2008-07-31 09:54:35 +00:00
|
|
|
/*-
|
2008-07-22 15:29:48 +00:00
|
|
|
* Copyright (c) 1999-2005 Apple Inc.
|
2007-06-07 22:27:15 +00:00
|
|
|
* Copyright (c) 2006-2007 Robert N. M. Watson
|
2006-02-01 20:01:18 +00:00
|
|
|
* All rights reserved.
|
|
|
|
*
|
|
|
|
* Redistribution and use in source and binary forms, with or without
|
|
|
|
* modification, are permitted provided that the following conditions
|
|
|
|
* are met:
|
|
|
|
* 1. Redistributions of source code must retain the above copyright
|
|
|
|
* notice, this list of conditions and the following disclaimer.
|
|
|
|
* 2. Redistributions in binary form must reproduce the above copyright
|
|
|
|
* notice, this list of conditions and the following disclaimer in the
|
|
|
|
* documentation and/or other materials provided with the distribution.
|
2008-07-22 15:29:48 +00:00
|
|
|
* 3. Neither the name of Apple Inc. ("Apple") nor the names of
|
2006-02-01 20:01:18 +00:00
|
|
|
* its contributors may be used to endorse or promote products derived
|
|
|
|
* from this software without specific prior written permission.
|
|
|
|
*
|
|
|
|
* THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND
|
|
|
|
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
|
|
|
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
|
|
|
* ARE DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR
|
|
|
|
* ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
|
|
|
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
|
|
|
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
|
|
|
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
|
|
|
|
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
|
|
|
|
* IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
|
|
|
|
* POSSIBILITY OF SUCH DAMAGE.
|
|
|
|
*/
|
|
|
|
|
2008-04-13 22:06:56 +00:00
|
|
|
#include <sys/cdefs.h>
|
|
|
|
__FBSDID("$FreeBSD$");
|
|
|
|
|
2006-02-01 20:01:18 +00:00
|
|
|
#include <sys/param.h>
|
|
|
|
#include <sys/condvar.h>
|
|
|
|
#include <sys/conf.h>
|
|
|
|
#include <sys/file.h>
|
|
|
|
#include <sys/filedesc.h>
|
|
|
|
#include <sys/fcntl.h>
|
|
|
|
#include <sys/ipc.h>
|
2013-01-17 21:02:53 +00:00
|
|
|
#include <sys/jail.h>
|
2006-02-01 20:01:18 +00:00
|
|
|
#include <sys/kernel.h>
|
|
|
|
#include <sys/kthread.h>
|
|
|
|
#include <sys/malloc.h>
|
|
|
|
#include <sys/mount.h>
|
|
|
|
#include <sys/namei.h>
|
2006-11-06 13:42:10 +00:00
|
|
|
#include <sys/priv.h>
|
2006-02-01 20:01:18 +00:00
|
|
|
#include <sys/proc.h>
|
|
|
|
#include <sys/queue.h>
|
|
|
|
#include <sys/socket.h>
|
|
|
|
#include <sys/socketvar.h>
|
|
|
|
#include <sys/protosw.h>
|
|
|
|
#include <sys/domain.h>
|
2007-07-01 20:51:30 +00:00
|
|
|
#include <sys/sysctl.h>
|
2006-02-01 20:01:18 +00:00
|
|
|
#include <sys/sysproto.h>
|
|
|
|
#include <sys/sysent.h>
|
|
|
|
#include <sys/systm.h>
|
|
|
|
#include <sys/ucred.h>
|
|
|
|
#include <sys/uio.h>
|
|
|
|
#include <sys/un.h>
|
|
|
|
#include <sys/unistd.h>
|
|
|
|
#include <sys/vnode.h>
|
|
|
|
|
2006-02-06 22:30:54 +00:00
|
|
|
#include <bsm/audit.h>
|
2006-03-04 17:00:55 +00:00
|
|
|
#include <bsm/audit_internal.h>
|
2006-02-06 22:30:54 +00:00
|
|
|
#include <bsm/audit_kevents.h>
|
|
|
|
|
2006-02-01 20:01:18 +00:00
|
|
|
#include <netinet/in.h>
|
|
|
|
#include <netinet/in_pcb.h>
|
|
|
|
|
|
|
|
#include <security/audit/audit.h>
|
|
|
|
#include <security/audit/audit_private.h>
|
|
|
|
|
2006-02-06 22:30:54 +00:00
|
|
|
#include <vm/uma.h>
|
|
|
|
|
2011-02-25 10:11:01 +00:00
|
|
|
FEATURE(audit, "BSM audit support");
|
|
|
|
|
Merge Perforce changes 93512, 93514, 93515 from TrustedBSD audit3
branch:
Integrate audit.c to audit_worker.c, so as to migrate the worker
thread implementation to its own .c file.
Populate audit_worker.c using parts now removed from audit.c:
- Move audit rotation global variables.
- Move audit_record_write(), audit_worker_rotate(),
audit_worker_drain(), audit_worker(), audit_rotate_vnode().
- Create audit_worker_init() from relevant parts of audit_init(),
which now calls this routine.
- Recreate audit_free(), which wraps uma_zfree() so that
audit_record_zone can be static to audit.c.
- Unstaticize various types and variables relating to the audit
record queue so that audit_worker can get to them. We may want
to wrap these in accessor methods at some point.
- Move AUDIT_PRINTF() to audit_private.h.
Addition of audit_worker.c to kernel configuration, missed in
earlier submit.
Obtained from: TrustedBSD Project
2006-03-19 16:03:43 +00:00
|
|
|
static uma_zone_t audit_record_zone;
|
2007-06-07 22:27:15 +00:00
|
|
|
static MALLOC_DEFINE(M_AUDITCRED, "audit_cred", "Audit cred storage");
|
2006-02-01 20:01:18 +00:00
|
|
|
MALLOC_DEFINE(M_AUDITDATA, "audit_data", "Audit data storage");
|
|
|
|
MALLOC_DEFINE(M_AUDITPATH, "audit_path", "Audit path storage");
|
|
|
|
MALLOC_DEFINE(M_AUDITTEXT, "audit_text", "Audit text storage");
|
2009-06-29 20:19:19 +00:00
|
|
|
MALLOC_DEFINE(M_AUDITGIDSET, "audit_gidset", "Audit GID set storage");
|
2006-02-01 20:01:18 +00:00
|
|
|
|
2011-11-07 15:43:11 +00:00
|
|
|
static SYSCTL_NODE(_security, OID_AUTO, audit, CTLFLAG_RW, 0,
|
2007-07-01 20:51:30 +00:00
|
|
|
"TrustedBSD audit controls");
|
|
|
|
|
2006-02-01 20:01:18 +00:00
|
|
|
/*
|
2007-06-01 21:58:59 +00:00
|
|
|
* Audit control settings that are set/read by system calls and are hence
|
|
|
|
* non-static.
|
|
|
|
*
|
2006-02-01 20:01:18 +00:00
|
|
|
* Define the audit control flags.
|
|
|
|
*/
|
2006-03-19 17:34:00 +00:00
|
|
|
int audit_enabled;
|
|
|
|
int audit_suspended;
|
2006-02-01 20:01:18 +00:00
|
|
|
|
|
|
|
/*
|
2006-09-09 10:23:00 +00:00
|
|
|
* Flags controlling behavior in low storage situations. Should we panic if
|
|
|
|
* a write fails? Should we fail stop if we're out of disk space?
|
2006-02-01 20:01:18 +00:00
|
|
|
*/
|
2006-03-19 17:34:00 +00:00
|
|
|
int audit_panic_on_write_fail;
|
|
|
|
int audit_fail_stop;
|
2006-09-01 11:45:40 +00:00
|
|
|
int audit_argv;
|
|
|
|
int audit_arge;
|
2006-02-01 20:01:18 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* Are we currently "failing stop" due to out of disk space?
|
|
|
|
*/
|
2006-03-19 17:34:00 +00:00
|
|
|
int audit_in_failure;
|
2006-02-01 20:01:18 +00:00
|
|
|
|
|
|
|
/*
|
2007-06-14 03:02:33 +00:00
|
|
|
* Global audit statistics.
|
2006-02-01 20:01:18 +00:00
|
|
|
*/
|
2006-03-19 17:34:00 +00:00
|
|
|
struct audit_fstat audit_fstat;
|
2006-02-01 20:01:18 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* Preselection mask for non-attributable events.
|
|
|
|
*/
|
2006-03-19 17:34:00 +00:00
|
|
|
struct au_mask audit_nae_mask;
|
2006-02-01 20:01:18 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* Mutex to protect global variables shared between various threads and
|
|
|
|
* processes.
