17c478bd9Sstevel@tonic-gate /*
27c478bd9Sstevel@tonic-gate * CDDL HEADER START
37c478bd9Sstevel@tonic-gate *
47c478bd9Sstevel@tonic-gate * The contents of this file are subject to the terms of the
57257d1b4Sraf * Common Development and Distribution License (the "License").
67257d1b4Sraf * You may not use this file except in compliance with the License.
77c478bd9Sstevel@tonic-gate *
87c478bd9Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
97c478bd9Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing.
107c478bd9Sstevel@tonic-gate * See the License for the specific language governing permissions
117c478bd9Sstevel@tonic-gate * and limitations under the License.
127c478bd9Sstevel@tonic-gate *
137c478bd9Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each
147c478bd9Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
157c478bd9Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the
167c478bd9Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying
177c478bd9Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner]
187c478bd9Sstevel@tonic-gate *
197c478bd9Sstevel@tonic-gate * CDDL HEADER END
207c478bd9Sstevel@tonic-gate */
217257d1b4Sraf
227c478bd9Sstevel@tonic-gate /*
23*10c0e3a0Sgww * Copyright (c) 1992, 2010, Oracle and/or its affiliates. All rights reserved.
247c478bd9Sstevel@tonic-gate */
257c478bd9Sstevel@tonic-gate
267c478bd9Sstevel@tonic-gate #include <sys/param.h>
277c478bd9Sstevel@tonic-gate #include <sys/time.h>
287c478bd9Sstevel@tonic-gate #include <sys/types.h>
297c478bd9Sstevel@tonic-gate #include <stdlib.h>
307c478bd9Sstevel@tonic-gate #include <string.h>
317c478bd9Sstevel@tonic-gate #include <bsm/audit.h>
327c478bd9Sstevel@tonic-gate #include <bsm/libbsm.h>
337c478bd9Sstevel@tonic-gate #include <bsm/audit_record.h>
347c478bd9Sstevel@tonic-gate #include <synch.h>
357c478bd9Sstevel@tonic-gate
367c478bd9Sstevel@tonic-gate
377c478bd9Sstevel@tonic-gate /*
387c478bd9Sstevel@tonic-gate * Open an audit record = find a free descriptor and pass it back.
397c478bd9Sstevel@tonic-gate * The descriptors are in a "fixed" length array which is extended
407c478bd9Sstevel@tonic-gate * whenever it gets full.
417c478bd9Sstevel@tonic-gate *
427c478bd9Sstevel@tonic-gate * Since the expected frequency of copies is expected to be low,
437c478bd9Sstevel@tonic-gate * and since realloc loses data if it fails to expand the buffer,
447c478bd9Sstevel@tonic-gate * calloc() is used rather than realloc().
457c478bd9Sstevel@tonic-gate */
467c478bd9Sstevel@tonic-gate
477c478bd9Sstevel@tonic-gate /*
487c478bd9Sstevel@tonic-gate * AU_TABLE_MAX must be a integer multiple of AU_TABLE_LENGTH
497c478bd9Sstevel@tonic-gate */
507c478bd9Sstevel@tonic-gate #define AU_TABLE_LENGTH 16
517c478bd9Sstevel@tonic-gate #define AU_TABLE_MAX 256
527c478bd9Sstevel@tonic-gate
