]> git.saurik.com Git - apple/xnu.git/blob - bsd/security/audit/audit_bsm.c
projects / apple / xnu.git / blob
? search:


edebfd61bef521369ee8c08e81c429ae3f21cde7
[apple/xnu.git] / bsd / security / audit / audit_bsm.c
1 /*
2 * Copyright (c) 1999-2016 Apple Inc.
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 * 3. Neither the name of Apple Inc. ("Apple") nor the names of
14 * its contributors may be used to endorse or promote products derived
15 * from this software without specific prior written permission.
16 *
17 * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND
18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20 * ARE DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR
21 * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
25 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
26 * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
27 * POSSIBILITY OF SUCH DAMAGE.
28 */
29 /*
30 * NOTICE: This file was modified by SPARTA, Inc. in 2005 to introduce
31 * support for mandatory and extensible security protections. This notice
32 * is included in support of clause 2.2 (b) of the Apple Public License,
33 * Version 2.0.
34 */
35
36 #include <sys/types.h>
37 #include <sys/vnode_internal.h>
38 #include <sys/ipc.h>
39 #include <sys/sem.h>
40 #include <sys/socketvar.h>
41 #include <sys/socket.h>
42 #include <sys/queue.h>
43 #include <sys/fcntl.h>
44 #include <sys/user.h>
45 #include <sys/ipc.h>
46
47 #include <bsm/audit.h>
48 #include <bsm/audit_internal.h>
49 #include <bsm/audit_record.h>
50 #include <bsm/audit_kevents.h>
51
52 #include <security/audit/audit.h>
53 #include <security/audit/audit_bsd.h>
54 #include <security/audit/audit_private.h>
55
56 #include <netinet/in_systm.h>
57 #include <netinet/in.h>
58 #include <netinet/ip.h>
59
60 #if CONFIG_AUDIT
61 MALLOC_DEFINE(M_AUDITBSM, "audit_bsm", "Audit BSM data");
62
63 #if CONFIG_MACF
64 #include <security/mac_framework.h>
65 #endif
66
67 static void audit_sys_auditon(struct audit_record *ar,
68 struct au_record *rec);
69 static void audit_sys_fcntl(struct kaudit_record *kar,
70 struct au_record *rec);
71
72 /*
73 * Initialize the BSM auditing subsystem.
74 */
75 void
76 kau_init(void)
77 {
78
79 au_evclassmap_init();
80 }
81
82 /*
83 * This call reserves memory for the audit record. Memory must be guaranteed
84 * before any auditable event can be generated. The au_record structure
85 * maintains a reference to the memory allocated above and also the list of
86 * tokens associated with this record.
87 */
88 static struct au_record *
89 kau_open(void)
90 {
91 struct au_record *rec;
92
93 rec = malloc(sizeof(*rec), M_AUDITBSM, M_WAITOK);
94 rec->data = NULL;
95 TAILQ_INIT(&rec->token_q);
96 rec->len = 0;
97 rec->used = 1;
98
99 return (rec);
100 }
101
102 /*
103 * Store the token with the record descriptor.
104 */
105 static void
106 kau_write(struct au_record *rec, struct au_token *tok)
107 {
108
109 KASSERT(tok != NULL, ("kau_write: tok == NULL"));
110
111 TAILQ_INSERT_TAIL(&rec->token_q, tok, tokens);
112 rec->len += tok->len;
113 }
114
115 /*
116 * Close out the audit record by adding the header token, identifying any
117 * missing tokens. Write out the tokens to the record memory.
118 */
119 static void
120 kau_close(struct au_record *rec, struct timespec *ctime, short event)
121 {
122 u_char *dptr;
123 size_t tot_rec_size;
124 token_t *cur, *hdr, *trail;
125 struct timeval tm;
126 size_t hdrsize;
127 struct auditinfo_addr ak;
128 struct in6_addr *ap;
129
130 audit_get_kinfo(&ak);
131 hdrsize = 0;
132 switch (ak.ai_termid.at_type) {
133 case AU_IPv4:
134 hdrsize = (ak.ai_termid.at_addr[0] == INADDR_ANY) ?
135 AUDIT_HEADER_SIZE : AUDIT_HEADER_EX_SIZE(&ak);
136 break;
137 case AU_IPv6:
138 ap = (struct in6_addr *)&ak.ai_termid.at_addr[0];
139 hdrsize = (IN6_IS_ADDR_UNSPECIFIED(ap)) ? AUDIT_HEADER_SIZE :
140 AUDIT_HEADER_EX_SIZE(&ak);
141 break;
142 default:
143 panic("kau_close: invalid address family");
144 }
145 tot_rec_size = rec->len + AUDIT_HEADER_SIZE + AUDIT_TRAILER_SIZE;
146 rec->data = malloc(tot_rec_size, M_AUDITBSM, M_WAITOK | M_ZERO);
147
148 tm.tv_usec = ctime->tv_nsec / 1000;
149 tm.tv_sec = ctime->tv_sec;
150 if (hdrsize != AUDIT_HEADER_SIZE)
151 hdr = au_to_header32_ex_tm(tot_rec_size, event, 0, tm, &ak);
152 else
153 hdr = au_to_header32_tm(tot_rec_size, event, 0, tm);
154 TAILQ_INSERT_HEAD(&rec->token_q, hdr, tokens);
155
156 trail = au_to_trailer(tot_rec_size);
157 TAILQ_INSERT_TAIL(&rec->token_q, trail, tokens);
158
159 rec->len = tot_rec_size;
160 dptr = rec->data;
161 TAILQ_FOREACH(cur, &rec->token_q, tokens) {
162 memcpy(dptr, cur->t_data, cur->len);
163 dptr += cur->len;
164 }
165 }
166
167 /*
168 * Free a BSM audit record by releasing all the tokens and clearing the audit
169 * record information.
170 */
171 void
172 kau_free(struct au_record *rec)
173 {
174 struct au_token *tok;
175
176 /* Free the token list. */
177 while ((tok = TAILQ_FIRST(&rec->token_q))) {
178 TAILQ_REMOVE(&rec->token_q, tok, tokens);
179 free(tok->t_data, M_AUDITBSM);
180 free(tok, M_AUDITBSM);
181 }
182
183 rec->used = 0;
184 rec->len = 0;
185 free(rec->data, M_AUDITBSM);
186 free(rec, M_AUDITBSM);
187 }
188
189 /*
190 * XXX: May want turn some (or all) of these macros into functions in order
191 * to reduce the generated code size.
192 *
193 * XXXAUDIT: These macros assume that 'kar', 'ar', 'rec', and 'tok' in the
194 * caller are OK with this.
195 */
196 #if CONFIG_MACF
197 #define MAC_VNODE1_LABEL_TOKEN do { \
198 if (ar->ar_vnode1_mac_labels != NULL && \
199 strlen(ar->ar_vnode1_mac_labels) != 0) { \
200 tok = au_to_text(ar->ar_vnode1_mac_labels); \
201 kau_write(rec, tok); \
202 } \
203 } while (0)
204
205 #define MAC_VNODE2_LABEL_TOKEN do { \
206 if (ar->ar_vnode2_mac_labels != NULL && \
207 strlen(ar->ar_vnode2_mac_labels) != 0) { \
208 tok = au_to_text(ar->ar_vnode2_mac_labels); \
209 kau_write(rec, tok); \
210 } \
211 } while (0)
212 #else
213 #define MAC_VNODE1_LABEL_TOKEN
214 #define MAC_VNODE2_LABEL_TOKEN
215 #endif
216 #define UPATH1_TOKENS do { \
217 if (ARG_IS_VALID(kar, ARG_UPATH1)) { \
218 tok = au_to_path(ar->ar_arg_upath1); \
219 kau_write(rec, tok); \
220 } \
221 } while (0)
222
223 #define UPATH2_TOKENS do { \
224 if (ARG_IS_VALID(kar, ARG_UPATH2)) { \
225 tok = au_to_path(ar->ar_arg_upath2); \
226 kau_write(rec, tok); \
227 } \
228 } while (0)
229
230 #define VNODE1_TOKENS do { \
231 if (ARG_IS_VALID(kar, ARG_KPATH1)) { \
232 tok = au_to_path(ar->ar_arg_kpath1); \
233 kau_write(rec, tok); \
234 } \
235 if (ARG_IS_VALID(kar, ARG_VNODE1)) { \
236 tok = au_to_attr32(&ar->ar_arg_vnode1); \
237 kau_write(rec, tok); \
238 MAC_VNODE1_LABEL_TOKEN; \
239 } \
240 } while (0)
241
242 #define UPATH1_VNODE1_TOKENS do { \
243 if (ARG_IS_VALID(kar, ARG_UPATH1)) { \
244 tok = au_to_path(ar->ar_arg_upath1); \
245 kau_write(rec, tok); \
246 } \
247 if (ARG_IS_VALID(kar, ARG_KPATH1)) { \
248 tok = au_to_path(ar->ar_arg_kpath1); \
249 kau_write(rec, tok); \
250 } \
251 if (ARG_IS_VALID(kar, ARG_VNODE1)) { \
252 tok = au_to_attr32(&ar->ar_arg_vnode1); \
253 kau_write(rec, tok); \
254 MAC_VNODE1_LABEL_TOKEN; \
255 } \
256 } while (0)
257
258 #define VNODE2_TOKENS do { \
259 if (ARG_IS_VALID(kar, ARG_VNODE2)) { \
260 tok = au_to_attr32(&ar->ar_arg_vnode2); \
261 kau_write(rec, tok); \
262 MAC_VNODE2_LABEL_TOKEN; \
263 } \
264 } while (0)
265
266 #define FD_VNODE1_TOKENS do { \
267 if (ARG_IS_VALID(kar, ARG_VNODE1)) { \
268 if (ARG_IS_VALID(kar, ARG_KPATH1)) { \
269 tok = au_to_path(ar->ar_arg_kpath1); \
