d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
aa10345311
freebsd-dev/sys/security/audit/audit.h

373 lines
11 KiB
C
Raw Normal View History

Further synchronization of copyrights, licenses, white space, etc from Apple and from the OpenBSM vendor tree. Obtained from: Apple Inc., TrustedBSD Project MFC after: 3 days
2008-07-31 09:54:35 +00:00
/*-
In preparation to sync Apple and FreeBSD versions of security audit, pick up the Apple Computer -> Apple change in their copyright and license templates. Obtained from: Apple Inc. MFC after: 3 days
2008-07-22 15:29:48 +00:00
* Copyright (c) 1999-2005 Apple Inc.
Import kernel audit framework: - Management of audit state on processes. - Audit system calls to configure process and system audit state. - Reliable audit record queue implementation, audit_worker kernel thread to asynchronously store records on disk. - Audit event argument. - Internal audit data structure -> BSM audit trail conversion library. - Audit event pre-selection. - Audit pseudo-device permitting kernel->user upcalls to notify auditd of kernel audit events. Much work by: wsalamon Obtained from: TrustedBSD Project, Apple Computer, Inc.
2006-02-01 20:01:18 +00:00
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
In preparation to sync Apple and FreeBSD versions of security audit, pick up the Apple Computer -> Apple change in their copyright and license templates. Obtained from: Apple Inc. MFC after: 3 days
2008-07-22 15:29:48 +00:00
* 3. Neither the name of Apple Inc. ("Apple") nor the names of
Import kernel audit framework: - Management of audit state on processes. - Audit system calls to configure process and system audit state. - Reliable audit record queue implementation, audit_worker kernel thread to asynchronously store records on disk. - Audit event argument. - Internal audit data structure -> BSM audit trail conversion library. - Audit event pre-selection. - Audit pseudo-device permitting kernel->user upcalls to notify auditd of kernel audit events. Much work by: wsalamon Obtained from: TrustedBSD Project, Apple Computer, Inc.
2006-02-01 20:01:18 +00:00
* its contributors may be used to endorse or promote products derived
* from this software without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR
* ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
* IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*
* $FreeBSD$
*/
/*
* This header includes function prototypes and type definitions that are
* necessary for the kernel as a whole to interact with the audit subsystem.
*/
Merge Perforce change 93568 from TrustedBSD audit3 branch: Normalize nested include guards. Obtained from: TrustedBSD Project
2006-03-19 15:37:04 +00:00
#ifndef _SECURITY_AUDIT_KERNEL_H_
Fix include guard spelling. MFC after: 3 days Submitted by: diego
2008-04-27 15:51:49 +00:00
#define _SECURITY_AUDIT_KERNEL_H_
Import kernel audit framework: - Management of audit state on processes. - Audit system calls to configure process and system audit state. - Reliable audit record queue implementation, audit_worker kernel thread to asynchronously store records on disk. - Audit event argument. - Internal audit data structure -> BSM audit trail conversion library. - Audit event pre-selection. - Audit pseudo-device permitting kernel->user upcalls to notify auditd of kernel audit events. Much work by: wsalamon Obtained from: TrustedBSD Project, Apple Computer, Inc.
2006-02-01 20:01:18 +00:00
#ifndef _KERNEL
#error "no user-serviceable parts inside"
#endif
#include <bsm/audit.h>
#include <sys/file.h>
#include <sys/sysctl.h>
/*
* Audit subsystem condition flags. The audit_enabled flag is set and
Clean up audit comments--formatting, spelling, etc.
2007-06-01 21:58:59 +00:00
* removed automatically as a result of configuring log files, and can be
* observed but should not be directly manipulated. The audit suspension
* flag permits audit to be temporarily disabled without reconfiguring the
* audit target.
Import kernel audit framework: - Management of audit state on processes. - Audit system calls to configure process and system audit state. - Reliable audit record queue implementation, audit_worker kernel thread to asynchronously store records on disk. - Audit event argument. - Internal audit data structure -> BSM audit trail conversion library. - Audit event pre-selection. - Audit pseudo-device permitting kernel->user upcalls to notify auditd of kernel audit events. Much work by: wsalamon Obtained from: TrustedBSD Project, Apple Computer, Inc.
2006-02-01 20:01:18 +00:00
*/
extern int audit_enabled;
extern int audit_suspended;
Merge Perforce change 93581 from TrustedBSD audit3 branch: Mega-style patch. Obtained from: TrustedBSD Project
2006-03-19 17:34:00 +00:00
void audit_syscall_enter(unsigned short code, struct thread *td);
void audit_syscall_exit(int error, struct thread *td);
Import kernel audit framework: - Management of audit state on processes. - Audit system calls to configure process and system audit state. - Reliable audit record queue implementation, audit_worker kernel thread to asynchronously store records on disk. - Audit event argument. - Internal audit data structure -> BSM audit trail conversion library. - Audit event pre-selection. - Audit pseudo-device permitting kernel->user upcalls to notify auditd of kernel audit events. Much work by: wsalamon Obtained from: TrustedBSD Project, Apple Computer, Inc.
2006-02-01 20:01:18 +00:00
/*
Clean up audit comments--formatting, spelling, etc.
2007-06-01 21:58:59 +00:00
* The remaining kernel functions are conditionally compiled in as they are
* wrapped by a macro, and the macro should be the only place in the source
* tree where these functions are referenced.
