]> git.saurik.com Git - apple/xnu.git/blame_incremental - bsd/security/audit/audit_bsd.c
xnu-4570.41.2.tar.gz
[apple/xnu.git] / bsd / security / audit / audit_bsd.c
... / ...
CommitLineData
1/*-
2 * Copyright (c) 2008-2010 Apple Inc.
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 *
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in the
13 * documentation and/or other materials provided with the distribution.
14 * 3. Neither the name of Apple Inc. ("Apple") nor the names of
15 * its contributors may be used to endorse or promote products derived
16 * from this software without specific prior written permission.
17 *
18 * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
19 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
20 * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
21 * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
22 * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
23 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
24 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
25 * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
26 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
27 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
28 */
29
30#include <string.h>
31
32#include <sys/kernel.h>
33#include <sys/proc.h>
34#include <sys/systm.h>
35
36#include <kern/host.h>
37#include <kern/kalloc.h>
38#include <kern/locks.h>
39#include <kern/sched_prim.h>
40
41#include <libkern/OSAtomic.h>
42
43#include <bsm/audit.h>
44#include <bsm/audit_internal.h>
45
46#include <security/audit/audit_bsd.h>
47#include <security/audit/audit.h>
48#include <security/audit/audit_private.h>
49
50#include <mach/host_priv.h>
51#include <mach/host_special_ports.h>
52#include <mach/audit_triggers_server.h>
53
54extern void ipc_port_release_send(ipc_port_t port);
55
56#if CONFIG_AUDIT
57struct mhdr {
58 size_t mh_size;
59 au_malloc_type_t *mh_type;
60 u_long mh_magic;
61 char mh_data[0];
62};
63
64/*
65 * The lock group for the audit subsystem.
66 */
67static lck_grp_t *audit_lck_grp = NULL;
68
69#define AUDIT_MHMAGIC 0x4D656C53
70
71#if AUDIT_MALLOC_DEBUG
72#define AU_MAX_SHORTDESC 20
73#define AU_MAX_LASTCALLER 20
74struct au_malloc_debug_info {
75 SInt64 md_size;
76 SInt64 md_maxsize;
77 SInt32 md_inuse;
78 SInt32 md_maxused;
79 unsigned md_type;
80 unsigned md_magic;
81 char md_shortdesc[AU_MAX_SHORTDESC];
82 char md_lastcaller[AU_MAX_LASTCALLER];
83};
84typedef struct au_malloc_debug_info au_malloc_debug_info_t;
85
86au_malloc_type_t *audit_malloc_types[NUM_MALLOC_TYPES];
87
88static int audit_sysctl_malloc_debug(struct sysctl_oid *oidp, void *arg1,
89 int arg2, struct sysctl_req *req);
90
91SYSCTL_PROC(_kern, OID_AUTO, audit_malloc_debug, CTLFLAG_RD, NULL, 0,
92 audit_sysctl_malloc_debug, "S,audit_malloc_debug",
93 "Current malloc debug info for auditing.");
94
95#define AU_MALLOC_DBINFO_SZ \
96 (NUM_MALLOC_TYPES * sizeof(au_malloc_debug_info_t))
97
98/*
99 * Copy out the malloc debug info via the sysctl interface. The userland code
100 * is something like the following:
101 *
102 * error = sysctlbyname("kern.audit_malloc_debug", buffer_ptr, &buffer_len,
103 * NULL, 0);
104 */
105static int
106audit_sysctl_malloc_debug(__unused struct sysctl_oid *oidp, __unused void *arg1,
107 __unused int arg2, struct sysctl_req *req)
108{
109 int i;
110 size_t sz;
111 au_malloc_debug_info_t *amdi_ptr, *nxt_ptr;
112 int err;
113
114 /*
115 * This provides a read-only node.
116 */
117 if (req->newptr != USER_ADDR_NULL)
118 return (EPERM);
119
120 /*
121 * If just querying then return the space required.
122 */
123 if (req->oldptr == USER_ADDR_NULL) {
124 req->oldidx = AU_MALLOC_DBINFO_SZ;
125 return (0);
126 }
127
128 /*
129 * Alloc a temporary buffer.
130 */
131 if (req->oldlen < AU_MALLOC_DBINFO_SZ)
132 return (ENOMEM);
133 amdi_ptr = (au_malloc_debug_info_t *)kalloc(AU_MALLOC_DBINFO_SZ);
134 if (amdi_ptr == NULL)
135 return (ENOMEM);
136 bzero(amdi_ptr, AU_MALLOC_DBINFO_SZ);
137
138 /*
139 * Build the record array.
