1 /*
2 * SPDX-License-Identifier: BSD-3-Clause
3 *
4 * Copyright (c) 1999-2009 Apple Inc.
5 * Copyright (c) 2016-2017 Robert N. M. Watson
6 * All rights reserved.
7 *
8 * Portions of this software were developed by BAE Systems, the University of
9 * Cambridge Computer Laboratory, and Memorial University under DARPA/AFRL
10 * contract FA8650-15-C-7558 ("CADETS"), as part of the DARPA Transparent
11 * Computing (TC) research program.
12 *
13 * Redistribution and use in source and binary forms, with or without
14 * modification, are permitted provided that the following conditions
15 * are met:
16 * 1. Redistributions of source code must retain the above copyright
17 * notice, this list of conditions and the following disclaimer.
18 * 2. Redistributions in binary form must reproduce the above copyright
19 * notice, this list of conditions and the following disclaimer in the
20 * documentation and/or other materials provided with the distribution.
21 * 3. Neither the name of Apple Inc. ("Apple") nor the names of
22 * its contributors may be used to endorse or promote products derived
23 * from this software without specific prior written permission.
24 *
25 * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND
26 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
27 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
28 * ARE DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR
29 * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
30 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
31 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
32 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
33 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
34 * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
35 * POSSIBILITY OF SUCH DAMAGE.
36 */
37
38 #include <sys/cdefs.h>
39 __FBSDID("$FreeBSD$");
40
41 #include <sys/param.h>
42 #include <sys/vnode.h>
43 #include <sys/ipc.h>
44 #include <sys/lock.h>
45 #include <sys/malloc.h>
46 #include <sys/mutex.h>
47 #include <sys/socket.h>
48 #include <sys/extattr.h>
49 #include <sys/fcntl.h>
50 #include <sys/user.h>
51 #include <sys/systm.h>
52
53 #include <bsm/audit.h>
54 #include <bsm/audit_internal.h>
55 #include <bsm/audit_record.h>
56 #include <bsm/audit_kevents.h>
57
58 #include <security/audit/audit.h>
59 #include <security/audit/audit_private.h>
60
61 #include <netinet/in_systm.h>
62 #include <netinet/in.h>
63 #include <netinet/ip.h>
64
65 MALLOC_DEFINE(M_AUDITBSM, "audit_bsm", "Audit BSM data");
66
67 static void audit_sys_auditon(struct audit_record *ar,
68 struct au_record *rec);
69
70 /*
71 * Initialize the BSM auditing subsystem.
72 */
73 void
kau_init(void)74 kau_init(void)
75 {
76
77 au_evclassmap_init();
78 au_evnamemap_init();
79 }
80
81 /*
82 * This call reserves memory for the audit record. Memory must be guaranteed
83 * before any auditable event can be generated. The au_record structure
84 * maintains a reference to the memory allocated above and also the list of
85 * tokens associated with this record.
86 */
87 static struct au_record *
kau_open(void)88 kau_open(void)
89 {
90 struct au_record *rec;
91
92 rec = malloc(sizeof(*rec), M_AUDITBSM, M_WAITOK);
93 rec->data = NULL;
94 TAILQ_INIT(&rec->token_q);
95 rec->len = 0;
96 rec->used = 1;
97
98 return (rec);
99 }
100
101 /*
102 * Store the token with the record descriptor.
103 */
104 static void
kau_write(struct au_record * rec,struct au_token * tok)105 kau_write(struct au_record *rec, struct au_token *tok)
106 {
107
108 KASSERT(tok != NULL, ("kau_write: tok == NULL"));
109
110 TAILQ_INSERT_TAIL(&rec->token_q, tok, tokens);
111 rec->len += tok->len;
112 }
113
114 /*
115 * Close out the audit record by adding the header token, identifying any
116 * missing tokens. Write out the tokens to the record memory.
117 */
118 static void
kau_close(struct au_record * rec,struct timespec * ctime,short event)119 kau_close(struct au_record *rec, struct timespec *ctime, short event)
120 {
121 u_char *dptr;
122 size_t tot_rec_size;
123 token_t *cur, *hdr, *trail;
124 struct timeval tm;
125 size_t hdrsize;
126 struct auditinfo_addr ak;
127 struct in6_addr *ap;
128
129 audit_get_kinfo(&ak);
130 hdrsize = 0;
131 switch (ak.ai_termid.at_type) {
132 case AU_IPv4:
133 hdrsize = (ak.ai_termid.at_addr[0] == INADDR_ANY) ?
134 AUDIT_HEADER_SIZE : AUDIT_HEADER_EX_SIZE(&ak);
135 break;
136 case AU_IPv6:
137 ap = (struct in6_addr *)&ak.ai_termid.at_addr[0];
138 hdrsize = (IN6_IS_ADDR_UNSPECIFIED(ap)) ? AUDIT_HEADER_SIZE :
139 AUDIT_HEADER_EX_SIZE(&ak);
140 break;
141 default:
142 panic("kau_close: invalid address family");
143 }
144 tot_rec_size = rec->len + hdrsize + AUDIT_TRAILER_SIZE;
145 rec->data = malloc(tot_rec_size, M_AUDITBSM, M_WAITOK | M_ZERO);
146
147 tm.tv_usec = ctime->tv_nsec / 1000;
148 tm.tv_sec = ctime->tv_sec;
149 if (hdrsize != AUDIT_HEADER_SIZE)
150 hdr = au_to_header32_ex_tm(tot_rec_size, event, 0, tm, &ak);
151 else
152 hdr = au_to_header32_tm(tot_rec_size, event, 0, tm);
153 TAILQ_INSERT_HEAD(&rec->token_q, hdr, tokens);
154
155 trail = au_to_trailer(tot_rec_size);
156 TAILQ_INSERT_TAIL(&rec->token_q, trail, tokens);
157
158 rec->len = tot_rec_size;
159 dptr = rec->data;
160 TAILQ_FOREACH(cur, &rec->token_q, tokens) {
161 memcpy(dptr, cur->t_data, cur->len);
162 dptr += cur->len;
163 }
164 }
165
166 /*
167 * Free a BSM audit record by releasing all the tokens and clearing the audit
168 * record information.
169 */
170 void
kau_free(struct au_record * rec)171 kau_free(struct au_record *rec)
172 {
173 struct au_token *tok;
174
175 /* Free the token list. */
176 while ((tok = TAILQ_FIRST(&rec->token_q))) {
177 TAILQ_REMOVE(&rec->token_q, tok, tokens);
178 free(tok->t_data, M_AUDITBSM);
179 free(tok, M_AUDITBSM);
180 }
181
182 rec->used = 0;
183 rec->len = 0;
184 free(rec->data, M_AUDITBSM);
185 free(rec, M_AUDITBSM);
186 }
187
188 /*
189 * XXX: May want turn some (or all) of these macros into functions in order
190 * to reduce the generated code size.
191 *
192 * XXXAUDIT: These macros assume that 'kar', 'ar', 'rec', and 'tok' in the
193 * caller are OK with this.
