17c478bd9Sstevel@tonic-gate /*
27c478bd9Sstevel@tonic-gate  * CDDL HEADER START
37c478bd9Sstevel@tonic-gate  *
47c478bd9Sstevel@tonic-gate  * The contents of this file are subject to the terms of the
5d75d0dc9Stz  * Common Development and Distribution License (the "License").
6d75d0dc9Stz  * You may not use this file except in compliance with the License.
77c478bd9Sstevel@tonic-gate  *
87c478bd9Sstevel@tonic-gate  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
97c478bd9Sstevel@tonic-gate  * or http://www.opensolaris.org/os/licensing.
107c478bd9Sstevel@tonic-gate  * See the License for the specific language governing permissions
117c478bd9Sstevel@tonic-gate  * and limitations under the License.
127c478bd9Sstevel@tonic-gate  *
137c478bd9Sstevel@tonic-gate  * When distributing Covered Code, include this CDDL HEADER in each
147c478bd9Sstevel@tonic-gate  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
157c478bd9Sstevel@tonic-gate  * If applicable, add the following below this CDDL HEADER, with the
167c478bd9Sstevel@tonic-gate  * fields enclosed by brackets "[]" replaced with your own identifying
177c478bd9Sstevel@tonic-gate  * information: Portions Copyright [yyyy] [name of copyright owner]
187c478bd9Sstevel@tonic-gate  *
197c478bd9Sstevel@tonic-gate  * CDDL HEADER END
207c478bd9Sstevel@tonic-gate  */
217c478bd9Sstevel@tonic-gate 
227c478bd9Sstevel@tonic-gate /*
235707ed5dSMarek Pospisil  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
24d75d0dc9Stz  * Use is subject to license terms.
25*b9c9c359SMatthias Scheler  *
26*b9c9c359SMatthias Scheler  * Copyright 2019 by Western Digital Corporation
277c478bd9Sstevel@tonic-gate  */
287c478bd9Sstevel@tonic-gate 
297c478bd9Sstevel@tonic-gate /*
307c478bd9Sstevel@tonic-gate  * au_preselect.c
317c478bd9Sstevel@tonic-gate  */
327c478bd9Sstevel@tonic-gate 
337c478bd9Sstevel@tonic-gate #include <sys/types.h>
34*b9c9c359SMatthias Scheler #include <errno.h>
357c478bd9Sstevel@tonic-gate #include <stdio.h>
367c478bd9Sstevel@tonic-gate #include <stdlib.h>
377c478bd9Sstevel@tonic-gate #include <bsm/audit.h>
387c478bd9Sstevel@tonic-gate #include <bsm/libbsm.h>
397c478bd9Sstevel@tonic-gate #include <synch.h>
407c478bd9Sstevel@tonic-gate 
417c478bd9Sstevel@tonic-gate #define	ALLOC_INIT (600)	/* initially allocate ALLOC_INIT map entries */
427c478bd9Sstevel@tonic-gate #define	ALLOC_INCR (100)	/* if more map entries are needed, realloc */
437c478bd9Sstevel@tonic-gate 				/* in ALLOC_INCR increments */
447c478bd9Sstevel@tonic-gate 
457c478bd9Sstevel@tonic-gate static int alloc_map();
467c478bd9Sstevel@tonic-gate static int load_map();
477c478bd9Sstevel@tonic-gate static int realloc_map();
487c478bd9Sstevel@tonic-gate 
497c478bd9Sstevel@tonic-gate typedef struct event_map {
507c478bd9Sstevel@tonic-gate 	au_event_t event;	/* audit event number */
517c478bd9Sstevel@tonic-gate 	au_class_t class;	/* audit event class mask */
527c478bd9Sstevel@tonic-gate } event_map_t;
537c478bd9Sstevel@tonic-gate 
547c478bd9Sstevel@tonic-gate static event_map_t *event_map;	/* the map */
55d75d0dc9Stz static uint_t alloc_count;	/* number of entries currently allocated */
56d75d0dc9Stz static uint_t event_count;	/* number of entries in map */
577c478bd9Sstevel@tonic-gate static mutex_t mutex_au_preselect = DEFAULTMUTEX;
587c478bd9Sstevel@tonic-gate 
597c478bd9Sstevel@tonic-gate /*
607c478bd9Sstevel@tonic-gate  * au_preselect:
617c478bd9Sstevel@tonic-gate  *
627c478bd9Sstevel@tonic-gate  * Keep a dynamic array of event<-->class mappings.
635707ed5dSMarek Pospisil  * Refresh the map when the value of flag is AU_PRS_REREAD.
647c478bd9Sstevel@tonic-gate  * Return:
657c478bd9Sstevel@tonic-gate  *	1: The event is preselected.
