1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216121712181219122012211222122312241225122612271228122912301231123212331234123512361237123812391240124112421243124412451246124712481249125012511252125312541255125612571258125912601261126212631264126512661267126812691270127112721273127412751276127712781279128012811282128312841285128612871288128912901291129212931294129512961297129812991300130113021303130413051306130713081309131013111312131313141315131613171318131913201321132213231324132513261327132813291330133113321333133413351336133713381339134013411342134313441345134613471348134913501351135213531354135513561357135813591360136113621363136413651366136713681369137013711372137313741375137613771378137913801381138213831384138513861387138813891390139113921393139413951396139713981399140014011402140314041405140614071408140914101411141214131414141514161417141814191420142114221423142414251426142714281429143014311432143314341435143614371438143914401441144214431444144514461447144814491450145114521453145414551456145714581459146014611462146314641465146614671468146914701471147214731474147514761477147814791480148114821483148414851486148714881489149014911492149314941495149614971498149915001501150215031504150515061507150815091510151115121513151415151516151715181519152015211522152315241525152615271528152915301531153215331534153515361537153815391540154115421543154415451546154715481549155015511552155315541555155615571558155915601561156215631564156515661567156815691570157115721573157415751576157715781579158015811582158315841585158615871588158915901591159215931594159515961597159815991600160116021603160416051606160716081609 |
- /*-
- * SPDX-License-Identifier: BSD-3-Clause
- *
- * Copyright (c) 2004-2009 Apple Inc.
- * Copyright (c) 2005 SPARTA, Inc.
- * All rights reserved.
- *
- * This code was developed in part by Robert N. M. Watson, Senior Principal
- * Scientist, SPARTA, Inc.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in the
- * documentation and/or other materials provided with the distribution.
- * 3. Neither the name of Apple Inc. ("Apple") nor the names of
- * its contributors may be used to endorse or promote products derived
- * from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR
- * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
- * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
- * POSSIBILITY OF SUCH DAMAGE.
- */
- #include <sys/param.h>
- #include <sys/types.h>
- #include <sys/endian.h>
- #include <sys/queue.h>
- #include <sys/socket.h>
- #include <sys/time.h>
- #include <sys/ipc.h>
- #include <sys/libkern.h>
- #include <sys/malloc.h>
- #include <sys/un.h>
- #include <netinet/in.h>
- #include <netinet/in_systm.h>
- #include <netinet/ip.h>
- #include <bsm/audit.h>
- #include <bsm/audit_internal.h>
- #include <bsm/audit_record.h>
- #include <security/audit/audit.h>
- #include <security/audit/audit_private.h>
- #define GET_TOKEN_AREA(t, dptr, length) do { \
- t = malloc(sizeof(token_t), M_AUDITBSM, M_WAITOK); \
- t->t_data = malloc(length, M_AUDITBSM, M_WAITOK | M_ZERO); \
- t->len = length; \
- dptr = t->t_data; \
- } while (0)
- /*
- * token ID 1 byte
- * success/failure 1 byte
- * privstrlen 2 bytes
- * privstr N bytes + 1 (\0 byte)
- */
- token_t *
- au_to_upriv(char sorf, char *priv)
- {
- u_int16_t textlen;
- u_char *dptr;
- token_t *t;
- textlen = strlen(priv) + 1;
- GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_char) +
- sizeof(u_int16_t) + textlen);
- ADD_U_CHAR(dptr, AUT_UPRIV);
- ADD_U_CHAR(dptr, sorf);
- ADD_U_INT16(dptr, textlen);
- ADD_STRING(dptr, priv, textlen);
- return (t);
- }
- /*
- * token ID 1 byte
- * privtstrlen 2 bytes
- * privtstr N bytes + 1
- * privstrlen 2 bytes
- * privstr N bytes + 1
- */
- token_t *
- au_to_privset(char *privtypestr, char *privstr)
- {
- u_int16_t type_len, priv_len;
- u_char *dptr;
- token_t *t;
- type_len = strlen(privtypestr) + 1;
- priv_len = strlen(privstr) + 1;
- GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t) +
- sizeof(u_int16_t) + type_len + priv_len);
- ADD_U_CHAR(dptr, AUT_PRIV);
- ADD_U_INT16(dptr, type_len);
- ADD_STRING(dptr, privtypestr, type_len);
- ADD_U_INT16(dptr, priv_len);
- ADD_STRING(dptr, privstr, priv_len);
- return (t);
- }
- /*
- * token ID 1 byte
- * argument # 1 byte
- * argument value 4 bytes/8 bytes (32-bit/64-bit value)
- * text length 2 bytes
- * text N bytes + 1 terminating NULL byte
- */
- token_t *
- au_to_arg32(char n, const char *text, u_int32_t v)
- {
- token_t *t;
- u_char *dptr = NULL;
- u_int16_t textlen;
- textlen = strlen(text);
- textlen += 1;
- GET_TOKEN_AREA(t, dptr, 2 * sizeof(u_char) + sizeof(u_int32_t) +
- sizeof(u_int16_t) + textlen);
- ADD_U_CHAR(dptr, AUT_ARG32);
- ADD_U_CHAR(dptr, n);
- ADD_U_INT32(dptr, v);
- ADD_U_INT16(dptr, textlen);
- ADD_STRING(dptr, text, textlen);
- return (t);
- }
- token_t *
- au_to_arg64(char n, const char *text, u_int64_t v)
- {
- token_t *t;
- u_char *dptr = NULL;
- u_int16_t textlen;
- textlen = strlen(text);
- textlen += 1;
- GET_TOKEN_AREA(t, dptr, 2 * sizeof(u_char) + sizeof(u_int64_t) +
- sizeof(u_int16_t) + textlen);
- ADD_U_CHAR(dptr, AUT_ARG64);
- ADD_U_CHAR(dptr, n);
- ADD_U_INT64(dptr, v);
- ADD_U_INT16(dptr, textlen);
- ADD_STRING(dptr, text, textlen);
- return (t);
- }
- token_t *
- au_to_arg(char n, const char *text, u_int32_t v)
- {
- return (au_to_arg32(n, text, v));
- }
- #if defined(_KERNEL) || defined(KERNEL)
- /*
- * token ID 1 byte
- * file access mode 4 bytes
- * owner user ID 4 bytes
- * owner group ID 4 bytes
- * file system ID 4 bytes
- * node ID 8 bytes
- * device 4 bytes/8 bytes (32-bit/64-bit)
- */
- token_t *
- au_to_attr32(struct vnode_au_info *vni)
- {
- token_t *t;
- u_char *dptr = NULL;
- u_int16_t pad0_16 = 0;
- u_int32_t pad0_32 = 0;
- GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 2 * sizeof(u_int16_t) +
- 3 * sizeof(u_int32_t) + sizeof(u_int64_t) + sizeof(u_int32_t));
- ADD_U_CHAR(dptr, AUT_ATTR32);
- /*
- * BSD defines the size for the file mode as 2 bytes; BSM defines 4
- * so pad with 0.
