xnu-3789.51.2.tar.gz

[apple/xnu.git] / bsd / security / audit / audit_arg.c

diff --git a/bsd/security/audit/audit_arg.c b/bsd/security/audit/audit_arg.c
index 66792758fd1e0679c37ff236961315d64476e79b..71f3e0716a5e1d27cb6bb9f8a9532ca1c2f221fb 100644 (file)
--- a/bsd/security/audit/audit_arg.c
+++ b/bsd/security/audit/audit_arg.c
@@ -1,5 +1,5 @@
 /*-
 /*-

- * Copyright (c) 1999-2009 Apple Inc.
+ * Copyright (c) 1999-2016 Apple Inc.

  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without


@@ -75,8 +75,6 @@
 #include <kern/host.h>
 #include <kern/kalloc.h>
 #include <kern/zalloc.h>
 #include <kern/host.h>
 #include <kern/kalloc.h>
 #include <kern/zalloc.h>

-#include <kern/lock.h>
-#include <kern/wait_queue.h>

 #include <kern/sched_prim.h>
 
 #if CONFIG_MACF
 #include <kern/sched_prim.h>
 
 #if CONFIG_MACF


@@ -136,6 +134,14 @@ audit_arg_len(struct kaudit_record *ar, user_size_t len)
        ARG_SET_VALID(ar, ARG_LEN);
 }
 
        ARG_SET_VALID(ar, ARG_LEN);
 }
 

+void
+audit_arg_fd2(struct kaudit_record *ar, int fd)
+{
+
+       ar->k_ar.ar_arg_fd2 = fd;
+       ARG_SET_VALID(ar, ARG_FD2);
+}
+

 void
 audit_arg_fd(struct kaudit_record *ar, int fd)
 {
 void
 audit_arg_fd(struct kaudit_record *ar, int fd)
 {


@@ -308,10 +314,10 @@ audit_arg_process(struct kaudit_record *ar, proc_t p)
        ar->k_ar.ar_arg_asid = my_cred->cr_audit.as_aia_p->ai_asid;
        bcopy(&my_cred->cr_audit.as_aia_p->ai_termid,
            &ar->k_ar.ar_arg_termid_addr, sizeof(au_tid_addr_t));
        ar->k_ar.ar_arg_asid = my_cred->cr_audit.as_aia_p->ai_asid;
        bcopy(&my_cred->cr_audit.as_aia_p->ai_termid,
            &ar->k_ar.ar_arg_termid_addr, sizeof(au_tid_addr_t));

-       ar->k_ar.ar_arg_euid = my_cred->cr_uid;
-       ar->k_ar.ar_arg_egid = my_cred->cr_groups[0];
-       ar->k_ar.ar_arg_ruid = my_cred->cr_ruid;
-       ar->k_ar.ar_arg_rgid = my_cred->cr_rgid;
+       ar->k_ar.ar_arg_euid = kauth_cred_getuid(my_cred);
+       ar->k_ar.ar_arg_egid = kauth_cred_getgid(my_cred);
+       ar->k_ar.ar_arg_ruid = kauth_cred_getruid(my_cred);
+       ar->k_ar.ar_arg_rgid = kauth_cred_getrgid(my_cred);

        kauth_cred_unref(&my_cred);
        ar->k_ar.ar_arg_pid = p->p_pid;
        ARG_SET_VALID(ar, ARG_AUID | ARG_EUID | ARG_EGID | ARG_RUID |
        kauth_cred_unref(&my_cred);
        ar->k_ar.ar_arg_pid = p->p_pid;
        ARG_SET_VALID(ar, ARG_AUID | ARG_EUID | ARG_EGID | ARG_RUID |


@@ -348,7 +354,6 @@ void
 audit_arg_sockaddr(struct kaudit_record *ar, struct vnode *cwd_vp,
     struct sockaddr *sa)
 {
 audit_arg_sockaddr(struct kaudit_record *ar, struct vnode *cwd_vp,
     struct sockaddr *sa)
 {

-       int slen;

        struct sockaddr_un *sun;
        char path[SOCK_MAXADDRLEN - offsetof(struct sockaddr_un, sun_path) + 1];
 
        struct sockaddr_un *sun;
        char path[SOCK_MAXADDRLEN - offsetof(struct sockaddr_un, sun_path) + 1];
 


@@ -357,7 +362,11 @@ audit_arg_sockaddr(struct kaudit_record *ar, struct vnode *cwd_vp,
        if (cwd_vp == NULL || sa == NULL)
                return;
 
        if (cwd_vp == NULL || sa == NULL)
                return;
 

-       bcopy(sa, &ar->k_ar.ar_arg_sockaddr, sa->sa_len);
+       if (sa->sa_len > sizeof(ar->k_ar.ar_arg_sockaddr))
+               bcopy(sa, &ar->k_ar.ar_arg_sockaddr, sizeof(ar->k_ar.ar_arg_sockaddr));
+       else
+               bcopy(sa, &ar->k_ar.ar_arg_sockaddr, sa->sa_len);
+

        switch (sa->sa_family) {
        case AF_INET:
                ARG_SET_VALID(ar, ARG_SADDRINET);
        switch (sa->sa_family) {
        case AF_INET:
                ARG_SET_VALID(ar, ARG_SADDRINET);


