bsd/security/audit/audit_arg.c

   1 /*-
   2  * Copyright (c) 1999-2016 Apple Inc.
   3  * All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions
   7  * are met:
   8  * 1.  Redistributions of source code must retain the above copyright
   9  *     notice, this list of conditions and the following disclaimer.
  10  * 2.  Redistributions in binary form must reproduce the above copyright
  11  *     notice, this list of conditions and the following disclaimer in the
  12  *     documentation and/or other materials provided with the distribution.
  13  * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
  14  *     its contributors may be used to endorse or promote products derived
  15  *     from this software without specific prior written permission.
  16  *
  17  * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND
  18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  20  * ARE DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR
  21  * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
  25  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
  26  * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  27  * POSSIBILITY OF SUCH DAMAGE.
  28  *
  29  */
  30 /*
  31  * NOTICE: This file was modified by McAfee Research in 2004 to introduce
  32  * support for mandatory and extensible security protections.  This notice
  33  * is included in support of clause 2.2 (b) of the Apple Public License,
  34  * Version 2.0.
  35  */
  36
  37 #include <sys/param.h>
  38 #include <sys/fcntl.h>
  39 #include <sys/kernel.h>
  40 #include <sys/lock.h>
  41 #include <sys/namei.h>
  42 #include <sys/proc_internal.h>
  43 #include <sys/kauth.h>
  44 #include <sys/queue.h>
  45 #include <sys/systm.h>
  46 #include <sys/time.h>
  47 #include <sys/ucred.h>
  48 #include <sys/uio.h>
  49 #include <sys/unistd.h>
  50 #include <sys/file_internal.h>
  51 #include <sys/vnode_internal.h>
  52 #include <sys/user.h>
  53 #include <sys/syscall.h>
  54 #include <sys/malloc.h>
  55 #include <sys/un.h>
  56 #include <sys/sysent.h>
  57 #include <sys/sysproto.h>
  58 #include <sys/vfs_context.h>
  59 #include <sys/domain.h>
  60 #include <sys/protosw.h>
  61 #include <sys/socketvar.h>
  62 #include <sys/codesign.h>
  63 #include <sys/ubc.h>
  64
  65 #include <bsm/audit.h>
  66 #include <bsm/audit_internal.h>
  67 #include <bsm/audit_kevents.h>
  68
  69 #include <security/audit/audit.h>
  70 #include <security/audit/audit_bsd.h>
  71 #include <security/audit/audit_private.h>
  72
  73 #include <mach/host_priv.h>
  74 #include <mach/host_special_ports.h>
  75 #include <mach/audit_triggers_server.h>
  76
  77 #include <kern/host.h>
  78 #include <kern/kalloc.h>
  79 #include <kern/zalloc.h>
  80 #include <kern/sched_prim.h>
  81
  82 #if CONFIG_MACF
  83 #include <bsm/audit_record.h>
  84 #include <security/mac.h>
  85 #include <security/mac_framework.h>
  86 #include <security/mac_policy.h>
  87 extern zone_t audit_mac_label_zone;
  88 #endif
  89
  90 #include <net/route.h>
  91
  92 #include <netinet/in.h>
  93 #include <netinet/in_pcb.h>
  94
  95 #if CONFIG_AUDIT
  96 /*
  97  * Calls to manipulate elements of the audit record structure from system
  98  * call code.  Macro wrappers will prevent this functions from being entered
  99  * if auditing is disabled, avoiding the function call cost.  We check the
 100  * thread audit record pointer anyway, as the audit condition could change,
 101  * and pre-selection may not have allocated an audit record for this event.
 102  *
 103  * XXXAUDIT: Should we assert, in each case, that this field of the record
 104  * hasn't already been filled in?
 105  */
 106 void
 107 audit_arg_addr(struct kaudit_record *ar, user_addr_t addr)
 108 {
 109         struct proc *p = current_proc();
 110
 111         ar->k_ar.ar_arg_addr = addr;
 112
 113         /*
 114          * If the process is 64-bit then flag the address as such.