- *
- * XXXRW: Possibly should be conditionally compiled.
- *
- * XXXRW: Should any conversions take place on the mode?
- */
- ADD_U_INT16(dptr, pad0_16);
- ADD_U_INT16(dptr, vni->vn_mode);
- ADD_U_INT32(dptr, vni->vn_uid);
- ADD_U_INT32(dptr, vni->vn_gid);
- ADD_U_INT32(dptr, vni->vn_fsid);
- /*
- * Some systems use 32-bit file ID's, others use 64-bit file IDs.
- * Attempt to handle both, and let the compiler sort it out. If we
- * could pick this out at compile-time, it would be better, so as to
- * avoid the else case below.
- */
- if (sizeof(vni->vn_fileid) == sizeof(uint32_t)) {
- ADD_U_INT32(dptr, pad0_32);
- ADD_U_INT32(dptr, vni->vn_fileid);
- } else if (sizeof(vni->vn_fileid) == sizeof(uint64_t))
- ADD_U_INT64(dptr, vni->vn_fileid);
- else
- ADD_U_INT64(dptr, 0LL);
- ADD_U_INT32(dptr, vni->vn_dev);
- return (t);
- }
- token_t *
- au_to_attr64(struct vnode_au_info *vni)
- {
- token_t *t;
- u_char *dptr = NULL;
- u_int16_t pad0_16 = 0;
- u_int32_t pad0_32 = 0;
- GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 2 * sizeof(u_int16_t) +
- 3 * sizeof(u_int32_t) + sizeof(u_int64_t) * 2);
- ADD_U_CHAR(dptr, AUT_ATTR64);
- /*
- * BSD defines the size for the file mode as 2 bytes; BSM defines 4
- * so pad with 0.
- *
- * XXXRW: Possibly should be conditionally compiled.
- *
- * XXXRW: Should any conversions take place on the mode?
- */
- ADD_U_INT16(dptr, pad0_16);
- ADD_U_INT16(dptr, vni->vn_mode);
- ADD_U_INT32(dptr, vni->vn_uid);
- ADD_U_INT32(dptr, vni->vn_gid);
- ADD_U_INT32(dptr, vni->vn_fsid);
- /*
- * Some systems use 32-bit file ID's, other's use 64-bit file IDs.
- * Attempt to handle both, and let the compiler sort it out. If we
- * could pick this out at compile-time, it would be better, so as to
- * avoid the else case below.
- */
- if (sizeof(vni->vn_fileid) == sizeof(uint32_t)) {
- ADD_U_INT32(dptr, pad0_32);
- ADD_U_INT32(dptr, vni->vn_fileid);
- } else if (sizeof(vni->vn_fileid) == sizeof(uint64_t))
- ADD_U_INT64(dptr, vni->vn_fileid);
- else
- ADD_U_INT64(dptr, 0LL);
- ADD_U_INT64(dptr, vni->vn_dev);
- return (t);
- }
- token_t *
- au_to_attr(struct vnode_au_info *vni)
- {
- return (au_to_attr32(vni));
- }
- #endif /* !(defined(_KERNEL) || defined(KERNEL) */
- /*
- * token ID 1 byte
- * how to print 1 byte
- * basic unit 1 byte
- * unit count 1 byte
- * data items (depends on basic unit)
- */
- token_t *
- au_to_data(char unit_print, char unit_type, char unit_count, const char *p)
- {
- token_t *t;
- u_char *dptr = NULL;
- size_t datasize, totdata;
- /* Determine the size of the basic unit. */
- switch (unit_type) {
- case AUR_BYTE:
- /* case AUR_CHAR: */
- datasize = AUR_BYTE_SIZE;
- break;
- case AUR_SHORT:
- datasize = AUR_SHORT_SIZE;
- break;
- case AUR_INT32:
- /* case AUR_INT: */
- datasize = AUR_INT32_SIZE;
- break;
- case AUR_INT64:
- datasize = AUR_INT64_SIZE;
- break;
- default:
- return (NULL);
- }
- totdata = datasize * unit_count;
- GET_TOKEN_AREA(t, dptr, 4 * sizeof(u_char) + totdata);
- /*
- * XXXRW: We should be byte-swapping each data item for multi-byte
- * types.
- */
- ADD_U_CHAR(dptr, AUT_DATA);
- ADD_U_CHAR(dptr, unit_print);
- ADD_U_CHAR(dptr, unit_type);
- ADD_U_CHAR(dptr, unit_count);
- ADD_MEM(dptr, p, totdata);
- return (t);
- }
- /*
- * token ID 1 byte
- * status 4 bytes
- * return value 4 bytes
- */
- token_t *
- au_to_exit(int retval, int err)
- {
- token_t *t;
- u_char *dptr = NULL;
- GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 2 * sizeof(u_int32_t));
- ADD_U_CHAR(dptr, AUT_EXIT);
- ADD_U_INT32(dptr, err);
- ADD_U_INT32(dptr, retval);
- return (t);
- }
- /*
- */
- token_t *
- au_to_groups(int *groups)
- {
- return (au_to_newgroups(AUDIT_MAX_GROUPS, (gid_t *)groups));
- }
- /*
- * token ID 1 byte
- * number groups 2 bytes
- * group list count * 4 bytes
- */
- token_t *
- au_to_newgroups(u_int16_t n, gid_t *groups)
- {
- token_t *t;
- u_char *dptr = NULL;
- int i;
- GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t) +
- n * sizeof(u_int32_t));
- ADD_U_CHAR(dptr, AUT_NEWGROUPS);
- ADD_U_INT16(dptr, n);
- for (i = 0; i < n; i++)
- ADD_U_INT32(dptr, groups[i]);
- return (t);
- }
- /*
- * token ID 1 byte
- * internet address 4 bytes
- */
- token_t *
- au_to_in_addr(struct in_addr *internet_addr)
- {
- token_t *t;
- u_char *dptr = NULL;
- GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(uint32_t));
- ADD_U_CHAR(dptr, AUT_IN_ADDR);
- ADD_MEM(dptr, &internet_addr->s_addr, sizeof(uint32_t));
- return (t);
- }
- /*
- * token ID 1 byte
- * address type/length 4 bytes
- * address 16 bytes
- */
- token_t *
- au_to_in_addr_ex(struct in6_addr *internet_addr)
- {
- token_t *t;
- u_char *dptr = NULL;
- u_int32_t type = AU_IPv6;
- GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 5 * sizeof(uint32_t));
- ADD_U_CHAR(dptr, AUT_IN_ADDR_EX);
- ADD_U_INT32(dptr, type);
- ADD_MEM(dptr, internet_addr, 4 * sizeof(uint32_t));
- return (t);
- }
- /*
- * token ID 1 byte
- * ip header 20 bytes
- *
- * The IP header should be submitted in network byte order.
