[apple/xnu.git] / bsd / security / audit / audit_bsd.c

/*-
 * Copyright (c) 2008-2010 Apple Inc.
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 *
 * 1.  Redistributions of source code must retain the above copyright
 *     notice, this list of conditions and the following disclaimer.
 * 2.  Redistributions in binary form must reproduce the above copyright
 *     notice, this list of conditions and the following disclaimer in the
 *     documentation and/or other materials provided with the distribution.
 * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
 *     its contributors may be used to endorse or promote products derived
 *     from this software without specific prior written permission.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
 * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
 * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
 * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
 * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 */

#include <string.h>

#include <sys/kernel.h>
#include <sys/proc.h>
#include <sys/systm.h>

#include <kern/host.h>
#include <kern/kalloc.h>
#include <kern/locks.h>
#include <kern/sched_prim.h>

#include <libkern/OSAtomic.h>

#include <bsm/audit.h>
#include <bsm/audit_internal.h>

#include <security/audit/audit_bsd.h>
#include <security/audit/audit.h>
#include <security/audit/audit_private.h>

#include <mach/host_priv.h>
#include <mach/host_special_ports.h>
#include <mach/audit_triggers_server.h>

#if CONFIG_AUDIT
struct mhdr {
	size_t 		 	 mh_size;
	au_malloc_type_t 	*mh_type;
	u_long			 mh_magic;
	char		 	 mh_data[0];
};

/*
 * The lock group for the audit subsystem. 
 */
static lck_grp_t *audit_lck_grp = NULL;

#define	AUDIT_MHMAGIC	0x4D656C53

#if AUDIT_MALLOC_DEBUG
#define AU_MAX_SHORTDESC	20
#define AU_MAX_LASTCALLER	20
struct au_malloc_debug_info {
	SInt64		md_size;
	SInt64		md_maxsize;
	SInt32		md_inuse;
	SInt32		md_maxused;
	unsigned 	md_type;
	unsigned	md_magic;
	char		md_shortdesc[AU_MAX_SHORTDESC];
	char		md_lastcaller[AU_MAX_LASTCALLER];
};
typedef struct au_malloc_debug_info   au_malloc_debug_info_t;

au_malloc_type_t	*audit_malloc_types[NUM_MALLOC_TYPES];

static int audit_sysctl_malloc_debug(struct sysctl_oid *oidp, void *arg1,
    int arg2, struct sysctl_req *req);

SYSCTL_PROC(_kern, OID_AUTO, audit_malloc_debug, CTLFLAG_RD, NULL, 0,
    audit_sysctl_malloc_debug, "S,audit_malloc_debug",
    "Current malloc debug info for auditing.");

#define	AU_MALLOC_DBINFO_SZ \
    (NUM_MALLOC_TYPES * sizeof(au_malloc_debug_info_t))

/*
 * Copy out the malloc debug info via the sysctl interface.  The userland code 
 * is something like the following:
 *
 *  error = sysctlbyname("kern.audit_malloc_debug", buffer_ptr, &buffer_len,
 *             NULL, 0);
 */
static int
audit_sysctl_malloc_debug(__unused struct sysctl_oid *oidp, __unused void *arg1,
    __unused int arg2, struct sysctl_req *req)
{
	int i;
	size_t sz;
	au_malloc_debug_info_t *amdi_ptr, *nxt_ptr;
	int err;

	/*
	 * This provides a read-only node.
	 */
	if (req->newptr != USER_ADDR_NULL)
		return (EPERM);

	/*
	 * If just querying then return the space required. 
	 */
	if (req->oldptr == USER_ADDR_NULL) {
		req->oldidx = AU_MALLOC_DBINFO_SZ; 
		return (0);
	}

	/*
	 *  Alloc a temporary buffer.
	 */
	if (req->oldlen < AU_MALLOC_DBINFO_SZ)
		return (ENOMEM);
	amdi_ptr = (au_malloc_debug_info_t *)kalloc(AU_MALLOC_DBINFO_SZ);
	if (amdi_ptr == NULL)
		return (ENOMEM);
	bzero(amdi_ptr, AU_MALLOC_DBINFO_SZ);

	/*
	 * Build the record array. 
	 */
	sz = 0;
	nxt_ptr = amdi_ptr;
	for(i = 0; i < NUM_MALLOC_TYPES; i++) {
		if (audit_malloc_types[i] == NULL)
			continue;
		if (audit_malloc_types[i]->mt_magic != M_MAGIC) {
			nxt_ptr->md_magic = audit_malloc_types[i]->mt_magic;
			continue;
		}
		nxt_ptr->md_magic = audit_malloc_types[i]->mt_magic;
		nxt_ptr->md_size = audit_malloc_types[i]->mt_size;
		nxt_ptr->md_maxsize = audit_malloc_types[i]->mt_maxsize;
		nxt_ptr->md_inuse = (int)audit_malloc_types[i]->mt_inuse;
		nxt_ptr->md_maxused = (int)audit_malloc_types[i]->mt_maxused;
		strlcpy(nxt_ptr->md_shortdesc,
		    audit_malloc_types[i]->mt_shortdesc, AU_MAX_SHORTDESC - 1);
		strlcpy(nxt_ptr->md_lastcaller,
		    audit_malloc_types[i]->mt_lastcaller, AU_MAX_LASTCALLER-1);
		sz += sizeof(au_malloc_debug_info_t);
		nxt_ptr++;
	}

	req->oldlen = sz;
	err = SYSCTL_OUT(req, amdi_ptr, sz);
	kfree(amdi_ptr, AU_MALLOC_DBINFO_SZ);

