17c478bd9Sstevel@tonic-gate /*
27c478bd9Sstevel@tonic-gate * CDDL HEADER START
37c478bd9Sstevel@tonic-gate *
47c478bd9Sstevel@tonic-gate * The contents of this file are subject to the terms of the
577e01d41STony Nguyen * Common Development and Distribution License (the "License").
677e01d41STony Nguyen * You may not use this file except in compliance with the License.
77c478bd9Sstevel@tonic-gate *
87c478bd9Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
97c478bd9Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing.
107c478bd9Sstevel@tonic-gate * See the License for the specific language governing permissions
117c478bd9Sstevel@tonic-gate * and limitations under the License.
127c478bd9Sstevel@tonic-gate *
137c478bd9Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each
147c478bd9Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
157c478bd9Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the
167c478bd9Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying
177c478bd9Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner]
187c478bd9Sstevel@tonic-gate *
197c478bd9Sstevel@tonic-gate * CDDL HEADER END
207c478bd9Sstevel@tonic-gate */
2177e01d41STony Nguyen
227c478bd9Sstevel@tonic-gate /*
2377e01d41STony Nguyen * Copyright 2009 Sun Microsystems, Inc. All rights reserved.
247c478bd9Sstevel@tonic-gate * Use is subject to license terms.
257c478bd9Sstevel@tonic-gate */
267c478bd9Sstevel@tonic-gate
27*c85f09ccSJohn Levon /*
28*c85f09ccSJohn Levon * Copyright 2019 Joyent, Inc.
29*c85f09ccSJohn Levon */
30*c85f09ccSJohn Levon
317c478bd9Sstevel@tonic-gate /*
327c478bd9Sstevel@tonic-gate * The Secure SunOS audit reduction tool - auditreduce.
337c478bd9Sstevel@tonic-gate * Document SM0071 is the primary source of information on auditreduce.
347c478bd9Sstevel@tonic-gate *
357c478bd9Sstevel@tonic-gate * Composed of 4 source modules:
367c478bd9Sstevel@tonic-gate * main.c - main driver.
377c478bd9Sstevel@tonic-gate * option.c - command line option processing.
387c478bd9Sstevel@tonic-gate * process.c - record/file/process functions.
397c478bd9Sstevel@tonic-gate * time.c - date/time handling.
407c478bd9Sstevel@tonic-gate *
417c478bd9Sstevel@tonic-gate * Main(), write_header(), audit_stats(), and a_calloc()
427c478bd9Sstevel@tonic-gate * are the only functions visible outside this module.
437c478bd9Sstevel@tonic-gate */
447c478bd9Sstevel@tonic-gate
457c478bd9Sstevel@tonic-gate #include <siginfo.h>
467c478bd9Sstevel@tonic-gate #include <locale.h>
477c478bd9Sstevel@tonic-gate #include <libintl.h>
487c478bd9Sstevel@tonic-gate #include "auditr.h"
497c478bd9Sstevel@tonic-gate #include "auditrd.h"
507c478bd9Sstevel@tonic-gate
517c478bd9Sstevel@tonic-gate #if !defined(TEXT_DOMAIN)
527c478bd9Sstevel@tonic-gate #define TEXT_DOMAIN "SUNW_OST_OSCMD"
537c478bd9Sstevel@tonic-gate #endif
547c478bd9Sstevel@tonic-gate
557c478bd9Sstevel@tonic-gate extern void derive_str(time_t, char *);
567c478bd9Sstevel@tonic-gate extern int process_options(int, char **);
577c478bd9Sstevel@tonic-gate extern int mproc(audit_pcb_t *);
587c478bd9Sstevel@tonic-gate extern void init_tokens(void); /* shared with praudit */
597c478bd9Sstevel@tonic-gate
607c478bd9Sstevel@tonic-gate static int a_pow(int, int);
617c478bd9Sstevel@tonic-gate static void calc_procs(void);
627c478bd9Sstevel@tonic-gate static void chld_handler(int);
637c478bd9Sstevel@tonic-gate static int close_outfile(void);
647c478bd9Sstevel@tonic-gate static void c_close(audit_pcb_t *, int);
657c478bd9Sstevel@tonic-gate static void delete_infiles(void);
667c478bd9Sstevel@tonic-gate static void gather_pcb(audit_pcb_t *, int, int);
677c478bd9Sstevel@tonic-gate static void init_options(void);
687c478bd9Sstevel@tonic-gate static int init_sig(void);
697c478bd9Sstevel@tonic-gate static void int_handler(int);
707c478bd9Sstevel@tonic-gate static int mfork(audit_pcb_t *, int, int, int);
717c478bd9Sstevel@tonic-gate static void mcount(int, int);
727c478bd9Sstevel@tonic-gate static int open_outfile(void);
737c478bd9Sstevel@tonic-gate static void p_close(audit_pcb_t *);
747c478bd9Sstevel@tonic-gate static int rename_outfile(void);
757c478bd9Sstevel@tonic-gate static void rm_mem(audit_pcb_t *);
767c478bd9Sstevel@tonic-gate static void rm_outfile(void);
777c478bd9Sstevel@tonic-gate static void trim_mem(audit_pcb_t *);
787c478bd9Sstevel@tonic-gate static int write_file_token(time_t);
797c478bd9Sstevel@tonic-gate static int write_trailer(void);
807c478bd9Sstevel@tonic-gate
817c478bd9Sstevel@tonic-gate /*
827c478bd9Sstevel@tonic-gate * File globals.
837c478bd9Sstevel@tonic-gate */
847c478bd9Sstevel@tonic-gate static int max_sproc; /* maximum number of subprocesses per process */
857c478bd9Sstevel@tonic-gate static int total_procs; /* number of processes in the process tree */
867c478bd9Sstevel@tonic-gate static int total_layers; /* number of layers in the process tree */
877c478bd9Sstevel@tonic-gate
887c478bd9Sstevel@tonic-gate /*
897c478bd9Sstevel@tonic-gate * .func main - main.
907c478bd9Sstevel@tonic-gate * .desc The beginning. Main() calls each of the initialization routines
917c478bd9Sstevel@tonic-gate * and then allocates the root pcb. Then it calls mfork() to get
927c478bd9Sstevel@tonic-gate * the work done.
937c478bd9Sstevel@tonic-gate * .call main(argc, argv).
947c478bd9Sstevel@tonic-gate * .arg argc - number of arguments.
957c478bd9Sstevel@tonic-gate * .arg argv - array of pointers to arguments.
967c478bd9Sstevel@tonic-gate * .ret 0 - via exit() - no errors detected.
977c478bd9Sstevel@tonic-gate * .ret 1 - via exit() - errors detected (messages printed).
987c478bd9Sstevel@tonic-gate */
997c478bd9Sstevel@tonic-gate int
main(int argc,char ** argv)1007c478bd9Sstevel@tonic-gate main(int argc, char **argv)
1017c478bd9Sstevel@tonic-gate {
1027c478bd9Sstevel@tonic-gate int ret;
1037c478bd9Sstevel@tonic-gate audit_pcb_t *pcb;
1047c478bd9Sstevel@tonic-gate
1057c478bd9Sstevel@tonic-gate /* Internationalization */
1067c478bd9Sstevel@tonic-gate (void) setlocale(LC_ALL, "");
1077c478bd9Sstevel@tonic-gate (void) textdomain(TEXT_DOMAIN);
1087c478bd9Sstevel@tonic-gate
1097c478bd9Sstevel@tonic-gate root_pid = getpid(); /* know who is root process for error */
1107c478bd9Sstevel@tonic-gate init_options(); /* initialize options */
1117c478bd9Sstevel@tonic-gate init_tokens(); /* initialize token processing table */
1127c478bd9Sstevel@tonic-gate if (init_sig()) /* initialize signals */
1137c478bd9Sstevel@tonic-gate exit(1);
1147c478bd9Sstevel@tonic-gate if (process_options(argc, argv))
1157c478bd9Sstevel@tonic-gate exit(1); /* process command line options */
1167c478bd9Sstevel@tonic-gate if (open_outfile()) /* setup root process output stream */
1177c478bd9Sstevel@tonic-gate exit(1);
1187c478bd9Sstevel@tonic-gate calc_procs(); /* see how many subprocesses we need */
1197c478bd9Sstevel@tonic-gate /*
1207c478bd9Sstevel@tonic-gate * Allocate the root pcb and set it up.
1217c478bd9Sstevel@tonic-gate */
1227c478bd9Sstevel@tonic-gate pcb = (audit_pcb_t *)a_calloc(1, sizeof (audit_pcb_t));
1237c478bd9Sstevel@tonic-gate pcb->pcb_procno = root_pid;
1247c478bd9Sstevel@tonic-gate pcb->pcb_flags |= PF_ROOT;
1257c478bd9Sstevel@tonic-gate pcb->pcb_fpw = stdout;
1267c478bd9Sstevel@tonic-gate pcb->pcb_time = -1;
1277c478bd9Sstevel@tonic-gate /*
1287c478bd9Sstevel@tonic-gate * Now start the whole thing rolling.
1297c478bd9Sstevel@tonic-gate */
1307c478bd9Sstevel@tonic-gate if (mfork(pcb, pcbnum, 0, pcbnum - 1)) {
1317c478bd9Sstevel@tonic-gate /*
1327c478bd9Sstevel@tonic-gate * Error in processing somewhere. A message is already printed.
1337c478bd9Sstevel@tonic-gate * Display usage statistics and remove the outfile.
1347c478bd9Sstevel@tonic-gate */
1357c478bd9Sstevel@tonic-gate if (getpid() == root_pid) {
1367c478bd9Sstevel@tonic-gate audit_stats();
1377c478bd9Sstevel@tonic-gate (void) close_outfile();
1387c478bd9Sstevel@tonic-gate rm_outfile();
1397c478bd9Sstevel@tonic-gate }
1407c478bd9Sstevel@tonic-gate exit(1);
1417c478bd9Sstevel@tonic-gate }
1427c478bd9Sstevel@tonic-gate /*
1437c478bd9Sstevel@tonic-gate * Clean up afterwards.