- */
- token_t *
- au_to_ip(struct ip *ip)
- {
- token_t *t;
- u_char *dptr = NULL;
- GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(struct ip));
- ADD_U_CHAR(dptr, AUT_IP);
- ADD_MEM(dptr, ip, sizeof(struct ip));
- return (t);
- }
- /*
- * token ID 1 byte
- * object ID type 1 byte
- * object ID 4 bytes
- */
- token_t *
- au_to_ipc(char type, int id)
- {
- token_t *t;
- u_char *dptr = NULL;
- GET_TOKEN_AREA(t, dptr, 2 * sizeof(u_char) + sizeof(u_int32_t));
- ADD_U_CHAR(dptr, AUT_IPC);
- ADD_U_CHAR(dptr, type);
- ADD_U_INT32(dptr, id);
- return (t);
- }
- /*
- * token ID 1 byte
- * owner user ID 4 bytes
- * owner group ID 4 bytes
- * creator user ID 4 bytes
- * creator group ID 4 bytes
- * access mode 4 bytes
- * slot sequence # 4 bytes
- * key 4 bytes
- */
- token_t *
- au_to_ipc_perm(struct ipc_perm *perm)
- {
- token_t *t;
- u_char *dptr = NULL;
- u_int16_t pad0 = 0;
- GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 12 * sizeof(u_int16_t) +
- sizeof(u_int32_t));
- ADD_U_CHAR(dptr, AUT_IPC_PERM);
- /*
- * Systems vary significantly in what types they use in struct
- * ipc_perm; at least a few still use 16-bit uid's and gid's, so
- * allow for that, as BSM define 32-bit values here.
- * Some systems define the sizes for ipc_perm members as 2 bytes;
- * BSM defines 4 so pad with 0.
- *
- * XXXRW: Possibly shoulid be conditionally compiled, and more cases
- * need to be handled.
- */
- if (sizeof(perm->uid) != sizeof(u_int32_t)) {
- ADD_U_INT16(dptr, pad0);
- ADD_U_INT16(dptr, perm->uid);
- ADD_U_INT16(dptr, pad0);
- ADD_U_INT16(dptr, perm->gid);
- ADD_U_INT16(dptr, pad0);
- ADD_U_INT16(dptr, perm->cuid);
- ADD_U_INT16(dptr, pad0);
- ADD_U_INT16(dptr, perm->cgid);
- } else {
- ADD_U_INT32(dptr, perm->uid);
- ADD_U_INT32(dptr, perm->gid);
- ADD_U_INT32(dptr, perm->cuid);
- ADD_U_INT32(dptr, perm->cgid);
- }
- ADD_U_INT16(dptr, pad0);
- ADD_U_INT16(dptr, perm->mode);
- ADD_U_INT16(dptr, pad0);
- ADD_U_INT16(dptr, perm->seq);
- ADD_U_INT32(dptr, perm->key);
- return (t);
- }
- /*
- * token ID 1 byte
- * port IP address 2 bytes
- */
- token_t *
- au_to_iport(u_int16_t iport)
- {
- token_t *t;
- u_char *dptr = NULL;
- GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t));
- ADD_U_CHAR(dptr, AUT_IPORT);
- ADD_U_INT16(dptr, iport);
- return (t);
- }
- /*
- * token ID 1 byte
- * size 2 bytes
- * data size bytes
- */
- token_t *
- au_to_opaque(const char *data, u_int16_t bytes)
- {
- token_t *t;
- u_char *dptr = NULL;
- GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t) + bytes);
- ADD_U_CHAR(dptr, AUT_OPAQUE);
- ADD_U_INT16(dptr, bytes);
- ADD_MEM(dptr, data, bytes);
- return (t);
- }
- /*
- * token ID 1 byte
- * seconds of time 4 bytes
- * milliseconds of time 4 bytes
- * file name len 2 bytes
- * file pathname N bytes + 1 terminating NULL byte
- */
- token_t *
- au_to_file(const char *file, struct timeval tm)
- {
- token_t *t;
- u_char *dptr = NULL;
- u_int16_t filelen;
- u_int32_t timems;
- filelen = strlen(file);
- filelen += 1;
- GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 2 * sizeof(u_int32_t) +
- sizeof(u_int16_t) + filelen);
- timems = tm.tv_usec/1000;
- ADD_U_CHAR(dptr, AUT_OTHER_FILE32);
- ADD_U_INT32(dptr, tm.tv_sec);
- ADD_U_INT32(dptr, timems); /* We need time in ms. */
- ADD_U_INT16(dptr, filelen);
- ADD_STRING(dptr, file, filelen);
- return (t);
- }
- /*
- * token ID 1 byte
- * text length 2 bytes
- * text N bytes + 1 terminating NULL byte
- */
- token_t *
- au_to_text(const char *text)
- {
- token_t *t;
- u_char *dptr = NULL;
- u_int16_t textlen;
- textlen = strlen(text);
- textlen += 1;
- /* XXXRW: Should validate length against token size limit. */
- GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t) + textlen);
- ADD_U_CHAR(dptr, AUT_TEXT);
- ADD_U_INT16(dptr, textlen);
- ADD_STRING(dptr, text, textlen);
- return (t);
- }
- /*
- * token ID 1 byte
- * path length 2 bytes
- * path N bytes + 1 terminating NULL byte
- */
- token_t *
- au_to_path(const char *text)
- {
- token_t *t;
- u_char *dptr = NULL;
- u_int16_t textlen;
- textlen = strlen(text);
- textlen += 1;
- GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t) + textlen);
- ADD_U_CHAR(dptr, AUT_PATH);
- ADD_U_INT16(dptr, textlen);
- ADD_STRING(dptr, text, textlen);
- return (t);
- }
- /*
- * token ID 1 byte
- * audit ID 4 bytes
- * effective user ID 4 bytes
- * effective group ID 4 bytes
- * real user ID 4 bytes
- * real group ID 4 bytes
- * process ID 4 bytes
- * session ID 4 bytes
- * terminal ID
- * port ID 4 bytes/8 bytes (32-bit/64-bit value)
- * machine address 4 bytes
- */
- token_t *
- au_to_process32(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid, gid_t rgid,
- pid_t pid, au_asid_t sid, au_tid_t *tid)
- {
- token_t *t;
- u_char *dptr = NULL;
- GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 9 * sizeof(u_int32_t));
- ADD_U_CHAR(dptr, AUT_PROCESS32);
- ADD_U_INT32(dptr, auid);
- ADD_U_INT32(dptr, euid);
- ADD_U_INT32(dptr, egid);
- ADD_U_INT32(dptr, ruid);
- ADD_U_INT32(dptr, rgid);
- ADD_U_INT32(dptr, pid);
- ADD_U_INT32(dptr, sid);
- ADD_U_INT32(dptr, tid->port);
- /*
- * Note: Solaris will write out IPv6 addresses here as a 32-bit
- * address type and 16 bytes of address, but for IPv4 addresses it
- * simply writes the 4-byte address directly. We support only IPv4
- * addresses for process32 tokens.