140 */
141 sz = 0;
142 nxt_ptr = amdi_ptr;
143 for(i = 0; i < NUM_MALLOC_TYPES; i++) {
144 if (audit_malloc_types[i] == NULL)
145 continue;
146 if (audit_malloc_types[i]->mt_magic != M_MAGIC) {
147 nxt_ptr->md_magic = audit_malloc_types[i]->mt_magic;
148 continue;
149 }
150 nxt_ptr->md_magic = audit_malloc_types[i]->mt_magic;
151 nxt_ptr->md_size = audit_malloc_types[i]->mt_size;
152 nxt_ptr->md_maxsize = audit_malloc_types[i]->mt_maxsize;
153 nxt_ptr->md_inuse = (int)audit_malloc_types[i]->mt_inuse;
154 nxt_ptr->md_maxused = (int)audit_malloc_types[i]->mt_maxused;
155 strlcpy(nxt_ptr->md_shortdesc,
156 audit_malloc_types[i]->mt_shortdesc, AU_MAX_SHORTDESC - 1);
157 strlcpy(nxt_ptr->md_lastcaller,
158 audit_malloc_types[i]->mt_lastcaller, AU_MAX_LASTCALLER-1);
159 sz += sizeof(au_malloc_debug_info_t);
160 nxt_ptr++;
161 }
162
163 req->oldlen = sz;
164 err = SYSCTL_OUT(req, amdi_ptr, sz);
165 kfree(amdi_ptr, AU_MALLOC_DBINFO_SZ);
166
167 return (err);
168}
169#endif /* AUDIT_MALLOC_DEBUG */
170
171/*
172 * BSD malloc()
173 *
174 * If the M_NOWAIT flag is set then it may not block and return NULL.
175 * If the M_ZERO flag is set then zero out the buffer.
176 */
177void *
178#if AUDIT_MALLOC_DEBUG
179_audit_malloc(size_t size, au_malloc_type_t *type, int flags, const char *fn)
180#else
181_audit_malloc(size_t size, au_malloc_type_t *type, int flags)
182#endif
183{
184 struct mhdr *hdr;
185 size_t memsize = sizeof (*hdr) + size;
186
187 if (size == 0)
188 return (NULL);
189 if (flags & M_NOWAIT) {
190 hdr = (void *)kalloc_noblock(memsize);
191 } else {
192 hdr = (void *)kalloc(memsize);
193 if (hdr == NULL)
194 panic("_audit_malloc: kernel memory exhausted");
195 }
196 if (hdr == NULL)
197 return (NULL);
198 hdr->mh_size = memsize;
199 hdr->mh_type = type;
200 hdr->mh_magic = AUDIT_MHMAGIC;
201 if (flags & M_ZERO)
202 memset(hdr->mh_data, 0, size);
203#if AUDIT_MALLOC_DEBUG
204 if (type != NULL && type->mt_type < NUM_MALLOC_TYPES) {
205 OSAddAtomic64(memsize, &type->mt_size);
206 type->mt_maxsize = max(type->mt_size, type->mt_maxsize);
207 OSAddAtomic(1, &type->mt_inuse);
208 type->mt_maxused = max(type->mt_inuse, type->mt_maxused);
209 type->mt_lastcaller = fn;
210 audit_malloc_types[type->mt_type] = type;
211 }
212#endif /* AUDIT_MALLOC_DEBUG */
213 return (hdr->mh_data);
214}
215
216/*
217 * BSD free()
218 */
219void
220#if AUDIT_MALLOC_DEBUG
221_audit_free(void *addr, au_malloc_type_t *type)
222#else
223_audit_free(void *addr, __unused au_malloc_type_t *type)
224#endif
225{
226 struct mhdr *hdr;
227
228 if (addr == NULL)
229 return;
230 hdr = addr; hdr--;
231
232 KASSERT(hdr->mh_magic == AUDIT_MHMAGIC,
233 ("_audit_free(): hdr->mh_magic != AUDIT_MHMAGIC"));
234
235#if AUDIT_MALLOC_DEBUG
236 if (type != NULL) {
237 OSAddAtomic64(-hdr->mh_size, &type->mt_size);
238 OSAddAtomic(-1, &type->mt_inuse);
239 }
240#endif /* AUDIT_MALLOC_DEBUG */
241 kfree(hdr, hdr->mh_size);
242}
243
244/*
245 * Initialize a condition variable. Must be called before use.