1447c478bd9Sstevel@tonic-gate * Only do outfile cleanup if we are root process.
1457c478bd9Sstevel@tonic-gate */
1467c478bd9Sstevel@tonic-gate if (getpid() == root_pid) {
1477c478bd9Sstevel@tonic-gate if ((ret = write_trailer()) == 0) { /* write trailer to file */
1487c478bd9Sstevel@tonic-gate
1497c478bd9Sstevel@tonic-gate ret = close_outfile(); /* close the outfile */
1507c478bd9Sstevel@tonic-gate }
1517c478bd9Sstevel@tonic-gate /*
1527c478bd9Sstevel@tonic-gate * If there was an error in cleanup then remove outfile.
1537c478bd9Sstevel@tonic-gate */
1547c478bd9Sstevel@tonic-gate if (ret) {
1557c478bd9Sstevel@tonic-gate rm_outfile();
1567c478bd9Sstevel@tonic-gate exit(1);
1577c478bd9Sstevel@tonic-gate }
1587c478bd9Sstevel@tonic-gate /*
1597c478bd9Sstevel@tonic-gate * And lastly delete the infiles if the user so wishes.
1607c478bd9Sstevel@tonic-gate */
1617c478bd9Sstevel@tonic-gate if (f_delete)
1627c478bd9Sstevel@tonic-gate delete_infiles();
1637c478bd9Sstevel@tonic-gate }
1647c478bd9Sstevel@tonic-gate return (0);
1657c478bd9Sstevel@tonic-gate /*NOTREACHED*/
1667c478bd9Sstevel@tonic-gate }
1677c478bd9Sstevel@tonic-gate
1687c478bd9Sstevel@tonic-gate
1697c478bd9Sstevel@tonic-gate /*
1707c478bd9Sstevel@tonic-gate * .func mfork - main fork routine.
1717c478bd9Sstevel@tonic-gate * .desc Create a (sub-)tree of processses if needed, or just do the work
1727c478bd9Sstevel@tonic-gate * if we have few enough groups to process. This is a recursive routine
1737c478bd9Sstevel@tonic-gate * which stops recursing when the number of files to process is small
1747c478bd9Sstevel@tonic-gate * enough. Each call to mfork() is responsible for a range of pcbs
1757c478bd9Sstevel@tonic-gate * from audit_pcbs[]. This range is designated by the lo and hi
1767c478bd9Sstevel@tonic-gate * arguments (inclusive). If the number of pcbs is small enough
1777c478bd9Sstevel@tonic-gate * then we have hit a leaf of the tree and mproc() is called to
1787c478bd9Sstevel@tonic-gate * do the processing. Otherwise we fork some processes and break
1797c478bd9Sstevel@tonic-gate * the range of pcbs up amongst them.
1807c478bd9Sstevel@tonic-gate * .call ret = mfork(pcb, nsp, lo, hi).
1817c478bd9Sstevel@tonic-gate * .arg pcb - ptr to pcb that is root node of the to-be-created tree.
1827c478bd9Sstevel@tonic-gate * .arg nsp - number of sub-processes this tree must process.
1837c478bd9Sstevel@tonic-gate * .arg lo - lower-limit of process number range. Index into audit_pcbs.
1847c478bd9Sstevel@tonic-gate * .arg hi - higher limit of pcb range. Index into audit_pcbs.
1857c478bd9Sstevel@tonic-gate * .ret 0 - succesful completion.
1867c478bd9Sstevel@tonic-gate * .ret -1 - error encountered in processing - message already printed.
1877c478bd9Sstevel@tonic-gate */
1887c478bd9Sstevel@tonic-gate static int
mfork(audit_pcb_t * pcb,int nsp,int lo,int hi)1897c478bd9Sstevel@tonic-gate mfork(audit_pcb_t *pcb, int nsp, int lo, int hi)
1907c478bd9Sstevel@tonic-gate {
1917c478bd9Sstevel@tonic-gate int range, procno, i, tofork, nnsp, nrem;
1927c478bd9Sstevel@tonic-gate int fildes[2];
1937c478bd9Sstevel@tonic-gate audit_pcb_t *pcbn;
1947c478bd9Sstevel@tonic-gate
1957c478bd9Sstevel@tonic-gate #if AUDIT_PROC_TRACE
1967c478bd9Sstevel@tonic-gate (void) fprintf(stderr, "mfork: nsp %d %d->%d\n", nsp, lo, hi);
1977c478bd9Sstevel@tonic-gate #endif
1987c478bd9Sstevel@tonic-gate
1997c478bd9Sstevel@tonic-gate /*
2007c478bd9Sstevel@tonic-gate * The range of pcb's to process is small enough now. Do the work.
2017c478bd9Sstevel@tonic-gate */
2027c478bd9Sstevel@tonic-gate if (nsp <= max_sproc) {
2037c478bd9Sstevel@tonic-gate pcb->pcb_flags |= PF_LEAF; /* leaf in process tree */
2047c478bd9Sstevel@tonic-gate pcb->pcb_below = audit_pcbs; /* proc pcbs from audit_pcbs */
2057c478bd9Sstevel@tonic-gate gather_pcb(pcb, lo, hi);
2067c478bd9Sstevel@tonic-gate trim_mem(pcb); /* trim allocated memory */
2077c478bd9Sstevel@tonic-gate return (mproc(pcb)); /* do the work */
2087c478bd9Sstevel@tonic-gate }
2097c478bd9Sstevel@tonic-gate /*
2107c478bd9Sstevel@tonic-gate * Too many pcb's for one process - must fork.
2117c478bd9Sstevel@tonic-gate * Try to balance the tree as it grows and make it short and fat.
2127c478bd9Sstevel@tonic-gate * The thing to minimize is the number of times a record passes
2137c478bd9Sstevel@tonic-gate * through a pipe.
2147c478bd9Sstevel@tonic-gate */
2157c478bd9Sstevel@tonic-gate else {
2167c478bd9Sstevel@tonic-gate /*
2177c478bd9Sstevel@tonic-gate * Fork less than the maximum number of processes.
2187c478bd9Sstevel@tonic-gate */
2197c478bd9Sstevel@tonic-gate if (nsp <= max_sproc * (max_sproc - 1)) {
2207c478bd9Sstevel@tonic-gate tofork = nsp / max_sproc;
2217c478bd9Sstevel@tonic-gate if (nsp % max_sproc)
2227c478bd9Sstevel@tonic-gate tofork++; /* how many to fork */
2237c478bd9Sstevel@tonic-gate }
2247c478bd9Sstevel@tonic-gate /*
2257c478bd9Sstevel@tonic-gate * Fork the maximum number of processes.
2267c478bd9Sstevel@tonic-gate */
2277c478bd9Sstevel@tonic-gate else {
2287c478bd9Sstevel@tonic-gate tofork = max_sproc; /* how many to fork */
2297c478bd9Sstevel@tonic-gate }
2307c478bd9Sstevel@tonic-gate /*
2317c478bd9Sstevel@tonic-gate * Allocate the nodes below us in the process tree.
2327c478bd9Sstevel@tonic-gate */
2337c478bd9Sstevel@tonic-gate pcb->pcb_below = (audit_pcb_t *)
2347c478bd9Sstevel@tonic-gate a_calloc(tofork, sizeof (*pcb));
2357c478bd9Sstevel@tonic-gate nnsp = nsp / tofork; /* # of pcbs per forked process */
2367c478bd9Sstevel@tonic-gate nrem = nsp % tofork; /* remainder to spread around */
2377c478bd9Sstevel@tonic-gate /*
2387c478bd9Sstevel@tonic-gate * Loop to fork all of the subs. Open a pipe for each.
2397c478bd9Sstevel@tonic-gate * If there are any errors in pipes, forks, or getting streams
2407c478bd9Sstevel@tonic-gate * for the pipes then quit altogether.
2417c478bd9Sstevel@tonic-gate */
2427c478bd9Sstevel@tonic-gate for (i = 0; i < tofork; i++) {
2437c478bd9Sstevel@tonic-gate pcbn = &pcb->pcb_below[i];
2447c478bd9Sstevel@tonic-gate pcbn->pcb_time = -1;
2457c478bd9Sstevel@tonic-gate if (pipe(fildes)) {
2467c478bd9Sstevel@tonic-gate perror(gettext(
2477c478bd9Sstevel@tonic-gate "auditreduce: couldn't get a pipe"));
2487c478bd9Sstevel@tonic-gate return (-1);
2497c478bd9Sstevel@tonic-gate }
2507c478bd9Sstevel@tonic-gate /*
2517c478bd9Sstevel@tonic-gate * Convert descriptors to streams.
2527c478bd9Sstevel@tonic-gate */
2537c478bd9Sstevel@tonic-gate if ((pcbn->pcb_fpr = fdopen(fildes[0], "r")) == NULL) {
254*c85f09ccSJohn Levon perror(gettext("auditreduce: couldn't get read "
255*c85f09ccSJohn Levon "stream for pipe"));
2567c478bd9Sstevel@tonic-gate return (-1);
2577c478bd9Sstevel@tonic-gate }
2587c478bd9Sstevel@tonic-gate if ((pcbn->pcb_fpw = fdopen(fildes[1], "w")) == NULL) {
259*c85f09ccSJohn Levon perror(gettext("auditreduce: couldn't get "
260*c85f09ccSJohn Levon "write stream for pipe"));
2617c478bd9Sstevel@tonic-gate return (-1);
2627c478bd9Sstevel@tonic-gate }
2637c478bd9Sstevel@tonic-gate if ((procno = fork()) == -1) {
2647c478bd9Sstevel@tonic-gate perror(gettext("auditreduce: fork failed"));
2657c478bd9Sstevel@tonic-gate return (-1);
2667c478bd9Sstevel@tonic-gate }
2677c478bd9Sstevel@tonic-gate /*
2687c478bd9Sstevel@tonic-gate * Calculate the range of pcbs from audit_pcbs [] this
2697c478bd9Sstevel@tonic-gate * branch of the tree will be responsible for.