 115          */
 116         if (proc_is64bit(p)) {
 117                 ARG_SET_VALID(ar, ARG_ADDR64);
 118         } else {
 119                 ARG_SET_VALID(ar, ARG_ADDR32);
 120         }
 121 }
 122
 123 void
 124 audit_arg_exit(struct kaudit_record *ar, int status, int retval)
 125 {
 126         ar->k_ar.ar_arg_exitstatus = status;
 127         ar->k_ar.ar_arg_exitretval = retval;
 128         ARG_SET_VALID(ar, ARG_EXIT);
 129 }
 130
 131 void
 132 audit_arg_len(struct kaudit_record *ar, user_size_t len)
 133 {
 134         ar->k_ar.ar_arg_len = len;
 135         ARG_SET_VALID(ar, ARG_LEN);
 136 }
 137
 138 void
 139 audit_arg_fd2(struct kaudit_record *ar, int fd)
 140 {
 141         ar->k_ar.ar_arg_fd2 = fd;
 142         ARG_SET_VALID(ar, ARG_FD2);
 143 }
 144
 145 void
 146 audit_arg_fd(struct kaudit_record *ar, int fd)
 147 {
 148         ar->k_ar.ar_arg_fd = fd;
 149         ARG_SET_VALID(ar, ARG_FD);
 150 }
 151
 152 void
 153 audit_arg_fflags(struct kaudit_record *ar, int fflags)
 154 {
 155         ar->k_ar.ar_arg_fflags = fflags;
 156         ARG_SET_VALID(ar, ARG_FFLAGS);
 157 }
 158
 159 void
 160 audit_arg_gid(struct kaudit_record *ar, gid_t gid)
 161 {
 162         ar->k_ar.ar_arg_gid = gid;
 163         ARG_SET_VALID(ar, ARG_GID);
 164 }
 165
 166 void
 167 audit_arg_uid(struct kaudit_record *ar, uid_t uid)
 168 {
 169         ar->k_ar.ar_arg_uid = uid;
 170         ARG_SET_VALID(ar, ARG_UID);
 171 }
 172
 173 void
 174 audit_arg_egid(struct kaudit_record *ar, gid_t egid)
 175 {
 176         ar->k_ar.ar_arg_egid = egid;
 177         ARG_SET_VALID(ar, ARG_EGID);
 178 }
 179
 180 void
 181 audit_arg_euid(struct kaudit_record *ar, uid_t euid)
 182 {
 183         ar->k_ar.ar_arg_euid = euid;
 184         ARG_SET_VALID(ar, ARG_EUID);
 185 }
 186
 187 void
 188 audit_arg_rgid(struct kaudit_record *ar, gid_t rgid)
 189 {
 190         ar->k_ar.ar_arg_rgid = rgid;
 191         ARG_SET_VALID(ar, ARG_RGID);
 192 }
 193
 194 void
 195 audit_arg_ruid(struct kaudit_record *ar, uid_t ruid)
 196 {
 197         ar->k_ar.ar_arg_ruid = ruid;
 198         ARG_SET_VALID(ar, ARG_RUID);
 199 }
 200
 201 void
 202 audit_arg_sgid(struct kaudit_record *ar, gid_t sgid)
 203 {
 204         ar->k_ar.ar_arg_sgid = sgid;
 205         ARG_SET_VALID(ar, ARG_SGID);
 206 }
 207
 208 void
 209 audit_arg_suid(struct kaudit_record *ar, uid_t suid)
 210 {
 211         ar->k_ar.ar_arg_suid = suid;
 212         ARG_SET_VALID(ar, ARG_SUID);
 213 }
 214
 215 void
 216 audit_arg_groupset(struct kaudit_record *ar, gid_t *gidset, u_int gidset_size)
 217 {
 218         u_int i;
 219
 220         for (i = 0; i < gidset_size; i++) {
 221                 ar->k_ar.ar_arg_groups.gidset[i] = gidset[i];
 222         }
 223         ar->k_ar.ar_arg_groups.gidset_size = gidset_size;
 224         ARG_SET_VALID(ar, ARG_GROUPSET);
 225 }
 226
 227 void
 228 audit_arg_login(struct kaudit_record *ar, char *login)
 229 {
 230         strlcpy(ar->k_ar.ar_arg_login, login, MAXLOGNAME);
 231         ARG_SET_VALID(ar, ARG_LOGIN);
 232 }
 233
 234 void
 235 audit_arg_ctlname(struct kaudit_record *ar, int *name, int namelen)
 236 {
 237         bcopy(name, &ar->k_ar.ar_arg_ctlname, namelen * sizeof(int));
 238         ar->k_ar.ar_arg_len = namelen;
 239         ARG_SET_VALID(ar, ARG_CTLNAME | ARG_LEN);
 240 }
 241
 242 void
 243 audit_arg_mask(struct kaudit_record *ar, int mask)
 244 {
 245         ar->k_ar.ar_arg_mask = mask;
 246         ARG_SET_VALID(ar, ARG_MASK);
 247 }
 248
 249 void
 250 audit_arg_mode(struct kaudit_record *ar, mode_t mode)
 251 {
 252         ar->k_ar.ar_arg_mode = mode;
 253         ARG_SET_VALID(ar, ARG_MODE);
 254 }
 255
 256 void
 257 audit_arg_value32(struct kaudit_record *ar, uint32_t value32)
 258 {
 259         ar->k_ar.ar_arg_value32 = value32;
 260         ARG_SET_VALID(ar, ARG_VALUE32);
 261 }
 262
 263 void
 264 audit_arg_value64(struct kaudit_record *ar, uint64_t value64)
 265 {
 266         ar->k_ar.ar_arg_value64 = value64;
 267         ARG_SET_VALID(ar, ARG_VALUE64);
 268 }
 269
 270 void
 271 audit_arg_owner(struct kaudit_record *ar, uid_t uid, gid_t gid)
 272 {
 273         ar->k_ar.ar_arg_uid = uid;
 274         ar->k_ar.ar_arg_gid = gid;
 275         ARG_SET_VALID(ar, ARG_UID | ARG_GID);
 276 }
 277
 278 void
 279 audit_arg_pid(struct kaudit_record *ar, pid_t pid)
 280 {
 281         ar->k_ar.ar_arg_pid = pid;
 282         ARG_SET_VALID(ar, ARG_PID);
 283 }
 284
 285 void
 286 audit_arg_process(struct kaudit_record *ar, proc_t p)
 287 {
