X-Git-Url: https://git.saurik.com/apple/xnu.git/blobdiff_plain/b0d623f7f2ae71ed96e60569f61f9a9a27016e80..3903760236c30e3b5ace7a4eefac3a269d68957c:/bsd/security/audit/audit_session.c diff --git a/bsd/security/audit/audit_session.c b/bsd/security/audit/audit_session.c index 8e05f9dcd..639920f5e 100644 --- a/bsd/security/audit/audit_session.c +++ b/bsd/security/audit/audit_session.c @@ -27,46 +27,40 @@ * POSSIBILITY OF SUCH DAMAGE. */ +#include + #include -#include +#include #include +#include +#include #include +#include #include #include #include #include #include +#include + +#include #include #include +#include +#include + #include #include +#include #include #include +#include #include -kern_return_t ipc_object_copyin(ipc_space_t, mach_port_name_t, - mach_msg_type_name_t, ipc_port_t *); -void ipc_port_release_send(ipc_port_t); - -/* - * The default auditinfo_addr entry for ucred. - */ -struct auditinfo_addr audit_default_aia = { - .ai_auid = AU_DEFAUDITID, - .ai_asid = AU_DEFAUDITSID, - .ai_termid = { .at_type = AU_IPv4, }, -}; - -#if CONFIG_AUDIT - -/* - * Currently the hash table is a fixed size. - */ -#define HASH_TABLE_SIZE 97 -#define HASH_ASID(asid) (audit_session_hash(asid) % HASH_TABLE_SIZE) +#include /* * Audit Session Entry. This is treated as an object with public and private @@ -84,119 +78,397 @@ struct au_sentry { long se_refcnt; /* Reference count. */ long se_procnt; /* Processes in session. */ ipc_port_t se_port; /* Session port. */ - struct klist se_klist; /* Knotes for session */ - struct mtx se_klist_mtx; /* se_klist mutex */ LIST_ENTRY(au_sentry) se_link; /* Hash bucket link list (1) */ }; typedef struct au_sentry au_sentry_t; #define AU_SENTRY_PTR(aia_p) ((au_sentry_t *)(aia_p)) +/* + * The default au_sentry/auditinfo_addr entry for ucred. + */ + +static au_sentry_t audit_default_se = { + .se_auinfo = { + .ai_auid = AU_DEFAUDITID, + .ai_asid = AU_DEFAUDITSID, + .ai_termid = { .at_type = AU_IPv4, }, + }, + .se_refcnt = 1, + .se_procnt = 1, +}; + +struct auditinfo_addr *audit_default_aia_p = &audit_default_se.se_auinfo; + +kern_return_t ipc_object_copyin(ipc_space_t, mach_port_name_t, + mach_msg_type_name_t, ipc_port_t *); +void ipc_port_release_send(ipc_port_t); + +#if CONFIG_AUDIT + + +/* + * Currently the hash table is a fixed size. + */ +#define HASH_TABLE_SIZE 97 +#define HASH_ASID(asid) (audit_session_hash(asid) % HASH_TABLE_SIZE) + static struct rwlock se_entry_lck; /* (1) lock for se_link above */ LIST_HEAD(au_sentry_head, au_sentry); static struct au_sentry_head *au_sentry_bucket = NULL; +#define AU_HISTORY_LOGGING 0 +#if AU_HISTORY_LOGGING +typedef enum au_history_event { + AU_HISTORY_EVENT_UNKNOWN = 0, + AU_HISTORY_EVENT_REF = 1, + AU_HISTORY_EVENT_UNREF = 2, + AU_HISTORY_EVENT_BIRTH = 3, + AU_HISTORY_EVENT_DEATH = 4, + AU_HISTORY_EVENT_FIND = 5 +} au_history_event_t; + +#define AU_HISTORY_MAX_STACK_DEPTH 8 + +struct au_history { + struct au_sentry *ptr; + struct au_sentry se; + void *stack[AU_HISTORY_MAX_STACK_DEPTH]; + unsigned int stack_depth; + au_history_event_t event; +}; + +static struct au_history *au_history; +static size_t au_history_size = 65536; +static unsigned int au_history_index; + +static inline unsigned int +au_history_entries(void) +{ + if (au_history_index >= au_history_size) + return au_history_size; + else + return au_history_index; +} + +static inline void +au_history_record(au_sentry_t *se, au_history_event_t event) +{ + struct au_history *p; + unsigned int i; + + i = OSAddAtomic(1, &au_history_index); + p = &au_history[i % au_history_size]; + + bzero(p, sizeof(*p)); + p->event = event; + bcopy(se, &p->se, sizeof(p->se)); + p->stack_depth = OSBacktrace(&p->stack[0], AU_HISTORY_MAX_STACK_DEPTH); + p->ptr = se; +} +#else +#define au_history_record(se, event) do {} while (0) +#endif + +MALLOC_DEFINE(M_AU_SESSION, "audit_session", "Audit session data"); + +static void audit_ref_session(au_sentry_t *se); +static void audit_unref_session(au_sentry_t *se); + +static void audit_session_event(int event, auditinfo_addr_t *aia_p); + +/* + * Audit session device. + */ + +static MALLOC_DEFINE(M_AUDIT_SDEV, "audit_sdev", "Audit sdevs"); +static MALLOC_DEFINE(M_AUDIT_SDEV_ENTRY, "audit_sdevent", + "Audit sdev entries and buffers"); + +/* + * Default audit sdev buffer parameters. + */ +#define AUDIT_SDEV_QLIMIT_DEFAULT 128 +#define AUDIT_SDEV_QLIMIT_MIN 1 +#define AUDIT_SDEV_QLIMIT_MAX 1024 + /* - * Audit Propagation Knote List is a list of kevent knotes that are assosiated - * with an any ASID knote. If the any ASID gets modified or deleted these are - * modified or deleted as well. + * Entry structure. */ -struct au_plist { - struct knote *pl_knote; /* ptr to per-session knote */ - LIST_ENTRY(au_plist) pl_link; /* list link (2) */ +struct audit_sdev_entry { + void *ase_record; + u_int ase_record_len; + TAILQ_ENTRY(audit_sdev_entry) ase_queue; }; -typedef struct au_plist au_plist_t; -struct au_plisthead { - struct rlck ph_rlck; /* (2) lock for pl_link list */ - LIST_HEAD(au_plhead, au_plist) ph_head; /* list head */ +/* + * Per audit sdev structure. + */ + +struct audit_sdev { + int asdev_open; + +#define AUDIT_SDEV_ASYNC 0x00000001 +#define AUDIT_SDEV_NBIO 0x00000002 + +#define AUDIT_SDEV_ALLSESSIONS 0x00010000 + u_int asdev_flags; + + struct selinfo asdev_selinfo; + pid_t asdev_sigio; + + au_id_t asdev_auid; + au_asid_t asdev_asid; + + /* Per-sdev mutex for most fields in this struct. */ + struct mtx asdev_mtx; + + /* + * Per-sdev sleep lock serializing user-generated reads and + * flushes. uiomove() is called to copy out the current head + * record's data whie the record remains in the queue, so we + * prevent other threads from removing it using this lock. + */ + struct slck asdev_sx; + + /* + * Condition variable to signal when data has been delivered to + * a sdev. + */ + struct cv asdev_cv; + + /* Count and bound of records in the queue. */ + u_int asdev_qlen; + u_int asdev_qlimit; + + /* The number of bytes of data across all records. */ + u_int asdev_qbyteslen; + + /* + * The amount read so far of the first record in the queue. + * (The number of bytes available for reading in the queue is + * qbyteslen - qoffset.) + */ + u_int asdev_qoffset; + + /* + * Per-sdev operation statistics. + */ + u_int64_t asdev_inserts; /* Records added. */ + u_int64_t asdev_reads; /* Records read. */ + u_int64_t asdev_drops; /* Records dropped. */ + + /* + * Current pending record list. This is protected by a + * combination of asdev_mtx and asdev_sx. Note that both + * locks are required to remove a record from the head of the + * queue, as an in-progress read may sleep while copying and, + * therefore, cannot hold asdev_mtx. + */ + TAILQ_HEAD(, audit_sdev_entry) asdev_queue; + + /* Global sdev list. */ + TAILQ_ENTRY(audit_sdev) asdev_list; }; -typedef struct au_plisthead au_plisthead_t; -#define EV_ANY_ASID EV_FLAG0 +#define AUDIT_SDEV_LOCK(asdev) mtx_lock(&(asdev)->asdev_mtx) +#define AUDIT_SDEV_LOCK_ASSERT(asdev) mtx_assert(&(asdev)->asdev_mtx, \ + MA_OWNED) +#define AUDIT_SDEV_LOCK_DESTROY(asdev) mtx_destroy(&(asdev)->asdev_mtx) +#define AUDIT_SDEV_LOCK_INIT(asdev) mtx_init(&(asdev)->asdev_mtx, \ + "audit_sdev_mtx", NULL, MTX_DEF) +#define AUDIT_SDEV_UNLOCK(asdev) mtx_unlock(&(asdev)->asdev_mtx) +#define AUDIT_SDEV_MTX(asdev) (&(asdev)->asdev_mtx) + +#define AUDIT_SDEV_SX_LOCK_DESTROY(asd) slck_destroy(&(asd)->asdev_sx) +#define AUDIT_SDEV_SX_LOCK_INIT(asd) slck_init(&(asd)->asdev_sx, \ + "audit_sdev_sx") +#define AUDIT_SDEV_SX_XLOCK_ASSERT(asd) slck_assert(&(asd)->asdev_sx, \ + SA_XLOCKED) +#define AUDIT_SDEV_SX_XLOCK_SIG(asd) slck_lock_sig(&(asd)->asdev_sx) +#define AUDIT_SDEV_SX_XUNLOCK(asd) slck_unlock(&(asd)->asdev_sx) -MALLOC_DEFINE(M_AU_SESSION, "audit_session", "Audit session data"); -MALLOC_DEFINE(M_AU_EV_PLIST, "audit_ev_plist", "Audit session event plist"); +/* + * Cloning variables and constants. + */ +#define AUDIT_SDEV_NAME "auditsessions" +#define MAX_AUDIT_SDEVS 32 + +static int audit_sdev_major; +static void *devnode; + +/* + * Global list of