#include <sys/types.h>
#include <sys/un.h>
#include <sys/event.h>
#include <sys/ucred.h>
#include <sys/ipc.h>
#include <bsm/audit.h>
#include <bsm/audit_record.h>
#include <bsm/audit_klib.h>
#include <bsm/audit_kernel.h>
#include <kern/clock.h>
#include <kern/kalloc.h>
#include <string.h>
#define GET_TOKEN_AREA(tok, dptr, length) \
do {\
tok = (token_t *)kalloc(sizeof(*tok) + length); \
if(tok != NULL)\
{\
tok->len = length;\
dptr = tok->t_data = (u_char *)&tok[1];\
memset(dptr, 0, length);\
}\
}while(0)
token_t *
au_to_arg32(char n, const char *text, u_int32_t v)
{
token_t *t;
u_char *dptr;
u_int16_t textlen;
if(text == NULL) {
return NULL;
}
textlen = strlen(text);
GET_TOKEN_AREA(t, dptr, 9 + textlen);
if(t == NULL) {
return NULL;
}
textlen += 1;
ADD_U_CHAR(dptr, AU_ARG32_TOKEN);
ADD_U_CHAR(dptr, n);
ADD_U_INT32(dptr, v);
ADD_U_INT16(dptr, textlen);
ADD_STRING(dptr, text, textlen);
return t;
}
token_t *
au_to_arg64(char n, const char *text, u_int64_t v)
{
token_t *t;
u_char *dptr;
u_int16_t textlen;
if(text == NULL) {
return NULL;
}
textlen = strlen(text);
GET_TOKEN_AREA(t, dptr, 13 + textlen);
if(t == NULL) {
return NULL;
}
textlen += 1;
ADD_U_CHAR(dptr, AU_ARG64_TOKEN);
ADD_U_CHAR(dptr, n);
ADD_U_INT64(dptr, v);
ADD_U_INT16(dptr, textlen);
ADD_STRING(dptr, text, textlen);
return t;
}
token_t *
au_to_arg(char n, char *text, u_int32_t v)
{
return au_to_arg32(n, text, v);
}
token_t *au_to_attr32(__unused struct vnode_attr *attr)
{
return NULL;
}
token_t *kau_to_attr32(struct vnode_au_info *vni)
{
token_t *t;
u_char *dptr;
u_int64_t fileid;
u_int16_t pad0_16 = 0;
u_int32_t pad0_32 = 0;
if(vni == NULL) {
return NULL;
}
GET_TOKEN_AREA(t, dptr, 29);
if(t == NULL) {
return NULL;
}
ADD_U_CHAR(dptr, AU_ATTR32_TOKEN);
ADD_U_INT16(dptr, pad0_16);
ADD_U_INT16(dptr, vni->vn_mode);
ADD_U_INT32(dptr, vni->vn_uid);
ADD_U_INT32(dptr, vni->vn_gid);
ADD_U_INT32(dptr, vni->vn_fsid);
fileid = vni->vn_fileid;
ADD_U_INT32(dptr, pad0_32);
ADD_U_INT32(dptr, fileid);
ADD_U_INT32(dptr, vni->vn_dev);
return t;
}
token_t *au_to_attr64(__unused struct vnode_attr *attr)
{
return NULL;
}
token_t *kau_to_attr64(__unused struct vnode_au_info *vni)
{
return NULL;
}
token_t *au_to_attr(struct vnode_attr *attr)
{
return au_to_attr32(attr);
}
token_t *au_to_data(char unit_print, char unit_type,
char unit_count, unsigned char *p)
{
token_t *t;
u_char *dptr;
size_t datasize, totdata;
if(p == NULL) {
return NULL;
}
switch(unit_type) {
case AUR_BYTE: datasize = AUR_BYTE_SIZE;
break;
case AUR_SHORT: datasize = AUR_SHORT_SIZE;
break;
case AUR_LONG: datasize = AUR_LONG_SIZE;
break;
default: return NULL;
}
totdata = datasize * unit_count;
GET_TOKEN_AREA(t, dptr, totdata + 4);
