1 /*-
2 * Copyright (c) 2008-2009 Apple Inc.
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 * 3. Neither the name of Apple Inc. ("Apple") nor the names of
14 * its contributors may be used to endorse or promote products derived
15 * from this software without specific prior written permission.
16 *
17 * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND
18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20 * ARE DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR
21 * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
25 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
26 * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
27 * POSSIBILITY OF SUCH DAMAGE.
28 */
29
30 #include <stdarg.h>
31
32 #include <sys/kernel.h>
33 #include <sys/fcntl.h>
34 #include <sys/kauth.h>
35 #include <sys/conf.h>
36 #include <sys/poll.h>
37 #include <sys/priv.h>
38 #include <sys/queue.h>
39 #include <sys/signalvar.h>
40 #include <sys/syscall.h>
41 #include <sys/sysent.h>
42 #include <sys/sysproto.h>
43 #include <sys/systm.h>
44 #include <sys/ucred.h>
45 #include <sys/user.h>
46
47 #include <miscfs/devfs/devfs.h>
48
49 #include <libkern/OSAtomic.h>
50
51 #include <bsm/audit.h>
52 #include <bsm/audit_internal.h>
53 #include <bsm/audit_kevents.h>
54
55 #include <security/audit/audit.h>
56 #include <security/audit/audit_bsd.h>
57 #include <security/audit/audit_ioctl.h>
58 #include <security/audit/audit_private.h>
59
60 #include <vm/vm_protos.h>
61 #include <mach/mach_port.h>
62 #include <kern/audit_sessionport.h>
63
64 #include <libkern/OSDebug.h>
65
66 /*
67 * Audit Session Entry. This is treated as an object with public and private
68 * data. The se_auinfo field is the only information that is public and
69 * needs to be the first entry.
70 */
71 struct au_sentry {
72 auditinfo_addr_t se_auinfo; /* Public audit session data. */
73 #define se_asid se_auinfo.ai_asid
74 #define se_auid se_auinfo.ai_auid
75 #define se_mask se_auinfo.ai_mask
76 #define se_termid se_auinfo.ai_termid
77 #define se_flags se_auinfo.ai_flags
78
79 long se_refcnt; /* Reference count. */
80 long se_procnt; /* Processes in session. */
81 ipc_port_t se_port; /* Session port. */
82 LIST_ENTRY(au_sentry) se_link; /* Hash bucket link list (1) */
83 };
84 typedef struct au_sentry au_sentry_t;
85
86 #define AU_SENTRY_PTR(aia_p) ((au_sentry_t *)(aia_p))
87
88 /*
89 * The default au_sentry/auditinfo_addr entry for ucred.
90 */
91
92 static au_sentry_t audit_default_se = {
93 .se_auinfo = {
94 .ai_auid = AU_DEFAUDITID,
95 .ai_asid = AU_DEFAUDITSID,
96 .ai_termid = { .at_type = AU_IPv4, },
97 },
98 .se_refcnt = 1,
99 .se_procnt = 1,
100 };
101
102 struct auditinfo_addr * const audit_default_aia_p = &audit_default_se.se_auinfo;
103
104 /* Copied from <ipc/ipc_object.h> */
105 #define IPC_OBJECT_COPYIN_FLAGS_ALLOW_IMMOVABLE_SEND 0x1
106 kern_return_t ipc_object_copyin(ipc_space_t, mach_port_name_t,
107 mach_msg_type_name_t, ipc_port_t *, mach_port_context_t, mach_msg_guard_flags_t *, uint32_t);
108 void ipc_port_release_send(ipc_port_t);
109
110 #if CONFIG_AUDIT
111
112
113 /*
114 * Currently the hash table is a fixed size.
115 */
116 #define HASH_TABLE_SIZE 97
117 #define HASH_ASID(asid) (audit_session_hash(asid) % HASH_TABLE_SIZE)
118
119 static struct rwlock se_entry_lck; /* (1) lock for se_link above */
120
121 LIST_HEAD(au_sentry_head, au_sentry);
122 static struct au_sentry_head *au_sentry_bucket = NULL;
123
124 #define AU_HISTORY_LOGGING 0
125 #if AU_HISTORY_LOGGING
126 typedef enum au_history_event {
127 AU_HISTORY_EVENT_UNKNOWN = 0,
128 AU_HISTORY_EVENT_REF = 1,
129 AU_HISTORY_EVENT_UNREF = 2,
130 AU_HISTORY_EVENT_BIRTH = 3,
131 AU_HISTORY_EVENT_DEATH = 4,
132 AU_HISTORY_EVENT_FIND = 5
133 } au_history_event_t;
134
135 #define AU_HISTORY_MAX_STACK_DEPTH 8
136
137 struct au_history {
138 struct au_sentry *ptr;
139 struct au_sentry se;
140 void *stack[AU_HISTORY_MAX_STACK_DEPTH];
141 unsigned int stack_depth;
142 au_history_event_t event;
143 };
144
145 static struct au_history *au_history;
146 static size_t au_history_size = 65536;
147 static unsigned int au_history_index;
148
149 static inline unsigned int
au_history_entries(void)150 au_history_entries(void)
151 {
152 if (au_history_index >= au_history_size) {
153 return au_history_size;
154 } else {
155 return au_history_index;
156 }
157 }
158
159 static inline void
au_history_record(au_sentry_t * se,au_history_event_t event)160 au_history_record(au_sentry_t *se, au_history_event_t event)
161 {
162 struct au_history *p;
163 unsigned int i;
164
165 i = OSAddAtomic(1, &au_history_index);
166 p = &au_history[i % au_history_size];
167
168 bzero(p, sizeof(*p));
169 p->event = event;
170 bcopy(se, &p->se, sizeof(p->se));
171 p->stack_depth = OSBacktrace(&p->stack[0], AU_HISTORY_MAX_STACK_DEPTH);
172 p->ptr = se;
173 }
174 #else
175 #define au_history_record(se, event) do {} while (0)
176 #endif
177
178 MALLOC_DEFINE(M_AU_SESSION, "audit_session", "Audit session data");
179
180 static void audit_ref_session(au_sentry_t *se);
181 static void audit_unref_session(au_sentry_t *se);
182
183 static void audit_session_event(int event, auditinfo_addr_t *aia_p);
184
185 /*
186 * Audit session device.
187 */
188
189 static MALLOC_DEFINE(M_AUDIT_SDEV, "audit_sdev", "Audit sdevs");
190 static MALLOC_DEFINE(M_AUDIT_SDEV_ENTRY, "audit_sdevent",
191 "Audit sdev entries and buffers");
192
193 /*
194 * Default audit sdev buffer parameters.
195 */
196 #define AUDIT_SDEV_QLIMIT_DEFAULT 128
197 #define AUDIT_SDEV_QLIMIT_MIN 1
198 #define AUDIT_SDEV_QLIMIT_MAX 1024
199
200 /*
201 * Entry structure.
202 */
203 struct audit_sdev_entry {
204 void *ase_record;
205 u_int ase_record_len;
206 TAILQ_ENTRY(audit_sdev_entry) ase_queue;
207 };
208
209 /*
210 * Per audit sdev structure.
211 */
212
213 struct audit_sdev {
214 int asdev_open;
215
216 #define AUDIT_SDEV_ASYNC 0x00000001
217 #define AUDIT_SDEV_NBIO 0x00000002
218
219 #define AUDIT_SDEV_ALLSESSIONS 0x00010000
220 u_int asdev_flags;
221
222 struct selinfo asdev_selinfo;
223 pid_t asdev_sigio;
224
225 au_id_t asdev_auid;
226 au_asid_t asdev_asid;
227
228 /* Per-sdev mutex for most fields in this struct. */
229 struct mtx asdev_mtx;
230
231 /*
232 * Per-sdev sleep lock serializing user-generated reads and
233 * flushes. uiomove() is called to copy out the current head
234 * record's data whie the record remains in the queue, so we
235 * prevent other threads from removing it using this lock.
236 */
237 struct slck asdev_sx;
238
239 /*
240 * Condition variable to signal when data has been delivered to
241 * a sdev.
242 */
243 struct cv asdev_cv;
244
245 /* Count and bound of records in the queue. */
246 u_int asdev_qlen;
247 u_int asdev_qlimit;
248
249 /* The number of bytes of data across all records. */
250 u_int asdev_qbyteslen;
251
252 /*
253 * The amount read so far of the first record in the queue.
254 * (The number of bytes available for reading in the queue is
255 * qbyteslen - qoffset.)
256 */
257 u_int asdev_qoffset;
258
259 /*
260 * Per-sdev operation statistics.
261 */
262 u_int64_t asdev_inserts; /* Records added. */
263 u_int64_t asdev_reads; /* Records read. */
264 u_int64_t asdev_drops; /* Records dropped. */
265
266 /*
267 * Current pending record list. This is protected by a
268 * combination of asdev_mtx and asdev_sx. Note that both
269 * locks are required to remove a record from the head of the
270 * queue, as an in-progress read may sleep while copying and,
271 * therefore, cannot hold asdev_mtx.
272 */
273 TAILQ_HEAD(, audit_sdev_entry) asdev_queue;
274
275 /* Global sdev list. */
276 TAILQ_ENTRY(audit_sdev) asdev_list;
277 };
278
279 #define AUDIT_SDEV_LOCK(asdev) mtx_lock(&(asdev)->asdev_mtx)
280 #define AUDIT_SDEV_LOCK_ASSERT(asdev) mtx_assert(&(asdev)->asdev_mtx, \
281 MA_OWNED)
282 #define AUDIT_SDEV_LOCK_DESTROY(asdev) mtx_destroy(&(asdev)->asdev_mtx)
283 #define AUDIT_SDEV_LOCK_INIT(asdev) mtx_init(&(asdev)->asdev_mtx, \
284 "audit_sdev_mtx", NULL, MTX_DEF)
285 #define AUDIT_SDEV_UNLOCK(asdev) mtx_unlock(&(asdev)->asdev_mtx)
286 #define AUDIT_SDEV_MTX(asdev) (&(asdev)->asdev_mtx)
287
288 #define AUDIT_SDEV_SX_LOCK_DESTROY(asd) slck_destroy(&(asd)->asdev_sx)
289 #define AUDIT_SDEV_SX_LOCK_INIT(asd) slck_init(&(asd)->asdev_sx, \
290 "audit_sdev_sx")
291 #define AUDIT_SDEV_SX_XLOCK_ASSERT(asd) slck_assert(&(asd)->asdev_sx, \
292 SA_XLOCKED)
293 #define AUDIT_SDEV_SX_XLOCK_SIG(asd) slck_lock_sig(&(asd)->asdev_sx)
294 #define AUDIT_SDEV_SX_XUNLOCK(asd) slck_unlock(&(asd)->asdev_sx)
295
296 /*
297 * Cloning variables and constants.