270 kau_write(rec, tok); \
271 } \
272 if (ARG_IS_VALID(kar, ARG_FD)) { \
273 tok = au_to_arg32(1, "fd", ar->ar_arg_fd); \
274 kau_write(rec, tok); \
275 MAC_VNODE1_LABEL_TOKEN; \
276 } \
277 tok = au_to_attr32(&ar->ar_arg_vnode1); \
278 kau_write(rec, tok); \
279 } else { \
280 if (ARG_IS_VALID(kar, ARG_FD)) { \
281 tok = au_to_arg32(1, "fd", \
282 ar->ar_arg_fd); \
283 kau_write(rec, tok); \
284 MAC_VNODE1_LABEL_TOKEN; \
285 } \
286 } \
287 } while (0)
288
289 #define PROCESS_PID_TOKENS(argn) do { \
290 if ((ar->ar_arg_pid > 0) /* Reference a single process */ \
291 && (ARG_IS_VALID(kar, ARG_PROCESS))) { \
292 tok = au_to_process32_ex(ar->ar_arg_auid, \
293 ar->ar_arg_euid, ar->ar_arg_egid, \
294 ar->ar_arg_ruid, ar->ar_arg_rgid, \
295 ar->ar_arg_pid, ar->ar_arg_asid, \
296 &ar->ar_arg_termid_addr); \
297 kau_write(rec, tok); \
298 } else if (ARG_IS_VALID(kar, ARG_PID)) { \
299 tok = au_to_arg32(argn, "process", ar->ar_arg_pid); \
300 kau_write(rec, tok); \
301 } \
302 } while (0)
303
304 #define EXTATTR_TOKENS do { \
305 if (ARG_IS_VALID(kar, ARG_VALUE32)) { \
306 switch (ar->ar_arg_value32) { \
307 case EXTATTR_NAMESPACE_USER: \
308 tok = au_to_text(EXTATTR_NAMESPACE_USER_STRING);\
309 break; \
310 case EXTATTR_NAMESPACE_SYSTEM: \
311 tok = au_to_text(EXTATTR_NAMESPACE_SYSTEM_STRING);\
312 break; \
313 default: \
314 tok = au_to_arg32(3, "attrnamespace", \
315 ar->ar_arg_value32); \
316 break; \
317 } \
318 kau_write(rec, tok); \
319 } \
320 /* attrname is in the text field */ \
321 if (ARG_IS_VALID(kar, ARG_TEXT)) { \
322 tok = au_to_text(ar->ar_arg_text); \
323 kau_write(rec, tok); \
324 } \
325 } while (0)
326
327 #define EXTENDED_TOKENS(n) do { \
328 /* ACL data */ \
329 if (ARG_IS_VALID(kar, ARG_OPAQUE)) { \
330 tok = au_to_opaque(ar->ar_arg_opaque, \
331 ar->ar_arg_opq_size); \
332 kau_write(rec, tok); \
333 } \
334 if (ARG_IS_VALID(kar, ARG_MODE)) { \
335 tok = au_to_arg32(n+2, "mode", ar->ar_arg_mode);\
336 kau_write(rec, tok); \
337 } \
338 if (ARG_IS_VALID(kar, ARG_GID)) { \
339 tok = au_to_arg32(n+1, "gid", ar->ar_arg_gid); \
340 kau_write(rec, tok); \
341 } \
342 if (ARG_IS_VALID(kar, ARG_UID)) { \
343 tok = au_to_arg32(n, "uid", ar->ar_arg_uid); \
344 kau_write(rec, tok); \
345 } \
346 } while (0)
347
348 #define PROCESS_MAC_TOKENS do { \
349 if (ar->ar_valid_arg & ARG_MAC_STRING) { \
350 tok = au_to_text(ar->ar_arg_mac_string); \
351 kau_write(rec, tok); \
352 } \
353 } while (0)
354
355 /*
356 * Implement auditing for the auditon() system call. The audit tokens that
357 * are generated depend on the command that was sent into the auditon()
358 * system call.
359 */
360 static void
361 audit_sys_auditon(struct audit_record *ar, struct au_record *rec)
362 {
363 struct au_token *tok;
364
365 switch (ar->ar_arg_cmd) {
366 case A_OLDSETPOLICY:
367 if (ar->ar_arg_len > sizeof(int)) {
368 tok = au_to_arg32(3, "length", ar->ar_arg_len);
369 kau_write(rec, tok);
370 tok = au_to_arg64(2, "policy",
371 ar->ar_arg_auditon.au_policy64);
372 kau_write(rec, tok);
373 break;
374 }
375 /* FALLTHROUGH */
376 case A_SETPOLICY:
377 tok = au_to_arg32(3, "length", ar->ar_arg_len);
378 kau_write(rec, tok);
379 tok = au_to_arg32(2, "policy", ar->ar_arg_auditon.au_policy);
380 kau_write(rec, tok);
381 break;
382
383 case A_SETKMASK:
384 tok = au_to_arg32(3, "length", ar->ar_arg_len);
385 kau_write(rec, tok);
386 tok = au_to_arg32(2, "setkmask:as_success",
387 ar->ar_arg_auditon.au_mask.am_success);
388 kau_write(rec, tok);
389 tok = au_to_arg32(2, "setkmask:as_failure",
390 ar->ar_arg_auditon.au_mask.am_failure);
391 kau_write(rec, tok);
392 break;
393
394 case A_OLDSETQCTRL:
395 if (ar->ar_arg_len > sizeof(au_qctrl_t)) {
396 tok = au_to_arg32(3, "length", ar->ar_arg_len);
397 kau_write(rec, tok);
398 tok = au_to_arg64(2, "setqctrl:aq_hiwater",
399 ar->ar_arg_auditon.au_qctrl64.aq64_hiwater);
400 kau_write(rec, tok);
401 tok = au_to_arg64(2, "setqctrl:aq_lowater",
402 ar->ar_arg_auditon.au_qctrl64.aq64_lowater);
403 kau_write(rec, tok);
404 tok = au_to_arg64(2, "setqctrl:aq_bufsz",
405 ar->ar_arg_auditon.au_qctrl64.aq64_bufsz);
406 kau_write(rec, tok);
407 tok = au_to_arg64(2, "setqctrl:aq_delay",
408 ar->ar_arg_auditon.au_qctrl64.aq64_delay);
409 kau_write(rec, tok);
410 tok = au_to_arg32(2, "setqctrl:aq_minfree",
411 ar->ar_arg_auditon.au_qctrl64.aq64_minfree);
412 kau_write(rec, tok);
413 break;
414 }
415 /* FALLTHROUGH */
416 case A_SETQCTRL:
417 tok = au_to_arg32(3, "length", ar->ar_arg_len);
418 kau_write(rec, tok);
419 tok = au_to_arg32(2, "setqctrl:aq_hiwater",
420 ar->ar_arg_auditon.au_qctrl.aq_hiwater);
421 kau_write(rec, tok);
422 tok = au_to_arg32(2, "setqctrl:aq_lowater",
423 ar->ar_arg_auditon.au_qctrl.aq_lowater);
424 kau_write(rec, tok);
425 tok = au_to_arg32(2, "setqctrl:aq_bufsz",
426 ar->ar_arg_auditon.au_qctrl.aq_bufsz);
427 kau_write(rec, tok);
428 tok = au_to_arg32(2, "setqctrl:aq_delay",
429 ar->ar_arg_auditon.au_qctrl.aq_delay);
430 kau_write(rec, tok);
431 tok = au_to_arg32(2, "setqctrl:aq_minfree",
432 ar->ar_arg_auditon.au_qctrl.aq_minfree);
433 kau_write(rec, tok);
434 break;
435
436 case A_SETUMASK:
437 tok = au_to_arg32(3, "length", ar->ar_arg_len);
438 kau_write(rec, tok);
439 tok = au_to_arg32(2, "setumask:as_success",
440 ar->ar_arg_auditon.au_auinfo.ai_mask.am_success);
441 kau_write(rec, tok);
442 tok = au_to_arg32(2, "setumask:as_failure",
443 ar->ar_arg_auditon.au_auinfo.ai_mask.am_failure);
444 kau_write(rec, tok);
445 break;
446
447 case A_SETSMASK:
448 tok = au_to_arg32(3, "length", ar->ar_arg_len);
449 kau_write(rec, tok);
450 tok = au_to_arg32(2, "setsmask:as_success",
451 ar->ar_arg_auditon.au_auinfo.ai_mask.am_success);
452 kau_write(rec, tok);
453 tok = au_to_arg32(2, "setsmask:as_failure",
454 ar->ar_arg_auditon.au_auinfo.ai_mask.am_failure);
455 kau_write(rec, tok);
456 break;
457
458 case A_OLDSETCOND:
459 if (ar->ar_arg_len > sizeof(int)) {
460 tok = au_to_arg32(3, "length", ar->ar_arg_len);
461 kau_write(rec, tok);
462 tok = au_to_arg64(2, "setcond",
463 ar->ar_arg_auditon.au_cond64);
464 kau_write(rec, tok);
465 break;
466 }
467 /* FALLTHROUGH */
468 case A_SETCOND:
469 tok = au_to_arg32(3, "length", ar->ar_arg_len);
470 kau_write(rec, tok);
471 tok = au_to_arg32(2, "setcond", ar->ar_arg_auditon.au_cond);
472 kau_write(rec, tok);
473 break;
474
475 case A_SETCLASS:
476 tok = au_to_arg32(3, "length", ar->ar_arg_len);
477 kau_write(rec, tok);
478 tok = au_to_arg32(2, "setclass:ec_event",
479 ar->ar_arg_auditon.au_evclass.ec_number);
480 kau_write(rec, tok);
481 tok = au_to_arg32(3, "setclass:ec_class",
482 ar->ar_arg_auditon.au_evclass.ec_class);
483 kau_write(rec, tok);
484 break;
485
486 case A_SETPMASK:
487 tok = au_to_arg32(3, "length", ar->ar_arg_len);
488 kau_write(rec, tok);
489 tok = au_to_arg32(2, "setpmask:as_success",
490 ar->ar_arg_auditon.au_aupinfo.ap_mask.am_success);
491 kau_write(rec, tok);
492 tok = au_to_arg32(2, "setpmask:as_failure",
493 ar->ar_arg_auditon.au_aupinfo.ap_mask.am_failure);
494 kau_write(rec, tok);
495 break;
496
497 case A_SETFSIZE:
498 tok = au_to_arg32(3, "length", ar->ar_arg_len);
499 kau_write(rec, tok);
500 tok = au_to_arg32(2, "setfsize:filesize",
501 ar->ar_arg_auditon.au_fstat.af_filesz);
502 kau_write(rec, tok);
503 break;
504
505 default:
506 break;
507 }
508 tok = au_to_arg32(1, "cmd", ar->ar_arg_cmd);
509 kau_write(rec, tok);
510 }
511
512 /*
513 * Implement auditing for the fcntl() system call. The audit tokens that
514 * are generated depend on the command that was sent into the fcntl()
515 * system call.
