bsd/security/audit/audit_private.h

   1 /*-
   2  * Copyright (c) 1999-2016 Apple Inc.
   3  * All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions
   7  * are met:
   8  * 1.  Redistributions of source code must retain the above copyright
   9  *     notice, this list of conditions and the following disclaimer.
  10  * 2.  Redistributions in binary form must reproduce the above copyright
  11  *     notice, this list of conditions and the following disclaimer in the
  12  *     documentation and/or other materials provided with the distribution.
  13  * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
  14  *     its contributors may be used to endorse or promote products derived
  15  *     from this software without specific prior written permission.
  16  *
  17  * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND
  18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  20  * ARE DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR
  21  * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
  25  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
  26  * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  27  * POSSIBILITY OF SUCH DAMAGE.
  28  */
  29 /*
  30  * NOTICE: This file was modified by SPARTA, Inc. in 2005 to introduce
  31  * support for mandatory and extensible security protections.  This notice
  32  * is included in support of clause 2.2 (b) of the Apple Public License,
  33  * Version 2.0.
  34  */
  35
  36 /*
  37  * This include file contains function prototypes and type definitions used
  38  * within the audit implementation.
  39  */
  40
  41 #ifndef _SECURITY_AUDIT_PRIVATE_H_
  42 #define _SECURITY_AUDIT_PRIVATE_H_
  43
  44 #if defined(_KERNEL) || defined(KERNEL)
  45
  46 #if CONFIG_MACF
  47 #include <sys/queue.h>
  48 #include <security/mac_framework.h>
  49 #endif
  50
  51 #include <sys/ipc.h>
  52 #include <sys/proc_internal.h>  /* for PID_MAX */
  53 #include <sys/socket.h>
  54 #include <sys/ucred.h>
  55
  56 #ifdef MALLOC_DECLARE
  57 MALLOC_DECLARE(M_AUDITBSM);
  58 MALLOC_DECLARE(M_AUDITDATA);
  59 MALLOC_DECLARE(M_AUDITPATH);
  60 MALLOC_DECLARE(M_AUDITTEXT);
  61 #endif
  62
  63 /*
  64  * Audit control variables that are usually set/read via system calls and
  65  * used to control various aspects of auditing.
  66  */
  67 extern struct au_qctrl          audit_qctrl;
  68 extern struct audit_fstat       audit_fstat;
  69 extern struct au_mask           audit_nae_mask;
  70 extern int                      audit_panic_on_write_fail;
  71 extern int                      audit_fail_stop;
  72 extern int                      audit_argv;
  73 extern int                      audit_arge;
  74 extern au_ctlmode_t     audit_ctl_mode;
  75 extern au_expire_after_t        audit_expire_after;
  76
  77 /*
  78  * Kernel mask that is used to check to see if system calls need to be audited.
  79  */
  80 extern au_class_t               audit_kevent_mask;
  81
  82 /*
  83  * The macro used to check to see if the system calls need to be auditing.
  84  * This will pessimisticly set the audit syscalls flag if the audit kevent
  85  * mask has not been created yet.  User code should build the event/class
  86  * mapping table before setting preselection masks to avoid this.
  87  */
  88 #define AUDIT_CHECK_IF_KEVENTS_MASK(m) do {                             \
  89         if ((m).am_success || (m).am_failure)                           \
  90                 if (!audit_kevent_mask ||                               \
  91                     (audit_kevent_mask & (m).am_success) ||             \
  92                     (audit_kevent_mask & (m).am_failure))               \
  93                         audit_syscalls = 1;                             \
  94 } while (0)
  95
  96 /*
  97  * Success/failure conditions for the conversion of a kernel audit record to
  98  * BSM format.
  99  */
 100 #define BSM_SUCCESS     0
 101 #define BSM_FAILURE     1
 102 #define BSM_NOAUDIT     2
 103
 104 /*
 105  * Defines for the kernel audit record k_ar_commit field.  Flags are set to
 106  * indicate what sort of record it is, and which preselection mechanism
 107  * selected it.
