17c478bdstevel@tonic-gate/*
27c478bdstevel@tonic-gate * CDDL HEADER START
37c478bdstevel@tonic-gate *
47c478bdstevel@tonic-gate * The contents of this file are subject to the terms of the
545916cdjpk * Common Development and Distribution License (the "License").
645916cdjpk * You may not use this file except in compliance with the License.
77c478bdstevel@tonic-gate *
87c478bdstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
97c478bdstevel@tonic-gate * or http://www.opensolaris.org/os/licensing.
107c478bdstevel@tonic-gate * See the License for the specific language governing permissions
117c478bdstevel@tonic-gate * and limitations under the License.
127c478bdstevel@tonic-gate *
137c478bdstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each
147c478bdstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
157c478bdstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the
167c478bdstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying
177c478bdstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner]
187c478bdstevel@tonic-gate *
197c478bdstevel@tonic-gate * CDDL HEADER END
207c478bdstevel@tonic-gate */
217c478bdstevel@tonic-gate/*
22f899407Jan Friedel * Copyright (c) 1992, 2010, Oracle and/or its affiliates. All rights reserved.
237c478bdstevel@tonic-gate */
247c478bdstevel@tonic-gate
257c478bdstevel@tonic-gate#include <sys/types.h>
267c478bdstevel@tonic-gate#include <stdio.h>
277c478bdstevel@tonic-gate#include <unistd.h>
287c478bdstevel@tonic-gate#include <sys/fcntl.h>
297c478bdstevel@tonic-gate#include <bsm/audit.h>
307c478bdstevel@tonic-gate#include <bsm/audit_record.h>
317c478bdstevel@tonic-gate#include <bsm/audit_uevents.h>
327c478bdstevel@tonic-gate#include <bsm/libbsm.h>
337c478bdstevel@tonic-gate#include <bsm/audit_private.h>
347c478bdstevel@tonic-gate#include <stdlib.h>
357c478bdstevel@tonic-gate#include <string.h>
367c478bdstevel@tonic-gate#include <syslog.h>
377c478bdstevel@tonic-gate#include <pwd.h>
387c478bdstevel@tonic-gate#include <netinet/in.h>
3945916cdjpk#include <tsol/label.h>
407c478bdstevel@tonic-gate#include <locale.h>
417c478bdstevel@tonic-gate#include "generic.h"
427c478bdstevel@tonic-gate
437c478bdstevel@tonic-gate#ifdef C2_DEBUG
44dfc7be0Jan Friedel#define	dprintf(x) { (void) printf x; }
457c478bdstevel@tonic-gate#else
467c478bdstevel@tonic-gate#define	dprintf(x)
477c478bdstevel@tonic-gate#endif
487c478bdstevel@tonic-gate
497c478bdstevel@tonic-gatestatic au_event_t	event;
507c478bdstevel@tonic-gatestatic int		audit_rexecd_status = 0;
517c478bdstevel@tonic-gate
527c478bdstevel@tonic-gatestatic int
537c478bdstevel@tonic-gateselected(uid, user, event, sf)
547c478bdstevel@tonic-gateuid_t uid;
557c478bdstevel@tonic-gatechar	*user;
567c478bdstevel@tonic-gateau_event_t	event;
577c478bdstevel@tonic-gateint	sf;
587c478bdstevel@tonic-gate{
