[apple/xnu.git] / bsd / security / audit / audit_private.h

/*-
 * Copyright (c) 1999-2016 Apple Inc.
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1.  Redistributions of source code must retain the above copyright
 *     notice, this list of conditions and the following disclaimer.
 * 2.  Redistributions in binary form must reproduce the above copyright
 *     notice, this list of conditions and the following disclaimer in the
 *     documentation and/or other materials provided with the distribution.
 * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
 *     its contributors may be used to endorse or promote products derived
 *     from this software without specific prior written permission.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR
 * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
 * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 * POSSIBILITY OF SUCH DAMAGE.
 */
/*
 * NOTICE: This file was modified by SPARTA, Inc. in 2005 to introduce
 * support for mandatory and extensible security protections.  This notice
 * is included in support of clause 2.2 (b) of the Apple Public License,
 * Version 2.0.
 */

/*
 * This include file contains function prototypes and type definitions used
 * within the audit implementation.
 */

#ifndef _SECURITY_AUDIT_PRIVATE_H_
#define	_SECURITY_AUDIT_PRIVATE_H_

#if defined(_KERNEL) || defined(KERNEL)

#if CONFIG_MACF
#include <sys/queue.h>
#include <security/mac_framework.h>
#endif

#include <sys/ipc.h>
#include <sys/proc_internal.h>	/* for PID_MAX */
#include <sys/socket.h>
#include <sys/ucred.h>

#ifdef MALLOC_DECLARE
MALLOC_DECLARE(M_AUDITBSM);
MALLOC_DECLARE(M_AUDITDATA);
MALLOC_DECLARE(M_AUDITPATH);
MALLOC_DECLARE(M_AUDITTEXT);
#endif

/*
 * Audit control variables that are usually set/read via system calls and
 * used to control various aspects of auditing.
 */
extern struct au_qctrl		audit_qctrl;
extern struct audit_fstat	audit_fstat;
extern struct au_mask		audit_nae_mask;
extern int			audit_panic_on_write_fail;
extern int			audit_fail_stop;
extern int			audit_argv;
extern int			audit_arge;

/*
 * Kernel mask that is used to check to see if system calls need to be audited.
 */
extern au_class_t		audit_kevent_mask;

/*
 * The macro used to check to see if the system calls need to be auditing. 
 * This will pessimisticly set the audit syscalls flag if the audit kevent
 * mask has not been created yet.  User code should build the event/class
 * mapping table before setting preselection masks to avoid this.
 */
#define	AUDIT_CHECK_IF_KEVENTS_MASK(m) do {				\
	if ((m).am_success || (m).am_failure)				\
		if (!audit_kevent_mask || 				\
		    (audit_kevent_mask & (m).am_success) ||		\
		    (audit_kevent_mask & (m).am_failure))		\
			audit_syscalls = 1;				\
} while (0)

/*
 * Success/failure conditions for the conversion of a kernel audit record to
 * BSM format.
 */
#define	BSM_SUCCESS	0
#define	BSM_FAILURE	1
#define	BSM_NOAUDIT	2

/*
 * Defines for the kernel audit record k_ar_commit field.  Flags are set to
 * indicate what sort of record it is, and which preselection mechanism
 * selected it.
 */
#define	AR_COMMIT_KERNEL	0x00000001U
#define	AR_COMMIT_USER		0x00000010U

#define	AR_PRESELECT_TRAIL	0x00001000U
#define	AR_PRESELECT_PIPE	0x00002000U

#define	AR_PRESELECT_USER_TRAIL	0x00004000U
#define	AR_PRESELECT_USER_PIPE	0x00008000U

#define	AR_PRESELECT_FILTER	0x00010000U

#define	AR_DRAIN_QUEUE		0x80000000U

/*
 * Audit data is generated as a stream of struct audit_record structures,
 * linked by struct kaudit_record, and contain storage for possible audit so
 * that it will not need to be allocated during the processing of a system
 * call, both improving efficiency and avoiding sleeping at untimely moments.
 * This structure is converted to BSM format before being written to disk.
 */
struct vnode_au_info {
	mode_t	vn_mode;
	uid_t	vn_uid;
	gid_t	vn_gid;
	dev_t	vn_dev;
	long	vn_fsid;
	long	vn_fileid;
	long	vn_gen;
};

struct groupset {
	gid_t	gidset[NGROUPS];
	u_int	gidset_size;
};

struct socket_au_info {
	int		 	sai_domain;
	int		 	sai_type;
	int		 	sai_protocol;

