aboutsummaryrefslogtreecommitdiff
path: root/sys/bsm
diff options
context:
space:
mode:
authorRobert Watson <rwatson@FreeBSD.org>2008-12-02 23:26:43 +0000
committerRobert Watson <rwatson@FreeBSD.org>2008-12-02 23:26:43 +0000
commit52267f7411adcc76ede961420e08c0e42f42d415 (patch)
tree909e4490f5c6d4141d466ad2fdf963beeb90afca /sys/bsm
parent23c30ae8754294d1d17b16866ed09f282cda357d (diff)
parenta5c6cfa00d9aad0a0da65a940ac6d782edfa841e (diff)
downloadsrc-52267f7411adcc76ede961420e08c0e42f42d415.tar.gz
src-52267f7411adcc76ede961420e08c0e42f42d415.zip
Merge OpenBSM 1.1 alpha 2 from the OpenBSM vendor branch to head, both
contrib/openbsm (svn merge) and sys/{bsm,security/audit} (manual merge). - Add OpenBSM contrib tree to include paths for audit(8) and auditd(8). - Merge support for new tokens, fixes to existing token generation to audit_bsm_token.c. - Synchronize bsm includes and definitions. OpenBSM history for imported revisions below for reference. MFC after: 1 month Sponsored by: Apple Inc. Obtained from: TrustedBSD Project -- OpenBSM 1.1 alpha 2 - Include files in OpenBSM are now broken out into two parts: library builds required solely for user space, and system includes, which may also be required for use in the kernels of systems integrating OpenBSM. Submitted by Stacey Son. - Configure option --with-native-includes allows forcing the use of native include for system includes, rather than the versions bundled with OpenBSM. This is intended specifically for platforms that ship OpenBSM, have adapted versions of the system includes in a kernel source tree, and will use the OpenBSM build infrastructure with an unmodified OpenBSM distribution, allowing the customized system includes to be used with the OpenBSM build. Submitted by Stacey Son. - Various strcpy()'s/strcat()'s have been changed to strlcpy()'s/strlcat()'s or asprintf(). Added compat/strlcpy.h for Linux. - Remove compatibility defines for old Darwin token constant names; now only BSM token names are provided and used. - Add support for extended header tokens, which contain space for information on the host generating the record. - Add support for setting extended host information in the kernel, which is used for setting host information in extended header tokens. The audit_control file now supports a "host" parameter which can be used by auditd to set the information; if not present, the kernel parameters won't be set and auditd uses unextended headers for records that it generates. OpenBSM 1.1 alpha 1 - Add option to auditreduce(1) which allows users to invert sense of matching, such that BSM records that do not match, are selected. - Fix bug in audit_write() where we commit an incomplete record in the event there is an error writing the subject token. This was submitted by Diego Giagio. - Build support for Mac OS X 10.5.1 submitted by Eric Hall. - Fix a bug which resulted in host XML attributes not being arguments so that const strings can be passed as arguments to tokens. This patch was submitted by Xin LI. - Modify the -m option so users can select more then one audit event. - For Mac OS X, added Mach IPC support for audit trigger messages. - Fixed a bug in getacna() which resulted in a locking problem on Mac OS X. - Added LOG_PERROR flag to openlog when -d option is used with auditd. - AUE events added for Mac OS X Leopard system calls.
Notes
Notes: svn path=/head/; revision=185573
Diffstat (limited to 'sys/bsm')
-rw-r--r--sys/bsm/audit.h4
-rw-r--r--sys/bsm/audit_internal.h4
-rw-r--r--sys/bsm/audit_kevents.h61
-rw-r--r--sys/bsm/audit_record.h92
4 files changed, 77 insertions, 84 deletions
diff --git a/sys/bsm/audit.h b/sys/bsm/audit.h
index bed5e73adb4f..029919fb6468 100644
--- a/sys/bsm/audit.h
+++ b/sys/bsm/audit.h
@@ -1,4 +1,4 @@
-/*
+/*-
* Copyright (c) 2005 Apple Inc.
* All rights reserved.