Import kernel audit framework: - Management of audit state on processes. - Audit system calls to configure process and system audit state. - Reliable audit record queue implementation, audit_worker kernel thread to asynchronously store records on disk. - Audit event argument. - Internal audit data structure -> BSM audit trail conversion library. - Audit event pre-selection. - Audit pseudo-device permitting kernel->user upcalls to notify auditd of kernel audit events. Much work by: wsalamon Obtained from: TrustedBSD Project, Apple Computer, Inc.
2006-02-01 20:01:18 +00:00
*/
#ifdef AUDIT
struct ipc_perm;
struct sockaddr;
union auditon_udata;
Merge Perforce change 93581 from TrustedBSD audit3 branch: Mega-style patch. Obtained from: TrustedBSD Project
2006-03-19 17:34:00 +00:00
void audit_arg_addr(void * addr);
void audit_arg_exit(int status, int retval);
void audit_arg_len(int len);
Audit file descriptors passed to fooat(2) system calls, which are used instead of the root/current working directory as the starting point for lookups. Up to two such descriptors can be audited. Add audit record BSM encoding for fooat(2). Note: due to an error in the OpenBSM 1.1p1 configuration file, a further change is required to that file in order to fix openat(2) auditing. Approved by: re (kib) Reviewed by: rdivacky (fooat(2) portions) Obtained from: TrustedBSD Project MFC after: 1 month
2009-07-28 21:39:58 +00:00
void audit_arg_atfd1(int atfd);
void audit_arg_atfd2(int atfd);
Merge Perforce change 93581 from TrustedBSD audit3 branch: Mega-style patch. Obtained from: TrustedBSD Project
2006-03-19 17:34:00 +00:00
void audit_arg_fd(int fd);
void audit_arg_fflags(int fflags);
void audit_arg_gid(gid_t gid);
void audit_arg_uid(uid_t uid);
void audit_arg_egid(gid_t egid);
void audit_arg_euid(uid_t euid);
void audit_arg_rgid(gid_t rgid);
void audit_arg_ruid(uid_t ruid);
void audit_arg_sgid(gid_t sgid);
void audit_arg_suid(uid_t suid);
void audit_arg_groupset(gid_t *gidset, u_int gidset_size);
void audit_arg_login(char *login);
void audit_arg_ctlname(int *name, int namelen);
void audit_arg_mask(int mask);
void audit_arg_mode(mode_t mode);
void audit_arg_dev(int dev);
void audit_arg_value(long value);
void audit_arg_owner(uid_t uid, gid_t gid);
void audit_arg_pid(pid_t pid);
void audit_arg_process(struct proc *p);
void audit_arg_signum(u_int signum);
void audit_arg_socket(int sodomain, int sotype, int soprotocol);
Correct a number of problems that were previously commented on: - Correct audit_arg_socketaddr() argument name from so to sa. - Assert arguments are non-NULL to many argument capture functions rather than testing them. This may trip some bugs. - Assert the process lock is held when auditing process information. - Test currecord in several more places. - Test validity of more arguments with kasserts, such as flag values when auditing vnode information. Perforce change: 98825 Obtained from: TrustedBSD Project
2006-07-03 14:55:55 +00:00
void audit_arg_sockaddr(struct thread *td, struct sockaddr *sa);
Merge Perforce change 93581 from TrustedBSD audit3 branch: Mega-style patch. Obtained from: TrustedBSD Project
2006-03-19 17:34:00 +00:00
void audit_arg_auid(uid_t auid);
void audit_arg_auditinfo(struct auditinfo *au_info);
- Add audit_arg_audinfo_addr() for auditing the arguments for setaudit_addr(2) - In audit_bsm.c, make sure all the arguments: ARG_AUID, ARG_ASID, ARG_AMASK, and ARG_TERMID{_ADDR} are valid before auditing their arguments. (This is done for both setaudit and setaudit_addr. - Audit the arguments passed to setaudit_addr(2) - AF_INET6 does not equate to AU_IPv6. Change this in au_to_in_addr_ex() so the audit token is created with the correct type. This fixes the processing of the in_addr_ex token in users pace. - Change the size of the token (as generated by the kernel) from 5*4 bytes to 4*4 bytes (the correct size of an ip6 address) - Correct regression from ucred work which resulted in getaudit() not returning E2BIG if the subject had an ip6 termid - Correct slight regression in getaudit(2) which resulted in the size of a pointer being passed instead of the size of the structure. (This resulted in invalid auditinfo data being returned via getaudit(2)) Reviewed by: rwatson Approved by: re@ (kensmith) Obtained from: TrustedBSD Project MFC after: 1 month
2007-06-27 17:01:15 +00:00
void audit_arg_auditinfo_addr(struct auditinfo_addr *au_info);
Eliminate ARG_UPATH[12] arguments to AUDIT_ARG_UPATH() and instead provide specific macros, AUDIT_ARG_UPATH1() and AUDIT_ARG_UPATH2() to capture path information for audit records. This allows us to move the definitions of ARG_* out of the public audit header file, as they are an implementation detail of our current kernel-internal audit record, which may change. Approved by: re (kensmith) Obtained from: TrustedBSD Project MFC after: 1 month
2009-07-29 07:44:43 +00:00
void audit_arg_upath1(struct thread *td, char *upath);
void audit_arg_upath2(struct thread *td, char *upath);
Rework vnode argument auditing to follow the same structure, in order to avoid exposing ARG_ macros/flag values outside of the audit code in order to name which one of two possible vnodes will be audited for a system call. Approved by: re (kib) Obtained from: TrustedBSD Project MFC after: 1 month
2009-07-28 21:52:24 +00:00
void audit_arg_vnode1(struct vnode *vp);
void audit_arg_vnode2(struct vnode *vp);
Merge Perforce change 93581 from TrustedBSD audit3 branch: Mega-style patch. Obtained from: TrustedBSD Project