	return (err);
}
#endif /* AUDIT_MALLOC_DEBUG */
	
/*
 * BSD malloc()
 * 
 * If the M_NOWAIT flag is set then it may not block and return NULL.
 * If the M_ZERO flag is set then zero out the buffer.
 */
void *
#if AUDIT_MALLOC_DEBUG
_audit_malloc(size_t size, au_malloc_type_t *type, int flags, const char *fn)
#else
_audit_malloc(size_t size, au_malloc_type_t *type, int flags)
#endif
{
	struct mhdr	*hdr;
	size_t	memsize = sizeof (*hdr) + size;

	if (size == 0)
		return (NULL);
	if (flags & M_NOWAIT) {
		hdr = (void *)kalloc_noblock(memsize);
	} else {
		hdr = (void *)kalloc(memsize);
		if (hdr == NULL)
			panic("_audit_malloc: kernel memory exhausted");
	}
	if (hdr == NULL)
		return (NULL);
	hdr->mh_size = memsize;
	hdr->mh_type = type;
	hdr->mh_magic = AUDIT_MHMAGIC;
	if (flags & M_ZERO)
		memset(hdr->mh_data, 0, size);
#if AUDIT_MALLOC_DEBUG
	if (type != NULL && type->mt_type < NUM_MALLOC_TYPES) {
		OSAddAtomic64(memsize, &type->mt_size);
		type->mt_maxsize = max(type->mt_size, type->mt_maxsize);
		OSAddAtomic(1, &type->mt_inuse);
		type->mt_maxused = max(type->mt_inuse, type->mt_maxused);
		type->mt_lastcaller = fn;
		audit_malloc_types[type->mt_type] = type;
	}
#endif /* AUDIT_MALLOC_DEBUG */
	return (hdr->mh_data);
}

/*
 * BSD free()
 */
void
#if AUDIT_MALLOC_DEBUG
_audit_free(void *addr, au_malloc_type_t *type)
#else
_audit_free(void *addr, __unused au_malloc_type_t *type)
#endif
{
	struct mhdr *hdr;
	
	if (addr == NULL)
		return;
	hdr = addr; hdr--;

	KASSERT(hdr->mh_magic == AUDIT_MHMAGIC,
	    ("_audit_free(): hdr->mh_magic != AUDIT_MHMAGIC"));

#if AUDIT_MALLOC_DEBUG
	if (type != NULL) {
		OSAddAtomic64(-hdr->mh_size, &type->mt_size);
		OSAddAtomic(-1, &type->mt_inuse);
	}
#endif /* AUDIT_MALLOC_DEBUG */
	kfree(hdr, hdr->mh_size);
}

/*
 * Initialize a condition variable.  Must be called before use.
 */
void
_audit_cv_init(struct cv *cvp, const char *desc)
{

	if (desc == NULL)
		cvp->cv_description = "UNKNOWN";
	else
		cvp->cv_description = desc;
	cvp->cv_waiters = 0;
}

/*
 *  Destory a condition variable.
 */
void
_audit_cv_destroy(struct cv *cvp)
{

	cvp->cv_description = NULL;
	cvp->cv_waiters = 0;
}

/*
 * Signal a condition variable, wakes up one waiting thread.
 */
void
_audit_cv_signal(struct cv *cvp)
{

	if (cvp->cv_waiters > 0) {
		wakeup_one((caddr_t)cvp);
		cvp->cv_waiters--;
	}
}

/*
 * Broadcast a signal to a condition variable.
 */
void
_audit_cv_broadcast(struct cv *cvp)
{

	if (cvp->cv_waiters > 0) {
		wakeup((caddr_t)cvp);
		cvp->cv_waiters = 0;
	}
}

/*
 * Wait on a condition variable. A cv_signal or cv_broadcast on the same
 * condition variable will resume the thread. It is recommended that the mutex
 * be held when cv_signal or cv_broadcast are called.
 */
void
_audit_cv_wait(struct cv *cvp, lck_mtx_t *mp, const char *desc)
{

	cvp->cv_waiters++;
	(void) msleep(cvp, mp, PZERO, desc, 0);
}

/*
 * Wait on a condition variable, allowing interruption by signals.  Return 0
 * if the thread was resumed with cv_signal or cv_broadcast, EINTR or
 * ERESTART if a signal was caught.  If ERESTART is returned the system call
 * should be restarted if possible.
 */
int
_audit_cv_wait_sig(struct cv *cvp, lck_mtx_t *mp, const char *desc)
{

	cvp->cv_waiters++;
	return (msleep(cvp, mp, PSOCK | PCATCH, desc, 0));
}

/*
 * BSD Mutexes.
 */
void
#if DIAGNOSTIC
_audit_mtx_init(struct mtx *mp, const char *lckname)
#else
_audit_mtx_init(struct mtx *mp, __unused const char *lckname)
#endif
{
	mp->mtx_lock = lck_mtx_alloc_init(audit_lck_grp, LCK_ATTR_NULL);
	KASSERT(mp->mtx_lock != NULL, 
	    ("_audit_mtx_init: Could not allocate a mutex."));
#if DIAGNOSTIC
	strlcpy(mp->mtx_name, lckname, AU_MAX_LCK_NAME);	
#endif
}

void
_audit_mtx_destroy(struct mtx *mp)
{

	if (mp->mtx_lock) {
		lck_mtx_free(mp->mtx_lock, audit_lck_grp);
		mp->mtx_lock = NULL;
	}
}