667c478bd9Sstevel@tonic-gate  *	0: The event is not preselected.
677c478bd9Sstevel@tonic-gate  *	-1: There was an error:
687c478bd9Sstevel@tonic-gate  *		Couldn't allocate memory.
697c478bd9Sstevel@tonic-gate  *		Couldn't find event.
707c478bd9Sstevel@tonic-gate  */
717c478bd9Sstevel@tonic-gate int
au_preselect(au_event_t au_event,au_mask_t * au_mask_p,int sorf,int flag)727c478bd9Sstevel@tonic-gate au_preselect(au_event_t au_event, au_mask_t *au_mask_p, int sorf, int flag)
737c478bd9Sstevel@tonic-gate {
747c478bd9Sstevel@tonic-gate 	static char been_here_before;  /* we cache the map */
757c478bd9Sstevel@tonic-gate 	register int i;
767c478bd9Sstevel@tonic-gate 	register au_class_t comp_class;
777c478bd9Sstevel@tonic-gate 
787257d1b4Sraf 	(void) mutex_lock(&mutex_au_preselect);
797c478bd9Sstevel@tonic-gate 	if (!been_here_before) {
807c478bd9Sstevel@tonic-gate 		if (alloc_map() == -1) {
817257d1b4Sraf 			(void) mutex_unlock(&mutex_au_preselect);
827c478bd9Sstevel@tonic-gate 			return (-1);
837c478bd9Sstevel@tonic-gate 		}
847c478bd9Sstevel@tonic-gate 
857c478bd9Sstevel@tonic-gate 		if (load_map() == -1) {
867257d1b4Sraf 			(void) mutex_unlock(&mutex_au_preselect);
877c478bd9Sstevel@tonic-gate 			return (-1);
887c478bd9Sstevel@tonic-gate 		}
897c478bd9Sstevel@tonic-gate 
907c478bd9Sstevel@tonic-gate 		been_here_before = 1;
917c478bd9Sstevel@tonic-gate 	}
927c478bd9Sstevel@tonic-gate 
937c478bd9Sstevel@tonic-gate 	/*
947c478bd9Sstevel@tonic-gate 	 * Don't use the cache. Re-read the audit_event(5) db every time
957c478bd9Sstevel@tonic-gate 	 */
967c478bd9Sstevel@tonic-gate 	if (flag == AU_PRS_REREAD) {
977c478bd9Sstevel@tonic-gate 		if (load_map() == -1) {
987257d1b4Sraf 			(void) mutex_unlock(&mutex_au_preselect);
997c478bd9Sstevel@tonic-gate 			return (-1);
1007c478bd9Sstevel@tonic-gate 		}
1017c478bd9Sstevel@tonic-gate 	}
1027c478bd9Sstevel@tonic-gate 
1037c478bd9Sstevel@tonic-gate 	/* Determine what portion of the preselection mask to check. */
1047c478bd9Sstevel@tonic-gate 	if (sorf == AU_PRS_SUCCESS)
1057c478bd9Sstevel@tonic-gate 		comp_class = au_mask_p->am_success;
1067c478bd9Sstevel@tonic-gate 	else if (sorf == AU_PRS_FAILURE)
1077c478bd9Sstevel@tonic-gate 		comp_class = au_mask_p->am_failure;
1087c478bd9Sstevel@tonic-gate 	else
1097c478bd9Sstevel@tonic-gate 		comp_class = au_mask_p->am_success | au_mask_p->am_failure;
1107c478bd9Sstevel@tonic-gate 
1117c478bd9Sstevel@tonic-gate 	for (i = 0; i < event_count; i++) {
1127c478bd9Sstevel@tonic-gate 		if (event_map[i].event == au_event) {
1137c478bd9Sstevel@tonic-gate 			if (event_map[i].class & comp_class) {
1147257d1b4Sraf 				(void) mutex_unlock(&mutex_au_preselect);
1157c478bd9Sstevel@tonic-gate 				return (1);
1167c478bd9Sstevel@tonic-gate 			} else {
1177257d1b4Sraf 				(void) mutex_unlock(&mutex_au_preselect);
1187c478bd9Sstevel@tonic-gate 				return (0);
1197c478bd9Sstevel@tonic-gate 			}
1207c478bd9Sstevel@tonic-gate 		}
1217c478bd9Sstevel@tonic-gate 	}
1227c478bd9Sstevel@tonic-gate 
1237257d1b4Sraf 	(void) mutex_unlock(&mutex_au_preselect);
1247c478bd9Sstevel@tonic-gate 	return (-1);	/* could not find event in the table */
1257c478bd9Sstevel@tonic-gate }
1267c478bd9Sstevel@tonic-gate 
1277c478bd9Sstevel@tonic-gate /*
1287c478bd9Sstevel@tonic-gate  * Initially allocate about as many map entries as are there
1297c478bd9Sstevel@tonic-gate  * are audit events shipped with the system. For sites
1307c478bd9Sstevel@tonic-gate  * that don't add audit events, this should be enough.
