17c478bd9Sstevel@tonic-gate /*
27c478bd9Sstevel@tonic-gate * CDDL HEADER START
37c478bd9Sstevel@tonic-gate *
47c478bd9Sstevel@tonic-gate * The contents of this file are subject to the terms of the
5*dfc7be02SJan Friedel * Common Development and Distribution License (the "License").
6*dfc7be02SJan Friedel * You may not use this file except in compliance with the License.
77c478bd9Sstevel@tonic-gate *
87c478bd9Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
97c478bd9Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing.
107c478bd9Sstevel@tonic-gate * See the License for the specific language governing permissions
117c478bd9Sstevel@tonic-gate * and limitations under the License.
127c478bd9Sstevel@tonic-gate *
137c478bd9Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each
147c478bd9Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
157c478bd9Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the
167c478bd9Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying
177c478bd9Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner]
187c478bd9Sstevel@tonic-gate *
197c478bd9Sstevel@tonic-gate * CDDL HEADER END
207c478bd9Sstevel@tonic-gate */
217c478bd9Sstevel@tonic-gate /*
22*dfc7be02SJan Friedel * Copyright 2010 Sun Microsystems, Inc. All rights reserved.
23*dfc7be02SJan Friedel * Use is subject to license terms.
24*dfc7be02SJan Friedel *
257c478bd9Sstevel@tonic-gate */
267c478bd9Sstevel@tonic-gate #include <sys/types.h>
277c478bd9Sstevel@tonic-gate #include <sys/param.h>
287c478bd9Sstevel@tonic-gate #include <stdio.h>
297c478bd9Sstevel@tonic-gate #include <sys/fcntl.h>
307c478bd9Sstevel@tonic-gate #include <bsm/audit.h>
317c478bd9Sstevel@tonic-gate #include <bsm/audit_record.h>
327c478bd9Sstevel@tonic-gate #include <bsm/audit_uevents.h>
337c478bd9Sstevel@tonic-gate #include <bsm/libbsm.h>
347c478bd9Sstevel@tonic-gate #include <stdlib.h>
357c478bd9Sstevel@tonic-gate #include <string.h>
367c478bd9Sstevel@tonic-gate #include <syslog.h>
377c478bd9Sstevel@tonic-gate #include <netinet/in.h>
387c478bd9Sstevel@tonic-gate #include <sys/socket.h>
397c478bd9Sstevel@tonic-gate #include <rpc/rpc.h>
407c478bd9Sstevel@tonic-gate #include <tiuser.h>
417c478bd9Sstevel@tonic-gate #include <unistd.h>
427c478bd9Sstevel@tonic-gate #include <generic.h>
437c478bd9Sstevel@tonic-gate #include <note.h>
447c478bd9Sstevel@tonic-gate
457c478bd9Sstevel@tonic-gate #ifdef C2_DEBUG2
46*dfc7be02SJan Friedel #define dprintf(x) { (void) printf x; }
477c478bd9Sstevel@tonic-gate #else
487c478bd9Sstevel@tonic-gate #define dprintf(x)
497c478bd9Sstevel@tonic-gate #endif
507c478bd9Sstevel@tonic-gate
517c478bd9Sstevel@tonic-gate /*
527c478bd9Sstevel@tonic-gate * netbuf2pm()
537c478bd9Sstevel@tonic-gate *
547c478bd9Sstevel@tonic-gate * Given an endpt in netbuf form, return the port and machine.
557c478bd9Sstevel@tonic-gate * kadmind (currently) only works over IPv4, so only handle IPv4 addresses.
