xref: /illumos-gate/usr/src/lib/libbsm/common/generic.c (revision 96093503)
17c478bd9Sstevel@tonic-gate /*
27c478bd9Sstevel@tonic-gate  * CDDL HEADER START
37c478bd9Sstevel@tonic-gate  *
47c478bd9Sstevel@tonic-gate  * The contents of this file are subject to the terms of the
545916cd2Sjpk  * Common Development and Distribution License (the "License").
645916cd2Sjpk  * You may not use this file except in compliance with the License.
77c478bd9Sstevel@tonic-gate  *
87c478bd9Sstevel@tonic-gate  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
97c478bd9Sstevel@tonic-gate  * or http://www.opensolaris.org/os/licensing.
107c478bd9Sstevel@tonic-gate  * See the License for the specific language governing permissions
117c478bd9Sstevel@tonic-gate  * and limitations under the License.
127c478bd9Sstevel@tonic-gate  *
137c478bd9Sstevel@tonic-gate  * When distributing Covered Code, include this CDDL HEADER in each
147c478bd9Sstevel@tonic-gate  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
157c478bd9Sstevel@tonic-gate  * If applicable, add the following below this CDDL HEADER, with the
167c478bd9Sstevel@tonic-gate  * fields enclosed by brackets "[]" replaced with your own identifying
177c478bd9Sstevel@tonic-gate  * information: Portions Copyright [yyyy] [name of copyright owner]
187c478bd9Sstevel@tonic-gate  *
197c478bd9Sstevel@tonic-gate  * CDDL HEADER END
207c478bd9Sstevel@tonic-gate  */
217c478bd9Sstevel@tonic-gate /*
22*96093503SMarek Pospisil  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
237c478bd9Sstevel@tonic-gate  * Use is subject to license terms.
247c478bd9Sstevel@tonic-gate  */
257c478bd9Sstevel@tonic-gate 
267c478bd9Sstevel@tonic-gate #include <netdb.h>
277c478bd9Sstevel@tonic-gate #include <netinet/in.h>
287c478bd9Sstevel@tonic-gate #include <pwd.h>
297c478bd9Sstevel@tonic-gate #include <sys/errno.h>
307c478bd9Sstevel@tonic-gate #include <sys/mutex.h>
317c478bd9Sstevel@tonic-gate #include <sys/param.h>
327c478bd9Sstevel@tonic-gate #include <sys/socket.h>
337c478bd9Sstevel@tonic-gate #include <sys/stat.h>
347c478bd9Sstevel@tonic-gate #include <sys/types.h>
357c478bd9Sstevel@tonic-gate #include <string.h>
367c478bd9Sstevel@tonic-gate #include <unistd.h>
3767dbe2beSCasper H.S. Dik #include <alloca.h>
387c478bd9Sstevel@tonic-gate #include <stdlib.h>
3945916cd2Sjpk #include <tsol/label.h>
407c478bd9Sstevel@tonic-gate #include <bsm/audit.h>
417c478bd9Sstevel@tonic-gate #include <bsm/libbsm.h>
427c478bd9Sstevel@tonic-gate #include <bsm/audit_uevents.h>
437c478bd9Sstevel@tonic-gate #include <bsm/audit_record.h>
447c478bd9Sstevel@tonic-gate 
457c478bd9Sstevel@tonic-gate #define	AUC_NEVER	-2	/* audit module not loaded */
467c478bd9Sstevel@tonic-gate 
477c478bd9Sstevel@tonic-gate /* Private Functions */
487c478bd9Sstevel@tonic-gate static int selected(au_event_t, au_mask_t *, int);
497c478bd9Sstevel@tonic-gate 
507c478bd9Sstevel@tonic-gate int aug_selected();
517c478bd9Sstevel@tonic-gate int aug_na_selected();
527c478bd9Sstevel@tonic-gate 
537c478bd9Sstevel@tonic-gate /* Global Variables */
547c478bd9Sstevel@tonic-gate static au_id_t		aug_auid;	/* auid of user writing audit record */
557c478bd9Sstevel@tonic-gate static uid_t		aug_uid;	/* uid of user writing audit record */
567c478bd9Sstevel@tonic-gate static uid_t		aug_euid;	/* euid of user writing audit record */
577c478bd9Sstevel@tonic-gate static gid_t		aug_gid;	/* gid of user writing audit record */
587c478bd9Sstevel@tonic-gate static gid_t		aug_egid;	/* euid of user writing audit record */
597c478bd9Sstevel@tonic-gate static pid_t		aug_pid;	/* pid of user writing audit record */
607c478bd9Sstevel@tonic-gate static au_tid_addr_t	aug_tid;	/* tid of user writing audit record */
617c478bd9Sstevel@tonic-gate static int		aug_na;		/* 0 if event is attributable */
627c478bd9Sstevel@tonic-gate static au_mask_t	aug_namask;	/* not attributable flags */
637c478bd9Sstevel@tonic-gate static au_event_t	aug_event;	/* id of event being audited */
647c478bd9Sstevel@tonic-gate static int 		aug_sorf;	/* success or failure of aug_event */
657c478bd9Sstevel@tonic-gate static char		*aug_text;	/* misc text to be written to trail */
667c478bd9Sstevel@tonic-gate static char		*aug_text1;	/* misc text to be written to trail */
677c478bd9Sstevel@tonic-gate static char		*aug_text2;	/* misc text to be written to trail */
687c478bd9Sstevel@tonic-gate static au_asid_t	aug_asid;	/* asid of process writing record */
697c478bd9Sstevel@tonic-gate static int 		(*aug_afunc)();	/* write additional tokens if needed */
707c478bd9Sstevel@tonic-gate static char		*aug_path;	/* path token */
71*96093503SMarek Pospisil static uint32_t		aug_policy;	/* kernel audit policy */
727c478bd9Sstevel@tonic-gate 
737c478bd9Sstevel@tonic-gate /*
747c478bd9Sstevel@tonic-gate  * cannot_audit:
757c478bd9Sstevel@tonic-gate  *	Return 1 if audit module not loaded.