 288         kauth_cred_t my_cred;
 289
 290         KASSERT(p != NULL, ("audit_arg_process: p == NULL"));
 291
 292         if (p == NULL) {
 293                 return;
 294         }
 295
 296         my_cred = kauth_cred_proc_ref(p);
 297         ar->k_ar.ar_arg_auid = my_cred->cr_audit.as_aia_p->ai_auid;
 298         ar->k_ar.ar_arg_asid = my_cred->cr_audit.as_aia_p->ai_asid;
 299         bcopy(&my_cred->cr_audit.as_aia_p->ai_termid,
 300             &ar->k_ar.ar_arg_termid_addr, sizeof(au_tid_addr_t));
 301         ar->k_ar.ar_arg_euid = kauth_cred_getuid(my_cred);
 302         ar->k_ar.ar_arg_egid = kauth_cred_getgid(my_cred);
 303         ar->k_ar.ar_arg_ruid = kauth_cred_getruid(my_cred);
 304         ar->k_ar.ar_arg_rgid = kauth_cred_getrgid(my_cred);
 305         kauth_cred_unref(&my_cred);
 306         ar->k_ar.ar_arg_pid = p->p_pid;
 307         ARG_SET_VALID(ar, ARG_AUID | ARG_EUID | ARG_EGID | ARG_RUID |
 308             ARG_RGID | ARG_ASID | ARG_TERMID_ADDR | ARG_PID | ARG_PROCESS);
 309 }
 310
 311 void
 312 audit_arg_signum(struct kaudit_record *ar, u_int signum)
 313 {
 314         ar->k_ar.ar_arg_signum = signum;
 315         ARG_SET_VALID(ar, ARG_SIGNUM);
 316 }
 317
 318 void
 319 audit_arg_socket(struct kaudit_record *ar, int sodomain, int sotype,
 320     int soprotocol)
 321 {
 322         ar->k_ar.ar_arg_sockinfo.sai_domain = sodomain;
 323         ar->k_ar.ar_arg_sockinfo.sai_type = sotype;
 324         ar->k_ar.ar_arg_sockinfo.sai_protocol = soprotocol;
 325         ARG_SET_VALID(ar, ARG_SOCKINFO);
 326 }
 327
 328 /*
 329  * Note that the current working directory vp must be supplied at the audit
 330  * call site to permit per thread current working directories, and that it
 331  * must take a upath starting with '/' into account for chroot if the path
 332  * is absolute.  This results in the real (non-chroot) path being recorded
 333  * in the audit record.
 334  */
 335 void
 336 audit_arg_sockaddr(struct kaudit_record *ar, struct vnode *cwd_vp,
 337     struct sockaddr *sa)
 338 {
 339         char path[SOCK_MAXADDRLEN - offsetof(struct sockaddr_un, sun_path) + 1] = "";
 340         struct sockaddr_un *sun;
 341         ssize_t namelen;
 342
 343         KASSERT(sa != NULL, ("audit_arg_sockaddr: sa == NULL"));
 344
 345         if (cwd_vp == NULL || sa == NULL) {
 346                 return;
 347         }
 348
 349         if (sa->sa_len > sizeof(ar->k_ar.ar_arg_sockaddr)) {
 350                 bcopy(sa, &ar->k_ar.ar_arg_sockaddr, sizeof(ar->k_ar.ar_arg_sockaddr));
 351         } else {
 352                 bcopy(sa, &ar->k_ar.ar_arg_sockaddr, sa->sa_len);
 353         }
 354
 355         switch (sa->sa_family) {
 356         case AF_INET:
 357                 ARG_SET_VALID(ar, ARG_SADDRINET);
 358                 break;
 359
 360         case AF_INET6:
 361                 ARG_SET_VALID(ar, ARG_SADDRINET6);
 362                 break;
 363
 364         case AF_UNIX:
 365                 sun = (struct sockaddr_un *)sa;
 366                 namelen = sun->sun_len - offsetof(struct sockaddr_un, sun_path);
 367                 if (namelen > 0 && (size_t)namelen < sizeof(path)) {
 368                         /*
 369                          * Make sure the path is NUL-terminated
 370                          */
 371                         bcopy(sun->sun_path, path, namelen);
 372                         path[namelen] = 0;
 373                         audit_arg_upath(ar, cwd_vp, path, ARG_UPATH1);
 374                 }
 375                 ARG_SET_VALID(ar, ARG_SADDRUNIX);
 376                 break;
 377                 /* XXXAUDIT: default:? */
 378         }
 379 }
 380
 381 void
 382 audit_arg_auid(struct kaudit_record *ar, uid_t auid)
 383 {
 384         ar->k_ar.ar_arg_auid = auid;
 385         ARG_SET_VALID(ar, ARG_AUID);
 386 }
 387
 388 void
 389 audit_arg_auditinfo(struct kaudit_record *ar, struct auditinfo *au_info)
 390 {
 391         ar->k_ar.ar_arg_auid = au_info->ai_auid;
 392         ar->k_ar.ar_arg_asid = au_info->ai_asid;
 393         ar->k_ar.ar_arg_amask.am_success = au_info->ai_mask.am_success;
 394         ar->k_ar.ar_arg_amask.am_failure = au_info->ai_mask.am_failure;
 395         ar->k_ar.ar_arg_termid.port = au_info->ai_termid.port;
 396         ar->k_ar.ar_arg_termid.machine = au_info->ai_termid.machine;
 397         ARG_SET_VALID(ar, ARG_AUID | ARG_ASID | ARG_AMASK | ARG_TERMID);
 398 }
 399
 400 void
 401 audit_arg_auditinfo_addr(struct kaudit_record *ar,
 402     struct auditinfo_addr *au_info)