2707c478bd9Sstevel@tonic-gate */
2717c478bd9Sstevel@tonic-gate range = (nrem > 0) ? nnsp + 1 : nnsp;
2727c478bd9Sstevel@tonic-gate /*
2737c478bd9Sstevel@tonic-gate * Child route.
2747c478bd9Sstevel@tonic-gate */
2757c478bd9Sstevel@tonic-gate if (procno == 0) {
2767c478bd9Sstevel@tonic-gate pcbn->pcb_procno = getpid();
2777c478bd9Sstevel@tonic-gate c_close(pcb, i); /* close unused streams */
2787c478bd9Sstevel@tonic-gate /*
2797c478bd9Sstevel@tonic-gate * Continue resolving this branch.
2807c478bd9Sstevel@tonic-gate */
2817c478bd9Sstevel@tonic-gate return (mfork(pcbn, range, lo, lo + range - 1));
2827c478bd9Sstevel@tonic-gate }
2837c478bd9Sstevel@tonic-gate /* Parent route. */
2847c478bd9Sstevel@tonic-gate else {
2857c478bd9Sstevel@tonic-gate pcbn->pcb_procno = i;
2867c478bd9Sstevel@tonic-gate /* allocate buffer to hold record */
2877c478bd9Sstevel@tonic-gate pcbn->pcb_rec = (char *)a_calloc(1,
2887c478bd9Sstevel@tonic-gate AUDITBUFSIZE);
2897c478bd9Sstevel@tonic-gate pcbn->pcb_size = AUDITBUFSIZE;
2907c478bd9Sstevel@tonic-gate p_close(pcbn); /* close unused streams */
2917c478bd9Sstevel@tonic-gate
2927c478bd9Sstevel@tonic-gate nrem--;
2937c478bd9Sstevel@tonic-gate lo += range;
2947c478bd9Sstevel@tonic-gate }
2957c478bd9Sstevel@tonic-gate }
2967c478bd9Sstevel@tonic-gate /*
2977c478bd9Sstevel@tonic-gate * Done forking all of the subs.
2987c478bd9Sstevel@tonic-gate */
2997c478bd9Sstevel@tonic-gate gather_pcb(pcb, 0, tofork - 1);
3007c478bd9Sstevel@tonic-gate trim_mem(pcb); /* free unused memory */
3017c478bd9Sstevel@tonic-gate return (mproc(pcb));
3027c478bd9Sstevel@tonic-gate }
3037c478bd9Sstevel@tonic-gate }
3047c478bd9Sstevel@tonic-gate
3057c478bd9Sstevel@tonic-gate
3067c478bd9Sstevel@tonic-gate /*
3077c478bd9Sstevel@tonic-gate * .func trim_mem - trim memory usage.
3087c478bd9Sstevel@tonic-gate * .desc Free un-needed allocated memory.
3097c478bd9Sstevel@tonic-gate * .call trim_mem(pcb).
3107c478bd9Sstevel@tonic-gate * .arg pcb - ptr to pcb for current process.
3117c478bd9Sstevel@tonic-gate * .ret void.
3127c478bd9Sstevel@tonic-gate */
3137c478bd9Sstevel@tonic-gate static void
trim_mem(audit_pcb_t * pcb)3147c478bd9Sstevel@tonic-gate trim_mem(audit_pcb_t *pcb)
3157c478bd9Sstevel@tonic-gate {
3167c478bd9Sstevel@tonic-gate int count;
3177c478bd9Sstevel@tonic-gate size_t size;
3187c478bd9Sstevel@tonic-gate
3197c478bd9Sstevel@tonic-gate /*
3207c478bd9Sstevel@tonic-gate * For the root don't free anything. We need to save audit_pcbs[]
3217c478bd9Sstevel@tonic-gate * in case we are deleting the infiles at the end.
3227c478bd9Sstevel@tonic-gate */
3237c478bd9Sstevel@tonic-gate if (pcb->pcb_flags & PF_ROOT)
3247c478bd9Sstevel@tonic-gate return;
3257c478bd9Sstevel@tonic-gate /*
3267c478bd9Sstevel@tonic-gate * For a leaf save its part of audit_pcbs[] and then remove it all.
3277c478bd9Sstevel@tonic-gate */
3287c478bd9Sstevel@tonic-gate if (pcb->pcb_flags & PF_LEAF) {
3297c478bd9Sstevel@tonic-gate count = pcb->pcb_count;
3307c478bd9Sstevel@tonic-gate size = sizeof (audit_pcb_t);
3317c478bd9Sstevel@tonic-gate /* allocate a new buffer to hold the pcbs */
3327c478bd9Sstevel@tonic-gate pcb->pcb_below = (audit_pcb_t *)a_calloc(count, size);
3337c478bd9Sstevel@tonic-gate /* save this pcb's portion */
3347c478bd9Sstevel@tonic-gate (void) memcpy((void *) pcb->pcb_below,
3357c478bd9Sstevel@tonic-gate (void *) &audit_pcbs[pcb->pcb_lo], count * size);
3367c478bd9Sstevel@tonic-gate rm_mem(pcb);
3377c478bd9Sstevel@tonic-gate gather_pcb(pcb, 0, count - 1);
3387c478bd9Sstevel@tonic-gate }
3397c478bd9Sstevel@tonic-gate /*
3407c478bd9Sstevel@tonic-gate * If this is an intermediate node then just remove it all.
3417c478bd9Sstevel@tonic-gate */
3427c478bd9Sstevel@tonic-gate else {
3437c478bd9Sstevel@tonic-gate rm_mem(pcb);
3447c478bd9Sstevel@tonic-gate }
3457c478bd9Sstevel@tonic-gate }
3467c478bd9Sstevel@tonic-gate
3477c478bd9Sstevel@tonic-gate
3487c478bd9Sstevel@tonic-gate /*
3497c478bd9Sstevel@tonic-gate * .func rm_mem - remove memory.
3507c478bd9Sstevel@tonic-gate * .desc Remove unused memory associated with audit_pcbs[]. For each
3517c478bd9Sstevel@tonic-gate * pcb in audit_pcbs[] free the record buffer and all of
3527c478bd9Sstevel@tonic-gate * the fcbs. Then free audit_pcbs[].
3537c478bd9Sstevel@tonic-gate * .call rm_mem(pcbr).
3547c478bd9Sstevel@tonic-gate * .arg pcbr - ptr to pcb of current process.
3557c478bd9Sstevel@tonic-gate * .ret void.
3567c478bd9Sstevel@tonic-gate */
3577c478bd9Sstevel@tonic-gate static void
rm_mem(audit_pcb_t * pcbr)3587c478bd9Sstevel@tonic-gate rm_mem(audit_pcb_t *pcbr)
3597c478bd9Sstevel@tonic-gate {
3607c478bd9Sstevel@tonic-gate int i;
3617c478bd9Sstevel@tonic-gate audit_pcb_t *pcb;
3627c478bd9Sstevel@tonic-gate audit_fcb_t *fcb, *fcbn;
3637c478bd9Sstevel@tonic-gate
3647c478bd9Sstevel@tonic-gate for (i = 0; i < pcbsize; i++) {
3657c478bd9Sstevel@tonic-gate /*
3667c478bd9Sstevel@tonic-gate * Don't free the record buffer and fcbs for the pcbs this
3677c478bd9Sstevel@tonic-gate * process is using.
3687c478bd9Sstevel@tonic-gate */
3697c478bd9Sstevel@tonic-gate if (pcbr->pcb_flags & PF_LEAF) {
3707c478bd9Sstevel@tonic-gate if (pcbr->pcb_lo <= i || i <= pcbr->pcb_hi)
3717c478bd9Sstevel@tonic-gate continue;
3727c478bd9Sstevel@tonic-gate }
3737c478bd9Sstevel@tonic-gate pcb = &audit_pcbs[i];
3747c478bd9Sstevel@tonic-gate free(pcb->pcb_rec);
3757c478bd9Sstevel@tonic-gate for (fcb = pcb->pcb_first; fcb != NULL; /* */) {
3767c478bd9Sstevel@tonic-gate fcbn = fcb->fcb_next;
3777c478bd9Sstevel@tonic-gate free((char *)fcb);
3787c478bd9Sstevel@tonic-gate fcb = fcbn;
3797c478bd9Sstevel@tonic-gate }
3807c478bd9Sstevel@tonic-gate }
3817c478bd9Sstevel@tonic-gate free((char *)audit_pcbs);
3827c478bd9Sstevel@tonic-gate }
3837c478bd9Sstevel@tonic-gate
3847c478bd9Sstevel@tonic-gate
3857c478bd9Sstevel@tonic-gate /*
3867c478bd9Sstevel@tonic-gate * .func c_close - close unused streams.
3877c478bd9Sstevel@tonic-gate * .desc This is called for each child process just after being born.
3887c478bd9Sstevel@tonic-gate * The child closes the read stream for the pipe to its parent.
3897c478bd9Sstevel@tonic-gate * It also closes the read streams for the other children that
3907c478bd9Sstevel@tonic-gate * have been born before it. If any closes fail a warning message
3917c478bd9Sstevel@tonic-gate * is printed, but processing continues.
3927c478bd9Sstevel@tonic-gate * .call ret = c_close(pcb, i).
3937c478bd9Sstevel@tonic-gate * .arg pcb - ptr to the child's parent pcb.
3947c478bd9Sstevel@tonic-gate * .arg i - iteration # of child in forking loop.
3957c478bd9Sstevel@tonic-gate * .ret void.