	/* Foreign (remote) address/port. */
	struct sockaddr_storage	sai_faddr;

	/* Local address/port. */
	struct sockaddr_storage	sai_laddr;
};

/*
 *  The following is used for A_OLDSETQCTRL and A_OLDGETQCTRL and a 64-bit
 *  userland.
 */
struct	au_qctrl64 {
	u_int64_t		aq64_hiwater;
	u_int64_t		aq64_lowater;
	u_int64_t		aq64_bufsz;
	u_int64_t		aq64_delay;
	int64_t			aq64_minfree;
};
typedef	struct au_qctrl64 au_qctrl64_t;

union auditon_udata {
	char			*au_path;
	int			au_cond;
	int			au_policy;
	int64_t			au_cond64;
	int64_t			au_policy64;
	int			au_trigger;
	au_evclass_map_t	au_evclass;
	au_mask_t		au_mask;
	au_asflgs_t		au_flags;
	auditinfo_t		au_auinfo;
	auditpinfo_t		au_aupinfo;
	auditpinfo_addr_t	au_aupinfo_addr;
	au_qctrl_t		au_qctrl;
	au_qctrl64_t		au_qctrl64;
	au_stat_t		au_stat;
	au_fstat_t		au_fstat;
	auditinfo_addr_t	au_kau_info;
};

struct posix_ipc_perm {
	uid_t	pipc_uid;
	gid_t	pipc_gid;
	mode_t	pipc_mode;
};

struct audit_record {
	/* Audit record header. */
	u_int32_t		ar_magic;
	int			ar_event;
	int			ar_retval; /* value returned to the process */
	int			ar_errno;  /* return status of system call */
	struct timespec		ar_starttime;
	struct timespec		ar_endtime;
	u_int64_t		ar_valid_arg;  /* Bitmask of valid arguments */

	/* Audit subject information. */
	struct xucred		ar_subj_cred;
	uid_t			ar_subj_ruid;
	gid_t			ar_subj_rgid;
	gid_t			ar_subj_egid;
	uid_t			ar_subj_auid; /* Audit user ID */
	pid_t			ar_subj_asid; /* Audit session ID */
	pid_t			ar_subj_pid;
	struct au_tid		ar_subj_term;
	struct au_tid_addr	ar_subj_term_addr;
	struct au_mask		ar_subj_amask;

	/* Operation arguments. */
	uid_t			ar_arg_euid;
	uid_t			ar_arg_ruid;
	uid_t			ar_arg_suid;
	gid_t			ar_arg_egid;
	gid_t			ar_arg_rgid;
	gid_t			ar_arg_sgid;
	pid_t			ar_arg_pid;
	pid_t			ar_arg_asid;
	struct au_tid		ar_arg_termid;
	struct au_tid_addr	ar_arg_termid_addr;
	uid_t			ar_arg_uid;
	uid_t			ar_arg_auid;
	gid_t			ar_arg_gid;
	struct groupset		ar_arg_groups;
	int			ar_arg_fd;
	int			ar_arg_fflags;
	mode_t			ar_arg_mode;
	uint32_t		ar_arg_value32;
	uint64_t		ar_arg_value64;
	user_addr_t		ar_arg_addr;
	user_size_t		ar_arg_len;
	int			ar_arg_mask;
	u_int			ar_arg_signum;
	char			ar_arg_login[MAXLOGNAME];
	int			ar_arg_ctlname[CTL_MAXNAME];
	struct socket_au_info	ar_arg_sockinfo;
	char			*ar_arg_upath1;
	char			*ar_arg_upath2;
	char			*ar_arg_kpath1;		/* darwin-only */
	char			*ar_arg_kpath2;		/* darwin-only */
#if CONFIG_MACF
	char			*ar_vnode1_mac_labels;
	char			*ar_vnode2_mac_labels;
	char			*ar_cred_mac_labels;
	char			*ar_arg_mac_string;
#endif
	char			*ar_arg_text;
	void			*ar_arg_opaque;		/* darwin-only */
	void			*ar_arg_data;		/* darwin-only */
	u_int16_t		ar_arg_opq_size;	/* darwin-only */
	u_char			ar_arg_data_type;	/* darwin-only */
	u_char			ar_arg_data_count;	/* darwin-only */
	struct au_mask		ar_arg_amask;
	struct vnode_au_info	ar_arg_vnode1;
	struct vnode_au_info	ar_arg_vnode2;
	int			ar_arg_cmd;
	int			ar_arg_svipc_cmd;
	struct ipc_perm		ar_arg_svipc_perm;
	int			ar_arg_svipc_id;
	user_addr_t		ar_arg_svipc_addr;
	struct posix_ipc_perm	ar_arg_pipc_perm;
	mach_port_name_t	ar_arg_mach_port1;	/* darwin-only */
	mach_port_name_t	ar_arg_mach_port2;	/* darwin-only */
	union auditon_udata	ar_arg_auditon;
	char			*ar_arg_argv;
	int			ar_arg_argc;
	char			*ar_arg_envv;
	int			ar_arg_envc;
	int			ar_arg_exitstatus;
	int			ar_arg_exitretval;
	struct sockaddr_storage ar_arg_sockaddr;
	int			ar_arg_fd2;