246 */
247void
248_audit_cv_init(struct cv *cvp, const char *desc)
249{
250
251 if (desc == NULL)
252 cvp->cv_description = "UNKNOWN";
253 else
254 cvp->cv_description = desc;
255 cvp->cv_waiters = 0;
256}
257
258/*
259 * Destory a condition variable.
260 */
261void
262_audit_cv_destroy(struct cv *cvp)
263{
264
265 cvp->cv_description = NULL;
266 cvp->cv_waiters = 0;
267}
268
269/*
270 * Signal a condition variable, wakes up one waiting thread.
271 */
272void
273_audit_cv_signal(struct cv *cvp)
274{
275
276 if (cvp->cv_waiters > 0) {
277 wakeup_one((caddr_t)cvp);
278 cvp->cv_waiters--;
279 }
280}
281
282/*
283 * Broadcast a signal to a condition variable.
284 */
285void
286_audit_cv_broadcast(struct cv *cvp)
287{
288
289 if (cvp->cv_waiters > 0) {
290 wakeup((caddr_t)cvp);
291 cvp->cv_waiters = 0;
292 }
293}
294
295/*
296 * Wait on a condition variable. A cv_signal or cv_broadcast on the same
297 * condition variable will resume the thread. It is recommended that the mutex
298 * be held when cv_signal or cv_broadcast are called.
299 */
300void
301_audit_cv_wait(struct cv *cvp, lck_mtx_t *mp, const char *desc)
302{
303
304 cvp->cv_waiters++;
305 (void) msleep(cvp, mp, PZERO, desc, 0);
306}
307
308/*
309 * Wait on a condition variable, allowing interruption by signals. Return 0
310 * if the thread was resumed with cv_signal or cv_broadcast, EINTR or
311 * ERESTART if a signal was caught. If ERESTART is returned the system call
312 * should be restarted if possible.
313 */
314int
315_audit_cv_wait_sig(struct cv *cvp, lck_mtx_t *mp, const char *desc)
316{
317
318 cvp->cv_waiters++;
319 return (msleep(cvp, mp, PSOCK | PCATCH, desc, 0));
320}
321
322/*
323 * BSD Mutexes.
324 */
325void
326#if DIAGNOSTIC
327_audit_mtx_init(struct mtx *mp, const char *lckname)
328#else
329_audit_mtx_init(struct mtx *mp, __unused const char *lckname)
330#endif
331{
332 mp->mtx_lock = lck_mtx_alloc_init(audit_lck_grp, LCK_ATTR_NULL);
333 KASSERT(mp->mtx_lock != NULL,
334 ("_audit_mtx_init: Could not allocate a mutex."));
335#if DIAGNOSTIC
336 strlcpy(mp->mtx_name, lckname, AU_MAX_LCK_NAME);
337#endif
338}
339
340void
341_audit_mtx_destroy(struct mtx *mp)
342{
343
344 if (mp->mtx_lock) {
345 lck_mtx_free(mp->mtx_lock, audit_lck_grp);
346 mp->mtx_lock = NULL;
347 }
348}
349
350/*
351 * BSD rw locks.
352 */
353void
354#if DIAGNOSTIC
355_audit_rw_init(struct rwlock *lp, const char *lckname)
356#else
357_audit_rw_init(struct rwlock *lp, __unused const char *lckname)
358#endif
359{
360 lp->rw_lock = lck_rw_alloc_init(audit_lck_grp, LCK_ATTR_NULL);
361 KASSERT(lp->rw_lock != NULL,
362 ("_audit_rw_init: Could not allocate a rw lock."));
363#if DIAGNOSTIC
364 strlcpy(lp->rw_name, lckname, AU_MAX_LCK_NAME);
365#endif
366}
367
368void
369_audit_rw_destroy(struct rwlock *lp)
370{
371
372 if (lp->rw_lock) {
373 lck_rw_free(lp->rw_lock, audit_lck_grp);
374 lp->rw_lock = NULL;
375 }
376}
377/*
378 * Wait on a condition variable in a continuation (i.e. yield kernel stack).
379 * A cv_signal or cv_broadcast on the same condition variable will cause
380 * the thread to be scheduled.
381 */
382int
383_audit_cv_wait_continuation(struct cv *cvp, lck_mtx_t *mp, thread_continue_t function)
384{
385 int status = KERN_SUCCESS;
386
387 cvp->cv_waiters++;
388 assert_wait(cvp, THREAD_UNINT);
389 lck_mtx_unlock(mp);
390
391 status = thread_block(function);
392
393 /* should not be reached, but just in case, re-lock */
394 lck_mtx_lock(mp);
395
396 return status;
397}
398
399/*
400 * Simple recursive lock.
