2008-07-31 09:54:35 +00:00
|
|
|
/*-
|
2017-11-20 19:43:44 +00:00
|
|
|
* SPDX-License-Identifier: BSD-3-Clause
|
|
|
|
*
|
2008-07-22 15:29:48 +00:00
|
|
|
* Copyright (c) 1999-2005 Apple Inc.
|
Rework the logic around quick checks for auditing that take place at
system-call entry and whenever audit arguments or return values are
captured:
1. Expose a single global, audit_syscalls_enabled, which controls
whether the audit framework is entered, rather than exposing
components of the policy -- e.g., if the trail is enabled,
suspended, etc.
2. Introduce a new function audit_syscalls_enabled_update(), which is
called to update audit_syscalls_enabled whenever an aspect of the
policy changes, so that the value can be updated.
3. Remove a check of trail enablement/suspension from audit_new() --
at the point where this function has been entered, we believe that
system-call auditing is already in force, or we wouldn't get here,
so simply proceed to more expensive policy checks.
4. Use an audit-provided global, audit_dtrace_enabled, rather than a
dtaudit-provided global, to provide policy indicating whether
dtaudit would like system calls to be audited.
5. Do some minor cosmetic renaming to clarify what various variables
are for.
These changes collectively arrange it so that traditional audit
(trail, pipes) or the DTrace audit provider can enable system-call
probes without the other configured. Otherwise, dtaudit cannot
capture system-call data without auditd(8) started.
Reviewed by: gnn
Sponsored by: DARPA, AFRL
Approved by: re (gjb)
Differential Revision: https://reviews.freebsd.org/D17348
2018-10-02 15:58:17 +00:00
|
|
|
* Copyright (c) 2006-2007, 2016-2018 Robert N. M. Watson
|
2006-02-01 20:01:18 +00:00
|
|
|
* All rights reserved.
|
|
|
|
*
|
Add an experimental DTrace audit provider, which allows users of DTrace to
instrument security event auditing rather than relying on conventional BSM
trail files or audit pipes:
- Add a set of per-event 'commit' probes, which provide access to
particular auditable events at the time of commit in system-call return.
These probes gain access to audit data via the in-kernel audit_record
data structure, providing convenient access to system-call arguments and
return values in a single probe.
- Add a set of per-event 'bsm' probes, which provide access to particular
auditable events at the time of BSM record generation in the audit
worker thread. These probes have access to the in-kernel audit_record
data structure and BSM representation as would be written to a trail
file or audit pipe -- i.e., asynchronously in the audit worker thread.
DTrace probe arguments consist of the name of the audit event (to support
future mechanisms of instrumenting multiple events via a single probe --
e.g., using classes), a pointer to the in-kernel audit record, and an
optional pointer to the BSM data and its length. For human convenience,
upper-case audit event names (AUE_...) are converted to lower case in
DTrace.
DTrace scripts can now cause additional audit-based data to be collected
on system calls, and inspect internal and BSM representations of the data.
They do not affect data captured in the audit trail or audit pipes
configured in the system. auditd(8) must be configured and running in
order to provide a database of event information, as well as other audit
configuration parameters (e.g., to capture command-line arguments or
environmental variables) for the provider to operate.
Reviewed by: gnn, jonathan, markj
Sponsored by: DARPA, AFRL
MFC after: 3 weeks
Differential Revision: https://reviews.freebsd.org/D10149
2017-03-29 19:58:00 +00:00
|
|
|
* Portions of this software were developed by BAE Systems, the University of
|
|
|
|
* Cambridge Computer Laboratory, and Memorial University under DARPA/AFRL
|
|
|
|
* contract FA8650-15-C-7558 ("CADETS"), as part of the DARPA Transparent
|
|
|
|
* Computing (TC) research program.
|
|
|
|
*
|
2006-02-01 20:01:18 +00:00
|
|
|
* Redistribution and use in source and binary forms, with or without
|
|
|
|
* modification, are permitted provided that the following conditions
|
|
|
|
* are met:
|
|
|
|
* 1. Redistributions of source code must retain the above copyright
|
|
|
|
* notice, this list of conditions and the following disclaimer.
|
|
|
|
* 2. Redistributions in binary form must reproduce the above copyright
|
|
|
|
* notice, this list of conditions and the following disclaimer in the
|
|
|
|
* documentation and/or other materials provided with the distribution.
|
2008-07-22 15:29:48 +00:00
|
|
|
* 3. Neither the name of Apple Inc. ("Apple") nor the names of
|
2006-02-01 20:01:18 +00:00
|
|
|
* its contributors may be used to endorse or promote products derived
|
|
|
|
* from this software without specific prior written permission.
|
|
|
|
*
|
|
|
|
* THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND
|
|
|
|
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
|
|
|
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
|
|
|
* ARE DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR
|
|
|
|
* ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
|
|
|
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
|
|
|
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
|
|
|
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
|
|
|
|
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
|
|
|
|
* IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
|
|
|
|
* POSSIBILITY OF SUCH DAMAGE.
|
|
|
|
*/
|
|
|
|
|
2008-04-13 22:06:56 +00:00
|
|
|
#include <sys/cdefs.h>
|
|
|
|
__FBSDID("$FreeBSD$");
|
|
|
|
|
2006-02-01 20:01:18 +00:00
|
|
|
#include <sys/param.h>
|
|
|
|
#include <sys/condvar.h>
|
|
|
|
#include <sys/conf.h>
|
Extract eventfilter declarations to sys/_eventfilter.h
This allows replacing "sys/eventfilter.h" includes with "sys/_eventfilter.h"
in other header files (e.g., sys/{bus,conf,cpu}.h) and reduces header
pollution substantially.
EVENTHANDLER_DECLARE and EVENTHANDLER_LIST_DECLAREs were moved out of .c
files into appropriate headers (e.g., sys/proc.h, powernv/opal.h).
As a side effect of reduced header pollution, many .c files and headers no
longer contain needed definitions. The remainder of the patch addresses
adding appropriate includes to fix those files.
LOCK_DEBUG and LOCK_FILE_LINE_ARG are moved to sys/_lock.h, as required by
sys/mutex.h since r326106 (but silently protected by header pollution prior
to this change).
No functional change (intended). Of course, any out of tree modules that
relied on header pollution for sys/eventhandler.h, sys/lock.h, or
sys/mutex.h inclusion need to be fixed. __FreeBSD_version has been bumped.
2019-05-20 00:38:23 +00:00
|
|
|
#include <sys/eventhandler.h>
|
2006-02-01 20:01:18 +00:00
|
|
|
#include <sys/file.h>
|
|
|
|
#include <sys/filedesc.h>
|
|
|
|
#include <sys/fcntl.h>
|
|
|
|
#include <sys/ipc.h>
|
2013-01-17 21:02:53 +00:00
|
|
|
#include <sys/jail.h>
|
2006-02-01 20:01:18 +00:00
|
|
|
#include <sys/kernel.h>
|
|
|
|
#include <sys/kthread.h>
|
|
|
|
#include <sys/malloc.h>
|
|
|
|
#include <sys/mount.h>
|
|
|
|
#include <sys/namei.h>
|
2006-11-06 13:42:10 +00:00
|
|
|
#include <sys/priv.h>
|
2006-02-01 20:01:18 +00:00
|
|
|
#include <sys/proc.h>
|
|
|
|
#include <sys/queue.h>
|
|
|
|
#include <sys/socket.h>
|
|
|
|
#include <sys/socketvar.h>
|
|
|
|
#include <sys/protosw.h>
|
|
|
|
#include <sys/domain.h>
|
2007-07-01 20:51:30 +00:00
|
|
|
#include <sys/sysctl.h>
|
2006-02-01 20:01:18 +00:00
|
|
|
#include <sys/sysproto.h>
|
|
|
|
#include <sys/sysent.h>
|
|
|
|
#include <sys/systm.h>
|
|
|
|
#include <sys/ucred.h>
|
|
|
|
#include <sys/uio.h>
|
|
|
|
#include <sys/un.h>
|
|
|
|
#include <sys/unistd.h>
|
|
|
|
#include <sys/vnode.h>
|
|
|
|
|
2006-02-06 22:30:54 +00:00
|
|
|
#include <bsm/audit.h>
|
2006-03-04 17:00:55 +00:00
|
|
|
#include <bsm/audit_internal.h>
|
2006-02-06 22:30:54 +00:00
|
|
|
#include <bsm/audit_kevents.h>
|
|
|
|
|
2006-02-01 20:01:18 +00:00
|
|
|
#include <netinet/in.h>
|
|
|
|
#include <netinet/in_pcb.h>
|
|
|
|
|
|
|
|
#include <security/audit/audit.h>
|
|
|
|
#include <security/audit/audit_private.h>
|
|
|
|
|
2006-02-06 22:30:54 +00:00
|
|
|
#include <vm/uma.h>
|
|
|
|
|
2011-02-25 10:11:01 +00:00
|
|
|
FEATURE(audit, "BSM audit support");
|
|
|
|
|
Merge Perforce changes 93512, 93514, 93515 from TrustedBSD audit3
branch:
Integrate audit.c to audit_worker.c, so as to migrate the worker
thread implementation to its own .c file.
Populate audit_worker.c using parts now removed from audit.c:
- Move audit rotation global variables.
- Move audit_record_write(), audit_worker_rotate(),
audit_worker_drain(), audit_worker(), audit_rotate_vnode().
- Create audit_worker_init() from relevant parts of audit_init(),
which now calls this routine.
- Recreate audit_free(), which wraps uma_zfree() so that
audit_record_zone can be static to audit.c.
- Unstaticize various types and variables relating to the audit
record queue so that audit_worker can get to them. We may want
to wrap these in accessor methods at some point.
- Move AUDIT_PRINTF() to audit_private.h.
Addition of audit_worker.c to kernel configuration, missed in
earlier submit.
Obtained from: TrustedBSD Project
2006-03-19 16:03:43 +00:00
|
|
|
static uma_zone_t audit_record_zone;
|
2007-06-07 22:27:15 +00:00
|
|
|
static MALLOC_DEFINE(M_AUDITCRED, "audit_cred", "Audit cred storage");
|
2006-02-01 20:01:18 +00:00
|
|
|
MALLOC_DEFINE(M_AUDITDATA, "audit_data", "Audit data storage");
|
|
|
|
MALLOC_DEFINE(M_AUDITPATH, "audit_path", "Audit path storage");
|
|
|
|
MALLOC_DEFINE(M_AUDITTEXT, "audit_text", "Audit text storage");
|
2009-06-29 20:19:19 +00:00
|
|
|
MALLOC_DEFINE(M_AUDITGIDSET, "audit_gidset", "Audit GID set storage");
|
2006-02-01 20:01:18 +00:00
|
|
|
|
2020-02-26 14:26:36 +00:00
|
|
|
static SYSCTL_NODE(_security, OID_AUTO, audit, CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
|
2007-07-01 20:51:30 +00:00
|
|
|
"TrustedBSD audit controls");
|
|
|
|
|
2006-02-01 20:01:18 +00:00
|
|
|
/*
|
2007-06-01 21:58:59 +00:00
|
|
|
* Audit control settings that are set/read by system calls and are hence
|
|
|
|
* non-static.
|
|
|
|
*
|
2006-02-01 20:01:18 +00:00
|
|
|
* Define the audit control flags.
|
|
|
|
*/
|
Rework the logic around quick checks for auditing that take place at
system-call entry and whenever audit arguments or return values are
captured:
1. Expose a single global, audit_syscalls_enabled, which controls
whether the audit framework is entered, rather than exposing
components of the policy -- e.g., if the trail is enabled,
suspended, etc.
2. Introduce a new function audit_syscalls_enabled_update(), which is
called to update audit_syscalls_enabled whenever an aspect of the
policy changes, so that the value can be updated.
3. Remove a check of trail enablement/suspension from audit_new() --
at the point where this function has been entered, we believe that
system-call auditing is already in force, or we wouldn't get here,
so simply proceed to more expensive policy checks.
4. Use an audit-provided global, audit_dtrace_enabled, rather than a
dtaudit-provided global, to provide policy indicating whether
dtaudit would like system calls to be audited.
5. Do some minor cosmetic renaming to clarify what various variables
are for.
These changes collectively arrange it so that traditional audit
(trail, pipes) or the DTrace audit provider can enable system-call
probes without the other configured. Otherwise, dtaudit cannot
capture system-call data without auditd(8) started.