#if CONFIG_MACF
	/*
	 * MAC security related fields added by MAC policies ar_forced_by_mac
	 * is 1 if mac_audit_check_preselect() forced this call to be audited,
	 * 0 otherwise.
 	 */
	LIST_HEAD(mac_audit_record_list_t, mac_audit_record)	*ar_mac_records;
	int			ar_forced_by_mac;
#endif
};

/*
 * Arguments in the audit record are initially not defined; flags are set to
 * indicate if they are present so they can be included in the audit log
 * stream only if defined.
 */
#define	ARG_IS_VALID(kar, arg)	((kar)->k_ar.ar_valid_arg & (arg))
#define	ARG_SET_VALID(kar, arg) do {					\
	(kar)->k_ar.ar_valid_arg |= (arg);				\
} while (0)

/*
 * Current thread macro.  get_bsdthread_info() returns a void ptr for some
 * reason.
 */
#define	curthread()	((struct uthread *)get_bsdthread_info(current_thread()))

/*
 * In-kernel version of audit record; the basic record plus queue meta-data.
 * This record can also have a pointer set to some opaque data that will be
 * passed through to the audit writing mechanism.
 */
struct kaudit_record {
	struct audit_record		 k_ar;
	u_int32_t			 k_ar_commit;
	void				*k_udata;	/* User data. */
	u_int				 k_ulen;	/* User data length. */
	struct uthread			*k_uthread;	/* Audited thread. */
	TAILQ_ENTRY(kaudit_record)	 k_q;
};
TAILQ_HEAD(kaudit_queue, kaudit_record);

/*
 * Functions to manage the allocation, release, and commit of kernel audit
 * records.
 */
void			 audit_abort(struct kaudit_record *ar);
void			 audit_commit(struct kaudit_record *ar, int error,
			    int retval);
struct kaudit_record	*audit_new(int event, proc_t p, struct uthread *td);

/*
 * Functions relating to the conversion of internal kernel audit records to
 * the BSM file format.
 */
struct au_record;
int	 kaudit_to_bsm(struct kaudit_record *kar, struct au_record **pau);
int	 bsm_rec_verify(void *rec);

/*
 * Kernel versions of the libbsm audit record functions.
 */
void	 kau_free(struct au_record *rec);
void	 kau_init(void);

/*
 * Return values for pre-selection and post-selection decisions.
 */
#define	AU_PRS_SUCCESS	1
#define	AU_PRS_FAILURE	2
#define	AU_PRS_BOTH	(AU_PRS_SUCCESS|AU_PRS_FAILURE)

/*
 * Data structures relating to the kernel audit queue.  Ideally, these might
 * be abstracted so that only accessor methods are exposed.
 */
extern struct mtx		audit_mtx;
extern struct cv		audit_watermark_cv;
extern struct cv		audit_worker_cv;
extern struct cv		audit_drain_cv;
extern struct kaudit_queue	audit_q;
extern int			audit_q_len;
extern int			audit_pre_q_len;
extern int			audit_in_failure;

/*
 * Flags to use on audit files when opening and closing.
 */
#define	AUDIT_OPEN_FLAGS	(FWRITE | O_APPEND)
#define	AUDIT_CLOSE_FLAGS	(FWRITE | O_APPEND)

#include <sys/fcntl.h>
#include <sys/kernel.h>
#include <sys/malloc.h>

/*
 * Some of the BSM tokenizer functions take different parameters in the
 * kernel implementations in order to save the copying of large kernel data
 * structures.  The prototypes of these functions are declared here.
 */
token_t		*kau_to_socket(struct socket_au_info *soi);

