freebsd-dev/contrib/openbsm/libbsm/bsm_notify.c

182 lines
4.9 KiB
C
Raw Normal View History

Vendor import of OpenBSM 1.1 alpha2, which incorporates the following changes since the last imported OpenBSM release: OpenBSM 1.1 alpha 2 - Include files in OpenBSM are now broken out into two parts: library builds required solely for user space, and system includes, which may also be required for use in the kernels of systems integrating OpenBSM. Submitted by Stacey Son. - Configure option --with-native-includes allows forcing the use of native include for system includes, rather than the versions bundled with OpenBSM. This is intended specifically for platforms that ship OpenBSM, have adapted versions of the system includes in a kernel source tree, and will use the OpenBSM build infrastructure with an unmodified OpenBSM distribution, allowing the customized system includes to be used with the OpenBSM build. Submitted by Stacey Son. - Various strcpy()'s/strcat()'s have been changed to strlcpy()'s/strlcat()'s or asprintf(). Added compat/strlcpy.h for Linux. - Remove compatibility defines for old Darwin token constant names; now only BSM token names are provided and used. - Add support for extended header tokens, which contain space for information on the host generating the record. - Add support for setting extended host information in the kernel, which is used for setting host information in extended header tokens. The audit_control file now supports a "host" parameter which can be used by auditd to set the information; if not present, the kernel parameters won't be set and auditd uses unextended headers for records that it generates. OpenBSM 1.1 alpha 1 - Add option to auditreduce(1) which allows users to invert sense of matching, such that BSM records that do not match, are selected. - Fix bug in audit_write() where we commit an incomplete record in the event there is an error writing the subject token. This was submitted by Diego Giagio. - Build support for Mac OS X 10.5.1 submitted by Eric Hall. - Fix a bug which resulted in host XML attributes not beingguments so that const strings can be passed as arguments to tokens. This patch was submitted by Xin LI. - Modify the -m option so users can select more then one audit event. - For Mac OS X, added Mach IPC support for audit trigger messages. - Fixed a bug in getacna() which resulted in a locking problem on Mac OS X. - Added LOG_PERROR flag to openlog when -d option is used with auditd. - AUE events added for Mac OS X Leopard system calls. Obtained from: TrustedBSD Project Sponsored by: Apple Inc.
2008-11-13 00:04:15 +00:00
/*-
* Copyright (c) 2004-2009 Apple Inc.
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
Vendor import of OpenBSM 1.1 alpha2, which incorporates the following changes since the last imported OpenBSM release: OpenBSM 1.1 alpha 2 - Include files in OpenBSM are now broken out into two parts: library builds required solely for user space, and system includes, which may also be required for use in the kernels of systems integrating OpenBSM. Submitted by Stacey Son. - Configure option --with-native-includes allows forcing the use of native include for system includes, rather than the versions bundled with OpenBSM. This is intended specifically for platforms that ship OpenBSM, have adapted versions of the system includes in a kernel source tree, and will use the OpenBSM build infrastructure with an unmodified OpenBSM distribution, allowing the customized system includes to be used with the OpenBSM build. Submitted by Stacey Son. - Various strcpy()'s/strcat()'s have been changed to strlcpy()'s/strlcat()'s or asprintf(). Added compat/strlcpy.h for Linux. - Remove compatibility defines for old Darwin token constant names; now only BSM token names are provided and used. - Add support for extended header tokens, which contain space for information on the host generating the record. - Add support for setting extended host information in the kernel, which is used for setting host information in extended header tokens. The audit_control file now supports a "host" parameter which can be used by auditd to set the information; if not present, the kernel parameters won't be set and auditd uses unextended headers for records that it generates. OpenBSM 1.1 alpha 1 - Add option to auditreduce(1) which allows users to invert sense of matching, such that BSM records that do not match, are selected. - Fix bug in audit_write() where we commit an incomplete record in the event there is an error writing the subject token. This was submitted by Diego Giagio. - Build support for Mac OS X 10.5.1 submitted by Eric Hall. - Fix a bug which resulted in host XML attributes not beingguments so that const strings can be passed as arguments to tokens. This patch was submitted by Xin LI. - Modify the -m option so users can select more then one audit event. - For Mac OS X, added Mach IPC support for audit trigger messages. - Fixed a bug in getacna() which resulted in a locking problem on Mac OS X. - Added LOG_PERROR flag to openlog when -d option is used with auditd. - AUE events added for Mac OS X Leopard system calls. Obtained from: TrustedBSD Project Sponsored by: Apple Inc.
