/*
* The close() system call uses it's own audit call to capture the path/vnode
* information because those pieces are not easily obtained within the system
* call itself.
*/
void
audit_sysclose(struct thread *td, int fd)
{
struct kaudit_record *ar;
struct vnode *vp;
struct file *fp;
int vfslocked;
KASSERT(td != NULL, ("audit_sysclose: td == NULL"));
ar = currecord();
if (ar == NULL)
return;
audit_arg_fd(fd);
if (getvnode(td->td_proc->p_fd, fd, &fp) != 0)
return;
vp = fp->f_vnode;
vfslocked = VFS_LOCK_GIANT(vp->v_mount);
vn_lock(vp, LK_SHARED | LK_RETRY);
audit_arg_vnode1(vp);
VOP_UNLOCK(vp, 0);
VFS_UNLOCK_GIANT(vfslocked);
fdrop(fp, td);
}
void
audit_arg_sockaddr(struct thread *td, struct sockaddr *sa)
{
struct kaudit_record *ar;
KASSERT(td != NULL, ("audit_arg_sockaddr: td == NULL"));
KASSERT(sa != NULL, ("audit_arg_sockaddr: sa == NULL"));
ar = currecord();
if (ar == NULL)
return;
bcopy(sa, &ar->k_ar.ar_arg_sockaddr, sa->sa_len);
switch (sa->sa_family) {
case AF_INET:
ARG_SET_VALID(ar, ARG_SADDRINET);
break;
case AF_INET6:
ARG_SET_VALID(ar, ARG_SADDRINET6);
break;
case AF_UNIX:
audit_arg_upath1(td, ((struct sockaddr_un *)sa)->sun_path);
ARG_SET_VALID(ar, ARG_SADDRUNIX);
break;
/* XXXAUDIT: default:? */
}
}
void
audit_arg_process(struct proc *p)
{
struct kaudit_record *ar;
struct ucred *cred;
KASSERT(p != NULL, ("audit_arg_process: p == NULL"));
PROC_LOCK_ASSERT(p, MA_OWNED);
ar = currecord();
if (ar == NULL)
return;
cred = p->p_ucred;
ar->k_ar.ar_arg_auid = cred->cr_audit.ai_auid;
ar->k_ar.ar_arg_euid = cred->cr_uid;
ar->k_ar.ar_arg_egid = cred->cr_groups[0];
ar->k_ar.ar_arg_ruid = cred->cr_ruid;
ar->k_ar.ar_arg_rgid = cred->cr_rgid;
ar->k_ar.ar_arg_asid = cred->cr_audit.ai_asid;
ar->k_ar.ar_arg_termid_addr = cred->cr_audit.ai_termid;
ar->k_ar.ar_arg_pid = p->p_pid;
ARG_SET_VALID(ar, ARG_AUID | ARG_EUID | ARG_EGID | ARG_RUID |
ARG_RGID | ARG_ASID | ARG_TERMID_ADDR | ARG_PID | ARG_PROCESS);
}
/*
* Audit information about a file, either the file's vnode info, or its
* socket address info.
*/
void
audit_arg_file(struct proc *p, struct file *fp)
{
struct kaudit_record *ar;
struct socket *so;
struct inpcb *pcb;
struct vnode *vp;
int vfslocked;
ar = currecord();
if (ar == NULL)
return;
switch (fp->f_type) {
case DTYPE_VNODE:
case DTYPE_FIFO:
/*
* XXXAUDIT: Only possibly to record as first vnode?