/*
 * audit_klib prototypes
 */
int		 au_preselect(au_event_t event, au_class_t class,
		    au_mask_t *mask_p, int sorf);
void		 au_evclassmap_init(void);
void		 au_evclassmap_insert(au_event_t event, au_class_t class);
au_class_t	 au_event_class(au_event_t event);
au_event_t	 audit_ctlname_to_sysctlevent(int name[], uint64_t valid_arg);
au_event_t	 audit_flags_and_error_to_openevent(int oflags, int error);
au_event_t	 audit_flags_and_error_to_openextendedevent(int oflags,
		    int error);
au_event_t	 audit_flags_and_error_to_openatevent(int oflags,
		    int error);
au_event_t	 audit_flags_and_error_to_openbyidevent(int oflags,
		    int error);
au_event_t	 audit_msgctl_to_event(int cmd);
au_event_t	 audit_semctl_to_event(int cmr);
int		 audit_canon_path(struct vnode *cwd_vp, char *path,
		    char *cpath);
au_event_t	 auditon_command_event(int cmd);
au_event_t	 audit_fcntl_command_event(int cmd, int oflags, int error);

/*
 * Audit trigger events notify user space of kernel audit conditions
 * asynchronously.
 */
int		 audit_send_trigger(unsigned int trigger);

/*
 * Accessor functions to manage global audit state.
 */
void		audit_set_kinfo(struct auditinfo_addr *);
void		audit_get_kinfo(struct auditinfo_addr *);

/*
 * General audit related functions.
 */
struct kaudit_record	*currecord(void);
void			 audit_free(struct kaudit_record *ar);
void			 audit_rotate_vnode(struct ucred *cred,
			    struct vnode *vp);
void			 audit_worker_init(void);

/*
 * Audit pipe functions.
 */
int	 audit_pipe_init(void);
int	 audit_pipe_shutdown(void);
int	 audit_pipe_preselect(au_id_t auid, au_event_t event,
	    au_class_t class, int sorf, int trail_select);
void	 audit_pipe_submit(au_id_t auid, au_event_t event, au_class_t class,
	    int sorf, int trail_select, void *record, u_int record_len);
void	 audit_pipe_submit_user(void *record, u_int record_len);

/*
 * Audit MAC prototypes.
 */
void	audit_mac_init(void);
int	audit_mac_new(proc_t p, struct kaudit_record *ar);
void	audit_mac_free(struct kaudit_record *ar);
int	audit_mac_syscall_enter(unsigned short code, proc_t p,
	    struct uthread *uthread, kauth_cred_t my_cred, au_event_t event);
int	audit_mac_syscall_exit(unsigned short code, struct uthread *uthread,
	    int error, int retval);

/*
 * Audit Session.
 */
void	audit_session_init(void);
int 	audit_session_setaia(proc_t p, auditinfo_addr_t *aia_p);
auditinfo_addr_t *audit_session_update(auditinfo_addr_t *new_aia);
int	audit_session_lookup(au_asid_t asid, auditinfo_addr_t *ret_aia);

/*
 * Kernel assigned audit session IDs start at PID_MAX + 1 and ends at
 * ASSIGNED_ASID_MAX.
 */
#define	ASSIGNED_ASID_MIN	(PID_MAX + 1)
#define	ASSIGNED_ASID_MAX	(0xFFFFFFFF - 1)

