]> git.saurik.com Git - apple/xnu.git/blob - bsd/security/audit/audit_bsm.c
projects / apple / xnu.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
xnu-6153.141.1.tar.gz
[apple/xnu.git] / bsd / security / audit / audit_bsm.c
1 /*
2 * Copyright (c) 1999-2016 Apple Inc.
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 * 3. Neither the name of Apple Inc. ("Apple") nor the names of
14 * its contributors may be used to endorse or promote products derived
15 * from this software without specific prior written permission.
16 *
17 * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND
18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20 * ARE DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR
21 * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
25 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
26 * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
27 * POSSIBILITY OF SUCH DAMAGE.
28 */
29 /*
30 * NOTICE: This file was modified by SPARTA, Inc. in 2005 to introduce
31 * support for mandatory and extensible security protections. This notice
32 * is included in support of clause 2.2 (b) of the Apple Public License,
33 * Version 2.0.
34 */
35
36 #include <sys/types.h>
37 #include <sys/vnode_internal.h>
38 #include <sys/ipc.h>
39 #include <sys/sem.h>
40 #include <sys/socketvar.h>
41 #include <sys/socket.h>
42 #include <sys/queue.h>
43 #include <sys/fcntl.h>
44 #include <sys/user.h>
45 #include <sys/ipc.h>
46
47 #include <bsm/audit.h>
48 #include <bsm/audit_internal.h>
49 #include <bsm/audit_record.h>
50 #include <bsm/audit_kevents.h>
51
52 #include <security/audit/audit.h>
53 #include <security/audit/audit_bsd.h>
54 #include <security/audit/audit_private.h>
55
56 #include <netinet/in_systm.h>
57 #include <netinet/in.h>
58 #include <netinet/ip.h>
59
60 #if CONFIG_AUDIT
61 MALLOC_DEFINE(M_AUDITBSM, "audit_bsm", "Audit BSM data");
62
63 #if CONFIG_MACF
64 #include <security/mac_framework.h>
65 #endif
66
67 static void audit_sys_auditon(struct audit_record *ar,
68 struct au_record *rec);
69 static void audit_sys_fcntl(struct kaudit_record *kar,
70 struct au_record *rec);
71
72 /*
73 * Initialize the BSM auditing subsystem.
74 */
75 void
76 kau_init(void)
77 {
78 au_evclassmap_init();
79 }
80
81 /*
82 * This call reserves memory for the audit record. Memory must be guaranteed
83 * before any auditable event can be generated. The au_record structure
84 * maintains a reference to the memory allocated above and also the list of
85 * tokens associated with this record.
86 */
87 static struct au_record *
88 kau_open(void)
89 {
90 struct au_record *rec;
91
92 rec = malloc(sizeof(*rec), M_AUDITBSM, M_WAITOK);
93 rec->data = NULL;
94 TAILQ_INIT(&rec->token_q);
95 rec->len = 0;
96 rec->used = 1;
97
98 return rec;
99 }
100
101 /*
102 * Store the token with the record descriptor.
103 */
104 static void
105 kau_write(struct au_record *rec, struct au_token *tok)
106 {
107 KASSERT(tok != NULL, ("kau_write: tok == NULL"));
108
109 TAILQ_INSERT_TAIL(&rec->token_q, tok, tokens);
110 rec->len += tok->len;
111 }
112
113 /*
114 * Close out the audit record by adding the header token, identifying any
115 * missing tokens. Write out the tokens to the record memory.
116 */
117 static void
118 kau_close(struct au_record *rec, struct timespec *ctime, short event)
119 {
120 u_char *dptr;
121 size_t tot_rec_size;
122 token_t *cur, *hdr, *trail;
123 struct timeval tm;
124 size_t hdrsize;
125 struct auditinfo_addr ak;
126 struct in6_addr *ap;
127
128 audit_get_kinfo(&ak);
129 hdrsize = 0;
130 switch (ak.ai_termid.at_type) {
131 case AU_IPv4:
132 hdrsize = (ak.ai_termid.at_addr[0] == INADDR_ANY) ?
133 AUDIT_HEADER_SIZE : AUDIT_HEADER_EX_SIZE(&ak);
134 break;
135 case AU_IPv6:
136 ap = (struct in6_addr *)&ak.ai_termid.at_addr[0];
137 hdrsize = (IN6_IS_ADDR_UNSPECIFIED(ap)) ? AUDIT_HEADER_SIZE :
138 AUDIT_HEADER_EX_SIZE(&ak);
139 break;
140 default:
141 panic("kau_close: invalid address family");
142 }
143 tot_rec_size = rec->len + AUDIT_HEADER_SIZE + AUDIT_TRAILER_SIZE;
144 rec->data = malloc(tot_rec_size, M_AUDITBSM, M_WAITOK | M_ZERO);
145
146 tm.tv_usec = ctime->tv_nsec / 1000;
147 tm.tv_sec = ctime->tv_sec;
148 if (hdrsize != AUDIT_HEADER_SIZE) {
149 hdr = au_to_header32_ex_tm(tot_rec_size, event, 0, tm, &ak);
150 } else {
151 hdr = au_to_header32_tm(tot_rec_size, event, 0, tm);
152 }
153 TAILQ_INSERT_HEAD(&rec->token_q, hdr, tokens);
154
155 trail = au_to_trailer(tot_rec_size);
156 TAILQ_INSERT_TAIL(&rec->token_q, trail, tokens);
157
158 rec->len = tot_rec_size;
159 dptr = rec->data;
160 TAILQ_FOREACH(cur, &rec->token_q, tokens) {
161 memcpy(dptr, cur->t_data, cur->len);
162 dptr += cur->len;
163 }
164 }
165
166 /*
167 * Free a BSM audit record by releasing all the tokens and clearing the audit
168 * record information.
169 */
170 void
171 kau_free(struct au_record *rec)
172 {
173 struct au_token *tok;
174
175 /* Free the token list. */
176 while ((tok = TAILQ_FIRST(&rec->token_q))) {
177 TAILQ_REMOVE(&rec->token_q, tok, tokens);
178 free(tok->t_data, M_AUDITBSM);
179 free(tok, M_AUDITBSM);
180 }
181
182 rec->used = 0;
183 rec->len = 0;
184 free(rec->data, M_AUDITBSM);
185 free(rec, M_AUDITBSM);
186 }
187
188 /*
189 * XXX: May want turn some (or all) of these macros into functions in order
190 * to reduce the generated code size.
191 *
192 * XXXAUDIT: These macros assume that 'kar', 'ar', 'rec', and 'tok' in the
193 * caller are OK with this.
194 */
195 #if CONFIG_MACF
196 #define MAC_VNODE1_LABEL_TOKEN do { \
197 if (ar->ar_vnode1_mac_labels != NULL && \
198 strlen(ar->ar_vnode1_mac_labels) != 0) { \
199 tok = au_to_text(ar->ar_vnode1_mac_labels); \
200 kau_write(rec, tok); \
201 } \
202 } while (0)
203
204 #define MAC_VNODE2_LABEL_TOKEN do { \
205 if (ar->ar_vnode2_mac_labels != NULL && \
206 strlen(ar->ar_vnode2_mac_labels) != 0) { \
207 tok = au_to_text(ar->ar_vnode2_mac_labels); \
208 kau_write(rec, tok); \
209 } \
210 } while (0)
211 #else
212 #define MAC_VNODE1_LABEL_TOKEN
213 #define MAC_VNODE2_LABEL_TOKEN
214 #endif
215 #define UPATH1_TOKENS do { \
216 if (ARG_IS_VALID(kar, ARG_UPATH1)) { \
217 tok = au_to_path(ar->ar_arg_upath1); \
218 kau_write(rec, tok); \
219 } \
220 } while (0)
221
222 #define UPATH2_TOKENS do { \
223 if (ARG_IS_VALID(kar, ARG_UPATH2)) { \
224 tok = au_to_path(ar->ar_arg_upath2); \
225 kau_write(rec, tok); \
226 } \
227 } while (0)
228
229 #define KPATH2_TOKENS do { \
230 if (ARG_IS_VALID(kar, ARG_KPATH2)) { \
231 tok = au_to_path(ar->ar_arg_kpath2); \
232 kau_write(rec, tok); \
233 } \
234 } while (0)
235
236 #define VNODE1_TOKENS do { \
237 if (ARG_IS_VALID(kar, ARG_KPATH1)) { \
238 tok = au_to_path(ar->ar_arg_kpath1); \
239 kau_write(rec, tok); \
240 } \
241 if (ARG_IS_VALID(kar, ARG_VNODE1)) { \
242 tok = au_to_attr32(&ar->ar_arg_vnode1); \
243 kau_write(rec, tok); \
244 MAC_VNODE1_LABEL_TOKEN; \
245 } \
246 } while (0)
247
248 #define UPATH1_VNODE1_TOKENS do { \
249 if (ARG_IS_VALID(kar, ARG_UPATH1)) { \
250 tok = au_to_path(ar->ar_arg_upath1); \
251 kau_write(rec, tok); \
252 } \
253 if (ARG_IS_VALID(kar, ARG_KPATH1)) { \
254 tok = au_to_path(ar->ar_arg_kpath1); \
255 kau_write(rec, tok); \
256 } \
257 if (ARG_IS_VALID(kar, ARG_VNODE1)) { \
258 tok = au_to_attr32(&ar->ar_arg_vnode1); \
259 kau_write(rec, tok); \
260 MAC_VNODE1_LABEL_TOKEN; \
261 } \
262 } while (0)
263
264 #define VNODE2_TOKENS do { \
265 if (ARG_IS_VALID(kar, ARG_VNODE2)) { \
266 tok = au_to_attr32(&ar->ar_arg_vnode2); \
267 kau_write(rec, tok); \
268 MAC_VNODE2_LABEL_TOKEN; \
269 } \
270 } while (0)
271
272 #define VNODE2_PATH_TOKENS do { \
273 if (ARG_IS_VALID(kar, ARG_KPATH2)) { \
274 tok = au_to_path(ar->ar_arg_kpath2); \
275 kau_write(rec, tok); \
276 } \
277 if (ARG_IS_VALID(kar, ARG_VNODE2)) { \
278 tok = au_to_attr32(&ar->ar_arg_vnode2); \