59f899407Jan Friedel	int		sorf;
60f899407Jan Friedel	struct au_mask	mask;
617c478bdstevel@tonic-gate
627c478bdstevel@tonic-gate	mask.am_success = mask.am_failure = 0;
63f48205bcasper	if (uid > MAXEPHUID) {
64f899407Jan Friedel		/* get non-attrib flags */
65f899407Jan Friedel		(void) auditon(A_GETKMASK, (caddr_t)&mask, sizeof (mask));
667c478bdstevel@tonic-gate	} else {
67f899407Jan Friedel		(void) au_user_mask(user, &mask);
687c478bdstevel@tonic-gate	}
697c478bdstevel@tonic-gate
70f899407Jan Friedel	if (sf == 0) {
717c478bdstevel@tonic-gate		sorf = AU_PRS_SUCCESS;
72f899407Jan Friedel	} else if (sf == -1) {
737c478bdstevel@tonic-gate		sorf = AU_PRS_FAILURE;
74f899407Jan Friedel	} else {
757c478bdstevel@tonic-gate		sorf = AU_PRS_BOTH;
76f899407Jan Friedel	}
77f899407Jan Friedel
78f899407Jan Friedel	return (au_preselect(event, &mask, sorf, AU_PRS_REREAD));
797c478bdstevel@tonic-gate}
807c478bdstevel@tonic-gate
817c478bdstevel@tonic-gatevoid
827c478bdstevel@tonic-gateaudit_rexecd_setup()
837c478bdstevel@tonic-gate{
847c478bdstevel@tonic-gate	dprintf(("audit_rexecd_setup()\n"));
857c478bdstevel@tonic-gate
867c478bdstevel@tonic-gate	event = AUE_rexecd;
877c478bdstevel@tonic-gate}
887c478bdstevel@tonic-gate
897c478bdstevel@tonic-gate
907c478bdstevel@tonic-gatestatic void
917c478bdstevel@tonic-gateaudit_rexecd_session_setup(char *name, char *mach, uid_t uid)
927c478bdstevel@tonic-gate{
937c478bdstevel@tonic-gate	int			rc;
947c478bdstevel@tonic-gate	au_mask_t		mask;
957c478bdstevel@tonic-gate	struct auditinfo_addr	info;
967c478bdstevel@tonic-gate	uint32_t addr[4], type;
977c478bdstevel@tonic-gate
987c478bdstevel@tonic-gate	info.ai_auid = uid;
997c478bdstevel@tonic-gate	info.ai_asid = getpid();
1007c478bdstevel@tonic-gate
1017c478bdstevel@tonic-gate	mask.am_success = 0;
1027c478bdstevel@tonic-gate	mask.am_failure = 0;
1037c478bdstevel@tonic-gate
1047c478bdstevel@tonic-gate	(void) au_user_mask(name, &mask);
1057c478bdstevel@tonic-gate
1067c478bdstevel@tonic-gate	info.ai_mask.am_success  = mask.am_success;
1077c478bdstevel@tonic-gate	info.ai_mask.am_failure  = mask.am_failure;
1087c478bdstevel@tonic-gate
1097c478bdstevel@tonic-gate	rc = aug_get_machine(mach, addr, &type);
1107c478bdstevel@tonic-gate	if (rc < 0) {
1117c478bdstevel@tonic-gate		perror("get address");
1127c478bdstevel@tonic-gate	}
1137c478bdstevel@tonic-gate	info.ai_termid.at_port = aug_get_port();
1147c478bdstevel@tonic-gate	info.ai_termid.at_type    = type;
1157c478bdstevel@tonic-gate	info.ai_termid.at_addr[0] = addr[0];
1167c478bdstevel@tonic-gate	info.ai_termid.at_addr[1] = addr[1];
1177c478bdstevel@tonic-gate	info.ai_termid.at_addr[2] = addr[2];
1187c478bdstevel@tonic-gate	info.ai_termid.at_addr[3] = addr[3];
1197c478bdstevel@tonic-gate
1207c478bdstevel@tonic-gate	rc = setaudit_addr(&info, sizeof (info));