 108  */
 109 #define AR_COMMIT_KERNEL        0x00000001U
 110 #define AR_COMMIT_USER          0x00000010U
 111
 112 #define AR_PRESELECT_TRAIL      0x00001000U
 113 #define AR_PRESELECT_PIPE       0x00002000U
 114
 115 #define AR_PRESELECT_USER_TRAIL 0x00004000U
 116 #define AR_PRESELECT_USER_PIPE  0x00008000U
 117
 118 #define AR_PRESELECT_FILTER     0x00010000U
 119
 120 #define AR_DRAIN_QUEUE          0x80000000U
 121
 122 /*
 123  * Audit data is generated as a stream of struct audit_record structures,
 124  * linked by struct kaudit_record, and contain storage for possible audit so
 125  * that it will not need to be allocated during the processing of a system
 126  * call, both improving efficiency and avoiding sleeping at untimely moments.
 127  * This structure is converted to BSM format before being written to disk.
 128  */
 129 struct vnode_au_info {
 130         mode_t  vn_mode;
 131         uid_t   vn_uid;
 132         gid_t   vn_gid;
 133         dev_t   vn_dev;
 134         long    vn_fsid;
 135         long    vn_fileid;
 136         long    vn_gen;
 137 };
 138
 139 struct groupset {
 140         gid_t   gidset[NGROUPS];
 141         u_int   gidset_size;
 142 };
 143
 144 struct socket_au_info {
 145         int                     sai_domain;
 146         int                     sai_type;
 147         int                     sai_protocol;
 148
 149         /* Foreign (remote) address/port. */
 150         struct sockaddr_storage sai_faddr;
 151
 152         /* Local address/port. */
 153         struct sockaddr_storage sai_laddr;
 154 };
 155
 156 /*
 157  *  The following is used for A_OLDSETQCTRL and A_OLDGETQCTRL and a 64-bit
 158  *  userland.
 159  */
 160 struct  au_qctrl64 {
 161         u_int64_t               aq64_hiwater;
 162         u_int64_t               aq64_lowater;
 163         u_int64_t               aq64_bufsz;
 164         u_int64_t               aq64_delay;
 165         int64_t                 aq64_minfree;
 166 };
 167 typedef struct au_qctrl64 au_qctrl64_t;
 168
 169 union auditon_udata {
 170         char                    *au_path;
 171         int                     au_cond;
 172         int                     au_policy;
 173         int64_t                 au_cond64;
 174         int64_t                 au_policy64;
 175         int                     au_trigger;
 176         au_evclass_map_t        au_evclass;
 177         au_mask_t               au_mask;
 178         au_asflgs_t             au_flags;
 179         auditinfo_t             au_auinfo;
 180         auditpinfo_t            au_aupinfo;
 181         auditpinfo_addr_t       au_aupinfo_addr;
 182         au_qctrl_t              au_qctrl;
 183         au_qctrl64_t            au_qctrl64;
 184         au_stat_t               au_stat;
 185         au_fstat_t              au_fstat;
 186         auditinfo_addr_t        au_kau_info;
 187         au_ctlmode_t    au_ctl_mode;
 188         au_expire_after_t       au_expire_after;
 189 };
 190
 191 struct posix_ipc_perm {
 192         uid_t   pipc_uid;
 193         gid_t   pipc_gid;
 194         mode_t  pipc_mode;
 195 };
 196
 197 struct au_identity_info {
 198         u_int32_t       signer_type;
 199         char            *signing_id;
 200         u_char          signing_id_trunc;
 201         char            *team_id;
 202         u_char          team_id_trunc;
 203         u_int8_t        *cdhash;
 204         u_int16_t       cdhash_len;
 205 };
 206
 207 struct audit_record {
 208         /* Audit record header. */
 209         u_int32_t               ar_magic;
 210         int                     ar_event;
 211         int                     ar_retval; /* value returned to the process */
 212         int                     ar_errno;  /* return status of system call */
 213         struct timespec         ar_starttime;
 214         struct timespec         ar_endtime;
 215         u_int64_t               ar_valid_arg;  /* Bitmask of valid arguments */
 216
 217         /* Audit subject information. */
 218         struct xucred           ar_subj_cred;
 219         uid_t                   ar_subj_ruid;
 220         gid_t                   ar_subj_rgid;
 221         gid_t                   ar_subj_egid;
 222         uid_t                   ar_subj_auid; /* Audit user ID */
 223         pid_t                   ar_subj_asid; /* Audit session ID */
 224         pid_t                   ar_subj_pid;
 225         struct au_tid           ar_subj_term;
 226         struct au_tid_addr      ar_subj_term_addr;
