xref: /illumos-gate/usr/src/lib/libbsm/common/libbsm.h (revision 6a634c9d)
17c478bd9Sstevel@tonic-gate /*
27c478bd9Sstevel@tonic-gate  * CDDL HEADER START
37c478bd9Sstevel@tonic-gate  *
47c478bd9Sstevel@tonic-gate  * The contents of this file are subject to the terms of the
57c1a0576Sgww  * Common Development and Distribution License (the "License").
67c1a0576Sgww  * You may not use this file except in compliance with the License.
77c478bd9Sstevel@tonic-gate  *
87c478bd9Sstevel@tonic-gate  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
97c478bd9Sstevel@tonic-gate  * or http://www.opensolaris.org/os/licensing.
107c478bd9Sstevel@tonic-gate  * See the License for the specific language governing permissions
117c478bd9Sstevel@tonic-gate  * and limitations under the License.
127c478bd9Sstevel@tonic-gate  *
137c478bd9Sstevel@tonic-gate  * When distributing Covered Code, include this CDDL HEADER in each
147c478bd9Sstevel@tonic-gate  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
157c478bd9Sstevel@tonic-gate  * If applicable, add the following below this CDDL HEADER, with the
167c478bd9Sstevel@tonic-gate  * fields enclosed by brackets "[]" replaced with your own identifying
177c478bd9Sstevel@tonic-gate  * information: Portions Copyright [yyyy] [name of copyright owner]
187c478bd9Sstevel@tonic-gate  *
197c478bd9Sstevel@tonic-gate  * CDDL HEADER END
207c478bd9Sstevel@tonic-gate  */
217c478bd9Sstevel@tonic-gate /*
22*f8804e7fSgww  * Copyright (c) 1992, 2010, Oracle and/or its affiliates. All rights reserved.
237c478bd9Sstevel@tonic-gate  */
247c478bd9Sstevel@tonic-gate 
257c478bd9Sstevel@tonic-gate #ifndef _BSM_LIBBSM_H
267c478bd9Sstevel@tonic-gate #define	_BSM_LIBBSM_H
277c478bd9Sstevel@tonic-gate 
287c478bd9Sstevel@tonic-gate 
29*f8804e7fSgww #include <ctype.h>
307c478bd9Sstevel@tonic-gate #include <secdb.h>
317c478bd9Sstevel@tonic-gate #include <stdio.h>
327c478bd9Sstevel@tonic-gate #include <errno.h>
337c478bd9Sstevel@tonic-gate #include <sys/types.h>
347c478bd9Sstevel@tonic-gate #include <bsm/audit.h>
357c478bd9Sstevel@tonic-gate #include <bsm/audit_record.h>
367c478bd9Sstevel@tonic-gate 
377c478bd9Sstevel@tonic-gate #ifdef	__cplusplus
387c478bd9Sstevel@tonic-gate extern "C" {
397c478bd9Sstevel@tonic-gate #endif
407c478bd9Sstevel@tonic-gate 
417c478bd9Sstevel@tonic-gate #ifndef TEXT_DOMAIN
427c478bd9Sstevel@tonic-gate #define	TEXT_DOMAIN	"SUNW_OST_OSLIB"
437c478bd9Sstevel@tonic-gate #endif
447c478bd9Sstevel@tonic-gate 
457c478bd9Sstevel@tonic-gate extern const char *bsm_dom;
467c478bd9Sstevel@tonic-gate 
477c478bd9Sstevel@tonic-gate /*
487c478bd9Sstevel@tonic-gate  * For audit_event(5)
497c478bd9Sstevel@tonic-gate  */
507c478bd9Sstevel@tonic-gate struct au_event_ent {
517c478bd9Sstevel@tonic-gate 	au_event_t ae_number;
527c478bd9Sstevel@tonic-gate 	char	*ae_name;
537c478bd9Sstevel@tonic-gate 	char	*ae_desc;
547c478bd9Sstevel@tonic-gate 	au_class_t ae_class;
557c478bd9Sstevel@tonic-gate };
567c478bd9Sstevel@tonic-gate typedef struct au_event_ent au_event_ent_t;
577c478bd9Sstevel@tonic-gate 
587c478bd9Sstevel@tonic-gate /*
597c478bd9Sstevel@tonic-gate  * For audit_class(5)
607c478bd9Sstevel@tonic-gate  */