Reviewed by: gnn
Sponsored by: DARPA, AFRL
Approved by: re (gjb)
Differential Revision: https://reviews.freebsd.org/D17348
2018-10-02 15:58:17 +00:00
|
|
|
int audit_trail_enabled;
|
|
|
|
int audit_trail_suspended;
|
|
|
|
#ifdef KDTRACE_HOOKS
|
|
|
|
u_int audit_dtrace_enabled;
|
|
|
|
#endif
|
2018-11-29 08:37:33 +00:00
|
|
|
bool __read_frequently audit_syscalls_enabled;
|
2006-02-01 20:01:18 +00:00
|
|
|
|
|
|
|
/*
|
2006-09-09 10:23:00 +00:00
|
|
|
* Flags controlling behavior in low storage situations. Should we panic if
|
|
|
|
* a write fails? Should we fail stop if we're out of disk space?
|
2006-02-01 20:01:18 +00:00
|
|
|
*/
|
2006-03-19 17:34:00 +00:00
|
|
|
int audit_panic_on_write_fail;
|
|
|
|
int audit_fail_stop;
|
2006-09-01 11:45:40 +00:00
|
|
|
int audit_argv;
|
|
|
|
int audit_arge;
|
2006-02-01 20:01:18 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* Are we currently "failing stop" due to out of disk space?
|
|
|
|
*/
|
2006-03-19 17:34:00 +00:00
|
|
|
int audit_in_failure;
|
2006-02-01 20:01:18 +00:00
|
|
|
|
|
|
|
/*
|
2007-06-14 03:02:33 +00:00
|
|
|
* Global audit statistics.
|
2006-02-01 20:01:18 +00:00
|
|
|
*/
|
2006-03-19 17:34:00 +00:00
|
|
|
struct audit_fstat audit_fstat;
|
2006-02-01 20:01:18 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* Preselection mask for non-attributable events.
|
|
|
|
*/
|
2006-03-19 17:34:00 +00:00
|
|
|
struct au_mask audit_nae_mask;
|
2006-02-01 20:01:18 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* Mutex to protect global variables shared between various threads and
|
|
|
|
* processes.
|
|
|
|
*/
|
2006-03-19 17:34:00 +00:00
|
|
|
struct mtx audit_mtx;
|
2006-02-01 20:01:18 +00:00
|
|
|
|
|
|
|
/*
|
2007-06-01 21:58:59 +00:00
|
|
|
* Queue of audit records ready for delivery to disk. We insert new records
|
|
|
|
* at the tail, and remove records from the head. Also, a count of the
|
|
|
|
* number of records used for checking queue depth. In addition, a counter
|
|
|
|
* of records that we have allocated but are not yet in the queue, which is
|
|
|
|
* needed to estimate the total size of the combined set of records
|
|
|
|
* outstanding in the system.
|
2006-02-01 20:01:18 +00:00
|
|
|
*/
|
2006-03-19 17:34:00 +00:00
|
|
|
struct kaudit_queue audit_q;
|
2009-04-19 14:53:17 +00:00
|
|
|
int audit_q_len;
|
|
|
|
int audit_pre_q_len;
|
2006-02-01 20:01:18 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* Audit queue control settings (minimum free, low/high water marks, etc.)
|
|
|
|
*/
|
2006-03-19 17:34:00 +00:00
|
|
|
struct au_qctrl audit_qctrl;
|
2006-02-01 20:01:18 +00:00
|
|
|
|
|
|
|
/*
|
2007-06-01 21:58:59 +00:00
|
|
|
* Condition variable to signal to the worker that it has work to do: either
|
|
|
|
* new records are in the queue, or a log replacement is taking place.
|
2006-02-01 20:01:18 +00:00
|
|
|
*/
|
2006-06-05 13:43:57 +00:00
|
|
|
struct cv audit_worker_cv;
|
2006-02-01 20:01:18 +00:00
|
|
|
|
|
|
|
/*
|
2006-06-05 13:43:57 +00:00
|
|
|
* Condition variable to flag when crossing the low watermark, meaning that
|
|
|
|
* threads blocked due to hitting the high watermark can wake up and continue
|
|
|
|
* to commit records.
|
2006-02-01 20:01:18 +00:00
|
|
|
*/
|
2006-06-05 13:43:57 +00:00
|
|
|
struct cv audit_watermark_cv;
|
2006-02-01 20:01:18 +00:00
|
|
|
|
2006-03-19 17:34:00 +00:00
|
|
|
/*
|
|
|
|
* Condition variable for auditing threads wait on when in fail-stop mode.
|
2007-06-01 21:58:59 +00:00
|
|
|
* Threads wait on this CV forever (and ever), never seeing the light of day
|
|
|
|
* again.
|
2006-02-01 20:01:18 +00:00
|
|
|
*/
|
2006-03-19 17:34:00 +00:00
|
|
|
static struct cv audit_fail_cv;
|
2006-02-01 20:01:18 +00:00
|
|
|
|
Add an experimental DTrace audit provider, which allows users of DTrace to
instrument security event auditing rather than relying on conventional BSM
trail files or audit pipes:
- Add a set of per-event 'commit' probes, which provide access to
particular auditable events at the time of commit in system-call return.
These probes gain access to audit data via the in-kernel audit_record
data structure, providing convenient access to system-call arguments and
return values in a single probe.
- Add a set of per-event 'bsm' probes, which provide access to particular
auditable events at the time of BSM record generation in the audit
worker thread. These probes have access to the in-kernel audit_record
data structure and BSM representation as would be written to a trail
file or audit pipe -- i.e., asynchronously in the audit worker thread.
DTrace probe arguments consist of the name of the audit event (to support
future mechanisms of instrumenting multiple events via a single probe --
e.g., using classes), a pointer to the in-kernel audit record, and an
optional pointer to the BSM data and its length. For human convenience,
upper-case audit event names (AUE_...) are converted to lower case in
DTrace.
DTrace scripts can now cause additional audit-based data to be collected
on system calls, and inspect internal and BSM representations of the data.
They do not affect data captured in the audit trail or audit pipes
configured in the system. auditd(8) must be configured and running in
order to provide a database of event information, as well as other audit
configuration parameters (e.g., to capture command-line arguments or
environmental variables) for the provider to operate.
Reviewed by: gnn, jonathan, markj
Sponsored by: DARPA, AFRL
MFC after: 3 weeks
Differential Revision: https://reviews.freebsd.org/D10149
2017-03-29 19:58:00 +00:00
|
|
|
/*
|
|
|
|
* Optional DTrace audit provider support: function pointers for preselection
|
|
|
|
* and commit events.
|
|
|
|
*/
|
|
|
|
#ifdef KDTRACE_HOOKS
|
|
|
|
void *(*dtaudit_hook_preselect)(au_id_t auid, au_event_t event,
|
|
|
|
au_class_t class);
|
|
|
|
int (*dtaudit_hook_commit)(struct kaudit_record *kar, au_id_t auid,
|
|
|
|
au_event_t event, au_class_t class, int sorf);
|
|
|
|
void (*dtaudit_hook_bsm)(struct kaudit_record *kar, au_id_t auid,
|
|
|
|
au_event_t event, au_class_t class, int sorf,
|
|
|
|
void *bsm_data, size_t bsm_lenlen);
|
|
|
|
#endif
|
|
|
|
|
2008-11-11 21:57:03 +00:00
|
|
|
/*
|
|
|
|
* Kernel audit information. This will store the current audit address
|
|
|
|
* or host information that the kernel will use when it's generating
|
|
|
|
* audit records. This data is modified by the A_GET{SET}KAUDIT auditon(2)
|
|
|
|
* command.
|
|
|
|
*/
|
|
|
|
static struct auditinfo_addr audit_kinfo;
|
|
|
|
static struct rwlock audit_kinfo_lock;
|
|
|
|
|
2008-11-11 22:59:40 +00:00
|
|
|
#define KINFO_LOCK_INIT() rw_init(&audit_kinfo_lock, \
|
|
|
|
"audit_kinfo_lock")
|
2008-11-11 21:57:03 +00:00
|
|
|
#define KINFO_RLOCK() rw_rlock(&audit_kinfo_lock)
|
|
|
|
#define KINFO_WLOCK() rw_wlock(&audit_kinfo_lock)
|
|
|
|
#define KINFO_RUNLOCK() rw_runlock(&audit_kinfo_lock)
|
|
|
|
#define KINFO_WUNLOCK() rw_wunlock(&audit_kinfo_lock)
|
|
|
|
|
Rework the logic around quick checks for auditing that take place at
system-call entry and whenever audit arguments or return values are
captured:
1. Expose a single global, audit_syscalls_enabled, which controls
whether the audit framework is entered, rather than exposing
components of the policy -- e.g., if the trail is enabled,
suspended, etc.
2. Introduce a new function audit_syscalls_enabled_update(), which is
called to update audit_syscalls_enabled whenever an aspect of the
policy changes, so that the value can be updated.
3. Remove a check of trail enablement/suspension from audit_new() --
at the point where this function has been entered, we believe that
system-call auditing is already in force, or we wouldn't get here,
so simply proceed to more expensive policy checks.
4. Use an audit-provided global, audit_dtrace_enabled, rather than a
dtaudit-provided global, to provide policy indicating whether
dtaudit would like system calls to be audited.
5. Do some minor cosmetic renaming to clarify what various variables
are for.
These changes collectively arrange it so that traditional audit
(trail, pipes) or the DTrace audit provider can enable system-call
probes without the other configured. Otherwise, dtaudit cannot
capture system-call data without auditd(8) started.
Reviewed by: gnn
Sponsored by: DARPA, AFRL
Approved by: re (gjb)
Differential Revision: https://reviews.freebsd.org/D17348
2018-10-02 15:58:17 +00:00
|
|
|
/*
|
|
|
|
* Check various policies to see if we should enable system-call audit hooks.
|
|
|
|
* Note that despite the mutex being held, we want to assign a value exactly
|
|
|
|
* once, as checks of the flag are performed lock-free for performance
|
|
|
|
* reasons. The mutex is used to get a consistent snapshot of policy state --
|
|
|
|
* e.g., safely accessing the two audit_trail flags.
|
|
|
|
*/
|
|
|
|
void
|
|
|
|
audit_syscalls_enabled_update(void)
|
|
|
|
{
|
|
|
|
|
|
|
|
mtx_lock(&audit_mtx);
|
|
|
|
#ifdef KDTRACE_HOOKS
|
|
|
|
if (audit_dtrace_enabled)
|
2018-11-29 08:37:33 +00:00
|
|
|
audit_syscalls_enabled = true;
|
Rework the logic around quick checks for auditing that take place at
system-call entry and whenever audit arguments or return values are
captured:
1. Expose a single global, audit_syscalls_enabled, which controls
whether the audit framework is entered, rather than exposing
components of the policy -- e.g., if the trail is enabled,
suspended, etc.
2. Introduce a new function audit_syscalls_enabled_update(), which is
called to update audit_syscalls_enabled whenever an aspect of the
policy changes, so that the value can be updated.
3. Remove a check of trail enablement/suspension from audit_new() --
at the point where this function has been entered, we believe that
system-call auditing is already in force, or we wouldn't get here,
so simply proceed to more expensive policy checks.
4. Use an audit-provided global, audit_dtrace_enabled, rather than a
dtaudit-provided global, to provide policy indicating whether
dtaudit would like system calls to be audited.
5. Do some minor cosmetic renaming to clarify what various variables
are for.
These changes collectively arrange it so that traditional audit
(trail, pipes) or the DTrace audit provider can enable system-call
probes without the other configured. Otherwise, dtaudit cannot
capture system-call data without auditd(8) started.
Reviewed by: gnn
Sponsored by: DARPA, AFRL
Approved by: re (gjb)
Differential Revision: https://reviews.freebsd.org/D17348
2018-10-02 15:58:17 +00:00
|
|
|
else {
|
|
|
|
#endif
|
|
|
|
if (audit_trail_enabled && !audit_trail_suspended)
|
2018-11-29 08:37:33 +00:00
|
|
|
audit_syscalls_enabled = true;
|
Rework the logic around quick checks for auditing that take place at
system-call entry and whenever audit arguments or return values are
captured:
1. Expose a single global, audit_syscalls_enabled, which controls
whether the audit framework is entered, rather than exposing
components of the policy -- e.g., if the trail is enabled,
suspended, etc.
2. Introduce a new function audit_syscalls_enabled_update(), which is
called to update audit_syscalls_enabled whenever an aspect of the
policy changes, so that the value can be updated.
3. Remove a check of trail enablement/suspension from audit_new() --
at the point where this function has been entered, we believe that
system-call auditing is already in force, or we wouldn't get here,
so simply proceed to more expensive policy checks.
4. Use an audit-provided global, audit_dtrace_enabled, rather than a
dtaudit-provided global, to provide policy indicating whether
dtaudit would like system calls to be audited.
5. Do some minor cosmetic renaming to clarify what various variables
are for.
These changes collectively arrange it so that traditional audit
(trail, pipes) or the DTrace audit provider can enable system-call
probes without the other configured. Otherwise, dtaudit cannot
capture system-call data without auditd(8) started.
Reviewed by: gnn
Sponsored by: DARPA, AFRL
Approved by: re (gjb)
Differential Revision: https://reviews.freebsd.org/D17348
2018-10-02 15:58:17 +00:00
|
|
|
else
|
2018-11-29 08:37:33 +00:00
|
|
|
audit_syscalls_enabled = false;
|
Rework the logic around quick checks for auditing that take place at
system-call entry and whenever audit arguments or return values are
captured:
1. Expose a single global, audit_syscalls_enabled, which controls
whether the audit framework is entered, rather than exposing
components of the policy -- e.g., if the trail is enabled,
suspended, etc.
2. Introduce a new function audit_syscalls_enabled_update(), which is
called to update audit_syscalls_enabled whenever an aspect of the
policy changes, so that the value can be updated.
3. Remove a check of trail enablement/suspension from audit_new() --
at the point where this function has been entered, we believe that
system-call auditing is already in force, or we wouldn't get here,
so simply proceed to more expensive policy checks.
4. Use an audit-provided global, audit_dtrace_enabled, rather than a
dtaudit-provided global, to provide policy indicating whether
dtaudit would like system calls to be audited.
5. Do some minor cosmetic renaming to clarify what various variables
are for.
These changes collectively arrange it so that traditional audit
(trail, pipes) or the DTrace audit provider can enable system-call
probes without the other configured. Otherwise, dtaudit cannot
capture system-call data without auditd(8) started.