298 */
299 #define AUDIT_SDEV_NAME "auditsessions"
300 #define MAX_AUDIT_SDEVS 32
301
302 static int audit_sdev_major;
303 static void *devnode;
304
305 /*
306 * Global list of audit sdevs. The list is protected by a rw lock.
307 * Individaul record queues are protected by per-sdev locks. These
308 * locks synchronize between threads walking the list to deliver to
309 * individual sdevs and adds/removes of sdevs.
310 */
311 static TAILQ_HEAD(, audit_sdev) audit_sdev_list;
312 static struct rwlock audit_sdev_lock;
313
314 #define AUDIT_SDEV_LIST_LOCK_INIT() rw_init(&audit_sdev_lock, \
315 "audit_sdev_list_lock")
316 #define AUDIT_SDEV_LIST_RLOCK() rw_rlock(&audit_sdev_lock)
317 #define AUDIT_SDEV_LIST_RUNLOCK() rw_runlock(&audit_sdev_lock)
318 #define AUDIT_SDEV_LIST_WLOCK() rw_wlock(&audit_sdev_lock)
319 #define AUDIT_SDEV_LIST_WLOCK_ASSERT() rw_assert(&audit_sdev_lock, \
320 RA_WLOCKED)
321 #define AUDIT_SDEV_LIST_WUNLOCK() rw_wunlock(&audit_sdev_lock)
322
323 /*
324 * dev_t doesn't have a pointer for "softc" data so we have to keep track of
325 * it with the following global array (indexed by the minor number).
326 *
327 * XXX We may want to dynamically grow this as need.
328 */
329 static struct audit_sdev *audit_sdev_dtab[MAX_AUDIT_SDEVS];
330
331 /*
332 * Special device methods and definition.
333 */
334 static open_close_fcn_t audit_sdev_open;
335 static open_close_fcn_t audit_sdev_close;
336 static read_write_fcn_t audit_sdev_read;
337 static ioctl_fcn_t audit_sdev_ioctl;
338 static select_fcn_t audit_sdev_poll;
339
340 static const struct cdevsw audit_sdev_cdevsw = {
341 .d_open = audit_sdev_open,
342 .d_close = audit_sdev_close,
343 .d_read = audit_sdev_read,
344 .d_write = eno_rdwrt,
345 .d_ioctl = audit_sdev_ioctl,
346 .d_stop = eno_stop,
347 .d_reset = eno_reset,
348 .d_ttys = NULL,
349 .d_select = audit_sdev_poll,
350 .d_mmap = eno_mmap,
351 .d_strategy = eno_strat,
352 .d_type = 0
353 };
354
355 /*
356 * Global statistics on audit sdevs.
357 */
358 static int audit_sdev_count; /* Current number of sdevs. */
359 static u_int64_t audit_sdev_ever; /* Sdevs ever allocated. */
360 static u_int64_t audit_sdev_records; /* Total records seen. */
361 static u_int64_t audit_sdev_drops; /* Global record drop count. */
362
363 static int audit_sdev_init(void);
364
365 #define AUDIT_SENTRY_RWLOCK_INIT() rw_init(&se_entry_lck, \
366 "se_entry_lck")
367 #define AUDIT_SENTRY_RLOCK() rw_rlock(&se_entry_lck)
368 #define AUDIT_SENTRY_WLOCK() rw_wlock(&se_entry_lck)
369 #define AUDIT_SENTRY_RWLOCK_ASSERT() rw_assert(&se_entry_lck, RA_LOCKED)
370 #define AUDIT_SENTRY_RUNLOCK() rw_runlock(&se_entry_lck)
371 #define AUDIT_SENTRY_WUNLOCK() rw_wunlock(&se_entry_lck)
372
373 /* Access control on the auditinfo_addr.ai_flags member. */
374 static uint64_t audit_session_superuser_set_sflags_mask;
375 static uint64_t audit_session_superuser_clear_sflags_mask;
376 static uint64_t audit_session_member_set_sflags_mask;
377 static uint64_t audit_session_member_clear_sflags_mask;
378 SYSCTL_NODE(, OID_AUTO, audit, CTLFLAG_RW | CTLFLAG_LOCKED, 0, "Audit controls");
379 SYSCTL_NODE(_audit, OID_AUTO, session, CTLFLAG_RW | CTLFLAG_LOCKED, 0, "Audit sessions");
380 SYSCTL_QUAD(_audit_session, OID_AUTO, superuser_set_sflags_mask, CTLFLAG_RW | CTLFLAG_LOCKED,
381 &audit_session_superuser_set_sflags_mask,
382 "Audit session flags settable by superuser");
383 SYSCTL_QUAD(_audit_session, OID_AUTO, superuser_clear_sflags_mask, CTLFLAG_RW | CTLFLAG_LOCKED,
384 &audit_session_superuser_clear_sflags_mask,
385 "Audit session flags clearable by superuser");
386 SYSCTL_QUAD(_audit_session, OID_AUTO, member_set_sflags_mask, CTLFLAG_RW | CTLFLAG_LOCKED,
387 &audit_session_member_set_sflags_mask,
388 "Audit session flags settable by a session member");
389 SYSCTL_QUAD(_audit_session, OID_AUTO, member_clear_sflags_mask, CTLFLAG_RW | CTLFLAG_LOCKED,
390 &audit_session_member_clear_sflags_mask,
391 "Audit session flags clearable by a session member");
392
393 extern int set_security_token_task_internal(proc_t p, void *task);
394
395 #define AUDIT_SESSION_DEBUG 0
396 #if AUDIT_SESSION_DEBUG
397 /*
398 * The following is debugging code that can be used to get a snapshot of the
399 * session state. The audit session information is read out using sysctl:
400 *
401 * error = sysctlbyname("kern.audit_session_debug", buffer_ptr, &buffer_len,
402 * NULL, 0);
403 */
404 #include <kern/kalloc.h>
405
406 /*
407 * The per session record structure for the snapshot data.
408 */
409 struct au_sentry_debug {
410 auditinfo_addr_t se_auinfo;
411 int64_t se_refcnt; /* refereence count */
412 int64_t se_procnt; /* process count */
413 int64_t se_ptcnt; /* process count from
414 * proc table */
415 };
416 typedef struct au_sentry_debug au_sentry_debug_t;
417
418 static int audit_sysctl_session_debug(struct sysctl_oid *oidp, void *arg1,
419 int arg2, struct sysctl_req *req);
420
421 SYSCTL_PROC(_kern, OID_AUTO, audit_session_debug, CTLFLAG_RD | CTLFLAG_LOCKED,
422 NULL, 0, audit_sysctl_session_debug, "S,audit_session_debug",
423 "Current session debug info for auditing.");
424
425 /*
426 * Callouts for proc_interate() which is used to reconcile the audit session
427 * proc state information with the proc table. We get everything we need
428 * in the filterfn while the proc_lock() is held so we really don't need the
429 * callout() function.
430 */
431 static int
audit_session_debug_callout(__unused proc_t p,__unused void * arg)432 audit_session_debug_callout(__unused proc_t p, __unused void *arg)
433 {
434 return PROC_RETURNED_DONE;
435 }
436
437 static int
audit_session_debug_filterfn(proc_t p,void * st)438 audit_session_debug_filterfn(proc_t p, void *st)
439 {
440 kauth_cred_t cred = kauth_cred_get();
441 auditinfo_addr_t *aia_p = cred->cr_audit.as_aia_p;
442 au_sentry_debug_t *sed_tab = (au_sentry_debug_t *) st;
443 au_sentry_debug_t *sdtp;
444 au_sentry_t *se;
445
446 if (IS_VALID_SESSION(aia_p)) {
447 sdtp = &sed_tab[0];
448 do {
449 if (aia_p->ai_asid == sdtp->se_asid) {
450 sdtp->se_ptcnt++;
451
452 /* Do some santy checks. */
453 se = AU_SENTRY_PTR(aia_p);
454 if (se->se_refcnt != sdtp->se_refcnt) {
455 sdtp->se_refcnt =
456 (int64_t)se->se_refcnt;
457 }
458 if (se->se_procnt != sdtp->se_procnt) {
459 sdtp->se_procnt =
460 (int64_t)se->se_procnt;
461 }
462 break;
463 }
464 sdtp++;
465 } while (sdtp->se_asid != 0 && sdtp->se_auid != 0);
466 } else {
467 /* add it to the default sesison */
468 sed_tab->se_ptcnt++;
469 }
470
471 return 0;
472 }
473
474 /*
475 * Copy out the session debug info via the sysctl interface.
476 *
477 */
478 static int
audit_sysctl_session_debug(__unused struct sysctl_oid * oidp,__unused void * arg1,__unused int arg2,struct sysctl_req * req)479 audit_sysctl_session_debug(__unused struct sysctl_oid *oidp,
480 __unused void *arg1, __unused int arg2, struct sysctl_req *req)
481 {
482 au_sentry_t *se;
483 au_sentry_debug_t *sed_tab, *next_sed;
484 int i, entry_cnt = 0;
485 size_t sz;
486 int err = 0;
487
488 /*
489 * This provides a read-only node.
490 */
491 if (req->newptr != USER_ADDR_NULL) {
492 return EPERM;
493 }
494
495 /*
496 * Walk the audit session hash table to determine the size.
