorf_str)) 23287c478bd9Sstevel@tonic-gate exit_error(gettext("Invalid sorf specified: %s"), sorf_str); 23297c478bd9Sstevel@tonic-gate } 23307c478bd9Sstevel@tonic-gate 23317c478bd9Sstevel@tonic-gate static void 23329e3700dfSgww chk_retval(char *retval_str) 23337c478bd9Sstevel@tonic-gate { 23347c478bd9Sstevel@tonic-gate if (!strisnum(retval_str)) 23357c478bd9Sstevel@tonic-gate exit_error(gettext("Invalid retval specified: %s"), retval_str); 23367c478bd9Sstevel@tonic-gate } 23377c478bd9Sstevel@tonic-gate 23387c478bd9Sstevel@tonic-gate static void 23399e3700dfSgww execit(char **argv) 23407c478bd9Sstevel@tonic-gate { 23414e5fbfedStz char *args, *args_pos; 23424e5fbfedStz size_t len = 0; 23434e5fbfedStz size_t n = 0; 23444e5fbfedStz char **argv_pos; 23457c478bd9Sstevel@tonic-gate 23469e3700dfSgww if (*argv) { 23474e5fbfedStz /* concatenate argument array to be passed to sh -c "..." */ 23484e5fbfedStz for (argv_pos = argv; *argv_pos; argv_pos++) 23494e5fbfedStz len += strlen(*argv_pos) + 1; 23504e5fbfedStz 23514e5fbfedStz if ((args = malloc(len + 1)) == NULL) 23524e5fbfedStz exit_error( 23534e5fbfedStz gettext("Allocation for command/arguments " 23544e5fbfedStz "failed")); 23554e5fbfedStz 23564e5fbfedStz args_pos = args; 23574e5fbfedStz for (argv_pos = argv; *argv_pos; argv_pos++) { 23584e5fbfedStz n += snprintf(args_pos, len - n, "%s ", *argv_pos); 23594e5fbfedStz args_pos = args + n; 23604e5fbfedStz } 23614e5fbfedStz /* strip the last space */ 23624e5fbfedStz args[strlen(args)] = '\0'; 23637c478bd9Sstevel@tonic-gate 23644e5fbfedStz (void) execl("/bin/sh", "sh", "-c", args, NULL); 23654e5fbfedStz } else { 23664e5fbfedStz (void) execl("/bin/sh", "sh", NULL); 23677c478bd9Sstevel@tonic-gate } 23687c478bd9Sstevel@tonic-gate 23697c478bd9Sstevel@tonic-gate exit_error(gettext("exec(2) failed")); 23707c478bd9Sstevel@tonic-gate } 23717c478bd9Sstevel@tonic-gate 23727c478bd9Sstevel@tonic-gate /* 23737c478bd9Sstevel@tonic-gate * exit_error() 23747c478bd9Sstevel@tonic-gate * Desc: Prints an error message along with corresponding system 23757c478bd9Sstevel@tonic-gate * error number and error message, then exits. 23767c478bd9Sstevel@tonic-gate * Inputs: Program name, program error message. 23777c478bd9Sstevel@tonic-gate */ 23787c478bd9Sstevel@tonic-gate /*PRINTFLIKE1*/ 23797c478bd9Sstevel@tonic-gate static void 23807c478bd9Sstevel@tonic-gate exit_error(char *fmt, ...) 23817c478bd9Sstevel@tonic-gate { 23827c478bd9Sstevel@tonic-gate va_list args; 23837c478bd9Sstevel@tonic-gate 23847c478bd9Sstevel@tonic-gate (void) fprintf(stderr, "%s: ", progname); 23857c478bd9Sstevel@tonic-gate 23867c478bd9Sstevel@tonic-gate va_start(args, fmt); 23877c478bd9Sstevel@tonic-gate (void) vfprintf(stderr, fmt, args); 23887c478bd9Sstevel@tonic-gate va_end(args); 23897c478bd9Sstevel@tonic-gate 23907c478bd9Sstevel@tonic-gate (void) fputc('\n', stderr); 23917c478bd9Sstevel@tonic-gate if (errno) 23927c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext("%s: error = %s(%d)\n"), 23937c478bd9Sstevel@tonic-gate progname, strerror(errno), errno); 23947c478bd9Sstevel@tonic-gate (void) fflush(stderr); 23957c478bd9Sstevel@tonic-gate 23967c478bd9Sstevel@tonic-gate exit(1); 23977c478bd9Sstevel@tonic-gate } 23987c478bd9Sstevel@tonic-gate 23997c478bd9Sstevel@tonic-gate static void 24009e3700dfSgww exit_usage(int status) 24017c478bd9Sstevel@tonic-gate { 24027c478bd9Sstevel@tonic-gate FILE *fp; 24037c478bd9Sstevel@tonic-gate int i; 24047c478bd9Sstevel@tonic-gate 24057c478bd9Sstevel@tonic-gate fp = (status ? stderr : stdout); 24067c478bd9Sstevel@tonic-gate (void) fprintf(fp, gettext("usage: %s option ...