Reviewed by: gnn
Sponsored by: DARPA, AFRL
Approved by: re (gjb)
Differential Revision: https://reviews.freebsd.org/D17348
2018-10-02 15:58:17 +00:00
|
|
|
#ifdef KDTRACE_HOOKS
|
|
|
|
}
|
|
|
|
#endif
|
|
|
|
mtx_unlock(&audit_mtx);
|
|
|
|
}
|
|
|
|
|
2008-11-11 21:57:03 +00:00
|
|
|
void
|
|
|
|
audit_set_kinfo(struct auditinfo_addr *ak)
|
|
|
|
{
|
|
|
|
|
|
|
|
KASSERT(ak->ai_termid.at_type == AU_IPv4 ||
|
|
|
|
ak->ai_termid.at_type == AU_IPv6,
|
|
|
|
("audit_set_kinfo: invalid address type"));
|
2008-11-11 22:59:40 +00:00
|
|
|
|
2008-11-11 21:57:03 +00:00
|
|
|
KINFO_WLOCK();
|
|
|
|
audit_kinfo = *ak;
|
|
|
|
KINFO_WUNLOCK();
|
|
|
|
}
|
|
|
|
|
|
|
|
void
|
|
|
|
audit_get_kinfo(struct auditinfo_addr *ak)
|
|
|
|
{
|
|
|
|
|
|
|
|
KASSERT(audit_kinfo.ai_termid.at_type == AU_IPv4 ||
|
|
|
|
audit_kinfo.ai_termid.at_type == AU_IPv6,
|
|
|
|
("audit_set_kinfo: invalid address type"));
|
2008-11-11 22:59:40 +00:00
|
|
|
|
2008-11-11 21:57:03 +00:00
|
|
|
KINFO_RLOCK();
|
|
|
|
*ak = audit_kinfo;
|
|
|
|
KINFO_RUNLOCK();
|
|
|
|
}
|
|
|
|
|
2006-02-01 20:01:18 +00:00
|
|
|
/*
|
2006-02-06 22:30:54 +00:00
|
|
|
* Construct an audit record for the passed thread.
|
2006-02-01 20:01:18 +00:00
|
|
|
*/
|
2006-02-06 22:30:54 +00:00
|
|
|
static int
|
|
|
|
audit_record_ctor(void *mem, int size, void *arg, int flags)
|
|
|
|
{
|
|
|
|
struct kaudit_record *ar;
|
|
|
|
struct thread *td;
|
2008-11-14 01:24:52 +00:00
|
|
|
struct ucred *cred;
|
2013-01-17 21:02:53 +00:00
|
|
|
struct prison *pr;
|
2006-02-06 22:30:54 +00:00
|
|
|
|
|
|
|
KASSERT(sizeof(*ar) == size, ("audit_record_ctor: wrong size"));
|
|
|
|
|
|
|
|
td = arg;
|
|
|
|
ar = mem;
|
|
|
|
bzero(ar, sizeof(*ar));
|
|
|
|
ar->k_ar.ar_magic = AUDIT_RECORD_MAGIC;
|
|
|
|
nanotime(&ar->k_ar.ar_starttime);
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Export the subject credential.
|
|
|
|
*/
|
2008-11-14 01:24:52 +00:00
|
|
|
cred = td->td_ucred;
|
|
|
|
cru2x(cred, &ar->k_ar.ar_subj_cred);
|
|
|
|
ar->k_ar.ar_subj_ruid = cred->cr_ruid;
|
|
|
|
ar->k_ar.ar_subj_rgid = cred->cr_rgid;
|
|
|
|
ar->k_ar.ar_subj_egid = cred->cr_groups[0];
|
|
|
|
ar->k_ar.ar_subj_auid = cred->cr_audit.ai_auid;
|
|
|
|
ar->k_ar.ar_subj_asid = cred->cr_audit.ai_asid;
|
2006-02-06 22:30:54 +00:00
|
|
|
ar->k_ar.ar_subj_pid = td->td_proc->p_pid;
|
2008-11-14 01:24:52 +00:00
|
|
|
ar->k_ar.ar_subj_amask = cred->cr_audit.ai_mask;
|
|
|
|
ar->k_ar.ar_subj_term_addr = cred->cr_audit.ai_termid;
|
2013-01-17 21:02:53 +00:00
|
|
|
/*
|
|
|
|
* If this process is jailed, make sure we capture the name of the
|
|
|
|
* jail so we can use it to generate a zonename token when we covert
|
|
|
|
* this record to BSM.
|
|
|
|
*/
|
|
|
|
if (jailed(cred)) {
|
|
|
|
pr = cred->cr_prison;
|
|
|
|
(void) strlcpy(ar->k_ar.ar_jailname, pr->pr_name,
|
|
|
|
sizeof(ar->k_ar.ar_jailname));
|
|
|
|
} else
|
|
|
|
ar->k_ar.ar_jailname[0] = '\0';
|
2006-02-06 22:30:54 +00:00
|
|
|
return (0);
|
|
|
|
}
|
|
|
|
|
2006-02-01 20:01:18 +00:00
|
|
|
static void
|
2006-02-06 22:30:54 +00:00
|
|
|
audit_record_dtor(void *mem, int size, void *arg)
|
2006-02-01 20:01:18 +00:00
|
|
|
{
|
2006-02-06 22:30:54 +00:00
|
|
|
struct kaudit_record *ar;
|
2006-02-01 20:01:18 +00:00
|
|
|
|
2006-02-06 22:30:54 +00:00
|
|
|
KASSERT(sizeof(*ar) == size, ("audit_record_dtor: wrong size"));
|
|
|
|
|
|
|
|
ar = mem;
|
|
|
|
if (ar->k_ar.ar_arg_upath1 != NULL)
|
2006-02-01 20:01:18 +00:00
|
|
|
free(ar->k_ar.ar_arg_upath1, M_AUDITPATH);
|
2006-02-06 22:30:54 +00:00
|
|
|
if (ar->k_ar.ar_arg_upath2 != NULL)
|
2006-02-01 20:01:18 +00:00
|
|
|
free(ar->k_ar.ar_arg_upath2, M_AUDITPATH);
|
2006-02-06 22:30:54 +00:00
|
|
|
if (ar->k_ar.ar_arg_text != NULL)
|
2006-02-01 20:01:18 +00:00
|
|
|
free(ar->k_ar.ar_arg_text, M_AUDITTEXT);
|
2006-02-06 22:30:54 +00:00
|
|
|
if (ar->k_udata != NULL)
|
2006-02-01 20:01:18 +00:00
|
|
|
free(ar->k_udata, M_AUDITDATA);
|
2006-09-01 11:45:40 +00:00
|
|
|
if (ar->k_ar.ar_arg_argv != NULL)
|
|
|
|
free(ar->k_ar.ar_arg_argv, M_AUDITTEXT);
|
|
|
|
if (ar->k_ar.ar_arg_envv != NULL)
|
|
|
|
free(ar->k_ar.ar_arg_envv, M_AUDITTEXT);
|
2009-06-29 20:19:19 +00:00
|
|
|
if (ar->k_ar.ar_arg_groups.gidset != NULL)
|
|
|
|
free(ar->k_ar.ar_arg_groups.gidset, M_AUDITGIDSET);
|
2006-02-01 20:01:18 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Initialize the Audit subsystem: configuration state, work queue,
|
|
|
|
* synchronization primitives, worker thread, and trigger device node. Also
|
|
|
|
* call into the BSM assembly code to initialize it.
|
|
|
|
*/
|
|
|
|
static void
|
|
|
|
audit_init(void)
|
|
|
|
{
|
|
|
|
|
Rework the logic around quick checks for auditing that take place at
system-call entry and whenever audit arguments or return values are
captured:
1. Expose a single global, audit_syscalls_enabled, which controls
whether the audit framework is entered, rather than exposing
components of the policy -- e.g., if the trail is enabled,
suspended, etc.
2. Introduce a new function audit_syscalls_enabled_update(), which is
called to update audit_syscalls_enabled whenever an aspect of the
policy changes, so that the value can be updated.
3. Remove a check of trail enablement/suspension from audit_new() --
at the point where this function has been entered, we believe that
system-call auditing is already in force, or we wouldn't get here,
so simply proceed to more expensive policy checks.
4. Use an audit-provided global, audit_dtrace_enabled, rather than a
dtaudit-provided global, to provide policy indicating whether
dtaudit would like system calls to be audited.
5. Do some minor cosmetic renaming to clarify what various variables
are for.
These changes collectively arrange it so that traditional audit
(trail, pipes) or the DTrace audit provider can enable system-call
probes without the other configured. Otherwise, dtaudit cannot
capture system-call data without auditd(8) started.
Reviewed by: gnn
Sponsored by: DARPA, AFRL
Approved by: re (gjb)
Differential Revision: https://reviews.freebsd.org/D17348
2018-10-02 15:58:17 +00:00
|
|
|
audit_trail_enabled = 0;
|
|
|
|
audit_trail_suspended = 0;
|
2018-11-29 08:37:33 +00:00
|
|
|
audit_syscalls_enabled = false;
|
2006-02-01 20:01:18 +00:00
|
|
|
audit_panic_on_write_fail = 0;
|
|
|
|
audit_fail_stop = 0;
|
|
|
|
audit_in_failure = 0;
|
2006-09-01 11:45:40 +00:00
|
|
|
audit_argv = 0;
|
|
|
|
audit_arge = 0;
|
2006-02-01 20:01:18 +00:00
|
|
|
|
2007-06-01 21:58:59 +00:00
|
|
|
audit_fstat.af_filesz = 0; /* '0' means unset, unbounded. */
|
2006-03-19 17:34:00 +00:00
|
|
|
audit_fstat.af_currsz = 0;
|
2007-10-29 18:07:48 +00:00
|
|
|
audit_nae_mask.am_success = 0;
|
|
|
|
audit_nae_mask.am_failure = 0;
|
2006-02-01 20:01:18 +00:00
|
|
|
|
|
|
|
TAILQ_INIT(&audit_q);
|
|
|
|
audit_q_len = 0;
|
|
|
|
audit_pre_q_len = 0;
|
|
|
|
audit_qctrl.aq_hiwater = AQ_HIWATER;
|
|
|
|
audit_qctrl.aq_lowater = AQ_LOWATER;
|
|
|
|
audit_qctrl.aq_bufsz = AQ_BUFSZ;
|
|
|
|
audit_qctrl.aq_minfree = AU_FS_MINFREE;
|
|
|
|
|
2008-11-11 21:57:03 +00:00
|
|
|
audit_kinfo.ai_termid.at_type = AU_IPv4;
|
|
|
|
audit_kinfo.ai_termid.at_addr[0] = INADDR_ANY;
|
|
|
|
|
2006-02-01 20:01:18 +00:00
|
|
|
mtx_init(&audit_mtx, "audit_mtx", NULL, MTX_DEF);
|
2008-11-11 21:57:03 +00:00
|
|
|
KINFO_LOCK_INIT();
|
2006-06-05 13:43:57 +00:00
|
|
|
cv_init(&audit_worker_cv, "audit_worker_cv");
|
|
|
|
cv_init(&audit_watermark_cv, "audit_watermark_cv");
|
2006-02-01 20:01:18 +00:00
|
|
|
cv_init(&audit_fail_cv, "audit_fail_cv");
|
|
|
|
|
2006-06-05 14:11:28 +00:00
|
|
|
audit_record_zone = uma_zcreate("audit_record",
|
2006-02-06 22:30:54 +00:00
|
|
|
sizeof(struct kaudit_record), audit_record_ctor,
|
|
|
|
audit_record_dtor, NULL, NULL, UMA_ALIGN_PTR, 0);
|
|
|
|
|
Rework the logic around quick checks for auditing that take place at
system-call entry and whenever audit arguments or return values are
captured:
1. Expose a single global, audit_syscalls_enabled, which controls
whether the audit framework is entered, rather than exposing
components of the policy -- e.g., if the trail is enabled,
suspended, etc.
2. Introduce a new function audit_syscalls_enabled_update(), which is
called to update audit_syscalls_enabled whenever an aspect of the
policy changes, so that the value can be updated.
3. Remove a check of trail enablement/suspension from audit_new() --
at the point where this function has been entered, we believe that
system-call auditing is already in force, or we wouldn't get here,
so simply proceed to more expensive policy checks.
4. Use an audit-provided global, audit_dtrace_enabled, rather than a
dtaudit-provided global, to provide policy indicating whether
dtaudit would like system calls to be audited.
5. Do some minor cosmetic renaming to clarify what various variables
are for.
These changes collectively arrange it so that traditional audit
(trail, pipes) or the DTrace audit provider can enable system-call
probes without the other configured. Otherwise, dtaudit cannot
capture system-call data without auditd(8) started.
Reviewed by: gnn
Sponsored by: DARPA, AFRL
Approved by: re (gjb)
Differential Revision: https://reviews.freebsd.org/D17348
2018-10-02 15:58:17 +00:00
|
|
|
/* First initialisation of audit_syscalls_enabled. */
|
|
|
|
audit_syscalls_enabled_update();
|
|
|
|
|
2006-02-01 20:01:18 +00:00
|
|
|
/* Initialize the BSM audit subsystem. */
|
|
|
|
kau_init();
|
|
|
|
|
|
|
|
audit_trigger_init();
|
|
|
|
|
|
|
|
/* Register shutdown handler. */
|
|
|
|
EVENTHANDLER_REGISTER(shutdown_pre_sync, audit_shutdown, NULL,
|
|
|
|
SHUTDOWN_PRI_FIRST);
|
|
|
|
|
Merge Perforce changes 93512, 93514, 93515 from TrustedBSD audit3
branch:
Integrate audit.c to audit_worker.c, so as to migrate the worker
thread implementation to its own .c file.
Populate audit_worker.c using parts now removed from audit.c:
- Move audit rotation global variables.
- Move audit_record_write(), audit_worker_rotate(),
audit_worker_drain(), audit_worker(), audit_rotate_vnode().
- Create audit_worker_init() from relevant parts of audit_init(),
which now calls this routine.
- Recreate audit_free(), which wraps uma_zfree() so that
audit_record_zone can be static to audit.c.
- Unstaticize various types and variables relating to the audit
record queue so that audit_worker can get to them. We may want
to wrap these in accessor methods at some point.
- Move AUDIT_PRINTF() to audit_private.h.
Addition of audit_worker.c to kernel configuration, missed in
earlier submit.