767c478bd9Sstevel@tonic-gate  *	Return 0 otherwise.
777c478bd9Sstevel@tonic-gate  *
787c478bd9Sstevel@tonic-gate  * The argument, force, should be set to 1 for long-lived processes
797c478bd9Sstevel@tonic-gate  * like some daemons.  Force should be set to 0 for most programs.
807c478bd9Sstevel@tonic-gate  */
817c478bd9Sstevel@tonic-gate int
cannot_audit(force)827c478bd9Sstevel@tonic-gate cannot_audit(force)
837c478bd9Sstevel@tonic-gate 	int force;
847c478bd9Sstevel@tonic-gate {
857c478bd9Sstevel@tonic-gate 	static int auc = AUC_UNSET;
867c478bd9Sstevel@tonic-gate 	int cond = 0;
877c478bd9Sstevel@tonic-gate 
887c478bd9Sstevel@tonic-gate 	if (auc == AUC_UNSET || force) {
897c478bd9Sstevel@tonic-gate 		if (auditon(A_GETCOND, (caddr_t)&cond, sizeof (cond))) {
907c478bd9Sstevel@tonic-gate 			auc = AUC_NEVER;
917c478bd9Sstevel@tonic-gate 		} else {
927c478bd9Sstevel@tonic-gate 			auc = cond;
937c478bd9Sstevel@tonic-gate 		}
947c478bd9Sstevel@tonic-gate 	}
957c478bd9Sstevel@tonic-gate 	return (auc == AUC_NEVER);
967c478bd9Sstevel@tonic-gate }
977c478bd9Sstevel@tonic-gate 
987c478bd9Sstevel@tonic-gate /*
997c478bd9Sstevel@tonic-gate  * aug_init():
1007c478bd9Sstevel@tonic-gate  *	Initialize global variables.
1017c478bd9Sstevel@tonic-gate  */
1027c478bd9Sstevel@tonic-gate void
aug_init()1037c478bd9Sstevel@tonic-gate aug_init()
1047c478bd9Sstevel@tonic-gate {
105f48205beScasper 	aug_auid = (uid_t)-1;
106f48205beScasper 	aug_uid = (uid_t)-1;
107f48205beScasper 	aug_euid = (uid_t)-1;
108f48205beScasper 	aug_gid = (gid_t)-1;
109f48205beScasper 	aug_egid = (gid_t)-1;
1107c478bd9Sstevel@tonic-gate 	aug_pid = -1;
1117c478bd9Sstevel@tonic-gate 	aug_tid.at_port = 0;
1127c478bd9Sstevel@tonic-gate 	aug_tid.at_type = AU_IPv4;
1137c478bd9Sstevel@tonic-gate 	aug_tid.at_addr[0] = 0;
1147c478bd9Sstevel@tonic-gate 	aug_tid.at_addr[1] = 0;
1157c478bd9Sstevel@tonic-gate 	aug_tid.at_addr[2] = 0;
1167c478bd9Sstevel@tonic-gate 	aug_tid.at_addr[3] = 0;
1177c478bd9Sstevel@tonic-gate 	aug_namask.am_success = AU_MASK_ALL;
1187c478bd9Sstevel@tonic-gate 	aug_namask.am_failure = AU_MASK_ALL;
1197c478bd9Sstevel@tonic-gate 	aug_event = 0;
1207c478bd9Sstevel@tonic-gate 	aug_sorf = -2;
1217c478bd9Sstevel@tonic-gate 	aug_text = NULL;
1227c478bd9Sstevel@tonic-gate 	aug_text1 = NULL;
1237c478bd9Sstevel@tonic-gate 	aug_text2 = NULL;
1247c478bd9Sstevel@tonic-gate 	aug_na = 0;
125d0fa49b7STony Nguyen 	aug_asid = (au_asid_t)(-1);
1267c478bd9Sstevel@tonic-gate 	aug_afunc = NULL;
1277c478bd9Sstevel@tonic-gate 	aug_path = NULL;
1287c478bd9Sstevel@tonic-gate }
1297c478bd9Sstevel@tonic-gate 
1307c478bd9Sstevel@tonic-gate /*
1317c478bd9Sstevel@tonic-gate  * aug_get_port:
1327c478bd9Sstevel@tonic-gate  *	Return the raw device number of the port to which the
1337c478bd9Sstevel@tonic-gate  *	current process is attached (assumed to be attached
1347c478bd9Sstevel@tonic-gate  *	through file descriptor 0) or 0 if can't stat the port.