 403 {
 404         ar->k_ar.ar_arg_auid = au_info->ai_auid;
 405         ar->k_ar.ar_arg_asid = au_info->ai_asid;
 406         ar->k_ar.ar_arg_amask.am_success = au_info->ai_mask.am_success;
 407         ar->k_ar.ar_arg_amask.am_failure = au_info->ai_mask.am_failure;
 408         ar->k_ar.ar_arg_termid_addr.at_type = au_info->ai_termid.at_type;
 409         ar->k_ar.ar_arg_termid_addr.at_port = au_info->ai_termid.at_port;
 410         ar->k_ar.ar_arg_termid_addr.at_addr[0] = au_info->ai_termid.at_addr[0];
 411         ar->k_ar.ar_arg_termid_addr.at_addr[1] = au_info->ai_termid.at_addr[1];
 412         ar->k_ar.ar_arg_termid_addr.at_addr[2] = au_info->ai_termid.at_addr[2];
 413         ar->k_ar.ar_arg_termid_addr.at_addr[3] = au_info->ai_termid.at_addr[3];
 414         ARG_SET_VALID(ar, ARG_AUID | ARG_ASID | ARG_AMASK | ARG_TERMID_ADDR);
 415 }
 416
 417 void
 418 audit_arg_text(struct kaudit_record *ar, char *text)
 419 {
 420         KASSERT(text != NULL, ("audit_arg_text: text == NULL"));
 421
 422         /* Invalidate the text string */
 423         ar->k_ar.ar_valid_arg &= (ARG_ALL ^ ARG_TEXT);
 424         if (text == NULL) {
 425                 return;
 426         }
 427
 428         if (ar->k_ar.ar_arg_text == NULL) {
 429                 ar->k_ar.ar_arg_text = malloc(MAXPATHLEN, M_AUDITTEXT,
 430                     M_WAITOK);
 431         }
 432
 433         strncpy(ar->k_ar.ar_arg_text, text, MAXPATHLEN);
 434         ARG_SET_VALID(ar, ARG_TEXT);
 435 }
 436
 437 void
 438 audit_arg_opaque(struct kaudit_record *ar, void *data, size_t size)
 439 {
 440         KASSERT(data != NULL, ("audit_arg_opaque: data == NULL"));
 441         KASSERT(size <= UINT16_MAX, ("audit_arg_opaque: size > UINT16_MAX"));
 442
 443         if (data == NULL || size > UINT16_MAX) {
 444                 return;
 445         }
 446
 447         if (ar->k_ar.ar_arg_opaque == NULL) {
 448                 ar->k_ar.ar_arg_opaque = malloc(size, M_AUDITDATA, M_WAITOK);
 449         } else {
 450                 return;
 451         }
 452
 453         memcpy(ar->k_ar.ar_arg_opaque, data, size);
 454         ar->k_ar.ar_arg_opq_size = (u_int16_t) size;
 455         ARG_SET_VALID(ar, ARG_OPAQUE);
 456 }
 457
 458 void
 459 audit_arg_data(struct kaudit_record *ar, void *data, size_t size, size_t number)
 460 {
 461         size_t sz;
 462
 463         KASSERT(data != NULL, ("audit_arg_data: data == NULL"));
 464         KASSERT(size >= AUR_BYTE_SIZE && size <= AUR_INT64_SIZE,
 465             ("audit_arg_data: size < AUR_BYTE_SIZE or size > AUR_INT64_SIZE"));
 466         KASSERT(number <= UINT8_MAX,
 467             ("audit_arg_data: number > UINT8_MAX"));
 468
 469         if (data == NULL || size < AUR_BYTE_SIZE || size > AUR_INT64_SIZE ||
 470             number > UINT8_MAX) {
 471                 return;
 472         }
 473
 474         sz = size * number;
 475
 476         if (ar->k_ar.ar_arg_data == NULL) {
 477                 ar->k_ar.ar_arg_data = malloc(sz, M_AUDITDATA, M_WAITOK);
 478         } else {
 479                 return;
 480         }
 481
 482         memcpy(ar->k_ar.ar_arg_data, data, sz);
 483
 484         switch (size) {
 485         case AUR_BYTE_SIZE:
 486                 ar->k_ar.ar_arg_data_type = AUR_BYTE;
 487                 break;
 488
 489         case AUR_SHORT_SIZE:
 490                 ar->k_ar.ar_arg_data_type = AUR_SHORT;
 491                 break;
 492
 493         case AUR_INT32_SIZE:
 494                 ar->k_ar.ar_arg_data_type = AUR_INT32;
 495                 break;
 496
 497         case AUR_INT64_SIZE:
 498                 ar->k_ar.ar_arg_data_type = AUR_INT64;
 499                 break;
 500
 501         default:
 502                 free(ar->k_ar.ar_arg_data, M_AUDITDATA);
 503                 ar->k_ar.ar_arg_data = NULL;
 504                 return;
 505         }
 506
 507         ar->k_ar.ar_arg_data_count = (u_char)number;
 508
 509         ARG_SET_VALID(ar, ARG_DATA);
 510 }
 511
 512 void
 513 audit_arg_cmd(struct kaudit_record *ar, int cmd)
 514 {
 515         ar->k_ar.ar_arg_cmd = cmd;
 516         ARG_SET_VALID(ar, ARG_CMD);
 517 }
 518
 519 void
 520 audit_arg_svipc_cmd(struct kaudit_record *ar, int cmd)
 521 {
 522         ar->k_ar.ar_arg_svipc_cmd = cmd;
 523         ARG_SET_VALID(ar, ARG_SVIPC_CMD);
 524 }
 525
 526 void
 527 audit_arg_svipc_perm(struct kaudit_record *ar, struct ipc_perm *perm)
 528 {
 529         bcopy(perm, &ar->k_ar.ar_arg_svipc_perm,
 530             sizeof(ar->k_ar.ar_arg_svipc_perm));