194 */
195 #define ATFD1_TOKENS(argnum) do { \
196 if (ARG_IS_VALID(kar, ARG_ATFD1)) { \
197 tok = au_to_arg32(argnum, "at fd 1", ar->ar_arg_atfd1); \
198 kau_write(rec, tok); \
199 } \
200 } while (0)
201
202 #define ATFD2_TOKENS(argnum) do { \
203 if (ARG_IS_VALID(kar, ARG_ATFD2)) { \
204 tok = au_to_arg32(argnum, "at fd 2", ar->ar_arg_atfd2); \
205 kau_write(rec, tok); \
206 } \
207 } while (0)
208
209 #define UPATH1_TOKENS do { \
210 if (ARG_IS_VALID(kar, ARG_UPATH1)) { \
211 tok = au_to_path(ar->ar_arg_upath1); \
212 kau_write(rec, tok); \
213 } \
214 } while (0)
215
216 #define UPATH2_TOKENS do { \
217 if (ARG_IS_VALID(kar, ARG_UPATH2)) { \
218 tok = au_to_path(ar->ar_arg_upath2); \
219 kau_write(rec, tok); \
220 } \
221 } while (0)
222
223 #define VNODE1_TOKENS do { \
224 if (ARG_IS_VALID(kar, ARG_ATFD)) { \
225 tok = au_to_arg32(1, "at fd", ar->ar_arg_atfd); \
226 kau_write(rec, tok); \
227 } \
228 if (ARG_IS_VALID(kar, ARG_VNODE1)) { \
229 tok = au_to_attr32(&ar->ar_arg_vnode1); \
230 kau_write(rec, tok); \
231 } \
232 } while (0)
233
234 #define UPATH1_VNODE1_TOKENS do { \
235 UPATH1_TOKENS; \
236 if (ARG_IS_VALID(kar, ARG_VNODE1)) { \
237 tok = au_to_attr32(&ar->ar_arg_vnode1); \
238 kau_write(rec, tok); \
239 } \
240 } while (0)
241
242 #define VNODE2_TOKENS do { \
243 if (ARG_IS_VALID(kar, ARG_VNODE2)) { \
244 tok = au_to_attr32(&ar->ar_arg_vnode2); \
245 kau_write(rec, tok); \
246 } \
247 } while (0)
248
249 #define FD_VNODE1_TOKENS do { \
250 if (ARG_IS_VALID(kar, ARG_VNODE1)) { \
251 if (ARG_IS_VALID(kar, ARG_FD)) { \
252 tok = au_to_arg32(1, "fd", ar->ar_arg_fd); \
253 kau_write(rec, tok); \
254 } \
255 tok = au_to_attr32(&ar->ar_arg_vnode1); \
256 kau_write(rec, tok); \
257 } else { \
258 if (ARG_IS_VALID(kar, ARG_FD)) { \
259 tok = au_to_arg32(1, "non-file: fd", \
260 ar->ar_arg_fd); \
261 kau_write(rec, tok); \
262 } \
263 } \
264 } while (0)
265
266 #define PROCESS_PID_TOKENS(argn) do { \
267 if ((ar->ar_arg_pid > 0) /* Reference a single process */ \
268 && (ARG_IS_VALID(kar, ARG_PROCESS))) { \
269 tok = au_to_process32_ex(ar->ar_arg_auid, \
270 ar->ar_arg_euid, ar->ar_arg_egid, \
271 ar->ar_arg_ruid, ar->ar_arg_rgid, \
272 ar->ar_arg_pid, ar->ar_arg_asid, \
273 &ar->ar_arg_termid_addr); \
274 kau_write(rec, tok); \
275 } else if (ARG_IS_VALID(kar, ARG_PID)) { \
276 tok = au_to_arg32(argn, "process", ar->ar_arg_pid); \
277 kau_write(rec, tok); \
278 } \
279 } while (0)
280
281 #define EXTATTR_TOKENS(namespace_argnum) do { \
282 if (ARG_IS_VALID(kar, ARG_VALUE)) { \
283 switch (ar->ar_arg_value) { \
284 case EXTATTR_NAMESPACE_USER: \
285 tok = au_to_text(EXTATTR_NAMESPACE_USER_STRING);\
286 break; \
287 case EXTATTR_NAMESPACE_SYSTEM: \
288 tok = au_to_text(EXTATTR_NAMESPACE_SYSTEM_STRING);\
289 break; \
290 default: \
291 tok = au_to_arg32((namespace_argnum), \
292 "attrnamespace", ar->ar_arg_value); \
293 break; \
294 } \
295 kau_write(rec, tok); \
296 } \
297 /* attrname is in the text field */ \
298 if (ARG_IS_VALID(kar, ARG_TEXT)) { \
299 tok = au_to_text(ar->ar_arg_text); \
300 kau_write(rec, tok); \
301 } \
302 } while (0)
303
304 /*
305 * Not all pointer arguments to system calls are of interest, but in some
306 * cases they reflect delegation of rights, such as mmap(2) followed by
307 * minherit(2) before execve(2), so do the best we can.
308 */
309 #define ADDR_TOKEN(argnum, argname) do { \
310 if (ARG_IS_VALID(kar, ARG_ADDR)) { \
311 if (sizeof(void *) == sizeof(uint32_t)) \
312 tok = au_to_arg32((argnum), (argname), \
313 (uint32_t)(uintptr_t)ar->ar_arg_addr); \
314 else \
315 tok = au_to_arg64((argnum), (argname), \
316 (uint64_t)(uintptr_t)ar->ar_arg_addr); \
317 kau_write(rec, tok); \
318 } \
319 } while (0)
320
321
322 /*
323 * Implement auditing for the auditon() system call. The audit tokens that
324 * are generated depend on the command that was sent into the auditon()
325 * system call.
326 */
327 static void
audit_sys_auditon(struct audit_record * ar,struct au_record * rec)328 audit_sys_auditon(struct audit_record *ar, struct au_record *rec)
329 {
330 struct au_token *tok;
331
332 tok = au_to_arg32(3, "length", ar->ar_arg_len);
333 kau_write(rec, tok);
334 switch (ar->ar_arg_cmd) {
335 case A_OLDSETPOLICY:
336 if ((size_t)ar->ar_arg_len == sizeof(int64_t)) {
337 tok = au_to_arg64(2, "policy",
338 ar->ar_arg_auditon.au_policy64);
339 kau_write(rec, tok);
340 break;
341 }
342 /* FALLTHROUGH */
343
344 case A_SETPOLICY:
345 tok = au_to_arg32(2, "policy", ar->ar_arg_auditon.au_policy);
346 kau_write(rec, tok);
347 break;
348
349 case A_SETKMASK:
350 tok = au_to_arg32(2, "setkmask:as_success",
351 ar->ar_arg_auditon.au_mask.am_success);
352 kau_write(rec, tok);
353 tok = au_to_arg32(2, "setkmask:as_failure",
354 ar->ar_arg_auditon.au_mask.am_failure);
355 kau_write(rec, tok);
356 break;
357
358 case A_OLDSETQCTRL:
359 if ((size_t)ar->ar_arg_len == sizeof(au_qctrl64_t)) {
360 tok = au_to_arg64(2, "setqctrl:aq_hiwater",
361 ar->ar_arg_auditon.au_qctrl64.aq64_hiwater);
362 kau_write(rec, tok);
363 tok = au_to_arg64(2, "setqctrl:aq_lowater",
364 ar->ar_arg_auditon.au_qctrl64.aq64_lowater);
365 kau_write(rec, tok);
366 tok = au_to_arg64(2, "setqctrl:aq_bufsz",
367 ar->ar_arg_auditon.au_qctrl64.aq64_bufsz);
368 kau_write(rec, tok);
369 tok = au_to_arg64(2, "setqctrl:aq_delay",
370 ar->ar_arg_auditon.au_qctrl64.aq64_delay);
371 kau_write(rec, tok);
372 tok = au_to_arg64(2, "setqctrl:aq_minfree",
373 ar->ar_arg_auditon.au_qctrl64.aq64_minfree);
374 kau_write(rec, tok);
375 break;
376 }
377 /* FALLTHROUGH */
378
379 case A_SETQCTRL:
380 tok = au_to_arg32(2, "setqctrl:aq_hiwater",
381 ar->ar_arg_auditon.au_qctrl.aq_hiwater);
382 kau_write(rec, tok);
383 tok = au_to_arg32(2, "setqctrl:aq_lowater",
384 ar->ar_arg_auditon.au_qctrl.aq_lowater);
385 kau_write(rec, tok);
386 tok = au_to_arg32(2, "setqctrl:aq_bufsz",
387 ar->ar_arg_auditon.au_qctrl.aq_bufsz);
388 kau_write(rec, tok);
389 tok = au_to_arg32(2, "setqctrl:aq_delay",
390 ar->ar_arg_auditon.au_qctrl.aq_delay);
391 kau_write(rec, tok);
392 tok = au_to_arg32(2, "setqctrl:aq_minfree",
393 ar->ar_arg_auditon.au_qctrl.aq_minfree);
394 kau_write(rec, tok);
395 break;
396
397 case A_SETUMASK:
398 tok = au_to_arg32(2, "setumask:as_success",
399 ar->ar_arg_auditon.au_auinfo.ai_mask.am_success);
400 kau_write(rec, tok);
401 tok = au_to_arg32(2, "setumask:as_failure",
402 ar->ar_arg_auditon.au_auinfo.ai_mask.am_failure);
403 kau_write(rec, tok);
404 break;
405
406 case A_SETSMASK:
407 tok = au_to_arg32(2, "setsmask:as_success",
408 ar->ar_arg_auditon.au_auinfo.ai_mask.am_success);
409 kau_write(rec, tok);
410 tok = au_to_arg32(2, "setsmask:as_failure",
411 ar->ar_arg_auditon.au_auinfo.ai_mask.am_failure);
412 kau_write(rec, tok);
413 break;
414
415 case A_OLDSETCOND:
416 if ((size_t)ar->ar_arg_len == sizeof(int64_t)) {
417 tok = au_to_arg64(2, "setcond",
418 ar->ar_arg_auditon.au_cond64);
419 kau_write(rec, tok);
420 break;
421 }
422 /* FALLTHROUGH */
423
424 case A_SETCOND:
425 tok = au_to_arg32(2, "setcond", ar->ar_arg_auditon.au_cond);
426 kau_write(rec, tok);
427 break;
428
429 case A_SETCLASS:
430 tok = au_to_arg32(2, "setclass:ec_event",
431 ar->ar_arg_auditon.au_evclass.ec_number);
432 kau_write(rec, tok);
433 tok = au_to_arg32(2, "setclass:ec_class",
434 ar->ar_arg_auditon.au_evclass.ec_class);
435 kau_write(rec, tok);
436 break;
437
438 case A_SETPMASK:
439 tok = au_to_arg32(2, "setpmask:as_success",
440 ar->ar_arg_auditon.au_aupinfo.ap_mask.am_success);
441 kau_write(rec, tok);
442 tok = au_to_arg32(2, "setpmask:as_failure",
443 ar->ar_arg_auditon.au_aupinfo.ap_mask.am_failure);
444 kau_write(rec, tok);
445 break;
446
447 case A_SETFSIZE:
448 tok = au_to_arg32(2, "setfsize:filesize",
449 ar->ar_arg_auditon.au_fstat.af_filesz);
450 kau_write(rec, tok);
451 break;
452
453 default:
454 break;
455 }
456 }
457
458 /*
459 * Convert an internal kernel audit record to a BSM record and return a
460 * success/failure indicator. The BSM record is passed as an out parameter to
461 * this function.