*/
vp = fp->f_vnode;
vfslocked = VFS_LOCK_GIANT(vp->v_mount);
vn_lock(vp, LK_SHARED | LK_RETRY);
audit_arg_vnode1(vp);
VOP_UNLOCK(vp, 0);
VFS_UNLOCK_GIANT(vfslocked);
break;
case DTYPE_SOCKET:
so = (struct socket *)fp->f_data;
if (INP_CHECK_SOCKAF(so, PF_INET)) {
SOCK_LOCK(so);
ar->k_ar.ar_arg_sockinfo.so_type =
so->so_type;
ar->k_ar.ar_arg_sockinfo.so_domain =
INP_SOCKAF(so);
ar->k_ar.ar_arg_sockinfo.so_protocol =
so->so_proto->pr_protocol;
SOCK_UNLOCK(so);
pcb = (struct inpcb *)so->so_pcb;
INP_RLOCK(pcb);
ar->k_ar.ar_arg_sockinfo.so_raddr =
pcb->inp_faddr.s_addr;
ar->k_ar.ar_arg_sockinfo.so_laddr =
pcb->inp_laddr.s_addr;
ar->k_ar.ar_arg_sockinfo.so_rport =
pcb->inp_fport;
ar->k_ar.ar_arg_sockinfo.so_lport =
pcb->inp_lport;
INP_RUNLOCK(pcb);
ARG_SET_VALID(ar, ARG_SOCKINFO);
}
break;
default:
/* XXXAUDIT: else? */
break;
}
}
void
audit_arg_value(long value)
{
struct kaudit_record *ar;
ar = currecord();
if (ar == NULL)
return;
ar->k_ar.ar_arg_value = value;
ARG_SET_VALID(ar, ARG_VALUE);
}
void
audit_arg_dev(int dev)
{
struct kaudit_record *ar;
ar = currecord();
if (ar == NULL)
return;
ar->k_ar.ar_arg_dev = dev;
ARG_SET_VALID(ar, ARG_DEV);
}
void
audit_arg_mode(mode_t mode)
{
struct kaudit_record *ar;
ar = currecord();
if (ar == NULL)
return;
ar->k_ar.ar_arg_mode = mode;
ARG_SET_VALID(ar, ARG_MODE);
}
void
audit_arg_mask(int mask)
{
struct kaudit_record *ar;
ar = currecord();
if (ar == NULL)
return;
ar->k_ar.ar_arg_mask = mask;
ARG_SET_VALID(ar, ARG_MASK);
}
void
audit_arg_login(char *login)
{
struct kaudit_record *ar;
ar = currecord();
if (ar == NULL)
return;
strlcpy(ar->k_ar.ar_arg_login, login, MAXLOGNAME);
ARG_SET_VALID(ar, ARG_LOGIN);
}
void
audit_arg_sgid(gid_t sgid)
{
struct kaudit_record *ar;
ar = currecord();
if (ar == NULL)
return;
ar->k_ar.ar_arg_sgid = sgid;
ARG_SET_VALID(ar, ARG_SGID);
}
void
audit_arg_fflags(int fflags)
{
struct kaudit_record *ar;
ar = currecord();
if (ar == NULL)
return;
ar->k_ar.ar_arg_fflags = fflags;
ARG_SET_VALID(ar, ARG_FFLAGS);
}
void
audit_arg_fd(int fd)
{
struct kaudit_record *ar;
ar = currecord();
if (ar == NULL)
return;
ar->k_ar.ar_arg_fd = fd;
ARG_SET_VALID(ar, ARG_FD);
}
void
audit_arg_atfd2(int atfd)
{
struct kaudit_record *ar;
ar = currecord();
if (ar == NULL)
return;
ar->k_ar.ar_arg_atfd2 = atfd;
ARG_SET_VALID(ar, ARG_ATFD2);
}
void
audit_arg_pid(pid_t pid)
{
struct kaudit_record *ar;
ar = currecord();
if (ar == NULL)
return;
ar->k_ar.ar_arg_pid = pid;
ARG_SET_VALID(ar, ARG_PID);
}
void
audit_arg_len(int len)
{
struct kaudit_record *ar;
ar = currecord();
if (ar == NULL)
return;
ar->k_ar.ar_arg_len = len;
ARG_SET_VALID(ar, ARG_LEN);
}
void
audit_arg_rights(cap_rights_t rights)
{
struct kaudit_record *ar;
ar = currecord();
if (ar == NULL)
return;
ar->k_ar.ar_arg_rights = rights;
ARG_SET_VALID(ar, ARG_RIGHTS);
}
void
audit_arg_fcntl_rights(uint32_t fcntlrights)
{
struct kaudit_record *ar;
ar = currecord();
if (ar == NULL)
return;
ar->k_ar.ar_arg_fcntl_rights = fcntlrights;
ARG_SET_VALID(ar, ARG_FCNTL_RIGHTS);
}
void
audit_arg_upath2(struct thread *td, char *upath)
{
struct kaudit_record *ar;
ar = currecord();
if (ar == NULL)
return;
audit_arg_upath(td, upath, &ar->k_ar.ar_arg_upath2);
ARG_SET_VALID(ar, ARG_UPATH2);
}
/*
* Calls to manipulate elements of the audit record structure from system
* call code. Macro wrappers will prevent this functions from being entered
* if auditing is disabled, avoiding the function call cost. We check the
* thread audit record pointer anyway, as the audit condition could change,
* and pre-selection may not have allocated an audit record for this event.
