securityd/src/auditevents.cpp

   1 /*
   2  * Copyright (c) 2009-2010 Apple Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23
  24
  25 //
  26 // auditevents - monitor and act upon audit subsystem events
  27 //
  28 #include "auditevents.h"
  29 #include "dtrace.h"
  30 #include <security_utilities/logging.h>
  31 #include "self.h"
  32
  33 using namespace UnixPlusPlus;
  34 using namespace MachPlusPlus;
  35
  36
  37 AuditMonitor::AuditMonitor(Port relay)
  38         : mRelay(relay)
  39 {
  40 }
  41
  42 AuditMonitor::~AuditMonitor()
  43 {
  44 }
  45
  46
  47 //
  48 // Endlessly retrieve session events and dispatch them.
  49 // (The current version of MachServer cannot receive FileDesc-based events,
  50 // so we need a monitor thread for this.)
  51 //
  52 void AuditMonitor::action()
  53 {
  54         au_sdev_handle_t *dev = au_sdev_open(AU_SDEVF_ALLSESSIONS);
  55         int event;
  56         auditinfo_addr_t aia;
  57
  58         if (NULL == dev) {
  59                 Syslog::error("This is bad, man. I've got bad vibes here. Could not open %s: %d", AUDIT_SDEV_PATH, errno);
  60                 return;
  61         }
  62
  63         for (;;) {
  64                 if (0 != au_sdev_read_aia(dev, &event, &aia)) {
  65                         Syslog::error("au_sdev_read_aia failed: %d\n", errno);
  66                         continue;
  67                 }
  68         secinfo("SS", "%p session notify %d %d %d", this, aia.ai_asid, event, aia.ai_auid);
  69                 if (kern_return_t rc = self_client_handleSession(mRelay, mach_task_self(), event, aia.ai_asid))
  70                         Syslog::error("self-send failed (mach error %d)", rc);
  71         }
  72 }