537c478bd9Sstevel@tonic-gate static token_t **au_d;
547c478bd9Sstevel@tonic-gate static int au_d_length = 0; /* current table length */
557c478bd9Sstevel@tonic-gate static int au_d_required_length = AU_TABLE_LENGTH; /* new table length */
567c478bd9Sstevel@tonic-gate static mutex_t mutex_au_d = DEFAULTMUTEX;
577c478bd9Sstevel@tonic-gate
587c478bd9Sstevel@tonic-gate int
au_open(void)597c478bd9Sstevel@tonic-gate au_open(void)
607c478bd9Sstevel@tonic-gate {
617c478bd9Sstevel@tonic-gate int d; /* descriptor */
627c478bd9Sstevel@tonic-gate token_t **au_d_new;
637c478bd9Sstevel@tonic-gate
647257d1b4Sraf (void) mutex_lock(&mutex_au_d);
657c478bd9Sstevel@tonic-gate
667c478bd9Sstevel@tonic-gate if (au_d_required_length > au_d_length) {
677c478bd9Sstevel@tonic-gate au_d_new = (token_t **)calloc(au_d_required_length,
687c478bd9Sstevel@tonic-gate sizeof (au_d));
697c478bd9Sstevel@tonic-gate
707c478bd9Sstevel@tonic-gate if (au_d_new == NULL) {
717c478bd9Sstevel@tonic-gate au_d_required_length = au_d_length;
727257d1b4Sraf (void) mutex_unlock(&mutex_au_d);
737c478bd9Sstevel@tonic-gate return (-1);
747c478bd9Sstevel@tonic-gate }
757c478bd9Sstevel@tonic-gate if (au_d_length > 0) {
767c478bd9Sstevel@tonic-gate (void) memcpy(au_d_new, au_d, au_d_length *
777c478bd9Sstevel@tonic-gate sizeof (au_d));
787c478bd9Sstevel@tonic-gate free(au_d);
797c478bd9Sstevel@tonic-gate }
807c478bd9Sstevel@tonic-gate au_d = au_d_new;
817c478bd9Sstevel@tonic-gate au_d_length = au_d_required_length;
827c478bd9Sstevel@tonic-gate }
837c478bd9Sstevel@tonic-gate for (d = 0; d < au_d_length; d++) {
847c478bd9Sstevel@tonic-gate if (au_d[d] == (token_t *)0) {
857c478bd9Sstevel@tonic-gate au_d[d] = (token_t *)&au_d;
867257d1b4Sraf (void) mutex_unlock(&mutex_au_d);
877c478bd9Sstevel@tonic-gate return (d);
887c478bd9Sstevel@tonic-gate }
897c478bd9Sstevel@tonic-gate }
907c478bd9Sstevel@tonic-gate /*
917c478bd9Sstevel@tonic-gate * table full; make more room.
927c478bd9Sstevel@tonic-gate * AU_TABLE_MAX limits recursion.
937c478bd9Sstevel@tonic-gate * Logic here expects AU_TABLE_MAX to be multiple of AU_TABLE_LENGTH
947c478bd9Sstevel@tonic-gate */
957c478bd9Sstevel@tonic-gate if (au_d_length >= AU_TABLE_MAX) {
967257d1b4Sraf (void) mutex_unlock(&mutex_au_d);
977c478bd9Sstevel@tonic-gate return (-1);
987c478bd9Sstevel@tonic-gate }
997c478bd9Sstevel@tonic-gate au_d_required_length += AU_TABLE_LENGTH;
1007257d1b4Sraf (void) mutex_unlock(&mutex_au_d);
1017c478bd9Sstevel@tonic-gate
1027c478bd9Sstevel@tonic-gate return (au_open());
1037c478bd9Sstevel@tonic-gate }
1047c478bd9Sstevel@tonic-gate
1057c478bd9Sstevel@tonic-gate /*
1067c478bd9Sstevel@tonic-gate * Write to an audit descriptor.
1077c478bd9Sstevel@tonic-gate * Add the mbuf to the descriptor chain and free the chain passed in.