if(t == NULL) {
return NULL;
}
ADD_U_CHAR(dptr, AU_ARB_TOKEN);
ADD_U_CHAR(dptr, unit_print);
ADD_U_CHAR(dptr, unit_type);
ADD_U_CHAR(dptr, unit_count);
ADD_MEM(dptr, p, totdata);
return t;
}
token_t *au_to_exit(int retval, int err)
{
token_t *t;
u_char *dptr;
GET_TOKEN_AREA(t, dptr, 9);
if(t == NULL) {
return NULL;
}
ADD_U_CHAR(dptr, AU_EXIT_TOKEN);
ADD_U_INT32(dptr, err);
ADD_U_INT32(dptr, retval);
return t;
}
token_t *
au_to_groups(gid_t *groups)
{
return au_to_newgroups(MAX_GROUPS, groups);
}
token_t *au_to_newgroups(u_int16_t n, gid_t *groups)
{
token_t *t;
u_char *dptr;
int i;
if(groups == NULL) {
return NULL;
}
GET_TOKEN_AREA(t, dptr, n * 4 + 3);
if(t == NULL) {
return NULL;
}
ADD_U_CHAR(dptr, AU_NEWGROUPS_TOKEN);
ADD_U_INT16(dptr, n);
for(i = 0; i < n; i++) {
ADD_U_INT32(dptr, groups[i]);
}
return t;
}
token_t *au_to_in_addr(struct in_addr *internet_addr)
{
token_t *t;
u_char *dptr;
if(internet_addr == NULL) {
return NULL;
}
GET_TOKEN_AREA(t, dptr, 5);
if(t == NULL) {
return NULL;
}
ADD_U_CHAR(dptr, AU_IN_ADDR_TOKEN);
ADD_U_INT32(dptr, internet_addr->s_addr);
return t;
}
token_t *au_to_in_addr_ex(struct in6_addr *internet_addr)
{
token_t *t;
u_char *dptr;
u_int32_t type = AF_INET6;
if(internet_addr == NULL) {
return NULL;
}
GET_TOKEN_AREA(t, dptr, 21);
if(t == NULL) {
return NULL;
}
ADD_U_CHAR(dptr, AU_IN_ADDR_EX_TOKEN);
ADD_U_INT32(dptr, type);
ADD_U_INT32(dptr, internet_addr->__u6_addr.__u6_addr32[0]);
ADD_U_INT32(dptr, internet_addr->__u6_addr.__u6_addr32[1]);
ADD_U_INT32(dptr, internet_addr->__u6_addr.__u6_addr32[2]);
ADD_U_INT32(dptr, internet_addr->__u6_addr.__u6_addr32[3]);
return t;
}
token_t *au_to_ip(struct ip *ip)
{
token_t *t;
u_char *dptr;
if(ip == NULL) {
return NULL;
}
GET_TOKEN_AREA(t, dptr, 21);
if(t == NULL) {
return NULL;
}
ADD_U_CHAR(dptr, AU_IP_TOKEN);
ADD_MEM(dptr, ip, sizeof(struct ip));
return t;
}
token_t *au_to_ipc(char type, int id)
{
token_t *t;
u_char *dptr;
GET_TOKEN_AREA(t, dptr, 6);
if(t == NULL) {
return NULL;
}
ADD_U_CHAR(dptr, AU_IPC_TOKEN);
ADD_U_CHAR(dptr, type);
ADD_U_INT32(dptr, id);
return t;
}
token_t *au_to_ipc_perm(struct ipc_perm *perm)
{
token_t *t;
u_char *dptr;
u_int16_t pad0 = 0;
if(perm == NULL) {
return NULL;
}
GET_TOKEN_AREA(t, dptr, 29);
if(t == NULL) {
return NULL;
}
ADD_U_CHAR(dptr, AU_IPCPERM_TOKEN);
ADD_U_INT32(dptr, perm->uid);
ADD_U_INT32(dptr, perm->gid);
ADD_U_INT32(dptr, perm->cuid);
ADD_U_INT32(dptr, perm->cgid);
ADD_U_INT16(dptr, pad0);
ADD_U_INT16(dptr, perm->mode);
ADD_U_INT16(dptr, pad0);
ADD_U_INT16(dptr, perm->_seq);
ADD_U_INT16(dptr, pad0);
ADD_U_INT16(dptr, perm->_key);
return t;
}
token_t *au_to_iport(u_int16_t iport)
{
token_t *t;
u_char *dptr;