2006-03-19 17:34:00 +00:00
void audit_arg_text(char *text);
void audit_arg_cmd(int cmd);
void audit_arg_svipc_cmd(int cmd);
void audit_arg_svipc_perm(struct ipc_perm *perm);
void audit_arg_svipc_id(int id);
void audit_arg_svipc_addr(void *addr);
void audit_arg_posix_ipc_perm(uid_t uid, gid_t gid, mode_t mode);
void audit_arg_auditon(union auditon_udata *udata);
void audit_arg_file(struct proc *p, struct file *fp);
Audit the argv and env vectors passed in on exec: Add the argument auditing functions for argv and env. Add kernel-specific versions of the tokenizer functions for the arg and env represented as a char array. Implement the AUDIT_ARGV and AUDIT_ARGE audit policy commands to enable/disable argv/env auditing. Call the argument auditing from the exec system calls. Obtained from: TrustedBSD Project Approved by: rwatson (mentor)
2006-09-01 11:45:40 +00:00
void audit_arg_argv(char *argv, int argc, int length);
void audit_arg_envv(char *envv, int envc, int length);
Provide ability to audit cap_rights_t arguments. We wish to be able to audit capability rights arguments; this code provides the necessary infrastructure. This commit does not, of itself, turn on such auditing for any system call; that should follow shortly. Approved by: mentor (rwatson), re (Capsicum blanket) Sponsored by: Google Inc
2011-07-18 12:58:18 +00:00
void audit_arg_rights(cap_rights_t rights);
Merge Perforce change 93581 from TrustedBSD audit3 branch: Mega-style patch. Obtained from: TrustedBSD Project
2006-03-19 17:34:00 +00:00
void audit_sysclose(struct thread *td, int fd);
Move per-process audit state from a pointer in the proc structure to embedded storage in struct ucred. This allows audit state to be cached with the thread, avoiding locking operations with each system call, and makes it available in asynchronous execution contexts, such as deep in the network stack or VFS. Reviewed by: csjp Approved by: re (kensmith) Obtained from: TrustedBSD Project
2007-06-07 22:27:15 +00:00
void audit_cred_copy(struct ucred *src, struct ucred *dest);
void audit_cred_destroy(struct ucred *cred);
void audit_cred_init(struct ucred *cred);
void audit_cred_kproc0(struct ucred *cred);
void audit_cred_proc1(struct ucred *cred);
Implement AUE_CORE, which adds process core dump support into the kernel. This change introduces audit_proc_coredump() which is called by coredump(9) to create an audit record for the coredump event. When a process dumps a core, it could be security relevant. It could be an indicator that a stack within the process has been overflowed with an incorrectly constructed malicious payload or a number of other events. The record that is generated looks like this: header,111,10,process dumped core,0,Thu Oct 25 19:36:29 2007, + 179 msec argument,0,0xb,signal path,/usr/home/csjp/test.core subject,csjp,csjp,staff,csjp,staff,1101,1095,50457,10.37.129.2 return,success,1 trailer,111 - We allocate a completely new record to make sure we arent clobbering the audit data associated with the syscall that produced the core (assuming the core is being generated in response to SIGABRT and not an invalid memory access). - Shuffle around expand_name() so we can use the coredump name at the very beginning of the coredump call. Make sure we free the storage referenced by "name" if we need to bail out early. - Audit both successful and failed coredump creation efforts Obtained from: TrustedBSD Project Reviewed by: rwatson MFC after: 1 month
2007-10-26 01:23:07 +00:00
void audit_proc_coredump(struct thread *td, char *path, int errcode);
Merge Perforce change 93581 from TrustedBSD audit3 branch: Mega-style patch. Obtained from: TrustedBSD Project
2006-03-19 17:34:00 +00:00
void audit_thread_alloc(struct thread *td);
void audit_thread_free(struct thread *td);
Import kernel audit framework: - Management of audit state on processes. - Audit system calls to configure process and system audit state. - Reliable audit record queue implementation, audit_worker kernel thread to asynchronously store records on disk. - Audit event argument. - Internal audit data structure -> BSM audit trail conversion library. - Audit event pre-selection. - Audit pseudo-device permitting kernel->user upcalls to notify auditd of kernel audit events. Much work by: wsalamon Obtained from: TrustedBSD Project, Apple Computer, Inc.
2006-02-01 20:01:18 +00:00
/*
Replace AUDIT_ARG() with variable argument macros with a set more more specific macros for each audit argument type. This makes it easier to follow call-graphs, especially for automated analysis tools (such as fxr). In MFC, we should leave the existing AUDIT_ARG() macros as they may be used by third-party kernel modules. Suggested by: brooks Approved by: re (kib) Obtained from: TrustedBSD Project MFC after: 1 week
2009-06-27 13:58:44 +00:00
* Define macros to wrap the audit_arg_* calls by checking the global
Import kernel audit framework: - Management of audit state on processes. - Audit system calls to configure process and system audit state. - Reliable audit record queue implementation, audit_worker kernel thread to asynchronously store records on disk. - Audit event argument. - Internal audit data structure -> BSM audit trail conversion library. - Audit event pre-selection. - Audit pseudo-device permitting kernel->user upcalls to notify auditd of kernel audit events. Much work by: wsalamon Obtained from: TrustedBSD Project, Apple Computer, Inc.
2006-02-01 20:01:18 +00:00
* audit_enabled flag before performing the actual call.