Obtained from: TrustedBSD Project
2006-03-19 16:03:43 +00:00
|
|
|
/* Start audit worker thread. */
|
|
|
|
audit_worker_init();
|
2006-02-01 20:01:18 +00:00
|
|
|
}
|
|
|
|
|
2008-03-16 10:58:09 +00:00
|
|
|
SYSINIT(audit_init, SI_SUB_AUDIT, SI_ORDER_FIRST, audit_init, NULL);
|
2006-02-01 20:01:18 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* Drain the audit queue and close the log at shutdown. Note that this can
|
|
|
|
* be called both from the system shutdown path and also from audit
|
|
|
|
* configuration syscalls, so 'arg' and 'howto' are ignored.
|
2008-06-03 11:06:34 +00:00
|
|
|
*
|
|
|
|
* XXXRW: In FreeBSD 7.x and 8.x, this fails to wait for the record queue to
|
|
|
|
* drain before returning, which could lead to lost records on shutdown.
|
2006-02-01 20:01:18 +00:00
|
|
|
*/
|
|
|
|
void
|
|
|
|
audit_shutdown(void *arg, int howto)
|
|
|
|
{
|
|
|
|
|
|
|
|
audit_rotate_vnode(NULL, NULL);
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Return the current thread's audit record, if any.
|
|
|
|
*/
|
2007-05-23 09:32:30 +00:00
|
|
|
struct kaudit_record *
|
2006-02-01 20:01:18 +00:00
|
|
|
currecord(void)
|
|
|
|
{
|
|
|
|
|
|
|
|
return (curthread->td_ar);
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* XXXAUDIT: Shouldn't there be logic here to sleep waiting on available
|
|
|
|
* pre_q space, suspending the system call until there is room?
|
|
|
|
*/
|
|
|
|
struct kaudit_record *
|
|
|
|
audit_new(int event, struct thread *td)
|
|
|
|
{
|
|
|
|
struct kaudit_record *ar;
|
|
|
|
|
|
|
|
/*
|
2006-12-28 22:18:43 +00:00
|
|
|
* Note: the number of outstanding uncommitted audit records is
|
|
|
|
* limited to the number of concurrent threads servicing system calls
|
|
|
|
* in the kernel.
|
2006-02-01 20:01:18 +00:00
|
|
|
*/
|
2006-02-06 22:30:54 +00:00
|
|
|
ar = uma_zalloc_arg(audit_record_zone, td, M_WAITOK);
|
|
|
|
ar->k_ar.ar_event = event;
|
2006-02-01 20:01:18 +00:00
|
|
|
|
|
|
|
mtx_lock(&audit_mtx);
|
|
|
|
audit_pre_q_len++;
|
|
|
|
mtx_unlock(&audit_mtx);
|
|
|
|
|
|
|
|
return (ar);
|
|
|
|
}
|
|
|
|
|
Merge Perforce changes 93512, 93514, 93515 from TrustedBSD audit3
branch:
Integrate audit.c to audit_worker.c, so as to migrate the worker
thread implementation to its own .c file.
Populate audit_worker.c using parts now removed from audit.c:
- Move audit rotation global variables.
- Move audit_record_write(), audit_worker_rotate(),
audit_worker_drain(), audit_worker(), audit_rotate_vnode().
- Create audit_worker_init() from relevant parts of audit_init(),
which now calls this routine.
- Recreate audit_free(), which wraps uma_zfree() so that
audit_record_zone can be static to audit.c.
- Unstaticize various types and variables relating to the audit
record queue so that audit_worker can get to them. We may want
to wrap these in accessor methods at some point.
- Move AUDIT_PRINTF() to audit_private.h.
Addition of audit_worker.c to kernel configuration, missed in
earlier submit.
Obtained from: TrustedBSD Project
2006-03-19 16:03:43 +00:00
|
|
|
void
|
|
|
|
audit_free(struct kaudit_record *ar)
|
|
|
|
{
|
|
|
|
|
|
|
|
uma_zfree(audit_record_zone, ar);
|
|
|
|
}
|
|
|
|
|
2006-02-01 20:01:18 +00:00
|
|
|
void
|
|
|
|
audit_commit(struct kaudit_record *ar, int error, int retval)
|
|
|
|
{
|
Introduce support for per-audit pipe preselection independent from the
global audit trail configuration. This allows applications consuming
audit trails to specify parameters for which audit records are of
interest, including selecting records not required by the global trail.
Allowing application interest specification without changing the global
configuration allows intrusion detection systems to run without
interfering with global auditing or each other (if multiple are
present). To implement this:
- Kernel audit records now carry a flag to indicate whether they have
been selected by the global trail or by the audit pipe subsystem,
set during record commit, so that this information is available
after BSM conversion when delivering the BSM to the trail and audit
pipes in the audit worker thread asynchronously. Preselection by
either record target will cause the record to be kept.
- Similar changes to preselection when the audit record is created
when the system call is entering: consult both the global trail and
pipes.
- au_preselect() now accepts the class in order to avoid repeatedly
looking up the mask for each preselection test.
- Define a series of ioctls that allow applications to specify whether
they want to track the global trail, or program their own
preselection parameters: they may specify their own flags and naflags
masks, similar to the global masks of the same name, as well as a set
of per-auid masks. They also set a per-pipe mode specifying whether
they track the global trail, or user their own -- the door is left
open for future additional modes. A new ioctl is defined to allow a
user process to flush the current audit pipe queue, which can be used
after reprogramming pre-selection to make sure that only records of
interest are received in future reads.
- Audit pipe data structures are extended to hold the additional fields
necessary to support preselection. By default, audit pipes track the
global trail, so "praudit /dev/auditpipe" will track the global audit
trail even though praudit doesn't program the audit pipe selection
model.
- Comment about the complexities of potentially adding partial read
support to audit pipes.
By using a set of ioctls, applications can select which records are of
interest, and toggle the preselection mode.
Obtained from: TrustedBSD Project
2006-06-05 14:48:17 +00:00
|
|
|
au_event_t event;
|
|
|
|
au_class_t class;
|
|
|
|
au_id_t auid;
|
2006-02-01 20:01:18 +00:00
|
|
|
int sorf;
|
|
|
|
struct au_mask *aumask;
|
|
|
|
|
|
|
|
if (ar == NULL)
|
|
|
|
return;
|
|
|
|
|
Add an experimental DTrace audit provider, which allows users of DTrace to
instrument security event auditing rather than relying on conventional BSM
trail files or audit pipes:
- Add a set of per-event 'commit' probes, which provide access to
particular auditable events at the time of commit in system-call return.
These probes gain access to audit data via the in-kernel audit_record
data structure, providing convenient access to system-call arguments and
return values in a single probe.
- Add a set of per-event 'bsm' probes, which provide access to particular
auditable events at the time of BSM record generation in the audit
worker thread. These probes have access to the in-kernel audit_record
data structure and BSM representation as would be written to a trail
file or audit pipe -- i.e., asynchronously in the audit worker thread.
DTrace probe arguments consist of the name of the audit event (to support
future mechanisms of instrumenting multiple events via a single probe --
e.g., using classes), a pointer to the in-kernel audit record, and an
optional pointer to the BSM data and its length. For human convenience,
upper-case audit event names (AUE_...) are converted to lower case in
DTrace.
DTrace scripts can now cause additional audit-based data to be collected
on system calls, and inspect internal and BSM representations of the data.
They do not affect data captured in the audit trail or audit pipes
configured in the system. auditd(8) must be configured and running in
order to provide a database of event information, as well as other audit
configuration parameters (e.g., to capture command-line arguments or
environmental variables) for the provider to operate.
Reviewed by: gnn, jonathan, markj
Sponsored by: DARPA, AFRL
MFC after: 3 weeks
Differential Revision: https://reviews.freebsd.org/D10149
2017-03-29 19:58:00 +00:00
|
|
|
ar->k_ar.ar_errno = error;
|
|
|
|
ar->k_ar.ar_retval = retval;
|
|
|
|
nanotime(&ar->k_ar.ar_endtime);
|
|
|
|
|
2006-02-01 20:01:18 +00:00
|
|
|
/*
|
2007-06-01 21:58:59 +00:00
|
|
|
* Decide whether to commit the audit record by checking the error
|
|
|
|
* value from the system call and using the appropriate audit mask.
|
2006-02-01 20:01:18 +00:00
|
|
|
*/
|
|
|
|
if (ar->k_ar.ar_subj_auid == AU_DEFAUDITID)
|
|
|
|
aumask = &audit_nae_mask;
|
|
|
|
else
|
|
|
|
aumask = &ar->k_ar.ar_subj_amask;
|
2006-03-19 17:34:00 +00:00
|
|
|
|
2006-02-01 20:01:18 +00:00
|
|
|
if (error)
|
|
|
|
sorf = AU_PRS_FAILURE;
|
|
|
|
else
|
|
|
|
sorf = AU_PRS_SUCCESS;
|
|
|
|
|
2009-07-28 21:39:58 +00:00
|
|
|
/*
|
|
|
|
* syscalls.master sometimes contains a prototype event number, which
|
|
|
|
* we will transform into a more specific event number now that we
|
|
|
|
* have more complete information gathered during the system call.
|
|
|
|
*/
|
2006-02-01 20:01:18 +00:00
|
|
|
switch(ar->k_ar.ar_event) {
|
|
|
|
case AUE_OPEN_RWTC:
|
2008-03-01 11:40:49 +00:00
|
|
|
ar->k_ar.ar_event = audit_flags_and_error_to_openevent(
|
2006-02-01 20:01:18 +00:00
|
|
|
ar->k_ar.ar_arg_fflags, error);
|
|
|
|
break;
|
|
|
|
|
2009-07-28 21:39:58 +00:00
|
|
|
case AUE_OPENAT_RWTC:
|
|
|
|
ar->k_ar.ar_event = audit_flags_and_error_to_openatevent(
|
|
|
|
ar->k_ar.ar_arg_fflags, error);
|
|
|
|
break;
|
|
|
|
|
2006-02-01 20:01:18 +00:00
|
|
|
case AUE_SYSCTL:
|
2008-03-01 11:40:49 +00:00
|
|
|
ar->k_ar.ar_event = audit_ctlname_to_sysctlevent(
|
2006-02-01 20:01:18 +00:00
|
|
|
ar->k_ar.ar_arg_ctlname, ar->k_ar.ar_valid_arg);
|
|
|
|
break;
|
|
|
|
|
|
|
|
case AUE_AUDITON:
|
2007-06-11 22:10:54 +00:00
|
|
|
/* Convert the auditon() command to an event. */
|
2006-02-01 20:01:18 +00:00
|
|
|
ar->k_ar.ar_event = auditon_command_event(ar->k_ar.ar_arg_cmd);
|
|
|
|
break;
|
2017-03-29 23:31:35 +00:00
|
|
|
|
|
|
|
case AUE_MSGSYS:
|
|
|
|
if (ARG_IS_VALID(ar, ARG_SVIPC_WHICH))
|
|
|
|
ar->k_ar.ar_event =
|
|
|
|
audit_msgsys_to_event(ar->k_ar.ar_arg_svipc_which);
|
|
|
|
break;
|
|
|
|
|
|
|
|
case AUE_SEMSYS:
|
|
|
|
if (ARG_IS_VALID(ar, ARG_SVIPC_WHICH))
|
|
|
|
ar->k_ar.ar_event =
|
|
|
|
audit_semsys_to_event(ar->k_ar.ar_arg_svipc_which);
|
|
|
|
break;
|
|
|
|
|
|
|
|
case AUE_SHMSYS:
|
|
|
|
if (ARG_IS_VALID(ar, ARG_SVIPC_WHICH))
|
|
|
|
ar->k_ar.ar_event =
|
|
|
|
audit_shmsys_to_event(ar->k_ar.ar_arg_svipc_which);
|
|
|
|
break;
|
2006-02-01 20:01:18 +00:00
|
|
|
}
|
|
|
|
|
Introduce support for per-audit pipe preselection independent from the
global audit trail configuration. This allows applications consuming
audit trails to specify parameters for which audit records are of
interest, including selecting records not required by the global trail.
Allowing application interest specification without changing the global
configuration allows intrusion detection systems to run without
interfering with global auditing or each other (if multiple are
present). To implement this:
- Kernel audit records now carry a flag to indicate whether they have
been selected by the global trail or by the audit pipe subsystem,
set during record commit, so that this information is available
after BSM conversion when delivering the BSM to the trail and audit
pipes in the audit worker thread asynchronously. Preselection by
either record target will cause the record to be kept.
- Similar changes to preselection when the audit record is created
when the system call is entering: consult both the global trail and
pipes.
- au_preselect() now accepts the class in order to avoid repeatedly
looking up the mask for each preselection test.
- Define a series of ioctls that allow applications to specify whether
they want to track the global trail, or program their own
preselection parameters: they may specify their own flags and naflags
masks, similar to the global masks of the same name, as well as a set
of per-auid masks. They also set a per-pipe mode specifying whether
they track the global trail, or user their own -- the door is left
open for future additional modes. A new ioctl is defined to allow a
user process to flush the current audit pipe queue, which can be used
after reprogramming pre-selection to make sure that only records of
interest are received in future reads.
- Audit pipe data structures are extended to hold the additional fields
necessary to support preselection. By default, audit pipes track the
global trail, so "praudit /dev/auditpipe" will track the global audit
trail even though praudit doesn't program the audit pipe selection
model.
- Comment about the complexities of potentially adding partial read
support to audit pipes.
By using a set of ioctls, applications can select which records are of
interest, and toggle the preselection mode.
