Eliminate ARG_UPATH[12] arguments to AUDIT_ARG_UPATH() and instead
provide specific macros, AUDIT_ARG_UPATH1() and AUDIT_ARG_UPATH2() to capture path information for audit records. This allows us to move the definitions of ARG_* out of the public audit header file, as they are an implementation detail of our current kernel-internal audit record, which may change. Approved by: re (kensmith) Obtained from: TrustedBSD Project MFC after: 1 month
This commit is contained in:
rwatson
parent
2ef0bbd3c7
commit
6b019307f4
@ -164,9 +164,9 @@ namei(struct nameidata *ndp)
|
||||
|
||||
/* If we are auditing the kernel pathname, save the user pathname. */
|
||||
if (cnp->cn_flags & AUDITVNODE1)
|
||||
AUDIT_ARG_UPATH(td, cnp->cn_pnbuf, ARG_UPATH1);
|
||||
AUDIT_ARG_UPATH1(td, cnp->cn_pnbuf);
|
||||
if (cnp->cn_flags & AUDITVNODE2)
|
||||
AUDIT_ARG_UPATH(td, cnp->cn_pnbuf, ARG_UPATH2);
|
||||
AUDIT_ARG_UPATH2(td, cnp->cn_pnbuf);
|
||||
|
||||
/*
|
||||
* Don't allow empty pathnames.
|
||||
|
||||
@ -1144,7 +1144,7 @@ unmount(td, uap)
|
||||
}
|
||||
mtx_unlock(&mountlist_mtx);
|
||||
} else {
|
||||
AUDIT_ARG_UPATH(td, pathbuf, ARG_UPATH1);
|
||||
AUDIT_ARG_UPATH1(td, pathbuf);
|
||||
mtx_lock(&mountlist_mtx);
|
||||
TAILQ_FOREACH_REVERSE(mp, &mountlist, mntlist, mnt_list) {
|
||||
if (strcmp(mp->mnt_stat.f_mntonname, pathbuf) == 0)
|
||||
|
||||
@ -56,69 +56,6 @@
|
||||
extern int audit_enabled;
|
||||
extern int audit_suspended;
|
||||
|
||||
/*
|
||||
* Define the masks for the audited arguments.
|
||||
*
|
||||
* XXXRW: These need to remain in audit.h for now because our vnode and name
|
||||
* lookup audit calls rely on passing in flags to indicate which name or
|
||||
* vnode is being logged. These should move to audit_private.h when that is
|
||||
* fixed.
|
||||
*/
|
||||
#define ARG_EUID 0x0000000000000001ULL
|
||||
#define ARG_RUID 0x0000000000000002ULL
|
||||
#define ARG_SUID 0x0000000000000004ULL
|
||||
#define ARG_EGID 0x0000000000000008ULL
|
||||
#define ARG_RGID 0x0000000000000010ULL
|
||||
#define ARG_SGID 0x0000000000000020ULL
|
||||
#define ARG_PID 0x0000000000000040ULL
|
||||
#define ARG_UID 0x0000000000000080ULL
|
||||
#define ARG_AUID 0x0000000000000100ULL
|
||||
#define ARG_GID 0x0000000000000200ULL
|
||||
#define ARG_FD 0x0000000000000400ULL
|
||||
#define ARG_POSIX_IPC_PERM 0x0000000000000800ULL
|
||||
#define ARG_FFLAGS 0x0000000000001000ULL
|
||||
#define ARG_MODE 0x0000000000002000ULL
|
||||
#define ARG_DEV 0x0000000000004000ULL
|
||||
#define ARG_ADDR 0x0000000000008000ULL
|
||||
#define ARG_LEN 0x0000000000010000ULL
|
||||
#define ARG_MASK 0x0000000000020000ULL
|
||||
#define ARG_SIGNUM 0x0000000000040000ULL
|
||||
#define ARG_LOGIN 0x0000000000080000ULL
|
||||
#define ARG_SADDRINET 0x0000000000100000ULL
|
||||
#define ARG_SADDRINET6 0x0000000000200000ULL
|
||||
#define ARG_SADDRUNIX 0x0000000000400000ULL
|
||||