 531         ARG_SET_VALID(ar, ARG_SVIPC_PERM);
 532 }
 533
 534 void
 535 audit_arg_svipc_id(struct kaudit_record *ar, int id)
 536 {
 537         ar->k_ar.ar_arg_svipc_id = id;
 538         ARG_SET_VALID(ar, ARG_SVIPC_ID);
 539 }
 540
 541 void
 542 audit_arg_svipc_addr(struct kaudit_record *ar, user_addr_t addr)
 543 {
 544         ar->k_ar.ar_arg_svipc_addr = addr;
 545         ARG_SET_VALID(ar, ARG_SVIPC_ADDR);
 546 }
 547
 548 void
 549 audit_arg_posix_ipc_perm(struct kaudit_record *ar, uid_t uid, gid_t gid,
 550     mode_t mode)
 551 {
 552         ar->k_ar.ar_arg_pipc_perm.pipc_uid = uid;
 553         ar->k_ar.ar_arg_pipc_perm.pipc_gid = gid;
 554         ar->k_ar.ar_arg_pipc_perm.pipc_mode = mode;
 555         ARG_SET_VALID(ar, ARG_POSIX_IPC_PERM);
 556 }
 557
 558 void
 559 audit_arg_auditon(struct kaudit_record *ar, union auditon_udata *udata)
 560 {
 561         bcopy((void *)udata, &ar->k_ar.ar_arg_auditon,
 562             sizeof(ar->k_ar.ar_arg_auditon));
 563         ARG_SET_VALID(ar, ARG_AUDITON);
 564 }
 565
 566 /*
 567  * Audit information about a file, either the file's vnode info, or its
 568  * socket address info.
 569  */
 570 void
 571 audit_arg_file(struct kaudit_record *ar, __unused proc_t p,
 572     struct fileproc *fp)
 573 {
 574         struct socket *so;
 575         struct inpcb *pcb;
 576         struct sockaddr_in *sin;
 577         struct sockaddr_in6 *sin6;
 578
 579         switch (FILEGLOB_DTYPE(fp->f_fglob)) {
 580         case DTYPE_VNODE:
 581                 /* case DTYPE_FIFO: */
 582                 audit_arg_vnpath_withref(ar,
 583                     (struct vnode *)fp->f_fglob->fg_data, ARG_VNODE1);
 584                 break;
 585
 586         case DTYPE_SOCKET:
 587                 so = (struct socket *)fp->f_fglob->fg_data;
 588                 if (SOCK_CHECK_DOM(so, PF_INET)) {
 589                         if (so->so_pcb == NULL) {
 590                                 break;
 591                         }
 592                         ar->k_ar.ar_arg_sockinfo.sai_type =
 593                             so->so_type;
 594                         ar->k_ar.ar_arg_sockinfo.sai_domain = SOCK_DOM(so);
 595                         ar->k_ar.ar_arg_sockinfo.sai_protocol = SOCK_PROTO(so);
 596                         pcb = (struct inpcb *)so->so_pcb;
 597                         sin = (struct sockaddr_in *)
 598                             &ar->k_ar.ar_arg_sockinfo.sai_faddr;
 599                         sin->sin_addr.s_addr = pcb->inp_faddr.s_addr;
 600                         sin->sin_port = pcb->inp_fport;
 601                         sin = (struct sockaddr_in *)
 602                             &ar->k_ar.ar_arg_sockinfo.sai_laddr;
 603                         sin->sin_addr.s_addr = pcb->inp_laddr.s_addr;
 604                         sin->sin_port = pcb->inp_lport;
 605                         ARG_SET_VALID(ar, ARG_SOCKINFO);
 606                 }
 607                 if (SOCK_CHECK_DOM(so, PF_INET6)) {
 608                         if (so->so_pcb == NULL) {
 609                                 break;
 610                         }
 611                         ar->k_ar.ar_arg_sockinfo.sai_type =
 612                             so->so_type;
 613                         ar->k_ar.ar_arg_sockinfo.sai_domain = SOCK_DOM(so);
 614                         ar->k_ar.ar_arg_sockinfo.sai_protocol = SOCK_PROTO(so);
 615                         pcb = (struct inpcb *)so->so_pcb;
 616                         sin6 = (struct sockaddr_in6 *)
 617                             &ar->k_ar.ar_arg_sockinfo.sai_faddr;
 618                         sin6->sin6_addr = pcb->in6p_faddr;
 619                         sin6->sin6_port = pcb->in6p_fport;
 620                         sin6 = (struct sockaddr_in6 *)
 621                             &ar->k_ar.ar_arg_sockinfo.sai_laddr;
 622                         sin6->sin6_addr = pcb->in6p_laddr;
 623                         sin6->sin6_port = pcb->in6p_lport;
 624                         ARG_SET_VALID(ar, ARG_SOCKINFO);
 625                 }
 626                 break;
 627
 628         default:
 629                 /* XXXAUDIT: else? */
 630                 break;
 631         }
 632 }
 633
 634 /*
 635  * Store a path as given by the user process for auditing into the audit
 636  * record stored on the user thread.  This function will allocate the memory
 637  * to store the path info if not already available.  This memory will be
 638  * freed when the audit record is freed.
