]> git.saurik.com Git - apple/xnu.git/blob - bsd/kern/kern_bsm_klib.c
projects / apple / xnu.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
xnu-517.7.7.tar.gz
[apple/xnu.git] / bsd / kern / kern_bsm_klib.c
1 /*
2 * Copyright (c) 2004 Apple Computer, Inc. All rights reserved.
3 *
4 * @APPLE_LICENSE_HEADER_START@
5 *
6 * The contents of this file constitute Original Code as defined in and
7 * are subject to the Apple Public Source License Version 1.1 (the
8 * "License"). You may not use this file except in compliance with the
9 * License. Please obtain a copy of the License at
10 * http://www.apple.com/publicsource and read it before using this file.
11 *
12 * This Original Code and all software distributed under the License are
13 * distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY KIND, EITHER
14 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
15 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
16 * FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT. Please see the
17 * License for the specific language governing rights and limitations
18 * under the License.
19 *
20 * @APPLE_LICENSE_HEADER_END@
21 */
22
23 #include <sys/types.h>
24 #include <sys/vnode.h>
25 #include <sys/fcntl.h>
26 #include <sys/filedesc.h>
27 #include <sys/sem.h>
28
29 #include <bsm/audit.h>
30 #include <bsm/audit_kernel.h>
31 #include <bsm/audit_kevents.h>
32 #include <bsm/audit_klib.h>
33
34 /*
35 * Initialize the system call to audit event mapping table. This table
36 * must be kept in sync with the system call table. This table is meant to
37 * be directly accessed.
38 * XXX This should be improved, though, to make it independent of the syscall
39 * table (but we don't want to traverse a large table for every system call
40 * to find a match). Ultimately, it would be best to place the audit event
41 * number in the system call table.
42 */
43 au_event_t sys_au_event[] = {
44 AUE_NULL, /* 0 = indir */
45 AUE_EXIT, /* 1 = exit */
46 AUE_FORK, /* 2 = fork */
47 AUE_NULL, /* 3 = read */
48 AUE_NULL, /* 4 = write */
49 AUE_OPEN_RWTC, /* 5 = open */
50 AUE_CLOSE, /* 6 = close */
51 AUE_NULL, /* 7 = wait4 */
52 AUE_O_CREAT, /* 8 = old creat */
53 AUE_LINK, /* 9 = link */
54 AUE_UNLINK, /* 10 = unlink */
55 AUE_NULL, /* 11 was obsolete execv */
56 AUE_CHDIR, /* 12 = chdir */
57 AUE_FCHDIR, /* 13 = fchdir */
58 AUE_MKNOD, /* 14 = mknod */
59 AUE_CHMOD, /* 15 = chmod */
60 AUE_CHOWN, /* 16 = chown; now 3 args */
61 AUE_NULL, /* 17 = old break */
62 #if COMPAT_GETFSSTAT
63 AUE_GETFSSTAT, /* 18 = getfsstat */
64 #else
65 AUE_NULL, /* 18 = ogetfsstat */
66 #endif
67 AUE_NULL, /* 19 = old lseek */
68 AUE_NULL, /* 20 = getpid */
69 AUE_NULL, /* 21 was obsolete mount */
70 AUE_NULL, /* 22 was obsolete umount */
71 AUE_SETUID, /* 23 = setuid */
72 AUE_NULL, /* 24 = getuid */
73 AUE_NULL, /* 25 = geteuid */
74 AUE_PTRACE, /* 26 = ptrace */
75 AUE_RECVMSG, /* 27 = recvmsg */
76 AUE_SENDMSG, /* 28 = sendmsg */
77 AUE_RECVFROM, /* 29 = recvfrom */
78 AUE_ACCEPT, /* 30 = accept */
79 AUE_NULL, /* 31 = getpeername */
80 AUE_NULL, /* 32 = getsockname */
81 AUE_ACCESS, /* 33 = access */