*/
Replace AUDIT_ARG() with variable argument macros with a set more more specific macros for each audit argument type. This makes it easier to follow call-graphs, especially for automated analysis tools (such as fxr). In MFC, we should leave the existing AUDIT_ARG() macros as they may be used by third-party kernel modules. Suggested by: brooks Approved by: re (kib) Obtained from: TrustedBSD Project MFC after: 1 week
2009-06-27 13:58:44 +00:00
#define AUDITING_TD(td) ((td)->td_pflags & TDP_AUDITREC)
#define AUDIT_ARG_ADDR(addr) do { \
if (AUDITING_TD(curthread)) \
audit_arg_addr((addr)); \
} while (0)
#define AUDIT_ARG_ARGV(argv, argc, length) do { \
if (AUDITING_TD(curthread)) \
audit_arg_argv((argv), (argc), (length)); \
} while (0)
Audit file descriptors passed to fooat(2) system calls, which are used instead of the root/current working directory as the starting point for lookups. Up to two such descriptors can be audited. Add audit record BSM encoding for fooat(2). Note: due to an error in the OpenBSM 1.1p1 configuration file, a further change is required to that file in order to fix openat(2) auditing. Approved by: re (kib) Reviewed by: rdivacky (fooat(2) portions) Obtained from: TrustedBSD Project MFC after: 1 month
2009-07-28 21:39:58 +00:00
#define AUDIT_ARG_ATFD1(atfd) do { \
if (AUDITING_TD(curthread)) \
audit_arg_atfd1((atfd)); \
} while (0)
#define AUDIT_ARG_ATFD2(atfd) do { \
if (AUDITING_TD(curthread)) \
audit_arg_atfd2((atfd)); \
} while (0)
Replace AUDIT_ARG() with variable argument macros with a set more more specific macros for each audit argument type. This makes it easier to follow call-graphs, especially for automated analysis tools (such as fxr). In MFC, we should leave the existing AUDIT_ARG() macros as they may be used by third-party kernel modules. Suggested by: brooks Approved by: re (kib) Obtained from: TrustedBSD Project MFC after: 1 week
2009-06-27 13:58:44 +00:00
#define AUDIT_ARG_AUDITON(udata) do { \
if (AUDITING_TD(curthread)) \
audit_arg_auditon((udata)); \
} while (0)
#define AUDIT_ARG_CMD(cmd) do { \
if (AUDITING_TD(curthread)) \
audit_arg_cmd((cmd)); \
} while (0)
#define AUDIT_ARG_DEV(dev) do { \
if (AUDITING_TD(curthread)) \
audit_arg_dev((dev)); \
} while (0)
#define AUDIT_ARG_EGID(egid) do { \
if (AUDITING_TD(curthread)) \
audit_arg_egid((egid)); \
} while (0)
#define AUDIT_ARG_ENVV(envv, envc, length) do { \
if (AUDITING_TD(curthread)) \
audit_arg_envv((envv), (envc), (length)); \
} while (0)
#define AUDIT_ARG_EXIT(status, retval) do { \
if (AUDITING_TD(curthread)) \
audit_arg_exit((status), (retval)); \
} while (0)
#define AUDIT_ARG_EUID(euid) do { \
if (AUDITING_TD(curthread)) \
audit_arg_euid((euid)); \
} while (0)
#define AUDIT_ARG_FD(fd) do { \
if (AUDITING_TD(curthread)) \
audit_arg_fd((fd)); \
} while (0)
#define AUDIT_ARG_FILE(p, fp) do { \
if (AUDITING_TD(curthread)) \
audit_arg_file((p), (fp)); \
} while (0)
#define AUDIT_ARG_FFLAGS(fflags) do { \
if (AUDITING_TD(curthread)) \
audit_arg_fflags((fflags)); \
} while (0)
#define AUDIT_ARG_GID(gid) do { \
if (AUDITING_TD(curthread)) \
audit_arg_gid((gid)); \
} while (0)
#define AUDIT_ARG_GROUPSET(gidset, gidset_size) do { \
if (AUDITING_TD(curthread)) \
audit_arg_groupset((gidset), (gidset_size)); \
} while (0)
#define AUDIT_ARG_MODE(mode) do { \
if (AUDITING_TD(curthread)) \
audit_arg_mode((mode)); \
} while (0)
#define AUDIT_ARG_OWNER(uid, gid) do { \
if (AUDITING_TD(curthread)) \
audit_arg_owner((uid), (gid)); \
} while (0)
#define AUDIT_ARG_PID(pid) do { \
if (AUDITING_TD(curthread)) \
audit_arg_pid((pid)); \
} while (0)
#define AUDIT_ARG_PROCESS(p) do { \
if (AUDITING_TD(curthread)) \
audit_arg_process((p)); \
} while (0)
#define AUDIT_ARG_RGID(rgid) do { \
if (AUDITING_TD(curthread)) \
Correctly audit real gids following changes to the audit record argument interface. Approved by: re (kib)
2009-08-12 10:45:45 +00:00
audit_arg_rgid((rgid)); \
Replace AUDIT_ARG() with variable argument macros with a set more more specific macros for each audit argument type. This makes it easier to follow call-graphs, especially for automated analysis tools (such as fxr). In MFC, we should leave the existing AUDIT_ARG() macros as they may be used by third-party kernel modules. Suggested by: brooks Approved by: re (kib) Obtained from: TrustedBSD Project MFC after: 1 week
2009-06-27 13:58:44 +00:00
} while (0)
Provide ability to audit cap_rights_t arguments. We wish to be able to audit capability rights arguments; this code provides the necessary infrastructure. This commit does not, of itself, turn on such auditing for any system call; that should follow shortly. Approved by: mentor (rwatson), re (Capsicum blanket) Sponsored by: Google Inc
2011-07-18 12:58:18 +00:00
#define AUDIT_ARG_RIGHTS(rights) do { \
if (AUDITING_TD(curthread)) \
audit_arg_rights((rights)); \
} while (0)
Replace AUDIT_ARG() with variable argument macros with a set more more specific macros for each audit argument type. This makes it easier to follow call-graphs, especially for automated analysis tools (such as fxr). In MFC, we should leave the existing AUDIT_ARG() macros as they may be used by third-party kernel modules. Suggested by: brooks Approved by: re (kib) Obtained from: TrustedBSD Project MFC after: 1 week
2009-06-27 13:58:44 +00:00
#define AUDIT_ARG_RUID(ruid) do { \
if (AUDITING_TD(curthread)) \
audit_arg_ruid((ruid)); \
} while (0)
#define AUDIT_ARG_SIGNUM(signum) do { \
if (AUDITING_TD(curthread)) \