497 */
498 AUDIT_SENTRY_RLOCK();
499 for (i = 0; i < HASH_TABLE_SIZE; i++) {
500 LIST_FOREACH(se, &au_sentry_bucket[i], se_link)
501 if (se != NULL) {
502 entry_cnt++;
503 }
504 }
505
506 entry_cnt++; /* add one for the default entry */
507 /*
508 * If just querying then return the space required. There is an
509 * obvious race condition here so we just fudge this by 3 in case
510 * the audit session table grows.
511 */
512 if (req->oldptr == USER_ADDR_NULL) {
513 req->oldidx = (entry_cnt + 3) * sizeof(au_sentry_debug_t);
514 AUDIT_SENTRY_RUNLOCK();
515 return 0;
516 }
517
518 /*
519 * Alloc a temporary buffer.
520 */
521 if (req->oldlen < (entry_cnt * sizeof(au_sentry_debug_t))) {
522 AUDIT_SENTRY_RUNLOCK();
523 return ENOMEM;
524 }
525 /*
526 * We hold the lock over the alloc since we don't want the table to
527 * grow on us. Therefore, use the non-blocking version of kalloc().
528 */
529 sed_tab = kalloc_data(entry_cnt * sizeof(au_sentry_debug_t),
530 Z_NOWAIT | Z_ZERO);
531 if (sed_tab == NULL) {
532 AUDIT_SENTRY_RUNLOCK();
533 return ENOMEM;
534 }
535
536 /*
537 * Walk the audit session hash table and build the record array.
538 */
539 sz = 0;
540 next_sed = sed_tab;
541 /* add the first entry for processes not tracked in sessions. */
542 bcopy(audit_default_aia_p, &next_sed->se_auinfo, sizeof(au_sentry_t));
543 next_sed->se_refcnt = (int64_t)audit_default_se.se_refcnt;
544 next_sed->se_procnt = (int64_t)audit_default_se.se_procnt;
545 next_sed++;
546 sz += sizeof(au_sentry_debug_t);
547 for (i = 0; i < HASH_TABLE_SIZE; i++) {
548 LIST_FOREACH(se, &au_sentry_bucket[i], se_link) {
549 if (se != NULL) {
550 next_sed->se_auinfo = se->se_auinfo;
551 next_sed->se_refcnt = (int64_t)se->se_refcnt;
552 next_sed->se_procnt = (int64_t)se->se_procnt;
553 next_sed++;
554 sz += sizeof(au_sentry_debug_t);
555 }
556 }
557 }
558 AUDIT_SENTRY_RUNLOCK();
559
560 /* Reconcile with the process table. */
561 proc_iterate(PROC_ALLPROCLIST | PROC_ZOMBPROCLIST,
562 audit_session_debug_callout, NULL,
563 audit_session_debug_filterfn, (void *)&sed_tab[0]);
564
565
566 req->oldlen = sz;
567 err = SYSCTL_OUT(req, sed_tab, sz);
568 kfree_data(sed_tab, entry_cnt * sizeof(au_sentry_debug_t));
569
570 return err;
571 }
572
573 #endif /* AUDIT_SESSION_DEBUG */
574
575 /*
576 * Create and commit a session audit event. The proc and se arguments needs to
577 * be that of the subject and not necessarily the current process.
578 */
579 static void
audit_session_event(int event,auditinfo_addr_t * aia_p)580 audit_session_event(int event, auditinfo_addr_t *aia_p)
581 {
582 struct kaudit_record *ar;
583
584 KASSERT(AUE_SESSION_START == event || AUE_SESSION_UPDATE == event ||
585 AUE_SESSION_END == event || AUE_SESSION_CLOSE == event,
586 ("audit_session_event: invalid event: %d", event));
587
588 if (NULL == aia_p) {
589 return;
590 }
591
592 /*
593 * Create a new audit record. The record will contain the subject
594 * ruid, rgid, egid, pid, auid, asid, amask, and term_addr
595 * (implicitly added by audit_new).
596 */
597 ar = audit_new(event, PROC_NULL, /* Not used */ NULL);
598 if (NULL == ar) {
599 return;
600 }
601
602 /*
603 * Audit session events are always generated because they are used
604 * by some userland consumers so just set the preselect flag.
605 */
606 ar->k_ar_commit |= AR_PRESELECT_FILTER;
607
608 /*
609 * Populate the subject information. Note that the ruid, rgid,
610 * egid, and pid values are incorrect. We only need the auditinfo_addr
611 * information.
612 */
613 ar->k_ar.ar_subj_ruid = 0;
614 ar->k_ar.ar_subj_rgid = 0;
615 ar->k_ar.ar_subj_egid = 0;
616 ar->k_ar.ar_subj_pid = 0;
617 ar->k_ar.ar_subj_auid = aia_p->ai_auid;
618 ar->k_ar.ar_subj_asid = aia_p->ai_asid;
619 bcopy(&aia_p->ai_termid, &ar->k_ar.ar_subj_term_addr,
620 sizeof(struct au_tid_addr));
621
622 /* Add the audit masks to the record. */
623 ar->k_ar.ar_arg_amask.am_success = aia_p->ai_mask.am_success;
624 ar->k_ar.ar_arg_amask.am_failure = aia_p->ai_mask.am_failure;
625 ARG_SET_VALID(ar, ARG_AMASK);
626
627 /* Add the audit session flags to the record. */
628 ar->k_ar.ar_arg_value64 = aia_p->ai_flags;
629 ARG_SET_VALID(ar, ARG_VALUE64);
630
631
632 /* Commit the record to the queue. */
633 audit_commit(ar, 0, 0);
634 }
635
636 /*
637 * Hash the audit session ID using a simple 32-bit mix.
638 */
639 static inline uint32_t
audit_session_hash(au_asid_t asid)640 audit_session_hash(au_asid_t asid)
641 {
642 uint32_t a = (uint32_t) asid;
643
644 a = (a - (a << 6)) ^ (a >> 17);
645 a = (a - (a << 9)) ^ (a << 4);
646 a = (a - (a << 3)) ^ (a << 10);
647 a = a ^ (a >> 15);
648
649 return a;
650 }
651
652 /*
653 * Do an hash lookup and find the session entry for a given ASID. Return NULL
654 * if not found. If the session is found then audit_session_find takes a
655 * reference.
656 */
657 static au_sentry_t *
audit_session_find(au_asid_t asid)658 audit_session_find(au_asid_t asid)
659 {
660 uint32_t hkey;
661 au_sentry_t *found_se;
662
663 AUDIT_SENTRY_RWLOCK_ASSERT();
664
665 hkey = HASH_ASID(asid);
666
667 LIST_FOREACH(found_se, &au_sentry_bucket[hkey], se_link)
668 if (found_se->se_asid == asid) {
669 au_history_record(found_se, AU_HISTORY_EVENT_FIND);
670 audit_ref_session(found_se);
671 return found_se;
672 }
673 return NULL;
674 }
675
676 /*
677 * Remove the given audit_session entry from the hash table.
678 */
679 static void
audit_session_remove(au_sentry_t * se)680 audit_session_remove(au_sentry_t *se)
681 {
682 uint32_t hkey;
683 au_sentry_t *found_se, *tmp_se;
684
685 au_history_record(se, AU_HISTORY_EVENT_DEATH);
686 KASSERT(se->se_refcnt == 0, ("audit_session_remove: ref count != 0"));
687 KASSERT(se != &audit_default_se,
688 ("audit_session_remove: removing default session"));
689
690 hkey = HASH_ASID(se->se_asid);
691
692 AUDIT_SENTRY_WLOCK();
693 /*
694 * Check and see if someone got a reference before we got the lock.
695 */
696 if (se->se_refcnt != 0) {
697 AUDIT_SENTRY_WUNLOCK();
698 return;
699 }
700
701 audit_session_portdestroy(&se->se_port);
702 LIST_FOREACH_SAFE(found_se, &au_sentry_bucket[hkey], se_link, tmp_se) {
703 if (found_se == se) {
704 /*
705 * Generate an audit event to notify userland of the
706 * session close.
707 */
708 audit_session_event(AUE_SESSION_CLOSE,
709 &found_se->se_auinfo);
710
711 LIST_REMOVE(found_se, se_link);
712 AUDIT_SENTRY_WUNLOCK();
713 kfree_type(au_sentry_t, found_se);
714
715 return;
716 }
717 }
718 AUDIT_SENTRY_WUNLOCK();
719 }
720
721 /*
722 * Reference the session by incrementing the sentry ref count.
723 */
724 static void
audit_ref_session(au_sentry_t * se)725 audit_ref_session(au_sentry_t *se)
726 {
727 long old_val;
728
729 if (se == NULL || se == &audit_default_se) {
730 return;
731 }
732
733 au_history_record(se, AU_HISTORY_EVENT_REF);
734
735 old_val = OSAddAtomicLong(1, &se->se_refcnt);
736 KASSERT(old_val < 100000,
737 ("audit_ref_session: Too many references on session."));
738 }
739
740 /*
741 * Decrement the sentry ref count and remove the session entry if last one.
742 */
743 static void
audit_unref_session(au_sentry_t * se)744 audit_unref_session(au_sentry_t *se)
745 {
746 long old_val;
747
748 if (se == NULL || se == &audit_default_se) {
749 return;
750 }
751
752 au_history_record(se, AU_HISTORY_EVENT_UNREF);
753
754 old_val = OSAddAtomicLong(-1, &se->se_refcnt);
755 if (old_val == 1) {
756 audit_session_remove(se);
757 }
758 KASSERT(old_val > 0,
759 ("audit_unref_session: Too few references on session."));
760 }
761
762 /*
763 * Increment the process count in the session.
764 */
765 static void
audit_inc_procount(au_sentry_t * se)766 audit_inc_procount(au_sentry_t *se)
767 {
768 long old_val;
769
770 if (se == NULL || se == &audit_default_se) {
771 return;
772 }
773
774 old_val = OSAddAtomicLong(1, &se->se_procnt);
775 KASSERT(old_val <= PID_MAX,
776 ("audit_inc_procount: proc count > PID_MAX"));
777 }
778
779 /*
780 * Decrement the process count and add a knote if it is the last process
781 * to exit the session.
