17c478bd9Sstevel@tonic-gate /*
27c478bd9Sstevel@tonic-gate * CDDL HEADER START
37c478bd9Sstevel@tonic-gate *
47c478bd9Sstevel@tonic-gate * The contents of this file are subject to the terms of the
51a578a15Spaulson * Common Development and Distribution License (the "License").
61a578a15Spaulson * You may not use this file except in compliance with the License.
77c478bd9Sstevel@tonic-gate *
87c478bd9Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
97c478bd9Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing.
107c478bd9Sstevel@tonic-gate * See the License for the specific language governing permissions
117c478bd9Sstevel@tonic-gate * and limitations under the License.
127c478bd9Sstevel@tonic-gate *
137c478bd9Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each
147c478bd9Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
157c478bd9Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the
167c478bd9Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying
177c478bd9Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner]
187c478bd9Sstevel@tonic-gate *
197c478bd9Sstevel@tonic-gate * CDDL HEADER END
207c478bd9Sstevel@tonic-gate */
217c478bd9Sstevel@tonic-gate /*
22f8994074SJan Friedel * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
237c478bd9Sstevel@tonic-gate */
248f775e0aSJan Friedel
25*430fb051SAndy Giles /*
26*430fb051SAndy Giles * Copyright 2022 Tintri by DDN, Inc. All rights reserved.
27*430fb051SAndy Giles */
28*430fb051SAndy Giles
297c478bd9Sstevel@tonic-gate /*
307c478bd9Sstevel@tonic-gate * Threads:
317c478bd9Sstevel@tonic-gate *
327c478bd9Sstevel@tonic-gate * auditd is thread 0 and does signal handling
337c478bd9Sstevel@tonic-gate *
347c478bd9Sstevel@tonic-gate * input() is a door server that receives binary audit records and
357c478bd9Sstevel@tonic-gate * queues them for handling by an instance of process() for conversion to syslog
367c478bd9Sstevel@tonic-gate * message(s). There is one process thread per plugin.
377c478bd9Sstevel@tonic-gate *
387c478bd9Sstevel@tonic-gate * Queues:
397c478bd9Sstevel@tonic-gate *
407c478bd9Sstevel@tonic-gate * Each plugin has a buffer pool and and queue for feeding the
417c478bd9Sstevel@tonic-gate * the process threads. The input thread moves buffers from the pool
427c478bd9Sstevel@tonic-gate * to the queue and the process thread puts them back.
437c478bd9Sstevel@tonic-gate *
447c478bd9Sstevel@tonic-gate * Another pool, b_pool, contains buffers referenced by each of the
457c478bd9Sstevel@tonic-gate * process queues; this is to minimize the number of buffer copies
467c478bd9Sstevel@tonic-gate *
477c478bd9Sstevel@tonic-gate */
487c478bd9Sstevel@tonic-gate
497c478bd9Sstevel@tonic-gate #include <arpa/inet.h>
507c478bd9Sstevel@tonic-gate #include <assert.h>
517c478bd9Sstevel@tonic-gate #include <bsm/adt.h>
527c478bd9Sstevel@tonic-gate #include <dlfcn.h>
537c478bd9Sstevel@tonic-gate #include <errno.h>
547c478bd9Sstevel@tonic-gate #include <fcntl.h>
557c478bd9Sstevel@tonic-gate #include <libintl.h>
567c478bd9Sstevel@tonic-gate #include <pthread.h>
577c478bd9Sstevel@tonic-gate #include <secdb.h>
587c478bd9Sstevel@tonic-gate #include <security/auditd.h>
597c478bd9Sstevel@tonic-gate #include <signal.h>
607c478bd9Sstevel@tonic-gate #include <stdio.h>
617c478bd9Sstevel@tonic-gate #include <stdlib.h>
627c478bd9Sstevel@tonic-gate #include <string.h>
637c478bd9Sstevel@tonic-gate #include <syslog.h>
647c478bd9Sstevel@tonic-gate #include <sys/socket.h>
657c478bd9Sstevel@tonic-gate #include <sys/types.h>
667c478bd9Sstevel@tonic-gate #include <sys/stat.h>
677c478bd9Sstevel@tonic-gate #include <unistd.h>
687c478bd9Sstevel@tonic-gate #include <audit_plugin.h> /* libbsm */
697c478bd9Sstevel@tonic-gate #include "plugin.h"
707c478bd9Sstevel@tonic-gate #include <bsm/audit_door_infc.h>
717c478bd9Sstevel@tonic-gate #include "queue.h"
727c478bd9Sstevel@tonic-gate
737c478bd9Sstevel@tonic-gate #define DEBUG 0
747c478bd9Sstevel@tonic-gate
75dfc7be02SJan Friedel /* gettext() obfuscation routine for lint */
76dfc7be02SJan Friedel #ifdef __lint
77dfc7be02SJan Friedel #define gettext(x) x
78dfc7be02SJan Friedel #endif
797c478bd9Sstevel@tonic-gate
80dfc7be02SJan Friedel #if DEBUG
817c478bd9Sstevel@tonic-gate static FILE *dbfp;
827c478bd9Sstevel@tonic-gate #define DUMP(w, x, y, z) dump_state(w, x, y, z)
83dfc7be02SJan Friedel #define DPRINT(x) { (void) fprintf x; }
847c478bd9Sstevel@tonic-gate #else
857c478bd9Sstevel@tonic-gate #define DUMP(w, x, y, z)
867c478bd9Sstevel@tonic-gate #define DPRINT(x)
877c478bd9Sstevel@tonic-gate #endif
887c478bd9Sstevel@tonic-gate
897c478bd9Sstevel@tonic-gate #define FATAL_MESSAGE_LEN 256
907c478bd9Sstevel@tonic-gate
917c478bd9Sstevel@tonic-gate #define MIN_RECORD_SIZE (size_t)25
927c478bd9Sstevel@tonic-gate
937c478bd9Sstevel@tonic-gate #define INPUT_MIN 2
947c478bd9Sstevel@tonic-gate #define THRESHOLD_PCT 75
957c478bd9Sstevel@tonic-gate #define DEFAULT_BUF_SZ (size_t)250
967c478bd9Sstevel@tonic-gate #define BASE_PRIORITY 10 /* 0 - 20 valid for user, time share */
977c478bd9Sstevel@tonic-gate #define HIGH_PRIORITY BASE_PRIORITY - 1
987c478bd9Sstevel@tonic-gate
997c478bd9Sstevel@tonic-gate static thr_data_t in_thr; /* input thread locks and data */
1007c478bd9Sstevel@tonic-gate static int doorfd = -1;
1017c478bd9Sstevel@tonic-gate
1027c478bd9Sstevel@tonic-gate static int largest_queue = INPUT_MIN;
1037c478bd9Sstevel@tonic-gate static au_queue_t b_pool;
1047c478bd9Sstevel@tonic-gate static int b_allocated = 0;
1057c478bd9Sstevel@tonic-gate static pthread_mutex_t b_alloc_lock;
1067c478bd9Sstevel@tonic-gate static pthread_mutex_t b_refcnt_lock;
1077c478bd9Sstevel@tonic-gate
1087c478bd9Sstevel@tonic-gate static void input(void *, void *, int, door_desc_t *, int);
109d6beba26SToomas Soome static void *process(void *);
1107c478bd9Sstevel@tonic-gate
1117c478bd9Sstevel@tonic-gate static audit_q_t *qpool_withdraw(plugin_t *);
1127c478bd9Sstevel@tonic-gate static void qpool_init(plugin_t *, int);
1137c478bd9Sstevel@tonic-gate static void qpool_return(plugin_t *, audit_q_t *);
1147c478bd9Sstevel@tonic-gate static void qpool_close(plugin_t *);
1157c478bd9Sstevel@tonic-gate
1167c478bd9Sstevel@tonic-gate static audit_rec_t *bpool_withdraw(char *, size_t, size_t);
1177c478bd9Sstevel@tonic-gate static void bpool_init();
1187c478bd9Sstevel@tonic-gate static void bpool_return(audit_rec_t *);
1197c478bd9Sstevel@tonic-gate
1207c478bd9Sstevel@tonic-gate /*
1217c478bd9Sstevel@tonic-gate * warn_or_fatal() -- log daemon error and (optionally) exit
1227c478bd9Sstevel@tonic-gate */
1237c478bd9Sstevel@tonic-gate static void
warn_or_fatal(int fatal,char * parting_shot)1247c478bd9Sstevel@tonic-gate warn_or_fatal(int fatal, char *parting_shot)
1257c478bd9Sstevel@tonic-gate {
1267c478bd9Sstevel@tonic-gate char *severity;
1277c478bd9Sstevel@tonic-gate char message[512];
1287c478bd9Sstevel@tonic-gate
1297c478bd9Sstevel@tonic-gate if (fatal)
1307c478bd9Sstevel@tonic-gate severity = gettext("fatal error");
1317c478bd9Sstevel@tonic-gate else
1327c478bd9Sstevel@tonic-gate severity = gettext("warning");
1337c478bd9Sstevel@tonic-gate
1347c478bd9Sstevel@tonic-gate (void) snprintf(message, 512, "%s: %s", severity, parting_shot);
1357c478bd9Sstevel@tonic-gate
1367c478bd9Sstevel@tonic-gate __audit_syslog("auditd", LOG_PID | LOG_ODELAY | LOG_CONS,
1377c478bd9Sstevel@tonic-gate LOG_DAEMON, LOG_ALERT, message);
1387c478bd9Sstevel@tonic-gate
1397c478bd9Sstevel@tonic-gate DPRINT((dbfp, "auditd warn_or_fatal %s: %s\n", severity, parting_shot));
1407c478bd9Sstevel@tonic-gate if (fatal)
1417c478bd9Sstevel@tonic-gate auditd_exit(1);
1427c478bd9Sstevel@tonic-gate }
1437c478bd9Sstevel@tonic-gate
1447c478bd9Sstevel@tonic-gate /* Internal to doorway.c errors... */
1457c478bd9Sstevel@tonic-gate #define INTERNAL_LOAD_ERROR -1
1467c478bd9Sstevel@tonic-gate #define INTERNAL_SYS_ERROR -2
1477c478bd9Sstevel@tonic-gate #define INTERNAL_CONFIG_ERROR -3
1487c478bd9Sstevel@tonic-gate
1497c478bd9Sstevel@tonic-gate /*
1507c478bd9Sstevel@tonic-gate * report_error -- handle errors returned by plugin
1517c478bd9Sstevel@tonic-gate *
1527c478bd9Sstevel@tonic-gate * rc is plugin's return code if it is a non-negative value,
1537c478bd9Sstevel@tonic-gate * otherwise it is a doorway.c code about a plugin.
