17c478bd9Sstevel@tonic-gate /* 27c478bd9Sstevel@tonic-gate * CDDL HEADER START 37c478bd9Sstevel@tonic-gate * 47c478bd9Sstevel@tonic-gate * The contents of this file are subject to the terms of the 545916cd2Sjpk * Common Development and Distribution License (the "License"). 645916cd2Sjpk * You may not use this file except in compliance with the License. 77c478bd9Sstevel@tonic-gate * 87c478bd9Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 97c478bd9Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing. 107c478bd9Sstevel@tonic-gate * See the License for the specific language governing permissions 117c478bd9Sstevel@tonic-gate * and limitations under the License. 127c478bd9Sstevel@tonic-gate * 137c478bd9Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each 147c478bd9Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 157c478bd9Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the 167c478bd9Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying 177c478bd9Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner] 187c478bd9Sstevel@tonic-gate * 197c478bd9Sstevel@tonic-gate * CDDL HEADER END 207c478bd9Sstevel@tonic-gate */ 217c478bd9Sstevel@tonic-gate /* 22*134a1f4eSCasper H.S. Dik * Copyright (c) 1992, 2010, Oracle and/or its affiliates. All rights reserved. 237c478bd9Sstevel@tonic-gate */ 247c478bd9Sstevel@tonic-gate 257c478bd9Sstevel@tonic-gate /* 267c478bd9Sstevel@tonic-gate * This file contains the audit hook support code for auditing. 277c478bd9Sstevel@tonic-gate */ 287c478bd9Sstevel@tonic-gate 297c478bd9Sstevel@tonic-gate #include <sys/types.h> 307c478bd9Sstevel@tonic-gate #include <sys/proc.h> 317c478bd9Sstevel@tonic-gate #include <sys/vnode.h> 327c478bd9Sstevel@tonic-gate #include <sys/vfs.h> 337c478bd9Sstevel@tonic-gate #include <sys/file.h> 347c478bd9Sstevel@tonic-gate #include <sys/user.h> 357c478bd9Sstevel@tonic-gate #include <sys/stropts.h> 367c478bd9Sstevel@tonic-gate #include <sys/systm.h> 377c478bd9Sstevel@tonic-gate #include <sys/pathname.h> 387c478bd9Sstevel@tonic-gate #include <sys/syscall.h> 397c478bd9Sstevel@tonic-gate #include <sys/fcntl.h> 407c478bd9Sstevel@tonic-gate #include <sys/ipc_impl.h> 417c478bd9Sstevel@tonic-gate #include <sys/msg_impl.h> 427c478bd9Sstevel@tonic-gate #include <sys/sem_impl.h> 437c478bd9Sstevel@tonic-gate #include <sys/shm_impl.h> 447c478bd9Sstevel@tonic-gate #include <sys/kmem.h> /* for KM_SLEEP */ 457c478bd9Sstevel@tonic-gate #include <sys/socket.h> 467c478bd9Sstevel@tonic-gate #include <sys/cmn_err.h> /* snprintf... */ 477c478bd9Sstevel@tonic-gate #include <sys/debug.h> 487c478bd9Sstevel@tonic-gate #include <sys/thread.h> 497c478bd9Sstevel@tonic-gate #include <netinet/in.h> 507c478bd9Sstevel@tonic-gate #include <c2/audit.h> /* needs to be included before user.h */ 517c478bd9Sstevel@tonic-gate #include <c2/audit_kernel.h> /* for M_DONTWAIT */ 527c478bd9Sstevel@tonic-gate #include <c2/audit_kevents.h> 537c478bd9Sstevel@tonic-gate #include <c2/audit_record.h> 547c478bd9Sstevel@tonic-gate #include <sys/strsubr.h> 557c478bd9Sstevel@tonic-gate #include <sys/tihdr.h> 567c478bd9Sstevel@tonic-gate #include <sys/tiuser.h> 577c478bd9Sstevel@tonic-gate #include <sys/timod.h> 587c478bd9Sstevel@tonic-gate #include <sys/model.h> /* for model_t */ 597c478bd9Sstevel@tonic-gate #include <sys/disp.h> /* for servicing_interrupt() */ 607c478bd9Sstevel@tonic-gate #include <sys/devpolicy.h> 617c478bd9Sstevel@tonic-gate #include <sys/crypto/ioctladmin.h> 62*134a1f4eSCasper H.S. Dik #include <sys/cred_impl.h> 63c28749e9Skais #include <inet/kssl/kssl.h> 64799bd290Spwernau #include <net/pfpolicy.h> 657c478bd9Sstevel@tonic-gate 667c478bd9Sstevel@tonic-gate static void add_return_token(caddr_t *, unsigned int scid, int err, int rval); 677c478bd9Sstevel@tonic-gate 687c478bd9Sstevel@tonic-gate static void audit_pathbuild(struct pathname *pnp); 697c478bd9Sstevel@tonic-gate 707c478bd9Sstevel@tonic-gate 717c478bd9Sstevel@tonic-gate /* 727c478bd9Sstevel@tonic-gate * ROUTINE: AUDIT_SAVEPATH 737c478bd9Sstevel@tonic-gate * PURPOSE: 747c478bd9Sstevel@tonic-gate * CALLBY: LOOKUPPN 757c478bd9Sstevel@tonic-gate * 767c478bd9Sstevel@tonic-gate * NOTE: We have reached the end of a path in fs/lookup.c. 777c478bd9Sstevel@tonic-gate * We get two pieces of information here: 787c478bd9Sstevel@tonic-gate * the vnode of the last component (vp) and 797c478bd9Sstevel@tonic-gate * the status of the last access (flag). 807c478bd9Sstevel@tonic-gate * TODO: 817c478bd9Sstevel@tonic-gate * QUESTION: 827c478bd9Sstevel@tonic-gate */ 837c478bd9Sstevel@tonic-gate 847c478bd9Sstevel@tonic-gate /*ARGSUSED*/ 857c478bd9Sstevel@tonic-gate int 867c478bd9Sstevel@tonic-gate audit_savepath( 877c478bd9Sstevel@tonic-gate struct pathname *pnp, /* pathname to lookup */ 887c478bd9Sstevel@tonic-gate struct vnode *vp, /* vnode of the last component */ 897c478bd9Sstevel@tonic-gate int flag, /* status of the last access */ 907c478bd9Sstevel@tonic-gate cred_t *cr) /* cred of requestor */ 917c478bd9Sstevel@tonic-gate { 927c478bd9Sstevel@tonic-gate 937c478bd9Sstevel@tonic-gate t_audit_data_t *tad; /* current thread */ 949e9e6ab8Spaulson au_kcontext_t *kctx = GET_KCTX_PZ; 957c478bd9Sstevel@tonic-gate 967c478bd9Sstevel@tonic-gate tad = U2A(u); 977c478bd9Sstevel@tonic-gate 987c478bd9Sstevel@tonic-gate /* 997c478bd9Sstevel@tonic-gate * this event being audited or do we need path information 1007c478bd9Sstevel@tonic-gate * later? This might be for a chdir/chroot or open (add path 1017c478bd9Sstevel@tonic-gate * to file pointer. If the path has already been found for an 1027c478bd9Sstevel@tonic-gate * open/creat then we don't need to process the path. 1037c478bd9Sstevel@tonic-gate * 1047c478bd9Sstevel@tonic-gate * S2E_SP (PAD_SAVPATH) flag comes from audit_s2e[].au_ctrl. Used with 1057c478bd9Sstevel@tonic-gate * chroot, chdir, open, creat system call processing. It determines 1067c478bd9Sstevel@tonic-gate * if audit_savepath() will discard the path or we need it later. 1077c478bd9Sstevel@tonic-gate * PAD_PATHFND means path already included in this audit record. It 1087c478bd9Sstevel@tonic-gate * is used in cases where multiple path lookups are done per 1097c478bd9Sstevel@tonic-gate * system call. The policy flag, AUDIT_PATH, controls if multiple 1107c478bd9Sstevel@tonic-gate * paths are allowed. 1117c478bd9Sstevel@tonic-gate * S2E_NPT (PAD_NOPATH) flag comes from audit_s2e[].au_ctrl. Used with 1127c478bd9Sstevel@tonic-gate * exit processing to inhibit any paths that may be added due to 1137c478bd9Sstevel@tonic-gate * closes. 1147c478bd9Sstevel@tonic-gate */ 1157c478bd9Sstevel@tonic-gate if ((tad->tad_flag == 0 && !(tad->tad_ctrl & PAD_SAVPATH)) || 11651d48dedSMarek Pospisil ((tad->tad_ctrl & PAD_PATHFND) && 11751d48dedSMarek Pospisil !(kctx->auk_policy & AUDIT_PATH)) || 11851d48dedSMarek Pospisil (tad->tad_ctrl & PAD_NOPATH)) { 11951d48dedSMarek Pospisil return (0); 1207c478bd9Sstevel@tonic-gate } 1217c478bd9Sstevel@tonic-gate 12245916cd2Sjpk tad->tad_ctrl |= PAD_NOPATH; /* prevent possible reentry */ 12345916cd2Sjpk 1247c478bd9Sstevel@tonic-gate audit_pathbuild(pnp); 1257c478bd9Sstevel@tonic-gate tad->tad_vn = vp; 1267c478bd9Sstevel@tonic-gate 1277c478bd9Sstevel@tonic-gate /* 1287c478bd9Sstevel@tonic-gate * are we auditing only if error, or if it is not open or create 1297c478bd9Sstevel@tonic-gate * otherwise audit_setf will do it 1307c478bd9Sstevel@tonic-gate */ 1317c478bd9Sstevel@tonic-gate 1327c478bd9Sstevel@tonic-gate if (tad->tad_flag) { 1338fd04b83SRoger A. Faulkner if (flag && 1348fd04b83SRoger A. Faulkner (tad->tad_scid == SYS_open || 1357c478bd9Sstevel@tonic-gate tad->tad_scid == SYS_open64 || 1368fd04b83SRoger A. Faulkner tad->tad_scid == SYS_openat || 1378fd04b83SRoger A. Faulkner tad->tad_scid == SYS_openat64)) { 1387c478bd9Sstevel@tonic-gate tad->tad_ctrl |= PAD_TRUE_CREATE; 1397c478bd9Sstevel@tonic-gate } 1407c478bd9Sstevel@tonic-gate 1417c478bd9Sstevel@tonic-gate /* add token to audit record for this name */ 1427c478bd9Sstevel@tonic-gate au_uwrite(au_to_path(tad->tad_aupath)); 1437c478bd9Sstevel@tonic-gate 1447c478bd9Sstevel@tonic-gate /* add the attributes of the object */ 1457c478bd9Sstevel@tonic-gate if (vp) { 1467c478bd9Sstevel@tonic-gate /* 1477c478bd9Sstevel@tonic-gate * only capture attributes when there is no error 1487c478bd9Sstevel@tonic-gate * lookup will not return the vnode of the failing 1497c478bd9Sstevel@tonic-gate * component. 1507c478bd9Sstevel@tonic-gate * 1517c478bd9Sstevel@tonic-gate * if there was a lookup error, then don't add 1527c478bd9Sstevel@tonic-gate * attribute. if lookup in vn_create(), 1537c478bd9Sstevel@tonic-gate * then don't add attribute, 1547c478bd9Sstevel@tonic-gate * it will be added at end of vn_create(). 1557c478bd9Sstevel@tonic-gate */ 1567c478bd9Sstevel@tonic-gate if (!flag && !(tad->tad_ctrl & PAD_NOATTRB)) 1577c478bd9Sstevel@tonic-gate audit_attributes(vp); 1587c478bd9Sstevel@tonic-gate } 1597c478bd9Sstevel@tonic-gate } 1607c478bd9Sstevel@tonic-gate 1618fd04b83SRoger A. Faulkner /* free up space if we're not going to save path (open, creat) */ 1627c478bd9Sstevel@tonic-gate if ((tad->tad_ctrl & PAD_SAVPATH) == 0) { 1637c478bd9Sstevel@tonic-gate if (tad->tad_aupath != NULL) { 1647c478bd9Sstevel@tonic-gate au_pathrele(tad->tad_aupath); 1657c478bd9Sstevel@tonic-gate tad->tad_aupath = NULL; 1667c478bd9Sstevel@tonic-gate tad->tad_vn = NULL; 1677c478bd9Sstevel@tonic-gate } 1687c478bd9Sstevel@tonic-gate } 1697c478bd9Sstevel@tonic-gate if (tad->tad_ctrl & PAD_MLD) 1707c478bd9Sstevel@tonic-gate tad->tad_ctrl |= PAD_PATHFND; 1717c478bd9Sstevel@tonic-gate 17245916cd2Sjpk tad->tad_ctrl &= ~PAD_NOPATH; /* restore */ 1737c478bd9Sstevel@tonic-gate return (0); 1747c478bd9Sstevel@tonic-gate } 1757c478bd9Sstevel@tonic-gate 1767c478bd9Sstevel@tonic-gate static void 1777c478bd9Sstevel@tonic-gate audit_pathbuild(struct pathname *pnp) 1787c478bd9Sstevel@tonic-gate { 1797c478bd9Sstevel@tonic-gate char *pp; /* pointer to path */ 1807c478bd9Sstevel@tonic-gate int len; /* length of incoming segment */ 1817c478bd9Sstevel@tonic-gate int newsect; /* path requires a new section */ 1827c478bd9Sstevel@tonic-gate struct audit_path *pfxapp; /* prefix for path */ 1837c478bd9Sstevel@tonic-gate struct audit_path *newapp; /* new audit_path */ 1847c478bd9Sstevel@tonic-gate t_audit_data_t *tad; /* current thread */ 1857c478bd9Sstevel@tonic-gate p_audit_data_t *pad; /* current process */ 1867c478bd9Sstevel@tonic-gate 1877c478bd9Sstevel@tonic-gate tad = U2A(u); 1887c478bd9Sstevel@tonic-gate ASSERT(tad != NULL); 1897c478bd9Sstevel@tonic-gate pad = P2A(curproc); 1907c478bd9Sstevel@tonic-gate ASSERT(pad != NULL); 1917c478bd9Sstevel@tonic-gate 1927c478bd9Sstevel@tonic-gate len = (pnp->pn_path - pnp->pn_buf) + 1; /* +1 for terminator */ 1937c478bd9Sstevel@tonic-gate ASSERT(len > 0); 1947c478bd9Sstevel@tonic-gate 1957c478bd9Sstevel@tonic-gate /* adjust for path prefix: tad_aupath, ATPATH, CRD, or CWD */ 1967c478bd9Sstevel@tonic-gate mutex_enter(&pad->pad_lock); 1977c478bd9Sstevel@tonic-gate if (tad->tad_aupath != NULL) { 1987c478bd9Sstevel@tonic-gate pfxapp = tad->tad_aupath; 1998fd04b83SRoger A. Faulkner } else if ((tad->tad_ctrl & PAD_ATCALL) && pnp->pn_buf[0] != '/') { 2007c478bd9Sstevel@tonic-gate ASSERT(tad->tad_atpath != NULL); 2017c478bd9Sstevel@tonic-gate pfxapp = tad->tad_atpath; 2027c478bd9Sstevel@tonic-gate } else if (tad->tad_ctrl & PAD_ABSPATH) { 2037c478bd9Sstevel@tonic-gate pfxapp = pad->pad_root; 2047c478bd9Sstevel@tonic-gate } else { 2057c478bd9Sstevel@tonic-gate pfxapp = pad->pad_cwd; 2067c478bd9Sstevel@tonic-gate } 2077c478bd9Sstevel@tonic-gate au_pathhold(pfxapp); 2087c478bd9Sstevel@tonic-gate mutex_exit(&pad->pad_lock); 2097c478bd9Sstevel@tonic-gate 2107c478bd9Sstevel@tonic-gate /* get an expanded buffer to hold the anchored path */ 2118fd04b83SRoger A. Faulkner newsect = tad->tad_ctrl & PAD_ATTPATH; 2127c478bd9Sstevel@tonic-gate newapp = au_pathdup(pfxapp, newsect, len); 2137c478bd9Sstevel@tonic-gate au_pathrele(pfxapp); 2147c478bd9Sstevel@tonic-gate 2157c478bd9Sstevel@tonic-gate pp = newapp->audp_sect[newapp->audp_cnt] - len; 2167c478bd9Sstevel@tonic-gate if (!newsect) { 2177c478bd9Sstevel@tonic-gate /* overlay previous NUL terminator */ 2187c478bd9Sstevel@tonic-gate *(pp - 1) = '/'; 2197c478bd9Sstevel@tonic-gate } 2207c478bd9Sstevel@tonic-gate 2217c478bd9Sstevel@tonic-gate /* now add string of processed path */ 2227c478bd9Sstevel@tonic-gate bcopy(pnp->pn_buf, pp, len); 2237c478bd9Sstevel@tonic-gate pp[len - 1] = '\0'; 2247c478bd9Sstevel@tonic-gate 2257c478bd9Sstevel@tonic-gate /* perform path simplification as necessary */ 2267c478bd9Sstevel@tonic-gate audit_fixpath(newapp, len); 2277c478bd9Sstevel@tonic-gate 2287c478bd9Sstevel@tonic-gate if (tad->tad_aupath) 2297c478bd9Sstevel@tonic-gate au_pathrele(tad->tad_aupath); 2307c478bd9Sstevel@tonic-gate tad->tad_aupath = newapp; 2317c478bd9Sstevel@tonic-gate 2327c478bd9Sstevel@tonic-gate /* for case where multiple lookups in one syscall (rename) */ 2338fd04b83SRoger A. Faulkner tad->tad_ctrl &= ~(PAD_ABSPATH | PAD_ATTPATH); 2347c478bd9Sstevel@tonic-gate } 2357c478bd9Sstevel@tonic-gate 2367c478bd9Sstevel@tonic-gate 2377c478bd9Sstevel@tonic-gate 2387c478bd9Sstevel@tonic-gate /*ARGSUSED*/ 2397c478bd9Sstevel@tonic-gate 2407c478bd9Sstevel@tonic-gate /* 2417c478bd9Sstevel@tonic-gate * ROUTINE: AUDIT_ADDCOMPONENT 2427c478bd9Sstevel@tonic-gate * PURPOSE: extend the path by the component accepted 2437c478bd9Sstevel@tonic-gate * CALLBY: LOOKUPPN 2447c478bd9Sstevel@tonic-gate * NOTE: This function is called only when there is an error in 2457c478bd9Sstevel@tonic-gate * parsing a path component 2467c478bd9Sstevel@tonic-gate * TODO: Add the error component to audit record 2477c478bd9Sstevel@tonic-gate * QUESTION: what is this for 2487c478bd9Sstevel@tonic-gate */ 2497c478bd9Sstevel@tonic-gate 2507c478bd9Sstevel@tonic-gate void 2517c478bd9Sstevel@tonic-gate audit_addcomponent(struct pathname *pnp) 2527c478bd9Sstevel@tonic-gate { 2539e9e6ab8Spaulson au_kcontext_t *kctx = GET_KCTX_PZ; 2547c478bd9Sstevel@tonic-gate t_audit_data_t *tad; 2557c478bd9Sstevel@tonic-gate 2567c478bd9Sstevel@tonic-gate tad = U2A(u); 2577c478bd9Sstevel@tonic-gate /* 2587c478bd9Sstevel@tonic-gate * S2E_SP (PAD_SAVPATH) flag comes from audit_s2e[].au_ctrl. Used with 2597c478bd9Sstevel@tonic-gate * chroot, chdir, open, creat system call processing. It determines 2607c478bd9Sstevel@tonic-gate * if audit_savepath() will discard the path or we need it later. 