/*
 * BSD rw locks.
 */
void
#if DIAGNOSTIC
_audit_rw_init(struct rwlock *lp, const char *lckname)
#else
_audit_rw_init(struct rwlock *lp, __unused const char *lckname)
#endif
{
	lp->rw_lock = lck_rw_alloc_init(audit_lck_grp, LCK_ATTR_NULL);
	KASSERT(lp->rw_lock != NULL, 
	    ("_audit_rw_init: Could not allocate a rw lock."));
#if DIAGNOSTIC
	strlcpy(lp->rw_name, lckname, AU_MAX_LCK_NAME);	
#endif
}

void
_audit_rw_destroy(struct rwlock *lp)
{

	if (lp->rw_lock) {
		lck_rw_free(lp->rw_lock, audit_lck_grp);
		lp->rw_lock = NULL;
	}
}
/*
 * Wait on a condition variable in a continuation (i.e. yield kernel stack).
 * A cv_signal or cv_broadcast on the same condition variable will cause
 * the thread to be scheduled.
 */
int
_audit_cv_wait_continuation(struct cv *cvp, lck_mtx_t *mp, thread_continue_t function)
{
	int status = KERN_SUCCESS;

	cvp->cv_waiters++;
	assert_wait(cvp, THREAD_UNINT);
	lck_mtx_unlock(mp);

	status = thread_block(function);

	/* should not be reached, but just in case, re-lock */
	lck_mtx_lock(mp);

	return status;
}

/*
 * Simple recursive lock. 
 */
void
#if DIAGNOSTIC
_audit_rlck_init(struct rlck *lp, const char *lckname)
#else
_audit_rlck_init(struct rlck *lp, __unused const char *lckname)
#endif
{

	lp->rl_mtx = lck_mtx_alloc_init(audit_lck_grp, LCK_ATTR_NULL);
	KASSERT(lp->rl_mtx != NULL, 
	    ("_audit_rlck_init: Could not allocate a recursive lock."));
#if DIAGNOSTIC
	strlcpy(lp->rl_name, lckname, AU_MAX_LCK_NAME);	
#endif
	lp->rl_thread = 0;
	lp->rl_recurse = 0;
}

/*
 * Recursive lock.  Allow same thread to recursively lock the same lock.
 */ 
void
_audit_rlck_lock(struct rlck *lp)
{

	if (lp->rl_thread == current_thread()) {
		OSAddAtomic(1, &lp->rl_recurse);
		KASSERT(lp->rl_recurse < 10000,
		    ("_audit_rlck_lock: lock nested too deep."));
	} else {
		lck_mtx_lock(lp->rl_mtx);
		lp->rl_thread = current_thread();
		lp->rl_recurse = 1;
	}
}

/*
 * Recursive unlock.  It should be the same thread that does the unlock.
 */
void
_audit_rlck_unlock(struct rlck *lp)
{
	KASSERT(lp->rl_thread == current_thread(), 
	    ("_audit_rlck_unlock(): Don't own lock."));

	/* Note: OSAddAtomic returns old value. */
	if (OSAddAtomic(-1, &lp->rl_recurse) == 1) {
		lp->rl_thread = 0;
		lck_mtx_unlock(lp->rl_mtx);
	}
}
		
void
_audit_rlck_destroy(struct rlck *lp)
{

	if (lp->rl_mtx) {
		lck_mtx_free(lp->rl_mtx, audit_lck_grp);
		lp->rl_mtx = NULL;
	}
}

/*
 * Recursive lock assert.
 */
void
_audit_rlck_assert(struct rlck *lp, u_int assert)
{
	thread_t cthd = current_thread();
	
	if (assert == LCK_MTX_ASSERT_OWNED && lp->rl_thread == cthd)
		panic("recursive lock (%p) not held by this thread (%p).",
		    lp, cthd);
	if (assert == LCK_MTX_ASSERT_NOTOWNED && lp->rl_thread != 0)
		panic("recursive lock (%p) held by thread (%p).",
		    lp, cthd);
}

/*
 * Simple sleep lock.
 */
void
#if DIAGNOSTIC
_audit_slck_init(struct slck *lp, const char *lckname)
#else
_audit_slck_init(struct slck *lp, __unused const char *lckname)
#endif
{

	lp->sl_mtx = lck_mtx_alloc_init(audit_lck_grp, LCK_ATTR_NULL);
	KASSERT(lp->sl_mtx != NULL, 
	    ("_audit_slck_init: Could not allocate a sleep lock."));
#if DIAGNOSTIC
	strlcpy(lp->sl_name, lckname, AU_MAX_LCK_NAME);	
#endif
	lp->sl_locked = 0;
	lp->sl_waiting = 0;
}

/*
 * Sleep lock lock.  The 'intr' flag determines if the lock is interruptible.
 * If 'intr' is true then signals or other events can interrupt the sleep lock. 
 */
wait_result_t
_audit_slck_lock(struct slck *lp, int intr)
{
	wait_result_t res = THREAD_AWAKENED;

	lck_mtx_lock(lp->sl_mtx);
	while (lp->sl_locked && res == THREAD_AWAKENED) {
		lp->sl_waiting = 1;
		res = lck_mtx_sleep(lp->sl_mtx, LCK_SLEEP_DEFAULT,
		   (event_t) lp, (intr) ? THREAD_INTERRUPTIBLE : THREAD_UNINT);
	}
	if (res == THREAD_AWAKENED)
		lp->sl_locked = 1;
	lck_mtx_unlock(lp->sl_mtx);
	
	return (res);
}

/*
 * Sleep lock unlock.  Wake up all the threads waiting for this lock.
 */
void
_audit_slck_unlock(struct slck *lp)
{
	
	lck_mtx_lock(lp->sl_mtx);
	lp->sl_locked = 0;
	if (lp->sl_waiting) {
		lp->sl_waiting = 0;

		/* Wake up *all* sleeping threads. */
		wakeup((event_t) lp);
	}
	lck_mtx_unlock(lp->sl_mtx);
}