1357c478bd9Sstevel@tonic-gate  */
1367c478bd9Sstevel@tonic-gate dev_t
aug_get_port()1377c478bd9Sstevel@tonic-gate aug_get_port()
1387c478bd9Sstevel@tonic-gate {
1397c478bd9Sstevel@tonic-gate 	int	rc;
1407c478bd9Sstevel@tonic-gate 	char	*ttyn;
1417c478bd9Sstevel@tonic-gate 	struct stat sb;
1427c478bd9Sstevel@tonic-gate 
1437c478bd9Sstevel@tonic-gate 	ttyn = ttyname(0);
1447c478bd9Sstevel@tonic-gate 	if (ttyn == 0 || *ttyn == '\0') {
1457c478bd9Sstevel@tonic-gate 		return (0);
1467c478bd9Sstevel@tonic-gate 	}
1477c478bd9Sstevel@tonic-gate 
1487c478bd9Sstevel@tonic-gate 	rc = stat(ttyn, &sb);
1497c478bd9Sstevel@tonic-gate 	if (rc < 0) {
1507c478bd9Sstevel@tonic-gate 		perror("stat");
1517c478bd9Sstevel@tonic-gate 		return (0);
1527c478bd9Sstevel@tonic-gate 	}
1537c478bd9Sstevel@tonic-gate 
1547c478bd9Sstevel@tonic-gate 	return ((dev_t)sb.st_rdev);
1557c478bd9Sstevel@tonic-gate }
1567c478bd9Sstevel@tonic-gate 
1577c478bd9Sstevel@tonic-gate /*
1587c478bd9Sstevel@tonic-gate  * aug_get_machine:
1597c478bd9Sstevel@tonic-gate  *	Return internet address of host hostname,
1607c478bd9Sstevel@tonic-gate  *	or 0 if can't do lookup.
1617c478bd9Sstevel@tonic-gate  */
1627c478bd9Sstevel@tonic-gate 
1637c478bd9Sstevel@tonic-gate int
aug_get_machine(const char * hostname,uint32_t * buf,uint32_t * type)1647c478bd9Sstevel@tonic-gate aug_get_machine(const char *hostname, uint32_t *buf, uint32_t *type)
1657c478bd9Sstevel@tonic-gate {
1667c478bd9Sstevel@tonic-gate 	struct addrinfo *ai;
1677c478bd9Sstevel@tonic-gate 	int err;
1687c478bd9Sstevel@tonic-gate 	void *p;
1697c478bd9Sstevel@tonic-gate 
1707c478bd9Sstevel@tonic-gate 	err = getaddrinfo(hostname, NULL, NULL, &ai);
1717c478bd9Sstevel@tonic-gate 	if (err != 0)
1727c478bd9Sstevel@tonic-gate 		return (0);
1737c478bd9Sstevel@tonic-gate 
1747c478bd9Sstevel@tonic-gate 	switch (ai->ai_family) {
1757c478bd9Sstevel@tonic-gate 	case AF_INET:
1767c478bd9Sstevel@tonic-gate 		/* LINTED */
1777c478bd9Sstevel@tonic-gate 		p = &((struct sockaddr_in *)ai->ai_addr)->sin_addr,
17867dbe2beSCasper H.S. Dik 		    (void) memcpy(buf, p,
1797c478bd9Sstevel@tonic-gate 		    sizeof (((struct sockaddr_in *)0)->sin_addr));
1807c478bd9Sstevel@tonic-gate 		*type = AU_IPv4;
1817c478bd9Sstevel@tonic-gate 		break;
1827c478bd9Sstevel@tonic-gate 	case AF_INET6:
1837c478bd9Sstevel@tonic-gate 		/* LINTED */
1847c478bd9Sstevel@tonic-gate 		p = &((struct sockaddr_in6 *)ai->ai_addr)->sin6_addr,
18567dbe2beSCasper H.S. Dik 		    (void) memcpy(buf, p,
1867c478bd9Sstevel@tonic-gate 		    sizeof (((struct sockaddr_in6 *)0)->sin6_addr));
1877c478bd9Sstevel@tonic-gate 		*type = AU_IPv6;
1887c478bd9Sstevel@tonic-gate 		break;
1897c478bd9Sstevel@tonic-gate 	default:
1907c478bd9Sstevel@tonic-gate 		return (0);
1917c478bd9Sstevel@tonic-gate 	}
1927c478bd9Sstevel@tonic-gate 
1937c478bd9Sstevel@tonic-gate 	freeaddrinfo(ai);
1947c478bd9Sstevel@tonic-gate 
1957c478bd9Sstevel@tonic-gate 	return (1);
1967c478bd9Sstevel@tonic-gate }
1977c478bd9Sstevel@tonic-gate 
1987c478bd9Sstevel@tonic-gate void
aug_save_auid(au_id_t id)1997c478bd9Sstevel@tonic-gate aug_save_auid(au_id_t id)
2007c478bd9Sstevel@tonic-gate {
2017c478bd9Sstevel@tonic-gate 	aug_auid = id;
2027c478bd9Sstevel@tonic-gate }
2037c478bd9Sstevel@tonic-gate 
2047c478bd9Sstevel@tonic-gate void
aug_save_uid(uid_t id)2057c478bd9Sstevel@tonic-gate aug_save_uid(uid_t id)
2067c478bd9Sstevel@tonic-gate {
2077c478bd9Sstevel@tonic-gate 	aug_uid = id;
2087c478bd9Sstevel@tonic-gate }
2097c478bd9Sstevel@tonic-gate 
2107c478bd9Sstevel@tonic-gate void
aug_save_euid(uid_t id)2117c478bd9Sstevel@tonic-gate aug_save_euid(uid_t id)
2127c478bd9Sstevel@tonic-gate {
2137c478bd9Sstevel@tonic-gate 	aug_euid = id;
2147c478bd9Sstevel@tonic-gate }
2157c478bd9Sstevel@tonic-gate 
2167c478bd9Sstevel@tonic-gate void
aug_save_gid(gid_t id)2177c478bd9Sstevel@tonic-gate aug_save_gid(gid_t id)
2187c478bd9Sstevel@tonic-gate {
2197c478bd9Sstevel@tonic-gate 	aug_gid = id;
2207c478bd9Sstevel@tonic-gate }
2217c478bd9Sstevel@tonic-gate 
2227c478bd9Sstevel@tonic-gate void
aug_save_egid(gid_t id)2237c478bd9Sstevel@tonic-gate aug_save_egid(gid_t id)
2247c478bd9Sstevel@tonic-gate {
2257c478bd9Sstevel@tonic-gate 	aug_egid = id;
2267c478bd9Sstevel@tonic-gate }
2277c478bd9Sstevel@tonic-gate 
2287c478bd9Sstevel@tonic-gate void
aug_save_pid(pid_t id)2297c478bd9Sstevel@tonic-gate aug_save_pid(pid_t id)
2307c478bd9Sstevel@tonic-gate {
2317c478bd9Sstevel@tonic-gate 	aug_pid = id;
2327c478bd9Sstevel@tonic-gate }
2337c478bd9Sstevel@tonic-gate 
2347c478bd9Sstevel@tonic-gate void
aug_save_asid(au_asid_t id)2357c478bd9Sstevel@tonic-gate aug_save_asid(au_asid_t id)
2367c478bd9Sstevel@tonic-gate {
2377c478bd9Sstevel@tonic-gate 	aug_asid = id;
2387c478bd9Sstevel@tonic-gate }
2397c478bd9Sstevel@tonic-gate 
2407c478bd9Sstevel@tonic-gate void
aug_save_afunc(int (* afunc)())2417c478bd9Sstevel@tonic-gate aug_save_afunc(int (*afunc)())
2427c478bd9Sstevel@tonic-gate {
2437c478bd9Sstevel@tonic-gate 	aug_afunc = afunc;
2447c478bd9Sstevel@tonic-gate }
2457c478bd9Sstevel@tonic-gate 
2467c478bd9Sstevel@tonic-gate void
aug_save_tid(dev_t port,int machine)2477c478bd9Sstevel@tonic-gate aug_save_tid(dev_t port, int machine)
2487c478bd9Sstevel@tonic-gate {
2497c478bd9Sstevel@tonic-gate 	aug_tid.at_port = port;
2507c478bd9Sstevel@tonic-gate 	aug_tid.at_type = AU_IPv4;
2517c478bd9Sstevel@tonic-gate 	aug_tid.at_addr[0] = machine;