567c478bd9Sstevel@tonic-gate */
577c478bd9Sstevel@tonic-gate static void
netbuf2pm(struct netbuf * addr,in_port_t * port,uint32_t * machine)587c478bd9Sstevel@tonic-gate netbuf2pm(
597c478bd9Sstevel@tonic-gate struct netbuf *addr,
607c478bd9Sstevel@tonic-gate in_port_t *port,
617c478bd9Sstevel@tonic-gate uint32_t *machine)
627c478bd9Sstevel@tonic-gate {
637c478bd9Sstevel@tonic-gate struct sockaddr_in sin4;
647c478bd9Sstevel@tonic-gate
657c478bd9Sstevel@tonic-gate if (!addr) {
667c478bd9Sstevel@tonic-gate syslog(LOG_DEBUG, "netbuf2pm: addr == NULL");
677c478bd9Sstevel@tonic-gate return;
687c478bd9Sstevel@tonic-gate }
697c478bd9Sstevel@tonic-gate
707c478bd9Sstevel@tonic-gate if (!addr->buf) {
717c478bd9Sstevel@tonic-gate syslog(LOG_DEBUG, "netbuf2pm: addr->buf == NULL");
727c478bd9Sstevel@tonic-gate return;
737c478bd9Sstevel@tonic-gate }
747c478bd9Sstevel@tonic-gate
757c478bd9Sstevel@tonic-gate (void) memcpy(&sin4, addr->buf, sizeof (struct sockaddr_in));
767c478bd9Sstevel@tonic-gate if (sin4.sin_family == AF_INET) {
777c478bd9Sstevel@tonic-gate if (machine)
787c478bd9Sstevel@tonic-gate *machine = sin4.sin_addr.s_addr;
797c478bd9Sstevel@tonic-gate if (port)
807c478bd9Sstevel@tonic-gate *port = sin4.sin_port;
817c478bd9Sstevel@tonic-gate } else {
827c478bd9Sstevel@tonic-gate dprintf(("netbuf2pm: unknown caller IP address family %d",
83*dfc7be02SJan Friedel sin4.sin_family));
847c478bd9Sstevel@tonic-gate syslog(LOG_DEBUG,
857c478bd9Sstevel@tonic-gate "netbuf2pm: unknown caller IP address family %d",
867c478bd9Sstevel@tonic-gate sin4.sin_family);
877c478bd9Sstevel@tonic-gate }
887c478bd9Sstevel@tonic-gate }
897c478bd9Sstevel@tonic-gate
907c478bd9Sstevel@tonic-gate #define AUD_NULL_STR(s) ((s) ? (s) : "(null)")
917c478bd9Sstevel@tonic-gate
927c478bd9Sstevel@tonic-gate static void
common_audit(au_event_t event,SVCXPRT * xprt,in_port_t l_port,char * op,char * prime_arg,char * clnt_name,int sorf)937c478bd9Sstevel@tonic-gate common_audit(
947c478bd9Sstevel@tonic-gate au_event_t event, /* audit event */
957c478bd9Sstevel@tonic-gate SVCXPRT *xprt, /* net transport handle */
967c478bd9Sstevel@tonic-gate in_port_t l_port, /* local port */
977c478bd9Sstevel@tonic-gate char *op, /* requested operation */
987c478bd9Sstevel@tonic-gate char *prime_arg, /* argument for op */
997c478bd9Sstevel@tonic-gate char *clnt_name, /* client principal name */
1007c478bd9Sstevel@tonic-gate int sorf) /* flag for success or failure */
1017c478bd9Sstevel@tonic-gate
1027c478bd9Sstevel@tonic-gate {
1037c478bd9Sstevel@tonic-gate auditinfo_t ai;
1047c478bd9Sstevel@tonic-gate in_port_t r_port = 0;
1057c478bd9Sstevel@tonic-gate dev_t port;
1067c478bd9Sstevel@tonic-gate uint32_t machine = 0;
1077c478bd9Sstevel@tonic-gate char text_buf[512];
1087c478bd9Sstevel@tonic-gate
1097c478bd9Sstevel@tonic-gate dprintf(("common_audit() start\n"));
1107c478bd9Sstevel@tonic-gate
1117c478bd9Sstevel@tonic-gate /* if auditing turned off, then don't do anything */
1127c478bd9Sstevel@tonic-gate if (cannot_audit(0))
1137c478bd9Sstevel@tonic-gate return;
1147c478bd9Sstevel@tonic-gate
1157c478bd9Sstevel@tonic-gate (void) aug_save_namask();
1167c478bd9Sstevel@tonic-gate
1177c478bd9Sstevel@tonic-gate /*
1187c478bd9Sstevel@tonic-gate * set default values. We will overwrite them if appropriate.