462 *
463 * Return conditions:
464 * BSM_SUCCESS: The BSM record is valid
465 * BSM_FAILURE: Failure; the BSM record is NULL.
466 * BSM_NOAUDIT: The event is not auditable for BSM; the BSM record is NULL.
467 */
468 int
kaudit_to_bsm(struct kaudit_record * kar,struct au_record ** pau)469 kaudit_to_bsm(struct kaudit_record *kar, struct au_record **pau)
470 {
471 struct au_token *tok, *subj_tok, *jail_tok;
472 struct au_record *rec;
473 au_tid_t tid;
474 struct audit_record *ar;
475 int ctr;
476
477 KASSERT(kar != NULL, ("kaudit_to_bsm: kar == NULL"));
478
479 *pau = NULL;
480 ar = &kar->k_ar;
481 rec = kau_open();
482
483 /*
484 * Create the subject token. If this credential was jailed be sure to
485 * generate a zonename token.
486 */
487 if (ar->ar_jailname[0] != '\0')
488 jail_tok = au_to_zonename(ar->ar_jailname);
489 else
490 jail_tok = NULL;
491 switch (ar->ar_subj_term_addr.at_type) {
492 case AU_IPv4:
493 tid.port = ar->ar_subj_term_addr.at_port;
494 tid.machine = ar->ar_subj_term_addr.at_addr[0];
495 subj_tok = au_to_subject32(ar->ar_subj_auid, /* audit ID */
496 ar->ar_subj_cred.cr_uid, /* eff uid */
497 ar->ar_subj_egid, /* eff group id */
498 ar->ar_subj_ruid, /* real uid */
499 ar->ar_subj_rgid, /* real group id */
500 ar->ar_subj_pid, /* process id */
501 ar->ar_subj_asid, /* session ID */
502 &tid);
503 break;
504 case AU_IPv6:
505 subj_tok = au_to_subject32_ex(ar->ar_subj_auid,
506 ar->ar_subj_cred.cr_uid,
507 ar->ar_subj_egid,
508 ar->ar_subj_ruid,
509 ar->ar_subj_rgid,
510 ar->ar_subj_pid,
511 ar->ar_subj_asid,
512 &ar->ar_subj_term_addr);
513 break;
514 default:
515 bzero(&tid, sizeof(tid));
516 subj_tok = au_to_subject32(ar->ar_subj_auid,
517 ar->ar_subj_cred.cr_uid,
518 ar->ar_subj_egid,
519 ar->ar_subj_ruid,
520 ar->ar_subj_rgid,
521 ar->ar_subj_pid,
522 ar->ar_subj_asid,
523 &tid);
524 }
525
526 /*
527 * The logic inside each case fills in the tokens required for the
528 * event, except for the header, trailer, and return tokens. The
529 * header and trailer tokens are added by the kau_close() function.
530 * The return token is added outside of the switch statement.
531 */
532 switch(ar->ar_event) {
533 case AUE_ACCEPT:
534 if (ARG_IS_VALID(kar, ARG_FD)) {
535 tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
536 kau_write(rec, tok);
537 }
538 if (ARG_IS_VALID(kar, ARG_SADDRINET)) {
539 tok = au_to_sock_inet((struct sockaddr_in *)
540 &ar->ar_arg_sockaddr);
541 kau_write(rec, tok);
542 }
543 if (ARG_IS_VALID(kar, ARG_SADDRUNIX)) {
544 tok = au_to_sock_unix((struct sockaddr_un *)
545 &ar->ar_arg_sockaddr);
546 kau_write(rec, tok);
547 UPATH1_TOKENS;
548 }
549 break;
550
551 case AUE_BIND:
552 case AUE_LISTEN:
553 case AUE_CONNECT:
554 case AUE_RECV:
555 case AUE_RECVFROM:
556 case AUE_RECVMSG:
557 case AUE_SEND:
558 case AUE_SENDMSG:
559 case AUE_SENDTO:
560 /*
561 * Socket-related events.
562 */
563 if (ARG_IS_VALID(kar, ARG_FD)) {
564 tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
565 kau_write(rec, tok);
566 }
567 if (ARG_IS_VALID(kar, ARG_SADDRINET)) {
568 tok = au_to_sock_inet((struct sockaddr_in *)
569 &ar->ar_arg_sockaddr);
570 kau_write(rec, tok);
571 }
572 if (ARG_IS_VALID(kar, ARG_SADDRUNIX)) {
573 tok = au_to_sock_unix((struct sockaddr_un *)
574 &ar->ar_arg_sockaddr);
575 kau_write(rec, tok);
576 UPATH1_TOKENS;
577 }
578 /* XXX Need to handle ARG_SADDRINET6 */
579 break;
580
581 case AUE_BINDAT:
582 case AUE_CONNECTAT:
583 ATFD1_TOKENS(1);
584 if (ARG_IS_VALID(kar, ARG_FD)) {
585 tok = au_to_arg32(2, "fd", ar->ar_arg_fd);
586 kau_write(rec, tok);
587 }
588 if (ARG_IS_VALID(kar, ARG_SADDRUNIX)) {
589 tok = au_to_sock_unix((struct sockaddr_un *)
590 &ar->ar_arg_sockaddr);
591 kau_write(rec, tok);
592 UPATH1_TOKENS;
593 }
594 break;
595
596 case AUE_SENDFILE:
597 FD_VNODE1_TOKENS;
598 if (ARG_IS_VALID(kar, ARG_SADDRINET)) {
599 tok = au_to_sock_inet((struct sockaddr_in *)
600 &ar->ar_arg_sockaddr);
601 kau_write(rec, tok);
602 }
603 if (ARG_IS_VALID(kar, ARG_SADDRUNIX)) {
604 tok = au_to_sock_unix((struct sockaddr_un *)
605 &ar->ar_arg_sockaddr);
606 kau_write(rec, tok);
607 UPATH1_TOKENS;
608 }
609 /* XXX Need to handle ARG_SADDRINET6 */
610 break;
611
612 case AUE_SOCKET:
613 case AUE_SOCKETPAIR:
614 if (ARG_IS_VALID(kar, ARG_SOCKINFO)) {
615 tok = au_to_arg32(1, "domain",
616 ar->ar_arg_sockinfo.so_domain);
617 kau_write(rec, tok);
618 tok = au_to_arg32(2, "type",
619 ar->ar_arg_sockinfo.so_type);
620 kau_write(rec, tok);
621 tok = au_to_arg32(3, "protocol",
622 ar->ar_arg_sockinfo.so_protocol);
623 kau_write(rec, tok);
624 }
625 break;
626
627 case AUE_SETSOCKOPT:
628 case AUE_SHUTDOWN:
629 if (ARG_IS_VALID(kar, ARG_FD)) {
630 tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
631 kau_write(rec, tok);
632 }
633 break;
634
635 case AUE_ACCT:
636 if (ARG_IS_VALID(kar, ARG_UPATH1)) {
637 UPATH1_VNODE1_TOKENS;
638 } else {
639 tok = au_to_arg32(1, "accounting off", 0);
640 kau_write(rec, tok);
641 }
642 break;
643
644 case AUE_SETAUID:
645 if (ARG_IS_VALID(kar, ARG_AUID)) {
646 tok = au_to_arg32(2, "setauid", ar->ar_arg_auid);
647 kau_write(rec, tok);
648 }
649 break;
650
651 case AUE_SETAUDIT:
652 if (ARG_IS_VALID(kar, ARG_AUID) &&
653 ARG_IS_VALID(kar, ARG_ASID) &&
654 ARG_IS_VALID(kar, ARG_AMASK) &&
655 ARG_IS_VALID(kar, ARG_TERMID)) {
656 tok = au_to_arg32(1, "setaudit:auid",
657 ar->ar_arg_auid);
658 kau_write(rec, tok);
659 tok = au_to_arg32(1, "setaudit:port",
660 ar->ar_arg_termid.port);
661 kau_write(rec, tok);
662 tok = au_to_arg32(1, "setaudit:machine",
663 ar->ar_arg_termid.machine);
664 kau_write(rec, tok);
665 tok = au_to_arg32(1, "setaudit:as_success",
666 ar->ar_arg_amask.am_success);
667 kau_write(rec, tok);
668 tok = au_to_arg32(1, "setaudit:as_failure",
669 ar->ar_arg_amask.am_failure);
670 kau_write(rec, tok);
671 tok = au_to_arg32(1, "setaudit:asid",
672 ar->ar_arg_asid);
673 kau_write(rec, tok);
674 }
675 break;
676
677 case AUE_SETAUDIT_ADDR:
678 if (ARG_IS_VALID(kar, ARG_AUID) &&
679 ARG_IS_VALID(kar, ARG_ASID) &&
680 ARG_IS_VALID(kar, ARG_AMASK) &&
681 ARG_IS_VALID(kar, ARG_TERMID_ADDR)) {
682 tok = au_to_arg32(1, "setaudit_addr:auid",
683 ar->ar_arg_auid);
684 kau_write(rec, tok);
685 tok = au_to_arg32(1, "setaudit_addr:as_success",
686 ar->ar_arg_amask.am_success);
687 kau_write(rec, tok);
688 tok = au_to_arg32(1, "setaudit_addr:as_failure",
689 ar->ar_arg_amask.am_failure);
690 kau_write(rec, tok);
691 tok = au_to_arg32(1, "setaudit_addr:asid",
692 ar->ar_arg_asid);
693 kau_write(rec, tok);
694 tok = au_to_arg32(1, "setaudit_addr:type",
695 ar->ar_arg_termid_addr.at_type);
696 kau_write(rec, tok);
697 tok = au_to_arg32(1, "setaudit_addr:port",
698 ar->ar_arg_termid_addr.at_port);
699 kau_write(rec, tok);
700 if (ar->ar_arg_termid_addr.at_type == AU_IPv6)
701 tok = au_to_in_addr_ex((struct in6_addr *)
702 &ar->ar_arg_termid_addr.at_addr[0]);
703 if (ar->ar_arg_termid_addr.at_type == AU_IPv4)
704 tok = au_to_in_addr((struct in_addr *)
705 &ar->ar_arg_termid_addr.at_addr[0]);
706 kau_write(rec, tok);
707 }
708 break;
709
710 case AUE_AUDITON:
711 /*
712 * For AUDITON commands without own event, audit the cmd.