3967c478bd9Sstevel@tonic-gate */
3977c478bd9Sstevel@tonic-gate static void
c_close(audit_pcb_t * pcb,int i)3987c478bd9Sstevel@tonic-gate c_close(audit_pcb_t *pcb, int i)
3997c478bd9Sstevel@tonic-gate {
4007c478bd9Sstevel@tonic-gate int j;
4017c478bd9Sstevel@tonic-gate audit_pcb_t *pcbt;
4027c478bd9Sstevel@tonic-gate
4037c478bd9Sstevel@tonic-gate /*
4047c478bd9Sstevel@tonic-gate * Do all pcbs in parent's group up to and including us
4057c478bd9Sstevel@tonic-gate */
4067c478bd9Sstevel@tonic-gate for (j = 0; j <= i; j++) {
4077c478bd9Sstevel@tonic-gate pcbt = &pcb->pcb_below[j];
4087c478bd9Sstevel@tonic-gate if (fclose(pcbt->pcb_fpr) == EOF) {
409*c85f09ccSJohn Levon if (!f_quiet) {
410*c85f09ccSJohn Levon perror(gettext("auditreduce: initial close "
411*c85f09ccSJohn Levon "on pipe failed"));
412*c85f09ccSJohn Levon }
4137c478bd9Sstevel@tonic-gate }
4147c478bd9Sstevel@tonic-gate /*
4157c478bd9Sstevel@tonic-gate * Free the buffer allocated to hold incoming records.
4167c478bd9Sstevel@tonic-gate */
4177c478bd9Sstevel@tonic-gate if (i != j) {
4187c478bd9Sstevel@tonic-gate free(pcbt->pcb_rec);
4197c478bd9Sstevel@tonic-gate }
4207c478bd9Sstevel@tonic-gate }
4217c478bd9Sstevel@tonic-gate }
4227c478bd9Sstevel@tonic-gate
4237c478bd9Sstevel@tonic-gate
4247c478bd9Sstevel@tonic-gate /*
4257c478bd9Sstevel@tonic-gate * .func p_close - close unused streams for parent.
4267c478bd9Sstevel@tonic-gate * .desc Called by the parent right after forking a child.
4277c478bd9Sstevel@tonic-gate * Closes the write stream on the pipe to the child since
4287c478bd9Sstevel@tonic-gate * we will never use it.
4297c478bd9Sstevel@tonic-gate * .call p_close(pcbn),
4307c478bd9Sstevel@tonic-gate * .arg pcbn - ptr to pcb.
4317c478bd9Sstevel@tonic-gate * .ret void.
4327c478bd9Sstevel@tonic-gate */
4337c478bd9Sstevel@tonic-gate static void
p_close(audit_pcb_t * pcbn)4347c478bd9Sstevel@tonic-gate p_close(audit_pcb_t *pcbn)
4357c478bd9Sstevel@tonic-gate {
4367c478bd9Sstevel@tonic-gate if (fclose(pcbn->pcb_fpw) == EOF) {
437*c85f09ccSJohn Levon if (!f_quiet) {
438*c85f09ccSJohn Levon perror(gettext("auditreduce: close for write "
439*c85f09ccSJohn Levon "pipe failed"));
440*c85f09ccSJohn Levon }
4417c478bd9Sstevel@tonic-gate }
4427c478bd9Sstevel@tonic-gate }
4437c478bd9Sstevel@tonic-gate
4447c478bd9Sstevel@tonic-gate
4457c478bd9Sstevel@tonic-gate /*
4467c478bd9Sstevel@tonic-gate * .func audit_stats - print statistics.
4477c478bd9Sstevel@tonic-gate * .desc Print usage statistics for the user if the run fails.
4487c478bd9Sstevel@tonic-gate * Tells them how many files they had and how many groups this
4497c478bd9Sstevel@tonic-gate * totalled. Also tell them how many layers and processes the
4507c478bd9Sstevel@tonic-gate * process tree had.
4517c478bd9Sstevel@tonic-gate * .call audit_stats().
4527c478bd9Sstevel@tonic-gate * .arg none.
4537c478bd9Sstevel@tonic-gate * .ret void.
4547c478bd9Sstevel@tonic-gate */
4557c478bd9Sstevel@tonic-gate void
audit_stats(void)4567c478bd9Sstevel@tonic-gate audit_stats(void)
4577c478bd9Sstevel@tonic-gate {
4587c478bd9Sstevel@tonic-gate struct rlimit rl;
4597c478bd9Sstevel@tonic-gate
4607c478bd9Sstevel@tonic-gate if (getrlimit(RLIMIT_NOFILE, &rl) != -1)
4617c478bd9Sstevel@tonic-gate (void) fprintf(stderr,
4627c478bd9Sstevel@tonic-gate gettext("%s The system allows %d files per process.\n"),
4637c478bd9Sstevel@tonic-gate ar, rl.rlim_cur);
4647c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext(
4657c478bd9Sstevel@tonic-gate "%s There were %d file(s) %d file group(s) %d process(es) %d layer(s).\n"),
4667c478bd9Sstevel@tonic-gate ar, filenum, pcbnum, total_procs, total_layers);
4677c478bd9Sstevel@tonic-gate }
4687c478bd9Sstevel@tonic-gate
4697c478bd9Sstevel@tonic-gate
4707c478bd9Sstevel@tonic-gate /*
4717c478bd9Sstevel@tonic-gate * .func gather_pcb - gather pcbs.
4727c478bd9Sstevel@tonic-gate * .desc Gather together the range of the sub-processes that we are
4737c478bd9Sstevel@tonic-gate * responsible for. For a pcb that controls processes this is all
4747c478bd9Sstevel@tonic-gate * of the sub-processes that it forks. For a pcb that controls
4757c478bd9Sstevel@tonic-gate * files this is the the range of pcbs from audit_pcbs[].
4767c478bd9Sstevel@tonic-gate * .call gather_pcb(pcb, lo, hi).
4777c478bd9Sstevel@tonic-gate * .arg pcb - ptr to pcb.
4787c478bd9Sstevel@tonic-gate * .arg lo - lo index into pcb_below.
4797c478bd9Sstevel@tonic-gate * .arg hi - hi index into pcb_below.
4807c478bd9Sstevel@tonic-gate * .ret void.
4817c478bd9Sstevel@tonic-gate */
4827c478bd9Sstevel@tonic-gate static void
gather_pcb(audit_pcb_t * pcb,int lo,int hi)4837c478bd9Sstevel@tonic-gate gather_pcb(audit_pcb_t *pcb, int lo, int hi)
4847c478bd9Sstevel@tonic-gate {
4857c478bd9Sstevel@tonic-gate pcb->pcb_lo = lo;
4867c478bd9Sstevel@tonic-gate pcb->pcb_hi = hi;
4877c478bd9Sstevel@tonic-gate pcb->pcb_count = hi - lo + 1;
4887c478bd9Sstevel@tonic-gate }
4897c478bd9Sstevel@tonic-gate
4907c478bd9Sstevel@tonic-gate
4917c478bd9Sstevel@tonic-gate /*
4927c478bd9Sstevel@tonic-gate * .func calc_procs - calculate process parameters.
4937c478bd9Sstevel@tonic-gate * .desc Calculate the current run's paramters regarding how many
4947c478bd9Sstevel@tonic-gate * processes will have to be forked (maybe none).
4957c478bd9Sstevel@tonic-gate * 5 is subtracted from maxfiles_proc to allow for stdin, stdout,
4967c478bd9Sstevel@tonic-gate * stderr, and the pipe to a parent process. The outfile
4977c478bd9Sstevel@tonic-gate * in the root process is assigned to stdout. The unused half of each
4987c478bd9Sstevel@tonic-gate * pipe is closed, to allow for more connections, but we still
4997c478bd9Sstevel@tonic-gate * have to have the 5th spot because in order to get the pipe
5007c478bd9Sstevel@tonic-gate * we need 2 descriptors up front.
5017c478bd9Sstevel@tonic-gate * .call calc_procs().
5027c478bd9Sstevel@tonic-gate * .arg none.
5037c478bd9Sstevel@tonic-gate * .ret void.
5047c478bd9Sstevel@tonic-gate */
5057c478bd9Sstevel@tonic-gate static void
calc_procs(void)5067c478bd9Sstevel@tonic-gate calc_procs(void)
5077c478bd9Sstevel@tonic-gate {
5087c478bd9Sstevel@tonic-gate int val;
5097c478bd9Sstevel@tonic-gate int maxfiles_proc;
5107c478bd9Sstevel@tonic-gate struct rlimit rl;
5117c478bd9Sstevel@tonic-gate
5127c478bd9Sstevel@tonic-gate if (getrlimit(RLIMIT_NOFILE, &rl) == -1) {
5137c478bd9Sstevel@tonic-gate perror("auditreduce: getrlimit");
5147c478bd9Sstevel@tonic-gate exit(1);
5157c478bd9Sstevel@tonic-gate }
5167c478bd9Sstevel@tonic-gate
5177c478bd9Sstevel@tonic-gate maxfiles_proc = rl.rlim_cur;
5187c478bd9Sstevel@tonic-gate
5197c478bd9Sstevel@tonic-gate max_sproc = maxfiles_proc - 5; /* max subprocesses per process */
5207c478bd9Sstevel@tonic-gate
5217c478bd9Sstevel@tonic-gate /*
5227c478bd9Sstevel@tonic-gate * Calculate how many layers the process tree has.
5237c478bd9Sstevel@tonic-gate */
5247c478bd9Sstevel@tonic-gate total_layers = 1;
5257c478bd9Sstevel@tonic-gate for (/* */; /* */; /* */) {
5267c478bd9Sstevel@tonic-gate val = a_pow(max_sproc, total_layers);
5277c478bd9Sstevel@tonic-gate if (val > pcbnum)
5287c478bd9Sstevel@tonic-gate break;
5297c478bd9Sstevel@tonic-gate total_layers++;
5307c478bd9Sstevel@tonic-gate }
5317c478bd9Sstevel@tonic-gate /*
5327c478bd9Sstevel@tonic-gate * Count how many processes are in the process tree.