1087c478bd9Sstevel@tonic-gate */
1097c478bd9Sstevel@tonic-gate
1107c478bd9Sstevel@tonic-gate int
au_write(int d,token_t * m)1117c478bd9Sstevel@tonic-gate au_write(int d, token_t *m)
1127c478bd9Sstevel@tonic-gate {
1137c478bd9Sstevel@tonic-gate token_t *mp;
1147c478bd9Sstevel@tonic-gate
1157c478bd9Sstevel@tonic-gate if (d < 0)
1167c478bd9Sstevel@tonic-gate return (-1);
1177c478bd9Sstevel@tonic-gate if (m == (token_t *)0)
1187c478bd9Sstevel@tonic-gate return (-1);
1197257d1b4Sraf (void) mutex_lock(&mutex_au_d);
1207c478bd9Sstevel@tonic-gate if ((d >= au_d_length) || (au_d[d] == (token_t *)0)) {
1217257d1b4Sraf (void) mutex_unlock(&mutex_au_d);
1227c478bd9Sstevel@tonic-gate return (-1);
1237c478bd9Sstevel@tonic-gate } else if (au_d[d] == (token_t *)&au_d) {
1247c478bd9Sstevel@tonic-gate au_d[d] = m;
1257257d1b4Sraf (void) mutex_unlock(&mutex_au_d);
1267c478bd9Sstevel@tonic-gate return (0);
1277c478bd9Sstevel@tonic-gate }
1287c478bd9Sstevel@tonic-gate for (mp = au_d[d]; mp->tt_next != (token_t *)0; mp = mp->tt_next)
1297c478bd9Sstevel@tonic-gate ;
1307c478bd9Sstevel@tonic-gate mp->tt_next = m;
1317257d1b4Sraf (void) mutex_unlock(&mutex_au_d);
1327c478bd9Sstevel@tonic-gate return (0);
1337c478bd9Sstevel@tonic-gate }
1347c478bd9Sstevel@tonic-gate
1357c478bd9Sstevel@tonic-gate /*
1367c478bd9Sstevel@tonic-gate * Close an audit descriptor.
1377c478bd9Sstevel@tonic-gate * Use the second parameter to indicate if it should be written or not.
1387c478bd9Sstevel@tonic-gate */
1397c478bd9Sstevel@tonic-gate int
au_close(int d,int right,au_event_t e_type)140d0fa49b7STony Nguyen au_close(int d, int right, au_event_t e_type)
1417c478bd9Sstevel@tonic-gate {
142d0fa49b7STony Nguyen au_emod_t e_mod;
1437c478bd9Sstevel@tonic-gate struct timeval now; /* current time */
1447c478bd9Sstevel@tonic-gate adr_t adr; /* adr header */
1457c478bd9Sstevel@tonic-gate auditinfo_addr_t audit_info;
1467c478bd9Sstevel@tonic-gate au_tid_addr_t *host_info = &audit_info.ai_termid;
1477c478bd9Sstevel@tonic-gate token_t *dchain; /* mbuf chain which is the tokens */
1487c478bd9Sstevel@tonic-gate token_t *record; /* mbuf chain which is the record */
1497c478bd9Sstevel@tonic-gate char data_header; /* token type */
1507c478bd9Sstevel@tonic-gate char version; /* token version */
1517c478bd9Sstevel@tonic-gate char *buffer; /* to build record into */
1527c478bd9Sstevel@tonic-gate int byte_count; /* bytes in the record */
1537c478bd9Sstevel@tonic-gate int v;
1547c478bd9Sstevel@tonic-gate
1557257d1b4Sraf (void) mutex_lock(&mutex_au_d);
1567c478bd9Sstevel@tonic-gate if (d < 0 || d >= au_d_length ||
1577c478bd9Sstevel@tonic-gate ((dchain = au_d[d]) == (token_t *)0)) {
1587257d1b4Sraf (void) mutex_unlock(&mutex_au_d);
1597c478bd9Sstevel@tonic-gate return (-1);
1607c478bd9Sstevel@tonic-gate }
1617c478bd9Sstevel@tonic-gate
1627c478bd9Sstevel@tonic-gate au_d[d] = (token_t *)0;
1637c478bd9Sstevel@tonic-gate
1647c478bd9Sstevel@tonic-gate if (dchain == (token_t *)&au_d) {
1657257d1b4Sraf (void) mutex_unlock(&mutex_au_d);
1667c478bd9Sstevel@tonic-gate return (0);
1677c478bd9Sstevel@tonic-gate }
1687c478bd9Sstevel@tonic-gate /*
1697c478bd9Sstevel@tonic-gate * If not to be written toss the record
1707c478bd9Sstevel@tonic-gate */
1717c478bd9Sstevel@tonic-gate if (!right) {
1727c478bd9Sstevel@tonic-gate while (dchain != (token_t *)0) {
1737c478bd9Sstevel@tonic-gate record = dchain;
1747c478bd9Sstevel@tonic-gate dchain = dchain->tt_next;
1757c478bd9Sstevel@tonic-gate free(record->tt_data);
1767c478bd9Sstevel@tonic-gate free(record);
1777c478bd9Sstevel@tonic-gate }
1787257d1b4Sraf (void) mutex_unlock(&mutex_au_d);
1797c478bd9Sstevel@tonic-gate return (0);
1807c478bd9Sstevel@tonic-gate }
1817c478bd9Sstevel@tonic-gate
1827c478bd9Sstevel@tonic-gate /*
1837c478bd9Sstevel@tonic-gate * Count up the bytes used in the record.