713 */
714 if (ARG_IS_VALID(kar, ARG_CMD)) {
715 tok = au_to_arg32(1, "cmd", ar->ar_arg_cmd);
716 kau_write(rec, tok);
717 }
718 /* FALLTHROUGH */
719
720 case AUE_AUDITON_GETCAR:
721 case AUE_AUDITON_GETCLASS:
722 case AUE_AUDITON_GETCOND:
723 case AUE_AUDITON_GETCWD:
724 case AUE_AUDITON_GETKMASK:
725 case AUE_AUDITON_GETSTAT:
726 case AUE_AUDITON_GPOLICY:
727 case AUE_AUDITON_GQCTRL:
728 case AUE_AUDITON_SETCLASS:
729 case AUE_AUDITON_SETCOND:
730 case AUE_AUDITON_SETKMASK:
731 case AUE_AUDITON_SETSMASK:
732 case AUE_AUDITON_SETSTAT:
733 case AUE_AUDITON_SETUMASK:
734 case AUE_AUDITON_SPOLICY:
735 case AUE_AUDITON_SQCTRL:
736 if (ARG_IS_VALID(kar, ARG_AUDITON))
737 audit_sys_auditon(ar, rec);
738 break;
739
740 case AUE_AUDITCTL:
741 UPATH1_VNODE1_TOKENS;
742 break;
743
744 case AUE_EXIT:
745 if (ARG_IS_VALID(kar, ARG_EXIT)) {
746 tok = au_to_exit(ar->ar_arg_exitretval,
747 ar->ar_arg_exitstatus);
748 kau_write(rec, tok);
749 }
750 break;
751
752 case AUE_ADJTIME:
753 case AUE_CLOCK_SETTIME:
754 case AUE_AUDIT:
755 case AUE_DUP2:
756 case AUE_GETAUDIT:
757 case AUE_GETAUDIT_ADDR:
758 case AUE_GETAUID:
759 case AUE_GETCWD:
760 case AUE_GETFSSTAT:
761 case AUE_GETRESUID:
762 case AUE_GETRESGID:
763 case AUE_KQUEUE:
764 case AUE_MODLOAD:
765 case AUE_MODUNLOAD:
766 case AUE_MSGSYS:
767 case AUE_NTP_ADJTIME:
768 case AUE_PIPE:
769 case AUE_POSIX_OPENPT:
770 case AUE_PROFILE:
771 case AUE_RTPRIO:
772 case AUE_SEMSYS:
773 case AUE_SETFIB:
774 case AUE_SHMSYS:
775 case AUE_SETPGRP:
776 case AUE_SETRLIMIT:
777 case AUE_SETSID:
778 case AUE_SETTIMEOFDAY:
779 case AUE_SYSARCH:
780
781 /*
782 * Header, subject, and return tokens added at end.
783 */
784 break;
785
786 case AUE_ACL_DELETE_FD:
787 case AUE_ACL_DELETE_FILE:
788 case AUE_ACL_CHECK_FD:
789 case AUE_ACL_CHECK_FILE:
790 case AUE_ACL_CHECK_LINK:
791 case AUE_ACL_DELETE_LINK:
792 case AUE_ACL_GET_FD:
793 case AUE_ACL_GET_FILE:
794 case AUE_ACL_GET_LINK:
795 case AUE_ACL_SET_FD:
796 case AUE_ACL_SET_FILE:
797 case AUE_ACL_SET_LINK:
798 if (ARG_IS_VALID(kar, ARG_VALUE)) {
799 tok = au_to_arg32(1, "type", ar->ar_arg_value);
800 kau_write(rec, tok);
801 }
802 ATFD1_TOKENS(1);
803 UPATH1_VNODE1_TOKENS;
804 break;
805
806 case AUE_CHDIR:
807 case AUE_CHROOT:
808 case AUE_FSTATAT:
809 case AUE_FUTIMESAT:
810 case AUE_GETATTRLIST:
811 case AUE_JAIL:
812 case AUE_LUTIMES:
813 case AUE_NFS_GETFH:
814 case AUE_LGETFH:
815 case AUE_LSTAT:
816 case AUE_LPATHCONF:
817 case AUE_PATHCONF:
818 case AUE_READLINK:
819 case AUE_READLINKAT:
820 case AUE_REVOKE:
821 case AUE_RMDIR:
822 case AUE_SEARCHFS:
823 case AUE_SETATTRLIST:
824 case AUE_STAT:
825 case AUE_STATFS:
826 case AUE_SWAPON:
827 case AUE_SWAPOFF:
828 case AUE_TRUNCATE:
829 case AUE_UNDELETE:
830 case AUE_UNLINK:
831 case AUE_UNLINKAT:
832 case AUE_UTIMES:
833 ATFD1_TOKENS(1);
834 UPATH1_VNODE1_TOKENS;
835 break;
836
837 case AUE_ACCESS:
838 case AUE_EACCESS:
839 case AUE_FACCESSAT:
840 ATFD1_TOKENS(1);
841 UPATH1_VNODE1_TOKENS;
842 if (ARG_IS_VALID(kar, ARG_VALUE)) {
843 tok = au_to_arg32(2, "mode", ar->ar_arg_value);
844 kau_write(rec, tok);
845 }
846 break;
847
848 case AUE_FHSTATFS:
849 case AUE_FHOPEN:
850 case AUE_FHSTAT:
851 /* XXXRW: Need to audit vnode argument. */
852 break;
853
854 case AUE_CHFLAGS:
855 case AUE_LCHFLAGS:
856 case AUE_CHFLAGSAT:
857 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
858 tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
859 kau_write(rec, tok);
860 }
861 UPATH1_VNODE1_TOKENS;
862 break;
863
864 case AUE_CHMOD:
865 case AUE_LCHMOD:
866 if (ARG_IS_VALID(kar, ARG_MODE)) {
867 tok = au_to_arg32(2, "new file mode",
868 ar->ar_arg_mode);
869 kau_write(rec, tok);
870 }
871 UPATH1_VNODE1_TOKENS;
872 break;
873
874 case AUE_FCHMODAT:
875 ATFD1_TOKENS(1);
876 if (ARG_IS_VALID(kar, ARG_MODE)) {
877 tok = au_to_arg32(3, "new file mode",
878 ar->ar_arg_mode);
879 kau_write(rec, tok);
880 }
881 UPATH1_VNODE1_TOKENS;
882 break;
883
884 case AUE_CHOWN:
885 case AUE_LCHOWN:
886 if (ARG_IS_VALID(kar, ARG_UID)) {
887 tok = au_to_arg32(2, "new file uid", ar->ar_arg_uid);
888 kau_write(rec, tok);
889 }
890 if (ARG_IS_VALID(kar, ARG_GID)) {
891 tok = au_to_arg32(3, "new file gid", ar->ar_arg_gid);
892 kau_write(rec, tok);
893 }
894 UPATH1_VNODE1_TOKENS;
895 break;
896
897 case AUE_FCHOWNAT:
898 ATFD1_TOKENS(1);
899 if (ARG_IS_VALID(kar, ARG_UID)) {
900 tok = au_to_arg32(3, "new file uid", ar->ar_arg_uid);
901 kau_write(rec, tok);
902 }
903 if (ARG_IS_VALID(kar, ARG_GID)) {
904 tok = au_to_arg32(4, "new file gid", ar->ar_arg_gid);
905 kau_write(rec, tok);
906 }
907 UPATH1_VNODE1_TOKENS;
908 break;
909
910 case AUE_EXCHANGEDATA:
911 UPATH1_VNODE1_TOKENS;
912 UPATH2_TOKENS;
913 break;
914
915 case AUE_CLOSE:
916 if (ARG_IS_VALID(kar, ARG_FD)) {
917 tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
918 kau_write(rec, tok);
919 }
920 UPATH1_VNODE1_TOKENS;
921 break;
922
923 case AUE_CLOSEFROM:
924 if (ARG_IS_VALID(kar, ARG_FD)) {
925 tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
926 kau_write(rec, tok);
927 }
928 break;
929
930 case AUE_CORE:
931 if (ARG_IS_VALID(kar, ARG_SIGNUM)) {
932 tok = au_to_arg32(1, "signal", ar->ar_arg_signum);
933 kau_write(rec, tok);
934 }
935 UPATH1_VNODE1_TOKENS;
936 break;
937
938 case AUE_EXTATTRCTL:
939 UPATH1_VNODE1_TOKENS;
940 if (ARG_IS_VALID(kar, ARG_CMD)) {
941 tok = au_to_arg32(2, "cmd", ar->ar_arg_cmd);
942 kau_write(rec, tok);
943 }