- */
- ADD_MEM(dptr, &tid->machine, sizeof(u_int32_t));
- return (t);
- }
- token_t *
- au_to_process64(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid, gid_t rgid,
- pid_t pid, au_asid_t sid, au_tid_t *tid)
- {
- token_t *t;
- u_char *dptr = NULL;
- GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 8 * sizeof(u_int32_t) +
- sizeof(u_int64_t));
- ADD_U_CHAR(dptr, AUT_PROCESS64);
- ADD_U_INT32(dptr, auid);
- ADD_U_INT32(dptr, euid);
- ADD_U_INT32(dptr, egid);
- ADD_U_INT32(dptr, ruid);
- ADD_U_INT32(dptr, rgid);
- ADD_U_INT32(dptr, pid);
- ADD_U_INT32(dptr, sid);
- ADD_U_INT64(dptr, tid->port);
- /*
- * Note: Solaris will write out IPv6 addresses here as a 32-bit
- * address type and 16 bytes of address, but for IPv4 addresses it
- * simply writes the 4-byte address directly. We support only IPv4
- * addresses for process64 tokens.
- */
- ADD_MEM(dptr, &tid->machine, sizeof(u_int32_t));
- return (t);
- }
- token_t *
- au_to_process(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid, gid_t rgid,
- pid_t pid, au_asid_t sid, au_tid_t *tid)
- {
- return (au_to_process32(auid, euid, egid, ruid, rgid, pid, sid,
- tid));
- }
- /*
- * token ID 1 byte
- * audit ID 4 bytes
- * effective user ID 4 bytes
- * effective group ID 4 bytes
- * real user ID 4 bytes
- * real group ID 4 bytes
- * process ID 4 bytes
- * session ID 4 bytes
- * terminal ID
- * port ID 4 bytes/8 bytes (32-bit/64-bit value)
- * address type-len 4 bytes
- * machine address 16 bytes
- */
- token_t *
- au_to_process32_ex(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
- gid_t rgid, pid_t pid, au_asid_t sid, au_tid_addr_t *tid)
- {
- token_t *t;
- u_char *dptr = NULL;
- KASSERT((tid->at_type == AU_IPv4) || (tid->at_type == AU_IPv6),
- ("au_to_process32_ex: type %u", (unsigned int)tid->at_type));
- if (tid->at_type == AU_IPv4)
- GET_TOKEN_AREA(t, dptr, sizeof(u_char) +
- 10 * sizeof(u_int32_t));
- else
- GET_TOKEN_AREA(t, dptr, sizeof(u_char) +
- 13 * sizeof(u_int32_t));
- ADD_U_CHAR(dptr, AUT_PROCESS32_EX);
- ADD_U_INT32(dptr, auid);
- ADD_U_INT32(dptr, euid);
- ADD_U_INT32(dptr, egid);
- ADD_U_INT32(dptr, ruid);
- ADD_U_INT32(dptr, rgid);
- ADD_U_INT32(dptr, pid);
- ADD_U_INT32(dptr, sid);
- ADD_U_INT32(dptr, tid->at_port);
- ADD_U_INT32(dptr, tid->at_type);
- ADD_MEM(dptr, &tid->at_addr[0], sizeof(u_int32_t));
- if (tid->at_type == AU_IPv6) {
- ADD_MEM(dptr, &tid->at_addr[1], sizeof(u_int32_t));
- ADD_MEM(dptr, &tid->at_addr[2], sizeof(u_int32_t));
- ADD_MEM(dptr, &tid->at_addr[3], sizeof(u_int32_t));
- }
- return (t);
- }
- token_t *
- au_to_process64_ex(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
- gid_t rgid, pid_t pid, au_asid_t sid, au_tid_addr_t *tid)
- {
- token_t *t;
- u_char *dptr = NULL;
- if (tid->at_type == AU_IPv4)
- GET_TOKEN_AREA(t, dptr, sizeof(u_char) +
- 7 * sizeof(u_int32_t) + sizeof(u_int64_t) +
- 2 * sizeof(u_int32_t));
- else if (tid->at_type == AU_IPv6)
- GET_TOKEN_AREA(t, dptr, sizeof(u_char) +
- 7 * sizeof(u_int32_t) + sizeof(u_int64_t) +
- 5 * sizeof(u_int32_t));
- else
- panic("au_to_process64_ex: invalidate at_type (%d)",
- tid->at_type);
- ADD_U_CHAR(dptr, AUT_PROCESS64_EX);
- ADD_U_INT32(dptr, auid);
- ADD_U_INT32(dptr, euid);
- ADD_U_INT32(dptr, egid);
- ADD_U_INT32(dptr, ruid);
- ADD_U_INT32(dptr, rgid);
- ADD_U_INT32(dptr, pid);
- ADD_U_INT32(dptr, sid);
- ADD_U_INT64(dptr, tid->at_port);
- ADD_U_INT32(dptr, tid->at_type);
- ADD_MEM(dptr, &tid->at_addr[0], sizeof(u_int32_t));
- if (tid->at_type == AU_IPv6) {
- ADD_MEM(dptr, &tid->at_addr[1], sizeof(u_int32_t));
- ADD_MEM(dptr, &tid->at_addr[2], sizeof(u_int32_t));
- ADD_MEM(dptr, &tid->at_addr[3], sizeof(u_int32_t));
- }
- return (t);
- }
- token_t *
- au_to_process_ex(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
- gid_t rgid, pid_t pid, au_asid_t sid, au_tid_addr_t *tid)
- {
- return (au_to_process32_ex(auid, euid, egid, ruid, rgid, pid, sid,
- tid));
- }
- token_t *
- au_to_rights(cap_rights_t *rightsp)
- {
- token_t *t;
- u_char *dptr;
- int i;
- GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(*rightsp));
- ADD_U_CHAR(dptr, AUT_RIGHTS);
- for (i = 0; i < nitems(rightsp->cr_rights); i++)
- ADD_U_INT64(dptr, rightsp->cr_rights[i]);
- return (t);
- }
- /*
- * token ID 1 byte
- * error status 1 byte
- * return value 4 bytes/8 bytes (32-bit/64-bit value)
- */
- token_t *
- au_to_return32(char status, u_int32_t ret)
- {
- token_t *t;
- u_char *dptr = NULL;