 639  *
 640  * Note that the current working directory vp must be supplied at the audit call
 641  * site to permit per thread current working directories, and that it must take
 642  * a upath starting with '/' into account for chroot if the path is absolute.
 643  * This results in the real (non-chroot) path being recorded in the audit
 644  * record.
 645  *
 646  * XXXAUDIT: Possibly assert that the memory isn't already allocated?
 647  */
 648 void
 649 audit_arg_upath(struct kaudit_record *ar, struct vnode *cwd_vp, char *upath, u_int64_t flag)
 650 {
 651         char **pathp;
 652
 653         KASSERT(upath != NULL, ("audit_arg_upath: upath == NULL"));
 654         KASSERT((flag == ARG_UPATH1) || (flag == ARG_UPATH2),
 655             ("audit_arg_upath: flag %llu", (unsigned long long)flag));
 656         KASSERT((flag != ARG_UPATH1) || (flag != ARG_UPATH2),
 657             ("audit_arg_upath: flag %llu", (unsigned long long)flag));
 658
 659         if (flag == ARG_UPATH1) {
 660                 pathp = &ar->k_ar.ar_arg_upath1;
 661         } else {
 662                 pathp = &ar->k_ar.ar_arg_upath2;
 663         }
 664
 665         if (*pathp == NULL) {
 666                 *pathp = malloc(MAXPATHLEN, M_AUDITPATH, M_WAITOK);
 667         } else {
 668                 return;
 669         }
 670
 671         if (audit_canon_path(cwd_vp, upath, *pathp) == 0) {
 672                 ARG_SET_VALID(ar, flag);
 673         } else {
 674                 free(*pathp, M_AUDITPATH);
 675                 *pathp = NULL;
 676         }
 677 }
 678
 679 void
 680 audit_arg_kpath(struct kaudit_record *ar, char *kpath, u_int64_t flag)
 681 {
 682         char **pathp;
 683
 684         KASSERT(kpath != NULL, ("audit_arg_kpath: kpath == NULL"));
 685         KASSERT((flag == ARG_KPATH1) || (flag == ARG_KPATH2),
 686             ("audit_arg_kpath: flag %llu", (unsigned long long)flag));
 687         KASSERT((flag != ARG_KPATH1) || (flag != ARG_KPATH2),
 688             ("audit_arg_kpath: flag %llu", (unsigned long long)flag));
 689
 690         if (flag == ARG_KPATH1) {
 691                 pathp = &ar->k_ar.ar_arg_kpath1;
 692         } else {
 693                 pathp = &ar->k_ar.ar_arg_kpath2;
 694         }
 695
 696         if (*pathp == NULL) {
 697                 *pathp = malloc(MAXPATHLEN, M_AUDITPATH, M_WAITOK);
 698         } else {
 699                 return;
 700         }
 701
 702         strlcpy(*pathp, kpath, MAXPATHLEN);
 703         ARG_SET_VALID(ar, flag);
 704 }
 705
 706 /*
 707  * Function to save the path and vnode attr information into the audit
 708  * record.
 709  *
 710  * It is assumed that the caller will hold any vnode locks necessary to
 711  * perform a VNOP_GETATTR() on the passed vnode.
 712  *
 713  * XXX: The attr code is very similar to vfs_vnops.c:vn_stat(), but always
 714  * provides access to the generation number as we need that to construct the
 715  * BSM file ID.
 716  *
 717  * XXX: We should accept the process argument from the caller, since it's
 718  * very likely they already have a reference.
 719  *
 720  * XXX: Error handling in this function is poor.
 721  *
 722  * XXXAUDIT: Possibly KASSERT the path pointer is NULL?
 723  */
 724 void
 725 audit_arg_vnpath(struct kaudit_record *ar, struct vnode *vp, u_int64_t flags)
 726 {
 727         struct vnode_attr va;
 728         int error;
 729         int len;
 730         char **pathp;
 731         struct vnode_au_info *vnp;
 732         proc_t p;
 733 #if CONFIG_MACF
 734         char **vnode_mac_labelp;
 735         struct mac mac;
 736 #endif
 737
 738         KASSERT(vp != NULL, ("audit_arg_vnpath: vp == NULL"));
 739         KASSERT((flags == ARG_VNODE1) || (flags == ARG_VNODE2),
 740             ("audit_arg_vnpath: flags != ARG_VNODE[1,2]"));
 741
 742         p = current_proc();
 743
 744         /*
 745          * XXXAUDIT: The below clears, and then resets the flags for valid
 746          * arguments.  Ideally, either the new vnode is used, or the old one
 747          * would be.