1847c478bd9Sstevel@tonic-gate */
1857c478bd9Sstevel@tonic-gate byte_count = sizeof (char) * 2 + sizeof (short) * 2 +
186*10c0e3a0Sgww sizeof (int32_t) + sizeof (struct timeval);
1877c478bd9Sstevel@tonic-gate
1887c478bd9Sstevel@tonic-gate for (record = dchain; record != (token_t *)0;
189*10c0e3a0Sgww record = record->tt_next) {
190*10c0e3a0Sgww byte_count += record->tt_size;
1917c478bd9Sstevel@tonic-gate }
1927c478bd9Sstevel@tonic-gate
1937c478bd9Sstevel@tonic-gate #ifdef _LP64
1947c478bd9Sstevel@tonic-gate #define HEADER_ID AUT_HEADER64
1957c478bd9Sstevel@tonic-gate #define HEADER_ID_EX AUT_HEADER64_EX
1967c478bd9Sstevel@tonic-gate #else
1977c478bd9Sstevel@tonic-gate #define HEADER_ID AUT_HEADER32
1987c478bd9Sstevel@tonic-gate #define HEADER_ID_EX AUT_HEADER32_EX
1997c478bd9Sstevel@tonic-gate #endif
2007c478bd9Sstevel@tonic-gate
2017c478bd9Sstevel@tonic-gate /* Use the extended headed if our host address can be determined. */
2027c478bd9Sstevel@tonic-gate
2037c478bd9Sstevel@tonic-gate data_header = HEADER_ID; /* Assume the worst */
2047c478bd9Sstevel@tonic-gate if (auditon(A_GETKAUDIT, (caddr_t)&audit_info,
2057c478bd9Sstevel@tonic-gate sizeof (audit_info)) == 0) {
2067c478bd9Sstevel@tonic-gate int have_valid_addr;
2077c478bd9Sstevel@tonic-gate
2087c478bd9Sstevel@tonic-gate if (host_info->at_type == AU_IPv6)
2097c478bd9Sstevel@tonic-gate have_valid_addr = IN6_IS_ADDR_UNSPECIFIED(
2107c478bd9Sstevel@tonic-gate (in6_addr_t *)host_info->at_addr) ? 0 : 1;
2117c478bd9Sstevel@tonic-gate else
2127c478bd9Sstevel@tonic-gate have_valid_addr = (host_info->at_addr[0] ==
2137c478bd9Sstevel@tonic-gate htonl(INADDR_ANY)) ? 0 : 1;
2147c478bd9Sstevel@tonic-gate
2157c478bd9Sstevel@tonic-gate if (have_valid_addr) {
2167c478bd9Sstevel@tonic-gate data_header = HEADER_ID_EX;
2177c478bd9Sstevel@tonic-gate byte_count += sizeof (int32_t) + host_info->at_type;
2187c478bd9Sstevel@tonic-gate }
2197c478bd9Sstevel@tonic-gate }
2207c478bd9Sstevel@tonic-gate
2217c478bd9Sstevel@tonic-gate /*
2227c478bd9Sstevel@tonic-gate * Build the header
2237c478bd9Sstevel@tonic-gate */
224*10c0e3a0Sgww if ((buffer = malloc((size_t)byte_count)) == NULL) {
225*10c0e3a0Sgww /* free the token chain */
226*10c0e3a0Sgww while (dchain != (token_t *)0) {
227*10c0e3a0Sgww record = dchain;
228*10c0e3a0Sgww dchain = dchain->tt_next;