*
@@ -26,7 +26,7 @@
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
- * P4: //depot/projects/trustedbsd/audit3/sys/bsm/audit.h#40
+ * P4: //depot/projects/trustedbsd/openbsm/sys/bsm/audit.h#1
* $FreeBSD$
*/
diff --git a/sys/bsm/audit_internal.h b/sys/bsm/audit_internal.h
index 19bec4591874..dc583ab7a9d8 100644
--- a/sys/bsm/audit_internal.h
+++ b/sys/bsm/audit_internal.h
@@ -1,4 +1,4 @@
-/*
+/*-
* Copyright (c) 2005 Apple Inc.
* Copyright (c) 2005 SPARTA, Inc.
* All rights reserved.
@@ -30,7 +30,7 @@
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
- * P4: //depot/projects/trustedbsd/audit3/sys/bsm/audit_internal.h#18
+ * P4: //depot/projects/trustedbsd/openbsm/sys/bsm/audit_internal.h#2
* $FreeBSD$
*/
diff --git a/sys/bsm/audit_kevents.h b/sys/bsm/audit_kevents.h
index 6e073d47fe70..a881d78f65c4 100644
--- a/sys/bsm/audit_kevents.h
+++ b/sys/bsm/audit_kevents.h
@@ -1,4 +1,4 @@
-/*
+/*-
* Copyright (c) 2005 Apple Inc.
* All rights reserved.
*
@@ -26,7 +26,7 @@
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
- * P4: //depot/projects/trustedbsd/audit3/sys/bsm/audit_kevents.h#34
+ * P4: //depot/projects/trustedbsd/openbsm/sys/bsm/audit_kevents.h#3
* $FreeBSD$
*/
@@ -308,6 +308,7 @@
#define AUE_PF_POLICY_FLIP 298 /* Solaris-specific. */
#define AUE_PF_POLICY_FLUSH 299 /* Solaris-specific. */
#define AUE_PF_POLICY_ALGS 300 /* Solaris-specific. */
+#define AUE_PORTFS 301 /* Solaris-specific. */
/*
* Events added for Apple Darwin that potentially collide with future Solaris
@@ -516,17 +517,17 @@
#define AUE_READDIR 43118 /* Linux. */
#define AUE_IOPL 43119 /* Linux. */
#define AUE_VM86 43120 /* Linux. */
-#define AUE_MAC_GET_PROC 43121 /* FreeBSD. */
-#define AUE_MAC_SET_PROC 43122 /* FreeBSD. */
-#define AUE_MAC_GET_FD 43123 /* FreeBSD. */
-#define AUE_MAC_GET_FILE 43124 /* FreeBSD. */
-#define AUE_MAC_SET_FD 43125 /* FreeBSD. */
-#define AUE_MAC_SET_FILE 43126 /* FreeBSD. */
+#define AUE_MAC_GET_PROC 43121 /* FreeBSD/Darwin. */
+#define AUE_MAC_SET_PROC 43122 /* FreeBSD/Darwin. */
+#define AUE_MAC_GET_FD 43123 /* FreeBSD/Darwin. */
+#define AUE_MAC_GET_FILE 43124 /* FreeBSD/Darwin. */
+#define AUE_MAC_SET_FD 43125 /* FreeBSD/Darwin. */
+#define AUE_MAC_SET_FILE 43126 /* FreeBSD/Darwin. */
#define AUE_MAC_SYSCALL 43127 /* FreeBSD. */
-#define AUE_MAC_GET_PID 43128 /* FreeBSD. */
-#define AUE_MAC_GET_LINK 43129 /* FreeBSD. */
-#define AUE_MAC_SET_LINK 43130 /* FreeBSD. */
-#define AUE_MAC_EXECVE 43131 /* FreeBSD. */
+#define AUE_MAC_GET_PID 43128 /* FreeBSD/Darwin. */