5337c478bd9Sstevel@tonic-gate */
5347c478bd9Sstevel@tonic-gate mcount(pcbnum, 0);
5357c478bd9Sstevel@tonic-gate
5367c478bd9Sstevel@tonic-gate #if AUDIT_PROC_TRACE
5377c478bd9Sstevel@tonic-gate (void) fprintf(stderr,
5387c478bd9Sstevel@tonic-gate "pcbnum %d filenum %d mfp %d msp %d ly %d tot %d\n\n",
5397c478bd9Sstevel@tonic-gate pcbnum, filenum, maxfiles_proc, max_sproc,
5407c478bd9Sstevel@tonic-gate total_layers, total_procs);
5417c478bd9Sstevel@tonic-gate #endif
5427c478bd9Sstevel@tonic-gate }
5437c478bd9Sstevel@tonic-gate
5447c478bd9Sstevel@tonic-gate
5457c478bd9Sstevel@tonic-gate static int
a_pow(int base,int exp)5467c478bd9Sstevel@tonic-gate a_pow(int base, int exp)
5477c478bd9Sstevel@tonic-gate {
5487c478bd9Sstevel@tonic-gate int i;
5497c478bd9Sstevel@tonic-gate int answer;
5507c478bd9Sstevel@tonic-gate
5517c478bd9Sstevel@tonic-gate if (exp == 0) {
5527c478bd9Sstevel@tonic-gate answer = 1;
5537c478bd9Sstevel@tonic-gate } else {
5547c478bd9Sstevel@tonic-gate answer = base;
5557c478bd9Sstevel@tonic-gate for (i = 0; i < (exp - 1); i++)
5567c478bd9Sstevel@tonic-gate answer *= base;
5577c478bd9Sstevel@tonic-gate }
5587c478bd9Sstevel@tonic-gate return (answer);
5597c478bd9Sstevel@tonic-gate }
5607c478bd9Sstevel@tonic-gate
5617c478bd9Sstevel@tonic-gate
5627c478bd9Sstevel@tonic-gate /*
5637c478bd9Sstevel@tonic-gate * .func mcount - main count.
5647c478bd9Sstevel@tonic-gate * .desc Go through the motions of building the process tree just
5657c478bd9Sstevel@tonic-gate * to count how many processes there are. Don't really
5667c478bd9Sstevel@tonic-gate * build anything. Answer is in global var total_procs.
5677c478bd9Sstevel@tonic-gate * .call mcount(nsp, lo).
5687c478bd9Sstevel@tonic-gate * .arg nsp - number of subs for this tree branch.
5697c478bd9Sstevel@tonic-gate * .arg lo - lo side of range of subs.
5707c478bd9Sstevel@tonic-gate * .ret void.
5717c478bd9Sstevel@tonic-gate */
5727c478bd9Sstevel@tonic-gate static void
mcount(int nsp,int lo)5737c478bd9Sstevel@tonic-gate mcount(int nsp, int lo)
5747c478bd9Sstevel@tonic-gate {
5757c478bd9Sstevel@tonic-gate int range, i, tofork, nnsp, nrem;
5767c478bd9Sstevel@tonic-gate
5777c478bd9Sstevel@tonic-gate total_procs++; /* count another process created */
5787c478bd9Sstevel@tonic-gate
5797c478bd9Sstevel@tonic-gate if (nsp > max_sproc) {
5807c478bd9Sstevel@tonic-gate if (nsp <= max_sproc * (max_sproc - 1)) {
5817c478bd9Sstevel@tonic-gate tofork = nsp / max_sproc;
5827c478bd9Sstevel@tonic-gate if (nsp % max_sproc)
5837c478bd9Sstevel@tonic-gate tofork++;
5847c478bd9Sstevel@tonic-gate } else {
5857c478bd9Sstevel@tonic-gate tofork = max_sproc;
5867c478bd9Sstevel@tonic-gate }
5877c478bd9Sstevel@tonic-gate nnsp = nsp / tofork;
5887c478bd9Sstevel@tonic-gate nrem = nsp % tofork;
5897c478bd9Sstevel@tonic-gate for (i = 0; i < tofork; i++) {
5907c478bd9Sstevel@tonic-gate range = (nrem > 0) ? nnsp + 1 : nnsp;
5917c478bd9Sstevel@tonic-gate mcount(range, lo);
5927c478bd9Sstevel@tonic-gate nrem--;
5937c478bd9Sstevel@tonic-gate lo += range;
5947c478bd9Sstevel@tonic-gate }
5957c478bd9Sstevel@tonic-gate }
5967c478bd9Sstevel@tonic-gate }
5977c478bd9Sstevel@tonic-gate
5987c478bd9Sstevel@tonic-gate
5997c478bd9Sstevel@tonic-gate /*
6007c478bd9Sstevel@tonic-gate * .func delete_infiles - delete the input files.
6017c478bd9Sstevel@tonic-gate * .desc If the user asked us to (via 'D' flag) then unlink the input files.
6027c478bd9Sstevel@tonic-gate * .call ret = delete_infiles().
6037c478bd9Sstevel@tonic-gate * .arg none.
6047c478bd9Sstevel@tonic-gate * .ret void.
6057c478bd9Sstevel@tonic-gate */
6067c478bd9Sstevel@tonic-gate static void
delete_infiles(void)6077c478bd9Sstevel@tonic-gate delete_infiles(void)
6087c478bd9Sstevel@tonic-gate {
6097c478bd9Sstevel@tonic-gate int i;
6107c478bd9Sstevel@tonic-gate audit_pcb_t *pcb;
6117c478bd9Sstevel@tonic-gate audit_fcb_t *fcb;
6127c478bd9Sstevel@tonic-gate
6137c478bd9Sstevel@tonic-gate for (i = 0; i < pcbsize; i++) {
6147c478bd9Sstevel@tonic-gate pcb = &audit_pcbs[i];
6157c478bd9Sstevel@tonic-gate fcb = pcb->pcb_dfirst;
6167c478bd9Sstevel@tonic-gate while (fcb != NULL) {
6177c478bd9Sstevel@tonic-gate /*
6187c478bd9Sstevel@tonic-gate * Only delete a file if it was succesfully processed.
6197c478bd9Sstevel@tonic-gate * If there were any read errors or bad records
6207c478bd9Sstevel@tonic-gate * then don't delete it.
6217c478bd9Sstevel@tonic-gate * There may still be unprocessed records in it.
6227c478bd9Sstevel@tonic-gate */
6237c478bd9Sstevel@tonic-gate if (fcb->fcb_flags & FF_DELETE) {
6247c478bd9Sstevel@tonic-gate if (unlink(fcb->fcb_file)) {
6257c478bd9Sstevel@tonic-gate if (f_verbose) {
6267c478bd9Sstevel@tonic-gate (void) sprintf(errbuf, gettext(
6277c478bd9Sstevel@tonic-gate "%s delete on %s failed"),
6287c478bd9Sstevel@tonic-gate ar, fcb->fcb_file);
6297c478bd9Sstevel@tonic-gate }
6307c478bd9Sstevel@tonic-gate perror(errbuf);
6317c478bd9Sstevel@tonic-gate }
6327c478bd9Sstevel@tonic-gate }
6337c478bd9Sstevel@tonic-gate fcb = fcb->fcb_next;
6347c478bd9Sstevel@tonic-gate }
6357c478bd9Sstevel@tonic-gate }
6367c478bd9Sstevel@tonic-gate }
6377c478bd9Sstevel@tonic-gate
6387c478bd9Sstevel@tonic-gate
6397c478bd9Sstevel@tonic-gate /*
6407c478bd9Sstevel@tonic-gate * .func rm_outfile - remove the outfile.
6417c478bd9Sstevel@tonic-gate * .desc Remove the file we are writing the records to. We do this if
6427c478bd9Sstevel@tonic-gate * processing failed and we are quitting before finishing.
6437c478bd9Sstevel@tonic-gate * Update - don't actually remove the outfile, but generate
6447c478bd9Sstevel@tonic-gate * a warning about its possible heathen nature.
6457c478bd9Sstevel@tonic-gate * .call ret = rm_outfile().
6467c478bd9Sstevel@tonic-gate * .arg none.
6477c478bd9Sstevel@tonic-gate * .ret void.
6487c478bd9Sstevel@tonic-gate */
6497c478bd9Sstevel@tonic-gate static void
rm_outfile(void)6507c478bd9Sstevel@tonic-gate rm_outfile(void)
6517c478bd9Sstevel@tonic-gate {
6527c478bd9Sstevel@tonic-gate #if 0
6537c478bd9Sstevel@tonic-gate if (f_outfile) {
6547c478bd9Sstevel@tonic-gate if (unlink(f_outtemp) == -1) {
6557c478bd9Sstevel@tonic-gate (void) sprintf(errbuf,
6567c478bd9Sstevel@tonic-gate gettext("%s delete on %s failed"),
6577c478bd9Sstevel@tonic-gate ar, f_outtemp);
6587c478bd9Sstevel@tonic-gate perror(errbuf);
6597c478bd9Sstevel@tonic-gate }
6607c478bd9Sstevel@tonic-gate }
6617c478bd9Sstevel@tonic-gate #else
6627c478bd9Sstevel@tonic-gate (void) fprintf(stderr,
6637c478bd9Sstevel@tonic-gate gettext("%s Warning: Incomplete audit file may have been generated - %s\n"),
6647c478bd9Sstevel@tonic-gate ar,
6657c478bd9Sstevel@tonic-gate (f_outfile == NULL) ? gettext("standard output") : f_outfile);
6667c478bd9Sstevel@tonic-gate #endif
6677c478bd9Sstevel@tonic-gate }
6687c478bd9Sstevel@tonic-gate
6697c478bd9Sstevel@tonic-gate
6707c478bd9Sstevel@tonic-gate /*
6717c478bd9Sstevel@tonic-gate * .func close_outfile - close the outfile.
6727c478bd9Sstevel@tonic-gate * .desc Close the file we are writing records to.
6737c478bd9Sstevel@tonic-gate * .call ret = close_outfile().
6747c478bd9Sstevel@tonic-gate * .arg none.
6757c478bd9Sstevel@tonic-gate * .ret 0 - close was succesful.
6767c478bd9Sstevel@tonic-gate * .ret -1 - close failed.