617c478bd9Sstevel@tonic-gate struct au_class_ent {
627c478bd9Sstevel@tonic-gate 	char	*ac_name;
637c478bd9Sstevel@tonic-gate 	au_class_t ac_class;
647c478bd9Sstevel@tonic-gate 	char	*ac_desc;
657c478bd9Sstevel@tonic-gate };
667c478bd9Sstevel@tonic-gate typedef struct au_class_ent au_class_ent_t;
677c478bd9Sstevel@tonic-gate 
687c478bd9Sstevel@tonic-gate /*
697c478bd9Sstevel@tonic-gate  * For audit_user(5)
707c478bd9Sstevel@tonic-gate  */
717c478bd9Sstevel@tonic-gate struct au_user_ent {
727c478bd9Sstevel@tonic-gate 	char	*au_name;
737c478bd9Sstevel@tonic-gate 	au_mask_t au_always;
747c478bd9Sstevel@tonic-gate 	au_mask_t au_never;
757c478bd9Sstevel@tonic-gate };
767c478bd9Sstevel@tonic-gate typedef struct au_user_ent au_user_ent_t;
777c478bd9Sstevel@tonic-gate 
787c478bd9Sstevel@tonic-gate /*
797c478bd9Sstevel@tonic-gate  * Internal representation of audit user in libnsl
807c478bd9Sstevel@tonic-gate  */
817c478bd9Sstevel@tonic-gate typedef struct au_user_str_s {
827c478bd9Sstevel@tonic-gate 	char	*au_name;
837c478bd9Sstevel@tonic-gate 	char	*au_always;
847c478bd9Sstevel@tonic-gate 	char	*au_never;
857c478bd9Sstevel@tonic-gate } au_user_str_t;
867c478bd9Sstevel@tonic-gate 
877c478bd9Sstevel@tonic-gate /*
887c478bd9Sstevel@tonic-gate  * adrf's version of adr_t
897c478bd9Sstevel@tonic-gate  */
907c478bd9Sstevel@tonic-gate typedef struct adrf_s {
917c478bd9Sstevel@tonic-gate 	adr_t	*adrf_adr;
927c478bd9Sstevel@tonic-gate 	FILE	*adrf_fp;
937c478bd9Sstevel@tonic-gate } adrf_t;
947c478bd9Sstevel@tonic-gate 
957c478bd9Sstevel@tonic-gate /*
967c478bd9Sstevel@tonic-gate  * Functions that manipulate bytes from an audit file
977c478bd9Sstevel@tonic-gate  */
987c478bd9Sstevel@tonic-gate 
997c478bd9Sstevel@tonic-gate extern void	adr_char(adr_t *, char *, int);
1007c478bd9Sstevel@tonic-gate extern int	adr_count(adr_t *);
1017c478bd9Sstevel@tonic-gate extern void	adr_int32(adr_t *, int32_t *, int);
10261e717d6Sgww extern void	adr_uid(adr_t *, uid_t *, int);
1037c478bd9Sstevel@tonic-gate extern void	adr_int64(adr_t *, int64_t *, int);
1047c478bd9Sstevel@tonic-gate extern void	adr_short(adr_t *, short *, int);
105d0fa49b7STony Nguyen extern void	adr_ushort(adr_t *, ushort_t *, int);
1067c478bd9Sstevel@tonic-gate extern void	adr_start(adr_t *, char *);
1077c478bd9Sstevel@tonic-gate 
1087c478bd9Sstevel@tonic-gate extern int	adrf_char(adrf_t *, char *, int);
1097c478bd9Sstevel@tonic-gate extern int	adrf_int32(adrf_t *, int32_t *, int);
1107c478bd9Sstevel@tonic-gate extern int	adrf_int64(adrf_t *, int64_t *, int);
1117c478bd9Sstevel@tonic-gate extern int	adrf_short(adrf_t *, short *, int);
1127c478bd9Sstevel@tonic-gate extern void	adrf_start(adrf_t *, adr_t *, FILE *);
1137c478bd9Sstevel@tonic-gate extern int	adrf_u_char(adrf_t *, uchar_t *, int);
1147c478bd9Sstevel@tonic-gate extern int	adrf_u_int32(adrf_t *, uint32_t *, int);
1157c478bd9Sstevel@tonic-gate extern int	adrf_u_int64(adrf_t *, uint64_t *, int);
1167c478bd9Sstevel@tonic-gate extern int	adrf_u_short(adrf_t *, ushort_t *, int);
1177c478bd9Sstevel@tonic-gate 
1187c478bd9Sstevel@tonic-gate /*
1197c478bd9Sstevel@tonic-gate  * Functions that manipulate bytes from an audit character stream.