1317c478bd9Sstevel@tonic-gate  */
1327c478bd9Sstevel@tonic-gate static int
alloc_map()1337c478bd9Sstevel@tonic-gate alloc_map()
1347c478bd9Sstevel@tonic-gate {
1357c478bd9Sstevel@tonic-gate 	if ((event_map = (event_map_t *)
136d75d0dc9Stz 	    calloc(ALLOC_INIT, (size_t)sizeof (event_map_t))) ==
137d75d0dc9Stz 	    (event_map_t *)NULL)
1387c478bd9Sstevel@tonic-gate 		return (-1);
1397c478bd9Sstevel@tonic-gate 	else
1407c478bd9Sstevel@tonic-gate 		alloc_count = ALLOC_INIT;
1417c478bd9Sstevel@tonic-gate 
1427c478bd9Sstevel@tonic-gate 	return (0);
1437c478bd9Sstevel@tonic-gate }
1447c478bd9Sstevel@tonic-gate 
1457c478bd9Sstevel@tonic-gate /*
1467c478bd9Sstevel@tonic-gate  * load the event<->class map into memory
1477c478bd9Sstevel@tonic-gate  */
1487c478bd9Sstevel@tonic-gate static int
load_map()1497c478bd9Sstevel@tonic-gate load_map()
1507c478bd9Sstevel@tonic-gate {
1517c478bd9Sstevel@tonic-gate 	register au_event_ent_t *evp;
1527c478bd9Sstevel@tonic-gate 
1537c478bd9Sstevel@tonic-gate 	event_count = 0;
1547c478bd9Sstevel@tonic-gate 	setauevent();
1557c478bd9Sstevel@tonic-gate 	while ((evp = getauevent()) != (au_event_ent_t *)NULL) {
156*b9c9c359SMatthias Scheler 		if (event_count == alloc_count && realloc_map() == -1) {
157*b9c9c359SMatthias Scheler 			endauevent();
158*b9c9c359SMatthias Scheler 			return (-1);
159*b9c9c359SMatthias Scheler 		}
1607c478bd9Sstevel@tonic-gate 		event_map[event_count].event = evp->ae_number;
1617c478bd9Sstevel@tonic-gate 		event_map[event_count].class = evp->ae_class;
1627c478bd9Sstevel@tonic-gate 		++event_count;
1637c478bd9Sstevel@tonic-gate 	}
1647c478bd9Sstevel@tonic-gate 	endauevent();
1657c478bd9Sstevel@tonic-gate 
1667c478bd9Sstevel@tonic-gate 	return (0);
1677c478bd9Sstevel@tonic-gate }
1687c478bd9Sstevel@tonic-gate 
1697c478bd9Sstevel@tonic-gate /*
1707c478bd9Sstevel@tonic-gate  * realloc the event map in ALLOC_INCR increments
1717c478bd9Sstevel@tonic-gate  */
1727c478bd9Sstevel@tonic-gate static int
realloc_map()1737c478bd9Sstevel@tonic-gate realloc_map()
1747c478bd9Sstevel@tonic-gate {
175*b9c9c359SMatthias Scheler 	uint_t new_alloc_count;
176*b9c9c359SMatthias Scheler 	event_map_t *new_event_map;
1777c478bd9Sstevel@tonic-gate 
178*b9c9c359SMatthias Scheler 	new_alloc_count = alloc_count + ALLOC_INCR;
179*b9c9c359SMatthias Scheler 	if (new_alloc_count <= alloc_count) {
180*b9c9c359SMatthias Scheler 		errno = ENOMEM;
1817c478bd9Sstevel@tonic-gate 		return (-1);
182*b9c9c359SMatthias Scheler 	}
183*b9c9c359SMatthias Scheler 
184*b9c9c359SMatthias Scheler 	if ((new_event_map = recallocarray(event_map, alloc_count,
185*b9c9c359SMatthias Scheler 	    new_alloc_count, sizeof (event_map_t))) == NULL)
186*b9c9c359SMatthias Scheler 		return (-1);
187*b9c9c359SMatthias Scheler 
188*b9c9c359SMatthias Scheler 	alloc_count = new_alloc_count;
189*b9c9c359SMatthias Scheler 	event_map = new_event_map;
1907c478bd9Sstevel@tonic-gate 
1917c478bd9Sstevel@tonic-gate 	return (0);
1927c478bd9Sstevel@tonic-gate }
193