-extern struct au_qctrl audit_qctrl;
-extern struct audit_fstat audit_fstat;
-extern struct au_mask audit_nae_mask;
-extern int audit_panic_on_write_fail;
-extern int audit_fail_stop;
-extern int audit_argv;
-extern int audit_arge;
+extern struct au_qctrl audit_qctrl;
+extern struct audit_fstat audit_fstat;
+extern struct au_mask audit_nae_mask;
+extern int audit_panic_on_write_fail;
+extern int audit_fail_stop;
+extern int audit_argv;
+extern int audit_arge;
+extern au_ctlmode_t audit_ctl_mode;
+extern au_expire_after_t audit_expire_after;
* This will pessimisticly set the audit syscalls flag if the audit kevent
* mask has not been created yet. User code should build the event/class
* mapping table before setting preselection masks to avoid this.
*/
* This will pessimisticly set the audit syscalls flag if the audit kevent
* mask has not been created yet. User code should build the event/class
* mapping table before setting preselection masks to avoid this.
*/
-#define AUDIT_CHECK_IF_KEVENTS_MASK(m) do { \
- if ((m).am_success || (m).am_failure) \
- if (!audit_kevent_mask || \
- (audit_kevent_mask & (m).am_success) || \
- (audit_kevent_mask & (m).am_failure)) \
- audit_syscalls = 1; \
+#define AUDIT_CHECK_IF_KEVENTS_MASK(m) do { \
+ if ((m).am_success || (m).am_failure) \
+ if (!audit_kevent_mask || \
+ (audit_kevent_mask & (m).am_success) || \
+ (audit_kevent_mask & (m).am_failure)) \
+ audit_syscalls = 1; \
/*
* Defines for the kernel audit record k_ar_commit field. Flags are set to
* indicate what sort of record it is, and which preselection mechanism
* selected it.
*/
/*
* Defines for the kernel audit record k_ar_commit field. Flags are set to
* indicate what sort of record it is, and which preselection mechanism
* selected it.
*/
- char *au_path;
- int au_cond;
- int au_policy;
- int64_t au_cond64;
- int64_t au_policy64;
- int au_trigger;
- au_evclass_map_t au_evclass;
- au_mask_t au_mask;
- au_asflgs_t au_flags;
- auditinfo_t au_auinfo;
- auditpinfo_t au_aupinfo;
- auditpinfo_addr_t au_aupinfo_addr;
- au_qctrl_t au_qctrl;
- au_qctrl64_t au_qctrl64;
- au_stat_t au_stat;
- au_fstat_t au_fstat;
- auditinfo_addr_t au_kau_info;
+ char *au_path;
+ int au_cond;
+ int au_policy;
+ int64_t au_cond64;
+ int64_t au_policy64;
+ int au_trigger;
+ au_evclass_map_t au_evclass;
+ au_mask_t au_mask;
+ au_asflgs_t au_flags;
+ auditinfo_t au_auinfo;
+ auditpinfo_t au_aupinfo;
+ auditpinfo_addr_t au_aupinfo_addr;
+ au_qctrl_t au_qctrl;
+ au_qctrl64_t au_qctrl64;
+ au_stat_t au_stat;
+ au_fstat_t au_fstat;
+ auditinfo_addr_t au_kau_info;
+ au_ctlmode_t au_ctl_mode;
+ au_expire_after_t au_expire_after;
- u_int32_t ar_magic;
- int ar_event;
- int ar_retval; /* value returned to the process */
- int ar_errno; /* return status of system call */
- struct timespec ar_starttime;
- struct timespec ar_endtime;
- u_int64_t ar_valid_arg; /* Bitmask of valid arguments */
+ u_int32_t ar_magic;
+ int ar_event;
+ int ar_retval; /* value returned to the process */
+ int ar_errno; /* return status of system call */
+ struct timespec ar_starttime;