1207c478bd9Sstevel@tonic-gate  */
1217c478bd9Sstevel@tonic-gate 
1227c478bd9Sstevel@tonic-gate extern void	adrm_start(adr_t *, char *);
1237c478bd9Sstevel@tonic-gate extern void	adrm_char(adr_t *, char *, int);
1247c478bd9Sstevel@tonic-gate extern void	adrm_short(adr_t *, short *, int);
1257c478bd9Sstevel@tonic-gate extern void	adrm_int64(adr_t *, int64_t *, int);
1267c478bd9Sstevel@tonic-gate extern void	adrm_int32(adr_t *, int32_t *, int);
127a7746f66Stz extern void	adrm_uid(adr_t *, uid_t *, int);
1287c478bd9Sstevel@tonic-gate extern void	adrm_u_int32(adr_t *, uint32_t *, int);
1297c478bd9Sstevel@tonic-gate extern void	adrm_u_char(adr_t *, uchar_t *, int);
1307c478bd9Sstevel@tonic-gate extern void	adrm_u_int64(adr_t *, uint64_t *, int);
1317c478bd9Sstevel@tonic-gate extern void	adrm_u_short(adr_t *, ushort_t *, int);
1327c478bd9Sstevel@tonic-gate extern void	adrm_putint32(adr_t *, int32_t *, int);
1337c478bd9Sstevel@tonic-gate 
1347c478bd9Sstevel@tonic-gate /*
1357c478bd9Sstevel@tonic-gate  * Functions that do I/O for audit files
1367c478bd9Sstevel@tonic-gate  */
1377c478bd9Sstevel@tonic-gate 
138d0fa49b7STony Nguyen extern int	au_close(int, int, au_event_t);
1397c478bd9Sstevel@tonic-gate extern int	au_open(void);
1407c478bd9Sstevel@tonic-gate extern int	au_write(int, token_t *);
1417c478bd9Sstevel@tonic-gate 
1427c478bd9Sstevel@tonic-gate /*
1437c478bd9Sstevel@tonic-gate  * Functions than manipulate audit events
1447c478bd9Sstevel@tonic-gate  */
1457c478bd9Sstevel@tonic-gate 
1467c478bd9Sstevel@tonic-gate extern void	setauevent(void);
1477c478bd9Sstevel@tonic-gate extern void	endauevent(void);
1487c478bd9Sstevel@tonic-gate 
1497c478bd9Sstevel@tonic-gate extern au_event_ent_t	*getauevent(void);
1507c478bd9Sstevel@tonic-gate extern au_event_ent_t	*getauevent_r(au_event_ent_t *);
1517c478bd9Sstevel@tonic-gate extern au_event_ent_t	*getauevnam(char *);
1527c478bd9Sstevel@tonic-gate extern au_event_ent_t	*getauevnam_r(au_event_ent_t *, char *);
1537c478bd9Sstevel@tonic-gate extern au_event_ent_t	*getauevnum(au_event_t);
1547c478bd9Sstevel@tonic-gate extern au_event_ent_t	*getauevnum_r(au_event_ent_t *, au_event_t);
1557c478bd9Sstevel@tonic-gate extern au_event_t	getauevnonam(char *);
1567c478bd9Sstevel@tonic-gate extern int		au_preselect(au_event_t, au_mask_t *, int, int);
1577c478bd9Sstevel@tonic-gate extern int		cacheauevent(au_event_ent_t **, au_event_t);
1587c478bd9Sstevel@tonic-gate 
1597c478bd9Sstevel@tonic-gate /*
1607c478bd9Sstevel@tonic-gate  * Functions that manipulate audit classes
1617c478bd9Sstevel@tonic-gate  */
1627c478bd9Sstevel@tonic-gate 
1637c478bd9Sstevel@tonic-gate extern void	setauclass(void);