516 */
517 static void
518 audit_sys_fcntl(struct kaudit_record *kar, struct au_record *rec)
519 {
520 struct au_token *tok;
521 struct audit_record *ar = &kar->k_ar;
522
523 switch (ar->ar_arg_cmd) {
524
525 case F_DUPFD:
526 if (ARG_IS_VALID(kar, ARG_VALUE32)) {
527 tok = au_to_arg32(3, "min fd", ar->ar_arg_value32);
528 kau_write(rec, tok);
529 }
530 break;
531
532 case F_SETFD:
533 if (ARG_IS_VALID(kar, ARG_VALUE32)) {
534 tok = au_to_arg32(3, "close-on-exec flag",
535 ar->ar_arg_value32);
536 kau_write(rec, tok);
537 }
538 break;
539
540 case F_SETFL:
541 if (ARG_IS_VALID(kar, ARG_VALUE32)) {
542 tok = au_to_arg32(3, "fd flags", ar->ar_arg_value32);
543 kau_write(rec, tok);
544 }
545 break;
546
547 case F_SETOWN:
548 if (ARG_IS_VALID(kar, ARG_VALUE32)) {
549 tok = au_to_arg32(3, "pid", ar->ar_arg_value32);
550 kau_write(rec, tok);
551 }
552 break;
553
554 #ifdef F_SETSIZE
555 case F_SETSIZE:
556 if (ARG_IS_VALID(kar, ARG_VALUE64)) {
557 tok = au_to_arg64(3, "offset", ar->ar_arg_value64);
558 kau_write(rec, tok);
559 }
560 break;
561 #endif /* F_SETSIZE */
562
563 #ifdef F_PATHPKG_CHECK
564 case F_PATHPKG_CHECK:
565 if (ARG_IS_VALID(kar, ARG_TEXT)) {
566 tok = au_to_text(ar->ar_arg_text);
567 kau_write(rec, tok);
568 }
569 break;
570 #endif
571
572 default:
573 break;
574 }
575 tok = au_to_arg32(2, "cmd", au_fcntl_cmd_to_bsm(ar->ar_arg_cmd));
576 kau_write(rec, tok);
577 }
578
579 /*
580 * Convert an internal kernel audit record to a BSM record and return a
581 * success/failure indicator. The BSM record is passed as an out parameter to
582 * this function.
583 *
584 * Return conditions:
585 * BSM_SUCCESS: The BSM record is valid
586 * BSM_FAILURE: Failure; the BSM record is NULL.
587 * BSM_NOAUDIT: The event is not auditable for BSM; the BSM record is NULL.
588 */
589 int
590 kaudit_to_bsm(struct kaudit_record *kar, struct au_record **pau)
591 {
592 struct au_token *tok = NULL, *subj_tok;
593 struct au_record *rec;
594 au_tid_t tid;
595 struct audit_record *ar;
596 int ctr;
597 u_int uctr;
598
599 KASSERT(kar != NULL, ("kaudit_to_bsm: kar == NULL"));
600
601 *pau = NULL;
602 ar = &kar->k_ar;
603 rec = kau_open();
604
605 /*
606 * Create the subject token.
607 */
608 switch (ar->ar_subj_term_addr.at_type) {
609 case AU_IPv4:
610 tid.port = ar->ar_subj_term_addr.at_port;
611 tid.machine = ar->ar_subj_term_addr.at_addr[0];
612 subj_tok = au_to_subject32(ar->ar_subj_auid, /* audit ID */
613 ar->ar_subj_cred.cr_uid, /* eff uid */
614 ar->ar_subj_egid, /* eff group id */
615 ar->ar_subj_ruid, /* real uid */
616 ar->ar_subj_rgid, /* real group id */
617 ar->ar_subj_pid, /* process id */
618 ar->ar_subj_asid, /* session ID */
619 &tid);
620 break;
621 case AU_IPv6:
622 subj_tok = au_to_subject32_ex(ar->ar_subj_auid,
623 ar->ar_subj_cred.cr_uid,
624 ar->ar_subj_egid,
625 ar->ar_subj_ruid,
626 ar->ar_subj_rgid,
627 ar->ar_subj_pid,
628 ar->ar_subj_asid,
629 &ar->ar_subj_term_addr);
630 break;
631 default:
632 bzero(&tid, sizeof(tid));
633 subj_tok = au_to_subject32(ar->ar_subj_auid,
634 ar->ar_subj_cred.cr_uid,
635 ar->ar_subj_egid,
636 ar->ar_subj_ruid,
637 ar->ar_subj_rgid,
638 ar->ar_subj_pid,
639 ar->ar_subj_asid,
640 &tid);
641 }
642
643 /*
644 * The logic inside each case fills in the tokens required for the
645 * event, except for the header, trailer, and return tokens. The
646 * header and trailer tokens are added by the kau_close() function.
647 * The return token is added outside of the switch statement.
648 */
649 switch(ar->ar_event) {
650 case AUE_SENDFILE:
651 /* For sendfile the file and socket descriptor are both saved */
652 if (ARG_IS_VALID(kar, ARG_VALUE32)) {
653 tok = au_to_arg32(2, "sd", ar->ar_arg_value32);
654 kau_write(rec, tok);
655 }
656 /* FALLTHROUGH */
657 case AUE_ACCEPT:
658 case AUE_BIND:
659 case AUE_LISTEN:
660 case AUE_CONNECT:
661 case AUE_RECVFROM:
662 case AUE_RECVMSG:
663 case AUE_SENDMSG:
664 case AUE_SENDTO:
665 /*
666 * Socket-related events.
667 */
668 if (ARG_IS_VALID(kar, ARG_FD)) {
669 tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
670 kau_write(rec, tok);
671 }
672 if (ARG_IS_VALID(kar, ARG_SADDRINET)) {
673 tok = au_to_sock_inet((struct sockaddr_in *)
674 &ar->ar_arg_sockaddr);
675 kau_write(rec, tok);
676 }
677 if (ARG_IS_VALID(kar, ARG_SADDRUNIX)) {
678 tok = au_to_sock_unix((struct sockaddr_un *)
679 &ar->ar_arg_sockaddr);
680 kau_write(rec, tok);
681 UPATH1_TOKENS;
682 }
683 if (ARG_IS_VALID(kar, ARG_SADDRINET6)) {
684 tok = au_to_sock_inet128((struct sockaddr_in6 *)
685 &ar->ar_arg_sockaddr);
686 kau_write(rec, tok);
687 }
688 break;
689
690 case AUE_SOCKET:
691 case AUE_SOCKETPAIR:
692 if (ARG_IS_VALID(kar, ARG_SOCKINFO)) {
693 tok = au_to_arg32(1,"domain",
694 au_domain_to_bsm(ar->ar_arg_sockinfo.sai_domain));
695 kau_write(rec, tok);
696 tok = au_to_arg32(2,"type",
697 au_socket_type_to_bsm(ar->ar_arg_sockinfo.sai_type));
698 kau_write(rec, tok);
699 tok = au_to_arg32(3,"protocol",
700 ar->ar_arg_sockinfo.sai_protocol);
701 kau_write(rec, tok);
702 }
703 break;
704
705 case AUE_SETSOCKOPT:
706 case AUE_SHUTDOWN:
707 if (ARG_IS_VALID(kar, ARG_FD)) {
708 tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
709 kau_write(rec, tok);
710 }
711 break;
712
713 case AUE_ACCT:
714 if (ARG_IS_VALID(kar, (ARG_KPATH1 | ARG_UPATH1))) {
715 UPATH1_VNODE1_TOKENS;
716 } else {
717 tok = au_to_arg32(1, "accounting off", 0);
718 kau_write(rec, tok);
719 }
720 break;
721
722 case AUE_SETAUID:
723 if (ARG_IS_VALID(kar, ARG_AUID)) {
724 tok = au_to_arg32(2, "setauid", ar->ar_arg_auid);
725 kau_write(rec, tok);
726 }
727 break;
728
729 case AUE_SETAUDIT:
730 if (ARG_IS_VALID(kar, ARG_AUID) &&
731 ARG_IS_VALID(kar, ARG_ASID) &&
732 ARG_IS_VALID(kar, ARG_AMASK) &&
733 ARG_IS_VALID(kar, ARG_TERMID)) {
734 tok = au_to_arg32(1, "setaudit:auid",
735 ar->ar_arg_auid);
736 kau_write(rec, tok);
737 tok = au_to_arg32(1, "setaudit:port",
738 ar->ar_arg_termid.port);
739 kau_write(rec, tok);
740 tok = au_to_arg32(1, "setaudit:machine",
741 ar->ar_arg_termid.machine);
742 kau_write(rec, tok);
743 tok = au_to_arg32(1, "setaudit:as_success",
744 ar->ar_arg_amask.am_success);
745 kau_write(rec, tok);
746 tok = au_to_arg32(1, "setaudit:as_failure",
747 ar->ar_arg_amask.am_failure);
748 kau_write(rec, tok);
749 tok = au_to_arg32(1, "setaudit:asid",
750 ar->ar_arg_asid);
751 kau_write(rec, tok);
752 }
753 break;
754
755 case AUE_SETAUDIT_ADDR:
756 if (ARG_IS_VALID(kar, ARG_AUID) &&
757 ARG_IS_VALID(kar, ARG_ASID) &&
758 ARG_IS_VALID(kar, ARG_AMASK) &&
759 ARG_IS_VALID(kar, ARG_TERMID_ADDR)) {
760 tok = au_to_arg32(1, "setaudit_addr:auid",
761 ar->ar_arg_auid);
762 kau_write(rec, tok);
763 tok = au_to_arg32(1, "setaudit_addr:as_success",
764 ar->ar_arg_amask.am_success);
765 kau_write(rec, tok);
766 tok = au_to_arg32(1, "setaudit_addr:as_failure",
767 ar->ar_arg_amask.am_failure);
768 kau_write(rec, tok);
769 tok = au_to_arg32(1, "setaudit_addr:asid",
770 ar->ar_arg_asid);
771 kau_write(rec, tok);
772 tok = au_to_arg32(1, "setaudit_addr:type",
773 ar->ar_arg_termid_addr.at_type);
774 kau_write(rec, tok);
775 tok = au_to_arg32(1, "setaudit_addr:port",
776 ar->ar_arg_termid_addr.at_port);
777 kau_write(rec, tok);
778 if (ar->ar_arg_termid_addr.at_type == AU_IPv6)
779 tok = au_to_in_addr_ex((struct in6_addr *)
780 &ar->ar_arg_termid_addr.at_addr[0]);
781 if (ar->ar_arg_termid_addr.at_type == AU_IPv4)
782 tok = au_to_in_addr((struct in_addr *)
783 &ar->ar_arg_termid_addr.at_addr[0]);
784 kau_write(rec, tok);
785 }
786 break;
787
788 case AUE_AUDITON:
789 /*
790 * For AUDITON commands without own event, audit the cmd.