1197c478bd9Sstevel@tonic-gate */
1207c478bd9Sstevel@tonic-gate if (getaudit(&ai)) {
1217c478bd9Sstevel@tonic-gate perror("kadmind");
1227c478bd9Sstevel@tonic-gate return;
1237c478bd9Sstevel@tonic-gate }
1247c478bd9Sstevel@tonic-gate aug_save_auid(ai.ai_auid); /* Audit ID */
1257c478bd9Sstevel@tonic-gate aug_save_uid(getuid()); /* User ID */
1267c478bd9Sstevel@tonic-gate aug_save_euid(geteuid()); /* Effective User ID */
1277c478bd9Sstevel@tonic-gate aug_save_gid(getgid()); /* Group ID */
1287c478bd9Sstevel@tonic-gate aug_save_egid(getegid()); /* Effective Group ID */
1297c478bd9Sstevel@tonic-gate aug_save_pid(getpid()); /* process ID */
1307c478bd9Sstevel@tonic-gate aug_save_asid(getpid()); /* session ID */
1317c478bd9Sstevel@tonic-gate
1327c478bd9Sstevel@tonic-gate aug_save_event(event);
1337c478bd9Sstevel@tonic-gate aug_save_sorf(sorf);
1347c478bd9Sstevel@tonic-gate
1357c478bd9Sstevel@tonic-gate (void) snprintf(text_buf, sizeof (text_buf), "Op: %s",
1367c478bd9Sstevel@tonic-gate AUD_NULL_STR(op));
1377c478bd9Sstevel@tonic-gate aug_save_text(text_buf);
1387c478bd9Sstevel@tonic-gate (void) snprintf(text_buf, sizeof (text_buf), "Arg: %s",
1397c478bd9Sstevel@tonic-gate AUD_NULL_STR(prime_arg));
1407c478bd9Sstevel@tonic-gate aug_save_text1(text_buf);
1417c478bd9Sstevel@tonic-gate (void) snprintf(text_buf, sizeof (text_buf), "Client: %s",
1427c478bd9Sstevel@tonic-gate AUD_NULL_STR(clnt_name));
1437c478bd9Sstevel@tonic-gate aug_save_text2(text_buf);
1447c478bd9Sstevel@tonic-gate
1457c478bd9Sstevel@tonic-gate netbuf2pm(svc_getrpccaller(xprt), &r_port, &machine);
1467c478bd9Sstevel@tonic-gate
1477c478bd9Sstevel@tonic-gate dprintf(("common_audit(): l_port=%d, r_port=%d,\n",
1487c478bd9Sstevel@tonic-gate ntohs(l_port), ntohs(r_port)));
1497c478bd9Sstevel@tonic-gate
1507c478bd9Sstevel@tonic-gate port = (r_port<<16 | l_port);
1517c478bd9Sstevel@tonic-gate
1527c478bd9Sstevel@tonic-gate aug_save_tid_ex(port, &machine, AU_IPv4);
1537c478bd9Sstevel@tonic-gate
1547c478bd9Sstevel@tonic-gate (void) aug_audit();
1557c478bd9Sstevel@tonic-gate }
1567c478bd9Sstevel@tonic-gate
1577c478bd9Sstevel@tonic-gate void
audit_kadmind_auth(SVCXPRT * xprt,in_port_t l_port,char * op,char * prime_arg,char * clnt_name,int sorf)1587c478bd9Sstevel@tonic-gate audit_kadmind_auth(
1597c478bd9Sstevel@tonic-gate SVCXPRT *xprt,
1607c478bd9Sstevel@tonic-gate in_port_t l_port,
1617c478bd9Sstevel@tonic-gate char *op,
1627c478bd9Sstevel@tonic-gate char *prime_arg,
1637c478bd9Sstevel@tonic-gate char *clnt_name,
1647c478bd9Sstevel@tonic-gate int sorf)
1657c478bd9Sstevel@tonic-gate {
1667c478bd9Sstevel@tonic-gate common_audit(AUE_kadmind_auth, xprt, l_port, op, prime_arg,
167*dfc7be02SJan Friedel clnt_name, sorf);
1687c478bd9Sstevel@tonic-gate }
1697c478bd9Sstevel@tonic-gate
1707c478bd9Sstevel@tonic-gate void
audit_kadmind_unauth(SVCXPRT * xprt,in_port_t l_port,char * op,char * prime_arg,char * clnt_name)1717c478bd9Sstevel@tonic-gate audit_kadmind_unauth(
1727c478bd9Sstevel@tonic-gate SVCXPRT *xprt,
1737c478bd9Sstevel@tonic-gate in_port_t l_port,
1747c478bd9Sstevel@tonic-gate char *op,
1757c478bd9Sstevel@tonic-gate char *prime_arg,
1767c478bd9Sstevel@tonic-gate char *clnt_name)
1777c478bd9Sstevel@tonic-gate {
1787c478bd9Sstevel@tonic-gate common_audit(AUE_kadmind_unauth, xprt, l_port, op, prime_arg,
179*dfc7be02SJan Friedel clnt_name, 1);
1807c478bd9Sstevel@tonic-gate }
181