782 */
783 static void
audit_dec_procount(au_sentry_t * se)784 audit_dec_procount(au_sentry_t *se)
785 {
786 long old_val;
787
788 if (se == NULL || se == &audit_default_se) {
789 return;
790 }
791
792 old_val = OSAddAtomicLong(-1, &se->se_procnt);
793 /*
794 * If this was the last process generate an audit event to notify
795 * userland of the session ending.
796 */
797 if (old_val == 1) {
798 audit_session_event(AUE_SESSION_END, &se->se_auinfo);
799 }
800 KASSERT(old_val >= 1,
801 ("audit_dec_procount: proc count < 0"));
802 }
803
804 /*
805 * Update the session entry and check to see if anything was updated.
806 * Returns:
807 * 0 Nothing was updated (We don't care about process preselection masks)
808 * 1 Something was updated.
809 */
810 static int
audit_update_sentry(au_sentry_t * se,auditinfo_addr_t * new_aia)811 audit_update_sentry(au_sentry_t *se, auditinfo_addr_t *new_aia)
812 {
813 auditinfo_addr_t *aia = &se->se_auinfo;
814 int update;
815
816 KASSERT(new_aia != audit_default_aia_p,
817 ("audit_update_sentry: Trying to update the default aia."));
818
819 update = (aia->ai_auid != new_aia->ai_auid ||
820 bcmp(&aia->ai_termid, &new_aia->ai_termid,
821 sizeof(new_aia->ai_termid)) ||
822 aia->ai_flags != new_aia->ai_flags);
823
824 if (update) {
825 bcopy(new_aia, aia, sizeof(*aia));
826 }
827
828 return update;
829 }
830
831 /*
832 * Return the next session ID. The range of kernel generated audit session IDs
833 * is ASSIGNED_ASID_MIN to ASSIGNED_ASID_MAX.
834 */
835 static uint32_t
audit_session_nextid(void)836 audit_session_nextid(void)
837 {
838 static uint32_t next_asid = ASSIGNED_ASID_MIN;
839
840 AUDIT_SENTRY_RWLOCK_ASSERT();
841
842 if (next_asid > ASSIGNED_ASID_MAX) {
843 next_asid = ASSIGNED_ASID_MIN;
844 }
845
846 return next_asid++;
847 }
848
849 /*
850 * Allocated a new audit_session entry and add it to the hash table. If the
851 * given ASID is set to AU_ASSIGN_ASID then audit_session_new() will pick an
852 * audit session ID. Otherwise, it attempts use the one given. It creates a
853 * reference to the entry that must be unref'ed.
854 */
855 static auditinfo_addr_t *
audit_session_new(auditinfo_addr_t * new_aia_p,auditinfo_addr_t * old_aia_p)856 audit_session_new(auditinfo_addr_t *new_aia_p, auditinfo_addr_t *old_aia_p)
857 {
858 au_asid_t new_asid;
859 au_sentry_t *se = NULL;
860 au_sentry_t *found_se = NULL;
861 auditinfo_addr_t *aia = NULL;
862
863 KASSERT(new_aia_p != NULL, ("audit_session_new: new_aia_p == NULL"));
864
865 new_asid = new_aia_p->ai_asid;
866
867 /*
868 * Alloc a new session entry now so we don't wait holding the lock.
869 */
870 se = kalloc_type(au_sentry_t, Z_WAITOK | Z_ZERO | Z_NOFAIL);
871
872 /*
873 * Find an unique session ID, if desired.
874 */
875 AUDIT_SENTRY_WLOCK();
876 if (new_asid == AU_ASSIGN_ASID) {
877 do {
878 new_asid = (au_asid_t)audit_session_nextid();
879 found_se = audit_session_find(new_asid);
880
881 /*
882 * If the session ID is currently active then drop the
883 * reference and try again.
884 */
885 if (found_se != NULL) {
886 audit_unref_session(found_se);
887 } else {
888 break;
889 }
890 } while (1);
891 } else {
892 /*
893 * Check to see if the requested ASID is already in the
894 * hash table. If so, update it with the new auditinfo.
895 */
896 if ((found_se = audit_session_find(new_asid)) != NULL) {
897 int updated;
898
899 updated = audit_update_sentry(found_se, new_aia_p);
900
901 AUDIT_SENTRY_WUNLOCK();
902 kfree_type(au_sentry_t, se);
903
904 /* If a different session then add this process in. */
905 if (new_aia_p != old_aia_p) {
906 audit_inc_procount(found_se);
907 }
908
909 /*
910 * If the session information was updated then
911 * generate an audit event to notify userland.
912 */
913 if (updated) {
914 audit_session_event(AUE_SESSION_UPDATE,
915 &found_se->se_auinfo);
916 }
917
918 return &found_se->se_auinfo;
919 }
920 }
921
922 /*
923 * Start the reference and proc count at 1 to account for the process
924 * that invoked this via setaudit_addr() (or friends).
925 */
926 se->se_refcnt = se->se_procnt = 1;
927
928 /*
929 * Populate the new session entry. Note that process masks are stored
930 * in kauth ucred so just zero them here.
931 */
932 se->se_port = IPC_PORT_NULL;
933 aia = &se->se_auinfo;
934 aia->ai_asid = new_asid;
935 aia->ai_auid = new_aia_p->ai_auid;
936 bzero(&new_aia_p->ai_mask, sizeof(new_aia_p->ai_mask));
937 bcopy(&new_aia_p->ai_termid, &aia->ai_termid, sizeof(aia->ai_termid));
938 aia->ai_flags = new_aia_p->ai_flags;
939
940 /*
941 * Add it to the hash table.
942 */
943 LIST_INSERT_HEAD(&au_sentry_bucket[HASH_ASID(new_asid)], se, se_link);
944 AUDIT_SENTRY_WUNLOCK();
945
946 /*
947 * Generate an audit event to notify userland of the new session.
948 */
949 audit_session_event(AUE_SESSION_START, aia);
950 au_history_record(se, AU_HISTORY_EVENT_BIRTH);
951 return aia;
952 }
953
954 /*
955 * Lookup an existing session. A copy of the audit session info for a given
956 * ASID is returned in ret_aia. Returns 0 on success.
957 */
958 int
audit_session_lookup(au_asid_t asid,auditinfo_addr_t * ret_aia)959 audit_session_lookup(au_asid_t asid, auditinfo_addr_t *ret_aia)
960 {
961 au_sentry_t *se = NULL;
962
963 if ((uint32_t)asid > ASSIGNED_ASID_MAX) {
964 return -1;
965 }
966 AUDIT_SENTRY_RLOCK();
967 if ((se = audit_session_find(asid)) == NULL) {
968 AUDIT_SENTRY_RUNLOCK();
969 return 1;
970 }
971 /* We have a reference on the session so it is safe to drop the lock. */
972 AUDIT_SENTRY_RUNLOCK();
973 if (ret_aia != NULL) {
974 bcopy(&se->se_auinfo, ret_aia, sizeof(*ret_aia));
975 }
976 audit_unref_session(se);
977
978 return 0;
979 }
980
981 void
audit_session_aiaref(auditinfo_addr_t * aia_p)982 audit_session_aiaref(auditinfo_addr_t *aia_p)
983 {
984 audit_ref_session(AU_SENTRY_PTR(aia_p));
985 }
986
987 /*
988 * Add a reference to the session entry.
989 */
990 void
audit_session_ref(kauth_cred_t cred)991 audit_session_ref(kauth_cred_t cred)
992 {
993 auditinfo_addr_t *aia_p;
994
995 KASSERT(IS_VALID_CRED(cred),
996 ("audit_session_ref: Invalid kauth_cred."));
997
998 aia_p = cred->cr_audit.as_aia_p;
999 audit_session_aiaref(aia_p);
1000 }
1001
1002 void
audit_session_aiaunref(auditinfo_addr_t * aia_p)1003 audit_session_aiaunref(auditinfo_addr_t *aia_p)
1004 {
1005 audit_unref_session(AU_SENTRY_PTR(aia_p));
1006 }
1007
1008 /*
1009 * Remove a reference to the session entry.
1010 */
1011 void
audit_session_unref(kauth_cred_t cred)1012 audit_session_unref(kauth_cred_t cred)
1013 {
1014 auditinfo_addr_t *aia_p;
1015
1016 KASSERT(IS_VALID_CRED(cred),
1017 ("audit_session_unref: Invalid kauth_cred."));
1018
1019 aia_p = cred->cr_audit.as_aia_p;
1020 audit_session_aiaunref(aia_p);
1021 }
1022
1023 /*
1024 * Increment the per audit session process count. Assumes that the caller has
1025 * a reference on the process' cred.
1026 */
1027 void
audit_session_procnew(proc_t p)1028 audit_session_procnew(proc_t p)
1029 {
1030 kauth_cred_t cred = proc_ucred(p);
1031 auditinfo_addr_t *aia_p;
1032
1033 KASSERT(IS_VALID_CRED(cred),
1034 ("audit_session_procnew: Invalid kauth_cred."));
1035
1036 aia_p = cred->cr_audit.as_aia_p;
1037
1038 audit_inc_procount(AU_SENTRY_PTR(aia_p));
1039 }
1040
1041 /*
1042 * Decrement the per audit session process count. Assumes that the caller has
1043 * a reference on the cred.
1044 */
1045 void
audit_session_procexit(proc_t p)1046 audit_session_procexit(proc_t p)
1047 {
1048 kauth_cred_t cred = proc_ucred(p);
1049 auditinfo_addr_t *aia_p;
1050
1051 KASSERT(IS_VALID_CRED(cred),
1052 ("audit_session_procexit: Invalid kauth_cred."));
1053
1054 aia_p = cred->cr_audit.as_aia_p;
1055
1056 audit_dec_procount(AU_SENTRY_PTR(aia_p));
1057 }
1058
1059 /*
1060 * Init the audit session code.
