1*4d495c6eSApple OSS Distributions #pragma clang diagnostic ignored "-Wdeprecated-declarations" 2*4d495c6eSApple OSS Distributions 3*4d495c6eSApple OSS Distributions #include <bsm/audit.h> 4*4d495c6eSApple OSS Distributions #include <bsm/audit_session.h> 5*4d495c6eSApple OSS Distributions #include <err.h> 6*4d495c6eSApple OSS Distributions #include <sysexits.h> 7*4d495c6eSApple OSS Distributions #include <unistd.h> 8*4d495c6eSApple OSS Distributions #include <errno.h> 9*4d495c6eSApple OSS Distributions #include <string.h> 10*4d495c6eSApple OSS Distributions 11*4d495c6eSApple OSS Distributions #include <darwintest.h> 12*4d495c6eSApple OSS Distributions #include <darwintest_utils.h> 13*4d495c6eSApple OSS Distributions 14*4d495c6eSApple OSS Distributions T_GLOBAL_META(T_META_RUN_CONCURRENTLY(true)); 15*4d495c6eSApple OSS Distributions 16*4d495c6eSApple OSS Distributions T_DECL(invalid_setaudit_57414044, 17*4d495c6eSApple OSS Distributions "Verify that auditing a setaudit_addr syscall which has an invalid " 18*4d495c6eSApple OSS Distributions "at_type field does not panic", 19*4d495c6eSApple OSS Distributions T_META_CHECK_LEAKS(false), T_META_TAG_VM_PREFERRED) 20*4d495c6eSApple OSS Distributions { 21*4d495c6eSApple OSS Distributions T_SETUPBEGIN; 22*4d495c6eSApple OSS Distributions 23*4d495c6eSApple OSS Distributions int cond, ret = auditon(A_GETCOND, &cond, sizeof(cond)); 24*4d495c6eSApple OSS Distributions if (ret == -1 && errno == ENOSYS) { 25*4d495c6eSApple OSS Distributions T_SKIP("no kernel support for auditing; can't test"); 26*4d495c6eSApple OSS Distributions } 27*4d495c6eSApple OSS Distributions T_ASSERT_POSIX_SUCCESS(ret, "auditon A_GETCOND"); 28*4d495c6eSApple OSS Distributions if (cond != AUC_AUDITING) { 29*4d495c6eSApple OSS Distributions T_SKIP("auditing is not enabled; can't test"); 30*4d495c6eSApple OSS Distributions } 31*4d495c6eSApple OSS Distributions 32*4d495c6eSApple OSS Distributions /* set up auditing to audit `setaudit_addr` */ 33*4d495c6eSApple OSS Distributions auditpinfo_addr_t pinfo_addr = {.ap_pid = getpid()}; 34*4d495c6eSApple OSS Distributions T_ASSERT_POSIX_SUCCESS(auditon(A_GETPINFO_ADDR, &pinfo_addr, sizeof(pinfo_addr)), NULL); 35*4d495c6eSApple OSS Distributions auditpinfo_t pinfo = {.ap_pid = getpid(), .ap_mask = pinfo_addr.ap_mask}; 36*4d495c6eSApple OSS Distributions pinfo.ap_mask.am_failure |= 0x800; /* man 5 audit_class */ 37*4d495c6eSApple OSS Distributions T_ASSERT_POSIX_SUCCESS(auditon(A_SETPMASK, &pinfo, sizeof(pinfo)), NULL); 38*4d495c6eSApple OSS Distributions 39*4d495c6eSApple OSS Distributions T_SETUPEND; 40*4d495c6eSApple OSS Distributions 41*4d495c6eSApple OSS Distributions struct auditinfo_addr a; 42*4d495c6eSApple OSS Distributions memset(&a, 0, sizeof(a)); 43*4d495c6eSApple OSS Distributions a.ai_termid.at_type = 999; 44*4d495c6eSApple OSS Distributions T_ASSERT_POSIX_FAILURE(setaudit_addr(&a, sizeof(a)), EINVAL, 45*4d495c6eSApple OSS Distributions "setaudit_addr should fail due to invalid at_type"); 46*4d495c6eSApple OSS Distributions } 47