#define ARG_TERMID_ADDR 0x0000000000400000ULL
|
||||
#define ARG_UNUSED2 0x0000000001000000ULL
|
||||
#define ARG_UPATH1 0x0000000002000000ULL
|
||||
#define ARG_UPATH2 0x0000000004000000ULL
|
||||
#define ARG_TEXT 0x0000000008000000ULL
|
||||
#define ARG_VNODE1 0x0000000010000000ULL
|
||||
#define ARG_VNODE2 0x0000000020000000ULL
|
||||
#define ARG_SVIPC_CMD 0x0000000040000000ULL
|
||||
#define ARG_SVIPC_PERM 0x0000000080000000ULL
|
||||
#define ARG_SVIPC_ID 0x0000000100000000ULL
|
||||
#define ARG_SVIPC_ADDR 0x0000000200000000ULL
|
||||
#define ARG_GROUPSET 0x0000000400000000ULL
|
||||
#define ARG_CMD 0x0000000800000000ULL
|
||||
#define ARG_SOCKINFO 0x0000001000000000ULL
|
||||
#define ARG_ASID 0x0000002000000000ULL
|
||||
#define ARG_TERMID 0x0000004000000000ULL
|
||||
#define ARG_AUDITON 0x0000008000000000ULL
|
||||
#define ARG_VALUE 0x0000010000000000ULL
|
||||
#define ARG_AMASK 0x0000020000000000ULL
|
||||
#define ARG_CTLNAME 0x0000040000000000ULL
|
||||
#define ARG_PROCESS 0x0000080000000000ULL
|
||||
#define ARG_MACHPORT1 0x0000100000000000ULL
|
||||
#define ARG_MACHPORT2 0x0000200000000000ULL
|
||||
#define ARG_EXIT 0x0000400000000000ULL
|
||||
#define ARG_IOVECSTR 0x0000800000000000ULL
|
||||
#define ARG_ARGV 0x0001000000000000ULL
|
||||
#define ARG_ENVV 0x0002000000000000ULL
|
||||
#define ARG_ATFD1 0x0004000000000000ULL
|
||||
#define ARG_ATFD2 0x0008000000000000ULL
|
||||
#define ARG_NONE 0x0000000000000000ULL
|
||||
#define ARG_ALL 0xFFFFFFFFFFFFFFFFULL
|
||||
|
||||
void audit_syscall_enter(unsigned short code, struct thread *td);
|
||||
void audit_syscall_exit(int error, struct thread *td);
|
||||
|
||||
@ -162,7 +99,8 @@ void audit_arg_sockaddr(struct thread *td, struct sockaddr *sa);
|
||||
void audit_arg_auid(uid_t auid);
|
||||
void audit_arg_auditinfo(struct auditinfo *au_info);
|
||||
void audit_arg_auditinfo_addr(struct auditinfo_addr *au_info);
|
||||
void audit_arg_upath(struct thread *td, char *upath, u_int64_t flags);
|
||||
void audit_arg_upath1(struct thread *td, char *upath);
|
||||
void audit_arg_upath2(struct thread *td, char *upath);
|
||||
void audit_arg_vnode1(struct vnode *vp);
|
||||
void audit_arg_vnode2(struct vnode *vp);
|
||||
void audit_arg_text(char *text);
|
||||
@ -332,9 +270,14 @@ void audit_thread_free(struct thread *td);
|
||||
audit_arg_uid((uid)); \
|
||||
} while (0)
|
||||
|
||||
#define AUDIT_ARG_UPATH(td, upath, flags) do { \
|
||||
#define AUDIT_ARG_UPATH1(td, upath) do { \
|
||||
if (AUDITING_TD(curthread)) \
|
||||
audit_arg_upath((td), (upath), (flags)); \
|
||||
audit_arg_upath1((td), (upath)); \
|
||||
} while (0)
|
||||
|
||||
#define AUDIT_ARG_UPATH2(td, upath) do { \
|
||||
if (AUDITING_TD(curthread)) \
|
||||
audit_arg_upath2((td), (upath)); \
|
||||
} while (0)
|
||||
|
||||
#define AUDIT_ARG_VALUE(value) do { \
|
||||
@ -406,7 +349,8 @@ void audit_thread_free(struct thread *td);
|
||||