1647c478bd9Sstevel@tonic-gate extern void	endauclass(void);
1657c478bd9Sstevel@tonic-gate 
1667c478bd9Sstevel@tonic-gate extern int	cacheauclass(au_class_ent_t **, au_class_t);
1677c478bd9Sstevel@tonic-gate extern int	cacheauclassnam(au_class_ent_t **, char *);
1687c478bd9Sstevel@tonic-gate extern au_class_ent_t *getauclassent(void);
1697c478bd9Sstevel@tonic-gate extern au_class_ent_t *getauclassent_r(au_class_ent_t *);
1707c478bd9Sstevel@tonic-gate extern au_class_ent_t *getauclassnam(char *);
1717c478bd9Sstevel@tonic-gate extern au_class_ent_t *getauclassnam_r(au_class_ent_t *, char *);
1727c478bd9Sstevel@tonic-gate 
1737c478bd9Sstevel@tonic-gate /*
1747c478bd9Sstevel@tonic-gate  * Functions that manipulate audit masks
1757c478bd9Sstevel@tonic-gate  */
1767c478bd9Sstevel@tonic-gate 
1777c478bd9Sstevel@tonic-gate extern int	au_user_mask(char *, au_mask_t *);
1787c478bd9Sstevel@tonic-gate extern int	getauditflagsbin(char *, au_mask_t *);
1797c478bd9Sstevel@tonic-gate extern int	getauditflagschar(char *, au_mask_t *, int);
1807c478bd9Sstevel@tonic-gate extern int	getfauditflags(au_mask_t *, au_mask_t *, au_mask_t *);
181*f8804e7fSgww extern boolean_t __chkflags(char *, au_mask_t *, boolean_t, char **);
1827c478bd9Sstevel@tonic-gate 
1837c478bd9Sstevel@tonic-gate /*
1847c478bd9Sstevel@tonic-gate  * Functions that do system calls
1857c478bd9Sstevel@tonic-gate  */
1867c478bd9Sstevel@tonic-gate 
1877c478bd9Sstevel@tonic-gate extern int	audit(char *, int);
1887c478bd9Sstevel@tonic-gate extern int	auditon(int, caddr_t, int);
1897c478bd9Sstevel@tonic-gate extern int	auditdoor(int);
1907c478bd9Sstevel@tonic-gate extern int	getaudit(auditinfo_t *);
1917c478bd9Sstevel@tonic-gate extern int	getaudit_addr(auditinfo_addr_t *, int);
1927c478bd9Sstevel@tonic-gate extern int	getauid(au_id_t *);
1937c478bd9Sstevel@tonic-gate extern int	setaudit(auditinfo_t *);
1947c478bd9Sstevel@tonic-gate extern int	setaudit_addr(auditinfo_addr_t *, int);
1957c478bd9Sstevel@tonic-gate extern int	setauid(au_id_t *);
1967c478bd9Sstevel@tonic-gate 
1977c478bd9Sstevel@tonic-gate /*
1987c478bd9Sstevel@tonic-gate  * Defines for au_preselect(3)
1997c478bd9Sstevel@tonic-gate  */
2007c478bd9Sstevel@tonic-gate #define	AU_PRS_SUCCESS	1
2017c478bd9Sstevel@tonic-gate #define	AU_PRS_FAILURE	2
2027c478bd9Sstevel@tonic-gate #define	AU_PRS_BOTH	(AU_PRS_SUCCESS|AU_PRS_FAILURE)
2037c478bd9Sstevel@tonic-gate 
2047c478bd9Sstevel@tonic-gate #define	AU_PRS_USECACHE	0
2057c478bd9Sstevel@tonic-gate #define	AU_PRS_REREAD	1
2067c478bd9Sstevel@tonic-gate 
2077c478bd9Sstevel@tonic-gate /*
2087c478bd9Sstevel@tonic-gate  * Defines for cacheauclass and cacheauevent
2097c478bd9Sstevel@tonic-gate  */