audit sdevs. The list is protected by a rw lock. + * Individaul record queues are protected by per-sdev locks. These + * locks synchronize between threads walking the list to deliver to + * individual sdevs and adds/removes of sdevs. + */ +static TAILQ_HEAD(, audit_sdev) audit_sdev_list; +static struct rwlock audit_sdev_lock; + +#define AUDIT_SDEV_LIST_LOCK_INIT() rw_init(&audit_sdev_lock, \ + "audit_sdev_list_lock") +#define AUDIT_SDEV_LIST_RLOCK() rw_rlock(&audit_sdev_lock) +#define AUDIT_SDEV_LIST_RUNLOCK() rw_runlock(&audit_sdev_lock) +#define AUDIT_SDEV_LIST_WLOCK() rw_wlock(&audit_sdev_lock) +#define AUDIT_SDEV_LIST_WLOCK_ASSERT() rw_assert(&audit_sdev_lock, \ + RA_WLOCKED) +#define AUDIT_SDEV_LIST_WUNLOCK() rw_wunlock(&audit_sdev_lock) + +/* + * dev_t doesn't have a pointer for "softc" data so we have to keep track of + * it with the following global array (indexed by the minor number). + * + * XXX We may want to dynamically grow this as need. + */ +static struct audit_sdev *audit_sdev_dtab[MAX_AUDIT_SDEVS]; /* - * Kevent filters. + * Special device methods and definition. */ -static int audit_filt_sessionattach(struct knote *kn); -static void audit_filt_sessiondetach(struct knote *kn); -static void audit_filt_sessiontouch(struct knote *kn, - struct kevent64_s *kev, long type); -static int audit_filt_session(struct knote *kn, long hint); - -static void audit_register_kevents(uint32_t asid, uint32_t auid); - -struct filterops audit_session_filtops = { - .f_attach = audit_filt_sessionattach, - .f_detach = audit_filt_sessiondetach, - .f_touch = audit_filt_sessiontouch, - .f_event = audit_filt_session, +static open_close_fcn_t audit_sdev_open; +static open_close_fcn_t audit_sdev_close; +static read_write_fcn_t audit_sdev_read; +static ioctl_fcn_t audit_sdev_ioctl; +static select_fcn_t audit_sdev_poll; + +static struct cdevsw audit_sdev_cdevsw = { + .d_open = audit_sdev_open, + .d_close = audit_sdev_close, + .d_read = audit_sdev_read, + .d_write = eno_rdwrt, + .d_ioctl = audit_sdev_ioctl, + .d_stop = eno_stop, + .d_reset = eno_reset, + .d_ttys = NULL, + .d_select = audit_sdev_poll, + .d_mmap = eno_mmap, + .d_strategy = eno_strat, + .d_type = 0 }; /* - * The klist for consumers that are interested in any session (ASID). This list - * is not associated with any data structure but is used for registering - * new kevents when sessions are created. This klist is lock by - * anyas_klist_mtx. - */ -static struct klist anyas_klist; -struct mtx anyas_klist_mtx; - -#define AUDIT_ANYAS_KLIST_LOCK_INIT() mtx_init(&anyas_klist_mtx, \ - "audit anyas_klist_mtx", NULL, MTX_DEF) -#define AUDIT_ANYAS_KLIST_LOCK() mtx_lock(&anyas_klist_mtx) -#define AUDIT_ANYAS_KLIST_UNLOCK() mtx_unlock(&anyas_klist_mtx) -#define AUDIT_ANYAS_KLIST_LOCK_ASSERT() mtx_assert(&anyas_klist_mtx, MA_OWNED) + * Global statistics on audit sdevs. + */ +static int audit_sdev_count; /* Current number of sdevs. */ +static u_int64_t audit_sdev_ever; /* Sdevs ever allocated. */ +static u_int64_t audit_sdev_records; /* Total records seen. */ +static u_int64_t audit_sdev_drops; /* Global record drop count. */ + +static int audit_sdev_init(void); #define AUDIT_SENTRY_RWLOCK_INIT() rw_init(&se_entry_lck, \ - "audit se_entry_lck") + "se_entry_lck") #define AUDIT_SENTRY_RLOCK() rw_rlock(&se_entry_lck) #define AUDIT_SENTRY_WLOCK() rw_wlock(&se_entry_lck) #define AUDIT_SENTRY_RWLOCK_ASSERT() rw_assert(&se_entry_lck, RA_LOCKED) #define AUDIT_SENTRY_RUNLOCK() rw_runlock(&se_entry_lck) #define AUDIT_SENTRY_WUNLOCK() rw_wunlock(&se_entry_lck) -#define AUDIT_SE_KLIST_LOCK_INIT(se, n) mtx_init(&(se)->se_klist_mtx, \ - n, NULL, MTX_DEF) -#define AUDIT_SE_KLIST_LOCK(se) mtx_lock(&(se)->se_klist_mtx) -#define AUDIT_SE_KLIST_UNLOCK(se) mtx_unlock(&(se)->se_klist_mtx) -#define AUDIT_SE_KLIST_LOCK_DESTROY(se) mtx_destroy(&(se)->se_klist_mtx) -#define AUDIT_SE_KLIST_LOCK_ASSERT(se) mtx_assert(&(se)->se_klist_mtx, \ - MA_OWNED) - -#define AUDIT_PLIST_LOCK_INIT(pl) rlck_init(&(pl)->ph_rlck, \ - "audit ph_rlck") -#define AUDIT_PLIST_LOCK(pl) rlck_lock(&(pl)->ph_rlck) -#define AUDIT_PLIST_UNLOCK(pl) rlck_unlock(&(pl)->ph_rlck) -#define AUDIT_PLIST_LOCK_DESTROY(pl) rlck_destroy(&(pl)->ph_rlck) - +/* Access control on the auditinfo_addr.ai_flags member. */ +static uint64_t audit_session_superuser_set_sflags_mask; +static uint64_t audit_session_superuser_clear_sflags_mask; +static uint64_t audit_session_member_set_sflags_mask; +static uint64_t audit_session_member_clear_sflags_mask; +SYSCTL_NODE(, OID_AUTO, audit, CTLFLAG_RW|CTLFLAG_LOCKED, 0, "Audit controls"); +SYSCTL_NODE(_audit, OID_AUTO, session, CTLFLAG_RW|CTLFLAG_LOCKED, 0, "Audit sessions"); +SYSCTL_QUAD(_audit_session, OID_AUTO, superuser_set_sflags_mask, CTLFLAG_RW | CTLFLAG_LOCKED, + &audit_session_superuser_set_sflags_mask, + "Audit session flags settable by superuser"); +SYSCTL_QUAD(_audit_session, OID_AUTO, superuser_clear_sflags_mask, CTLFLAG_RW | CTLFLAG_LOCKED, + &audit_session_superuser_clear_sflags_mask, + "Audit session flags clearable by superuser"); +SYSCTL_QUAD(_audit_session, OID_AUTO, member_set_sflags_mask, CTLFLAG_RW | CTLFLAG_LOCKED, + &audit_session_member_set_sflags_mask, + "Audit session flags settable by a session member"); +SYSCTL_QUAD(_audit_session, OID_AUTO, member_clear_sflags_mask, CTLFLAG_RW | CTLFLAG_LOCKED, + &audit_session_member_clear_sflags_mask, + "Audit session flags clearable by a session member"); + +#define AUDIT_SESSION_DEBUG 0 #if AUDIT_SESSION_DEBUG +/* + * The following is debugging code that can be used to get a snapshot of the + * session state. The audit session information is read out using sysctl: + * + * error = sysctlbyname("kern.audit_session_debug", buffer_ptr, &buffer_len, + * NULL, 0); + */ #include +/* + * The per session record structure for the snapshot data. + */ struct au_sentry_debug { auditinfo_addr_t se_auinfo; - long se_refcnt; - long se_procnt; + int64_t se_refcnt; /* refereence count */ + int64_t se_procnt; /* process count */ + int64_t se_ptcnt; /* process count from + proc table */ }; typedef struct au_sentry_debug au_sentry_debug_t; static int audit_sysctl_session_debug(struct sysctl_oid *oidp, void *arg1, int arg2, struct sysctl_req *req); -SYSCTL_PROC(_kern, OID_AUTO, audit_session_debug, CTLFLAG_RD, NULL, 0, - audit_sysctl_session_debug, "S,audit_session_debug", +SYSCTL_PROC(_kern, OID_AUTO, audit_session_debug, CTLFLAG_RD | CTLFLAG_LOCKED, + NULL, 0, audit_sysctl_session_debug, "S,audit_session_debug", "Current session debug info for auditing."); /* - * Copy out the session debug info via the sysctl interface. The userland code - * is something like the following: + * Callouts for proc_interate() which is used to reconcile the audit session + * proc state information with the proc table. We get everything we need + * in the filterfn while the proc_lock() is held so we really don't need the + * callout() function. + */ +static int +audit_session_debug_callout(__unused proc_t p, __unused void *arg) +{ + + return (PROC_RETURNED_DONE); +} + +static int +audit_session_debug_filterfn(proc_t p, void *st) +{ + kauth_cred_t cred = p->p_ucred; + auditinfo_addr_t *aia_p = cred->cr_audit.as_aia_p; + au_sentry_debug_t *sed_tab = (au_sentry_debug_t *) st; + au_sentry_debug_t *sdtp; + au_sentry_t *se; + + if (IS_VALID_SESSION(aia_p)) { + sdtp = &sed_tab[0]; + do { + if (aia_p->ai_asid == sdtp->se_asid) { + sdtp->se_ptcnt++; + + /* Do some santy checks. */ + se = AU_SENTRY_PTR(aia_p); + if (se->se_refcnt != sdtp->se_refcnt) { + sdtp->se_refcnt = + (int64_t)se->se_refcnt; + } + if (se->se_procnt != sdtp->se_procnt) { + sdtp->se_procnt = + (int64_t)se->se_procnt; + } + break; + } + sdtp++; + } while (sdtp->se_asid != 0 && sdtp->se_auid != 0); + } else { + /* add it to the default sesison */ + sed_tab->se_ptcnt++; + } + + return (0); +} + +/* + * Copy out the session debug info via the sysctl interface. * - * error = sysctlbyname("kern.audit_session_debug", buffer_ptr, &buffer_len, - * NULL, 0); */ static int audit_sysctl_session_debug(__unused struct sysctl_oid *oidp, @@ -223,6 +495,7 @@ audit_sysctl_session_debug(__unused struct sysctl_oid *oidp, if (se != NULL) entry_cnt++; + entry_cnt++; /* add one for the default entry */ /* * If just querying then return the space required. There is an * obvious race condition here so we just fudge this by 3 in case @@ -258,10 +531,18 @@ audit_sysctl_session_debug(__unused struct sysctl_oid *oidp, */ sz = 0; next_sed = sed_tab; + /* add the first entry for processes not tracked in sessions. */ + bcopy(audit_default_aia_p, &next_sed->se_auinfo, sizeof (au_sentry_t)); + next_sed->se_refcnt = (int64_t)audit_default_se.se_refcnt; + next_sed->se_procnt = (int64_t)audit_default_se.se_procnt; + next_sed++; + sz += sizeof(au_sentry_debug_t); for(i = 0; i < HASH_TABLE_SIZE; i++) { LIST_FOREACH(se, &au_sentry_bucket[i], se_link) { if (se != NULL) { - bcopy(se, next_sed, sizeof(next_sed)); + next_sed->se_auinfo = se->se_auinfo; + next_sed->se_refcnt = (int64_t)se->se_refcnt; + next_sed->se_procnt = (int64_t)se->se_procnt; next_sed++; sz += sizeof(au_sentry_debug_t); } @@ -269,6 +550,12 @@ audit_sysctl_session_debug(__unused struct sysctl_oid *oidp, } AUDIT_SENTRY_RUNLOCK(); + /* Reconcile with the process table. */ + (void) proc_iterate(PROC_ALLPROCLIST | PROC_ZOMBPROCLIST, + audit_session_debug_callout, NULL, + audit_session_debug_filterfn, (void *)&sed_tab[0]); + + req->oldlen = sz; err = SYSCTL_OUT(req, sed_tab, sz); kfree(sed_tab, entry_cnt * sizeof(au_sentry_debug_t)); @@ -278,6 +565,65 @@ audit_sysctl_session_debug(__unused struct sysctl_oid *oidp, #endif /* AUDIT_SESSION_DEBUG */ +/* + * Create and commit a session audit event. The proc and se arguments needs to + * be that of the subject and not necessarily the current process. + */ +static void +audit_session_event(int event, auditinfo_addr_t *aia_p) +{ + struct kaudit_record *ar; + + KASSERT(AUE_SESSION_START == event || AUE_SESSION_UPDATE == event || + AUE_SESSION_END == event || AUE_SESSION_CLOSE == event, + ("audit_session_event: invalid event: %d", event)); + + if (NULL == aia_p) + return; + + /* + * Create a new audit record. The record will contain the subject + * ruid, rgid, egid, pid, auid, asid, amask, and term_addr + * (implicitly added by audit_new). + */ + ar = audit_new(event, PROC_NULL, /* Not used */ NULL); + if (NULL == ar) + return; + + /* + * Audit session events are always generated because they are used + * by some userland consumers so just set the preselect flag. + */ + ar->k_ar_commit |= AR_PRESELECT_FILTER; + + /* + * Populate the subject information. Note that the ruid, rgid, + * egid, and pid values are incorrect. We only need the auditinfo_addr + * information. + */ + ar->k_ar.ar_subj_ruid = 0; + ar->k_ar.ar_subj_rgid = 0; + ar->k_ar.ar_subj_egid = 0; + ar->k_ar.ar_subj_pid = 0; + ar->k_ar.ar_subj_auid = aia_p->ai_auid; + ar->k_ar.ar_subj_asid = aia_p->ai_asid; + bcopy(&aia_p->ai_termid, &ar->k_ar.ar_subj_term_addr, + sizeof(struct au_tid_addr)); + + /* Add the audit masks to the record. */ + ar->k_ar.ar_arg_amask.am_success = aia_p->ai_mask.am_success; + ar->k_ar.ar_arg_amask.am_failure = aia_p->ai_mask.am_failure; + ARG_SET_VALID(ar, ARG_AMASK); + + /* Add the audit session flags to the record. */ + ar->k_ar.ar_arg_value64 = aia_p->ai_flags; + ARG_SET_VALID(ar, ARG_VALUE64); + + + /* Commit the record to the queue. */ + audit_commit(ar, 0, 0); +} + /* * Hash the audit session ID using a simple 32-bit mix. */ @@ -296,7 +642,8 @@ audit_session_hash(au_asid_t asid) /* * Do an hash lookup and find the session entry for a given ASID. Return NULL - * if not found. + * if not found. If the session is found then audit_session_find takes a + * reference. */ static au_sentry_t * audit_session_find(au_asid_t asid) @@ -309,23 +656,14 @@ audit_session_find(au_asid_t asid) hkey = HASH_ASID(asid); LIST_FOREACH(found_se, &au_sentry_bucket[hkey], se_link) - if (found_se->se_asid == asid) + if (found_se->se_asid == asid) { + au_history_record(found_se, AU_HISTORY_EVENT_FIND); + audit_ref_session(found_se); return (found_se); + } return (NULL); } -/* - * Call kqueue knote while holding the session entry klist lock. - */ -static void -audit_session_knote(au_sentry_t *se, long hint) -{ - - AUDIT_SE_KLIST_LOCK(se); - KNOTE(&se->se_klist, hint); - AUDIT_SE_KLIST_UNLOCK(se); -} - /* * Remove the given audit_session entry from the hash table. */ @@ -335,20 +673,35 @@ audit_session_remove(au_sentry_t *se) uint32_t hkey; au_sentry_t *found_se, *tmp_se; + au_history_record(se, AU_HISTORY_EVENT_DEATH); KASSERT(se->se_refcnt == 0, ("audit_session_remove: ref count != 0")); + KASSERT(se != &audit_default_se, + ("audit_session_remove: removing default session")); hkey = HASH_ASID(se->se_asid); AUDIT_SENTRY_WLOCK(); + /* + * Check and see if someone got a reference before we got the lock. + */ + if (se->se_refcnt != 0) { + AUDIT_SENTRY_WUNLOCK(); + return; + } + + audit_session_portdestroy(&se->se_port); LIST_FOREACH_SAFE(found_se, &au_sentry_bucket[hkey], se_link, tmp_se) { if (found_se == se) { - audit_session_knote(found_se, NOTE_AS_CLOSE); + /* + * Generate an audit event to notify userland of the + * session close. + */ + audit_session_event(AUE_SESSION_CLOSE, + &found_se->se_auinfo); LIST_REMOVE(found_se, se_link); AUDIT_SENTRY_WUNLOCK(); - AUDIT_SE_KLIST_LOCK_DESTROY(found_se); - found_se->se_refcnt = 0; free(found_se, M_AU_SESSION); return; @@ -365,6 +718,11 @@ audit_ref_session(au_sentry_t *se) { long old_val; + if (se == NULL || se == &audit_default_se) + return; + + au_history_record(se, AU_HISTORY_EVENT_REF); + old_val = OSAddAtomicLong(1, &se->se_refcnt); KASSERT(old_val < 100000, ("audit_ref_session: Too many references on session.")); @@ -378,6 +736,11 @@ audit_unref_session(au_sentry_t *se) { long old_val; + if (se == NULL || se == &audit_default_se) + return; + + au_history_record(se, AU_HISTORY_EVENT_UNREF); + old_val = OSAddAtomicLong(-1, &se->se_refcnt); if (old_val == 1) audit_session_remove(se); @@ -393,6 +756,9 @@ audit_inc_procount(au_sentry_t *se) { long old_val; + if (se == NULL || se == &audit_default_se) + return; + old_val = OSAddAtomicLong(1, &se->se_procnt); KASSERT(old_val <= PID_MAX, ("audit_inc_procount: proc count > PID_MAX")); @@ -407,9 +773,16 @@ audit_dec_procount(au_sentry_t *se) { long old_val; + if (se == NULL || se == &audit_default_se) + return; + old_val = OSAddAtomicLong(-1, &se->se_procnt); + /* + * If this was the last process generate an audit event to notify + * userland of the session ending. + */ if (old_val == 1) - audit_session_knote(se, NOTE_AS_END); + audit_session_event(AUE_SESSION_END, &se->se_auinfo); KASSERT(old_val >= 1, ("audit_dec_procount: proc count < 0")); } @@ -426,7 +799,7 @@ audit_update_sentry(au_sentry_t *se, auditinfo_addr_t *new_aia) auditinfo_addr_t *aia = &se->se_auinfo; int update; - KASSERT(new_aia != &audit_default_aia, + KASSERT(new_aia != audit_default_aia_p, ("audit_update_sentry: Trying to update the default aia.")); update = (aia->ai_auid != new_aia->ai_auid || @@ -464,64 +837,66 @@ audit_session_nextid(void) * reference to the entry that must be unref'ed. */ static auditinfo_addr_t * -audit_session_new(auditinfo_addr_t *new_aia, int newprocess) +audit_session_new(auditinfo_addr_t *new_aia_p, auditinfo_addr_t *old_aia_p) { - au_asid_t asid; + au_asid_t new_asid; au_sentry_t *se = NULL; + au_sentry_t *found_se = NULL; auditinfo_addr_t *aia = NULL; - char nm[LOCK_MAX_NAME]; - KASSERT(new_aia != NULL, ("audit_session_new: new_aia == NULL")); + KASSERT(new_aia_p != NULL, ("audit_session_new: new_aia_p == NULL")); - asid = new_aia->ai_asid; + new_asid = new_aia_p->ai_asid; -#if 0 /* XXX this assertion is currently broken by securityd/LoginWindow */ - KASSERT((asid != AU_ASSIGN_ASID && asid <= PID_MAX), - ("audit_session_new: illegal ASID value: %d", asid)); -#endif - /* * Alloc a new session entry now so we don't wait holding the lock. */ se = malloc(sizeof(au_sentry_t), M_AU_SESSION, M_WAITOK | M_ZERO); - snprintf(nm, sizeof(nm), "audit se_klist_mtx %d", asid); - AUDIT_SE_KLIST_LOCK_INIT(se, nm); - /* * Find