1217c478bdstevel@tonic-gate	if (rc < 0) {
1227c478bdstevel@tonic-gate		perror("setaudit");
1237c478bdstevel@tonic-gate	}
1247c478bdstevel@tonic-gate}
1257c478bdstevel@tonic-gate
1267c478bdstevel@tonic-gatevoid
1277c478bdstevel@tonic-gateaudit_rexecd_fail(msg, hostname, user, cmdbuf)
1287c478bdstevel@tonic-gatechar	*msg;		/* message containing failure information */
1297c478bdstevel@tonic-gatechar	*hostname;	/* hostname of machine requesting service */
1307c478bdstevel@tonic-gatechar	*user;		/* username of user requesting service */
1317c478bdstevel@tonic-gatechar	*cmdbuf;	/* command line to be executed locally */
1327c478bdstevel@tonic-gate{
1337c478bdstevel@tonic-gate	int	rd;		/* audit record descriptor */
1347c478bdstevel@tonic-gate	char	buf[256];	/* temporary buffer */
1357c478bdstevel@tonic-gate	char	*tbuf;		/* temporary buffer */
1367c478bdstevel@tonic-gate	int	tlen;
1377c478bdstevel@tonic-gate	const char *gtxt;
1387c478bdstevel@tonic-gate	uid_t 	uid;
1397c478bdstevel@tonic-gate	gid_t	gid;
1407c478bdstevel@tonic-gate	pid_t	pid;
1417c478bdstevel@tonic-gate	au_tid_addr_t	tid;
1427c478bdstevel@tonic-gate	struct passwd	*pwd;
1437c478bdstevel@tonic-gate	uint32_t addr[4], type;
1447c478bdstevel@tonic-gate	int rc;
1457c478bdstevel@tonic-gate
1467c478bdstevel@tonic-gate	dprintf(("audit_rexecd_fail()\n"));
1477c478bdstevel@tonic-gate
1487c478bdstevel@tonic-gate	/*
1497c478bdstevel@tonic-gate	 * check if audit_rexecd_fail() or audit_rexecd_success()
1507c478bdstevel@tonic-gate	 * have been called already.
1517c478bdstevel@tonic-gate	 */
1527c478bdstevel@tonic-gate	if (audit_rexecd_status == 1) {
1537c478bdstevel@tonic-gate		return;
1547c478bdstevel@tonic-gate	}
1557c478bdstevel@tonic-gate
1567c478bdstevel@tonic-gate	if (cannot_audit(0)) {
1577c478bdstevel@tonic-gate		return;
1587c478bdstevel@tonic-gate	}
1597c478bdstevel@tonic-gate
1607c478bdstevel@tonic-gate	/*
1617c478bdstevel@tonic-gate	 * set status to prevent multiple calls
1627c478bdstevel@tonic-gate	 * to audit_rexecd_fail() and audit_rexecd_success()
1637c478bdstevel@tonic-gate	 */
1647c478bdstevel@tonic-gate	audit_rexecd_status = 1;
1657c478bdstevel@tonic-gate
1667c478bdstevel@tonic-gate	pwd = getpwnam(user);
1677c478bdstevel@tonic-gate	if (pwd == NULL) {
168f48205bcasper		uid = (uid_t)-1;
169f48205bcasper		gid = (gid_t)-1;
1707c478bdstevel@tonic-gate	} else {
1717c478bdstevel@tonic-gate		uid = pwd->pw_uid;
1727c478bdstevel@tonic-gate		gid = pwd->pw_gid;
1737c478bdstevel@tonic-gate	}
1747c478bdstevel@tonic-gate
1757c478bdstevel@tonic-gate	/* determine if we're preselected */
1767c478bdstevel@tonic-gate	if (!selected(uid, user, event, -1))
1777c478bdstevel@tonic-gate		return;
1787c478bdstevel@tonic-gate
1797c478bdstevel@tonic-gate	pid = getpid();
1807c478bdstevel@tonic-gate	rc = aug_get_machine(hostname, addr, &type);