791 */
792 if (ARG_IS_VALID(kar, ARG_CMD)) {
793 tok = au_to_arg32(1, "cmd", ar->ar_arg_cmd);
794 kau_write(rec, tok);
795 }
796 /* FALLTHROUGH */
797
798 case AUE_AUDITON_GETCAR:
799 case AUE_AUDITON_GETCLASS:
800 case AUE_AUDITON_GETCOND:
801 case AUE_AUDITON_GETCWD:
802 case AUE_AUDITON_GETKMASK:
803 case AUE_AUDITON_GETSTAT:
804 case AUE_AUDITON_GPOLICY:
805 case AUE_AUDITON_GQCTRL:
806 case AUE_AUDITON_SETCLASS:
807 case AUE_AUDITON_SETCOND:
808 case AUE_AUDITON_SETKMASK:
809 case AUE_AUDITON_SETSMASK:
810 case AUE_AUDITON_SETSTAT:
811 case AUE_AUDITON_SETUMASK:
812 case AUE_AUDITON_SPOLICY:
813 case AUE_AUDITON_SQCTRL:
814 if (ARG_IS_VALID(kar, ARG_AUDITON))
815 audit_sys_auditon(ar, rec);
816 break;
817
818 case AUE_AUDITCTL:
819 UPATH1_VNODE1_TOKENS;
820 break;
821
822 case AUE_EXIT:
823 if (ARG_IS_VALID(kar, ARG_EXIT)) {
824 tok = au_to_exit(ar->ar_arg_exitretval,
825 ar->ar_arg_exitstatus);
826 kau_write(rec, tok);
827 }
828 break;
829
830 case AUE_ADJTIME:
831 case AUE_AUDIT:
832 case AUE_DUP2:
833 case AUE_GETAUDIT:
834 case AUE_GETAUDIT_ADDR:
835 case AUE_GETAUID:
836 case AUE_GETFSSTAT:
837 case AUE_KQUEUE:
838 case AUE_LSEEK:
839 #if 0
840 /* XXXss replace with kext */
841 case AUE_MODLOAD:
842 case AUE_MODUNLOAD:
843 #endif
844 case AUE_MAC_GETFSSTAT:
845 case AUE_PIPE:
846 case AUE_PROFILE:
847 case AUE_SEMSYS:
848 case AUE_SHMSYS:
849 case AUE_SETPGRP:
850 case AUE_SETRLIMIT:
851 case AUE_SETSID:
852 case AUE_SETTIMEOFDAY:
853 case AUE_KDEBUGTRACE:
854 case AUE_PTHREADSIGMASK:
855 /*
856 * Header, subject, and return tokens added at end.
857 */
858 break;
859
860 case AUE_MKFIFO:
861 if (ARG_IS_VALID(kar, ARG_MODE)) {
862 tok = au_to_arg32(2, "mode", ar->ar_arg_mode);
863 kau_write(rec, tok);
864 }
865 UPATH1_VNODE1_TOKENS;
866 break;
867
868 case AUE_ACCESS_EXTENDED:
869 /*
870 * The access_extended() argument vector is stored in an
871 * opaque token.
872 */
873 if (ARG_IS_VALID(kar, ARG_OPAQUE)) {
874 tok = au_to_opaque(ar->ar_arg_opaque,
875 ar->ar_arg_opq_size);
876 kau_write(rec, tok);
877 }
878 /*
879 * The access_extended() result vector is stored in an arbitrary
880 * data token.
881 */
882 if (ARG_IS_VALID(kar, ARG_DATA)) {
883 tok = au_to_data(AUP_DECIMAL, ar->ar_arg_data_type,
884 ar->ar_arg_data_count, ar->ar_arg_data);
885 kau_write(rec, tok);
886 }
887 UPATH1_VNODE1_TOKENS;
888 break;
889
890 case AUE_LSTAT_EXTENDED:
891 case AUE_STAT_EXTENDED:
892 case AUE_ACCESS:
893 case AUE_CHDIR:
894 case AUE_CHROOT:
895 case AUE_GETATTRLIST:
896 case AUE_NFS_GETFH:
897 case AUE_LSTAT:
898 case AUE_PATHCONF:
899 case AUE_READLINK:
900 case AUE_REVOKE:
901 case AUE_RMDIR:
902 case AUE_SEARCHFS:
903 case AUE_SETATTRLIST:
904 case AUE_STAT:
905 case AUE_STATFS:
906 case AUE_TRUNCATE:
907 case AUE_UNDELETE:
908 case AUE_UNLINK:
909 case AUE_UTIMES:
910 UPATH1_VNODE1_TOKENS;
911 break;
912
913 case AUE_FHOPEN:
914 break;
915
916 case AUE_CHFLAGS:
917 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
918 tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
919 kau_write(rec, tok);
920 }
921 UPATH1_VNODE1_TOKENS;
922 break;
923
924 case AUE_CHMOD:
925 if (ARG_IS_VALID(kar, ARG_MODE)) {
926 tok = au_to_arg32(2, "new file mode",
927 ar->ar_arg_mode);
928 kau_write(rec, tok);
929 }
930 UPATH1_VNODE1_TOKENS;
931 break;
932
933 case AUE_CHOWN:
934 case AUE_LCHOWN:
935 if (ARG_IS_VALID(kar, ARG_UID)) {
936 tok = au_to_arg32(2, "new file uid", ar->ar_arg_uid);
937 kau_write(rec, tok);
938 }
939 if (ARG_IS_VALID(kar, ARG_GID)) {
940 tok = au_to_arg32(3, "new file gid", ar->ar_arg_gid);
941 kau_write(rec, tok);
942 }
943 UPATH1_VNODE1_TOKENS;
944 break;
945
946 case AUE_EXCHANGEDATA:
947 UPATH1_VNODE1_TOKENS;
948 UPATH2_TOKENS;
949 break;
950
951 case AUE_CLOSE:
952 if (ARG_IS_VALID(kar, ARG_FD)) {
953 tok = au_to_arg32(2, "fd", ar->ar_arg_fd);
954 kau_write(rec, tok);
955 }
956 UPATH1_VNODE1_TOKENS;
957 break;
958
959 case AUE_CORE:
960 if (ARG_IS_VALID(kar, ARG_SIGNUM)) {
961 tok = au_to_arg32(0, "signal", ar->ar_arg_signum);
962 kau_write(rec, tok);
963 }
964 UPATH1_VNODE1_TOKENS;
965 break;
966
967 case AUE_POSIX_SPAWN:
968 if (ARG_IS_VALID(kar, ARG_PID)) {
969 tok = au_to_arg32(0, "child PID", ar->ar_arg_pid);
970 kau_write(rec, tok);
971 }
972 /* FALLTHROUGH */
973
974 case AUE_EXECVE:
975 if (ARG_IS_VALID(kar, ARG_ARGV)) {
976 tok = au_to_exec_args(ar->ar_arg_argv,
977 ar->ar_arg_argc);
978 kau_write(rec, tok);
979 }
980 if (ARG_IS_VALID(kar, ARG_ENVV)) {
981 tok = au_to_exec_env(ar->ar_arg_envv,
982 ar->ar_arg_envc);
983 kau_write(rec, tok);
984 }
985 UPATH1_VNODE1_TOKENS;
986 break;
987
988 case AUE_FCHMOD_EXTENDED:
989 EXTENDED_TOKENS(2);
990 FD_VNODE1_TOKENS;
991 break;
992
993 case AUE_FCHMOD:
994 if (ARG_IS_VALID(kar, ARG_MODE)) {
995 tok = au_to_arg32(2, "new file mode",
996 ar->ar_arg_mode);
997 kau_write(rec, tok);
998 }
999 FD_VNODE1_TOKENS;
1000 break;
1001
1002 case AUE_NFS_SVC:
1003 tok = au_to_arg32(1, "request", ar->ar_arg_cmd);
1004 kau_write(rec, tok);
1005 if (ar->ar_valid_arg & (ARG_KPATH1 | ARG_UPATH1)) {
1006 UPATH1_VNODE1_TOKENS;
1007 }
1008 break;
1009
1010 /*
1011 * XXXRW: Some of these need to handle non-vnode cases as well.