+ struct timespec ar_endtime;
+ u_int64_t ar_valid_arg; /* Bitmask of valid arguments */
- struct xucred ar_subj_cred;
- uid_t ar_subj_ruid;
- gid_t ar_subj_rgid;
- gid_t ar_subj_egid;
- uid_t ar_subj_auid; /* Audit user ID */
- pid_t ar_subj_asid; /* Audit session ID */
- pid_t ar_subj_pid;
- struct au_tid ar_subj_term;
- struct au_tid_addr ar_subj_term_addr;
- struct au_mask ar_subj_amask;
+ struct xucred ar_subj_cred;
+ uid_t ar_subj_ruid;
+ gid_t ar_subj_rgid;
+ gid_t ar_subj_egid;
+ uid_t ar_subj_auid; /* Audit user ID */
+ pid_t ar_subj_asid; /* Audit session ID */
+ pid_t ar_subj_pid;
+ struct au_tid ar_subj_term;
+ struct au_tid_addr ar_subj_term_addr;
+ struct au_mask ar_subj_amask;
- uid_t ar_arg_euid;
- uid_t ar_arg_ruid;
- uid_t ar_arg_suid;
- gid_t ar_arg_egid;
- gid_t ar_arg_rgid;
- gid_t ar_arg_sgid;
- pid_t ar_arg_pid;
- pid_t ar_arg_asid;
- struct au_tid ar_arg_termid;
- struct au_tid_addr ar_arg_termid_addr;
- uid_t ar_arg_uid;
- uid_t ar_arg_auid;
- gid_t ar_arg_gid;
- struct groupset ar_arg_groups;
- int ar_arg_fd;
- int ar_arg_fflags;
- mode_t ar_arg_mode;
- uint32_t ar_arg_value32;
- uint64_t ar_arg_value64;
- user_addr_t ar_arg_addr;
- user_size_t ar_arg_len;
- int ar_arg_mask;
- u_int ar_arg_signum;
- char ar_arg_login[MAXLOGNAME];
- int ar_arg_ctlname[CTL_MAXNAME];
- struct socket_au_info ar_arg_sockinfo;
- char *ar_arg_upath1;
- char *ar_arg_upath2;
- char *ar_arg_kpath1; /* darwin-only */
- char *ar_arg_kpath2; /* darwin-only */
+ uid_t ar_arg_euid;
+ uid_t ar_arg_ruid;
+ uid_t ar_arg_suid;
+ gid_t ar_arg_egid;
+ gid_t ar_arg_rgid;
+ gid_t ar_arg_sgid;
+ pid_t ar_arg_pid;
+ pid_t ar_arg_asid;
+ struct au_tid ar_arg_termid;
+ struct au_tid_addr ar_arg_termid_addr;
+ uid_t ar_arg_uid;
+ uid_t ar_arg_auid;
+ gid_t ar_arg_gid;
+ struct groupset ar_arg_groups;
+ int ar_arg_fd;
+ int ar_arg_fflags;
+ mode_t ar_arg_mode;
+ uint32_t ar_arg_value32;
+ uint64_t ar_arg_value64;
+ user_addr_t ar_arg_addr;
+ user_size_t ar_arg_len;
+ int ar_arg_mask;
+ u_int ar_arg_signum;
+ char ar_arg_login[MAXLOGNAME];
+ int ar_arg_ctlname[CTL_MAXNAME];
+ struct socket_au_info ar_arg_sockinfo;
+ char *ar_arg_upath1;
+ char *ar_arg_upath2;
+ char *ar_arg_kpath1; /* darwin-only */
+ char *ar_arg_kpath2; /* darwin-only */
- char *ar_vnode1_mac_labels;
- char *ar_vnode2_mac_labels;
- char *ar_cred_mac_labels;
- char *ar_arg_mac_string;
+ char *ar_vnode1_mac_labels;
+ char *ar_vnode2_mac_labels;
+ char *ar_cred_mac_labels;
+ char *ar_arg_mac_string;
- char *ar_arg_text;
- void *ar_arg_opaque; /* darwin-only */
- void *ar_arg_data; /* darwin-only */
- u_int16_t ar_arg_opq_size; /* darwin-only */
- u_char ar_arg_data_type; /* darwin-only */
- u_char ar_arg_data_count; /* darwin-only */
- struct au_mask ar_arg_amask;
- struct vnode_au_info ar_arg_vnode1;
- struct vnode_au_info ar_arg_vnode2;
- int ar_arg_cmd;
- int ar_arg_svipc_cmd;
- struct ipc_perm ar_arg_svipc_perm;
- int ar_arg_svipc_id;
- user_addr_t ar_arg_svipc_addr;
- struct posix_ipc_perm ar_arg_pipc_perm;
- mach_port_name_t ar_arg_mach_port1; /* darwin-only */
