17c478bdstevel@tonic-gate/*
27c478bdstevel@tonic-gate * CDDL HEADER START
37c478bdstevel@tonic-gate *
47c478bdstevel@tonic-gate * The contents of this file are subject to the terms of the
545916cdjpk * Common Development and Distribution License (the "License").
645916cdjpk * You may not use this file except in compliance with the License.
77c478bdstevel@tonic-gate *
87c478bdstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
97c478bdstevel@tonic-gate * or http://www.opensolaris.org/os/licensing.
107c478bdstevel@tonic-gate * See the License for the specific language governing permissions
117c478bdstevel@tonic-gate * and limitations under the License.
127c478bdstevel@tonic-gate *
137c478bdstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each
147c478bdstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
157c478bdstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the
167c478bdstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying
177c478bdstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner]
187c478bdstevel@tonic-gate *
197c478bdstevel@tonic-gate * CDDL HEADER END
207c478bdstevel@tonic-gate */
217c478bdstevel@tonic-gate/*
22f899407Jan Friedel * Copyright (c) 1992, 2010, Oracle and/or its affiliates. All rights reserved.
237c478bdstevel@tonic-gate */
247c478bdstevel@tonic-gate
257c478bdstevel@tonic-gate#include <sys/types.h>
26f48205bcasper#include <sys/param.h>
277c478bdstevel@tonic-gate#include <stdio.h>
287c478bdstevel@tonic-gate#include <sys/fcntl.h>
297c478bdstevel@tonic-gate#include <bsm/audit.h>
307c478bdstevel@tonic-gate#include <bsm/audit_record.h>
317c478bdstevel@tonic-gate#include <bsm/audit_uevents.h>
327c478bdstevel@tonic-gate#include <bsm/libbsm.h>
337c478bdstevel@tonic-gate#include <bsm/audit_private.h>
347c478bdstevel@tonic-gate#include <stdlib.h>
357c478bdstevel@tonic-gate#include <string.h>
367c478bdstevel@tonic-gate#include <syslog.h>
377c478bdstevel@tonic-gate#include <netinet/in.h>
3845916cdjpk#include <tsol/label.h>
397c478bdstevel@tonic-gate#include <locale.h>
407c478bdstevel@tonic-gate#include <unistd.h>
417c478bdstevel@tonic-gate#include <generic.h>
427c478bdstevel@tonic-gate
437c478bdstevel@tonic-gatestatic au_event_t	rshd_event;	/* audit event number */
447c478bdstevel@tonic-gatestatic uint32_t		rshd_addr[4];	/* peer address */
457c478bdstevel@tonic-gate
467c478bdstevel@tonic-gatestatic void generate_record(char *, char *, char *, int, char *);
477c478bdstevel@tonic-gatestatic void setup_session(char *);
487c478bdstevel@tonic-gatestatic int selected(uid_t, char *, au_event_t, int);
497c478bdstevel@tonic-gate
507c478bdstevel@tonic-gateint
517c478bdstevel@tonic-gateaudit_rshd_setup()
527c478bdstevel@tonic-gate{
537c478bdstevel@tonic-gate	rshd_event = AUE_rshd;
547c478bdstevel@tonic-gate	return (0);
557c478bdstevel@tonic-gate}
567c478bdstevel@tonic-gate
577c478bdstevel@tonic-gate/* ARGSUSED */
587c478bdstevel@tonic-gateint
