1/*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21/*
22 * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
23 * Use is subject to license terms.
24 */
25
26#include <netdb.h>
27#include <netinet/in.h>
28#include <pwd.h>
29#include <sys/errno.h>
30#include <sys/mutex.h>
31#include <sys/param.h>
32#include <sys/socket.h>
33#include <sys/stat.h>
34#include <sys/types.h>
35#include <string.h>
36#include <unistd.h>
37#include <alloca.h>
38#include <stdlib.h>
39#include <tsol/label.h>
40#include <bsm/audit.h>
41#include <bsm/libbsm.h>
42#include <bsm/audit_uevents.h>
43#include <bsm/audit_record.h>
44
45#define	AUC_NEVER	-2	/* audit module not loaded */
46
47/* Private Functions */
48static int selected(au_event_t, au_mask_t *, int);
49
50int aug_selected();
51int aug_na_selected();
52
53/* Global Variables */
54static au_id_t		aug_auid;	/* auid of user writing audit record */
55static uid_t		aug_uid;	/* uid of user writing audit record */
56static uid_t		aug_euid;	/* euid of user writing audit record */
57static gid_t		aug_gid;	/* gid of user writing audit record */
58static gid_t		aug_egid;	/* euid of user writing audit record */
59static pid_t		aug_pid;	/* pid of user writing audit record */
60static au_tid_addr_t	aug_tid;	/* tid of user writing audit record */
61static int		aug_na;		/* 0 if event is attributable */
62static au_mask_t	aug_namask;	/* not attributable flags */
63static au_event_t	aug_event;	/* id of event being audited */
64static int 		aug_sorf;	/* success or failure of aug_event */
65static char		*aug_text;	/* misc text to be written to trail */
66static char		*aug_text1;	/* misc text to be written to trail */
67static char		*aug_text2;	/* misc text to be written to trail */
68static au_asid_t	aug_asid;	/* asid of process writing record */
69static int 		(*aug_afunc)();	/* write additional tokens if needed */
70static char		*aug_path;	/* path token */
71static uint32_t		aug_policy;	/* kernel audit policy */
72
73/*
74 * cannot_audit:
75 *	Return 1 if audit module not loaded.
76 *	Return 0 otherwise.
77 *
78 * The argument, force, should be set to 1 for long-lived processes
79 * like some daemons.  Force should be set to 0 for most programs.
80 */
81int
82cannot_audit(force)
83	int force;
84{
85	static int auc = AUC_UNSET;
86	int cond = 0;
87
88	if (auc == AUC_UNSET || force) {
89		if (auditon(A_GETCOND, (caddr_t)&cond, sizeof (cond))) {
90			auc = AUC_NEVER;
91		} else {
92			auc = cond;
93		}
94	}
95	return (auc == AUC_NEVER);
96}
97
98/*
99 * aug_init():
100 *	Initialize global variables.
101 */
102void
103aug_init()
104{
105	aug_auid = (uid_t)-1;
106	aug_uid = (uid_t)-1;
107	aug_euid = (uid_t)-1;
108	aug_gid = (gid_t)-1;
109	aug_egid = (gid_t)-1;
110	aug_pid = -1;
111	aug_tid.at_port = 0;
112	aug_tid.at_type = AU_IPv4;
113	aug_tid.at_addr[0] = 0;
114	aug_tid.at_addr[1] = 0;
115	aug_tid.at_addr[2] = 0;
116	aug_tid.at_addr[3] = 0;
117	aug_namask.am_success = AU_MASK_ALL;
118	aug_namask.am_failure = AU_MASK_ALL;
119	aug_event = 0;
120	aug_sorf = -2;
121	aug_text = NULL;
122	aug_text1 = NULL;
123	aug_text2 = NULL;
124	aug_na = 0;
125	aug_asid = (au_asid_t)(-1);
126	aug_afunc = NULL;
127	aug_path = NULL;
128}
129
130/*
131 * aug_get_port:
132 *	Return the raw device number of the port to which the
133 *	current process is attached (assumed to be attached
134 *	through file descriptor 0) or 0 if can't stat the port.
135 */
136dev_t
137aug_get_port()
138{
139	int	rc;
140	char	*ttyn;
141	struct stat sb;
142
143	ttyn = ttyname(0);
144	if (ttyn == 0 || *ttyn == '\0') {
145		return (0);
146	}
147
148	rc = stat(ttyn, &sb);
149	if (rc < 0) {
150		perror("stat");
151		return (0);
152	}
153
154	return ((dev_t)sb.st_rdev);
155}
156
157/*
158 * aug_get_machine:
159 *	Return internet address of host hostname,
160 *	or 0 if can't do lookup.