2527c478bd9Sstevel@tonic-gate }
2537c478bd9Sstevel@tonic-gate 
2547c478bd9Sstevel@tonic-gate void
aug_save_tid_ex(dev_t port,uint32_t * machine,uint32_t type)2557c478bd9Sstevel@tonic-gate aug_save_tid_ex(dev_t port, uint32_t *machine, uint32_t type)
2567c478bd9Sstevel@tonic-gate {
2577c478bd9Sstevel@tonic-gate 	int i;
2587c478bd9Sstevel@tonic-gate 
2597c478bd9Sstevel@tonic-gate 	aug_tid.at_port = port;
2607c478bd9Sstevel@tonic-gate 	if ((type != AU_IPv4) && (type != AU_IPv6))
2617c478bd9Sstevel@tonic-gate 		type = AU_IPv4;
2627c478bd9Sstevel@tonic-gate 
2637c478bd9Sstevel@tonic-gate 	aug_tid.at_type = type;
2647c478bd9Sstevel@tonic-gate 	for (i = 0; i < (type/4); i++)
2657c478bd9Sstevel@tonic-gate 		aug_tid.at_addr[i] = machine[i];
2667c478bd9Sstevel@tonic-gate }
2677c478bd9Sstevel@tonic-gate 
2687c478bd9Sstevel@tonic-gate int
aug_save_me(void)2697c478bd9Sstevel@tonic-gate aug_save_me(void)
2707c478bd9Sstevel@tonic-gate {
2717c478bd9Sstevel@tonic-gate 	auditinfo_addr_t ai;
2727c478bd9Sstevel@tonic-gate 
2737c478bd9Sstevel@tonic-gate 	if (getaudit_addr(&ai, sizeof (ai)))
2747c478bd9Sstevel@tonic-gate 		return (-1);
2757c478bd9Sstevel@tonic-gate 
2767c478bd9Sstevel@tonic-gate 	aug_save_auid(ai.ai_auid);
2777c478bd9Sstevel@tonic-gate 	aug_save_euid(geteuid());
2787c478bd9Sstevel@tonic-gate 	aug_save_egid(getegid());
2797c478bd9Sstevel@tonic-gate 	aug_save_uid(getuid());
2807c478bd9Sstevel@tonic-gate 	aug_save_gid(getgid());
2817c478bd9Sstevel@tonic-gate 	aug_save_pid(getpid());
2827c478bd9Sstevel@tonic-gate 	aug_save_asid(ai.ai_asid);
2837c478bd9Sstevel@tonic-gate 	aug_save_tid_ex(ai.ai_termid.at_port,
28467dbe2beSCasper H.S. Dik 	    ai.ai_termid.at_addr,
28567dbe2beSCasper H.S. Dik 	    ai.ai_termid.at_type);
2867c478bd9Sstevel@tonic-gate 	return (0);
2877c478bd9Sstevel@tonic-gate }
2887c478bd9Sstevel@tonic-gate 
2897c478bd9Sstevel@tonic-gate /*
2907c478bd9Sstevel@tonic-gate  * aug_save_namask():
2917c478bd9Sstevel@tonic-gate  *	Save the namask using the naflags entry in the audit_control file.
2927c478bd9Sstevel@tonic-gate  *	Return 0 if successful.
2937c478bd9Sstevel@tonic-gate  *	Return -1, and don't change the namask, if failed.
2947c478bd9Sstevel@tonic-gate  *	Side Effect: Sets aug_na to -1 if error, 1 if successful.
2957c478bd9Sstevel@tonic-gate  */
2967c478bd9Sstevel@tonic-gate int
aug_save_namask()2977c478bd9Sstevel@tonic-gate aug_save_namask()
2987c478bd9Sstevel@tonic-gate {
2997c478bd9Sstevel@tonic-gate 	au_mask_t mask;
3007c478bd9Sstevel@tonic-gate 
3017c478bd9Sstevel@tonic-gate 	aug_na = -1;
3027c478bd9Sstevel@tonic-gate 
3037c478bd9Sstevel@tonic-gate 	/*
3047c478bd9Sstevel@tonic-gate 	 * get non-attributable system event mask from kernel.