2617c478bd9Sstevel@tonic-gate * PAD_PATHFND means path already included in this audit record. It 2627c478bd9Sstevel@tonic-gate * is used in cases where multiple path lookups are done per 2637c478bd9Sstevel@tonic-gate * system call. The policy flag, AUDIT_PATH, controls if multiple 2647c478bd9Sstevel@tonic-gate * paths are allowed. 2657c478bd9Sstevel@tonic-gate * S2E_NPT (PAD_NOPATH) flag comes from audit_s2e[].au_ctrl. Used with 2667c478bd9Sstevel@tonic-gate * exit processing to inhibit any paths that may be added due to 2677c478bd9Sstevel@tonic-gate * closes. 2687c478bd9Sstevel@tonic-gate */ 2697c478bd9Sstevel@tonic-gate if ((tad->tad_flag == 0 && !(tad->tad_ctrl & PAD_SAVPATH)) || 27051d48dedSMarek Pospisil ((tad->tad_ctrl & PAD_PATHFND) && 27151d48dedSMarek Pospisil !(kctx->auk_policy & AUDIT_PATH)) || 27251d48dedSMarek Pospisil (tad->tad_ctrl & PAD_NOPATH)) { 27351d48dedSMarek Pospisil return; 2747c478bd9Sstevel@tonic-gate } 2757c478bd9Sstevel@tonic-gate 2767c478bd9Sstevel@tonic-gate return; 2777c478bd9Sstevel@tonic-gate 2787c478bd9Sstevel@tonic-gate } /* AUDIT_ADDCOMPONENT */ 2797c478bd9Sstevel@tonic-gate 2807c478bd9Sstevel@tonic-gate 2817c478bd9Sstevel@tonic-gate /* 2827c478bd9Sstevel@tonic-gate * ROUTINE: AUDIT_ANCHORPATH 2837c478bd9Sstevel@tonic-gate * PURPOSE: 2847c478bd9Sstevel@tonic-gate * CALLBY: LOOKUPPN 2857c478bd9Sstevel@tonic-gate * NOTE: 2867c478bd9Sstevel@tonic-gate * anchor path at "/". We have seen a symbolic link or entering for the 2877c478bd9Sstevel@tonic-gate * first time we will throw away any saved path if path is anchored. 2887c478bd9Sstevel@tonic-gate * 2897c478bd9Sstevel@tonic-gate * flag = 0, path is relative. 2907c478bd9Sstevel@tonic-gate * flag = 1, path is absolute. Free any saved path and set flag to PAD_ABSPATH. 2917c478bd9Sstevel@tonic-gate * 2927c478bd9Sstevel@tonic-gate * If the (new) path is absolute, then we have to throw away whatever we have 293da6c28aaSamw * already accumulated since it is being superseded by new path which is 2947c478bd9Sstevel@tonic-gate * anchored at the root. 2957c478bd9Sstevel@tonic-gate * Note that if the path is relative, this function does nothing 2967c478bd9Sstevel@tonic-gate * TODO: 2977c478bd9Sstevel@tonic-gate * QUESTION: 2987c478bd9Sstevel@tonic-gate */ 2997c478bd9Sstevel@tonic-gate /*ARGSUSED*/ 3007c478bd9Sstevel@tonic-gate void 3017c478bd9Sstevel@tonic-gate audit_anchorpath(struct pathname *pnp, int flag) 3027c478bd9Sstevel@tonic-gate { 3039e9e6ab8Spaulson au_kcontext_t *kctx = GET_KCTX_PZ; 3047c478bd9Sstevel@tonic-gate t_audit_data_t *tad; 3057c478bd9Sstevel@tonic-gate 3067c478bd9Sstevel@tonic-gate tad = U2A(u); 3077c478bd9Sstevel@tonic-gate 3087c478bd9Sstevel@tonic-gate /* 3097c478bd9Sstevel@tonic-gate * this event being audited or do we need path information 3107c478bd9Sstevel@tonic-gate * later? This might be for a chdir/chroot or open (add path 3117c478bd9Sstevel@tonic-gate * to file pointer. If the path has already been found for an 3127c478bd9Sstevel@tonic-gate * open/creat then we don't need to process the path. 3137c478bd9Sstevel@tonic-gate * 3147c478bd9Sstevel@tonic-gate * S2E_SP (PAD_SAVPATH) flag comes from audit_s2e[].au_ctrl. Used with 3157c478bd9Sstevel@tonic-gate * chroot, chdir, open, creat system call processing. It determines 3167c478bd9Sstevel@tonic-gate * if audit_savepath() will discard the path or we need it later. 3177c478bd9Sstevel@tonic-gate * PAD_PATHFND means path already included in this audit record. It 3187c478bd9Sstevel@tonic-gate * is used in cases where multiple path lookups are done per 3197c478bd9Sstevel@tonic-gate * system call. The policy flag, AUDIT_PATH, controls if multiple 3207c478bd9Sstevel@tonic-gate * paths are allowed. 3217c478bd9Sstevel@tonic-gate * S2E_NPT (PAD_NOPATH) flag comes from audit_s2e[].au_ctrl. Used with 3227c478bd9Sstevel@tonic-gate * exit processing to inhibit any paths that may be added due to 3237c478bd9Sstevel@tonic-gate * closes. 3247c478bd9Sstevel@tonic-gate */ 3257c478bd9Sstevel@tonic-gate if ((tad->tad_flag == 0 && !(tad->tad_ctrl & PAD_SAVPATH)) || 32651d48dedSMarek Pospisil ((tad->tad_ctrl & PAD_PATHFND) && 32751d48dedSMarek Pospisil !(kctx->auk_policy & AUDIT_PATH)) || 32851d48dedSMarek Pospisil (tad->tad_ctrl & PAD_NOPATH)) { 32951d48dedSMarek Pospisil return; 3307c478bd9Sstevel@tonic-gate } 3317c478bd9Sstevel@tonic-gate 3327c478bd9Sstevel@tonic-gate if (flag) { 3337c478bd9Sstevel@tonic-gate tad->tad_ctrl |= PAD_ABSPATH; 3347c478bd9Sstevel@tonic-gate if (tad->tad_aupath != NULL) { 3357c478bd9Sstevel@tonic-gate au_pathrele(tad->tad_aupath); 3367c478bd9Sstevel@tonic-gate tad->tad_aupath = NULL; 3377c478bd9Sstevel@tonic-gate tad->tad_vn = NULL; 3387c478bd9Sstevel@tonic-gate } 3397c478bd9Sstevel@tonic-gate } 3407c478bd9Sstevel@tonic-gate } 3417c478bd9Sstevel@tonic-gate 3427c478bd9Sstevel@tonic-gate 3437c478bd9Sstevel@tonic-gate /* 3447c478bd9Sstevel@tonic-gate * symbolic link. Save previous components. 3457c478bd9Sstevel@tonic-gate * 3467c478bd9Sstevel@tonic-gate * the path seen so far looks like this 3477c478bd9Sstevel@tonic-gate * 3487c478bd9Sstevel@tonic-gate * +-----------------------+----------------+ 3497c478bd9Sstevel@tonic-gate * | path processed so far | remaining path | 3507c478bd9Sstevel@tonic-gate * +-----------------------+----------------+ 3517c478bd9Sstevel@tonic-gate * \-----------------------/ 3527c478bd9Sstevel@tonic-gate * save this string if 3537c478bd9Sstevel@tonic-gate * symbolic link relative 3547c478bd9Sstevel@tonic-gate * (but don't include symlink component) 3557c478bd9Sstevel@tonic-gate */ 3567c478bd9Sstevel@tonic-gate 3577c478bd9Sstevel@tonic-gate /*ARGSUSED*/ 3587c478bd9Sstevel@tonic-gate 3597c478bd9Sstevel@tonic-gate 3607c478bd9Sstevel@tonic-gate /* 3617c478bd9Sstevel@tonic-gate * ROUTINE: AUDIT_SYMLINK 3627c478bd9Sstevel@tonic-gate * PURPOSE: 3637c478bd9Sstevel@tonic-gate * CALLBY: LOOKUPPN 3647c478bd9Sstevel@tonic-gate * NOTE: 3657c478bd9Sstevel@tonic-gate * TODO: 3667c478bd9Sstevel@tonic-gate * QUESTION: 3677c478bd9Sstevel@tonic-gate */ 3687c478bd9Sstevel@tonic-gate void 3697c478bd9Sstevel@tonic-gate audit_symlink(struct pathname *pnp, struct pathname *sympath) 3707c478bd9Sstevel@tonic-gate { 3717c478bd9Sstevel@tonic-gate char *sp; /* saved initial pp */ 3727c478bd9Sstevel@tonic-gate char *cp; /* start of symlink path */ 3737c478bd9Sstevel@tonic-gate uint_t len_path; /* processed path before symlink */ 3747c478bd9Sstevel@tonic-gate t_audit_data_t *tad; 3759e9e6ab8Spaulson au_kcontext_t *kctx = GET_KCTX_PZ; 3767c478bd9Sstevel@tonic-gate 3777c478bd9Sstevel@tonic-gate tad = U2A(u); 3787c478bd9Sstevel@tonic-gate 3797c478bd9Sstevel@tonic-gate /* 3807c478bd9Sstevel@tonic-gate * this event being audited or do we need path information 3817c478bd9Sstevel@tonic-gate * later? This might be for a chdir/chroot or open (add path 3827c478bd9Sstevel@tonic-gate * to file pointer. If the path has already been found for an 3837c478bd9Sstevel@tonic-gate * open/creat then we don't need to process the path. 3847c478bd9Sstevel@tonic-gate * 3857c478bd9Sstevel@tonic-gate * S2E_SP (PAD_SAVPATH) flag comes from audit_s2e[].au_ctrl. Used with 3867c478bd9Sstevel@tonic-gate * chroot, chdir, open, creat system call processing. It determines 3877c478bd9Sstevel@tonic-gate * if audit_savepath() will discard the path or we need it later. 3887c478bd9Sstevel@tonic-gate * PAD_PATHFND means path already included in this audit record. It 3897c478bd9Sstevel@tonic-gate * is used in cases where multiple path lookups are done per 3907c478bd9Sstevel@tonic-gate * system call. The policy flag, AUDIT_PATH, controls if multiple 3917c478bd9Sstevel@tonic-gate * paths are allowed. 3927c478bd9Sstevel@tonic-gate * S2E_NPT (PAD_NOPATH) flag comes from audit_s2e[].au_ctrl. Used with 3937c478bd9Sstevel@tonic-gate * exit processing to inhibit any paths that may be added due to 3947c478bd9Sstevel@tonic-gate * closes. 3957c478bd9Sstevel@tonic-gate */ 3967c478bd9Sstevel@tonic-gate if ((tad->tad_flag == 0 && 39751d48dedSMarek Pospisil !(tad->tad_ctrl & PAD_SAVPATH)) || 39851d48dedSMarek Pospisil ((tad->tad_ctrl & PAD_PATHFND) && 39951d48dedSMarek Pospisil !(kctx->auk_policy & AUDIT_PATH)) || 40051d48dedSMarek Pospisil (tad->tad_ctrl & PAD_NOPATH)) { 40151d48dedSMarek Pospisil return; 4027c478bd9Sstevel@tonic-gate } 4037c478bd9Sstevel@tonic-gate 4047c478bd9Sstevel@tonic-gate /* 4057c478bd9Sstevel@tonic-gate * if symbolic link is anchored at / then do nothing. 4067c478bd9Sstevel@tonic-gate * When we cycle back to begin: in lookuppn() we will 4077c478bd9Sstevel@tonic-gate * call audit_anchorpath() with a flag indicating if the 4087c478bd9Sstevel@tonic-gate * path is anchored at / or is relative. We will release 4097c478bd9Sstevel@tonic-gate * any saved path at that point. 4107c478bd9Sstevel@tonic-gate * 4117c478bd9Sstevel@tonic-gate * Note In the event that an error occurs in pn_combine then 4127c478bd9Sstevel@tonic-gate * we want to remain pointing at the component that caused the 4137c478bd9Sstevel@tonic-gate * path to overflow the pnp structure. 4147c478bd9Sstevel@tonic-gate */ 4157c478bd9Sstevel@tonic-gate if (sympath->pn_buf[0] == '/') 4167c478bd9Sstevel@tonic-gate return; 4177c478bd9Sstevel@tonic-gate 4187c478bd9Sstevel@tonic-gate /* backup over last component */ 4197c478bd9Sstevel@tonic-gate sp = cp = pnp->pn_path; 4207c478bd9Sstevel@tonic-gate while (*--cp != '/' && cp > pnp->pn_buf) 4217c478bd9Sstevel@tonic-gate ; 4227c478bd9Sstevel@tonic-gate 4237c478bd9Sstevel@tonic-gate len_path = cp - pnp->pn_buf; 4247c478bd9Sstevel@tonic-gate 4257c478bd9Sstevel@tonic-gate /* is there anything to save? */ 4267c478bd9Sstevel@tonic-gate if (len_path) { 427405e5d68Stz pnp->pn_path = pnp->pn_buf; 4287c478bd9Sstevel@tonic-gate audit_pathbuild(pnp); 4297c478bd9Sstevel@tonic-gate pnp->pn_path = sp; 4307c478bd9Sstevel@tonic-gate } 4317c478bd9Sstevel@tonic-gate } 4327c478bd9Sstevel@tonic-gate 4337c478bd9Sstevel@tonic-gate /* 4347c478bd9Sstevel@tonic-gate * file_is_public : determine whether events for the file (corresponding to 4357c478bd9Sstevel@tonic-gate * the specified file attr) should be audited or ignored. 4367c478bd9Sstevel@tonic-gate * 4377c478bd9Sstevel@tonic-gate * returns: 1 - if audit policy and file attributes indicate that 4387c478bd9Sstevel@tonic-gate * file is effectively public. read events for 4397c478bd9Sstevel@tonic-gate * the file should not be audited. 4407c478bd9Sstevel@tonic-gate * 0 - otherwise 4417c478bd9Sstevel@tonic-gate * 4427c478bd9Sstevel@tonic-gate * The required attributes to be considered a public object are: 4437c478bd9Sstevel@tonic-gate * - owned by root, AND 4447c478bd9Sstevel@tonic-gate * - world-readable (permissions for other include read), AND 4457c478bd9Sstevel@tonic-gate * - NOT world-writeable (permissions for other don't 4467c478bd9Sstevel@tonic-gate * include write) 4477c478bd9Sstevel@tonic-gate * (mode doesn't need to be checked for symlinks) 4487c478bd9Sstevel@tonic-gate */ 4497c478bd9Sstevel@tonic-gate int 4507c478bd9Sstevel@tonic-gate file_is_public(struct vattr *attr) 4517c478bd9Sstevel@tonic-gate { 4529e9e6ab8Spaulson au_kcontext_t *kctx = GET_KCTX_PZ; 4537c478bd9Sstevel@tonic-gate 4547c478bd9Sstevel@tonic-gate if (!(kctx->auk_policy & AUDIT_PUBLIC) && (attr->va_uid == 0) && 4557c478bd9Sstevel@tonic-gate ((attr->va_type == VLNK) || 4567c478bd9Sstevel@tonic-gate ((attr->va_mode & (VREAD>>6)) != 0) && 4577c478bd9Sstevel@tonic-gate ((attr->va_mode & (VWRITE>>6)) == 0))) { 4587c478bd9Sstevel@tonic-gate return (1); 4597c478bd9Sstevel@tonic-gate } 4607c478bd9Sstevel@tonic-gate return (0); 4617c478bd9Sstevel@tonic-gate } 4627c478bd9Sstevel@tonic-gate 4637c478bd9Sstevel@tonic-gate 4647c478bd9Sstevel@tonic-gate /* 4657c478bd9Sstevel@tonic-gate * ROUTINE: AUDIT_ATTRIBUTES 466da6c28aaSamw * PURPOSE: Audit the attributes so we can tell why the error occurred 4677c478bd9Sstevel@tonic-gate * CALLBY: AUDIT_SAVEPATH 4687c478bd9Sstevel@tonic-gate * AUDIT_VNCREATE_FINISH 4697c478bd9Sstevel@tonic-gate * AUS_FCHOWN...audit_event.c...audit_path.c 4707c478bd9Sstevel@tonic-gate * NOTE: 4717c478bd9Sstevel@tonic-gate * TODO: 4727c478bd9Sstevel@tonic-gate * QUESTION: 4737c478bd9Sstevel@tonic-gate */ 4747c478bd9Sstevel@tonic-gate void 4757c478bd9Sstevel@tonic-gate audit_attributes(struct vnode *vp) 4767c478bd9Sstevel@tonic-gate { 4777c478bd9Sstevel@tonic-gate struct vattr attr; 4787c478bd9Sstevel@tonic-gate struct t_audit_data *tad; 4797c478bd9Sstevel@tonic-gate 4807c478bd9Sstevel@tonic-gate tad = U2A(u); 4817c478bd9Sstevel@tonic-gate 4827c478bd9Sstevel@tonic-gate if (vp) { 4837c478bd9Sstevel@tonic-gate attr.va_mask = AT_ALL; 484da6c28aaSamw if (VOP_GETATTR(vp, &attr, 0, CRED(), NULL) != 0) 4857c478bd9Sstevel@tonic-gate return; 4867c478bd9Sstevel@tonic-gate 4877c478bd9Sstevel@tonic-gate if (file_is_public(&attr) && (tad->tad_ctrl & PAD_PUBLIC_EV)) { 4887c478bd9Sstevel@tonic-gate /* 4897c478bd9Sstevel@tonic-gate * This is a public object and a "public" event 4907c478bd9Sstevel@tonic-gate * (i.e., read only) -- either by definition 4917c478bd9Sstevel@tonic-gate * (e.g., stat, access...) or by virtue of write access 4927c478bd9Sstevel@tonic-gate * not being requested (e.g. mmap). 4937c478bd9Sstevel@tonic-gate * Flag it in the tad to prevent this audit at the end. 4947c478bd9Sstevel@tonic-gate */ 4957c478bd9Sstevel@tonic-gate tad->tad_ctrl |= PAD_NOAUDIT; 4967c478bd9Sstevel@tonic-gate } else { 4977c478bd9Sstevel@tonic-gate au_uwrite(au_to_attr(&attr)); 49845916cd2Sjpk audit_sec_attributes(&(u_ad), vp); 4997c478bd9Sstevel@tonic-gate } 5007c478bd9Sstevel@tonic-gate } 5017c478bd9Sstevel@tonic-gate } 5027c478bd9Sstevel@tonic-gate 5037c478bd9Sstevel@tonic-gate 5047c478bd9Sstevel@tonic-gate /* 5057c478bd9Sstevel@tonic-gate * ROUTINE: AUDIT_EXIT 5067c478bd9Sstevel@tonic-gate * PURPOSE: 5077c478bd9Sstevel@tonic-gate * CALLBY: EXIT 5087c478bd9Sstevel@tonic-gate * NOTE: 5097c478bd9Sstevel@tonic-gate * TODO: 5107c478bd9Sstevel@tonic-gate * QUESTION: why cmw code as offset by 2 but not here 5117c478bd9Sstevel@tonic-gate */ 5127c478bd9Sstevel@tonic-gate /* ARGSUSED */ 5137c478bd9Sstevel@tonic-gate void 5147c478bd9Sstevel@tonic-gate audit_exit(int code, int what) 5157c478bd9Sstevel@tonic-gate { 5167c478bd9Sstevel@tonic-gate struct t_audit_data *tad; 5177c478bd9Sstevel@tonic-gate tad = U2A(u); 5187c478bd9Sstevel@tonic-gate 5197c478bd9Sstevel@tonic-gate /* 5207c478bd9Sstevel@tonic-gate * tad_scid will be set by audit_start even if we are not auditing 5217c478bd9Sstevel@tonic-gate * the event. 5227c478bd9Sstevel@tonic-gate */ 5237c478bd9Sstevel@tonic-gate if (tad->tad_scid == SYS_exit) { 5247c478bd9Sstevel@tonic-gate /* 5257c478bd9Sstevel@tonic-gate * if we are auditing the exit system call, then complete 5267c478bd9Sstevel@tonic-gate * audit record generation (no return from system call). 