279 kau_write(rec, tok); \
280 MAC_VNODE2_LABEL_TOKEN; \
281 } \
282 } while (0)
283
284 #define FD_VNODE1_TOKENS do { \
285 if (ARG_IS_VALID(kar, ARG_VNODE1)) { \
286 if (ARG_IS_VALID(kar, ARG_KPATH1)) { \
287 tok = au_to_path(ar->ar_arg_kpath1); \
288 kau_write(rec, tok); \
289 } \
290 if (ARG_IS_VALID(kar, ARG_FD)) { \
291 tok = au_to_arg32(1, "fd", ar->ar_arg_fd); \
292 kau_write(rec, tok); \
293 MAC_VNODE1_LABEL_TOKEN; \
294 } \
295 tok = au_to_attr32(&ar->ar_arg_vnode1); \
296 kau_write(rec, tok); \
297 } else { \
298 if (ARG_IS_VALID(kar, ARG_FD)) { \
299 tok = au_to_arg32(1, "fd", \
300 ar->ar_arg_fd); \
301 kau_write(rec, tok); \
302 MAC_VNODE1_LABEL_TOKEN; \
303 } \
304 } \
305 } while (0)
306
307 #define PROCESS_PID_TOKENS(argn) do { \
308 if ((ar->ar_arg_pid > 0) /* Reference a single process */ \
309 && (ARG_IS_VALID(kar, ARG_PROCESS))) { \
310 tok = au_to_process32_ex(ar->ar_arg_auid, \
311 ar->ar_arg_euid, ar->ar_arg_egid, \
312 ar->ar_arg_ruid, ar->ar_arg_rgid, \
313 ar->ar_arg_pid, ar->ar_arg_asid, \
314 &ar->ar_arg_termid_addr); \
315 kau_write(rec, tok); \
316 } else if (ARG_IS_VALID(kar, ARG_PID)) { \
317 tok = au_to_arg32(argn, "process", ar->ar_arg_pid); \
318 kau_write(rec, tok); \
319 } \
320 } while (0)
321
322 #define EXTATTR_TOKENS do { \
323 if (ARG_IS_VALID(kar, ARG_VALUE32)) { \
324 switch (ar->ar_arg_value32) { \
325 case EXTATTR_NAMESPACE_USER: \
326 tok = au_to_text(EXTATTR_NAMESPACE_USER_STRING);\
327 break; \
328 case EXTATTR_NAMESPACE_SYSTEM: \
329 tok = au_to_text(EXTATTR_NAMESPACE_SYSTEM_STRING);\
330 break; \
331 default: \
332 tok = au_to_arg32(3, "attrnamespace", \
333 ar->ar_arg_value32); \
334 break; \
335 } \
336 kau_write(rec, tok); \
337 } \
338 /* attrname is in the text field */ \
339 if (ARG_IS_VALID(kar, ARG_TEXT)) { \
340 tok = au_to_text(ar->ar_arg_text); \
341 kau_write(rec, tok); \
342 } \
343 } while (0)
344
345 #define EXTENDED_TOKENS(n) do { \
346 /* ACL data */ \
347 if (ARG_IS_VALID(kar, ARG_OPAQUE)) { \
348 tok = au_to_opaque(ar->ar_arg_opaque, \
349 ar->ar_arg_opq_size); \
350 kau_write(rec, tok); \
351 } \
352 if (ARG_IS_VALID(kar, ARG_MODE)) { \
353 tok = au_to_arg32(n+2, "mode", ar->ar_arg_mode);\
354 kau_write(rec, tok); \
355 } \
356 if (ARG_IS_VALID(kar, ARG_GID)) { \
357 tok = au_to_arg32(n+1, "gid", ar->ar_arg_gid); \
358 kau_write(rec, tok); \
359 } \
360 if (ARG_IS_VALID(kar, ARG_UID)) { \
361 tok = au_to_arg32(n, "uid", ar->ar_arg_uid); \
362 kau_write(rec, tok); \
363 } \
364 } while (0)
365
366 #define PROCESS_MAC_TOKENS do { \
367 if (ar->ar_valid_arg & ARG_MAC_STRING) { \
368 tok = au_to_text(ar->ar_arg_mac_string); \
369 kau_write(rec, tok); \
370 } \
371 } while (0)
372
373 /*
374 * Implement auditing for the auditon() system call. The audit tokens that
375 * are generated depend on the command that was sent into the auditon()
376 * system call.
377 */
378 static void
379 audit_sys_auditon(struct audit_record *ar, struct au_record *rec)
380 {
381 struct au_token *tok;
382
383 switch (ar->ar_arg_cmd) {
384 case A_OLDSETPOLICY:
385 if (ar->ar_arg_len > sizeof(int)) {
386 tok = au_to_arg32(3, "length", ar->ar_arg_len);
387 kau_write(rec, tok);
388 tok = au_to_arg64(2, "policy",
389 ar->ar_arg_auditon.au_policy64);
390 kau_write(rec, tok);
391 break;
392 }
393 /* FALLTHROUGH */
394 case A_SETPOLICY:
395 tok = au_to_arg32(3, "length", ar->ar_arg_len);
396 kau_write(rec, tok);
397 tok = au_to_arg32(2, "policy", ar->ar_arg_auditon.au_policy);
398 kau_write(rec, tok);
399 break;
400
401 case A_SETKMASK:
402 tok = au_to_arg32(3, "length", ar->ar_arg_len);
403 kau_write(rec, tok);
404 tok = au_to_arg32(2, "setkmask:as_success",
405 ar->ar_arg_auditon.au_mask.am_success);
406 kau_write(rec, tok);
407 tok = au_to_arg32(2, "setkmask:as_failure",
408 ar->ar_arg_auditon.au_mask.am_failure);
409 kau_write(rec, tok);
410 break;
411
412 case A_OLDSETQCTRL:
413 if (ar->ar_arg_len > sizeof(au_qctrl_t)) {
414 tok = au_to_arg32(3, "length", ar->ar_arg_len);
415 kau_write(rec, tok);
416 tok = au_to_arg64(2, "setqctrl:aq_hiwater",
417 ar->ar_arg_auditon.au_qctrl64.aq64_hiwater);
418 kau_write(rec, tok);
419 tok = au_to_arg64(2, "setqctrl:aq_lowater",
420 ar->ar_arg_auditon.au_qctrl64.aq64_lowater);
421 kau_write(rec, tok);
422 tok = au_to_arg64(2, "setqctrl:aq_bufsz",
423 ar->ar_arg_auditon.au_qctrl64.aq64_bufsz);
424 kau_write(rec, tok);
425 tok = au_to_arg64(2, "setqctrl:aq_delay",
426 ar->ar_arg_auditon.au_qctrl64.aq64_delay);
427 kau_write(rec, tok);
428 tok = au_to_arg32(2, "setqctrl:aq_minfree",
429 ar->ar_arg_auditon.au_qctrl64.aq64_minfree);
430 kau_write(rec, tok);
431 break;
432 }
433 /* FALLTHROUGH */
434 case A_SETQCTRL:
435 tok = au_to_arg32(3, "length", ar->ar_arg_len);
436 kau_write(rec, tok);
437 tok = au_to_arg32(2, "setqctrl:aq_hiwater",
438 ar->ar_arg_auditon.au_qctrl.aq_hiwater);
439 kau_write(rec, tok);
440 tok = au_to_arg32(2, "setqctrl:aq_lowater",
441 ar->ar_arg_auditon.au_qctrl.aq_lowater);
442 kau_write(rec, tok);
443 tok = au_to_arg32(2, "setqctrl:aq_bufsz",
444 ar->ar_arg_auditon.au_qctrl.aq_bufsz);
445 kau_write(rec, tok);
446 tok = au_to_arg32(2, "setqctrl:aq_delay",
447 ar->ar_arg_auditon.au_qctrl.aq_delay);
448 kau_write(rec, tok);
449 tok = au_to_arg32(2, "setqctrl:aq_minfree",
450 ar->ar_arg_auditon.au_qctrl.aq_minfree);
451 kau_write(rec, tok);
452 break;
453
454 case A_SETUMASK:
455 tok = au_to_arg32(3, "length", ar->ar_arg_len);
456 kau_write(rec, tok);
457 tok = au_to_arg32(2, "setumask:as_success",
458 ar->ar_arg_auditon.au_auinfo.ai_mask.am_success);
459 kau_write(rec, tok);
460 tok = au_to_arg32(2, "setumask:as_failure",
461 ar->ar_arg_auditon.au_auinfo.ai_mask.am_failure);
462 kau_write(rec, tok);
463 break;
464
465 case A_SETSMASK:
466 tok = au_to_arg32(3, "length", ar->ar_arg_len);
467 kau_write(rec, tok);
468 tok = au_to_arg32(2, "setsmask:as_success",
469 ar->ar_arg_auditon.au_auinfo.ai_mask.am_success);
470 kau_write(rec, tok);
471 tok = au_to_arg32(2, "setsmask:as_failure",
472 ar->ar_arg_auditon.au_auinfo.ai_mask.am_failure);
473 kau_write(rec, tok);
474 break;
475
476 case A_OLDSETCOND:
477 if (ar->ar_arg_len > sizeof(int)) {
478 tok = au_to_arg32(3, "length", ar->ar_arg_len);
479 kau_write(rec, tok);
480 tok = au_to_arg64(2, "setcond",
481 ar->ar_arg_auditon.au_cond64);
482 kau_write(rec, tok);
483 break;
484 }
485 /* FALLTHROUGH */
486 case A_SETCOND:
487 tok = au_to_arg32(3, "length", ar->ar_arg_len);
488 kau_write(rec, tok);
489 tok = au_to_arg32(2, "setcond", ar->ar_arg_auditon.au_cond);
490 kau_write(rec, tok);
491 break;
492
493 case A_SETCLASS:
494 tok = au_to_arg32(3, "length", ar->ar_arg_len);
495 kau_write(rec, tok);
496 tok = au_to_arg32(2, "setclass:ec_event",
497 ar->ar_arg_auditon.au_evclass.ec_number);
498 kau_write(rec, tok);
499 tok = au_to_arg32(3, "setclass:ec_class",
500 ar->ar_arg_auditon.au_evclass.ec_class);
501 kau_write(rec, tok);
502 break;
503
504 case A_SETPMASK:
505 tok = au_to_arg32(3, "length", ar->ar_arg_len);
506 kau_write(rec, tok);
507 tok = au_to_arg32(2, "setpmask:as_success",
508 ar->ar_arg_auditon.au_aupinfo.ap_mask.am_success);
509 kau_write(rec, tok);
510 tok = au_to_arg32(2, "setpmask:as_failure",
511 ar->ar_arg_auditon.au_aupinfo.ap_mask.am_failure);
512 kau_write(rec, tok);
513 break;
514
515 case A_SETFSIZE:
516 tok = au_to_arg32(3, "length", ar->ar_arg_len);
517 kau_write(rec, tok);
518 tok = au_to_arg32(2, "setfsize:filesize",
519 ar->ar_arg_auditon.au_fstat.af_filesz);
520 kau_write(rec, tok);
521 break;
522
523 default:
524 break;
525 }
526 tok = au_to_arg32(1, "cmd", ar->ar_arg_cmd);
527 kau_write(rec, tok);
528 }
529
530 /*
531 * Implement auditing for the fcntl() system call. The audit tokens that
532 * are generated depend on the command that was sent into the fcntl()
533 * system call.