1012 */
1013 case AUE_FSTAT_EXTENDED:
1014 case AUE_FCHDIR:
1015 case AUE_FPATHCONF:
1016 case AUE_FSTAT: /* XXX Need to handle sockets and shm */
1017 case AUE_FSTATFS:
1018 case AUE_FSYNC:
1019 case AUE_FTRUNCATE:
1020 case AUE_FUTIMES:
1021 case AUE_GETDIRENTRIES:
1022 case AUE_GETDIRENTRIESATTR:
1023 case AUE_GETATTRLISTBULK:
1024 #if 0 /* XXXss new */
1025 case AUE_POLL:
1026 #endif
1027 case AUE_READ:
1028 case AUE_READV:
1029 case AUE_PREAD:
1030 case AUE_WRITE:
1031 case AUE_WRITEV:
1032 case AUE_PWRITE:
1033 FD_VNODE1_TOKENS;
1034 break;
1035
1036 case AUE_FCHOWN:
1037 if (ARG_IS_VALID(kar, ARG_UID)) {
1038 tok = au_to_arg32(2, "new file uid", ar->ar_arg_uid);
1039 kau_write(rec, tok);
1040 }
1041 if (ARG_IS_VALID(kar, ARG_GID)) {
1042 tok = au_to_arg32(3, "new file gid", ar->ar_arg_gid);
1043 kau_write(rec, tok);
1044 }
1045 FD_VNODE1_TOKENS;
1046 break;
1047
1048 case AUE_FCNTL:
1049 if (ARG_IS_VALID(kar, ARG_CMD))
1050 audit_sys_fcntl(kar, rec);
1051 FD_VNODE1_TOKENS;
1052 break;
1053
1054 case AUE_FSCTL:
1055 if (ARG_IS_VALID(kar, ARG_VALUE32)) {
1056 tok = au_to_arg32(4, "options", ar->ar_arg_value32);
1057 kau_write(rec, tok);
1058 }
1059 if (ARG_IS_VALID(kar, ARG_CMD)) {
1060 tok = au_to_arg32(2, "cmd", ar->ar_arg_cmd);
1061 kau_write(rec, tok);
1062 }
1063 UPATH1_VNODE1_TOKENS;
1064 break;
1065
1066 case AUE_FFSCTL:
1067 if (ARG_IS_VALID(kar, ARG_VALUE32)) {
1068 tok = au_to_arg32(4, "options", ar->ar_arg_value32);
1069 kau_write(rec, tok);
1070 }
1071 if (ARG_IS_VALID(kar, ARG_CMD)) {
1072 tok = au_to_arg32(2, "cmd", ar->ar_arg_cmd);
1073 kau_write(rec, tok);
1074 }
1075 FD_VNODE1_TOKENS;
1076 break;
1077
1078
1079 case AUE_FCHFLAGS:
1080 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1081 tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
1082 kau_write(rec, tok);
1083 }
1084 FD_VNODE1_TOKENS;
1085 break;
1086
1087 case AUE_FLOCK:
1088 if (ARG_IS_VALID(kar, ARG_CMD)) {
1089 tok = au_to_arg32(2, "operation", ar->ar_arg_cmd);
1090 kau_write(rec, tok);
1091 }
1092 FD_VNODE1_TOKENS;
1093 break;
1094
1095 case AUE_FORK:
1096 case AUE_VFORK:
1097 if (ARG_IS_VALID(kar, ARG_PID)) {
1098 tok = au_to_arg32(0, "child PID", ar->ar_arg_pid);
1099 kau_write(rec, tok);
1100 }
1101 break;
1102
1103 case AUE_GETLCID:
1104 if (ARG_IS_VALID(kar, ARG_PID)) {
1105 tok = au_to_arg32(1, "pid", (u_int32_t)ar->ar_arg_pid);
1106 kau_write(rec, tok);
1107 }
1108 break;
1109
1110 case AUE_SETLCID:
1111 if (ARG_IS_VALID(kar, ARG_PID)) {
1112 tok = au_to_arg32(1, "pid", (u_int32_t)ar->ar_arg_pid);
1113 kau_write(rec, tok);
1114 }
1115 if (ARG_IS_VALID(kar, ARG_VALUE32)) {
1116 tok = au_to_arg32(2, "lcid",
1117 (u_int32_t)ar->ar_arg_value32);
1118 kau_write(rec, tok);
1119 }
1120 break;
1121
1122 case AUE_IOCTL:
1123 if (ARG_IS_VALID(kar, ARG_CMD)) {
1124 tok = au_to_arg32(2, "cmd", ar->ar_arg_cmd);
1125 kau_write(rec, tok);
1126 }
1127 if (ARG_IS_VALID(kar, ARG_VALUE64)) {
1128 tok = au_to_arg64(2, "cmd", ar->ar_arg_value64);
1129 kau_write(rec, tok);
1130 }
1131 if (ARG_IS_VALID(kar, ARG_ADDR64)) {
1132 tok = au_to_arg64(3, "arg", ar->ar_arg_addr);
1133 kau_write(rec, tok);
1134 } else if (ARG_IS_VALID(kar, ARG_ADDR32)) {
1135 tok = au_to_arg32(3, "arg",
1136 (u_int32_t)ar->ar_arg_addr);
1137 kau_write(rec, tok);
1138 }
1139 if (ARG_IS_VALID(kar, ARG_VNODE1))
1140 FD_VNODE1_TOKENS;
1141 else {
1142 if (ARG_IS_VALID(kar, ARG_SOCKINFO)) {
1143 tok = au_to_socket_ex(
1144 ar->ar_arg_sockinfo.sai_domain,
1145 ar->ar_arg_sockinfo.sai_type,
1146 (struct sockaddr *)
1147 &ar->ar_arg_sockinfo.sai_laddr,
1148 (struct sockaddr *)
1149 &ar->ar_arg_sockinfo.sai_faddr);
1150 kau_write(rec, tok);
1151 } else {
1152 if (ARG_IS_VALID(kar, ARG_FD)) {
1153 tok = au_to_arg32(1, "fd",
1154 ar->ar_arg_fd);
1155 kau_write(rec, tok);
1156 }
1157 }
1158 }
1159 break;
1160
1161 case AUE_KILL:
1162 if (ARG_IS_VALID(kar, ARG_SIGNUM)) {
1163 tok = au_to_arg32(2, "signal", ar->ar_arg_signum);
1164 kau_write(rec, tok);
1165 }
1166 PROCESS_PID_TOKENS(1);
1167 break;
1168
1169 case AUE_LINK:
1170 case AUE_RENAME:
1171 UPATH1_VNODE1_TOKENS;
1172 UPATH2_TOKENS;
1173 break;
1174
1175 case AUE_MKDIR_EXTENDED:
1176 case AUE_CHMOD_EXTENDED:
1177 case AUE_MKFIFO_EXTENDED:
1178 EXTENDED_TOKENS(2);
1179 UPATH1_VNODE1_TOKENS;
1180 break;
1181
1182 case AUE_MKDIR:
1183 if (ARG_IS_VALID(kar, ARG_MODE)) {
1184 tok = au_to_arg32(2, "mode", ar->ar_arg_mode);
1185 kau_write(rec, tok);
1186 }
1187 UPATH1_VNODE1_TOKENS;
1188 break;
1189
1190 case AUE_MKNOD:
1191 if (ARG_IS_VALID(kar, ARG_MODE)) {
1192 tok = au_to_arg32(2, "mode", ar->ar_arg_mode);
1193 kau_write(rec, tok);
1194 }
1195 if (ARG_IS_VALID(kar, ARG_VALUE32)) {
1196 tok = au_to_arg32(3, "dev", ar->ar_arg_value32);
1197 kau_write(rec, tok);
1198 }
1199 UPATH1_VNODE1_TOKENS;
1200 break;
1201
1202 case AUE_MMAP:
1203 case AUE_MUNMAP:
1204 case AUE_MPROTECT:
1205 case AUE_MLOCK:
1206 case AUE_MUNLOCK:
1207 case AUE_MINHERIT:
1208 if (ARG_IS_VALID(kar, ARG_ADDR64)) {
1209 tok = au_to_arg64(1, "addr", ar->ar_arg_addr);
1210 kau_write(rec, tok);
1211 } else if (ARG_IS_VALID(kar, ARG_ADDR32)) {
1212 tok = au_to_arg32(1, "addr",
1213 (u_int32_t)ar->ar_arg_addr);
1214 kau_write(rec, tok);
1215 }
1216 if (ARG_IS_VALID(kar, ARG_LEN)) {
1217 tok = au_to_arg64(2, "len", ar->ar_arg_len);
1218 kau_write(rec, tok);
1219 }
1220 if (ar->ar_event == AUE_MMAP)
1221 FD_VNODE1_TOKENS;
1222 if (ar->ar_event == AUE_MPROTECT) {
1223 if (ARG_IS_VALID(kar, ARG_VALUE32)) {
1224 tok = au_to_arg32(3, "protection",
1225 ar->ar_arg_value32);
1226 kau_write(rec, tok);
1227 }
1228 }
1229 if (ar->ar_event == AUE_MINHERIT) {
1230 if (ARG_IS_VALID(kar, ARG_VALUE32)) {
1231 tok = au_to_arg32(3, "inherit",
1232 ar->ar_arg_value32);
1233 kau_write(rec, tok);
1234 }
1235 }
1236 break;
1237
1238 #if CONFIG_MACF
1239 case AUE_MAC_MOUNT:
1240 PROCESS_MAC_TOKENS;
1241 /* FALLTHROUGH */
1242 #endif
1243 case AUE_MOUNT:
1244 /* XXX Need to handle NFS mounts */
1245 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1246 tok = au_to_arg32(3, "flags", ar->ar_arg_fflags);
1247 kau_write(rec, tok);
1248 }
1249 if (ARG_IS_VALID(kar, ARG_TEXT)) {
1250 tok = au_to_text(ar->ar_arg_text);
1251 kau_write(rec, tok);
1252 }
1253 /* FALLTHROUGH */
1254
1255 case AUE_UMOUNT:
1256 case AUE_UNMOUNT:
1257 UPATH1_VNODE1_TOKENS;
1258 break;
1259 case AUE_FMOUNT:
1260 if (ARG_IS_VALID(kar, ARG_FD)) {
1261 tok = au_to_arg32(2, "dir fd", ar->ar_arg_fd);
1262 kau_write(rec, tok);
1263 }
1264 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1265 tok = au_to_arg32(3, "flags", ar->ar_arg_fflags);
1266 kau_write(rec, tok);
1267 }
1268 if (ARG_IS_VALID(kar, ARG_TEXT)) {
1269 tok = au_to_text(ar->ar_arg_text);
1270 kau_write(rec, tok);
1271 }
1272 break;
1273
1274 case AUE_MSGCTL:
1275 ar->ar_event = audit_msgctl_to_event(ar->ar_arg_svipc_cmd);
1276 /* FALLTHROUGH */
1277
1278 case AUE_MSGRCV:
1279 case AUE_MSGSND:
1280 tok = au_to_arg32(1, "msg ID", ar->ar_arg_svipc_id);