6777c478bd9Sstevel@tonic-gate */
6787c478bd9Sstevel@tonic-gate static int
close_outfile(void)6797c478bd9Sstevel@tonic-gate close_outfile(void)
6807c478bd9Sstevel@tonic-gate {
6817c478bd9Sstevel@tonic-gate if (fclose(stdout) == EOF) {
6827c478bd9Sstevel@tonic-gate (void) sprintf(errbuf, gettext("%s close on %s failed"),
6837c478bd9Sstevel@tonic-gate ar, f_outfile ? f_outfile : "standard output");
6847c478bd9Sstevel@tonic-gate perror(errbuf);
6857c478bd9Sstevel@tonic-gate return (-1);
6867c478bd9Sstevel@tonic-gate }
6877c478bd9Sstevel@tonic-gate (void) fsync(fileno(stdout));
6887c478bd9Sstevel@tonic-gate return (rename_outfile());
6897c478bd9Sstevel@tonic-gate }
6907c478bd9Sstevel@tonic-gate
6917c478bd9Sstevel@tonic-gate
6927c478bd9Sstevel@tonic-gate /*
6937c478bd9Sstevel@tonic-gate * .func write_header - write audit file header.
6947c478bd9Sstevel@tonic-gate * .desc Write an audit file header to the output stream. The time in the
6957c478bd9Sstevel@tonic-gate * header is the time of the first record written to the stream. This
6967c478bd9Sstevel@tonic-gate * routine is called by the process handling the root node of the
6977c478bd9Sstevel@tonic-gate * process tree just before it writes the first record to the output
6987c478bd9Sstevel@tonic-gate * stream.
6997c478bd9Sstevel@tonic-gate * .ret 0 - succesful write.
7007c478bd9Sstevel@tonic-gate * .ret -1 - failed write - message printed.
7017c478bd9Sstevel@tonic-gate */
7027c478bd9Sstevel@tonic-gate int
write_header(void)7037c478bd9Sstevel@tonic-gate write_header(void)
7047c478bd9Sstevel@tonic-gate {
7057c478bd9Sstevel@tonic-gate return (write_file_token(f_start));
7067c478bd9Sstevel@tonic-gate }
7077c478bd9Sstevel@tonic-gate
7087c478bd9Sstevel@tonic-gate
7097c478bd9Sstevel@tonic-gate static int
write_file_token(time_t when)7107c478bd9Sstevel@tonic-gate write_file_token(time_t when)
7117c478bd9Sstevel@tonic-gate {
7127c478bd9Sstevel@tonic-gate adr_t adr; /* adr ptr */
7137c478bd9Sstevel@tonic-gate struct timeval tv; /* time now */
7147c478bd9Sstevel@tonic-gate char for_adr[16]; /* plenty of room */
7157c478bd9Sstevel@tonic-gate #ifdef _LP64
7167c478bd9Sstevel@tonic-gate char token_id = AUT_OTHER_FILE64;
7177c478bd9Sstevel@tonic-gate #else
7187c478bd9Sstevel@tonic-gate char token_id = AUT_OTHER_FILE32;
7197c478bd9Sstevel@tonic-gate #endif
7207c478bd9Sstevel@tonic-gate short i = 1;
7217c478bd9Sstevel@tonic-gate char c = '\0';
7227c478bd9Sstevel@tonic-gate
7237c478bd9Sstevel@tonic-gate tv.tv_sec = when;
7247c478bd9Sstevel@tonic-gate tv.tv_usec = 0;
7257c478bd9Sstevel@tonic-gate adr_start(&adr, for_adr);
7267c478bd9Sstevel@tonic-gate adr_char(&adr, &token_id, 1);
7277c478bd9Sstevel@tonic-gate #ifdef _LP64
7287c478bd9Sstevel@tonic-gate adr_int64(&adr, (int64_t *)&tv, 2);
7297c478bd9Sstevel@tonic-gate #else
7307c478bd9Sstevel@tonic-gate adr_int32(&adr, (int32_t *)&tv, 2);
7317c478bd9Sstevel@tonic-gate #endif
7327c478bd9Sstevel@tonic-gate adr_short(&adr, &i, 1);
7337c478bd9Sstevel@tonic-gate adr_char(&adr, &c, 1);
7347c478bd9Sstevel@tonic-gate
7357c478bd9Sstevel@tonic-gate if (fwrite(for_adr, sizeof (char), adr_count(&adr), stdout) !=
7367c478bd9Sstevel@tonic-gate adr_count(&adr)) {
7377c478bd9Sstevel@tonic-gate if (when == f_start) {
7387c478bd9Sstevel@tonic-gate (void) sprintf(errbuf,
7397c478bd9Sstevel@tonic-gate gettext("%s error writing header to %s. "),
7407c478bd9Sstevel@tonic-gate ar,
7417c478bd9Sstevel@tonic-gate f_outfile ? f_outfile :
7427c478bd9Sstevel@tonic-gate gettext("standard output"));
7437c478bd9Sstevel@tonic-gate } else {
7447c478bd9Sstevel@tonic-gate (void) sprintf(errbuf,
7457c478bd9Sstevel@tonic-gate gettext("%s error writing trailer to %s. "),
7467c478bd9Sstevel@tonic-gate ar,
7477c478bd9Sstevel@tonic-gate f_outfile ? f_outfile :
7487c478bd9Sstevel@tonic-gate gettext("standard output"));
7497c478bd9Sstevel@tonic-gate }
7507c478bd9Sstevel@tonic-gate perror(errbuf);
7517c478bd9Sstevel@tonic-gate return (-1);
7527c478bd9Sstevel@tonic-gate }
7537c478bd9Sstevel@tonic-gate return (0);
7547c478bd9Sstevel@tonic-gate }
7557c478bd9Sstevel@tonic-gate
7567c478bd9Sstevel@tonic-gate
7577c478bd9Sstevel@tonic-gate /*
7587c478bd9Sstevel@tonic-gate * .func write_trailer - write audit file trailer.
7597c478bd9Sstevel@tonic-gate * .desc Write an audit file trailer to the output stream. The finish
7607c478bd9Sstevel@tonic-gate * time for the trailer is the time of the last record written
7617c478bd9Sstevel@tonic-gate * to the stream.
7627c478bd9Sstevel@tonic-gate * .ret 0 - succesful write.
7637c478bd9Sstevel@tonic-gate * .ret -1 - failed write - message printed.
7647c478bd9Sstevel@tonic-gate */
7657c478bd9Sstevel@tonic-gate static int
write_trailer(void)7667c478bd9Sstevel@tonic-gate write_trailer(void)
7677c478bd9Sstevel@tonic-gate {
7687c478bd9Sstevel@tonic-gate return (write_file_token(f_end));
7697c478bd9Sstevel@tonic-gate }
7707c478bd9Sstevel@tonic-gate
7717c478bd9Sstevel@tonic-gate
7727c478bd9Sstevel@tonic-gate /*
7737c478bd9Sstevel@tonic-gate * .func rename_outfile - rename the outfile.
7747c478bd9Sstevel@tonic-gate * .desc If the user used the -O flag they only gave us the suffix name
7757c478bd9Sstevel@tonic-gate * for the outfile. We have to add the time stamps to put the filename
7767c478bd9Sstevel@tonic-gate * in the proper audit file name format. The start time will be the time
7777c478bd9Sstevel@tonic-gate * of the first record in the file and the end time will be the time of
7787c478bd9Sstevel@tonic-gate * the last record in the file.
7797c478bd9Sstevel@tonic-gate * .ret 0 - rename succesful.
7807c478bd9Sstevel@tonic-gate * .ret -1 - rename failed - message printed.
7817c478bd9Sstevel@tonic-gate */
7827c478bd9Sstevel@tonic-gate static int
rename_outfile(void)7837c478bd9Sstevel@tonic-gate rename_outfile(void)
7847c478bd9Sstevel@tonic-gate {
7857c478bd9Sstevel@tonic-gate char f_newfile[MAXFILELEN];
7867c478bd9Sstevel@tonic-gate char buf1[15], buf2[15];
7877c478bd9Sstevel@tonic-gate char *f_file, *f_nfile, *f_time, *f_name;
7887c478bd9Sstevel@tonic-gate
7897c478bd9Sstevel@tonic-gate if (f_outfile != NULL) {
7907c478bd9Sstevel@tonic-gate /*
7917c478bd9Sstevel@tonic-gate * Get string representations of start and end times.
7927c478bd9Sstevel@tonic-gate */
7937c478bd9Sstevel@tonic-gate derive_str(f_start, buf1);
7947c478bd9Sstevel@tonic-gate derive_str(f_end, buf2);
7957c478bd9Sstevel@tonic-gate
7967c478bd9Sstevel@tonic-gate f_nfile = f_time = f_newfile; /* working copy */
7977c478bd9Sstevel@tonic-gate f_file = f_name = f_outfile; /* their version */
7987c478bd9Sstevel@tonic-gate while (*f_file) {
7997c478bd9Sstevel@tonic-gate if (*f_file == '/') { /* look for filename */
8007c478bd9Sstevel@tonic-gate f_time = f_nfile + 1;
8017c478bd9Sstevel@tonic-gate f_name = f_file + 1;
8027c478bd9Sstevel@tonic-gate }
8037c478bd9Sstevel@tonic-gate *f_nfile++ = *f_file++; /* make copy of their version */
8047c478bd9Sstevel@tonic-gate }
8057c478bd9Sstevel@tonic-gate *f_time = '\0';
8067c478bd9Sstevel@tonic-gate /* start time goes first */
8077c478bd9Sstevel@tonic-gate (void) strcat(f_newfile, buf1);
8087c478bd9Sstevel@tonic-gate (void) strcat(f_newfile, ".");
8097c478bd9Sstevel@tonic-gate /* then the finish time */
8107c478bd9Sstevel@tonic-gate (void) strcat(f_newfile, buf2);
8117c478bd9Sstevel@tonic-gate (void) strcat(f_newfile, ".");
8127c478bd9Sstevel@tonic-gate /* and the name they gave us */
8137c478bd9Sstevel@tonic-gate (void) strcat(f_newfile, f_name);
8147c478bd9Sstevel@tonic-gate
8157c478bd9Sstevel@tonic-gate #if AUDIT_FILE
8167c478bd9Sstevel@tonic-gate (void) fprintf(stderr, "rename_outfile: <%s> --> <%s>\n",
8177c478bd9Sstevel@tonic-gate f_outfile, f_newfile);
8187c478bd9Sstevel@tonic-gate #endif
8197c478bd9Sstevel@tonic-gate
8207c478bd9Sstevel@tonic-gate #if AUDIT_RENAME
8217c478bd9Sstevel@tonic-gate if (rename(f_outtemp, f_newfile) == -1) {
8227c478bd9Sstevel@tonic-gate (void) fprintf(stderr,
8237c478bd9Sstevel@tonic-gate "%s rename of %s to %s failed.\n",
8247c478bd9Sstevel@tonic-gate ar, f_outtemp, f_newfile);
8257c478bd9Sstevel@tonic-gate return (-1);
8267c478bd9Sstevel@tonic-gate }
8277c478bd9Sstevel@tonic-gate f_outfile = f_newfile;
8287c478bd9Sstevel@tonic-gate #else
8297c478bd9Sstevel@tonic-gate if (rename(f_outtemp, f_outfile) == -1) {
8307c478bd9Sstevel@tonic-gate (void) fprintf(stderr,
8317c478bd9Sstevel@tonic-gate gettext("%s rename of %s to %s failed.\n"),
8327c478bd9Sstevel@tonic-gate ar, f_outtemp, f_outfile);
8337c478bd9Sstevel@tonic-gate return (-1);
8347c478bd9Sstevel@tonic-gate }
8357c478bd9Sstevel@tonic-gate #endif
8367c478bd9Sstevel@tonic-gate }
8377c478bd9Sstevel@tonic-gate return (0);
8387c478bd9Sstevel@tonic-gate }
8397c478bd9Sstevel@tonic-gate
8407c478bd9Sstevel@tonic-gate
8417c478bd9Sstevel@tonic-gate /*
8427c478bd9Sstevel@tonic-gate * .func open_outfile - open the outfile.