1061 */
1062 void
audit_session_init(void)1063 audit_session_init(void)
1064 {
1065 int i;
1066
1067 KASSERT((ASSIGNED_ASID_MAX - ASSIGNED_ASID_MIN) > PID_MAX,
1068 ("audit_session_init: ASSIGNED_ASID_MAX is not large enough."));
1069
1070 AUDIT_SENTRY_RWLOCK_INIT();
1071
1072 au_sentry_bucket = zalloc_permanent(sizeof(struct au_sentry) *
1073 HASH_TABLE_SIZE, ZALIGN_PTR);
1074
1075 for (i = 0; i < HASH_TABLE_SIZE; i++) {
1076 LIST_INIT(&au_sentry_bucket[i]);
1077 }
1078
1079 (void)audit_sdev_init();
1080 #if AU_HISTORY_LOGGING
1081 au_history = zalloc_permanent(sizeof(struct au_history) * au_history_size,
1082 ZALIGN_PTR);
1083 #endif
1084 }
1085
1086 static int
audit_session_update_check(kauth_cred_t cred,auditinfo_addr_t * old,auditinfo_addr_t * new)1087 audit_session_update_check(kauth_cred_t cred, auditinfo_addr_t *old,
1088 auditinfo_addr_t *new)
1089 {
1090 uint64_t n;
1091
1092 /* If the current audit ID is not the default then it is immutable. */
1093 if (old->ai_auid != AU_DEFAUDITID && old->ai_auid != new->ai_auid) {
1094 return EINVAL;
1095 }
1096
1097 /* If the current termid is not the default then it is immutable. */
1098 if ((old->ai_termid.at_type != AU_IPv4 ||
1099 old->ai_termid.at_port != 0 ||
1100 old->ai_termid.at_addr[0] != 0) &&
1101 (old->ai_termid.at_port != new->ai_termid.at_port ||
1102 old->ai_termid.at_type != new->ai_termid.at_type ||
1103 0 != bcmp(&old->ai_termid.at_addr, &new->ai_termid.at_addr,
1104 sizeof(old->ai_termid.at_addr)))) {
1105 return EINVAL;
1106 }
1107
1108 /* The flags may be set only according to the
1109 * audit_session_*_set_sflags_masks.
1110 */
1111 n = ~old->ai_flags & new->ai_flags;
1112 if (0 != n &&
1113 !((n == (audit_session_superuser_set_sflags_mask & n) &&
1114 kauth_cred_issuser(cred)) ||
1115 (n == (audit_session_member_set_sflags_mask & n) &&
1116 old->ai_asid == new->ai_asid))) {
1117 return EINVAL;
1118 }
1119
1120 /* The flags may be cleared only according to the
1121 * audit_session_*_clear_sflags_masks.
1122 */
1123 n = ~new->ai_flags & old->ai_flags;
1124 if (0 != n &&
1125 !((n == (audit_session_superuser_clear_sflags_mask & n) &&
1126 kauth_cred_issuser(cred)) ||
1127 (n == (audit_session_member_clear_sflags_mask & n) &&
1128 old->ai_asid == new->ai_asid))) {
1129 return EINVAL;
1130 }
1131
1132 /* The audit masks are mutable. */
1133 return 0;
1134 }
1135
1136 /*
1137 * Safely update kauth cred of the given process with new the given audit info.
1138 */
1139 int
audit_session_setaia(proc_t p,auditinfo_addr_t * new_aia_p)1140 audit_session_setaia(proc_t p, auditinfo_addr_t *new_aia_p)
1141 {
1142 kauth_cred_t my_cred, my_new_cred;
1143 struct au_session as;
1144 struct au_session tmp_as;
1145 auditinfo_addr_t caia, *old_aia_p;
1146 int ret;
1147
1148 /*
1149 * If this is going to modify an existing session then do some
1150 * immutable checks.
1151 */
1152 if (audit_session_lookup(new_aia_p->ai_asid, &caia) == 0) {
1153 my_cred = kauth_cred_proc_ref(p);
1154 ret = audit_session_update_check(my_cred, &caia, new_aia_p);
1155 kauth_cred_unref(&my_cred);
1156 if (ret) {
1157 return ret;
1158 }
1159 }
1160
1161 my_cred = kauth_cred_proc_ref(p);
1162 bcopy(&new_aia_p->ai_mask, &as.as_mask, sizeof(as.as_mask));
1163 old_aia_p = my_cred->cr_audit.as_aia_p;
1164 /* audit_session_new() adds a reference on the session */
1165 as.as_aia_p = audit_session_new(new_aia_p, old_aia_p);
1166
1167 /* If the process left a session then update the process count. */
1168 if (old_aia_p != new_aia_p) {
1169 audit_dec_procount(AU_SENTRY_PTR(old_aia_p));
1170 }
1171
1172
1173 /*
1174 * We are modifying the audit info in a credential so we need a new
1175 * credential (or take another reference on an existing credential that
1176 * matches our new one). We must do this because the audit info in the
1177 * credential is used as part of our hash key. Get current credential
1178 * in the target process and take a reference while we muck with it.
1179 */
1180 for (;;) {
1181 /*
1182 * Set the credential with new info. If there is no change,
1183 * we get back the same credential we passed in; if there is
1184 * a change, we drop the reference on the credential we
1185 * passed in. The subsequent compare is safe, because it is
1186 * a pointer compare rather than a contents compare.
1187 */
1188 bcopy(&as, &tmp_as, sizeof(tmp_as));
1189 my_new_cred = kauth_cred_setauditinfo(my_cred, &tmp_as);
1190
1191 if (my_cred != my_new_cred) {
1192 proc_ucred_lock(p);
1193 /* Need to protect for a race where another thread also
1194 * changed the credential after we took our reference.
1195 * If p_ucred has changed then we should restart this
1196 * again with the new cred.
1197 */
1198 if (proc_ucred(p) != my_cred) {
1199 proc_ucred_unlock(p);
1200 kauth_cred_unref(&my_new_cred);
1201 /* try again */
1202 my_cred = kauth_cred_proc_ref(p);
1203 continue;
1204 }
1205 proc_set_ucred(p, my_new_cred);
1206 /* update cred on proc */
1207 proc_update_creds_onproc(p);
1208 proc_ucred_unlock(p);
1209 }
1210
1211 kauth_cred_unref(&my_new_cred);
1212 break;
1213 }
1214
1215 /* Drop the reference taken by audit_session_new() above. */
1216 audit_unref_session(AU_SENTRY_PTR(as.as_aia_p));
1217
1218 /* Propagate the change from the process to the Mach task. */
1219 set_security_token(p);
1220
1221 return 0;
1222 }
1223
1224 /*
1225 * audit_session_self (system call)
1226 *
1227 * Description: Obtain a Mach send right for the current session.
1228 *
1229 * Parameters: p Process calling audit_session_self().
1230 *
1231 * Returns: *ret_port Named Mach send right, which may be
1232 * MACH_PORT_NULL in the failure case.
1233 *
1234 * Errno: 0 Success
1235 * EINVAL The calling process' session has not be set.
1236 * ESRCH Bad process, can't get valid cred for process.
1237 * ENOMEM Port allocation failed due to no free memory.
1238 */
1239 int
audit_session_self(proc_t p,__unused struct audit_session_self_args * uap,mach_port_name_t * ret_port)1240 audit_session_self(proc_t p, __unused struct audit_session_self_args *uap,
1241 mach_port_name_t *ret_port)
1242 {
1243 ipc_port_t sendport = IPC_PORT_NULL;
1244 kauth_cred_t cred = NULL;
1245 auditinfo_addr_t *aia_p;
1246 au_sentry_t *se;
1247 int err = 0;
1248
1249 cred = kauth_cred_proc_ref(p);
1250 if (!IS_VALID_CRED(cred)) {
1251 err = ESRCH;
1252 goto done;
1253 }
1254
1255 aia_p = cred->cr_audit.as_aia_p;
1256 if (!IS_VALID_SESSION(aia_p)) {
1257 /* Can't join the default session. */
1258 err = EINVAL;
1259 goto done;
1260 }
1261
1262 se = AU_SENTRY_PTR(aia_p);
1263
1264 /*
1265 * Processes that join using this mach port will inherit this process'
1266 * pre-selection masks.
1267 */
1268 if (se->se_port == IPC_PORT_NULL) {
1269 bcopy(&cred->cr_audit.as_mask, &se->se_mask,
1270 sizeof(se->se_mask));
1271 }
1272
1273 /*
1274 * Get a send right to the session's Mach port and insert it in the
1275 * process' mach port namespace.
1276 */
1277 sendport = audit_session_mksend(aia_p, &se->se_port);
1278 *ret_port = ipc_port_copyout_send(sendport, get_task_ipcspace(p->task));
1279
1280 done:
1281 if (cred != NULL) {
1282 kauth_cred_unref(&cred);
1283 }
1284 if (err != 0) {
1285 *ret_port = MACH_PORT_NULL;
1286 }
1287 return err;
1288 }
1289
1290 /*
1291 * audit_session_port (system call)
1292 *
1293 * Description: Obtain a Mach send right for the given session ID.
1294 *
1295 * Parameters: p Process calling audit_session_port().
1296 * uap->asid The target audit session ID. The special
1297 * value -1 can be used to target the process's
1298 * own session.
1299 * uap->portnamep User address at which to place port name.
1300 *
1301 * Returns: 0 Success
1302 * EINVAL The calling process' session has not be set.
1303 * EINVAL The given session ID could not be found.
1304 * EINVAL The Mach port right could not be copied out.
1305 * ESRCH Bad process, can't get valid cred for process.
1306 * EPERM Only the superuser can reference sessions other
1307 * than the process's own.
1308 * ENOMEM Port allocation failed due to no free memory.
1309 */
1310 int
audit_session_port(proc_t p,struct audit_session_port_args * uap,__unused int * retval)1311 audit_session_port(proc_t p, struct audit_session_port_args *uap,
1312 __unused int *retval)
1313 {
1314 ipc_port_t sendport = IPC_PORT_NULL;
1315 mach_port_name_t portname = MACH_PORT_NULL;
1316 kauth_cred_t cred = NULL;
1317 auditinfo_addr_t *aia_p = NULL;
1318 au_sentry_t *se = NULL;
1319 int err = 0;
1320
1321 /* Note: Currently this test will never be true, because
1322 * ASSIGNED_ASID_MAX is effectively (uint32_t)-2.