1281 kau_write(rec, tok);
1282 if (ar->ar_errno != EINVAL) {
1283 tok = au_to_ipc(AT_IPC_MSG, ar->ar_arg_svipc_id);
1284 kau_write(rec, tok);
1285 }
1286 break;
1287
1288 case AUE_MSGGET:
1289 if (ar->ar_errno == 0) {
1290 if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
1291 tok = au_to_ipc(AT_IPC_MSG,
1292 ar->ar_arg_svipc_id);
1293 kau_write(rec, tok);
1294 }
1295 }
1296 break;
1297
1298 case AUE_OPEN:
1299 case AUE_OPEN_R:
1300 case AUE_OPEN_RT:
1301 case AUE_OPEN_RW:
1302 case AUE_OPEN_RWT:
1303 case AUE_OPEN_W:
1304 case AUE_OPEN_WT:
1305 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1306 tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
1307 kau_write(rec, tok);
1308 }
1309 UPATH1_VNODE1_TOKENS;
1310 break;
1311
1312 case AUE_OPEN_RC:
1313 case AUE_OPEN_RTC:
1314 case AUE_OPEN_RWC:
1315 case AUE_OPEN_RWTC:
1316 case AUE_OPEN_WC:
1317 case AUE_OPEN_WTC:
1318 if (ARG_IS_VALID(kar, ARG_MODE)) {
1319 tok = au_to_arg32(3, "mode", ar->ar_arg_mode);
1320 kau_write(rec, tok);
1321 }
1322 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1323 tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
1324 kau_write(rec, tok);
1325 }
1326 UPATH1_VNODE1_TOKENS;
1327 break;
1328
1329 case AUE_OPEN_EXTENDED:
1330 case AUE_OPEN_EXTENDED_R:
1331 case AUE_OPEN_EXTENDED_RT:
1332 case AUE_OPEN_EXTENDED_RW:
1333 case AUE_OPEN_EXTENDED_RWT:
1334 case AUE_OPEN_EXTENDED_W:
1335 case AUE_OPEN_EXTENDED_WT:
1336 EXTENDED_TOKENS(3);
1337 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1338 tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
1339 kau_write(rec, tok);
1340 }
1341 UPATH1_VNODE1_TOKENS;
1342 break;
1343
1344 case AUE_OPEN_EXTENDED_RC:
1345 case AUE_OPEN_EXTENDED_RTC:
1346 case AUE_OPEN_EXTENDED_RWC:
1347 case AUE_OPEN_EXTENDED_RWTC:
1348 case AUE_OPEN_EXTENDED_WC:
1349 case AUE_OPEN_EXTENDED_WTC:
1350 EXTENDED_TOKENS(3);
1351 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1352 tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
1353 kau_write(rec, tok);
1354 }
1355 UPATH1_VNODE1_TOKENS;
1356 break;
1357
1358 case AUE_OPENAT:
1359 case AUE_OPENAT_R:
1360 case AUE_OPENAT_RT:
1361 case AUE_OPENAT_RW:
1362 case AUE_OPENAT_RWT:
1363 case AUE_OPENAT_W:
1364 case AUE_OPENAT_WT:
1365 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1366 tok = au_to_arg32(3, "flags", ar->ar_arg_fflags);
1367 kau_write(rec, tok);
1368 }
1369 if (ARG_IS_VALID(kar, ARG_FD)) {
1370 tok = au_to_arg32(1, "dir fd", ar->ar_arg_fd);
1371 kau_write(rec, tok);
1372 }
1373 UPATH1_VNODE1_TOKENS;
1374 break;
1375
1376 case AUE_OPENAT_RC:
1377 case AUE_OPENAT_RTC:
1378 case AUE_OPENAT_RWC:
1379 case AUE_OPENAT_RWTC:
1380 case AUE_OPENAT_WC:
1381 case AUE_OPENAT_WTC:
1382 if (ARG_IS_VALID(kar, ARG_MODE)) {
1383 tok = au_to_arg32(4, "mode", ar->ar_arg_mode);
1384 kau_write(rec, tok);
1385 }
1386 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1387 tok = au_to_arg32(3, "flags", ar->ar_arg_fflags);
1388 kau_write(rec, tok);
1389 }
1390 if (ARG_IS_VALID(kar, ARG_FD)) {
1391 tok = au_to_arg32(1, "dir fd", ar->ar_arg_fd);
1392 kau_write(rec, tok);
1393 }
1394 UPATH1_VNODE1_TOKENS;
1395 break;
1396
1397 case AUE_OPENBYID:
1398 case AUE_OPENBYID_R:
1399 case AUE_OPENBYID_RT:
1400 case AUE_OPENBYID_RW:
1401 case AUE_OPENBYID_RWT:
1402 case AUE_OPENBYID_W:
1403 case AUE_OPENBYID_WT:
1404 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1405 tok = au_to_arg32(3, "flags", ar->ar_arg_fflags);
1406 kau_write(rec, tok);
1407 }
1408 if (ARG_IS_VALID(kar, ARG_VALUE32)) {
1409 tok = au_to_arg32(1, "volfsid", ar->ar_arg_value32);
1410 kau_write(rec, tok);
1411 }
1412 if (ARG_IS_VALID(kar, ARG_VALUE64)) {
1413 tok = au_to_arg64(2, "objid", ar->ar_arg_value64);
1414 kau_write(rec, tok);
1415 }
1416 break;
1417
1418 case AUE_RENAMEAT:
1419 case AUE_FACCESSAT:
1420 case AUE_FCHMODAT:
1421 case AUE_FCHOWNAT:
1422 case AUE_FSTATAT:
1423 case AUE_LINKAT:
1424 case AUE_UNLINKAT:
1425 case AUE_READLINKAT:
1426 case AUE_SYMLINKAT:
1427 case AUE_MKDIRAT:
1428 case AUE_GETATTRLISTAT:
1429 case AUE_SETATTRLISTAT:
1430 if (ARG_IS_VALID(kar, ARG_FD)) {
1431 tok = au_to_arg32(1, "dir fd", ar->ar_arg_fd);
1432 kau_write(rec, tok);
1433 }
1434 UPATH1_VNODE1_TOKENS;
1435 break;
1436
1437 case AUE_CLONEFILEAT:
1438 if (ARG_IS_VALID(kar, ARG_FD)) {
1439 tok = au_to_arg32(1, "src dir fd", ar->ar_arg_fd);
1440 kau_write(rec, tok);
1441 }
1442 UPATH1_VNODE1_TOKENS;
1443 if (ARG_IS_VALID(kar, ARG_FD2)) {
1444 tok = au_to_arg32(1, "dst dir fd", ar->ar_arg_fd2);
1445 kau_write(rec, tok);
1446 }
1447 UPATH2_TOKENS;
1448 if (ARG_IS_VALID(kar, ARG_VALUE32)) {
1449 tok = au_to_arg32(1, "flags", ar->ar_arg_value32);
1450 kau_write(rec, tok);
1451 }
1452 break;
1453
1454 case AUE_FCLONEFILEAT:
1455 FD_VNODE1_TOKENS;
1456 if (ARG_IS_VALID(kar, ARG_FD2)) {
1457 tok = au_to_arg32(1, "dst dir fd", ar->ar_arg_fd2);
1458 kau_write(rec, tok);
1459 }
1460 UPATH2_TOKENS;
1461 if (ARG_IS_VALID(kar, ARG_VALUE32)) {
1462 tok = au_to_arg32(1, "flags", ar->ar_arg_value32);
1463 kau_write(rec, tok);
1464 }
1465 break;
1466
1467 case AUE_PTRACE:
1468 if (ARG_IS_VALID(kar, ARG_CMD)) {
1469 tok = au_to_arg32(1, "request", ar->ar_arg_cmd);
1470 kau_write(rec, tok);
1471 }
1472 if (ARG_IS_VALID(kar, ARG_ADDR64)) {
1473 tok = au_to_arg64(3, "addr", ar->ar_arg_addr);
1474 kau_write(rec, tok);
1475 } else if (ARG_IS_VALID(kar, ARG_ADDR32)) {
1476 tok = au_to_arg32(3, "addr",
1477 (u_int32_t)ar->ar_arg_addr);
1478 kau_write(rec, tok);
1479 }
1480 if (ARG_IS_VALID(kar, ARG_VALUE32)) {
1481 tok = au_to_arg32(4, "data", ar->ar_arg_value32);
1482 kau_write(rec, tok);
1483 }
1484 PROCESS_PID_TOKENS(2);
1485 break;
1486
1487 case AUE_QUOTACTL:
1488 if (ARG_IS_VALID(kar, ARG_CMD)) {
1489 tok = au_to_arg32(2, "command", ar->ar_arg_cmd);
1490 kau_write(rec, tok);
1491 }
1492 if (ARG_IS_VALID(kar, ARG_UID)) {
1493 tok = au_to_arg32(3, "uid", ar->ar_arg_uid);
1494 kau_write(rec, tok);
1495 }
1496 UPATH1_VNODE1_TOKENS;
1497 break;
1498
1499 case AUE_REBOOT:
1500 if (ARG_IS_VALID(kar, ARG_CMD)) {
1501 tok = au_to_arg32(1, "howto", ar->ar_arg_cmd);
1502 kau_write(rec, tok);
1503 }
1504 break;
1505
1506 case AUE_SEMCTL:
1507 ar->ar_event = audit_semctl_to_event(ar->ar_arg_svipc_cmd);
1508 /* FALLTHROUGH */
1509
1510 case AUE_SEMOP:
1511 if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
1512 tok = au_to_arg32(1, "sem ID", ar->ar_arg_svipc_id);
1513 kau_write(rec, tok);
1514 if (ar->ar_errno != EINVAL) {
1515 tok = au_to_ipc(AT_IPC_SEM,
1516 ar->ar_arg_svipc_id);
1517 kau_write(rec, tok);
1518 }
1519 }
1520 break;
1521
1522 case AUE_SEMGET:
1523 if (ar->ar_errno == 0) {
1524 if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
1525 tok = au_to_ipc(AT_IPC_SEM,
1526 ar->ar_arg_svipc_id);
1527 kau_write(rec, tok);
1528 }
1529 }
1530 break;
1531
1532 case AUE_SETEGID:
1533 if (ARG_IS_VALID(kar, ARG_EGID)) {
1534 tok = au_to_arg32(1, "gid", ar->ar_arg_egid);