1547c478bd9Sstevel@tonic-gate */
1557c478bd9Sstevel@tonic-gate static void
report_error(int rc,char * error_text,char * plugin_path)15650f7888bSToomas Soome report_error(int rc, char *error_text, char *plugin_path)
1577c478bd9Sstevel@tonic-gate {
1587c478bd9Sstevel@tonic-gate char rcbuf[100]; /* short error name string */
1597c478bd9Sstevel@tonic-gate char message[FATAL_MESSAGE_LEN];
1607c478bd9Sstevel@tonic-gate int bad_count = 0;
1617c478bd9Sstevel@tonic-gate char *name;
1627c478bd9Sstevel@tonic-gate char empty[] = "..";
163*430fb051SAndy Giles boolean_t warn = B_FALSE, discard = B_FALSE;
1647c478bd9Sstevel@tonic-gate
1657c478bd9Sstevel@tonic-gate static int no_plug = 0;
1667c478bd9Sstevel@tonic-gate static int no_load = 0;
1677c478bd9Sstevel@tonic-gate static int no_thread;
1687c478bd9Sstevel@tonic-gate static int no_memory = 0;
1697c478bd9Sstevel@tonic-gate static int invalid = 0;
1707c478bd9Sstevel@tonic-gate static int retry = 0;
1717c478bd9Sstevel@tonic-gate static int fail = 0;
1727c478bd9Sstevel@tonic-gate
1737c478bd9Sstevel@tonic-gate name = plugin_path;
1747c478bd9Sstevel@tonic-gate if (error_text == NULL)
1757c478bd9Sstevel@tonic-gate error_text = empty;
1767c478bd9Sstevel@tonic-gate if (name == NULL)
1777c478bd9Sstevel@tonic-gate name = empty;
1787c478bd9Sstevel@tonic-gate
1797c478bd9Sstevel@tonic-gate switch (rc) {
1807c478bd9Sstevel@tonic-gate case INTERNAL_LOAD_ERROR:
181*430fb051SAndy Giles warn = B_TRUE;
1827c478bd9Sstevel@tonic-gate bad_count = ++no_load;
1837c478bd9Sstevel@tonic-gate (void) strcpy(rcbuf, "load_error");
1847c478bd9Sstevel@tonic-gate break;
1857c478bd9Sstevel@tonic-gate case INTERNAL_SYS_ERROR:
186*430fb051SAndy Giles warn = B_TRUE;
1877c478bd9Sstevel@tonic-gate bad_count = ++no_thread;
1887c478bd9Sstevel@tonic-gate (void) strcpy(rcbuf, "sys_error");
1897c478bd9Sstevel@tonic-gate break;
1907c478bd9Sstevel@tonic-gate case INTERNAL_CONFIG_ERROR:
191*430fb051SAndy Giles warn = B_TRUE;
1927c478bd9Sstevel@tonic-gate bad_count = ++no_plug;
1937c478bd9Sstevel@tonic-gate (void) strcpy(rcbuf, "config_error");
1947c478bd9Sstevel@tonic-gate name = strdup("--");
1957c478bd9Sstevel@tonic-gate break;
1967c478bd9Sstevel@tonic-gate case AUDITD_SUCCESS:
1977c478bd9Sstevel@tonic-gate break;
1987c478bd9Sstevel@tonic-gate case AUDITD_NO_MEMORY: /* no_memory */
199*430fb051SAndy Giles warn = B_TRUE;
2007c478bd9Sstevel@tonic-gate bad_count = ++no_memory;
2017c478bd9Sstevel@tonic-gate (void) strcpy(rcbuf, "no_memory");
2027c478bd9Sstevel@tonic-gate break;
2037c478bd9Sstevel@tonic-gate case AUDITD_INVALID: /* invalid */
204*430fb051SAndy Giles warn = B_TRUE;
2057c478bd9Sstevel@tonic-gate bad_count = ++invalid;
2067c478bd9Sstevel@tonic-gate (void) strcpy(rcbuf, "invalid");
2077c478bd9Sstevel@tonic-gate break;
2087c478bd9Sstevel@tonic-gate case AUDITD_RETRY:
209*430fb051SAndy Giles warn = B_TRUE;
2107c478bd9Sstevel@tonic-gate bad_count = ++retry;
2117c478bd9Sstevel@tonic-gate (void) strcpy(rcbuf, "retry");
2127c478bd9Sstevel@tonic-gate break;
2137c478bd9Sstevel@tonic-gate case AUDITD_COMM_FAIL: /* comm_fail */
2147c478bd9Sstevel@tonic-gate (void) strcpy(rcbuf, "comm_fail");
2157c478bd9Sstevel@tonic-gate break;
2167c478bd9Sstevel@tonic-gate case AUDITD_FATAL: /* failure */
217*430fb051SAndy Giles warn = B_TRUE;
2187c478bd9Sstevel@tonic-gate bad_count = ++fail;
2197c478bd9Sstevel@tonic-gate (void) strcpy(rcbuf, "failure");
2207c478bd9Sstevel@tonic-gate break;
221*430fb051SAndy Giles case AUDITD_DISCARD: /* discarded - shouldn't get here */
222*430fb051SAndy Giles /* Don't report this one; it's a non-error. */
223*430fb051SAndy Giles discard = B_TRUE;
224*430fb051SAndy Giles (void) strcpy(rcbuf, "discarded");
225*430fb051SAndy Giles break;
2267c478bd9Sstevel@tonic-gate default:
2277c478bd9Sstevel@tonic-gate (void) strcpy(rcbuf, "error");
2287c478bd9Sstevel@tonic-gate break;
2297c478bd9Sstevel@tonic-gate }
2307c478bd9Sstevel@tonic-gate DPRINT((dbfp, "report_error(%d - %s): %s\n\t%s\n",
2317c478bd9Sstevel@tonic-gate bad_count, name, rcbuf, error_text));
2327c478bd9Sstevel@tonic-gate if (warn)
2337c478bd9Sstevel@tonic-gate __audit_dowarn2("plugin", name, rcbuf, error_text, bad_count);
234*430fb051SAndy Giles else if (!discard) {
2357c478bd9Sstevel@tonic-gate (void) snprintf(message, FATAL_MESSAGE_LEN,
2367c478bd9Sstevel@tonic-gate gettext("audit plugin %s reported error = \"%s\": %s\n"),
2377c478bd9Sstevel@tonic-gate name, rcbuf, error_text);
2387c478bd9Sstevel@tonic-gate warn_or_fatal(0, message);
2397c478bd9Sstevel@tonic-gate }
2407c478bd9Sstevel@tonic-gate }
2417c478bd9Sstevel@tonic-gate
2427c478bd9Sstevel@tonic-gate static size_t
getlen(char * buf)2437c478bd9Sstevel@tonic-gate getlen(char *buf)
2447c478bd9Sstevel@tonic-gate {
2457c478bd9Sstevel@tonic-gate adr_t adr;
2467c478bd9Sstevel@tonic-gate char tokenid;
2477c478bd9Sstevel@tonic-gate uint32_t len;
2487c478bd9Sstevel@tonic-gate
2497c478bd9Sstevel@tonic-gate adr.adr_now = buf;
2507c478bd9Sstevel@tonic-gate adr.adr_stream = buf;
2517c478bd9Sstevel@tonic-gate
2527c478bd9Sstevel@tonic-gate adrm_char(&adr, &tokenid, 1);
2537c478bd9Sstevel@tonic-gate if ((tokenid == AUT_OHEADER) || (tokenid == AUT_HEADER32) ||
2547c478bd9Sstevel@tonic-gate (tokenid == AUT_HEADER32_EX) || (tokenid == AUT_HEADER64) ||
2557c478bd9Sstevel@tonic-gate (tokenid == AUT_HEADER64_EX)) {
2567c478bd9Sstevel@tonic-gate adrm_u_int32(&adr, &len, 1);
2577c478bd9Sstevel@tonic-gate
2587c478bd9Sstevel@tonic-gate return (len);
2597c478bd9Sstevel@tonic-gate }
2607c478bd9Sstevel@tonic-gate DPRINT((dbfp, "getlen() is not looking at a header token\n"));
2617c478bd9Sstevel@tonic-gate
2627c478bd9Sstevel@tonic-gate return (0);
2637c478bd9Sstevel@tonic-gate }
2647c478bd9Sstevel@tonic-gate
2657c478bd9Sstevel@tonic-gate /*
2667c478bd9Sstevel@tonic-gate * load_function - call dlsym() to resolve the function address
2677c478bd9Sstevel@tonic-gate */
2687c478bd9Sstevel@tonic-gate static int
load_function(plugin_t * p,char * name,auditd_rc_t (** func)())2697c478bd9Sstevel@tonic-gate load_function(plugin_t *p, char *name, auditd_rc_t (**func)())
2707c478bd9Sstevel@tonic-gate {
2717c478bd9Sstevel@tonic-gate *func = (auditd_rc_t (*)())dlsym(p->plg_dlptr, name);
2727c478bd9Sstevel@tonic-gate if (*func == NULL) {
2737c478bd9Sstevel@tonic-gate char message[FATAL_MESSAGE_LEN];
2747c478bd9Sstevel@tonic-gate char *errmsg = dlerror();
2757c478bd9Sstevel@tonic-gate
2767c478bd9Sstevel@tonic-gate (void) snprintf(message, FATAL_MESSAGE_LEN,
2777c478bd9Sstevel@tonic-gate gettext("dlsym failed %s: error %s"),
2787c478bd9Sstevel@tonic-gate name, errmsg != NULL ? errmsg : gettext("Unknown error\n"));
2797c478bd9Sstevel@tonic-gate
2807c478bd9Sstevel@tonic-gate warn_or_fatal(0, message);
2817c478bd9Sstevel@tonic-gate return (-1);
2827c478bd9Sstevel@tonic-gate }
2837c478bd9Sstevel@tonic-gate return (0);
2847c478bd9Sstevel@tonic-gate }
2857c478bd9Sstevel@tonic-gate
2867c478bd9Sstevel@tonic-gate /*
2877c478bd9Sstevel@tonic-gate * load the auditd plug in
2887c478bd9Sstevel@tonic-gate */
2897c478bd9Sstevel@tonic-gate static int
load_plugin(plugin_t * p)2907c478bd9Sstevel@tonic-gate load_plugin(plugin_t *p)
2917c478bd9Sstevel@tonic-gate {
2927c478bd9Sstevel@tonic-gate struct stat64 stat;
2937c478bd9Sstevel@tonic-gate int fd;
2947c478bd9Sstevel@tonic-gate int fail = 0;
2957c478bd9Sstevel@tonic-gate
2967c478bd9Sstevel@tonic-gate /*
2977c478bd9Sstevel@tonic-gate * Stat the file so we can check modes and ownerships
2987c478bd9Sstevel@tonic-gate */
2997c478bd9Sstevel@tonic-gate if ((fd = open(p->plg_path, O_NONBLOCK | O_RDONLY)) != -1) {
3007c478bd9Sstevel@tonic-gate if ((fstat64(fd, &stat) == -1) || (!S_ISREG(stat.st_mode)))
3017c478bd9Sstevel@tonic-gate fail = 1;
3027c478bd9Sstevel@tonic-gate } else
3037c478bd9Sstevel@tonic-gate fail = 1;
3047c478bd9Sstevel@tonic-gate if (fail) {
3057c478bd9Sstevel@tonic-gate char message[FATAL_MESSAGE_LEN];
3067c478bd9Sstevel@tonic-gate
3077c478bd9Sstevel@tonic-gate (void) snprintf(message, FATAL_MESSAGE_LEN,
3087c478bd9Sstevel@tonic-gate gettext("auditd plugin: stat(%s) failed: %s\n"),
3097c478bd9Sstevel@tonic-gate p->plg_path, strerror(errno));
3107c478bd9Sstevel@tonic-gate
3117c478bd9Sstevel@tonic-gate warn_or_fatal(0, message);
3127c478bd9Sstevel@tonic-gate return (-1);
3137c478bd9Sstevel@tonic-gate }
3147c478bd9Sstevel@tonic-gate /*
3157c478bd9Sstevel@tonic-gate * Check the ownership of the file
3167c478bd9Sstevel@tonic-gate */
3177c478bd9Sstevel@tonic-gate if (stat.st_uid != (uid_t)0) {
3187c478bd9Sstevel@tonic-gate char message[FATAL_MESSAGE_LEN];
3197c478bd9Sstevel@tonic-gate
3207c478bd9Sstevel@tonic-gate (void) snprintf(message, FATAL_MESSAGE_LEN,
3217c478bd9Sstevel@tonic-gate gettext(
3227c478bd9Sstevel@tonic-gate "auditd plugin: Owner of the module %s is not root\n"),
3237c478bd9Sstevel@tonic-gate p->plg_path);
3247c478bd9Sstevel@tonic-gate
3257c478bd9Sstevel@tonic-gate warn_or_fatal(0, message);
3267c478bd9Sstevel@tonic-gate return (-1);
3277c478bd9Sstevel@tonic-gate }
3287c478bd9Sstevel@tonic-gate /*
3297c478bd9Sstevel@tonic-gate * Check the modes on the file
3307c478bd9Sstevel@tonic-gate */
3317c478bd9Sstevel@tonic-gate if (stat.st_mode&S_IWGRP) {
3327c478bd9Sstevel@tonic-gate char message[FATAL_MESSAGE_LEN];
3337c478bd9Sstevel@tonic-gate
3347c478bd9Sstevel@tonic-gate (void) snprintf(message, FATAL_MESSAGE_LEN,
3357c478bd9Sstevel@tonic-gate gettext("auditd plugin: module %s writable by group\n"),
3367c478bd9Sstevel@tonic-gate p->plg_path);
3377c478bd9Sstevel@tonic-gate