161 */
162
163int
164aug_get_machine(const char *hostname, uint32_t *buf, uint32_t *type)
165{
166	struct addrinfo *ai;
167	int err;
168	void *p;
169
170	err = getaddrinfo(hostname, NULL, NULL, &ai);
171	if (err != 0)
172		return (0);
173
174	switch (ai->ai_family) {
175	case AF_INET:
176		/* LINTED */
177		p = &((struct sockaddr_in *)ai->ai_addr)->sin_addr,
178		    (void) memcpy(buf, p,
179		    sizeof (((struct sockaddr_in *)0)->sin_addr));
180		*type = AU_IPv4;
181		break;
182	case AF_INET6:
183		/* LINTED */
184		p = &((struct sockaddr_in6 *)ai->ai_addr)->sin6_addr,
185		    (void) memcpy(buf, p,
186		    sizeof (((struct sockaddr_in6 *)0)->sin6_addr));
187		*type = AU_IPv6;
188		break;
189	default:
190		return (0);
191	}
192
193	freeaddrinfo(ai);
194
195	return (1);
196}
197
198void
199aug_save_auid(au_id_t id)
200{
201	aug_auid = id;
202}
203
204void
205aug_save_uid(uid_t id)
206{
207	aug_uid = id;
208}
209
210void
211aug_save_euid(uid_t id)
212{
213	aug_euid = id;
214}
215
216void
217aug_save_gid(gid_t id)
218{
219	aug_gid = id;
220}
221
222void
223aug_save_egid(gid_t id)
224{
225	aug_egid = id;
226}
227
228void
229aug_save_pid(pid_t id)
230{
231	aug_pid = id;
232}
233
234void
235aug_save_asid(au_asid_t id)
236{
237	aug_asid = id;
238}
239
240void
241aug_save_afunc(int (*afunc)())
242{
243	aug_afunc = afunc;
244}
245
246void
247aug_save_tid(dev_t port, int machine)
248{
249	aug_tid.at_port = port;
250	aug_tid.at_type = AU_IPv4;
251	aug_tid.at_addr[0] = machine;
252}
253
254void
255aug_save_tid_ex(dev_t port, uint32_t *machine, uint32_t type)
256{
257	int i;
258
259	aug_tid.at_port = port;
260	if ((type != AU_IPv4) && (type != AU_IPv6))
261		type = AU_IPv4;
262
263	aug_tid.at_type = type;
264	for (i = 0; i < (type/4); i++)
265		aug_tid.at_addr[i] = machine[i];
266}
267
268int
269aug_save_me(void)
270{
271	auditinfo_addr_t ai;
272
273	if (getaudit_addr(&ai, sizeof (ai)))
274		return (-1);
275
276	aug_save_auid(ai.ai_auid);
277	aug_save_euid(geteuid());
278	aug_save_egid(getegid());
279	aug_save_uid(getuid());
280	aug_save_gid(getgid());
281	aug_save_pid(getpid());
282	aug_save_asid(ai.ai_asid);
283	aug_save_tid_ex(ai.ai_termid.at_port,
284	    ai.ai_termid.at_addr,
285	    ai.ai_termid.at_type);
286	return (0);
287}
288
289/*
290 * aug_save_namask():
291 *	Save the namask using the naflags entry in the audit_control file.
292 *	Return 0 if successful.
293 *	Return -1, and don't change the namask, if failed.
294 *	Side Effect: Sets aug_na to -1 if error, 1 if successful.
295 */
296int
297aug_save_namask()
298{
299	au_mask_t mask;
300
301	aug_na = -1;
302
303	/*
304	 * get non-attributable system event mask from kernel.