597c478bdstevel@tonic-gateaudit_rshd_fail(msg, hostname, remuser, locuser, cmdbuf)
607c478bdstevel@tonic-gatechar	*msg;		/* message containing failure information */
617c478bdstevel@tonic-gatechar	*hostname;		/* hostname of machine requesting service */
627c478bdstevel@tonic-gatechar	*remuser;		/* username at machine requesting service */
637c478bdstevel@tonic-gatechar	*locuser;		/* username of local machine */
647c478bdstevel@tonic-gatechar	*cmdbuf;		/* command line to be executed locally */
657c478bdstevel@tonic-gate{
667c478bdstevel@tonic-gate	if (cannot_audit(0)) {
677c478bdstevel@tonic-gate		return (0);
687c478bdstevel@tonic-gate	}
697c478bdstevel@tonic-gate	generate_record(remuser, locuser, cmdbuf, -1, msg);
707c478bdstevel@tonic-gate	return (0);
717c478bdstevel@tonic-gate}
727c478bdstevel@tonic-gate
737c478bdstevel@tonic-gate/* ARGSUSED */
747c478bdstevel@tonic-gateint
757c478bdstevel@tonic-gateaudit_rshd_success(hostname, remuser, locuser, cmdbuf)
767c478bdstevel@tonic-gatechar	*hostname;		/* hostname of machine requesting service */
777c478bdstevel@tonic-gatechar	*remuser;		/* username at machine requesting service */
787c478bdstevel@tonic-gatechar	*locuser;		/* username at local machine */
797c478bdstevel@tonic-gatechar	*cmdbuf;		/* command line to be executed locally */
807c478bdstevel@tonic-gate{
817c478bdstevel@tonic-gate	if (cannot_audit(0)) {
827c478bdstevel@tonic-gate		return (0);
837c478bdstevel@tonic-gate	}
847c478bdstevel@tonic-gate	generate_record(remuser, locuser, cmdbuf, 0, "");
857c478bdstevel@tonic-gate	setup_session(locuser);
867c478bdstevel@tonic-gate	return (0);
877c478bdstevel@tonic-gate}
887c478bdstevel@tonic-gate
897c478bdstevel@tonic-gate
907c478bdstevel@tonic-gate#include <pwd.h>
917c478bdstevel@tonic-gate
927c478bdstevel@tonic-gatestatic void
937c478bdstevel@tonic-gategenerate_record(char *remuser,	/* username at machine requesting service */
947c478bdstevel@tonic-gate		char *locuser,	/* username of local machine */
957c478bdstevel@tonic-gate		char *cmdbuf,	/* command line to be executed locally */
967c478bdstevel@tonic-gate		int sf_flag,	/* success (0) or failure (-1) flag */
977c478bdstevel@tonic-gate		char *msg)	/* message containing failure information */
987c478bdstevel@tonic-gate{
997c478bdstevel@tonic-gate	int	rd;		/* audit record descriptor */
1007c478bdstevel@tonic-gate	char	buf[256];	/* temporary buffer */
1017c478bdstevel@tonic-gate	char	*tbuf;		/* temporary buffer */
1027c478bdstevel@tonic-gate	int	tlen;
1037c478bdstevel@tonic-gate	const char *gtxt;
1047c478bdstevel@tonic-gate	uid_t	uid;
1057c478bdstevel@tonic-gate	gid_t	gid;
1067c478bdstevel@tonic-gate	pid_t	pid;
1077c478bdstevel@tonic-gate	struct passwd *pwd;
1087c478bdstevel@tonic-gate	struct auditinfo_addr info;
1097c478bdstevel@tonic-gate
1107c478bdstevel@tonic-gate	if (cannot_audit(0)) {
1117c478bdstevel@tonic-gate		return;
1127c478bdstevel@tonic-gate	}
1137c478bdstevel@tonic-gate