1535 kau_write(rec, tok);
1536 }
1537 break;
1538
1539 case AUE_SETEUID:
1540 if (ARG_IS_VALID(kar, ARG_EUID)) {
1541 tok = au_to_arg32(1, "uid", ar->ar_arg_euid);
1542 kau_write(rec, tok);
1543 }
1544 break;
1545
1546 case AUE_SETREGID:
1547 if (ARG_IS_VALID(kar, ARG_RGID)) {
1548 tok = au_to_arg32(1, "rgid", ar->ar_arg_rgid);
1549 kau_write(rec, tok);
1550 }
1551 if (ARG_IS_VALID(kar, ARG_EGID)) {
1552 tok = au_to_arg32(2, "egid", ar->ar_arg_egid);
1553 kau_write(rec, tok);
1554 }
1555 break;
1556
1557 case AUE_SETREUID:
1558 if (ARG_IS_VALID(kar, ARG_RUID)) {
1559 tok = au_to_arg32(1, "ruid", ar->ar_arg_ruid);
1560 kau_write(rec, tok);
1561 }
1562 if (ARG_IS_VALID(kar, ARG_EUID)) {
1563 tok = au_to_arg32(2, "euid", ar->ar_arg_euid);
1564 kau_write(rec, tok);
1565 }
1566 break;
1567
1568 case AUE_SETGID:
1569 if (ARG_IS_VALID(kar, ARG_GID)) {
1570 tok = au_to_arg32(1, "gid", ar->ar_arg_gid);
1571 kau_write(rec, tok);
1572 }
1573 break;
1574
1575 case AUE_SETUID:
1576 if (ARG_IS_VALID(kar, ARG_UID)) {
1577 tok = au_to_arg32(1, "uid", ar->ar_arg_uid);
1578 kau_write(rec, tok);
1579 }
1580 break;
1581
1582 case AUE_SETGROUPS:
1583 if (ARG_IS_VALID(kar, ARG_GROUPSET)) {
1584 for (uctr = 0; uctr < ar->ar_arg_groups.gidset_size;
1585 uctr++) {
1586 tok = au_to_arg32(1, "setgroups",
1587 ar->ar_arg_groups.gidset[uctr]);
1588 kau_write(rec, tok);
1589 }
1590 }
1591 break;
1592
1593 case AUE_SETLOGIN:
1594 if (ARG_IS_VALID(kar, ARG_TEXT)) {
1595 tok = au_to_text(ar->ar_arg_text);
1596 kau_write(rec, tok);
1597 }
1598 break;
1599
1600 case AUE_SETPRIORITY:
1601 if (ARG_IS_VALID(kar, ARG_CMD)) {
1602 tok = au_to_arg32(1, "which", ar->ar_arg_cmd);
1603 kau_write(rec, tok);
1604 }
1605 if (ARG_IS_VALID(kar, ARG_UID)) {
1606 tok = au_to_arg32(2, "who", ar->ar_arg_uid);
1607 kau_write(rec, tok);
1608 }
1609 if (ARG_IS_VALID(kar, ARG_VALUE32)) {
1610 tok = au_to_arg32(2, "priority", ar->ar_arg_value32);
1611 kau_write(rec, tok);
1612 }
1613 break;
1614
1615 case AUE_SETPRIVEXEC:
1616 if (ARG_IS_VALID(kar, ARG_VALUE32)) {
1617 tok = au_to_arg32(1, "flag", ar->ar_arg_value32);
1618 kau_write(rec, tok);
1619 }
1620 break;
1621
1622 /* AUE_SHMAT, AUE_SHMCTL, AUE_SHMDT and AUE_SHMGET are SysV IPC */
1623 case AUE_SHMAT:
1624 if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
1625 tok = au_to_arg32(1, "shmid", ar->ar_arg_svipc_id);
1626 kau_write(rec, tok);
1627 /* XXXAUDIT: Does having the ipc token make sense? */
1628 tok = au_to_ipc(AT_IPC_SHM, ar->ar_arg_svipc_id);
1629 kau_write(rec, tok);
1630 }
1631 if (ARG_IS_VALID(kar, ARG_SVIPC_ADDR)) {
1632 tok = au_to_arg64(2, "shmaddr", ar->ar_arg_svipc_addr);
1633 kau_write(rec, tok);
1634 }
1635 if (ARG_IS_VALID(kar, ARG_SVIPC_PERM)) {
1636 tok = au_to_ipc_perm(&ar->ar_arg_svipc_perm);
1637 kau_write(rec, tok);
1638 }
1639 break;
1640
1641 case AUE_SHMCTL:
1642 if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
1643 tok = au_to_arg32(1, "shmid", ar->ar_arg_svipc_id);
1644 kau_write(rec, tok);
1645 /* XXXAUDIT: Does having the ipc token make sense? */
1646 tok = au_to_ipc(AT_IPC_SHM, ar->ar_arg_svipc_id);
1647 kau_write(rec, tok);
1648 }
1649 switch (ar->ar_arg_svipc_cmd) {
1650 case IPC_STAT:
1651 ar->ar_event = AUE_SHMCTL_STAT;
1652 break;
1653 case IPC_RMID:
1654 ar->ar_event = AUE_SHMCTL_RMID;
1655 break;
1656 case IPC_SET:
1657 ar->ar_event = AUE_SHMCTL_SET;
1658 if (ARG_IS_VALID(kar, ARG_SVIPC_PERM)) {
1659 tok = au_to_ipc_perm(&ar->ar_arg_svipc_perm);
1660 kau_write(rec, tok);
1661 }
1662 break;
1663 default:
1664 break; /* We will audit a bad command */
1665 }
1666 break;
1667
1668 case AUE_SHMDT:
1669 if (ARG_IS_VALID(kar, ARG_SVIPC_ADDR)) {
1670 tok = au_to_arg64(1, "shmaddr",
1671 (int)(uintptr_t)ar->ar_arg_svipc_addr);
1672 kau_write(rec, tok);
1673 }
1674 break;
1675
1676 case AUE_SHMGET:
1677 /* This is unusual; the return value is in an argument token */
1678 if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
1679 tok = au_to_arg32(0, "shmid", ar->ar_arg_svipc_id);
1680 kau_write(rec, tok);
1681 tok = au_to_ipc(AT_IPC_SHM, ar->ar_arg_svipc_id);
1682 kau_write(rec, tok);
1683 }
1684 if (ARG_IS_VALID(kar, ARG_SVIPC_PERM)) {
1685 tok = au_to_ipc_perm(&ar->ar_arg_svipc_perm);
1686 kau_write(rec, tok);
1687 }
1688 break;
1689
1690 /* AUE_SHMOPEN, AUE_SHMUNLINK, AUE_SEMOPEN, AUE_SEMCLOSE
1691 * and AUE_SEMUNLINK are Posix IPC */
1692 case AUE_SHMOPEN:
1693 if (ARG_IS_VALID(kar, ARG_SVIPC_ADDR)) {
1694 tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
1695 kau_write(rec, tok);
1696 }
1697 if (ARG_IS_VALID(kar, ARG_MODE)) {
1698 tok = au_to_arg32(3, "mode", ar->ar_arg_mode);
1699 kau_write(rec, tok);
1700 }
1701 /* FALLTHROUGH */
1702
1703 case AUE_SHMUNLINK:
1704 if (ARG_IS_VALID(kar, ARG_TEXT)) {
1705 tok = au_to_text(ar->ar_arg_text);
1706 kau_write(rec, tok);
1707 }
1708 if (ARG_IS_VALID(kar, ARG_POSIX_IPC_PERM)) {
1709 struct ipc_perm perm;
1710
1711 perm.uid = ar->ar_arg_pipc_perm.pipc_uid;
1712 perm.gid = ar->ar_arg_pipc_perm.pipc_gid;
1713 perm.cuid = ar->ar_arg_pipc_perm.pipc_uid;
1714 perm.cgid = ar->ar_arg_pipc_perm.pipc_gid;
1715 perm.mode = ar->ar_arg_pipc_perm.pipc_mode;
1716 perm._seq = 0;
1717 perm._key = 0;
1718 tok = au_to_ipc_perm(&perm);
1719 kau_write(rec, tok);
1720 }
1721 break;
1722
1723 case AUE_SEMOPEN:
1724 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1725 tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
1726 kau_write(rec, tok);
1727 }
1728 if (ARG_IS_VALID(kar, ARG_MODE)) {
1729 tok = au_to_arg32(3, "mode", ar->ar_arg_mode);
1730 kau_write(rec, tok);
1731 }
1732 if (ARG_IS_VALID(kar, ARG_VALUE32)) {
1733 tok = au_to_arg32(4, "value", ar->ar_arg_value32);
1734 kau_write(rec, tok);
1735 }
1736 /* FALLTHROUGH */
1737
1738 case AUE_SEMUNLINK:
1739 if (ARG_IS_VALID(kar, ARG_TEXT)) {
1740 tok = au_to_text(ar->ar_arg_text);
1741 kau_write(rec, tok);
1742 }
1743 if (ARG_IS_VALID(kar, ARG_POSIX_IPC_PERM)) {
1744 struct ipc_perm perm;
1745
1746 perm.uid = ar->ar_arg_pipc_perm.pipc_uid;
1747 perm.gid = ar->ar_arg_pipc_perm.pipc_gid;
1748 perm.cuid = ar->ar_arg_pipc_perm.pipc_uid;
1749 perm.cgid = ar->ar_arg_pipc_perm.pipc_gid;
1750 perm.mode = ar->ar_arg_pipc_perm.pipc_mode;
1751 perm._seq = 0;
1752 perm._key = 0;
1753 tok = au_to_ipc_perm(&perm);
1754 kau_write(rec, tok);
1755 }
1756 break;
1757
1758 case AUE_SEMCLOSE:
1759 if (ARG_IS_VALID(kar, ARG_FD)) {
1760 tok = au_to_arg32(1, "sem", ar->ar_arg_fd);
1761 kau_write(rec, tok);
1762 }
1763 break;
1764
1765 case AUE_SYMLINK:
1766 if (ARG_IS_VALID(kar, ARG_TEXT)) {
1767 tok = au_to_text(ar->ar_arg_text);
1768 kau_write(rec, tok);
1769 }
1770 UPATH1_VNODE1_TOKENS;
1771 break;
1772
1773 case AUE_SYSCTL:
1774 case AUE_SYSCTL_NONADMIN:
1775 if (ARG_IS_VALID(kar, ARG_CTLNAME | ARG_LEN)) {
1776 for (ctr = 0; ctr < (int)ar->ar_arg_len; ctr++) {
1777 tok = au_to_arg32(1, "name",
1778 ar->ar_arg_ctlname[ctr]);
1779 kau_write(rec, tok);
1780 }
1781 }