#endif /* defined(KERNEL) || defined(_KERNEL) */

#endif /* ! _SECURITY_AUDIT_PRIVATE_H_ */
Commit	Line	Data
b0d623f7	1	/*-
39037602	2	* Copyright (c) 1999-2016 Apple Inc.
b0d623f7 A	3	* All rights reserved.
	4	*
	5	* Redistribution and use in source and binary forms, with or without
	6	* modification, are permitted provided that the following conditions
	7	* are met:
	8	* 1. Redistributions of source code must retain the above copyright
	9	* notice, this list of conditions and the following disclaimer.
	10	* 2. Redistributions in binary form must reproduce the above copyright
	11	* notice, this list of conditions and the following disclaimer in the
	12	* documentation and/or other materials provided with the distribution.
	13	* 3. Neither the name of Apple Inc. ("Apple") nor the names of
	14	* its contributors may be used to endorse or promote products derived
	15	* from this software without specific prior written permission.
	16	*
	17	* THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND
	18	* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
	19	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
	20	* ARE DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR
	21	* ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
	22	* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
	23	* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
	24	* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
	25	* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
	26	* IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
	27	* POSSIBILITY OF SUCH DAMAGE.
	28	*/
	29	/*
	30	* NOTICE: This file was modified by SPARTA, Inc. in 2005 to introduce
	31	* support for mandatory and extensible security protections. This notice
	32	* is included in support of clause 2.2 (b) of the Apple Public License,
	33	* Version 2.0.
	34	*/
	35
	36	/*
	37	* This include file contains function prototypes and type definitions used
	38	* within the audit implementation.
	39	*/
	40
	41	#ifndef _SECURITY_AUDIT_PRIVATE_H_
	42	#define _SECURITY_AUDIT_PRIVATE_H_
	43
	44	#if defined(_KERNEL) \|\| defined(KERNEL)
	45
	46	#if CONFIG_MACF
	47	#include <sys/queue.h>
	48	#include <security/mac_framework.h>
	49	#endif
	50
	51	#include <sys/ipc.h>
	52	#include <sys/proc_internal.h> /* for PID_MAX */
	53	#include <sys/socket.h>
	54	#include <sys/ucred.h>
	55
	56	#ifdef MALLOC_DECLARE
	57	MALLOC_DECLARE(M_AUDITBSM);
	58	MALLOC_DECLARE(M_AUDITDATA);
	59	MALLOC_DECLARE(M_AUDITPATH);
	60	MALLOC_DECLARE(M_AUDITTEXT);
	61	#endif
	62
	63	/*
	64	* Audit control variables that are usually set/read via system calls and
	65	* used to control various aspects of auditing.
	66	*/
67	extern struct au_qctrl audit_qctrl;
68	extern struct audit_fstat audit_fstat;
69	extern struct au_mask audit_nae_mask;
70	extern int audit_panic_on_write_fail;
71	extern int audit_fail_stop;
72	extern int audit_argv;
73	extern int audit_arge;
74
75	/*
76	* Kernel mask that is used to check to see if system calls need to be audited.
77	*/
78	extern au_class_t audit_kevent_mask;
79
80	/*
81	* The macro used to check to see if the system calls need to be auditing.
82	* This will pessimisticly set the audit syscalls flag if the audit kevent
83	* mask has not been created yet. User code should build the event/class
84	* mapping table before setting preselection masks to avoid this.
85	*/
86	#define AUDIT_CHECK_IF_KEVENTS_MASK(m) do { \
87	if ((m).am_success \|\| (m).am_failure) \
88	if (!audit_kevent_mask \|\| \
89	(audit_kevent_mask & (m).am_success) \|\| \
90	(audit_kevent_mask & (m).am_failure)) \
91	audit_syscalls = 1; \
92	} while (0)
93
94	/*
95	* Success/failure conditions for the conversion of a kernel audit record to
96	* BSM format.
97	*/
98	#define BSM_SUCCESS 0
99	#define BSM_FAILURE 1
100	#define BSM_NOAUDIT 2
101
102	/*
103	* Defines for the kernel audit record k_ar_commit field. Flags are set to
