1 | /*- |
2 | * Copyright (c) 2005-2009 Apple Inc. |
3 | * All rights reserved. |
4 | * |
5 | * Redistribution and use in source and binary forms, with or without |
6 | * modification, are permitted provided that the following conditions |
7 | * are met: |
8 | * |
9 | * 1. Redistributions of source code must retain the above copyright |
10 | * notice, this list of conditions and the following disclaimer. |
11 | * 2. Redistributions in binary form must reproduce the above copyright |
12 | * notice, this list of conditions and the following disclaimer in the |
13 | * documentation and/or other materials provided with the distribution. |
14 | * 3. Neither the name of Apple Inc. ("Apple") nor the names of |
15 | * its contributors may be used to endorse or promote products derived |
16 | * from this software without specific prior written permission. |
17 | * |
18 | * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY |
19 | * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED |
20 | * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE |
21 | * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY |
22 | * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES |
23 | * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; |
24 | * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND |
25 | * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT |
26 | * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF |
27 | * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
28 | * |
29 | * $P4: //depot/projects/trustedbsd/openbsm/sys/bsm/audit_record.h#10 $ |
30 | */ |
31 | |
32 | #ifndef _BSM_AUDIT_RECORD_H_ |
33 | #define _BSM_AUDIT_RECORD_H_ |
34 | |
35 | #include <bsm/audit.h> /* token_t */ |
36 | #include <sys/time.h> /* struct timeval */ |
37 | |
38 | /* |
39 | * Token type identifiers. |
40 | */ |
41 | #define AUT_INVALID 0x00 |
42 | #define AUT_OTHER_FILE32 0x11 |
43 | #define 0x12 |
44 | #define AUT_TRAILER 0x13 |
45 | #define 0x14 |
46 | #define 0x15 |
47 | #define AUT_DATA 0x21 |
48 | #define AUT_IPC 0x22 |
49 | #define AUT_PATH 0x23 |
50 | #define AUT_SUBJECT32 0x24 |
51 | #define AUT_XATPATH 0x25 |
52 | #define AUT_PROCESS32 0x26 |
53 | #define AUT_RETURN32 0x27 |
54 | #define AUT_TEXT 0x28 |
55 | #define AUT_OPAQUE 0x29 |
56 | #define AUT_IN_ADDR 0x2a |
57 | #define AUT_IP 0x2b |
58 | #define AUT_IPORT 0x2c |
59 | #define AUT_ARG32 0x2d |
60 | #define AUT_SOCKET 0x2e |
61 | #define AUT_SEQ 0x2f |
62 | #define AUT_ACL 0x30 |
63 | #define AUT_ATTR 0x31 |
64 | #define AUT_IPC_PERM 0x32 |
65 | #define AUT_LABEL 0x33 |
66 | #define AUT_GROUPS 0x34 |
67 | #define AUT_ACE 0x35 |
68 | #define AUT_PRIV 0x38 |
69 | #define AUT_UPRIV 0x39 |
70 | #define AUT_LIAISON 0x3a |
71 | #define AUT_NEWGROUPS 0x3b |
72 | #define AUT_EXEC_ARGS 0x3c |
73 | #define AUT_EXEC_ENV 0x3d |
74 | #define AUT_ATTR32 0x3e |
75 | #define AUT_UNAUTH 0x3f |
76 | #define AUT_XATOM 0x40 |
77 | #define AUT_XOBJ 0x41 |
78 | #define AUT_XPROTO 0x42 |
79 | #define AUT_XSELECT 0x43 |
80 | #define AUT_XCOLORMAP 0x44 |
81 | #define AUT_XCURSOR 0x45 |
82 | #define AUT_XFONT 0x46 |
83 | #define AUT_XGC 0x47 |
84 | #define AUT_XPIXMAP 0x48 |
85 | #define AUT_XPROPERTY 0x49 |
86 | #define AUT_XWINDOW 0x4a |
87 | #define AUT_XCLIENT 0x4b |
88 | #define AUT_CMD 0x51 |