944 /* extattrctl(2) filename parameter is in upath2/vnode2 */
945 UPATH2_TOKENS;
946 VNODE2_TOKENS;
947 EXTATTR_TOKENS(4);
948 break;
949
950 case AUE_EXTATTR_GET_FILE:
951 case AUE_EXTATTR_SET_FILE:
952 case AUE_EXTATTR_LIST_FILE:
953 case AUE_EXTATTR_DELETE_FILE:
954 case AUE_EXTATTR_GET_LINK:
955 case AUE_EXTATTR_SET_LINK:
956 case AUE_EXTATTR_LIST_LINK:
957 case AUE_EXTATTR_DELETE_LINK:
958 UPATH1_VNODE1_TOKENS;
959 EXTATTR_TOKENS(2);
960 break;
961
962 case AUE_EXTATTR_GET_FD:
963 case AUE_EXTATTR_SET_FD:
964 case AUE_EXTATTR_LIST_FD:
965 case AUE_EXTATTR_DELETE_FD:
966 if (ARG_IS_VALID(kar, ARG_FD)) {
967 tok = au_to_arg32(2, "fd", ar->ar_arg_fd);
968 kau_write(rec, tok);
969 }
970 EXTATTR_TOKENS(2);
971 break;
972
973 case AUE_FEXECVE:
974 if (ARG_IS_VALID(kar, ARG_FD)) {
975 tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
976 kau_write(rec, tok);
977 }
978 /* FALLTHROUGH */
979
980 case AUE_EXECVE:
981 case AUE_MAC_EXECVE:
982 if (ARG_IS_VALID(kar, ARG_ARGV)) {
983 tok = au_to_exec_args(ar->ar_arg_argv,
984 ar->ar_arg_argc);
985 kau_write(rec, tok);
986 }
987 if (ARG_IS_VALID(kar, ARG_ENVV)) {
988 tok = au_to_exec_env(ar->ar_arg_envv,
989 ar->ar_arg_envc);
990 kau_write(rec, tok);
991 }
992 UPATH1_VNODE1_TOKENS;
993 break;
994
995 case AUE_FCHMOD:
996 if (ARG_IS_VALID(kar, ARG_MODE)) {
997 tok = au_to_arg32(2, "new file mode",
998 ar->ar_arg_mode);
999 kau_write(rec, tok);
1000 }
1001 FD_VNODE1_TOKENS;
1002 break;
1003
1004 /*
1005 * XXXRW: Some of these need to handle non-vnode cases as well.
1006 */
1007 case AUE_FCHDIR:
1008 case AUE_FPATHCONF:
1009 case AUE_FSTAT:
1010 case AUE_FSTATFS:
1011 case AUE_FSYNC:
1012 case AUE_FTRUNCATE:
1013 case AUE_FUTIMES:
1014 case AUE_GETDIRENTRIES:
1015 case AUE_GETDIRENTRIESATTR:
1016 case AUE_LSEEK:
1017 case AUE_POLL:
1018 case AUE_POSIX_FALLOCATE:
1019 case AUE_PREAD:
1020 case AUE_PWRITE:
1021 case AUE_READ:
1022 case AUE_READV:
1023 case AUE_WRITE:
1024 case AUE_WRITEV:
1025 FD_VNODE1_TOKENS;
1026 break;
1027
1028 case AUE_FCHOWN:
1029 if (ARG_IS_VALID(kar, ARG_UID)) {
1030 tok = au_to_arg32(2, "new file uid", ar->ar_arg_uid);
1031 kau_write(rec, tok);
1032 }
1033 if (ARG_IS_VALID(kar, ARG_GID)) {
1034 tok = au_to_arg32(3, "new file gid", ar->ar_arg_gid);
1035 kau_write(rec, tok);
1036 }
1037 FD_VNODE1_TOKENS;
1038 break;
1039
1040 case AUE_FCNTL:
1041 if (ARG_IS_VALID(kar, ARG_CMD)) {
1042 tok = au_to_arg32(2, "cmd",
1043 au_fcntl_cmd_to_bsm(ar->ar_arg_cmd));
1044 kau_write(rec, tok);
1045 }
1046 FD_VNODE1_TOKENS;
1047 break;
1048
1049 case AUE_FCHFLAGS:
1050 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1051 tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
1052 kau_write(rec, tok);
1053 }
1054 FD_VNODE1_TOKENS;
1055 break;
1056
1057 case AUE_FLOCK:
1058 if (ARG_IS_VALID(kar, ARG_CMD)) {
1059 tok = au_to_arg32(2, "operation", ar->ar_arg_cmd);
1060 kau_write(rec, tok);
1061 }
1062 FD_VNODE1_TOKENS;
1063 break;
1064
1065 case AUE_RFORK:
1066 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1067 tok = au_to_arg32(1, "flags", ar->ar_arg_fflags);
1068 kau_write(rec, tok);
1069 }
1070 /* FALLTHROUGH */
1071
1072 case AUE_FORK:
1073 case AUE_VFORK:
1074 if (ARG_IS_VALID(kar, ARG_PID)) {
1075 tok = au_to_arg32(0, "child PID", ar->ar_arg_pid);
1076 kau_write(rec, tok);
1077 }
1078 break;
1079
1080 case AUE_IOCTL:
1081 if (ARG_IS_VALID(kar, ARG_CMD)) {
1082 tok = au_to_arg32(2, "cmd", ar->ar_arg_cmd);
1083 kau_write(rec, tok);
1084 }
1085 if (ARG_IS_VALID(kar, ARG_VNODE1))
1086 FD_VNODE1_TOKENS;
1087 else {
1088 if (ARG_IS_VALID(kar, ARG_SOCKINFO)) {
1089 tok = kau_to_socket(&ar->ar_arg_sockinfo);
1090 kau_write(rec, tok);
1091 } else {
1092 if (ARG_IS_VALID(kar, ARG_FD)) {
1093 tok = au_to_arg32(1, "fd",
1094 ar->ar_arg_fd);
1095 kau_write(rec, tok);
1096 }
1097 }
1098 }
1099 break;
1100
1101 case AUE_KILL:
1102 case AUE_KILLPG:
1103 if (ARG_IS_VALID(kar, ARG_SIGNUM)) {
1104 tok = au_to_arg32(2, "signal", ar->ar_arg_signum);
1105 kau_write(rec, tok);
1106 }
1107 PROCESS_PID_TOKENS(1);
1108 break;
1109
1110 case AUE_KTRACE:
1111 if (ARG_IS_VALID(kar, ARG_CMD)) {
1112 tok = au_to_arg32(2, "ops", ar->ar_arg_cmd);
1113 kau_write(rec, tok);
1114 }
1115 if (ARG_IS_VALID(kar, ARG_VALUE)) {
1116 tok = au_to_arg32(3, "trpoints", ar->ar_arg_value);
1117 kau_write(rec, tok);
1118 }
1119 PROCESS_PID_TOKENS(4);
1120 UPATH1_VNODE1_TOKENS;
1121 break;
1122
1123 case AUE_LINK:
1124 case AUE_LINKAT:
1125 case AUE_RENAME:
1126 case AUE_RENAMEAT:
1127 ATFD1_TOKENS(1);
1128 UPATH1_VNODE1_TOKENS;
1129 ATFD2_TOKENS(3);
1130 UPATH2_TOKENS;
1131 break;
1132
1133 case AUE_LOADSHFILE:
1134 ADDR_TOKEN(4, "base addr");
1135 UPATH1_VNODE1_TOKENS;
1136 break;
1137
1138 case AUE_MKDIR:
1139 case AUE_MKDIRAT:
1140 case AUE_MKFIFO:
1141 case AUE_MKFIFOAT:
1142 ATFD1_TOKENS(1);
1143 if (ARG_IS_VALID(kar, ARG_MODE)) {
1144 tok = au_to_arg32(2, "mode", ar->ar_arg_mode);
1145 kau_write(rec, tok);
1146 }
1147 UPATH1_VNODE1_TOKENS;
1148 break;
1149
1150 case AUE_MKNOD:
1151 case AUE_MKNODAT:
1152 ATFD1_TOKENS(1);
1153 if (ARG_IS_VALID(kar, ARG_MODE)) {
1154 tok = au_to_arg32(2, "mode", ar->ar_arg_mode);
1155 kau_write(rec, tok);
1156 }
1157 if (ARG_IS_VALID(kar, ARG_DEV)) {
1158 tok = au_to_arg32(3, "dev", ar->ar_arg_dev);
1159 kau_write(rec, tok);
1160 }
1161 UPATH1_VNODE1_TOKENS;
1162 break;
1163
1164 case AUE_MMAP:
1165 case AUE_MUNMAP:
1166 case AUE_MPROTECT:
1167 case AUE_MLOCK:
1168 case AUE_MUNLOCK:
1169 case AUE_MINHERIT:
1170 ADDR_TOKEN(1, "addr");
1171 if (ARG_IS_VALID(kar, ARG_LEN)) {
1172 tok = au_to_arg32(2, "len", ar->ar_arg_len);
1173 kau_write(rec, tok);
1174 }
1175 if (ar->ar_event == AUE_MMAP)
1176 FD_VNODE1_TOKENS;
1177 if (ar->ar_event == AUE_MPROTECT) {
1178 if (ARG_IS_VALID(kar, ARG_VALUE)) {
1179 tok = au_to_arg32(3, "protection",
1180 ar->ar_arg_value);
1181 kau_write(rec, tok);
1182 }
1183 }
1184 if (ar->ar_event == AUE_MINHERIT) {
1185 if (ARG_IS_VALID(kar, ARG_VALUE)) {
1186 tok = au_to_arg32(3, "inherit",
1187 ar->ar_arg_value);
1188 kau_write(rec, tok);
1189 }
1190 }
1191 break;
1192
1193 case AUE_MOUNT:
1194 case AUE_NMOUNT:
1195 /* XXX Need to handle NFS mounts */
1196 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1197 tok = au_to_arg32(3, "flags", ar->ar_arg_fflags);
1198 kau_write(rec, tok);
1199 }
1200 if (ARG_IS_VALID(kar, ARG_TEXT)) {
1201 tok = au_to_text(ar->ar_arg_text);
1202 kau_write(rec, tok);
1203 }
1204 /* FALLTHROUGH */
1205
1206 case AUE_NFS_SVC:
1207 if (ARG_IS_VALID(kar, ARG_CMD)) {
1208 tok = au_to_arg32(1, "flags", ar->ar_arg_cmd);
1209 kau_write(rec, tok);
1210 }
1211 break;
1212
1213 case AUE_UMOUNT:
1214 if (ARG_IS_VALID(kar, ARG_VALUE)) {
1215 tok = au_to_arg32(2, "flags", ar->ar_arg_value);
1216 kau_write(rec, tok);
1217 }
1218 UPATH1_VNODE1_TOKENS;
1219 if (ARG_IS_VALID(kar, ARG_TEXT)) {
1220 tok = au_to_text(ar->ar_arg_text);
1221 kau_write(rec, tok);
1222 }
1223 break;
1224
1225 case AUE_MSGCTL:
1226 ar->ar_event = audit_msgctl_to_event(ar->ar_arg_svipc_cmd);
1227 /* Fall through */
1228
1229 case AUE_MSGRCV:
1230 case AUE_MSGSND:
1231 tok = au_to_arg32(1, "msg ID", ar->ar_arg_svipc_id);
1232 kau_write(rec, tok);
1233 if (ar->ar_errno != EINVAL) {
1234 tok = au_to_ipc(AT_IPC_MSG, ar->ar_arg_svipc_id);
1235 kau_write(rec, tok);
1236 }
1237 break;
1238
1239 case AUE_MSGGET:
1240 if (ar->ar_errno == 0) {
1241 if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
1242 tok = au_to_ipc(AT_IPC_MSG,
1243 ar->ar_arg_svipc_id);
1244 kau_write(rec, tok);
1245 }
1246 }
1247 break;
1248
1249 case AUE_RESETSHFILE:
1250 ADDR_TOKEN(1, "base addr");
1251 break;
1252
1253 case AUE_OPEN_RC:
1254 case AUE_OPEN_RTC:
1255 case AUE_OPEN_RWC:
1256 case AUE_OPEN_RWTC:
1257 case AUE_OPEN_WC:
1258 case AUE_OPEN_WTC:
1259 case AUE_CREAT:
1260 if (ARG_IS_VALID(kar, ARG_MODE)) {
1261 tok = au_to_arg32(3, "mode", ar->ar_arg_mode);
1262 kau_write(rec, tok);
1263 }
1264 /* FALLTHROUGH */
1265
1266 case AUE_OPEN_R:
1267 case AUE_OPEN_RT:
1268 case AUE_OPEN_RW:
1269 case AUE_OPEN_RWT:
1270 case AUE_OPEN_W:
1271 case AUE_OPEN_WT:
1272 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1273 tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
1274 kau_write(rec, tok);
1275 }
1276 UPATH1_VNODE1_TOKENS;
1277 break;
1278
1279 case AUE_OPENAT_RC:
1280 case AUE_OPENAT_RTC:
1281 case AUE_OPENAT_RWC:
1282 case AUE_OPENAT_RWTC:
1283 case AUE_OPENAT_WC:
1284 case AUE_OPENAT_WTC:
1285 if (ARG_IS_VALID(kar, ARG_MODE)) {
1286 tok = au_to_arg32(3, "mode", ar->ar_arg_mode);
1287 kau_write(rec, tok);
1288 }
1289 /* FALLTHROUGH */
1290
1291 case AUE_OPENAT_R:
1292 case AUE_OPENAT_RT:
1293 case AUE_OPENAT_RW:
1294 case AUE_OPENAT_RWT:
1295 case AUE_OPENAT_W:
1296 case AUE_OPENAT_WT:
1297 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1298 tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
1299 kau_write(rec, tok);
1300 }
1301 ATFD1_TOKENS(1);
1302 UPATH1_VNODE1_TOKENS;
1303 break;
1304
1305 case AUE_PROCCTL:
1306 if (ARG_IS_VALID(kar, ARG_VALUE)) {
1307 tok = au_to_arg32(1, "idtype", ar->ar_arg_value);
1308 kau_write(rec, tok);
1309 }
1310 if (ARG_IS_VALID(kar, ARG_CMD)) {
1311 tok = au_to_arg32(2, "com", ar->ar_arg_cmd);
1312 kau_write(rec, tok);
1313 }
1314 PROCESS_PID_TOKENS(3);
1315 break;
1316
1317 case AUE_PTRACE:
1318 if (ARG_IS_VALID(kar, ARG_CMD)) {
1319 tok = au_to_arg32(1, "request", ar->ar_arg_cmd);
1320 kau_write(rec, tok);
1321 }
1322 if (ARG_IS_VALID(kar, ARG_VALUE)) {
1323 tok = au_to_arg32(4, "data", ar->ar_arg_value);
1324 kau_write(rec, tok);
1325 }
1326 PROCESS_PID_TOKENS(2);
1327 break;
1328
1329 case AUE_QUOTACTL:
1330 if (ARG_IS_VALID(kar, ARG_CMD)) {
1331 tok = au_to_arg32(2, "command", ar->ar_arg_cmd);
1332 kau_write(rec, tok);
1333 }
1334 if (ARG_IS_VALID(kar, ARG_UID)) {
1335 tok = au_to_arg32(3, "uid", ar->ar_arg_uid);
1336 kau_write(rec, tok);
1337 }
1338 if (ARG_IS_VALID(kar, ARG_GID)) {
1339 tok = au_to_arg32(3, "gid", ar->ar_arg_gid);
1340 kau_write(rec, tok);
1341 }
1342 UPATH1_VNODE1_TOKENS;
1343 break;
1344
1345 case AUE_REBOOT:
1346 if (ARG_IS_VALID(kar, ARG_CMD)) {
1347 tok = au_to_arg32(1, "howto", ar->ar_arg_cmd);
1348 kau_write(rec, tok);
1349 }
1350 break;
1351
1352 case AUE_SEMCTL:
1353 ar->ar_event = audit_semctl_to_event(ar->ar_arg_svipc_cmd);
1354 /* Fall through */
1355
1356 case AUE_SEMOP:
1357 if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
1358 tok = au_to_arg32(1, "sem ID", ar->ar_arg_svipc_id);
1359 kau_write(rec, tok);
1360 if (ar->ar_errno != EINVAL) {
1361 tok = au_to_ipc(AT_IPC_SEM,
1362 ar->ar_arg_svipc_id);
1363 kau_write(rec, tok);
1364 }
1365 }
1366 break;
1367
1368 case AUE_SEMGET:
1369 if (ar->ar_errno == 0) {
1370 if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
1371 tok = au_to_ipc(AT_IPC_SEM,
1372 ar->ar_arg_svipc_id);
1373 kau_write(rec, tok);
1374 }
1375 }
1376 break;