an unique session ID, if desired. */ AUDIT_SENTRY_WLOCK(); - if (asid == AU_ASSIGN_ASID) { + if (new_asid == AU_ASSIGN_ASID) { do { - asid = (au_asid_t)audit_session_nextid(); - } while(audit_session_find(asid) != NULL); + + new_asid = (au_asid_t)audit_session_nextid(); + found_se = audit_session_find(new_asid); + + /* + * If the session ID is currently active then drop the + * reference and try again. + */ + if (found_se != NULL) + audit_unref_session(found_se); + else + break; + } while(1); } else { - au_sentry_t *found_se = NULL; /* * Check to see if the requested ASID is already in the * hash table. If so, update it with the new auditinfo. */ - if ((found_se = audit_session_find(asid)) != NULL) { + if ((found_se = audit_session_find(new_asid)) != NULL) { int updated; - updated = audit_update_sentry(found_se, new_aia); - audit_ref_session(found_se); + updated = audit_update_sentry(found_se, new_aia_p); AUDIT_SENTRY_WUNLOCK(); - AUDIT_SE_KLIST_LOCK_DESTROY(se); free(se, M_AU_SESSION); - if (updated) - audit_session_knote(found_se, NOTE_AS_UPDATE); + /* If a different session then add this process in. */ + if (new_aia_p != old_aia_p) + audit_inc_procount(found_se); /* - * If this is a new process joining this session then - * we need to update the proc count. + * If the session information was updated then + * generate an audit event to notify userland. */ - if (newprocess) - audit_inc_procount(found_se); + if (updated) + audit_session_event(AUE_SESSION_UPDATE, + &found_se->se_auinfo); return (&found_se->se_auinfo); } @@ -539,25 +914,23 @@ audit_session_new(auditinfo_addr_t *new_aia, int newprocess) */ se->se_port = IPC_PORT_NULL; aia = &se->se_auinfo; - aia->ai_asid = asid; - aia->ai_auid = new_aia->ai_auid; - bzero(&new_aia->ai_mask, sizeof(new_aia->ai_mask)); - bcopy(&new_aia->ai_termid, &aia->ai_termid, sizeof(aia->ai_termid)); - aia->ai_flags = new_aia->ai_flags; + aia->ai_asid = new_asid; + aia->ai_auid = new_aia_p->ai_auid; + bzero(&new_aia_p->ai_mask, sizeof(new_aia_p->ai_mask)); + bcopy(&new_aia_p->ai_termid, &aia->ai_termid, sizeof(aia->ai_termid)); + aia->ai_flags = new_aia_p->ai_flags; /* * Add it to the hash table. */ - LIST_INSERT_HEAD(&au_sentry_bucket[HASH_ASID(asid)], se, se_link); + LIST_INSERT_HEAD(&au_sentry_bucket[HASH_ASID(new_asid)], se, se_link); AUDIT_SENTRY_WUNLOCK(); /* - * Register kevents for consumers wanting events for any ASID - * and knote the event. + * Generate an audit event to notify userland of the new session. */ - audit_register_kevents(se->se_asid, se->se_auid); - audit_session_knote(se, NOTE_AS_START); - + audit_session_event(AUE_SESSION_START, aia); + au_history_record(se, AU_HISTORY_EVENT_BIRTH); return (aia); } @@ -577,13 +950,22 @@ audit_session_lookup(au_asid_t asid, auditinfo_addr_t *ret_aia) AUDIT_SENTRY_RUNLOCK(); return (1); } + /* We have a reference on the session so it is safe to drop the lock. */ + AUDIT_SENTRY_RUNLOCK(); if (ret_aia != NULL) bcopy(&se->se_auinfo, ret_aia, sizeof(*ret_aia)); - AUDIT_SENTRY_RUNLOCK(); + audit_unref_session(se); return (0); } +void +audit_session_aiaref(auditinfo_addr_t *aia_p) +{ + + audit_ref_session(AU_SENTRY_PTR(aia_p)); +} + /* * Add a reference to the session entry. */ @@ -596,9 +978,13 @@ audit_session_ref(kauth_cred_t cred) ("audit_session_ref: Invalid kauth_cred.")); aia_p = cred->cr_audit.as_aia_p; + audit_session_aiaref(aia_p); +} + +void audit_session_aiaunref(auditinfo_addr_t *aia_p) +{ - if (IS_VALID_SESSION(aia_p)) - audit_ref_session(AU_SENTRY_PTR(aia_p)); + audit_unref_session(AU_SENTRY_PTR(aia_p)); } /* @@ -613,14 +999,17 @@ audit_session_unref(kauth_cred_t cred) ("audit_session_unref: Invalid kauth_cred.")); aia_p = cred->cr_audit.as_aia_p; - - if (IS_VALID_SESSION(aia_p)) - audit_unref_session(AU_SENTRY_PTR(aia_p)); + audit_session_aiaunref(aia_p); } +/* + * Increment the per audit session process count. Assumes that the caller has + * a reference on the process' cred. + */ void -audit_session_procnew(kauth_cred_t cred) +audit_session_procnew(proc_t p) { + kauth_cred_t cred = p->p_ucred; auditinfo_addr_t *aia_p; KASSERT(IS_VALID_CRED(cred), @@ -628,13 +1017,17 @@ audit_session_procnew(kauth_cred_t cred) aia_p = cred->cr_audit.as_aia_p; - if (IS_VALID_SESSION(aia_p)) - audit_inc_procount(AU_SENTRY_PTR(aia_p)); + audit_inc_procount(AU_SENTRY_PTR(aia_p)); } +/* + * Decrement the per audit session process count. Assumes that the caller has + * a reference on the cred. + */ void -audit_session_procexit(kauth_cred_t cred) +audit_session_procexit(proc_t p) { + kauth_cred_t cred = p->p_ucred; auditinfo_addr_t *aia_p; KASSERT(IS_VALID_CRED(cred), @@ -642,8 +1035,7 @@ audit_session_procexit(kauth_cred_t cred) aia_p = cred->cr_audit.as_aia_p; - if (IS_VALID_SESSION(aia_p)) - audit_dec_procount(AU_SENTRY_PTR(aia_p)); + audit_dec_procount(AU_SENTRY_PTR(aia_p)); } /* @@ -658,450 +1050,109 @@ audit_session_init(void) ("audit_session_init: ASSIGNED_ASID_MAX is not large enough.")); AUDIT_SENTRY_RWLOCK_INIT(); - AUDIT_ANYAS_KLIST_LOCK_INIT(); au_sentry_bucket = malloc( sizeof(struct au_sentry) * HASH_TABLE_SIZE, M_AU_SESSION, M_WAITOK | M_ZERO); for (i = 0; i < HASH_TABLE_SIZE; i++) LIST_INIT(&au_sentry_bucket[i]); -} - -/* - * Allocate a new kevent propagation list (plist). - */ -static caddr_t -audit_new_plist(void) -{ - au_plisthead_t *plhead; - - plhead = malloc(sizeof(au_plisthead_t), M_AU_EV_PLIST, M_WAITOK | - M_ZERO); - - LIST_INIT(&plhead->ph_head); - AUDIT_PLIST_LOCK_INIT(plhead); - return ((caddr_t) plhead); + (void)audit_sdev_init(); +#if AU_HISTORY_LOGGING + au_history = malloc(sizeof(struct au_history) * au_history_size, + M_AU_SESSION, M_WAITOK|M_ZERO); +#endif } -/* - * Destroy a kevent propagation list (plist). The anyas_klist_mtx mutex must be - * held by the caller. - */ -static void -audit_destroy_plist(struct knote *anyas_kn) +static int +audit_session_update_check(kauth_cred_t cred, auditinfo_addr_t *old, + auditinfo_addr_t *new) { - au_plisthead_t *plhead; - au_plist_t *plentry, *ple_tmp; - struct kevent64_s kev; - - KASSERT(anyas_kn != NULL, ("audit_destroy_plist: anyas = NULL")); - plhead = (au_plisthead_t *)anyas_kn->kn_hook; - KASSERT(plhead != NULL, ("audit_destroy_plist: plhead = NULL")); - - /* - * Delete everything in the propagation list. + uint64_t n; + + /* If the current audit ID is not the default then it is immutable. */ + if (old->ai_auid != AU_DEFAUDITID && old->ai_auid != new->ai_auid) + return (EINVAL); + + /* If the current termid is not the default then it is immutable. */ + if ((old->ai_termid.at_type != AU_IPv4 || + old->ai_termid.at_port != 0 || + old->ai_termid.at_addr[0] != 0) && + (old->ai_termid.at_port != new->ai_termid.at_port || + old->ai_termid.at_type != new->ai_termid.at_type || + 0 != bcmp(&old->ai_termid.at_addr, &new->ai_termid.at_addr, + sizeof (old->ai_termid.at_addr)))) + return (EINVAL); + + /* The flags may be set only according to the + * audit_session_*_set_sflags_masks. */ - AUDIT_PLIST_LOCK(plhead); - LIST_FOREACH_SAFE(plentry, &plhead->ph_head, pl_link, ple_tmp) { - struct kqueue *kq = plentry->pl_knote->kn_kq; - - kev.ident = plentry->pl_knote->kn_id; - kev.filter = EVFILT_SESSION; - kev.flags = EV_DELETE; - - /* - * The plist entry gets removed in rm_from_plist() which is - * called indirectly by kevent_register(). - */ - kevent_register(kq, &kev, NULL); - } - AUDIT_PLIST_UNLOCK(plhead); - - /* - * Remove the head. + n = ~old->ai_flags & new->ai_flags; + if (0 != n && + !((n == (audit_session_superuser_set_sflags_mask & n) && + kauth_cred_issuser(cred)) || + (n == (audit_session_member_set_sflags_mask & n) && + old->ai_asid == new->ai_asid))) + return (EINVAL); + + /* The flags may be cleared only according to the + * audit_session_*_clear_sflags_masks. */ - AUDIT_PLIST_LOCK_DESTROY(plhead); - free(plhead, M_AU_EV_PLIST); + n = ~new->ai_flags & old->ai_flags; + if (0 != n && + !