89 | #define AUT_EXIT 0x52 |
90 | #define AUT_ZONENAME 0x60 |
91 | #define AUT_HOST 0x70 |
92 | #define AUT_ARG64 0x71 |
93 | #define AUT_RETURN64 0x72 |
94 | #define AUT_ATTR64 0x73 |
95 | #define 0x74 |
96 | #define AUT_SUBJECT64 0x75 |
97 | #define AUT_PROCESS64 0x77 |
98 | #define AUT_OTHER_FILE64 0x78 |
99 | #define 0x79 |
100 | #define AUT_SUBJECT32_EX 0x7a |
101 | #define AUT_PROCESS32_EX 0x7b |
102 | #define AUT_SUBJECT64_EX 0x7c |
103 | #define AUT_PROCESS64_EX 0x7d |
104 | #define AUT_IN_ADDR_EX 0x7e |
105 | #define AUT_SOCKET_EX 0x7f |
106 | |
107 | /* |
108 | * Pre-64-bit BSM, 32-bit tokens weren't explicitly named as '32'. We have |
109 | * compatibility defines. |
110 | */ |
111 | #define AUT_HEADER32 |
112 | #define AUT_ARG AUT_ARG32 |
113 | #define AUT_RETURN AUT_RETURN32 |
114 | #define AUT_SUBJECT AUT_SUBJECT32 |
115 | #define AUT_PROCESS AUT_PROCESS32 |
116 | #define AUT_OTHER_FILE AUT_OTHER_FILE32 |
117 | |
118 | /* |
119 | * The values for the following token ids are not defined by BSM. |
120 | * |
121 | * XXXRW: Not sure how to handle these in OpenBSM yet, but I'll give them |
122 | * names more consistent with Sun's BSM. These originally came from Apple's |
123 | * BSM. |
124 | */ |
125 | #define AUT_SOCKINET32 0x80 /* XXX */ |
126 | #define AUT_SOCKINET128 0x81 /* XXX */ |
127 | #define AUT_SOCKUNIX 0x82 /* XXX */ |
128 | |
129 | /* Apple specific tokens*/ |
130 | #define AUT_IDENTITY 0xed |
131 | #define AUT_KRB5_PRINCIPAL 0xee |
132 | #define AUT_CERT_HASH 0xef |
133 | |
134 | /* print values for the arbitrary token */ |
135 | #define AUP_BINARY 0 |
136 | #define AUP_OCTAL 1 |
137 | #define AUP_DECIMAL 2 |
138 | #define AUP_HEX 3 |
139 | #define AUP_STRING 4 |
140 | |
141 | /* data-types for the arbitrary token */ |
142 | #define AUR_BYTE 0 |
143 | #define AUR_CHAR AUR_BYTE |
144 | #define AUR_SHORT 1 |
145 | #define AUR_INT32 2 |
146 | #define AUR_INT AUR_INT32 |
147 | #define AUR_INT64 3 |
148 | |
149 | /* ... and their sizes */ |
150 | #define AUR_BYTE_SIZE sizeof(u_char) |
151 | #define AUR_CHAR_SIZE AUR_BYTE_SIZE |
152 | #define AUR_SHORT_SIZE sizeof(uint16_t) |
153 | #define AUR_INT32_SIZE sizeof(uint32_t) |
154 | #define AUR_INT_SIZE AUR_INT32_SIZE |
155 | #define AUR_INT64_SIZE sizeof(uint64_t) |
156 | |
157 | /* Modifiers for the header token */ |
158 | #define PAD_NOTATTR 0x4000 /* nonattributable event */ |
159 | #define PAD_FAILURE 0x8000 /* fail audit event */ |
160 | |
161 | #define AUDIT_MAX_GROUPS 16 |
162 | |
163 | /* |
164 | * A number of BSM versions are floating around and defined. Here are |
165 | * constants for them. OpenBSM uses the same token types, etc, used in the |
166 | * Solaris BSM version, but has a separate version number in order to |
167 | * identify a potentially different event identifier name space. |
168 | */ |
169 | #define 1 /* In retrospect, a mistake. */ |
170 | #define 2 |
171 | #define 3 |
172 | #define 4 |
173 | #define 10 |
174 | #define 11 |
175 | #define AUDIT_HEADER_VERSION_OPENBSM11 |
176 | |
177 | #define AUT_TRAILER_MAGIC 0xb105 |
178 | |
179 | /* BSM library calls */ |
180 | |
181 | __BEGIN_DECLS |
182 | |
183 | struct in_addr; |
184 | struct in6_addr; |
185 | struct ip; |
186 | struct ipc_perm; |
187 | struct kevent; |
188 | struct sockaddr; |
189 | struct sockaddr_in; |