8437c478bd9Sstevel@tonic-gate * .desc Open the outfile specified by the -O option. Assign it to the
8447c478bd9Sstevel@tonic-gate * the standard output. Get a unique temporary name to use so we
8457c478bd9Sstevel@tonic-gate * don't clobber an existing file.
8467c478bd9Sstevel@tonic-gate * .ret 0 - no errors detected.
8477c478bd9Sstevel@tonic-gate * .ret -1 - errors in processing (message already printed).
8487c478bd9Sstevel@tonic-gate */
8497c478bd9Sstevel@tonic-gate static int
open_outfile(void)8507c478bd9Sstevel@tonic-gate open_outfile(void)
8517c478bd9Sstevel@tonic-gate {
8527c478bd9Sstevel@tonic-gate int tmpfd = -1;
8537c478bd9Sstevel@tonic-gate
8547c478bd9Sstevel@tonic-gate if (f_outfile != NULL) {
8557c478bd9Sstevel@tonic-gate f_outtemp = (char *)a_calloc(1, strlen(f_outfile) + 8);
8567c478bd9Sstevel@tonic-gate (void) strcpy(f_outtemp, f_outfile);
8577c478bd9Sstevel@tonic-gate (void) strcat(f_outtemp, "XXXXXX");
8587c478bd9Sstevel@tonic-gate if ((tmpfd = mkstemp(f_outtemp)) == -1) {
8597c478bd9Sstevel@tonic-gate (void) sprintf(errbuf,
8607c478bd9Sstevel@tonic-gate gettext("%s couldn't create temporary file"), ar);
8617c478bd9Sstevel@tonic-gate perror(errbuf);
8627c478bd9Sstevel@tonic-gate return (-1);
8637c478bd9Sstevel@tonic-gate }
8647c478bd9Sstevel@tonic-gate (void) fflush(stdout);
8657c478bd9Sstevel@tonic-gate if (tmpfd != fileno(stdout)) {
8667c478bd9Sstevel@tonic-gate if ((dup2(tmpfd, fileno(stdout))) == -1) {
8677c478bd9Sstevel@tonic-gate (void) sprintf(errbuf,
8687c478bd9Sstevel@tonic-gate gettext("%s can't assign %s to the "
8697c478bd9Sstevel@tonic-gate "standard output"), ar, f_outfile);
8707c478bd9Sstevel@tonic-gate perror(errbuf);
8717c478bd9Sstevel@tonic-gate return (-1);
8727c478bd9Sstevel@tonic-gate }
8737c478bd9Sstevel@tonic-gate (void) close(tmpfd);
8747c478bd9Sstevel@tonic-gate }
8757c478bd9Sstevel@tonic-gate }
8767c478bd9Sstevel@tonic-gate return (0);
8777c478bd9Sstevel@tonic-gate }
8787c478bd9Sstevel@tonic-gate
8797c478bd9Sstevel@tonic-gate
8807c478bd9Sstevel@tonic-gate /*
8817c478bd9Sstevel@tonic-gate * .func init_options - initialize the options.
8827c478bd9Sstevel@tonic-gate * .desc Give initial and/or default values to some options.
8837c478bd9Sstevel@tonic-gate * .call init_options();
8847c478bd9Sstevel@tonic-gate * .arg none.
8857c478bd9Sstevel@tonic-gate * .ret void.
8867c478bd9Sstevel@tonic-gate */
8877c478bd9Sstevel@tonic-gate static void
init_options(void)8887c478bd9Sstevel@tonic-gate init_options(void)
8897c478bd9Sstevel@tonic-gate {
8907c478bd9Sstevel@tonic-gate struct timeval tp;
8917c478bd9Sstevel@tonic-gate struct timezone tpz;
8927c478bd9Sstevel@tonic-gate
8937c478bd9Sstevel@tonic-gate /*
8947c478bd9Sstevel@tonic-gate * Get current time for general use.
8957c478bd9Sstevel@tonic-gate */
8967c478bd9Sstevel@tonic-gate if (gettimeofday(&tp, &tpz) == -1)
8977c478bd9Sstevel@tonic-gate perror(gettext("auditreduce: initial getttimeofday failed"));
8987c478bd9Sstevel@tonic-gate
8997c478bd9Sstevel@tonic-gate time_now = tp.tv_sec; /* save for general use */
9007c478bd9Sstevel@tonic-gate f_start = 0; /* first record time default */
9017c478bd9Sstevel@tonic-gate f_end = time_now; /* last record time default */
9027c478bd9Sstevel@tonic-gate m_after = 0; /* Jan 1, 1970 00:00:00 */
9037c478bd9Sstevel@tonic-gate
9047c478bd9Sstevel@tonic-gate /*
9057c478bd9Sstevel@tonic-gate * Setup initial size of audit_pcbs[].
9067c478bd9Sstevel@tonic-gate */
9077c478bd9Sstevel@tonic-gate pcbsize = PCB_INITSIZE; /* initial size of file-holding pcb's */
9087c478bd9Sstevel@tonic-gate
9097c478bd9Sstevel@tonic-gate audit_pcbs = (audit_pcb_t *)a_calloc(pcbsize, sizeof (audit_pcb_t));
9107c478bd9Sstevel@tonic-gate
9117c478bd9Sstevel@tonic-gate /* description of 'current' error */
9127c478bd9Sstevel@tonic-gate error_str = gettext("initial error");
9137c478bd9Sstevel@tonic-gate
9147c478bd9Sstevel@tonic-gate }
9157c478bd9Sstevel@tonic-gate
9167c478bd9Sstevel@tonic-gate
9177c478bd9Sstevel@tonic-gate /*
9187c478bd9Sstevel@tonic-gate * .func a_calloc - audit calloc.
9197c478bd9Sstevel@tonic-gate * .desc Calloc with check for failure. This is called by all of the
9207c478bd9Sstevel@tonic-gate * places that want memory.
9217c478bd9Sstevel@tonic-gate * .call ptr = a_calloc(nelem, size).
9227c478bd9Sstevel@tonic-gate * .arg nelem - number of elements to allocate.
9237c478bd9Sstevel@tonic-gate * .arg size - size of each element.
9247c478bd9Sstevel@tonic-gate * .ret ptr - ptr to allocated and zeroed memory.
9257c478bd9Sstevel@tonic-gate * .ret never - if calloc fails then we never return.
9267c478bd9Sstevel@tonic-gate */
9277c478bd9Sstevel@tonic-gate void *
a_calloc(int nelem,size_t size)9287c478bd9Sstevel@tonic-gate a_calloc(int nelem, size_t size)
9297c478bd9Sstevel@tonic-gate {
9307c478bd9Sstevel@tonic-gate void *ptr;
9317c478bd9Sstevel@tonic-gate
9327c478bd9Sstevel@tonic-gate if ((ptr = calloc((unsigned)nelem, size)) == NULL) {
9337c478bd9Sstevel@tonic-gate perror(gettext("auditreduce: memory allocation failed"));
9347c478bd9Sstevel@tonic-gate exit(1);
9357c478bd9Sstevel@tonic-gate }
9367c478bd9Sstevel@tonic-gate return (ptr);
9377c478bd9Sstevel@tonic-gate }
9387c478bd9Sstevel@tonic-gate
9397c478bd9Sstevel@tonic-gate
9407c478bd9Sstevel@tonic-gate /*
9417c478bd9Sstevel@tonic-gate * .func init_sig - initial signal catching.
9427c478bd9Sstevel@tonic-gate *
9437c478bd9Sstevel@tonic-gate * .desc
9447c478bd9Sstevel@tonic-gate * Setup the signal catcher to catch the SIGCHLD signal plus
9457c478bd9Sstevel@tonic-gate * "environmental" signals -- keyboard plus other externally
9467c478bd9Sstevel@tonic-gate * generated signals such as out of file space or cpu time. If a
9477c478bd9Sstevel@tonic-gate * child exits with either a non-zero exit code or was killed by
9487c478bd9Sstevel@tonic-gate * a signal to it then we will also exit with a non-zero exit
9497c478bd9Sstevel@tonic-gate * code. In this way abnormal conditions can be passed up to the
9507c478bd9Sstevel@tonic-gate * root process and the entire run be halted. Also catch the int
9517c478bd9Sstevel@tonic-gate * and quit signals. Remove the output file since it is in an
9527c478bd9Sstevel@tonic-gate * inconsistent state.