 227         struct au_mask          ar_subj_amask;
 228
 229         /* Operation arguments. */
 230         uid_t                   ar_arg_euid;
 231         uid_t                   ar_arg_ruid;
 232         uid_t                   ar_arg_suid;
 233         gid_t                   ar_arg_egid;
 234         gid_t                   ar_arg_rgid;
 235         gid_t                   ar_arg_sgid;
 236         pid_t                   ar_arg_pid;
 237         pid_t                   ar_arg_asid;
 238         struct au_tid           ar_arg_termid;
 239         struct au_tid_addr      ar_arg_termid_addr;
 240         uid_t                   ar_arg_uid;
 241         uid_t                   ar_arg_auid;
 242         gid_t                   ar_arg_gid;
 243         struct groupset         ar_arg_groups;
 244         int                     ar_arg_fd;
 245         int                     ar_arg_fflags;
 246         mode_t                  ar_arg_mode;
 247         uint32_t                ar_arg_value32;
 248         uint64_t                ar_arg_value64;
 249         user_addr_t             ar_arg_addr;
 250         user_size_t             ar_arg_len;
 251         int                     ar_arg_mask;
 252         u_int                   ar_arg_signum;
 253         char                    ar_arg_login[MAXLOGNAME];
 254         int                     ar_arg_ctlname[CTL_MAXNAME];
 255         struct socket_au_info   ar_arg_sockinfo;
 256         char                    *ar_arg_upath1;
 257         char                    *ar_arg_upath2;
 258         char                    *ar_arg_kpath1;         /* darwin-only */
 259         char                    *ar_arg_kpath2;         /* darwin-only */
 260 #if CONFIG_MACF
 261         char                    *ar_vnode1_mac_labels;
 262         char                    *ar_vnode2_mac_labels;
 263         char                    *ar_cred_mac_labels;
 264         char                    *ar_arg_mac_string;
 265 #endif
 266         char                    *ar_arg_text;
 267         void                    *ar_arg_opaque;         /* darwin-only */
 268         void                    *ar_arg_data;           /* darwin-only */
 269         u_int16_t               ar_arg_opq_size;        /* darwin-only */
 270         u_char                  ar_arg_data_type;       /* darwin-only */
 271         u_char                  ar_arg_data_count;      /* darwin-only */
 272         struct au_mask          ar_arg_amask;
 273         struct vnode_au_info    ar_arg_vnode1;
 274         struct vnode_au_info    ar_arg_vnode2;
 275         int                     ar_arg_cmd;
 276         int                     ar_arg_svipc_cmd;
 277         struct ipc_perm         ar_arg_svipc_perm;
 278         int                     ar_arg_svipc_id;
 279         user_addr_t             ar_arg_svipc_addr;
 280         struct posix_ipc_perm   ar_arg_pipc_perm;
 281         mach_port_name_t        ar_arg_mach_port1;      /* darwin-only */
 282         mach_port_name_t        ar_arg_mach_port2;      /* darwin-only */
 283         union auditon_udata     ar_arg_auditon;
 284         char                    *ar_arg_argv;
 285         int                     ar_arg_argc;
 286         char                    *ar_arg_envv;
 287         int                     ar_arg_envc;
 288         int                     ar_arg_exitstatus;
 289         int                     ar_arg_exitretval;
 290         struct sockaddr_storage ar_arg_sockaddr;
 291         int                     ar_arg_fd2;
 292
 293 #if CONFIG_MACF
 294         /*
 295          * MAC security related fields added by MAC policies ar_forced_by_mac
 296          * is 1 if mac_audit_check_preselect() forced this call to be audited,
 297          * 0 otherwise.
 298          */
 299         LIST_HEAD(mac_audit_record_list_t, mac_audit_record)    *ar_mac_records;
 300         int                     ar_forced_by_mac;
 301 #endif
 302         struct au_identity_info ar_arg_identity;
 303 };
 304
 305 /*
 306  * Arguments in the audit record are initially not defined; flags are set to
 307  * indicate if they are present so they can be included in the audit log
 308  * stream only if defined.
 309  */
 310 #define ARG_IS_VALID(kar, arg)  ((kar)->k_ar.ar_valid_arg & (arg))
 311 #define ARG_SET_VALID(kar, arg) do {                                    \
 312         (kar)->k_ar.ar_valid_arg |= (arg);                              \
 313 } while (0)
 314
 315 /*
 316  * Current thread macro.  get_bsdthread_info() returns a void ptr for some
 317  * reason.