401 */
402void
403#if DIAGNOSTIC
404_audit_rlck_init(struct rlck *lp, const char *lckname)
405#else
406_audit_rlck_init(struct rlck *lp, __unused const char *lckname)
407#endif
408{
409
410 lp->rl_mtx = lck_mtx_alloc_init(audit_lck_grp, LCK_ATTR_NULL);
411 KASSERT(lp->rl_mtx != NULL,
412 ("_audit_rlck_init: Could not allocate a recursive lock."));
413#if DIAGNOSTIC
414 strlcpy(lp->rl_name, lckname, AU_MAX_LCK_NAME);
415#endif
416 lp->rl_thread = 0;
417 lp->rl_recurse = 0;
418}
419
420/*
421 * Recursive lock. Allow same thread to recursively lock the same lock.
422 */
423void
424_audit_rlck_lock(struct rlck *lp)
425{
426
427 if (lp->rl_thread == current_thread()) {
428 OSAddAtomic(1, &lp->rl_recurse);
429 KASSERT(lp->rl_recurse < 10000,
430 ("_audit_rlck_lock: lock nested too deep."));
431 } else {
432 lck_mtx_lock(lp->rl_mtx);
433 lp->rl_thread = current_thread();
434 lp->rl_recurse = 1;
435 }
436}
437
438/*
439 * Recursive unlock. It should be the same thread that does the unlock.
440 */
441void
442_audit_rlck_unlock(struct rlck *lp)
443{
444 KASSERT(lp->rl_thread == current_thread(),
445 ("_audit_rlck_unlock(): Don't own lock."));
446
447 /* Note: OSAddAtomic returns old value. */
448 if (OSAddAtomic(-1, &lp->rl_recurse) == 1) {
449 lp->rl_thread = 0;
450 lck_mtx_unlock(lp->rl_mtx);
451 }
452}
453
454void
455_audit_rlck_destroy(struct rlck *lp)
456{
457
458 if (lp->rl_mtx) {
459 lck_mtx_free(lp->rl_mtx, audit_lck_grp);
460 lp->rl_mtx = NULL;
461 }
462}
463
464/*
465 * Recursive lock assert.
466 */
467void
468_audit_rlck_assert(struct rlck *lp, u_int assert)
469{
470 thread_t cthd = current_thread();
471
472 if (assert == LCK_MTX_ASSERT_OWNED && lp->rl_thread == cthd)
473 panic("recursive lock (%p) not held by this thread (%p).",
474 lp, cthd);
475 if (assert == LCK_MTX_ASSERT_NOTOWNED && lp->rl_thread != 0)
476 panic("recursive lock (%p) held by thread (%p).",
477 lp, cthd);
478}
479
480/*
481 * Simple sleep lock.
482 */
483void
484#if DIAGNOSTIC
485_audit_slck_init(struct slck *lp, const char *lckname)
486#else
487_audit_slck_init(struct slck *lp, __unused const char *lckname)
488#endif
489{
490
491 lp->sl_mtx = lck_mtx_alloc_init(audit_lck_grp, LCK_ATTR_NULL);
492 KASSERT(lp->sl_mtx != NULL,
493 ("_audit_slck_init: Could not allocate a sleep lock."));
494#if DIAGNOSTIC
495 strlcpy(lp->sl_name, lckname, AU_MAX_LCK_NAME);
496#endif
497 lp->sl_locked = 0;
498 lp->sl_waiting = 0;
499}
500
501/*
502 * Sleep lock lock. The 'intr' flag determines if the lock is interruptible.
503 * If 'intr' is true then signals or other events can interrupt the sleep lock.
504 */
505wait_result_t
506_audit_slck_lock(struct slck *lp, int intr)
507{
508 wait_result_t res = THREAD_AWAKENED;
509
510 lck_mtx_lock(lp->sl_mtx);
511 while (lp->sl_locked && res == THREAD_AWAKENED) {
512 lp->sl_waiting = 1;
513 res = lck_mtx_sleep(lp->sl_mtx, LCK_SLEEP_DEFAULT,
514 (event_t) lp, (intr) ? THREAD_INTERRUPTIBLE : THREAD_UNINT);
515 }
516 if (res == THREAD_AWAKENED)
517 lp->sl_locked = 1;
518 lck_mtx_unlock(lp->sl_mtx);
519
520 return (res);
521}
522
523/*
524 * Sleep lock unlock. Wake up all the threads waiting for this lock.