2008-11-13 00:04:15 +00:00
* 3. Neither the name of Apple Inc. ("Apple") nor the names of
* its contributors may be used to endorse or promote products derived
* from this software without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR
* ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
* IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*
* $P4: //depot/projects/trustedbsd/openbsm/libbsm/bsm_notify.c#17 $
*/
/*
* Based on sample code from Marc Majka.
*/
Vendor branch import of TrustedBSD OpenBSM 1.0 alpha 5: - Update install notes to indicate /etc files are to be installed manually. - On systems without LOG_SECURITY, use LOG_AUTH. - Convert to autoconf/automake in order to move to a more portable (not BSD-specific) build infrastructure, and more easy conditional building of components. Currently, the primary feature loss is that automake does not have native support for manual symlinks. This will be addressed in a future OpenBSM release. - Add compat/queue.h, to be used on systems dated BSD queue macro libraries (as found on Linux). - Rename CHANGELOG to HISTORY, as our change log doesn't follow some of the existing conventions for a CHANGELOG. - Some private data structures moved from audit.h to audit_internal.h to prevent inappropriate use by applications and name space pollution. - Improved detection and use of endian macros using autoconf. - Avoid non-portable use of struct in6_addr, which is largely opaque. - Avoid leaking BSD kernel socket related token code to user space in bsm_token.c. - Teach System V IPC calls to look for Linux naming variations for certain struct ipc_perm fields. - Test for audit system calls, and if not present, don't build bsm_wrappers.c, bsm_notify.c, audit(8), and auditd(8), which rely on those system calls. - au_close() is not implemented on systems that don't have audit system calls, but au_close_buffer() is. - Work around missing BSDisms in bsm_wrapper.c. - Fix nested includes so including libbsm.h in an application on Linux picks up the necessary definitions. Obtained from: TrustedBSD Project
2006-03-04 16:45:52 +00:00
#include <sys/types.h>
#include <config/config.h>
#ifdef HAVE_FULL_QUEUE_H
#include <sys/queue.h>
#else /* !HAVE_FULL_QUEUE_H */
#include <compat/queue.h>
#endif /* !HAVE_FULL_QUEUE_H */
#include <bsm/audit_internal.h>
#include <bsm/libbsm.h>
Vendor branch import of TrustedBSD OpenBSM 1.0 alpha 5: - Update install notes to indicate /etc files are to be installed manually. - On systems without LOG_SECURITY, use LOG_AUTH. - Convert to autoconf/automake in order to move to a more portable (not BSD-specific) build infrastructure, and more easy conditional building of components. Currently, the primary feature loss is that automake does not have native support for manual symlinks. This will be addressed in a future OpenBSM release. - Add compat/queue.h, to be used on systems dated BSD queue macro libraries (as found on Linux). - Rename CHANGELOG to HISTORY, as our change log doesn't follow some of the existing conventions for a CHANGELOG. - Some private data structures moved from audit.h to audit_internal.h to prevent inappropriate use by applications and name space pollution. - Improved detection and use of endian macros using autoconf. - Avoid non-portable use of struct in6_addr, which is largely opaque. - Avoid leaking BSD kernel socket related token code to user space in bsm_token.c. - Teach System V IPC calls to look for Linux naming variations for certain struct ipc_perm fields. - Test for audit system calls, and if not present, don't build bsm_wrappers.c, bsm_notify.c, audit(8), and auditd(8), which rely on those system calls. - au_close() is not implemented on systems that don't have audit system calls, but au_close_buffer() is. - Work around missing BSDisms in bsm_wrapper.c. - Fix nested includes so including libbsm.h in an application on Linux picks up the necessary definitions. Obtained from: TrustedBSD Project
2006-03-04 16:45:52 +00:00
#include <errno.h>
#include <inttypes.h>