 318  */
 319 #define curthread()     ((struct uthread *)get_bsdthread_info(current_thread()))
 320
 321 /*
 322  * In-kernel version of audit record; the basic record plus queue meta-data.
 323  * This record can also have a pointer set to some opaque data that will be
 324  * passed through to the audit writing mechanism.
 325  */
 326 struct kaudit_record {
 327         struct audit_record              k_ar;
 328         u_int32_t                        k_ar_commit;
 329         void                            *k_udata;       /* User data. */
 330         u_int                            k_ulen;        /* User data length. */
 331         struct uthread                  *k_uthread;     /* Audited thread. */
 332         TAILQ_ENTRY(kaudit_record)       k_q;
 333 };
 334 TAILQ_HEAD(kaudit_queue, kaudit_record);
 335
 336 /*
 337  * Functions to manage the allocation, release, and commit of kernel audit
 338  * records.
 339  */
 340 void                     audit_abort(struct kaudit_record *ar);
 341 void                     audit_commit(struct kaudit_record *ar, int error,
 342                             int retval);
 343 struct kaudit_record    *audit_new(int event, proc_t p, struct uthread *td);
 344
 345 /*
 346  * Functions relating to the conversion of internal kernel audit records to
 347  * the BSM file format.
 348  */
 349 struct au_record;
 350 int      kaudit_to_bsm(struct kaudit_record *kar, struct au_record **pau);
 351 int      bsm_rec_verify(void *rec, int length);
 352
 353 /*
 354  * Kernel versions of the libbsm audit record functions.
 355  */
 356 void     kau_free(struct au_record *rec);
 357 void     kau_init(void);
 358
 359 /*
 360  * Return values for pre-selection and post-selection decisions.
 361  */
 362 #define AU_PRS_SUCCESS  1
 363 #define AU_PRS_FAILURE  2
 364 #define AU_PRS_BOTH     (AU_PRS_SUCCESS|AU_PRS_FAILURE)
 365
 366 /*
 367  * Data structures relating to the kernel audit queue.  Ideally, these might
 368  * be abstracted so that only accessor methods are exposed.
 369  */
 370 extern struct mtx               audit_mtx;
 371 extern struct cv                audit_watermark_cv;
 372 extern struct cv                audit_worker_cv;
 373 extern struct cv                audit_drain_cv;
 374 extern struct kaudit_queue      audit_q;
 375 extern int                      audit_q_len;
 376 extern int                      audit_pre_q_len;
 377 extern int                      audit_in_failure;
 378
 379 /*
 380  * Flags to use on audit files when opening and closing.
 381  */
 382 #define AUDIT_OPEN_FLAGS        (FWRITE | O_APPEND)
 383 #define AUDIT_CLOSE_FLAGS       (FWRITE | O_APPEND)
 384
 385 #include <sys/fcntl.h>
 386 #include <sys/kernel.h>
 387 #include <sys/malloc.h>
 388
 389 /*
 390  * Some of the BSM tokenizer functions take different parameters in the
 391  * kernel implementations in order to save the copying of large kernel data
 392  * structures.  The prototypes of these functions are declared here.
 393  */
 394 token_t         *kau_to_socket(struct socket_au_info *soi);
 395
 396 /*
 397  * audit_klib prototypes
 398  */
 399 int              au_preselect(au_event_t event, au_class_t class,
 400                     au_mask_t *mask_p, int sorf);
 401 void             au_evclassmap_init(void);
 402 void             au_evclassmap_insert(au_event_t event, au_class_t class);
 403 au_class_t       au_event_class(au_event_t event);
 404 au_event_t       audit_ctlname_to_sysctlevent(int name[], uint64_t valid_arg);
 405 au_event_t       audit_flags_and_error_to_openevent(int oflags, int error);
 406 au_event_t       audit_flags_and_error_to_openextendedevent(int oflags,
 407                     int error);
 408 au_event_t       audit_flags_and_error_to_openatevent(int oflags,
 409                     int error);
 410 au_event_t       audit_flags_and_error_to_openbyidevent(int oflags,
 411                     int error);
 412 au_event_t       audit_msgctl_to_event(int cmd);
 413 au_event_t       audit_semctl_to_event(int cmr);
 414 int              audit_canon_path(struct vnode *cwd_vp, char *path,
 415                     char *cpath);
 416 au_event_t       auditon_command_event(int cmd);
 417 au_event_t       audit_fcntl_command_event(int cmd, int oflags, int error);
 418
 419 /*
 420  * Audit trigger events notify user space of kernel audit conditions
 421  * asynchronously.