- GET_TOKEN_AREA(t, dptr, 2 * sizeof(u_char) + sizeof(u_int32_t));
- ADD_U_CHAR(dptr, AUT_RETURN32);
- ADD_U_CHAR(dptr, status);
- ADD_U_INT32(dptr, ret);
- return (t);
- }
- token_t *
- au_to_return64(char status, u_int64_t ret)
- {
- token_t *t;
- u_char *dptr = NULL;
- GET_TOKEN_AREA(t, dptr, 2 * sizeof(u_char) + sizeof(u_int64_t));
- ADD_U_CHAR(dptr, AUT_RETURN64);
- ADD_U_CHAR(dptr, status);
- ADD_U_INT64(dptr, ret);
- return (t);
- }
- token_t *
- au_to_return(char status, u_int32_t ret)
- {
- return (au_to_return32(status, ret));
- }
- /*
- * token ID 1 byte
- * sequence number 4 bytes
- */
- token_t *
- au_to_seq(long audit_count)
- {
- token_t *t;
- u_char *dptr = NULL;
- GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int32_t));
- ADD_U_CHAR(dptr, AUT_SEQ);
- ADD_U_INT32(dptr, audit_count);
- return (t);
- }
- /*
- * token ID 1 byte
- * socket domain 2 bytes
- * socket type 2 bytes
- * address type 2 byte
- * local port 2 bytes
- * local address 4 bytes/16 bytes (IPv4/IPv6 address)
- * remote port 2 bytes
- * remote address 4 bytes/16 bytes (IPv4/IPv6 address)
- *
- * Domain and type arguments to this routine are assumed to already have been
- * converted to the BSM constant space, so we don't do that here.
- */
- token_t *
- au_to_socket_ex(u_short so_domain, u_short so_type,
- struct sockaddr *sa_local, struct sockaddr *sa_remote)
- {
- token_t *t;
- u_char *dptr = NULL;
- struct sockaddr_in *sin;
- struct sockaddr_in6 *sin6;
- if (so_domain == AF_INET)
- GET_TOKEN_AREA(t, dptr, sizeof(u_char) +
- 5 * sizeof(u_int16_t) + 2 * sizeof(u_int32_t));
- else if (so_domain == AF_INET6)
- GET_TOKEN_AREA(t, dptr, sizeof(u_char) +
- 5 * sizeof(u_int16_t) + 8 * sizeof(u_int32_t));
- else
- return (NULL);
- ADD_U_CHAR(dptr, AUT_SOCKET_EX);
- ADD_U_INT16(dptr, au_domain_to_bsm(so_domain));
- ADD_U_INT16(dptr, au_socket_type_to_bsm(so_type));
- if (so_domain == AF_INET) {
- ADD_U_INT16(dptr, AU_IPv4);
- sin = (struct sockaddr_in *)sa_local;
- ADD_MEM(dptr, &sin->sin_port, sizeof(uint16_t));
- ADD_MEM(dptr, &sin->sin_addr.s_addr, sizeof(uint32_t));
- sin = (struct sockaddr_in *)sa_remote;
- ADD_MEM(dptr, &sin->sin_port, sizeof(uint16_t));
- ADD_MEM(dptr, &sin->sin_addr.s_addr, sizeof(uint32_t));
- } else {
- ADD_U_INT16(dptr, AU_IPv6);
- sin6 = (struct sockaddr_in6 *)sa_local;
- ADD_MEM(dptr, &sin6->sin6_port, sizeof(uint16_t));
- ADD_MEM(dptr, &sin6->sin6_addr, 4 * sizeof(uint32_t));
- sin6 = (struct sockaddr_in6 *)sa_remote;
- ADD_MEM(dptr, &sin6->sin6_port, sizeof(uint16_t));
- ADD_MEM(dptr, &sin6->sin6_addr, 4 * sizeof(uint32_t));
- }
- return (t);
- }
- /*
- * Kernel-specific version of the above function.
- *
- * XXXRW: Should now use au_to_socket_ex() here.
- */
- #ifdef _KERNEL
- token_t *
- kau_to_socket(struct socket_au_info *soi)
- {
- token_t *t;
- u_char *dptr;
- u_int16_t so_type;
- GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 2 * sizeof(u_int16_t) +
- sizeof(u_int32_t) + sizeof(u_int16_t) + sizeof(u_int32_t));
-
- ADD_U_CHAR(dptr, AUT_SOCKET);
- /* Coerce the socket type into a short value */
- so_type = soi->so_type;
- ADD_U_INT16(dptr, so_type);
- ADD_U_INT16(dptr, soi->so_lport);
- ADD_U_INT32(dptr, soi->so_laddr);
- ADD_U_INT16(dptr, soi->so_rport);
- ADD_U_INT32(dptr, soi->so_raddr);
- return (t);
- }
- #endif
- /*
- * token ID 1 byte
- * socket family 2 bytes
- * path (up to) 104 bytes + NULL (NULL terminated string)
- */
- token_t *
- au_to_sock_unix(struct sockaddr_un *so)
- {
- token_t *t;
- u_char *dptr;
- GET_TOKEN_AREA(t, dptr, 3 * sizeof(u_char) + strlen(so->sun_path) + 1);
- ADD_U_CHAR(dptr, AUT_SOCKUNIX);
- /* BSM token has two bytes for family */
- ADD_U_CHAR(dptr, 0);
- ADD_U_CHAR(dptr, so->sun_family);
- ADD_STRING(dptr, so->sun_path, strlen(so->sun_path) + 1);
- return (t);
- }
- /*
- * token ID 1 byte
- * socket family 2 bytes
- * local port 2 bytes
- * socket address 4 bytes
- */
- token_t *
- au_to_sock_inet32(struct sockaddr_in *so)
- {
- token_t *t;
- u_char *dptr = NULL;
- uint16_t family;
- GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 2 * sizeof(uint16_t) +
- sizeof(uint32_t));
- ADD_U_CHAR(dptr, AUT_SOCKINET32);
- /*
- * BSM defines the family field as 16 bits, but many operating
- * systems have an 8-bit sin_family field. Extend to 16 bits before
- * writing into the token. Assume that both the port and the address
- * in the sockaddr_in are already in network byte order, but family
- * is in local byte order.