\n"), progname); 24077c478bd9Sstevel@tonic-gate 24089e3700dfSgww for (i = 0; i < ARG_TBL_SZ; i++) 24097c478bd9Sstevel@tonic-gate (void) fprintf(fp, " %s %s\n", 24109e3700dfSgww arg_table[i].arg_str, arg_table[i].arg_opts); 24117c478bd9Sstevel@tonic-gate 24127c478bd9Sstevel@tonic-gate exit(status); 24137c478bd9Sstevel@tonic-gate } 24147c478bd9Sstevel@tonic-gate 24157c478bd9Sstevel@tonic-gate static void 24169e3700dfSgww print_asid(au_asid_t asid) 24177c478bd9Sstevel@tonic-gate { 24187c478bd9Sstevel@tonic-gate (void) printf(gettext("audit session id = %u\n"), asid); 24197c478bd9Sstevel@tonic-gate } 24207c478bd9Sstevel@tonic-gate 24217c478bd9Sstevel@tonic-gate static void 24229e3700dfSgww print_auid(au_id_t auid) 24237c478bd9Sstevel@tonic-gate { 24247c478bd9Sstevel@tonic-gate struct passwd *pwd; 24257c478bd9Sstevel@tonic-gate char *username; 24267c478bd9Sstevel@tonic-gate 24279e3700dfSgww if ((pwd = getpwuid((uid_t)auid)) != NULL) 24287c478bd9Sstevel@tonic-gate username = pwd->pw_name; 24297c478bd9Sstevel@tonic-gate else 24307c478bd9Sstevel@tonic-gate username = gettext("unknown"); 24317c478bd9Sstevel@tonic-gate 24327c478bd9Sstevel@tonic-gate (void) printf(gettext("audit id = %s(%d)\n"), username, auid); 24337c478bd9Sstevel@tonic-gate } 24347c478bd9Sstevel@tonic-gate 24357c478bd9Sstevel@tonic-gate static void 24369e3700dfSgww print_mask(char *desc, au_mask_t *pmp) 24377c478bd9Sstevel@tonic-gate { 24387c478bd9Sstevel@tonic-gate char auflags[512]; 24397c478bd9Sstevel@tonic-gate 24407c478bd9Sstevel@tonic-gate if (getauditflagschar(auflags, pmp, NULL) < 0) 24417c478bd9Sstevel@tonic-gate (void) strlcpy(auflags, gettext("unknown"), sizeof (auflags)); 24427c478bd9Sstevel@tonic-gate 24437c478bd9Sstevel@tonic-gate (void) printf("%s = %s(0x%x,0x%x)\n", 24449e3700dfSgww desc, auflags, pmp->am_success, pmp->am_failure); 24457c478bd9Sstevel@tonic-gate } 24467c478bd9Sstevel@tonic-gate 24477c478bd9Sstevel@tonic-gate static void 24489e3700dfSgww print_tid_ex(au_tid_addr_t *tidp) 24497c478bd9Sstevel@tonic-gate { 24507c478bd9Sstevel@tonic-gate struct hostent *phe; 24517c478bd9Sstevel@tonic-gate char *hostname; 24527c478bd9Sstevel@tonic-gate struct in_addr ia; 24537c478bd9Sstevel@tonic-gate uint32_t *addr; 24547c478bd9Sstevel@tonic-gate int err; 24559e3700dfSgww char buf[INET6_ADDRSTRLEN]; 24567c478bd9Sstevel@tonic-gate char *bufp; 24577c478bd9Sstevel@tonic-gate 24587c478bd9Sstevel@tonic-gate 24597c478bd9Sstevel@tonic-gate /* IPV6 or IPV4 address */ 24607c478bd9Sstevel@tonic-gate if (tidp->at_type == AU_IPv4) { 24617c478bd9Sstevel@tonic-gate if ((phe = gethostbyaddr((char *)&tidp->at_addr[0], 24629e3700dfSgww sizeof (tidp->at_addr[0]), AF_INET)) != NULL) { 24637c478bd9Sstevel@tonic-gate hostname = phe->h_name; 24649e3700dfSgww } else { 24657c478bd9Sstevel@tonic-gate hostname = gettext("unknown"); 24669e3700dfSgww } 24677c478bd9Sstevel@tonic-gate 24687c478bd9Sstevel@tonic-gate ia.s_addr = tidp->at_addr[0]; 24697c478bd9Sstevel@tonic-gate 24707c478bd9Sstevel@tonic-gate (void) printf(gettext( 24719e3700dfSgww "terminal id (maj,min,host) = %u,%u,%s(%s)\n"), 24729e3700dfSgww major(tidp->at_port), minor(tidp->at_port), 24739e3700dfSgww hostname, inet_ntoa(ia)); 24747c478bd9Sstevel@tonic-gate } else { 24757c478bd9Sstevel@tonic-gate addr = &tidp->at_addr[0]; 