|
|
|
|
*/
|
2006-03-19 17:34:00 +00:00
|
|
|
struct mtx audit_mtx;
|
2006-02-01 20:01:18 +00:00
|
|
|
|
|
|
|
/*
|
2007-06-01 21:58:59 +00:00
|
|
|
* Queue of audit records ready for delivery to disk. We insert new records
|
|
|
|
* at the tail, and remove records from the head. Also, a count of the
|
|
|
|
* number of records used for checking queue depth. In addition, a counter
|
|
|
|
* of records that we have allocated but are not yet in the queue, which is
|
|
|
|
* needed to estimate the total size of the combined set of records
|
|
|
|
* outstanding in the system.
|
2006-02-01 20:01:18 +00:00
|
|
|
*/
|
2006-03-19 17:34:00 +00:00
|
|
|
struct kaudit_queue audit_q;
|
2009-04-19 14:53:17 +00:00
|
|
|
int audit_q_len;
|
|
|
|
int audit_pre_q_len;
|
2006-02-01 20:01:18 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* Audit queue control settings (minimum free, low/high water marks, etc.)
|
|
|
|
*/
|
2006-03-19 17:34:00 +00:00
|
|
|
struct au_qctrl audit_qctrl;
|
2006-02-01 20:01:18 +00:00
|
|
|
|
|
|
|
/*
|
2007-06-01 21:58:59 +00:00
|
|
|
* Condition variable to signal to the worker that it has work to do: either
|
|
|
|
* new records are in the queue, or a log replacement is taking place.
|
2006-02-01 20:01:18 +00:00
|
|
|
*/
|
2006-06-05 13:43:57 +00:00
|
|
|
struct cv audit_worker_cv;
|
2006-02-01 20:01:18 +00:00
|
|
|
|
|
|
|
/*
|
2006-06-05 13:43:57 +00:00
|
|
|
* Condition variable to flag when crossing the low watermark, meaning that
|
|
|
|
* threads blocked due to hitting the high watermark can wake up and continue
|
|
|
|
* to commit records.
|
2006-02-01 20:01:18 +00:00
|
|
|
*/
|
2006-06-05 13:43:57 +00:00
|
|
|
struct cv audit_watermark_cv;
|
2006-02-01 20:01:18 +00:00
|
|
|
|
2006-03-19 17:34:00 +00:00
|
|
|
/*
|
|
|
|
* Condition variable for auditing threads wait on when in fail-stop mode.
|
2007-06-01 21:58:59 +00:00
|
|
|
* Threads wait on this CV forever (and ever), never seeing the light of day
|
|
|
|
* again.
|
2006-02-01 20:01:18 +00:00
|
|
|
*/
|
2006-03-19 17:34:00 +00:00
|
|
|
static struct cv audit_fail_cv;
|
2006-02-01 20:01:18 +00:00
|
|
|
|
2008-11-11 21:57:03 +00:00
|
|
|
/*
|
|
|
|
* Kernel audit information. This will store the current audit address
|
|
|
|
* or host information that the kernel will use when it's generating
|
|
|
|
* audit records. This data is modified by the A_GET{SET}KAUDIT auditon(2)
|
|
|
|
* command.
|
|
|
|
*/
|
|
|
|
static struct auditinfo_addr audit_kinfo;
|
|
|
|
static struct rwlock audit_kinfo_lock;
|
|
|
|
|
2008-11-11 22:59:40 +00:00
|
|
|
#define KINFO_LOCK_INIT() rw_init(&audit_kinfo_lock, \
|
|
|
|
"audit_kinfo_lock")
|
2008-11-11 21:57:03 +00:00
|
|
|
#define KINFO_RLOCK() rw_rlock(&audit_kinfo_lock)
|
|
|
|
#define KINFO_WLOCK() rw_wlock(&audit_kinfo_lock)
|
|
|
|
#define KINFO_RUNLOCK() rw_runlock(&audit_kinfo_lock)
|
|
|
|
#define KINFO_WUNLOCK() rw_wunlock(&audit_kinfo_lock)
|
|
|
|
|
|
|
|
void
|
|
|
|
audit_set_kinfo(struct auditinfo_addr *ak)
|
|
|
|
{
|
|
|
|
|
|
|
|
KASSERT(ak->ai_termid.at_type == AU_IPv4 ||
|
|
|
|
ak->ai_termid.at_type == AU_IPv6,
|
|
|
|
("audit_set_kinfo: invalid address type"));
|
2008-11-11 22:59:40 +00:00
|
|
|
|
2008-11-11 21:57:03 +00:00
|
|
|
KINFO_WLOCK();
|
|
|
|
audit_kinfo = *ak;
|
|
|
|
KINFO_WUNLOCK();
|
|
|
|
}
|
|
|
|
|
|
|
|
void
|
|
|
|
audit_get_kinfo(struct auditinfo_addr *ak)
|
|
|
|
{
|
|
|
|
|
|
|
|
KASSERT(audit_kinfo.ai_termid.at_type == AU_IPv4 ||
|
|
|
|
audit_kinfo.ai_termid.at_type == AU_IPv6,
|
|
|
|
("audit_set_kinfo: invalid address type"));
|
2008-11-11 22:59:40 +00:00
|
|
|
|
2008-11-11 21:57:03 +00:00
|
|
|
KINFO_RLOCK();
|
|
|
|
*ak = audit_kinfo;
|
|
|
|
KINFO_RUNLOCK();
|
|
|
|
}
|
|
|
|
|
2006-02-01 20:01:18 +00:00
|
|
|
/*
|
2006-02-06 22:30:54 +00:00
|
|
|
* Construct an audit record for the passed thread.
|
2006-02-01 20:01:18 +00:00
|
|
|
*/
|
2006-02-06 22:30:54 +00:00
|
|
|
static int
|
|
|
|
audit_record_ctor(void *mem, int size, void *arg, int flags)
|
|
|
|
{
|
|
|
|
struct kaudit_record *ar;
|
|
|
|
struct thread *td;
|
2008-11-14 01:24:52 +00:00
|
|
|
struct ucred *cred;
|
2013-01-17 21:02:53 +00:00
|
|
|
struct prison *pr;
|
2006-02-06 22:30:54 +00:00
|
|
|
|
|
|
|
KASSERT(sizeof(*ar) == size, ("audit_record_ctor: wrong size"));
|
|
|
|
|
|
|
|
td = arg;
|
|
|
|
ar = mem;
|
|
|
|
bzero(ar, sizeof(*ar));
|
|
|
|
ar->k_ar.ar_magic = AUDIT_RECORD_MAGIC;
|
|
|
|
nanotime(&ar->k_ar.ar_starttime);
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Export the subject credential.
|
|
|
|
*/
|
2008-11-14 01:24:52 +00:00
|
|
|
cred = td->td_ucred;
|
|
|
|
cru2x(cred, &ar->k_ar.ar_subj_cred);
|
|
|
|
ar->k_ar.ar_subj_ruid = cred->cr_ruid;
|
|
|
|
ar->k_ar.ar_subj_rgid = cred->cr_rgid;
|
|
|
|
ar->k_ar.ar_subj_egid = cred->cr_groups[0];
|
|
|
|
ar->k_ar.ar_subj_auid = cred->cr_audit.ai_auid;
|
|
|
|
ar->k_ar.ar_subj_asid = cred->cr_audit.ai_asid;
|
2006-02-06 22:30:54 +00:00
|
|
|
ar->k_ar.ar_subj_pid = td->td_proc->p_pid;
|
2008-11-14 01:24:52 +00:00
|
|
|
ar->k_ar.ar_subj_amask = cred->cr_audit.ai_mask;
|
|
|
|
ar->k_ar.ar_subj_term_addr = cred->cr_audit.ai_termid;
|
2013-01-17 21:02:53 +00:00
|
|
|
/*
|
|
|
|
* If this process is jailed, make sure we capture the name of the
|
|
|
|
* jail so we can use it to generate a zonename token when we covert
|
|
|
|
* this record to BSM.