1323 */
1324 if (uap->asid != -1 && (uint32_t)uap->asid > ASSIGNED_ASID_MAX) {
1325 err = EINVAL;
1326 goto done;
1327 }
1328 cred = kauth_cred_proc_ref(p);
1329 if (!IS_VALID_CRED(cred)) {
1330 err = ESRCH;
1331 goto done;
1332 }
1333 aia_p = cred->cr_audit.as_aia_p;
1334
1335 /* Find the session corresponding to the requested audit
1336 * session ID. If found, take a reference on it so that
1337 * the session is not dropped until the join is later done.
1338 */
1339 if (uap->asid == (au_asid_t)-1 ||
1340 uap->asid == aia_p->ai_asid) {
1341 if (!IS_VALID_SESSION(aia_p)) {
1342 /* Can't join the default session. */
1343 err = EINVAL;
1344 goto done;
1345 }
1346
1347 /* No privilege is required to obtain a port for our
1348 * own session.
1349 */
1350 se = AU_SENTRY_PTR(aia_p);
1351 audit_ref_session(se);
1352 } else {
1353 /*
1354 * Only privileged processes may obtain a port for
1355 * any existing session.
1356 */
1357 err = priv_check_cred(cred, PRIV_AUDIT_SESSION_PORT, 0);
1358 if (err != 0) {
1359 goto done;
1360 }
1361 AUDIT_SENTRY_RLOCK();
1362 se = audit_session_find(uap->asid);
1363 AUDIT_SENTRY_RUNLOCK();
1364 if (NULL == se) {
1365 err = EINVAL;
1366 goto done;
1367 }
1368 aia_p = &se->se_auinfo;
1369 }
1370
1371 /*
1372 * Processes that join using this mach port will inherit this process'
1373 * pre-selection masks.
1374 */
1375 if (se->se_port == IPC_PORT_NULL) {
1376 bcopy(&cred->cr_audit.as_mask, &se->se_mask,
1377 sizeof(se->se_mask));
1378 }
1379
1380 /*
1381 * Use the session reference to create a mach port reference for the
1382 * session (at which point we are free to drop the session reference)
1383 * and then copy out the mach port to the process' mach port namespace.
1384 */
1385 sendport = audit_session_mksend(aia_p, &se->se_port);
1386 portname = ipc_port_copyout_send(sendport, get_task_ipcspace(p->task));
1387 if (!MACH_PORT_VALID(portname)) {
1388 err = EINVAL;
1389 goto done;
1390 }
1391 err = copyout(&portname, uap->portnamep, sizeof(mach_port_name_t));
1392 done:
1393 if (cred != NULL) {
1394 kauth_cred_unref(&cred);
1395 }
1396 if (NULL != se) {
1397 audit_unref_session(se);
1398 }
1399 if (MACH_PORT_VALID(portname) && 0 != err) {
1400 (void)mach_port_deallocate(get_task_ipcspace(p->task),
1401 portname);
1402 }
1403
1404 return err;
1405 }
1406
1407 static int
audit_session_join_internal(proc_t p,task_t task,ipc_port_t port,au_asid_t * new_asid)1408 audit_session_join_internal(proc_t p, task_t task, ipc_port_t port, au_asid_t *new_asid)
1409 {
1410 auditinfo_addr_t *new_aia_p, *old_aia_p;
1411 kauth_cred_t my_cred = NULL;
1412 au_asid_t old_asid;
1413 int err = 0;
1414
1415 *new_asid = AU_DEFAUDITSID;
1416
1417 if ((new_aia_p = audit_session_porttoaia(port)) == NULL) {
1418 err = EINVAL;
1419 goto done;
1420 }
1421
1422 proc_ucred_lock(p);
1423 my_cred = proc_ucred(p);
1424 kauth_cred_ref(my_cred);
1425
1426 old_aia_p = my_cred->cr_audit.as_aia_p;
1427 old_asid = old_aia_p->ai_asid;
1428 *new_asid = new_aia_p->ai_asid;
1429
1430 /*
1431 * Add process in if not already in the session.
1432 */
1433 if (*new_asid != old_asid) {
1434 kauth_cred_t my_new_cred;
1435 struct au_session new_as;
1436
1437 bcopy(&new_aia_p->ai_mask, &new_as.as_mask,
1438 sizeof(new_as.as_mask));
1439 new_as.as_aia_p = new_aia_p;
1440
1441 my_new_cred = kauth_cred_setauditinfo(my_cred, &new_as);
1442 proc_set_ucred(p, my_new_cred);
1443 proc_update_creds_onproc(p);
1444
1445 /* Increment the proc count of new session */
1446 audit_inc_procount(AU_SENTRY_PTR(new_aia_p));
1447
1448 proc_ucred_unlock(p);
1449
1450 kauth_cred_unref(&my_new_cred);
1451
1452 /* Propagate the change from the process to the Mach task. */
1453 set_security_token_task_internal(p, task);
1454
1455 /* Decrement the process count of the former session. */
1456 audit_dec_procount(AU_SENTRY_PTR(old_aia_p));
1457 } else {
1458 proc_ucred_unlock(p);
1459 kauth_cred_unref(&my_cred);
1460 }
1461
1462 done:
1463 if (port != IPC_PORT_NULL) {
1464 ipc_port_release_send(port);
1465 }
1466
1467 return err;
1468 }
1469
1470 /*
1471 * audit_session_spawnjoin
1472 *
1473 * Description: posix_spawn() interface to audit_session_join_internal().
1474 *
1475 * Returns: 0 Success
1476 * EINVAL Invalid Mach port name.
1477 * ESRCH Invalid calling process/cred.
1478 */
1479 int
audit_session_spawnjoin(proc_t p,task_t task,ipc_port_t port)1480 audit_session_spawnjoin(proc_t p, task_t task, ipc_port_t port)
1481 {
1482 au_asid_t new_asid;
1483
1484 return audit_session_join_internal(p, task, port, &new_asid);
1485 }
1486
1487 /*
1488 * audit_session_join (system call)
1489 *
1490 * Description: Join the session for a given Mach port send right.
1491 *
1492 * Parameters: p Process calling session join.
1493 * uap->port A Mach send right.
1494 *
1495 * Returns: *ret_asid Audit session ID of new session.
1496 * In the failure case the return value will be -1
1497 * and 'errno' will be set to a non-zero value
1498 * described below.
1499 *
1500 * Errno: 0 Success
1501 * EINVAL Invalid Mach port name.
1502 * ESRCH Invalid calling process/cred.
1503 */
1504 int
audit_session_join(proc_t p,struct audit_session_join_args * uap,au_asid_t * ret_asid)1505 audit_session_join(proc_t p, struct audit_session_join_args *uap,
1506 au_asid_t *ret_asid)
1507 {
1508 ipc_port_t port = IPC_PORT_NULL;
1509 mach_port_name_t send = uap->port;
1510 int err = 0;
1511
1512
1513 if (ipc_object_copyin(get_task_ipcspace(p->task), send,
1514 MACH_MSG_TYPE_COPY_SEND, &port, 0, NULL, IPC_OBJECT_COPYIN_FLAGS_ALLOW_IMMOVABLE_SEND) != KERN_SUCCESS) {
1515 *ret_asid = AU_DEFAUDITSID;
1516 err = EINVAL;
1517 } else {
1518 err = audit_session_join_internal(p, p->task, port, ret_asid);
1519 }
1520
1521 return err;
1522 }
1523
1524 /*
1525 * Audit session device.
1526 */
1527
1528 /*
1529 * Free an audit sdev entry.
1530 */
1531 static void
audit_sdev_entry_free(struct audit_sdev_entry * ase)1532 audit_sdev_entry_free(struct audit_sdev_entry *ase)
1533 {
1534 kfree_data(ase->ase_record, ase->ase_record_len);
1535 kfree_type(struct audit_sdev_entry, ase);
1536 }
1537
1538 /*
1539 * Append individual record to a queue. Allocate queue-local buffer and
1540 * add to the queue. If the queue is full or we can't allocate memory,
1541 * drop the newest record.
1542 */
1543 static void
audit_sdev_append(struct audit_sdev * asdev,void * record,u_int record_len)1544 audit_sdev_append(struct audit_sdev *asdev, void *record, u_int record_len)
1545 {
1546 struct audit_sdev_entry *ase;
1547
1548 AUDIT_SDEV_LOCK_ASSERT(asdev);
1549
1550 if (asdev->asdev_qlen >= asdev->asdev_qlimit) {
1551 asdev->asdev_drops++;
1552 audit_sdev_drops++;
1553 return;
1554 }
1555
1556 ase = kalloc_type(struct audit_sdev_entry, Z_NOWAIT | Z_ZERO);
1557 if (NULL == ase) {
1558 asdev->asdev_drops++;
1559 audit_sdev_drops++;
1560 return;
1561 }
1562
1563 ase->ase_record = kalloc_data(record_len, Z_NOWAIT);
1564 if (NULL == ase->ase_record) {
1565 kfree_type(struct audit_sdev_entry, ase);
1566 asdev->asdev_drops++;
1567 audit_sdev_drops++;
1568 return;
1569 }
1570
1571 bcopy(record, ase->ase_record, record_len);
1572 ase->ase_record_len = record_len;
1573
1574 TAILQ_INSERT_TAIL(&asdev->asdev_queue, ase, ase_queue);
1575 asdev->asdev_inserts++;
1576 asdev->asdev_qlen++;
1577 asdev->asdev_qbyteslen += ase->ase_record_len;
1578 selwakeup(&asdev->asdev_selinfo);
1579 if (asdev->asdev_flags & AUDIT_SDEV_ASYNC) {
1580 pgsigio(asdev->asdev_sigio, SIGIO);
1581 }
1582
1583 cv_broadcast(&asdev->asdev_cv);
1584 }
1585
1586 /*
1587 * Submit an audit record to be queued in the audit session device.
1588 */
1589 void
audit_sdev_submit(__unused au_id_t auid,__unused au_asid_t asid,void * record,u_int record_len)1590 audit_sdev_submit(__unused au_id_t auid, __unused au_asid_t asid, void *record,
1591 u_int record_len)
1592 {
1593 struct audit_sdev *asdev;
1594
1595 /*
1596 * Lockless read to avoid lock overhead if sessio devices are not in
1597 * use.