3387c478bd9Sstevel@tonic-gate warn_or_fatal(0, message);
3397c478bd9Sstevel@tonic-gate return (-1);
3407c478bd9Sstevel@tonic-gate }
3417c478bd9Sstevel@tonic-gate if (stat.st_mode&S_IWOTH) {
3427c478bd9Sstevel@tonic-gate char message[FATAL_MESSAGE_LEN];
3437c478bd9Sstevel@tonic-gate
3447c478bd9Sstevel@tonic-gate (void) snprintf(message, FATAL_MESSAGE_LEN,
3457c478bd9Sstevel@tonic-gate gettext("auditd plugin: module %s writable by world\n"),
3467c478bd9Sstevel@tonic-gate p->plg_path);
3477c478bd9Sstevel@tonic-gate
3487c478bd9Sstevel@tonic-gate warn_or_fatal(0, message);
3497c478bd9Sstevel@tonic-gate return (-1);
3507c478bd9Sstevel@tonic-gate }
3517c478bd9Sstevel@tonic-gate /*
3527c478bd9Sstevel@tonic-gate * Open the plugin
3537c478bd9Sstevel@tonic-gate */
3547c478bd9Sstevel@tonic-gate p->plg_dlptr = dlopen(p->plg_path, RTLD_LAZY);
3557c478bd9Sstevel@tonic-gate
3567c478bd9Sstevel@tonic-gate if (p->plg_dlptr == NULL) {
3577c478bd9Sstevel@tonic-gate char message[FATAL_MESSAGE_LEN];
3587c478bd9Sstevel@tonic-gate char *errmsg = dlerror();
3597c478bd9Sstevel@tonic-gate
3607c478bd9Sstevel@tonic-gate (void) snprintf(message, FATAL_MESSAGE_LEN,
3617c478bd9Sstevel@tonic-gate gettext("plugin load %s failed: %s\n"),
3627c478bd9Sstevel@tonic-gate p->plg_path, errmsg != NULL ? errmsg :
3637c478bd9Sstevel@tonic-gate gettext("Unknown error\n"));
3647c478bd9Sstevel@tonic-gate
3657c478bd9Sstevel@tonic-gate warn_or_fatal(0, message);
3667c478bd9Sstevel@tonic-gate return (-1);
3677c478bd9Sstevel@tonic-gate }
3687c478bd9Sstevel@tonic-gate if (load_function(p, "auditd_plugin", &(p->plg_fplugin)))
3697c478bd9Sstevel@tonic-gate return (-1);
3707c478bd9Sstevel@tonic-gate
3717c478bd9Sstevel@tonic-gate if (load_function(p, "auditd_plugin_open", &(p->plg_fplugin_open)))
3727c478bd9Sstevel@tonic-gate return (-1);
3737c478bd9Sstevel@tonic-gate
3747c478bd9Sstevel@tonic-gate if (load_function(p, "auditd_plugin_close", &(p->plg_fplugin_close)))
3757c478bd9Sstevel@tonic-gate return (-1);
3767c478bd9Sstevel@tonic-gate
3777c478bd9Sstevel@tonic-gate return (0);
3787c478bd9Sstevel@tonic-gate }
3797c478bd9Sstevel@tonic-gate
3807c478bd9Sstevel@tonic-gate /*
3817c478bd9Sstevel@tonic-gate * unload_plugin() unlinks and frees the plugin_t structure after
3827c478bd9Sstevel@tonic-gate * freeing buffers and structures that hang off it. It also dlcloses
3837c478bd9Sstevel@tonic-gate * the referenced plugin. The return is the next entry, which may be NULL
3847c478bd9Sstevel@tonic-gate *
3857c478bd9Sstevel@tonic-gate * hold plugin_mutex for this call
3867c478bd9Sstevel@tonic-gate */
3877c478bd9Sstevel@tonic-gate static plugin_t *
unload_plugin(plugin_t * p)3887c478bd9Sstevel@tonic-gate unload_plugin(plugin_t *p)
3897c478bd9Sstevel@tonic-gate {
3907c478bd9Sstevel@tonic-gate plugin_t *q, **r;
3917c478bd9Sstevel@tonic-gate
3927c478bd9Sstevel@tonic-gate assert(pthread_mutex_trylock(&plugin_mutex) != 0);
3937c478bd9Sstevel@tonic-gate
3947c478bd9Sstevel@tonic-gate DPRINT((dbfp, "unload_plugin: removing %s\n", p->plg_path));
3957c478bd9Sstevel@tonic-gate
3967c478bd9Sstevel@tonic-gate _kva_free(p->plg_kvlist); /* _kva_free accepts NULL */
3977c478bd9Sstevel@tonic-gate qpool_close(p); /* qpool_close accepts NULL pool, queue */
3987c478bd9Sstevel@tonic-gate DPRINT((dbfp, "unload_plugin: %s structure removed\n", p->plg_path));
3997c478bd9Sstevel@tonic-gate
4007c478bd9Sstevel@tonic-gate (void) dlclose(p->plg_dlptr);
4017c478bd9Sstevel@tonic-gate
4027c478bd9Sstevel@tonic-gate DPRINT((dbfp, "unload_plugin: %s dlclosed\n", p->plg_path));
4037c478bd9Sstevel@tonic-gate free(p->plg_path);
4047c478bd9Sstevel@tonic-gate
4057c478bd9Sstevel@tonic-gate (void) pthread_mutex_destroy(&(p->plg_mutex));
4067c478bd9Sstevel@tonic-gate (void) pthread_cond_destroy(&(p->plg_cv));
4077c478bd9Sstevel@tonic-gate
4087c478bd9Sstevel@tonic-gate q = plugin_head;
4097c478bd9Sstevel@tonic-gate r = &plugin_head;
4107c478bd9Sstevel@tonic-gate while (q != NULL) {
4117c478bd9Sstevel@tonic-gate if (q == p) {
4127c478bd9Sstevel@tonic-gate *r = p->plg_next;
4137c478bd9Sstevel@tonic-gate free(p);
4147c478bd9Sstevel@tonic-gate break;
4157c478bd9Sstevel@tonic-gate }
4167c478bd9Sstevel@tonic-gate r = &(q->plg_next);
4177c478bd9Sstevel@tonic-gate q = q->plg_next;
4187c478bd9Sstevel@tonic-gate }
4197c478bd9Sstevel@tonic-gate return (*r);
4207c478bd9Sstevel@tonic-gate }
4217c478bd9Sstevel@tonic-gate
4227c478bd9Sstevel@tonic-gate /*
4237c478bd9Sstevel@tonic-gate * process return values from plugin_open
4247c478bd9Sstevel@tonic-gate *
4257c478bd9Sstevel@tonic-gate * presently no attribute is defined.
4267c478bd9Sstevel@tonic-gate */
4277c478bd9Sstevel@tonic-gate /* ARGSUSED */
4287c478bd9Sstevel@tonic-gate static void
open_return(plugin_t * p,char * attrval)4297c478bd9Sstevel@tonic-gate open_return(plugin_t *p, char *attrval)
4307c478bd9Sstevel@tonic-gate {
4317c478bd9Sstevel@tonic-gate }
4327c478bd9Sstevel@tonic-gate
4337c478bd9Sstevel@tonic-gate /*
4347c478bd9Sstevel@tonic-gate * auditd_thread_init
4357c478bd9Sstevel@tonic-gate * - create threads
4367c478bd9Sstevel@tonic-gate * - load plugins
4377c478bd9Sstevel@tonic-gate *
4387c478bd9Sstevel@tonic-gate * auditd_thread_init is called at auditd startup with an initial list
439f8994074SJan Friedel * of plugins and again each time audit catches a SIGHUP or SIGUSR1.
4407c478bd9Sstevel@tonic-gate */
4417c478bd9Sstevel@tonic-gate int
auditd_thread_init()4427c478bd9Sstevel@tonic-gate auditd_thread_init()
4437c478bd9Sstevel@tonic-gate {
4447c478bd9Sstevel@tonic-gate int threshold;
4457c478bd9Sstevel@tonic-gate auditd_rc_t rc;
4467c478bd9Sstevel@tonic-gate plugin_t *p;
4477c478bd9Sstevel@tonic-gate char *open_params;
4487c478bd9Sstevel@tonic-gate char *error_string;
4497c478bd9Sstevel@tonic-gate int plugin_count = 0;
4507c478bd9Sstevel@tonic-gate static int threads_ready = 0;
4517c478bd9Sstevel@tonic-gate
4527c478bd9Sstevel@tonic-gate if (!threads_ready) {
4537c478bd9Sstevel@tonic-gate struct sched_param param;
4547c478bd9Sstevel@tonic-gate #if DEBUG
4557c478bd9Sstevel@tonic-gate dbfp = __auditd_debug_file_open();
4567c478bd9Sstevel@tonic-gate #endif
4577c478bd9Sstevel@tonic-gate doorfd = door_create((void(*)())input, 0,
4587c478bd9Sstevel@tonic-gate DOOR_REFUSE_DESC | DOOR_NO_CANCEL);
4597c478bd9Sstevel@tonic-gate if (doorfd < 0)
4607c478bd9Sstevel@tonic-gate return (1); /* can't create door -> fatal */
4617c478bd9Sstevel@tonic-gate
4627c478bd9Sstevel@tonic-gate param.sched_priority = BASE_PRIORITY;
4637c478bd9Sstevel@tonic-gate (void) pthread_setschedparam(pthread_self(), SCHED_OTHER,
4647c478bd9Sstevel@tonic-gate ¶m);
4657c478bd9Sstevel@tonic-gate
4667c478bd9Sstevel@tonic-gate /* input door server */
4677c478bd9Sstevel@tonic-gate (void) pthread_mutex_init(&(in_thr.thd_mutex), NULL);
4687c478bd9Sstevel@tonic-gate (void) pthread_cond_init(&(in_thr.thd_cv), NULL);
4697c478bd9Sstevel@tonic-gate in_thr.thd_waiting = 0;
4707c478bd9Sstevel@tonic-gate
4717c478bd9Sstevel@tonic-gate bpool_init();
4727c478bd9Sstevel@tonic-gate }
4737c478bd9Sstevel@tonic-gate p = plugin_head;
4747c478bd9Sstevel@tonic-gate while (p != NULL) {
4757c478bd9Sstevel@tonic-gate if (p->plg_removed) {
4767c478bd9Sstevel@tonic-gate DPRINT((dbfp, "start removing %s\n", p->plg_path));
4777c478bd9Sstevel@tonic-gate /* tell process(p) to exit and dlclose */
4787c478bd9Sstevel@tonic-gate (void) pthread_cond_signal(&(p->plg_cv));
4797c478bd9Sstevel@tonic-gate } else if (!p->plg_initialized) {
4807c478bd9Sstevel@tonic-gate DPRINT((dbfp, "start initial load of %s\n",
4817c478bd9Sstevel@tonic-gate p->plg_path));
4827c478bd9Sstevel@tonic-gate if (load_plugin(p)) {
4837c478bd9Sstevel@tonic-gate report_error(INTERNAL_LOAD_ERROR,
4847c478bd9Sstevel@tonic-gate gettext("dynamic load failed"),
4857c478bd9Sstevel@tonic-gate p->plg_path);
4867c478bd9Sstevel@tonic-gate p = unload_plugin(p);
4877c478bd9Sstevel@tonic-gate continue;
4887c478bd9Sstevel@tonic-gate }
4897c478bd9Sstevel@tonic-gate open_params = NULL;
4907c478bd9Sstevel@tonic-gate error_string = NULL;
4917c478bd9Sstevel@tonic-gate if ((rc = p->plg_fplugin_open(
4927c478bd9Sstevel@tonic-gate p->plg_kvlist,
4937c478bd9Sstevel@tonic-gate &open_params, &error_string)) != AUDITD_SUCCESS) {
4947c478bd9Sstevel@tonic-gate report_error(rc, error_string, p->plg_path);
4957c478bd9Sstevel@tonic-gate free(error_string);
4967c478bd9Sstevel@tonic-gate p = unload_plugin(p);
4977c478bd9Sstevel@tonic-gate continue;
4987c478bd9Sstevel@tonic-gate }
4997c478bd9Sstevel@tonic-gate open_return(p, open_params);
5007c478bd9Sstevel@tonic-gate p->plg_reopen = 0;
5017c478bd9Sstevel@tonic-gate
5027c478bd9Sstevel@tonic-gate threshold = ((p->plg_qmax * THRESHOLD_PCT) + 99) / 100;
5037c478bd9Sstevel@tonic-gate p->plg_qmin = INPUT_MIN;
5047c478bd9Sstevel@tonic-gate
5057c478bd9Sstevel@tonic-gate DPRINT((dbfp,
5067c478bd9Sstevel@tonic-gate "calling qpool_init for %s with qmax=%d\n",
5077c478bd9Sstevel@tonic-gate p->plg_path, p->plg_qmax));
5087c478bd9Sstevel@tonic-gate
5097c478bd9Sstevel@tonic-gate qpool_init(p, threshold);
5107c478bd9Sstevel@tonic-gate audit_queue_init(&(p->plg_queue));
5117c478bd9Sstevel@tonic-gate p->plg_initialized = 1;
5127c478bd9Sstevel@tonic-gate
5137c478bd9Sstevel@tonic-gate (void) pthread_mutex_init(&(p->plg_mutex), NULL);
5147c478bd9Sstevel@tonic-gate (void) pthread_cond_init(&(p->plg_cv), NULL);
5157c478bd9Sstevel@tonic-gate p->plg_waiting = 0;
5167c478bd9Sstevel@tonic-gate
517d6beba26SToomas Soome if (pthread_create(&(p->plg_tid), NULL, process, p)) {