/*
 * Sleep lock try.  Don't sleep if it doesn't get the lock. 
 */
int
_audit_slck_trylock(struct slck *lp)
{
	int result;

	lck_mtx_lock(lp->sl_mtx);
	result = !lp->sl_locked;
	if (result)
		lp->sl_locked = 1;
	lck_mtx_unlock(lp->sl_mtx);

	return (result);
}

/*
 * Sleep lock assert.
 */
void
_audit_slck_assert(struct slck *lp, u_int assert)
{

	if (assert == LCK_MTX_ASSERT_OWNED && lp->sl_locked == 0)
		panic("sleep lock (%p) not held.", lp);
	if (assert == LCK_MTX_ASSERT_NOTOWNED && lp->sl_locked == 1)
		panic("sleep lock (%p) held.", lp);
}

void
_audit_slck_destroy(struct slck *lp)
{

	if (lp->sl_mtx) {
		lck_mtx_free(lp->sl_mtx, audit_lck_grp);
		lp->sl_mtx = NULL;
	}
}

/*
 * XXXss - This code was taken from bsd/netinet6/icmp6.c.  Maybe ppsratecheck()
 * should be made global in icmp6.c.
 */
#ifndef timersub
#define timersub(tvp, uvp, vvp)                                         \
        do {                                                            \
                (vvp)->tv_sec = (tvp)->tv_sec - (uvp)->tv_sec;          \
                (vvp)->tv_usec = (tvp)->tv_usec - (uvp)->tv_usec;       \
                if ((vvp)->tv_usec < 0) {                               \
                        (vvp)->tv_sec--;                                \
                        (vvp)->tv_usec += 1000000;                      \
                }                                                       \
        } while (0)
#endif

/*
 * Packets (or events) per second limitation.
 */
int
_audit_ppsratecheck(struct timeval *lasttime, int *curpps, int maxpps)
{
	struct timeval tv, delta;
	int rv;

	microtime(&tv);

	timersub(&tv, lasttime, &delta);

	/*
	 * Check for 0,0 so that the message will be seen at least once.
	 * If more than one second has passed since the last update of
	 * lasttime, reset the counter.
	 *
	 * we do increment *curpps even in *curpps < maxpps case, as some may
	 * try to use *curpps for stat purposes as well.
	 */
	if ((lasttime->tv_sec == 0 && lasttime->tv_usec == 0) ||
	    delta.tv_sec >= 1) {
		*lasttime = tv;
		*curpps = 0;
		rv = 1;
	} else if (maxpps < 0)
		rv = 1;
	else if (*curpps < maxpps)
		rv = 1;
	else
		rv = 0;
	if (*curpps + 1 > 0)
		*curpps = *curpps + 1;

	return (rv);	
}

/*
 * Initialize lock group for audit related locks/mutexes.
 */
void
_audit_lck_grp_init(void)
{
	audit_lck_grp = lck_grp_alloc_init("Audit", LCK_GRP_ATTR_NULL);

	KASSERT(audit_lck_grp != NULL,
	    ("audit_get_lck_grp: Could not allocate the audit lock group."));
}

int
audit_send_trigger(unsigned int trigger)
{
	mach_port_t audit_port;
	int error;