|
|
|
|
*/
|
|
|
|
if (jailed(cred)) {
|
|
|
|
pr = cred->cr_prison;
|
|
|
|
(void) strlcpy(ar->k_ar.ar_jailname, pr->pr_name,
|
|
|
|
sizeof(ar->k_ar.ar_jailname));
|
|
|
|
} else
|
|
|
|
ar->k_ar.ar_jailname[0] = '\0';
|
2006-02-06 22:30:54 +00:00
|
|
|
return (0);
|
|
|
|
}
|
|
|
|
|
2006-02-01 20:01:18 +00:00
|
|
|
static void
|
2006-02-06 22:30:54 +00:00
|
|
|
audit_record_dtor(void *mem, int size, void *arg)
|
2006-02-01 20:01:18 +00:00
|
|
|
{
|
2006-02-06 22:30:54 +00:00
|
|
|
struct kaudit_record *ar;
|
2006-02-01 20:01:18 +00:00
|
|
|
|
2006-02-06 22:30:54 +00:00
|
|
|
KASSERT(sizeof(*ar) == size, ("audit_record_dtor: wrong size"));
|
|
|
|
|
|
|
|
ar = mem;
|
|
|
|
if (ar->k_ar.ar_arg_upath1 != NULL)
|
2006-02-01 20:01:18 +00:00
|
|
|
free(ar->k_ar.ar_arg_upath1, M_AUDITPATH);
|
2006-02-06 22:30:54 +00:00
|
|
|
if (ar->k_ar.ar_arg_upath2 != NULL)
|
2006-02-01 20:01:18 +00:00
|
|
|
free(ar->k_ar.ar_arg_upath2, M_AUDITPATH);
|
2006-02-06 22:30:54 +00:00
|
|
|
if (ar->k_ar.ar_arg_text != NULL)
|
2006-02-01 20:01:18 +00:00
|
|
|
free(ar->k_ar.ar_arg_text, M_AUDITTEXT);
|
2006-02-06 22:30:54 +00:00
|
|
|
if (ar->k_udata != NULL)
|
2006-02-01 20:01:18 +00:00
|
|
|
free(ar->k_udata, M_AUDITDATA);
|
2006-09-01 11:45:40 +00:00
|
|
|
if (ar->k_ar.ar_arg_argv != NULL)
|
|
|
|
free(ar->k_ar.ar_arg_argv, M_AUDITTEXT);
|
|
|
|
if (ar->k_ar.ar_arg_envv != NULL)
|
|
|
|
free(ar->k_ar.ar_arg_envv, M_AUDITTEXT);
|
2009-06-29 20:19:19 +00:00
|
|
|
if (ar->k_ar.ar_arg_groups.gidset != NULL)
|
|
|
|
free(ar->k_ar.ar_arg_groups.gidset, M_AUDITGIDSET);
|
2006-02-01 20:01:18 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Initialize the Audit subsystem: configuration state, work queue,
|
|
|
|
* synchronization primitives, worker thread, and trigger device node. Also
|
|
|
|
* call into the BSM assembly code to initialize it.
|
|
|
|
*/
|
|
|
|
static void
|
|
|
|
audit_init(void)
|
|
|
|
{
|
|
|
|
|
|
|
|
audit_enabled = 0;
|
|
|
|
audit_suspended = 0;
|
|
|
|
audit_panic_on_write_fail = 0;
|
|
|
|
audit_fail_stop = 0;
|
|
|
|
audit_in_failure = 0;
|
2006-09-01 11:45:40 +00:00
|
|
|
audit_argv = 0;
|
|
|
|
audit_arge = 0;
|
2006-02-01 20:01:18 +00:00
|
|
|
|
2007-06-01 21:58:59 +00:00
|
|
|
audit_fstat.af_filesz = 0; /* '0' means unset, unbounded. */
|
2006-03-19 17:34:00 +00:00
|
|
|
audit_fstat.af_currsz = 0;
|
2007-10-29 18:07:48 +00:00
|
|
|
audit_nae_mask.am_success = 0;
|
|
|
|
audit_nae_mask.am_failure = 0;
|
2006-02-01 20:01:18 +00:00
|
|
|
|
|
|
|
TAILQ_INIT(&audit_q);
|
|
|
|
audit_q_len = 0;
|
|
|
|
audit_pre_q_len = 0;
|
|
|
|
audit_qctrl.aq_hiwater = AQ_HIWATER;
|
|
|
|
audit_qctrl.aq_lowater = AQ_LOWATER;
|
|
|
|
audit_qctrl.aq_bufsz = AQ_BUFSZ;
|
|
|
|
audit_qctrl.aq_minfree = AU_FS_MINFREE;
|
|
|
|
|
2008-11-11 21:57:03 +00:00
|
|
|
audit_kinfo.ai_termid.at_type = AU_IPv4;
|
|
|
|
audit_kinfo.ai_termid.at_addr[0] = INADDR_ANY;
|
|
|
|
|
2006-02-01 20:01:18 +00:00
|
|
|
mtx_init(&audit_mtx, "audit_mtx", NULL, MTX_DEF);
|
2008-11-11 21:57:03 +00:00
|
|
|
KINFO_LOCK_INIT();
|
2006-06-05 13:43:57 +00:00
|
|
|
cv_init(&audit_worker_cv, "audit_worker_cv");
|
|
|
|
cv_init(&audit_watermark_cv, "audit_watermark_cv");
|
2006-02-01 20:01:18 +00:00
|
|
|
cv_init(&audit_fail_cv, "audit_fail_cv");
|
|
|
|
|
2006-06-05 14:11:28 +00:00
|
|
|
audit_record_zone = uma_zcreate("audit_record",
|
2006-02-06 22:30:54 +00:00
|
|
|
sizeof(struct kaudit_record), audit_record_ctor,
|
|
|
|
audit_record_dtor, NULL, NULL, UMA_ALIGN_PTR, 0);
|
|
|
|
|
2006-02-01 20:01:18 +00:00
|
|
|
/* Initialize the BSM audit subsystem. */
|
|
|
|
kau_init();
|
|
|
|
|
|
|
|
audit_trigger_init();
|
|
|
|
|
|
|
|
/* Register shutdown handler. */
|
|
|
|
EVENTHANDLER_REGISTER(shutdown_pre_sync, audit_shutdown, NULL,
|
|
|
|
SHUTDOWN_PRI_FIRST);
|
|
|
|
|
Merge Perforce changes 93512, 93514, 93515 from TrustedBSD audit3
branch:
Integrate audit.c to audit_worker.c, so as to migrate the worker
thread implementation to its own .c file.
Populate audit_worker.c using parts now removed from audit.c:
- Move audit rotation global variables.
- Move audit_record_write(), audit_worker_rotate(),
audit_worker_drain(), audit_worker(), audit_rotate_vnode().
- Create audit_worker_init() from relevant parts of audit_init(),
which now calls this routine.
- Recreate audit_free(), which wraps uma_zfree() so that
audit_record_zone can be static to audit.c.
- Unstaticize various types and variables relating to the audit
record queue so that audit_worker can get to them. We may want
to wrap these in accessor methods at some point.
- Move AUDIT_PRINTF() to audit_private.h.
Addition of audit_worker.c to kernel configuration, missed in
earlier submit.
Obtained from: TrustedBSD Project
2006-03-19 16:03:43 +00:00
|
|
|
/* Start audit worker thread. */
|
|
|
|
audit_worker_init();
|
2006-02-01 20:01:18 +00:00
|
|
|
}
|
|
|
|
|
2008-03-16 10:58:09 +00:00
|
|
|
SYSINIT(audit_init, SI_SUB_AUDIT, SI_ORDER_FIRST, audit_init, NULL);
|
2006-02-01 20:01:18 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* Drain the audit queue and close the log at shutdown. Note that this can
|
|
|
|
* be called both from the system shutdown path and also from audit
|
|
|
|
* configuration syscalls, so 'arg' and 'howto' are ignored.
|
2008-06-03 11:06:34 +00:00
|
|
|
*
|
|
|
|
* XXXRW: In FreeBSD 7.x and 8.x, this fails to wait for the record queue to
|
|
|
|
* drain before returning, which could lead to lost records on shutdown.
|
2006-02-01 20:01:18 +00:00
|
|
|
*/
|
|
|
|
void
|
|
|
|
audit_shutdown(void *arg, int howto)
|
|
|
|
{
|
|
|
|
|
|
|
|
audit_rotate_vnode(NULL, NULL);
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Return the current thread's audit record, if any.
|
|
|
|
*/
|
2007-05-23 09:32:30 +00:00
|
|
|
struct kaudit_record *
|
2006-02-01 20:01:18 +00:00
|
|
|
currecord(void)
|
|
|
|
{
|
|
|
|
|
|
|
|
return (curthread->td_ar);
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* XXXAUDIT: There are a number of races present in the code below due to
|
|
|
|
* release and re-grab of the mutex. The code should be revised to become
|
|
|
|
* slightly less racy.
|
|
|
|
*
|
|
|
|
* XXXAUDIT: Shouldn't there be logic here to sleep waiting on available
|
|
|
|
* pre_q space, suspending the system call until there is room?
|
|
|
|
*/
|
|
|
|
struct kaudit_record *
|
|
|
|
audit_new(int event, struct thread *td)
|
|
|
|
{
|
|
|
|
struct kaudit_record *ar;
|
|
|
|
int no_record;
|
|
|
|
|
2006-02-06 22:30:54 +00:00
|
|
|
mtx_lock(&audit_mtx);
|
|
|
|
no_record = (audit_suspended || !audit_enabled);
|
|
|
|
mtx_unlock(&audit_mtx);
|
|
|
|
if (no_record)
|
|
|
|
return (NULL);
|
2006-02-01 20:01:18 +00:00
|
|
|
|
|
|
|
/*
|
2006-12-28 22:18:43 +00:00
|
|
|
* Note: the number of outstanding uncommitted audit records is
|
|
|
|
* limited to the number of concurrent threads servicing system calls
|
|
|
|
* in the kernel.
|
2006-02-01 20:01:18 +00:00
|
|
|
*/
|
2006-02-06 22:30:54 +00:00
|
|
|
ar = uma_zalloc_arg(audit_record_zone, td, M_WAITOK);
|
|
|
|
ar->k_ar.ar_event = event;
|
2006-02-01 20:01:18 +00:00
|
|
|
|
|
|
|
mtx_lock(&audit_mtx);
|
|
|
|
audit_pre_q_len++;
|
|
|
|
mtx_unlock(&audit_mtx);
|
|
|
|
|
|
|
|
return (ar);
|
|
|
|
}
|
|
|
|
|
Merge Perforce changes 93512, 93514, 93515 from TrustedBSD audit3
branch:
Integrate audit.c to audit_worker.c, so as to migrate the worker
thread implementation to its own .c file.