534 */
535 static void
536 audit_sys_fcntl(struct kaudit_record *kar, struct au_record *rec)
537 {
538 struct au_token *tok;
539 struct audit_record *ar = &kar->k_ar;
540
541 switch (ar->ar_arg_cmd) {
542 case F_DUPFD:
543 if (ARG_IS_VALID(kar, ARG_VALUE32)) {
544 tok = au_to_arg32(3, "min fd", ar->ar_arg_value32);
545 kau_write(rec, tok);
546 }
547 break;
548
549 case F_SETFD:
550 if (ARG_IS_VALID(kar, ARG_VALUE32)) {
551 tok = au_to_arg32(3, "close-on-exec flag",
552 ar->ar_arg_value32);
553 kau_write(rec, tok);
554 }
555 break;
556
557 case F_SETFL:
558 if (ARG_IS_VALID(kar, ARG_VALUE32)) {
559 tok = au_to_arg32(3, "fd flags", ar->ar_arg_value32);
560 kau_write(rec, tok);
561 }
562 break;
563
564 case F_SETOWN:
565 if (ARG_IS_VALID(kar, ARG_VALUE32)) {
566 tok = au_to_arg32(3, "pid", ar->ar_arg_value32);
567 kau_write(rec, tok);
568 }
569 break;
570
571 #ifdef F_SETSIZE
572 case F_SETSIZE:
573 if (ARG_IS_VALID(kar, ARG_VALUE64)) {
574 tok = au_to_arg64(3, "offset", ar->ar_arg_value64);
575 kau_write(rec, tok);
576 }
577 break;
578 #endif /* F_SETSIZE */
579
580 #ifdef F_PATHPKG_CHECK
581 case F_PATHPKG_CHECK:
582 if (ARG_IS_VALID(kar, ARG_TEXT)) {
583 tok = au_to_text(ar->ar_arg_text);
584 kau_write(rec, tok);
585 }
586 break;
587 #endif
588
589 default:
590 break;
591 }
592 tok = au_to_arg32(2, "cmd", au_fcntl_cmd_to_bsm(ar->ar_arg_cmd));
593 kau_write(rec, tok);
594 }
595
596 /*
597 * Convert an internal kernel audit record to a BSM record and return a
598 * success/failure indicator. The BSM record is passed as an out parameter to
599 * this function.
600 *
601 * Return conditions:
602 * BSM_SUCCESS: The BSM record is valid
603 * BSM_FAILURE: Failure; the BSM record is NULL.
604 * BSM_NOAUDIT: The event is not auditable for BSM; the BSM record is NULL.
605 */
606 int
607 kaudit_to_bsm(struct kaudit_record *kar, struct au_record **pau)
608 {
609 struct au_token *tok = NULL, *subj_tok;
610 struct au_record *rec;
611 au_tid_t tid;
612 struct audit_record *ar;
613 int ctr;
614 u_int uctr;
615
616 KASSERT(kar != NULL, ("kaudit_to_bsm: kar == NULL"));
617
618 *pau = NULL;
619 ar = &kar->k_ar;
620 rec = kau_open();
621
622 /*
623 * Create the subject token.
624 */
625 switch (ar->ar_subj_term_addr.at_type) {
626 case AU_IPv4:
627 tid.port = ar->ar_subj_term_addr.at_port;
628 tid.machine = ar->ar_subj_term_addr.at_addr[0];
629 subj_tok = au_to_subject32(ar->ar_subj_auid, /* audit ID */
630 ar->ar_subj_cred.cr_uid, /* eff uid */
631 ar->ar_subj_egid, /* eff group id */
632 ar->ar_subj_ruid, /* real uid */
633 ar->ar_subj_rgid, /* real group id */
634 ar->ar_subj_pid, /* process id */
635 ar->ar_subj_asid, /* session ID */
636 &tid);
637 break;
638 case AU_IPv6:
639 subj_tok = au_to_subject32_ex(ar->ar_subj_auid,
640 ar->ar_subj_cred.cr_uid,
641 ar->ar_subj_egid,
642 ar->ar_subj_ruid,
643 ar->ar_subj_rgid,
644 ar->ar_subj_pid,
645 ar->ar_subj_asid,
646 &ar->ar_subj_term_addr);
647 break;
648 default:
649 bzero(&tid, sizeof(tid));
650 subj_tok = au_to_subject32(ar->ar_subj_auid,
651 ar->ar_subj_cred.cr_uid,
652 ar->ar_subj_egid,
653 ar->ar_subj_ruid,
654 ar->ar_subj_rgid,
655 ar->ar_subj_pid,
656 ar->ar_subj_asid,
657 &tid);
658 }
659
660 /*
661 * The logic inside each case fills in the tokens required for the
662 * event, except for the header, trailer, and return tokens. The
663 * header and trailer tokens are added by the kau_close() function.
664 * The return token is added outside of the switch statement.
665 */
666 switch (ar->ar_event) {
667 case AUE_SENDFILE:
668 /* For sendfile the file and socket descriptor are both saved */
669 if (ARG_IS_VALID(kar, ARG_VALUE32)) {
670 tok = au_to_arg32(2, "sd", ar->ar_arg_value32);
671 kau_write(rec, tok);
672 }
673 /* FALLTHROUGH */
674 case AUE_ACCEPT:
675 case AUE_BIND:
676 case AUE_LISTEN:
677 case AUE_CONNECT:
678 case AUE_RECVFROM:
679 case AUE_RECVMSG:
680 case AUE_SENDMSG:
681 case AUE_SENDTO:
682 /*
683 * Socket-related events.
684 */
685 if (ARG_IS_VALID(kar, ARG_FD)) {
686 tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
687 kau_write(rec, tok);
688 }
689 if (ARG_IS_VALID(kar, ARG_SADDRINET)) {
690 tok = au_to_sock_inet((struct sockaddr_in *)
691 &ar->ar_arg_sockaddr);
692 kau_write(rec, tok);
693 }
694 if (ARG_IS_VALID(kar, ARG_SADDRUNIX)) {
695 tok = au_to_sock_unix((struct sockaddr_un *)
696 &ar->ar_arg_sockaddr);
697 kau_write(rec, tok);
698 UPATH1_TOKENS;
699 }
700 if (ARG_IS_VALID(kar, ARG_SADDRINET6)) {
701 tok = au_to_sock_inet128((struct sockaddr_in6 *)
702 &ar->ar_arg_sockaddr);
703 kau_write(rec, tok);
704 }
705 break;
706
707 case AUE_SOCKET:
708 case AUE_SOCKETPAIR:
709 if (ARG_IS_VALID(kar, ARG_SOCKINFO)) {
710 tok = au_to_arg32(1, "domain",
711 au_domain_to_bsm(ar->ar_arg_sockinfo.sai_domain));
712 kau_write(rec, tok);
713 tok = au_to_arg32(2, "type",
714 au_socket_type_to_bsm(ar->ar_arg_sockinfo.sai_type));
715 kau_write(rec, tok);
716 tok = au_to_arg32(3, "protocol",
717 ar->ar_arg_sockinfo.sai_protocol);
718 kau_write(rec, tok);
719 }
720 break;
721
722 case AUE_SETSOCKOPT:
723 case AUE_SHUTDOWN:
724 if (ARG_IS_VALID(kar, ARG_FD)) {
725 tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
726 kau_write(rec, tok);
727 }
728 break;
729
730 case AUE_ACCT:
731 if (ARG_IS_VALID(kar, (ARG_KPATH1 | ARG_UPATH1))) {
732 UPATH1_VNODE1_TOKENS;
733 } else {
734 tok = au_to_arg32(1, "accounting off", 0);
735 kau_write(rec, tok);
736 }
737 break;
738
739 case AUE_SETAUID:
740 if (ARG_IS_VALID(kar, ARG_AUID)) {
741 tok = au_to_arg32(2, "setauid", ar->ar_arg_auid);
742 kau_write(rec, tok);
743 }
744 break;
745
746 case AUE_SETAUDIT:
747 if (ARG_IS_VALID(kar, ARG_AUID) &&
748 ARG_IS_VALID(kar, ARG_ASID) &&
749 ARG_IS_VALID(kar, ARG_AMASK) &&
750 ARG_IS_VALID(kar, ARG_TERMID)) {
751 tok = au_to_arg32(1, "setaudit:auid",
752 ar->ar_arg_auid);
753 kau_write(rec, tok);
754 tok = au_to_arg32(1, "setaudit:port",
755 ar->ar_arg_termid.port);
756 kau_write(rec, tok);
757 tok = au_to_arg32(1, "setaudit:machine",
758 ar->ar_arg_termid.machine);
759 kau_write(rec, tok);
760 tok = au_to_arg32(1, "setaudit:as_success",
761 ar->ar_arg_amask.am_success);
762 kau_write(rec, tok);
763 tok = au_to_arg32(1, "setaudit:as_failure",
764 ar->ar_arg_amask.am_failure);
765 kau_write(rec, tok);
766 tok = au_to_arg32(1, "setaudit:asid",
767 ar->ar_arg_asid);
768 kau_write(rec, tok);
769 }
770 break;
771
772 case AUE_SETAUDIT_ADDR:
773 if (ARG_IS_VALID(kar, ARG_AUID) &&
774 ARG_IS_VALID(kar, ARG_ASID) &&
775 ARG_IS_VALID(kar, ARG_AMASK) &&
776 ARG_IS_VALID(kar, ARG_TERMID_ADDR)) {
777 tok = au_to_arg32(1, "setaudit_addr:auid",
778 ar->ar_arg_auid);
779 kau_write(rec, tok);
780 tok = au_to_arg32(1, "setaudit_addr:as_success",
781 ar->ar_arg_amask.am_success);
782 kau_write(rec, tok);
783 tok = au_to_arg32(1, "setaudit_addr:as_failure",
784 ar->ar_arg_amask.am_failure);
785 kau_write(rec, tok);
786 tok = au_to_arg32(1, "setaudit_addr:asid",
787 ar->ar_arg_asid);
788 kau_write(rec, tok);
789 tok = au_to_arg32(1, "setaudit_addr:type",
790 ar->ar_arg_termid_addr.at_type);
791 kau_write(rec, tok);
792 tok = au_to_arg32(1, "setaudit_addr:port",
793 ar->ar_arg_termid_addr.at_port);
794 kau_write(rec, tok);
795 if (ar->ar_arg_termid_addr.at_type == AU_IPv6) {
796 tok = au_to_in_addr_ex((struct in6_addr *)
797 &ar->ar_arg_termid_addr.at_addr[0]);
798 }
799 if (ar->ar_arg_termid_addr.at_type == AU_IPv4) {
800 tok = au_to_in_addr((struct in_addr *)
801 &ar->ar_arg_termid_addr.at_addr[0]);
802 }
803 kau_write(rec, tok);
804 }
805 break;
806
807 case AUE_AUDITON:
808 /*
809 * For AUDITON commands without own event, audit the cmd.