- *
- * XXXRW: Should a name space conversion be taking place on the value
- * of sin_family?
- */
- family = so->sin_family;
- ADD_U_INT16(dptr, family);
- ADD_MEM(dptr, &so->sin_port, sizeof(uint16_t));
- ADD_MEM(dptr, &so->sin_addr.s_addr, sizeof(uint32_t));
- return (t);
- }
- token_t *
- au_to_sock_inet128(struct sockaddr_in6 *so)
- {
- token_t *t;
- u_char *dptr = NULL;
- GET_TOKEN_AREA(t, dptr, 3 * sizeof(u_char) + sizeof(u_int16_t) +
- 4 * sizeof(u_int32_t));
- ADD_U_CHAR(dptr, AUT_SOCKINET128);
- /*
- * In BSD, sin6_family is one octet, but BSM defines the token to
- * store two. So we copy in a 0 first. XXXRW: Possibly should be
- * conditionally compiled.
- */
- ADD_U_CHAR(dptr, 0);
- ADD_U_CHAR(dptr, so->sin6_family);
- ADD_U_INT16(dptr, so->sin6_port);
- ADD_MEM(dptr, &so->sin6_addr, 4 * sizeof(uint32_t));
- return (t);
- }
- token_t *
- au_to_sock_inet(struct sockaddr_in *so)
- {
- return (au_to_sock_inet32(so));
- }
- /*
- * token ID 1 byte
- * audit ID 4 bytes
- * effective user ID 4 bytes
- * effective group ID 4 bytes
- * real user ID 4 bytes
- * real group ID 4 bytes
- * process ID 4 bytes
- * session ID 4 bytes
- * terminal ID
- * port ID 4 bytes/8 bytes (32-bit/64-bit value)
- * machine address 4 bytes
- */
- token_t *
- au_to_subject32(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid, gid_t rgid,
- pid_t pid, au_asid_t sid, au_tid_t *tid)
- {
- token_t *t;
- u_char *dptr = NULL;
- GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 9 * sizeof(u_int32_t));
- ADD_U_CHAR(dptr, AUT_SUBJECT32);
- ADD_U_INT32(dptr, auid);
- ADD_U_INT32(dptr, euid);
- ADD_U_INT32(dptr, egid);
- ADD_U_INT32(dptr, ruid);
- ADD_U_INT32(dptr, rgid);
- ADD_U_INT32(dptr, pid);
- ADD_U_INT32(dptr, sid);
- ADD_U_INT32(dptr, tid->port);
- ADD_MEM(dptr, &tid->machine, sizeof(u_int32_t));
- return (t);
- }
- token_t *
- au_to_subject64(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid, gid_t rgid,
- pid_t pid, au_asid_t sid, au_tid_t *tid)
- {
- token_t *t;
- u_char *dptr = NULL;
- GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 7 * sizeof(u_int32_t) +
- sizeof(u_int64_t) + sizeof(u_int32_t));
- ADD_U_CHAR(dptr, AUT_SUBJECT64);
- ADD_U_INT32(dptr, auid);
- ADD_U_INT32(dptr, euid);
- ADD_U_INT32(dptr, egid);
- ADD_U_INT32(dptr, ruid);
- ADD_U_INT32(dptr, rgid);
- ADD_U_INT32(dptr, pid);
- ADD_U_INT32(dptr, sid);
- ADD_U_INT64(dptr, tid->port);
- ADD_MEM(dptr, &tid->machine, sizeof(u_int32_t));
- return (t);
- }
- token_t *
- au_to_subject(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid, gid_t rgid,
- pid_t pid, au_asid_t sid, au_tid_t *tid)
- {
- return (au_to_subject32(auid, euid, egid, ruid, rgid, pid, sid,
- tid));
- }
- /*
- * token ID 1 byte
- * audit ID 4 bytes
- * effective user ID 4 bytes
- * effective group ID 4 bytes
- * real user ID 4 bytes
- * real group ID 4 bytes
- * process ID 4 bytes
- * session ID 4 bytes
- * terminal ID
- * port ID 4 bytes/8 bytes (32-bit/64-bit value)
- * address type/length 4 bytes
- * machine address 16 bytes
- */
- token_t *
- au_to_subject32_ex(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
- gid_t rgid, pid_t pid, au_asid_t sid, au_tid_addr_t *tid)
- {
- token_t *t;
- u_char *dptr = NULL;
- KASSERT((tid->at_type == AU_IPv4) || (tid->at_type == AU_IPv6),
- ("au_to_subject32_ex: type %u", (unsigned int)tid->at_type));
- if (tid->at_type == AU_IPv4)
- GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 10 *
- sizeof(u_int32_t));
- else
- GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 13 *
- sizeof(u_int32_t));
- ADD_U_CHAR(dptr, AUT_SUBJECT32_EX);
- ADD_U_INT32(dptr, auid);
- ADD_U_INT32(dptr, euid);
- ADD_U_INT32(dptr, egid);
- ADD_U_INT32(dptr, ruid);
- ADD_U_INT32(dptr, rgid);
- ADD_U_INT32(dptr, pid);
- ADD_U_INT32(dptr, sid);
- ADD_U_INT32(dptr, tid->at_port);
- ADD_U_INT32(dptr, tid->at_type);
- if (tid->at_type == AU_IPv6)
- ADD_MEM(dptr, &tid->at_addr[0], 4 * sizeof(u_int32_t));
- else
- ADD_MEM(dptr, &tid->at_addr[0], sizeof(u_int32_t));
- return (t);
- }
- token_t *
- au_to_subject64_ex(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
- gid_t rgid, pid_t pid, au_asid_t sid, au_tid_addr_t *tid)
- {
- token_t *t;
- u_char *dptr = NULL;
- KASSERT((tid->at_type == AU_IPv4) || (tid->at_type == AU_IPv6),
- ("au_to_subject64_ex: type %u", (unsigned int)tid->at_type));
- if (tid->at_type == AU_IPv4)
- GET_TOKEN_AREA(t, dptr, sizeof(u_char) +
- 7 * sizeof(u_int32_t) + sizeof(u_int64_t) +
- 2 * sizeof(u_int32_t));
- else
- GET_TOKEN_AREA(t, dptr, sizeof(u_char) +