- mach_port_name_t ar_arg_mach_port2; /* darwin-only */
- union auditon_udata ar_arg_auditon;
- char *ar_arg_argv;
- int ar_arg_argc;
- char *ar_arg_envv;
- int ar_arg_envc;
- int ar_arg_exitstatus;
- int ar_arg_exitretval;
+ char *ar_arg_text;
+ void *ar_arg_opaque; /* darwin-only */
+ void *ar_arg_data; /* darwin-only */
+ u_int16_t ar_arg_opq_size; /* darwin-only */
+ u_char ar_arg_data_type; /* darwin-only */
+ u_char ar_arg_data_count; /* darwin-only */
+ struct au_mask ar_arg_amask;
+ struct vnode_au_info ar_arg_vnode1;
+ struct vnode_au_info ar_arg_vnode2;
+ int ar_arg_cmd;
+ int ar_arg_svipc_cmd;
+ struct ipc_perm ar_arg_svipc_perm;
+ int ar_arg_svipc_id;
+ user_addr_t ar_arg_svipc_addr;
+ struct posix_ipc_perm ar_arg_pipc_perm;
+ mach_port_name_t ar_arg_mach_port1; /* darwin-only */
+ mach_port_name_t ar_arg_mach_port2; /* darwin-only */
+ union auditon_udata ar_arg_auditon;
+ char *ar_arg_argv;
+ int ar_arg_argc;
+ char *ar_arg_envv;
+ int ar_arg_envc;
+ int ar_arg_exitstatus;
+ int ar_arg_exitretval;
#if CONFIG_MACF
/*
* MAC security related fields added by MAC policies ar_forced_by_mac
* is 1 if mac_audit_check_preselect() forced this call to be audited,
* 0 otherwise.
#if CONFIG_MACF
/*
* MAC security related fields added by MAC policies ar_forced_by_mac
* is 1 if mac_audit_check_preselect() forced this call to be audited,
* 0 otherwise.
-#define ARG_IS_VALID(kar, arg) ((kar)->k_ar.ar_valid_arg & (arg))
-#define ARG_SET_VALID(kar, arg) do { \
- (kar)->k_ar.ar_valid_arg |= (arg); \
+#define ARG_IS_VALID(kar, arg) ((kar)->k_ar.ar_valid_arg & (arg))
+#define ARG_SET_VALID(kar, arg) do { \
+ (kar)->k_ar.ar_valid_arg |= (arg); \
- struct audit_record k_ar;
- u_int32_t k_ar_commit;
- void *k_udata; /* User data. */
- u_int k_ulen; /* User data length. */
- struct uthread *k_uthread; /* Audited thread. */
- TAILQ_ENTRY(kaudit_record) k_q;
+ struct audit_record k_ar;
+ u_int32_t k_ar_commit;
+ void *k_udata; /* User data. */
+ u_int k_ulen; /* User data length. */
+ struct uthread *k_uthread; /* Audited thread. */
+ TAILQ_ENTRY(kaudit_record) k_q;
-void audit_abort(struct kaudit_record *ar);
-void audit_commit(struct kaudit_record *ar, int error,
- int retval);
-struct kaudit_record *audit_new(int event, proc_t p, struct uthread *td);
+void audit_abort(struct kaudit_record *ar);
+void audit_commit(struct kaudit_record *ar, int error,
+ int retval);
+struct kaudit_record *audit_new(int event, proc_t p, struct uthread *td);
-int kaudit_to_bsm(struct kaudit_record *kar, struct au_record **pau);
-int bsm_rec_verify(void *rec);
+int kaudit_to_bsm(struct kaudit_record *kar, struct au_record **pau);
+int bsm_rec_verify(void *rec, int length, boolean_t kern_events_allowed);
-#define AU_PRS_SUCCESS 1
-#define AU_PRS_FAILURE 2
-#define AU_PRS_BOTH (AU_PRS_SUCCESS|AU_PRS_FAILURE)
+#define AU_PRS_SUCCESS 1
+#define AU_PRS_FAILURE 2
+#define AU_PRS_BOTH (AU_PRS_SUCCESS|AU_PRS_FAILURE)
/*
* Data structures relating to the kernel audit queue. Ideally, these might
* be abstracted so that only accessor methods are exposed.