104	* indicate what sort of record it is, and which preselection mechanism
105	* selected it.
106	*/
107	#define AR_COMMIT_KERNEL 0x00000001U
108	#define AR_COMMIT_USER 0x00000010U
109
110	#define AR_PRESELECT_TRAIL 0x00001000U
111	#define AR_PRESELECT_PIPE 0x00002000U
112
113	#define AR_PRESELECT_USER_TRAIL 0x00004000U
114	#define AR_PRESELECT_USER_PIPE 0x00008000U
115
6d2010ae A	116	#define AR_PRESELECT_FILTER 0x00010000U
6d2010ae A	117
b0d623f7 A	118	#define AR_DRAIN_QUEUE 0x80000000U
	119
	120	/*
	121	* Audit data is generated as a stream of struct audit_record structures,
	122	* linked by struct kaudit_record, and contain storage for possible audit so
	123	* that it will not need to be allocated during the processing of a system
	124	* call, both improving efficiency and avoiding sleeping at untimely moments.
	125	* This structure is converted to BSM format before being written to disk.
	126	*/
	127	struct vnode_au_info {
	128	mode_t vn_mode;
	129	uid_t vn_uid;
	130	gid_t vn_gid;
	131	dev_t vn_dev;
	132	long vn_fsid;
	133	long vn_fileid;
	134	long vn_gen;
	135	};
	136
	137	struct groupset {
	138	gid_t gidset[NGROUPS];
	139	u_int gidset_size;
	140	};
	141
	142	struct socket_au_info {
	143	int sai_domain;
	144	int sai_type;
	145	int sai_protocol;
	146
	147	/* Foreign (remote) address/port. */
	148	struct sockaddr_storage sai_faddr;
	149
	150	/* Local address/port. */
	151	struct sockaddr_storage sai_laddr;
	152	};
	153
	154	/*
	155	* The following is used for A_OLDSETQCTRL and A_OLDGETQCTRL and a 64-bit
	156	* userland.
	157	*/
	158	struct au_qctrl64 {
	159	u_int64_t aq64_hiwater;
	160	u_int64_t aq64_lowater;
	161	u_int64_t aq64_bufsz;
	162	u_int64_t aq64_delay;
	163	int64_t aq64_minfree;
	164	};
	165	typedef struct au_qctrl64 au_qctrl64_t;
	166
	167	union auditon_udata {
	168	char *au_path;
	169	int au_cond;
	170	int au_policy;
	171	int64_t au_cond64;
	172	int64_t au_policy64;
	173	int au_trigger;
	174	au_evclass_map_t au_evclass;
	175	au_mask_t au_mask;
6d2010ae	176	au_asflgs_t au_flags;
b0d623f7 A	177	auditinfo_t au_auinfo;
	178	auditpinfo_t au_aupinfo;
	179	auditpinfo_addr_t au_aupinfo_addr;
	180	au_qctrl_t au_qctrl;
	181	au_qctrl64_t au_qctrl64;
	182	au_stat_t au_stat;
	183	au_fstat_t au_fstat;
	184	auditinfo_addr_t au_kau_info;
	185	};
	186
	187	struct posix_ipc_perm {
	188	uid_t pipc_uid;
	189	gid_t pipc_gid;
	190	mode_t pipc_mode;
	191	};
	192
	193	struct audit_record {
	194	/* Audit record header. */
	195	u_int32_t ar_magic;
	196	int ar_event;
	197	int ar_retval; /* value returned to the process */
	198	int ar_errno; /* return status of system call */
	199	struct timespec ar_starttime;
	200	struct timespec ar_endtime;
	201	u_int64_t ar_valid_arg; /* Bitmask of valid arguments */
	202
	203	/* Audit subject information. */
	204	struct xucred ar_subj_cred;
	205	uid_t ar_subj_ruid;
	206	gid_t ar_subj_rgid;
	207	gid_t ar_subj_egid;
	208	uid_t ar_subj_auid; /* Audit user ID */
	209	pid_t ar_subj_asid; /* Audit session ID */
	210	pid_t ar_subj_pid;
	211	struct au_tid ar_subj_term;
	212	struct au_tid_addr ar_subj_term_addr;
	213	struct au_mask ar_subj_amask;
	214
	215	/* Operation arguments. */
	216	uid_t ar_arg_euid;
	217	uid_t ar_arg_ruid;
	218	uid_t ar_arg_suid;
	219	gid_t ar_arg_egid;
	220	gid_t ar_arg_rgid;
	221	gid_t ar_arg_sgid;
	222	pid_t ar_arg_pid;
	223	pid_t ar_arg_asid;
	224	struct au_tid ar_arg_termid;
	225	struct au_tid_addr ar_arg_termid_addr;
	226	uid_t ar_arg_uid;
	227	uid_t ar_arg_auid;
	228	gid_t ar_arg_gid;
	229	struct groupset ar_arg_groups;
	230	int ar_arg_fd;
	231	int ar_arg_fflags;
	232	mode_t ar_arg_mode;
	233	uint32_t ar_arg_value32;
	234	uint64_t ar_arg_value64;
	235	user_addr_t ar_arg_addr;
	236	user_size_t ar_arg_len;
	237	int ar_arg_mask;
	238	u_int ar_arg_signum;
	239	char ar_arg_login[MAXLOGNAME];
	240	int ar_arg_ctlname[CTL_MAXNAME];