 422  */
 423 int              audit_send_trigger(unsigned int trigger);
 424
 425 /*
 426  * Accessor functions to manage global audit state.
 427  */
 428 void            audit_set_kinfo(struct auditinfo_addr *);
 429 void            audit_get_kinfo(struct auditinfo_addr *);
 430
 431 /*
 432  * General audit related functions.
 433  */
 434 struct kaudit_record    *currecord(void);
 435 void                     audit_free(struct kaudit_record *ar);
 436 void                     audit_rotate_vnode(struct ucred *cred,
 437                             struct vnode *vp);
 438 void                     audit_worker_init(void);
 439 void                     audit_identity_info_construct(
 440                             struct au_identity_info *id_info);
 441 void                     audit_identity_info_destruct(
 442                             struct au_identity_info *id_info);
 443
 444 /*
 445  * Audit pipe functions.
 446  */
 447 int      audit_pipe_init(void);
 448 int      audit_pipe_shutdown(void);
 449 int      audit_pipe_preselect(au_id_t auid, au_event_t event,
 450             au_class_t class, int sorf, int trail_select);
 451 void     audit_pipe_submit(au_id_t auid, au_event_t event, au_class_t class,
 452             int sorf, int trail_select, void *record, u_int record_len);
 453 void     audit_pipe_submit_user(void *record, u_int record_len);
 454
 455 /*
 456  * Audit MAC prototypes.
 457  */
 458 void    audit_mac_init(void);
 459 int     audit_mac_new(proc_t p, struct kaudit_record *ar);
 460 void    audit_mac_free(struct kaudit_record *ar);
 461 int     audit_mac_syscall_enter(unsigned short code, proc_t p,
 462             struct uthread *uthread, kauth_cred_t my_cred, au_event_t event);
 463 int     audit_mac_syscall_exit(unsigned short code, struct uthread *uthread,
 464             int error, int retval);
 465
 466 /*
 467  * Audit Session.
 468  */
 469 void    audit_session_init(void);
 470 int     audit_session_setaia(proc_t p, auditinfo_addr_t *aia_p);
 471 auditinfo_addr_t *audit_session_update(auditinfo_addr_t *new_aia);
 472 int     audit_session_lookup(au_asid_t asid, auditinfo_addr_t *ret_aia);
 473
 474 /*
 475  * Kernel assigned audit session IDs start at PID_MAX + 1 and ends at
 476  * ASSIGNED_ASID_MAX.
 477  */
 478 #define ASSIGNED_ASID_MIN       (PID_MAX + 1)
 479 #define ASSIGNED_ASID_MAX       (0xFFFFFFFF - 1)
 480
 481 /*
 482  * Entitlement required to control various audit subsystem settings
 483  */
 484 #define AU_CLASS_RESERVED_ENTITLEMENT "com.apple.private.dz.audit"
 485
 486 /*
 487  * Entitlement required to control auditctl sys call
 488  */
 489 #define AU_AUDITCTL_RESERVED_ENTITLEMENT "com.apple.private.protected-audit-control"
 490
 491 /*
 492  * Max sizes used by the kernel for signing id and team id values of the
 493  * identity tokens. These lengths include space for the null terminator.
 494  */
 495 #define MAX_AU_IDENTITY_SIGNING_ID_LENGTH 129
 496 #define MAX_AU_IDENTITY_TEAM_ID_LENGTH 17
 497
 498 struct __attribute__((__packed__)) hdr_tok_partial {
 499         u_char type;
 500         uint32_t len;
 501 };
 502 static_assert(sizeof(struct hdr_tok_partial) == 5);
 503
 504 struct __attribute__((__packed__)) trl_tok_partial {
 505         u_char type;
 506         uint16_t magic;
 507         uint32_t len;
 508 };
 509 static_assert(sizeof(struct trl_tok_partial) == 7);
 510
 511 #endif /* defined(KERNEL) || defined(_KERNEL) */
 512
 513 #endif /* ! _SECURITY_AUDIT_PRIVATE_H_ */