((n == (audit_session_superuser_clear_sflags_mask & n) && + kauth_cred_issuser(cred)) || + (n == (audit_session_member_clear_sflags_mask & n) && + old->ai_asid == new->ai_asid))) + return (EINVAL); + + /* The audit masks are mutable. */ + return (0); } /* - * Add a knote pointer entry to the kevent propagation list. + * Safely update kauth cred of the given process with new the given audit info. */ -static void -audit_add_to_plist(struct knote *anyas_kn, struct knote *kn) +int +audit_session_setaia(proc_t p, auditinfo_addr_t *new_aia_p) { - au_plisthead_t *plhead; - au_plist_t *plentry; - - KASSERT(anyas_kn != NULL, ("audit_add_to_plist: anyas = NULL")); - plhead = (au_plisthead_t *)anyas_kn->kn_hook; - KASSERT(plhead != NULL, ("audit_add_to_plist: plhead = NULL")); + kauth_cred_t my_cred, my_new_cred; + struct au_session as; + struct au_session tmp_as; + auditinfo_addr_t caia, *old_aia_p; + int ret; - plentry = malloc(sizeof(au_plist_t), M_AU_EV_PLIST, M_WAITOK | M_ZERO); + /* + * If this is going to modify an existing session then do some + * immutable checks. + */ + if (audit_session_lookup(new_aia_p->ai_asid, &caia) == 0) { + my_cred = kauth_cred_proc_ref(p); + ret = audit_session_update_check(my_cred, &caia, new_aia_p); + kauth_cred_unref(&my_cred); + if (ret) + return (ret); + } - plentry->pl_knote = kn; - AUDIT_PLIST_LOCK(plhead); - LIST_INSERT_HEAD(&plhead->ph_head, plentry, pl_link); - AUDIT_PLIST_UNLOCK(plhead); -} + my_cred = kauth_cred_proc_ref(p); + bcopy(&new_aia_p->ai_mask, &as.as_mask, sizeof(as.as_mask)); + old_aia_p = my_cred->cr_audit.as_aia_p; + /* audit_session_new() adds a reference on the session */ + as.as_aia_p = audit_session_new(new_aia_p, old_aia_p); -/* - * Remote a knote pointer entry from the kevent propagation list. The lock - * on the plist may already be head (by audit_destroy_plist() above) so we use - * a recursive lock. - */ -static void -audit_rm_from_plist(struct knote *kn) -{ - struct knote *anyas_kn; - au_plisthead_t *plhd; - au_plist_t *plentry, *ple_tmp; - - KASSERT(kn != NULL, ("audit_rm_from_plist: kn = NULL")); - anyas_kn = (struct knote *)kn->kn_hook; - KASSERT(anyas_kn != NULL, ("audit_rm_to_plist: anyas = NULL")); - plhd = (au_plisthead_t *)anyas_kn->kn_hook; - - AUDIT_PLIST_LOCK(plhd); - LIST_FOREACH_SAFE(plentry, &plhd->ph_head, pl_link, ple_tmp) { - if (plentry->pl_knote == kn) { - LIST_REMOVE(plentry, pl_link); - free(plentry, M_AU_EV_PLIST); - AUDIT_PLIST_UNLOCK(plhd); - return; - } - } - AUDIT_PLIST_UNLOCK(plhd); -} + /* If the process left a session then update the process count. */ + if (old_aia_p != new_aia_p) + audit_dec_procount(AU_SENTRY_PTR(old_aia_p)); -/* - * The attach filter for EVFILT_SESSION. - */ -static int -audit_filt_sessionattach(struct knote *kn) -{ - au_sentry_t *se = NULL; /* - * Check flags for the events we currently support. + * We are modifying the audit info in a credential so we need a new + * credential (or take another reference on an existing credential that + * matches our new one). We must do this because the audit info in the + * credential is used as part of our hash key. Get current credential + * in the target process and take a reference while we muck with it. */ - if ((kn->kn_sfflags & (NOTE_AS_START | NOTE_AS_END | NOTE_AS_CLOSE - | NOTE_AS_UPDATE | NOTE_AS_ERR)) == 0) - return (ENOTSUP); - - /* - * If the interest is in any session then add to the any ASID knote - * list. Otherwise, add it to the knote list assosiated with the - * given session. - */ - if (kn->kn_id == AS_ANY_ASID) { - - kn->kn_flags |= EV_CLEAR; - kn->kn_ptr.p_se = NULL; - - /* - * Attach a kevent propagation list for any kevents that get - * added. - */ - kn->kn_hook = audit_new_plist(); - - AUDIT_ANYAS_KLIST_LOCK(); - KNOTE_ATTACH(&anyas_klist, kn); - AUDIT_ANYAS_KLIST_UNLOCK(); - - return (0); - } else { - - /* - * NOTE: The anyas klist lock will be held in this - * part of the code when indirectly called from - * audit_register_kevents() below. - */ - - /* - * Check to make sure it is a valid ASID. - */ - if (kn->kn_id > ASSIGNED_ASID_MAX) - return (EINVAL); - - AUDIT_SENTRY_RLOCK(); - se = audit_session_find(kn->kn_id); - AUDIT_SENTRY_RUNLOCK(); - if (se == NULL) - return (EINVAL); - - AUDIT_SE_KLIST_LOCK(se); - kn->kn_flags |= EV_CLEAR; - kn->kn_ptr.p_se = se; - - /* - * If this attach is the result of an "any ASID" (pseudo) - * kevent then attach the any session knote ptr to this knote. - * Also, add this knote to the its propagation list. - */ - if (kn->kn_flags & EV_ANY_ASID) { - struct knote *anyas_kn = - (struct knote *)((uintptr_t)kn->kn_kevent.ext[0]); - kn->kn_hook = (caddr_t) anyas_kn; - kn->kn_flags &= ~EV_ANY_ASID; - audit_add_to_plist(anyas_kn, kn); - } else - kn->kn_hook = NULL; - KNOTE_ATTACH(&se->se_klist, kn); - AUDIT_SE_KLIST_UNLOCK(se); - - return (0); - } -} - -/* - * The detach filter for EVFILT_SESSION. - */ -static void -audit_filt_sessiondetach(struct knote *kn) -{ - au_sentry_t *se = NULL; - - if (kn->kn_id == AS_ANY_ASID) { - - AUDIT_ANYAS_KLIST_LOCK(); - audit_destroy_plist(kn); - KNOTE_DETACH(&anyas_klist, kn); - AUDIT_ANYAS_KLIST_UNLOCK(); - - } else { - /* - * If this knote was created by any ASID kevent then remove - * from kevent propagation list. - */ - if (kn->kn_hook != NULL) { - audit_rm_from_plist(kn); - kn->kn_hook = NULL; - } - - /* - * Check to see if already detached. - */ - se = kn->kn_ptr.p_se; - if (se != NULL) { - AUDIT_SE_KLIST_LOCK(se); - kn->kn_ptr.p_se = NULL; - KNOTE_DETACH(&se->se_klist, kn); - AUDIT_SE_KLIST_UNLOCK(se); - } - } -} - -/* - * The touch filter for EVFILT_SESSION. Check for any ASID kevent updates and - * propagate the change. - */ -static void -audit_filt_sessiontouch(struct knote *kn, struct kevent64_s *kev, long type) -{ - struct knote *ple_kn; - struct kqueue *kq; - au_sentry_t *se; - au_plisthead_t *plhead; - au_plist_t *plentry; - struct kevent64_s newkev; - - switch (type) { - case EVENT_REGISTER: - kn->kn_sfflags = kev->fflags; - kn->kn_sdata = kev->data; - /* - * If an any ASID kevent was updated then we may need to - * propagate the update. - */ - if (kev->ident == AS_ANY_ASID && kn->kn_hook != NULL) { - - /* - * Propagate the change to each of the session kevents - * that were created by this any ASID kevent. - */ - plhead = (au_plisthead_t *)kn->kn_hook; - AUDIT_PLIST_LOCK(plhead); - LIST_FOREACH(plentry, &plhead->ph_head, pl_link) { - - if ((ple_kn = plentry->pl_knote) == NULL) - continue; - if ((se = ple_kn->kn_ptr.p_se) == NULL) - continue; - if ((kq = ple_kn->kn_kq) == NULL) - continue; - - newkev.ident = plentry->pl_knote->kn_id; - newkev.filter = EVFILT_SESSION; - newkev.flags = kev->flags; - newkev.fflags = kev->fflags; - newkev.data = kev->data; - newkev.udata = kev->udata; - kevent_register(kq, &newkev, NULL); - } - AUDIT_PLIST_UNLOCK(plhead); - } - break; - - case EVENT_PROCESS: - *kev = kn->kn_kevent; - if (kn->kn_flags & EV_CLEAR) { - kn->kn_data = 0; - kn->kn_fflags = 0; - } - break; - - default: - KASSERT((type == EVENT_REGISTER || type == EVENT_PROCESS), - ("filt_sessiontouch(): invalid type (%ld)", type)); - break; - } -} - -/* - * Event filter for EVFILT_SESSION. The AUDIT_SE_KLIST_LOCK should be held - * by audit_session_knote(). - */ -static int -audit_filt_session(struct knote *kn, long hint) -{ - int events = (int)hint; - au_sentry_t *se = kn->kn_ptr.p_se; - - if (hint != 0 && se != NULL) { - - if (kn->kn_sfflags & events) { - kn->kn_fflags |= events; - kn->kn_data = se->se_auid; - } - - /* - * If this is the last possible event for the knote, - * detach the knote from the audit session before the - * session goes away. - */ - if (events & NOTE_AS_CLOSE) { - - /* - * If created by any ASID kevent then remove from - * propagation list. - */ - if (kn->kn_hook != NULL) { - audit_rm_from_plist(kn); - kn->kn_hook = NULL; - } - kn->kn_flags |= (EV_EOF | EV_ONESHOT); - kn->kn_ptr.p_se = NULL; - AUDIT_SE_KLIST_LOCK_ASSERT(se); - KNOTE_DETACH(&se->se_klist, kn); - - return (1); - } - } - return (kn->kn_fflags != 0); -} - -/* - * For all the consumers wanting events for all sessions, register new - * kevents associated with the session for the given ASID. The actual - * attachment