5277c478bd9Sstevel@tonic-gate */ 5287c478bd9Sstevel@tonic-gate if (tad->tad_flag && tad->tad_event == AUE_EXIT) 5297c478bd9Sstevel@tonic-gate audit_finish(0, SYS_exit, 0, 0); 5307c478bd9Sstevel@tonic-gate return; 5317c478bd9Sstevel@tonic-gate } 5327c478bd9Sstevel@tonic-gate 5337c478bd9Sstevel@tonic-gate /* 5347c478bd9Sstevel@tonic-gate * Anyone auditing the system call that was aborted? 5357c478bd9Sstevel@tonic-gate */ 5367c478bd9Sstevel@tonic-gate if (tad->tad_flag) { 5377c478bd9Sstevel@tonic-gate au_uwrite(au_to_text("event aborted")); 5387c478bd9Sstevel@tonic-gate audit_finish(0, tad->tad_scid, 0, 0); 5397c478bd9Sstevel@tonic-gate } 5407c478bd9Sstevel@tonic-gate 5417c478bd9Sstevel@tonic-gate /* 5427c478bd9Sstevel@tonic-gate * Generate an audit record for process exit if preselected. 5437c478bd9Sstevel@tonic-gate */ 544005d3febSMarek Pospisil (void) audit_start(0, SYS_exit, AUC_UNSET, 0, 0); 5457c478bd9Sstevel@tonic-gate audit_finish(0, SYS_exit, 0, 0); 5467c478bd9Sstevel@tonic-gate } 5477c478bd9Sstevel@tonic-gate 5487c478bd9Sstevel@tonic-gate /* 5497c478bd9Sstevel@tonic-gate * ROUTINE: AUDIT_CORE_START 5507c478bd9Sstevel@tonic-gate * PURPOSE: 5517c478bd9Sstevel@tonic-gate * CALLBY: PSIG 5527c478bd9Sstevel@tonic-gate * NOTE: 5537c478bd9Sstevel@tonic-gate * TODO: 5547c478bd9Sstevel@tonic-gate */ 5557c478bd9Sstevel@tonic-gate void 5567c478bd9Sstevel@tonic-gate audit_core_start(int sig) 5577c478bd9Sstevel@tonic-gate { 5587c478bd9Sstevel@tonic-gate au_event_t event; 5597c478bd9Sstevel@tonic-gate au_state_t estate; 5607c478bd9Sstevel@tonic-gate t_audit_data_t *tad; 5617c478bd9Sstevel@tonic-gate au_kcontext_t *kctx; 5627c478bd9Sstevel@tonic-gate 5637c478bd9Sstevel@tonic-gate tad = U2A(u); 5647c478bd9Sstevel@tonic-gate 5657c478bd9Sstevel@tonic-gate ASSERT(tad != (t_audit_data_t *)0); 5667c478bd9Sstevel@tonic-gate 5677c478bd9Sstevel@tonic-gate ASSERT(tad->tad_scid == 0); 5687c478bd9Sstevel@tonic-gate ASSERT(tad->tad_event == 0); 5697c478bd9Sstevel@tonic-gate ASSERT(tad->tad_evmod == 0); 5707c478bd9Sstevel@tonic-gate ASSERT(tad->tad_ctrl == 0); 5717c478bd9Sstevel@tonic-gate ASSERT(tad->tad_flag == 0); 5727c478bd9Sstevel@tonic-gate ASSERT(tad->tad_aupath == NULL); 5737c478bd9Sstevel@tonic-gate 5749e9e6ab8Spaulson kctx = GET_KCTX_PZ; 5757c478bd9Sstevel@tonic-gate 5767c478bd9Sstevel@tonic-gate /* get basic event for system call */ 5777c478bd9Sstevel@tonic-gate event = AUE_CORE; 5787c478bd9Sstevel@tonic-gate estate = kctx->auk_ets[event]; 5797c478bd9Sstevel@tonic-gate 5807c478bd9Sstevel@tonic-gate if ((tad->tad_flag = auditme(kctx, tad, estate)) == 0) 5817c478bd9Sstevel@tonic-gate return; 5827c478bd9Sstevel@tonic-gate 5837c478bd9Sstevel@tonic-gate /* reset the flags for non-user attributable events */ 5847c478bd9Sstevel@tonic-gate tad->tad_ctrl = PAD_CORE; 5857c478bd9Sstevel@tonic-gate tad->tad_scid = 0; 5867c478bd9Sstevel@tonic-gate 5877c478bd9Sstevel@tonic-gate /* if auditing not enabled, then don't generate an audit record */ 5887c478bd9Sstevel@tonic-gate 5897c478bd9Sstevel@tonic-gate if (!((kctx->auk_auditstate == AUC_AUDITING || 5907c478bd9Sstevel@tonic-gate kctx->auk_auditstate == AUC_INIT_AUDIT) || 5917c478bd9Sstevel@tonic-gate kctx->auk_auditstate == AUC_NOSPACE)) { 5927c478bd9Sstevel@tonic-gate tad->tad_flag = 0; 5937c478bd9Sstevel@tonic-gate tad->tad_ctrl = 0; 5947c478bd9Sstevel@tonic-gate return; 5957c478bd9Sstevel@tonic-gate } 5967c478bd9Sstevel@tonic-gate 5977c478bd9Sstevel@tonic-gate tad->tad_event = event; 5987c478bd9Sstevel@tonic-gate tad->tad_evmod = 0; 5997c478bd9Sstevel@tonic-gate 6007c478bd9Sstevel@tonic-gate ASSERT(tad->tad_ad == NULL); 6017c478bd9Sstevel@tonic-gate 6027c478bd9Sstevel@tonic-gate au_write(&(u_ad), au_to_arg32(1, "signal", (uint32_t)sig)); 6037c478bd9Sstevel@tonic-gate } 6047c478bd9Sstevel@tonic-gate 6057c478bd9Sstevel@tonic-gate /* 6067c478bd9Sstevel@tonic-gate * ROUTINE: AUDIT_CORE_FINISH 6077c478bd9Sstevel@tonic-gate * PURPOSE: 6087c478bd9Sstevel@tonic-gate * CALLBY: PSIG 6097c478bd9Sstevel@tonic-gate * NOTE: 6107c478bd9Sstevel@tonic-gate * TODO: 6117c478bd9Sstevel@tonic-gate * QUESTION: 6127c478bd9Sstevel@tonic-gate */ 6137c478bd9Sstevel@tonic-gate 6147c478bd9Sstevel@tonic-gate /*ARGSUSED*/ 6157c478bd9Sstevel@tonic-gate void 6167c478bd9Sstevel@tonic-gate audit_core_finish(int code) 6177c478bd9Sstevel@tonic-gate { 6187c478bd9Sstevel@tonic-gate int flag; 6197c478bd9Sstevel@tonic-gate t_audit_data_t *tad; 6207c478bd9Sstevel@tonic-gate au_kcontext_t *kctx; 6217c478bd9Sstevel@tonic-gate 6227c478bd9Sstevel@tonic-gate tad = U2A(u); 6237c478bd9Sstevel@tonic-gate 6247c478bd9Sstevel@tonic-gate ASSERT(tad != (t_audit_data_t *)0); 6257c478bd9Sstevel@tonic-gate 6267c478bd9Sstevel@tonic-gate if ((flag = tad->tad_flag) == 0) { 6277c478bd9Sstevel@tonic-gate tad->tad_event = 0; 6287c478bd9Sstevel@tonic-gate tad->tad_evmod = 0; 6297c478bd9Sstevel@tonic-gate tad->tad_ctrl = 0; 6307c478bd9Sstevel@tonic-gate ASSERT(tad->tad_aupath == NULL); 6317c478bd9Sstevel@tonic-gate return; 6327c478bd9Sstevel@tonic-gate } 6337c478bd9Sstevel@tonic-gate tad->tad_flag = 0; 6347c478bd9Sstevel@tonic-gate 6359e9e6ab8Spaulson kctx = GET_KCTX_PZ; 6367c478bd9Sstevel@tonic-gate 6377c478bd9Sstevel@tonic-gate /* kludge for error 0, should use `code==CLD_DUMPED' instead */ 638799bd290Spwernau if (flag = audit_success(kctx, tad, 0, NULL)) { 6397c478bd9Sstevel@tonic-gate cred_t *cr = CRED(); 6407c478bd9Sstevel@tonic-gate const auditinfo_addr_t *ainfo = crgetauinfo(cr); 6417c478bd9Sstevel@tonic-gate 6427c478bd9Sstevel@tonic-gate ASSERT(ainfo != NULL); 6437c478bd9Sstevel@tonic-gate 6447c478bd9Sstevel@tonic-gate /* 64581490fd2Sgww * Add subject information (no locks since our private copy of 6467c478bd9Sstevel@tonic-gate * credential 6477c478bd9Sstevel@tonic-gate */ 64881490fd2Sgww AUDIT_SETSUBJ(&(u_ad), cr, ainfo, kctx); 64945916cd2Sjpk 6507c478bd9Sstevel@tonic-gate /* Add a return token (should use f argument) */ 6517c478bd9Sstevel@tonic-gate add_return_token((caddr_t *)&(u_ad), tad->tad_scid, 0, 0); 6527c478bd9Sstevel@tonic-gate 6537c478bd9Sstevel@tonic-gate AS_INC(as_generated, 1, kctx); 6547c478bd9Sstevel@tonic-gate AS_INC(as_kernel, 1, kctx); 6557c478bd9Sstevel@tonic-gate } 6567c478bd9Sstevel@tonic-gate 6577c478bd9Sstevel@tonic-gate /* Close up everything */ 658005d3febSMarek Pospisil au_close(kctx, &(u_ad), flag, tad->tad_event, tad->tad_evmod, NULL); 6597c478bd9Sstevel@tonic-gate 6607c478bd9Sstevel@tonic-gate /* free up any space remaining with the path's */ 6617c478bd9Sstevel@tonic-gate if (tad->tad_aupath != NULL) { 6627c478bd9Sstevel@tonic-gate au_pathrele(tad->tad_aupath); 6637c478bd9Sstevel@tonic-gate tad->tad_aupath = NULL; 6647c478bd9Sstevel@tonic-gate tad->tad_vn = NULL; 6657c478bd9Sstevel@tonic-gate } 6667c478bd9Sstevel@tonic-gate tad->tad_event = 0; 6677c478bd9Sstevel@tonic-gate tad->tad_evmod = 0; 6687c478bd9Sstevel@tonic-gate tad->tad_ctrl = 0; 6697c478bd9Sstevel@tonic-gate } 6707c478bd9Sstevel@tonic-gate 6717c478bd9Sstevel@tonic-gate /*ARGSUSED*/ 6727c478bd9Sstevel@tonic-gate void 6737c478bd9Sstevel@tonic-gate audit_stropen(struct vnode *vp, dev_t *devp, int flag, cred_t *crp) 6747c478bd9Sstevel@tonic-gate { 6757c478bd9Sstevel@tonic-gate } 6767c478bd9Sstevel@tonic-gate 6777c478bd9Sstevel@tonic-gate /*ARGSUSED*/ 6787c478bd9Sstevel@tonic-gate void 6797c478bd9Sstevel@tonic-gate audit_strclose(struct vnode *vp, int flag, cred_t *crp) 6807c478bd9Sstevel@tonic-gate { 6817c478bd9Sstevel@tonic-gate } 6827c478bd9Sstevel@tonic-gate 6837c478bd9Sstevel@tonic-gate /*ARGSUSED*/ 6847c478bd9Sstevel@tonic-gate void 6857c478bd9Sstevel@tonic-gate audit_strioctl(struct vnode *vp, int cmd, intptr_t arg, int flag, 6867c478bd9Sstevel@tonic-gate int copyflag, cred_t *crp, int *rvalp) 6877c478bd9Sstevel@tonic-gate { 6887c478bd9Sstevel@tonic-gate } 6897c478bd9Sstevel@tonic-gate 6907c478bd9Sstevel@tonic-gate 6917c478bd9Sstevel@tonic-gate /*ARGSUSED*/ 6927c478bd9Sstevel@tonic-gate void 6937c478bd9Sstevel@tonic-gate audit_strgetmsg(struct vnode *vp, struct strbuf *mctl, struct strbuf *mdata, 6947c478bd9Sstevel@tonic-gate unsigned char *pri, int *flag, int fmode) 6957c478bd9Sstevel@tonic-gate { 6967c478bd9Sstevel@tonic-gate struct stdata *stp; 6977c478bd9Sstevel@tonic-gate t_audit_data_t *tad = U2A(u); 6987c478bd9Sstevel@tonic-gate 6997c478bd9Sstevel@tonic-gate ASSERT(tad != (t_audit_data_t *)0); 7007c478bd9Sstevel@tonic-gate 7017c478bd9Sstevel@tonic-gate stp = vp->v_stream; 7027c478bd9Sstevel@tonic-gate 7037c478bd9Sstevel@tonic-gate /* lock stdata from audit_sock */ 7047c478bd9Sstevel@tonic-gate mutex_enter(&stp->sd_lock); 7057c478bd9Sstevel@tonic-gate 7067c478bd9Sstevel@tonic-gate /* proceed ONLY if user is being audited */ 7077c478bd9Sstevel@tonic-gate if (!tad->tad_flag) { 7087c478bd9Sstevel@tonic-gate /* 7097c478bd9Sstevel@tonic-gate * this is so we will not add audit data onto 7107c478bd9Sstevel@tonic-gate * a thread that is not being audited. 7117c478bd9Sstevel@tonic-gate */ 7127c478bd9Sstevel@tonic-gate stp->sd_t_audit_data = NULL; 7137c478bd9Sstevel@tonic-gate mutex_exit(&stp->sd_lock); 7147c478bd9Sstevel@tonic-gate return; 7157c478bd9Sstevel@tonic-gate } 7167c478bd9Sstevel@tonic-gate 7177c478bd9Sstevel@tonic-gate stp->sd_t_audit_data = (caddr_t)curthread; 7187c478bd9Sstevel@tonic-gate mutex_exit(&stp->sd_lock); 7197c478bd9Sstevel@tonic-gate } 7207c478bd9Sstevel@tonic-gate 7217c478bd9Sstevel@tonic-gate /*ARGSUSED*/ 7227c478bd9Sstevel@tonic-gate void 7237c478bd9Sstevel@tonic-gate audit_strputmsg(struct vnode *vp, struct strbuf *mctl, struct strbuf *mdata, 7247c478bd9Sstevel@tonic-gate unsigned char pri, int flag, int fmode) 7257c478bd9Sstevel@tonic-gate { 7267c478bd9Sstevel@tonic-gate struct stdata *stp; 7277c478bd9Sstevel@tonic-gate t_audit_data_t *tad = U2A(u); 7287c478bd9Sstevel@tonic-gate 7297c478bd9Sstevel@tonic-gate ASSERT(tad != (t_audit_data_t *)0); 7307c478bd9Sstevel@tonic-gate 7317c478bd9Sstevel@tonic-gate stp = vp->v_stream; 7327c478bd9Sstevel@tonic-gate 7337c478bd9Sstevel@tonic-gate /* lock stdata from audit_sock */ 7347c478bd9Sstevel@tonic-gate mutex_enter(&stp->sd_lock); 7357c478bd9Sstevel@tonic-gate 7367c478bd9Sstevel@tonic-gate /* proceed ONLY if user is being audited */ 7377c478bd9Sstevel@tonic-gate if (!tad->tad_flag) { 7387c478bd9Sstevel@tonic-gate /* 7397c478bd9Sstevel@tonic-gate * this is so we will not add audit data onto 7407c478bd9Sstevel@tonic-gate * a thread that is not being audited. 7417c478bd9Sstevel@tonic-gate */ 7427c478bd9Sstevel@tonic-gate stp->sd_t_audit_data = NULL; 7437c478bd9Sstevel@tonic-gate mutex_exit(&stp->sd_lock); 7447c478bd9Sstevel@tonic-gate return; 7457c478bd9Sstevel@tonic-gate } 7467c478bd9Sstevel@tonic-gate 7477c478bd9Sstevel@tonic-gate stp->sd_t_audit_data = (caddr_t)curthread; 7487c478bd9Sstevel@tonic-gate mutex_exit(&stp->sd_lock); 7497c478bd9Sstevel@tonic-gate } 7507c478bd9Sstevel@tonic-gate 7517c478bd9Sstevel@tonic-gate /* 7527c478bd9Sstevel@tonic-gate * ROUTINE: AUDIT_CLOSEF 7537c478bd9Sstevel@tonic-gate * PURPOSE: 7547c478bd9Sstevel@tonic-gate * CALLBY: CLOSEF 7557c478bd9Sstevel@tonic-gate * NOTE: 7567c478bd9Sstevel@tonic-gate * release per file audit resources when file structure is being released. 7577c478bd9Sstevel@tonic-gate * 7587c478bd9Sstevel@tonic-gate * IMPORTANT NOTE: Since we generate an audit record here, we may sleep 7597c478bd9Sstevel@tonic-gate * on the audit queue if it becomes full. This means 7607c478bd9Sstevel@tonic-gate * audit_closef can not be called when f_count == 0. Since 7617c478bd9Sstevel@tonic-gate * f_count == 0 indicates the file structure is free, another 7627c478bd9Sstevel@tonic-gate * process could attempt to use the file while we were still 7637c478bd9Sstevel@tonic-gate * asleep waiting on the audit queue. This would cause the 7647c478bd9Sstevel@tonic-gate * per file audit data to be corrupted when we finally do 7657c478bd9Sstevel@tonic-gate * wakeup. 7667c478bd9Sstevel@tonic-gate * TODO: 7677c478bd9Sstevel@tonic-gate * QUESTION: 7687c478bd9Sstevel@tonic-gate */ 7697c478bd9Sstevel@tonic-gate 7707c478bd9Sstevel@tonic-gate void 7717c478bd9Sstevel@tonic-gate audit_closef(struct file *fp) 7727c478bd9Sstevel@tonic-gate { /* AUDIT_CLOSEF */ 7737c478bd9Sstevel@tonic-gate f_audit_data_t *fad; 7747c478bd9Sstevel@tonic-gate t_audit_data_t *tad; 7757c478bd9Sstevel@tonic-gate int success; 7767c478bd9Sstevel@tonic-gate au_state_t estate; 7777c478bd9Sstevel@tonic-gate struct vnode *vp; 7787c478bd9Sstevel@tonic-gate token_t *ad = NULL; 7797c478bd9Sstevel@tonic-gate struct vattr attr; 780d0fa49b7STony Nguyen au_emod_t evmod = 0; 7817c478bd9Sstevel@tonic-gate const auditinfo_addr_t *ainfo; 7827c478bd9Sstevel@tonic-gate int getattr_ret; 7837c478bd9Sstevel@tonic-gate cred_t *cr; 7849e9e6ab8Spaulson au_kcontext_t *kctx = GET_KCTX_PZ; 785005d3febSMarek Pospisil uint32_t auditing; 7867c478bd9Sstevel@tonic-gate 7877c478bd9Sstevel@tonic-gate fad = F2A(fp); 7887c478bd9Sstevel@tonic-gate estate = kctx->auk_ets[AUE_CLOSE]; 7897c478bd9Sstevel@tonic-gate tad = U2A(u); 7907c478bd9Sstevel@tonic-gate cr = CRED(); 7917c478bd9Sstevel@tonic-gate 7927c478bd9Sstevel@tonic-gate /* audit record already generated by system call envelope */ 7937c478bd9Sstevel@tonic-gate if (tad->tad_event == AUE_CLOSE) { 7947c478bd9Sstevel@tonic-gate /* so close audit event will have bits set */ 795d0fa49b7STony Nguyen tad->tad_evmod |= (au_emod_t)fad->fad_flags; 7967c478bd9Sstevel@tonic-gate return; 7977c478bd9Sstevel@tonic-gate } 7987c478bd9Sstevel@tonic-gate 7997c478bd9Sstevel@tonic-gate /* if auditing not enabled, then don't generate an audit record */ 800005d3febSMarek Pospisil auditing = (tad->tad_audit == AUC_UNSET) ? 801005d3febSMarek Pospisil kctx->auk_auditstate : tad->tad_audit; 802005d3febSMarek Pospisil if (auditing & ~(AUC_AUDITING | AUC_INIT_AUDIT | AUC_NOSPACE)) 8037c478bd9Sstevel@tonic-gate return; 8047c478bd9Sstevel@tonic-gate 8057c478bd9Sstevel@tonic-gate ainfo = crgetauinfo(cr); 8067c478bd9Sstevel@tonic-gate if (ainfo == NULL) 8077c478bd9Sstevel@tonic-gate return; 8087c478bd9Sstevel@tonic-gate 8097c478bd9Sstevel@tonic-gate success = ainfo->ai_mask.as_success & estate; 8107c478bd9Sstevel@tonic-gate 8117c478bd9Sstevel@tonic-gate /* not selected for this event */ 8127c478bd9Sstevel@tonic-gate if (success == 0) 8137c478bd9Sstevel@tonic-gate return; 8147c478bd9Sstevel@tonic-gate 8157c478bd9Sstevel@tonic-gate /* 8167c478bd9Sstevel@tonic-gate * can't use audit_attributes here since we use a private audit area 8177c478bd9Sstevel@tonic-gate * to build the audit record instead of the one off the thread. 