5187c478bd9Sstevel@tonic-gate report_error(INTERNAL_SYS_ERROR,
5197c478bd9Sstevel@tonic-gate gettext("thread creation failed"),
5207c478bd9Sstevel@tonic-gate p->plg_path);
5217c478bd9Sstevel@tonic-gate p = unload_plugin(p);
5227c478bd9Sstevel@tonic-gate continue;
5237c478bd9Sstevel@tonic-gate }
5247c478bd9Sstevel@tonic-gate } else if (p->plg_reopen) {
5257c478bd9Sstevel@tonic-gate DPRINT((dbfp, "reopen %s\n", p->plg_path));
5267c478bd9Sstevel@tonic-gate error_string = NULL;
527f8994074SJan Friedel if ((rc = p->plg_fplugin_open(p->plg_kvlist,
5287c478bd9Sstevel@tonic-gate &open_params, &error_string)) != AUDITD_SUCCESS) {
5297c478bd9Sstevel@tonic-gate report_error(rc, error_string, p->plg_path);
5307c478bd9Sstevel@tonic-gate free(error_string);
5317c478bd9Sstevel@tonic-gate p = unload_plugin(p);
5327c478bd9Sstevel@tonic-gate continue;
5337c478bd9Sstevel@tonic-gate }
5347c478bd9Sstevel@tonic-gate open_return(p, open_params);
5357c478bd9Sstevel@tonic-gate p->plg_reopen = 0;
5367c478bd9Sstevel@tonic-gate
5377c478bd9Sstevel@tonic-gate DPRINT((dbfp, "%s qmax=%d\n",
5387c478bd9Sstevel@tonic-gate p->plg_path, p->plg_qmax));
5397c478bd9Sstevel@tonic-gate
5407c478bd9Sstevel@tonic-gate }
5417c478bd9Sstevel@tonic-gate p->plg_q_threshold = ((p->plg_qmax * THRESHOLD_PCT) + 99) / 100;
5427c478bd9Sstevel@tonic-gate
5437c478bd9Sstevel@tonic-gate p = p->plg_next;
5447c478bd9Sstevel@tonic-gate plugin_count++;
5457c478bd9Sstevel@tonic-gate }
5467c478bd9Sstevel@tonic-gate if (plugin_count == 0) {
5477c478bd9Sstevel@tonic-gate report_error(INTERNAL_CONFIG_ERROR,
5487c478bd9Sstevel@tonic-gate gettext("No plugins are configured"), NULL);
5497c478bd9Sstevel@tonic-gate return (-1);
5507c478bd9Sstevel@tonic-gate }
5517c478bd9Sstevel@tonic-gate if (!threads_ready) {
5527c478bd9Sstevel@tonic-gate /* unleash the kernel */
5537c478bd9Sstevel@tonic-gate rc = auditdoor(doorfd);
5547c478bd9Sstevel@tonic-gate
5557c478bd9Sstevel@tonic-gate DPRINT((dbfp, "%d returned from auditdoor.\n",
5567c478bd9Sstevel@tonic-gate rc));
5577c478bd9Sstevel@tonic-gate if (rc != 0)
5587c478bd9Sstevel@tonic-gate return (1); /* fatal */
5597c478bd9Sstevel@tonic-gate
5607c478bd9Sstevel@tonic-gate threads_ready = 1;
5617c478bd9Sstevel@tonic-gate }
5627c478bd9Sstevel@tonic-gate return (0);
5637c478bd9Sstevel@tonic-gate }
5647c478bd9Sstevel@tonic-gate
5657c478bd9Sstevel@tonic-gate /*
5667c478bd9Sstevel@tonic-gate * Door invocations that are in progress during a
5677c478bd9Sstevel@tonic-gate * door_revoke() invocation are allowed to complete normally.
5687c478bd9Sstevel@tonic-gate * -- man page for door_revoke()
5697c478bd9Sstevel@tonic-gate */
5707c478bd9Sstevel@tonic-gate void
auditd_thread_close()5717c478bd9Sstevel@tonic-gate auditd_thread_close()
5727c478bd9Sstevel@tonic-gate {
5737c478bd9Sstevel@tonic-gate if (doorfd == -1)
5747c478bd9Sstevel@tonic-gate return;
5757c478bd9Sstevel@tonic-gate (void) door_revoke(doorfd);
5767c478bd9Sstevel@tonic-gate doorfd = -1;
5777c478bd9Sstevel@tonic-gate }
5787c478bd9Sstevel@tonic-gate
5797c478bd9Sstevel@tonic-gate /*
5807c478bd9Sstevel@tonic-gate * qpool_init() sets up pool for queue entries (audit_q_t)
5817c478bd9Sstevel@tonic-gate *
5827c478bd9Sstevel@tonic-gate */
5837c478bd9Sstevel@tonic-gate static void
qpool_init(plugin_t * p,int threshold)5847c478bd9Sstevel@tonic-gate qpool_init(plugin_t *p, int threshold)
5857c478bd9Sstevel@tonic-gate {
5867c478bd9Sstevel@tonic-gate int i;
5877c478bd9Sstevel@tonic-gate audit_q_t *node;
5887c478bd9Sstevel@tonic-gate
5897c478bd9Sstevel@tonic-gate audit_queue_init(&(p->plg_pool));
5907c478bd9Sstevel@tonic-gate
5917c478bd9Sstevel@tonic-gate DPRINT((dbfp, "qpool_init(%d) max, min, threshhold = %d, %d, %d\n",
5921a578a15Spaulson p->plg_tid, p->plg_qmax, p->plg_qmin, threshold));
5937c478bd9Sstevel@tonic-gate
5947c478bd9Sstevel@tonic-gate if (p->plg_qmax > largest_queue)
5957c478bd9Sstevel@tonic-gate largest_queue = p->plg_qmax;
5967c478bd9Sstevel@tonic-gate
5977c478bd9Sstevel@tonic-gate p->plg_q_threshold = threshold;
5987c478bd9Sstevel@tonic-gate
5997c478bd9Sstevel@tonic-gate for (i = 0; i < p->plg_qmin; i++) {
6007c478bd9Sstevel@tonic-gate node = malloc(sizeof (audit_q_t));
6017c478bd9Sstevel@tonic-gate if (node == NULL)
6027c478bd9Sstevel@tonic-gate warn_or_fatal(1, gettext("no memory\n"));
6037c478bd9Sstevel@tonic-gate /* doesn't return */
6047c478bd9Sstevel@tonic-gate
6057c478bd9Sstevel@tonic-gate audit_enqueue(&p->plg_pool, node);
6067c478bd9Sstevel@tonic-gate }
6077c478bd9Sstevel@tonic-gate }
6087c478bd9Sstevel@tonic-gate
6097c478bd9Sstevel@tonic-gate /*
6107c478bd9Sstevel@tonic-gate * bpool_init() sets up pool and queue for record entries (audit_rec_t)
6117c478bd9Sstevel@tonic-gate *
6127c478bd9Sstevel@tonic-gate */
6137c478bd9Sstevel@tonic-gate static void
bpool_init()6147c478bd9Sstevel@tonic-gate bpool_init()
6157c478bd9Sstevel@tonic-gate {
6167c478bd9Sstevel@tonic-gate int i;
6177c478bd9Sstevel@tonic-gate audit_rec_t *node;
6187c478bd9Sstevel@tonic-gate
6197c478bd9Sstevel@tonic-gate audit_queue_init(&b_pool);
6207c478bd9Sstevel@tonic-gate (void) pthread_mutex_init(&b_alloc_lock, NULL);
6217c478bd9Sstevel@tonic-gate (void) pthread_mutex_init(&b_refcnt_lock, NULL);
6227c478bd9Sstevel@tonic-gate
6237c478bd9Sstevel@tonic-gate for (i = 0; i < INPUT_MIN; i++) {
6247c478bd9Sstevel@tonic-gate node = malloc(AUDIT_REC_HEADER + DEFAULT_BUF_SZ);
6257c478bd9Sstevel@tonic-gate if (node == NULL)
6267c478bd9Sstevel@tonic-gate warn_or_fatal(1, gettext("no memory\n"));
6277c478bd9Sstevel@tonic-gate /* doesn't return */
6287c478bd9Sstevel@tonic-gate
6297c478bd9Sstevel@tonic-gate node->abq_buf_len = DEFAULT_BUF_SZ;
6307c478bd9Sstevel@tonic-gate
6317c478bd9Sstevel@tonic-gate node->abq_data_len = 0;
6327c478bd9Sstevel@tonic-gate audit_enqueue(&b_pool, node);
6337c478bd9Sstevel@tonic-gate (void) pthread_mutex_lock(&b_alloc_lock);
6347c478bd9Sstevel@tonic-gate b_allocated++;
6357c478bd9Sstevel@tonic-gate (void) pthread_mutex_unlock(&b_alloc_lock);
6367c478bd9Sstevel@tonic-gate }
6377c478bd9Sstevel@tonic-gate }
6387c478bd9Sstevel@tonic-gate
6397c478bd9Sstevel@tonic-gate /*
6407c478bd9Sstevel@tonic-gate * qpool_close() discard queue and pool for a discontinued plugin
6417c478bd9Sstevel@tonic-gate *
6427c478bd9Sstevel@tonic-gate * there is no corresponding bpool_close() since it would only
6437c478bd9Sstevel@tonic-gate * be called as auditd is going down.
6447c478bd9Sstevel@tonic-gate */
6457c478bd9Sstevel@tonic-gate static void
qpool_close(plugin_t * p)64650f7888bSToomas Soome qpool_close(plugin_t *p)
64750f7888bSToomas Soome {
6487c478bd9Sstevel@tonic-gate audit_q_t *q_node;
6497c478bd9Sstevel@tonic-gate audit_rec_t *b_node;
6507c478bd9Sstevel@tonic-gate
6517c478bd9Sstevel@tonic-gate if (!p->plg_initialized)
6527c478bd9Sstevel@tonic-gate return;
6537c478bd9Sstevel@tonic-gate
6547c478bd9Sstevel@tonic-gate while (audit_dequeue(&(p->plg_pool), (void *)&q_node) == 0) {
6557c478bd9Sstevel@tonic-gate free(q_node);
6567c478bd9Sstevel@tonic-gate }
6577c478bd9Sstevel@tonic-gate audit_queue_destroy(&(p->plg_pool));
6587c478bd9Sstevel@tonic-gate
6597c478bd9Sstevel@tonic-gate while (audit_dequeue(&(p->plg_queue), (void *)&q_node) == 0) {
6607c478bd9Sstevel@tonic-gate b_node = audit_release(&b_refcnt_lock, q_node->aqq_data);
6617c478bd9Sstevel@tonic-gate if (b_node != NULL)
6627c478bd9Sstevel@tonic-gate audit_enqueue(&b_pool, b_node);
6637c478bd9Sstevel@tonic-gate free(q_node);
6647c478bd9Sstevel@tonic-gate }
6657c478bd9Sstevel@tonic-gate audit_queue_destroy(&(p->plg_queue));
6667c478bd9Sstevel@tonic-gate }
6677c478bd9Sstevel@tonic-gate
6687c478bd9Sstevel@tonic-gate /*
6697c478bd9Sstevel@tonic-gate * qpool_withdraw
6707c478bd9Sstevel@tonic-gate */
6717c478bd9Sstevel@tonic-gate static audit_q_t *
qpool_withdraw(plugin_t * p)6727c478bd9Sstevel@tonic-gate qpool_withdraw(plugin_t *p)
6737c478bd9Sstevel@tonic-gate {
6747c478bd9Sstevel@tonic-gate audit_q_t *node;
6757c478bd9Sstevel@tonic-gate int rc;
6767c478bd9Sstevel@tonic-gate
6777c478bd9Sstevel@tonic-gate /* get a buffer from the pool, if any */
6787c478bd9Sstevel@tonic-gate rc = audit_dequeue(&(p->plg_pool), (void *)&node);
6797c478bd9Sstevel@tonic-gate if (rc == 0)
6807c478bd9Sstevel@tonic-gate return (node);
6817c478bd9Sstevel@tonic-gate
6827c478bd9Sstevel@tonic-gate /*
6837c478bd9Sstevel@tonic-gate * the pool is empty: allocate a new element
6847c478bd9Sstevel@tonic-gate */
6857c478bd9Sstevel@tonic-gate node = malloc(sizeof (audit_q_t));
6867c478bd9Sstevel@tonic-gate
6877c478bd9Sstevel@tonic-gate if (node == NULL)
6887c478bd9Sstevel@tonic-gate warn_or_fatal(1, gettext("no memory\n"));
6897c478bd9Sstevel@tonic-gate /* doesn't return */
6907c478bd9Sstevel@tonic-gate
6917c478bd9Sstevel@tonic-gate return (node);
6927c478bd9Sstevel@tonic-gate }
6937c478bd9Sstevel@tonic-gate
6947c478bd9Sstevel@tonic-gate /*
6957c478bd9Sstevel@tonic-gate * bpool_withdraw -- gets a buffer and fills it
6967c478bd9Sstevel@tonic-gate *
6977c478bd9Sstevel@tonic-gate */
6987c478bd9Sstevel@tonic-gate static audit_rec_t *
bpool_withdraw(char * buffer,size_t buff_size,size_t request_size)6997c478bd9Sstevel@tonic-gate bpool_withdraw(char *buffer, size_t buff_size, size_t request_size)
7007c478bd9Sstevel@tonic-gate {
7017c478bd9Sstevel@tonic-gate audit_rec_t *node;
7027c478bd9Sstevel@tonic-gate int rc;
7037c478bd9Sstevel@tonic-gate size_t new_length;
7047c478bd9Sstevel@tonic-gate
7057c478bd9Sstevel@tonic-gate new_length = (request_size > DEFAULT_BUF_SZ) ?