24767c478bd9Sstevel@tonic-gate phe = getipnodebyaddr((const void *)addr, 16, AF_INET6, &err); 24777c478bd9Sstevel@tonic-gate 24787c478bd9Sstevel@tonic-gate bzero(buf, sizeof (buf)); 24797c478bd9Sstevel@tonic-gate 24809e3700dfSgww (void) inet_ntop(AF_INET6, (void *)addr, buf, sizeof (buf)); 24819e3700dfSgww if (phe == NULL) { 24827c478bd9Sstevel@tonic-gate bufp = gettext("unknown"); 24839e3700dfSgww } else { 24847c478bd9Sstevel@tonic-gate bufp = phe->h_name; 24859e3700dfSgww } 24867c478bd9Sstevel@tonic-gate 24877c478bd9Sstevel@tonic-gate (void) printf(gettext( 24889e3700dfSgww "terminal id (maj,min,host) = %u,%u,%s(%s)\n"), 24899e3700dfSgww major(tidp->at_port), minor(tidp->at_port), 24909e3700dfSgww bufp, buf); 24919e3700dfSgww if (phe) { 24927c478bd9Sstevel@tonic-gate freehostent(phe); 24939e3700dfSgww } 24947c478bd9Sstevel@tonic-gate } 24957c478bd9Sstevel@tonic-gate } 24967c478bd9Sstevel@tonic-gate 24977c478bd9Sstevel@tonic-gate static int 24989e3700dfSgww str2ipaddr(char *s, uint32_t *addr, uint32_t type) 24997c478bd9Sstevel@tonic-gate { 25007c478bd9Sstevel@tonic-gate int j, sl; 25017c478bd9Sstevel@tonic-gate char *ss; 25027c478bd9Sstevel@tonic-gate unsigned int v; 25037c478bd9Sstevel@tonic-gate 25047c478bd9Sstevel@tonic-gate bzero(addr, 16); 25057c478bd9Sstevel@tonic-gate if (strisipaddr(s)) { 25067c478bd9Sstevel@tonic-gate if (type == AU_IPv4) { 25079e3700dfSgww if (inet_pton(AF_INET, s, addr)) { 25087c478bd9Sstevel@tonic-gate return (0); 25099e3700dfSgww } 25107c478bd9Sstevel@tonic-gate return (1); 25119e3700dfSgww } else if (type == AU_IPv6) { 25127c478bd9Sstevel@tonic-gate if (inet_pton(AF_INET6, s, addr)) 25137c478bd9Sstevel@tonic-gate return (0); 25147c478bd9Sstevel@tonic-gate return (1); 25157c478bd9Sstevel@tonic-gate } 25167c478bd9Sstevel@tonic-gate return (1); 25177c478bd9Sstevel@tonic-gate } else { 25187c478bd9Sstevel@tonic-gate if (type == AU_IPv4) { 25197c478bd9Sstevel@tonic-gate (void) sscanf(s, "%x", &addr[0]); 25207c478bd9Sstevel@tonic-gate return (0); 25219e3700dfSgww } else if (type == AU_IPv6) { 25227c478bd9Sstevel@tonic-gate sl = strlen(s); 25237c478bd9Sstevel@tonic-gate ss = s; 25247c478bd9Sstevel@tonic-gate for (j = 3; j >= 0; j--) { 25257c478bd9Sstevel@tonic-gate if ((sl - 8) <= 0) { 25267c478bd9Sstevel@tonic-gate (void) sscanf(s, "%x", &v); 25277c478bd9Sstevel@tonic-gate addr[j] = v; 25287c478bd9Sstevel@tonic-gate return (0); 25297c478bd9Sstevel@tonic-gate } 25307c478bd9Sstevel@tonic-gate ss = &s[sl-8]; 25317c478bd9Sstevel@tonic-gate (void) sscanf(ss, "%x", &v); 25327c478bd9Sstevel@tonic-gate addr[j] = v; 25337c478bd9Sstevel@tonic-gate sl -= 8; 25347c478bd9Sstevel@tonic-gate *ss = '\0'; 25357c478bd9Sstevel@tonic-gate } 25367c478bd9Sstevel@tonic-gate } 25377c478bd9Sstevel@tonic-gate return (0); 25387c478bd9Sstevel@tonic-gate } 25397c478bd9Sstevel@tonic-gate } 25407c478bd9Sstevel@tonic-gate 25417c478bd9Sstevel@tonic-gate static int 25429e3700dfSgww str2type(char *s, uint_t *type) 25437c478bd9Sstevel@tonic-gate { 25447c478bd9Sstevel@tonic-gate if (strcmp(s, "ipv6") == 0) { 25457c478bd9Sstevel@tonic-gate *type = AU_IPv6; 25467c478bd9Sstevel@tonic-gate return (0); 25477c478bd9Sstevel@tonic-gate } 25487c478bd9Sstevel@tonic-gate if (strcmp(s, "ipv4") == 0) { 25497c478bd9Sstevel@tonic-gate *type = AU_IPv4; 25507c478bd9Sstevel@tonic-gate return (0); 25517c478bd9Sstevel@tonic-gate } 25527c478bd9Sstevel@tonic-gate 25537c478bd9Sstevel@tonic-gate return (1); 25547c478bd9Sstevel@tonic-gate } 2555