- 7 * sizeof(u_int32_t) + sizeof(u_int64_t) +
- 5 * sizeof(u_int32_t));
- ADD_U_CHAR(dptr, AUT_SUBJECT64_EX);
- ADD_U_INT32(dptr, auid);
- ADD_U_INT32(dptr, euid);
- ADD_U_INT32(dptr, egid);
- ADD_U_INT32(dptr, ruid);
- ADD_U_INT32(dptr, rgid);
- ADD_U_INT32(dptr, pid);
- ADD_U_INT32(dptr, sid);
- ADD_U_INT64(dptr, tid->at_port);
- ADD_U_INT32(dptr, tid->at_type);
- if (tid->at_type == AU_IPv6)
- ADD_MEM(dptr, &tid->at_addr[0], 4 * sizeof(u_int32_t));
- else
- ADD_MEM(dptr, &tid->at_addr[0], sizeof(u_int32_t));
- return (t);
- }
- token_t *
- au_to_subject_ex(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
- gid_t rgid, pid_t pid, au_asid_t sid, au_tid_addr_t *tid)
- {
- return (au_to_subject32_ex(auid, euid, egid, ruid, rgid, pid, sid,
- tid));
- }
- #if !defined(_KERNEL) && !defined(KERNEL) && defined(HAVE_AUDIT_SYSCALLS)
- /*
- * Collects audit information for the current process and creates a subject
- * token from it.
- */
- token_t *
- au_to_me(void)
- {
- auditinfo_t auinfo;
- auditinfo_addr_t aia;
- /*
- * Try to use getaudit_addr(2) first. If this kernel does not support
- * it, then fall back on to getaudit(2).
- */
- if (getaudit_addr(&aia, sizeof(aia)) != 0) {
- if (errno == ENOSYS) {
- if (getaudit(&auinfo) != 0)
- return (NULL);
- return (au_to_subject32(auinfo.ai_auid, geteuid(),
- getegid(), getuid(), getgid(), getpid(),
- auinfo.ai_asid, &auinfo.ai_termid));
- } else {
- /* getaudit_addr(2) failed for some other reason. */
- return (NULL);
- }
- }
- return (au_to_subject32_ex(aia.ai_auid, geteuid(), getegid(), getuid(),
- getgid(), getpid(), aia.ai_asid, &aia.ai_termid));
- }
- #endif
- #if defined(_KERNEL) || defined(KERNEL)
- static token_t *
- au_to_exec_strings(char *strs, int count, u_char type)
- {
- token_t *t;
- u_char *dptr = NULL;
- u_int32_t totlen;
- int ctr;
- char *p;
- totlen = 0;
- ctr = count;
- p = strs;
- while (ctr-- > 0) {
- totlen += strlen(p) + 1;
- p = strs + totlen;
- }
- GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int32_t) + totlen);
- ADD_U_CHAR(dptr, type);
- ADD_U_INT32(dptr, count);
- ADD_STRING(dptr, strs, totlen);
- return (t);
- }
- /*
- * token ID 1 byte
- * count 4 bytes
- * text count null-terminated strings
- */
- token_t *
- au_to_exec_args(char *args, int argc)
- {
- return (au_to_exec_strings(args, argc, AUT_EXEC_ARGS));
- }
- /*
- * token ID 1 byte
- * count 4 bytes
- * text count null-terminated strings
- */
- token_t *
- au_to_exec_env(char *envs, int envc)
- {
- return (au_to_exec_strings(envs, envc, AUT_EXEC_ENV));
- }
- #else
- /*
- * token ID 1 byte
- * count 4 bytes
- * text count null-terminated strings
- */
- token_t *
- au_to_exec_args(char **argv)
- {
- token_t *t;
- u_char *dptr = NULL;
- const char *nextarg;
- int i, count = 0;
- size_t totlen = 0;
- nextarg = *argv;
- while (nextarg != NULL) {
- int nextlen;
- nextlen = strlen(nextarg);
- totlen += nextlen + 1;
- count++;
- nextarg = *(argv + count);
- }
- GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int32_t) + totlen);
- ADD_U_CHAR(dptr, AUT_EXEC_ARGS);
- ADD_U_INT32(dptr, count);
- for (i = 0; i < count; i++) {
- nextarg = *(argv + i);
- ADD_MEM(dptr, nextarg, strlen(nextarg) + 1);
- }
- return (t);
- }
- /*
- * token ID 1 byte
- * count 4 bytes
- * text count null-terminated strings
- */
- token_t *
- au_to_exec_env(char **envp)
- {
- token_t *t;
- u_char *dptr = NULL;
- int i, count = 0;
- size_t totlen = 0;
- const char *nextenv;
- nextenv = *envp;
- while (nextenv != NULL) {
- int nextlen;
- nextlen = strlen(nextenv);
- totlen += nextlen + 1;
- count++;
- nextenv = *(envp + count);
- }
- GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int32_t) + totlen);
- ADD_U_CHAR(dptr, AUT_EXEC_ENV);
- ADD_U_INT32(dptr, count);
- for (i = 0; i < count; i++) {
- nextenv = *(envp + i);
- ADD_MEM(dptr, nextenv, strlen(nextenv) + 1);
- }
- return (t);
- }
- #endif
- /*
- * token ID 1 byte
- * zonename length 2 bytes
- * zonename N bytes + 1 terminating NULL byte
- */
- token_t *
- au_to_zonename(const char *zonename)
- {
- u_char *dptr = NULL;
- u_int16_t textlen;
- token_t *t;
- textlen = strlen(zonename) + 1;
- GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t) + textlen);
- ADD_U_CHAR(dptr, AUT_ZONENAME);
- ADD_U_INT16(dptr, textlen);
- ADD_STRING(dptr, zonename, textlen);
- return (t);
- }
- /*
- * token ID 1 byte
- * record byte count 4 bytes
- * version # 1 byte [2]
- * event type 2 bytes
- * event modifier 2 bytes
- * seconds of time 4 bytes/8 bytes (32-bit/64-bit value)