810 */
811 if (ARG_IS_VALID(kar, ARG_CMD)) {
812 tok = au_to_arg32(1, "cmd", ar->ar_arg_cmd);
813 kau_write(rec, tok);
814 }
815 /* FALLTHROUGH */
816
817 case AUE_AUDITON_GETCAR:
818 case AUE_AUDITON_GETCLASS:
819 case AUE_AUDITON_GETCOND:
820 case AUE_AUDITON_GETCWD:
821 case AUE_AUDITON_GETKMASK:
822 case AUE_AUDITON_GETSTAT:
823 case AUE_AUDITON_GPOLICY:
824 case AUE_AUDITON_GQCTRL:
825 case AUE_AUDITON_SETCLASS:
826 case AUE_AUDITON_SETCOND:
827 case AUE_AUDITON_SETKMASK:
828 case AUE_AUDITON_SETSMASK:
829 case AUE_AUDITON_SETSTAT:
830 case AUE_AUDITON_SETUMASK:
831 case AUE_AUDITON_SPOLICY:
832 case AUE_AUDITON_SQCTRL:
833 if (ARG_IS_VALID(kar, ARG_AUDITON)) {
834 audit_sys_auditon(ar, rec);
835 }
836 break;
837
838 case AUE_AUDITCTL:
839 UPATH1_VNODE1_TOKENS;
840 break;
841
842 case AUE_EXIT:
843 if (ARG_IS_VALID(kar, ARG_EXIT)) {
844 tok = au_to_exit(ar->ar_arg_exitretval,
845 ar->ar_arg_exitstatus);
846 kau_write(rec, tok);
847 }
848 break;
849
850 case AUE_ADJTIME:
851 case AUE_AUDIT:
852 case AUE_DUP2:
853 case AUE_GETAUDIT:
854 case AUE_GETAUDIT_ADDR:
855 case AUE_GETAUID:
856 case AUE_GETFSSTAT:
857 case AUE_KQUEUE:
858 case AUE_LSEEK:
859 #if 0
860 /* XXXss replace with kext */
861 case AUE_MODLOAD:
862 case AUE_MODUNLOAD:
863 #endif
864 case AUE_MAC_GETFSSTAT:
865 case AUE_PIPE:
866 case AUE_PROFILE:
867 case AUE_SEMSYS:
868 case AUE_SHMSYS:
869 case AUE_SETPGRP:
870 case AUE_SETRLIMIT:
871 case AUE_SETSID:
872 case AUE_SETTIMEOFDAY:
873 case AUE_KDEBUGTRACE:
874 case AUE_PTHREADSIGMASK:
875 /*
876 * Header, subject, and return tokens added at end.
877 */
878 break;
879
880 case AUE_MKFIFO:
881 if (ARG_IS_VALID(kar, ARG_MODE)) {
882 tok = au_to_arg32(2, "mode", ar->ar_arg_mode);
883 kau_write(rec, tok);
884 }
885 UPATH1_VNODE1_TOKENS;
886 break;
887
888 case AUE_ACCESS_EXTENDED:
889 /*
890 * The access_extended() argument vector is stored in an
891 * opaque token.
892 */
893 if (ARG_IS_VALID(kar, ARG_OPAQUE)) {
894 tok = au_to_opaque(ar->ar_arg_opaque,
895 ar->ar_arg_opq_size);
896 kau_write(rec, tok);
897 }
898 /*
899 * The access_extended() result vector is stored in an arbitrary
900 * data token.
901 */
902 if (ARG_IS_VALID(kar, ARG_DATA)) {
903 tok = au_to_data(AUP_DECIMAL, ar->ar_arg_data_type,
904 ar->ar_arg_data_count, ar->ar_arg_data);
905 kau_write(rec, tok);
906 }
907 UPATH1_VNODE1_TOKENS;
908 break;
909
910 case AUE_LSTAT_EXTENDED:
911 case AUE_STAT_EXTENDED:
912 case AUE_ACCESS:
913 case AUE_CHDIR:
914 case AUE_CHROOT:
915 case AUE_GETATTRLIST:
916 case AUE_NFS_GETFH:
917 case AUE_LSTAT:
918 case AUE_PATHCONF:
919 case AUE_READLINK:
920 case AUE_REVOKE:
921 case AUE_RMDIR:
922 case AUE_SEARCHFS:
923 case AUE_SETATTRLIST:
924 case AUE_STAT:
925 case AUE_STATFS:
926 case AUE_TRUNCATE:
927 case AUE_UNDELETE:
928 case AUE_UNLINK:
929 case AUE_UTIMES:
930 UPATH1_VNODE1_TOKENS;
931 break;
932
933 case AUE_FHOPEN:
934 break;
935
936 case AUE_CHFLAGS:
937 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
938 tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
939 kau_write(rec, tok);
940 }
941 UPATH1_VNODE1_TOKENS;
942 break;
943
944 case AUE_CHMOD:
945 if (ARG_IS_VALID(kar, ARG_MODE)) {
946 tok = au_to_arg32(2, "new file mode",
947 ar->ar_arg_mode);
948 kau_write(rec, tok);
949 }
950 UPATH1_VNODE1_TOKENS;
951 break;
952
953 case AUE_CHOWN:
954 case AUE_LCHOWN:
955 if (ARG_IS_VALID(kar, ARG_UID)) {
956 tok = au_to_arg32(2, "new file uid", ar->ar_arg_uid);
957 kau_write(rec, tok);
958 }
959 if (ARG_IS_VALID(kar, ARG_GID)) {
960 tok = au_to_arg32(3, "new file gid", ar->ar_arg_gid);
961 kau_write(rec, tok);
962 }
963 UPATH1_VNODE1_TOKENS;
964 break;
965
966 case AUE_EXCHANGEDATA:
967 UPATH1_VNODE1_TOKENS;
968 UPATH2_TOKENS;
969 break;
970
971 case AUE_CLOSE:
972 if (ARG_IS_VALID(kar, ARG_FD)) {
973 tok = au_to_arg32(2, "fd", ar->ar_arg_fd);
974 kau_write(rec, tok);
975 }
976 UPATH1_VNODE1_TOKENS;
977 break;
978
979 case AUE_CORE:
980 if (ARG_IS_VALID(kar, ARG_SIGNUM)) {
981 tok = au_to_arg32(0, "signal", ar->ar_arg_signum);
982 kau_write(rec, tok);
983 }
984 UPATH1_VNODE1_TOKENS;
985 break;
986
987 case AUE_POSIX_SPAWN:
988 if (ARG_IS_VALID(kar, ARG_PID)) {
989 tok = au_to_arg32(0, "child PID", ar->ar_arg_pid);
990 kau_write(rec, tok);
991 }
992 /* FALLTHROUGH */
993
994 case AUE_EXECVE:
995 if (ARG_IS_VALID(kar, ARG_ARGV)) {
996 tok = au_to_exec_args(ar->ar_arg_argv,
997 ar->ar_arg_argc);
998 kau_write(rec, tok);
999 }
1000 if (ARG_IS_VALID(kar, ARG_ENVV)) {
1001 tok = au_to_exec_env(ar->ar_arg_envv,
1002 ar->ar_arg_envc);
1003 kau_write(rec, tok);
1004 }
1005 UPATH1_VNODE1_TOKENS;
1006 VNODE2_PATH_TOKENS;
1007 if (ARG_IS_VALID(kar, ARG_DATA)) {
1008 tok = au_to_data(AUP_HEX, ar->ar_arg_data_type,
1009 ar->ar_arg_data_count, ar->ar_arg_data);
1010 kau_write(rec, tok);
1011 }
1012 break;
1013
1014 case AUE_FCHMOD_EXTENDED:
1015 EXTENDED_TOKENS(2);
1016 FD_VNODE1_TOKENS;
1017 break;
1018
1019 case AUE_FCHMOD:
1020 if (ARG_IS_VALID(kar, ARG_MODE)) {
1021 tok = au_to_arg32(2, "new file mode",
1022 ar->ar_arg_mode);
1023 kau_write(rec, tok);
1024 }
1025 FD_VNODE1_TOKENS;
1026 break;
1027
1028 case AUE_NFS_SVC:
1029 tok = au_to_arg32(1, "request", ar->ar_arg_cmd);
1030 kau_write(rec, tok);
1031 if (ar->ar_valid_arg & (ARG_KPATH1 | ARG_UPATH1)) {
1032 UPATH1_VNODE1_TOKENS;
1033 }
1034 break;
1035
1036 /*
1037 * XXXRW: Some of these need to handle non-vnode cases as well.