*/
/*
* Data structures relating to the kernel audit queue. Ideally, these might
* be abstracted so that only accessor methods are exposed.
*/
-extern struct mtx audit_mtx;
-extern struct cv audit_watermark_cv;
-extern struct cv audit_worker_cv;
-extern struct cv audit_drain_cv;
-extern struct kaudit_queue audit_q;
-extern int audit_q_len;
-extern int audit_pre_q_len;
-extern int audit_in_failure;
+extern struct mtx audit_mtx;
+extern struct cv audit_watermark_cv;
+extern struct cv audit_worker_cv;
+extern struct cv audit_drain_cv;
+extern struct kaudit_queue audit_q;
+extern int audit_q_len;
+extern int audit_pre_q_len;
+extern int audit_in_failure;
-int au_preselect(au_event_t event, au_class_t class,
- au_mask_t *mask_p, int sorf);
-void au_evclassmap_init(void);
-void au_evclassmap_insert(au_event_t event, au_class_t class);
-au_class_t au_event_class(au_event_t event);
-au_event_t audit_ctlname_to_sysctlevent(int name[], uint64_t valid_arg);
-au_event_t audit_flags_and_error_to_openevent(int oflags, int error);
-au_event_t audit_flags_and_error_to_openextendedevent(int oflags,
- int error);
-au_event_t audit_flags_and_error_to_openatevent(int oflags,
- int error);
-au_event_t audit_flags_and_error_to_openbyidevent(int oflags,
- int error);
-au_event_t audit_msgctl_to_event(int cmd);
-au_event_t audit_semctl_to_event(int cmr);
-int audit_canon_path(struct vnode *cwd_vp, char *path,
- char *cpath);
-au_event_t auditon_command_event(int cmd);
-au_event_t audit_fcntl_command_event(int cmd, int oflags, int error);
+int au_preselect(au_event_t event, au_class_t class,
+ au_mask_t *mask_p, int sorf);
+void au_evclassmap_init(void);
+void au_evclassmap_insert(au_event_t event, au_class_t class);
+au_class_t au_event_class(au_event_t event);
+au_event_t audit_ctlname_to_sysctlevent(int name[], uint64_t valid_arg);
+au_event_t audit_flags_and_error_to_openevent(int oflags, int error);
+au_event_t audit_flags_and_error_to_openextendedevent(int oflags,
+ int error);
+au_event_t audit_flags_and_error_to_openatevent(int oflags,
+ int error);
+au_event_t audit_flags_and_error_to_openbyidevent(int oflags,
+ int error);
+au_event_t audit_msgctl_to_event(int cmd);
+au_event_t audit_semctl_to_event(int cmr);
+int audit_canon_path(struct vnode *cwd_vp, char *path,
+ char *cpath);
+au_event_t auditon_command_event(int cmd);
+au_event_t audit_fcntl_command_event(int cmd, int oflags, int error);
-struct kaudit_record *currecord(void);
-void audit_free(struct kaudit_record *ar);
-void audit_rotate_vnode(struct ucred *cred,
- struct vnode *vp);
-void audit_worker_init(void);
+struct kaudit_record *currecord(void);
+void audit_free(struct kaudit_record *ar);
+void audit_rotate_vnode(struct ucred *cred,
+ struct vnode *vp);
+void audit_worker_init(void);
+void audit_identity_info_construct(
