X-Git-Url: https://git.saurik.com/apple/xnu.git/blobdiff_plain/e2fac8b15b12a7979f72090454d850e612fc5b13..b0d623f7f2ae71ed96e60569f61f9a9a27016e80:/bsd/security/audit/audit_bsd.c?ds=inline diff --git a/bsd/security/audit/audit_bsd.c b/bsd/security/audit/audit_bsd.c new file mode 100644 index 000000000..fdae0d79d --- /dev/null +++ b/bsd/security/audit/audit_bsd.c @@ -0,0 +1,563 @@ +/*- + * Copyright (c) 2008-2009 Apple Inc. + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 3. Neither the name of Apple Inc. ("Apple") nor the names of + * its contributors may be used to endorse or promote products derived + * from this software without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY + * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED + * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE + * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY + * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES + * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; + * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND + * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT + * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF + * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + */ + +#include + +#include +#include +#include + +#include +#include +#include +#include + +#include + +#include +#include + +#include +#include +#include + +#include +#include +#include + +#if CONFIG_AUDIT +struct mhdr { + size_t mh_size; + au_malloc_type_t *mh_type; + u_long mh_magic; + char mh_data[0]; +}; + +#define AUDIT_MHMAGIC 0x4D656C53 + +#if AUDIT_MALLOC_DEBUG +#define AU_MAX_SHORTDESC 20 +#define AU_MAX_LASTCALLER 20 +struct au_malloc_debug_info { + SInt64 md_size; + SInt64 md_maxsize; + SInt32 md_inuse; + SInt32 md_maxused; + unsigned md_type; + unsigned md_magic; + char md_shortdesc[AU_MAX_SHORTDESC]; + char md_lastcaller[AU_MAX_LASTCALLER]; +}; +typedef struct au_malloc_debug_info au_malloc_debug_info_t; + +au_malloc_type_t *audit_malloc_types[NUM_MALLOC_TYPES]; + +static int audit_sysctl_malloc_debug(struct sysctl_oid *oidp, void *arg1, + int arg2, struct sysctl_req *req); + +SYSCTL_PROC(_kern, OID_AUTO, audit_malloc_debug, CTLFLAG_RD, NULL, 0, + audit_sysctl_malloc_debug, "S,audit_malloc_debug", + "Current malloc debug info for auditing."); + +#define AU_MALLOC_DBINFO_SZ \ + (NUM_MALLOC_TYPES * sizeof(au_malloc_debug_info_t)) + +/* + * Copy out the malloc debug info via the sysctl interface. The userland code + * is something like the following: + * + * error = sysctlbyname("kern.audit_malloc_debug", buffer_ptr, &buffer_len, + * NULL, 0); + */ +static int +audit_sysctl_malloc_debug(__unused struct sysctl_oid *oidp, __unused void *arg1, + __unused int arg2, struct sysctl_req *req) +{ + int i; + size_t sz; + au_malloc_debug_info_t *amdi_ptr, *nxt_ptr; + int err; + + /* + * This provides a read-only node. + */ + if (req->newptr != USER_ADDR_NULL) + return (EPERM); + + /* + * If just querying then return the space required. + */ + if (req->oldptr == USER_ADDR_NULL) { + req->oldidx = AU_MALLOC_DBINFO_SZ; + return (0); + } + + /* + * Alloc a temporary buffer. + */ + if (req->oldlen < AU_MALLOC_DBINFO_SZ) + return (ENOMEM); + amdi_ptr = (au_malloc_debug_info_t *)kalloc(AU_MALLOC_DBINFO_SZ); + if (amdi_ptr == NULL) + return (ENOMEM); + bzero(amdi_ptr, AU_MALLOC_DBINFO_SZ); + + /* + * Build the record array. + */ + sz = 0; + nxt_ptr = amdi_ptr; + for(i = 0; i < NUM_MALLOC_TYPES; i++) { + if (audit_malloc_types[i] == NULL) + continue; + if (audit_malloc_types[i]->mt_magic != M_MAGIC) { + nxt_ptr->md_magic = audit_malloc_types[i]->mt_magic; + continue; + } + nxt_ptr->md_magic = audit_malloc_types[i]->mt_magic; + nxt_ptr->md_size = audit_malloc_types[i]->mt_size; + nxt_ptr->md_maxsize = audit_malloc_types[i]->mt_maxsize; + nxt_ptr->md_inuse = (int)audit_malloc_types[i]->mt_inuse; + nxt_ptr->md_maxused = (int)audit_malloc_types[i]->mt_maxused; + strlcpy(nxt_ptr->md_shortdesc, + audit_malloc_types[i]->mt_shortdesc, AU_MAX_SHORTDESC - 1); + strlcpy(nxt_ptr->md_lastcaller, + audit_malloc_types[i]->mt_lastcaller, AU_MAX_LASTCALLER-1); + sz += sizeof(au_malloc_debug_info_t); + nxt_ptr++; + } + + req->oldlen = sz; + err = SYSCTL_OUT(req, amdi_ptr, sz); + kfree(amdi_ptr, AU_MALLOC_DBINFO_SZ); + + return (err); +} +#endif /* AUDIT_MALLOC_DEBUG */ + +/* + * BSD malloc() + * + * If the M_NOWAIT flag is set then it may not block and return NULL. + * If the M_ZERO flag is set then zero out the buffer. + */ +void * +#if AUDIT_MALLOC_DEBUG +_audit_malloc(size_t size, au_malloc_type_t *type, int flags, const char *fn) +#else +_audit_malloc(size_t size, au_malloc_type_t *type, int flags) +#endif +{ + union { + struct mhdr hdr; + char mem[size + sizeof (struct mhdr)]; + } *mem; + size_t memsize = sizeof (*mem); + + if (size == 0) + return (NULL); + if (flags & M_NOWAIT) { + mem = (void *)kalloc_noblock(memsize); + } else { + mem = (void *)kalloc(memsize); + if (mem == NULL) + panic("_audit_malloc: kernel memory exhausted"); + } + if (mem == NULL) + return (NULL); + mem->hdr.mh_size = memsize; + mem->hdr.mh_type = type; + mem->hdr.mh_magic = AUDIT_MHMAGIC; + if (flags & M_ZERO) + memset(mem->hdr.mh_data, 0, size); +#if AUDIT_MALLOC_DEBUG + if (type != NULL && type->mt_type < NUM_MALLOC_TYPES) { + OSAddAtomic64(memsize, &type->mt_size); + type->mt_maxsize = max(type->mt_size, type->mt_maxsize); + OSAddAtomic(1, &type->mt_inuse); + type->mt_maxused = max(type->mt_inuse, type->mt_maxused); + type->mt_lastcaller = fn; + audit_malloc_types[type->mt_type] = type; + } +#endif /* AUDIT_MALLOC_DEBUG */ + return (mem->hdr.mh_data); +} + +/* + * BSD free() + */ +void +#if AUDIT_MALLOC_DEBUG +_audit_free(void *addr, au_malloc_type_t *type) +#else +_audit_free(void *addr, __unused au_malloc_type_t *type) +#endif +{ + struct mhdr *hdr; + + if (addr == NULL) + return; + hdr = addr; hdr--; + + KASSERT(hdr->mh_magic == AUDIT_MHMAGIC, + ("_audit_free(): hdr->mh_magic != AUDIT_MHMAGIC")); + +#if AUDIT_MALLOC_DEBUG + if (type != NULL) { + OSAddAtomic64(-hdr->mh_size, &type->mt_size); + OSAddAtomic(-1, &type->mt_inuse); + } +#endif /* AUDIT_MALLOC_DEBUG */ + kfree(hdr, hdr->mh_size); +} + +/* + * Initialize a condition variable. Must be called before use. + */ +void +_audit_cv_init(struct cv *cvp, const char *desc) +{ + + if (desc == NULL) + cvp->cv_description = "UNKNOWN"; + else + cvp->cv_description = desc; + cvp->cv_waiters = 0; +} + +/* + * Destory a condition variable. + */ +void +_audit_cv_destroy(struct cv *cvp) +{ + + cvp->cv_description = NULL; + cvp->cv_waiters = 0; +} + +/* + * Signal a condition variable, wakes up one waiting thread. + */ +void +_audit_cv_signal(struct cv *cvp) +{ + + if (cvp->cv_waiters > 0) { + wakeup_one((caddr_t)cvp); + cvp->cv_waiters--; + } +} + +/* + * Broadcast a signal to a condition variable. + */ +void +_audit_cv_broadcast(struct cv *cvp) +{ + + if (cvp->cv_waiters > 0) { + wakeup((caddr_t)cvp); + cvp->cv_waiters = 0; + } +} + +/* + * Wait on a condition variable. A cv_signal or cv_broadcast on the same + * condition variable will resume the thread. It is recommended that the mutex + * be held when cv_signal or cv_broadcast are called. + */ +void +_audit_cv_wait(struct cv *cvp, lck_mtx_t *mp, const char *desc) +{ + + cvp->cv_waiters++; + (void) msleep(cvp, mp, PZERO, desc, 0); +} + +/* + * Wait on a condition variable, allowing interruption by signals. Return 0 + * if the thread was resumed with cv_signal or cv_broadcast, EINTR or + * ERESTART if a signal was caught. If ERESTART is returned the system call + * should be restarted if possible. + */ +int +_audit_cv_wait_sig(struct cv *cvp, lck_mtx_t *mp, const char *desc) +{ + + cvp->cv_waiters++; + return (msleep(cvp, mp, PSOCK | PCATCH, desc, 0)); +} + +/* + * Simple recursive lock. + */ +void +_audit_rlck_init(struct rlck *lp, const char *grpname) +{ + + lp->rl_grp = lck_grp_alloc_init(grpname, LCK_GRP_ATTR_NULL); + lp->rl_mtx = lck_mtx_alloc_init(lp->rl_grp, LCK_ATTR_NULL); + + lp->rl_thread = 0; + lp->rl_recurse = 0; +} + +/* + * Recursive lock. Allow same thread to recursively lock the same lock. + */ +void +_audit_rlck_lock(struct rlck *lp) +{ + + if (lp->rl_thread == current_thread()) { + OSAddAtomic(1, &lp->rl_recurse); + KASSERT(lp->rl_recurse < 10000, + ("_audit_rlck_lock: lock nested too deep.")); + } else { + lck_mtx_lock(lp->rl_mtx); + lp->rl_thread = current_thread(); + lp->rl_recurse = 1; + } +} + +/* + * Recursive unlock. It should be the same thread that does the unlock. + */ +void +_audit_rlck_unlock(struct rlck *lp) +{ + KASSERT(lp->rl_thread == current_thread(), + ("_audit_rlck_unlock(): Don't own lock.")); + + /* Note: OSAddAtomic returns old value. */ + if (OSAddAtomic(-1, &lp->rl_recurse) == 1) { + lp->rl_thread = 0; + lck_mtx_unlock(lp->rl_mtx); + } +} + +void +_audit_rlck_destroy(struct rlck *lp) +{ + + if (lp->rl_mtx) { + lck_mtx_free(lp->rl_mtx, lp->rl_grp); + lp->rl_mtx = 0; + } + if (lp->rl_grp) { + lck_grp_free(lp->rl_grp); + lp->rl_grp = 0; + } +} + +/* + * Recursive lock assert. + */ +void +_audit_rlck_assert(struct rlck *lp, u_int assert) +{ + thread_t cthd = current_thread(); + + if (assert == LCK_MTX_ASSERT_OWNED && lp->rl_thread == cthd) + panic("recursive lock (%p) not held by this thread (%p).", + lp, cthd); + if (assert == LCK_MTX_ASSERT_NOTOWNED && lp->rl_thread != 0) + panic("recursive lock (%p) held by thread (%p).", + lp, cthd); +} + +/* + * Simple sleep lock. + */ +void +_audit_slck_init(struct slck *lp, const char *grpname) +{ + + lp->sl_grp = lck_grp_alloc_init(grpname, LCK_GRP_ATTR_NULL); + lp->sl_mtx = lck_mtx_alloc_init(lp->sl_grp, LCK_ATTR_NULL); + + lp->sl_locked = 0; + lp->sl_waiting = 0; +} + +/* + * Sleep lock lock. The 'intr' flag determines if the lock is interruptible. + * If 'intr' is