is done by the EVFILT_SESSION attach filter above. - */ -static void -audit_register_kevents(uint32_t asid, uint32_t auid) -{ - struct knote *kn; - - AUDIT_ANYAS_KLIST_LOCK(); - SLIST_FOREACH(kn, &anyas_klist, kn_selnext) { - struct kqueue *kq = kn->kn_kq; - struct kevent64_s kev; - int err; - - kev.ident = asid; - kev.filter = EVFILT_SESSION; - kev.flags = kn->kn_flags | EV_ADD | EV_ENABLE | EV_ANY_ASID; - kev.fflags = kn->kn_sfflags; - kev.data = auid; - kev.udata = kn->kn_kevent.udata; - - /* - * Save the knote ptr for this "any ASID" knote for the attach - * filter. - */ - kev.ext[0] = (uint64_t)((uintptr_t)kn); - - /* - * XXX kevent_register() may block here alloc'ing a new knote. - * We may want to think about using a lockless linked list or - * at least a sleep rwlock for the anyas_klist. - */ - err = kevent_register(kq, &kev, NULL); - if (err) - kn->kn_fflags |= NOTE_AS_ERR; - } - AUDIT_ANYAS_KLIST_UNLOCK(); -} - -/* - * Safely update kauth cred of the given process with new the given audit info. - * If the newprocess flag is set then we need to account for this process in - * the proc count. - */ -int -audit_session_setaia(proc_t p, auditinfo_addr_t *aia_p, int newprocess) -{ - kauth_cred_t my_cred, my_new_cred; - struct au_session as; - struct au_session tmp_as; - auditinfo_addr_t caia; - - /* - * If this is going to modify an existing session then do some - * immutable checks. - */ - if (audit_session_lookup(aia_p->ai_asid, &caia) == 0) { - - /* - * If the current audit ID is not the default then it is - * immutable. - */ - if (caia.ai_auid != AU_DEFAUDITID && - caia.ai_auid != aia_p->ai_auid) - return (EINVAL); - - /* - * If the current termid is not the default then it is - * immutable. - */ - if ((caia.ai_termid.at_type != AU_IPv4 || - caia.ai_termid.at_port != 0 || - caia.ai_termid.at_addr[0] != 0) && - (caia.ai_termid.at_port != aia_p->ai_termid.at_port || - caia.ai_termid.at_type != aia_p->ai_termid.at_type || - bcmp(&caia.ai_termid.at_addr, &aia_p->ai_termid.at_addr, - sizeof (caia.ai_termid.at_addr) )) ) - return (EINVAL); - - /* The audit flags are immutable. */ - if (caia.ai_flags != aia_p->ai_flags) - return (EINVAL); - - /* The audit masks are mutable. */ - } - - my_cred = kauth_cred_proc_ref(p); - bcopy(&aia_p->ai_mask, &as.as_mask, sizeof(as.as_mask)); - as.as_aia_p = audit_session_new(aia_p, newprocess); - - /* - * We are modifying the audit info in a credential so we need a new - * credential (or take another reference on an existing credential that - * matches our new one). We must do this because the audit info in the - * credential is used as part of our hash key. Get current credential - * in the target process and take a reference while we muck with it. - */ - for (;;) { + for (;;) { /* * Set the credential with new info. If there is no change, @@ -1114,14 +1165,14 @@ audit_session_setaia(proc_t p, auditinfo_addr_t *aia_p, int newprocess) my_new_cred = kauth_cred_setauditinfo(my_cred, &tmp_as); if (my_cred != my_new_cred) { - proc_lock(p); + proc_ucred_lock(p); /* Need to protect for a race where another thread also * changed the credential after we took our reference. * If p_ucred has changed then we should restart this * again with the new cred. */ if (p->p_ucred != my_cred) { - proc_unlock(p); + proc_ucred_unlock(p); audit_session_unref(my_new_cred); kauth_cred_unref(&my_new_cred); /* try again */ @@ -1129,7 +1180,9 @@ audit_session_setaia(proc_t p, auditinfo_addr_t *aia_p, int newprocess) continue; } p->p_ucred = my_new_cred; - proc_unlock(p); + /* update cred on proc */ + PROC_UPDATE_CREDS_ONPROC(p); + proc_ucred_unlock(p); } /* * Drop old proc reference or our extra reference. @@ -1137,11 +1190,11 @@ audit_session_setaia(proc_t p, auditinfo_addr_t *aia_p, int newprocess) kauth_cred_unref(&my_cred); break; } - audit_session_unref(my_new_cred); - /* - * Propagate the change from the process to the Mach task. - */ + /* Drop the reference taken by audit_session_new() above. */ + audit_unref_session(AU_SENTRY_PTR(as.as_aia_p)); + + /* Propagate the change from the process to the Mach task. */ set_security_token(p); return (0); @@ -1180,6 +1233,7 @@ audit_session_self(proc_t p, __unused struct audit_session_self_args *uap, aia_p = cred->cr_audit.as_aia_p; if (!IS_VALID_SESSION(aia_p)) { + /* Can't join the default session. */ err = EINVAL; goto done; } @@ -1194,91 +1248,190 @@ audit_session_self(proc_t p, __unused struct audit_session_self_args *uap, bcopy(&cred->cr_audit.as_mask, &se->se_mask, sizeof(se->se_mask)); - if ((sendport = audit_session_mksend(aia_p, &se->se_port)) == NULL) { - /* failed to alloc new port */ - err = ENOMEM; - goto done; - } - /* - * This reference on the session is unref'ed in - * audit_session_port_destory(). This reference is needed so the - * session doesn't get dropped until the session join is done. + * Get a send right to the session's Mach port and insert it in the + * process' mach port namespace. */ - audit_ref_session(se); - + sendport = audit_session_mksend(aia_p, &se->se_port); + *ret_port = ipc_port_copyout_send(sendport, get_task_ipcspace(p->task)); done: if (cred != NULL) kauth_cred_unref(&cred); - if (err == 0) - *ret_port = ipc_port_copyout_send(sendport, - get_task_ipcspace(p->task)); - else + if (err != 0) *ret_port = MACH_PORT_NULL; - return (err); } -void -audit_session_portaiadestroy(struct auditinfo_addr *port_aia_p) +/* + * audit_session_port (system call) + * + * Description: Obtain a Mach send right for the given session ID. + * + * Parameters: p Process calling audit_session_port(). + * uap->asid The target audit session ID. The special + * value -1 can be used to target the process's + * own session. + * uap->portnamep User address at which to place port name. + * + * Returns: 0 Success + * EINVAL The calling process' session has not be set. + * EINVAL The given session ID could not be found. + * EINVAL The Mach port right could not be copied out. + * ESRCH Bad process, can't get valid cred for process. + * EPERM Only the superuser can reference sessions other + * than the process's own. + * ENOMEM Port allocation failed due to no free memory. + */ +int +audit_session_port(proc_t p, struct audit_session_port_args *uap, + __unused int *retval) { - au_sentry_t *se; + ipc_port_t sendport = IPC_PORT_NULL; + mach_port_name_t portname = MACH_PORT_NULL; + kauth_cred_t cred = NULL; + auditinfo_addr_t *aia_p = NULL; + au_sentry_t *se = NULL; + int err = 0; + + /* Note: Currently this test will never be true, because + * ASSIGNED_ASID_MAX is effectively (uint32_t)-2. + */ + if (uap->asid != -1 && (uint32_t)uap->asid > ASSIGNED_ASID_MAX) { + err = EINVAL; + goto done; + } + cred = kauth_cred_proc_ref(p); + if (!IS_VALID_CRED(cred)) { + err = ESRCH; + goto done; + } + aia_p = cred->cr_audit.as_aia_p; - KASSERT(port_aia_p != NULL, - ("audit_session_infodestroy: port_aia_p = NULL")); + /* Find the session corresponding to the requested audit + * session ID. If found, take a reference on it so that + * the session is not dropped until the join is later done. + */ + if (uap->asid == (au_asid_t)-1 || + uap->asid == aia_p->ai_asid) { - se = AU_SENTRY_PTR(port_aia_p); + if (!IS_VALID_SESSION(aia_p)) { + /* Can't join the default session. */ + err = EINVAL; + goto done; + } + + /* No privilege is required to obtain a port for our + * own session. + */ + se = AU_SENTRY_PTR(aia_p); + audit_ref_session(se); + } else if (kauth_cred_issuser(cred)) { + /* The superuser may obtain a port for any existing + * session. + */ + AUDIT_SENTRY_RLOCK(); + se = audit_session_find(uap->asid); + AUDIT_SENTRY_RUNLOCK(); + if (NULL == se) { + err = EINVAL; + goto done; + } + aia_p = &se->se_auinfo; + } else { + err = EPERM; + goto done; + } /* - * Drop the reference added in audit_session_self(). + * Processes that join using this mach port will inherit this process' + * pre-selection masks. */ - if (se != NULL) { - se->se_port = IPC_PORT_NULL; - audit_unref_session(se); + if (se->se_port == IPC_PORT_NULL) + bcopy(&cred->cr_audit.as_mask, &se->se_mask, + sizeof(se->se_mask)); + + /* + * Use