1598 */
1599 if (NULL == TAILQ_FIRST(&audit_sdev_list)) {
1600 return;
1601 }
1602
1603 AUDIT_SDEV_LIST_RLOCK();
1604 TAILQ_FOREACH(asdev, &audit_sdev_list, asdev_list) {
1605 AUDIT_SDEV_LOCK(asdev);
1606
1607 /*
1608 * Only append to the sdev queue if the AUID and ASID match that
1609 * of the process that opened this session device or if the
1610 * ALLSESSIONS flag is set.
1611 */
1612 if ((/* XXXss auid == asdev->asdev_auid && */
1613 asid == asdev->asdev_asid) ||
1614 (asdev->asdev_flags & AUDIT_SDEV_ALLSESSIONS) != 0) {
1615 audit_sdev_append(asdev, record, record_len);
1616 }
1617 AUDIT_SDEV_UNLOCK(asdev);
1618 }
1619 AUDIT_SDEV_LIST_RUNLOCK();
1620
1621 /* Unlocked increment. */
1622 audit_sdev_records++;
1623 }
1624
1625 /*
1626 * Allocate a new audit sdev. Connects the sdev, on succes, to the global
1627 * list and updates statistics.
1628 */
1629 static struct audit_sdev *
audit_sdev_alloc(void)1630 audit_sdev_alloc(void)
1631 {
1632 struct audit_sdev *asdev;
1633
1634 AUDIT_SDEV_LIST_WLOCK_ASSERT();
1635
1636 asdev = kalloc_type(struct audit_sdev, Z_ZERO | Z_WAITOK | Z_NOFAIL);
1637 asdev->asdev_qlimit = AUDIT_SDEV_QLIMIT_DEFAULT;
1638 TAILQ_INIT(&asdev->asdev_queue);
1639 AUDIT_SDEV_LOCK_INIT(asdev);
1640 AUDIT_SDEV_SX_LOCK_INIT(asdev);
1641 cv_init(&asdev->asdev_cv, "audit_sdev_cv");
1642
1643 /*
1644 * Add to global list and update global statistics.
1645 */
1646 TAILQ_INSERT_HEAD(&audit_sdev_list, asdev, asdev_list);
1647 audit_sdev_count++;
1648 audit_sdev_ever++;
1649
1650 return asdev;
1651 }
1652
1653 /*
1654 * Flush all records currently present in an audit sdev.
1655 */
1656 static void
audit_sdev_flush(struct audit_sdev * asdev)1657 audit_sdev_flush(struct audit_sdev *asdev)
1658 {
1659 struct audit_sdev_entry *ase;
1660
1661 AUDIT_SDEV_LOCK_ASSERT(asdev);
1662
1663 while ((ase = TAILQ_FIRST(&asdev->asdev_queue)) != NULL) {
1664 TAILQ_REMOVE(&asdev->asdev_queue, ase, ase_queue);
1665 asdev->asdev_qbyteslen -= ase->ase_record_len;
1666 audit_sdev_entry_free(ase);
1667 asdev->asdev_qlen--;
1668 }
1669 asdev->asdev_qoffset = 0;
1670
1671 KASSERT(0 == asdev->asdev_qlen, ("audit_sdev_flush: asdev_qlen"));
1672 KASSERT(0 == asdev->asdev_qbyteslen,
1673 ("audit_sdev_flush: asdev_qbyteslen"));
1674 }
1675
1676 /*
1677 * Free an audit sdev.
1678 */
1679 static void
audit_sdev_free(struct audit_sdev * asdev)1680 audit_sdev_free(struct audit_sdev *asdev)
1681 {
1682 AUDIT_SDEV_LIST_WLOCK_ASSERT();
1683 AUDIT_SDEV_LOCK_ASSERT(asdev);
1684
1685 /* XXXss - preselect hook here */
1686 audit_sdev_flush(asdev);
1687 cv_destroy(&asdev->asdev_cv);
1688 AUDIT_SDEV_SX_LOCK_DESTROY(asdev);
1689 AUDIT_SDEV_UNLOCK(asdev);
1690 AUDIT_SDEV_LOCK_DESTROY(asdev);
1691
1692 TAILQ_REMOVE(&audit_sdev_list, asdev, asdev_list);
1693 kfree_type(struct audit_sdev, asdev);
1694 audit_sdev_count--;
1695 }
1696
1697 /*
1698 * Get the auditinfo_addr of the proc and check to see if suser. Will return
1699 * non-zero if not suser.
1700 */
1701 static int
audit_sdev_get_aia(proc_t p,struct auditinfo_addr * aia_p)1702 audit_sdev_get_aia(proc_t p, struct auditinfo_addr *aia_p)
1703 {
1704 int error;
1705 kauth_cred_t scred;
1706
1707 scred = kauth_cred_proc_ref(p);
1708 error = suser(scred, &p->p_acflag);
1709
1710 if (NULL != aia_p) {
1711 bcopy(scred->cr_audit.as_aia_p, aia_p, sizeof(*aia_p));
1712 }
1713 kauth_cred_unref(&scred);
1714
1715 return error;
1716 }
1717
1718 /*
1719 * Audit session dev open method.
1720 */
1721 static int
audit_sdev_open(dev_t dev,__unused int flags,__unused int devtype,proc_t p)1722 audit_sdev_open(dev_t dev, __unused int flags, __unused int devtype, proc_t p)
1723 {
1724 struct audit_sdev *asdev;
1725 struct auditinfo_addr aia;
1726 int u;
1727
1728 u = minor(dev);
1729 if (u < 0 || u >= MAX_AUDIT_SDEVS) {
1730 return ENXIO;
1731 }
1732
1733 (void) audit_sdev_get_aia(p, &aia);
1734
1735 AUDIT_SDEV_LIST_WLOCK();
1736 asdev = audit_sdev_dtab[u];
1737 if (NULL == asdev) {
1738 asdev = audit_sdev_alloc();
1739 if (NULL == asdev) {
1740 AUDIT_SDEV_LIST_WUNLOCK();
1741 return ENOMEM;
1742 }
1743 audit_sdev_dtab[u] = asdev;
1744 } else {
1745 KASSERT(asdev->asdev_open, ("audit_sdev_open: Already open"));
1746 AUDIT_SDEV_LIST_WUNLOCK();
1747 return EBUSY;
1748 }
1749 asdev->asdev_open = 1;
1750 asdev->asdev_auid = aia.ai_auid;
1751 asdev->asdev_asid = aia.ai_asid;
1752 asdev->asdev_flags = 0;
1753
1754 AUDIT_SDEV_LIST_WUNLOCK();
1755
1756 return 0;
1757 }
1758
1759 /*
1760 * Audit session dev close method.
1761 */
1762 static int
audit_sdev_close(dev_t dev,__unused int flags,__unused int devtype,__unused proc_t p)1763 audit_sdev_close(dev_t dev, __unused int flags, __unused int devtype,
1764 __unused proc_t p)
1765 {
1766 struct audit_sdev *asdev;
1767 int u;
1768
1769 u = minor(dev);
1770 asdev = audit_sdev_dtab[u];
1771
1772 KASSERT(asdev != NULL, ("audit_sdev_close: asdev == NULL"));
1773 KASSERT(asdev->asdev_open, ("audit_sdev_close: !asdev_open"));
1774
1775 AUDIT_SDEV_LIST_WLOCK();
1776 AUDIT_SDEV_LOCK(asdev);
1777 asdev->asdev_open = 0;
1778 audit_sdev_free(asdev); /* sdev lock unlocked in audit_sdev_free() */
1779 audit_sdev_dtab[u] = NULL;
1780 AUDIT_SDEV_LIST_WUNLOCK();
1781
1782 return 0;
1783 }
1784
1785 /*
1786 * Audit session dev ioctl method.
1787 */
1788 static int
audit_sdev_ioctl(dev_t dev,u_long cmd,caddr_t data,__unused int flag,proc_t p)1789 audit_sdev_ioctl(dev_t dev, u_long cmd, caddr_t data,
1790 __unused int flag, proc_t p)
1791 {
1792 struct audit_sdev *asdev;
1793 int error;
1794
1795 asdev = audit_sdev_dtab[minor(dev)];
1796 KASSERT(asdev != NULL, ("audit_sdev_ioctl: asdev == NULL"));
1797
1798 error = 0;
1799
1800 switch (cmd) {
1801 case FIONBIO:
1802 AUDIT_SDEV_LOCK(asdev);
1803 if (*(int *)data) {
1804 asdev->asdev_flags |= AUDIT_SDEV_NBIO;
1805 } else {
1806 asdev->asdev_flags &= ~AUDIT_SDEV_NBIO;
1807 }
1808 AUDIT_SDEV_UNLOCK(asdev);
1809 break;
1810
1811 case FIONREAD:
1812 AUDIT_SDEV_LOCK(asdev);
1813 *(int *)data = asdev->asdev_qbyteslen - asdev->asdev_qoffset;
1814 AUDIT_SDEV_UNLOCK(asdev);
1815 break;
1816
1817 case AUDITSDEV_GET_QLEN:
1818 *(u_int *)data = asdev->asdev_qlen;
1819 break;
1820
1821 case AUDITSDEV_GET_QLIMIT:
1822 *(u_int *)data = asdev->asdev_qlimit;
1823 break;
1824
1825 case AUDITSDEV_SET_QLIMIT:
1826 if (*(u_int *)data >= AUDIT_SDEV_QLIMIT_MIN ||
1827 *(u_int *)data <= AUDIT_SDEV_QLIMIT_MAX) {
1828 asdev->asdev_qlimit = *(u_int *)data;
1829 } else {
1830 error = EINVAL;
1831 }
1832 break;
1833
1834 case AUDITSDEV_GET_QLIMIT_MIN:
1835 *(u_int *)data = AUDIT_SDEV_QLIMIT_MIN;
1836 break;
1837
1838 case AUDITSDEV_GET_QLIMIT_MAX:
1839 *(u_int *)data = AUDIT_SDEV_QLIMIT_MAX;
1840 break;
1841
1842 case AUDITSDEV_FLUSH:
1843 if (AUDIT_SDEV_SX_XLOCK_SIG(asdev) != 0) {
1844 return EINTR;
1845 }
1846 AUDIT_SDEV_LOCK(asdev);
1847 audit_sdev_flush(asdev);
1848 AUDIT_SDEV_UNLOCK(asdev);
1849 AUDIT_SDEV_SX_XUNLOCK(asdev);
1850 break;
1851
1852 case AUDITSDEV_GET_MAXDATA:
1853 *(u_int *)data = MAXAUDITDATA;
1854 break;
1855
1856 /* XXXss these should be 64 bit, maybe. */
1857 case AUDITSDEV_GET_INSERTS:
1858 *(u_int *)data = asdev->asdev_inserts;
1859 break;
1860
1861 case AUDITSDEV_GET_READS:
1862 *(u_int *)data = asdev->asdev_reads;
1863 break;
1864
1865 case AUDITSDEV_GET_DROPS:
1866 *(u_int *)data = asdev->asdev_drops;
1867 break;
1868
1869 case AUDITSDEV_GET_ALLSESSIONS:
1870 error = audit_sdev_get_aia(p, NULL);
1871 if (error) {
1872 break;
1873 }
1874 *(u_int *)data = (asdev->asdev_flags & AUDIT_SDEV_ALLSESSIONS) ?