241	struct socket_au_info ar_arg_sockinfo;
242	char *ar_arg_upath1;
243	char *ar_arg_upath2;
244	char ar_arg_kpath1; / darwin-only */
245	char ar_arg_kpath2; / darwin-only */
246	#if CONFIG_MACF
247	char *ar_vnode1_mac_labels;
248	char *ar_vnode2_mac_labels;
249	char *ar_cred_mac_labels;
250	char *ar_arg_mac_string;
251	#endif
252	char *ar_arg_text;
253	void ar_arg_opaque; / darwin-only */
254	void ar_arg_data; / darwin-only */
255	u_int16_t ar_arg_opq_size; /* darwin-only */
256	u_char ar_arg_data_type; /* darwin-only */
257	u_char ar_arg_data_count; /* darwin-only */
258	struct au_mask ar_arg_amask;
259	struct vnode_au_info ar_arg_vnode1;
260	struct vnode_au_info ar_arg_vnode2;
261	int ar_arg_cmd;
262	int ar_arg_svipc_cmd;
263	struct ipc_perm ar_arg_svipc_perm;
264	int ar_arg_svipc_id;
265	user_addr_t ar_arg_svipc_addr;
266	struct posix_ipc_perm ar_arg_pipc_perm;
267	mach_port_name_t ar_arg_mach_port1; /* darwin-only */
268	mach_port_name_t ar_arg_mach_port2; /* darwin-only */
269	union auditon_udata ar_arg_auditon;
270	char *ar_arg_argv;
271	int ar_arg_argc;
272	char *ar_arg_envv;
273	int ar_arg_envc;
274	int ar_arg_exitstatus;
275	int ar_arg_exitretval;
276	struct sockaddr_storage ar_arg_sockaddr;
39037602	277	int ar_arg_fd2;
b0d623f7 A	278
	279	#if CONFIG_MACF
	280	/*
	281	* MAC security related fields added by MAC policies ar_forced_by_mac
	282	* is 1 if mac_audit_check_preselect() forced this call to be audited,
	283	* 0 otherwise.
	284	*/
	285	LIST_HEAD(mac_audit_record_list_t, mac_audit_record) *ar_mac_records;
	286	int ar_forced_by_mac;
	287	#endif
	288	};
	289
	290	/*
	291	* Arguments in the audit record are initially not defined; flags are set to
	292	* indicate if they are present so they can be included in the audit log
	293	* stream only if defined.
	294	*/
	295	#define ARG_IS_VALID(kar, arg) ((kar)->k_ar.ar_valid_arg & (arg))
	296	#define ARG_SET_VALID(kar, arg) do { \
	297	(kar)->k_ar.ar_valid_arg \|= (arg); \
	298	} while (0)
	299
	300	/*
	301	* Current thread macro. get_bsdthread_info() returns a void ptr for some
	302	* reason.
	303	*/
	304	#define curthread() ((struct uthread *)get_bsdthread_info(current_thread()))
	305
	306	/*
	307	* In-kernel version of audit record; the basic record plus queue meta-data.
	308	* This record can also have a pointer set to some opaque data that will be
	309	* passed through to the audit writing mechanism.
	310	*/
	311	struct kaudit_record {
	312	struct audit_record k_ar;
	313	u_int32_t k_ar_commit;
	314	void k_udata; / User data. */
	315	u_int k_ulen; /* User data length. */
	316	struct uthread k_uthread; / Audited thread. */
	317	TAILQ_ENTRY(kaudit_record) k_q;
	318	};
	319	TAILQ_HEAD(kaudit_queue, kaudit_record);
	320
	321	/*
	322	* Functions to manage the allocation, release, and commit of kernel audit
	323	* records.
	324	*/
	325	void audit_abort(struct kaudit_record *ar);
	326	void audit_commit(struct kaudit_record *ar, int error,
	327	int retval);
	328	struct kaudit_record audit_new(int event, proc_t p, struct uthread td);
	329
	330	/*
	331	* Functions relating to the conversion of internal kernel audit records to
	332	* the BSM file format.
	333	*/
	334	struct au_record;
	335	int kaudit_to_bsm(struct kaudit_record kar, struct au_record *pau);
	336	int bsm_rec_verify(void *rec);
	337
	338	/*
	339	* Kernel versions of the libbsm audit record functions.
	340	*/
	341	void kau_free(struct au_record *rec);
342	void kau_init(void);
343
344	/*
345	* Return values for pre-selection and post-selection decisions.
346	*/
347	#define AU_PRS_SUCCESS 1
348	#define AU_PRS_FAILURE 2
349	#define AU_PRS_BOTH (AU_PRS_SUCCESS\|AU_PRS_FAILURE)
350
351	/*
352	* Data structures relating to the kernel audit queue. Ideally, these might
353	* be abstracted so that only accessor methods are exposed.
354	*/
355	extern struct mtx audit_mtx;
356	extern struct cv audit_watermark_cv;