8187c478bd9Sstevel@tonic-gate */ 8197c478bd9Sstevel@tonic-gate if ((vp = fp->f_vnode) != NULL) { 8207c478bd9Sstevel@tonic-gate attr.va_mask = AT_ALL; 821da6c28aaSamw getattr_ret = VOP_GETATTR(vp, &attr, 0, CRED(), NULL); 8227c478bd9Sstevel@tonic-gate } 8237c478bd9Sstevel@tonic-gate 8247c478bd9Sstevel@tonic-gate /* 8257c478bd9Sstevel@tonic-gate * When write was not used and the file can be considered public, 8267c478bd9Sstevel@tonic-gate * then skip the audit. 8277c478bd9Sstevel@tonic-gate */ 8287c478bd9Sstevel@tonic-gate if ((getattr_ret == 0) && ((fp->f_flag & FWRITE) == 0)) { 8297c478bd9Sstevel@tonic-gate if (file_is_public(&attr)) { 8307c478bd9Sstevel@tonic-gate return; 8317c478bd9Sstevel@tonic-gate } 8327c478bd9Sstevel@tonic-gate } 8337c478bd9Sstevel@tonic-gate 834d0fa49b7STony Nguyen evmod = (au_emod_t)fad->fad_flags; 8357c478bd9Sstevel@tonic-gate if (fad->fad_aupath != NULL) { 8367c478bd9Sstevel@tonic-gate au_write((caddr_t *)&(ad), au_to_path(fad->fad_aupath)); 8377c478bd9Sstevel@tonic-gate } else { 8387c478bd9Sstevel@tonic-gate #ifdef _LP64 8397c478bd9Sstevel@tonic-gate au_write((caddr_t *)&(ad), au_to_arg64( 8407c478bd9Sstevel@tonic-gate 1, "no path: fp", (uint64_t)fp)); 8417c478bd9Sstevel@tonic-gate #else 8427c478bd9Sstevel@tonic-gate au_write((caddr_t *)&(ad), au_to_arg32( 8437c478bd9Sstevel@tonic-gate 1, "no path: fp", (uint32_t)fp)); 8447c478bd9Sstevel@tonic-gate #endif 8457c478bd9Sstevel@tonic-gate } 8467c478bd9Sstevel@tonic-gate 8477c478bd9Sstevel@tonic-gate if (getattr_ret == 0) { 8487c478bd9Sstevel@tonic-gate au_write((caddr_t *)&(ad), au_to_attr(&attr)); 84945916cd2Sjpk audit_sec_attributes((caddr_t *)&(ad), vp); 8507c478bd9Sstevel@tonic-gate } 8517c478bd9Sstevel@tonic-gate 85281490fd2Sgww /* Add subject information */ 85381490fd2Sgww AUDIT_SETSUBJ((caddr_t *)&(ad), cr, ainfo, kctx); 85445916cd2Sjpk 8557c478bd9Sstevel@tonic-gate /* add a return token */ 8567c478bd9Sstevel@tonic-gate add_return_token((caddr_t *)&(ad), tad->tad_scid, 0, 0); 8577c478bd9Sstevel@tonic-gate 8587c478bd9Sstevel@tonic-gate AS_INC(as_generated, 1, kctx); 8597c478bd9Sstevel@tonic-gate AS_INC(as_kernel, 1, kctx); 8607c478bd9Sstevel@tonic-gate 8617c478bd9Sstevel@tonic-gate /* 8627c478bd9Sstevel@tonic-gate * Close up everything 8637c478bd9Sstevel@tonic-gate * Note: path space recovery handled by normal system 8647c478bd9Sstevel@tonic-gate * call envelope if not at last close. 8657c478bd9Sstevel@tonic-gate * Note there is no failure at this point since 8667c478bd9Sstevel@tonic-gate * this represents closes due to exit of process, 8677c478bd9Sstevel@tonic-gate * thus we always indicate successful closes. 8687c478bd9Sstevel@tonic-gate */ 8697c478bd9Sstevel@tonic-gate au_close(kctx, (caddr_t *)&(ad), AU_OK | AU_DEFER, 870005d3febSMarek Pospisil AUE_CLOSE, evmod, NULL); 8717c478bd9Sstevel@tonic-gate } 8727c478bd9Sstevel@tonic-gate 8737c478bd9Sstevel@tonic-gate /* 8747c478bd9Sstevel@tonic-gate * ROUTINE: AUDIT_SET 8757c478bd9Sstevel@tonic-gate * PURPOSE: Audit the file path and file attributes. 8767c478bd9Sstevel@tonic-gate * CALLBY: SETF 8777c478bd9Sstevel@tonic-gate * NOTE: SETF associate a file pointer with user area's open files. 8787c478bd9Sstevel@tonic-gate * TODO: 8797c478bd9Sstevel@tonic-gate * call audit_finish directly ??? 8807c478bd9Sstevel@tonic-gate * QUESTION: 8817c478bd9Sstevel@tonic-gate */ 8827c478bd9Sstevel@tonic-gate 8837c478bd9Sstevel@tonic-gate /*ARGSUSED*/ 8847c478bd9Sstevel@tonic-gate void 8857c478bd9Sstevel@tonic-gate audit_setf(file_t *fp, int fd) 8867c478bd9Sstevel@tonic-gate { 8877c478bd9Sstevel@tonic-gate f_audit_data_t *fad; 8887c478bd9Sstevel@tonic-gate t_audit_data_t *tad; 8897c478bd9Sstevel@tonic-gate 8907c478bd9Sstevel@tonic-gate if (fp == NULL) 8917c478bd9Sstevel@tonic-gate return; 8927c478bd9Sstevel@tonic-gate 8937c478bd9Sstevel@tonic-gate tad = T2A(curthread); 8947c478bd9Sstevel@tonic-gate fad = F2A(fp); 8957c478bd9Sstevel@tonic-gate 8968fd04b83SRoger A. Faulkner if (!(tad->tad_scid == SYS_open || 8978fd04b83SRoger A. Faulkner tad->tad_scid == SYS_open64 || 8988fd04b83SRoger A. Faulkner tad->tad_scid == SYS_openat || 8998fd04b83SRoger A. Faulkner tad->tad_scid == SYS_openat64)) 9007c478bd9Sstevel@tonic-gate return; 9017c478bd9Sstevel@tonic-gate 9027c478bd9Sstevel@tonic-gate /* no path */ 9037c478bd9Sstevel@tonic-gate if (tad->tad_aupath == 0) 9047c478bd9Sstevel@tonic-gate return; 9057c478bd9Sstevel@tonic-gate 9067c478bd9Sstevel@tonic-gate /* 9077c478bd9Sstevel@tonic-gate * assign path information associated with file audit data 9087c478bd9Sstevel@tonic-gate * use tad hold 9097c478bd9Sstevel@tonic-gate */ 9107c478bd9Sstevel@tonic-gate fad->fad_aupath = tad->tad_aupath; 9117c478bd9Sstevel@tonic-gate tad->tad_aupath = NULL; 9127c478bd9Sstevel@tonic-gate tad->tad_vn = NULL; 9137c478bd9Sstevel@tonic-gate 9147c478bd9Sstevel@tonic-gate if (!(tad->tad_ctrl & PAD_TRUE_CREATE)) { 9158fd04b83SRoger A. Faulkner /* adjust event type by dropping the 'creat' part */ 9167c478bd9Sstevel@tonic-gate switch (tad->tad_event) { 9177c478bd9Sstevel@tonic-gate case AUE_OPEN_RC: 9187c478bd9Sstevel@tonic-gate tad->tad_event = AUE_OPEN_R; 9197c478bd9Sstevel@tonic-gate tad->tad_ctrl |= PAD_PUBLIC_EV; 9207c478bd9Sstevel@tonic-gate break; 9217c478bd9Sstevel@tonic-gate case AUE_OPEN_RTC: 9227c478bd9Sstevel@tonic-gate tad->tad_event = AUE_OPEN_RT; 9237c478bd9Sstevel@tonic-gate break; 9247c478bd9Sstevel@tonic-gate case AUE_OPEN_WC: 9257c478bd9Sstevel@tonic-gate tad->tad_event = AUE_OPEN_W; 9267c478bd9Sstevel@tonic-gate break; 9277c478bd9Sstevel@tonic-gate case AUE_OPEN_WTC: 9287c478bd9Sstevel@tonic-gate tad->tad_event = AUE_OPEN_WT; 9297c478bd9Sstevel@tonic-gate break; 9307c478bd9Sstevel@tonic-gate case AUE_OPEN_RWC: 9317c478bd9Sstevel@tonic-gate tad->tad_event = AUE_OPEN_RW; 9327c478bd9Sstevel@tonic-gate break; 9337c478bd9Sstevel@tonic-gate case AUE_OPEN_RWTC: 9347c478bd9Sstevel@tonic-gate tad->tad_event = AUE_OPEN_RWT; 9357c478bd9Sstevel@tonic-gate break; 9367c478bd9Sstevel@tonic-gate default: 9377c478bd9Sstevel@tonic-gate break; 9387c478bd9Sstevel@tonic-gate } 9397c478bd9Sstevel@tonic-gate } 9407c478bd9Sstevel@tonic-gate } 9417c478bd9Sstevel@tonic-gate 9427c478bd9Sstevel@tonic-gate 9437c478bd9Sstevel@tonic-gate /* 9447c478bd9Sstevel@tonic-gate * ROUTINE: AUDIT_COPEN 9457c478bd9Sstevel@tonic-gate * PURPOSE: 9467c478bd9Sstevel@tonic-gate * CALLBY: COPEN 9477c478bd9Sstevel@tonic-gate * NOTE: 9487c478bd9Sstevel@tonic-gate * TODO: 9497c478bd9Sstevel@tonic-gate * QUESTION: 9507c478bd9Sstevel@tonic-gate */ 9517c478bd9Sstevel@tonic-gate /*ARGSUSED*/ 9527c478bd9Sstevel@tonic-gate void 9537c478bd9Sstevel@tonic-gate audit_copen(int fd, file_t *fp, vnode_t *vp) 9547c478bd9Sstevel@tonic-gate { 9557c478bd9Sstevel@tonic-gate } 9567c478bd9Sstevel@tonic-gate 9577c478bd9Sstevel@tonic-gate void 9587c478bd9Sstevel@tonic-gate audit_ipc(int type, int id, void *vp) 9597c478bd9Sstevel@tonic-gate { 9607c478bd9Sstevel@tonic-gate /* if not auditing this event, then do nothing */ 9617c478bd9Sstevel@tonic-gate if (ad_flag == 0) 9627c478bd9Sstevel@tonic-gate return; 9637c478bd9Sstevel@tonic-gate 9647c478bd9Sstevel@tonic-gate switch (type) { 9657c478bd9Sstevel@tonic-gate case AT_IPC_MSG: 9667c478bd9Sstevel@tonic-gate au_uwrite(au_to_ipc(AT_IPC_MSG, id)); 9677c478bd9Sstevel@tonic-gate au_uwrite(au_to_ipc_perm(&(((kmsqid_t *)vp)->msg_perm))); 9687c478bd9Sstevel@tonic-gate break; 9697c478bd9Sstevel@tonic-gate case AT_IPC_SEM: 9707c478bd9Sstevel@tonic-gate au_uwrite(au_to_ipc(AT_IPC_SEM, id)); 9717c478bd9Sstevel@tonic-gate au_uwrite(au_to_ipc_perm(&(((ksemid_t *)vp)->sem_perm))); 9727c478bd9Sstevel@tonic-gate break; 9737c478bd9Sstevel@tonic-gate case AT_IPC_SHM: 9747c478bd9Sstevel@tonic-gate au_uwrite(au_to_ipc(AT_IPC_SHM, id)); 9757c478bd9Sstevel@tonic-gate au_uwrite(au_to_ipc_perm(&(((kshmid_t *)vp)->shm_perm))); 9767c478bd9Sstevel@tonic-gate break; 9777c478bd9Sstevel@tonic-gate } 9787c478bd9Sstevel@tonic-gate } 9797c478bd9Sstevel@tonic-gate 9807c478bd9Sstevel@tonic-gate void 9817c478bd9Sstevel@tonic-gate audit_ipcget(int type, void *vp) 9827c478bd9Sstevel@tonic-gate { 9837c478bd9Sstevel@tonic-gate /* if not auditing this event, then do nothing */ 9847c478bd9Sstevel@tonic-gate if (ad_flag == 0) 9857c478bd9Sstevel@tonic-gate return; 9867c478bd9Sstevel@tonic-gate 9877c478bd9Sstevel@tonic-gate switch (type) { 9887c478bd9Sstevel@tonic-gate case NULL: 9897c478bd9Sstevel@tonic-gate au_uwrite(au_to_ipc_perm((struct kipc_perm *)vp)); 9907c478bd9Sstevel@tonic-gate break; 9917c478bd9Sstevel@tonic-gate case AT_IPC_MSG: 9927c478bd9Sstevel@tonic-gate au_uwrite(au_to_ipc_perm(&(((kmsqid_t *)vp)->msg_perm))); 9937c478bd9Sstevel@tonic-gate break; 9947c478bd9Sstevel@tonic-gate case AT_IPC_SEM: 9957c478bd9Sstevel@tonic-gate au_uwrite(au_to_ipc_perm(&(((ksemid_t *)vp)->sem_perm))); 9967c478bd9Sstevel@tonic-gate break; 9977c478bd9Sstevel@tonic-gate case AT_IPC_SHM: 9987c478bd9Sstevel@tonic-gate au_uwrite(au_to_ipc_perm(&(((kshmid_t *)vp)->shm_perm))); 9997c478bd9Sstevel@tonic-gate break; 10007c478bd9Sstevel@tonic-gate } 10017c478bd9Sstevel@tonic-gate } 10027c478bd9Sstevel@tonic-gate 10037c478bd9Sstevel@tonic-gate /* 10047c478bd9Sstevel@tonic-gate * ROUTINE: AUDIT_REBOOT 10057c478bd9Sstevel@tonic-gate * PURPOSE: 10067c478bd9Sstevel@tonic-gate * CALLBY: 10077c478bd9Sstevel@tonic-gate * NOTE: 10087c478bd9Sstevel@tonic-gate * At this point we know that the system call reboot will not return. We thus 10097c478bd9Sstevel@tonic-gate * have to complete the audit record generation and put it onto the queue. 10107c478bd9Sstevel@tonic-gate * This might be fairly useless if the auditing daemon is already dead.... 10117c478bd9Sstevel@tonic-gate * TODO: 10127c478bd9Sstevel@tonic-gate * QUESTION: who calls audit_reboot 10137c478bd9Sstevel@tonic-gate */ 10147c478bd9Sstevel@tonic-gate 10157c478bd9Sstevel@tonic-gate void 10167c478bd9Sstevel@tonic-gate audit_reboot(void) 10177c478bd9Sstevel@tonic-gate { 10187c478bd9Sstevel@tonic-gate int flag; 10197c478bd9Sstevel@tonic-gate t_audit_data_t *tad; 10209e9e6ab8Spaulson au_kcontext_t *kctx = GET_KCTX_PZ; 10217c478bd9Sstevel@tonic-gate 10227c478bd9Sstevel@tonic-gate tad = U2A(u); 10237c478bd9Sstevel@tonic-gate 10247c478bd9Sstevel@tonic-gate /* if not auditing this event, then do nothing */ 10257c478bd9Sstevel@tonic-gate if (tad->tad_flag == 0) 10267c478bd9Sstevel@tonic-gate return; 10277c478bd9Sstevel@tonic-gate 10287c478bd9Sstevel@tonic-gate /* do preselection on success/failure */ 1029799bd290Spwernau if (flag = audit_success(kctx, tad, 0, NULL)) { 10307c478bd9Sstevel@tonic-gate /* add a process token */ 10317c478bd9Sstevel@tonic-gate 10327c478bd9Sstevel@tonic-gate cred_t *cr = CRED(); 10337c478bd9Sstevel@tonic-gate const auditinfo_addr_t *ainfo = crgetauinfo(cr); 10347c478bd9Sstevel@tonic-gate 10357c478bd9Sstevel@tonic-gate if (ainfo == NULL) 10367c478bd9Sstevel@tonic-gate return; 10377c478bd9Sstevel@tonic-gate 103881490fd2Sgww /* Add subject information */ 103981490fd2Sgww AUDIT_SETSUBJ(&(u_ad), cr, ainfo, kctx); 104045916cd2Sjpk 10417c478bd9Sstevel@tonic-gate /* add a return token */ 10427c478bd9Sstevel@tonic-gate add_return_token((caddr_t *)&(u_ad), tad->tad_scid, 0, 0); 10437c478bd9Sstevel@tonic-gate 10447c478bd9Sstevel@tonic-gate AS_INC(as_generated, 1, kctx); 10457c478bd9Sstevel@tonic-gate AS_INC(as_kernel, 1, kctx); 10467c478bd9Sstevel@tonic-gate } 10477c478bd9Sstevel@tonic-gate 10487c478bd9Sstevel@tonic-gate /* 10497c478bd9Sstevel@tonic-gate * Flow control useless here since we're going 10507c478bd9Sstevel@tonic-gate * to drop everything in the queue anyway. Why 10517c478bd9Sstevel@tonic-gate * block and wait. There aint anyone left alive to 10527c478bd9Sstevel@tonic-gate * read the records remaining anyway. 10537c478bd9Sstevel@tonic-gate */ 10547c478bd9Sstevel@tonic-gate 10557c478bd9Sstevel@tonic-gate /* Close up everything */ 10567c478bd9Sstevel@tonic-gate au_close(kctx, &(u_ad), flag | AU_DONTBLOCK, 1057005d3febSMarek Pospisil tad->tad_event, tad->tad_evmod, NULL); 10587c478bd9Sstevel@tonic-gate } 10597c478bd9Sstevel@tonic-gate 10607c478bd9Sstevel@tonic-gate void 10617c478bd9Sstevel@tonic-gate audit_setfsat_path(int argnum) 10627c478bd9Sstevel@tonic-gate { 10637c478bd9Sstevel@tonic-gate klwp_id_t clwp = ttolwp(curthread); 10647c478bd9Sstevel@tonic-gate struct file *fp; 10657c478bd9Sstevel@tonic-gate uint32_t fd; 10667c478bd9Sstevel@tonic-gate t_audit_data_t *tad; 10677c478bd9Sstevel@tonic-gate struct f_audit_data *fad; 10687c478bd9Sstevel@tonic-gate p_audit_data_t *pad; /* current process */ 1069da6c28aaSamw struct a { 1070da6c28aaSamw long arg1; 1071da6c28aaSamw long arg2; 1072da6c28aaSamw long arg3; 1073da6c28aaSamw long arg4; 1074da6c28aaSamw long arg5; 1075da6c28aaSamw } *uap; 10767c478bd9Sstevel@tonic-gate 10777c478bd9Sstevel@tonic-gate if (clwp == NULL) 10787c478bd9Sstevel@tonic-gate return; 1079da6c28aaSamw uap = (struct a *)clwp->lwp_ap; 10807c478bd9Sstevel@tonic-gate 10817c478bd9Sstevel@tonic-gate tad = U2A(u); 10827c478bd9Sstevel@tonic-gate ASSERT(tad != NULL); 10837c478bd9Sstevel@tonic-gate 10848fd04b83SRoger A. Faulkner switch (tad->tad_scid) { 10858fd04b83SRoger A. Faulkner case SYS_faccessat: 10868fd04b83SRoger A. Faulkner case SYS_fchownat: 10878fd04b83SRoger A. Faulkner case SYS_fstatat: 10888fd04b83SRoger A. Faulkner case SYS_fstatat64: 10898fd04b83SRoger A. Faulkner case SYS_openat: 10908fd04b83SRoger A. Faulkner case SYS_openat64: 10918fd04b83SRoger A. Faulkner case SYS_unlinkat: 10928fd04b83SRoger A. Faulkner fd = uap->arg1; 10937c478bd9Sstevel@tonic-gate break; 10948fd04b83SRoger A. Faulkner case SYS_renameat: 10958fd04b83SRoger A. Faulkner if (argnum == 3) 10968fd04b83SRoger A. Faulkner fd = uap->arg3; 10978fd04b83SRoger A. Faulkner else 10988fd04b83SRoger A. Faulkner fd = uap->arg1; 10997c478bd9Sstevel@tonic-gate break; 11008fd04b83SRoger A. Faulkner case SYS_utimesys: 11018fd04b83SRoger A. Faulkner fd = uap->arg2; 11027c478bd9Sstevel@tonic-gate break; 11037c478bd9Sstevel@tonic-gate default: 11047c478bd9Sstevel@tonic-gate return; 11057c478bd9Sstevel@tonic-gate } 11067c478bd9Sstevel@tonic-gate 11077c478bd9Sstevel@tonic-gate if (tad->tad_atpath != NULL) { 11087c478bd9Sstevel@tonic-gate au_pathrele(tad->tad_atpath); 11097c478bd9Sstevel@tonic-gate tad->tad_atpath = NULL; 11107c478bd9Sstevel@tonic-gate } 11117c478bd9Sstevel@tonic-gate if (fd != AT_FDCWD) { 1112fc960aa7SBrent Paulson if ((fp = getf(fd)) == NULL) { 1113fc960aa7SBrent Paulson tad->tad_ctrl |= PAD_NOPATH; 11147c478bd9Sstevel@tonic-gate