Obtained from: TrustedBSD Project
2006-06-05 14:48:17 +00:00
|
|
|
auid = ar->k_ar.ar_subj_auid;
|
|
|
|
event = ar->k_ar.ar_event;
|
|
|
|
class = au_event_class(event);
|
|
|
|
|
|
|
|
ar->k_ar_commit |= AR_COMMIT_KERNEL;
|
|
|
|
if (au_preselect(event, class, aumask, sorf) != 0)
|
|
|
|
ar->k_ar_commit |= AR_PRESELECT_TRAIL;
|
|
|
|
if (audit_pipe_preselect(auid, event, class, sorf,
|
|
|
|
ar->k_ar_commit & AR_PRESELECT_TRAIL) != 0)
|
|
|
|
ar->k_ar_commit |= AR_PRESELECT_PIPE;
|
Add an experimental DTrace audit provider, which allows users of DTrace to
instrument security event auditing rather than relying on conventional BSM
trail files or audit pipes:
- Add a set of per-event 'commit' probes, which provide access to
particular auditable events at the time of commit in system-call return.
These probes gain access to audit data via the in-kernel audit_record
data structure, providing convenient access to system-call arguments and
return values in a single probe.
- Add a set of per-event 'bsm' probes, which provide access to particular
auditable events at the time of BSM record generation in the audit
worker thread. These probes have access to the in-kernel audit_record
data structure and BSM representation as would be written to a trail
file or audit pipe -- i.e., asynchronously in the audit worker thread.
DTrace probe arguments consist of the name of the audit event (to support
future mechanisms of instrumenting multiple events via a single probe --
e.g., using classes), a pointer to the in-kernel audit record, and an
optional pointer to the BSM data and its length. For human convenience,
upper-case audit event names (AUE_...) are converted to lower case in
DTrace.
DTrace scripts can now cause additional audit-based data to be collected
on system calls, and inspect internal and BSM representations of the data.
They do not affect data captured in the audit trail or audit pipes
configured in the system. auditd(8) must be configured and running in
order to provide a database of event information, as well as other audit
configuration parameters (e.g., to capture command-line arguments or
environmental variables) for the provider to operate.
Reviewed by: gnn, jonathan, markj
Sponsored by: DARPA, AFRL
MFC after: 3 weeks
Differential Revision: https://reviews.freebsd.org/D10149
2017-03-29 19:58:00 +00:00
|
|
|
#ifdef KDTRACE_HOOKS
|
|
|
|
/*
|
|
|
|
* Expose the audit record to DTrace, both to allow the "commit" probe
|
|
|
|
* to fire if it's desirable, and also to allow a decision to be made
|
|
|
|
* about later firing with BSM in the audit worker.
|
|
|
|
*/
|
|
|
|
if (dtaudit_hook_commit != NULL) {
|
|
|
|
if (dtaudit_hook_commit(ar, auid, event, class, sorf) != 0)
|
|
|
|
ar->k_ar_commit |= AR_PRESELECT_DTRACE;
|
|
|
|
}
|
|
|
|
#endif
|
|
|
|
|
2006-09-17 17:52:57 +00:00
|
|
|
if ((ar->k_ar_commit & (AR_PRESELECT_TRAIL | AR_PRESELECT_PIPE |
|
Add an experimental DTrace audit provider, which allows users of DTrace to
instrument security event auditing rather than relying on conventional BSM
trail files or audit pipes:
- Add a set of per-event 'commit' probes, which provide access to
particular auditable events at the time of commit in system-call return.
These probes gain access to audit data via the in-kernel audit_record
data structure, providing convenient access to system-call arguments and
return values in a single probe.
- Add a set of per-event 'bsm' probes, which provide access to particular
auditable events at the time of BSM record generation in the audit
worker thread. These probes have access to the in-kernel audit_record
data structure and BSM representation as would be written to a trail
file or audit pipe -- i.e., asynchronously in the audit worker thread.
DTrace probe arguments consist of the name of the audit event (to support
future mechanisms of instrumenting multiple events via a single probe --
e.g., using classes), a pointer to the in-kernel audit record, and an
optional pointer to the BSM data and its length. For human convenience,
upper-case audit event names (AUE_...) are converted to lower case in
DTrace.
DTrace scripts can now cause additional audit-based data to be collected
on system calls, and inspect internal and BSM representations of the data.
They do not affect data captured in the audit trail or audit pipes
configured in the system. auditd(8) must be configured and running in
order to provide a database of event information, as well as other audit
configuration parameters (e.g., to capture command-line arguments or
environmental variables) for the provider to operate.
Reviewed by: gnn, jonathan, markj
Sponsored by: DARPA, AFRL
MFC after: 3 weeks
Differential Revision: https://reviews.freebsd.org/D10149
2017-03-29 19:58:00 +00:00
|
|
|
AR_PRESELECT_USER_TRAIL | AR_PRESELECT_USER_PIPE |
|
|
|
|
AR_PRESELECT_DTRACE)) == 0) {
|
2006-02-01 20:01:18 +00:00
|
|
|
mtx_lock(&audit_mtx);
|
|
|
|
audit_pre_q_len--;
|
|
|
|
mtx_unlock(&audit_mtx);
|
2006-06-05 15:38:12 +00:00
|
|
|
audit_free(ar);
|
2006-02-01 20:01:18 +00:00
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Note: it could be that some records initiated while audit was
|
|
|
|
* enabled should still be committed?
|
Rework the logic around quick checks for auditing that take place at
system-call entry and whenever audit arguments or return values are
captured:
1. Expose a single global, audit_syscalls_enabled, which controls
whether the audit framework is entered, rather than exposing
components of the policy -- e.g., if the trail is enabled,
suspended, etc.
2. Introduce a new function audit_syscalls_enabled_update(), which is
called to update audit_syscalls_enabled whenever an aspect of the
policy changes, so that the value can be updated.
3. Remove a check of trail enablement/suspension from audit_new() --
at the point where this function has been entered, we believe that
system-call auditing is already in force, or we wouldn't get here,
so simply proceed to more expensive policy checks.
4. Use an audit-provided global, audit_dtrace_enabled, rather than a
dtaudit-provided global, to provide policy indicating whether
dtaudit would like system calls to be audited.
5. Do some minor cosmetic renaming to clarify what various variables
are for.
These changes collectively arrange it so that traditional audit
(trail, pipes) or the DTrace audit provider can enable system-call
probes without the other configured. Otherwise, dtaudit cannot
capture system-call data without auditd(8) started.
Reviewed by: gnn
Sponsored by: DARPA, AFRL
Approved by: re (gjb)
Differential Revision: https://reviews.freebsd.org/D17348
2018-10-02 15:58:17 +00:00
|
|
|
*
|
|
|
|
* NB: The check here is not for audit_syscalls because any
|
|
|
|
* DTrace-related obligations have been fulfilled above -- we're just
|
|
|
|
* down to the trail and pipes now.
|
2006-02-01 20:01:18 +00:00
|
|
|
*/
|
2007-06-01 21:58:59 +00:00
|
|
|
mtx_lock(&audit_mtx);
|
Rework the logic around quick checks for auditing that take place at
system-call entry and whenever audit arguments or return values are
captured:
1. Expose a single global, audit_syscalls_enabled, which controls
whether the audit framework is entered, rather than exposing
components of the policy -- e.g., if the trail is enabled,
suspended, etc.
2. Introduce a new function audit_syscalls_enabled_update(), which is
called to update audit_syscalls_enabled whenever an aspect of the
policy changes, so that the value can be updated.
3. Remove a check of trail enablement/suspension from audit_new() --
at the point where this function has been entered, we believe that
system-call auditing is already in force, or we wouldn't get here,
so simply proceed to more expensive policy checks.
4. Use an audit-provided global, audit_dtrace_enabled, rather than a
dtaudit-provided global, to provide policy indicating whether
dtaudit would like system calls to be audited.
5. Do some minor cosmetic renaming to clarify what various variables
are for.
These changes collectively arrange it so that traditional audit
(trail, pipes) or the DTrace audit provider can enable system-call
probes without the other configured. Otherwise, dtaudit cannot
capture system-call data without auditd(8) started.
Reviewed by: gnn
Sponsored by: DARPA, AFRL
Approved by: re (gjb)
Differential Revision: https://reviews.freebsd.org/D17348
2018-10-02 15:58:17 +00:00
|
|
|
if (audit_trail_suspended || !audit_trail_enabled) {
|
2006-02-01 20:01:18 +00:00
|
|
|
audit_pre_q_len--;
|
|
|
|
mtx_unlock(&audit_mtx);
|
2006-06-05 15:38:12 +00:00
|
|
|
audit_free(ar);
|
2006-02-01 20:01:18 +00:00
|
|
|
return;
|
|
|
|
}
|
2006-03-19 17:34:00 +00:00
|
|
|
|
2006-02-01 20:01:18 +00:00
|
|
|
/*
|
2007-06-01 13:53:37 +00:00
|
|
|
* Constrain the number of committed audit records based on the
|
|
|
|
* configurable parameter.
|
2006-02-01 20:01:18 +00:00
|
|
|
*/
|
2007-06-01 13:53:37 +00:00
|
|
|
while (audit_q_len >= audit_qctrl.aq_hiwater)
|
2006-06-05 13:43:57 +00:00
|
|
|
cv_wait(&audit_watermark_cv, &audit_mtx);
|
2006-02-01 20:01:18 +00:00
|
|
|
|
|
|
|
TAILQ_INSERT_TAIL(&audit_q, ar, k_q);
|
|
|
|
audit_q_len++;
|
|
|
|
audit_pre_q_len--;
|
2006-06-05 13:43:57 +00:00
|
|
|
cv_signal(&audit_worker_cv);
|
2006-02-01 20:01:18 +00:00
|
|
|
mtx_unlock(&audit_mtx);
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* audit_syscall_enter() is called on entry to each system call. It is
|
|
|
|
* responsible for deciding whether or not to audit the call (preselection),
|
|
|
|
* and if so, allocating a per-thread audit record. audit_new() will fill in
|
|
|
|
* basic thread/credential properties.
|
Rework the logic around quick checks for auditing that take place at
system-call entry and whenever audit arguments or return values are
captured:
1. Expose a single global, audit_syscalls_enabled, which controls
whether the audit framework is entered, rather than exposing
components of the policy -- e.g., if the trail is enabled,
suspended, etc.
2. Introduce a new function audit_syscalls_enabled_update(), which is
called to update audit_syscalls_enabled whenever an aspect of the
policy changes, so that the value can be updated.
3. Remove a check of trail enablement/suspension from audit_new() --
at the point where this function has been entered, we believe that
system-call auditing is already in force, or we wouldn't get here,
so simply proceed to more expensive policy checks.
4. Use an audit-provided global, audit_dtrace_enabled, rather than a
dtaudit-provided global, to provide policy indicating whether
dtaudit would like system calls to be audited.
5. Do some minor cosmetic renaming to clarify what various variables
are for.
These changes collectively arrange it so that traditional audit
(trail, pipes) or the DTrace audit provider can enable system-call
probes without the other configured. Otherwise, dtaudit cannot
capture system-call data without auditd(8) started.
Reviewed by: gnn
Sponsored by: DARPA, AFRL
Approved by: re (gjb)
Differential Revision: https://reviews.freebsd.org/D17348
2018-10-02 15:58:17 +00:00
|
|
|
*
|
|
|
|
* This function will be entered only if audit_syscalls_enabled was set in the
|
|
|
|
* macro wrapper for this function. It could be cleared by the time this
|
|
|
|
* function runs, but that is an acceptable race.
|
2006-02-01 20:01:18 +00:00
|
|
|
*/
|
|
|
|
void
|
|
|
|
audit_syscall_enter(unsigned short code, struct thread *td)
|
|
|
|
{
|
|
|
|
struct au_mask *aumask;
|
Add an experimental DTrace audit provider, which allows users of DTrace to
instrument security event auditing rather than relying on conventional BSM
trail files or audit pipes:
- Add a set of per-event 'commit' probes, which provide access to
particular auditable events at the time of commit in system-call return.
These probes gain access to audit data via the in-kernel audit_record
data structure, providing convenient access to system-call arguments and
return values in a single probe.
- Add a set of per-event 'bsm' probes, which provide access to particular
auditable events at the time of BSM record generation in the audit
worker thread. These probes have access to the in-kernel audit_record
data structure and BSM representation as would be written to a trail
file or audit pipe -- i.e., asynchronously in the audit worker thread.
DTrace probe arguments consist of the name of the audit event (to support
future mechanisms of instrumenting multiple events via a single probe --
e.g., using classes), a pointer to the in-kernel audit record, and an
optional pointer to the BSM data and its length. For human convenience,
upper-case audit event names (AUE_...) are converted to lower case in
DTrace.
DTrace scripts can now cause additional audit-based data to be collected
on system calls, and inspect internal and BSM representations of the data.
They do not affect data captured in the audit trail or audit pipes
configured in the system. auditd(8) must be configured and running in
order to provide a database of event information, as well as other audit
configuration parameters (e.g., to capture command-line arguments or
environmental variables) for the provider to operate.
Reviewed by: gnn, jonathan, markj
Sponsored by: DARPA, AFRL
MFC after: 3 weeks
Differential Revision: https://reviews.freebsd.org/D10149
2017-03-29 19:58:00 +00:00
|
|
|
#ifdef KDTRACE_HOOKS
|
|
|
|
void *dtaudit_state;
|
|
|
|
#endif
|
Introduce support for per-audit pipe preselection independent from the
global audit trail configuration. This allows applications consuming
audit trails to specify parameters for which audit records are of
interest, including selecting records not required by the global trail.
Allowing application interest specification without changing the global
configuration allows intrusion detection systems to run without
interfering with global auditing or each other (if multiple are
present). To implement this:
- Kernel audit records now carry a flag to indicate whether they have
been selected by the global trail or by the audit pipe subsystem,
set during record commit, so that this information is available
after BSM conversion when delivering the BSM to the trail and audit
pipes in the audit worker thread asynchronously. Preselection by
either record target will cause the record to be kept.
- Similar changes to preselection when the audit record is created
when the system call is entering: consult both the global trail and
pipes.
- au_preselect() now accepts the class in order to avoid repeatedly
looking up the mask for each preselection test.