1147c478bdstevel@tonic-gate	pwd = getpwnam(locuser);
1157c478bdstevel@tonic-gate	if (pwd == NULL) {
116f48205bcasper		uid = (uid_t)-1;
117f48205bcasper		gid = (gid_t)-1;
1187c478bdstevel@tonic-gate	} else {
1197c478bdstevel@tonic-gate		uid = pwd->pw_uid;
1207c478bdstevel@tonic-gate		gid = pwd->pw_gid;
1217c478bdstevel@tonic-gate	}
1227c478bdstevel@tonic-gate
1237c478bdstevel@tonic-gate	if (!selected(uid, locuser, rshd_event, sf_flag))
1247c478bdstevel@tonic-gate		return;
1257c478bdstevel@tonic-gate
1267c478bdstevel@tonic-gate	pid = getpid();
1277c478bdstevel@tonic-gate
1287c478bdstevel@tonic-gate	/* see if terminal id already set */
1297c478bdstevel@tonic-gate	if (getaudit_addr(&info, sizeof (info)) < 0) {
1307c478bdstevel@tonic-gate		perror("getaudit");
1317c478bdstevel@tonic-gate	}
1327c478bdstevel@tonic-gate	rd = au_open();
1337c478bdstevel@tonic-gate
1347c478bdstevel@tonic-gate	(void) au_write(rd, au_to_subject_ex(uid, uid, gid, uid, gid, pid, pid,
135f899407Jan Friedel	    &info.ai_termid));
13645916cdjpk	if (is_system_labeled())
13745916cdjpk		(void) au_write(rd, au_to_mylabel());
1387c478bdstevel@tonic-gate
1397c478bdstevel@tonic-gate	gtxt = dgettext(bsm_dom, "cmd %s");
1407c478bdstevel@tonic-gate	tlen = strlen(gtxt) + strlen(cmdbuf) + 1;
1417c478bdstevel@tonic-gate	if ((tbuf = malloc(tlen)) == NULL) {
1427c478bdstevel@tonic-gate		(void) au_close(rd, 0, 0);
1437c478bdstevel@tonic-gate		return;
1447c478bdstevel@tonic-gate	}
1457c478bdstevel@tonic-gate	(void) snprintf(tbuf, tlen, gtxt, cmdbuf);
1467c478bdstevel@tonic-gate	(void) au_write(rd, au_to_text(tbuf));
1477c478bdstevel@tonic-gate	(void) free(tbuf);
1487c478bdstevel@tonic-gate
1497c478bdstevel@tonic-gate	if (strcmp(remuser, locuser) != 0) {
1507c478bdstevel@tonic-gate		(void) snprintf(buf, sizeof (buf), dgettext(bsm_dom,
151f899407Jan Friedel		    "remote user %s"), remuser);
1527c478bdstevel@tonic-gate		(void) au_write(rd, au_to_text(buf));
1537c478bdstevel@tonic-gate	}
1547c478bdstevel@tonic-gate
1557c478bdstevel@tonic-gate	if (sf_flag == -1) {
1567c478bdstevel@tonic-gate		(void) snprintf(buf, sizeof (buf), dgettext(bsm_dom,
157f899407Jan Friedel		    "local user %s"), locuser);
1587c478bdstevel@tonic-gate		(void) au_write(rd, au_to_text(buf));
1597c478bdstevel@tonic-gate		(void) au_write(rd, au_to_text(msg));
1607c478bdstevel@tonic-gate	}
1617c478bdstevel@tonic-gate
1627c478bdstevel@tonic-gate#ifdef _LP64
1637c478bdstevel@tonic-gate	(void) au_write(rd, au_to_return64(sf_flag, (int64_t)0));
1647c478bdstevel@tonic-gate#else
1657c478bdstevel@tonic-gate	(void) au_write(rd, au_to_return32(sf_flag, (int32_t)0));
1667c478bdstevel@tonic-gate#endif
1677c478bdstevel@tonic-gate
1687c478bdstevel@tonic-gate	if (au_close(rd, 1, rshd_event) < 0) {
1697c478bdstevel@tonic-gate		(void) au_close(rd, 0, 0);
1707c478bdstevel@tonic-gate	}
1717c478bdstevel@tonic-gate}
1727c478bdstevel@tonic-gate
1737c478bdstevel@tonic-gatestatic int