9537c478bd9Sstevel@tonic-gate * .call ret = init_sig().
9547c478bd9Sstevel@tonic-gate * .arg none.
9557c478bd9Sstevel@tonic-gate * .ret 0 - no errors detected.
9567c478bd9Sstevel@tonic-gate * .ret -1 - signal failed (message printed).
9577c478bd9Sstevel@tonic-gate */
9587c478bd9Sstevel@tonic-gate static int
init_sig(void)9597c478bd9Sstevel@tonic-gate init_sig(void)
9607c478bd9Sstevel@tonic-gate {
9617c478bd9Sstevel@tonic-gate if (signal(SIGCHLD, chld_handler) == SIG_ERR) {
9627c478bd9Sstevel@tonic-gate perror(gettext("auditreduce: SIGCHLD signal failed"));
9637c478bd9Sstevel@tonic-gate return (-1);
9647c478bd9Sstevel@tonic-gate }
9657c478bd9Sstevel@tonic-gate
9667c478bd9Sstevel@tonic-gate if (signal(SIGHUP, int_handler) == SIG_ERR) {
9677c478bd9Sstevel@tonic-gate perror(gettext("auditreduce: SIGHUP signal failed"));
9687c478bd9Sstevel@tonic-gate return (-1);
9697c478bd9Sstevel@tonic-gate }
9707c478bd9Sstevel@tonic-gate if (signal(SIGINT, int_handler) == SIG_ERR) {
9717c478bd9Sstevel@tonic-gate perror(gettext("auditreduce: SIGINT signal failed"));
9727c478bd9Sstevel@tonic-gate return (-1);
9737c478bd9Sstevel@tonic-gate }
9747c478bd9Sstevel@tonic-gate if (signal(SIGQUIT, int_handler) == SIG_ERR) {
9757c478bd9Sstevel@tonic-gate perror(gettext("auditreduce: SIGQUIT signal failed"));
9767c478bd9Sstevel@tonic-gate return (-1);
9777c478bd9Sstevel@tonic-gate }
9787c478bd9Sstevel@tonic-gate if (signal(SIGABRT, int_handler) == SIG_ERR) {
9797c478bd9Sstevel@tonic-gate perror(gettext("auditreduce: SIGABRT signal failed"));
9807c478bd9Sstevel@tonic-gate return (-1);
9817c478bd9Sstevel@tonic-gate }
9827c478bd9Sstevel@tonic-gate if (signal(SIGTERM, int_handler) == SIG_ERR) {
9837c478bd9Sstevel@tonic-gate perror(gettext("auditreduce: SIGTERM signal failed"));
9847c478bd9Sstevel@tonic-gate return (-1);
9857c478bd9Sstevel@tonic-gate }
9867c478bd9Sstevel@tonic-gate if (signal(SIGPWR, int_handler) == SIG_ERR) {
9877c478bd9Sstevel@tonic-gate perror(gettext("auditreduce: SIGPWR signal failed"));
9887c478bd9Sstevel@tonic-gate return (-1);
9897c478bd9Sstevel@tonic-gate }
9907c478bd9Sstevel@tonic-gate if (signal(SIGXCPU, int_handler) == SIG_ERR) {
9917c478bd9Sstevel@tonic-gate perror(gettext("auditreduce: SIGXCPU signal failed"));
9927c478bd9Sstevel@tonic-gate return (-1);
9937c478bd9Sstevel@tonic-gate }
9947c478bd9Sstevel@tonic-gate if (signal(SIGXFSZ, int_handler) == SIG_ERR) {
9957c478bd9Sstevel@tonic-gate perror(gettext("auditreduce: SIGXFSZ signal failed"));
9967c478bd9Sstevel@tonic-gate return (-1);
9977c478bd9Sstevel@tonic-gate }
99877e01d41STony Nguyen if (signal(SIGSEGV, int_handler) == SIG_ERR) {
99977e01d41STony Nguyen perror(gettext("auditreduce: SIGSEGV signal failed"));
100077e01d41STony Nguyen return (-1);
100177e01d41STony Nguyen }
10027c478bd9Sstevel@tonic-gate
10037c478bd9Sstevel@tonic-gate return (0);
10047c478bd9Sstevel@tonic-gate }
10057c478bd9Sstevel@tonic-gate
10067c478bd9Sstevel@tonic-gate
10077c478bd9Sstevel@tonic-gate /*
10087c478bd9Sstevel@tonic-gate * .func chld_handler - handle child signals.
10097c478bd9Sstevel@tonic-gate * .desc Catch the SIGCHLD signals. Remove the root process
10107c478bd9Sstevel@tonic-gate * output file because it is in an inconsistent state.
10117c478bd9Sstevel@tonic-gate * Print a message giving the signal number and/or return code
10127c478bd9Sstevel@tonic-gate * of the child who caused the signal.
10137c478bd9Sstevel@tonic-gate * .ret void.
10147c478bd9Sstevel@tonic-gate */
10157c478bd9Sstevel@tonic-gate /* ARGSUSED */
10167c478bd9Sstevel@tonic-gate void
chld_handler(int sig)10177c478bd9Sstevel@tonic-gate chld_handler(int sig)
10187c478bd9Sstevel@tonic-gate {
10197c478bd9Sstevel@tonic-gate int pid;
10207c478bd9Sstevel@tonic-gate int status;
10217c478bd9Sstevel@tonic-gate
10227c478bd9Sstevel@tonic-gate /*
10237c478bd9Sstevel@tonic-gate * Get pid and reasons for cause of event.
10247c478bd9Sstevel@tonic-gate */
10257c478bd9Sstevel@tonic-gate pid = wait(&status);
10267c478bd9Sstevel@tonic-gate
10277c478bd9Sstevel@tonic-gate if (pid > 0) {
10287c478bd9Sstevel@tonic-gate /*
10297c478bd9Sstevel@tonic-gate * If child received a signal or exited with a non-zero
10307c478bd9Sstevel@tonic-gate * exit status then print message and exit
10317c478bd9Sstevel@tonic-gate */
10327c478bd9Sstevel@tonic-gate if ((WHIBYTE(status) == 0 && WLOBYTE(status) != 0) ||
10337c478bd9Sstevel@tonic-gate (WHIBYTE(status) != 0 && WLOBYTE(status) == 0)) {
10347c478bd9Sstevel@tonic-gate (void) fprintf(stderr,
10357c478bd9Sstevel@tonic-gate gettext("%s abnormal child termination - "), ar);
10367c478bd9Sstevel@tonic-gate
10377c478bd9Sstevel@tonic-gate if (WHIBYTE(status) == 0 && WLOBYTE(status) != 0) {
10387c478bd9Sstevel@tonic-gate psignal(WLOBYTE(status), "signal");
10397c478bd9Sstevel@tonic-gate if (WCOREDUMP(status))
10407c478bd9Sstevel@tonic-gate (void) fprintf(stderr,
10417c478bd9Sstevel@tonic-gate gettext("core dumped\n"));
10427c478bd9Sstevel@tonic-gate }
10437c478bd9Sstevel@tonic-gate
10447c478bd9Sstevel@tonic-gate if (WHIBYTE(status) != 0 && WLOBYTE(status) == 0)
10457c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext(
10467c478bd9Sstevel@tonic-gate "return code %d\n"),
10477c478bd9Sstevel@tonic-gate WHIBYTE(status));
10487c478bd9Sstevel@tonic-gate
10497c478bd9Sstevel@tonic-gate /*
10507c478bd9Sstevel@tonic-gate * Get rid of outfile - it is suspect.
10517c478bd9Sstevel@tonic-gate */
10527c478bd9Sstevel@tonic-gate if (f_outfile != NULL) {
10537c478bd9Sstevel@tonic-gate (void) close_outfile();
10547c478bd9Sstevel@tonic-gate rm_outfile();
10557c478bd9Sstevel@tonic-gate }
10567c478bd9Sstevel@tonic-gate /*
10577c478bd9Sstevel@tonic-gate * Give statistical info that may be useful.
10587c478bd9Sstevel@tonic-gate */
10597c478bd9Sstevel@tonic-gate audit_stats();
10607c478bd9Sstevel@tonic-gate
10617c478bd9Sstevel@tonic-gate exit(1);
10627c478bd9Sstevel@tonic-gate }
10637c478bd9Sstevel@tonic-gate }
10647c478bd9Sstevel@tonic-gate }
10657c478bd9Sstevel@tonic-gate
10667c478bd9Sstevel@tonic-gate
10677c478bd9Sstevel@tonic-gate /*
10687c478bd9Sstevel@tonic-gate * .func int_handler - handle quit/int signals.
10697c478bd9Sstevel@tonic-gate * .desc Catch the keyboard and other environmental signals.
10707c478bd9Sstevel@tonic-gate * Remove the root process output file because it is in
10717c478bd9Sstevel@tonic-gate * an inconsistent state.
10727c478bd9Sstevel@tonic-gate * .ret void.
10737c478bd9Sstevel@tonic-gate */
10747c478bd9Sstevel@tonic-gate /* ARGSUSED */
10757c478bd9Sstevel@tonic-gate void
int_handler(int sig)10767c478bd9Sstevel@tonic-gate int_handler(int sig)
10777c478bd9Sstevel@tonic-gate {
10787c478bd9Sstevel@tonic-gate if (getpid() == root_pid) {
10797c478bd9Sstevel@tonic-gate (void) close_outfile();
10807c478bd9Sstevel@tonic-gate rm_outfile();
10817c478bd9Sstevel@tonic-gate exit(1);
10827c478bd9Sstevel@tonic-gate }
10837c478bd9Sstevel@tonic-gate /*
10847c478bd9Sstevel@tonic-gate * For a child process don't give an error exit or the
10857c478bd9Sstevel@tonic-gate * parent process will catch it with the chld_handler and
10867c478bd9Sstevel@tonic-gate * try to erase the outfile again.
10877c478bd9Sstevel@tonic-gate */
10887c478bd9Sstevel@tonic-gate exit(0);
10897c478bd9Sstevel@tonic-gate }
1090