	error = host_get_audit_control_port(host_priv_self(), &audit_port);
	if (error == KERN_SUCCESS && audit_port != MACH_PORT_NULL) {
		audit_triggers(audit_port, trigger);
		return (0);
	} else {
		printf("Cannot get audit control port\n");
		return (error);
	}
}
#endif /* CONFIG_AUDIT */
Commit	Line	Data
b0d623f7	1	/*-
6d2010ae	2	* Copyright (c) 2008-2010 Apple Inc.
b0d623f7 A	3	* All rights reserved.
	4	*
	5	* Redistribution and use in source and binary forms, with or without
	6	* modification, are permitted provided that the following conditions
	7	* are met:
	8	*
	9	* 1. Redistributions of source code must retain the above copyright
	10	* notice, this list of conditions and the following disclaimer.
	11	* 2. Redistributions in binary form must reproduce the above copyright
	12	* notice, this list of conditions and the following disclaimer in the
	13	* documentation and/or other materials provided with the distribution.
	14	* 3. Neither the name of Apple Inc. ("Apple") nor the names of
	15	* its contributors may be used to endorse or promote products derived
	16	* from this software without specific prior written permission.
	17	*
	18	* THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
	19	* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
	20	* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
	21	* DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
	22	* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
	23	* (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
	24	* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
	25	* ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
	26	* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
	27	* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	28	*/
	29
	30	#include <string.h>
	31
	32	#include <sys/kernel.h>
	33	#include <sys/proc.h>
	34	#include <sys/systm.h>
	35
	36	#include <kern/host.h>
	37	#include <kern/kalloc.h>
	38	#include <kern/locks.h>
	39	#include <kern/sched_prim.h>
	40
	41	#include <libkern/OSAtomic.h>
	42
	43	#include <bsm/audit.h>
	44	#include <bsm/audit_internal.h>
	45
	46	#include <security/audit/audit_bsd.h>
	47	#include <security/audit/audit.h>
	48	#include <security/audit/audit_private.h>
	49
	50	#include <mach/host_priv.h>
	51	#include <mach/host_special_ports.h>
	52	#include <mach/audit_triggers_server.h>
	53
	54	#if CONFIG_AUDIT
	55	struct mhdr {
	56	size_t mh_size;
	57	au_malloc_type_t *mh_type;
	58	u_long mh_magic;
	59	char mh_data[0];
	60	};
	61
6d2010ae A	62	/*
	63	* The lock group for the audit subsystem.
	64	*/
	65	static lck_grp_t *audit_lck_grp = NULL;
	66
b0d623f7 A	67	#define AUDIT_MHMAGIC 0x4D656C53
	68
	69	#if AUDIT_MALLOC_DEBUG
	70	#define AU_MAX_SHORTDESC 20
	71	#define AU_MAX_LASTCALLER 20
	72	struct au_malloc_debug_info {
	73	SInt64 md_size;
	74	SInt64 md_maxsize;
	75	SInt32 md_inuse;
	76	SInt32 md_maxused;
	77	unsigned md_type;
	78	unsigned md_magic;
	79	char md_shortdesc[AU_MAX_SHORTDESC];
	80	char md_lastcaller[AU_MAX_LASTCALLER];
	81	};
	82	typedef struct au_malloc_debug_info au_malloc_debug_info_t;
	83
	84	au_malloc_type_t *audit_malloc_types[NUM_MALLOC_TYPES];
	85
	86	static int audit_sysctl_malloc_debug(struct sysctl_oid oidp, void arg1,
	87	int arg2, struct sysctl_req *req);
	88
	89	SYSCTL_PROC(_kern, OID_AUTO, audit_malloc_debug, CTLFLAG_RD, NULL, 0,
	90	audit_sysctl_malloc_debug, "S,audit_malloc_debug",
	91	"Current malloc debug info for auditing.");
	92
	93	#define AU_MALLOC_DBINFO_SZ \
	94	(NUM_MALLOC_TYPES * sizeof(au_malloc_debug_info_t))
	95
	96	/*
	97	* Copy out the malloc debug info via the sysctl interface. The userland code
	98	* is something like the following:
	99	*
	100	* error = sysctlbyname("kern.audit_malloc_debug", buffer_ptr, &buffer_len,
	101	* NULL, 0);
	102	*/
	103	static int
	104	audit_sysctl_malloc_debug(__unused struct sysctl_oid oidp, __unused void arg1,
	105	__unused int arg2, struct sysctl_req *req)
	106	{
	107	int i;
	108	size_t sz;
	109	au_malloc_debug_info_t amdi_ptr, nxt_ptr;
	110	int err;
	111
	112	/*
	113	* This provides a read-only node.
	114	*/
	115	if (req->newptr != USER_ADDR_NULL)
	116	return (EPERM);
	117
	118	/*
	119	* If just querying then return the space required.
	120	*/
	121	if (req->oldptr == USER_ADDR_NULL) {
	122	req->oldidx = AU_MALLOC_DBINFO_SZ;
	123	return (0);
	124	}
	125
	126	/*
	127	* Alloc a temporary buffer.
	128	*/
	129	if (req->oldlen < AU_MALLOC_DBINFO_SZ)
	130	return (ENOMEM);
131	amdi_ptr = (au_malloc_debug_info_t *)kalloc(AU_MALLOC_DBINFO_SZ);
132	if (amdi_ptr == NULL)
133	return (ENOMEM);
134	bzero(amdi_ptr, AU_MALLOC_DBINFO_SZ);
135