audit_arg_signum((signum)); \
} while (0)
#define AUDIT_ARG_SGID(sgid) do { \
if (AUDITING_TD(curthread)) \
audit_arg_sgid((sgid)); \
} while (0)
Define missing audit argument macro AUDIT_ARG_SOCKET(), and capture the domain, type, and protocol arguments to socket(2) and socketpair(2). Approved by: re (audit argument blanket) MFC after: 3 days
2009-07-01 18:54:49 +00:00
#define AUDIT_ARG_SOCKET(sodomain, sotype, soprotocol) do { \
if (AUDITING_TD(curthread)) \
audit_arg_socket((sodomain), (sotype), (soprotocol)); \
} while (0)
Replace AUDIT_ARG() with variable argument macros with a set more more specific macros for each audit argument type. This makes it easier to follow call-graphs, especially for automated analysis tools (such as fxr). In MFC, we should leave the existing AUDIT_ARG() macros as they may be used by third-party kernel modules. Suggested by: brooks Approved by: re (kib) Obtained from: TrustedBSD Project MFC after: 1 week
2009-06-27 13:58:44 +00:00
#define AUDIT_ARG_SUID(suid) do { \
if (AUDITING_TD(curthread)) \
audit_arg_suid((suid)); \
} while (0)
#define AUDIT_ARG_TEXT(text) do { \
if (AUDITING_TD(curthread)) \
audit_arg_text((text)); \
} while (0)
#define AUDIT_ARG_UID(uid) do { \
if (AUDITING_TD(curthread)) \
audit_arg_uid((uid)); \
} while (0)
Eliminate ARG_UPATH[12] arguments to AUDIT_ARG_UPATH() and instead provide specific macros, AUDIT_ARG_UPATH1() and AUDIT_ARG_UPATH2() to capture path information for audit records. This allows us to move the definitions of ARG_* out of the public audit header file, as they are an implementation detail of our current kernel-internal audit record, which may change. Approved by: re (kensmith) Obtained from: TrustedBSD Project MFC after: 1 month
2009-07-29 07:44:43 +00:00
#define AUDIT_ARG_UPATH1(td, upath) do { \
if (AUDITING_TD(curthread)) \
audit_arg_upath1((td), (upath)); \
} while (0)
#define AUDIT_ARG_UPATH2(td, upath) do { \
Replace AUDIT_ARG() with variable argument macros with a set more more specific macros for each audit argument type. This makes it easier to follow call-graphs, especially for automated analysis tools (such as fxr). In MFC, we should leave the existing AUDIT_ARG() macros as they may be used by third-party kernel modules. Suggested by: brooks Approved by: re (kib) Obtained from: TrustedBSD Project MFC after: 1 week
2009-06-27 13:58:44 +00:00
if (AUDITING_TD(curthread)) \
Eliminate ARG_UPATH[12] arguments to AUDIT_ARG_UPATH() and instead provide specific macros, AUDIT_ARG_UPATH1() and AUDIT_ARG_UPATH2() to capture path information for audit records. This allows us to move the definitions of ARG_* out of the public audit header file, as they are an implementation detail of our current kernel-internal audit record, which may change. Approved by: re (kensmith) Obtained from: TrustedBSD Project MFC after: 1 month
2009-07-29 07:44:43 +00:00
audit_arg_upath2((td), (upath)); \
Replace AUDIT_ARG() with variable argument macros with a set more more specific macros for each audit argument type. This makes it easier to follow call-graphs, especially for automated analysis tools (such as fxr). In MFC, we should leave the existing AUDIT_ARG() macros as they may be used by third-party kernel modules. Suggested by: brooks Approved by: re (kib) Obtained from: TrustedBSD Project MFC after: 1 week
2009-06-27 13:58:44 +00:00
} while (0)
#define AUDIT_ARG_VALUE(value) do { \
if (AUDITING_TD(curthread)) \
audit_arg_value((value)); \
} while (0)
Rework vnode argument auditing to follow the same structure, in order to avoid exposing ARG_ macros/flag values outside of the audit code in order to name which one of two possible vnodes will be audited for a system call. Approved by: re (kib) Obtained from: TrustedBSD Project MFC after: 1 month
2009-07-28 21:52:24 +00:00
#define AUDIT_ARG_VNODE1(vp) do { \
Replace AUDIT_ARG() with variable argument macros with a set more more specific macros for each audit argument type. This makes it easier to follow call-graphs, especially for automated analysis tools (such as fxr). In MFC, we should leave the existing AUDIT_ARG() macros as they may be used by third-party kernel modules. Suggested by: brooks Approved by: re (kib) Obtained from: TrustedBSD Project MFC after: 1 week
2009-06-27 13:58:44 +00:00
if (AUDITING_TD(curthread)) \
Rework vnode argument auditing to follow the same structure, in order to avoid exposing ARG_ macros/flag values outside of the audit code in order to name which one of two possible vnodes will be audited for a system call. Approved by: re (kib) Obtained from: TrustedBSD Project MFC after: 1 month
2009-07-28 21:52:24 +00:00
audit_arg_vnode1((vp)); \
} while (0)
#define AUDIT_ARG_VNODE2(vp) do { \
if (AUDITING_TD(curthread)) \
audit_arg_vnode2((vp)); \
Merge Perforce change 93581 from TrustedBSD audit3 branch: Mega-style patch. Obtained from: TrustedBSD Project
2006-03-19 17:34:00 +00:00
} while (0)
Import kernel audit framework: - Management of audit state on processes. - Audit system calls to configure process and system audit state. - Reliable audit record queue implementation, audit_worker kernel thread to asynchronously store records on disk. - Audit event argument. - Internal audit data structure -> BSM audit trail conversion library. - Audit event pre-selection. - Audit pseudo-device permitting kernel->user upcalls to notify auditd of kernel audit events. Much work by: wsalamon Obtained from: TrustedBSD Project, Apple Computer, Inc.
