/* * Copyright (c) 2006-2014 Apple Inc. All rights reserved. * * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ * * This file contains Original Code and/or Modifications of Original Code * as defined in and that are subject to the Apple Public Source License * Version 2.0 (the 'License'). You may not use this file except in * compliance with the License. The rights granted to you under the License * may not be used to create, or enable the creation or redistribution of, * unlawful or unlicensed copies of an Apple operating system, or to * circumvent, violate, or enable the circumvention or violation of, any * terms of an Apple operating system software license agreement. * * Please obtain a copy of the License at * http://www.opensource.apple.com/apsl/ and read it before using this file. * * The Original Code and all software distributed under the License are * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. * Please see the License for the specific language governing rights and * limitations under the License. * * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ */ #include <sys/errno.h> #include <sys/types.h> #include <sys/malloc.h> #include <sys/buf.h> #include <sys/time.h> #include <sys/kauth.h> #include <sys/mount.h> #include <sys/vnode.h> #include <sys/syslog.h> #include <sys/vnode_internal.h> #include <sys/fslog.h> #include <sys/mount_internal.h> #include <sys/kasl.h> #include <dev/random/randomdev.h> #include <uuid/uuid.h> #include <stdarg.h> /* Log information about external modification of a process, * using MessageTracer formatting. Assumes that both the caller * and target are appropriately locked. * Currently prints following information - * 1. Caller process name (truncated to 16 characters) * 2. Caller process Mach-O UUID * 3. Target process name (truncated to 16 characters) * 4. Target process Mach-O UUID */ void fslog_extmod_msgtracer(proc_t caller, proc_t target) { if ((caller != PROC_NULL) && (target != PROC_NULL)) { /* * Print into buffer large enough for "ThisIsAnApplicat(BC223DD7-B314-42E0-B6B0-C5D2E6638337)", * including space for escaping, and NUL byte included in sizeof(uuid_string_t). */ uuid_string_t uuidstr; char c_name[2*MAXCOMLEN + 2 /* () */ + sizeof(uuid_string_t)]; char t_name[2*MAXCOMLEN + 2 /* () */ + sizeof(uuid_string_t)]; strlcpy(c_name, caller->p_comm, sizeof(c_name)); uuid_unparse_upper(caller->p_uuid, uuidstr); strlcat(c_name, "(", sizeof(c_name)); strlcat(c_name, uuidstr, sizeof(c_name)); strlcat(c_name, ")", sizeof(c_name)); if (0 != escape_str(c_name, strlen(c_name), sizeof(c_name))) { return; } strlcpy(t_name, target->p_comm, sizeof(t_name)); uuid_unparse_upper(target->p_uuid, uuidstr); strlcat(t_name, "(", sizeof(t_name)); strlcat(t_name, uuidstr, sizeof(t_name)); strlcat(t_name, ")", sizeof(t_name)); if (0 != escape_str(t_name, strlen(t_name), sizeof(t_name))) { return; } #if DEBUG printf("EXTMOD: %s(%d) -> %s(%d)\n", c_name, proc_pid(caller), t_name, proc_pid(target)); #endif kern_asl_msg(LOG_DEBUG, "messagetracer", 5, "com.apple.message.domain", "com.apple.kernel.external_modification", /* 0 */ "com.apple.message.signature", c_name, /* 1 */ "com.apple.message.signature2", t_name, /* 2 */ "com.apple.message.result", "noop", /* 3 */ "com.apple.message.summarize", "YES", /* 4 */ NULL); } }