2107c478bd9Sstevel@tonic-gate #define	AU_CACHE_FREE	0x0000
2117c478bd9Sstevel@tonic-gate #define	AU_CACHE_NAME	0x0001
2127c478bd9Sstevel@tonic-gate #define	AU_CACHE_NUMBER	0x0002
2137c478bd9Sstevel@tonic-gate 
2147c478bd9Sstevel@tonic-gate /* Flags for user-level audit routines: au_open, au_close, au_to_ */
2157c478bd9Sstevel@tonic-gate #define	AU_TO_NO_WRITE	0
2167c478bd9Sstevel@tonic-gate #define	AU_TO_WRITE	1
2177c478bd9Sstevel@tonic-gate 
2187c478bd9Sstevel@tonic-gate /* system audit files for auditd */
2197c478bd9Sstevel@tonic-gate #define	AUDITCLASSFILE		"/etc/security/audit_class"
2207c478bd9Sstevel@tonic-gate #define	AUDITEVENTFILE		"/etc/security/audit_event"
2217c478bd9Sstevel@tonic-gate #define	AUDITUSERFILE		"/etc/security/audit_user"
2227c478bd9Sstevel@tonic-gate 
2237c478bd9Sstevel@tonic-gate /* array sizes for audit library structures */
2247c478bd9Sstevel@tonic-gate #define	AU_CLASS_NAME_MAX	8
2257c478bd9Sstevel@tonic-gate #define	AU_CLASS_DESC_MAX	72
2267c478bd9Sstevel@tonic-gate #define	AU_EVENT_NAME_MAX	30
2277c478bd9Sstevel@tonic-gate #define	AU_EVENT_DESC_MAX	50
2287c478bd9Sstevel@tonic-gate #define	AU_EVENT_LINE_MAX	256
2297c478bd9Sstevel@tonic-gate 
2307c478bd9Sstevel@tonic-gate /*
2317c478bd9Sstevel@tonic-gate  * Some macros used internally by the nsswitch code
2327c478bd9Sstevel@tonic-gate  */
2337c478bd9Sstevel@tonic-gate #define	AUDITUSER_FILENAME		"/etc/security/audit_user"
2347c478bd9Sstevel@tonic-gate #define	AUDITUSER_DB_NAME		"audit_user.org_dir"
2357c478bd9Sstevel@tonic-gate #define	AUDITUSER_DB_NCOL		3	/* total columns */
2367c478bd9Sstevel@tonic-gate #define	AUDITUSER_DB_NKEYCOL		1	/* total searchable columns */
2377c478bd9Sstevel@tonic-gate #define	AUDITUSER_DB_TBLT		"audit_user_tbl"
2387c478bd9Sstevel@tonic-gate #define	AUDITUSER_SUCCESS		0
2397c478bd9Sstevel@tonic-gate #define	AUDITUSER_PARSE_ERANGE		1
2407c478bd9Sstevel@tonic-gate #define	AUDITUSER_NOT_FOUND		2
2417c478bd9Sstevel@tonic-gate 
2427c478bd9Sstevel@tonic-gate #define	AUDITUSER_COL0_KW		"name"
2437c478bd9Sstevel@tonic-gate #define	AUDITUSER_COL1_KW		"always"
2447c478bd9Sstevel@tonic-gate #define	AUDITUSER_COL2_KW		"never"
2457c478bd9Sstevel@tonic-gate 
2467c478bd9Sstevel@tonic-gate /*
2477c478bd9Sstevel@tonic-gate  * indices of searchable columns
2487c478bd9Sstevel@tonic-gate  */
2497c478bd9Sstevel@tonic-gate #define	AUDITUSER_KEYCOL0		0	/* name */
2507c478bd9Sstevel@tonic-gate 
2517c478bd9Sstevel@tonic-gate 
2527c478bd9Sstevel@tonic-gate #ifdef	__cplusplus
2537c478bd9Sstevel@tonic-gate }
2547c478bd9Sstevel@tonic-gate #endif
2557c478bd9Sstevel@tonic-gate 
2567c478bd9Sstevel@tonic-gate #endif	/* _BSM_LIBBSM_H */
257