3057c478bd9Sstevel@tonic-gate 	 */
3067c478bd9Sstevel@tonic-gate 	if (auditon(A_GETKMASK, (caddr_t)&mask, sizeof (mask)) != 0) {
3077c478bd9Sstevel@tonic-gate 		return (-1);
3087c478bd9Sstevel@tonic-gate 	}
3097c478bd9Sstevel@tonic-gate 
3107c478bd9Sstevel@tonic-gate 	aug_namask.am_success = mask.am_success;
3117c478bd9Sstevel@tonic-gate 	aug_namask.am_failure = mask.am_failure;
3127c478bd9Sstevel@tonic-gate 	aug_na = 1;
3137c478bd9Sstevel@tonic-gate 	return (0);
3147c478bd9Sstevel@tonic-gate }
3157c478bd9Sstevel@tonic-gate 
3167c478bd9Sstevel@tonic-gate void
aug_save_event(au_event_t id)3177c478bd9Sstevel@tonic-gate aug_save_event(au_event_t id)
3187c478bd9Sstevel@tonic-gate {
3197c478bd9Sstevel@tonic-gate 	aug_event = id;
3207c478bd9Sstevel@tonic-gate }
3217c478bd9Sstevel@tonic-gate 
3227c478bd9Sstevel@tonic-gate void
aug_save_sorf(int sorf)3237c478bd9Sstevel@tonic-gate aug_save_sorf(int sorf)
3247c478bd9Sstevel@tonic-gate {
3257c478bd9Sstevel@tonic-gate 	aug_sorf = sorf;
3267c478bd9Sstevel@tonic-gate }
3277c478bd9Sstevel@tonic-gate 
3287c478bd9Sstevel@tonic-gate void
aug_save_text(char * s)3297c478bd9Sstevel@tonic-gate aug_save_text(char *s)
3307c478bd9Sstevel@tonic-gate {
3317c478bd9Sstevel@tonic-gate 	if (aug_text != NULL)
3327c478bd9Sstevel@tonic-gate 		free(aug_text);
3337c478bd9Sstevel@tonic-gate 	if (s == NULL)
3347c478bd9Sstevel@tonic-gate 		aug_text = NULL;
3357c478bd9Sstevel@tonic-gate 	else
3367c478bd9Sstevel@tonic-gate 		aug_text = strdup(s);
3377c478bd9Sstevel@tonic-gate }
3387c478bd9Sstevel@tonic-gate 
3397c478bd9Sstevel@tonic-gate void
aug_save_text1(char * s)3407c478bd9Sstevel@tonic-gate aug_save_text1(char *s)
3417c478bd9Sstevel@tonic-gate {
3427c478bd9Sstevel@tonic-gate 	if (aug_text1 != NULL)
3437c478bd9Sstevel@tonic-gate 		free(aug_text1);
3447c478bd9Sstevel@tonic-gate 	if (s == NULL)
3457c478bd9Sstevel@tonic-gate 		aug_text1 = NULL;
3467c478bd9Sstevel@tonic-gate 	else
3477c478bd9Sstevel@tonic-gate 		aug_text1 = strdup(s);
3487c478bd9Sstevel@tonic-gate }
3497c478bd9Sstevel@tonic-gate 
3507c478bd9Sstevel@tonic-gate void
aug_save_text2(char * s)3517c478bd9Sstevel@tonic-gate aug_save_text2(char *s)
3527c478bd9Sstevel@tonic-gate {
3537c478bd9Sstevel@tonic-gate 	if (aug_text2 != NULL)
3547c478bd9Sstevel@tonic-gate 		free(aug_text2);
3557c478bd9Sstevel@tonic-gate 	if (s == NULL)
3567c478bd9Sstevel@tonic-gate 		aug_text2 = NULL;
3577c478bd9Sstevel@tonic-gate 	else
3587c478bd9Sstevel@tonic-gate 		aug_text2 = strdup(s);
3597c478bd9Sstevel@tonic-gate }
3607c478bd9Sstevel@tonic-gate 
3617c478bd9Sstevel@tonic-gate void
aug_save_na(int flag)3627c478bd9Sstevel@tonic-gate aug_save_na(int flag)
3637c478bd9Sstevel@tonic-gate {
3647c478bd9Sstevel@tonic-gate 	aug_na = flag;
3657c478bd9Sstevel@tonic-gate }
3667c478bd9Sstevel@tonic-gate 
3677c478bd9Sstevel@tonic-gate void
aug_save_path(char * s)3687c478bd9Sstevel@tonic-gate aug_save_path(char *s)
3697c478bd9Sstevel@tonic-gate {
3707c478bd9Sstevel@tonic-gate 	if (aug_path != NULL)
3717c478bd9Sstevel@tonic-gate 		free(aug_path);
3727c478bd9Sstevel@tonic-gate 	if (s == NULL)
3737c478bd9Sstevel@tonic-gate 		aug_path = NULL;
3747c478bd9Sstevel@tonic-gate 	aug_path = strdup(s);
3757c478bd9Sstevel@tonic-gate }
3767c478bd9Sstevel@tonic-gate 
3777c478bd9Sstevel@tonic-gate int
aug_save_policy()3787c478bd9Sstevel@tonic-gate aug_save_policy()
3797c478bd9Sstevel@tonic-gate {
380*96093503SMarek Pospisil 	uint32_t policy;
3817c478bd9Sstevel@tonic-gate 
3827c478bd9Sstevel@tonic-gate 	if (auditon(A_GETPOLICY, (caddr_t)&policy, sizeof (policy))) {
3837c478bd9Sstevel@tonic-gate 		return (-1);
3847c478bd9Sstevel@tonic-gate 	}
3857c478bd9Sstevel@tonic-gate 	aug_policy = policy;
3867c478bd9Sstevel@tonic-gate 	return (0);
3877c478bd9Sstevel@tonic-gate }
3887c478bd9Sstevel@tonic-gate 
3897c478bd9Sstevel@tonic-gate /*
3907c478bd9Sstevel@tonic-gate  * aug_audit:
3917c478bd9Sstevel@tonic-gate  *	Cut and audit record if it is selected.