Populate audit_worker.c using parts now removed from audit.c:
- Move audit rotation global variables.
- Move audit_record_write(), audit_worker_rotate(),
audit_worker_drain(), audit_worker(), audit_rotate_vnode().
- Create audit_worker_init() from relevant parts of audit_init(),
which now calls this routine.
- Recreate audit_free(), which wraps uma_zfree() so that
audit_record_zone can be static to audit.c.
- Unstaticize various types and variables relating to the audit
record queue so that audit_worker can get to them. We may want
to wrap these in accessor methods at some point.
- Move AUDIT_PRINTF() to audit_private.h.
Addition of audit_worker.c to kernel configuration, missed in
earlier submit.
Obtained from: TrustedBSD Project
2006-03-19 16:03:43 +00:00
|
|
|
void
|
|
|
|
audit_free(struct kaudit_record *ar)
|
|
|
|
{
|
|
|
|
|
|
|
|
uma_zfree(audit_record_zone, ar);
|
|
|
|
}
|
|
|
|
|
2006-02-01 20:01:18 +00:00
|
|
|
void
|
|
|
|
audit_commit(struct kaudit_record *ar, int error, int retval)
|
|
|
|
{
|
Introduce support for per-audit pipe preselection independent from the
global audit trail configuration. This allows applications consuming
audit trails to specify parameters for which audit records are of
interest, including selecting records not required by the global trail.
Allowing application interest specification without changing the global
configuration allows intrusion detection systems to run without
interfering with global auditing or each other (if multiple are
present). To implement this:
- Kernel audit records now carry a flag to indicate whether they have
been selected by the global trail or by the audit pipe subsystem,
set during record commit, so that this information is available
after BSM conversion when delivering the BSM to the trail and audit
pipes in the audit worker thread asynchronously. Preselection by
either record target will cause the record to be kept.
- Similar changes to preselection when the audit record is created
when the system call is entering: consult both the global trail and
pipes.
- au_preselect() now accepts the class in order to avoid repeatedly
looking up the mask for each preselection test.
- Define a series of ioctls that allow applications to specify whether
they want to track the global trail, or program their own
preselection parameters: they may specify their own flags and naflags
masks, similar to the global masks of the same name, as well as a set
of per-auid masks. They also set a per-pipe mode specifying whether
they track the global trail, or user their own -- the door is left
open for future additional modes. A new ioctl is defined to allow a
user process to flush the current audit pipe queue, which can be used
after reprogramming pre-selection to make sure that only records of
interest are received in future reads.
- Audit pipe data structures are extended to hold the additional fields
necessary to support preselection. By default, audit pipes track the
global trail, so "praudit /dev/auditpipe" will track the global audit
trail even though praudit doesn't program the audit pipe selection
model.
- Comment about the complexities of potentially adding partial read
support to audit pipes.
By using a set of ioctls, applications can select which records are of
interest, and toggle the preselection mode.
Obtained from: TrustedBSD Project
2006-06-05 14:48:17 +00:00
|
|
|
au_event_t event;
|
|
|
|
au_class_t class;
|
|
|
|
au_id_t auid;
|
2006-02-01 20:01:18 +00:00
|
|
|
int sorf;
|
|
|
|
struct au_mask *aumask;
|
|
|
|
|
|
|
|
if (ar == NULL)
|
|
|
|
return;
|
|
|
|
|
|
|
|
/*
|
2007-06-01 21:58:59 +00:00
|
|
|
* Decide whether to commit the audit record by checking the error
|
|
|
|
* value from the system call and using the appropriate audit mask.
|
2006-02-01 20:01:18 +00:00
|
|
|
*/
|
|
|
|
if (ar->k_ar.ar_subj_auid == AU_DEFAUDITID)
|
|
|
|
aumask = &audit_nae_mask;
|
|
|
|
else
|
|
|
|
aumask = &ar->k_ar.ar_subj_amask;
|
2006-03-19 17:34:00 +00:00
|
|
|
|
2006-02-01 20:01:18 +00:00
|
|
|
if (error)
|
|
|
|
sorf = AU_PRS_FAILURE;
|
|
|
|
else
|
|
|
|
sorf = AU_PRS_SUCCESS;
|
|
|
|
|
2009-07-28 21:39:58 +00:00
|
|
|
/*
|
|
|
|
* syscalls.master sometimes contains a prototype event number, which
|
|
|
|
* we will transform into a more specific event number now that we
|
|
|
|
* have more complete information gathered during the system call.
|
|
|
|
*/
|
2006-02-01 20:01:18 +00:00
|
|
|
switch(ar->k_ar.ar_event) {
|
|
|
|
case AUE_OPEN_RWTC:
|
2008-03-01 11:40:49 +00:00
|
|
|
ar->k_ar.ar_event = audit_flags_and_error_to_openevent(
|
2006-02-01 20:01:18 +00:00
|
|
|
ar->k_ar.ar_arg_fflags, error);
|
|
|
|
break;
|
|
|
|
|
2009-07-28 21:39:58 +00:00
|
|
|
case AUE_OPENAT_RWTC:
|
|
|
|
ar->k_ar.ar_event = audit_flags_and_error_to_openatevent(
|
|
|
|
ar->k_ar.ar_arg_fflags, error);
|
|
|
|
break;
|
|
|
|
|
2006-02-01 20:01:18 +00:00
|
|
|
case AUE_SYSCTL:
|
2008-03-01 11:40:49 +00:00
|
|
|
ar->k_ar.ar_event = audit_ctlname_to_sysctlevent(
|
2006-02-01 20:01:18 +00:00
|
|
|
ar->k_ar.ar_arg_ctlname, ar->k_ar.ar_valid_arg);
|
|
|
|
break;
|
|
|
|
|
|
|
|
case AUE_AUDITON:
|
2007-06-11 22:10:54 +00:00
|
|
|
/* Convert the auditon() command to an event. */
|
2006-02-01 20:01:18 +00:00
|
|
|
ar->k_ar.ar_event = auditon_command_event(ar->k_ar.ar_arg_cmd);
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
Introduce support for per-audit pipe preselection independent from the
global audit trail configuration. This allows applications consuming
audit trails to specify parameters for which audit records are of
interest, including selecting records not required by the global trail.
Allowing application interest specification without changing the global
configuration allows intrusion detection systems to run without
interfering with global auditing or each other (if multiple are
present). To implement this:
- Kernel audit records now carry a flag to indicate whether they have
been selected by the global trail or by the audit pipe subsystem,
set during record commit, so that this information is available
after BSM conversion when delivering the BSM to the trail and audit
pipes in the audit worker thread asynchronously. Preselection by
either record target will cause the record to be kept.
- Similar changes to preselection when the audit record is created
when the system call is entering: consult both the global trail and
pipes.
- au_preselect() now accepts the class in order to avoid repeatedly
looking up the mask for each preselection test.
- Define a series of ioctls that allow applications to specify whether
they want to track the global trail, or program their own
preselection parameters: they may specify their own flags and naflags
masks, similar to the global masks of the same name, as well as a set
of per-auid masks. They also set a per-pipe mode specifying whether
they track the global trail, or user their own -- the door is left
open for future additional modes. A new ioctl is defined to allow a
user process to flush the current audit pipe queue, which can be used
after reprogramming pre-selection to make sure that only records of
interest are received in future reads.
- Audit pipe data structures are extended to hold the additional fields
necessary to support preselection. By default, audit pipes track the
global trail, so "praudit /dev/auditpipe" will track the global audit
trail even though praudit doesn't program the audit pipe selection
model.
- Comment about the complexities of potentially adding partial read
support to audit pipes.
By using a set of ioctls, applications can select which records are of
interest, and toggle the preselection mode.