@@ -369,20 +378,12 @@ audit_arg_sockaddr(struct kaudit_record *ar, struct vnode *cwd_vp,
 
        case AF_UNIX:
                sun = (struct sockaddr_un *)sa;
 
        case AF_UNIX:
                sun = (struct sockaddr_un *)sa;

-               slen = sun->sun_len - offsetof(struct sockaddr_un, sun_path);
-
-               if (slen >= 0) {
+               if (sun->sun_len > offsetof(struct sockaddr_un, sun_path)) {

                        /*
                         * Make sure the path is NULL-terminated
                         */
                        /*
                         * Make sure the path is NULL-terminated
                         */

-                       if (sun->sun_path[slen] != 0) {
-                               bcopy(sun->sun_path, path, slen);
-                               path[slen] = 0;
-                               audit_arg_upath(ar, cwd_vp, path, ARG_UPATH1);
-                       } else {
-                               audit_arg_upath(ar, cwd_vp, sun->sun_path, 
-                                       ARG_UPATH1);
-                       }
+                       strlcpy(path, sun->sun_path, sizeof(path));
+                       audit_arg_upath(ar, cwd_vp, path, ARG_UPATH1);

                }
                ARG_SET_VALID(ar, ARG_SADDRUNIX);
                break;
                }
                ARG_SET_VALID(ar, ARG_SADDRUNIX);
                break;


@@ -594,7 +595,7 @@ audit_arg_file(struct kaudit_record *ar, __unused proc_t p,
        struct sockaddr_in *sin;
        struct sockaddr_in6 *sin6;
 
        struct sockaddr_in *sin;
        struct sockaddr_in6 *sin6;
 

-       switch (fp->f_fglob->fg_type) {
+       switch (FILEGLOB_DTYPE(fp->f_fglob)) {

        case DTYPE_VNODE:
        /* case DTYPE_FIFO: */
                audit_arg_vnpath_withref(ar,
        case DTYPE_VNODE:
        /* case DTYPE_FIFO: */
                audit_arg_vnpath_withref(ar,


@@ -603,15 +604,13 @@ audit_arg_file(struct kaudit_record *ar, __unused proc_t p,
 
        case DTYPE_SOCKET:
                so = (struct socket *)fp->f_fglob->fg_data;
 
        case DTYPE_SOCKET:
                so = (struct socket *)fp->f_fglob->fg_data;

-               if (INP_CHECK_SOCKAF(so, PF_INET)) {
+               if (SOCK_CHECK_DOM(so, PF_INET)) {

                        if (so->so_pcb == NULL)
                                break;
                        ar->k_ar.ar_arg_sockinfo.sai_type =
                            so->so_type;
                        if (so->so_pcb == NULL)
                                break;
                        ar->k_ar.ar_arg_sockinfo.sai_type =
                            so->so_type;

-                       ar->k_ar.ar_arg_sockinfo.sai_domain =
-                           INP_SOCKAF(so);
-                       ar->k_ar.ar_arg_sockinfo.sai_protocol =
-                           so->so_proto->pr_protocol;
+                       ar->k_ar.ar_arg_sockinfo.sai_domain = SOCK_DOM(so);
+                       ar->k_ar.ar_arg_sockinfo.sai_protocol = SOCK_PROTO(so);

                        pcb = (struct inpcb *)so->so_pcb;
                        sin = (struct sockaddr_in *)
                            &ar->k_ar.ar_arg_sockinfo.sai_faddr;
                        pcb = (struct inpcb *)so->so_pcb;
                        sin = (struct sockaddr_in *)
                            &ar->k_ar.ar_arg_sockinfo.sai_faddr;


@@ -623,15 +622,13 @@ audit_arg_file(struct kaudit_record *ar, __unused proc_t p,
                        sin->sin_port = pcb->inp_lport;
                        ARG_SET_VALID(ar, ARG_SOCKINFO);
                }
                        sin->sin_port = pcb->inp_lport;
                        ARG_SET_VALID(ar, ARG_SOCKINFO);
                }

-               if (INP_CHECK_SOCKAF(so, PF_INET6)) {
+               if (SOCK_CHECK_DOM(so, PF_INET6)) {

                        if (so->so_pcb == NULL)
                                break;
                        ar->k_ar.ar_arg_sockinfo.sai_type =
                            so->so_type;
                        if (so->so_pcb == NULL)
                                break;
                        ar->k_ar.ar_arg_sockinfo.sai_type =
                            so->so_type;

-                       ar->k_ar.ar_arg_sockinfo.sai_domain =
-                           INP_SOCKAF(so);
-                       ar->k_ar.ar_arg_sockinfo.sai_protocol =
-                           so->so_proto->pr_protocol;
+                       ar->k_ar.ar_arg_sockinfo.sai_domain = SOCK_DOM(so);
+                       ar->k_ar.ar_arg_sockinfo.sai_protocol = SOCK_PROTO(so);

                        pcb = (struct inpcb *)so->so_pcb;
                        sin6 = (struct sockaddr_in6 *)
                            &ar->k_ar.ar_arg_sockinfo.sai_faddr;
                        pcb = (struct inpcb *)so->so_pcb;
                        sin6 = (struct sockaddr_in6 *)
                            &ar->k_ar.ar_arg_sockinfo.sai_faddr;