1038 */
1039 case AUE_FSTAT_EXTENDED:
1040 case AUE_FCHDIR:
1041 case AUE_FPATHCONF:
1042 case AUE_FSTAT: /* XXX Need to handle sockets and shm */
1043 case AUE_FSTATFS:
1044 case AUE_FSYNC:
1045 case AUE_FTRUNCATE:
1046 case AUE_FUTIMES:
1047 case AUE_GETDIRENTRIES:
1048 case AUE_GETDIRENTRIESATTR:
1049 case AUE_GETATTRLISTBULK:
1050 #if 0 /* XXXss new */
1051 case AUE_POLL:
1052 #endif
1053 case AUE_READ:
1054 case AUE_READV:
1055 case AUE_PREAD:
1056 case AUE_WRITE:
1057 case AUE_WRITEV:
1058 case AUE_PWRITE:
1059 FD_VNODE1_TOKENS;
1060 break;
1061
1062 case AUE_FCHOWN:
1063 if (ARG_IS_VALID(kar, ARG_UID)) {
1064 tok = au_to_arg32(2, "new file uid", ar->ar_arg_uid);
1065 kau_write(rec, tok);
1066 }
1067 if (ARG_IS_VALID(kar, ARG_GID)) {
1068 tok = au_to_arg32(3, "new file gid", ar->ar_arg_gid);
1069 kau_write(rec, tok);
1070 }
1071 FD_VNODE1_TOKENS;
1072 break;
1073
1074 case AUE_FCNTL:
1075 if (ARG_IS_VALID(kar, ARG_CMD)) {
1076 audit_sys_fcntl(kar, rec);
1077 }
1078 FD_VNODE1_TOKENS;
1079 break;
1080
1081 case AUE_FSCTL:
1082 if (ARG_IS_VALID(kar, ARG_VALUE32)) {
1083 tok = au_to_arg32(4, "options", ar->ar_arg_value32);
1084 kau_write(rec, tok);
1085 }
1086 if (ARG_IS_VALID(kar, ARG_CMD)) {
1087 tok = au_to_arg32(2, "cmd", ar->ar_arg_cmd);
1088 kau_write(rec, tok);
1089 }
1090 UPATH1_VNODE1_TOKENS;
1091 break;
1092
1093 case AUE_FFSCTL:
1094 if (ARG_IS_VALID(kar, ARG_VALUE32)) {
1095 tok = au_to_arg32(4, "options", ar->ar_arg_value32);
1096 kau_write(rec, tok);
1097 }
1098 if (ARG_IS_VALID(kar, ARG_CMD)) {
1099 tok = au_to_arg32(2, "cmd", ar->ar_arg_cmd);
1100 kau_write(rec, tok);
1101 }
1102 FD_VNODE1_TOKENS;
1103 break;
1104
1105
1106 case AUE_FCHFLAGS:
1107 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1108 tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
1109 kau_write(rec, tok);
1110 }
1111 FD_VNODE1_TOKENS;
1112 break;
1113
1114 case AUE_FLOCK:
1115 if (ARG_IS_VALID(kar, ARG_CMD)) {
1116 tok = au_to_arg32(2, "operation", ar->ar_arg_cmd);
1117 kau_write(rec, tok);
1118 }
1119 FD_VNODE1_TOKENS;
1120 break;
1121
1122 case AUE_FORK:
1123 case AUE_VFORK:
1124 if (ARG_IS_VALID(kar, ARG_PID)) {
1125 tok = au_to_arg32(0, "child PID", ar->ar_arg_pid);
1126 kau_write(rec, tok);
1127 }
1128 break;
1129
1130 case AUE_GETLCID:
1131 if (ARG_IS_VALID(kar, ARG_PID)) {
1132 tok = au_to_arg32(1, "pid", (u_int32_t)ar->ar_arg_pid);
1133 kau_write(rec, tok);
1134 }
1135 break;
1136
1137 case AUE_SETLCID:
1138 if (ARG_IS_VALID(kar, ARG_PID)) {
1139 tok = au_to_arg32(1, "pid", (u_int32_t)ar->ar_arg_pid);
1140 kau_write(rec, tok);
1141 }
1142 if (ARG_IS_VALID(kar, ARG_VALUE32)) {
1143 tok = au_to_arg32(2, "lcid",
1144 (u_int32_t)ar->ar_arg_value32);
1145 kau_write(rec, tok);
1146 }
1147 break;
1148
1149 case AUE_IOCTL:
1150 if (ARG_IS_VALID(kar, ARG_CMD)) {
1151 tok = au_to_arg32(2, "cmd", ar->ar_arg_cmd);
1152 kau_write(rec, tok);
1153 }
1154 if (ARG_IS_VALID(kar, ARG_VALUE64)) {
1155 tok = au_to_arg64(2, "cmd", ar->ar_arg_value64);
1156 kau_write(rec, tok);
1157 }
1158 if (ARG_IS_VALID(kar, ARG_ADDR64)) {
1159 tok = au_to_arg64(3, "arg", ar->ar_arg_addr);
1160 kau_write(rec, tok);
1161 } else if (ARG_IS_VALID(kar, ARG_ADDR32)) {
1162 tok = au_to_arg32(3, "arg",
1163 (u_int32_t)ar->ar_arg_addr);
1164 kau_write(rec, tok);
1165 }
1166 if (ARG_IS_VALID(kar, ARG_VNODE1)) {
1167 FD_VNODE1_TOKENS;
1168 } else {
1169 if (ARG_IS_VALID(kar, ARG_SOCKINFO)) {
1170 tok = au_to_socket_ex(
1171 ar->ar_arg_sockinfo.sai_domain,
1172 ar->ar_arg_sockinfo.sai_type,
1173 (struct sockaddr *)
1174 &ar->ar_arg_sockinfo.sai_laddr,
1175 (struct sockaddr *)
1176 &ar->ar_arg_sockinfo.sai_faddr);
1177 kau_write(rec, tok);
1178 } else {
1179 if (ARG_IS_VALID(kar, ARG_FD)) {
1180 tok = au_to_arg32(1, "fd",
1181 ar->ar_arg_fd);
1182 kau_write(rec, tok);
1183 }
1184 }
1185 }
1186 break;
1187
1188 case AUE_KILL:
1189 if (ARG_IS_VALID(kar, ARG_SIGNUM)) {
1190 tok = au_to_arg32(2, "signal", ar->ar_arg_signum);
1191 kau_write(rec, tok);
1192 }
1193 PROCESS_PID_TOKENS(1);
1194 break;
1195
1196 case AUE_LINK:
1197 case AUE_RENAME:
1198 UPATH1_VNODE1_TOKENS;
1199 UPATH2_TOKENS;
1200 KPATH2_TOKENS;
1201 break;
1202
1203 case AUE_MKDIR_EXTENDED:
1204 case AUE_CHMOD_EXTENDED:
1205 case AUE_MKFIFO_EXTENDED:
1206 EXTENDED_TOKENS(2);
1207 UPATH1_VNODE1_TOKENS;
1208 break;
1209
1210 case AUE_MKDIR:
1211 if (ARG_IS_VALID(kar, ARG_MODE)) {
1212 tok = au_to_arg32(2, "mode", ar->ar_arg_mode);
1213 kau_write(rec, tok);
1214 }
1215 UPATH1_VNODE1_TOKENS;
1216 break;
1217
1218 case AUE_MKNOD:
1219 if (ARG_IS_VALID(kar, ARG_MODE)) {
1220 tok = au_to_arg32(2, "mode", ar->ar_arg_mode);
1221 kau_write(rec, tok);
1222 }
1223 if (ARG_IS_VALID(kar, ARG_VALUE32)) {
1224 tok = au_to_arg32(3, "dev", ar->ar_arg_value32);
1225 kau_write(rec, tok);
1226 }
1227 UPATH1_VNODE1_TOKENS;
1228 break;
1229
1230 case AUE_MMAP:
1231 case AUE_MUNMAP:
1232 case AUE_MPROTECT:
1233 case AUE_MLOCK:
1234 case AUE_MUNLOCK:
1235 case AUE_MINHERIT:
1236 if (ARG_IS_VALID(kar, ARG_ADDR64)) {
1237 tok = au_to_arg64(1, "addr", ar->ar_arg_addr);
1238 kau_write(rec, tok);
1239 } else if (ARG_IS_VALID(kar, ARG_ADDR32)) {
1240 tok = au_to_arg32(1, "addr",
1241 (u_int32_t)ar->ar_arg_addr);
1242 kau_write(rec, tok);
1243 }
1244 if (ARG_IS_VALID(kar, ARG_LEN)) {
1245 tok = au_to_arg64(2, "len", ar->ar_arg_len);
1246 kau_write(rec, tok);
1247 }
1248 if (ar->ar_event == AUE_MMAP) {
1249 FD_VNODE1_TOKENS;
1250 }
1251 if (ar->ar_event == AUE_MPROTECT) {
1252 if (ARG_IS_VALID(kar, ARG_VALUE32)) {
1253 tok = au_to_arg32(3, "protection",
1254 ar->ar_arg_value32);
1255 kau_write(rec, tok);
1256 }
1257 }
1258 if (ar->ar_event == AUE_MINHERIT) {
1259 if (ARG_IS_VALID(kar, ARG_VALUE32)) {
1260 tok = au_to_arg32(3, "inherit",
1261 ar->ar_arg_value32);
1262 kau_write(rec, tok);
1263 }
1264 }
1265 break;
1266
1267 #if CONFIG_MACF
1268 case AUE_MAC_MOUNT:
1269 PROCESS_MAC_TOKENS;
1270 /* FALLTHROUGH */
1271 #endif
1272 case AUE_MOUNT:
1273 /* XXX Need to handle NFS mounts */
1274 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1275 tok = au_to_arg32(3, "flags", ar->ar_arg_fflags);
1276 kau_write(rec, tok);
1277 }
1278 if (ARG_IS_VALID(kar, ARG_TEXT)) {
1279 tok = au_to_text(ar->ar_arg_text);
1280 kau_write(rec, tok);
1281 }
1282 /* FALLTHROUGH */
1283
1284 case AUE_UMOUNT:
1285 case AUE_UNMOUNT:
1286 UPATH1_VNODE1_TOKENS;
1287 break;
1288 case AUE_FMOUNT:
1289 if (ARG_IS_VALID(kar, ARG_FD)) {
1290 tok = au_to_arg32(2, "dir fd", ar->ar_arg_fd);
1291 kau_write(rec, tok);
1292 }
1293 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1294 tok = au_to_arg32(3, "flags", ar->ar_arg_fflags);
1295 kau_write(rec, tok);
1296 }
1297 if (ARG_IS_VALID(kar, ARG_TEXT)) {
1298 tok = au_to_text(ar->ar_arg_text);
1299 kau_write(rec, tok);
1300 }
1301 break;
1302
1303 case AUE_MSGCTL:
1304 ar->ar_event = audit_msgctl_to_event(ar->ar_arg_svipc_cmd);
1305 /* FALLTHROUGH */
1306
1307 case AUE_MSGRCV:
1308 case AUE_MSGSND:
1309 tok = au_to_arg32(1, "msg ID", ar->ar_arg_svipc_id);
1310 kau_write(rec, tok);
1311 if (ar->ar_errno != EINVAL) {
1312 tok = au_to_ipc(AT_IPC_MSG, ar->ar_arg_svipc_id);
1313 kau_write(rec, tok);
1314 }
1315 break;
1316
1317 case AUE_MSGGET:
1318 if (ar->ar_errno == 0) {
