Ejemplo n.º 1
0
void
audit_queue_init(au_queue_t *q)
{
	q->auq_head = NULL;
	q->auq_tail = NULL;
	(void) pthread_mutex_init(&q->auq_lock, NULL);
	q->auq_count = 0;
#if DEBUG
	dbfp = __auditd_debug_file_open();
#endif
}
Ejemplo n.º 2
0
/*
 * auditd_plugin_open() may be called multiple times; on initial open or
 * `audit -s`, then kvlist != NULL; on `audit -n`, then kvlist == NULL.
 * For more information see audit(1M).
 *
 * Note, that space on stack allocated for any error message returned along
 * with AUDITD_RETRY is subsequently freed by auditd.
 *
 */
auditd_rc_t
auditd_plugin_open(const kva_t *kvlist, char **ret_list, char **error)
{
	kva_t	*kv;
	char	*val_str;
	int	val;
	long	val_l;
	int	rc = 0;

	*error = NULL;
	*ret_list = NULL;
	kv = (kva_t *)kvlist;

#if DEBUG
	dfile = __auditd_debug_file_open();
#endif

	/* initial open or audit -s */
	if (kvlist != NULL) {
		DPRINT((dfile, "Action: initial open or `audit -s`\n"));
		val_str = kva_match(kv, "p_timeout");
		if (val_str == NULL) {
			*error = strdup(
			    gettext("p_timeout attribute not found"));
			return (AUDITD_RETRY);
		}
		DPRINT((dfile, "val_str=%s\n", val_str));
		errno = 0;
		val = atoi(val_str);
		if (errno == 0 && val >= 1) {
			timeout_p_timeout = val;
			timeout = val;
		} else {
			timeout_p_timeout = DEFAULT_TIMEOUT;
			timeout = timeout_p_timeout;
			DPRINT((dfile, "p_timeout set to default value: %d\n",
			    timeout));
		}

		val_str = kva_match(kv, "p_retries");
		if (val_str == NULL) {
			*error = strdup(
			    gettext("p_retries attribute not found"));
			return (AUDITD_RETRY);
		}
		DPRINT((dfile, "val_str=%s\n", val_str));
		errno = 0;
		val = atoi(val_str);
		if (errno == 0 && val >= 0) {
			retries = val;
		}

		val_str = kva_match(kv, "qsize");
		if (val_str == NULL) {
			*error = strdup(gettext("qsize attribute not found"));
			return (AUDITD_RETRY);
		}
		DPRINT((dfile, "qsize=%s\n", val_str));
		errno = 0;
		val_l = atol(val_str);
		if (errno == 0 && val_l >= 0) {
			transq_count_max = val_l;
		}
		if (transq_count_max == 0 &&
		    (rc = set_transq_count_max()) != AUDITD_SUCCESS) {
			*error = strdup(gettext("cannot get kernel "
			    "auditd queue high water mark\n"));
			return (rc);
		}
		DPRINT((dfile, "timeout=%d, retries=%d, transq_count_max=%ld\n",
		    timeout, retries, transq_count_max));

		val_str = kva_match(kv, "p_hosts");
		if (val_str == NULL) {
			*error = strdup(gettext("no hosts configured"));
			return (AUDITD_RETRY);
		}
		if ((rc = parsehosts(val_str, error)) != AUDITD_SUCCESS) {
			return (rc);
		}

		/* create the notification pipe towards the receiving thread */
		if (!notify_pipe_ready) {
			if (create_notify_pipe(notify_pipe, error)) {
				notify_pipe_ready = B_TRUE;
			} else {
				return (AUDITD_RETRY);
			}
		}

#if DEBUG
	} else { /* audit -n */
		DPRINT((dfile, "Action: `audit -n`\n"));
#endif
	}

	return (AUDITD_SUCCESS);
}