2006-02-01 20:01:18 +00:00
White space cleanup, no functional change.
2006-09-04 06:06:23 +00:00
#define AUDIT_SYSCALL_ENTER(code, td) do { \
Import kernel audit framework: - Management of audit state on processes. - Audit system calls to configure process and system audit state. - Reliable audit record queue implementation, audit_worker kernel thread to asynchronously store records on disk. - Audit event argument. - Internal audit data structure -> BSM audit trail conversion library. - Audit event pre-selection. - Audit pseudo-device permitting kernel->user upcalls to notify auditd of kernel audit events. Much work by: wsalamon Obtained from: TrustedBSD Project, Apple Computer, Inc.
2006-02-01 20:01:18 +00:00
if (audit_enabled) { \
audit_syscall_enter(code, td); \
} \
Merge Perforce change 93581 from TrustedBSD audit3 branch: Mega-style patch. Obtained from: TrustedBSD Project
2006-03-19 17:34:00 +00:00
} while (0)
Import kernel audit framework: - Management of audit state on processes. - Audit system calls to configure process and system audit state. - Reliable audit record queue implementation, audit_worker kernel thread to asynchronously store records on disk. - Audit event argument. - Internal audit data structure -> BSM audit trail conversion library. - Audit event pre-selection. - Audit pseudo-device permitting kernel->user upcalls to notify auditd of kernel audit events. Much work by: wsalamon Obtained from: TrustedBSD Project, Apple Computer, Inc.
2006-02-01 20:01:18 +00:00
/*
* Wrap the audit_syscall_exit() function so that it is called only when
In AUDIT_SYSCALL_EXIT(), invoke audit_syscall_exit() only if an audit record is active on the current thread--historically we may always have wanted to enter the audit code if auditing was enabled, but now we just commit the audit record so don't need to enter if there isn't one. Obtained from: TrustedBSD Project Sponsored by: Apple, Inc.
2009-01-06 13:59:59 +00:00
* we have a audit record on the thread. Audit records can persist after
* auditing is disabled, so we don't just check audit_enabled here.
Import kernel audit framework: - Management of audit state on processes. - Audit system calls to configure process and system audit state. - Reliable audit record queue implementation, audit_worker kernel thread to asynchronously store records on disk. - Audit event argument. - Internal audit data structure -> BSM audit trail conversion library. - Audit event pre-selection. - Audit pseudo-device permitting kernel->user upcalls to notify auditd of kernel audit events. Much work by: wsalamon Obtained from: TrustedBSD Project, Apple Computer, Inc.
2006-02-01 20:01:18 +00:00
*/
White space cleanup, no functional change.
2006-09-04 06:06:23 +00:00
#define AUDIT_SYSCALL_EXIT(error, td) do { \
Add a new thread-private flag, TDP_AUDITREC, to indicate whether or not there is an audit record hung off of td_ar on the current thread. Test this flag instead of td_ar when auditing syscall arguments or checking for an audit record to commit on syscall return. Under these circumstances, td_pflags is much more likely to be in the cache (especially if there is no auditing of the current system call), so this should help reduce cache misses in the system call return path. MFC after: 1 week Reported by: kris Obtained from: TrustedBSD Project
2009-03-09 10:45:58 +00:00
if (td->td_pflags & TDP_AUDITREC) \
Import kernel audit framework: - Management of audit state on processes. - Audit system calls to configure process and system audit state. - Reliable audit record queue implementation, audit_worker kernel thread to asynchronously store records on disk. - Audit event argument. - Internal audit data structure -> BSM audit trail conversion library. - Audit event pre-selection. - Audit pseudo-device permitting kernel->user upcalls to notify auditd of kernel audit events. Much work by: wsalamon Obtained from: TrustedBSD Project, Apple Computer, Inc.
2006-02-01 20:01:18 +00:00
audit_syscall_exit(error, td); \
Merge Perforce change 93581 from TrustedBSD audit3 branch: Mega-style patch. Obtained from: TrustedBSD Project
2006-03-19 17:34:00 +00:00
} while (0)
Import kernel audit framework: - Management of audit state on processes. - Audit system calls to configure process and system audit state. - Reliable audit record queue implementation, audit_worker kernel thread to asynchronously store records on disk. - Audit event argument. - Internal audit data structure -> BSM audit trail conversion library. - Audit event pre-selection. - Audit pseudo-device permitting kernel->user upcalls to notify auditd of kernel audit events. Much work by: wsalamon Obtained from: TrustedBSD Project, Apple Computer, Inc.