- Define a series of ioctls that allow applications to specify whether
they want to track the global trail, or program their own
preselection parameters: they may specify their own flags and naflags
masks, similar to the global masks of the same name, as well as a set
of per-auid masks. They also set a per-pipe mode specifying whether
they track the global trail, or user their own -- the door is left
open for future additional modes. A new ioctl is defined to allow a
user process to flush the current audit pipe queue, which can be used
after reprogramming pre-selection to make sure that only records of
interest are received in future reads.
- Audit pipe data structures are extended to hold the additional fields
necessary to support preselection. By default, audit pipes track the
global trail, so "praudit /dev/auditpipe" will track the global audit
trail even though praudit doesn't program the audit pipe selection
model.
- Comment about the complexities of potentially adding partial read
support to audit pipes.
By using a set of ioctls, applications can select which records are of
interest, and toggle the preselection mode.
Obtained from: TrustedBSD Project
2006-06-05 14:48:17 +00:00
|
|
|
au_class_t class;
|
|
|
|
au_event_t event;
|
|
|
|
au_id_t auid;
|
Add an experimental DTrace audit provider, which allows users of DTrace to
instrument security event auditing rather than relying on conventional BSM
trail files or audit pipes:
- Add a set of per-event 'commit' probes, which provide access to
particular auditable events at the time of commit in system-call return.
These probes gain access to audit data via the in-kernel audit_record
data structure, providing convenient access to system-call arguments and
return values in a single probe.
- Add a set of per-event 'bsm' probes, which provide access to particular
auditable events at the time of BSM record generation in the audit
worker thread. These probes have access to the in-kernel audit_record
data structure and BSM representation as would be written to a trail
file or audit pipe -- i.e., asynchronously in the audit worker thread.
DTrace probe arguments consist of the name of the audit event (to support
future mechanisms of instrumenting multiple events via a single probe --
e.g., using classes), a pointer to the in-kernel audit record, and an
optional pointer to the BSM data and its length. For human convenience,
upper-case audit event names (AUE_...) are converted to lower case in
DTrace.
DTrace scripts can now cause additional audit-based data to be collected
on system calls, and inspect internal and BSM representations of the data.
They do not affect data captured in the audit trail or audit pipes
configured in the system. auditd(8) must be configured and running in
order to provide a database of event information, as well as other audit
configuration parameters (e.g., to capture command-line arguments or
environmental variables) for the provider to operate.
Reviewed by: gnn, jonathan, markj
Sponsored by: DARPA, AFRL
MFC after: 3 weeks
Differential Revision: https://reviews.freebsd.org/D10149
2017-03-29 19:58:00 +00:00
|
|
|
int record_needed;
|
2006-02-01 20:01:18 +00:00
|
|
|
|
|
|
|
KASSERT(td->td_ar == NULL, ("audit_syscall_enter: td->td_ar != NULL"));
|
2009-03-09 10:45:58 +00:00
|
|
|
KASSERT((td->td_pflags & TDP_AUDITREC) == 0,
|
|
|
|
("audit_syscall_enter: TDP_AUDITREC set"));
|
2006-02-01 20:01:18 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* In FreeBSD, each ABI has its own system call table, and hence
|
|
|
|
* mapping of system call codes to audit events. Convert the code to
|
|
|
|
* an audit event identifier using the process system call table
|
|
|
|
* reference. In Darwin, there's only one, so we use the global
|
2006-10-02 11:32:23 +00:00
|
|
|
* symbol for the system call table. No audit record is generated
|
|
|
|
* for bad system calls, as no operation has been performed.
|
2006-02-01 20:01:18 +00:00
|
|
|
*/
|
|
|
|
if (code >= td->td_proc->p_sysent->sv_size)
|
|
|
|
return;
|
|
|
|
|
Introduce support for per-audit pipe preselection independent from the
global audit trail configuration. This allows applications consuming
audit trails to specify parameters for which audit records are of
interest, including selecting records not required by the global trail.
Allowing application interest specification without changing the global
configuration allows intrusion detection systems to run without
interfering with global auditing or each other (if multiple are
present). To implement this:
- Kernel audit records now carry a flag to indicate whether they have
been selected by the global trail or by the audit pipe subsystem,
set during record commit, so that this information is available
after BSM conversion when delivering the BSM to the trail and audit
pipes in the audit worker thread asynchronously. Preselection by
either record target will cause the record to be kept.
- Similar changes to preselection when the audit record is created
when the system call is entering: consult both the global trail and
pipes.
- au_preselect() now accepts the class in order to avoid repeatedly
looking up the mask for each preselection test.
- Define a series of ioctls that allow applications to specify whether
they want to track the global trail, or program their own
preselection parameters: they may specify their own flags and naflags
masks, similar to the global masks of the same name, as well as a set
of per-auid masks. They also set a per-pipe mode specifying whether
they track the global trail, or user their own -- the door is left
open for future additional modes. A new ioctl is defined to allow a
user process to flush the current audit pipe queue, which can be used
after reprogramming pre-selection to make sure that only records of
interest are received in future reads.
- Audit pipe data structures are extended to hold the additional fields
necessary to support preselection. By default, audit pipes track the
global trail, so "praudit /dev/auditpipe" will track the global audit
trail even though praudit doesn't program the audit pipe selection
model.
- Comment about the complexities of potentially adding partial read
support to audit pipes.
By using a set of ioctls, applications can select which records are of
interest, and toggle the preselection mode.
Obtained from: TrustedBSD Project
2006-06-05 14:48:17 +00:00
|
|
|
event = td->td_proc->p_sysent->sv_table[code].sy_auevent;
|
|
|
|
if (event == AUE_NULL)
|
2006-02-01 20:01:18 +00:00
|
|
|
return;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Check which audit mask to use; either the kernel non-attributable
|
|
|
|
* event mask or the process audit mask.
|
|
|
|
*/
|
2007-06-07 22:27:15 +00:00
|
|
|
auid = td->td_ucred->cr_audit.ai_auid;
|
Introduce support for per-audit pipe preselection independent from the
global audit trail configuration. This allows applications consuming
audit trails to specify parameters for which audit records are of
interest, including selecting records not required by the global trail.
Allowing application interest specification without changing the global
configuration allows intrusion detection systems to run without
interfering with global auditing or each other (if multiple are
present). To implement this:
- Kernel audit records now carry a flag to indicate whether they have
been selected by the global trail or by the audit pipe subsystem,
set during record commit, so that this information is available
after BSM conversion when delivering the BSM to the trail and audit
pipes in the audit worker thread asynchronously. Preselection by
either record target will cause the record to be kept.
- Similar changes to preselection when the audit record is created
when the system call is entering: consult both the global trail and
pipes.
- au_preselect() now accepts the class in order to avoid repeatedly
looking up the mask for each preselection test.
- Define a series of ioctls that allow applications to specify whether
they want to track the global trail, or program their own
preselection parameters: they may specify their own flags and naflags
masks, similar to the global masks of the same name, as well as a set
of per-auid masks. They also set a per-pipe mode specifying whether
they track the global trail, or user their own -- the door is left
open for future additional modes. A new ioctl is defined to allow a
user process to flush the current audit pipe queue, which can be used
after reprogramming pre-selection to make sure that only records of
interest are received in future reads.
- Audit pipe data structures are extended to hold the additional fields
necessary to support preselection. By default, audit pipes track the
global trail, so "praudit /dev/auditpipe" will track the global audit
trail even though praudit doesn't program the audit pipe selection
model.
- Comment about the complexities of potentially adding partial read
support to audit pipes.
By using a set of ioctls, applications can select which records are of
interest, and toggle the preselection mode.
Obtained from: TrustedBSD Project
2006-06-05 14:48:17 +00:00
|
|
|
if (auid == AU_DEFAUDITID)
|
2006-02-01 20:01:18 +00:00
|
|
|
aumask = &audit_nae_mask;
|
|
|
|
else
|
2007-06-07 22:27:15 +00:00
|
|
|
aumask = &td->td_ucred->cr_audit.ai_mask;
|
2006-03-19 17:34:00 +00:00
|
|
|
|
2006-02-01 20:01:18 +00:00
|
|
|
/*
|
Add an experimental DTrace audit provider, which allows users of DTrace to
instrument security event auditing rather than relying on conventional BSM
trail files or audit pipes:
- Add a set of per-event 'commit' probes, which provide access to
particular auditable events at the time of commit in system-call return.
These probes gain access to audit data via the in-kernel audit_record
data structure, providing convenient access to system-call arguments and
return values in a single probe.
- Add a set of per-event 'bsm' probes, which provide access to particular
auditable events at the time of BSM record generation in the audit
worker thread. These probes have access to the in-kernel audit_record
data structure and BSM representation as would be written to a trail
file or audit pipe -- i.e., asynchronously in the audit worker thread.
DTrace probe arguments consist of the name of the audit event (to support
future mechanisms of instrumenting multiple events via a single probe --
e.g., using classes), a pointer to the in-kernel audit record, and an
optional pointer to the BSM data and its length. For human convenience,
upper-case audit event names (AUE_...) are converted to lower case in
DTrace.
DTrace scripts can now cause additional audit-based data to be collected
on system calls, and inspect internal and BSM representations of the data.
They do not affect data captured in the audit trail or audit pipes
configured in the system. auditd(8) must be configured and running in
order to provide a database of event information, as well as other audit
configuration parameters (e.g., to capture command-line arguments or
environmental variables) for the provider to operate.
Reviewed by: gnn, jonathan, markj
Sponsored by: DARPA, AFRL
MFC after: 3 weeks
Differential Revision: https://reviews.freebsd.org/D10149
2017-03-29 19:58:00 +00:00
|
|
|
* Determine whether trail or pipe preselection would like an audit
|
|
|
|
* record allocated for this system call.
|
2006-02-01 20:01:18 +00:00
|
|
|
*/
|
Introduce support for per-audit pipe preselection independent from the
global audit trail configuration. This allows applications consuming
audit trails to specify parameters for which audit records are of
interest, including selecting records not required by the global trail.
Allowing application interest specification without changing the global
configuration allows intrusion detection systems to run without
interfering with global auditing or each other (if multiple are
present). To implement this:
- Kernel audit records now carry a flag to indicate whether they have
been selected by the global trail or by the audit pipe subsystem,
set during record commit, so that this information is available
after BSM conversion when delivering the BSM to the trail and audit
pipes in the audit worker thread asynchronously. Preselection by
either record target will cause the record to be kept.
- Similar changes to preselection when the audit record is created
when the system call is entering: consult both the global trail and
pipes.
- au_preselect() now accepts the class in order to avoid repeatedly
looking up the mask for each preselection test.
- Define a series of ioctls that allow applications to specify whether
they want to track the global trail, or program their own
preselection parameters: they may specify their own flags and naflags
masks, similar to the global masks of the same name, as well as a set
of per-auid masks. They also set a per-pipe mode specifying whether
they track the global trail, or user their own -- the door is left
open for future additional modes. A new ioctl is defined to allow a
user process to flush the current audit pipe queue, which can be used
after reprogramming pre-selection to make sure that only records of
interest are received in future reads.
- Audit pipe data structures are extended to hold the additional fields
necessary to support preselection. By default, audit pipes track the
global trail, so "praudit /dev/auditpipe" will track the global audit
trail even though praudit doesn't program the audit pipe selection
model.
- Comment about the complexities of potentially adding partial read
support to audit pipes.
By using a set of ioctls, applications can select which records are of
interest, and toggle the preselection mode.
Obtained from: TrustedBSD Project
2006-06-05 14:48:17 +00:00
|
|
|
class = au_event_class(event);
|
|
|
|
if (au_preselect(event, class, aumask, AU_PRS_BOTH)) {
|
2006-02-01 20:01:18 +00:00
|
|
|
/*
|
|
|
|
* If we're out of space and need to suspend unprivileged
|
|
|
|
* processes, do that here rather than trying to allocate
|
|
|
|
* another audit record.
|
|
|
|
*
|
2006-12-28 22:18:43 +00:00
|
|
|
* Note: we might wish to be able to continue here in the
|
2006-02-01 20:01:18 +00:00
|
|
|
* future, if the system recovers. That should be possible
|
|
|
|
* by means of checking the condition in a loop around
|
|
|
|
* cv_wait(). It might be desirable to reevaluate whether an
|
|
|
|
* audit record is still required for this event by
|
|
|
|
* re-calling au_preselect().
|
|
|
|
*/
|
2006-11-06 13:42:10 +00:00
|
|
|
if (audit_in_failure &&
|
|
|
|
priv_check(td, PRIV_AUDIT_FAILSTOP) != 0) {
|
2006-02-01 20:01:18 +00:00
|
|
|
cv_wait(&audit_fail_cv, &audit_mtx);
|
|
|
|
panic("audit_failing_stop: thread continued");
|
|
|
|
}
|
Add an experimental DTrace audit provider, which allows users of DTrace to
instrument security event auditing rather than relying on conventional BSM
trail files or audit pipes:
- Add a set of per-event 'commit' probes, which provide access to
particular auditable events at the time of commit in system-call return.
These probes gain access to audit data via the in-kernel audit_record
data structure, providing convenient access to system-call arguments and
return values in a single probe.
- Add a set of per-event 'bsm' probes, which provide access to particular
auditable events at the time of BSM record generation in the audit
worker thread. These probes have access to the in-kernel audit_record
data structure and BSM representation as would be written to a trail
file or audit pipe -- i.e., asynchronously in the audit worker thread.
DTrace probe arguments consist of the name of the audit event (to support
future mechanisms of instrumenting multiple events via a single probe --
e.g., using classes), a pointer to the in-kernel audit record, and an
optional pointer to the BSM data and its length. For human convenience,
upper-case audit event names (AUE_...) are converted to lower case in
DTrace.
DTrace scripts can now cause additional audit-based data to be collected
on system calls, and inspect internal and BSM representations of the data.