190 | struct sockaddr_in6; |
191 | struct sockaddr_un; |
192 | #if defined(_KERNEL) || defined(KERNEL) |
193 | struct vnode_au_info; |
194 | #endif |
195 | |
196 | int au_open(void); |
197 | int au_write(int d, token_t *m); |
198 | int au_close(int d, int keep, short event); |
199 | int au_close_buffer(int d, short event, u_char *buffer, size_t *buflen); |
200 | int au_close_token(token_t *tok, u_char *buffer, size_t *buflen); |
201 | |
202 | token_t *au_to_file(const char *file, struct timeval tm); |
203 | |
204 | token_t *(int rec_size, au_event_t e_type, au_emod_t e_mod, |
205 | struct timeval tm); |
206 | token_t *(int rec_size, au_event_t e_type, au_emod_t e_mod, |
207 | struct timeval tm, struct auditinfo_addr *aia); |
208 | token_t *(int rec_size, au_event_t e_type, au_emod_t e_mod, |
209 | struct timeval tm); |
210 | #if !defined(KERNEL) && !defined(_KERNEL) |
211 | token_t *au_to_header(int rec_size, au_event_t e_type, au_emod_t e_mod); |
212 | token_t *au_to_header_ex(int rec_size, au_event_t e_type, au_emod_t e_mod); |
213 | token_t *au_to_header32(int rec_size, au_event_t e_type, au_emod_t e_mod); |
214 | token_t *au_to_header64(int rec_size, au_event_t e_type, au_emod_t e_mod); |
215 | token_t *au_to_header32_ex(int rec_size, au_event_t e_type, au_emod_t e_mod); |
216 | #endif |
217 | |
218 | token_t *au_to_me(void); |
219 | token_t *au_to_arg(char n, const char *text, uint32_t v); |
220 | token_t *au_to_arg32(char n, const char *text, uint32_t v); |
221 | token_t *au_to_arg64(char n, const char *text, uint64_t v); |
222 | |
223 | #if defined(_KERNEL) || defined(KERNEL) |
224 | token_t *au_to_attr(struct vnode_au_info *vni); |
225 | token_t *au_to_attr32(struct vnode_au_info *vni); |
226 | token_t *au_to_attr64(struct vnode_au_info *vni); |
227 | #endif |
228 | |
229 | token_t *au_to_data(char unit_print, char unit_type, char unit_count, |
230 | const char *p); |
231 | token_t *au_to_exit(int retval, int err); |
232 | token_t *au_to_groups(int *groups); |
233 | token_t *au_to_newgroups(uint16_t n, gid_t *groups); |
234 | token_t *au_to_in_addr(struct in_addr *internet_addr); |
235 | token_t *au_to_in_addr_ex(struct in6_addr *internet_addr); |
236 | token_t *au_to_ip(struct ip *ip); |
237 | token_t *au_to_ipc(char type, int id); |
238 | token_t *au_to_ipc_perm(struct ipc_perm *perm); |
239 | token_t *au_to_iport(uint16_t iport); |
240 | token_t *au_to_opaque(const char *data, uint16_t bytes); |
241 | token_t *au_to_path(const char *path); |
242 | token_t *au_to_process(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid, |
243 | gid_t rgid, pid_t pid, au_asid_t sid, au_tid_t *tid); |
244 | token_t *au_to_process32(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid, |
245 | gid_t rgid, pid_t pid, au_asid_t sid, au_tid_t *tid); |
246 | token_t *au_to_process64(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid, |
247 | gid_t rgid, pid_t pid, au_asid_t sid, au_tid_t *tid); |
248 | token_t *au_to_process_ex(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid, |
249 | gid_t rgid, pid_t pid, au_asid_t sid, au_tid_addr_t *tid); |
250 | token_t *au_to_process32_ex(au_id_t auid, uid_t euid, gid_t egid, |
251 | uid_t ruid, gid_t rgid, pid_t pid, au_asid_t sid, |
252 | au_tid_addr_t *tid); |