82 AUE_CHFLAGS, /* 34 = chflags */
83 AUE_FCHFLAGS, /* 35 = fchflags */
84 AUE_NULL, /* 36 = sync */
85 AUE_KILL, /* 37 = kill */
86 AUE_O_STAT, /* 38 = old stat */
87 AUE_NULL, /* 39 = getppid */
88 AUE_O_LSTAT, /* 40 = old lstat */
89 AUE_NULL, /* 41 = dup */
90 AUE_PIPE, /* 42 = pipe */
91 AUE_NULL, /* 43 = getegid */
92 AUE_NULL, /* 44 = profil */
93 AUE_KTRACE, /* 45 = ktrace */
94 AUE_NULL, /* 46 = sigaction */
95 AUE_NULL, /* 47 = getgid */
96 AUE_NULL, /* 48 = sigprocmask */
97 AUE_NULL, /* 49 = getlogin */
98 AUE_SETLOGIN, /* 50 = setlogin */
99 AUE_ACCT, /* 51 = turn acct off/on */
100 AUE_NULL, /* 52 = sigpending */
101 AUE_NULL, /* 53 = sigaltstack */
102 AUE_IOCTL, /* 54 = ioctl */
103 AUE_REBOOT, /* 55 = reboot */
104 AUE_REVOKE, /* 56 = revoke */
105 AUE_SYMLINK, /* 57 = symlink */
106 AUE_READLINK, /* 58 = readlink */
107 AUE_EXECVE, /* 59 = execve */
108 AUE_UMASK, /* 60 = umask */
109 AUE_CHROOT, /* 61 = chroot */
110 AUE_O_FSTAT, /* 62 = old fstat */
111 AUE_NULL, /* 63 = used internally, reserved */
112 AUE_NULL, /* 64 = old getpagesize */
113 AUE_NULL, /* 65 = msync */
114 AUE_VFORK, /* 66 = vfork */
115 AUE_NULL, /* 67 was obsolete vread */
116 AUE_NULL, /* 68 was obsolete vwrite */
117 AUE_NULL, /* 69 = sbrk */
118 AUE_NULL, /* 70 = sstk */
119 AUE_O_MMAP, /* 71 = old mmap */
120 AUE_NULL, /* 72 = old vadvise */
121 AUE_MUNMAP, /* 73 = munmap */
122 AUE_MPROTECT, /* 74 = mprotect */
123 AUE_NULL, /* 75 = madvise */
124 AUE_NULL, /* 76 was obsolete vhangup */
125 AUE_NULL, /* 77 was obsolete vlimit */
126 AUE_NULL, /* 78 = mincore */
127 AUE_NULL, /* 79 = getgroups */
128 AUE_SETGROUPS, /* 80 = setgroups */
129 AUE_NULL, /* 81 = getpgrp */
130 AUE_SETPGRP, /* 82 = setpgid */
131 AUE_NULL, /* 83 = setitimer */
132 AUE_NULL, /* 84 = old wait */
133 AUE_NULL, /* 85 = swapon */
134 AUE_NULL, /* 86 = getitimer */
135 AUE_NULL, /* 87 = old gethostname */
136 AUE_O_SETHOSTNAME, /* 88 = old sethostname */
137 AUE_NULL, /* 89 getdtablesize */
138 AUE_NULL, /* 90 = dup2 */
139 AUE_NULL, /* 91 was obsolete getdopt */
140 AUE_FCNTL, /* 92 = fcntl */
141 AUE_NULL, /* 93 = select */
142 AUE_NULL, /* 94 was obsolete setdopt */
143 AUE_NULL, /* 95 = fsync */
144 AUE_SETPRIORITY, /* 96 = setpriority */
145 AUE_SOCKET, /* 97 = socket */
146 AUE_CONNECT, /* 98 = connect */
147 AUE_NULL, /* 99 = accept */
148 AUE_NULL, /* 100 = getpriority */
149 AUE_O_SEND, /* 101 = old send */
150 AUE_O_RECV, /* 102 = old recv */
151 AUE_NULL, /* 103 = sigreturn */
152 AUE_BIND, /* 104 = bind */
153 AUE_SETSOCKOPT, /* 105 = setsockopt */
154 AUE_NULL, /* 106 = listen */
155 AUE_NULL, /* 107 was vtimes */
156 AUE_NULL, /* 108 = sigvec */
157 AUE_NULL, /* 109 = sigblock */
158 AUE_NULL, /* 110 = sigsetmask */
159 AUE_NULL, /* 111 = sigpause */
160 AUE_NULL, /* 112 = sigstack */
161 AUE_O_RECVMSG, /* 113 = recvmsg */
162 AUE_O_SENDMSG, /* 114 = sendmsg */
163 AUE_NULL, /* 115 = old vtrace */
164 AUE_NULL, /* 116 = gettimeofday */
165 AUE_NULL, /* 117 = getrusage */
166 AUE_NULL, /* 118 = getsockopt */
167 AUE_NULL, /* 119 = old resuba */
168 AUE_NULL, /* 120 = readv */
169 AUE_NULL, /* 121 = writev */