Obtained from: TrustedBSD Project
2006-06-05 14:48:17 +00:00
|
|
|
auid = ar->k_ar.ar_subj_auid;
|
|
|
|
event = ar->k_ar.ar_event;
|
|
|
|
class = au_event_class(event);
|
|
|
|
|
|
|
|
ar->k_ar_commit |= AR_COMMIT_KERNEL;
|
|
|
|
if (au_preselect(event, class, aumask, sorf) != 0)
|
|
|
|
ar->k_ar_commit |= AR_PRESELECT_TRAIL;
|
|
|
|
if (audit_pipe_preselect(auid, event, class, sorf,
|
|
|
|
ar->k_ar_commit & AR_PRESELECT_TRAIL) != 0)
|
|
|
|
ar->k_ar_commit |= AR_PRESELECT_PIPE;
|
2006-09-17 17:52:57 +00:00
|
|
|
if ((ar->k_ar_commit & (AR_PRESELECT_TRAIL | AR_PRESELECT_PIPE |
|
|
|
|
AR_PRESELECT_USER_TRAIL | AR_PRESELECT_USER_PIPE)) == 0) {
|
2006-02-01 20:01:18 +00:00
|
|
|
mtx_lock(&audit_mtx);
|
|
|
|
audit_pre_q_len--;
|
|
|
|
mtx_unlock(&audit_mtx);
|
2006-06-05 15:38:12 +00:00
|
|
|
audit_free(ar);
|
2006-02-01 20:01:18 +00:00
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
|
|
|
ar->k_ar.ar_errno = error;
|
|
|
|
ar->k_ar.ar_retval = retval;
|
|
|
|
nanotime(&ar->k_ar.ar_endtime);
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Note: it could be that some records initiated while audit was
|
|
|
|
* enabled should still be committed?
|
|
|
|
*/
|
2007-06-01 21:58:59 +00:00
|
|
|
mtx_lock(&audit_mtx);
|
2006-02-01 20:01:18 +00:00
|
|
|
if (audit_suspended || !audit_enabled) {
|
|
|
|
audit_pre_q_len--;
|
|
|
|
mtx_unlock(&audit_mtx);
|
2006-06-05 15:38:12 +00:00
|
|
|
audit_free(ar);
|
2006-02-01 20:01:18 +00:00
|
|
|
return;
|
|
|
|
}
|
2006-03-19 17:34:00 +00:00
|
|
|
|
2006-02-01 20:01:18 +00:00
|
|
|
/*
|
2007-06-01 13:53:37 +00:00
|
|
|
* Constrain the number of committed audit records based on the
|
|
|
|
* configurable parameter.
|
2006-02-01 20:01:18 +00:00
|
|
|
*/
|
2007-06-01 13:53:37 +00:00
|
|
|
while (audit_q_len >= audit_qctrl.aq_hiwater)
|
2006-06-05 13:43:57 +00:00
|
|
|
cv_wait(&audit_watermark_cv, &audit_mtx);
|
2006-02-01 20:01:18 +00:00
|
|
|
|
|
|
|
TAILQ_INSERT_TAIL(&audit_q, ar, k_q);
|
|
|
|
audit_q_len++;
|
|
|
|
audit_pre_q_len--;
|
2006-06-05 13:43:57 +00:00
|
|
|
cv_signal(&audit_worker_cv);
|
2006-02-01 20:01:18 +00:00
|
|
|
mtx_unlock(&audit_mtx);
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* audit_syscall_enter() is called on entry to each system call. It is
|
|
|
|
* responsible for deciding whether or not to audit the call (preselection),
|
|
|
|
* and if so, allocating a per-thread audit record. audit_new() will fill in
|
|
|
|
* basic thread/credential properties.
|
|
|
|
*/
|
|
|
|
void
|
|
|
|
audit_syscall_enter(unsigned short code, struct thread *td)
|
|
|
|
{
|
|
|
|
struct au_mask *aumask;
|
Introduce support for per-audit pipe preselection independent from the
global audit trail configuration. This allows applications consuming
audit trails to specify parameters for which audit records are of
interest, including selecting records not required by the global trail.
Allowing application interest specification without changing the global
configuration allows intrusion detection systems to run without
interfering with global auditing or each other (if multiple are
present). To implement this:
- Kernel audit records now carry a flag to indicate whether they have
been selected by the global trail or by the audit pipe subsystem,
set during record commit, so that this information is available
after BSM conversion when delivering the BSM to the trail and audit
pipes in the audit worker thread asynchronously. Preselection by
either record target will cause the record to be kept.
- Similar changes to preselection when the audit record is created
when the system call is entering: consult both the global trail and
pipes.
- au_preselect() now accepts the class in order to avoid repeatedly
looking up the mask for each preselection test.
- Define a series of ioctls that allow applications to specify whether
they want to track the global trail, or program their own
preselection parameters: they may specify their own flags and naflags
masks, similar to the global masks of the same name, as well as a set
of per-auid masks. They also set a per-pipe mode specifying whether
they track the global trail, or user their own -- the door is left
open for future additional modes. A new ioctl is defined to allow a
user process to flush the current audit pipe queue, which can be used
after reprogramming pre-selection to make sure that only records of
interest are received in future reads.
- Audit pipe data structures are extended to hold the additional fields
necessary to support preselection. By default, audit pipes track the
global trail, so "praudit /dev/auditpipe" will track the global audit
trail even though praudit doesn't program the audit pipe selection
model.
- Comment about the complexities of potentially adding partial read
support to audit pipes.
By using a set of ioctls, applications can select which records are of
interest, and toggle the preselection mode.
Obtained from: TrustedBSD Project
2006-06-05 14:48:17 +00:00
|
|
|
au_class_t class;
|
|
|
|
au_event_t event;
|
|
|
|
au_id_t auid;
|
2006-02-01 20:01:18 +00:00
|
|
|
|
|
|
|
KASSERT(td->td_ar == NULL, ("audit_syscall_enter: td->td_ar != NULL"));
|
2009-03-09 10:45:58 +00:00
|
|
|
KASSERT((td->td_pflags & TDP_AUDITREC) == 0,
|
|
|
|
("audit_syscall_enter: TDP_AUDITREC set"));
|
2006-02-01 20:01:18 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* In FreeBSD, each ABI has its own system call table, and hence
|
|
|
|
* mapping of system call codes to audit events. Convert the code to
|
|
|
|
* an audit event identifier using the process system call table
|
|
|
|
* reference. In Darwin, there's only one, so we use the global
|
2006-10-02 11:32:23 +00:00
|
|
|
* symbol for the system call table. No audit record is generated
|
|
|
|
* for bad system calls, as no operation has been performed.
|
2006-02-01 20:01:18 +00:00
|
|
|
*/
|
|
|
|
if (code >= td->td_proc->p_sysent->sv_size)
|
|
|
|
return;
|
|
|
|
|
Introduce support for per-audit pipe preselection independent from the
global audit trail configuration. This allows applications consuming
audit trails to specify parameters for which audit records are of
interest, including selecting records not required by the global trail.
Allowing application interest specification without changing the global
configuration allows intrusion detection systems to run without
interfering with global auditing or each other (if multiple are
present). To implement this:
- Kernel audit records now carry a flag to indicate whether they have
been selected by the global trail or by the audit pipe subsystem,
set during record commit, so that this information is available
after BSM conversion when delivering the BSM to the trail and audit
pipes in the audit worker thread asynchronously. Preselection by
either record target will cause the record to be kept.
- Similar changes to preselection when the audit record is created
when the system call is entering: consult both the global trail and
pipes.
- au_preselect() now accepts the class in order to avoid repeatedly
looking up the mask for each preselection test.
- Define a series of ioctls that allow applications to specify whether
they want to track the global trail, or program their own
preselection parameters: they may specify their own flags and naflags
masks, similar to the global masks of the same name, as well as a set
of per-auid masks. They also set a per-pipe mode specifying whether
they track the global trail, or user their own -- the door is left
open for future additional modes. A new ioctl is defined to allow a
user process to flush the current audit pipe queue, which can be used
after reprogramming pre-selection to make sure that only records of
interest are received in future reads.
- Audit pipe data structures are extended to hold the additional fields
necessary to support preselection. By default, audit pipes track the
global trail, so "praudit /dev/auditpipe" will track the global audit
trail even though praudit doesn't program the audit pipe selection
model.
- Comment about the complexities of potentially adding partial read
support to audit pipes.
By using a set of ioctls, applications can select which records are of
interest, and toggle the preselection mode.
Obtained from: TrustedBSD Project
2006-06-05 14:48:17 +00:00
|
|
|
event = td->td_proc->p_sysent->sv_table[code].sy_auevent;
|
|
|
|
if (event == AUE_NULL)
|
2006-02-01 20:01:18 +00:00
|
|
|
return;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Check which audit mask to use; either the kernel non-attributable
|
|
|
|
* event mask or the process audit mask.
|
|
|
|
*/
|
2007-06-07 22:27:15 +00:00
|
|
|
auid = td->td_ucred->cr_audit.ai_auid;
|
Introduce support for per-audit pipe preselection independent from the
global audit trail configuration. This allows applications consuming
audit trails to specify parameters for which audit records are of
interest, including selecting records not required by the global trail.