1875 1 : 0;
1876 break;
1877
1878 case AUDITSDEV_SET_ALLSESSIONS:
1879 error = audit_sdev_get_aia(p, NULL);
1880 if (error) {
1881 break;
1882 }
1883
1884 AUDIT_SDEV_LOCK(asdev);
1885 if (*(int *)data) {
1886 asdev->asdev_flags |= AUDIT_SDEV_ALLSESSIONS;
1887 } else {
1888 asdev->asdev_flags &= ~AUDIT_SDEV_ALLSESSIONS;
1889 }
1890 AUDIT_SDEV_UNLOCK(asdev);
1891 break;
1892
1893 default:
1894 error = ENOTTY;
1895 }
1896
1897 return error;
1898 }
1899
1900 /*
1901 * Audit session dev read method.
1902 */
1903 static int
audit_sdev_read(dev_t dev,struct uio * uio,__unused int flag)1904 audit_sdev_read(dev_t dev, struct uio *uio, __unused int flag)
1905 {
1906 struct audit_sdev_entry *ase;
1907 struct audit_sdev *asdev;
1908 u_int toread;
1909 int error;
1910
1911 asdev = audit_sdev_dtab[minor(dev)];
1912 KASSERT(NULL != asdev, ("audit_sdev_read: asdev == NULL"));
1913
1914 /*
1915 * We hold a sleep lock over read and flush because we rely on the
1916 * stability of a record in the queue during uiomove.
1917 */
1918 if (0 != AUDIT_SDEV_SX_XLOCK_SIG(asdev)) {
1919 return EINTR;
1920 }
1921 AUDIT_SDEV_LOCK(asdev);
1922 while (TAILQ_EMPTY(&asdev->asdev_queue)) {
1923 if (asdev->asdev_flags & AUDIT_SDEV_NBIO) {
1924 AUDIT_SDEV_UNLOCK(asdev);
1925 AUDIT_SDEV_SX_XUNLOCK(asdev);
1926 return EAGAIN;
1927 }
1928 error = cv_wait_sig(&asdev->asdev_cv, AUDIT_SDEV_MTX(asdev));
1929 if (error) {
1930 AUDIT_SDEV_UNLOCK(asdev);
1931 AUDIT_SDEV_SX_XUNLOCK(asdev);
1932 return error;
1933 }
1934 }
1935
1936 /*
1937 * Copy as many remaining bytes from the current record to userspace
1938 * as we can. Keep processing records until we run out of records in
1939 * the queue or until the user buffer runs out of space.
1940 *
1941 * We rely on the sleep lock to maintain ase's stability here.
1942 */
1943 asdev->asdev_reads++;
1944 while ((ase = TAILQ_FIRST(&asdev->asdev_queue)) != NULL &&
1945 uio_resid(uio) > 0) {
1946 AUDIT_SDEV_LOCK_ASSERT(asdev);
1947
1948 KASSERT(ase->ase_record_len > asdev->asdev_qoffset,
1949 ("audit_sdev_read: record_len > qoffset (1)"));
1950 toread = MIN((int)(ase->ase_record_len - asdev->asdev_qoffset),
1951 uio_resid(uio));
1952 AUDIT_SDEV_UNLOCK(asdev);
1953 error = uiomove((char *) ase->ase_record + asdev->asdev_qoffset,
1954 toread, uio);
1955 if (error) {
1956 AUDIT_SDEV_SX_XUNLOCK(asdev);
1957 return error;
1958 }
1959
1960 /*
1961 * If the copy succeeded then update book-keeping, and if no
1962 * bytes remain in the current record then free it.
1963 */
1964 AUDIT_SDEV_LOCK(asdev);
1965 KASSERT(TAILQ_FIRST(&asdev->asdev_queue) == ase,
1966 ("audit_sdev_read: queue out of sync after uiomove"));
1967 asdev->asdev_qoffset += toread;
1968 KASSERT(ase->ase_record_len >= asdev->asdev_qoffset,
1969 ("audit_sdev_read: record_len >= qoffset (2)"));
1970 if (asdev->asdev_qoffset == ase->ase_record_len) {
1971 TAILQ_REMOVE(&asdev->asdev_queue, ase, ase_queue);
1972 asdev->asdev_qbyteslen -= ase->ase_record_len;
1973 audit_sdev_entry_free(ase);
1974 asdev->asdev_qlen--;
1975 asdev->asdev_qoffset = 0;
1976 }
1977 }
1978 AUDIT_SDEV_UNLOCK(asdev);
1979 AUDIT_SDEV_SX_XUNLOCK(asdev);
1980 return 0;
1981 }
1982
1983 /*
1984 * Audit session device poll method.
1985 */
1986 static int
audit_sdev_poll(dev_t dev,int events,void * wql,struct proc * p)1987 audit_sdev_poll(dev_t dev, int events, void *wql, struct proc *p)
1988 {
1989 struct audit_sdev *asdev;
1990 int revents;
1991
1992 revents = 0;
1993 asdev = audit_sdev_dtab[minor(dev)];
1994 KASSERT(NULL != asdev, ("audit_sdev_poll: asdev == NULL"));
1995
1996 if (events & (POLLIN | POLLRDNORM)) {
1997 AUDIT_SDEV_LOCK(asdev);
1998 if (NULL != TAILQ_FIRST(&asdev->asdev_queue)) {
1999 revents |= events & (POLLIN | POLLRDNORM);
2000 } else {
2001 selrecord(p, &asdev->asdev_selinfo, wql);
2002 }
2003 AUDIT_SDEV_UNLOCK(asdev);
2004 }
2005 return revents;
2006 }
2007
2008 /*
2009 * Audit sdev clone routine. Provides a new minor number or returns -1.
2010 * This called with DEVFS_LOCK held.
2011 */
2012 static int
audit_sdev_clone(__unused dev_t dev,int action)2013 audit_sdev_clone(__unused dev_t dev, int action)
2014 {
2015 int i;
2016
2017 if (DEVFS_CLONE_ALLOC == action) {
2018 for (i = 0; i < MAX_AUDIT_SDEVS; i++) {
2019 if (NULL == audit_sdev_dtab[i]) {
2020 return i;
2021 }
2022 }
2023
2024 /*
2025 * This really should return -1 here but that seems to
2026 * hang things in devfs. We instead return 0 and let
2027 * audit_sdev_open tell userland the bad news.
2028 */
2029 return 0;
2030 }
2031
2032 return -1;
2033 }
2034
2035 static int
audit_sdev_init(void)2036 audit_sdev_init(void)
2037 {
2038 dev_t dev;
2039
2040 TAILQ_INIT(&audit_sdev_list);
2041 AUDIT_SDEV_LIST_LOCK_INIT();
2042
2043 audit_sdev_major = cdevsw_add(-1, &audit_sdev_cdevsw);
2044 if (audit_sdev_major < 0) {
2045 return KERN_FAILURE;
2046 }
2047
2048 dev = makedev(audit_sdev_major, 0);
2049 devnode = devfs_make_node_clone(dev, DEVFS_CHAR, UID_ROOT, GID_WHEEL,
2050 0644, audit_sdev_clone, AUDIT_SDEV_NAME);
2051
2052 if (NULL == devnode) {
2053 return KERN_FAILURE;
2054 }
2055
2056 return KERN_SUCCESS;
2057 }
2058
2059 /* XXXss
2060 * static int
2061 * audit_sdev_shutdown(void)
2062 * {
2063 *
2064 * devfs_remove(devnode);
2065 * (void) cdevsw_remove(audit_sdev_major, &audit_sdev_cdevsw);
2066 *
2067 * return (KERN_SUCCESS);
2068 * }
2069 */
2070
2071 #else
2072
2073 int
audit_session_self(proc_t p,struct audit_session_self_args * uap,mach_port_name_t * ret_port)2074 audit_session_self(proc_t p, struct audit_session_self_args *uap,
2075 mach_port_name_t *ret_port)
2076 {
2077 #pragma unused(p, uap, ret_port)
2078
2079 return ENOSYS;
2080 }
2081
2082 int
audit_session_join(proc_t p,struct audit_session_join_args * uap,au_asid_t * ret_asid)2083 audit_session_join(proc_t p, struct audit_session_join_args *uap,
2084 au_asid_t *ret_asid)
2085 {
2086 #pragma unused(p, uap, ret_asid)
2087
2088 return ENOSYS;
2089 }
2090
2091 int
audit_session_port(proc_t p,struct audit_session_port_args * uap,int * retval)2092 audit_session_port(proc_t p, struct audit_session_port_args *uap, int *retval)
2093 {
2094 #pragma unused(p, uap, retval)
2095
2096 return ENOSYS;
2097 }
2098
2099 #endif /* CONFIG_AUDIT */
2100