- * milliseconds of time 4 bytes/8 bytes (32-bit/64-bit value)
- */
- token_t *
- au_to_header32_tm(int rec_size, au_event_t e_type, au_emod_t e_mod,
- struct timeval tm)
- {
- token_t *t;
- u_char *dptr = NULL;
- u_int32_t timems;
- GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int32_t) +
- sizeof(u_char) + 2 * sizeof(u_int16_t) + 2 * sizeof(u_int32_t));
- ADD_U_CHAR(dptr, AUT_HEADER32);
- ADD_U_INT32(dptr, rec_size);
- ADD_U_CHAR(dptr, AUDIT_HEADER_VERSION_OPENBSM);
- ADD_U_INT16(dptr, e_type);
- ADD_U_INT16(dptr, e_mod);
- timems = tm.tv_usec/1000;
- /* Add the timestamp */
- ADD_U_INT32(dptr, tm.tv_sec);
- ADD_U_INT32(dptr, timems); /* We need time in ms. */
- return (t);
- }
- /*
- * token ID 1 byte
- * record byte count 4 bytes
- * version # 1 byte [2]
- * event type 2 bytes
- * event modifier 2 bytes
- * address type/length 4 bytes
- * machine address 4 bytes/16 bytes (IPv4/IPv6 address)
- * seconds of time 4 bytes/8 bytes (32-bit/64-bit value)
- * milliseconds of time 4 bytes/8 bytes (32-bit/64-bit value)
- */
- token_t *
- au_to_header32_ex_tm(int rec_size, au_event_t e_type, au_emod_t e_mod,
- struct timeval tm, struct auditinfo_addr *aia)
- {
- token_t *t;
- u_char *dptr = NULL;
- u_int32_t timems;
- au_tid_addr_t *tid;
- tid = &aia->ai_termid;
- KASSERT(tid->at_type == AU_IPv4 || tid->at_type == AU_IPv6,
- ("au_to_header32_ex_tm: invalid address family"));
- GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int32_t) +
- sizeof(u_char) + 2 * sizeof(u_int16_t) + 3 *
- sizeof(u_int32_t) + tid->at_type);
- ADD_U_CHAR(dptr, AUT_HEADER32_EX);
- ADD_U_INT32(dptr, rec_size);
- ADD_U_CHAR(dptr, AUDIT_HEADER_VERSION_OPENBSM);
- ADD_U_INT16(dptr, e_type);
- ADD_U_INT16(dptr, e_mod);
- ADD_U_INT32(dptr, tid->at_type);
- if (tid->at_type == AU_IPv6)
- ADD_MEM(dptr, &tid->at_addr[0], 4 * sizeof(u_int32_t));
- else
- ADD_MEM(dptr, &tid->at_addr[0], sizeof(u_int32_t));
- timems = tm.tv_usec/1000;
- /* Add the timestamp */
- ADD_U_INT32(dptr, tm.tv_sec);
- ADD_U_INT32(dptr, timems); /* We need time in ms. */
- return (t);
- }
- token_t *
- au_to_header64_tm(int rec_size, au_event_t e_type, au_emod_t e_mod,
- struct timeval tm)
- {
- token_t *t;
- u_char *dptr = NULL;
- u_int32_t timems;
- GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int32_t) +
- sizeof(u_char) + 2 * sizeof(u_int16_t) + 2 * sizeof(u_int64_t));
- ADD_U_CHAR(dptr, AUT_HEADER64);
- ADD_U_INT32(dptr, rec_size);
- ADD_U_CHAR(dptr, AUDIT_HEADER_VERSION_OPENBSM);
- ADD_U_INT16(dptr, e_type);
- ADD_U_INT16(dptr, e_mod);
- timems = tm.tv_usec/1000;
- /* Add the timestamp */
- ADD_U_INT64(dptr, tm.tv_sec);
- ADD_U_INT64(dptr, timems); /* We need time in ms. */
- return (t);
- }
- #if !defined(KERNEL) && !defined(_KERNEL)
- #ifdef HAVE_AUDIT_SYSCALLS
- token_t *
- au_to_header32_ex(int rec_size, au_event_t e_type, au_emod_t e_mod)
- {
- struct timeval tm;
- struct auditinfo_addr aia;
- if (gettimeofday(&tm, NULL) == -1)
- return (NULL);
- if (audit_get_kaudit(&aia, sizeof(aia)) != 0) {
- if (errno != ENOSYS)
- return (NULL);
- return (au_to_header32_tm(rec_size, e_type, e_mod, tm));
- }
- return (au_to_header32_ex_tm(rec_size, e_type, e_mod, tm, &aia));
- }
- #endif /* HAVE_AUDIT_SYSCALLS */
- token_t *
- au_to_header32(int rec_size, au_event_t e_type, au_emod_t e_mod)
- {
- struct timeval tm;
- if (gettimeofday(&tm, NULL) == -1)
- return (NULL);
- return (au_to_header32_tm(rec_size, e_type, e_mod, tm));
- }
- token_t *
- au_to_header64(__unused int rec_size, __unused au_event_t e_type,
- __unused au_emod_t e_mod)
- {
- struct timeval tm;
- if (gettimeofday(&tm, NULL) == -1)
- return (NULL);
- return (au_to_header64_tm(rec_size, e_type, e_mod, tm));
- }
- token_t *
- au_to_header(int rec_size, au_event_t e_type, au_emod_t e_mod)
- {
- return (au_to_header32(rec_size, e_type, e_mod));
- }
- #ifdef HAVE_AUDIT_SYSCALLS
- token_t *
- au_to_header_ex(int rec_size, au_event_t e_type, au_emod_t e_mod)
- {
- return (au_to_header32_ex(rec_size, e_type, e_mod));
- }
- #endif /* HAVE_AUDIT_SYSCALLS */
- #endif /* !defined(KERNEL) && !defined(_KERNEL) */
- /*
- * token ID 1 byte
- * trailer magic number 2 bytes
- * record byte count 4 bytes
- */
- token_t *
- au_to_trailer(int rec_size)
- {
- token_t *t;
- u_char *dptr = NULL;
- u_int16_t magic = AUT_TRAILER_MAGIC;
- GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t) +
- sizeof(u_int32_t));
- ADD_U_CHAR(dptr, AUT_TRAILER);
- ADD_U_INT16(dptr, magic);
- ADD_U_INT32(dptr, rec_size);
- return (t);
- }
|