7067c478bd9Sstevel@tonic-gate request_size : DEFAULT_BUF_SZ;
7077c478bd9Sstevel@tonic-gate
7087c478bd9Sstevel@tonic-gate /* get a buffer from the pool, if any */
7097c478bd9Sstevel@tonic-gate rc = audit_dequeue(&b_pool, (void *)&node);
7107c478bd9Sstevel@tonic-gate
7117c478bd9Sstevel@tonic-gate DPRINT((dbfp, "bpool_withdraw buf length=%d,"
7121a578a15Spaulson " requested size=%d, dequeue rc=%d\n",
7131a578a15Spaulson new_length, request_size, rc));
7147c478bd9Sstevel@tonic-gate
7157c478bd9Sstevel@tonic-gate if (rc == 0) {
716dfc7be02SJan Friedel DPRINT((dbfp, "bpool_withdraw node=%p (pool=%d)\n",
717dfc7be02SJan Friedel (void *)node, audit_queue_size(&b_pool)));
7187c478bd9Sstevel@tonic-gate
7197c478bd9Sstevel@tonic-gate if (new_length > node->abq_buf_len) {
7207c478bd9Sstevel@tonic-gate node = realloc(node, AUDIT_REC_HEADER + new_length);
7217c478bd9Sstevel@tonic-gate if (node == NULL)
7227c478bd9Sstevel@tonic-gate warn_or_fatal(1, gettext("no memory\n"));
7237c478bd9Sstevel@tonic-gate /* no return */
7247c478bd9Sstevel@tonic-gate }
7257c478bd9Sstevel@tonic-gate } else {
7267c478bd9Sstevel@tonic-gate /*
7277c478bd9Sstevel@tonic-gate * the pool is empty: allocate a new element
7287c478bd9Sstevel@tonic-gate */
7297c478bd9Sstevel@tonic-gate (void) pthread_mutex_lock(&b_alloc_lock);
7307c478bd9Sstevel@tonic-gate if (b_allocated >= largest_queue) {
7317c478bd9Sstevel@tonic-gate (void) pthread_mutex_unlock(&b_alloc_lock);
7327c478bd9Sstevel@tonic-gate DPRINT((dbfp, "bpool_withdraw is over max (pool=%d)\n",
7337c478bd9Sstevel@tonic-gate audit_queue_size(&b_pool)));
7347c478bd9Sstevel@tonic-gate return (NULL);
7357c478bd9Sstevel@tonic-gate }
7367c478bd9Sstevel@tonic-gate (void) pthread_mutex_unlock(&b_alloc_lock);
7377c478bd9Sstevel@tonic-gate
7387c478bd9Sstevel@tonic-gate node = malloc(AUDIT_REC_HEADER + new_length);
7397c478bd9Sstevel@tonic-gate
7407c478bd9Sstevel@tonic-gate if (node == NULL)
7417c478bd9Sstevel@tonic-gate warn_or_fatal(1, gettext("no memory\n"));
7427c478bd9Sstevel@tonic-gate /* no return */
7437c478bd9Sstevel@tonic-gate
7447c478bd9Sstevel@tonic-gate (void) pthread_mutex_lock(&b_alloc_lock);
7457c478bd9Sstevel@tonic-gate b_allocated++;
7467c478bd9Sstevel@tonic-gate (void) pthread_mutex_unlock(&b_alloc_lock);
747dfc7be02SJan Friedel DPRINT((dbfp, "bpool_withdraw node=%p (alloc=%d, pool=%d)\n",
748dfc7be02SJan Friedel (void *)node, b_allocated, audit_queue_size(&b_pool)));
7497c478bd9Sstevel@tonic-gate }
7507c478bd9Sstevel@tonic-gate assert(request_size <= new_length);
7517c478bd9Sstevel@tonic-gate
7527c478bd9Sstevel@tonic-gate (void) memcpy(node->abq_buffer, buffer, buff_size);
7537c478bd9Sstevel@tonic-gate node->abq_data_len = buff_size;
7547c478bd9Sstevel@tonic-gate node->abq_buf_len = new_length;
7557c478bd9Sstevel@tonic-gate node->abq_ref_count = 0;
7567c478bd9Sstevel@tonic-gate
7577c478bd9Sstevel@tonic-gate return (node);
7587c478bd9Sstevel@tonic-gate }
7597c478bd9Sstevel@tonic-gate
7607c478bd9Sstevel@tonic-gate /*
7617c478bd9Sstevel@tonic-gate * qpool_return() moves queue nodes back to the pool queue.
7627c478bd9Sstevel@tonic-gate *
7637c478bd9Sstevel@tonic-gate * if the pool is over max, the node is discarded instead.
7647c478bd9Sstevel@tonic-gate */
7657c478bd9Sstevel@tonic-gate static void
qpool_return(plugin_t * p,audit_q_t * node)7667c478bd9Sstevel@tonic-gate qpool_return(plugin_t *p, audit_q_t *node)
7677c478bd9Sstevel@tonic-gate {
7687c478bd9Sstevel@tonic-gate int qpool_size;
7697c478bd9Sstevel@tonic-gate int q_size;
7707c478bd9Sstevel@tonic-gate
7717c478bd9Sstevel@tonic-gate #if DEBUG
7728f775e0aSJan Friedel uint64_t sequence = node->aqq_sequence;
7737c478bd9Sstevel@tonic-gate #endif
7747c478bd9Sstevel@tonic-gate qpool_size = audit_queue_size(&(p->plg_pool));
7757c478bd9Sstevel@tonic-gate q_size = audit_queue_size(&(p->plg_queue));
7767c478bd9Sstevel@tonic-gate
7777c478bd9Sstevel@tonic-gate if (qpool_size + q_size > p->plg_qmax)
7787c478bd9Sstevel@tonic-gate free(node);
7797c478bd9Sstevel@tonic-gate else
7807c478bd9Sstevel@tonic-gate audit_enqueue(&(p->plg_pool), node);
7817c478bd9Sstevel@tonic-gate
7827c478bd9Sstevel@tonic-gate DPRINT((dbfp,
7838f775e0aSJan Friedel "qpool_return(%d): seq=%llu, q size=%d,"
7847c478bd9Sstevel@tonic-gate " pool size=%d (total alloc=%d), threshhold=%d\n",
7857c478bd9Sstevel@tonic-gate p->plg_tid, sequence, q_size, qpool_size,
7867c478bd9Sstevel@tonic-gate q_size + qpool_size, p->plg_q_threshold));
7877c478bd9Sstevel@tonic-gate }
7887c478bd9Sstevel@tonic-gate
7897c478bd9Sstevel@tonic-gate /*
7907c478bd9Sstevel@tonic-gate * bpool_return() moves queue nodes back to the pool queue.
7917c478bd9Sstevel@tonic-gate */
7927c478bd9Sstevel@tonic-gate static void
bpool_return(audit_rec_t * node)7937c478bd9Sstevel@tonic-gate bpool_return(audit_rec_t *node)
7947c478bd9Sstevel@tonic-gate {
7957c478bd9Sstevel@tonic-gate #if DEBUG
7967c478bd9Sstevel@tonic-gate audit_rec_t *copy = node;
7977c478bd9Sstevel@tonic-gate #endif
798d6beba26SToomas Soome node = audit_release(&b_refcnt_lock, node); /* decrement ref cnt */
7997c478bd9Sstevel@tonic-gate
8007c478bd9Sstevel@tonic-gate if (node != NULL) { /* NULL if ref cnt is not zero */
8017c478bd9Sstevel@tonic-gate audit_enqueue(&b_pool, node);
8027c478bd9Sstevel@tonic-gate DPRINT((dbfp,
803dfc7be02SJan Friedel "bpool_return: requeue %p (allocated=%d,"
804dfc7be02SJan Friedel " pool size=%d)\n", (void *)node, b_allocated,
8057c478bd9Sstevel@tonic-gate audit_queue_size(&b_pool)));
8067c478bd9Sstevel@tonic-gate }
8077c478bd9Sstevel@tonic-gate #if DEBUG
8087c478bd9Sstevel@tonic-gate else {
8097c478bd9Sstevel@tonic-gate DPRINT((dbfp,
810dfc7be02SJan Friedel "bpool_return: decrement count for %p (allocated=%d,"
811dfc7be02SJan Friedel " pool size=%d)\n", (void *)copy, b_allocated,
8127c478bd9Sstevel@tonic-gate audit_queue_size(&b_pool)));
8137c478bd9Sstevel@tonic-gate }
8147c478bd9Sstevel@tonic-gate #endif
8157c478bd9Sstevel@tonic-gate }
8167c478bd9Sstevel@tonic-gate
8177c478bd9Sstevel@tonic-gate #if DEBUG
8187c478bd9Sstevel@tonic-gate static void
dump_state(char * src,plugin_t * p,uint64_t count,char * msg)8198f775e0aSJan Friedel dump_state(char *src, plugin_t *p, uint64_t count, char *msg)
8207c478bd9Sstevel@tonic-gate {
8217c478bd9Sstevel@tonic-gate struct sched_param param;
8227c478bd9Sstevel@tonic-gate int policy;
8237c478bd9Sstevel@tonic-gate /*
8247c478bd9Sstevel@tonic-gate * count is message sequence
8257c478bd9Sstevel@tonic-gate */
8267c478bd9Sstevel@tonic-gate (void) pthread_getschedparam(p->plg_tid, &policy, ¶m);
8278f775e0aSJan Friedel (void) fprintf(dbfp, "%7s(%d/%llu) %11s:"
8287c478bd9Sstevel@tonic-gate " input_in_wait=%d"
8297c478bd9Sstevel@tonic-gate " priority=%d"
8307c478bd9Sstevel@tonic-gate " queue size=%d pool size=%d"
8317c478bd9Sstevel@tonic-gate "\n\t"
8327c478bd9Sstevel@tonic-gate "process wait=%d"
8337c478bd9Sstevel@tonic-gate " tossed=%d"
8347c478bd9Sstevel@tonic-gate " queued=%d"
8357c478bd9Sstevel@tonic-gate " written=%d"
8367c478bd9Sstevel@tonic-gate "\n",
8377c478bd9Sstevel@tonic-gate src, p->plg_tid, count, msg,
8387c478bd9Sstevel@tonic-gate in_thr.thd_waiting, param.sched_priority,
8397c478bd9Sstevel@tonic-gate audit_queue_size(&(p->plg_queue)),
8407c478bd9Sstevel@tonic-gate audit_queue_size(&(p->plg_pool)),
8417c478bd9Sstevel@tonic-gate p->plg_waiting, p->plg_tossed,
8427c478bd9Sstevel@tonic-gate p->plg_queued, p->plg_output);
8437c478bd9Sstevel@tonic-gate
8447c478bd9Sstevel@tonic-gate (void) fflush(dbfp);
8457c478bd9Sstevel@tonic-gate }
8467c478bd9Sstevel@tonic-gate #endif
8477c478bd9Sstevel@tonic-gate
8487c478bd9Sstevel@tonic-gate /*
8497c478bd9Sstevel@tonic-gate * policy_is_block: return 1 if the continue policy is off for any active
8507c478bd9Sstevel@tonic-gate * plugin, else 0
8517c478bd9Sstevel@tonic-gate */
8527c478bd9Sstevel@tonic-gate static int
policy_is_block()8537c478bd9Sstevel@tonic-gate policy_is_block()
8547c478bd9Sstevel@tonic-gate {
8557c478bd9Sstevel@tonic-gate plugin_t *p;
8567c478bd9Sstevel@tonic-gate
8577c478bd9Sstevel@tonic-gate (void) pthread_mutex_lock(&plugin_mutex);
8587c478bd9Sstevel@tonic-gate p = plugin_head;
8597c478bd9Sstevel@tonic-gate
8607c478bd9Sstevel@tonic-gate while (p != NULL) {
8617c478bd9Sstevel@tonic-gate if (p->plg_cnt == 0) {
8627c478bd9Sstevel@tonic-gate (void) pthread_mutex_unlock(&plugin_mutex);
8637c478bd9Sstevel@tonic-gate DPRINT((dbfp,
8647c478bd9Sstevel@tonic-gate "policy_is_block: policy is to block\n"));
8657c478bd9Sstevel@tonic-gate return (1);
8667c478bd9Sstevel@tonic-gate }
8677c478bd9Sstevel@tonic-gate p = p->plg_next;
8687c478bd9Sstevel@tonic-gate }
8697c478bd9Sstevel@tonic-gate (void) pthread_mutex_unlock(&plugin_mutex);
8707c478bd9Sstevel@tonic-gate DPRINT((dbfp, "policy_is_block: policy is to continue\n"));
8717c478bd9Sstevel@tonic-gate return (0);
8727c478bd9Sstevel@tonic-gate }
8737c478bd9Sstevel@tonic-gate
8747c478bd9Sstevel@tonic-gate /*
8757c478bd9Sstevel@tonic-gate * policy_update() -- the kernel has received a policy change.