true then signals or other events can interrupt the sleep lock. + */ +wait_result_t +_audit_slck_lock(struct slck *lp, int intr) +{ + wait_result_t res = THREAD_AWAKENED; + + lck_mtx_lock(lp->sl_mtx); + while (lp->sl_locked && res == THREAD_AWAKENED) { + lp->sl_waiting = 1; + res = lck_mtx_sleep(lp->sl_mtx, LCK_SLEEP_DEFAULT, + (event_t) lp, (intr) ? THREAD_INTERRUPTIBLE : THREAD_UNINT); + } + if (res == THREAD_AWAKENED) + lp->sl_locked = 1; + lck_mtx_unlock(lp->sl_mtx); + + return (res); +} + +/* + * Sleep lock unlock. Wake up all the threads waiting for this lock. + */ +void +_audit_slck_unlock(struct slck *lp) +{ + + lck_mtx_lock(lp->sl_mtx); + lp->sl_locked = 0; + if (lp->sl_waiting) { + lp->sl_waiting = 0; + + /* Wake up *all* sleeping threads. */ + thread_wakeup_prim((event_t) lp, /*1 thr*/ 0, THREAD_AWAKENED); + } + lck_mtx_unlock(lp->sl_mtx); +} + +/* + * Sleep lock try. Don't sleep if it doesn't get the lock. + */ +int +_audit_slck_trylock(struct slck *lp) +{ + int result; + + lck_mtx_lock(lp->sl_mtx); + result = !lp->sl_locked; + if (result) + lp->sl_locked = 1; + lck_mtx_unlock(lp->sl_mtx); + + return (result); +} + +/* + * Sleep lock assert. + */ +void +_audit_slck_assert(struct slck *lp, u_int assert) +{ + + if (assert == LCK_MTX_ASSERT_OWNED && lp->sl_locked == 0) + panic("sleep lock (%p) not held.", lp); + if (assert == LCK_MTX_ASSERT_NOTOWNED && lp->sl_locked == 1) + panic("sleep lock (%p) held.", lp); +} + +void +_audit_slck_destroy(struct slck *lp) +{ + + if (lp->sl_mtx) { + lck_mtx_free(lp->sl_mtx, lp->sl_grp); + lp->sl_mtx = 0; + } + if (lp->sl_grp) { + lck_grp_free(lp->sl_grp); + lp->sl_grp = 0; + } +} + +/* + * XXXss - This code was taken from bsd/netinet6/icmp6.c. Maybe ppsratecheck() + * should be made global in icmp6.c. + */ +#ifndef timersub +#define timersub(tvp, uvp, vvp) \ + do { \ + (vvp)->tv_sec = (tvp)->tv_sec - (uvp)->tv_sec; \ + (vvp)->tv_usec = (tvp)->tv_usec - (uvp)->tv_usec; \ + if ((vvp)->tv_usec < 0) { \ + (vvp)->tv_sec--; \ + (vvp)->tv_usec += 1000000; \ + } \ + } while (0) +#endif + +/* + * Packets (or events) per second limitation. + */ +int +_audit_ppsratecheck(struct timeval *lasttime, int *curpps, int maxpps) +{ + struct timeval tv, delta; + int rv; + + microtime(&tv); + + timersub(&tv, lasttime, &delta); + + /* + * Check for 0,0 so that the message will be seen at least once. + * If more than one second has passed since the last update of + * lasttime, reset the counter. + * + * we do increment *curpps even in *curpps < maxpps case, as some may + * try to use *curpps for stat purposes as well. + */ + if ((lasttime->tv_sec == 0 && lasttime->tv_usec == 0) || + delta.tv_sec >= 1) { + *lasttime = tv; + *curpps = 0; + rv = 1; + } else if (maxpps < 0) + rv = 1; + else if (*curpps < maxpps) + rv = 1; + else + rv = 0; + if (*curpps + 1 > 0) + *curpps = *curpps + 1; + + return (rv); +} + +int +audit_send_trigger(unsigned int trigger) +{ + mach_port_t audit_port; + int error; + + error = host_get_audit_control_port(host_priv_self(), &audit_port); + if (error == KERN_SUCCESS && audit_port != MACH_PORT_NULL) { + audit_triggers(audit_port, trigger); + return (0); + } else { + printf("Cannot get audit control port\n"); + return (error); + } +} +#endif /* CONFIG_AUDIT */