1817c478bdstevel@tonic-gate	if (rc < 0) {
1827c478bdstevel@tonic-gate		perror("get address");
1837c478bdstevel@tonic-gate	}
1847c478bdstevel@tonic-gate
1857c478bdstevel@tonic-gate	tid.at_port    = aug_get_port();
1867c478bdstevel@tonic-gate	tid.at_addr[0] = addr[0];
1877c478bdstevel@tonic-gate	tid.at_addr[1] = addr[1];
1887c478bdstevel@tonic-gate	tid.at_addr[2] = addr[2];
1897c478bdstevel@tonic-gate	tid.at_addr[3] = addr[3];
1907c478bdstevel@tonic-gate	tid.at_type    = type;
1917c478bdstevel@tonic-gate
1927c478bdstevel@tonic-gate	rd = au_open();
1937c478bdstevel@tonic-gate
1947c478bdstevel@tonic-gate	/* add subject token */
1957c478bdstevel@tonic-gate	(void) au_write(rd,
1967c478bdstevel@tonic-gate		au_to_subject_ex(uid, uid, gid, uid, gid, pid, pid, &tid));
19745916cdjpk	if (is_system_labeled())
19845916cdjpk		(void) au_write(rd, au_to_mylabel());
1997c478bdstevel@tonic-gate
2007c478bdstevel@tonic-gate	/* add reason for failure */
2017c478bdstevel@tonic-gate	(void) au_write(rd, au_to_text(msg));
2027c478bdstevel@tonic-gate
2037c478bdstevel@tonic-gate	/* add hostname of machine requesting service */
2047c478bdstevel@tonic-gate	(void) snprintf(buf, sizeof (buf), dgettext(bsm_dom,
2057c478bdstevel@tonic-gate		"Remote execution requested by: %s"), hostname);
2067c478bdstevel@tonic-gate	(void) au_write(rd, au_to_text(buf));
2077c478bdstevel@tonic-gate
2087c478bdstevel@tonic-gate	/* add username of user requesting service */
2097c478bdstevel@tonic-gate	(void) snprintf(buf, sizeof (buf), dgettext(bsm_dom,
2107c478bdstevel@tonic-gate		"Username: %s"), user);
2117c478bdstevel@tonic-gate	(void) au_write(rd, au_to_text(buf));
2127c478bdstevel@tonic-gate
2137c478bdstevel@tonic-gate	/* add command line to be executed locally */
2147c478bdstevel@tonic-gate	gtxt = dgettext(bsm_dom, "Command line: %s");
2157c478bdstevel@tonic-gate	tlen = strlen(gtxt) + strlen(cmdbuf) + 1;
2167c478bdstevel@tonic-gate	if ((tbuf = malloc(tlen)) == NULL) {
2177c478bdstevel@tonic-gate		(void) au_close(rd, 0, 0);
2187c478bdstevel@tonic-gate		return;
2197c478bdstevel@tonic-gate	}
2207c478bdstevel@tonic-gate	(void) snprintf(tbuf, tlen, gtxt, cmdbuf);
2217c478bdstevel@tonic-gate	(void) au_write(rd, au_to_text(tbuf));
2227c478bdstevel@tonic-gate	(void) free(tbuf);
2237c478bdstevel@tonic-gate
2247c478bdstevel@tonic-gate	/* add return token */
2257c478bdstevel@tonic-gate#ifdef _LP64
2267c478bdstevel@tonic-gate	(void) au_write(rd, au_to_return64(-1, (int64_t)0));
2277c478bdstevel@tonic-gate#else
2287c478bdstevel@tonic-gate	(void) au_write(rd, au_to_return32(-1, (int32_t)0));
2297c478bdstevel@tonic-gate#endif
2307c478bdstevel@tonic-gate
2317c478bdstevel@tonic-gate	/* write audit record */
2327c478bdstevel@tonic-gate	if (au_close(rd, 1, event) < 0) {
2337c478bdstevel@tonic-gate		(void) au_close(rd, 0, 0);