8767c478bd9Sstevel@tonic-gate * Presently, the only policy auditd cares about is AUDIT_CNT
8777c478bd9Sstevel@tonic-gate */
8787c478bd9Sstevel@tonic-gate static void
policy_update(uint32_t newpolicy)8797c478bd9Sstevel@tonic-gate policy_update(uint32_t newpolicy)
8807c478bd9Sstevel@tonic-gate {
8817c478bd9Sstevel@tonic-gate plugin_t *p;
8827c478bd9Sstevel@tonic-gate
883dfc7be02SJan Friedel DPRINT((dbfp, "policy change: %X\n", newpolicy));
8847c478bd9Sstevel@tonic-gate (void) pthread_mutex_lock(&plugin_mutex);
8857c478bd9Sstevel@tonic-gate p = plugin_head;
8867c478bd9Sstevel@tonic-gate while (p != NULL) {
8877c478bd9Sstevel@tonic-gate p->plg_cnt = (newpolicy & AUDIT_CNT) ? 1 : 0;
8887c478bd9Sstevel@tonic-gate (void) pthread_cond_signal(&(p->plg_cv));
8897c478bd9Sstevel@tonic-gate
8907c478bd9Sstevel@tonic-gate DPRINT((dbfp, "policy changed for thread %d\n", p->plg_tid));
8917c478bd9Sstevel@tonic-gate p = p->plg_next;
8927c478bd9Sstevel@tonic-gate }
8937c478bd9Sstevel@tonic-gate (void) pthread_mutex_unlock(&plugin_mutex);
8947c478bd9Sstevel@tonic-gate }
8957c478bd9Sstevel@tonic-gate
8967c478bd9Sstevel@tonic-gate /*
8977c478bd9Sstevel@tonic-gate * queue_buffer() inputs a buffer and queues for each active plugin if
8987c478bd9Sstevel@tonic-gate * it represents a complete audit record. Otherwise it builds a
8997c478bd9Sstevel@tonic-gate * larger buffer to hold the record and take successive buffers from
9007c478bd9Sstevel@tonic-gate * c2audit to build a complete record; then queues it for each plugin.
9017c478bd9Sstevel@tonic-gate *
9027c478bd9Sstevel@tonic-gate * return 0 if data is queued (or damaged and tossed). If resources
9037c478bd9Sstevel@tonic-gate * are not available, return 0 if all active plugins have the cnt
9047c478bd9Sstevel@tonic-gate * policy set, else 1. 0 is also returned if the input is a control
9057c478bd9Sstevel@tonic-gate * message. (aub_buf is aligned on a 64 bit boundary, so casting
9067c478bd9Sstevel@tonic-gate * it to an integer works just fine.)
9077c478bd9Sstevel@tonic-gate */
9087c478bd9Sstevel@tonic-gate static int
queue_buffer(au_dbuf_t * kl)9097c478bd9Sstevel@tonic-gate queue_buffer(au_dbuf_t *kl)
9107c478bd9Sstevel@tonic-gate {
9117c478bd9Sstevel@tonic-gate plugin_t *p;
9127c478bd9Sstevel@tonic-gate audit_rec_t *b_copy;
9137c478bd9Sstevel@tonic-gate audit_q_t *q_copy;
9147c478bd9Sstevel@tonic-gate boolean_t referenced = 0;
9157c478bd9Sstevel@tonic-gate static char *invalid_msg = "invalid audit record discarded";
9161a578a15Spaulson static char *invalid_control = "invalid audit control discarded";
9177c478bd9Sstevel@tonic-gate
9187c478bd9Sstevel@tonic-gate static audit_rec_t *alt_b_copy = NULL;
9197c478bd9Sstevel@tonic-gate static size_t alt_length;
9207c478bd9Sstevel@tonic-gate static size_t alt_offset;
9217c478bd9Sstevel@tonic-gate
9227c478bd9Sstevel@tonic-gate /*
9237c478bd9Sstevel@tonic-gate * the buffer may be a kernel -> auditd message. (only
9247c478bd9Sstevel@tonic-gate * the policy change message exists so far.)
9257c478bd9Sstevel@tonic-gate */
9267c478bd9Sstevel@tonic-gate
9277c478bd9Sstevel@tonic-gate if ((kl->aub_type & AU_DBUF_NOTIFY) != 0) {
9287c478bd9Sstevel@tonic-gate uint32_t control;
9297c478bd9Sstevel@tonic-gate
9307c478bd9Sstevel@tonic-gate control = kl->aub_type & ~AU_DBUF_NOTIFY;
9317c478bd9Sstevel@tonic-gate switch (control) {
9327c478bd9Sstevel@tonic-gate case AU_DBUF_POLICY:
9337c478bd9Sstevel@tonic-gate /* LINTED */
9347c478bd9Sstevel@tonic-gate policy_update(*(uint32_t *)kl->aub_buf);
9357c478bd9Sstevel@tonic-gate break;
9367c478bd9Sstevel@tonic-gate case AU_DBUF_SHUTDOWN:
937f8994074SJan Friedel (void) kill(getpid(), SIGTERM);
9387c478bd9Sstevel@tonic-gate DPRINT((dbfp, "AU_DBUF_SHUTDOWN message\n"));
9397c478bd9Sstevel@tonic-gate break;
9407c478bd9Sstevel@tonic-gate default:
9417c478bd9Sstevel@tonic-gate warn_or_fatal(0, gettext(invalid_control));
9427c478bd9Sstevel@tonic-gate break;
9437c478bd9Sstevel@tonic-gate }
9447c478bd9Sstevel@tonic-gate return (0);
9457c478bd9Sstevel@tonic-gate }
9467c478bd9Sstevel@tonic-gate /*
9477c478bd9Sstevel@tonic-gate * The test for valid continuation/completion may fail. Need to
9487c478bd9Sstevel@tonic-gate * assume the failure was earlier and that this buffer may
9497c478bd9Sstevel@tonic-gate * be a valid first or complete buffer after discarding the
9507c478bd9Sstevel@tonic-gate * incomplete record
9517c478bd9Sstevel@tonic-gate */
9527c478bd9Sstevel@tonic-gate
9537c478bd9Sstevel@tonic-gate if (alt_b_copy != NULL) {
9547c478bd9Sstevel@tonic-gate if ((kl->aub_type == AU_DBUF_FIRST) ||
9557c478bd9Sstevel@tonic-gate (kl->aub_type == AU_DBUF_COMPLETE)) {
9567c478bd9Sstevel@tonic-gate DPRINT((dbfp, "copy is not null, partial is %d\n",
9577c478bd9Sstevel@tonic-gate kl->aub_type));
9587c478bd9Sstevel@tonic-gate bpool_return(alt_b_copy);
9597c478bd9Sstevel@tonic-gate warn_or_fatal(0, gettext(invalid_msg));
9607c478bd9Sstevel@tonic-gate alt_b_copy = NULL;
9617c478bd9Sstevel@tonic-gate }
9627c478bd9Sstevel@tonic-gate }
9637c478bd9Sstevel@tonic-gate if (alt_b_copy != NULL) { /* continue collecting a long record */
9647c478bd9Sstevel@tonic-gate if (kl->aub_size + alt_offset > alt_length) {
9657c478bd9Sstevel@tonic-gate bpool_return(alt_b_copy);
9667c478bd9Sstevel@tonic-gate alt_b_copy = NULL;
9677c478bd9Sstevel@tonic-gate warn_or_fatal(0, gettext(invalid_msg));
9687c478bd9Sstevel@tonic-gate return (0);
9697c478bd9Sstevel@tonic-gate }
9707c478bd9Sstevel@tonic-gate (void) memcpy(alt_b_copy->abq_buffer + alt_offset, kl->aub_buf,
9717c478bd9Sstevel@tonic-gate kl->aub_size);
9727c478bd9Sstevel@tonic-gate alt_offset += kl->aub_size;
9737c478bd9Sstevel@tonic-gate if (kl->aub_type == AU_DBUF_MIDDLE)
9747c478bd9Sstevel@tonic-gate return (0);
9757c478bd9Sstevel@tonic-gate b_copy = alt_b_copy;
9767c478bd9Sstevel@tonic-gate alt_b_copy = NULL;
9777c478bd9Sstevel@tonic-gate b_copy->abq_data_len = alt_length;
9787c478bd9Sstevel@tonic-gate } else if (kl->aub_type == AU_DBUF_FIRST) {
9797c478bd9Sstevel@tonic-gate /* first buffer of a multiple buffer record */
9807c478bd9Sstevel@tonic-gate alt_length = getlen(kl->aub_buf);
9817c478bd9Sstevel@tonic-gate if ((alt_length < MIN_RECORD_SIZE) ||
9827c478bd9Sstevel@tonic-gate (alt_length <= kl->aub_size)) {
9837c478bd9Sstevel@tonic-gate warn_or_fatal(0, gettext(invalid_msg));
9847c478bd9Sstevel@tonic-gate return (0);
9857c478bd9Sstevel@tonic-gate }
9867c478bd9Sstevel@tonic-gate alt_b_copy = bpool_withdraw(kl->aub_buf, kl->aub_size,
9877c478bd9Sstevel@tonic-gate alt_length);
9887c478bd9Sstevel@tonic-gate
9897c478bd9Sstevel@tonic-gate if (alt_b_copy == NULL)
9907c478bd9Sstevel@tonic-gate return (policy_is_block());
9917c478bd9Sstevel@tonic-gate
9927c478bd9Sstevel@tonic-gate alt_offset = kl->aub_size;
9937c478bd9Sstevel@tonic-gate return (0);
9947c478bd9Sstevel@tonic-gate } else { /* one buffer, one record -- the basic case */
9957c478bd9Sstevel@tonic-gate if (kl->aub_type != AU_DBUF_COMPLETE) {
9967c478bd9Sstevel@tonic-gate DPRINT((dbfp, "copy is null, partial is %d\n",
9977c478bd9Sstevel@tonic-gate kl->aub_type));
9987c478bd9Sstevel@tonic-gate warn_or_fatal(0, gettext(invalid_msg));
9997c478bd9Sstevel@tonic-gate return (0); /* tossed */
10007c478bd9Sstevel@tonic-gate }
10017c478bd9Sstevel@tonic-gate b_copy = bpool_withdraw(kl->aub_buf, kl->aub_size,
10027c478bd9Sstevel@tonic-gate kl->aub_size);
10037c478bd9Sstevel@tonic-gate
10047c478bd9Sstevel@tonic-gate if (b_copy == NULL)
10057c478bd9Sstevel@tonic-gate return (policy_is_block());
10067c478bd9Sstevel@tonic-gate }
10077c478bd9Sstevel@tonic-gate
10087c478bd9Sstevel@tonic-gate (void) pthread_mutex_lock(&plugin_mutex);
10097c478bd9Sstevel@tonic-gate p = plugin_head;
10107c478bd9Sstevel@tonic-gate while (p != NULL) {
10117c478bd9Sstevel@tonic-gate if (!p->plg_removed) {
10127c478bd9Sstevel@tonic-gate /*
10137c478bd9Sstevel@tonic-gate * Link the record buffer to the input queues.