#define AUDIT_ARG_SUID(suid)
|
||||
#define AUDIT_ARG_TEXT(text)
|
||||
#define AUDIT_ARG_UID(uid)
|
||||
#define AUDIT_ARG_UPATH(td, upath, flags)
|
||||
#define AUDIT_ARG_UPATH1(td, upath)
|
||||
#define AUDIT_ARG_UPATH2(td, upath)
|
||||
#define AUDIT_ARG_VALUE(value)
|
||||
#define AUDIT_ARG_VNODE1(vp)
|
||||
#define AUDIT_ARG_VNODE2(vp)
|
||||
|
||||
@ -463,8 +463,7 @@ audit_arg_sockaddr(struct thread *td, struct sockaddr *sa)
|
||||
break;
|
||||
|
||||
case AF_UNIX:
|
||||
audit_arg_upath(td, ((struct sockaddr_un *)sa)->sun_path,
|
||||
ARG_UPATH1);
|
||||
audit_arg_upath1(td, ((struct sockaddr_un *)sa)->sun_path);
|
||||
ARG_SET_VALID(ar, ARG_SADDRUNIX);
|
||||
break;
|
||||
/* XXXAUDIT: default:? */
|
||||
@ -709,38 +708,40 @@ audit_arg_file(struct proc *p, struct file *fp)
|
||||
* record stored on the user thread. This function will allocate the memory
|
||||
* to store the path info if not already available. This memory will be
|
||||
* freed when the audit record is freed.
|
||||
*
|
||||
* XXXAUDIT: Possibly assert that the memory isn't already allocated?
|
||||
*/
|
||||
static void
|
||||
audit_arg_upath(struct thread *td, char *upath, char **pathp)
|
||||
{
|
||||
|
||||
if (*pathp == NULL)
|
||||
*pathp = malloc(MAXPATHLEN, M_AUDITPATH, M_WAITOK);
|
||||
audit_canon_path(td, upath, *pathp);
|
||||
}
|
||||
|
||||
void
|
||||
audit_arg_upath(struct thread *td, char *upath, u_int64_t flag)
|
||||
audit_arg_upath1(struct thread *td, char *upath)
|
||||
{
|
||||
struct kaudit_record *ar;
|
||||
char **pathp;
|
||||
|
||||
KASSERT(td != NULL, ("audit_arg_upath: td == NULL"));
|
||||
KASSERT(upath != NULL, ("audit_arg_upath: upath == NULL"));
|
||||
|
||||
ar = currecord();
|
||||
if (ar == NULL)
|
||||
return;
|
||||
|
||||
KASSERT((flag == ARG_UPATH1) || (flag == ARG_UPATH2),
|
||||
("audit_arg_upath: flag %llu", (unsigned long long)flag));
|
||||
KASSERT((flag != ARG_UPATH1) || (flag != ARG_UPATH2),
|
||||
("audit_arg_upath: flag %llu", (unsigned long long)flag));
|
||||
audit_arg_upath(td, upath, &ar->k_ar.ar_arg_upath1);
|
||||
ARG_SET_VALID(ar, ARG_UPATH1);
|
||||
}
|
||||
|
||||
if (flag == ARG_UPATH1)
|
||||
pathp = &ar->k_ar.ar_arg_upath1;
|
||||
else
|
||||
pathp = &ar->k_ar.ar_arg_upath2;
|
||||
void
|
||||
audit_arg_upath2(struct thread *td, char *upath)
|
||||
{
|
||||
struct kaudit_record *ar;
|
||||
|
||||
if (*pathp == NULL)
|
||||
*pathp = malloc(MAXPATHLEN, M_AUDITPATH, M_WAITOK);
|
||||
ar = currecord();
|
||||
if (ar == NULL)
|
||||
return;
|
||||
|
||||
audit_canon_path(td, upath, *pathp);
|
||||
|
||||
ARG_SET_VALID(ar, flag);
|
||||
audit_arg_upath(td, upath, &ar->k_ar.ar_arg_upath2);
|
||||
ARG_SET_VALID(ar, ARG_UPATH2);
|
||||
}
|
||||
|
||||
/*
|
||||
|
||||
@ -236,6 +236,61 @@ struct audit_record {
|
||||
* indicate if they are present so they can be included in the audit log
|
||||
* stream only if defined.