They do not affect data captured in the audit trail or audit pipes
configured in the system. auditd(8) must be configured and running in
order to provide a database of event information, as well as other audit
configuration parameters (e.g., to capture command-line arguments or
environmental variables) for the provider to operate.
Reviewed by: gnn, jonathan, markj
Sponsored by: DARPA, AFRL
MFC after: 3 weeks
Differential Revision: https://reviews.freebsd.org/D10149
2017-03-29 19:58:00 +00:00
|
|
|
record_needed = 1;
|
2009-03-09 10:45:58 +00:00
|
|
|
} else if (audit_pipe_preselect(auid, event, class, AU_PRS_BOTH, 0)) {
|
Add an experimental DTrace audit provider, which allows users of DTrace to
instrument security event auditing rather than relying on conventional BSM
trail files or audit pipes:
- Add a set of per-event 'commit' probes, which provide access to
particular auditable events at the time of commit in system-call return.
These probes gain access to audit data via the in-kernel audit_record
data structure, providing convenient access to system-call arguments and
return values in a single probe.
- Add a set of per-event 'bsm' probes, which provide access to particular
auditable events at the time of BSM record generation in the audit
worker thread. These probes have access to the in-kernel audit_record
data structure and BSM representation as would be written to a trail
file or audit pipe -- i.e., asynchronously in the audit worker thread.
DTrace probe arguments consist of the name of the audit event (to support
future mechanisms of instrumenting multiple events via a single probe --
e.g., using classes), a pointer to the in-kernel audit record, and an
optional pointer to the BSM data and its length. For human convenience,
upper-case audit event names (AUE_...) are converted to lower case in
DTrace.
DTrace scripts can now cause additional audit-based data to be collected
on system calls, and inspect internal and BSM representations of the data.
They do not affect data captured in the audit trail or audit pipes
configured in the system. auditd(8) must be configured and running in
order to provide a database of event information, as well as other audit
configuration parameters (e.g., to capture command-line arguments or
environmental variables) for the provider to operate.
Reviewed by: gnn, jonathan, markj
Sponsored by: DARPA, AFRL
MFC after: 3 weeks
Differential Revision: https://reviews.freebsd.org/D10149
2017-03-29 19:58:00 +00:00
|
|
|
record_needed = 1;
|
|
|
|
} else {
|
|
|
|
record_needed = 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* After audit trails and pipes have made their policy choices, DTrace
|
|
|
|
* may request that records be generated as well. This is a slightly
|
|
|
|
* complex affair, as the DTrace audit provider needs the audit
|
|
|
|
* framework to maintain some state on the audit record, which has not
|
|
|
|
* been allocated at the point where the decision has to be made.
|
|
|
|
* This hook must run even if we are not changing the decision, as
|
|
|
|
* DTrace may want to stick event state onto a record we were going to
|
|
|
|
* produce due to the trail or pipes. The event state returned by the
|
|
|
|
* DTrace provider must be safe without locks held between here and
|
|
|
|
* below -- i.e., dtaudit_state must must refer to stable memory.
|
|
|
|
*/
|
|
|
|
#ifdef KDTRACE_HOOKS
|
|
|
|
dtaudit_state = NULL;
|
|
|
|
if (dtaudit_hook_preselect != NULL) {
|
|
|
|
dtaudit_state = dtaudit_hook_preselect(auid, event, class);
|
|
|
|
if (dtaudit_state != NULL)
|
|
|
|
record_needed = 1;
|
|
|
|
}
|
|
|
|
#endif
|
|
|
|
|
|
|
|
/*
|
|
|
|
* If a record is required, allocate it and attach it to the thread
|
|
|
|
* for use throughout the system call. Also attach DTrace state if
|
|
|
|
* required.
|
|
|
|
*
|
|
|
|
* XXXRW: If we decide to reference count the evname_elem underlying
|
|
|
|
* dtaudit_state, we will need to free here if no record is allocated
|
|
|
|
* or allocatable.
|
|
|
|
*/
|
|
|
|
if (record_needed) {
|
Introduce support for per-audit pipe preselection independent from the
global audit trail configuration. This allows applications consuming
audit trails to specify parameters for which audit records are of
interest, including selecting records not required by the global trail.
Allowing application interest specification without changing the global
configuration allows intrusion detection systems to run without
interfering with global auditing or each other (if multiple are
present). To implement this:
- Kernel audit records now carry a flag to indicate whether they have
been selected by the global trail or by the audit pipe subsystem,
set during record commit, so that this information is available
after BSM conversion when delivering the BSM to the trail and audit
pipes in the audit worker thread asynchronously. Preselection by
either record target will cause the record to be kept.
- Similar changes to preselection when the audit record is created
when the system call is entering: consult both the global trail and
pipes.
- au_preselect() now accepts the class in order to avoid repeatedly
looking up the mask for each preselection test.
- Define a series of ioctls that allow applications to specify whether
they want to track the global trail, or program their own
preselection parameters: they may specify their own flags and naflags
masks, similar to the global masks of the same name, as well as a set
of per-auid masks. They also set a per-pipe mode specifying whether
they track the global trail, or user their own -- the door is left
open for future additional modes. A new ioctl is defined to allow a
user process to flush the current audit pipe queue, which can be used
after reprogramming pre-selection to make sure that only records of
interest are received in future reads.
- Audit pipe data structures are extended to hold the additional fields
necessary to support preselection. By default, audit pipes track the
global trail, so "praudit /dev/auditpipe" will track the global audit
trail even though praudit doesn't program the audit pipe selection
model.
- Comment about the complexities of potentially adding partial read
support to audit pipes.
By using a set of ioctls, applications can select which records are of
interest, and toggle the preselection mode.
Obtained from: TrustedBSD Project
2006-06-05 14:48:17 +00:00
|
|
|
td->td_ar = audit_new(event, td);
|
Add an experimental DTrace audit provider, which allows users of DTrace to
instrument security event auditing rather than relying on conventional BSM
trail files or audit pipes:
- Add a set of per-event 'commit' probes, which provide access to
particular auditable events at the time of commit in system-call return.
These probes gain access to audit data via the in-kernel audit_record
data structure, providing convenient access to system-call arguments and
return values in a single probe.
- Add a set of per-event 'bsm' probes, which provide access to particular
auditable events at the time of BSM record generation in the audit
worker thread. These probes have access to the in-kernel audit_record
data structure and BSM representation as would be written to a trail
file or audit pipe -- i.e., asynchronously in the audit worker thread.
DTrace probe arguments consist of the name of the audit event (to support
future mechanisms of instrumenting multiple events via a single probe --
e.g., using classes), a pointer to the in-kernel audit record, and an
optional pointer to the BSM data and its length. For human convenience,
upper-case audit event names (AUE_...) are converted to lower case in
DTrace.
DTrace scripts can now cause additional audit-based data to be collected
on system calls, and inspect internal and BSM representations of the data.
They do not affect data captured in the audit trail or audit pipes
configured in the system. auditd(8) must be configured and running in
order to provide a database of event information, as well as other audit
configuration parameters (e.g., to capture command-line arguments or
environmental variables) for the provider to operate.
Reviewed by: gnn, jonathan, markj
Sponsored by: DARPA, AFRL
MFC after: 3 weeks
Differential Revision: https://reviews.freebsd.org/D10149
2017-03-29 19:58:00 +00:00
|
|
|
if (td->td_ar != NULL) {
|
2009-03-09 10:45:58 +00:00
|
|
|
td->td_pflags |= TDP_AUDITREC;
|
Add an experimental DTrace audit provider, which allows users of DTrace to
instrument security event auditing rather than relying on conventional BSM
trail files or audit pipes:
- Add a set of per-event 'commit' probes, which provide access to
particular auditable events at the time of commit in system-call return.
These probes gain access to audit data via the in-kernel audit_record
data structure, providing convenient access to system-call arguments and
return values in a single probe.
- Add a set of per-event 'bsm' probes, which provide access to particular
auditable events at the time of BSM record generation in the audit
worker thread. These probes have access to the in-kernel audit_record
data structure and BSM representation as would be written to a trail
file or audit pipe -- i.e., asynchronously in the audit worker thread.
DTrace probe arguments consist of the name of the audit event (to support
future mechanisms of instrumenting multiple events via a single probe --
e.g., using classes), a pointer to the in-kernel audit record, and an
optional pointer to the BSM data and its length. For human convenience,
upper-case audit event names (AUE_...) are converted to lower case in
DTrace.
DTrace scripts can now cause additional audit-based data to be collected
on system calls, and inspect internal and BSM representations of the data.
They do not affect data captured in the audit trail or audit pipes
configured in the system. auditd(8) must be configured and running in
order to provide a database of event information, as well as other audit
configuration parameters (e.g., to capture command-line arguments or
environmental variables) for the provider to operate.
Reviewed by: gnn, jonathan, markj
Sponsored by: DARPA, AFRL
MFC after: 3 weeks
Differential Revision: https://reviews.freebsd.org/D10149
2017-03-29 19:58:00 +00:00
|
|
|
#ifdef KDTRACE_HOOKS
|
|
|
|
td->td_ar->k_dtaudit_state = dtaudit_state;
|
|
|
|
#endif
|
|
|
|
}
|
2009-03-09 10:45:58 +00:00
|
|
|
} else
|
2006-02-01 20:01:18 +00:00
|
|
|
td->td_ar = NULL;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* audit_syscall_exit() is called from the return of every system call, or in
|
|
|
|
* the event of exit1(), during the execution of exit1(). It is responsible
|
|
|
|
* for committing the audit record, if any, along with return condition.
|
|
|
|
*/
|
|
|
|
void
|
|
|
|
audit_syscall_exit(int error, struct thread *td)
|
|
|
|
{
|
|
|
|
int retval;
|
|
|
|
|
|
|
|
/*
|
2007-06-01 21:58:59 +00:00
|
|
|
* Commit the audit record as desired; once we pass the record into
|
|
|
|
* audit_commit(), the memory is owned by the audit subsystem. The
|
|
|
|
* return value from the system call is stored on the user thread.
|
|
|
|
* If there was an error, the return value is set to -1, imitating
|
|
|
|
* the behavior of the cerror routine.
|
2006-02-01 20:01:18 +00:00
|
|
|
*/
|
|
|
|
if (error)
|
|
|
|
retval = -1;
|
|
|
|
else
|
|
|
|
retval = td->td_retval[0];
|
|
|
|
|
|
|
|
audit_commit(td->td_ar, error, retval);
|
|
|
|
td->td_ar = NULL;
|
2009-03-09 10:45:58 +00:00
|
|
|
td->td_pflags &= ~TDP_AUDITREC;
|
2006-02-01 20:01:18 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
void
|
2007-06-07 22:27:15 +00:00
|
|
|
audit_cred_copy(struct ucred *src, struct ucred *dest)
|
2006-02-01 20:01:18 +00:00
|
|
|
{
|
|
|
|
|
2007-06-07 22:27:15 +00:00
|
|
|
bcopy(&src->cr_audit, &dest->cr_audit, sizeof(dest->cr_audit));
|
2006-02-01 20:01:18 +00:00
|
|
|
}
|
|
|
|
|
2006-02-02 00:37:05 +00:00
|
|
|
void
|
2007-06-07 22:27:15 +00:00
|
|
|
audit_cred_destroy(struct ucred *cred)
|
2006-02-02 00:37:05 +00:00
|
|
|
{
|
|
|
|
|
|
|
|
}
|
|
|
|
|
2006-02-05 21:06:09 +00:00
|
|
|
void
|
2007-06-07 22:27:15 +00:00
|
|
|
audit_cred_init(struct ucred *cred)
|
2006-02-05 21:06:09 +00:00
|
|
|
{
|
|
|
|
|
2007-06-07 22:27:15 +00:00
|
|
|
bzero(&cred->cr_audit, sizeof(cred->cr_audit));
|
2006-02-05 21:06:09 +00:00
|
|
|
}
|
|
|
|
|
2006-03-19 17:34:00 +00:00
|
|
|
/*
|
2006-10-02 11:32:23 +00:00
|
|
|
* Initialize audit information for the first kernel process (proc 0) and for
|
|
|
|
* the first user process (init).
|
2006-02-01 20:01:18 +00:00
|
|
|
*/
|
|
|
|
void
|
2007-06-07 22:27:15 +00:00
|
|
|
audit_cred_kproc0(struct ucred *cred)
|
2006-02-01 20:01:18 +00:00
|
|
|
{
|
|
|
|
|
2007-06-11 22:10:54 +00:00
|
|
|
cred->cr_audit.ai_auid = AU_DEFAUDITID;
|
2008-01-28 17:33:46 +00:00
|
|
|
cred->cr_audit.ai_termid.at_type = AU_IPv4;
|
2006-02-01 20:01:18 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
void
|
2007-06-07 22:27:15 +00:00
|
|
|
audit_cred_proc1(struct ucred *cred)
|
2006-02-01 20:01:18 +00:00
|
|
|
{
|
|
|
|
|
2007-06-07 22:27:15 +00:00
|
|
|
cred->cr_audit.ai_auid = AU_DEFAUDITID;
|
2008-01-28 17:33:46 +00:00
|
|
|
cred->cr_audit.ai_termid.at_type = AU_IPv4;
|
2006-02-01 20:01:18 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
void
|
2007-06-07 22:27:15 +00:00
|
|
|
audit_thread_alloc(struct thread *td)
|
2006-02-01 20:01:18 +00:00
|
|
|
{
|
|
|
|
|
2007-06-07 22:27:15 +00:00
|
|
|
td->td_ar = NULL;
|
2006-02-01 20:01:18 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
void
|
2007-06-07 22:27:15 +00:00
|
|
|
audit_thread_free(struct thread *td)
|
2006-02-01 20:01:18 +00:00
|
|
|
{
|
|
|
|
|
2007-06-07 22:27:15 +00:00
|
|
|
KASSERT(td->td_ar == NULL, ("audit_thread_free: td_ar != NULL"));
|
2009-03-09 10:45:58 +00:00
|
|
|
KASSERT((td->td_pflags & TDP_AUDITREC) == 0,
|
|
|
|
("audit_thread_free: TDP_AUDITREC set"));
|
2006-02-01 20:01:18 +00:00
|
|
|
}
|
Implement AUE_CORE, which adds process core dump support into the kernel.