3927c478bd9Sstevel@tonic-gate  *	Return 0, if successfully written.
3937c478bd9Sstevel@tonic-gate  *	Return 0, if not written, and not expected to write.
3947c478bd9Sstevel@tonic-gate  *	Return -1, if not written because of unexpected error.
3957c478bd9Sstevel@tonic-gate  */
3967c478bd9Sstevel@tonic-gate int
aug_audit(void)3977c478bd9Sstevel@tonic-gate aug_audit(void)
3987c478bd9Sstevel@tonic-gate {
3997c478bd9Sstevel@tonic-gate 	int ad;
4007c478bd9Sstevel@tonic-gate 
4017c478bd9Sstevel@tonic-gate 	if (cannot_audit(0)) {
4027c478bd9Sstevel@tonic-gate 		return (0);
4037c478bd9Sstevel@tonic-gate 	}
4047c478bd9Sstevel@tonic-gate 
4057c478bd9Sstevel@tonic-gate 	if (aug_na) {
4067c478bd9Sstevel@tonic-gate 		if (!aug_na_selected()) {
4077c478bd9Sstevel@tonic-gate 			return (0);
4087c478bd9Sstevel@tonic-gate 		}
4097c478bd9Sstevel@tonic-gate 	} else if (!aug_selected()) {
4107c478bd9Sstevel@tonic-gate 		return (0);
4117c478bd9Sstevel@tonic-gate 	}
4127c478bd9Sstevel@tonic-gate 
4137c478bd9Sstevel@tonic-gate 	if ((ad = au_open()) == -1) {
4147c478bd9Sstevel@tonic-gate 		return (-1);
4157c478bd9Sstevel@tonic-gate 	}
4167c478bd9Sstevel@tonic-gate 
4177c478bd9Sstevel@tonic-gate 	(void) au_write(ad, au_to_subject_ex(aug_auid, aug_euid, aug_egid,
41867dbe2beSCasper H.S. Dik 	    aug_uid, aug_gid, aug_pid, aug_asid, &aug_tid));
419c7bb2ee8Sgww 	if (is_system_labeled())
420c7bb2ee8Sgww 		(void) au_write(ad, au_to_mylabel());
4217c478bd9Sstevel@tonic-gate 	if (aug_policy & AUDIT_GROUP) {
4227c478bd9Sstevel@tonic-gate 		int ng;
42367dbe2beSCasper H.S. Dik 		int maxgrp = getgroups(0, NULL);
42467dbe2beSCasper H.S. Dik 		gid_t *grplst = alloca(maxgrp * sizeof (gid_t));
4257c478bd9Sstevel@tonic-gate 
42667dbe2beSCasper H.S. Dik 		if ((ng = getgroups(maxgrp, grplst)) > 0) {
4277c478bd9Sstevel@tonic-gate 			(void) au_write(ad, au_to_newgroups(ng, grplst));
4287c478bd9Sstevel@tonic-gate 		}
4297c478bd9Sstevel@tonic-gate 	}
4307c478bd9Sstevel@tonic-gate 	if (aug_text != NULL) {
4317c478bd9Sstevel@tonic-gate 		(void) au_write(ad, au_to_text(aug_text));
4327c478bd9Sstevel@tonic-gate 	}
4337c478bd9Sstevel@tonic-gate 	if (aug_text1 != NULL) {
4347c478bd9Sstevel@tonic-gate 		(void) au_write(ad, au_to_text(aug_text1));
4357c478bd9Sstevel@tonic-gate 	}
4367c478bd9Sstevel@tonic-gate 	if (aug_text2 != NULL) {
4377c478bd9Sstevel@tonic-gate 		(void) au_write(ad, au_to_text(aug_text2));
4387c478bd9Sstevel@tonic-gate 	}
4397c478bd9Sstevel@tonic-gate 	if (aug_path != NULL) {
4407c478bd9Sstevel@tonic-gate 		(void) au_write(ad, au_to_path(aug_path));
4417c478bd9Sstevel@tonic-gate 	}
4427c478bd9Sstevel@tonic-gate 	if (aug_afunc != NULL) {
4437c478bd9Sstevel@tonic-gate 		(*aug_afunc)(ad);