return; 1115fc960aa7SBrent Paulson } 11167c478bd9Sstevel@tonic-gate fad = F2A(fp); 11177c478bd9Sstevel@tonic-gate ASSERT(fad); 1118fc960aa7SBrent Paulson if (fad->fad_aupath == NULL) { 1119fc960aa7SBrent Paulson tad->tad_ctrl |= PAD_NOPATH; 1120fc960aa7SBrent Paulson releasef(fd); 1121fc960aa7SBrent Paulson return; 1122fc960aa7SBrent Paulson } 11237c478bd9Sstevel@tonic-gate au_pathhold(fad->fad_aupath); 11247c478bd9Sstevel@tonic-gate tad->tad_atpath = fad->fad_aupath; 11257c478bd9Sstevel@tonic-gate releasef(fd); 11267c478bd9Sstevel@tonic-gate } else { 11277c478bd9Sstevel@tonic-gate pad = P2A(curproc); 11287c478bd9Sstevel@tonic-gate mutex_enter(&pad->pad_lock); 11297c478bd9Sstevel@tonic-gate au_pathhold(pad->pad_cwd); 11307c478bd9Sstevel@tonic-gate tad->tad_atpath = pad->pad_cwd; 11317c478bd9Sstevel@tonic-gate mutex_exit(&pad->pad_lock); 11327c478bd9Sstevel@tonic-gate } 11337c478bd9Sstevel@tonic-gate } 11347c478bd9Sstevel@tonic-gate 11357c478bd9Sstevel@tonic-gate void 11367c478bd9Sstevel@tonic-gate audit_symlink_create(vnode_t *dvp, char *sname, char *target, int error) 11377c478bd9Sstevel@tonic-gate { 11387c478bd9Sstevel@tonic-gate t_audit_data_t *tad; 11397c478bd9Sstevel@tonic-gate vnode_t *vp; 11407c478bd9Sstevel@tonic-gate 11417c478bd9Sstevel@tonic-gate tad = U2A(u); 11427c478bd9Sstevel@tonic-gate 11437c478bd9Sstevel@tonic-gate /* if not auditing this event, then do nothing */ 11447c478bd9Sstevel@tonic-gate if (tad->tad_flag == 0) 11457c478bd9Sstevel@tonic-gate return; 11467c478bd9Sstevel@tonic-gate 11477c478bd9Sstevel@tonic-gate au_uwrite(au_to_text(target)); 11487c478bd9Sstevel@tonic-gate 11497c478bd9Sstevel@tonic-gate if (error) 11507c478bd9Sstevel@tonic-gate return; 11517c478bd9Sstevel@tonic-gate 1152da6c28aaSamw error = VOP_LOOKUP(dvp, sname, &vp, NULL, 0, NULL, CRED(), 115351d48dedSMarek Pospisil NULL, NULL, NULL); 11547c478bd9Sstevel@tonic-gate if (error == 0) { 11557c478bd9Sstevel@tonic-gate audit_attributes(vp); 11567c478bd9Sstevel@tonic-gate VN_RELE(vp); 11577c478bd9Sstevel@tonic-gate } 11587c478bd9Sstevel@tonic-gate } 11597c478bd9Sstevel@tonic-gate 11607c478bd9Sstevel@tonic-gate /* 11617c478bd9Sstevel@tonic-gate * ROUTINE: AUDIT_VNCREATE_START 11627c478bd9Sstevel@tonic-gate * PURPOSE: set flag so path name lookup in create will not add attribute 11637c478bd9Sstevel@tonic-gate * CALLBY: VN_CREATE 11647c478bd9Sstevel@tonic-gate * NOTE: 11657c478bd9Sstevel@tonic-gate * TODO: 11667c478bd9Sstevel@tonic-gate * QUESTION: 11677c478bd9Sstevel@tonic-gate */ 11687c478bd9Sstevel@tonic-gate 11697c478bd9Sstevel@tonic-gate void 11707c478bd9Sstevel@tonic-gate audit_vncreate_start() 11717c478bd9Sstevel@tonic-gate { 11727c478bd9Sstevel@tonic-gate t_audit_data_t *tad; 11737c478bd9Sstevel@tonic-gate 11747c478bd9Sstevel@tonic-gate tad = U2A(u); 11757c478bd9Sstevel@tonic-gate tad->tad_ctrl |= PAD_NOATTRB; 11767c478bd9Sstevel@tonic-gate } 11777c478bd9Sstevel@tonic-gate 11787c478bd9Sstevel@tonic-gate /* 11797c478bd9Sstevel@tonic-gate * ROUTINE: AUDIT_VNCREATE_FINISH 11807c478bd9Sstevel@tonic-gate * PURPOSE: 11817c478bd9Sstevel@tonic-gate * CALLBY: VN_CREATE 11827c478bd9Sstevel@tonic-gate * NOTE: 11837c478bd9Sstevel@tonic-gate * TODO: 11847c478bd9Sstevel@tonic-gate * QUESTION: 11857c478bd9Sstevel@tonic-gate */ 11867c478bd9Sstevel@tonic-gate void 11877c478bd9Sstevel@tonic-gate audit_vncreate_finish(struct vnode *vp, int error) 11887c478bd9Sstevel@tonic-gate { 11897c478bd9Sstevel@tonic-gate t_audit_data_t *tad; 11907c478bd9Sstevel@tonic-gate 11917c478bd9Sstevel@tonic-gate if (error) 11927c478bd9Sstevel@tonic-gate return; 11937c478bd9Sstevel@tonic-gate 11947c478bd9Sstevel@tonic-gate tad = U2A(u); 11957c478bd9Sstevel@tonic-gate 11967c478bd9Sstevel@tonic-gate /* if not auditing this event, then do nothing */ 11977c478bd9Sstevel@tonic-gate if (tad->tad_flag == 0) 11987c478bd9Sstevel@tonic-gate return; 11997c478bd9Sstevel@tonic-gate 12007c478bd9Sstevel@tonic-gate if (tad->tad_ctrl & PAD_TRUE_CREATE) { 12017c478bd9Sstevel@tonic-gate audit_attributes(vp); 12027c478bd9Sstevel@tonic-gate } 12037c478bd9Sstevel@tonic-gate 12047c478bd9Sstevel@tonic-gate if (tad->tad_ctrl & PAD_CORE) { 12057c478bd9Sstevel@tonic-gate audit_attributes(vp); 12067c478bd9Sstevel@tonic-gate tad->tad_ctrl &= ~PAD_CORE; 12077c478bd9Sstevel@tonic-gate } 12087c478bd9Sstevel@tonic-gate 12097c478bd9Sstevel@tonic-gate if (!error && ((tad->tad_event == AUE_MKNOD) || 121051d48dedSMarek Pospisil (tad->tad_event == AUE_MKDIR))) { 12117c478bd9Sstevel@tonic-gate audit_attributes(vp); 12127c478bd9Sstevel@tonic-gate } 12137c478bd9Sstevel@tonic-gate 12147c478bd9Sstevel@tonic-gate /* for case where multiple lookups in one syscall (rename) */ 12157c478bd9Sstevel@tonic-gate tad->tad_ctrl &= ~PAD_NOATTRB; 12167c478bd9Sstevel@tonic-gate } 12177c478bd9Sstevel@tonic-gate 12187c478bd9Sstevel@tonic-gate 12197c478bd9Sstevel@tonic-gate 12207c478bd9Sstevel@tonic-gate 12217c478bd9Sstevel@tonic-gate 12227c478bd9Sstevel@tonic-gate 12237c478bd9Sstevel@tonic-gate 12247c478bd9Sstevel@tonic-gate 12257c478bd9Sstevel@tonic-gate /* 12267c478bd9Sstevel@tonic-gate * ROUTINE: AUDIT_EXEC 12277c478bd9Sstevel@tonic-gate * PURPOSE: Records the function arguments and environment variables 12287c478bd9Sstevel@tonic-gate * CALLBY: EXEC_ARGS 12297c478bd9Sstevel@tonic-gate * NOTE: 12307c478bd9Sstevel@tonic-gate * TODO: 12317c478bd9Sstevel@tonic-gate * QUESTION: 12327c478bd9Sstevel@tonic-gate */ 12337c478bd9Sstevel@tonic-gate 12347c478bd9Sstevel@tonic-gate void 12357c478bd9Sstevel@tonic-gate audit_exec( 12367c478bd9Sstevel@tonic-gate const char *argstr, /* argument strings */ 12377c478bd9Sstevel@tonic-gate const char *envstr, /* environment strings */ 12387c478bd9Sstevel@tonic-gate ssize_t argc, /* total # arguments */ 1239*134a1f4eSCasper H.S. Dik ssize_t envc, /* total # environment variables */ 1240*134a1f4eSCasper H.S. Dik cred_t *pfcred) /* the additional privileges in a profile */ 12417c478bd9Sstevel@tonic-gate { 12427c478bd9Sstevel@tonic-gate t_audit_data_t *tad; 12439e9e6ab8Spaulson au_kcontext_t *kctx = GET_KCTX_PZ; 12447c478bd9Sstevel@tonic-gate 12457c478bd9Sstevel@tonic-gate tad = U2A(u); 12467c478bd9Sstevel@tonic-gate 12477c478bd9Sstevel@tonic-gate /* if not auditing this event, then do nothing */ 12487c478bd9Sstevel@tonic-gate if (!tad->tad_flag) 12497c478bd9Sstevel@tonic-gate return; 12507c478bd9Sstevel@tonic-gate 1251*134a1f4eSCasper H.S. Dik if (pfcred != NULL) { 1252*134a1f4eSCasper H.S. Dik p_audit_data_t *pad; 1253*134a1f4eSCasper H.S. Dik cred_t *cr = CRED(); 1254*134a1f4eSCasper H.S. Dik priv_set_t pset = CR_IPRIV(cr); 12557c478bd9Sstevel@tonic-gate 1256*134a1f4eSCasper H.S. Dik pad = P2A(curproc); 1257*134a1f4eSCasper H.S. Dik 1258*134a1f4eSCasper H.S. Dik /* It's a different event. */ 1259*134a1f4eSCasper H.S. Dik tad->tad_event = AUE_PFEXEC; 1260*134a1f4eSCasper H.S. Dik 1261*134a1f4eSCasper H.S. Dik /* Add the current working directory to the audit trail. */ 1262*134a1f4eSCasper H.S. Dik if (pad->pad_cwd != NULL) 1263*134a1f4eSCasper H.S. Dik au_uwrite(au_to_path(pad->pad_cwd)); 1264*134a1f4eSCasper H.S. Dik 1265*134a1f4eSCasper H.S. Dik /* 1266*134a1f4eSCasper H.S. Dik * The new credential is not yet in place when audit_exec 1267*134a1f4eSCasper H.S. Dik * is called. 1268*134a1f4eSCasper H.S. Dik * Compute the additional bits available in the new credential 1269*134a1f4eSCasper H.S. Dik * and the limit set. 1270*134a1f4eSCasper H.S. Dik */ 1271*134a1f4eSCasper H.S. Dik priv_inverse(&pset); 1272*134a1f4eSCasper H.S. Dik priv_intersect(&CR_IPRIV(pfcred), &pset); 1273*134a1f4eSCasper H.S. Dik if (!priv_isemptyset(&pset) || 1274*134a1f4eSCasper H.S. Dik !priv_isequalset(&CR_LPRIV(pfcred), &CR_LPRIV(cr))) { 1275*134a1f4eSCasper H.S. Dik au_uwrite(au_to_privset( 1276*134a1f4eSCasper H.S. Dik priv_getsetbynum(PRIV_INHERITABLE), &pset, AUT_PRIV, 1277*134a1f4eSCasper H.S. Dik 0)); 1278*134a1f4eSCasper H.S. Dik au_uwrite(au_to_privset(priv_getsetbynum(PRIV_LIMIT), 1279*134a1f4eSCasper H.S. Dik &CR_LPRIV(pfcred), AUT_PRIV, 0)); 1280*134a1f4eSCasper H.S. Dik } 1281*134a1f4eSCasper H.S. Dik /* 1282*134a1f4eSCasper H.S. Dik * Compare the uids & gids: create a process token if changed. 1283*134a1f4eSCasper H.S. Dik */ 1284*134a1f4eSCasper H.S. Dik if (crgetuid(cr) != crgetuid(pfcred) || 1285*134a1f4eSCasper H.S. Dik crgetruid(cr) != crgetruid(pfcred) || 1286*134a1f4eSCasper H.S. Dik crgetgid(cr) != crgetgid(pfcred) || 1287*134a1f4eSCasper H.S. Dik crgetrgid(cr) != crgetrgid(pfcred)) { 1288*134a1f4eSCasper H.S. Dik AUDIT_SETPROC(&(u_ad), cr, crgetauinfo(cr)); 1289*134a1f4eSCasper H.S. Dik } 12907c478bd9Sstevel@tonic-gate } 12917c478bd9Sstevel@tonic-gate 1292*134a1f4eSCasper H.S. Dik if (pfcred != NULL || (kctx->auk_policy & AUDIT_ARGV) != 0) 1293*134a1f4eSCasper H.S. Dik au_uwrite(au_to_exec_args(argstr, argc)); 1294*134a1f4eSCasper H.S. Dik 1295*134a1f4eSCasper H.S. Dik if (kctx->auk_policy & AUDIT_ARGE) 12967c478bd9Sstevel@tonic-gate au_uwrite(au_to_exec_env(envstr, envc)); 12977c478bd9Sstevel@tonic-gate } 12987c478bd9Sstevel@tonic-gate 12997c478bd9Sstevel@tonic-gate /* 13007c478bd9Sstevel@tonic-gate * ROUTINE: AUDIT_ENTERPROM 13017c478bd9Sstevel@tonic-gate * PURPOSE: 13027c478bd9Sstevel@tonic-gate * CALLBY: KBDINPUT 13037c478bd9Sstevel@tonic-gate * ZSA_XSINT 13047c478bd9Sstevel@tonic-gate * NOTE: 13057c478bd9Sstevel@tonic-gate * TODO: 13067c478bd9Sstevel@tonic-gate * QUESTION: 13077c478bd9Sstevel@tonic-gate */ 13087c478bd9Sstevel@tonic-gate void 13097c478bd9Sstevel@tonic-gate audit_enterprom(int flg) 13107c478bd9Sstevel@tonic-gate { 13117c478bd9Sstevel@tonic-gate token_t *rp = NULL; 13127c478bd9Sstevel@tonic-gate int sorf; 13137c478bd9Sstevel@tonic-gate 13147c478bd9Sstevel@tonic-gate if (flg) 13157c478bd9Sstevel@tonic-gate sorf = AUM_SUCC; 13167c478bd9Sstevel@tonic-gate else 13177c478bd9Sstevel@tonic-gate sorf = AUM_FAIL; 13187c478bd9Sstevel@tonic-gate 13197c478bd9Sstevel@tonic-gate AUDIT_ASYNC_START(rp, AUE_ENTERPROM, sorf); 13207c478bd9Sstevel@tonic-gate 13217c478bd9Sstevel@tonic-gate au_write((caddr_t *)&(rp), au_to_text("kmdb")); 13227c478bd9Sstevel@tonic-gate 13237c478bd9Sstevel@tonic-gate if (flg) 13247c478bd9Sstevel@tonic-gate au_write((caddr_t *)&(rp), au_to_return32(0, 0)); 13257c478bd9Sstevel@tonic-gate else 13267c478bd9Sstevel@tonic-gate au_write((caddr_t *)&(rp), au_to_return32(ECANCELED, 0)); 13277c478bd9Sstevel@tonic-gate 1328005d3febSMarek Pospisil AUDIT_ASYNC_FINISH(rp, AUE_ENTERPROM, NULL, NULL); 13297c478bd9Sstevel@tonic-gate } 13307c478bd9Sstevel@tonic-gate 13317c478bd9Sstevel@tonic-gate 13327c478bd9Sstevel@tonic-gate /* 13337c478bd9Sstevel@tonic-gate * ROUTINE: AUDIT_EXITPROM 13347c478bd9Sstevel@tonic-gate * PURPOSE: 13357c478bd9Sstevel@tonic-gate * CALLBY: KBDINPUT 13367c478bd9Sstevel@tonic-gate * ZSA_XSINT 13377c478bd9Sstevel@tonic-gate * NOTE: 13387c478bd9Sstevel@tonic-gate * TODO: 13397c478bd9Sstevel@tonic-gate * QUESTION: 13407c478bd9Sstevel@tonic-gate */ 13417c478bd9Sstevel@tonic-gate void 13427c478bd9Sstevel@tonic-gate audit_exitprom(int flg) 13437c478bd9Sstevel@tonic-gate { 13447c478bd9Sstevel@tonic-gate int sorf; 13457c478bd9Sstevel@tonic-gate token_t *rp = NULL; 13467c478bd9Sstevel@tonic-gate 13477c478bd9Sstevel@tonic-gate if (flg) 13487c478bd9Sstevel@tonic-gate sorf = AUM_SUCC; 13497c478bd9Sstevel@tonic-gate else 13507c478bd9Sstevel@tonic-gate sorf = AUM_FAIL; 13517c478bd9Sstevel@tonic-gate 13527c478bd9Sstevel@tonic-gate AUDIT_ASYNC_START(rp, AUE_EXITPROM, sorf); 13537c478bd9Sstevel@tonic-gate 13547c478bd9Sstevel@tonic-gate au_write((caddr_t *)&(rp), au_to_text("kmdb")); 13557c478bd9Sstevel@tonic-gate 13567c478bd9Sstevel@tonic-gate if (flg) 13577c478bd9Sstevel@tonic-gate au_write((caddr_t *)&(rp), au_to_return32(0, 0)); 13587c478bd9Sstevel@tonic-gate else 13597c478bd9Sstevel@tonic-gate au_write((caddr_t *)&(rp), au_to_return32(ECANCELED, 0)); 13607c478bd9Sstevel@tonic-gate 1361005d3febSMarek Pospisil AUDIT_ASYNC_FINISH(rp, AUE_EXITPROM, NULL, NULL); 13627c478bd9Sstevel@tonic-gate } 13637c478bd9Sstevel@tonic-gate 13647c478bd9Sstevel@tonic-gate struct fcntla { 13657c478bd9Sstevel@tonic-gate int fdes; 13667c478bd9Sstevel@tonic-gate int cmd; 13677c478bd9Sstevel@tonic-gate intptr_t arg; 13687c478bd9Sstevel@tonic-gate }; 13697c478bd9Sstevel@tonic-gate 13707c478bd9Sstevel@tonic-gate /* 13717c478bd9Sstevel@tonic-gate * ROUTINE: AUDIT_C2_REVOKE 13727c478bd9Sstevel@tonic-gate * PURPOSE: 13737c478bd9Sstevel@tonic-gate * CALLBY: FCNTL 13747c478bd9Sstevel@tonic-gate * NOTE: 13757c478bd9Sstevel@tonic-gate * TODO: 13767c478bd9Sstevel@tonic-gate * QUESTION: are we keeping this func 13777c478bd9Sstevel@tonic-gate */ 13787c478bd9Sstevel@tonic-gate 13797c478bd9Sstevel@tonic-gate /*ARGSUSED*/ 13807c478bd9Sstevel@tonic-gate int 13817c478bd9Sstevel@tonic-gate audit_c2_revoke(struct fcntla *uap, rval_t *rvp) 13827c478bd9Sstevel@tonic-gate { 13837c478bd9Sstevel@tonic-gate return (0); 13847c478bd9Sstevel@tonic-gate } 13857c478bd9Sstevel@tonic-gate 13867c478bd9Sstevel@tonic-gate 13877c478bd9Sstevel@tonic-gate /* 13887c478bd9Sstevel@tonic-gate * ROUTINE: AUDIT_CHDIREC 13897c478bd9Sstevel@tonic-gate * PURPOSE: 13907c478bd9Sstevel@tonic-gate * CALLBY: CHDIREC 13917c478bd9Sstevel@tonic-gate * NOTE: The main function of CHDIREC 13927c478bd9Sstevel@tonic-gate * TODO: Move the audit_chdirec hook above the VN_RELE in vncalls.c 13937c478bd9Sstevel@tonic-gate * QUESTION: 13947c478bd9Sstevel@tonic-gate */ 13957c478bd9Sstevel@tonic-gate 13967c478bd9Sstevel@tonic-gate /*ARGSUSED*/ 13977c478bd9Sstevel@tonic-gate void 13987c478bd9Sstevel@tonic-gate audit_chdirec(vnode_t *vp, vnode_t **vpp) 13997c478bd9Sstevel@tonic-gate { 14007c478bd9Sstevel@tonic-gate int chdir; 14017c478bd9Sstevel@tonic-gate int fchdir; 14027c478bd9Sstevel@tonic-gate struct audit_path **appp; 14037c478bd9Sstevel@tonic-gate struct file *fp; 14047c478bd9Sstevel@tonic-gate f_audit_data_t *fad; 14057c478bd9Sstevel@tonic-gate p_audit_data_t *pad = P2A(curproc); 14067c478bd9Sstevel@tonic-gate t_audit_data_t *tad = T2A(curthread); 14077c478bd9Sstevel@tonic-gate 14087c478bd9Sstevel@tonic-gate struct a { 14097c478bd9Sstevel@tonic-gate long fd; 14107c478bd9Sstevel@tonic-gate } *uap = (struct a *)ttolwp(curthread)->lwp_ap; 14117c478bd9Sstevel@tonic-gate 14127c478bd9Sstevel@tonic-gate if ((tad->tad_scid == SYS_chdir) || (tad->tad_scid == SYS_chroot)) { 14137c478bd9Sstevel@tonic-gate chdir = tad->tad_scid == SYS_chdir; 14147c478bd9Sstevel@tonic-gate if (tad->tad_aupath) { 14157c478bd9Sstevel@tonic-gate mutex_enter(&pad->pad_lock); 14167c478bd9Sstevel@tonic-gate if (chdir) 14177c478bd9Sstevel@tonic-gate appp = &(pad->pad_cwd); 14187c478bd9Sstevel@tonic-gate else 14197c478bd9Sstevel@tonic-gate appp = &(pad->pad_root); 14207c478bd9Sstevel@tonic-gate au_pathrele(*appp); 14217c478bd9Sstevel@tonic-gate /* use tad hold */ 14227c478bd9Sstevel@tonic-gate *appp = tad->tad_aupath; 14237c478bd9Sstevel@tonic-gate tad->tad_aupath = NULL; 14247c478bd9Sstevel@tonic-gate mutex_exit(&pad->pad_lock); 14257c478bd9Sstevel@tonic-gate } 14267c478bd9Sstevel@tonic-gate } else if ((tad->tad_scid == SYS_fchdir) || 14277c478bd9Sstevel@tonic-gate (tad->tad_scid == SYS_fchroot)) { 14287c478bd9Sstevel@tonic-gate fchdir = tad->tad_scid == SYS_fchdir; 14297c478bd9Sstevel@tonic-gate if ((fp = getf(uap->fd)) == NULL) 14307c478bd9Sstevel@tonic-gate return; 14317c478bd9Sstevel@tonic-gate fad = F2A(fp); 14327c478bd9Sstevel@tonic-gate if (fad->fad_aupath) { 14337c478bd9Sstevel@tonic-gate au_pathhold(fad->fad_aupath); 14347c478bd9Sstevel@tonic-gate mutex_enter(&pad->pad_lock); 14357c478bd9Sstevel@tonic-gate if (fchdir) 14367c478bd9Sstevel@tonic-gate appp = &(pad->pad_cwd); 14377c478bd9Sstevel@tonic-gate else 14387c478bd9Sstevel@tonic-gate appp = &(pad->pad_root); 14397c478bd9Sstevel@tonic-gate au_pathrele(*appp); 14407c478bd9Sstevel@tonic-gate *appp = fad->fad_aupath; 14417c478bd9Sstevel@tonic-gate mutex_exit(&pad->pad_lock); 14427c478bd9Sstevel@tonic-gate if (tad->tad_flag) { 14437c478bd9Sstevel@tonic-gate au_uwrite(au_to_path(fad->fad_aupath)); 14447c478bd9Sstevel@tonic-gate audit_attributes(fp->f_vnode); 14457c478bd9Sstevel@tonic-gate } 14467c478bd9Sstevel@tonic-gate } 14477c478bd9Sstevel@tonic-gate releasef(uap->fd); 14487c478bd9Sstevel@tonic-gate } 14497c478bd9Sstevel@tonic-gate } 14507c478bd9Sstevel@tonic-gate 14517c478bd9Sstevel@tonic-gate /* 14527c478bd9Sstevel@tonic-gate * ROUTINE: AUDIT_GETF 14537c478bd9Sstevel@tonic-gate * PURPOSE: 14547c478bd9Sstevel@tonic-gate * CALLBY: GETF_INTERNAL 14557c478bd9Sstevel@tonic-gate * NOTE: The main function of GETF_INTERNAL is to associate a given 14567c478bd9Sstevel@tonic-gate * file descriptor with a file structure and increment the 14577c478bd9Sstevel@tonic-gate * file pointer reference count. 