This change introduces audit_proc_coredump() which is called by coredump(9)
to create an audit record for the coredump event. When a process
dumps a core, it could be security relevant. It could be an indicator that
a stack within the process has been overflowed with an incorrectly constructed
malicious payload or a number of other events.
The record that is generated looks like this:
header,111,10,process dumped core,0,Thu Oct 25 19:36:29 2007, + 179 msec
argument,0,0xb,signal
path,/usr/home/csjp/test.core
subject,csjp,csjp,staff,csjp,staff,1101,1095,50457,10.37.129.2
return,success,1
trailer,111
- We allocate a completely new record to make sure we arent clobbering
the audit data associated with the syscall that produced the core
(assuming the core is being generated in response to SIGABRT and not
an invalid memory access).
- Shuffle around expand_name() so we can use the coredump name at the very
beginning of the coredump call. Make sure we free the storage referenced
by "name" if we need to bail out early.
- Audit both successful and failed coredump creation efforts
Obtained from: TrustedBSD Project
Reviewed by: rwatson
MFC after: 1 month
2007-10-26 01:23:07 +00:00
|
|
|
|
|
|
|
void
|
|
|
|
audit_proc_coredump(struct thread *td, char *path, int errcode)
|
|
|
|
{
|
|
|
|
struct kaudit_record *ar;
|
|
|
|
struct au_mask *aumask;
|
2008-11-14 01:24:52 +00:00
|
|
|
struct ucred *cred;
|
Implement AUE_CORE, which adds process core dump support into the kernel.
This change introduces audit_proc_coredump() which is called by coredump(9)
to create an audit record for the coredump event. When a process
dumps a core, it could be security relevant. It could be an indicator that
a stack within the process has been overflowed with an incorrectly constructed
malicious payload or a number of other events.
The record that is generated looks like this:
header,111,10,process dumped core,0,Thu Oct 25 19:36:29 2007, + 179 msec
argument,0,0xb,signal
path,/usr/home/csjp/test.core
subject,csjp,csjp,staff,csjp,staff,1101,1095,50457,10.37.129.2
return,success,1
trailer,111
- We allocate a completely new record to make sure we arent clobbering
the audit data associated with the syscall that produced the core
(assuming the core is being generated in response to SIGABRT and not
an invalid memory access).
- Shuffle around expand_name() so we can use the coredump name at the very
beginning of the coredump call. Make sure we free the storage referenced
by "name" if we need to bail out early.
- Audit both successful and failed coredump creation efforts
Obtained from: TrustedBSD Project
Reviewed by: rwatson
MFC after: 1 month
2007-10-26 01:23:07 +00:00
|
|
|
au_class_t class;
|
|
|
|
int ret, sorf;
|
|
|
|
char **pathp;
|
|
|
|
au_id_t auid;
|
|
|
|
|
2007-12-04 20:20:59 +00:00
|
|
|
ret = 0;
|
|
|
|
|
Implement AUE_CORE, which adds process core dump support into the kernel.
This change introduces audit_proc_coredump() which is called by coredump(9)
to create an audit record for the coredump event. When a process
dumps a core, it could be security relevant. It could be an indicator that
a stack within the process has been overflowed with an incorrectly constructed
malicious payload or a number of other events.
The record that is generated looks like this:
header,111,10,process dumped core,0,Thu Oct 25 19:36:29 2007, + 179 msec
argument,0,0xb,signal
path,/usr/home/csjp/test.core
subject,csjp,csjp,staff,csjp,staff,1101,1095,50457,10.37.129.2
return,success,1
trailer,111
- We allocate a completely new record to make sure we arent clobbering
the audit data associated with the syscall that produced the core
(assuming the core is being generated in response to SIGABRT and not
an invalid memory access).
- Shuffle around expand_name() so we can use the coredump name at the very
beginning of the coredump call. Make sure we free the storage referenced
by "name" if we need to bail out early.
- Audit both successful and failed coredump creation efforts
Obtained from: TrustedBSD Project
Reviewed by: rwatson
MFC after: 1 month
2007-10-26 01:23:07 +00:00
|
|
|
/*
|
|
|
|
* Make sure we are using the correct preselection mask.
|
|
|
|
*/
|
2008-11-14 01:24:52 +00:00
|
|
|
cred = td->td_ucred;
|
|
|
|
auid = cred->cr_audit.ai_auid;
|
Implement AUE_CORE, which adds process core dump support into the kernel.
This change introduces audit_proc_coredump() which is called by coredump(9)
to create an audit record for the coredump event. When a process
dumps a core, it could be security relevant. It could be an indicator that
a stack within the process has been overflowed with an incorrectly constructed
malicious payload or a number of other events.
The record that is generated looks like this:
header,111,10,process dumped core,0,Thu Oct 25 19:36:29 2007, + 179 msec
argument,0,0xb,signal
path,/usr/home/csjp/test.core
subject,csjp,csjp,staff,csjp,staff,1101,1095,50457,10.37.129.2
return,success,1
trailer,111
- We allocate a completely new record to make sure we arent clobbering
the audit data associated with the syscall that produced the core
(assuming the core is being generated in response to SIGABRT and not
an invalid memory access).
- Shuffle around expand_name() so we can use the coredump name at the very
beginning of the coredump call. Make sure we free the storage referenced
by "name" if we need to bail out early.
- Audit both successful and failed coredump creation efforts
Obtained from: TrustedBSD Project
Reviewed by: rwatson
MFC after: 1 month
2007-10-26 01:23:07 +00:00
|
|
|
if (auid == AU_DEFAUDITID)
|
|
|
|
aumask = &audit_nae_mask;
|
|
|
|
else
|
2008-11-14 01:24:52 +00:00
|
|
|
aumask = &cred->cr_audit.ai_mask;
|
Implement AUE_CORE, which adds process core dump support into the kernel.
This change introduces audit_proc_coredump() which is called by coredump(9)
to create an audit record for the coredump event. When a process
dumps a core, it could be security relevant. It could be an indicator that
a stack within the process has been overflowed with an incorrectly constructed
malicious payload or a number of other events.
The record that is generated looks like this:
header,111,10,process dumped core,0,Thu Oct 25 19:36:29 2007, + 179 msec
argument,0,0xb,signal
path,/usr/home/csjp/test.core
subject,csjp,csjp,staff,csjp,staff,1101,1095,50457,10.37.129.2
return,success,1
trailer,111
- We allocate a completely new record to make sure we arent clobbering
the audit data associated with the syscall that produced the core
(assuming the core is being generated in response to SIGABRT and not
an invalid memory access).
- Shuffle around expand_name() so we can use the coredump name at the very
beginning of the coredump call. Make sure we free the storage referenced
by "name" if we need to bail out early.
- Audit both successful and failed coredump creation efforts
Obtained from: TrustedBSD Project
Reviewed by: rwatson
MFC after: 1 month
2007-10-26 01:23:07 +00:00
|
|
|
/*
|
|
|
|
* It's possible for coredump(9) generation to fail. Make sure that
|
|
|
|
* we handle this case correctly for preselection.
|
|
|
|
*/
|
|
|
|
if (errcode != 0)
|
|
|
|
sorf = AU_PRS_FAILURE;
|
|
|
|
else
|
|
|
|
sorf = AU_PRS_SUCCESS;
|
|
|
|
class = au_event_class(AUE_CORE);
|
2008-08-11 20:14:56 +00:00
|
|
|
if (au_preselect(AUE_CORE, class, aumask, sorf) == 0 &&
|
|
|
|
audit_pipe_preselect(auid, AUE_CORE, class, sorf, 0) == 0)
|
Implement AUE_CORE, which adds process core dump support into the kernel.
This change introduces audit_proc_coredump() which is called by coredump(9)
to create an audit record for the coredump event. When a process
dumps a core, it could be security relevant. It could be an indicator that
a stack within the process has been overflowed with an incorrectly constructed
malicious payload or a number of other events.
The record that is generated looks like this:
header,111,10,process dumped core,0,Thu Oct 25 19:36:29 2007, + 179 msec
argument,0,0xb,signal
path,/usr/home/csjp/test.core
subject,csjp,csjp,staff,csjp,staff,1101,1095,50457,10.37.129.2
return,success,1
trailer,111
- We allocate a completely new record to make sure we arent clobbering
the audit data associated with the syscall that produced the core
(assuming the core is being generated in response to SIGABRT and not
an invalid memory access).
- Shuffle around expand_name() so we can use the coredump name at the very
beginning of the coredump call. Make sure we free the storage referenced
by "name" if we need to bail out early.
- Audit both successful and failed coredump creation efforts
Obtained from: TrustedBSD Project
Reviewed by: rwatson
MFC after: 1 month
2007-10-26 01:23:07 +00:00
|
|
|
return;
|
2008-11-14 01:24:52 +00:00
|
|
|
|
Implement AUE_CORE, which adds process core dump support into the kernel.
This change introduces audit_proc_coredump() which is called by coredump(9)
to create an audit record for the coredump event. When a process
dumps a core, it could be security relevant. It could be an indicator that
a stack within the process has been overflowed with an incorrectly constructed
malicious payload or a number of other events.
The record that is generated looks like this:
header,111,10,process dumped core,0,Thu Oct 25 19:36:29 2007, + 179 msec
argument,0,0xb,signal
path,/usr/home/csjp/test.core
subject,csjp,csjp,staff,csjp,staff,1101,1095,50457,10.37.129.2
return,success,1
trailer,111
- We allocate a completely new record to make sure we arent clobbering
the audit data associated with the syscall that produced the core
(assuming the core is being generated in response to SIGABRT and not
an invalid memory access).
- Shuffle around expand_name() so we can use the coredump name at the very
beginning of the coredump call. Make sure we free the storage referenced
by "name" if we need to bail out early.
- Audit both successful and failed coredump creation efforts
Obtained from: TrustedBSD Project
Reviewed by: rwatson
MFC after: 1 month
2007-10-26 01:23:07 +00:00
|
|
|
/*
|
|
|
|
* If we are interested in seeing this audit record, allocate it.
|
|
|
|
* Where possible coredump records should contain a pathname and arg32
|
|
|
|
* (signal) tokens.
|
|
|
|
*/
|
|
|
|
ar = audit_new(AUE_CORE, td);
|
2013-07-09 09:03:01 +00:00
|
|
|
if (ar == NULL)
|
|
|
|
return;
|
Implement AUE_CORE, which adds process core dump support into the kernel.
This change introduces audit_proc_coredump() which is called by coredump(9)
to create an audit record for the coredump event. When a process
dumps a core, it could be security relevant. It could be an indicator that
a stack within the process has been overflowed with an incorrectly constructed
malicious payload or a number of other events.
The record that is generated looks like this:
header,111,10,process dumped core,0,Thu Oct 25 19:36:29 2007, + 179 msec
argument,0,0xb,signal
path,/usr/home/csjp/test.core
subject,csjp,csjp,staff,csjp,staff,1101,1095,50457,10.37.129.2
return,success,1
trailer,111
- We allocate a completely new record to make sure we arent clobbering
the audit data associated with the syscall that produced the core
(assuming the core is being generated in response to SIGABRT and not
an invalid memory access).
- Shuffle around expand_name() so we can use the coredump name at the very
beginning of the coredump call. Make sure we free the storage referenced
by "name" if we need to bail out early.
- Audit both successful and failed coredump creation efforts
Obtained from: TrustedBSD Project
Reviewed by: rwatson
MFC after: 1 month
2007-10-26 01:23:07 +00:00
|
|
|
if (path != NULL) {
|
|
|
|
pathp = &ar->k_ar.ar_arg_upath1;
|
|
|
|
*pathp = malloc(MAXPATHLEN, M_AUDITPATH, M_WAITOK);
|
2012-11-30 23:18:49 +00:00
|
|
|
audit_canon_path(td, AT_FDCWD, path, *pathp);
|
Implement AUE_CORE, which adds process core dump support into the kernel.
This change introduces audit_proc_coredump() which is called by coredump(9)
to create an audit record for the coredump event. When a process
dumps a core, it could be security relevant. It could be an indicator that
a stack within the process has been overflowed with an incorrectly constructed
malicious payload or a number of other events.
The record that is generated looks like this:
header,111,10,process dumped core,0,Thu Oct 25 19:36:29 2007, + 179 msec
argument,0,0xb,signal
path,/usr/home/csjp/test.core
subject,csjp,csjp,staff,csjp,staff,1101,1095,50457,10.37.129.2
return,success,1
trailer,111
- We allocate a completely new record to make sure we arent clobbering
the audit data associated with the syscall that produced the core
(assuming the core is being generated in response to SIGABRT and not
an invalid memory access).
- Shuffle around expand_name() so we can use the coredump name at the very
beginning of the coredump call. Make sure we free the storage referenced
by "name" if we need to bail out early.
- Audit both successful and failed coredump creation efforts
Obtained from: TrustedBSD Project
Reviewed by: rwatson
MFC after: 1 month
2007-10-26 01:23:07 +00:00
|
|
|
ARG_SET_VALID(ar, ARG_UPATH1);
|
|
|
|
}
|
|
|
|
ar->k_ar.ar_arg_signum = td->td_proc->p_sig;
|
|
|
|
ARG_SET_VALID(ar, ARG_SIGNUM);
|
|
|
|
if (errcode != 0)
|
|
|
|
ret = 1;
|
|
|
|
audit_commit(ar, errcode, ret);
|
|
|
|
}
|