|
||||
*/
|
||||
#define ARG_EUID 0x0000000000000001ULL
|
||||
#define ARG_RUID 0x0000000000000002ULL
|
||||
#define ARG_SUID 0x0000000000000004ULL
|
||||
#define ARG_EGID 0x0000000000000008ULL
|
||||
#define ARG_RGID 0x0000000000000010ULL
|
||||
#define ARG_SGID 0x0000000000000020ULL
|
||||
#define ARG_PID 0x0000000000000040ULL
|
||||
#define ARG_UID 0x0000000000000080ULL
|
||||
#define ARG_AUID 0x0000000000000100ULL
|
||||
#define ARG_GID 0x0000000000000200ULL
|
||||
#define ARG_FD 0x0000000000000400ULL
|
||||
#define ARG_POSIX_IPC_PERM 0x0000000000000800ULL
|
||||
#define ARG_FFLAGS 0x0000000000001000ULL
|
||||
#define ARG_MODE 0x0000000000002000ULL
|
||||
#define ARG_DEV 0x0000000000004000ULL
|
||||
#define ARG_ADDR 0x0000000000008000ULL
|
||||
#define ARG_LEN 0x0000000000010000ULL
|
||||
#define ARG_MASK 0x0000000000020000ULL
|
||||
#define ARG_SIGNUM 0x0000000000040000ULL
|
||||
#define ARG_LOGIN 0x0000000000080000ULL
|
||||
#define ARG_SADDRINET 0x0000000000100000ULL
|
||||
#define ARG_SADDRINET6 0x0000000000200000ULL
|
||||
#define ARG_SADDRUNIX 0x0000000000400000ULL
|
||||
#define ARG_TERMID_ADDR 0x0000000000400000ULL
|
||||
#define ARG_UNUSED2 0x0000000001000000ULL
|
||||
#define ARG_UPATH1 0x0000000002000000ULL
|
||||
#define ARG_UPATH2 0x0000000004000000ULL
|
||||
#define ARG_TEXT 0x0000000008000000ULL
|
||||
#define ARG_VNODE1 0x0000000010000000ULL
|
||||
#define ARG_VNODE2 0x0000000020000000ULL
|
||||
#define ARG_SVIPC_CMD 0x0000000040000000ULL
|
||||
#define ARG_SVIPC_PERM 0x0000000080000000ULL
|
||||
#define ARG_SVIPC_ID 0x0000000100000000ULL
|
||||
#define ARG_SVIPC_ADDR 0x0000000200000000ULL
|
||||
#define ARG_GROUPSET 0x0000000400000000ULL
|
||||
#define ARG_CMD 0x0000000800000000ULL
|
||||
#define ARG_SOCKINFO 0x0000001000000000ULL
|
||||
#define ARG_ASID 0x0000002000000000ULL
|
||||
#define ARG_TERMID 0x0000004000000000ULL
|
||||
#define ARG_AUDITON 0x0000008000000000ULL
|
||||
#define ARG_VALUE 0x0000010000000000ULL
|
||||
#define ARG_AMASK 0x0000020000000000ULL
|
||||
#define ARG_CTLNAME 0x0000040000000000ULL
|
||||
#define ARG_PROCESS 0x0000080000000000ULL
|
||||
#define ARG_MACHPORT1 0x0000100000000000ULL
|
||||
#define ARG_MACHPORT2 0x0000200000000000ULL
|
||||
#define ARG_EXIT 0x0000400000000000ULL
|
||||
#define ARG_IOVECSTR 0x0000800000000000ULL
|
||||
#define ARG_ARGV 0x0001000000000000ULL
|
||||
#define ARG_ENVV 0x0002000000000000ULL
|
||||
#define ARG_ATFD1 0x0004000000000000ULL
|
||||
#define ARG_ATFD2 0x0008000000000000ULL
|
||||
#define ARG_NONE 0x0000000000000000ULL
|
||||
#define ARG_ALL 0xFFFFFFFFFFFFFFFFULL
|
||||
|
||||
#define ARG_IS_VALID(kar, arg) ((kar)->k_ar.ar_valid_arg & (arg))
|
||||
#define ARG_SET_VALID(kar, arg) do { \
|
||||
(kar)->k_ar.ar_valid_arg |= (arg); \
|
||||
|
||||
Loading…
Reference in New Issue
Block a user