170 AUE_SETTIMEOFDAY, /* 122 = settimeofday */
171 AUE_FCHOWN, /* 123 = fchown */
172 AUE_FCHMOD, /* 124 = fchmod */
173 AUE_O_RECVFROM, /* 125 = recvfrom */
174 AUE_NULL, /* 126 = setreuid */
175 AUE_NULL, /* 127 = setregid */
176 AUE_RENAME, /* 128 = rename */
177 AUE_O_TRUNCATE, /* 129 = old truncate */
178 AUE_O_FTRUNCATE, /* 130 = old ftruncate */
179 AUE_FLOCK, /* 131 = flock */
180 AUE_MKFIFO, /* 132 = mkfifo */
181 AUE_SENDTO, /* 133 = sendto */
182 AUE_SHUTDOWN, /* 134 = shutdown */
183 AUE_SOCKETPAIR, /* 135 = socketpair */
184 AUE_MKDIR, /* 136 = mkdir */
185 AUE_RMDIR, /* 137 = rmdir */
186 AUE_UTIMES, /* 138 = utimes */
187 AUE_FUTIMES, /* 139 = futimes */
188 AUE_ADJTIME, /* 140 = adjtime */
189 AUE_NULL, /* 141 = getpeername */
190 AUE_NULL, /* 142 = old gethostid */
191 AUE_NULL, /* 143 = old sethostid */
192 AUE_NULL, /* 144 = old getrlimit */
193 AUE_O_SETRLIMIT, /* 145 = old setrlimit */
194 AUE_O_KILLPG, /* 146 = old killpg */
195 AUE_SETSID, /* 147 = setsid */
196 AUE_NULL, /* 148 was setquota */
197 AUE_NULL, /* 149 was qquota */
198 AUE_NULL, /* 150 = getsockname */
199 AUE_NULL, /* 151 = getpgid */
200 AUE_SETPRIVEXEC, /* 152 = setprivexec */
201 AUE_NULL, /* 153 = pread */
202 AUE_NULL, /* 154 = pwrite */
203 AUE_NULL, /* 155 = nfs_svc */
204 AUE_O_GETDIRENTRIES, /* 156 = old getdirentries */
205 AUE_STATFS, /* 157 = statfs */
206 AUE_FSTATFS, /* 158 = fstatfs */
207 AUE_UMOUNT, /* 159 = unmount */
208 AUE_NULL, /* 160 was async_daemon */
209 AUE_GETFH, /* 161 = get file handle */
210 AUE_NULL, /* 162 = getdomainname */
211 AUE_O_SETDOMAINNAME, /* 163 = setdomainname */
212 AUE_NULL, /* 164 */
213 #if QUOTA
214 AUE_QUOTACTL, /* 165 = quotactl */
215 #else /* QUOTA */
216 AUE_NULL, /* 165 = not configured */
217 #endif /* QUOTA */
218 AUE_NULL, /* 166 was exportfs */
219 AUE_MOUNT, /* 167 = mount */
220 AUE_NULL, /* 168 was ustat */
221 AUE_NULL, /* 169 = nosys */
222 AUE_NULL, /* 170 was table */
223 AUE_NULL, /* 171 = old wait3 */
224 AUE_NULL, /* 172 was rpause */
225 AUE_NULL, /* 173 = nosys */
226 AUE_NULL, /* 174 was getdents */
227 AUE_NULL, /* 175 was gc_control */
228 AUE_NULL, /* 176 = add_profil */
229 AUE_NULL, /* 177 */
230 AUE_NULL, /* 178 */
231 AUE_NULL, /* 179 */
232 AUE_NULL, /* 180 */
233 AUE_SETGID, /* 181 */
234 AUE_SETEGID, /* 182 */
235 AUE_SETEUID, /* 183 */
236 AUE_NULL, /* 184 = nosys */
237 AUE_NULL, /* 185 = nosys */
238 AUE_NULL, /* 186 = nosys */
239 AUE_NULL, /* 187 = nosys */
240 AUE_STAT, /* 188 = stat */
241 AUE_FSTAT, /* 189 = fstat */
242 AUE_LSTAT, /* 190 = lstat */
243 AUE_PATHCONF, /* 191 = pathconf */
244 AUE_FPATHCONF, /* 192 = fpathconf */
245 #if COMPAT_GETFSSTAT
246 AUE_GETFSSTAT, /* 193 = getfsstat */
247 #else
248 AUE_NULL, /* 193 is unused */
249 #endif
250 AUE_NULL, /* 194 = getrlimit */
251 AUE_SETRLIMIT, /* 195 = setrlimit */
252 AUE_GETDIRENTRIES, /* 196 = getdirentries */
253 AUE_MMAP, /* 197 = mmap */
254 AUE_NULL, /* 198 = __syscall */
255 AUE_NULL, /* 199 = lseek */
256 AUE_TRUNCATE, /* 200 = truncate */
257 AUE_FTRUNCATE, /* 201 = ftruncate */
258 AUE_SYSCTL, /* 202 = __sysctl */
259 AUE_MLOCK, /* 203 = mlock */