1747c478bdstevel@tonic-gateselected(uid_t uid, char *locuser, au_event_t event, int sf)
1757c478bdstevel@tonic-gate{
176f899407Jan Friedel	int		sorf;
177f899407Jan Friedel	struct au_mask	mask;
1787c478bdstevel@tonic-gate
1797c478bdstevel@tonic-gate	mask.am_success = mask.am_failure = 0;
180f48205bcasper	if (uid > MAXEPHUID) {
181f899407Jan Friedel		/* get non-attrib flags */
182f899407Jan Friedel		(void) auditon(A_GETKMASK, (caddr_t)&mask, sizeof (mask));
1837c478bdstevel@tonic-gate	} else {
184f899407Jan Friedel		(void) au_user_mask(locuser, &mask);
1857c478bdstevel@tonic-gate	}
1867c478bdstevel@tonic-gate
187f899407Jan Friedel	if (sf == 0) {
1887c478bdstevel@tonic-gate		sorf = AU_PRS_SUCCESS;
189f899407Jan Friedel	} else if (sf == -1) {
1907c478bdstevel@tonic-gate		sorf = AU_PRS_FAILURE;
191f899407Jan Friedel	} else {
1927c478bdstevel@tonic-gate		sorf = AU_PRS_BOTH;
193f899407Jan Friedel	}
194f899407Jan Friedel
195f899407Jan Friedel	return (au_preselect(event, &mask, sorf, AU_PRS_REREAD));
1967c478bdstevel@tonic-gate}
1977c478bdstevel@tonic-gate
1987c478bdstevel@tonic-gatestatic void
1997c478bdstevel@tonic-gatesetup_session(char *locuser)
2007c478bdstevel@tonic-gate{
2017c478bdstevel@tonic-gate	int	rc;
2027c478bdstevel@tonic-gate	struct auditinfo_addr info;
2037c478bdstevel@tonic-gate	au_mask_t		mask;
2047c478bdstevel@tonic-gate	uid_t			uid;
2057c478bdstevel@tonic-gate	struct passwd *pwd;
2067c478bdstevel@tonic-gate
2077c478bdstevel@tonic-gate	pwd = getpwnam(locuser);
2087c478bdstevel@tonic-gate	if (pwd == NULL)
209f48205bcasper		uid = (uid_t)-1;
2107c478bdstevel@tonic-gate	else
2117c478bdstevel@tonic-gate		uid = pwd->pw_uid;
2127c478bdstevel@tonic-gate
2137c478bdstevel@tonic-gate	/* see if terminal id already set */
2147c478bdstevel@tonic-gate	if (getaudit_addr(&info, sizeof (info)) < 0) {
2157c478bdstevel@tonic-gate		perror("getaudit");
2167c478bdstevel@tonic-gate	}
2177c478bdstevel@tonic-gate
2187c478bdstevel@tonic-gate	info.ai_auid = uid;
2197c478bdstevel@tonic-gate	info.ai_asid = getpid();
2207c478bdstevel@tonic-gate
2217c478bdstevel@tonic-gate	mask.am_success = 0;
2227c478bdstevel@tonic-gate	mask.am_failure = 0;
2237c478bdstevel@tonic-gate	(void) au_user_mask(locuser, &mask);
2247c478bdstevel@tonic-gate
2257c478bdstevel@tonic-gate	info.ai_mask.am_success = mask.am_success;
2267c478bdstevel@tonic-gate	info.ai_mask.am_failure = mask.am_failure;
2277c478bdstevel@tonic-gate
2287c478bdstevel@tonic-gate	rshd_addr[0] = info.ai_termid.at_addr[0];
2297c478bdstevel@tonic-gate	rshd_addr[1] = info.ai_termid.at_addr[1];
2307c478bdstevel@tonic-gate	rshd_addr[2] = info.ai_termid.at_addr[2];
2317c478bdstevel@tonic-gate	rshd_addr[3] = info.ai_termid.at_addr[3];
2327c478bdstevel@tonic-gate
2337c478bdstevel@tonic-gate	rc = setaudit_addr(&info, sizeof (info));
2347c478bdstevel@tonic-gate	if (rc < 0) {
2357c478bdstevel@tonic-gate		perror("setaudit");
2367c478bdstevel@tonic-gate	}
2377c478bdstevel@tonic-gate}
238