2006-02-01 20:01:18 +00:00
/*
* A Macro to wrap the audit_sysclose() function.
*/
#define AUDIT_SYSCLOSE(td, fd) do { \
Add a new thread-private flag, TDP_AUDITREC, to indicate whether or not there is an audit record hung off of td_ar on the current thread. Test this flag instead of td_ar when auditing syscall arguments or checking for an audit record to commit on syscall return. Under these circumstances, td_pflags is much more likely to be in the cache (especially if there is no auditing of the current system call), so this should help reduce cache misses in the system call return path. MFC after: 1 week Reported by: kris Obtained from: TrustedBSD Project
2009-03-09 10:45:58 +00:00
if (td->td_pflags & TDP_AUDITREC) \
Import kernel audit framework: - Management of audit state on processes. - Audit system calls to configure process and system audit state. - Reliable audit record queue implementation, audit_worker kernel thread to asynchronously store records on disk. - Audit event argument. - Internal audit data structure -> BSM audit trail conversion library. - Audit event pre-selection. - Audit pseudo-device permitting kernel->user upcalls to notify auditd of kernel audit events. Much work by: wsalamon Obtained from: TrustedBSD Project, Apple Computer, Inc.
2006-02-01 20:01:18 +00:00
audit_sysclose(td, fd); \
Merge Perforce change 93581 from TrustedBSD audit3 branch: Mega-style patch. Obtained from: TrustedBSD Project
2006-03-19 17:34:00 +00:00
} while (0)
Import kernel audit framework: - Management of audit state on processes. - Audit system calls to configure process and system audit state. - Reliable audit record queue implementation, audit_worker kernel thread to asynchronously store records on disk. - Audit event argument. - Internal audit data structure -> BSM audit trail conversion library. - Audit event pre-selection. - Audit pseudo-device permitting kernel->user upcalls to notify auditd of kernel audit events. Much work by: wsalamon Obtained from: TrustedBSD Project, Apple Computer, Inc.
2006-02-01 20:01:18 +00:00
#else /* !AUDIT */
Replace AUDIT_ARG() with variable argument macros with a set more more specific macros for each audit argument type. This makes it easier to follow call-graphs, especially for automated analysis tools (such as fxr). In MFC, we should leave the existing AUDIT_ARG() macros as they may be used by third-party kernel modules. Suggested by: brooks Approved by: re (kib) Obtained from: TrustedBSD Project MFC after: 1 week
2009-06-27 13:58:44 +00:00
#define AUDIT_ARG_ADDR(addr)
#define AUDIT_ARG_ARGV(argv, argc, length)
Audit file descriptors passed to fooat(2) system calls, which are used instead of the root/current working directory as the starting point for lookups. Up to two such descriptors can be audited. Add audit record BSM encoding for fooat(2). Note: due to an error in the OpenBSM 1.1p1 configuration file, a further change is required to that file in order to fix openat(2) auditing. Approved by: re (kib) Reviewed by: rdivacky (fooat(2) portions) Obtained from: TrustedBSD Project MFC after: 1 month
2009-07-28 21:39:58 +00:00
#define AUDIT_ARG_ATFD1(atfd)
#define AUDIT_ARG_ATFD2(atfd)
Replace AUDIT_ARG() with variable argument macros with a set more more specific macros for each audit argument type. This makes it easier to follow call-graphs, especially for automated analysis tools (such as fxr). In MFC, we should leave the existing AUDIT_ARG() macros as they may be used by third-party kernel modules. Suggested by: brooks Approved by: re (kib) Obtained from: TrustedBSD Project MFC after: 1 week
2009-06-27 13:58:44 +00:00
#define AUDIT_ARG_AUDITON(udata)
#define AUDIT_ARG_CMD(cmd)
#define AUDIT_ARG_DEV(dev)
#define AUDIT_ARG_EGID(egid)
#define AUDIT_ARG_ENVV(envv, envc, length)
#define AUDIT_ARG_EXIT(status, retval)
#define AUDIT_ARG_EUID(euid)
#define AUDIT_ARG_FD(fd)
#define AUDIT_ARG_FILE(p, fp)
#define AUDIT_ARG_FFLAGS(fflags)
#define AUDIT_ARG_GID(gid)
#define AUDIT_ARG_GROUPSET(gidset, gidset_size)
#define AUDIT_ARG_MODE(mode)
#define AUDIT_ARG_OWNER(uid, gid)
#define AUDIT_ARG_PID(pid)
#define AUDIT_ARG_PROCESS(p)
#define AUDIT_ARG_RGID(rgid)
Provide ability to audit cap_rights_t arguments. We wish to be able to audit capability rights arguments; this code provides the necessary infrastructure. This commit does not, of itself, turn on such auditing for any system call; that should follow shortly. Approved by: mentor (rwatson), re (Capsicum blanket) Sponsored by: Google Inc
2011-07-18 12:58:18 +00:00
#define AUDIT_ARG_RIGHTS(rights)
Replace AUDIT_ARG() with variable argument macros with a set more more specific macros for each audit argument type. This makes it easier to follow call-graphs, especially for automated analysis tools (such as fxr). In MFC, we should leave the existing AUDIT_ARG() macros as they may be used by third-party kernel modules. Suggested by: brooks Approved by: re (kib) Obtained from: TrustedBSD Project MFC after: 1 week
2009-06-27 13:58:44 +00:00
#define AUDIT_ARG_RUID(ruid)
#define AUDIT_ARG_SIGNUM(signum)
#define AUDIT_ARG_SGID(sgid)