260 AUE_MUNLOCK, /* 204 = munlock */
261 AUE_UNDELETE, /* 205 = undelete */
262 AUE_NULL, /* 206 = ATsocket */
263 AUE_NULL, /* 207 = ATgetmsg*/
264 AUE_NULL, /* 208 = ATputmsg*/
265 AUE_NULL, /* 209 = ATPsndreq*/
266 AUE_NULL, /* 210 = ATPsndrsp*/
267 AUE_NULL, /* 211 = ATPgetreq*/
268 AUE_NULL, /* 212 = ATPgetrsp*/
269 AUE_NULL, /* 213 = Reserved for AppleTalk */
270 AUE_NULL, /* 214 = Reserved for AppleTalk */
271 AUE_NULL, /* 215 = Reserved for AppleTalk */
272
273 AUE_NULL, /* 216 = HFS make complex file call (multipel forks */
274 AUE_NULL, /* 217 = HFS statv extended stat call for HFS */
275 AUE_NULL, /* 218 = HFS lstatv extended lstat call for HFS */
276 AUE_NULL, /* 219 = HFS fstatv extended fstat call for HFS */
277 AUE_GETATTRLIST,/* 220 = HFS getarrtlist get attribute list cal */
278 AUE_SETATTRLIST,/* 221 = HFS setattrlist set attribute list */
279 AUE_GETDIRENTRIESATTR,/* 222 = HFS getdirentriesattr get directory attributes */
280 AUE_EXCHANGEDATA,/* 223 = HFS exchangedata exchange file contents */
281 AUE_NULL,/* 224 = HFS checkuseraccess check access to a file */
282 AUE_SEARCHFS, /* 225 = HFS searchfs to implement catalog searching */
283 AUE_NULL, /* 226 = private delete (Carbon semantics) */
284 AUE_NULL, /* 227 = copyfile - orignally for AFP */
285 AUE_NULL, /* 228 */
286 AUE_NULL, /* 229 */
287 AUE_NULL, /* 230 */
288 AUE_NULL, /* 231 */
289 AUE_NULL, /* 232 */
290 AUE_NULL, /* 233 */
291 AUE_NULL, /* 234 */
292 AUE_NULL, /* 235 */
293 AUE_NULL, /* 236 */
294 AUE_NULL, /* 237 */
295 AUE_NULL, /* 238 */
296 AUE_NULL, /* 239 */
297 AUE_NULL, /* 240 */
298 AUE_NULL, /* 241 */
299 AUE_NULL, /* 242 = fsctl */
300 AUE_NULL, /* 243 */
301 AUE_NULL, /* 244 */
302 AUE_NULL, /* 245 */
303 AUE_NULL, /* 246 */
304 AUE_NULL, /* 247 = nfsclnt*/
305 AUE_NULL, /* 248 = fhopen */
306 AUE_NULL, /* 249 */
307 AUE_MINHERIT, /* 250 = minherit */
308 AUE_NULL, /* 251 = semsys */
309 AUE_NULL, /* 252 = msgsys */
310 AUE_NULL, /* 253 = shmsys */
311 AUE_SEMCTL, /* 254 = semctl */
312 AUE_SEMGET, /* 255 = semget */
313 AUE_SEMOP, /* 256 = semop */
314 AUE_NULL, /* 257 = semconfig */
315 AUE_MSGCTL, /* 258 = msgctl */
316 AUE_MSGGET, /* 259 = msgget */
317 AUE_MSGSND, /* 260 = msgsnd */
318 AUE_MSGRCV, /* 261 = msgrcv */
319 AUE_SHMAT, /* 262 = shmat */
320 AUE_SHMCTL, /* 263 = shmctl */
321 AUE_SHMDT, /* 264 = shmdt */
322 AUE_SHMGET, /* 265 = shmget */
323 AUE_SHMOPEN, /* 266 = shm_open */
324 AUE_SHMUNLINK, /* 267 = shm_unlink */
325 AUE_SEMOPEN, /* 268 = sem_open */
326 AUE_SEMCLOSE, /* 269 = sem_close */
327 AUE_SEMUNLINK, /* 270 = sem_unlink */
328 AUE_NULL, /* 271 = sem_wait */
329 AUE_NULL, /* 272 = sem_trywait */
330 AUE_NULL, /* 273 = sem_post */
331 AUE_NULL, /* 274 = sem_getvalue */
332 AUE_NULL, /* 275 = sem_init */
333 AUE_NULL, /* 276 = sem_destroy */
334 AUE_NULL, /* 277 */
335 AUE_NULL, /* 278 */
336 AUE_NULL, /* 279 */
337 AUE_NULL, /* 280 */
338 AUE_NULL, /* 281 */
339 AUE_NULL, /* 282 */
340 AUE_NULL, /* 283 */
341 AUE_NULL, /* 284 */
342 AUE_NULL, /* 285 */
343 AUE_NULL, /* 286 */
344 AUE_NULL, /* 287 */
345 AUE_NULL, /* 288 */
346 AUE_NULL, /* 289 */