*
* XXXAUDIT: Should we assert, in each case, that this field of the record
* hasn't already been filled in?
*/
void
audit_arg_addr(void *addr)
{
struct kaudit_record *ar;
ar = currecord();
if (ar == NULL)
return;
ar->k_ar.ar_arg_addr = addr;
ARG_SET_VALID(ar, ARG_ADDR);
}
void
audit_arg_svipc_id(int id)
{
struct kaudit_record *ar;
ar = currecord();
if (ar == NULL)
return;
ar->k_ar.ar_arg_svipc_id = id;
ARG_SET_VALID(ar, ARG_SVIPC_ID);
}
void
audit_arg_svipc_cmd(int cmd)
{
struct kaudit_record *ar;
ar = currecord();
if (ar == NULL)
return;
ar->k_ar.ar_arg_svipc_cmd = cmd;
ARG_SET_VALID(ar, ARG_SVIPC_CMD);
}
void
audit_arg_auid(uid_t auid)
{
struct kaudit_record *ar;
ar = currecord();
if (ar == NULL)
return;
ar->k_ar.ar_arg_auid = auid;
ARG_SET_VALID(ar, ARG_AUID);
}
void
audit_arg_signum(u_int signum)
{
struct kaudit_record *ar;
ar = currecord();
if (ar == NULL)
return;
ar->k_ar.ar_arg_signum = signum;
ARG_SET_VALID(ar, ARG_SIGNUM);
}
void
audit_arg_exit(int status, int retval)
{
struct kaudit_record *ar;
ar = currecord();
if (ar == NULL)
return;
ar->k_ar.ar_arg_exitstatus = status;
ar->k_ar.ar_arg_exitretval = retval;
ARG_SET_VALID(ar, ARG_EXIT);
}
void
audit_arg_auditon(union auditon_udata *udata)
{
struct kaudit_record *ar;
ar = currecord();
if (ar == NULL)
return;
bcopy((void *)udata, &ar->k_ar.ar_arg_auditon,
sizeof(ar->k_ar.ar_arg_auditon));
ARG_SET_VALID(ar, ARG_AUDITON);
}
void
audit_arg_svipc_perm(struct ipc_perm *perm)
{
struct kaudit_record *ar;
ar = currecord();
if (ar == NULL)
return;
bcopy(perm, &ar->k_ar.ar_arg_svipc_perm,
sizeof(ar->k_ar.ar_arg_svipc_perm));
ARG_SET_VALID(ar, ARG_SVIPC_PERM);
}
void
audit_arg_ctlname(int *name, int namelen)
{
struct kaudit_record *ar;
ar = currecord();
if (ar == NULL)
return;
bcopy(name, &ar->k_ar.ar_arg_ctlname, namelen * sizeof(int));
ar->k_ar.ar_arg_len = namelen;
ARG_SET_VALID(ar, ARG_CTLNAME | ARG_LEN);
}
void
audit_arg_owner(uid_t uid, gid_t gid)
{
struct kaudit_record *ar;
ar = currecord();
if (ar == NULL)
return;
ar->k_ar.ar_arg_uid = uid;
ar->k_ar.ar_arg_gid = gid;
ARG_SET_VALID(ar, ARG_UID | ARG_GID);
}
void
audit_arg_posix_ipc_perm(uid_t uid, gid_t gid, mode_t mode)
{
struct kaudit_record *ar;
ar = currecord();
if (ar == NULL)
return;
ar->k_ar.ar_arg_pipc_perm.pipc_uid = uid;
ar->k_ar.ar_arg_pipc_perm.pipc_gid = gid;
ar->k_ar.ar_arg_pipc_perm.pipc_mode = mode;
ARG_SET_VALID(ar, ARG_POSIX_IPC_PERM);
}
void
audit_arg_socket(int sodomain, int sotype, int soprotocol)
{
struct kaudit_record *ar;
ar = currecord();
if (ar == NULL)
return;
ar->k_ar.ar_arg_sockinfo.so_domain = sodomain;
ar->k_ar.ar_arg_sockinfo.so_type = sotype;
ar->k_ar.ar_arg_sockinfo.so_protocol = soprotocol;
ARG_SET_VALID(ar, ARG_SOCKINFO);
}