10147c478bd9Sstevel@tonic-gate * To avoid a race, it is necessary to wait
10157c478bd9Sstevel@tonic-gate * until all reference count increments
10167c478bd9Sstevel@tonic-gate * are complete before queueing q_copy.
10177c478bd9Sstevel@tonic-gate */
10187c478bd9Sstevel@tonic-gate audit_incr_ref(&b_refcnt_lock, b_copy);
10197c478bd9Sstevel@tonic-gate
10207c478bd9Sstevel@tonic-gate q_copy = qpool_withdraw(p);
10217c478bd9Sstevel@tonic-gate q_copy->aqq_sequence = p->plg_sequence++;
10227c478bd9Sstevel@tonic-gate q_copy->aqq_data = b_copy;
10237c478bd9Sstevel@tonic-gate
10247c478bd9Sstevel@tonic-gate p->plg_save_q_copy = q_copy; /* enqueue below */
10257c478bd9Sstevel@tonic-gate referenced = 1;
10267c478bd9Sstevel@tonic-gate } else
10277c478bd9Sstevel@tonic-gate p->plg_save_q_copy = NULL;
10287c478bd9Sstevel@tonic-gate p = p->plg_next;
10297c478bd9Sstevel@tonic-gate }
10307c478bd9Sstevel@tonic-gate /*
10317c478bd9Sstevel@tonic-gate * now that the reference count is updated, queue it.
10327c478bd9Sstevel@tonic-gate */
10337c478bd9Sstevel@tonic-gate if (referenced) {
10347c478bd9Sstevel@tonic-gate p = plugin_head;
10357c478bd9Sstevel@tonic-gate while ((p != NULL) && (p->plg_save_q_copy != NULL)) {
10367c478bd9Sstevel@tonic-gate audit_enqueue(&(p->plg_queue), p->plg_save_q_copy);
10377c478bd9Sstevel@tonic-gate (void) pthread_cond_signal(&(p->plg_cv));
10387c478bd9Sstevel@tonic-gate p->plg_queued++;
10397c478bd9Sstevel@tonic-gate p = p->plg_next;
10407c478bd9Sstevel@tonic-gate }
10417c478bd9Sstevel@tonic-gate } else
10427c478bd9Sstevel@tonic-gate bpool_return(b_copy);
10437c478bd9Sstevel@tonic-gate
10447c478bd9Sstevel@tonic-gate (void) pthread_mutex_unlock(&plugin_mutex);
10457c478bd9Sstevel@tonic-gate
10467c478bd9Sstevel@tonic-gate return (0);
10477c478bd9Sstevel@tonic-gate }
10487c478bd9Sstevel@tonic-gate
10497c478bd9Sstevel@tonic-gate /*
10507c478bd9Sstevel@tonic-gate * wait_a_while() -- timed wait in the door server to allow output
10517c478bd9Sstevel@tonic-gate * time to catch up.
10527c478bd9Sstevel@tonic-gate */
10537c478bd9Sstevel@tonic-gate static void
wait_a_while()1054f8994074SJan Friedel wait_a_while()
1055f8994074SJan Friedel {
10567c478bd9Sstevel@tonic-gate struct timespec delay = {0, 500000000}; /* 1/2 second */;
10577c478bd9Sstevel@tonic-gate
10587c478bd9Sstevel@tonic-gate (void) pthread_mutex_lock(&(in_thr.thd_mutex));
10597c478bd9Sstevel@tonic-gate in_thr.thd_waiting = 1;
10607c478bd9Sstevel@tonic-gate (void) pthread_cond_reltimedwait_np(&(in_thr.thd_cv),
10617c478bd9Sstevel@tonic-gate &(in_thr.thd_mutex), &delay);
10627c478bd9Sstevel@tonic-gate in_thr.thd_waiting = 0;
10637c478bd9Sstevel@tonic-gate (void) pthread_mutex_unlock(&(in_thr.thd_mutex));
10647c478bd9Sstevel@tonic-gate }
10657c478bd9Sstevel@tonic-gate
10667c478bd9Sstevel@tonic-gate /*
10677c478bd9Sstevel@tonic-gate * adjust_priority() -- check queue and pools and adjust the priority
10687c478bd9Sstevel@tonic-gate * for process() accordingly. If we're way ahead of output, do a
10697c478bd9Sstevel@tonic-gate * timed wait as well.
10707c478bd9Sstevel@tonic-gate */
10717c478bd9Sstevel@tonic-gate static void
adjust_priority()1072f8994074SJan Friedel adjust_priority()
1073f8994074SJan Friedel {
10747c478bd9Sstevel@tonic-gate int queue_near_full;
10757c478bd9Sstevel@tonic-gate plugin_t *p;
10767c478bd9Sstevel@tonic-gate int queue_size;
10777c478bd9Sstevel@tonic-gate struct sched_param param;
10787c478bd9Sstevel@tonic-gate
10797c478bd9Sstevel@tonic-gate queue_near_full = 0;
10807c478bd9Sstevel@tonic-gate (void) pthread_mutex_lock(&plugin_mutex);
10817c478bd9Sstevel@tonic-gate p = plugin_head;
10827c478bd9Sstevel@tonic-gate while (p != NULL) {
10837c478bd9Sstevel@tonic-gate queue_size = audit_queue_size(&(p->plg_queue));
10847c478bd9Sstevel@tonic-gate if (queue_size > p->plg_q_threshold) {
10857c478bd9Sstevel@tonic-gate if (p->plg_priority != HIGH_PRIORITY) {
10867c478bd9Sstevel@tonic-gate p->plg_priority =
10877c478bd9Sstevel@tonic-gate param.sched_priority =
10887c478bd9Sstevel@tonic-gate HIGH_PRIORITY;
10897c478bd9Sstevel@tonic-gate (void) pthread_setschedparam(p->plg_tid,
10907c478bd9Sstevel@tonic-gate SCHED_OTHER, ¶m);
10917c478bd9Sstevel@tonic-gate }
10927c478bd9Sstevel@tonic-gate if (queue_size > p->plg_qmax - p->plg_qmin) {
10937c478bd9Sstevel@tonic-gate queue_near_full = 1;
10947c478bd9Sstevel@tonic-gate break;
10957c478bd9Sstevel@tonic-gate }
10967c478bd9Sstevel@tonic-gate }
10977c478bd9Sstevel@tonic-gate p = p->plg_next;
10987c478bd9Sstevel@tonic-gate }
10997c478bd9Sstevel@tonic-gate (void) pthread_mutex_unlock(&plugin_mutex);
11007c478bd9Sstevel@tonic-gate
11017c478bd9Sstevel@tonic-gate if (queue_near_full) {
11027c478bd9Sstevel@tonic-gate DPRINT((dbfp,
11037c478bd9Sstevel@tonic-gate "adjust_priority: input taking a short break\n"));
11047c478bd9Sstevel@tonic-gate wait_a_while();
11057c478bd9Sstevel@tonic-gate DPRINT((dbfp,
11067c478bd9Sstevel@tonic-gate "adjust_priority: input back from my break\n"));
11077c478bd9Sstevel@tonic-gate }
11087c478bd9Sstevel@tonic-gate }
11097c478bd9Sstevel@tonic-gate
11107c478bd9Sstevel@tonic-gate /*
11117c478bd9Sstevel@tonic-gate * input() is a door server; it blocks if any plugins have full queues
1112f8994074SJan Friedel * with the continue policy off. (auditconfig -setpolicy -cnt)
11137c478bd9Sstevel@tonic-gate *
11147c478bd9Sstevel@tonic-gate * input() is called synchronously from c2audit and is NOT
11157c478bd9Sstevel@tonic-gate * reentrant due to the (unprotected) static variables in
11167c478bd9Sstevel@tonic-gate * queue_buffer(). If multiple clients are created, a context
11177c478bd9Sstevel@tonic-gate * structure will be required for queue_buffer.
11187c478bd9Sstevel@tonic-gate *
11197c478bd9Sstevel@tonic-gate * timedwait is used when input() gets too far ahead of process();
11207c478bd9Sstevel@tonic-gate * the wait terminates either when the set time expires or when
11217c478bd9Sstevel@tonic-gate * process() signals that it has nearly caught up.
11227c478bd9Sstevel@tonic-gate */
11237c478bd9Sstevel@tonic-gate /* ARGSUSED */
11247c478bd9Sstevel@tonic-gate static void
input(void * cookie,void * argp,int arg_size,door_desc_t * dp,int n_descriptors)11257c478bd9Sstevel@tonic-gate input(void *cookie, void *argp, int arg_size, door_desc_t *dp,
11267c478bd9Sstevel@tonic-gate int n_descriptors)
11277c478bd9Sstevel@tonic-gate {
11287c478bd9Sstevel@tonic-gate int is_blocked;
11297c478bd9Sstevel@tonic-gate plugin_t *p;
11307c478bd9Sstevel@tonic-gate #if DEBUG
11317c478bd9Sstevel@tonic-gate int loop_count = 0;
11327c478bd9Sstevel@tonic-gate static int call_counter = 0;
11337c478bd9Sstevel@tonic-gate #endif
11347c478bd9Sstevel@tonic-gate if (argp == NULL) {
11357c478bd9Sstevel@tonic-gate warn_or_fatal(0,
11367c478bd9Sstevel@tonic-gate gettext("invalid data received from c2audit\n"));
11377c478bd9Sstevel@tonic-gate goto input_exit;
11387c478bd9Sstevel@tonic-gate }
11397c478bd9Sstevel@tonic-gate DPRINT((dbfp, "%d input new buffer: length=%u, "
11407c478bd9Sstevel@tonic-gate "partial=%u, arg_size=%d\n",
11417c478bd9Sstevel@tonic-gate ++call_counter, ((au_dbuf_t *)argp)->aub_size,
11427c478bd9Sstevel@tonic-gate ((au_dbuf_t *)argp)->aub_type, arg_size));
11437c478bd9Sstevel@tonic-gate
11447c478bd9Sstevel@tonic-gate if (((au_dbuf_t *)argp)->aub_size < 1) {
11457c478bd9Sstevel@tonic-gate warn_or_fatal(0,
11467c478bd9Sstevel@tonic-gate gettext("invalid data length received from c2audit\n"));
11477c478bd9Sstevel@tonic-gate goto input_exit;
11487c478bd9Sstevel@tonic-gate }
11497c478bd9Sstevel@tonic-gate /*
11507c478bd9Sstevel@tonic-gate * is_blocked is true only if one or more plugins have "no
11517c478bd9Sstevel@tonic-gate * continue" (-cnt) set and one of those has a full queue.
11527c478bd9Sstevel@tonic-gate * All plugins block until success is met.