347 AUE_NULL, /* 290 */
348 AUE_NULL, /* 291 */
349 AUE_NULL, /* 292 */
350 AUE_NULL, /* 293 */
351 AUE_NULL, /* 294 */
352 AUE_NULL, /* 295 */
353 AUE_LOADSHFILE, /* 296 = load_shared_file */
354 AUE_RESETSHFILE, /* 297 = reset_shared_file */
355 AUE_NEWSYSTEMSHREG, /* 298 = new_system_shared_regions */
356 AUE_NULL, /* 299 */
357 AUE_NULL, /* 300 */
358 AUE_NULL, /* 301 */
359 AUE_NULL, /* 302 */
360 AUE_NULL, /* 303 */
361 AUE_NULL, /* 304 */
362 AUE_NULL, /* 305 */
363 AUE_NULL, /* 306 */
364 AUE_NULL, /* 307 */
365 AUE_NULL, /* 308 */
366 AUE_NULL, /* 309 */
367 AUE_NULL, /* 310 = getsid */
368 AUE_NULL, /* 311 */
369 AUE_NULL, /* 312 */
370 AUE_NULL, /* 313 */
371 AUE_NULL, /* 314 */
372 AUE_NULL, /* 315 */
373 AUE_NULL, /* 316 */
374 AUE_NULL, /* 317 */
375 AUE_NULL, /* 318 */
376 AUE_NULL, /* 319 */
377 AUE_NULL, /* 320 */
378 AUE_NULL, /* 321 */
379 AUE_NULL, /* 322 */
380 AUE_NULL, /* 323 */
381 AUE_NULL, /* 324 = mlockall*/
382 AUE_NULL, /* 325 = munlockall*/
383 AUE_NULL, /* 326 */
384 AUE_NULL, /* 327 = issetugid */
385 AUE_NULL, /* 328 */
386 AUE_NULL, /* 329 */
387 AUE_NULL, /* 330 */
388 AUE_NULL, /* 331 */
389 AUE_NULL, /* 332 */
390 AUE_NULL, /* 333 */
391 AUE_NULL, /* 334 */
392 AUE_NULL, /* 335 = utrace */
393 AUE_NULL, /* 336 */
394 AUE_NULL, /* 337 */
395 AUE_NULL, /* 338 */
396 AUE_NULL, /* 339 */
397 AUE_NULL, /* 340 */
398 AUE_NULL, /* 341 */
399 AUE_NULL, /* 342 */
400 AUE_NULL, /* 343 */
401 AUE_NULL, /* 344 */
402 AUE_NULL, /* 345 */
403 AUE_NULL, /* 346 */
404 AUE_NULL, /* 347 */
405 AUE_NULL, /* 348 */
406 AUE_NULL, /* 349 */
407 AUE_AUDIT, /* 350 */
408 AUE_AUDITON, /* 351 */
409 AUE_NULL, /* 352 */
410 AUE_GETAUID, /* 353 */
411 AUE_SETAUID, /* 354 */
412 AUE_GETAUDIT, /* 355 */
413 AUE_SETAUDIT, /* 356 */
414 AUE_GETAUDIT_ADDR, /* 357 */
415 AUE_SETAUDIT_ADDR, /* 358 */
416 AUE_AUDITCTL, /* 359 */
417 AUE_NULL, /* 360 */
418 AUE_NULL, /* 361 */
419 AUE_NULL, /* 362 = kqueue */
420 AUE_NULL, /* 363 = kevent */
421 AUE_NULL, /* 364 */
422 AUE_NULL, /* 365 */
423 AUE_NULL, /* 366 */
424 AUE_NULL, /* 367 */
425 AUE_NULL, /* 368 */
426 AUE_NULL /* 369 */
427 };
428 int nsys_au_event = sizeof(sys_au_event) / sizeof(sys_au_event[0]);
429
430 /*
431 * Hash table functions for the audit event number to event class mask mapping.
432 */
433
434 #define EVCLASSMAP_HASH_TABLE_SIZE 251
435 struct evclass_elem {
436 au_event_t event;
437 au_class_t class;
438 LIST_ENTRY(evclass_elem) entry;
439 };
440 struct evclass_list {
441 LIST_HEAD(, evclass_elem) head;
442 };
443
444 struct evclass_list evclass_hash[EVCLASSMAP_HASH_TABLE_SIZE];
445
446 au_class_t au_event_class(au_event_t event)
447 {
448
449 struct evclass_list *evcl;
450 struct evclass_elem *evc;
451
452 evcl = &evclass_hash[event % EVCLASSMAP_HASH_TABLE_SIZE];
453
454 /* If an entry at our hash location matches the event, just return */
455 LIST_FOREACH(evc, &evcl->head, entry) {
456 if (evc->event == event)
457 return (evc->class);
458 }
459 return (AU_NULL);
460 }
461
462 /*
463 * Insert a event to class mapping. If the event already exists in the
464 * mapping, then replace the mapping with the new one.