2347c478bdstevel@tonic-gate		return;
2357c478bdstevel@tonic-gate	}
2367c478bdstevel@tonic-gate}
2377c478bdstevel@tonic-gate
2387c478bdstevel@tonic-gatevoid
2397c478bdstevel@tonic-gateaudit_rexecd_success(hostname, user, cmdbuf)
2407c478bdstevel@tonic-gatechar	*hostname;	/* hostname of machine requesting service */
2417c478bdstevel@tonic-gatechar	*user;		/* username of user requesting service */
2427c478bdstevel@tonic-gatechar	*cmdbuf;	/* command line to be executed locally */
2437c478bdstevel@tonic-gate{
2447c478bdstevel@tonic-gate	int	rd;		/* audit record descriptor */
2457c478bdstevel@tonic-gate	char	buf[256];	/* temporary buffer */
2467c478bdstevel@tonic-gate	char	*tbuf;		/* temporary buffer */
2477c478bdstevel@tonic-gate	int	tlen;
2487c478bdstevel@tonic-gate	const char *gtxt;
2497c478bdstevel@tonic-gate	uid_t 	uid;
2507c478bdstevel@tonic-gate	gid_t	gid;
2517c478bdstevel@tonic-gate	pid_t	pid;
2527c478bdstevel@tonic-gate	au_tid_addr_t	tid;
2537c478bdstevel@tonic-gate	struct passwd	*pwd;
2547c478bdstevel@tonic-gate	uint32_t addr[4], type;
2557c478bdstevel@tonic-gate	int rc;
2567c478bdstevel@tonic-gate
2577c478bdstevel@tonic-gate	dprintf(("audit_rexecd_success()\n"));
2587c478bdstevel@tonic-gate
2597c478bdstevel@tonic-gate	/*
2607c478bdstevel@tonic-gate	 * check if audit_rexecd_fail() or audit_rexecd_success()
2617c478bdstevel@tonic-gate	 * have been called already.
2627c478bdstevel@tonic-gate	 */
2637c478bdstevel@tonic-gate	if (audit_rexecd_status == 1) {
2647c478bdstevel@tonic-gate		return;
2657c478bdstevel@tonic-gate	}
2667c478bdstevel@tonic-gate
2677c478bdstevel@tonic-gate	if (cannot_audit(0)) {
2687c478bdstevel@tonic-gate		return;
2697c478bdstevel@tonic-gate	}
2707c478bdstevel@tonic-gate
2717c478bdstevel@tonic-gate	/*
2727c478bdstevel@tonic-gate	 * set status to prevent multiple calls
2737c478bdstevel@tonic-gate	 * to audit_rexecd_fail() and audit_rexecd_success()
2747c478bdstevel@tonic-gate	 */
2757c478bdstevel@tonic-gate	audit_rexecd_status = 1;
2767c478bdstevel@tonic-gate
2777c478bdstevel@tonic-gate	pwd = getpwnam(user);
2787c478bdstevel@tonic-gate	if (pwd == NULL) {
279f48205bcasper		uid = (uid_t)-1;
280f48205bcasper		gid = (gid_t)-1;
2817c478bdstevel@tonic-gate	} else {
2827c478bdstevel@tonic-gate		uid = pwd->pw_uid;
2837c478bdstevel@tonic-gate		gid = pwd->pw_gid;
2847c478bdstevel@tonic-gate	}
2857c478bdstevel@tonic-gate
2867c478bdstevel@tonic-gate	/* determine if we're preselected */
2877c478bdstevel@tonic-gate	if (!selected(uid, user, event, 0))
2887c478bdstevel@tonic-gate		goto rexecd_audit_session;
2897c478bdstevel@tonic-gate
2907c478bdstevel@tonic-gate	pid = getpid();
2917c478bdstevel@tonic-gate	rc = aug_get_machine(hostname, addr, &type);
2927c478bdstevel@tonic-gate	if (rc < 0) {
2937c478bdstevel@tonic-gate		perror("get address");