136	/*
137	* Build the record array.
138	*/
139	sz = 0;
140	nxt_ptr = amdi_ptr;
141	for(i = 0; i < NUM_MALLOC_TYPES; i++) {
142	if (audit_malloc_types[i] == NULL)
143	continue;
144	if (audit_malloc_types[i]->mt_magic != M_MAGIC) {
145	nxt_ptr->md_magic = audit_malloc_types[i]->mt_magic;
146	continue;
147	}
148	nxt_ptr->md_magic = audit_malloc_types[i]->mt_magic;
149	nxt_ptr->md_size = audit_malloc_types[i]->mt_size;
150	nxt_ptr->md_maxsize = audit_malloc_types[i]->mt_maxsize;
151	nxt_ptr->md_inuse = (int)audit_malloc_types[i]->mt_inuse;
152	nxt_ptr->md_maxused = (int)audit_malloc_types[i]->mt_maxused;
153	strlcpy(nxt_ptr->md_shortdesc,
154	audit_malloc_types[i]->mt_shortdesc, AU_MAX_SHORTDESC - 1);
155	strlcpy(nxt_ptr->md_lastcaller,
156	audit_malloc_types[i]->mt_lastcaller, AU_MAX_LASTCALLER-1);
157	sz += sizeof(au_malloc_debug_info_t);
158	nxt_ptr++;
159	}
160
161	req->oldlen = sz;
162	err = SYSCTL_OUT(req, amdi_ptr, sz);
163	kfree(amdi_ptr, AU_MALLOC_DBINFO_SZ);
164
165	return (err);
166	}
167	#endif /* AUDIT_MALLOC_DEBUG */
168
169	/*
170	* BSD malloc()
171	*
172	* If the M_NOWAIT flag is set then it may not block and return NULL.
173	* If the M_ZERO flag is set then zero out the buffer.
174	*/
175	void *
176	#if AUDIT_MALLOC_DEBUG
177	_audit_malloc(size_t size, au_malloc_type_t type, int flags, const char fn)
178	#else
179	_audit_malloc(size_t size, au_malloc_type_t *type, int flags)
180	#endif
181	{
6d2010ae A	182	struct mhdr *hdr;
6d2010ae A	183	size_t memsize = sizeof (*hdr) + size;
b0d623f7 A	184
	185	if (size == 0)
	186	return (NULL);
	187	if (flags & M_NOWAIT) {
6d2010ae	188	hdr = (void *)kalloc_noblock(memsize);
b0d623f7	189	} else {
6d2010ae A	190	hdr = (void *)kalloc(memsize);
6d2010ae A	191	if (hdr == NULL)
b0d623f7 A	192	panic("_audit_malloc: kernel memory exhausted");
b0d623f7 A	193	}
6d2010ae	194	if (hdr == NULL)
b0d623f7	195	return (NULL);
6d2010ae A	196	hdr->mh_size = memsize;
	197	hdr->mh_type = type;
	198	hdr->mh_magic = AUDIT_MHMAGIC;
b0d623f7	199	if (flags & M_ZERO)
6d2010ae	200	memset(hdr->mh_data, 0, size);
b0d623f7 A	201	#if AUDIT_MALLOC_DEBUG
	202	if (type != NULL && type->mt_type < NUM_MALLOC_TYPES) {
	203	OSAddAtomic64(memsize, &type->mt_size);
	204	type->mt_maxsize = max(type->mt_size, type->mt_maxsize);
	205	OSAddAtomic(1, &type->mt_inuse);
	206	type->mt_maxused = max(type->mt_inuse, type->mt_maxused);
	207	type->mt_lastcaller = fn;
	208	audit_malloc_types[type->mt_type] = type;
	209	}
	210	#endif /* AUDIT_MALLOC_DEBUG */
6d2010ae	211	return (hdr->mh_data);
b0d623f7 A	212	}
	213
	214	/*
	215	* BSD free()
	216	*/
	217	void
	218	#if AUDIT_MALLOC_DEBUG
	219	_audit_free(void addr, au_malloc_type_t type)
	220	#else
	221	_audit_free(void addr, __unused au_malloc_type_t type)
	222	#endif
	223	{
	224	struct mhdr *hdr;
	225
	226	if (addr == NULL)
	227	return;
	228	hdr = addr; hdr--;
	229
	230	KASSERT(hdr->mh_magic == AUDIT_MHMAGIC,
	231	("_audit_free(): hdr->mh_magic != AUDIT_MHMAGIC"));
	232
	233	#if AUDIT_MALLOC_DEBUG
	234	if (type != NULL) {
	235	OSAddAtomic64(-hdr->mh_size, &type->mt_size);
	236	OSAddAtomic(-1, &type->mt_inuse);
	237	}
	238	#endif /* AUDIT_MALLOC_DEBUG */
	239	kfree(hdr, hdr->mh_size);
	240	}
	241
	242	/*
	243	* Initialize a condition variable. Must be called before use.
	244	*/
	245	void
	246	_audit_cv_init(struct cv cvp, const char desc)
	247	{
	248
	249	if (desc == NULL)
	250	cvp->cv_description = "UNKNOWN";
	251	else
	252	cvp->cv_description = desc;
	253	cvp->cv_waiters = 0;
	254	}
	255
	256	/*
	257	* Destory a condition variable.
	258	*/
	259	void
	260	_audit_cv_destroy(struct cv *cvp)
	261	{
	262
	263	cvp->cv_description = NULL;
	264	cvp->cv_waiters = 0;
	265	}
	266
	267	/*
	268	* Signal a condition variable, wakes up one waiting thread.
	269	*/
	270	void
	271	_audit_cv_signal(struct cv *cvp)
	272	{
	273
	274	if (cvp->cv_waiters > 0) {
	275	wakeup_one((caddr_t)cvp);
276	cvp->cv_waiters--;
277	}
278	}
279
280	/*
281	* Broadcast a signal to a condition variable.
282	*/
283	void
284	_audit_cv_broadcast(struct cv *cvp)
285	{
286
287	if (cvp->cv_waiters > 0) {
288	wakeup((caddr_t)cvp);
289	cvp->cv_waiters = 0;
290	}
291	}
292
293	/*
294	* Wait on a condition variable. A cv_signal or cv_broadcast on the same
295	* condition variable will resume the thread. It is recommended that the mutex
296	* be held when cv_signal or cv_broadcast are called.
297	*/
298	void
299	_audit_cv_wait(struct cv cvp, lck_mtx_t mp, const char *desc)
300	{
301
302	cvp->cv_waiters++;
303	(void) msleep(cvp, mp, PZERO, desc, 0);
304	}
305
306	/*
307	* Wait on a condition variable, allowing interruption by signals. Return 0