+#define AUE_MAC_GET_LINK 43129 /* FreeBSD/Darwin. */
+#define AUE_MAC_SET_LINK 43130 /* FreeBSD/Darwin. */
+#define AUE_MAC_EXECVE 43131 /* FreeBSD/Darwin. */
#define AUE_GETPATH_FROMFD 43132 /* FreeBSD. */
#define AUE_GETPATH_FROMADDR 43133 /* FreeBSD. */
#define AUE_MQ_OPEN 43134 /* FreeBSD. */
@@ -548,7 +549,43 @@
#define AUE_MKNODAT 43150 /* FreeBSD. */
#define AUE_READLINKAT 43151 /* FreeBSD. */
#define AUE_SYMLINKAT 43152 /* FreeBSD. */
+#define AUE_MAC_GETFSSTAT 43153 /* Darwin. */
+#define AUE_MAC_GET_MOUNT 43154 /* Darwin. */
+#define AUE_MAC_GET_LCID 43155 /* Darwin. */
+#define AUE_MAC_GET_LCTX 43156 /* Darwin. */
+#define AUE_MAC_SET_LCTX 43157 /* Darwin. */
+#define AUE_MAC_MOUNT 43158 /* Darwin. */
+#define AUE_GETLCID 43159 /* Darwin. */
+#define AUE_SETLCID 43160 /* Darwin. */
+#define AUE_TASKNAMEFORPID 43161 /* Darwin. */
+#define AUE_ACCESS_EXTENDED 43162 /* Darwin. */
+#define AUE_CHMOD_EXTENDED 43163 /* Darwin. */
+#define AUE_FCHMOD_EXTENDED 43164 /* Darwin. */
+#define AUE_FSTAT_EXTENDED 43165 /* Dariwn. */
+#define AUE_LSTAT_EXTENDED 43166 /* Darwin. */
+#define AUE_MKDIR_EXTENDED 43167 /* Darwin. */
+#define AUE_MKFIFO_EXTENDED 43168 /* Darwin. */
+#define AUE_OPEN_EXTENDED 43169 /* Darwin. */
+#define AUE_OPEN_EXTENDED_R 43170 /* Darwin. */
+#define AUE_OPEN_EXTENDED_RC 43171 /* Darwin. */
+#define AUE_OPEN_EXTENDED_RT 43172 /* Darwin. */
+#define AUE_OPEN_EXTENDED_RTC 43173 /* Darwin. */
+#define AUE_OPEN_EXTENDED_W 43174 /* Darwin. */
+#define AUE_OPEN_EXTENDED_WC 43175 /* Darwin. */
+#define AUE_OPEN_EXTENDED_WT 43176 /* Darwin. */
+#define AUE_OPEN_EXTENDED_WTC 43177 /* Darwin. */
+#define AUE_OPEN_EXTENDED_RW 43178 /* Darwin. */
+#define AUE_OPEN_EXTENDED_RWC 43179 /* Darwin. */
+#define AUE_OPEN_EXTENDED_RWT 43180 /* Darwin. */
+#define AUE_OPEN_EXTENDED_RWTC 43181 /* Darwin. */
+#define AUE_STAT_EXTENDED 43182 /* Darwin. */
+#define AUE_UMASK_EXTENDED 43183 /* Darwin. */
+#define AUE_OPENAT 43184 /* FreeBSD. */
#define AUE_POSIX_OPENPT 43185 /* FreeBSD. */
+#define AUE_CAP_NEW 43186 /* TrustedBSD. */
+#define AUE_CAP_GETRIGHTS 43187 /* TrustedBSD. */
+#define AUE_CAP_ENTER 43188 /* TrustedBSD. */
+#define AUE_CAP_GETMODE 43189 /* TrustedBSD. */
/*
* Darwin BSM uses a number of AUE_O_* definitions, which are aliased to the
diff --git a/sys/bsm/audit_record.h b/sys/bsm/audit_record.h
index 4e269ea2f538..186b4f5db54d 100644
--- a/sys/bsm/audit_record.h
+++ b/sys/bsm/audit_record.h
@@ -1,5 +1,5 @@
-/*
- * Copyright (c) 2005 Apple Inc.
+/*-
+ * Copyright (c) 2005-2008 Apple Inc.