Allowing application interest specification without changing the global
configuration allows intrusion detection systems to run without
interfering with global auditing or each other (if multiple are
present). To implement this:
- Kernel audit records now carry a flag to indicate whether they have
been selected by the global trail or by the audit pipe subsystem,
set during record commit, so that this information is available
after BSM conversion when delivering the BSM to the trail and audit
pipes in the audit worker thread asynchronously. Preselection by
either record target will cause the record to be kept.
- Similar changes to preselection when the audit record is created
when the system call is entering: consult both the global trail and
pipes.
- au_preselect() now accepts the class in order to avoid repeatedly
looking up the mask for each preselection test.
- Define a series of ioctls that allow applications to specify whether
they want to track the global trail, or program their own
preselection parameters: they may specify their own flags and naflags
masks, similar to the global masks of the same name, as well as a set
of per-auid masks. They also set a per-pipe mode specifying whether
they track the global trail, or user their own -- the door is left
open for future additional modes. A new ioctl is defined to allow a
user process to flush the current audit pipe queue, which can be used
after reprogramming pre-selection to make sure that only records of
interest are received in future reads.
- Audit pipe data structures are extended to hold the additional fields
necessary to support preselection. By default, audit pipes track the
global trail, so "praudit /dev/auditpipe" will track the global audit
trail even though praudit doesn't program the audit pipe selection
model.
- Comment about the complexities of potentially adding partial read
support to audit pipes.
By using a set of ioctls, applications can select which records are of
interest, and toggle the preselection mode.
Obtained from: TrustedBSD Project
2006-06-05 14:48:17 +00:00
|
|
|
if (auid == AU_DEFAUDITID)
|
2006-02-01 20:01:18 +00:00
|
|
|
aumask = &audit_nae_mask;
|
|
|
|
else
|
2007-06-07 22:27:15 +00:00
|
|
|
aumask = &td->td_ucred->cr_audit.ai_mask;
|
2006-03-19 17:34:00 +00:00
|
|
|
|
2006-02-01 20:01:18 +00:00
|
|
|
/*
|
2007-06-01 21:58:59 +00:00
|
|
|
* Allocate an audit record, if preselection allows it, and store in
|
|
|
|
* the thread for later use.
|
2006-02-01 20:01:18 +00:00
|
|
|
*/
|
Introduce support for per-audit pipe preselection independent from the
global audit trail configuration. This allows applications consuming
audit trails to specify parameters for which audit records are of
interest, including selecting records not required by the global trail.
Allowing application interest specification without changing the global
configuration allows intrusion detection systems to run without
interfering with global auditing or each other (if multiple are
present). To implement this:
- Kernel audit records now carry a flag to indicate whether they have
been selected by the global trail or by the audit pipe subsystem,
set during record commit, so that this information is available
after BSM conversion when delivering the BSM to the trail and audit
pipes in the audit worker thread asynchronously. Preselection by
either record target will cause the record to be kept.
- Similar changes to preselection when the audit record is created
when the system call is entering: consult both the global trail and
pipes.
- au_preselect() now accepts the class in order to avoid repeatedly
looking up the mask for each preselection test.
- Define a series of ioctls that allow applications to specify whether
they want to track the global trail, or program their own
preselection parameters: they may specify their own flags and naflags
masks, similar to the global masks of the same name, as well as a set
of per-auid masks. They also set a per-pipe mode specifying whether
they track the global trail, or user their own -- the door is left
open for future additional modes. A new ioctl is defined to allow a
user process to flush the current audit pipe queue, which can be used
after reprogramming pre-selection to make sure that only records of
interest are received in future reads.
- Audit pipe data structures are extended to hold the additional fields
necessary to support preselection. By default, audit pipes track the
global trail, so "praudit /dev/auditpipe" will track the global audit
trail even though praudit doesn't program the audit pipe selection
model.
- Comment about the complexities of potentially adding partial read
support to audit pipes.
By using a set of ioctls, applications can select which records are of
interest, and toggle the preselection mode.
Obtained from: TrustedBSD Project
2006-06-05 14:48:17 +00:00
|
|
|
class = au_event_class(event);
|
|
|
|
if (au_preselect(event, class, aumask, AU_PRS_BOTH)) {
|
2006-02-01 20:01:18 +00:00
|
|
|
/*
|
|
|
|
* If we're out of space and need to suspend unprivileged
|
|
|
|
* processes, do that here rather than trying to allocate
|
|
|
|
* another audit record.
|
|
|
|
*
|
2006-12-28 22:18:43 +00:00
|
|
|
* Note: we might wish to be able to continue here in the
|
2006-02-01 20:01:18 +00:00
|
|
|
* future, if the system recovers. That should be possible
|
|
|
|
* by means of checking the condition in a loop around
|
|
|
|
* cv_wait(). It might be desirable to reevaluate whether an
|
|
|
|
* audit record is still required for this event by
|
|
|
|
* re-calling au_preselect().
|
|
|
|
*/
|
2006-11-06 13:42:10 +00:00
|
|
|
if (audit_in_failure &&
|
|
|
|
priv_check(td, PRIV_AUDIT_FAILSTOP) != 0) {
|
2006-02-01 20:01:18 +00:00
|
|
|
cv_wait(&audit_fail_cv, &audit_mtx);
|
|
|
|
panic("audit_failing_stop: thread continued");
|
|
|
|
}
|
Introduce support for per-audit pipe preselection independent from the
global audit trail configuration. This allows applications consuming
audit trails to specify parameters for which audit records are of
interest, including selecting records not required by the global trail.
Allowing application interest specification without changing the global
configuration allows intrusion detection systems to run without
interfering with global auditing or each other (if multiple are
present). To implement this:
- Kernel audit records now carry a flag to indicate whether they have
been selected by the global trail or by the audit pipe subsystem,
set during record commit, so that this information is available
after BSM conversion when delivering the BSM to the trail and audit
pipes in the audit worker thread asynchronously. Preselection by
either record target will cause the record to be kept.
- Similar changes to preselection when the audit record is created
when the system call is entering: consult both the global trail and
pipes.
- au_preselect() now accepts the class in order to avoid repeatedly
looking up the mask for each preselection test.
- Define a series of ioctls that allow applications to specify whether
they want to track the global trail, or program their own
preselection parameters: they may specify their own flags and naflags
masks, similar to the global masks of the same name, as well as a set
of per-auid masks. They also set a per-pipe mode specifying whether
they track the global trail, or user their own -- the door is left
open for future additional modes. A new ioctl is defined to allow a
user process to flush the current audit pipe queue, which can be used
after reprogramming pre-selection to make sure that only records of
interest are received in future reads.
- Audit pipe data structures are extended to hold the additional fields
necessary to support preselection. By default, audit pipes track the
global trail, so "praudit /dev/auditpipe" will track the global audit
trail even though praudit doesn't program the audit pipe selection
model.
- Comment about the complexities of potentially adding partial read
support to audit pipes.
By using a set of ioctls, applications can select which records are of
interest, and toggle the preselection mode.
Obtained from: TrustedBSD Project
2006-06-05 14:48:17 +00:00
|
|
|
td->td_ar = audit_new(event, td);
|
2009-03-09 10:45:58 +00:00
|
|
|
if (td->td_ar != NULL)
|
|
|
|
td->td_pflags |= TDP_AUDITREC;
|
|
|
|
} else if (audit_pipe_preselect(auid, event, class, AU_PRS_BOTH, 0)) {
|
Introduce support for per-audit pipe preselection independent from the
global audit trail configuration. This allows applications consuming
audit trails to specify parameters for which audit records are of
interest, including selecting records not required by the global trail.
Allowing application interest specification without changing the global
configuration allows intrusion detection systems to run without
interfering with global auditing or each other (if multiple are
present). To implement this:
- Kernel audit records now carry a flag to indicate whether they have
been selected by the global trail or by the audit pipe subsystem,
set during record commit, so that this information is available
after BSM conversion when delivering the BSM to the trail and audit
pipes in the audit worker thread asynchronously. Preselection by
either record target will cause the record to be kept.
- Similar changes to preselection when the audit record is created
when the system call is entering: consult both the global trail and
pipes.
- au_preselect() now accepts the class in order to avoid repeatedly
looking up the mask for each preselection test.
- Define a series of ioctls that allow applications to specify whether
they want to track the global trail, or program their own
preselection parameters: they may specify their own flags and naflags
masks, similar to the global masks of the same name, as well as a set
of per-auid masks. They also set a per-pipe mode specifying whether
they track the global trail, or user their own -- the door is left
open for future additional modes. A new ioctl is defined to allow a
user process to flush the current audit pipe queue, which can be used
after reprogramming pre-selection to make sure that only records of
interest are received in future reads.
- Audit pipe data structures are extended to hold the additional fields
necessary to support preselection. By default, audit pipes track the
global trail, so "praudit /dev/auditpipe" will track the global audit
trail even though praudit doesn't program the audit pipe selection
model.
- Comment about the complexities of potentially adding partial read
support to audit pipes.