229*10c0e3a0Sgww free(record->tt_data);
230*10c0e3a0Sgww free(record);
231*10c0e3a0Sgww }
232*10c0e3a0Sgww (void) mutex_unlock(&mutex_au_d);
233*10c0e3a0Sgww return (-1);
234*10c0e3a0Sgww }
2357c478bd9Sstevel@tonic-gate (void) gettimeofday(&now, NULL);
2367c478bd9Sstevel@tonic-gate version = TOKEN_VERSION;
2377c478bd9Sstevel@tonic-gate e_mod = 0;
2387c478bd9Sstevel@tonic-gate adr_start(&adr, buffer);
2397c478bd9Sstevel@tonic-gate adr_char(&adr, &data_header, 1);
2407c478bd9Sstevel@tonic-gate adr_int32(&adr, (int32_t *)&byte_count, 1);
2417c478bd9Sstevel@tonic-gate adr_char(&adr, &version, 1);
242d0fa49b7STony Nguyen adr_ushort(&adr, &e_type, 1);
243d0fa49b7STony Nguyen adr_ushort(&adr, &e_mod, 1);
2447c478bd9Sstevel@tonic-gate if (data_header == HEADER_ID_EX) {
2457c478bd9Sstevel@tonic-gate adr_int32(&adr, (int32_t *)&host_info->at_type, 1);
2467c478bd9Sstevel@tonic-gate adr_char(&adr, (char *)&host_info->at_addr[0],
2477c478bd9Sstevel@tonic-gate (int)host_info->at_type);
2487c478bd9Sstevel@tonic-gate }
2497c478bd9Sstevel@tonic-gate #ifdef _LP64
2507c478bd9Sstevel@tonic-gate adr_int64(&adr, (int64_t *)&now, 2);
2517c478bd9Sstevel@tonic-gate #else
2527c478bd9Sstevel@tonic-gate adr_int32(&adr, (int32_t *)&now, 2);
2537c478bd9Sstevel@tonic-gate #endif
2547c478bd9Sstevel@tonic-gate /*
2557c478bd9Sstevel@tonic-gate * Tack on the data, and free the tokens.
2567c478bd9Sstevel@tonic-gate * We're not supposed to know how adr works, but ...
2577c478bd9Sstevel@tonic-gate */
2587c478bd9Sstevel@tonic-gate while (dchain != (token_t *)0) {
2597c478bd9Sstevel@tonic-gate (void) memcpy(adr.adr_now, dchain->tt_data, dchain->tt_size);
2607c478bd9Sstevel@tonic-gate adr.adr_now += dchain->tt_size;
2617c478bd9Sstevel@tonic-gate record = dchain;
2627c478bd9Sstevel@tonic-gate dchain = dchain->tt_next;
2637c478bd9Sstevel@tonic-gate free(record->tt_data);
2647c478bd9Sstevel@tonic-gate free(record);
2657c478bd9Sstevel@tonic-gate }
2667c478bd9Sstevel@tonic-gate /*
2677c478bd9Sstevel@tonic-gate * Send it down to the system
2687c478bd9Sstevel@tonic-gate */
2697c478bd9Sstevel@tonic-gate v = audit((caddr_t)buffer, byte_count);
2707c478bd9Sstevel@tonic-gate free(buffer);
2717257d1b4Sraf (void) mutex_unlock(&mutex_au_d);
2727c478bd9Sstevel@tonic-gate return (v);
2737c478bd9Sstevel@tonic-gate }
274