+ struct au_identity_info *id_info);
+void audit_identity_info_destruct(
+ struct au_identity_info *id_info);
-int audit_pipe_init(void);
-int audit_pipe_shutdown(void);
-int audit_pipe_preselect(au_id_t auid, au_event_t event,
- au_class_t class, int sorf, int trail_select);
-void audit_pipe_submit(au_id_t auid, au_event_t event, au_class_t class,
- int sorf, int trail_select, void *record, u_int record_len);
-void audit_pipe_submit_user(void *record, u_int record_len);
+int audit_pipe_init(void);
+int audit_pipe_shutdown(void);
+int audit_pipe_preselect(au_id_t auid, au_event_t event,
+ au_class_t class, int sorf, int trail_select);
+void audit_pipe_submit(au_id_t auid, au_event_t event, au_class_t class,
+ int sorf, int trail_select, void *record, u_int record_len);
+void audit_pipe_submit_user(void *record, u_int record_len);
-void audit_mac_init(void);
-int audit_mac_new(proc_t p, struct kaudit_record *ar);
-void audit_mac_free(struct kaudit_record *ar);
-int audit_mac_syscall_enter(unsigned short code, proc_t p,
- struct uthread *uthread, kauth_cred_t my_cred, au_event_t event);
-int audit_mac_syscall_exit(unsigned short code, struct uthread *uthread,
- int error, int retval);
+void audit_mac_init(void);
+int audit_mac_new(proc_t p, struct kaudit_record *ar);
+void audit_mac_free(struct kaudit_record *ar);
+int audit_mac_syscall_enter(unsigned short code, proc_t p,
+ struct uthread *uthread, kauth_cred_t my_cred, au_event_t event);
+int audit_mac_syscall_exit(unsigned short code, struct uthread *uthread,
+ int error, int retval);
-#define ASSIGNED_ASID_MIN (PID_MAX + 1)
-#define ASSIGNED_ASID_MAX (0xFFFFFFFF - 1)
+#define ASSIGNED_ASID_MIN (PID_MAX + 1)
+#define ASSIGNED_ASID_MAX (0xFFFFFFFF - 1)
+
+/*
+ * Entitlement required to control various audit subsystem settings
+ */
+#define AU_CLASS_RESERVED_ENTITLEMENT "com.apple.private.dz.audit"
+
+/*
+ * Entitlement required to control auditctl sys call
+ */
+#define AU_AUDITCTL_RESERVED_ENTITLEMENT "com.apple.private.protected-audit-control"
+
+/*
+ * Entitlement required to control auditctl sys call
+ */
+#define AU_AUDIT_USER_ENTITLEMENT "com.apple.private.audit.user"
+
+/*
+ * Max sizes used by the kernel for signing id and team id values of the
+ * identity tokens. These lengths include space for the null terminator.
+ */
+#define MAX_AU_IDENTITY_SIGNING_ID_LENGTH 129
+#define MAX_AU_IDENTITY_TEAM_ID_LENGTH 17
+
+struct __attribute__((__packed__)) hdr_tok_partial {
+ u_char type;
+ uint32_t len;
+ u_char ver;
+ uint16_t e_type;
+};
+static_assert(sizeof(struct hdr_tok_partial) == 8);
+
+struct __attribute__((__packed__)) trl_tok_partial {
+ u_char type;
+ uint16_t magic;
+ uint32_t len;
+};
+static_assert(sizeof(struct trl_tok_partial) == 7);
projects / apple / xnu.git / blobdiff