GET_TOKEN_AREA(t, dptr, 3);
if(t == NULL) {
return NULL;
}
ADD_U_CHAR(dptr, AU_IPORT_TOKEN);
ADD_U_INT16(dptr, iport);
return t;
}
token_t *au_to_opaque(char *data, u_int16_t bytes)
{
token_t *t;
u_char *dptr;
if((data == NULL) || (bytes <= 0)) {
return NULL;
}
GET_TOKEN_AREA(t, dptr, bytes + 3);
if(t == NULL) {
return NULL;
}
ADD_U_CHAR(dptr, AU_OPAQUE_TOKEN);
ADD_U_INT16(dptr, bytes);
ADD_MEM(dptr, data, bytes);
return t;
}
token_t *kau_to_file(const char *file, const struct timeval *tv)
{
token_t *t;
u_char *dptr;
u_int16_t filelen;
u_int32_t timems = tv->tv_usec/1000;
if(file == NULL) {
return NULL;
}
filelen = strlen(file);
GET_TOKEN_AREA(t, dptr, filelen + 12);
if(t == NULL) {
return NULL;
}
filelen += 1;
ADD_U_CHAR(dptr, AU_FILE_TOKEN);
ADD_U_INT32(dptr, tv->tv_sec);
ADD_U_INT32(dptr, timems);
ADD_U_INT16(dptr, filelen);
ADD_STRING(dptr, file, filelen);
return t;
}
token_t *au_to_text(const char *text)
{
token_t *t;
u_char *dptr;
u_int16_t textlen;
if(text == NULL) {
return NULL;
}
textlen = strlen(text);
GET_TOKEN_AREA(t, dptr, textlen + 4);
if(t == NULL) {
return NULL;
}
textlen += 1;
ADD_U_CHAR(dptr, AU_TEXT_TOKEN);
ADD_U_INT16(dptr, textlen);
ADD_STRING(dptr, text, textlen);
return t;
}
token_t *au_to_path(char *text)
{
token_t *t;
u_char *dptr;
u_int16_t textlen;
if(text == NULL) {
return NULL;
}
textlen = strlen(text);
GET_TOKEN_AREA(t, dptr, textlen + 4);
if(t == NULL) {
return NULL;
}
textlen += 1;
ADD_U_CHAR(dptr, AU_PATH_TOKEN);
ADD_U_INT16(dptr, textlen);
ADD_STRING(dptr, text, textlen);
return t;
}
token_t *au_to_process32(au_id_t auid, uid_t euid, gid_t egid,
uid_t ruid, gid_t rgid, pid_t pid,
au_asid_t sid, au_tid_t *tid)
{
token_t *t;
u_char *dptr;
if(tid == NULL) {
return NULL;
}
GET_TOKEN_AREA(t, dptr, 37);
if(t == NULL) {
return NULL;
}
ADD_U_CHAR(dptr, AU_PROCESS_32_TOKEN);
ADD_U_INT32(dptr, auid);
ADD_U_INT32(dptr, euid);
ADD_U_INT32(dptr, egid);
ADD_U_INT32(dptr, ruid);
ADD_U_INT32(dptr, rgid);
ADD_U_INT32(dptr, pid);
ADD_U_INT32(dptr, sid);
ADD_U_INT32(dptr, tid->port);
ADD_U_INT32(dptr, tid->machine);
return t;
}
token_t *au_to_process64(__unused au_id_t auid,
__unused uid_t euid,
__unused gid_t egid,
__unused uid_t ruid,
__unused gid_t rgid,
__unused pid_t pid,
__unused au_asid_t sid,
__unused au_tid_t *tid)
{
return NULL;
}
token_t *au_to_process(au_id_t auid, uid_t euid, gid_t egid,
uid_t ruid, gid_t rgid, pid_t pid,
au_asid_t sid, au_tid_t *tid)
{
return au_to_process32(auid, euid, egid, ruid, rgid, pid,
sid, tid);
}
token_t *au_to_process32_ex(au_id_t auid, uid_t euid, gid_t egid,
uid_t ruid, gid_t rgid, pid_t pid,
au_asid_t sid, au_tid_addr_t *tid)
{
token_t *t;
u_char *dptr;
if(tid == NULL) {
return NULL;