1782 if (ARG_IS_VALID(kar, ARG_VALUE32)) {
1783 tok = au_to_arg32(5, "newval", ar->ar_arg_value32);
1784 kau_write(rec, tok);
1785 }
1786 if (ARG_IS_VALID(kar, ARG_TEXT)) {
1787 tok = au_to_text(ar->ar_arg_text);
1788 kau_write(rec, tok);
1789 }
1790 break;
1791
1792 case AUE_UMASK_EXTENDED:
1793 /* ACL data */
1794 if (ARG_IS_VALID(kar, ARG_OPAQUE)) {
1795 tok = au_to_opaque(ar->ar_arg_opaque,
1796 ar->ar_arg_opq_size);
1797 kau_write(rec, tok);
1798 }
1799 /* FALLTHROUGH */
1800
1801 case AUE_UMASK:
1802 if (ARG_IS_VALID(kar, ARG_MASK)) {
1803 tok = au_to_arg32(1, "new mask", ar->ar_arg_mask);
1804 kau_write(rec, tok);
1805 }
1806 tok = au_to_arg32(0, "prev mask", ar->ar_retval);
1807 kau_write(rec, tok);
1808 break;
1809
1810 case AUE_WAIT4:
1811 #if 0 /* XXXss - new */
1812 case AUE_WAITID:
1813 #endif
1814 if (ARG_IS_VALID(kar, ARG_PID)) {
1815 tok = au_to_arg32(0, "pid", ar->ar_arg_pid);
1816 kau_write(rec, tok);
1817 }
1818 break;
1819
1820 case AUE_FSGETPATH:
1821 if (ARG_IS_VALID(kar, ARG_VALUE32)) {
1822 tok = au_to_arg32(3, "volfsid", ar->ar_arg_value32);
1823 kau_write(rec, tok);
1824 }
1825 if (ARG_IS_VALID(kar, ARG_VALUE64)) {
1826 tok = au_to_arg64(4, "objid", ar->ar_arg_value64);
1827 kau_write(rec, tok);
1828 }
1829 if (ARG_IS_VALID(kar, ARG_TEXT)) {
1830 tok = au_to_text(ar->ar_arg_text);
1831 kau_write(rec, tok);
1832 }
1833 break;
1834
1835 case AUE_SESSION_START:
1836 case AUE_SESSION_UPDATE:
1837 case AUE_SESSION_END:
1838 case AUE_SESSION_CLOSE:
1839 if (ARG_IS_VALID(kar, ARG_VALUE64)) {
1840 tok = au_to_arg64(1, "sflags", ar->ar_arg_value64);
1841 kau_write(rec, tok);
1842 }
1843 if (ARG_IS_VALID(kar, ARG_AMASK)) {
1844 tok = au_to_arg32(2, "am_success",
1845 ar->ar_arg_amask.am_success);
1846 kau_write(rec, tok);
1847 tok = au_to_arg32(3, "am_failure",
1848 ar->ar_arg_amask.am_failure);
1849 kau_write(rec, tok);
1850 }
1851 break;
1852
1853 /************************
1854 * Mach system calls *
1855 ************************/
1856 case AUE_INITPROCESS:
1857 break;
1858
1859 case AUE_PIDFORTASK:
1860 if (ARG_IS_VALID(kar, ARG_MACHPORT1)) {
1861 tok = au_to_arg32(1, "port",
1862 (u_int32_t)ar->ar_arg_mach_port1);
1863 kau_write(rec, tok);
1864 }
1865 if (ARG_IS_VALID(kar, ARG_PID)) {
1866 tok = au_to_arg32(2, "pid", (u_int32_t)ar->ar_arg_pid);
1867 kau_write(rec, tok);
1868 }
1869 break;
1870
1871 case AUE_TASKFORPID:
1872 case AUE_TASKNAMEFORPID:
1873 if (ARG_IS_VALID(kar, ARG_MACHPORT1)) {
1874 tok = au_to_arg32(1, "target port",
1875 (u_int32_t)ar->ar_arg_mach_port1);
1876 kau_write(rec, tok);
1877 }
1878 if (ARG_IS_VALID(kar, ARG_MACHPORT2)) {
1879 tok = au_to_arg32(3, "task port",
1880 (u_int32_t)ar->ar_arg_mach_port2);
1881 kau_write(rec, tok);
1882 }
1883 PROCESS_PID_TOKENS(2);
1884 break;
1885
1886 case AUE_SWAPON:
1887 if (ARG_IS_VALID(kar, ARG_VALUE32)) {
1888 tok = au_to_arg32(4, "priority",
1889 (u_int32_t)ar->ar_arg_value32);
1890 kau_write(rec, tok);
1891 }
1892 UPATH1_VNODE1_TOKENS;
1893 break;
1894
1895 case AUE_SWAPOFF:
1896 UPATH1_VNODE1_TOKENS;
1897 break;
1898
1899 case AUE_MAPFD:
1900 if (ARG_IS_VALID(kar, ARG_ADDR64)) {
1901 tok = au_to_arg64(3, "va", ar->ar_arg_addr);
1902 kau_write(rec, tok);
1903 } else if (ARG_IS_VALID(kar, ARG_ADDR32)) {
1904 tok = au_to_arg32(3, "va",
1905 (u_int32_t)ar->ar_arg_addr);
1906 kau_write(rec, tok);
1907 }
1908 FD_VNODE1_TOKENS;
1909 break;
1910
1911 #if CONFIG_MACF
1912 case AUE_MAC_GET_FILE:
1913 case AUE_MAC_SET_FILE:
1914 case AUE_MAC_GET_LINK:
1915 case AUE_MAC_SET_LINK:
1916 case AUE_MAC_GET_MOUNT:
1917 UPATH1_VNODE1_TOKENS;
1918 PROCESS_MAC_TOKENS;
1919 break;
1920
1921 case AUE_MAC_GET_FD:
1922 case AUE_MAC_SET_FD:
1923 FD_VNODE1_TOKENS;
1924 PROCESS_MAC_TOKENS;
1925 break;
1926
1927 case AUE_MAC_SYSCALL:
1928 PROCESS_MAC_TOKENS;
1929 if (ARG_IS_VALID(kar, ARG_VALUE32)) {
1930 tok = au_to_arg32(3, "call", ar->ar_arg_value32);
1931 kau_write(rec, tok);
1932 }
1933 break;
1934
1935 case AUE_MAC_EXECVE:
1936 UPATH1_VNODE1_TOKENS;
1937 PROCESS_MAC_TOKENS;
1938 break;
1939
1940 case AUE_MAC_GET_PID:
1941 if (ARG_IS_VALID(kar, ARG_PID)) {
1942 tok = au_to_arg32(1, "pid", (u_int32_t)ar->ar_arg_pid);
1943 kau_write(rec, tok);
1944 }
1945 PROCESS_MAC_TOKENS;
1946 break;
1947
1948 case AUE_MAC_GET_LCID:
1949 if (ARG_IS_VALID(kar, ARG_VALUE32)) {
1950 tok = au_to_arg32(1, "lcid",
1951 (u_int32_t)ar->ar_arg_value32);
1952 kau_write(rec, tok);
1953 }
1954 PROCESS_MAC_TOKENS;
1955 break;
1956
1957 case AUE_MAC_GET_PROC:
1958 case AUE_MAC_SET_PROC:
1959 PROCESS_MAC_TOKENS;
1960 break;
1961 #endif
1962 case AUE_NULL:
1963 default:
1964 #if DIAGNOSTIC
1965 printf("BSM conversion requested for unknown event %d\n",
1966 ar->ar_event);
1967 #endif
1968
1969 /*
1970 * Write the subject token so it is properly freed here.
1971 */
1972 kau_write(rec, subj_tok);
1973 kau_free(rec);
1974 return (BSM_NOAUDIT);
1975 }
1976
1977 #if CONFIG_MACF
1978 if (NULL != ar->ar_mac_records) {
1979 /* Convert the audit data from the MAC policies */
1980 struct mac_audit_record *mar;
1981
1982 LIST_FOREACH(mar, ar->ar_mac_records, records) {
1983 switch (mar->type) {
1984 case MAC_AUDIT_DATA_TYPE:
1985 tok = au_to_data(AUP_BINARY, AUR_BYTE,
1986 mar->length,
1987 (const char *)mar->data);
1988 break;
1989 case MAC_AUDIT_TEXT_TYPE:
1990 tok = au_to_text((char*) mar->data);
1991 break;
1992 default:
1993 /*
1994 * XXX: we can either continue,
1995 * skipping this particular entry,
1996 * or we can pre-verify the list and
1997 * abort before writing any records
1998 */
1999 printf("kaudit_to_bsm(): "
2000 "BSM conversion requested for"
2001 "unknown mac_audit data type %d\n",
2002 mar->type);
2003 }
2004
2005 kau_write(rec, tok);
2006 }
2007 }
2008 #endif
2009
2010 kau_write(rec, subj_tok);
2011
2012 #if CONFIG_MACF
2013 if (ar->ar_cred_mac_labels != NULL &&
2014 strlen(ar->ar_cred_mac_labels) != 0) {
2015 tok = au_to_text(ar->ar_cred_mac_labels);
2016 kau_write(rec, tok);
2017 }
2018 #endif
2019
2020 tok = au_to_return32(au_errno_to_bsm(ar->ar_errno), ar->ar_retval);
2021 kau_write(rec, tok); /* Every record gets a return token */
2022
2023 kau_close(rec, &ar->ar_endtime, ar->ar_event);
2024
2025 *pau = rec;
2026 return (BSM_SUCCESS);
2027 }
2028
2029 /*
2030 * Verify that a record is a valid BSM record. This verification is simple
2031 * now, but may be expanded on sometime in the future. Return 1 if the
2032 * record is good, 0 otherwise.
2033 */
2034 int
2035 bsm_rec_verify(void *rec)
2036 {
2037 char c = *(char *)rec;
2038
2039 /*
2040 * Check the token ID of the first token; it has to be a header
2041 * token.
2042 *
2043 * XXXAUDIT There needs to be a token structure to map a token.
2044 * XXXAUDIT 'Shouldn't be simply looking at the first char.
2045 */
2046 if ((c != AUT_HEADER32) && (c != AUT_HEADER32_EX) &&
2047 (c != AUT_HEADER64) && (c != AUT_HEADER64_EX))
2048 return (0);
2049 return (1);
2050 }
2051 #endif /* CONFIG_AUDIT */
mirror of XNU