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
@@ -26,7 +26,7 @@
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
- * P4: //depot/projects/trustedbsd/audit3/sys/bsm/audit_record.h#26
+ * P4: //depot/projects/trustedbsd/openbsm/sys/bsm/audit_record.h#3
* $FreeBSD$
*/
@@ -48,7 +48,7 @@
#define AUT_IPC 0x22
#define AUT_PATH 0x23
#define AUT_SUBJECT32 0x24
-#define AUT_SERVER32 0x25
+#define AUT_XATPATH 0x25
#define AUT_PROCESS32 0x26
#define AUT_RETURN32 0x27
#define AUT_TEXT 0x28
@@ -64,9 +64,7 @@
#define AUT_IPC_PERM 0x32
#define AUT_LABEL 0x33
#define AUT_GROUPS 0x34
-#define AUT_ILABEL 0x35
-#define AUT_SLABEL 0x36
-#define AUT_CLEAR 0x37
+#define AUT_ACE 0x35
#define AUT_PRIV 0x38
#define AUT_UPRIV 0x39
#define AUT_LIAISON 0x3a
@@ -74,22 +72,28 @@
#define AUT_EXEC_ARGS 0x3c
#define AUT_EXEC_ENV 0x3d
#define AUT_ATTR32 0x3e
-/* #define AUT_???? 0x3f */
+#define AUT_UNAUTH 0x3f
#define AUT_XATOM 0x40
#define AUT_XOBJ 0x41
#define AUT_XPROTO 0x42
#define AUT_XSELECT 0x43
-/* XXXRW: Additional X11 tokens not defined? */
+#define AUT_XCOLORMAP 0x44
+#define AUT_XCURSOR 0x45
+#define AUT_XFONT 0x46
+#define AUT_XGC 0x47
+#define AUT_XPIXMAP 0x48
+#define AUT_XPROPERTY 0x49
+#define AUT_XWINDOW 0x4a
+#define AUT_XCLIENT 0x4b
#define AUT_CMD 0x51
#define AUT_EXIT 0x52
#define AUT_ZONENAME 0x60
-/* XXXRW: OpenBSM AUT_HOST 0x70? */
+#define AUT_HOST 0x70
#define AUT_ARG64 0x71
#define AUT_RETURN64 0x72
#define AUT_ATTR64 0x73
#define AUT_HEADER64 0x74
#define AUT_SUBJECT64 0x75
-#define AUT_SERVER64 0x76
#define AUT_PROCESS64 0x77
#define AUT_OTHER_FILE64 0x78
#define AUT_HEADER64_EX 0x79
@@ -108,55 +112,10 @@
#define AUT_ARG AUT_ARG32
#define AUT_RETURN AUT_RETURN32
#define AUT_SUBJECT AUT_SUBJECT32
-#define AUT_SERVER AUT_SERVER32
#define AUT_PROCESS AUT_PROCESS32
#define AUT_OTHER_FILE AUT_OTHER_FILE32
/*
- * Darwin's bsm distribution uses the following non-BSM token name defines.
- * We provide them for a single OpenBSM release for compatibility reasons.
- */
-#define AU_FILE_TOKEN AUT_OTHER_FILE32
-#define AU_TRAILER_TOKEN AUT_TRAILER
-#define AU_HEADER_32_TOKEN AUT_HEADER32
-#define AU_DATA_TOKEN AUT_DATA
-#define AU_ARB_TOKEN AUT_DATA
-#define AU_IPC_TOKEN AUT_IPC
-#define AU_PATH_TOKEN AUT_PATH
-#define AU_SUBJECT_32_TOKEN AUT_SUBJECT32
-#define AU_PROCESS_32_TOKEN AUT_PROCESS32
-#define AU_RETURN_32_TOKEN AUT_RETURN32
-#define AU_TEXT_TOKEN AUT_TEXT
-#define AU_OPAQUE_TOKEN AUT_OPAQUE
-#define AU_IN_ADDR_TOKEN AUT_IN_ADDR
-#define AU_IP_TOKEN AUT_IP
-#define AU_IPORT_TOKEN AUT_IPORT
-#define AU_ARG32_TOKEN AUT_ARG32
-#define AU_SOCK_TOKEN AUT_SOCKET
-#define AU_SEQ_TOKEN AUT_SEQ
-#define AU_ATTR_TOKEN AUT_ATTR
-#define AU_IPCPERM_TOKEN AUT_IPC_PERM
-#define AU_NEWGROUPS_TOKEN AUT_NEWGROUPS
-#define AU_EXEC_ARG_TOKEN AUT_EXEC_ARGS
-#define AU_EXEC_ENV_TOKEN AUT_EXEC_ENV
-#define AU_ATTR32_TOKEN AUT_ATTR32
-#define AU_CMD_TOKEN AUT_CMD
-#define AU_EXIT_TOKEN AUT_EXIT
-#define AU_ARG64_TOKEN AUT_ARG64
-#define AU_RETURN_64_TOKEN AUT_RETURN64
-#define AU_ATTR64_TOKEN AUT_ATTR64
-#define AU_HEADER_64_TOKEN AUT_HEADER64
-#define AU_SUBJECT_64_TOKEN AUT_SUBJECT64
-#define AU_PROCESS_64_TOKEN AUT_PROCESS64
-#define AU_HEADER_64_EX_TOKEN AUT_HEADER64_EX
-#define AU_SUBJECT_32_EX_TOKEN AUT_SUBJECT32_EX
-#define AU_PROCESS_32_EX_TOKEN AUT_PROCESS32_EX
-#define AU_SUBJECT_64_EX_TOKEN AUT_SUBJECT64_EX
-#define AU_PROCESS_64_EX_TOKEN AUT_PROCESS64_EX
-#define AU_IN_ADDR_EX_TOKEN AUT_IN_ADDR_EX
-#define AU_SOCK_32_EX_TOKEN AUT_SOCKET_EX
-
-/*
* The values for the following token ids are not defined by BSM.