}
GET_TOKEN_AREA(t, dptr, 53);
if(t == NULL) {
return NULL;
}
ADD_U_CHAR(dptr, AU_PROCESS_32_EX_TOKEN);
ADD_U_INT32(dptr, auid);
ADD_U_INT32(dptr, euid);
ADD_U_INT32(dptr, egid);
ADD_U_INT32(dptr, ruid);
ADD_U_INT32(dptr, rgid);
ADD_U_INT32(dptr, pid);
ADD_U_INT32(dptr, sid);
ADD_U_INT32(dptr, tid->at_port);
ADD_U_INT32(dptr, tid->at_type);
ADD_U_INT32(dptr, tid->at_addr[0]);
ADD_U_INT32(dptr, tid->at_addr[1]);
ADD_U_INT32(dptr, tid->at_addr[2]);
ADD_U_INT32(dptr, tid->at_addr[3]);
return t;
}
token_t *au_to_process64_ex(
__unused au_id_t auid,
__unused uid_t euid,
__unused gid_t egid,
__unused uid_t ruid,
__unused gid_t rgid,
__unused pid_t pid,
__unused au_asid_t sid,
__unused au_tid_addr_t *tid)
{
return NULL;
}
token_t *au_to_process_ex(au_id_t auid, uid_t euid, gid_t egid,
uid_t ruid, gid_t rgid, pid_t pid,
au_asid_t sid, au_tid_addr_t *tid)
{
return au_to_process32_ex(auid, euid, egid, ruid, rgid,
pid, sid, tid);
}
token_t *au_to_return32(char status, u_int32_t ret)
{
token_t *t;
u_char *dptr;
GET_TOKEN_AREA(t, dptr, 6);
if(t == NULL) {
return NULL;
}
ADD_U_CHAR(dptr, AU_RETURN_32_TOKEN);
ADD_U_CHAR(dptr, status);
ADD_U_INT32(dptr, ret);
return t;
}
token_t *au_to_return64(char status, u_int64_t ret)
{
token_t *t;
u_char *dptr;
GET_TOKEN_AREA(t, dptr, 10);
if(t == NULL) {
return NULL;
}
ADD_U_CHAR(dptr, AU_RETURN_64_TOKEN);
ADD_U_CHAR(dptr, status);
ADD_U_INT64(dptr, ret);
return t;
}
token_t *au_to_return(char status, u_int32_t ret)
{
return au_to_return32(status, ret);
}
token_t *au_to_seq(u_int32_t audit_count)
{
token_t *t;
u_char *dptr;
GET_TOKEN_AREA(t, dptr, 5);
if(t == NULL) {
return NULL;
}
ADD_U_CHAR(dptr, AU_SEQ_TOKEN);
ADD_U_INT32(dptr, audit_count);
return t;
}
token_t *au_to_socket(__unused struct socket *so)
{
return NULL;
}
token_t *kau_to_socket(struct socket_au_info *soi)
{
token_t *t;
u_char *dptr;
u_int16_t so_type;
if(soi == NULL) {
return NULL;
}
GET_TOKEN_AREA(t, dptr, 15);
if(t == NULL) {
return NULL;
}
ADD_U_CHAR(dptr, AU_SOCK_TOKEN);
so_type = soi->so_type;
ADD_U_INT16(dptr, so_type);
ADD_U_INT16(dptr, soi->so_lport);
ADD_U_INT32(dptr, soi->so_laddr);
ADD_U_INT16(dptr, soi->so_rport);
ADD_U_INT32(dptr, soi->so_raddr);
return t;
}
token_t *au_to_socket_ex_32(
__unused u_int16_t lp,
__unused u_int16_t rp,
__unused struct sockaddr *la,
__unused struct sockaddr *ra)
{
return NULL;
}
token_t *au_to_socket_ex_128(
__unused u_int16_t lp,
__unused u_int16_t rp,
__unused struct sockaddr *la,
__unused struct sockaddr *ra)
{
return NULL;
}
token_t *au_to_sock_inet32(struct sockaddr_in *so)
{
token_t *t;
u_char *dptr;
if(so == NULL) {
return NULL;
}
GET_TOKEN_AREA(t, dptr, 9);
if(t == NULL) {
return NULL;
}