308	* if the thread was resumed with cv_signal or cv_broadcast, EINTR or
309	* ERESTART if a signal was caught. If ERESTART is returned the system call
310	* should be restarted if possible.
311	*/
312	int
313	_audit_cv_wait_sig(struct cv cvp, lck_mtx_t mp, const char *desc)
314	{
315
316	cvp->cv_waiters++;
317	return (msleep(cvp, mp, PSOCK \| PCATCH, desc, 0));
318	}
319
320	/*
6d2010ae A	321	* BSD Mutexes.
	322	*/
	323	void
	324	#if DIAGNOSTIC
	325	_audit_mtx_init(struct mtx mp, const char lckname)
	326	#else
	327	_audit_mtx_init(struct mtx mp, __unused const char lckname)
	328	#endif
	329	{
	330	mp->mtx_lock = lck_mtx_alloc_init(audit_lck_grp, LCK_ATTR_NULL);
	331	KASSERT(mp->mtx_lock != NULL,
	332	("_audit_mtx_init: Could not allocate a mutex."));
	333	#if DIAGNOSTIC
	334	strlcpy(mp->mtx_name, lckname, AU_MAX_LCK_NAME);
	335	#endif
	336	}
	337
	338	void
	339	_audit_mtx_destroy(struct mtx *mp)
	340	{
	341
	342	if (mp->mtx_lock) {
	343	lck_mtx_free(mp->mtx_lock, audit_lck_grp);
	344	mp->mtx_lock = NULL;
	345	}
	346	}
	347
	348	/*
	349	* BSD rw locks.
b0d623f7 A	350	*/
b0d623f7 A	351	void
6d2010ae A	352	#if DIAGNOSTIC
	353	_audit_rw_init(struct rwlock lp, const char lckname)
	354	#else
	355	_audit_rw_init(struct rwlock lp, __unused const char lckname)
	356	#endif
	357	{
	358	lp->rw_lock = lck_rw_alloc_init(audit_lck_grp, LCK_ATTR_NULL);
	359	KASSERT(lp->rw_lock != NULL,
	360	("_audit_rw_init: Could not allocate a rw lock."));
	361	#if DIAGNOSTIC
	362	strlcpy(lp->rw_name, lckname, AU_MAX_LCK_NAME);
	363	#endif
	364	}
	365
	366	void
	367	_audit_rw_destroy(struct rwlock *lp)
	368	{
	369
	370	if (lp->rw_lock) {
	371	lck_rw_free(lp->rw_lock, audit_lck_grp);
	372	lp->rw_lock = NULL;
	373	}
	374	}
	375	/*
	376	* Wait on a condition variable in a continuation (i.e. yield kernel stack).
	377	* A cv_signal or cv_broadcast on the same condition variable will cause
	378	* the thread to be scheduled.
	379	*/
	380	int
	381	_audit_cv_wait_continuation(struct cv cvp, lck_mtx_t mp, thread_continue_t function)
b0d623f7	382	{
6d2010ae A	383	int status = KERN_SUCCESS;
	384
	385	cvp->cv_waiters++;
	386	assert_wait(cvp, THREAD_UNINT);
	387	lck_mtx_unlock(mp);
	388
	389	status = thread_block(function);
b0d623f7	390
6d2010ae A	391	/* should not be reached, but just in case, re-lock */
	392	lck_mtx_lock(mp);
	393
	394	return status;
	395	}
	396
	397	/*
	398	* Simple recursive lock.
	399	*/
	400	void
	401	#if DIAGNOSTIC
	402	_audit_rlck_init(struct rlck lp, const char lckname)
	403	#else
	404	_audit_rlck_init(struct rlck lp, __unused const char lckname)
	405	#endif
	406	{
b0d623f7	407
6d2010ae A	408	lp->rl_mtx = lck_mtx_alloc_init(audit_lck_grp, LCK_ATTR_NULL);
	409	KASSERT(lp->rl_mtx != NULL,
	410	("_audit_rlck_init: Could not allocate a recursive lock."));
	411	#if DIAGNOSTIC
	412	strlcpy(lp->rl_name, lckname, AU_MAX_LCK_NAME);
	413	#endif
b0d623f7 A	414	lp->rl_thread = 0;
	415	lp->rl_recurse = 0;
	416	}
	417
	418	/*
	419	* Recursive lock. Allow same thread to recursively lock the same lock.
	420	*/
	421	void
	422	_audit_rlck_lock(struct rlck *lp)
	423	{
	424
	425	if (lp->rl_thread == current_thread()) {
	426	OSAddAtomic(1, &lp->rl_recurse);
	427	KASSERT(lp->rl_recurse < 10000,
	428	("_audit_rlck_lock: lock nested too deep."));
	429	} else {
	430	lck_mtx_lock(lp->rl_mtx);
	431	lp->rl_thread = current_thread();
	432	lp->rl_recurse = 1;
	433	}
	434	}
	435
	436	/*
	437	* Recursive unlock. It should be the same thread that does the unlock.
	438	*/
	439	void
	440	_audit_rlck_unlock(struct rlck *lp)
	441	{
	442	KASSERT(lp->rl_thread == current_thread(),
	443	("_audit_rlck_unlock(): Don't own lock."));
	444
	445	/* Note: OSAddAtomic returns old value. */
	446	if (OSAddAtomic(-1, &lp->rl_recurse) == 1) {
	447	lp->rl_thread = 0;
	448	lck_mtx_unlock(lp->rl_mtx);
	449	}
	450	}
	451
	452	void
	453	_audit_rlck_destroy(struct rlck *lp)
	454	{
	455
	456	if (lp->rl_mtx) {
6d2010ae A	457	lck_mtx_free(lp->rl_mtx, audit_lck_grp);
6d2010ae A	458	lp->rl_mtx = NULL;
b0d623f7 A	459	}
	460	}
	461
	462	/*
	463	* Recursive lock assert.
	464	*/
	465	void
	466	_audit_rlck_assert(struct rlck *lp, u_int assert)
	467	{
	468	thread_t cthd = current_thread();
	469
	470	if (assert == LCK_MTX_ASSERT_OWNED && lp->rl_thread == cthd)
	471	panic("recursive lock (%p) not held by this thread (%p).",
	472	lp, cthd);
	473	if (assert == LCK_MTX_ASSERT_NOTOWNED && lp->rl_thread != 0)
	474	panic("recursive lock (%p) held by thread (%p).",
	475	lp, cthd);
	476	}
	477
	478	/*
	479	* Simple sleep lock.
	480	*/
	481	void
6d2010ae A	482	#if DIAGNOSTIC