Define missing audit argument macro AUDIT_ARG_SOCKET(), and capture the domain, type, and protocol arguments to socket(2) and socketpair(2). Approved by: re (audit argument blanket) MFC after: 3 days
2009-07-01 18:54:49 +00:00
#define AUDIT_ARG_SOCKET(sodomain, sotype, soprotocol)
Replace AUDIT_ARG() with variable argument macros with a set more more specific macros for each audit argument type. This makes it easier to follow call-graphs, especially for automated analysis tools (such as fxr). In MFC, we should leave the existing AUDIT_ARG() macros as they may be used by third-party kernel modules. Suggested by: brooks Approved by: re (kib) Obtained from: TrustedBSD Project MFC after: 1 week
2009-06-27 13:58:44 +00:00
#define AUDIT_ARG_SUID(suid)
#define AUDIT_ARG_TEXT(text)
#define AUDIT_ARG_UID(uid)
Eliminate ARG_UPATH[12] arguments to AUDIT_ARG_UPATH() and instead provide specific macros, AUDIT_ARG_UPATH1() and AUDIT_ARG_UPATH2() to capture path information for audit records. This allows us to move the definitions of ARG_* out of the public audit header file, as they are an implementation detail of our current kernel-internal audit record, which may change. Approved by: re (kensmith) Obtained from: TrustedBSD Project MFC after: 1 month
2009-07-29 07:44:43 +00:00
#define AUDIT_ARG_UPATH1(td, upath)
#define AUDIT_ARG_UPATH2(td, upath)
Replace AUDIT_ARG() with variable argument macros with a set more more specific macros for each audit argument type. This makes it easier to follow call-graphs, especially for automated analysis tools (such as fxr). In MFC, we should leave the existing AUDIT_ARG() macros as they may be used by third-party kernel modules. Suggested by: brooks Approved by: re (kib) Obtained from: TrustedBSD Project MFC after: 1 week
2009-06-27 13:58:44 +00:00
#define AUDIT_ARG_VALUE(value)
Rework vnode argument auditing to follow the same structure, in order to avoid exposing ARG_ macros/flag values outside of the audit code in order to name which one of two possible vnodes will be audited for a system call. Approved by: re (kib) Obtained from: TrustedBSD Project MFC after: 1 month
2009-07-28 21:52:24 +00:00
#define AUDIT_ARG_VNODE1(vp)
#define AUDIT_ARG_VNODE2(vp)
Import kernel audit framework: - Management of audit state on processes. - Audit system calls to configure process and system audit state. - Reliable audit record queue implementation, audit_worker kernel thread to asynchronously store records on disk. - Audit event argument. - Internal audit data structure -> BSM audit trail conversion library. - Audit event pre-selection. - Audit pseudo-device permitting kernel->user upcalls to notify auditd of kernel audit events. Much work by: wsalamon Obtained from: TrustedBSD Project, Apple Computer, Inc.
2006-02-01 20:01:18 +00:00
Replace AUDIT_ARG() with variable argument macros with a set more more specific macros for each audit argument type. This makes it easier to follow call-graphs, especially for automated analysis tools (such as fxr). In MFC, we should leave the existing AUDIT_ARG() macros as they may be used by third-party kernel modules. Suggested by: brooks Approved by: re (kib) Obtained from: TrustedBSD Project MFC after: 1 week
2009-06-27 13:58:44 +00:00
#define AUDIT_SYSCALL_ENTER(code, td)
#define AUDIT_SYSCALL_EXIT(error, td)
Import kernel audit framework: - Management of audit state on processes. - Audit system calls to configure process and system audit state. - Reliable audit record queue implementation, audit_worker kernel thread to asynchronously store records on disk. - Audit event argument. - Internal audit data structure -> BSM audit trail conversion library. - Audit event pre-selection. - Audit pseudo-device permitting kernel->user upcalls to notify auditd of kernel audit events. Much work by: wsalamon Obtained from: TrustedBSD Project, Apple Computer, Inc.
2006-02-01 20:01:18 +00:00
Replace AUDIT_ARG() with variable argument macros with a set more more specific macros for each audit argument type. This makes it easier to follow call-graphs, especially for automated analysis tools (such as fxr). In MFC, we should leave the existing AUDIT_ARG() macros as they may be used by third-party kernel modules. Suggested by: brooks Approved by: re (kib) Obtained from: TrustedBSD Project MFC after: 1 week
2009-06-27 13:58:44 +00:00
#define AUDIT_SYSCLOSE(p, fd)
Import kernel audit framework: - Management of audit state on processes. - Audit system calls to configure process and system audit state. - Reliable audit record queue implementation, audit_worker kernel thread to asynchronously store records on disk. - Audit event argument. - Internal audit data structure -> BSM audit trail conversion library. - Audit event pre-selection. - Audit pseudo-device permitting kernel->user upcalls to notify auditd of kernel audit events. Much work by: wsalamon Obtained from: TrustedBSD Project, Apple Computer, Inc.
2006-02-01 20:01:18 +00:00
#endif /* AUDIT */
Merge Perforce change 93568 from TrustedBSD audit3 branch: Normalize nested include guards. Obtained from: TrustedBSD Project
2006-03-19 15:37:04 +00:00
#endif /* !_SECURITY_AUDIT_KERNEL_H_ */
Reference in New Issue Copy Permalink