 748          */
 749         if (flags & ARG_VNODE1) {
 750                 ar->k_ar.ar_valid_arg &= (ARG_ALL ^ ARG_KPATH1);
 751                 ar->k_ar.ar_valid_arg &= (ARG_ALL ^ ARG_VNODE1);
 752                 pathp = &ar->k_ar.ar_arg_kpath1;
 753                 vnp = &ar->k_ar.ar_arg_vnode1;
 754 #if CONFIG_MACF
 755                 vnode_mac_labelp = &ar->k_ar.ar_vnode1_mac_labels;
 756 #endif
 757         } else {
 758                 ar->k_ar.ar_valid_arg &= (ARG_ALL ^ ARG_KPATH2);
 759                 ar->k_ar.ar_valid_arg &= (ARG_ALL ^ ARG_VNODE2);
 760                 pathp = &ar->k_ar.ar_arg_kpath2;
 761                 vnp = &ar->k_ar.ar_arg_vnode2;
 762 #if CONFIG_MACF
 763                 vnode_mac_labelp = &ar->k_ar.ar_vnode2_mac_labels;
 764 #endif
 765         }
 766
 767         if (*pathp == NULL) {
 768                 *pathp = malloc(MAXPATHLEN, M_AUDITPATH, M_WAITOK);
 769         } else {
 770                 return;
 771         }
 772
 773         /*
 774          * If vn_getpath() succeeds, place it in a string buffer
 775          * attached to the audit record, and set a flag indicating
 776          * it is present.
 777          */
 778         len = MAXPATHLEN;
 779         if (vn_getpath(vp, *pathp, &len) == 0) {
 780                 if (flags & ARG_VNODE1) {
 781                         ARG_SET_VALID(ar, ARG_KPATH1);
 782                 } else {
 783                         ARG_SET_VALID(ar, ARG_KPATH2);
 784                 }
 785         } else {
 786                 free(*pathp, M_AUDITPATH);
 787                 *pathp = NULL;
 788         }
 789
 790         VATTR_INIT(&va);
 791         VATTR_WANTED(&va, va_mode);
 792         VATTR_WANTED(&va, va_uid);
 793         VATTR_WANTED(&va, va_gid);
 794         VATTR_WANTED(&va, va_rdev);
 795         VATTR_WANTED(&va, va_fsid);
 796         VATTR_WANTED(&va, va_fileid);
 797         VATTR_WANTED(&va, va_gen);
 798         error = vnode_getattr(vp, &va, vfs_context_current());
 799         if (error) {
 800                 /* XXX: How to handle this case? */
 801                 return;
 802         }
 803
 804 #if CONFIG_MACF
 805         if (*vnode_mac_labelp == NULL && (vp->v_lflag & VL_LABELED) == VL_LABELED) {
 806                 *vnode_mac_labelp = (char *)zalloc(audit_mac_label_zone);
 807                 if (*vnode_mac_labelp != NULL) {
 808                         mac.m_buflen = MAC_AUDIT_LABEL_LEN;
 809                         mac.m_string = *vnode_mac_labelp;
 810                         mac_vnode_label_externalize_audit(vp, &mac);
 811                 }
 812         }
 813 #endif
 814
 815         /*
 816          * XXX do we want to fall back here when these aren't supported?
 817          */
 818         vnp->vn_mode = va.va_mode;
 819         vnp->vn_uid = va.va_uid;
 820         vnp->vn_gid = va.va_gid;
 821         vnp->vn_dev = va.va_rdev;
 822         vnp->vn_fsid = va.va_fsid;
 823         vnp->vn_fileid = (u_int32_t)va.va_fileid;
 824         vnp->vn_gen = va.va_gen;
 825         if (flags & ARG_VNODE1) {
 826                 ARG_SET_VALID(ar, ARG_VNODE1);
 827         } else {
 828                 ARG_SET_VALID(ar, ARG_VNODE2);
 829         }
 830 }
 831
 832 void
 833 audit_arg_vnpath_withref(struct kaudit_record *ar, struct vnode *vp, u_int64_t flags)
 834 {
 835         if (vp == NULL || vnode_getwithref(vp)) {
 836                 return;
 837         }
 838         audit_arg_vnpath(ar, vp, flags);
 839         (void)vnode_put(vp);
 840 }
 841
 842 void
 843 audit_arg_mach_port1(struct kaudit_record *ar, mach_port_name_t port)
 844 {
 845         ar->k_ar.ar_arg_mach_port1 = port;
 846         ARG_SET_VALID(ar, ARG_MACHPORT1);
 847 }
 848
 849 void
 850 audit_arg_mach_port2(struct kaudit_record *ar, mach_port_name_t port)
 851 {
 852         ar->k_ar.ar_arg_mach_port2 = port;
 853         ARG_SET_VALID(ar, ARG_MACHPORT2);
 854 }
 855
 856
 857 /*
 858  * Audit the argument strings passed to exec.
 859  */
 860 void
 861 audit_arg_argv(struct kaudit_record *ar, char *argv, int argc, int length)
 862 {
 863         if (audit_argv == 0 || argc == 0) {
 864                 return;
 865         }
 866
 867         if (ar->k_ar.ar_arg_argv == NULL) {
 868                 ar->k_ar.ar_arg_argv = malloc(length, M_AUDITTEXT, M_WAITOK);
 869         }
 870         bcopy(argv, ar->k_ar.ar_arg_argv, length);
 871         ar->k_ar.ar_arg_argc = argc;
 872         ARG_SET_VALID(ar, ARG_ARGV);
 873 }
 874
 875 /*
 876  * Audit the environment strings passed to exec.