	483	_audit_slck_init(struct slck lp, const char lckname)
	484	#else
	485	_audit_slck_init(struct slck lp, __unused const char lckname)
	486	#endif
b0d623f7 A	487	{
b0d623f7 A	488
6d2010ae A	489	lp->sl_mtx = lck_mtx_alloc_init(audit_lck_grp, LCK_ATTR_NULL);
	490	KASSERT(lp->sl_mtx != NULL,
	491	("_audit_slck_init: Could not allocate a sleep lock."));
	492	#if DIAGNOSTIC
	493	strlcpy(lp->sl_name, lckname, AU_MAX_LCK_NAME);
	494	#endif
b0d623f7 A	495	lp->sl_locked = 0;
	496	lp->sl_waiting = 0;
	497	}
	498
	499	/*
	500	* Sleep lock lock. The 'intr' flag determines if the lock is interruptible.
	501	* If 'intr' is true then signals or other events can interrupt the sleep lock.
	502	*/
	503	wait_result_t
	504	_audit_slck_lock(struct slck *lp, int intr)
	505	{
	506	wait_result_t res = THREAD_AWAKENED;
	507
	508	lck_mtx_lock(lp->sl_mtx);
	509	while (lp->sl_locked && res == THREAD_AWAKENED) {
	510	lp->sl_waiting = 1;
	511	res = lck_mtx_sleep(lp->sl_mtx, LCK_SLEEP_DEFAULT,
	512	(event_t) lp, (intr) ? THREAD_INTERRUPTIBLE : THREAD_UNINT);
	513	}
	514	if (res == THREAD_AWAKENED)
	515	lp->sl_locked = 1;
	516	lck_mtx_unlock(lp->sl_mtx);
	517
	518	return (res);
	519	}
	520
	521	/*
	522	* Sleep lock unlock. Wake up all the threads waiting for this lock.
	523	*/
	524	void
	525	_audit_slck_unlock(struct slck *lp)
	526	{
	527
	528	lck_mtx_lock(lp->sl_mtx);
	529	lp->sl_locked = 0;
	530	if (lp->sl_waiting) {
	531	lp->sl_waiting = 0;
	532
	533	/* Wake up all sleeping threads. */
6d2010ae	534	wakeup((event_t) lp);
b0d623f7 A	535	}
	536	lck_mtx_unlock(lp->sl_mtx);
	537	}
	538
	539	/*
	540	* Sleep lock try. Don't sleep if it doesn't get the lock.
	541	*/
	542	int
	543	_audit_slck_trylock(struct slck *lp)
	544	{
	545	int result;
	546
	547	lck_mtx_lock(lp->sl_mtx);
	548	result = !lp->sl_locked;
	549	if (result)
	550	lp->sl_locked = 1;
	551	lck_mtx_unlock(lp->sl_mtx);
	552
	553	return (result);
	554	}
	555
	556	/*
	557	* Sleep lock assert.
	558	*/
	559	void
	560	_audit_slck_assert(struct slck *lp, u_int assert)
	561	{
	562
	563	if (assert == LCK_MTX_ASSERT_OWNED && lp->sl_locked == 0)
	564	panic("sleep lock (%p) not held.", lp);
	565	if (assert == LCK_MTX_ASSERT_NOTOWNED && lp->sl_locked == 1)
	566	panic("sleep lock (%p) held.", lp);
	567	}
	568
	569	void
	570	_audit_slck_destroy(struct slck *lp)
	571	{
	572
	573	if (lp->sl_mtx) {
6d2010ae A	574	lck_mtx_free(lp->sl_mtx, audit_lck_grp);
6d2010ae A	575	lp->sl_mtx = NULL;
b0d623f7 A	576	}
	577	}
	578
	579	/*
	580	* XXXss - This code was taken from bsd/netinet6/icmp6.c. Maybe ppsratecheck()
	581	* should be made global in icmp6.c.
	582	*/
	583	#ifndef timersub
	584	#define timersub(tvp, uvp, vvp) \
	585	do { \
	586	(vvp)->tv_sec = (tvp)->tv_sec - (uvp)->tv_sec; \
	587	(vvp)->tv_usec = (tvp)->tv_usec - (uvp)->tv_usec; \
	588	if ((vvp)->tv_usec < 0) { \
	589	(vvp)->tv_sec--; \
	590	(vvp)->tv_usec += 1000000; \
	591	} \
	592	} while (0)
	593	#endif
	594
	595	/*
	596	* Packets (or events) per second limitation.
	597	*/
	598	int
	599	_audit_ppsratecheck(struct timeval lasttime, int curpps, int maxpps)
	600	{
	601	struct timeval tv, delta;
	602	int rv;
	603
	604	microtime(&tv);
	605
	606	timersub(&tv, lasttime, &delta);
	607
	608	/*
	609	* Check for 0,0 so that the message will be seen at least once.
	610	* If more than one second has passed since the last update of
	611	* lasttime, reset the counter.
	612	*
	613	* we do increment curpps even in curpps < maxpps case, as some may
	614	* try to use *curpps for stat purposes as well.
	615	*/
	616	if ((lasttime->tv_sec == 0 && lasttime->tv_usec == 0) \|\|
	617	delta.tv_sec >= 1) {
	618	*lasttime = tv;
	619	*curpps = 0;
	620	rv = 1;
	621	} else if (maxpps < 0)
	622	rv = 1;
	623	else if (*curpps < maxpps)
	624	rv = 1;
	625	else
	626	rv = 0;
	627	if (*curpps + 1 > 0)
	628	curpps = curpps + 1;
	629
	630	return (rv);
	631	}
	632
6d2010ae A	633	/*
	634	* Initialize lock group for audit related locks/mutexes.
	635	*/
	636	void
	637	_audit_lck_grp_init(void)
	638	{
	639	audit_lck_grp = lck_grp_alloc_init("Audit", LCK_GRP_ATTR_NULL);
	640
	641	KASSERT(audit_lck_grp != NULL,
	642	("audit_get_lck_grp: Could not allocate the audit lock group."));
	643	}
	644
b0d623f7 A	645	int
	646	audit_send_trigger(unsigned int trigger)
	647	{
	648	mach_port_t audit_port;
	649	int error;
	650
	651	error = host_get_audit_control_port(host_priv_self(), &audit_port);
	652	if (error == KERN_SUCCESS && audit_port != MACH_PORT_NULL) {
	653	audit_triggers(audit_port, trigger);
	654	return (0);
	655	} else {
	656	printf("Cannot get audit control port\n");
	657	return (error);
	658	}
	659	}
	660	#endif /* CONFIG_AUDIT */