1377
1378 case AUE_SETEGID:
1379 if (ARG_IS_VALID(kar, ARG_EGID)) {
1380 tok = au_to_arg32(1, "egid", ar->ar_arg_egid);
1381 kau_write(rec, tok);
1382 }
1383 break;
1384
1385 case AUE_SETEUID:
1386 if (ARG_IS_VALID(kar, ARG_EUID)) {
1387 tok = au_to_arg32(1, "euid", ar->ar_arg_euid);
1388 kau_write(rec, tok);
1389 }
1390 break;
1391
1392 case AUE_SETREGID:
1393 if (ARG_IS_VALID(kar, ARG_RGID)) {
1394 tok = au_to_arg32(1, "rgid", ar->ar_arg_rgid);
1395 kau_write(rec, tok);
1396 }
1397 if (ARG_IS_VALID(kar, ARG_EGID)) {
1398 tok = au_to_arg32(2, "egid", ar->ar_arg_egid);
1399 kau_write(rec, tok);
1400 }
1401 break;
1402
1403 case AUE_SETREUID:
1404 if (ARG_IS_VALID(kar, ARG_RUID)) {
1405 tok = au_to_arg32(1, "ruid", ar->ar_arg_ruid);
1406 kau_write(rec, tok);
1407 }
1408 if (ARG_IS_VALID(kar, ARG_EUID)) {
1409 tok = au_to_arg32(2, "euid", ar->ar_arg_euid);
1410 kau_write(rec, tok);
1411 }
1412 break;
1413
1414 case AUE_SETRESGID:
1415 if (ARG_IS_VALID(kar, ARG_RGID)) {
1416 tok = au_to_arg32(1, "rgid", ar->ar_arg_rgid);
1417 kau_write(rec, tok);
1418 }
1419 if (ARG_IS_VALID(kar, ARG_EGID)) {
1420 tok = au_to_arg32(2, "egid", ar->ar_arg_egid);
1421 kau_write(rec, tok);
1422 }
1423 if (ARG_IS_VALID(kar, ARG_SGID)) {
1424 tok = au_to_arg32(3, "sgid", ar->ar_arg_sgid);
1425 kau_write(rec, tok);
1426 }
1427 break;
1428
1429 case AUE_SETRESUID:
1430 if (ARG_IS_VALID(kar, ARG_RUID)) {
1431 tok = au_to_arg32(1, "ruid", ar->ar_arg_ruid);
1432 kau_write(rec, tok);
1433 }
1434 if (ARG_IS_VALID(kar, ARG_EUID)) {
1435 tok = au_to_arg32(2, "euid", ar->ar_arg_euid);
1436 kau_write(rec, tok);
1437 }
1438 if (ARG_IS_VALID(kar, ARG_SUID)) {
1439 tok = au_to_arg32(3, "suid", ar->ar_arg_suid);
1440 kau_write(rec, tok);
1441 }
1442 break;
1443
1444 case AUE_SETGID:
1445 if (ARG_IS_VALID(kar, ARG_GID)) {
1446 tok = au_to_arg32(1, "gid", ar->ar_arg_gid);
1447 kau_write(rec, tok);
1448 }
1449 break;
1450
1451 case AUE_SETUID:
1452 if (ARG_IS_VALID(kar, ARG_UID)) {
1453 tok = au_to_arg32(1, "uid", ar->ar_arg_uid);
1454 kau_write(rec, tok);
1455 }
1456 break;
1457
1458 case AUE_SETGROUPS:
1459 if (ARG_IS_VALID(kar, ARG_GROUPSET)) {
1460 for(ctr = 0; ctr < ar->ar_arg_groups.gidset_size; ctr++)
1461 {
1462 tok = au_to_arg32(1, "setgroups",
1463 ar->ar_arg_groups.gidset[ctr]);
1464 kau_write(rec, tok);
1465 }
1466 }
1467 break;
1468
1469 case AUE_SETLOGIN:
1470 if (ARG_IS_VALID(kar, ARG_LOGIN)) {
1471 tok = au_to_text(ar->ar_arg_login);
1472 kau_write(rec, tok);
1473 }
1474 break;
1475
1476 case AUE_SETPRIORITY:
1477 if (ARG_IS_VALID(kar, ARG_CMD)) {
1478 tok = au_to_arg32(1, "which", ar->ar_arg_cmd);
1479 kau_write(rec, tok);
1480 }
1481 if (ARG_IS_VALID(kar, ARG_UID)) {
1482 tok = au_to_arg32(2, "who", ar->ar_arg_uid);
1483 kau_write(rec, tok);
1484 }
1485 PROCESS_PID_TOKENS(2);
1486 if (ARG_IS_VALID(kar, ARG_VALUE)) {
1487 tok = au_to_arg32(3, "priority", ar->ar_arg_value);
1488 kau_write(rec, tok);
1489 }
1490 break;
1491
1492 case AUE_SETPRIVEXEC:
1493 if (ARG_IS_VALID(kar, ARG_VALUE)) {
1494 tok = au_to_arg32(1, "flag", ar->ar_arg_value);
1495 kau_write(rec, tok);
1496 }
1497 break;
1498
1499 /* AUE_SHMAT, AUE_SHMCTL, AUE_SHMDT and AUE_SHMGET are SysV IPC */
1500 case AUE_SHMAT:
1501 if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
1502 tok = au_to_arg32(1, "shmid", ar->ar_arg_svipc_id);
1503 kau_write(rec, tok);
1504 /* XXXAUDIT: Does having the ipc token make sense? */
1505 tok = au_to_ipc(AT_IPC_SHM, ar->ar_arg_svipc_id);
1506 kau_write(rec, tok);
1507 }
1508 if (ARG_IS_VALID(kar, ARG_SVIPC_ADDR)) {
1509 tok = au_to_arg32(2, "shmaddr",
1510 (int)(uintptr_t)ar->ar_arg_svipc_addr);
1511 kau_write(rec, tok);
1512 }
1513 if (ARG_IS_VALID(kar, ARG_SVIPC_PERM)) {
1514 tok = au_to_ipc_perm(&ar->ar_arg_svipc_perm);
1515 kau_write(rec, tok);
1516 }
1517 break;
1518
1519 case AUE_SHMCTL:
1520 if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
1521 tok = au_to_arg32(1, "shmid", ar->ar_arg_svipc_id);
1522 kau_write(rec, tok);
1523 /* XXXAUDIT: Does having the ipc token make sense? */
1524 tok = au_to_ipc(AT_IPC_SHM, ar->ar_arg_svipc_id);
1525 kau_write(rec, tok);
1526 }
1527 switch (ar->ar_arg_svipc_cmd) {
1528 case IPC_STAT:
1529 ar->ar_event = AUE_SHMCTL_STAT;
1530 break;
1531 case IPC_RMID:
1532 ar->ar_event = AUE_SHMCTL_RMID;
1533 break;
1534 case IPC_SET:
1535 ar->ar_event = AUE_SHMCTL_SET;
1536 if (ARG_IS_VALID(kar, ARG_SVIPC_PERM)) {
1537 tok = au_to_ipc_perm(&ar->ar_arg_svipc_perm);
1538 kau_write(rec, tok);
1539 }
1540 break;
1541 default:
1542 break; /* We will audit a bad command */
1543 }
1544 break;
1545
1546 case AUE_SHMDT:
1547 if (ARG_IS_VALID(kar, ARG_SVIPC_ADDR)) {
1548 tok = au_to_arg32(1, "shmaddr",
1549 (int)(uintptr_t)ar->ar_arg_svipc_addr);
1550 kau_write(rec, tok);
1551 }
1552 break;
1553
1554 case AUE_SHMGET:
1555 /* This is unusual; the return value is in an argument token */
1556 if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
1557 tok = au_to_arg32(0, "shmid", ar->ar_arg_svipc_id);
1558 kau_write(rec, tok);
1559 tok = au_to_ipc(AT_IPC_SHM, ar->ar_arg_svipc_id);
1560 kau_write(rec, tok);
1561 }
1562 if (ARG_IS_VALID(kar, ARG_SVIPC_PERM)) {
1563 tok = au_to_ipc_perm(&ar->ar_arg_svipc_perm);
1564 kau_write(rec, tok);
1565 }
1566 break;
1567
1568 /* AUE_SHMOPEN, AUE_SHMUNLINK, AUE_SEMOPEN, AUE_SEMCLOSE
1569 * and AUE_SEMUNLINK are Posix IPC */
1570 case AUE_SHMOPEN:
1571 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1572 tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
1573 kau_write(rec, tok);
1574 }
1575 if (ARG_IS_VALID(kar, ARG_MODE)) {
1576 tok = au_to_arg32(3, "mode", ar->ar_arg_mode);
1577 kau_write(rec, tok);
1578 }
1579 /* FALLTHROUGH */
1580
1581 case AUE_SHMUNLINK:
1582 UPATH1_TOKENS;
1583 if (ARG_IS_VALID(kar, ARG_POSIX_IPC_PERM)) {
1584 struct ipc_perm perm;
1585
1586 perm.uid = ar->ar_arg_pipc_perm.pipc_uid;
1587 perm.gid = ar->ar_arg_pipc_perm.pipc_gid;
1588 perm.cuid = ar->ar_arg_pipc_perm.pipc_uid;
1589 perm.cgid = ar->ar_arg_pipc_perm.pipc_gid;
1590 perm.mode = ar->ar_arg_pipc_perm.pipc_mode;
1591 perm.seq = 0;
1592 perm.key = 0;
1593 tok = au_to_ipc_perm(&perm);
1594 kau_write(rec, tok);
1595 }
1596 break;
1597
1598 case AUE_SEMOPEN:
1599 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1600 tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
1601 kau_write(rec, tok);
1602 }
1603 if (ARG_IS_VALID(kar, ARG_MODE)) {
1604 tok = au_to_arg32(3, "mode", ar->ar_arg_mode);
1605 kau_write(rec, tok);
1606 }
1607 if (ARG_IS_VALID(kar, ARG_VALUE)) {
1608 tok = au_to_arg32(4, "value", ar->ar_arg_value);
1609 kau_write(rec, tok);
1610 }
1611 /* FALLTHROUGH */
1612
1613 case AUE_SEMUNLINK:
1614 if (ARG_IS_VALID(kar, ARG_TEXT)) {
1615 tok = au_to_text(ar->ar_arg_text);
1616 kau_write(rec, tok);
1617 }
1618 if (ARG_IS_VALID(kar, ARG_POSIX_IPC_PERM)) {
1619 struct ipc_perm perm;
1620
1621 perm.uid = ar->ar_arg_pipc_perm.pipc_uid;
1622 perm.gid = ar->ar_arg_pipc_perm.pipc_gid;
1623 perm.cuid = ar->ar_arg_pipc_perm.pipc_uid;
1624 perm.cgid = ar->ar_arg_pipc_perm.pipc_gid;
1625 perm.mode = ar->ar_arg_pipc_perm.pipc_mode;
1626 perm.seq = 0;
1627 perm.key = 0;
1628 tok = au_to_ipc_perm(&perm);
1629 kau_write(rec, tok);
1630 }
1631 break;
1632
1633 case AUE_SEMCLOSE:
1634 if (ARG_IS_VALID(kar, ARG_FD)) {
1635 tok = au_to_arg32(1, "sem", ar->ar_arg_fd);
1636 kau_write(rec, tok);
1637 }
1638 break;
1639
1640 case AUE_SYMLINK:
1641 case AUE_SYMLINKAT:
1642 if (ARG_IS_VALID(kar, ARG_TEXT)) {
1643 tok = au_to_text(ar->ar_arg_text);
1644 kau_write(rec, tok);
1645 }
1646 ATFD1_TOKENS(1);
1647 UPATH1_VNODE1_TOKENS;
1648 break;
1649
1650 case AUE_SYSCTL:
1651 case AUE_SYSCTL_NONADMIN:
1652 if (ARG_IS_VALID(kar, ARG_CTLNAME | ARG_LEN)) {
1653 for (ctr = 0; ctr < ar->ar_arg_len; ctr++) {
1654 tok = au_to_arg32(1, "name",
1655 ar->ar_arg_ctlname[ctr]);
1656 kau_write(rec, tok);
1657 }
1658 }
1659 if (ARG_IS_VALID(kar, ARG_VALUE)) {
1660 tok = au_to_arg32(5, "newval", ar->ar_arg_value);
1661 kau_write(rec, tok);
1662 }
1663 if (ARG_IS_VALID(kar, ARG_TEXT)) {
1664 tok = au_to_text(ar->ar_arg_text);
1665 kau_write(rec, tok);
1666 }
1667 break;
1668
1669 case AUE_UMASK:
1670 if (ARG_IS_VALID(kar, ARG_MASK)) {
1671 tok = au_to_arg32(1, "new mask", ar->ar_arg_mask);
1672 kau_write(rec, tok);
1673 }
1674 tok = au_to_arg32(0, "prev mask", ar->ar_retval);
1675 kau_write(rec, tok);
1676 break;
1677
1678 case AUE_WAIT4:
1679 case AUE_WAIT6:
1680 PROCESS_PID_TOKENS(1);
1681 if (ARG_IS_VALID(kar, ARG_VALUE)) {
1682 tok = au_to_arg32(3, "options", ar->ar_arg_value);
1683 kau_write(rec, tok);
1684 }
1685 break;
1686
1687 case AUE_CAP_RIGHTS_LIMIT:
1688 /*
1689 * XXXRW/XXXJA: Would be nice to audit socket/etc information.
1690 */
1691 FD_VNODE1_TOKENS;
1692 if (ARG_IS_VALID(kar, ARG_RIGHTS)) {
1693 tok = au_to_rights(&ar->ar_arg_rights);
1694 kau_write(rec, tok);
1695 }
1696 break;
1697
1698 case AUE_CAP_FCNTLS_GET:
1699 case AUE_CAP_IOCTLS_GET:
1700 case AUE_CAP_IOCTLS_LIMIT:
1701 case AUE_CAP_RIGHTS_GET:
1702 if (ARG_IS_VALID(kar, ARG_FD)) {
1703 tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
1704 kau_write(rec, tok);
1705 }
1706 break;
1707
1708 case AUE_CAP_FCNTLS_LIMIT:
1709 FD_VNODE1_TOKENS;
1710 if (ARG_IS_VALID(kar, ARG_FCNTL_RIGHTS)) {
1711 tok = au_to_arg32(2, "fcntlrights",
1712 ar->ar_arg_fcntl_rights);
1713 kau_write(rec, tok);
1714 }
1715 break;
1716
1717 case AUE_CAP_ENTER:
1718 case AUE_CAP_GETMODE:
1719 break;
1720
1721 case AUE_NULL:
1722 default:
1723 printf("BSM conversion requested for unknown event %d\n",
1724 ar->ar_event);
1725
1726 /*
1727 * Write the subject token so it is properly freed here.
1728 */
1729 if (jail_tok != NULL)
1730 kau_write(rec, jail_tok);
1731 kau_write(rec, subj_tok);
1732 kau_free(rec);
1733 return (BSM_NOAUDIT);
1734 }
1735
1736 if (jail_tok != NULL)
1737 kau_write(rec, jail_tok);
1738 kau_write(rec, subj_tok);
1739 tok = au_to_return32(au_errno_to_bsm(ar->ar_errno), ar->ar_retval);
1740 kau_write(rec, tok); /* Every record gets a return token */
1741
1742 kau_close(rec, &ar->ar_endtime, ar->ar_event);
1743
1744 *pau = rec;
1745 return (BSM_SUCCESS);
1746 }
1747
1748 /*
1749 * Verify that a record is a valid BSM record. This verification is simple
1750 * now, but may be expanded on sometime in the future. Return 1 if the
1751 * record is good, 0 otherwise.
1752 */
1753 int
bsm_rec_verify(void * rec)1754 bsm_rec_verify(void *rec)
1755 {
1756 char c = *(char *)rec;
1757
1758 /*
1759 * Check the token ID of the first token; it has to be a header
1760 * token.
1761 *
1762 * XXXAUDIT There needs to be a token structure to map a token.
1763 * XXXAUDIT 'Shouldn't be simply looking at the first char.
1764 */
1765 if ((c != AUT_HEADER32) && (c != AUT_HEADER32_EX) &&
1766 (c != AUT_HEADER64) && (c != AUT_HEADER64_EX))
1767 return (0);
1768 return (1);
1769 }
1770