 877  */
 878 void
 879 audit_arg_envv(struct kaudit_record *ar, char *envv, int envc, int length)
 880 {
 881         if (audit_arge == 0 || envc == 0) {
 882                 return;
 883         }
 884
 885         if (ar->k_ar.ar_arg_envv == NULL) {
 886                 ar->k_ar.ar_arg_envv = malloc(length, M_AUDITTEXT, M_WAITOK);
 887         }
 888         bcopy(envv, ar->k_ar.ar_arg_envv, length);
 889         ar->k_ar.ar_arg_envc = envc;
 890         ARG_SET_VALID(ar, ARG_ENVV);
 891 }
 892
 893 /*
 894  * The close() system call uses it's own audit call to capture the path/vnode
 895  * information because those pieces are not easily obtained within the system
 896  * call itself.
 897  */
 898 void
 899 audit_sysclose(struct kaudit_record *ar, proc_t p, int fd)
 900 {
 901         struct fileproc *fp;
 902         struct vnode *vp;
 903
 904         KASSERT(p != NULL, ("audit_sysclose: p == NULL"));
 905
 906         audit_arg_fd(ar, fd);
 907
 908         if (fp_getfvp(p, fd, &fp, &vp) != 0) {
 909                 return;
 910         }
 911
 912         audit_arg_vnpath_withref(ar, (struct vnode *)fp->f_fglob->fg_data,
 913             ARG_VNODE1);
 914         fp_drop(p, fd, fp, 0);
 915 }
 916
 917 void
 918 audit_identity_info_destruct(struct au_identity_info *id_info)
 919 {
 920         if (!id_info) {
 921                 return;
 922         }
 923
 924         if (id_info->signing_id != NULL) {
 925                 free(id_info->signing_id, M_AUDITTEXT);
 926                 id_info->signing_id = NULL;
 927         }
 928
 929         if (id_info->team_id != NULL) {
 930                 free(id_info->team_id, M_AUDITTEXT);
 931                 id_info->team_id = NULL;
 932         }
 933
 934         if (id_info->cdhash != NULL) {
 935                 free(id_info->cdhash, M_AUDITDATA);
 936                 id_info->cdhash = NULL;
 937         }
 938 }
 939
 940 void
 941 audit_identity_info_construct(struct au_identity_info *id_info)
 942 {
 943         struct proc *p;
 944         struct cs_blob *blob;
 945         unsigned int signer_type = 0;
 946         const char *signing_id = NULL;
 947         const char* team_id = NULL;
 948         const uint8_t *cdhash = NULL;
 949         size_t src_len = 0;
 950
 951         p = current_proc();
 952         blob = csproc_get_blob(p);
 953         if (blob) {
 954                 signing_id = csblob_get_identity(blob);
 955                 cdhash = csblob_get_cdhash(blob);
 956                 team_id = csblob_get_teamid(blob);
 957                 signer_type = csblob_get_platform_binary(blob) ? 1 : 0;
 958         }
 959
 960         id_info->signer_type = signer_type;
 961
 962         if (id_info->signing_id == NULL && signing_id != NULL) {
 963                 id_info->signing_id = malloc( MAX_AU_IDENTITY_SIGNING_ID_LENGTH,
 964                     M_AUDITTEXT, M_WAITOK);
 965                 if (id_info->signing_id != NULL) {
 966                         src_len = strlcpy(id_info->signing_id,
 967                             signing_id, MAX_AU_IDENTITY_SIGNING_ID_LENGTH);
 968
 969                         if (src_len >= MAX_AU_IDENTITY_SIGNING_ID_LENGTH) {
 970                                 id_info->signing_id_trunc = 1;
 971                         }
 972                 }
 973         }
 974
 975         if (id_info->team_id == NULL && team_id != NULL) {
 976                 id_info->team_id = malloc(MAX_AU_IDENTITY_TEAM_ID_LENGTH,
 977                     M_AUDITTEXT, M_WAITOK);
 978                 if (id_info->team_id != NULL) {
 979                         src_len = strlcpy(id_info->team_id, team_id,
 980                             MAX_AU_IDENTITY_TEAM_ID_LENGTH);
 981
 982                         if (src_len >= MAX_AU_IDENTITY_TEAM_ID_LENGTH) {
 983                                 id_info->team_id_trunc = 1;
 984                         }
 985                 }
 986         }
 987
 988         if (id_info->cdhash == NULL && cdhash != NULL) {
 989                 id_info->cdhash = malloc(CS_CDHASH_LEN, M_AUDITDATA, M_WAITOK);
 990                 if (id_info->cdhash != NULL) {
 991                         memcpy(id_info->cdhash, cdhash, CS_CDHASH_LEN);
 992                         id_info->cdhash_len = CS_CDHASH_LEN;
 993                 }
 994         }
 995 }
 996
 997 void
 998 audit_arg_identity(struct kaudit_record *ar)
 999 {
1000         audit_identity_info_construct(&ar->k_ar.ar_arg_identity);
1001         ARG_SET_VALID(ar, ARG_IDENTITY);
1002 }
1003
1004 #endif /* CONFIG_AUDIT */