525 */
526void
527_audit_slck_unlock(struct slck *lp)
528{
529
530 lck_mtx_lock(lp->sl_mtx);
531 lp->sl_locked = 0;
532 if (lp->sl_waiting) {
533 lp->sl_waiting = 0;
534
535 /* Wake up *all* sleeping threads. */
536 wakeup((event_t) lp);
537 }
538 lck_mtx_unlock(lp->sl_mtx);
539}
540
541/*
542 * Sleep lock try. Don't sleep if it doesn't get the lock.
543 */
544int
545_audit_slck_trylock(struct slck *lp)
546{
547 int result;
548
549 lck_mtx_lock(lp->sl_mtx);
550 result = !lp->sl_locked;
551 if (result)
552 lp->sl_locked = 1;
553 lck_mtx_unlock(lp->sl_mtx);
554
555 return (result);
556}
557
558/*
559 * Sleep lock assert.
560 */
561void
562_audit_slck_assert(struct slck *lp, u_int assert)
563{
564
565 if (assert == LCK_MTX_ASSERT_OWNED && lp->sl_locked == 0)
566 panic("sleep lock (%p) not held.", lp);
567 if (assert == LCK_MTX_ASSERT_NOTOWNED && lp->sl_locked == 1)
568 panic("sleep lock (%p) held.", lp);
569}
570
571void
572_audit_slck_destroy(struct slck *lp)
573{
574
575 if (lp->sl_mtx) {
576 lck_mtx_free(lp->sl_mtx, audit_lck_grp);
577 lp->sl_mtx = NULL;
578 }
579}
580
581/*
582 * XXXss - This code was taken from bsd/netinet6/icmp6.c. Maybe ppsratecheck()
583 * should be made global in icmp6.c.
584 */
585#ifndef timersub
586#define timersub(tvp, uvp, vvp) \
587 do { \
588 (vvp)->tv_sec = (tvp)->tv_sec - (uvp)->tv_sec; \
589 (vvp)->tv_usec = (tvp)->tv_usec - (uvp)->tv_usec; \
590 if ((vvp)->tv_usec < 0) { \
591 (vvp)->tv_sec--; \
592 (vvp)->tv_usec += 1000000; \
593 } \
594 } while (0)
595#endif
596
597/*
598 * Packets (or events) per second limitation.
599 */
600int
601_audit_ppsratecheck(struct timeval *lasttime, int *curpps, int maxpps)
602{
603 struct timeval tv, delta;
604 int rv;
605
606 microtime(&tv);
607
608 timersub(&tv, lasttime, &delta);
609
610 /*
611 * Check for 0,0 so that the message will be seen at least once.
612 * If more than one second has passed since the last update of
613 * lasttime, reset the counter.
614 *
615 * we do increment *curpps even in *curpps < maxpps case, as some may
616 * try to use *curpps for stat purposes as well.
617 */
618 if ((lasttime->tv_sec == 0 && lasttime->tv_usec == 0) ||
619 delta.tv_sec >= 1) {
620 *lasttime = tv;
621 *curpps = 0;
622 rv = 1;
623 } else if (maxpps < 0)
624 rv = 1;
625 else if (*curpps < maxpps)
626 rv = 1;
627 else
628 rv = 0;
629 if (*curpps + 1 > 0)
630 *curpps = *curpps + 1;
631
632 return (rv);
633}
634
635/*
636 * Initialize lock group for audit related locks/mutexes.
637 */
638void
639_audit_lck_grp_init(void)
640{
641 audit_lck_grp = lck_grp_alloc_init("Audit", LCK_GRP_ATTR_NULL);
642
643 KASSERT(audit_lck_grp != NULL,
644 ("audit_get_lck_grp: Could not allocate the audit lock group."));
645}
646
647int
648audit_send_trigger(unsigned int trigger)
649{
650 mach_port_t audit_port;
651 int error;
652
653 error = host_get_audit_control_port(host_priv_self(), &audit_port);
654 if (error == KERN_SUCCESS && audit_port != MACH_PORT_NULL) {
655 (void)audit_triggers(audit_port, trigger);
656 ipc_port_release_send(audit_port);
657 return (0);
658 } else {
659 printf("Cannot get audit control port\n");
660 return (error);
661 }
662}
663#endif /* CONFIG_AUDIT */