ADD_U_CHAR(dptr, AU_SOCK_INET_32_TOKEN);
ADD_U_CHAR(dptr, 0);
ADD_U_CHAR(dptr, so->sin_family);
ADD_U_INT16(dptr, so->sin_port);
ADD_U_INT32(dptr, so->sin_addr.s_addr);
return t;
}
token_t *au_to_sock_inet128(struct sockaddr_in6 *so)
{
token_t *t;
u_char *dptr;
if(so == NULL) {
return NULL;
}
GET_TOKEN_AREA(t, dptr, 21);
if(t == NULL) {
return NULL;
}
ADD_U_CHAR(dptr, AU_SOCK_INET_128_TOKEN);
ADD_U_CHAR(dptr, 0);
ADD_U_CHAR(dptr, so->sin6_family);
ADD_U_INT16(dptr, so->sin6_port);
ADD_U_INT32(dptr, so->sin6_addr.__u6_addr.__u6_addr32[0]);
ADD_U_INT32(dptr, so->sin6_addr.__u6_addr.__u6_addr32[1]);
ADD_U_INT32(dptr, so->sin6_addr.__u6_addr.__u6_addr32[2]);
ADD_U_INT32(dptr, so->sin6_addr.__u6_addr.__u6_addr32[3]);
return t;
}
token_t *au_to_sock_unix(struct sockaddr_un *so)
{
token_t *t;
u_char *dptr;
if(so == NULL) {
return NULL;
}
GET_TOKEN_AREA(t, dptr, 107);
if(t == NULL) {
return NULL;
}
ADD_U_CHAR(dptr, AU_SOCK_UNIX_TOKEN);
ADD_U_CHAR(dptr, 0);
ADD_U_CHAR(dptr, so->sun_family);
ADD_STRING(dptr, so->sun_path, strlen(so->sun_path));
return t;
}
token_t *au_to_sock_inet(struct sockaddr_in *so)
{
return au_to_sock_inet32(so);
}
token_t *au_to_subject32(au_id_t auid, uid_t euid, gid_t egid,
uid_t ruid, gid_t rgid, pid_t pid,
au_asid_t sid, au_tid_t *tid)
{
token_t *t;
u_char *dptr;
if(tid == NULL) {
return NULL;
}
GET_TOKEN_AREA(t, dptr, 37);
if(t == NULL) {
return NULL;
}
ADD_U_CHAR(dptr, AU_SUBJECT_32_TOKEN);
ADD_U_INT32(dptr, auid);
ADD_U_INT32(dptr, euid);
ADD_U_INT32(dptr, egid);
ADD_U_INT32(dptr, ruid);
ADD_U_INT32(dptr, rgid);
ADD_U_INT32(dptr, pid);
ADD_U_INT32(dptr, sid);
ADD_U_INT32(dptr, tid->port);
ADD_U_INT32(dptr, tid->machine);
return t;
}
token_t *au_to_subject64(
__unused au_id_t auid,
__unused uid_t euid,
__unused gid_t egid,
__unused uid_t ruid,
__unused gid_t rgid,
__unused pid_t pid,
__unused au_asid_t sid,
__unused au_tid_t *tid)
{
return NULL;
}
token_t *au_to_subject(au_id_t auid, uid_t euid, gid_t egid,
uid_t ruid, gid_t rgid, pid_t pid,
au_asid_t sid, au_tid_t *tid)
{
return au_to_subject32(auid, euid, egid, ruid, rgid,
pid, sid, tid);
}
token_t *au_to_subject32_ex(au_id_t auid, uid_t euid,
gid_t egid, uid_t ruid, gid_t rgid, pid_t pid,
au_asid_t sid, au_tid_addr_t *tid)
{
token_t *t;
u_char *dptr;
if(tid == NULL) {
return NULL;
}
GET_TOKEN_AREA(t, dptr, 53);
if(t == NULL) {
return NULL;
}
ADD_U_CHAR(dptr, AU_SUBJECT_32_EX_TOKEN);
ADD_U_INT32(dptr, auid);
ADD_U_INT32(dptr, euid);
ADD_U_INT32(dptr, egid);
ADD_U_INT32(dptr, ruid);
ADD_U_INT32(dptr, rgid);
ADD_U_INT32(dptr, pid);
ADD_U_INT32(dptr, sid);
ADD_U_INT32(dptr, tid->at_port);
ADD_U_INT32(dptr, tid->at_type);
ADD_U_INT32(dptr, tid->at_addr[0]);