4447c478bd9Sstevel@tonic-gate 	}
4457c478bd9Sstevel@tonic-gate #ifdef _LP64
4467c478bd9Sstevel@tonic-gate 	(void) au_write(ad, au_to_return64((aug_sorf == 0) ? 0 : -1,
447c7bb2ee8Sgww 	    (int64_t)aug_sorf));
4487c478bd9Sstevel@tonic-gate #else
4497c478bd9Sstevel@tonic-gate 	(void) au_write(ad, au_to_return32((aug_sorf == 0) ? 0 : -1,
450c7bb2ee8Sgww 	    (int32_t)aug_sorf));
4517c478bd9Sstevel@tonic-gate #endif
4527c478bd9Sstevel@tonic-gate 	if (au_close(ad, 1, aug_event) < 0) {
4537c478bd9Sstevel@tonic-gate 		(void) au_close(ad, 0, 0);
4547c478bd9Sstevel@tonic-gate 		return (-1);
4557c478bd9Sstevel@tonic-gate 	}
4567c478bd9Sstevel@tonic-gate 
4577c478bd9Sstevel@tonic-gate 	return (0);
4587c478bd9Sstevel@tonic-gate }
4597c478bd9Sstevel@tonic-gate 
4607c478bd9Sstevel@tonic-gate int
aug_na_selected()4617c478bd9Sstevel@tonic-gate aug_na_selected()
4627c478bd9Sstevel@tonic-gate {
4637c478bd9Sstevel@tonic-gate 	if (aug_na == -1) {
4647c478bd9Sstevel@tonic-gate 		return (-1);
4657c478bd9Sstevel@tonic-gate 	}
4667c478bd9Sstevel@tonic-gate 
4677c478bd9Sstevel@tonic-gate 	return (selected(aug_event, &aug_namask, aug_sorf));
4687c478bd9Sstevel@tonic-gate }
4697c478bd9Sstevel@tonic-gate 
4707c478bd9Sstevel@tonic-gate int
aug_selected()4717c478bd9Sstevel@tonic-gate aug_selected()
4727c478bd9Sstevel@tonic-gate {
4737c478bd9Sstevel@tonic-gate 	auditinfo_addr_t mask;
4747c478bd9Sstevel@tonic-gate 
475f48205beScasper 	if (aug_uid > MAXEPHUID) {
4767c478bd9Sstevel@tonic-gate 		(void) aug_save_namask();
4777c478bd9Sstevel@tonic-gate 		return (aug_na_selected());
4787c478bd9Sstevel@tonic-gate 	}
4797c478bd9Sstevel@tonic-gate 	if (getaudit_addr(&mask, sizeof (mask))) {
4807c478bd9Sstevel@tonic-gate 		return (-1);
4817c478bd9Sstevel@tonic-gate 	}
4827c478bd9Sstevel@tonic-gate 
4837c478bd9Sstevel@tonic-gate 	return (selected(aug_event, &mask.ai_mask, aug_sorf));
4847c478bd9Sstevel@tonic-gate }
4857c478bd9Sstevel@tonic-gate 
4867c478bd9Sstevel@tonic-gate static int
selected(au_event_t e,au_mask_t * m,int sorf)4877c478bd9Sstevel@tonic-gate selected(au_event_t e, au_mask_t *m, int sorf)
4887c478bd9Sstevel@tonic-gate {
4897c478bd9Sstevel@tonic-gate 	int prs_sorf;
4907c478bd9Sstevel@tonic-gate 
4917c478bd9Sstevel@tonic-gate 	if (sorf == 0) {
4927c478bd9Sstevel@tonic-gate 		prs_sorf = AU_PRS_SUCCESS;
4937c478bd9Sstevel@tonic-gate 	} else if (sorf == -1) {
4947c478bd9Sstevel@tonic-gate 		prs_sorf = AU_PRS_FAILURE;
4957c478bd9Sstevel@tonic-gate 	} else {
4967c478bd9Sstevel@tonic-gate 		prs_sorf = AU_PRS_BOTH;
4977c478bd9Sstevel@tonic-gate 	}
4987c478bd9Sstevel@tonic-gate 
4997c478bd9Sstevel@tonic-gate 	return (au_preselect(e, m, prs_sorf, AU_PRS_REREAD));
5007c478bd9Sstevel@tonic-gate }
501