14587c478bd9Sstevel@tonic-gate * TODO: remove pass in of fpp. 14597c478bd9Sstevel@tonic-gate * increment a reference count so that even if a thread with same process delete 14607c478bd9Sstevel@tonic-gate * the same object, it will not panic our system 14617c478bd9Sstevel@tonic-gate * QUESTION: 14627c478bd9Sstevel@tonic-gate * where to decrement the f_count????????????????? 1463da6c28aaSamw * seems like I need to set a flag if f_count incremented through audit_getf 14647c478bd9Sstevel@tonic-gate */ 14657c478bd9Sstevel@tonic-gate 14667c478bd9Sstevel@tonic-gate /*ARGSUSED*/ 14677c478bd9Sstevel@tonic-gate int 14687c478bd9Sstevel@tonic-gate audit_getf(int fd) 14697c478bd9Sstevel@tonic-gate { 14707c478bd9Sstevel@tonic-gate #ifdef NOTYET 14717c478bd9Sstevel@tonic-gate t_audit_data_t *tad; 14727c478bd9Sstevel@tonic-gate 14737c478bd9Sstevel@tonic-gate tad = T2A(curthread); 14747c478bd9Sstevel@tonic-gate 14758fd04b83SRoger A. Faulkner if (!(tad->tad_scid == SYS_openat || 14768fd04b83SRoger A. Faulkner tad->tad_scid == SYS_openat64 || 14778fd04b83SRoger A. Faulkner tad->tad_scid == SYS_open || 14788fd04b83SRoger A. Faulkner tad->tad_scid == SYS_open64)) 14798fd04b83SRoger A. Faulkner return (0); 14807c478bd9Sstevel@tonic-gate #endif 14817c478bd9Sstevel@tonic-gate return (0); 14827c478bd9Sstevel@tonic-gate } 14837c478bd9Sstevel@tonic-gate 14847c478bd9Sstevel@tonic-gate /* 14857c478bd9Sstevel@tonic-gate * Audit hook for stream based socket and tli request. 14867c478bd9Sstevel@tonic-gate * Note that we do not have user context while executing 14877c478bd9Sstevel@tonic-gate * this code so we had to record them earlier during the 14887c478bd9Sstevel@tonic-gate * putmsg/getmsg to figure out which user we are dealing with. 14897c478bd9Sstevel@tonic-gate */ 14907c478bd9Sstevel@tonic-gate 14917c478bd9Sstevel@tonic-gate /*ARGSUSED*/ 14927c478bd9Sstevel@tonic-gate void 14937c478bd9Sstevel@tonic-gate audit_sock( 14947c478bd9Sstevel@tonic-gate int type, /* type of tihdr.h header requests */ 14957c478bd9Sstevel@tonic-gate queue_t *q, /* contains the process and thread audit data */ 14967c478bd9Sstevel@tonic-gate mblk_t *mp, /* contains the tihdr.h header structures */ 14977c478bd9Sstevel@tonic-gate int from) /* timod or sockmod request */ 14987c478bd9Sstevel@tonic-gate { 14997c478bd9Sstevel@tonic-gate int32_t len; 15007c478bd9Sstevel@tonic-gate int32_t offset; 15017c478bd9Sstevel@tonic-gate struct sockaddr_in *sock_data; 15027c478bd9Sstevel@tonic-gate struct T_conn_req *conn_req; 15037c478bd9Sstevel@tonic-gate struct T_conn_ind *conn_ind; 15047c478bd9Sstevel@tonic-gate struct T_unitdata_req *unitdata_req; 15057c478bd9Sstevel@tonic-gate struct T_unitdata_ind *unitdata_ind; 15067c478bd9Sstevel@tonic-gate au_state_t estate; 15077c478bd9Sstevel@tonic-gate t_audit_data_t *tad; 15087c478bd9Sstevel@tonic-gate caddr_t saved_thread_ptr; 15097c478bd9Sstevel@tonic-gate au_mask_t amask; 15107c478bd9Sstevel@tonic-gate const auditinfo_addr_t *ainfo; 15117c478bd9Sstevel@tonic-gate au_kcontext_t *kctx; 15127c478bd9Sstevel@tonic-gate 15137c478bd9Sstevel@tonic-gate if (q->q_stream == NULL) 15147c478bd9Sstevel@tonic-gate return; 15157c478bd9Sstevel@tonic-gate mutex_enter(&q->q_stream->sd_lock); 15167c478bd9Sstevel@tonic-gate /* are we being audited */ 15177c478bd9Sstevel@tonic-gate saved_thread_ptr = q->q_stream->sd_t_audit_data; 15187c478bd9Sstevel@tonic-gate /* no pointer to thread, nothing to do */ 15197c478bd9Sstevel@tonic-gate if (saved_thread_ptr == NULL) { 15207c478bd9Sstevel@tonic-gate mutex_exit(&q->q_stream->sd_lock); 15217c478bd9Sstevel@tonic-gate return; 15227c478bd9Sstevel@tonic-gate } 15237c478bd9Sstevel@tonic-gate /* only allow one addition of a record token */ 15247c478bd9Sstevel@tonic-gate q->q_stream->sd_t_audit_data = NULL; 15257c478bd9Sstevel@tonic-gate /* 15267c478bd9Sstevel@tonic-gate * thread is not the one being audited, then nothing to do 15277c478bd9Sstevel@tonic-gate * This could be the stream thread handling the module 15287c478bd9Sstevel@tonic-gate * service routine. In this case, the context for the audit 15297c478bd9Sstevel@tonic-gate * record can no longer be assumed. Simplest to just drop 15307c478bd9Sstevel@tonic-gate * the operation. 15317c478bd9Sstevel@tonic-gate */ 15327c478bd9Sstevel@tonic-gate if (curthread != (kthread_id_t)saved_thread_ptr) { 15337c478bd9Sstevel@tonic-gate mutex_exit(&q->q_stream->sd_lock); 15347c478bd9Sstevel@tonic-gate return; 15357c478bd9Sstevel@tonic-gate } 15367c478bd9Sstevel@tonic-gate if (curthread->t_sysnum >= SYS_so_socket && 15377c478bd9Sstevel@tonic-gate curthread->t_sysnum <= SYS_sockconfig) { 15387c478bd9Sstevel@tonic-gate mutex_exit(&q->q_stream->sd_lock); 15397c478bd9Sstevel@tonic-gate return; 15407c478bd9Sstevel@tonic-gate } 15417c478bd9Sstevel@tonic-gate mutex_exit(&q->q_stream->sd_lock); 15427c478bd9Sstevel@tonic-gate /* 15437c478bd9Sstevel@tonic-gate * we know that the thread that did the put/getmsg is the 15447c478bd9Sstevel@tonic-gate * one running. Now we can get the TAD and see if we should 15457c478bd9Sstevel@tonic-gate * add an audit token. 15467c478bd9Sstevel@tonic-gate */ 15477c478bd9Sstevel@tonic-gate tad = U2A(u); 15487c478bd9Sstevel@tonic-gate 15499e9e6ab8Spaulson kctx = GET_KCTX_PZ; 15507c478bd9Sstevel@tonic-gate 15517c478bd9Sstevel@tonic-gate /* proceed ONLY if user is being audited */ 15527c478bd9Sstevel@tonic-gate if (!tad->tad_flag) 15537c478bd9Sstevel@tonic-gate return; 15547c478bd9Sstevel@tonic-gate 15557c478bd9Sstevel@tonic-gate ainfo = crgetauinfo(CRED()); 15567c478bd9Sstevel@tonic-gate if (ainfo == NULL) 15577c478bd9Sstevel@tonic-gate return; 15587c478bd9Sstevel@tonic-gate amask = ainfo->ai_mask; 15597c478bd9Sstevel@tonic-gate 15607c478bd9Sstevel@tonic-gate /* 15617c478bd9Sstevel@tonic-gate * Figure out the type of stream networking request here. 15627c478bd9Sstevel@tonic-gate * Note that getmsg and putmsg are always preselected 15637c478bd9Sstevel@tonic-gate * because during the beginning of the system call we have 15647c478bd9Sstevel@tonic-gate * not yet figure out which of the socket or tli request 15657c478bd9Sstevel@tonic-gate * we are looking at until we are here. So we need to check 15667c478bd9Sstevel@tonic-gate * against that specific request and reset the type of event. 15677c478bd9Sstevel@tonic-gate */ 15687c478bd9Sstevel@tonic-gate switch (type) { 15697c478bd9Sstevel@tonic-gate case T_CONN_REQ: /* connection request */ 15707c478bd9Sstevel@tonic-gate conn_req = (struct T_conn_req *)mp->b_rptr; 15717c478bd9Sstevel@tonic-gate if (conn_req->DEST_offset < sizeof (struct T_conn_req)) 15727c478bd9Sstevel@tonic-gate return; 15737c478bd9Sstevel@tonic-gate offset = conn_req->DEST_offset; 15747c478bd9Sstevel@tonic-gate len = conn_req->DEST_length; 15757c478bd9Sstevel@tonic-gate estate = kctx->auk_ets[AUE_SOCKCONNECT]; 15767c478bd9Sstevel@tonic-gate if (amask.as_success & estate || amask.as_failure & estate) { 15777c478bd9Sstevel@tonic-gate tad->tad_event = AUE_SOCKCONNECT; 15787c478bd9Sstevel@tonic-gate break; 15797c478bd9Sstevel@tonic-gate } else { 15807c478bd9Sstevel@tonic-gate return; 15817c478bd9Sstevel@tonic-gate } 15827c478bd9Sstevel@tonic-gate case T_CONN_IND: /* connectionless receive request */ 15837c478bd9Sstevel@tonic-gate conn_ind = (struct T_conn_ind *)mp->b_rptr; 15847c478bd9Sstevel@tonic-gate if (conn_ind->SRC_offset < sizeof (struct T_conn_ind)) 15857c478bd9Sstevel@tonic-gate return; 15867c478bd9Sstevel@tonic-gate offset = conn_ind->SRC_offset; 15877c478bd9Sstevel@tonic-gate len = conn_ind->SRC_length; 15887c478bd9Sstevel@tonic-gate estate = kctx->auk_ets[AUE_SOCKACCEPT]; 15897c478bd9Sstevel@tonic-gate if (amask.as_success & estate || amask.as_failure & estate) { 15907c478bd9Sstevel@tonic-gate tad->tad_event = AUE_SOCKACCEPT; 15917c478bd9Sstevel@tonic-gate break; 15927c478bd9Sstevel@tonic-gate } else { 15937c478bd9Sstevel@tonic-gate return; 15947c478bd9Sstevel@tonic-gate } 15957c478bd9Sstevel@tonic-gate case T_UNITDATA_REQ: /* connectionless send request */ 15967c478bd9Sstevel@tonic-gate unitdata_req = (struct T_unitdata_req *)mp->b_rptr; 15977c478bd9Sstevel@tonic-gate if (unitdata_req->DEST_offset < sizeof (struct T_unitdata_req)) 15987c478bd9Sstevel@tonic-gate return; 15997c478bd9Sstevel@tonic-gate offset = unitdata_req->DEST_offset; 16007c478bd9Sstevel@tonic-gate len = unitdata_req->DEST_length; 16017c478bd9Sstevel@tonic-gate estate = kctx->auk_ets[AUE_SOCKSEND]; 16027c478bd9Sstevel@tonic-gate if (amask.as_success & estate || amask.as_failure & estate) { 16037c478bd9Sstevel@tonic-gate tad->tad_event = AUE_SOCKSEND; 16047c478bd9Sstevel@tonic-gate break; 16057c478bd9Sstevel@tonic-gate } else { 16067c478bd9Sstevel@tonic-gate return; 16077c478bd9Sstevel@tonic-gate } 16087c478bd9Sstevel@tonic-gate case T_UNITDATA_IND: /* connectionless receive request */ 16097c478bd9Sstevel@tonic-gate unitdata_ind = (struct T_unitdata_ind *)mp->b_rptr; 16107c478bd9Sstevel@tonic-gate if (unitdata_ind->SRC_offset < sizeof (struct T_unitdata_ind)) 16117c478bd9Sstevel@tonic-gate return; 16127c478bd9Sstevel@tonic-gate offset = unitdata_ind->SRC_offset; 16137c478bd9Sstevel@tonic-gate len = unitdata_ind->SRC_length; 16147c478bd9Sstevel@tonic-gate estate = kctx->auk_ets[AUE_SOCKRECEIVE]; 16157c478bd9Sstevel@tonic-gate if (amask.as_success & estate || amask.as_failure & estate) { 16167c478bd9Sstevel@tonic-gate tad->tad_event = AUE_SOCKRECEIVE; 16177c478bd9Sstevel@tonic-gate break; 16187c478bd9Sstevel@tonic-gate } else { 16197c478bd9Sstevel@tonic-gate return; 16207c478bd9Sstevel@tonic-gate } 16217c478bd9Sstevel@tonic-gate default: 16227c478bd9Sstevel@tonic-gate return; 16237c478bd9Sstevel@tonic-gate } 16247c478bd9Sstevel@tonic-gate 16257c478bd9Sstevel@tonic-gate /* 16267c478bd9Sstevel@tonic-gate * we are only interested in tcp stream connections, 16277c478bd9Sstevel@tonic-gate * not unix domain stuff 16287c478bd9Sstevel@tonic-gate */ 16297c478bd9Sstevel@tonic-gate if ((len < 0) || (len > sizeof (struct sockaddr_in))) { 16307c478bd9Sstevel@tonic-gate tad->tad_event = AUE_GETMSG; 16317c478bd9Sstevel@tonic-gate return; 16327c478bd9Sstevel@tonic-gate } 16337c478bd9Sstevel@tonic-gate /* skip over TPI header and point to the ip address */ 16347c478bd9Sstevel@tonic-gate sock_data = (struct sockaddr_in *)((char *)mp->b_rptr + offset); 16357c478bd9Sstevel@tonic-gate 16367c478bd9Sstevel@tonic-gate switch (sock_data->sin_family) { 16377c478bd9Sstevel@tonic-gate case AF_INET: 16387c478bd9Sstevel@tonic-gate au_write(&(tad->tad_ad), au_to_sock_inet(sock_data)); 16397c478bd9Sstevel@tonic-gate break; 16407c478bd9Sstevel@tonic-gate default: /* reset to AUE_PUTMSG if not a inet request */ 16417c478bd9Sstevel@tonic-gate tad->tad_event = AUE_GETMSG; 16427c478bd9Sstevel@tonic-gate break; 16437c478bd9Sstevel@tonic-gate } 16447c478bd9Sstevel@tonic-gate } 16457c478bd9Sstevel@tonic-gate 16467c478bd9Sstevel@tonic-gate void 16477c478bd9Sstevel@tonic-gate audit_lookupname() 16487c478bd9Sstevel@tonic-gate { 16497c478bd9Sstevel@tonic-gate } 16507c478bd9Sstevel@tonic-gate 16517c478bd9Sstevel@tonic-gate /*ARGSUSED*/ 16527c478bd9Sstevel@tonic-gate int 16537c478bd9Sstevel@tonic-gate audit_pathcomp(struct pathname *pnp, vnode_t *cvp, cred_t *cr) 16547c478bd9Sstevel@tonic-gate { 16557c478bd9Sstevel@tonic-gate return (0); 16567c478bd9Sstevel@tonic-gate } 16577c478bd9Sstevel@tonic-gate 16587c478bd9Sstevel@tonic-gate static void 16597c478bd9Sstevel@tonic-gate add_return_token(caddr_t *ad, unsigned int scid, int err, int rval) 16607c478bd9Sstevel@tonic-gate { 16617c478bd9Sstevel@tonic-gate unsigned int sy_flags; 16627c478bd9Sstevel@tonic-gate 16637c478bd9Sstevel@tonic-gate #ifdef _SYSCALL32_IMPL 1664950d6705SPaul Wernau /* 1665950d6705SPaul Wernau * Guard against t_lwp being NULL when this function is called 1666950d6705SPaul Wernau * from a kernel queue instead of from a direct system call. 1667950d6705SPaul Wernau * In that case, assume the running kernel data model. 