By using a set of ioctls, applications can select which records are of
interest, and toggle the preselection mode.
Obtained from: TrustedBSD Project
2006-06-05 14:48:17 +00:00
|
|
|
td->td_ar = audit_new(event, td);
|
2009-03-09 10:45:58 +00:00
|
|
|
if (td->td_ar != NULL)
|
|
|
|
td->td_pflags |= TDP_AUDITREC;
|
|
|
|
} else
|
2006-02-01 20:01:18 +00:00
|
|
|
td->td_ar = NULL;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* audit_syscall_exit() is called from the return of every system call, or in
|
|
|
|
* the event of exit1(), during the execution of exit1(). It is responsible
|
|
|
|
* for committing the audit record, if any, along with return condition.
|
|
|
|
*/
|
|
|
|
void
|
|
|
|
audit_syscall_exit(int error, struct thread *td)
|
|
|
|
{
|
|
|
|
int retval;
|
|
|
|
|
|
|
|
/*
|
2007-06-01 21:58:59 +00:00
|
|
|
* Commit the audit record as desired; once we pass the record into
|
|
|
|
* audit_commit(), the memory is owned by the audit subsystem. The
|
|
|
|
* return value from the system call is stored on the user thread.
|
|
|
|
* If there was an error, the return value is set to -1, imitating
|
|
|
|
* the behavior of the cerror routine.
|
2006-02-01 20:01:18 +00:00
|
|
|
*/
|
|
|
|
if (error)
|
|
|
|
retval = -1;
|
|
|
|
else
|
|
|
|
retval = td->td_retval[0];
|
|
|
|
|
|
|
|
audit_commit(td->td_ar, error, retval);
|
|
|
|
td->td_ar = NULL;
|
2009-03-09 10:45:58 +00:00
|
|
|
td->td_pflags &= ~TDP_AUDITREC;
|
2006-02-01 20:01:18 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
void
|
2007-06-07 22:27:15 +00:00
|
|
|
audit_cred_copy(struct ucred *src, struct ucred *dest)
|
2006-02-01 20:01:18 +00:00
|
|
|
{
|
|
|
|
|
2007-06-07 22:27:15 +00:00
|
|
|
bcopy(&src->cr_audit, &dest->cr_audit, sizeof(dest->cr_audit));
|
2006-02-01 20:01:18 +00:00
|
|
|
}
|
|
|
|
|
2006-02-02 00:37:05 +00:00
|
|
|
void
|
2007-06-07 22:27:15 +00:00
|
|
|
audit_cred_destroy(struct ucred *cred)
|
2006-02-02 00:37:05 +00:00
|
|
|
{
|
|
|
|
|
|
|
|
}
|
|
|
|
|
2006-02-05 21:06:09 +00:00
|
|
|
void
|
2007-06-07 22:27:15 +00:00
|
|
|
audit_cred_init(struct ucred *cred)
|
2006-02-05 21:06:09 +00:00
|
|
|
{
|
|
|
|
|
2007-06-07 22:27:15 +00:00
|
|
|
bzero(&cred->cr_audit, sizeof(cred->cr_audit));
|
2006-02-05 21:06:09 +00:00
|
|
|
}
|
|
|
|
|
2006-03-19 17:34:00 +00:00
|
|
|
/*
|
2006-10-02 11:32:23 +00:00
|
|
|
* Initialize audit information for the first kernel process (proc 0) and for
|
|
|
|
* the first user process (init).
|
2006-02-01 20:01:18 +00:00
|
|
|
*/
|
|
|
|
void
|
2007-06-07 22:27:15 +00:00
|
|
|
audit_cred_kproc0(struct ucred *cred)
|
2006-02-01 20:01:18 +00:00
|
|
|
{
|
|
|
|
|
2007-06-11 22:10:54 +00:00
|
|
|
cred->cr_audit.ai_auid = AU_DEFAUDITID;
|
2008-01-28 17:33:46 +00:00
|
|
|
cred->cr_audit.ai_termid.at_type = AU_IPv4;
|
2006-02-01 20:01:18 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
void
|
2007-06-07 22:27:15 +00:00
|
|
|
audit_cred_proc1(struct ucred *cred)
|
2006-02-01 20:01:18 +00:00
|
|
|
{
|
|
|
|
|
2007-06-07 22:27:15 +00:00
|
|
|
cred->cr_audit.ai_auid = AU_DEFAUDITID;
|
2008-01-28 17:33:46 +00:00
|
|
|
cred->cr_audit.ai_termid.at_type = AU_IPv4;
|
2006-02-01 20:01:18 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
void
|
2007-06-07 22:27:15 +00:00
|
|
|
audit_thread_alloc(struct thread *td)
|
2006-02-01 20:01:18 +00:00
|
|
|
{
|
|
|
|
|
2007-06-07 22:27:15 +00:00
|
|
|
td->td_ar = NULL;
|
2006-02-01 20:01:18 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
void
|
2007-06-07 22:27:15 +00:00
|
|
|
audit_thread_free(struct thread *td)
|
2006-02-01 20:01:18 +00:00
|
|
|
{
|
|
|
|
|
2007-06-07 22:27:15 +00:00
|
|
|
KASSERT(td->td_ar == NULL, ("audit_thread_free: td_ar != NULL"));
|
2009-03-09 10:45:58 +00:00
|
|
|
KASSERT((td->td_pflags & TDP_AUDITREC) == 0,
|
|
|
|
("audit_thread_free: TDP_AUDITREC set"));
|
2006-02-01 20:01:18 +00:00
|
|
|
}
|
Implement AUE_CORE, which adds process core dump support into the kernel.
This change introduces audit_proc_coredump() which is called by coredump(9)
to create an audit record for the coredump event. When a process
dumps a core, it could be security relevant. It could be an indicator that
a stack within the process has been overflowed with an incorrectly constructed
malicious payload or a number of other events.
The record that is generated looks like this:
header,111,10,process dumped core,0,Thu Oct 25 19:36:29 2007, + 179 msec
argument,0,0xb,signal
path,/usr/home/csjp/test.core
subject,csjp,csjp,staff,csjp,staff,1101,1095,50457,10.37.129.2
return,success,1
trailer,111
- We allocate a completely new record to make sure we arent clobbering
the audit data associated with the syscall that produced the core
(assuming the core is being generated in response to SIGABRT and not
an invalid memory access).
- Shuffle around expand_name() so we can use the coredump name at the very
beginning of the coredump call. Make sure we free the storage referenced
by "name" if we need to bail out early.
- Audit both successful and failed coredump creation efforts
Obtained from: TrustedBSD Project
Reviewed by: rwatson
MFC after: 1 month
2007-10-26 01:23:07 +00:00
|
|
|
|
|
|
|
void
|
|
|
|
audit_proc_coredump(struct thread *td, char *path, int errcode)
|
|
|
|
{
|
|
|
|
struct kaudit_record *ar;
|
|
|
|
struct au_mask *aumask;
|
2008-11-14 01:24:52 +00:00
|
|
|
struct ucred *cred;
|
Implement AUE_CORE, which adds process core dump support into the kernel.
This change introduces audit_proc_coredump() which is called by coredump(9)
to create an audit record for the coredump event. When a process
dumps a core, it could be security relevant. It could be an indicator that
a stack within the process has been overflowed with an incorrectly constructed
malicious payload or a number of other events.
The record that is generated looks like this:
header,111,10,process dumped core,0,Thu Oct 25 19:36:29 2007, + 179 msec
argument,0,0xb,signal
path,/usr/home/csjp/test.core
subject,csjp,csjp,staff,csjp,staff,1101,1095,50457,10.37.129.2
return,success,1
trailer,111
- We allocate a completely new record to make sure we arent clobbering
the audit data associated with the syscall that produced the core
(assuming the core is being generated in response to SIGABRT and not
an invalid memory access).
- Shuffle around expand_name() so we can use the coredump name at the very
beginning of the coredump call. Make sure we free the storage referenced
by "name" if we need to bail out early.
- Audit both successful and failed coredump creation efforts
Obtained from: TrustedBSD Project
Reviewed by: rwatson
MFC after: 1 month
2007-10-26 01:23:07 +00:00
|
|
|
au_class_t class;
|
|
|
|
int ret, sorf;
|
|
|
|
char **pathp;
|
|
|
|
au_id_t auid;
|
|
|
|
|
2007-12-04 20:20:59 +00:00
|
|
|
ret = 0;
|
|
|
|
|
Implement AUE_CORE, which adds process core dump support into the kernel.
This change introduces audit_proc_coredump() which is called by coredump(9)
to create an audit record for the coredump event. When a process
dumps a core, it could be security relevant. It could be an indicator that
a stack within the process has been overflowed with an incorrectly constructed
malicious payload or a number of other events.