465 * XXX There is currently no constraints placed on the number of mappings.
466 * May want to either limit to a number, or in terms of memory usage.
467 */
468 void au_evclassmap_insert(au_event_t event, au_class_t class)
469 {
470 struct evclass_list *evcl;
471 struct evclass_elem *evc;
472
473 evcl = &evclass_hash[event % EVCLASSMAP_HASH_TABLE_SIZE];
474
475 LIST_FOREACH(evc, &evcl->head, entry) {
476 if (evc->event == event) {
477 evc->class = class;
478 return;
479 }
480 }
481 kmem_alloc(kernel_map, &evc, sizeof(*evc));
482 if (evc == NULL) {
483 return;
484 }
485 evc->event = event;
486 evc->class = class;
487 LIST_INSERT_HEAD(&evcl->head, evc, entry);
488
489 }
490
491 void au_evclassmap_init()
492 {
493 int i;
494 for (i = 0; i < EVCLASSMAP_HASH_TABLE_SIZE; i++) {
495 LIST_INIT(&evclass_hash[i].head);
496 }
497
498 /* Set up the initial event to class mapping for system calls. */
499 for (i = 0; i < nsys_au_event; i++) {
500 if (sys_au_event[i] != AUE_NULL) {
501 au_evclassmap_insert(sys_au_event[i], AU_NULL);
502 }
503 }
504 /* Add the Mach system call events */
505 au_evclassmap_insert(AUE_TASKFORPID, AU_NULL);
506 au_evclassmap_insert(AUE_PIDFORTASK, AU_NULL);
507 au_evclassmap_insert(AUE_SWAPON, AU_NULL);
508 au_evclassmap_insert(AUE_SWAPOFF, AU_NULL);
509 au_evclassmap_insert(AUE_MAPFD, AU_NULL);
510 au_evclassmap_insert(AUE_INITPROCESS, AU_NULL);
511
512 /* Add the specific open events to the mapping. */
513 au_evclassmap_insert(AUE_OPEN_R, AU_FREAD);
514 au_evclassmap_insert(AUE_OPEN_RC, AU_FREAD|AU_FCREATE);
515 au_evclassmap_insert(AUE_OPEN_RTC, AU_FREAD|AU_FCREATE|AU_FDELETE);
516 au_evclassmap_insert(AUE_OPEN_RT, AU_FREAD|AU_FDELETE);
517 au_evclassmap_insert(AUE_OPEN_RW, AU_FREAD|AU_FWRITE);
518 au_evclassmap_insert(AUE_OPEN_RWC, AU_FREAD|AU_FWRITE|AU_FCREATE);
519 au_evclassmap_insert(AUE_OPEN_RWTC, AU_FREAD|AU_FWRITE|AU_FCREATE|AU_FDELETE);
520 au_evclassmap_insert(AUE_OPEN_RWT, AU_FREAD|AU_FWRITE|AU_FDELETE);
521 au_evclassmap_insert(AUE_OPEN_W, AU_FWRITE);
522 au_evclassmap_insert(AUE_OPEN_WC, AU_FWRITE|AU_FCREATE);
523 au_evclassmap_insert(AUE_OPEN_WTC, AU_FWRITE|AU_FCREATE|AU_FDELETE);
524 au_evclassmap_insert(AUE_OPEN_WT, AU_FWRITE|AU_FDELETE);
525 }
526
527 /*
528 * Check whether an event is aditable by comparing the mask of classes this
529 * event is part of against the given mask.
530 *
531 */
532 int au_preselect(au_event_t event, au_mask_t *mask_p, int sorf)
533 {
534 au_class_t effmask = 0;
535 au_class_t ae_class;
536
537 if(mask_p == NULL)
538 return (-1);
539
540 ae_class = au_event_class(event);
541 /*
542 * Perform the actual check of the masks against the event.