1319 if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
1320 tok = au_to_ipc(AT_IPC_MSG,
1321 ar->ar_arg_svipc_id);
1322 kau_write(rec, tok);
1323 }
1324 }
1325 break;
1326
1327 case AUE_OPEN:
1328 case AUE_OPEN_R:
1329 case AUE_OPEN_RT:
1330 case AUE_OPEN_RW:
1331 case AUE_OPEN_RWT:
1332 case AUE_OPEN_W:
1333 case AUE_OPEN_WT:
1334 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1335 tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
1336 kau_write(rec, tok);
1337 }
1338 UPATH1_VNODE1_TOKENS;
1339 break;
1340
1341 case AUE_OPEN_RC:
1342 case AUE_OPEN_RTC:
1343 case AUE_OPEN_RWC:
1344 case AUE_OPEN_RWTC:
1345 case AUE_OPEN_WC:
1346 case AUE_OPEN_WTC:
1347 if (ARG_IS_VALID(kar, ARG_MODE)) {
1348 tok = au_to_arg32(3, "mode", ar->ar_arg_mode);
1349 kau_write(rec, tok);
1350 }
1351 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1352 tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
1353 kau_write(rec, tok);
1354 }
1355 UPATH1_VNODE1_TOKENS;
1356 break;
1357
1358 case AUE_OPEN_EXTENDED:
1359 case AUE_OPEN_EXTENDED_R:
1360 case AUE_OPEN_EXTENDED_RT:
1361 case AUE_OPEN_EXTENDED_RW:
1362 case AUE_OPEN_EXTENDED_RWT:
1363 case AUE_OPEN_EXTENDED_W:
1364 case AUE_OPEN_EXTENDED_WT:
1365 EXTENDED_TOKENS(3);
1366 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1367 tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
1368 kau_write(rec, tok);
1369 }
1370 UPATH1_VNODE1_TOKENS;
1371 break;
1372
1373 case AUE_OPEN_EXTENDED_RC:
1374 case AUE_OPEN_EXTENDED_RTC:
1375 case AUE_OPEN_EXTENDED_RWC:
1376 case AUE_OPEN_EXTENDED_RWTC:
1377 case AUE_OPEN_EXTENDED_WC:
1378 case AUE_OPEN_EXTENDED_WTC:
1379 EXTENDED_TOKENS(3);
1380 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1381 tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
1382 kau_write(rec, tok);
1383 }
1384 UPATH1_VNODE1_TOKENS;
1385 break;
1386
1387 case AUE_OPENAT:
1388 case AUE_OPENAT_R:
1389 case AUE_OPENAT_RT:
1390 case AUE_OPENAT_RW:
1391 case AUE_OPENAT_RWT:
1392 case AUE_OPENAT_W:
1393 case AUE_OPENAT_WT:
1394 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1395 tok = au_to_arg32(3, "flags", ar->ar_arg_fflags);
1396 kau_write(rec, tok);
1397 }
1398 if (ARG_IS_VALID(kar, ARG_FD)) {
1399 tok = au_to_arg32(1, "dir fd", ar->ar_arg_fd);
1400 kau_write(rec, tok);
1401 }
1402 UPATH1_VNODE1_TOKENS;
1403 break;
1404
1405 case AUE_OPENAT_RC:
1406 case AUE_OPENAT_RTC:
1407 case AUE_OPENAT_RWC:
1408 case AUE_OPENAT_RWTC:
1409 case AUE_OPENAT_WC:
1410 case AUE_OPENAT_WTC:
1411 if (ARG_IS_VALID(kar, ARG_MODE)) {
1412 tok = au_to_arg32(4, "mode", ar->ar_arg_mode);
1413 kau_write(rec, tok);
1414 }
1415 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1416 tok = au_to_arg32(3, "flags", ar->ar_arg_fflags);
1417 kau_write(rec, tok);
1418 }
1419 if (ARG_IS_VALID(kar, ARG_FD)) {
1420 tok = au_to_arg32(1, "dir fd", ar->ar_arg_fd);
1421 kau_write(rec, tok);
1422 }
1423 UPATH1_VNODE1_TOKENS;
1424 break;
1425
1426 case AUE_OPENBYID:
1427 case AUE_OPENBYID_R:
1428 case AUE_OPENBYID_RT:
1429 case AUE_OPENBYID_RW:
1430 case AUE_OPENBYID_RWT:
1431 case AUE_OPENBYID_W:
1432 case AUE_OPENBYID_WT:
1433 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1434 tok = au_to_arg32(3, "flags", ar->ar_arg_fflags);
1435 kau_write(rec, tok);
1436 }
1437 if (ARG_IS_VALID(kar, ARG_VALUE32)) {
1438 tok = au_to_arg32(1, "volfsid", ar->ar_arg_value32);
1439 kau_write(rec, tok);
1440 }
1441 if (ARG_IS_VALID(kar, ARG_VALUE64)) {
1442 tok = au_to_arg64(2, "objid", ar->ar_arg_value64);
1443 kau_write(rec, tok);
1444 }
1445 break;
1446
1447 case AUE_RENAMEAT:
1448 case AUE_FACCESSAT:
1449 case AUE_FCHMODAT:
1450 case AUE_FCHOWNAT:
1451 case AUE_FSTATAT:
1452 case AUE_LINKAT:
1453 case AUE_UNLINKAT:
1454 case AUE_READLINKAT:
1455 case AUE_SYMLINKAT:
1456 case AUE_MKDIRAT:
1457 case AUE_GETATTRLISTAT:
1458 case AUE_SETATTRLISTAT:
1459 if (ARG_IS_VALID(kar, ARG_FD)) {
1460 tok = au_to_arg32(1, "dir fd", ar->ar_arg_fd);
1461 kau_write(rec, tok);
1462 }
1463 UPATH1_VNODE1_TOKENS;
1464 break;
1465
1466 case AUE_CLONEFILEAT:
1467 if (ARG_IS_VALID(kar, ARG_FD)) {
1468 tok = au_to_arg32(1, "src dir fd", ar->ar_arg_fd);
1469 kau_write(rec, tok);
1470 }
1471 UPATH1_VNODE1_TOKENS;
1472 if (ARG_IS_VALID(kar, ARG_FD2)) {
1473 tok = au_to_arg32(1, "dst dir fd", ar->ar_arg_fd2);
1474 kau_write(rec, tok);
1475 }
1476 UPATH2_TOKENS;
1477 if (ARG_IS_VALID(kar, ARG_VALUE32)) {
1478 tok = au_to_arg32(1, "flags", ar->ar_arg_value32);
1479 kau_write(rec, tok);
1480 }
1481 break;
1482
1483 case AUE_FCLONEFILEAT:
1484 FD_VNODE1_TOKENS;
1485 if (ARG_IS_VALID(kar, ARG_FD2)) {
1486 tok = au_to_arg32(1, "dst dir fd", ar->ar_arg_fd2);
1487 kau_write(rec, tok);
1488 }
1489 UPATH2_TOKENS;
1490 if (ARG_IS_VALID(kar, ARG_VALUE32)) {
1491 tok = au_to_arg32(1, "flags", ar->ar_arg_value32);
1492 kau_write(rec, tok);
1493 }
1494 break;
1495
1496 case AUE_PTRACE:
1497 if (ARG_IS_VALID(kar, ARG_CMD)) {
1498 tok = au_to_arg32(1, "request", ar->ar_arg_cmd);
1499 kau_write(rec, tok);
1500 }
1501 if (ARG_IS_VALID(kar, ARG_ADDR64)) {
1502 tok = au_to_arg64(3, "addr", ar->ar_arg_addr);
1503 kau_write(rec, tok);
1504 } else if (ARG_IS_VALID(kar, ARG_ADDR32)) {
1505 tok = au_to_arg32(3, "addr",
1506 (u_int32_t)ar->ar_arg_addr);
1507 kau_write(rec, tok);
1508 }
1509 if (ARG_IS_VALID(kar, ARG_VALUE32)) {
1510 tok = au_to_arg32(4, "data", ar->ar_arg_value32);
1511 kau_write(rec, tok);
1512 }
1513 PROCESS_PID_TOKENS(2);
1514 break;
1515
1516 case AUE_QUOTACTL:
1517 if (ARG_IS_VALID(kar, ARG_CMD)) {
1518 tok = au_to_arg32(2, "command", ar->ar_arg_cmd);
1519 kau_write(rec, tok);
1520 }
1521 if (ARG_IS_VALID(kar, ARG_UID)) {
1522 tok = au_to_arg32(3, "uid", ar->ar_arg_uid);
1523 kau_write(rec, tok);
1524 }
1525 UPATH1_VNODE1_TOKENS;
1526 break;
1527
1528 case AUE_REBOOT:
1529 if (ARG_IS_VALID(kar, ARG_CMD)) {
1530 tok = au_to_arg32(1, "howto", ar->ar_arg_cmd);
1531 kau_write(rec, tok);
1532 }
1533 break;
1534
1535 case AUE_SEMCTL:
1536 ar->ar_event = audit_semctl_to_event(ar->ar_arg_svipc_cmd);
1537 /* FALLTHROUGH */
1538
1539 case AUE_SEMOP:
1540 if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
1541 tok = au_to_arg32(1, "sem ID", ar->ar_arg_svipc_id);
1542 kau_write(rec, tok);
1543 if (ar->ar_errno != EINVAL) {
1544 tok = au_to_ipc(AT_IPC_SEM,
1545 ar->ar_arg_svipc_id);
1546 kau_write(rec, tok);
1547 }
1548 }
1549 break;
1550
1551 case AUE_SEMGET:
1552 if (ar->ar_errno == 0) {
1553 if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
1554 tok = au_to_ipc(AT_IPC_SEM,
1555 ar->ar_arg_svipc_id);
1556 kau_write(rec, tok);
1557 }
1558 }
1559 break;
1560
1561 case AUE_SETEGID:
1562 if (ARG_IS_VALID(kar, ARG_EGID)) {
1563 tok = au_to_arg32(1, "gid", ar->ar_arg_egid);
1564 kau_write(rec, tok);
1565 }
1566 break;
1567
1568 case AUE_SETEUID:
1569 if (ARG_IS_VALID(kar, ARG_EUID)) {
1570 tok = au_to_arg32(1, "uid", ar->ar_arg_euid);
1571 kau_write(rec, tok);
1572 }
1573 break;
1574
1575 case AUE_SETREGID:
1576 if (ARG_IS_VALID(kar, ARG_RGID)) {
1577 tok = au_to_arg32(1, "rgid", ar->ar_arg_rgid);
1578 kau_write(rec, tok);
1579 }
1580 if (ARG_IS_VALID(kar, ARG_EGID)) {
1581 tok = au_to_arg32(2, "egid", ar->ar_arg_egid);
1582 kau_write(rec, tok);
1583 }
1584 break;
1585