Vendor branch import of TrustedBSD OpenBSM 1.0 alpha 5: - Update install notes to indicate /etc files are to be installed manually. - On systems without LOG_SECURITY, use LOG_AUTH. - Convert to autoconf/automake in order to move to a more portable (not BSD-specific) build infrastructure, and more easy conditional building of components. Currently, the primary feature loss is that automake does not have native support for manual symlinks. This will be addressed in a future OpenBSM release. - Add compat/queue.h, to be used on systems dated BSD queue macro libraries (as found on Linux). - Rename CHANGELOG to HISTORY, as our change log doesn't follow some of the existing conventions for a CHANGELOG. - Some private data structures moved from audit.h to audit_internal.h to prevent inappropriate use by applications and name space pollution. - Improved detection and use of endian macros using autoconf. - Avoid non-portable use of struct in6_addr, which is largely opaque. - Avoid leaking BSD kernel socket related token code to user space in bsm_token.c. - Teach System V IPC calls to look for Linux naming variations for certain struct ipc_perm fields. - Test for audit system calls, and if not present, don't build bsm_wrappers.c, bsm_notify.c, audit(8), and auditd(8), which rely on those system calls. - au_close() is not implemented on systems that don't have audit system calls, but au_close_buffer() is. - Work around missing BSDisms in bsm_wrapper.c. - Fix nested includes so including libbsm.h in an application on Linux picks up the necessary definitions. Obtained from: TrustedBSD Project
2006-03-04 16:45:52 +00:00
#include <stdarg.h>
#include <string.h>
#include <syslog.h>
#ifdef __APPLE__
#include <notify.h>
/* If 1, assumes a kernel that sends the right notification. */
#define AUDIT_NOTIFICATION_ENABLED 1
#if AUDIT_NOTIFICATION_ENABLED
static int token = 0;
#endif /* AUDIT_NOTIFICATION_ENABLED */
static int au_cond = AUC_UNSET; /* <bsm/audit.h> */
uint32_t
au_notify_initialize(void)
{
#if AUDIT_NOTIFICATION_ENABLED
uint32_t status;
int ignore_first;
status = notify_register_check(__BSM_INTERNAL_NOTIFY_KEY, &token);
if (status != NOTIFY_STATUS_OK)
return (status);
status = notify_check(token, &ignore_first);
if (status != NOTIFY_STATUS_OK)
return (status);
#endif
if (audit_get_cond(&au_cond) != 0) {
syslog(LOG_ERR, "Initial audit status check failed (%s)",
strerror(errno));
if (errno == ENOSYS) /* auditon() unimplemented. */
return (AU_UNIMPL);
return (NOTIFY_STATUS_FAILED); /* Is there a better code? */
}
return (NOTIFY_STATUS_OK);
}
int
au_notify_terminate(void)
{
#if AUDIT_NOTIFICATION_ENABLED
return ((notify_cancel(token) == NOTIFY_STATUS_OK) ? 0 : -1);
#else
return (0);
#endif
}
/*
* On error of any notify(3) call, reset 'au_cond' to ensure we re-run
* au_notify_initialize() next time 'round--but assume auditing is on. This
* is a slight performance hit if auditing is off, but at least the system
* will behave correctly. The notification calls are unlikely to fail,
* anyway.
*/
int
au_get_state(void)
{
#if AUDIT_NOTIFICATION_ENABLED
int did_notify;
#endif
int status;
/*
* Don't make the client initialize this set of routines, but take the
* slight performance hit by checking ourselves every time.
*/
if (au_cond == AUC_UNSET) {
status = au_notify_initialize();
if (status != NOTIFY_STATUS_OK) {
if (status == AU_UNIMPL)
return (AU_UNIMPL);
return (AUC_AUDITING);
} else
return (au_cond);
}
#if AUDIT_NOTIFICATION_ENABLED
status = notify_check(token, &did_notify);
if (status != NOTIFY_STATUS_OK) {
au_cond = AUC_UNSET;
return (AUC_AUDITING);
}
if (did_notify == 0)
return (au_cond);
#endif
if (audit_get_cond(&au_cond) != 0) {
/* XXX Reset au_cond to AUC_UNSET? */
syslog(LOG_ERR, "Audit status check failed (%s)",
strerror(errno));
if (errno == ENOSYS) /* Function unimplemented. */
return (AU_UNIMPL);
return (errno);
}
switch (au_cond) {
case AUC_NOAUDIT: /* Auditing suspended. */
case AUC_DISABLED: /* Auditing shut off. */
return (AUC_NOAUDIT);
case AUC_UNSET: /* Uninitialized; shouldn't get here. */
case AUC_AUDITING: /* Audit on. */
default:
return (AUC_AUDITING);
}
}
#endif /* !__APPLE__ */
int
cannot_audit(int val __unused)
{
#ifdef __APPLE__
return (!(au_get_state() == AUC_AUDITING));
#else
int cond;
if (audit_get_cond(&cond) != 0) {
if (errno != ENOSYS) {
syslog(LOG_ERR, "Audit status check failed (%s)",
strerror(errno));
}
return (1);
}
if (cond == AUC_NOAUDIT || cond == AUC_DISABLED)
return (1);
return (0);
#endif /* !__APPLE__ */
}