11537c478bd9Sstevel@tonic-gate */
11547c478bd9Sstevel@tonic-gate for (;;) {
11557c478bd9Sstevel@tonic-gate DPRINT((dbfp, "%d input is calling queue_buffer\n",
11567c478bd9Sstevel@tonic-gate call_counter));
11577c478bd9Sstevel@tonic-gate
11587c478bd9Sstevel@tonic-gate is_blocked = queue_buffer((au_dbuf_t *)argp);
11597c478bd9Sstevel@tonic-gate
11607c478bd9Sstevel@tonic-gate if (!is_blocked) {
11617c478bd9Sstevel@tonic-gate adjust_priority();
11627c478bd9Sstevel@tonic-gate break;
11637c478bd9Sstevel@tonic-gate } else {
11647c478bd9Sstevel@tonic-gate DPRINT((dbfp,
11657c478bd9Sstevel@tonic-gate "%d input blocked (loop=%d)\n",
11667c478bd9Sstevel@tonic-gate call_counter, loop_count));
11677c478bd9Sstevel@tonic-gate
11687c478bd9Sstevel@tonic-gate wait_a_while();
11697c478bd9Sstevel@tonic-gate
11707c478bd9Sstevel@tonic-gate DPRINT((dbfp, "%d input unblocked (loop=%d)\n",
11717c478bd9Sstevel@tonic-gate call_counter, loop_count));
11727c478bd9Sstevel@tonic-gate }
11737c478bd9Sstevel@tonic-gate #if DEBUG
11747c478bd9Sstevel@tonic-gate loop_count++;
11757c478bd9Sstevel@tonic-gate #endif
11767c478bd9Sstevel@tonic-gate }
11777c478bd9Sstevel@tonic-gate input_exit:
11787c478bd9Sstevel@tonic-gate p = plugin_head;
11797c478bd9Sstevel@tonic-gate while (p != NULL) {
11807c478bd9Sstevel@tonic-gate (void) pthread_cond_signal(&(p->plg_cv));
11817c478bd9Sstevel@tonic-gate p = p->plg_next;
11827c478bd9Sstevel@tonic-gate }
11837c478bd9Sstevel@tonic-gate ((au_dbuf_t *)argp)->aub_size = 0; /* return code */
11847c478bd9Sstevel@tonic-gate (void) door_return(argp, sizeof (uint64_t), NULL, 0);
11857c478bd9Sstevel@tonic-gate }
11867c478bd9Sstevel@tonic-gate
11877c478bd9Sstevel@tonic-gate /*
11887c478bd9Sstevel@tonic-gate * process() -- pass a buffer to a plugin
11897c478bd9Sstevel@tonic-gate */
1190d6beba26SToomas Soome static void *
process(void * arg)1191d6beba26SToomas Soome process(void *arg)
11927c478bd9Sstevel@tonic-gate {
1193d6beba26SToomas Soome plugin_t *p = arg;
11947c478bd9Sstevel@tonic-gate int rc;
11957c478bd9Sstevel@tonic-gate audit_rec_t *b_node;
11967c478bd9Sstevel@tonic-gate audit_q_t *q_node;
11977c478bd9Sstevel@tonic-gate auditd_rc_t plugrc;
11987c478bd9Sstevel@tonic-gate char *error_string;
1199d6beba26SToomas Soome struct timespec delay;
12007c478bd9Sstevel@tonic-gate int sendsignal;
12017c478bd9Sstevel@tonic-gate int queue_len;
12027c478bd9Sstevel@tonic-gate struct sched_param param;
12031a578a15Spaulson static boolean_t once = B_FALSE;
12047c478bd9Sstevel@tonic-gate
12057c478bd9Sstevel@tonic-gate DPRINT((dbfp, "%s is thread %d\n", p->plg_path, p->plg_tid));
12067c478bd9Sstevel@tonic-gate p->plg_priority = param.sched_priority = BASE_PRIORITY;
12077c478bd9Sstevel@tonic-gate (void) pthread_setschedparam(p->plg_tid, SCHED_OTHER, ¶m);
12087c478bd9Sstevel@tonic-gate
12097c478bd9Sstevel@tonic-gate delay.tv_nsec = 0;
12107c478bd9Sstevel@tonic-gate
12117c478bd9Sstevel@tonic-gate for (;;) {
12127c478bd9Sstevel@tonic-gate while (audit_dequeue(&(p->plg_queue), (void *)&q_node) != 0) {
12137c478bd9Sstevel@tonic-gate DUMP("process", p, p->plg_last_seq_out, "blocked");
12147c478bd9Sstevel@tonic-gate (void) pthread_cond_signal(&(in_thr.thd_cv));
12157c478bd9Sstevel@tonic-gate
12167c478bd9Sstevel@tonic-gate (void) pthread_mutex_lock(&(p->plg_mutex));
12177c478bd9Sstevel@tonic-gate p->plg_waiting++;
12187c478bd9Sstevel@tonic-gate (void) pthread_cond_wait(&(p->plg_cv),
12197c478bd9Sstevel@tonic-gate &(p->plg_mutex));
12207c478bd9Sstevel@tonic-gate p->plg_waiting--;
12217c478bd9Sstevel@tonic-gate (void) pthread_mutex_unlock(&(p->plg_mutex));
12227c478bd9Sstevel@tonic-gate
12237c478bd9Sstevel@tonic-gate if (p->plg_removed)
12241a578a15Spaulson goto plugin_removed;
12257c478bd9Sstevel@tonic-gate
12267c478bd9Sstevel@tonic-gate DUMP("process", p, p->plg_last_seq_out, "unblocked");
12277c478bd9Sstevel@tonic-gate }
12287c478bd9Sstevel@tonic-gate #if DEBUG
12297c478bd9Sstevel@tonic-gate if (q_node->aqq_sequence != p->plg_last_seq_out + 1)
12307c478bd9Sstevel@tonic-gate (void) fprintf(dbfp,
12318f775e0aSJan Friedel "process(%d): buffer sequence=%llu but prev=%llu\n",
12327c478bd9Sstevel@tonic-gate p->plg_tid, q_node->aqq_sequence,
12337c478bd9Sstevel@tonic-gate p->plg_last_seq_out);
12347c478bd9Sstevel@tonic-gate #endif
12357c478bd9Sstevel@tonic-gate error_string = NULL;
12367c478bd9Sstevel@tonic-gate
12377c478bd9Sstevel@tonic-gate b_node = q_node->aqq_data;
12381a578a15Spaulson retry_mode:
12397c478bd9Sstevel@tonic-gate plugrc = p->plg_fplugin(b_node->abq_buffer,
12401a578a15Spaulson b_node->abq_data_len, q_node->aqq_sequence, &error_string);
12411a578a15Spaulson
12421a578a15Spaulson if (p->plg_removed)
12431a578a15Spaulson goto plugin_removed;
12447c478bd9Sstevel@tonic-gate #if DEBUG
12457c478bd9Sstevel@tonic-gate p->plg_last_seq_out = q_node->aqq_sequence;
12467c478bd9Sstevel@tonic-gate #endif
12477c478bd9Sstevel@tonic-gate switch (plugrc) {
12487c478bd9Sstevel@tonic-gate case AUDITD_RETRY:
12491a578a15Spaulson if (!once) {
12501a578a15Spaulson report_error(plugrc, error_string, p->plg_path);
12511a578a15Spaulson once = B_TRUE;
12521a578a15Spaulson }
12537c478bd9Sstevel@tonic-gate free(error_string);
12547c478bd9Sstevel@tonic-gate error_string = NULL;
12557c478bd9Sstevel@tonic-gate
12567c478bd9Sstevel@tonic-gate DPRINT((dbfp, "process(%d) AUDITD_RETRY returned."
12577c478bd9Sstevel@tonic-gate " cnt=%d (if 1, enter retry)\n",
12587c478bd9Sstevel@tonic-gate p->plg_tid, p->plg_cnt));
12597c478bd9Sstevel@tonic-gate
12607c478bd9Sstevel@tonic-gate if (p->plg_cnt) /* if cnt is on, lose the buffer */
12617c478bd9Sstevel@tonic-gate break;
12627c478bd9Sstevel@tonic-gate
12637c478bd9Sstevel@tonic-gate delay.tv_sec = p->plg_retry_time;
12647c478bd9Sstevel@tonic-gate (void) pthread_mutex_lock(&(p->plg_mutex));
12657c478bd9Sstevel@tonic-gate p->plg_waiting++;
12667c478bd9Sstevel@tonic-gate (void) pthread_cond_reltimedwait_np(&(p->plg_cv),
12671a578a15Spaulson &(p->plg_mutex), &delay);
12687c478bd9Sstevel@tonic-gate p->plg_waiting--;
12697c478bd9Sstevel@tonic-gate (void) pthread_mutex_unlock(&(p->plg_mutex));
12707c478bd9Sstevel@tonic-gate
12717c478bd9Sstevel@tonic-gate DPRINT((dbfp, "left retry mode for %d\n", p->plg_tid));
12727c478bd9Sstevel@tonic-gate goto retry_mode;
12737c478bd9Sstevel@tonic-gate
12747c478bd9Sstevel@tonic-gate case AUDITD_SUCCESS:
12757c478bd9Sstevel@tonic-gate p->plg_output++;
12761a578a15Spaulson once = B_FALSE;
12777c478bd9Sstevel@tonic-gate break;
12787c478bd9Sstevel@tonic-gate default:
12797c478bd9Sstevel@tonic-gate report_error(plugrc, error_string, p->plg_path);
12807c478bd9Sstevel@tonic-gate free(error_string);
12817c478bd9Sstevel@tonic-gate error_string = NULL;
12827c478bd9Sstevel@tonic-gate break;
12837c478bd9Sstevel@tonic-gate } /* end switch */
12847c478bd9Sstevel@tonic-gate bpool_return(b_node);
12857c478bd9Sstevel@tonic-gate qpool_return(p, q_node);
12867c478bd9Sstevel@tonic-gate
12877c478bd9Sstevel@tonic-gate sendsignal = 0;
12887c478bd9Sstevel@tonic-gate queue_len = audit_queue_size(&(p->plg_queue));
12897c478bd9Sstevel@tonic-gate
12907c478bd9Sstevel@tonic-gate (void) pthread_mutex_lock(&(in_thr.thd_mutex));
12917c478bd9Sstevel@tonic-gate if (in_thr.thd_waiting && (queue_len > p->plg_qmin) &&
12927c478bd9Sstevel@tonic-gate (queue_len < p->plg_q_threshold))
12937c478bd9Sstevel@tonic-gate sendsignal = 1;
12947c478bd9Sstevel@tonic-gate
12957c478bd9Sstevel@tonic-gate (void) pthread_mutex_unlock(&(in_thr.thd_mutex));
12967c478bd9Sstevel@tonic-gate
12977c478bd9Sstevel@tonic-gate if (sendsignal) {
12987c478bd9Sstevel@tonic-gate (void) pthread_cond_signal(&(in_thr.thd_cv));
12997c478bd9Sstevel@tonic-gate /*
13007c478bd9Sstevel@tonic-gate * sched_yield(); does not help
13017c478bd9Sstevel@tonic-gate * performance and in artificial tests
13027c478bd9Sstevel@tonic-gate * (high sustained volume) appears to
13037c478bd9Sstevel@tonic-gate * hurt by adding wide variability in
13047c478bd9Sstevel@tonic-gate * the results.
13057c478bd9Sstevel@tonic-gate */
13067c478bd9Sstevel@tonic-gate } else if ((p->plg_priority < BASE_PRIORITY) &&
13077c478bd9Sstevel@tonic-gate (queue_len < p->plg_q_threshold)) {
13087c478bd9Sstevel@tonic-gate p->plg_priority = param.sched_priority =
13097c478bd9Sstevel@tonic-gate BASE_PRIORITY;
13107c478bd9Sstevel@tonic-gate (void) pthread_setschedparam(p->plg_tid, SCHED_OTHER,
13117c478bd9Sstevel@tonic-gate ¶m);
13127c478bd9Sstevel@tonic-gate }
13137c478bd9Sstevel@tonic-gate } /* end for (;;) */
13141a578a15Spaulson plugin_removed:
13157c478bd9Sstevel@tonic-gate DUMP("process", p, p->plg_last_seq_out, "exit");
13167c478bd9Sstevel@tonic-gate error_string = NULL;
13177c478bd9Sstevel@tonic-gate if ((rc = p->plg_fplugin_close(&error_string)) !=
13187c478bd9Sstevel@tonic-gate AUDITD_SUCCESS)
13197c478bd9Sstevel@tonic-gate report_error(rc, error_string, p->plg_path);
13207c478bd9Sstevel@tonic-gate
13217c478bd9Sstevel@tonic-gate free(error_string);
13227c478bd9Sstevel@tonic-gate
13237c478bd9Sstevel@tonic-gate (void) pthread_mutex_lock(&plugin_mutex);
13247c478bd9Sstevel@tonic-gate (void) unload_plugin(p);
13257c478bd9Sstevel@tonic-gate (void) pthread_mutex_unlock(&plugin_mutex);
1326d6beba26SToomas Soome return (NULL);
13277c478bd9Sstevel@tonic-gate }
1328