The record that is generated looks like this:
header,111,10,process dumped core,0,Thu Oct 25 19:36:29 2007, + 179 msec
argument,0,0xb,signal
path,/usr/home/csjp/test.core
subject,csjp,csjp,staff,csjp,staff,1101,1095,50457,10.37.129.2
return,success,1
trailer,111
- We allocate a completely new record to make sure we arent clobbering
the audit data associated with the syscall that produced the core
(assuming the core is being generated in response to SIGABRT and not
an invalid memory access).
- Shuffle around expand_name() so we can use the coredump name at the very
beginning of the coredump call. Make sure we free the storage referenced
by "name" if we need to bail out early.
- Audit both successful and failed coredump creation efforts
Obtained from: TrustedBSD Project
Reviewed by: rwatson
MFC after: 1 month
2007-10-26 01:23:07 +00:00
|
|
|
/*
|
|
|
|
* Make sure we are using the correct preselection mask.
|
|
|
|
*/
|
2008-11-14 01:24:52 +00:00
|
|
|
cred = td->td_ucred;
|
|
|
|
auid = cred->cr_audit.ai_auid;
|
Implement AUE_CORE, which adds process core dump support into the kernel.
This change introduces audit_proc_coredump() which is called by coredump(9)
to create an audit record for the coredump event. When a process
dumps a core, it could be security relevant. It could be an indicator that
a stack within the process has been overflowed with an incorrectly constructed
malicious payload or a number of other events.
The record that is generated looks like this:
header,111,10,process dumped core,0,Thu Oct 25 19:36:29 2007, + 179 msec
argument,0,0xb,signal
path,/usr/home/csjp/test.core
subject,csjp,csjp,staff,csjp,staff,1101,1095,50457,10.37.129.2
return,success,1
trailer,111
- We allocate a completely new record to make sure we arent clobbering
the audit data associated with the syscall that produced the core
(assuming the core is being generated in response to SIGABRT and not
an invalid memory access).
- Shuffle around expand_name() so we can use the coredump name at the very
beginning of the coredump call. Make sure we free the storage referenced
by "name" if we need to bail out early.
- Audit both successful and failed coredump creation efforts
Obtained from: TrustedBSD Project
Reviewed by: rwatson
MFC after: 1 month
2007-10-26 01:23:07 +00:00
|
|
|
if (auid == AU_DEFAUDITID)
|
|
|
|
aumask = &audit_nae_mask;
|
|
|
|
else
|
2008-11-14 01:24:52 +00:00
|
|
|
aumask = &cred->cr_audit.ai_mask;
|
Implement AUE_CORE, which adds process core dump support into the kernel.
This change introduces audit_proc_coredump() which is called by coredump(9)
to create an audit record for the coredump event. When a process
dumps a core, it could be security relevant. It could be an indicator that
a stack within the process has been overflowed with an incorrectly constructed
malicious payload or a number of other events.
The record that is generated looks like this:
header,111,10,process dumped core,0,Thu Oct 25 19:36:29 2007, + 179 msec
argument,0,0xb,signal
path,/usr/home/csjp/test.core
subject,csjp,csjp,staff,csjp,staff,1101,1095,50457,10.37.129.2
return,success,1
trailer,111
- We allocate a completely new record to make sure we arent clobbering
the audit data associated with the syscall that produced the core
(assuming the core is being generated in response to SIGABRT and not
an invalid memory access).
- Shuffle around expand_name() so we can use the coredump name at the very
beginning of the coredump call. Make sure we free the storage referenced
by "name" if we need to bail out early.
- Audit both successful and failed coredump creation efforts
Obtained from: TrustedBSD Project
Reviewed by: rwatson
MFC after: 1 month
2007-10-26 01:23:07 +00:00
|
|
|
/*
|
|
|
|
* It's possible for coredump(9) generation to fail. Make sure that
|
|
|
|
* we handle this case correctly for preselection.
|
|
|
|
*/
|
|
|
|
if (errcode != 0)
|
|
|
|
sorf = AU_PRS_FAILURE;
|
|
|
|
else
|
|
|
|
sorf = AU_PRS_SUCCESS;
|
|
|
|
class = au_event_class(AUE_CORE);
|
2008-08-11 20:14:56 +00:00
|
|
|
if (au_preselect(AUE_CORE, class, aumask, sorf) == 0 &&
|
|
|
|
audit_pipe_preselect(auid, AUE_CORE, class, sorf, 0) == 0)
|
Implement AUE_CORE, which adds process core dump support into the kernel.
This change introduces audit_proc_coredump() which is called by coredump(9)
to create an audit record for the coredump event. When a process
dumps a core, it could be security relevant. It could be an indicator that
a stack within the process has been overflowed with an incorrectly constructed
malicious payload or a number of other events.
The record that is generated looks like this:
header,111,10,process dumped core,0,Thu Oct 25 19:36:29 2007, + 179 msec
argument,0,0xb,signal
path,/usr/home/csjp/test.core
subject,csjp,csjp,staff,csjp,staff,1101,1095,50457,10.37.129.2
return,success,1
trailer,111
- We allocate a completely new record to make sure we arent clobbering
the audit data associated with the syscall that produced the core
(assuming the core is being generated in response to SIGABRT and not
an invalid memory access).
- Shuffle around expand_name() so we can use the coredump name at the very
beginning of the coredump call. Make sure we free the storage referenced
by "name" if we need to bail out early.
- Audit both successful and failed coredump creation efforts
Obtained from: TrustedBSD Project
Reviewed by: rwatson
MFC after: 1 month
2007-10-26 01:23:07 +00:00
|
|
|
return;
|
2008-11-14 01:24:52 +00:00
|
|
|
|
Implement AUE_CORE, which adds process core dump support into the kernel.
This change introduces audit_proc_coredump() which is called by coredump(9)
to create an audit record for the coredump event. When a process
dumps a core, it could be security relevant. It could be an indicator that
a stack within the process has been overflowed with an incorrectly constructed
malicious payload or a number of other events.
The record that is generated looks like this:
header,111,10,process dumped core,0,Thu Oct 25 19:36:29 2007, + 179 msec
argument,0,0xb,signal
path,/usr/home/csjp/test.core
subject,csjp,csjp,staff,csjp,staff,1101,1095,50457,10.37.129.2
return,success,1
trailer,111
- We allocate a completely new record to make sure we arent clobbering
the audit data associated with the syscall that produced the core
(assuming the core is being generated in response to SIGABRT and not
an invalid memory access).
- Shuffle around expand_name() so we can use the coredump name at the very
beginning of the coredump call. Make sure we free the storage referenced
by "name" if we need to bail out early.
- Audit both successful and failed coredump creation efforts
Obtained from: TrustedBSD Project
Reviewed by: rwatson
MFC after: 1 month
2007-10-26 01:23:07 +00:00
|
|
|
/*
|
|
|
|
* If we are interested in seeing this audit record, allocate it.
|
|
|
|
* Where possible coredump records should contain a pathname and arg32
|
|
|
|
* (signal) tokens.
|
|
|
|
*/
|
|
|
|
ar = audit_new(AUE_CORE, td);
|
|
|
|
if (path != NULL) {
|
|
|
|
pathp = &ar->k_ar.ar_arg_upath1;
|
|
|
|
*pathp = malloc(MAXPATHLEN, M_AUDITPATH, M_WAITOK);
|
2012-11-30 23:18:49 +00:00
|
|
|
audit_canon_path(td, AT_FDCWD, path, *pathp);
|
Implement AUE_CORE, which adds process core dump support into the kernel.
This change introduces audit_proc_coredump() which is called by coredump(9)
to create an audit record for the coredump event. When a process
dumps a core, it could be security relevant. It could be an indicator that
a stack within the process has been overflowed with an incorrectly constructed
malicious payload or a number of other events.
The record that is generated looks like this:
header,111,10,process dumped core,0,Thu Oct 25 19:36:29 2007, + 179 msec
argument,0,0xb,signal
path,/usr/home/csjp/test.core
subject,csjp,csjp,staff,csjp,staff,1101,1095,50457,10.37.129.2
return,success,1
trailer,111
- We allocate a completely new record to make sure we arent clobbering
the audit data associated with the syscall that produced the core
(assuming the core is being generated in response to SIGABRT and not
an invalid memory access).
- Shuffle around expand_name() so we can use the coredump name at the very
beginning of the coredump call. Make sure we free the storage referenced
by "name" if we need to bail out early.
- Audit both successful and failed coredump creation efforts
Obtained from: TrustedBSD Project
Reviewed by: rwatson
MFC after: 1 month
2007-10-26 01:23:07 +00:00
|
|
|
ARG_SET_VALID(ar, ARG_UPATH1);
|
|
|
|
}
|
|
|
|
ar->k_ar.ar_arg_signum = td->td_proc->p_sig;
|
|
|
|
ARG_SET_VALID(ar, ARG_SIGNUM);
|
|
|
|
if (errcode != 0)
|
|
|
|
ret = 1;
|
|
|
|
audit_commit(ar, errcode, ret);
|
|
|
|
}
|