357	extern struct cv audit_worker_cv;
358	extern struct cv audit_drain_cv;
359	extern struct kaudit_queue audit_q;
360	extern int audit_q_len;
361	extern int audit_pre_q_len;
362	extern int audit_in_failure;
363
364	/*
365	* Flags to use on audit files when opening and closing.
366	*/
367	#define AUDIT_OPEN_FLAGS (FWRITE \| O_APPEND)
368	#define AUDIT_CLOSE_FLAGS (FWRITE \| O_APPEND)
369
370	#include <sys/fcntl.h>
371	#include <sys/kernel.h>
372	#include <sys/malloc.h>
373
374	/*
375	* Some of the BSM tokenizer functions take different parameters in the
376	* kernel implementations in order to save the copying of large kernel data
377	* structures. The prototypes of these functions are declared here.
378	*/
379	token_t kau_to_socket(struct socket_au_info soi);
380
381	/*
382	* audit_klib prototypes
383	*/
384	int au_preselect(au_event_t event, au_class_t class,
385	au_mask_t *mask_p, int sorf);
386	void au_evclassmap_init(void);
387	void au_evclassmap_insert(au_event_t event, au_class_t class);
388	au_class_t au_event_class(au_event_t event);
389	au_event_t audit_ctlname_to_sysctlevent(int name[], uint64_t valid_arg);
390	au_event_t audit_flags_and_error_to_openevent(int oflags, int error);
391	au_event_t audit_flags_and_error_to_openextendedevent(int oflags,
392	int error);
fe8ab488 A	393	au_event_t audit_flags_and_error_to_openatevent(int oflags,
	394	int error);
	395	au_event_t audit_flags_and_error_to_openbyidevent(int oflags,
	396	int error);
b0d623f7 A	397	au_event_t audit_msgctl_to_event(int cmd);
	398	au_event_t audit_semctl_to_event(int cmr);
	399	int audit_canon_path(struct vnode cwd_vp, char path,
	400	char *cpath);
	401	au_event_t auditon_command_event(int cmd);
	402	au_event_t audit_fcntl_command_event(int cmd, int oflags, int error);
	403
	404	/*
	405	* Audit trigger events notify user space of kernel audit conditions
	406	* asynchronously.
	407	*/
	408	int audit_send_trigger(unsigned int trigger);
	409
	410	/*
	411	* Accessor functions to manage global audit state.
	412	*/
	413	void audit_set_kinfo(struct auditinfo_addr *);
	414	void audit_get_kinfo(struct auditinfo_addr *);
	415
	416	/*
	417	* General audit related functions.
	418	*/
	419	struct kaudit_record *currecord(void);
	420	void audit_free(struct kaudit_record *ar);
	421	void audit_rotate_vnode(struct ucred *cred,
	422	struct vnode *vp);
	423	void audit_worker_init(void);
	424
	425	/*
	426	* Audit pipe functions.
	427	*/
	428	int audit_pipe_init(void);
	429	int audit_pipe_shutdown(void);
	430	int audit_pipe_preselect(au_id_t auid, au_event_t event,
	431	au_class_t class, int sorf, int trail_select);
	432	void audit_pipe_submit(au_id_t auid, au_event_t event, au_class_t class,
	433	int sorf, int trail_select, void *record, u_int record_len);
	434	void audit_pipe_submit_user(void *record, u_int record_len);
	435
	436	/*
	437	* Audit MAC prototypes.
	438	*/
	439	void audit_mac_init(void);
	440	int audit_mac_new(proc_t p, struct kaudit_record *ar);
	441	void audit_mac_free(struct kaudit_record *ar);
	442	int audit_mac_syscall_enter(unsigned short code, proc_t p,
	443	struct uthread *uthread, kauth_cred_t my_cred, au_event_t event);
	444	int audit_mac_syscall_exit(unsigned short code, struct uthread *uthread,
	445	int error, int retval);
	446
	447	/*
	448	* Audit Session.
	449	*/
	450	void audit_session_init(void);
6d2010ae	451	int audit_session_setaia(proc_t p, auditinfo_addr_t *aia_p);
b0d623f7 A	452	auditinfo_addr_t audit_session_update(auditinfo_addr_t new_aia);
	453	int audit_session_lookup(au_asid_t asid, auditinfo_addr_t *ret_aia);
	454
	455	/*
	456	* Kernel assigned audit session IDs start at PID_MAX + 1 and ends at
	457	* ASSIGNED_ASID_MAX.
	458	*/
	459	#define ASSIGNED_ASID_MIN (PID_MAX + 1)
	460	#define ASSIGNED_ASID_MAX (0xFFFFFFFF - 1)
	461
	462	#endif /* defined(KERNEL) \|\| defined(_KERNEL) */
	463
	464	#endif /* ! _SECURITY_AUDIT_PRIVATE_H_ */