305	 */
306	if (auditon(A_GETKMASK, (caddr_t)&mask, sizeof (mask)) != 0) {
307		return (-1);
308	}
309
310	aug_namask.am_success = mask.am_success;
311	aug_namask.am_failure = mask.am_failure;
312	aug_na = 1;
313	return (0);
314}
315
316void
317aug_save_event(au_event_t id)
318{
319	aug_event = id;
320}
321
322void
323aug_save_sorf(int sorf)
324{
325	aug_sorf = sorf;
326}
327
328void
329aug_save_text(char *s)
330{
331	if (aug_text != NULL)
332		free(aug_text);
333	if (s == NULL)
334		aug_text = NULL;
335	else
336		aug_text = strdup(s);
337}
338
339void
340aug_save_text1(char *s)
341{
342	if (aug_text1 != NULL)
343		free(aug_text1);
344	if (s == NULL)
345		aug_text1 = NULL;
346	else
347		aug_text1 = strdup(s);
348}
349
350void
351aug_save_text2(char *s)
352{
353	if (aug_text2 != NULL)
354		free(aug_text2);
355	if (s == NULL)
356		aug_text2 = NULL;
357	else
358		aug_text2 = strdup(s);
359}
360
361void
362aug_save_na(int flag)
363{
364	aug_na = flag;
365}
366
367void
368aug_save_path(char *s)
369{
370	if (aug_path != NULL)
371		free(aug_path);
372	if (s == NULL)
373		aug_path = NULL;
374	aug_path = strdup(s);
375}
376
377int
378aug_save_policy()
379{
380	uint32_t policy;
381
382	if (auditon(A_GETPOLICY, (caddr_t)&policy, sizeof (policy))) {
383		return (-1);
384	}
385	aug_policy = policy;
386	return (0);
387}
388
389/*
390 * aug_audit:
391 *	Cut and audit record if it is selected.
392 *	Return 0, if successfully written.
393 *	Return 0, if not written, and not expected to write.
394 *	Return -1, if not written because of unexpected error.
395 */
396int
397aug_audit(void)
398{
399	int ad;
400
401	if (cannot_audit(0)) {
402		return (0);
403	}
404
405	if (aug_na) {
406		if (!aug_na_selected()) {
407			return (0);
408		}
409	} else if (!aug_selected()) {
410		return (0);
411	}
412
413	if ((ad = au_open()) == -1) {
414		return (-1);
415	}
416
417	(void) au_write(ad, au_to_subject_ex(aug_auid, aug_euid, aug_egid,
418	    aug_uid, aug_gid, aug_pid, aug_asid, &aug_tid));
419	if (is_system_labeled())
420		(void) au_write(ad, au_to_mylabel());
421	if (aug_policy & AUDIT_GROUP) {
422		int ng;
423		int maxgrp = getgroups(0, NULL);
424		gid_t *grplst = alloca(maxgrp * sizeof (gid_t));
425
426		if ((ng = getgroups(maxgrp, grplst)) > 0) {
427			(void) au_write(ad, au_to_newgroups(ng, grplst));
428		}
429	}
430	if (aug_text != NULL) {
431		(void) au_write(ad, au_to_text(aug_text));
432	}
433	if (aug_text1 != NULL) {
434		(void) au_write(ad, au_to_text(aug_text1));
435	}
436	if (aug_text2 != NULL) {
437		(void) au_write(ad, au_to_text(aug_text2));
438	}
439	if (aug_path != NULL) {
440		(void) au_write(ad, au_to_path(aug_path));
441	}
442	if (aug_afunc != NULL) {
443		(*aug_afunc)(ad);
444	}
445#ifdef _LP64
446	(void) au_write(ad, au_to_return64((aug_sorf == 0) ? 0 : -1,
447	    (int64_t)aug_sorf));
448#else
449	(void) au_write(ad, au_to_return32((aug_sorf == 0) ? 0 : -1,
450	    (int32_t)aug_sorf));
451#endif
452	if (au_close(ad, 1, aug_event) < 0) {
453		(void) au_close(ad, 0, 0);
454		return (-1);
455	}
456
457	return (0);
458}
459
460int
461aug_na_selected()
462{
463	if (aug_na == -1) {
464		return (-1);
465	}
466
467	return (selected(aug_event, &aug_namask, aug_sorf));
468}
469
470int
471aug_selected()
472{
473	auditinfo_addr_t mask;
474
475	if (aug_uid > MAXEPHUID) {
476		(void) aug_save_namask();
477		return (aug_na_selected());
478	}
479	if (getaudit_addr(&mask, sizeof (mask))) {
480		return (-1);
481	}
482
483	return (selected(aug_event, &mask.ai_mask, aug_sorf));
484}
485
486static int
487selected(au_event_t e, au_mask_t *m, int sorf)
488{
489	int prs_sorf;
490
491	if (sorf == 0) {
492		prs_sorf = AU_PRS_SUCCESS;
493	} else if (sorf == -1) {
494		prs_sorf = AU_PRS_FAILURE;
495	} else {
496		prs_sorf = AU_PRS_BOTH;
497	}
498
499	return (au_preselect(e, m, prs_sorf, AU_PRS_REREAD));
500}
501