1668950d6705SPaul Wernau */ 1669950d6705SPaul Wernau if ((curthread->t_lwp == NULL) || (lwp_getdatamodel( 1670950d6705SPaul Wernau ttolwp(curthread)) == DATAMODEL_NATIVE)) 16717c478bd9Sstevel@tonic-gate sy_flags = sysent[scid].sy_flags & SE_RVAL_MASK; 16727c478bd9Sstevel@tonic-gate else 16737c478bd9Sstevel@tonic-gate sy_flags = sysent32[scid].sy_flags & SE_RVAL_MASK; 16747c478bd9Sstevel@tonic-gate #else 16757c478bd9Sstevel@tonic-gate sy_flags = sysent[scid].sy_flags & SE_RVAL_MASK; 16767c478bd9Sstevel@tonic-gate #endif 16777c478bd9Sstevel@tonic-gate 16787c478bd9Sstevel@tonic-gate if (sy_flags == SE_64RVAL) 16797c478bd9Sstevel@tonic-gate au_write(ad, au_to_return64(err, rval)); 16807c478bd9Sstevel@tonic-gate else 16817c478bd9Sstevel@tonic-gate au_write(ad, au_to_return32(err, rval)); 16827c478bd9Sstevel@tonic-gate 16837c478bd9Sstevel@tonic-gate } 16847c478bd9Sstevel@tonic-gate 16857c478bd9Sstevel@tonic-gate /*ARGSUSED*/ 16867c478bd9Sstevel@tonic-gate void 16877c478bd9Sstevel@tonic-gate audit_fdsend(fd, fp, error) 16887c478bd9Sstevel@tonic-gate int fd; 16897c478bd9Sstevel@tonic-gate struct file *fp; 16907c478bd9Sstevel@tonic-gate int error; /* ignore for now */ 16917c478bd9Sstevel@tonic-gate { 16927c478bd9Sstevel@tonic-gate t_audit_data_t *tad; /* current thread */ 16937c478bd9Sstevel@tonic-gate f_audit_data_t *fad; /* per file audit structure */ 16947c478bd9Sstevel@tonic-gate struct vnode *vp; /* for file attributes */ 16957c478bd9Sstevel@tonic-gate 16967c478bd9Sstevel@tonic-gate /* is this system call being audited */ 16977c478bd9Sstevel@tonic-gate tad = U2A(u); 16987c478bd9Sstevel@tonic-gate ASSERT(tad != (t_audit_data_t *)0); 16997c478bd9Sstevel@tonic-gate if (!tad->tad_flag) 17007c478bd9Sstevel@tonic-gate return; 17017c478bd9Sstevel@tonic-gate 17027c478bd9Sstevel@tonic-gate fad = F2A(fp); 17037c478bd9Sstevel@tonic-gate 17047c478bd9Sstevel@tonic-gate /* add path and file attributes */ 17057c478bd9Sstevel@tonic-gate if (fad != NULL && fad->fad_aupath != NULL) { 17067c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(0, "send fd", (uint32_t)fd)); 17077c478bd9Sstevel@tonic-gate au_uwrite(au_to_path(fad->fad_aupath)); 17087c478bd9Sstevel@tonic-gate } else { 17097c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(0, "send fd", (uint32_t)fd)); 17107c478bd9Sstevel@tonic-gate #ifdef _LP64 17117c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg64(0, "no path", (uint64_t)fp)); 17127c478bd9Sstevel@tonic-gate #else 17137c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(0, "no path", (uint32_t)fp)); 17147c478bd9Sstevel@tonic-gate #endif 17157c478bd9Sstevel@tonic-gate } 17167c478bd9Sstevel@tonic-gate vp = fp->f_vnode; /* include vnode attributes */ 17177c478bd9Sstevel@tonic-gate audit_attributes(vp); 17187c478bd9Sstevel@tonic-gate } 17197c478bd9Sstevel@tonic-gate 17207c478bd9Sstevel@tonic-gate /* 1721da6c28aaSamw * Record privileges successfully used and we attempted to use but 17227c478bd9Sstevel@tonic-gate * didn't have. 17237c478bd9Sstevel@tonic-gate */ 17247c478bd9Sstevel@tonic-gate void 17257c478bd9Sstevel@tonic-gate audit_priv(int priv, const priv_set_t *set, int flag) 17267c478bd9Sstevel@tonic-gate { 17277c478bd9Sstevel@tonic-gate t_audit_data_t *tad; 17287c478bd9Sstevel@tonic-gate int sbit; 17297c478bd9Sstevel@tonic-gate priv_set_t *target; 17307c478bd9Sstevel@tonic-gate 17317c478bd9Sstevel@tonic-gate /* Make sure this isn't being called in an interrupt context */ 17327c478bd9Sstevel@tonic-gate ASSERT(servicing_interrupt() == 0); 17337c478bd9Sstevel@tonic-gate 17347c478bd9Sstevel@tonic-gate tad = U2A(u); 17357c478bd9Sstevel@tonic-gate 17367c478bd9Sstevel@tonic-gate if (tad->tad_flag == 0) 17377c478bd9Sstevel@tonic-gate return; 17387c478bd9Sstevel@tonic-gate 17397c478bd9Sstevel@tonic-gate target = flag ? &tad->tad_sprivs : &tad->tad_fprivs; 17407c478bd9Sstevel@tonic-gate sbit = flag ? PAD_SPRIVUSE : PAD_FPRIVUSE; 17417c478bd9Sstevel@tonic-gate 17427c478bd9Sstevel@tonic-gate /* Tell audit_success() and audit_finish() that we saw this case */ 17437c478bd9Sstevel@tonic-gate if (!(tad->tad_evmod & sbit)) { 17447c478bd9Sstevel@tonic-gate /* Clear set first time around */ 17457c478bd9Sstevel@tonic-gate priv_emptyset(target); 17467c478bd9Sstevel@tonic-gate tad->tad_evmod |= sbit; 17477c478bd9Sstevel@tonic-gate } 17487c478bd9Sstevel@tonic-gate 17497c478bd9Sstevel@tonic-gate /* Save the privileges in the tad */ 17507c478bd9Sstevel@tonic-gate if (priv == PRIV_ALL) { 17517c478bd9Sstevel@tonic-gate priv_fillset(target); 17527c478bd9Sstevel@tonic-gate } else { 17537c478bd9Sstevel@tonic-gate ASSERT(set != NULL || priv != PRIV_NONE); 17547c478bd9Sstevel@tonic-gate if (set != NULL) 17557c478bd9Sstevel@tonic-gate priv_union(set, target); 17567c478bd9Sstevel@tonic-gate if (priv != PRIV_NONE) 17577c478bd9Sstevel@tonic-gate priv_addset(target, priv); 17587c478bd9Sstevel@tonic-gate } 17597c478bd9Sstevel@tonic-gate } 17607c478bd9Sstevel@tonic-gate 17617c478bd9Sstevel@tonic-gate /* 17627c478bd9Sstevel@tonic-gate * Audit the setpriv() system call; the operation, the set name and 17637c478bd9Sstevel@tonic-gate * the current value as well as the set argument are put in the 17647c478bd9Sstevel@tonic-gate * audit trail. 17657c478bd9Sstevel@tonic-gate */ 17667c478bd9Sstevel@tonic-gate void 17677c478bd9Sstevel@tonic-gate audit_setppriv(int op, int set, const priv_set_t *newpriv, const cred_t *ocr) 17687c478bd9Sstevel@tonic-gate { 17697c478bd9Sstevel@tonic-gate t_audit_data_t *tad; 17707c478bd9Sstevel@tonic-gate const priv_set_t *oldpriv; 17717c478bd9Sstevel@tonic-gate priv_set_t report; 17727c478bd9Sstevel@tonic-gate const char *setname; 17737c478bd9Sstevel@tonic-gate 17747c478bd9Sstevel@tonic-gate tad = U2A(u); 17757c478bd9Sstevel@tonic-gate 17767c478bd9Sstevel@tonic-gate if (tad->tad_flag == 0) 17777c478bd9Sstevel@tonic-gate return; 17787c478bd9Sstevel@tonic-gate 17797c478bd9Sstevel@tonic-gate oldpriv = priv_getset(ocr, set); 17807c478bd9Sstevel@tonic-gate 17817c478bd9Sstevel@tonic-gate /* Generate the actual record, include the before and after */ 17827c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(2, "op", op)); 17837c478bd9Sstevel@tonic-gate setname = priv_getsetbynum(set); 17847c478bd9Sstevel@tonic-gate 17857c478bd9Sstevel@tonic-gate switch (op) { 17867c478bd9Sstevel@tonic-gate case PRIV_OFF: 17877c478bd9Sstevel@tonic-gate /* Report privileges actually switched off */ 17887c478bd9Sstevel@tonic-gate report = *oldpriv; 17897c478bd9Sstevel@tonic-gate priv_intersect(newpriv, &report); 17907c478bd9Sstevel@tonic-gate au_uwrite(au_to_privset(setname, &report, AUT_PRIV, 0)); 17917c478bd9Sstevel@tonic-gate break; 17927c478bd9Sstevel@tonic-gate case PRIV_ON: 17937c478bd9Sstevel@tonic-gate /* Report privileges actually switched on */ 17947c478bd9Sstevel@tonic-gate report = *oldpriv; 17957c478bd9Sstevel@tonic-gate priv_inverse(&report); 17967c478bd9Sstevel@tonic-gate priv_intersect(newpriv, &report); 17977c478bd9Sstevel@tonic-gate au_uwrite(au_to_privset(setname, &report, AUT_PRIV, 0)); 17987c478bd9Sstevel@tonic-gate break; 17997c478bd9Sstevel@tonic-gate case PRIV_SET: 18007c478bd9Sstevel@tonic-gate /* Report before and after */ 18017c478bd9Sstevel@tonic-gate au_uwrite(au_to_privset(setname, oldpriv, AUT_PRIV, 0)); 18027c478bd9Sstevel@tonic-gate au_uwrite(au_to_privset(setname, newpriv, AUT_PRIV, 0)); 18037c478bd9Sstevel@tonic-gate break; 18047c478bd9Sstevel@tonic-gate } 18057c478bd9Sstevel@tonic-gate } 18067c478bd9Sstevel@tonic-gate 18077c478bd9Sstevel@tonic-gate /* 18087c478bd9Sstevel@tonic-gate * Dump the full device policy setting in the audit trail. 18097c478bd9Sstevel@tonic-gate */ 18107c478bd9Sstevel@tonic-gate void 18117c478bd9Sstevel@tonic-gate audit_devpolicy(int nitems, const devplcysys_t *items) 18127c478bd9Sstevel@tonic-gate { 18137c478bd9Sstevel@tonic-gate t_audit_data_t *tad; 18147c478bd9Sstevel@tonic-gate int i; 18157c478bd9Sstevel@tonic-gate 18167c478bd9Sstevel@tonic-gate tad = U2A(u); 18177c478bd9Sstevel@tonic-gate 18187c478bd9Sstevel@tonic-gate if (tad->tad_flag == 0) 18197c478bd9Sstevel@tonic-gate return; 18207c478bd9Sstevel@tonic-gate 18217c478bd9Sstevel@tonic-gate for (i = 0; i < nitems; i++) { 18227c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(2, "major", items[i].dps_maj)); 18237c478bd9Sstevel@tonic-gate if (items[i].dps_minornm[0] == '\0') { 18247c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(2, "lomin", items[i].dps_lomin)); 18257c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(2, "himin", items[i].dps_himin)); 18267c478bd9Sstevel@tonic-gate } else 18277c478bd9Sstevel@tonic-gate au_uwrite(au_to_text(items[i].dps_minornm)); 18287c478bd9Sstevel@tonic-gate 18297c478bd9Sstevel@tonic-gate au_uwrite(au_to_privset("read", &items[i].dps_rdp, 18307c478bd9Sstevel@tonic-gate AUT_PRIV, 0)); 18317c478bd9Sstevel@tonic-gate au_uwrite(au_to_privset("write", &items[i].dps_wrp, 18327c478bd9Sstevel@tonic-gate AUT_PRIV, 0)); 18337c478bd9Sstevel@tonic-gate } 18347c478bd9Sstevel@tonic-gate } 18357c478bd9Sstevel@tonic-gate 18367c478bd9Sstevel@tonic-gate /*ARGSUSED*/ 18377c478bd9Sstevel@tonic-gate void 18387c478bd9Sstevel@tonic-gate audit_fdrecv(fd, fp) 18397c478bd9Sstevel@tonic-gate int fd; 18407c478bd9Sstevel@tonic-gate struct file *fp; 18417c478bd9Sstevel@tonic-gate { 18427c478bd9Sstevel@tonic-gate t_audit_data_t *tad; /* current thread */ 18437c478bd9Sstevel@tonic-gate f_audit_data_t *fad; /* per file audit structure */ 18447c478bd9Sstevel@tonic-gate struct vnode *vp; /* for file attributes */ 18457c478bd9Sstevel@tonic-gate 18467c478bd9Sstevel@tonic-gate /* is this system call being audited */ 18477c478bd9Sstevel@tonic-gate tad = U2A(u); 18487c478bd9Sstevel@tonic-gate ASSERT(tad != (t_audit_data_t *)0); 18497c478bd9Sstevel@tonic-gate if (!tad->tad_flag) 18507c478bd9Sstevel@tonic-gate return; 18517c478bd9Sstevel@tonic-gate 18527c478bd9Sstevel@tonic-gate fad = F2A(fp); 18537c478bd9Sstevel@tonic-gate 18547c478bd9Sstevel@tonic-gate /* add path and file attributes */ 18557c478bd9Sstevel@tonic-gate if (fad != NULL && fad->fad_aupath != NULL) { 18567c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(0, "recv fd", (uint32_t)fd)); 18577c478bd9Sstevel@tonic-gate au_uwrite(au_to_path(fad->fad_aupath)); 18587c478bd9Sstevel@tonic-gate } else { 18597c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(0, "recv fd", (uint32_t)fd)); 18607c478bd9Sstevel@tonic-gate #ifdef _LP64 18617c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg64(0, "no path", (uint64_t)fp)); 18627c478bd9Sstevel@tonic-gate #else 18637c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(0, "no path", (uint32_t)fp)); 18647c478bd9Sstevel@tonic-gate #endif 18657c478bd9Sstevel@tonic-gate } 18667c478bd9Sstevel@tonic-gate vp = fp->f_vnode; /* include vnode attributes */ 18677c478bd9Sstevel@tonic-gate audit_attributes(vp); 18687c478bd9Sstevel@tonic-gate } 18697c478bd9Sstevel@tonic-gate 18707c478bd9Sstevel@tonic-gate /* 18717c478bd9Sstevel@tonic-gate * ROUTINE: AUDIT_CRYPTOADM 18727c478bd9Sstevel@tonic-gate * PURPOSE: Records arguments to administrative ioctls on /dev/cryptoadm 18737c478bd9Sstevel@tonic-gate * CALLBY: CRYPTO_LOAD_DEV_DISABLED, CRYPTO_LOAD_SOFT_DISABLED, 18747c478bd9Sstevel@tonic-gate * CRYPTO_UNLOAD_SOFT_MODULE, CRYPTO_LOAD_SOFT_CONFIG, 18757c478bd9Sstevel@tonic-gate * CRYPTO_POOL_CREATE, CRYPTO_POOL_WAIT, CRYPTO_POOL_RUN, 18767c478bd9Sstevel@tonic-gate * CRYPTO_LOAD_DOOR 18777c478bd9Sstevel@tonic-gate * NOTE: 18787c478bd9Sstevel@tonic-gate * TODO: 18797c478bd9Sstevel@tonic-gate * QUESTION: 18807c478bd9Sstevel@tonic-gate */ 18817c478bd9Sstevel@tonic-gate 18827c478bd9Sstevel@tonic-gate void 18837c478bd9Sstevel@tonic-gate audit_cryptoadm(int cmd, char *module_name, crypto_mech_name_t *mech_names, 18847c478bd9Sstevel@tonic-gate uint_t mech_count, uint_t device_instance, uint32_t rv, int error) 18857c478bd9Sstevel@tonic-gate { 18867c478bd9Sstevel@tonic-gate boolean_t mech_list_required = B_FALSE; 18877c478bd9Sstevel@tonic-gate cred_t *cr = CRED(); 18887c478bd9Sstevel@tonic-gate t_audit_data_t *tad; 18897c478bd9Sstevel@tonic-gate token_t *ad = NULL; 18907c478bd9Sstevel@tonic-gate const auditinfo_addr_t *ainfo = crgetauinfo(cr); 18917c478bd9Sstevel@tonic-gate char buffer[MAXNAMELEN * 2]; 18929e9e6ab8Spaulson au_kcontext_t *kctx = GET_KCTX_PZ; 18937c478bd9Sstevel@tonic-gate 18947c478bd9Sstevel@tonic-gate tad = U2A(u); 18957c478bd9Sstevel@tonic-gate if (tad == NULL) 18967c478bd9Sstevel@tonic-gate return; 18977c478bd9Sstevel@tonic-gate 18987c478bd9Sstevel@tonic-gate if (ainfo == NULL) 18997c478bd9Sstevel@tonic-gate return; 19007c478bd9Sstevel@tonic-gate 19017c478bd9Sstevel@tonic-gate tad->tad_event = AUE_CRYPTOADM; 19027c478bd9Sstevel@tonic-gate 1903799bd290Spwernau if (audit_success(kctx, tad, error, NULL) != AU_OK) 19047c478bd9Sstevel@tonic-gate return; 19057c478bd9Sstevel@tonic-gate 190681490fd2Sgww /* Add subject information */ 190781490fd2Sgww AUDIT_SETSUBJ((caddr_t *)&(ad), cr, ainfo, kctx); 190845916cd2Sjpk 19097c478bd9Sstevel@tonic-gate switch (cmd) { 19107c478bd9Sstevel@tonic-gate case CRYPTO_LOAD_DEV_DISABLED: 19117c478bd9Sstevel@tonic-gate if (error == 0 && rv == CRYPTO_SUCCESS) { 19127c478bd9Sstevel@tonic-gate (void) snprintf(buffer, sizeof (buffer), 19137c478bd9Sstevel@tonic-gate "op=CRYPTO_LOAD_DEV_DISABLED, module=%s," 19147c478bd9Sstevel@tonic-gate " dev_instance=%d", 19157c478bd9Sstevel@tonic-gate module_name, device_instance); 19167c478bd9Sstevel@tonic-gate mech_list_required = B_TRUE; 19177c478bd9Sstevel@tonic-gate } else { 19187c478bd9Sstevel@tonic-gate (void) snprintf(buffer, sizeof (buffer), 19197c478bd9Sstevel@tonic-gate "op=CRYPTO_LOAD_DEV_DISABLED, return_val=%d", rv); 19207c478bd9Sstevel@tonic-gate } 19217c478bd9Sstevel@tonic-gate break; 19227c478bd9Sstevel@tonic-gate 19237c478bd9Sstevel@tonic-gate case CRYPTO_LOAD_SOFT_DISABLED: 19247c478bd9Sstevel@tonic-gate if (error == 0 && rv == CRYPTO_SUCCESS) { 19257c478bd9Sstevel@tonic-gate (void) snprintf(buffer, sizeof (buffer), 19267c478bd9Sstevel@tonic-gate "op=CRYPTO_LOAD_SOFT_DISABLED, module=%s", 19277c478bd9Sstevel@tonic-gate module_name); 19287c478bd9Sstevel@tonic-gate mech_list_required = B_TRUE; 19297c478bd9Sstevel@tonic-gate } else { 19307c478bd9Sstevel@tonic-gate (void) snprintf(buffer, sizeof (buffer), 19317c478bd9Sstevel@tonic-gate "op=CRYPTO_LOAD_SOFT_DISABLED, return_val=%d", rv); 19327c478bd9Sstevel@tonic-gate } 19337c478bd9Sstevel@tonic-gate break; 19347c478bd9Sstevel@tonic-gate 19357c478bd9Sstevel@tonic-gate case CRYPTO_UNLOAD_SOFT_MODULE: 19367c478bd9Sstevel@tonic-gate if (error == 0 && rv == CRYPTO_SUCCESS) { 19377c478bd9Sstevel@tonic-gate (void) snprintf(buffer, sizeof (buffer), 19387c478bd9Sstevel@tonic-gate "op=CRYPTO_UNLOAD_SOFT_MODULE, module=%s", 19397c478bd9Sstevel@tonic-gate module_name); 19407c478bd9Sstevel@tonic-gate } else { 19417c478bd9Sstevel@tonic-gate (void) snprintf(buffer, sizeof (buffer), 19427c478bd9Sstevel@tonic-gate "op=CRYPTO_UNLOAD_SOFT_MODULE, return_val=%d", rv); 19437c478bd9Sstevel@tonic-gate } 19447c478bd9Sstevel@tonic-gate break; 19457c478bd9Sstevel@tonic-gate 