xnu-4903.241.1.tar.gz

[apple/xnu.git] / bsd / security / audit / audit_private.h

diff --git a/bsd/security/audit/audit_private.h b/bsd/security/audit/audit_private.h
index 803a2b93659e7a2c4eabc4340c709337d397423b..8b58b79c1ad01cfa0527b8824d83948c3ea280e2 100644 (file)
--- a/bsd/security/audit/audit_private.h
+++ b/bsd/security/audit/audit_private.h
@@ -1,5 +1,5 @@
 /*-
- * Copyright (c) 1999-2009 Apple Inc.
+ * Copyright (c) 1999-2016 Apple Inc.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -71,6 +71,8 @@ extern int                    audit_panic_on_write_fail;
 extern int                     audit_fail_stop;
 extern int                     audit_argv;
 extern int                     audit_arge;
+extern au_ctlmode_t    audit_ctl_mode;
+extern au_expire_after_t       audit_expire_after;
 
 /*
  * Kernel mask that is used to check to see if system calls need to be audited.
@@ -113,6 +115,8 @@ extern au_class_t           audit_kevent_mask;
 #define        AR_PRESELECT_USER_TRAIL 0x00004000U
 #define        AR_PRESELECT_USER_PIPE  0x00008000U
 
+#define        AR_PRESELECT_FILTER     0x00010000U
+
 #define        AR_DRAIN_QUEUE          0x80000000U
 
 /*
@@ -171,6 +175,7 @@ union auditon_udata {
        int                     au_trigger;
        au_evclass_map_t        au_evclass;
        au_mask_t               au_mask;
+       au_asflgs_t             au_flags;
        auditinfo_t             au_auinfo;
        auditpinfo_t            au_aupinfo;
        auditpinfo_addr_t       au_aupinfo_addr;
@@ -179,6 +184,8 @@ union auditon_udata {
        au_stat_t               au_stat;
        au_fstat_t              au_fstat;
        auditinfo_addr_t        au_kau_info;
+       au_ctlmode_t    au_ctl_mode;
+       au_expire_after_t       au_expire_after;
 };
 
 struct posix_ipc_perm {
@@ -187,6 +194,16 @@ struct posix_ipc_perm {
        mode_t  pipc_mode;
 };
 
+struct au_identity_info {
+       u_int32_t       signer_type;
+       char            *signing_id;
+       u_char          signing_id_trunc;
+       char            *team_id;
+       u_char          team_id_trunc;
+       u_int8_t        *cdhash;
+       u_int16_t       cdhash_len;
+};
+
 struct audit_record {
        /* Audit record header. */
        u_int32_t               ar_magic;
@@ -271,6 +288,7 @@ struct audit_record {
        int                     ar_arg_exitstatus;
        int                     ar_arg_exitretval;
        struct sockaddr_storage ar_arg_sockaddr;
+       int                     ar_arg_fd2;
 
 #if CONFIG_MACF
        /*
@@ -281,6 +299,7 @@ struct audit_record {
        LIST_HEAD(mac_audit_record_list_t, mac_audit_record)    *ar_mac_records;
        int                     ar_forced_by_mac;
 #endif
+       struct au_identity_info ar_arg_identity;
 };
 
 /*
@@ -329,7 +348,7 @@ struct kaudit_record        *audit_new(int event, proc_t p, struct uthread *td);
  */
 struct au_record;
 int     kaudit_to_bsm(struct kaudit_record *kar, struct au_record **pau);
-int     bsm_rec_verify(void *rec);
+int     bsm_rec_verify(void *rec, int length);
 
 /*
  * Kernel versions of the libbsm audit record functions.
@@ -386,6 +405,10 @@ au_event_t  audit_ctlname_to_sysctlevent(int name[], uint64_t valid_arg);
 au_event_t      audit_flags_and_error_to_openevent(int oflags, int error);
 au_event_t      audit_flags_and_error_to_openextendedevent(int oflags,
                    int error);
+au_event_t      audit_flags_and_error_to_openatevent(int oflags,
+                   int error);
+au_event_t      audit_flags_and_error_to_openbyidevent(int oflags,
+                   int error);
 au_event_t      audit_msgctl_to_event(int cmd);
 au_event_t      audit_semctl_to_event(int cmr);
 int             audit_canon_path(struct vnode *cwd_vp, char *path,
@@ -413,6 +436,10 @@ void                        audit_free(struct kaudit_record *ar);
 void                    audit_rotate_vnode(struct ucred *cred,
                            struct vnode *vp);
 void                    audit_worker_init(void);
+void                    audit_identity_info_construct(
+                           struct au_identity_info *id_info);
+void                    audit_identity_info_destruct(
+                           struct au_identity_info *id_info);
 
 /*
  * Audit pipe functions.
@@ -440,7 +467,7 @@ int audit_mac_syscall_exit(unsigned short code, struct uthread *uthread,
  * Audit Session.
  */
 void   audit_session_init(void);
-int    audit_session_setaia(proc_t p, auditinfo_addr_t *aia_p, int newprocess);
+int    audit_session_setaia(proc_t p, auditinfo_addr_t *aia_p);
 auditinfo_addr_t *audit_session_update(auditinfo_addr_t *new_aia);
 int    audit_session_lookup(au_asid_t asid, auditinfo_addr_t *ret_aia);
 
@@ -451,6 +478,36 @@ int        audit_session_lookup(au_asid_t asid, auditinfo_addr_t *ret_aia);
 #define        ASSIGNED_ASID_MIN       (PID_MAX + 1)
 #define        ASSIGNED_ASID_MAX       (0xFFFFFFFF - 1)
 
+/*
+ * Entitlement required to control various audit subsystem settings
+ */
+#define AU_CLASS_RESERVED_ENTITLEMENT "com.apple.private.dz.audit"
+
+/*
+ * Entitlement required to control auditctl sys call
+ */
+#define AU_AUDITCTL_RESERVED_ENTITLEMENT "com.apple.private.protected-audit-control"
+
+/*
+ * Max sizes used by the kernel for signing id and team id values of the
+ * identity tokens. These lengths include space for the null terminator.
+ */
+#define MAX_AU_IDENTITY_SIGNING_ID_LENGTH 129
+#define MAX_AU_IDENTITY_TEAM_ID_LENGTH 17
+
+struct __attribute__((__packed__)) hdr_tok_partial {
+       u_char type;
+       uint32_t len;
+};
+static_assert(sizeof(struct hdr_tok_partial) == 5);
+
+struct __attribute__((__packed__)) trl_tok_partial {
+       u_char type;
+       uint16_t magic;
+       uint32_t len;
+};
+static_assert(sizeof(struct trl_tok_partial) == 7);
+
 #endif /* defined(KERNEL) || defined(_KERNEL) */
 
 #endif /* ! _SECURITY_AUDIT_PRIVATE_H_ */