the session reference to create a mach port reference for the + * session (at which point we are free to drop the session reference) + * and then copy out the mach port to the process' mach port namespace. + */ + sendport = audit_session_mksend(aia_p, &se->se_port); + portname = ipc_port_copyout_send(sendport, get_task_ipcspace(p->task)); + if (!MACH_PORT_VALID(portname)) { + err = EINVAL; + goto done; } + err = copyout(&portname, uap->portnamep, sizeof(mach_port_name_t)); +done: + if (cred != NULL) + kauth_cred_unref(&cred); + if (NULL != se) + audit_unref_session(se); + if (MACH_PORT_VALID(portname) && 0 != err) + (void)mach_port_deallocate(get_task_ipcspace(p->task), + portname); + return (err); } static int audit_session_join_internal(proc_t p, ipc_port_t port, au_asid_t *new_asid) { - auditinfo_addr_t *port_aia_p, *old_aia_p; - kauth_cred_t cred = NULL; + auditinfo_addr_t *new_aia_p, *old_aia_p; + kauth_cred_t my_cred = NULL; au_asid_t old_asid; int err = 0; *new_asid = AU_DEFAUDITSID; - if ((port_aia_p = audit_session_porttoaia(port)) == NULL) { + if ((new_aia_p = audit_session_porttoaia(port)) == NULL) { err = EINVAL; goto done; } - *new_asid = port_aia_p->ai_asid; - cred = kauth_cred_proc_ref(p); - if (!IS_VALID_CRED(cred)) { - kauth_cred_unref(&cred); + proc_ucred_lock(p); + kauth_cred_ref(p->p_ucred); + my_cred = p->p_ucred; + if (!IS_VALID_CRED(my_cred)) { + kauth_cred_unref(&my_cred); + proc_ucred_unlock(p); err = ESRCH; goto done; } - old_aia_p = cred->cr_audit.as_aia_p; + old_aia_p = my_cred->cr_audit.as_aia_p; old_asid = old_aia_p->ai_asid; + *new_asid = new_aia_p->ai_asid; /* * Add process in if not already in the session. */ if (*new_asid != old_asid) { - audit_session_setaia(p, port_aia_p, 1); - /* - * If this process was in a valid session before then we - * need to decrement the process count of the session it - * came from. - */ - if (IS_VALID_SESSION(old_aia_p)) - audit_dec_procount(AU_SENTRY_PTR(old_aia_p)); + kauth_cred_t my_new_cred; + struct au_session new_as; + + bcopy(&new_aia_p->ai_mask, &new_as.as_mask, + sizeof(new_as.as_mask)); + new_as.as_aia_p = new_aia_p; + + my_new_cred = kauth_cred_setauditinfo(my_cred, &new_as); + p->p_ucred = my_new_cred; + PROC_UPDATE_CREDS_ONPROC(p); + + /* Increment the proc count of new session */ + audit_inc_procount(AU_SENTRY_PTR(new_aia_p)); + + proc_ucred_unlock(p); + + /* Propagate the change from the process to the Mach task. */ + set_security_token(p); + + /* Decrement the process count of the former session. */ + audit_dec_procount(AU_SENTRY_PTR(old_aia_p)); + } else { + proc_ucred_unlock(p); } - kauth_cred_unref(&cred); + kauth_cred_unref(&my_cred); done: if (port != IPC_PORT_NULL) @@ -1312,8 +1465,10 @@ audit_session_spawnjoin(proc_t p, ipc_port_t port) * Parameters: p Process calling session join. * uap->port A Mach send right. * - * Returns: *ret_asid Audit session ID of new session, which may - * be AU_DEFAUDITSID in the failure case. + * Returns: *ret_asid Audit session ID of new session. + * In the failure case the return value will be -1 + * and 'errno' will be set to a non-zero value + * described below. * * Errno: 0 Success * EINVAL Invalid Mach port name. @@ -1338,6 +1493,541 @@ audit_session_join(proc_t p, struct audit_session_join_args *uap, return (err); } +/* + * Audit session device. + */ + +/* + * Free an audit sdev entry. + */ +static void +audit_sdev_entry_free(struct audit_sdev_entry *ase) +{ + + free(ase->ase_record, M_AUDIT_SDEV_ENTRY); + free(ase, M_AUDIT_SDEV_ENTRY); +} + +/* + * Append individual record to a queue. Allocate queue-local buffer and + * add to the queue. If the queue is full or we can't allocate memory, + * drop the newest record. + */ +static void +audit_sdev_append(struct audit_sdev *asdev, void *record, u_int record_len) +{ + struct audit_sdev_entry *ase; + + AUDIT_SDEV_LOCK_ASSERT(asdev); + + if (asdev->asdev_qlen >= asdev->asdev_qlimit) { + asdev->asdev_drops++; + audit_sdev_drops++; + return; + } + + ase = malloc(sizeof (*ase), M_AUDIT_SDEV_ENTRY, M_NOWAIT | M_ZERO); + if (NULL == ase) { + asdev->asdev_drops++; + audit_sdev_drops++; + return; + } + + ase->ase_record = malloc(record_len, M_AUDIT_SDEV_ENTRY, M_NOWAIT); + if (NULL == ase->ase_record) { + free(ase, M_AUDIT_SDEV_ENTRY); + asdev->asdev_drops++; + audit_sdev_drops++; + return; + } + + bcopy(record, ase->ase_record, record_len); + ase->ase_record_len = record_len; + + TAILQ_INSERT_TAIL(&asdev->asdev_queue, ase, ase_queue); + asdev->asdev_inserts++; + asdev->asdev_qlen++; + asdev->asdev_qbyteslen += ase->ase_record_len; + selwakeup(&asdev->asdev_selinfo); + if (asdev->asdev_flags & AUDIT_SDEV_ASYNC) + pgsigio(asdev->asdev_sigio, SIGIO); + + cv_broadcast(&asdev->asdev_cv); +} + +/* + * Submit an audit record to be queued in the audit session device. + */ +void +audit_sdev_submit(__unused au_id_t auid, __unused au_asid_t asid, void *record, + u_int record_len) +{ + struct audit_sdev *asdev; + + /* + * Lockless read to avoid lock overhead if sessio devices are not in + * use. + */ + if (NULL == TAILQ_FIRST(&audit_sdev_list)) + return; + + AUDIT_SDEV_LIST_RLOCK(); + TAILQ_FOREACH(asdev, &audit_sdev_list, asdev_list) { + AUDIT_SDEV_LOCK(asdev); + + /* + * Only append to the sdev queue if the AUID and ASID match that + * of the process that opened this session device or if the + * ALLSESSIONS flag is set. + */ + if ((/* XXXss auid == asdev->asdev_auid && */ + asid == asdev->asdev_asid) || + (asdev->asdev_flags & AUDIT_SDEV_ALLSESSIONS) != 0) + audit_sdev_append(asdev, record, record_len); + AUDIT_SDEV_UNLOCK(asdev); + } + AUDIT_SDEV_LIST_RUNLOCK(); + + /* Unlocked increment. */ + audit_sdev_records++; +} + +/* + * Allocate a new audit sdev. Connects the sdev, on succes, to the global + * list and updates statistics. + */ +static struct audit_sdev * +audit_sdev_alloc(void) +{ + struct audit_sdev *asdev; + + AUDIT_SDEV_LIST_WLOCK_ASSERT(); + + asdev = malloc(sizeof (*asdev), M_AUDIT_SDEV, M_WAITOK | M_ZERO); + if (NULL == asdev) + return (NULL); + + asdev->asdev_qlimit = AUDIT_SDEV_QLIMIT_DEFAULT; + TAILQ_INIT(&asdev->asdev_queue); + AUDIT_SDEV_LOCK_INIT(asdev); + AUDIT_SDEV_SX_LOCK_INIT(asdev); + cv_init(&asdev->asdev_cv, "audit_sdev_cv"); + + /* + * Add to global list and update global statistics. + */ + TAILQ_INSERT_HEAD(&audit_sdev_list, asdev, asdev_list); + audit_sdev_count++; + audit_sdev_ever++; + + return (asdev); +} + +/* + * Flush all records currently present in an audit sdev. + */ +static void +audit_sdev_flush(struct audit_sdev *asdev) +{ + struct audit_sdev_entry *ase; + + AUDIT_SDEV_LOCK_ASSERT(asdev); + + while ((ase = TAILQ_FIRST(&asdev->asdev_queue)) != NULL) { + TAILQ_REMOVE(&asdev->asdev_queue, ase, ase_queue); + asdev->asdev_qbyteslen -= ase->ase_record_len; + audit_sdev_entry_free(ase); + asdev->asdev_qlen--; + } + asdev->asdev_qoffset = 0; + + KASSERT(0 == asdev->asdev_qlen, ("audit_sdev_flush: asdev_qlen")); + KASSERT(0 == asdev->asdev_qbyteslen, + ("audit_sdev_flush: asdev_qbyteslen")); +} + +/* + * Free an audit sdev. + */ +static void +audit_sdev_free(struct audit_sdev *asdev) +{ + + AUDIT_SDEV_LIST_WLOCK_ASSERT(); + AUDIT_SDEV_LOCK_ASSERT(asdev); + + /* XXXss - preselect hook here */ + audit_sdev_flush(asdev); + cv_destroy(&asdev->asdev_cv); + AUDIT_SDEV_SX_LOCK_DESTROY(asdev); + AUDIT_SDEV_UNLOCK(asdev); + AUDIT_SDEV_LOCK_DESTROY(asdev); + + TAILQ_REMOVE(&audit_sdev_list, asdev, asdev_list); + free(asdev, M_AUDIT_SDEV); + audit_sdev_count--; +} + +/* + * Get the auditinfo_addr of the proc and check to see if suser. Will return + * non-zero if not suser. + */ +static int +audit_sdev_get_aia(proc_t p, struct auditinfo_addr *aia_p) +{ + int error; + kauth_cred_t scred; + + scred = kauth_cred_proc_ref(p); + error = suser(scred, &p->p_acflag); + + if (NULL != aia_p) + bcopy(scred->cr_audit.as_aia_p, aia_p, sizeof (*aia_p)); + kauth_cred_unref(&scred); + + return (error); +} + +/* + * Audit session dev open method. + */ +static int +audit_sdev_open(dev_t dev, __unused