19467c478bd9Sstevel@tonic-gate case CRYPTO_LOAD_SOFT_CONFIG: 19477c478bd9Sstevel@tonic-gate if (error == 0 && rv == CRYPTO_SUCCESS) { 19487c478bd9Sstevel@tonic-gate (void) snprintf(buffer, sizeof (buffer), 19497c478bd9Sstevel@tonic-gate "op=CRYPTO_LOAD_SOFT_CONFIG, module=%s", 19507c478bd9Sstevel@tonic-gate module_name); 19517c478bd9Sstevel@tonic-gate mech_list_required = B_TRUE; 19527c478bd9Sstevel@tonic-gate } else { 19537c478bd9Sstevel@tonic-gate (void) snprintf(buffer, sizeof (buffer), 19547c478bd9Sstevel@tonic-gate "op=CRYPTO_LOAD_SOFT_CONFIG, return_val=%d", rv); 19557c478bd9Sstevel@tonic-gate } 19567c478bd9Sstevel@tonic-gate break; 19577c478bd9Sstevel@tonic-gate 19587c478bd9Sstevel@tonic-gate case CRYPTO_POOL_CREATE: 19597c478bd9Sstevel@tonic-gate (void) snprintf(buffer, sizeof (buffer), 19607c478bd9Sstevel@tonic-gate "op=CRYPTO_POOL_CREATE"); 19617c478bd9Sstevel@tonic-gate break; 19627c478bd9Sstevel@tonic-gate 19637c478bd9Sstevel@tonic-gate case CRYPTO_POOL_WAIT: 19647c478bd9Sstevel@tonic-gate (void) snprintf(buffer, sizeof (buffer), "op=CRYPTO_POOL_WAIT"); 19657c478bd9Sstevel@tonic-gate break; 19667c478bd9Sstevel@tonic-gate 19677c478bd9Sstevel@tonic-gate case CRYPTO_POOL_RUN: 19687c478bd9Sstevel@tonic-gate (void) snprintf(buffer, sizeof (buffer), "op=CRYPTO_POOL_RUN"); 19697c478bd9Sstevel@tonic-gate break; 19707c478bd9Sstevel@tonic-gate 19717c478bd9Sstevel@tonic-gate case CRYPTO_LOAD_DOOR: 19727c478bd9Sstevel@tonic-gate if (error == 0 && rv == CRYPTO_SUCCESS) 19737c478bd9Sstevel@tonic-gate (void) snprintf(buffer, sizeof (buffer), 19747c478bd9Sstevel@tonic-gate "op=CRYPTO_LOAD_DOOR"); 19757c478bd9Sstevel@tonic-gate else 19767c478bd9Sstevel@tonic-gate (void) snprintf(buffer, sizeof (buffer), 19777c478bd9Sstevel@tonic-gate "op=CRYPTO_LOAD_DOOR, return_val=%d", rv); 19787c478bd9Sstevel@tonic-gate break; 19797c478bd9Sstevel@tonic-gate 198073556491SAnthony Scarpino case CRYPTO_FIPS140_SET: 198173556491SAnthony Scarpino (void) snprintf(buffer, sizeof (buffer), 198273556491SAnthony Scarpino "op=CRYPTO_FIPS140_SET, fips_state=%d", rv); 198373556491SAnthony Scarpino break; 198473556491SAnthony Scarpino 19857c478bd9Sstevel@tonic-gate default: 19867c478bd9Sstevel@tonic-gate return; 19877c478bd9Sstevel@tonic-gate } 19887c478bd9Sstevel@tonic-gate 19897c478bd9Sstevel@tonic-gate au_write((caddr_t *)&ad, au_to_text(buffer)); 19907c478bd9Sstevel@tonic-gate 19917c478bd9Sstevel@tonic-gate if (mech_list_required) { 19927c478bd9Sstevel@tonic-gate int i; 19937c478bd9Sstevel@tonic-gate 19947c478bd9Sstevel@tonic-gate if (mech_count == 0) { 19957c478bd9Sstevel@tonic-gate au_write((caddr_t *)&ad, au_to_text("mech=list empty")); 19967c478bd9Sstevel@tonic-gate } else { 19977c478bd9Sstevel@tonic-gate char *pb = buffer; 19987c478bd9Sstevel@tonic-gate size_t l = sizeof (buffer); 19997c478bd9Sstevel@tonic-gate size_t n; 20007c478bd9Sstevel@tonic-gate char space[2] = ":"; 20017c478bd9Sstevel@tonic-gate 20027c478bd9Sstevel@tonic-gate n = snprintf(pb, l, "mech="); 20037c478bd9Sstevel@tonic-gate 20047c478bd9Sstevel@tonic-gate for (i = 0; i < mech_count; i++) { 20057c478bd9Sstevel@tonic-gate pb += n; 20067c478bd9Sstevel@tonic-gate l -= n; 20077c478bd9Sstevel@tonic-gate if (l < 0) 20087c478bd9Sstevel@tonic-gate l = 0; 20097c478bd9Sstevel@tonic-gate 20107c478bd9Sstevel@tonic-gate if (i == mech_count - 1) 20117c478bd9Sstevel@tonic-gate (void) strcpy(space, ""); 20127c478bd9Sstevel@tonic-gate 20137c478bd9Sstevel@tonic-gate n = snprintf(pb, l, "%s%s", mech_names[i], 20147c478bd9Sstevel@tonic-gate space); 20157c478bd9Sstevel@tonic-gate } 20167c478bd9Sstevel@tonic-gate au_write((caddr_t *)&ad, au_to_text(buffer)); 20177c478bd9Sstevel@tonic-gate } 20187c478bd9Sstevel@tonic-gate } 20197c478bd9Sstevel@tonic-gate 20207c478bd9Sstevel@tonic-gate /* add a return token */ 20217c478bd9Sstevel@tonic-gate if (error || (rv != CRYPTO_SUCCESS)) 20227c478bd9Sstevel@tonic-gate add_return_token((caddr_t *)&ad, tad->tad_scid, -1, error); 20237c478bd9Sstevel@tonic-gate else 20247c478bd9Sstevel@tonic-gate add_return_token((caddr_t *)&ad, tad->tad_scid, 0, rv); 20257c478bd9Sstevel@tonic-gate 20267c478bd9Sstevel@tonic-gate AS_INC(as_generated, 1, kctx); 20277c478bd9Sstevel@tonic-gate AS_INC(as_kernel, 1, kctx); 20287c478bd9Sstevel@tonic-gate 2029005d3febSMarek Pospisil au_close(kctx, (caddr_t *)&ad, AU_OK, AUE_CRYPTOADM, tad->tad_evmod, 2030005d3febSMarek Pospisil NULL); 20317c478bd9Sstevel@tonic-gate } 2032c28749e9Skais 2033c28749e9Skais /* 2034c28749e9Skais * Audit the kernel SSL administration command. The address and the 2035c28749e9Skais * port number for the SSL instance, and the proxy port are put in the 2036c28749e9Skais * audit trail. 2037c28749e9Skais */ 2038c28749e9Skais void 2039c28749e9Skais audit_kssl(int cmd, void *params, int error) 2040c28749e9Skais { 2041c28749e9Skais cred_t *cr = CRED(); 2042c28749e9Skais t_audit_data_t *tad; 2043c28749e9Skais token_t *ad = NULL; 2044c28749e9Skais const auditinfo_addr_t *ainfo = crgetauinfo(cr); 20459e9e6ab8Spaulson au_kcontext_t *kctx = GET_KCTX_PZ; 2046c28749e9Skais 2047c28749e9Skais tad = U2A(u); 2048c28749e9Skais 2049c28749e9Skais if (ainfo == NULL) 2050c28749e9Skais return; 2051c28749e9Skais 2052c28749e9Skais tad->tad_event = AUE_CONFIGKSSL; 2053c28749e9Skais 2054799bd290Spwernau if (audit_success(kctx, tad, error, NULL) != AU_OK) 2055c28749e9Skais return; 2056c28749e9Skais 205781490fd2Sgww /* Add subject information */ 205881490fd2Sgww AUDIT_SETSUBJ((caddr_t *)&ad, cr, ainfo, kctx); 205945916cd2Sjpk 2060c28749e9Skais switch (cmd) { 2061c28749e9Skais case KSSL_ADD_ENTRY: { 2062c28749e9Skais char buf[32]; 2063c28749e9Skais kssl_params_t *kp = (kssl_params_t *)params; 20642ec7cc7fSKrishna Yenduri struct sockaddr_in6 *saddr = &kp->kssl_addr; 2065c28749e9Skais 2066c28749e9Skais au_write((caddr_t *)&ad, au_to_text("op=KSSL_ADD_ENTRY")); 20672ec7cc7fSKrishna Yenduri au_write((caddr_t *)&ad, 20682ec7cc7fSKrishna Yenduri au_to_in_addr_ex((int32_t *)&saddr->sin6_addr)); 2069c28749e9Skais (void) snprintf(buf, sizeof (buf), "SSL port=%d", 20702ec7cc7fSKrishna Yenduri saddr->sin6_port); 2071c28749e9Skais au_write((caddr_t *)&ad, au_to_text(buf)); 2072c28749e9Skais 2073c28749e9Skais (void) snprintf(buf, sizeof (buf), "proxy port=%d", 2074c28749e9Skais kp->kssl_proxy_port); 2075c28749e9Skais au_write((caddr_t *)&ad, au_to_text(buf)); 2076c28749e9Skais break; 2077c28749e9Skais } 2078c28749e9Skais 2079c28749e9Skais case KSSL_DELETE_ENTRY: { 2080c28749e9Skais char buf[32]; 20812ec7cc7fSKrishna Yenduri struct sockaddr_in6 *saddr = (struct sockaddr_in6 *)params; 2082c28749e9Skais 2083c28749e9Skais au_write((caddr_t *)&ad, au_to_text("op=KSSL_DELETE_ENTRY")); 20842ec7cc7fSKrishna Yenduri au_write((caddr_t *)&ad, 20852ec7cc7fSKrishna Yenduri au_to_in_addr_ex((int32_t *)&saddr->sin6_addr)); 2086c28749e9Skais (void) snprintf(buf, sizeof (buf), "SSL port=%d", 20872ec7cc7fSKrishna Yenduri saddr->sin6_port); 2088c28749e9Skais au_write((caddr_t *)&ad, au_to_text(buf)); 2089c28749e9Skais break; 2090c28749e9Skais } 2091c28749e9Skais 2092c28749e9Skais default: 2093c28749e9Skais return; 2094c28749e9Skais } 2095c28749e9Skais 2096c28749e9Skais /* add a return token */ 2097c28749e9Skais add_return_token((caddr_t *)&ad, tad->tad_scid, error, 0); 2098c28749e9Skais 2099c28749e9Skais AS_INC(as_generated, 1, kctx); 2100c28749e9Skais AS_INC(as_kernel, 1, kctx); 2101c28749e9Skais 2102005d3febSMarek Pospisil au_close(kctx, (caddr_t *)&ad, AU_OK, AUE_CONFIGKSSL, tad->tad_evmod, 2103005d3febSMarek Pospisil NULL); 2104c28749e9Skais } 210545916cd2Sjpk 2106799bd290Spwernau /* 2107799bd290Spwernau * Audit the kernel PF_POLICY administration commands. Record command, 2108799bd290Spwernau * zone, policy type (global or tunnel, active or inactive) 2109799bd290Spwernau */ 2110799bd290Spwernau /* 2111799bd290Spwernau * ROUTINE: AUDIT_PF_POLICY 2112799bd290Spwernau * PURPOSE: Records arguments to administrative ioctls on PF_POLICY socket 2113799bd290Spwernau * CALLBY: SPD_ADDRULE, SPD_DELETERULE, SPD_FLUSH, SPD_UPDATEALGS, 2114799bd290Spwernau * SPD_CLONE, SPD_FLIP 2115799bd290Spwernau * NOTE: 2116799bd290Spwernau * TODO: 2117799bd290Spwernau * QUESTION: 2118799bd290Spwernau */ 2119799bd290Spwernau 2120799bd290Spwernau void 2121799bd290Spwernau audit_pf_policy(int cmd, cred_t *cred, netstack_t *ns, char *tun, 2122799bd290Spwernau boolean_t active, int error, pid_t pid) 2123799bd290Spwernau { 2124799bd290Spwernau const auditinfo_addr_t *ainfo; 2125799bd290Spwernau t_audit_data_t *tad; 2126799bd290Spwernau token_t *ad = NULL; 2127799bd290Spwernau au_kcontext_t *kctx = GET_KCTX_PZ; 2128799bd290Spwernau char buf[80]; 2129799bd290Spwernau int flag; 2130799bd290Spwernau 2131799bd290Spwernau tad = U2A(u); 2132799bd290Spwernau if (tad == NULL) 2133799bd290Spwernau return; 2134799bd290Spwernau 2135799bd290Spwernau ainfo = crgetauinfo((cred != NULL) ? cred : CRED()); 2136799bd290Spwernau if (ainfo == NULL) 2137799bd290Spwernau return; 2138799bd290Spwernau 2139799bd290Spwernau /* 2140799bd290Spwernau * Initialize some variables since these are only set 2141799bd290Spwernau * with system calls. 2142799bd290Spwernau */ 2143799bd290Spwernau 2144799bd290Spwernau switch (cmd) { 2145799bd290Spwernau case SPD_ADDRULE: { 2146799bd290Spwernau tad->tad_event = AUE_PF_POLICY_ADDRULE; 2147799bd290Spwernau break; 2148799bd290Spwernau } 2149799bd290Spwernau 2150799bd290Spwernau case SPD_DELETERULE: { 2151799bd290Spwernau tad->tad_event = AUE_PF_POLICY_DELRULE; 2152799bd290Spwernau break; 2153799bd290Spwernau } 2154799bd290Spwernau 2155799bd290Spwernau case SPD_FLUSH: { 2156799bd290Spwernau tad->tad_event = AUE_PF_POLICY_FLUSH; 2157799bd290Spwernau break; 2158799bd290Spwernau } 2159799bd290Spwernau 2160799bd290Spwernau case SPD_UPDATEALGS: { 2161799bd290Spwernau tad->tad_event = AUE_PF_POLICY_ALGS; 2162799bd290Spwernau break; 2163799bd290Spwernau } 2164799bd290Spwernau 2165799bd290Spwernau case SPD_CLONE: { 2166799bd290Spwernau tad->tad_event = AUE_PF_POLICY_CLONE; 2167799bd290Spwernau break; 2168799bd290Spwernau } 2169799bd290Spwernau 2170799bd290Spwernau case SPD_FLIP: { 2171799bd290Spwernau tad->tad_event = AUE_PF_POLICY_FLIP; 2172799bd290Spwernau break; 2173799bd290Spwernau } 2174799bd290Spwernau 2175799bd290Spwernau default: 2176799bd290Spwernau tad->tad_event = AUE_NULL; 2177799bd290Spwernau } 2178799bd290Spwernau 2179799bd290Spwernau tad->tad_evmod = 0; 2180799bd290Spwernau 2181799bd290Spwernau if (flag = audit_success(kctx, tad, error, cred)) { 2182799bd290Spwernau zone_t *nszone; 2183799bd290Spwernau 2184799bd290Spwernau /* 2185799bd290Spwernau * For now, just audit that an event happened, 2186799bd290Spwernau * along with the error code. 2187799bd290Spwernau */ 2188799bd290Spwernau au_write((caddr_t *)&ad, 2189799bd290Spwernau au_to_arg32(1, "Policy Active?", (uint32_t)active)); 2190799bd290Spwernau au_write((caddr_t *)&ad, 2191799bd290Spwernau au_to_arg32(2, "Policy Global?", (uint32_t)(tun == NULL))); 2192799bd290Spwernau 2193799bd290Spwernau /* Supplemental data */ 2194799bd290Spwernau 2195799bd290Spwernau /* 2196799bd290Spwernau * Generate this zone token if the target zone differs 2197799bd290Spwernau * from the administrative zone. If netstacks are expanded 2198799bd290Spwernau * to something other than a 1-1 relationship with zones, 2199799bd290Spwernau * the auditing framework should create a new token type 2200799bd290Spwernau * and audit it as a netstack instead. 2201799bd290Spwernau * Turn on general zone auditing to get the administrative zone. 2202799bd290Spwernau */ 2203799bd290Spwernau 2204799bd290Spwernau nszone = zone_find_by_id(netstackid_to_zoneid( 2205799bd290Spwernau ns->netstack_stackid)); 2206875a4abcSPaul Wernau if (nszone != NULL) { 220767dbe2beSCasper H.S. Dik if (strncmp(crgetzone(cred)->zone_name, 220867dbe2beSCasper H.S. Dik nszone->zone_name, ZONENAME_MAX) != 0) { 2209875a4abcSPaul Wernau token_t *ztoken; 2210799bd290Spwernau 2211875a4abcSPaul Wernau ztoken = au_to_zonename(0, nszone); 2212875a4abcSPaul Wernau au_write((caddr_t *)&ad, ztoken); 2213875a4abcSPaul Wernau } 2214875a4abcSPaul Wernau zone_rele(nszone); 2215799bd290Spwernau } 2216799bd290Spwernau 2217799bd290Spwernau if (tun != NULL) { 2218799bd290Spwernau /* write tunnel name - tun is bounded */ 2219799bd290Spwernau (void) snprintf(buf, sizeof (buf), "tunnel_name:%s", 2220799bd290Spwernau tun); 2221799bd290Spwernau au_write((caddr_t *)&ad, au_to_text(buf)); 2222799bd290Spwernau } 2223799bd290Spwernau 2224799bd290Spwernau /* Add subject information */ 2225799bd290Spwernau AUDIT_SETSUBJ_GENERIC((caddr_t *)&ad, 2226799bd290Spwernau ((cred != NULL) ? cred : CRED()), ainfo, kctx, pid); 2227799bd290Spwernau 2228799bd290Spwernau /* add a return token */ 2229799bd290Spwernau add_return_token((caddr_t *)&ad, 0, error, 0); 2230799bd290Spwernau 2231799bd290Spwernau AS_INC(as_generated, 1, kctx); 2232799bd290Spwernau AS_INC(as_kernel, 1, kctx); 2233799bd290Spwernau 2234799bd290Spwernau } 2235005d3febSMarek Pospisil au_close(kctx, (caddr_t *)&ad, flag, tad->tad_event, tad->tad_evmod, 2236005d3febSMarek Pospisil NULL); 2237799bd290Spwernau 2238799bd290Spwernau /* 2239799bd290Spwernau * clear the ctrl flag so that we don't have spurious collection of 2240799bd290Spwernau * audit information. 2241799bd290Spwernau */ 2242799bd290Spwernau tad->tad_scid = 0; 2243799bd290Spwernau tad->tad_event = 0; 2244799bd290Spwernau tad->tad_evmod = 0; 2245799bd290Spwernau tad->tad_ctrl = 0; 2246799bd290Spwernau } 2247799bd290Spwernau 224845916cd2Sjpk /* 224945916cd2Sjpk * ROUTINE: AUDIT_SEC_ATTRIBUTES 225045916cd2Sjpk * PURPOSE: Add security attributes 225145916cd2Sjpk * CALLBY: AUDIT_ATTRIBUTES 225245916cd2Sjpk * AUDIT_CLOSEF 225345916cd2Sjpk * AUS_CLOSE 225445916cd2Sjpk * NOTE: 225545916cd2Sjpk * TODO: 225645916cd2Sjpk * QUESTION: 225745916cd2Sjpk */ 225845916cd2Sjpk 225945916cd2Sjpk void 226045916cd2Sjpk audit_sec_attributes(caddr_t *ad, struct vnode *vp) 226145916cd2Sjpk { 226245916cd2Sjpk /* Dump the SL */ 226345916cd2Sjpk if (is_system_labeled()) { 226445916cd2Sjpk ts_label_t *tsl; 226545916cd2Sjpk bslabel_t *bsl; 226645916cd2Sjpk 226745916cd2Sjpk tsl = getflabel(vp); 226845916cd2Sjpk if (tsl == NULL) 226945916cd2Sjpk return; /* nothing else to do */ 227045916cd2Sjpk 227145916cd2Sjpk bsl = label2bslabel(tsl); 227245916cd2Sjpk if (bsl == NULL) 227345916cd2Sjpk return; /* nothing else to do */ 227445916cd2Sjpk au_write(ad, au_to_label(bsl)); 227545916cd2Sjpk label_rele(tsl); 227645916cd2Sjpk } 227745916cd2Sjpk 227845916cd2Sjpk } /* AUDIT_SEC_ATTRIBUTES */ 2279