543 */
544 if (sorf & AU_PRS_SUCCESS) {
545 effmask |= (mask_p->am_success & ae_class);
546 }
547
548 if(sorf & AU_PRS_FAILURE) {
549 effmask |= (mask_p->am_failure & ae_class);
550 }
551
552 if(effmask)
553 return (1);
554 else
555 return (0);
556 }
557
558 /*
559 * Convert sysctl names and present arguments to events
560 */
561 au_event_t ctlname_to_sysctlevent(int name[], uint64_t valid_arg) {
562
563 /* can't parse it - so return the worst case */
564 if ((valid_arg & (ARG_CTLNAME | ARG_LEN)) !=
565 (ARG_CTLNAME | ARG_LEN))
566 return AUE_SYSCTL;
567
568 switch (name[0]) {
569 /* non-admin "lookups" treat them special */
570 case KERN_OSTYPE:
571 case KERN_OSRELEASE:
572 case KERN_OSREV:
573 case KERN_VERSION:
574 case KERN_ARGMAX:
575 case KERN_CLOCKRATE:
576 case KERN_BOOTTIME:
577 case KERN_POSIX1:
578 case KERN_NGROUPS:
579 case KERN_JOB_CONTROL:
580 case KERN_SAVED_IDS:
581 case KERN_NETBOOT:
582 case KERN_SYMFILE:
583 return AUE_SYSCTL_NONADMIN;
584
585 /* only treat the sets as admin */
586 case KERN_MAXVNODES:
587 case KERN_MAXPROC:
588 case KERN_MAXFILES:
589 case KERN_MAXPROCPERUID:
590 case KERN_MAXFILESPERPROC:
591 case KERN_HOSTID:
592 case KERN_AIOMAX:
593 case KERN_AIOPROCMAX:
594 case KERN_AIOTHREADS:
595 case KERN_COREDUMP:
596 case KERN_SUGID_COREDUMP:
597 return (valid_arg & ARG_VALUE) ?
598 AUE_SYSCTL : AUE_SYSCTL_NONADMIN;
599
600 default:
601 return AUE_SYSCTL;
602 }
603 /* NOTREACHED */
604 }
605
606 /*
607 * Convert an open flags specifier into a specific type of open event for
608 * auditing purposes.
609 */
610 au_event_t flags_and_error_to_openevent(int oflags, int error) {
611 au_event_t aevent;
612
613 /* Need to check only those flags we care about. */
614 oflags = oflags & (O_RDONLY | O_CREAT | O_TRUNC | O_RDWR | O_WRONLY);
615
616 /* These checks determine what flags are on with the condition
617 * that ONLY that combination is on, and no other flags are on.
618 */
619 switch (oflags) {
620 case O_RDONLY:
621 aevent = AUE_OPEN_R;
622 break;
623 case (O_RDONLY | O_CREAT):
624 aevent = AUE_OPEN_RC;
625 break;
626 case (O_RDONLY | O_CREAT | O_TRUNC):
627 aevent = AUE_OPEN_RTC;
628 break;
629 case (O_RDONLY | O_TRUNC):
630 aevent = AUE_OPEN_RT;
631 break;
632 case O_RDWR:
633 aevent = AUE_OPEN_RW;
634 break;
635 case (O_RDWR | O_CREAT):
636 aevent = AUE_OPEN_RWC;
637 break;
638 case (O_RDWR | O_CREAT | O_TRUNC):
639 aevent = AUE_OPEN_RWTC;
640 break;
641 case (O_RDWR | O_TRUNC):
642 aevent = AUE_OPEN_RWT;
643 break;
644 case O_WRONLY:
645 aevent = AUE_OPEN_W;
646 break;
647 case (O_WRONLY | O_CREAT):
648 aevent = AUE_OPEN_WC;
649 break;
650 case (O_WRONLY | O_CREAT | O_TRUNC):
651 aevent = AUE_OPEN_WTC;
652 break;
653 case (O_WRONLY | O_TRUNC):
654 aevent = AUE_OPEN_WT;
655 break;
656 default:
657 aevent = AUE_OPEN;
658 break;
659 }
660
661 /*
662 * Convert chatty errors to better matching events.
663 * Failures to find a file are really just attribute
664 * events - so recast them as such.