ADD_U_INT32(dptr, tid->at_addr[1]);
ADD_U_INT32(dptr, tid->at_addr[2]);
ADD_U_INT32(dptr, tid->at_addr[3]);
return t;
}
token_t *au_to_subject64_ex(
__unused au_id_t auid,
__unused uid_t euid,
__unused gid_t egid,
__unused uid_t ruid,
__unused gid_t rgid,
__unused pid_t pid,
__unused au_asid_t sid,
__unused au_tid_addr_t *tid)
{
return NULL;
}
token_t *au_to_subject_ex(au_id_t auid, uid_t euid,
gid_t egid, uid_t ruid, gid_t rgid, pid_t pid,
au_asid_t sid, au_tid_addr_t *tid)
{
return au_to_subject32_ex(auid, euid, egid, ruid, rgid,
pid, sid, tid);
}
token_t *au_to_exec_args(const char **args)
{
token_t *t;
u_char *dptr;
const char *nextarg;
int i, count = 0;
size_t totlen = 0;
if(args == NULL) {
return NULL;
}
nextarg = *args;
while(nextarg != NULL) {
int nextlen;
nextlen = strlen(nextarg);
totlen += nextlen + 1;
count++;
nextarg = *(args + count);
}
GET_TOKEN_AREA(t, dptr, 5 + totlen);
if(t == NULL) {
return NULL;
}
ADD_U_CHAR(dptr, AU_EXEC_ARG_TOKEN);
ADD_U_INT32(dptr, count);
for(i =0; i< count; i++) {
nextarg = *(args + i);
ADD_MEM(dptr, nextarg, strlen(nextarg) + 1);
}
return t;
}
token_t *au_to_exec_env(const char **env)
{
token_t *t;
u_char *dptr;
int i, count = 0;
size_t totlen = 0;
const char *nextenv;
if(env == NULL) {
return NULL;
}
nextenv = *env;
while(nextenv != NULL) {
int nextlen;
nextlen = strlen(nextenv);
totlen += nextlen + 1;
count++;
nextenv = *(env + count);
}
GET_TOKEN_AREA(t, dptr, 5 + totlen);
if(t == NULL) {
return NULL;
}
ADD_U_CHAR(dptr, AU_EXEC_ENV_TOKEN);
ADD_U_INT32(dptr, count);
for(i =0; i< count; i++) {
nextenv = *(env + i);
ADD_MEM(dptr, nextenv, strlen(nextenv) + 1);
}
return t;
}
token_t *kau_to_header32(const struct timespec *ctime, int rec_size,
au_event_t e_type, au_emod_t e_mod)
{
token_t *t;
u_char *dptr;
u_int32_t timems = ctime->tv_nsec/1000000;
GET_TOKEN_AREA(t, dptr, 18);
if(t == NULL) {
return NULL;
}
ADD_U_CHAR(dptr, AU_HEADER_32_TOKEN);
ADD_U_INT32(dptr, rec_size);
ADD_U_CHAR(dptr, HEADER_VERSION);
ADD_U_INT16(dptr, e_type);
ADD_U_INT16(dptr, e_mod);
ADD_U_INT32(dptr, ctime->tv_sec);
ADD_U_INT32(dptr, timems);
return t;
}
token_t *kau_to_header64(
__unused const struct timespec *ctime,
__unused int rec_size,
__unused au_event_t e_type,
__unused au_emod_t e_mod)
{
return NULL;
}
token_t *kau_to_header(const struct timespec *ctime, int rec_size,
au_event_t e_type, au_emod_t e_mod)
{
return kau_to_header32(ctime, rec_size, e_type, e_mod);
}
token_t *au_to_trailer(int rec_size)
{
token_t *t;
u_char *dptr;
u_int16_t magic = TRAILER_PAD_MAGIC;
GET_TOKEN_AREA(t, dptr, 7);
if(t == NULL) {
return NULL;
}
ADD_U_CHAR(dptr, AU_TRAILER_TOKEN);
ADD_U_INT16(dptr, magic);
ADD_U_INT32(dptr, rec_size);
return t;
}