2947c478bdstevel@tonic-gate	}
2957c478bdstevel@tonic-gate
2967c478bdstevel@tonic-gate	tid.at_port    = aug_get_port();
2977c478bdstevel@tonic-gate	tid.at_addr[0] = addr[0];
2987c478bdstevel@tonic-gate	tid.at_addr[1] = addr[1];
2997c478bdstevel@tonic-gate	tid.at_addr[2] = addr[2];
3007c478bdstevel@tonic-gate	tid.at_addr[3] = addr[3];
3017c478bdstevel@tonic-gate	tid.at_type    = type;
3027c478bdstevel@tonic-gate
3037c478bdstevel@tonic-gate	rd = au_open();
3047c478bdstevel@tonic-gate
3057c478bdstevel@tonic-gate	/* add subject token */
3067c478bdstevel@tonic-gate	(void) au_write(rd,
3077c478bdstevel@tonic-gate		au_to_subject_ex(uid, uid, gid, uid, gid, pid, pid, &tid));
30845916cdjpk	if (is_system_labeled())
30945916cdjpk		(void) au_write(rd, au_to_mylabel());
3107c478bdstevel@tonic-gate
3117c478bdstevel@tonic-gate	/* add hostname of machine requesting service */
3127c478bdstevel@tonic-gate	(void) snprintf(buf, sizeof (buf), dgettext(bsm_dom,
3137c478bdstevel@tonic-gate		"Remote execution requested by: %s"), hostname);
3147c478bdstevel@tonic-gate	(void) au_write(rd, au_to_text(buf));
3157c478bdstevel@tonic-gate
3167c478bdstevel@tonic-gate	/* add username at machine requesting service */
3177c478bdstevel@tonic-gate	(void) snprintf(buf, sizeof (buf), dgettext(bsm_dom,
3187c478bdstevel@tonic-gate	    "Username: %s"), user);
3197c478bdstevel@tonic-gate	(void) au_write(rd, au_to_text(buf));
3207c478bdstevel@tonic-gate
3217c478bdstevel@tonic-gate	/* add command line to be executed locally */
3227c478bdstevel@tonic-gate	gtxt = dgettext(bsm_dom, "Command line: %s");
3237c478bdstevel@tonic-gate	tlen = strlen(gtxt) + strlen(cmdbuf) + 1;
3247c478bdstevel@tonic-gate	if ((tbuf = malloc(tlen)) == NULL) {
3257c478bdstevel@tonic-gate		(void) au_close(rd, 0, 0);
3267c478bdstevel@tonic-gate	} else {
3277c478bdstevel@tonic-gate		(void) snprintf(tbuf, tlen, gtxt, cmdbuf);
3287c478bdstevel@tonic-gate		(void) au_write(rd, au_to_text(tbuf));
3297c478bdstevel@tonic-gate		(void) free(tbuf);
3307c478bdstevel@tonic-gate
3317c478bdstevel@tonic-gate		/* add return token */
3327c478bdstevel@tonic-gate#ifdef _LP64
3337c478bdstevel@tonic-gate		(void) au_write(rd, au_to_return64(0, (int64_t)0));
3347c478bdstevel@tonic-gate#else
3357c478bdstevel@tonic-gate		(void) au_write(rd, au_to_return32(0, (int32_t)0));
3367c478bdstevel@tonic-gate#endif
3377c478bdstevel@tonic-gate
3387c478bdstevel@tonic-gate		/* write audit record */
3397c478bdstevel@tonic-gate		if (au_close(rd, 1, event) < 0) {
3407c478bdstevel@tonic-gate			(void) au_close(rd, 0, 0);
3417c478bdstevel@tonic-gate		}
3427c478bdstevel@tonic-gate	}
3437c478bdstevel@tonic-gate
3447c478bdstevel@tonic-gaterexecd_audit_session:
3457c478bdstevel@tonic-gate	audit_rexecd_session_setup(user, hostname, uid);
3467c478bdstevel@tonic-gate}
347