665 */
666 switch (aevent) {
667 case AUE_OPEN_R:
668 case AUE_OPEN_RT:
669 case AUE_OPEN_RW:
670 case AUE_OPEN_RWT:
671 case AUE_OPEN_W:
672 case AUE_OPEN_WT:
673 if (error == ENOENT)
674 aevent = AUE_OPEN;
675 }
676 return aevent;
677 }
678
679 /* Convert a MSGCTL command to a specific event. */
680 int msgctl_to_event(int cmd)
681 {
682 switch (cmd) {
683 case IPC_RMID:
684 return AUE_MSGCTL_RMID;
685 case IPC_SET:
686 return AUE_MSGCTL_SET;
687 case IPC_STAT:
688 return AUE_MSGCTL_STAT;
689 default:
690 return AUE_MSGCTL;
691 /* We will audit a bad command */
692 }
693 }
694
695 /* Convert a SEMCTL command to a specific event. */
696 int semctl_to_event(int cmd)
697 {
698 switch (cmd) {
699 case GETALL:
700 return AUE_SEMCTL_GETALL;
701 case GETNCNT:
702 return AUE_SEMCTL_GETNCNT;
703 case GETPID:
704 return AUE_SEMCTL_GETPID;
705 case GETVAL:
706 return AUE_SEMCTL_GETVAL;
707 case GETZCNT:
708 return AUE_SEMCTL_GETZCNT;
709 case IPC_RMID:
710 return AUE_SEMCTL_RMID;
711 case IPC_SET:
712 return AUE_SEMCTL_SET;
713 case SETALL:
714 return AUE_SEMCTL_SETALL;
715 case SETVAL:
716 return AUE_SEMCTL_SETVAL;
717 case IPC_STAT:
718 return AUE_SEMCTL_STAT;
719 default:
720 return AUE_SEMCTL;
721 /* We will audit a bad command */
722 }
723 }
724
725 /* Convert a command for the auditon() system call to a audit event. */
726 int auditon_command_event(int cmd)
727 {
728 switch(cmd) {
729 case A_GETPOLICY:
730 return AUE_AUDITON_GPOLICY;
731 break;
732 case A_SETPOLICY:
733 return AUE_AUDITON_SPOLICY;
734 break;
735 case A_GETKMASK:
736 return AUE_AUDITON_GETKMASK;
737 break;
738 case A_SETKMASK:
739 return AUE_AUDITON_SETKMASK;
740 break;
741 case A_GETQCTRL:
742 return AUE_AUDITON_GQCTRL;
743 break;
744 case A_SETQCTRL:
745 return AUE_AUDITON_SQCTRL;
746 break;
747 case A_GETCWD:
748 return AUE_AUDITON_GETCWD;
749 break;
750 case A_GETCAR:
751 return AUE_AUDITON_GETCAR;
752 break;
753 case A_GETSTAT:
754 return AUE_AUDITON_GETSTAT;
755 break;
756 case A_SETSTAT:
757 return AUE_AUDITON_SETSTAT;
758 break;
759 case A_SETUMASK:
760 return AUE_AUDITON_SETUMASK;
761 break;
762 case A_SETSMASK:
763 return AUE_AUDITON_SETSMASK;
764 break;
765 case A_GETCOND:
766 return AUE_AUDITON_GETCOND;
767 break;
768 case A_SETCOND:
769 return AUE_AUDITON_SETCOND;
770 break;
771 case A_GETCLASS:
772 return AUE_AUDITON_GETCLASS;
773 break;
774 case A_SETCLASS:
775 return AUE_AUDITON_SETCLASS;
776 break;
777 case A_GETPINFO:
778 case A_SETPMASK:
779 case A_SETFSIZE:
780 case A_GETFSIZE:
781 case A_GETPINFO_ADDR:
782 case A_GETKAUDIT:
783 case A_SETKAUDIT:
784 default:
785 return AUE_AUDITON; /* No special record */
786 break;
787 }
788 }
789
790 /*
791 * Create a canonical path from given path by prefixing either the
792 * root directory, or the current working directory.
793 * If the process working directory is NULL, we could use 'rootvnode'
794 * to obtain the root directoty, but this results in a volfs name
795 * written to the audit log. So we will leave the filename starting
796 * with '/' in the audit log in this case.
797 */
798 int canon_path(struct proc *p, char *path, char *cpath)
799 {
800 char *bufp;
801 int len;
802 struct vnode *vnp;
803 struct filedesc *fdp;
804 int ret;
805
806 fdp = p->p_fd;
807 bufp = path;
808 if (*(path) == '/') {
809 while (*(bufp) == '/')
810 bufp++; /* skip leading '/'s */
811 /* If no process root, or it is the same as the system root,
812 * audit the path as passed in with a single '/'.
813 */
814 if ((fdp->fd_rdir == NULL) ||
815 (fdp->fd_rdir == rootvnode)) {
816 vnp = NULL;
817 bufp--; /* restore one '/' */
818 } else {
819 vnp = fdp->fd_rdir; /* use process root */
820 }
821 } else {
822 vnp = fdp->fd_cdir; /* prepend the current dir */
823 bufp = path;
824 }
825 if (vnp != NULL) {
826 len = MAXPATHLEN;
827 ret = vn_getpath(vnp, cpath, &len);
828 if (ret != 0) {
829 cpath[0] = '\0';
830 return (ret);
831 }
832 /* The length returned by vn_getpath() is two greater than the
833 * number of characters in the string.
834 */
835 if (len < MAXPATHLEN)
836 cpath[len-2] = '/';
837 strncpy(cpath + len-1, bufp, MAXPATHLEN - len);
838 } else {
839 strncpy(cpath, bufp, MAXPATHLEN);
840 }
841 return (0);
842 }
mirror of XNU