int flags, __unused int devtype, proc_t p) +{ + struct audit_sdev *asdev; + struct auditinfo_addr aia; + int u; + + u = minor(dev); + if (u < 0 || u > MAX_AUDIT_SDEVS) + return (ENXIO); + + (void) audit_sdev_get_aia(p, &aia); + + AUDIT_SDEV_LIST_WLOCK(); + asdev = audit_sdev_dtab[u]; + if (NULL == asdev) { + asdev = audit_sdev_alloc(); + if (NULL == asdev) { + AUDIT_SDEV_LIST_WUNLOCK(); + return (ENOMEM); + } + audit_sdev_dtab[u] = asdev; + } else { + KASSERT(asdev->asdev_open, ("audit_sdev_open: Already open")); + AUDIT_SDEV_LIST_WUNLOCK(); + return (EBUSY); + } + asdev->asdev_open = 1; + asdev->asdev_auid = aia.ai_auid; + asdev->asdev_asid = aia.ai_asid; + asdev->asdev_flags = 0; + + AUDIT_SDEV_LIST_WUNLOCK(); + + return (0); +} + +/* + * Audit session dev close method. + */ +static int +audit_sdev_close(dev_t dev, __unused int flags, __unused int devtype, + __unused proc_t p) +{ + struct audit_sdev *asdev; + int u; + + u = minor(dev); + asdev = audit_sdev_dtab[u]; + + KASSERT(asdev != NULL, ("audit_sdev_close: asdev == NULL")); + KASSERT(asdev->asdev_open, ("audit_sdev_close: !asdev_open")); + + AUDIT_SDEV_LIST_WLOCK(); + AUDIT_SDEV_LOCK(asdev); + asdev->asdev_open = 0; + audit_sdev_free(asdev); /* sdev lock unlocked in audit_sdev_free() */ + audit_sdev_dtab[u] = NULL; + AUDIT_SDEV_LIST_WUNLOCK(); + + return (0); +} + +/* + * Audit session dev ioctl method. + */ +static int +audit_sdev_ioctl(dev_t dev, u_long cmd, caddr_t data, + __unused int flag, proc_t p) +{ + struct audit_sdev *asdev; + int error; + + asdev = audit_sdev_dtab[minor(dev)]; + KASSERT(asdev != NULL, ("audit_sdev_ioctl: asdev == NULL")); + + error = 0; + + switch (cmd) { + case FIONBIO: + AUDIT_SDEV_LOCK(asdev); + if (*(int *)data) + asdev->asdev_flags |= AUDIT_SDEV_NBIO; + else + asdev->asdev_flags &= ~AUDIT_SDEV_NBIO; + AUDIT_SDEV_UNLOCK(asdev); + break; + + case FIONREAD: + AUDIT_SDEV_LOCK(asdev); + *(int *)data = asdev->asdev_qbyteslen - asdev->asdev_qoffset; + AUDIT_SDEV_UNLOCK(asdev); + break; + + case AUDITSDEV_GET_QLEN: + *(u_int *)data = asdev->asdev_qlen; + break; + + case AUDITSDEV_GET_QLIMIT: + *(u_int *)data = asdev->asdev_qlimit; + break; + + case AUDITSDEV_SET_QLIMIT: + if (*(u_int *)data >= AUDIT_SDEV_QLIMIT_MIN || + *(u_int *)data <= AUDIT_SDEV_QLIMIT_MAX) { + asdev->asdev_qlimit = *(u_int *)data; + } else + error = EINVAL; + break; + + case AUDITSDEV_GET_QLIMIT_MIN: + *(u_int *)data = AUDIT_SDEV_QLIMIT_MIN; + break; + + case AUDITSDEV_GET_QLIMIT_MAX: + *(u_int *)data = AUDIT_SDEV_QLIMIT_MAX; + break; + + case AUDITSDEV_FLUSH: + if (AUDIT_SDEV_SX_XLOCK_SIG(asdev) != 0) + return (EINTR); + AUDIT_SDEV_LOCK(asdev); + audit_sdev_flush(asdev); + AUDIT_SDEV_UNLOCK(asdev); + AUDIT_SDEV_SX_XUNLOCK(asdev); + break; + + case AUDITSDEV_GET_MAXDATA: + *(u_int *)data = MAXAUDITDATA; + break; + + /* XXXss these should be 64 bit, maybe. */ + case AUDITSDEV_GET_INSERTS: + *(u_int *)data = asdev->asdev_inserts; + break; + + case AUDITSDEV_GET_READS: + *(u_int *)data = asdev->asdev_reads; + break; + + case AUDITSDEV_GET_DROPS: + *(u_int *)data = asdev->asdev_drops; + break; + + case AUDITSDEV_GET_ALLSESSIONS: + error = audit_sdev_get_aia(p, NULL); + if (error) + break; + *(u_int *)data = (asdev->asdev_flags & AUDIT_SDEV_ALLSESSIONS) ? + 1 : 0; + break; + + case AUDITSDEV_SET_ALLSESSIONS: + error = audit_sdev_get_aia(p, NULL); + if (error) + break; + + AUDIT_SDEV_LOCK(asdev); + if (*(int *)data) + asdev->asdev_flags |= AUDIT_SDEV_ALLSESSIONS; + else + asdev->asdev_flags &= ~AUDIT_SDEV_ALLSESSIONS; + AUDIT_SDEV_UNLOCK(asdev); + break; + + default: + error = ENOTTY; + } + + return (error); +} + +/* + * Audit session dev read method. + */ +static int +audit_sdev_read(dev_t dev, struct uio *uio, __unused int flag) +{ + struct audit_sdev_entry *ase; + struct audit_sdev *asdev; + u_int toread; + int error; + + asdev = audit_sdev_dtab[minor(dev)]; + KASSERT(NULL != asdev, ("audit_sdev_read: asdev == NULL")); + + /* + * We hold a sleep lock over read and flush because we rely on the + * stability of a record in the queue during uiomove. + */ + if (0 != AUDIT_SDEV_SX_XLOCK_SIG(asdev)) + return (EINTR); + AUDIT_SDEV_LOCK(asdev); + while (TAILQ_EMPTY(&asdev->asdev_queue)) { + if (asdev->asdev_flags & AUDIT_SDEV_NBIO) { + AUDIT_SDEV_UNLOCK(asdev); + AUDIT_SDEV_SX_XUNLOCK(asdev); + return (EAGAIN); + } + error = cv_wait_sig(&asdev->asdev_cv, AUDIT_SDEV_MTX(asdev)); + if (error) { + AUDIT_SDEV_UNLOCK(asdev); + AUDIT_SDEV_SX_XUNLOCK(asdev); + return (error); + } + } + + /* + * Copy as many remaining bytes from the current record to userspace + * as we can. Keep processing records until we run out of records in + * the queue or until the user buffer runs out of space. + * + * We rely on the sleep lock to maintain ase's stability here. + */ + asdev->asdev_reads++; + while ((ase = TAILQ_FIRST(&asdev->asdev_queue)) != NULL && + uio_resid(uio) > 0) { + AUDIT_SDEV_LOCK_ASSERT(asdev); + + KASSERT(ase->ase_record_len > asdev->asdev_qoffset, + ("audit_sdev_read: record_len > qoffset (1)")); + toread = MIN((int)(ase->ase_record_len - asdev->asdev_qoffset), + uio_resid(uio)); + AUDIT_SDEV_UNLOCK(asdev); + error = uiomove((char *) ase->ase_record + asdev->asdev_qoffset, + toread, uio); + if (error) { + AUDIT_SDEV_SX_XUNLOCK(asdev); + return (error); + } + + /* + * If the copy succeeded then update book-keeping, and if no + * bytes remain in the current record then free it. + */ + AUDIT_SDEV_LOCK(asdev); + KASSERT(TAILQ_FIRST(&asdev->asdev_queue) == ase, + ("audit_sdev_read: queue out of sync after uiomove")); + asdev->asdev_qoffset += toread; + KASSERT(ase->ase_record_len >= asdev->asdev_qoffset, + ("audit_sdev_read: record_len >= qoffset (2)")); + if (asdev->asdev_qoffset == ase->ase_record_len) { + TAILQ_REMOVE(&asdev->asdev_queue, ase, ase_queue); + asdev->asdev_qbyteslen -= ase->ase_record_len; + audit_sdev_entry_free(ase); + asdev->asdev_qlen--; + asdev->asdev_qoffset = 0; + } + } + AUDIT_SDEV_UNLOCK(asdev); + AUDIT_SDEV_SX_XUNLOCK(asdev); + return (0); +} + +/* + * Audit session device poll method. + */ +static int +audit_sdev_poll(dev_t dev, int events, void *wql, struct proc *p) +{ + struct audit_sdev *asdev; + int revents; + + revents = 0; + asdev = audit_sdev_dtab[minor(dev)]; + KASSERT(NULL != asdev, ("audit_sdev_poll: asdev == NULL")); + + if (events & (POLLIN | POLLRDNORM)) { + AUDIT_SDEV_LOCK(asdev); + if (NULL != TAILQ_FIRST(&asdev->asdev_queue)) + revents |= events & (POLLIN | POLLRDNORM); + else + selrecord(p, &asdev->asdev_selinfo, wql); + AUDIT_SDEV_UNLOCK(asdev); + } + return (revents); +} + +/* + * Audit sdev clone routine. Provides a new minor number or returns -1. + * This called with DEVFS_LOCK held. + */ +static int +audit_sdev_clone(__unused dev_t dev, int action) +{ + int i; + + if (DEVFS_CLONE_ALLOC == action) { + for(i = 0; i < MAX_AUDIT_SDEVS; i++) + if (NULL == audit_sdev_dtab[i]) + return (i); + + /* + * This really should return -1 here but that seems to + * hang things in devfs. We instead return 0 and let + * audit_sdev_open tell userland the bad news. + */ + return (0); + } + + return (-1); +} + +static int +audit_sdev_init(void) +{ + dev_t dev; + + TAILQ_INIT(&audit_sdev_list); + AUDIT_SDEV_LIST_LOCK_INIT(); + + audit_sdev_major = cdevsw_add(-1, &audit_sdev_cdevsw); + if (audit_sdev_major < 0) + return (KERN_FAILURE); + + dev = makedev(audit_sdev_major, 0); + devnode = devfs_make_node_clone(dev, DEVFS_CHAR, UID_ROOT, GID_WHEEL, + 0644, audit_sdev_clone, AUDIT_SDEV_NAME, 0); + + if (NULL == devnode) + return (KERN_FAILURE); + + return (KERN_SUCCESS); +} + +/* XXXss +static int +audit_sdev_shutdown(void) +{ + + devfs_remove(devnode); + (void) cdevsw_remove(audit_sdev_major, &audit_sdev_cdevsw); + + return (KERN_SUCCESS); +} +*/ + #else int @@ -1358,4 +2048,12 @@ audit_session_join(proc_t p, struct audit_session_join_args *uap, return (ENOSYS); } +int +audit_session_port(proc_t p, struct audit_session_port_args *uap, int *retval) +{ +#pragma unused(p, uap, retval) + + return (ENOSYS); +} + #endif /* CONFIG_AUDIT */