1586 case AUE_SETREUID:
1587 if (ARG_IS_VALID(kar, ARG_RUID)) {
1588 tok = au_to_arg32(1, "ruid", ar->ar_arg_ruid);
1589 kau_write(rec, tok);
1590 }
1591 if (ARG_IS_VALID(kar, ARG_EUID)) {
1592 tok = au_to_arg32(2, "euid", ar->ar_arg_euid);
1593 kau_write(rec, tok);
1594 }
1595 break;
1596
1597 case AUE_SETGID:
1598 if (ARG_IS_VALID(kar, ARG_GID)) {
1599 tok = au_to_arg32(1, "gid", ar->ar_arg_gid);
1600 kau_write(rec, tok);
1601 }
1602 break;
1603
1604 case AUE_SETUID:
1605 if (ARG_IS_VALID(kar, ARG_UID)) {
1606 tok = au_to_arg32(1, "uid", ar->ar_arg_uid);
1607 kau_write(rec, tok);
1608 }
1609 break;
1610
1611 case AUE_SETGROUPS:
1612 if (ARG_IS_VALID(kar, ARG_GROUPSET)) {
1613 for (uctr = 0; uctr < ar->ar_arg_groups.gidset_size;
1614 uctr++) {
1615 tok = au_to_arg32(1, "setgroups",
1616 ar->ar_arg_groups.gidset[uctr]);
1617 kau_write(rec, tok);
1618 }
1619 }
1620 break;
1621
1622 case AUE_SETLOGIN:
1623 if (ARG_IS_VALID(kar, ARG_TEXT)) {
1624 tok = au_to_text(ar->ar_arg_text);
1625 kau_write(rec, tok);
1626 }
1627 break;
1628
1629 case AUE_SETPRIORITY:
1630 if (ARG_IS_VALID(kar, ARG_CMD)) {
1631 tok = au_to_arg32(1, "which", ar->ar_arg_cmd);
1632 kau_write(rec, tok);
1633 }
1634 if (ARG_IS_VALID(kar, ARG_UID)) {
1635 tok = au_to_arg32(2, "who", ar->ar_arg_uid);
1636 kau_write(rec, tok);
1637 }
1638 if (ARG_IS_VALID(kar, ARG_VALUE32)) {
1639 tok = au_to_arg32(2, "priority", ar->ar_arg_value32);
1640 kau_write(rec, tok);
1641 }
1642 break;
1643
1644 case AUE_SETPRIVEXEC:
1645 if (ARG_IS_VALID(kar, ARG_VALUE32)) {
1646 tok = au_to_arg32(1, "flag", ar->ar_arg_value32);
1647 kau_write(rec, tok);
1648 }
1649 break;
1650
1651 /* AUE_SHMAT, AUE_SHMCTL, AUE_SHMDT and AUE_SHMGET are SysV IPC */
1652 case AUE_SHMAT:
1653 if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
1654 tok = au_to_arg32(1, "shmid", ar->ar_arg_svipc_id);
1655 kau_write(rec, tok);
1656 /* XXXAUDIT: Does having the ipc token make sense? */
1657 tok = au_to_ipc(AT_IPC_SHM, ar->ar_arg_svipc_id);
1658 kau_write(rec, tok);
1659 }
1660 if (ARG_IS_VALID(kar, ARG_SVIPC_ADDR)) {
1661 tok = au_to_arg64(2, "shmaddr", ar->ar_arg_svipc_addr);
1662 kau_write(rec, tok);
1663 }
1664 if (ARG_IS_VALID(kar, ARG_SVIPC_PERM)) {
1665 tok = au_to_ipc_perm(&ar->ar_arg_svipc_perm);
1666 kau_write(rec, tok);
1667 }
1668 break;
1669
1670 case AUE_SHMCTL:
1671 if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
1672 tok = au_to_arg32(1, "shmid", ar->ar_arg_svipc_id);
1673 kau_write(rec, tok);
1674 /* XXXAUDIT: Does having the ipc token make sense? */
1675 tok = au_to_ipc(AT_IPC_SHM, ar->ar_arg_svipc_id);
1676 kau_write(rec, tok);
1677 }
1678 switch (ar->ar_arg_svipc_cmd) {
1679 case IPC_STAT:
1680 ar->ar_event = AUE_SHMCTL_STAT;
1681 break;
1682 case IPC_RMID:
1683 ar->ar_event = AUE_SHMCTL_RMID;
1684 break;
1685 case IPC_SET:
1686 ar->ar_event = AUE_SHMCTL_SET;
1687 if (ARG_IS_VALID(kar, ARG_SVIPC_PERM)) {
1688 tok = au_to_ipc_perm(&ar->ar_arg_svipc_perm);
1689 kau_write(rec, tok);
1690 }
1691 break;
1692 default:
1693 break; /* We will audit a bad command */
1694 }
1695 break;
1696
1697 case AUE_SHMDT:
1698 if (ARG_IS_VALID(kar, ARG_SVIPC_ADDR)) {
1699 tok = au_to_arg64(1, "shmaddr",
1700 (int)(uintptr_t)ar->ar_arg_svipc_addr);
1701 kau_write(rec, tok);
1702 }
1703 break;
1704
1705 case AUE_SHMGET:
1706 /* This is unusual; the return value is in an argument token */
1707 if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
1708 tok = au_to_arg32(0, "shmid", ar->ar_arg_svipc_id);
1709 kau_write(rec, tok);
1710 tok = au_to_ipc(AT_IPC_SHM, ar->ar_arg_svipc_id);
1711 kau_write(rec, tok);
1712 }
1713 if (ARG_IS_VALID(kar, ARG_SVIPC_PERM)) {
1714 tok = au_to_ipc_perm(&ar->ar_arg_svipc_perm);
1715 kau_write(rec, tok);
1716 }
1717 break;
1718
1719 /* AUE_SHMOPEN, AUE_SHMUNLINK, AUE_SEMOPEN, AUE_SEMCLOSE
1720 * and AUE_SEMUNLINK are Posix IPC */
1721 case AUE_SHMOPEN:
1722 if (ARG_IS_VALID(kar, ARG_SVIPC_ADDR)) {
1723 tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
1724 kau_write(rec, tok);
1725 }
1726 if (ARG_IS_VALID(kar, ARG_MODE)) {
1727 tok = au_to_arg32(3, "mode", ar->ar_arg_mode);
1728 kau_write(rec, tok);
1729 }
1730 /* FALLTHROUGH */
1731
1732 case AUE_SHMUNLINK:
1733 if (ARG_IS_VALID(kar, ARG_TEXT)) {
1734 tok = au_to_text(ar->ar_arg_text);
1735 kau_write(rec, tok);
1736 }
1737 if (ARG_IS_VALID(kar, ARG_POSIX_IPC_PERM)) {
1738 struct ipc_perm perm;
1739
1740 perm.uid = ar->ar_arg_pipc_perm.pipc_uid;
1741 perm.gid = ar->ar_arg_pipc_perm.pipc_gid;
1742 perm.cuid = ar->ar_arg_pipc_perm.pipc_uid;
1743 perm.cgid = ar->ar_arg_pipc_perm.pipc_gid;
1744 perm.mode = ar->ar_arg_pipc_perm.pipc_mode;
1745 perm._seq = 0;
1746 perm._key = 0;
1747 tok = au_to_ipc_perm(&perm);
1748 kau_write(rec, tok);
1749 }
1750 break;
1751
1752 case AUE_SEMOPEN:
1753 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1754 tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
1755 kau_write(rec, tok);
1756 }
1757 if (ARG_IS_VALID(kar, ARG_MODE)) {
1758 tok = au_to_arg32(3, "mode", ar->ar_arg_mode);
1759 kau_write(rec, tok);
1760 }
1761 if (ARG_IS_VALID(kar, ARG_VALUE32)) {
1762 tok = au_to_arg32(4, "value", ar->ar_arg_value32);
1763 kau_write(rec, tok);
1764 }
1765 /* FALLTHROUGH */
1766
1767 case AUE_SEMUNLINK:
1768 if (ARG_IS_VALID(kar, ARG_TEXT)) {
1769 tok = au_to_text(ar->ar_arg_text);
1770 kau_write(rec, tok);
1771 }
1772 if (ARG_IS_VALID(kar, ARG_POSIX_IPC_PERM)) {
1773 struct ipc_perm perm;
1774
1775 perm.uid = ar->ar_arg_pipc_perm.pipc_uid;
1776 perm.gid = ar->ar_arg_pipc_perm.pipc_gid;
1777 perm.cuid = ar->ar_arg_pipc_perm.pipc_uid;
1778 perm.cgid = ar->ar_arg_pipc_perm.pipc_gid;
1779 perm.mode = ar->ar_arg_pipc_perm.pipc_mode;
1780 perm._seq = 0;
1781 perm._key = 0;
1782 tok = au_to_ipc_perm(&perm);
1783 kau_write(rec, tok);
1784 }
1785 break;
1786
1787 case AUE_SEMCLOSE:
1788 if (ARG_IS_VALID(kar, ARG_FD)) {
1789 tok = au_to_arg32(1, "sem", ar->ar_arg_fd);
1790 kau_write(rec, tok);
1791 }
1792 break;
1793
1794 case AUE_SYMLINK:
1795 if (ARG_IS_VALID(kar, ARG_TEXT)) {
1796 tok = au_to_text(ar->ar_arg_text);
1797 kau_write(rec, tok);
1798 }
1799 UPATH1_VNODE1_TOKENS;
1800 break;
1801
1802 case AUE_SYSCTL:
1803 case AUE_SYSCTL_NONADMIN:
1804 if (ARG_IS_VALID(kar, ARG_CTLNAME | ARG_LEN)) {
1805 for (ctr = 0; ctr < (int)ar->ar_arg_len; ctr++) {
1806 tok = au_to_arg32(1, "name",
1807 ar->ar_arg_ctlname[ctr]);
1808 kau_write(rec, tok);
1809 }
1810 }
1811 if (ARG_IS_VALID(kar, ARG_VALUE32)) {
1812 tok = au_to_arg32(5, "newval", ar->ar_arg_value32);
1813 kau_write(rec, tok);
1814 }
1815 if (ARG_IS_VALID(kar, ARG_TEXT)) {
1816 tok = au_to_text(ar->ar_arg_text);
1817 kau_write(rec, tok);
1818 }
1819 break;
1820
1821 case AUE_UMASK_EXTENDED:
1822 /* ACL data */
1823 if (ARG_IS_VALID(kar, ARG_OPAQUE)) {
1824 tok = au_to_opaque(ar->ar_arg_opaque,
1825 ar->ar_arg_opq_size);
1826 kau_write(rec, tok);
1827 }
1828 /* FALLTHROUGH */
1829
1830 case AUE_UMASK:
1831 if (ARG_IS_VALID(kar, ARG_MASK)) {
1832 tok = au_to_arg32(1, "new mask", ar->ar_arg_mask);
1833 kau_write(rec, tok);
1834 }
1835 tok = au_to_arg32(0, "prev mask", ar->ar_retval);
1836 kau_write(rec, tok);
1837 break;
1838
1839 case AUE_WAIT4:
1840 #if 0 /* XXXss - new */
1841 case AUE_WAITID:
1842 #endif
1843 if (ARG_IS_VALID(kar, ARG_PID)) {
1844 tok = au_to_arg32(0, "pid", ar->ar_arg_pid);
1845 kau_write(rec, tok);
1846 }
1847 break;
1848
1849 case AUE_FSGETPATH_EXTENDED:
1850 case AUE_FSGETPATH:
1851 if (ARG_IS_VALID(kar, ARG_VALUE32)) {
1852 tok = au_to_arg32(3, "volfsid", ar->ar_arg_value32);
1853 kau_write(rec, tok);
1854 }
1855 if (ARG_IS_VALID(kar, ARG_VALUE64)) {
1856 tok = au_to_arg64(4, "objid", ar->ar_arg_value64);
1857 kau_write(rec, tok);
1858 }
1859 if (ARG_IS_VALID(kar, ARG_TEXT)) {
1860 tok = au_to_text(ar->ar_arg_text);
1861 kau_write(rec, tok);
1862 }
1863 break;
1864
1865 case AUE_SESSION_START:
1866 case AUE_SESSION_UPDATE:
1867 case AUE_SESSION_END:
1868 case AUE_SESSION_CLOSE:
1869 if (ARG_IS_VALID(kar, ARG_VALUE64)) {
1870 tok = au_to_arg64(1, "sflags", ar->ar_arg_value64);
1871 kau_write(rec, tok);
1872 }
1873 if (ARG_IS_VALID(kar, ARG_AMASK)) {
1874 tok = au_to_arg32(2, "am_success",
1875 ar->ar_arg_amask.am_success);
1876 kau_write(rec, tok);
1877 tok = au_to_arg32(3, "am_failure",
1878 ar->ar_arg_amask.am_failure);
1879 kau_write(rec, tok);
1880 }
1881 break;
1882
1883 /************************
1884 * Mach system calls *
1885 ************************/
1886 case AUE_INITPROCESS:
1887 break;
1888
1889 case AUE_PIDFORTASK:
1890 if (ARG_IS_VALID(kar, ARG_MACHPORT1)) {
1891 tok = au_to_arg32(1, "port",
1892 (u_int32_t)ar->ar_arg_mach_port1);
1893 kau_write(rec, tok);
1894 }
1895 if (ARG_IS_VALID(kar, ARG_PID)) {
1896 tok = au_to_arg32(2, "pid", (u_int32_t)ar->ar_arg_pid);
1897 kau_write(rec, tok);
1898 }
1899 break;
1900
1901 case AUE_TASKFORPID:
1902 case AUE_TASKNAMEFORPID:
1903 if (ARG_IS_VALID(kar, ARG_MACHPORT1)) {
1904 tok = au_to_arg32(1, "target port",
1905 (u_int32_t)ar->ar_arg_mach_port1);
1906 kau_write(rec, tok);
1907 }
1908 if (ARG_IS_VALID(kar, ARG_MACHPORT2)) {
1909 tok = au_to_arg32(3, "task port",
1910 (u_int32_t)ar->ar_arg_mach_port2);
1911 kau_write(rec, tok);
1912 }
1913 PROCESS_PID_TOKENS(2);
1914 break;
1915
1916 case AUE_SWAPON:
1917 if (ARG_IS_VALID(kar, ARG_VALUE32)) {
1918 tok = au_to_arg32(4, "priority",
1919 (u_int32_t)ar->ar_arg_value32);
1920 kau_write(rec, tok);
1921 }
1922 UPATH1_VNODE1_TOKENS;
1923 break;
1924
1925 case AUE_SWAPOFF:
1926 UPATH1_VNODE1_TOKENS;
1927 break;
1928
1929 case AUE_MAPFD:
1930 if (ARG_IS_VALID(kar, ARG_ADDR64)) {
1931 tok = au_to_arg64(3, "va", ar->ar_arg_addr);
1932 kau_write(rec, tok);
1933 } else if (ARG_IS_VALID(kar, ARG_ADDR32)) {
1934 tok = au_to_arg32(3, "va",
1935 (u_int32_t)ar->ar_arg_addr);
1936 kau_write(rec, tok);
1937 }
1938 FD_VNODE1_TOKENS;
1939 break;
1940
1941 #if CONFIG_MACF
1942 case AUE_MAC_GET_FILE:
1943 case AUE_MAC_SET_FILE:
1944 case AUE_MAC_GET_LINK:
1945 case AUE_MAC_SET_LINK:
1946 case AUE_MAC_GET_MOUNT:
1947 UPATH1_VNODE1_TOKENS;
1948 PROCESS_MAC_TOKENS;
1949 break;
1950
1951 case AUE_MAC_GET_FD:
1952 case AUE_MAC_SET_FD:
1953 FD_VNODE1_TOKENS;
1954 PROCESS_MAC_TOKENS;
1955 break;
1956
1957 case AUE_MAC_SYSCALL:
1958 PROCESS_MAC_TOKENS;
1959 if (ARG_IS_VALID(kar, ARG_VALUE32)) {
1960 tok = au_to_arg32(3, "call", ar->ar_arg_value32);
1961 kau_write(rec, tok);
1962 }
1963 break;
1964
1965 case AUE_MAC_EXECVE:
1966 UPATH1_VNODE1_TOKENS;
1967 PROCESS_MAC_TOKENS;
1968 break;
1969
1970 case AUE_MAC_GET_PID:
1971 if (ARG_IS_VALID(kar, ARG_PID)) {
1972 tok = au_to_arg32(1, "pid", (u_int32_t)ar->ar_arg_pid);
1973 kau_write(rec, tok);
1974 }
1975 PROCESS_MAC_TOKENS;
1976 break;
1977
1978 case AUE_MAC_GET_LCID:
1979 if (ARG_IS_VALID(kar, ARG_VALUE32)) {
1980 tok = au_to_arg32(1, "lcid",
1981 (u_int32_t)ar->ar_arg_value32);
1982 kau_write(rec, tok);
1983 }
1984 PROCESS_MAC_TOKENS;
1985 break;
1986
1987 case AUE_MAC_GET_PROC:
1988 case AUE_MAC_SET_PROC:
1989 PROCESS_MAC_TOKENS;
1990 break;
1991 #endif
1992 case AUE_NULL:
1993 default:
1994 #if DIAGNOSTIC
1995 printf("BSM conversion requested for unknown event %d\n",
1996 ar->ar_event);
1997 #endif
1998
1999 /*
2000 * Write the subject token so it is properly freed here.
2001 */
2002 kau_write(rec, subj_tok);
2003 kau_free(rec);
2004 return BSM_NOAUDIT;
2005 }
2006
2007 #if CONFIG_MACF
2008 if (NULL != ar->ar_mac_records) {
2009 /* Convert the audit data from the MAC policies */
2010 struct mac_audit_record *mar;
2011
2012 LIST_FOREACH(mar, ar->ar_mac_records, records) {
2013 switch (mar->type) {
2014 case MAC_AUDIT_DATA_TYPE:
2015 tok = au_to_data(AUP_BINARY, AUR_BYTE,
2016 mar->length,
2017 (const char *)mar->data);
2018 break;
2019 case MAC_AUDIT_TEXT_TYPE:
2020 tok = au_to_text((char*) mar->data);
2021 break;
2022 default:
2023 /*
2024 * XXX: we can either continue,
2025 * skipping this particular entry,
2026 * or we can pre-verify the list and
2027 * abort before writing any records
2028 */
2029 printf("kaudit_to_bsm(): "
2030 "BSM conversion requested for"
2031 "unknown mac_audit data type %d\n",
2032 mar->type);
2033 }
2034
2035 kau_write(rec, tok);
2036 }
2037 }
2038 #endif
2039
2040 kau_write(rec, subj_tok);
2041
2042 #if CONFIG_MACF
2043 if (ar->ar_cred_mac_labels != NULL &&
2044 strlen(ar->ar_cred_mac_labels) != 0) {
2045 tok = au_to_text(ar->ar_cred_mac_labels);
2046 kau_write(rec, tok);
2047 }
2048 #endif
2049
2050 tok = au_to_return32(au_errno_to_bsm(ar->ar_errno), ar->ar_retval);
2051 kau_write(rec, tok); /* Every record gets a return token */
2052
2053 if (ARG_IS_VALID(kar, ARG_IDENTITY)) {
2054 struct au_identity_info *id = &ar->ar_arg_identity;
2055 tok = au_to_identity(id->signer_type, id->signing_id,
2056 id->signing_id_trunc, id->team_id, id->team_id_trunc,
2057 id->cdhash, id->cdhash_len);
2058 kau_write(rec, tok);
2059 }
2060
2061 kau_close(rec, &ar->ar_endtime, ar->ar_event);
2062
2063 *pau = rec;
2064 return BSM_SUCCESS;
2065 }
2066
2067 /*
2068 * Verify that a record is a valid BSM record. Return 1 if the
2069 * record is good, 0 otherwise.
2070 */
2071 int
2072 bsm_rec_verify(void *rec, int length, boolean_t kern_events_allowed)
2073 {
2074 /* Used to partially deserialize the buffer */
2075 struct hdr_tok_partial *hdr;
2076 struct trl_tok_partial *trl;
2077
2078 /* A record requires a complete header and trailer token */
2079 if (length < (AUDIT_HEADER_SIZE + AUDIT_TRAILER_SIZE)) {
2080 return 0;
2081 }
2082
2083 hdr = (struct hdr_tok_partial*)rec;
2084
2085 /* Ensure the provided length matches what the record shows */
2086 if ((uint32_t)length != ntohl(hdr->len)) {
2087 return 0;
2088 }
2089
2090 trl = (struct trl_tok_partial*)(rec + (length - AUDIT_TRAILER_SIZE));
2091
2092 /* Ensure the buffer contains what look like header and trailer tokens */
2093 if (((hdr->type != AUT_HEADER32) && (hdr->type != AUT_HEADER32_EX) &&
2094 (hdr->type != AUT_HEADER64) && (hdr->type != AUT_HEADER64_EX)) ||
2095 (trl->type != AUT_TRAILER)) {
2096 return 0;
2097 }
2098
2099 /* Ensure the header and trailer agree on the length */
2100 if (hdr->len != trl->len) {
2101 return 0;
2102 }
2103
2104 /* Ensure the trailer token has a proper magic value */
2105 if (ntohs(trl->magic) != AUT_TRAILER_MAGIC) {
2106 return 0;
2107 }
2108
2109 if (!kern_events_allowed && AUE_IS_A_KEVENT(ntohs(hdr->e_type))) {
2110 return 0;
2111 }
2112
2113 return 1;
2114 }
2115 #endif /* CONFIG_AUDIT */
mirror of XNU