bsd/vfs/vfs_fslog.c

   1 /*
   2  * Copyright (c) 2006-2014 Apple Inc. All rights reserved.
   3  *
   4  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. The rights granted to you under the License
  10  * may not be used to create, or enable the creation or redistribution of,
  11  * unlawful or unlicensed copies of an Apple operating system, or to
  12  * circumvent, violate, or enable the circumvention or violation of, any
  13  * terms of an Apple operating system software license agreement.
  14  *
  15  * Please obtain a copy of the License at
  16  * http://www.opensource.apple.com/apsl/ and read it before using this file.
  17  *
  18  * The Original Code and all software distributed under the License are
  19  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  20  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  21  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  22  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  23  * Please see the License for the specific language governing rights and
  24  * limitations under the License.
  25  *
  26  * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
  27  */
  28
  29 #include <sys/errno.h>
  30 #include <sys/types.h>
  31 #include <sys/malloc.h>
  32 #include <sys/buf.h>
  33 #include <sys/time.h>
  34 #include <sys/kauth.h>
  35 #include <sys/mount.h>
  36 #include <sys/vnode.h>
  37 #include <sys/syslog.h>
  38 #include <sys/vnode_internal.h>
  39 #include <sys/fslog.h>
  40 #include <sys/mount_internal.h>
  41 #include <sys/kasl.h>
  42
  43 #include <dev/random/randomdev.h>
  44
  45 #include <uuid/uuid.h>
  46
  47 #include <stdarg.h>
  48
  49 /* Log information about external modification of a process,
  50  * using MessageTracer formatting. Assumes that both the caller
  51  * and target are appropriately locked.
  52  * Currently prints following information -
  53  *      1. Caller process name (truncated to 16 characters)
  54  *      2. Caller process Mach-O UUID
  55  *  3. Target process name (truncated to 16 characters)
  56  *  4. Target process Mach-O UUID
  57  */
  58 void
  59 fslog_extmod_msgtracer(proc_t caller, proc_t target)
  60 {
  61         if ((caller != PROC_NULL) && (target != PROC_NULL)) {
  62
  63                 /*
  64                  * Print into buffer large enough for "ThisIsAnApplicat(BC223DD7-B314-42E0-B6B0-C5D2E6638337)",
  65                  * including space for escaping, and NUL byte included in sizeof(uuid_string_t).
  66                  */
  67
  68                 uuid_string_t uuidstr;
  69                 char c_name[2*MAXCOMLEN + 2 /* () */ + sizeof(uuid_string_t)];
  70                 char t_name[2*MAXCOMLEN + 2 /* () */ + sizeof(uuid_string_t)];
  71
  72                 strlcpy(c_name, caller->p_comm, sizeof(c_name));
  73                 uuid_unparse_upper(caller->p_uuid, uuidstr);
  74                 strlcat(c_name, "(", sizeof(c_name));
  75                 strlcat(c_name, uuidstr, sizeof(c_name));
  76                 strlcat(c_name, ")", sizeof(c_name));
  77                 if (0 != escape_str(c_name, strlen(c_name), sizeof(c_name))) {
  78                         return;
  79                 }
  80
  81                 strlcpy(t_name, target->p_comm, sizeof(t_name));
  82                 uuid_unparse_upper(target->p_uuid, uuidstr);
  83                 strlcat(t_name, "(", sizeof(t_name));
  84                 strlcat(t_name, uuidstr, sizeof(t_name));
  85                 strlcat(t_name, ")", sizeof(t_name));
  86                 if (0 != escape_str(t_name, strlen(t_name), sizeof(t_name))) {
  87                         return;
  88                 }
  89 #if DEBUG
  90                 printf("EXTMOD: %s(%d) -> %s(%d)\n",
  91                            c_name,
  92                            proc_pid(caller),
  93                            t_name,
  94                            proc_pid(target));
  95 #endif
  96
  97                 kern_asl_msg(LOG_DEBUG, "messagetracer",
  98                                                         5,
  99                                                         "com.apple.message.domain", "com.apple.kernel.external_modification", /* 0 */
 100                                                         "com.apple.message.signature", c_name, /* 1 */
 101                                                         "com.apple.message.signature2", t_name, /* 2 */
 102                                                         "com.apple.message.result", "noop", /* 3 */
 103                                                         "com.apple.message.summarize", "YES", /* 4 */
 104                                                         NULL);
 105         }
 106 }
 107