*
* XXXRW: Not sure how to handle these in OpenBSM yet, but I'll give them
@@ -166,9 +125,6 @@
#define AUT_SOCKINET32 0x80 /* XXX */
#define AUT_SOCKINET128 0x81 /* XXX */
#define AUT_SOCKUNIX 0x82 /* XXX */
-#define AU_SOCK_INET_32_TOKEN AUT_SOCKINET32
-#define AU_SOCK_INET_128_TOKEN AUT_SOCKINET128
-#define AU_SOCK_UNIX_TOKEN AUT_SOCKUNIX
/* print values for the arbitrary token */
#define AUP_BINARY 0
@@ -240,7 +196,7 @@ int au_close(int d, int keep, short event);
int au_close_buffer(int d, short event, u_char *buffer, size_t *buflen);
int au_close_token(token_t *tok, u_char *buffer, size_t *buflen);
-token_t *au_to_file(char *file, struct timeval tm);
+token_t *au_to_file(const char *file, struct timeval tm);
token_t *au_to_header32_tm(int rec_size, au_event_t e_type, au_emod_t e_mod,
struct timeval tm);
@@ -256,9 +212,9 @@ token_t *au_to_header64(int rec_size, au_event_t e_type, au_emod_t e_mod);
#endif
token_t *au_to_me(void);
-token_t *au_to_arg(char n, char *text, uint32_t v);
-token_t *au_to_arg32(char n, char *text, uint32_t v);
-token_t *au_to_arg64(char n, char *text, uint64_t v);
+token_t *au_to_arg(char n, const char *text, uint32_t v);
+token_t *au_to_arg32(char n, const char *text, uint32_t v);
+token_t *au_to_arg64(char n, const char *text, uint64_t v);
#if defined(_KERNEL) || defined(KERNEL)
token_t *au_to_attr(struct vnode_au_info *vni);
@@ -267,7 +223,7 @@ token_t *au_to_attr64(struct vnode_au_info *vni);
#endif
token_t *au_to_data(char unit_print, char unit_type, char unit_count,
- char *p);
+ const char *p);
token_t *au_to_exit(int retval, int err);
token_t *au_to_groups(int *groups);
token_t *au_to_newgroups(uint16_t n, gid_t *groups);
@@ -277,8 +233,8 @@ token_t *au_to_ip(struct ip *ip);
token_t *au_to_ipc(char type, int id);
token_t *au_to_ipc_perm(struct ipc_perm *perm);
token_t *au_to_iport(uint16_t iport);
-token_t *au_to_opaque(char *data, uint16_t bytes);
-token_t *au_to_path(char *path);
+token_t *au_to_opaque(const char *data, uint16_t bytes);
+token_t *au_to_path(const char *path);
token_t *au_to_process(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
gid_t rgid, pid_t pid, au_asid_t sid, au_tid_t *tid);
token_t *au_to_process32(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
@@ -328,10 +284,10 @@ token_t *au_to_exec_env(char *envs, int envc);
token_t *au_to_exec_args(char **argv);
token_t *au_to_exec_env(char **envp);
#endif
-token_t *au_to_text(char *text);
+token_t *au_to_text(const char *text);
token_t *au_to_kevent(struct kevent *kev);
token_t *au_to_trailer(int rec_size);
-token_t *au_to_zonename(char *zonename);
+token_t *au_to_zonename(const char *zonename);
__END_DECLS