253 | token_t *au_to_process64_ex(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid, |
254 | gid_t rgid, pid_t pid, au_asid_t sid, au_tid_addr_t *tid); |
255 | token_t *au_to_return(char status, uint32_t ret); |
256 | token_t *au_to_return32(char status, uint32_t ret); |
257 | token_t *au_to_return64(char status, uint64_t ret); |
258 | token_t *au_to_seq(long audit_count); |
259 | token_t *au_to_socket_ex(u_short so_domain, u_short so_type, |
260 | struct sockaddr *sa_local, struct sockaddr *sa_remote); |
261 | token_t *au_to_sock_inet(struct sockaddr_in *so); |
262 | token_t *au_to_sock_inet32(struct sockaddr_in *so); |
263 | token_t *au_to_sock_inet128(struct sockaddr_in6 *so); |
264 | token_t *au_to_sock_unix(struct sockaddr_un *so); |
265 | token_t *au_to_subject(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid, |
266 | gid_t rgid, pid_t pid, au_asid_t sid, au_tid_t *tid); |
267 | token_t *au_to_subject32(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid, |
268 | gid_t rgid, pid_t pid, au_asid_t sid, au_tid_t *tid); |
269 | token_t *au_to_subject64(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid, |
270 | gid_t rgid, pid_t pid, au_asid_t sid, au_tid_t *tid); |
271 | token_t *au_to_subject_ex(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid, |
272 | gid_t rgid, pid_t pid, au_asid_t sid, au_tid_addr_t *tid); |
273 | token_t *au_to_subject32_ex(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid, |
274 | gid_t rgid, pid_t pid, au_asid_t sid, au_tid_addr_t *tid); |
275 | token_t *au_to_subject64_ex(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid, |
276 | gid_t rgid, pid_t pid, au_asid_t sid, au_tid_addr_t *tid); |
277 | #if defined(_KERNEL) || defined(KERNEL) |
278 | token_t *au_to_exec_args(char *args, int argc); |
279 | token_t *au_to_exec_env(char *envs, int envc); |
280 | token_t *au_to_certificate_hash(char *hash, int hashc); |
281 | token_t *au_to_krb5_principal(char *principal, int princ); |
282 | #else |
283 | token_t *au_to_exec_args(char **argv); |
284 | token_t *au_to_exec_env(char **envp); |
285 | token_t *au_to_certificate_hash(char **hash); |
286 | token_t *au_to_krb5_principal(char **principal); |
287 | #endif |
288 | token_t *au_to_text(const char *text); |
289 | token_t *au_to_kevent(struct kevent *kev); |
290 | token_t *au_to_trailer(int rec_size); |
291 | token_t *au_to_zonename(const char *zonename); |
292 | token_t *au_to_identity(uint32_t signer_type, const char* signing_id, |
293 | u_char signing_id_trunc, const char* team_id, u_char team_id_trunc, |
294 | uint8_t* cdhash, uint16_t cdhash_len); |
295 | |
296 | /* |
297 | * BSM library routines for converting between local and BSM constant spaces. |
298 | */ |
299 | int au_bsm_to_domain(u_short bsm_domain, int *local_domainp); |
300 | int au_bsm_to_errno(u_char bsm_error, int *errorp); |
301 | int au_bsm_to_fcntl_cmd(u_short bsm_fcntl_cmd, int *local_fcntl_cmdp); |
302 | int au_bsm_to_socket_type(u_short bsm_socket_type, |
303 | int *local_socket_typep); |
304 | u_short au_domain_to_bsm(int local_domain); |
305 | u_char au_errno_to_bsm(int local_errno); |
306 | u_short au_fcntl_cmd_to_bsm(int local_fcntl_command); |
307 | u_short au_socket_type_to_bsm(int local_socket_type); |
308 | |
309 | __END_DECLS |
310 | |
311 | #endif /* ! _BSM_AUDIT_RECORD_H_ */ |
312 | |