1/*-
2 * Copyright (c) 1999-2016 Apple Inc.
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 * 3. Neither the name of Apple Inc. ("Apple") nor the names of
14 * its contributors may be used to endorse or promote products derived
15 * from this software without specific prior written permission.
16 *
17 * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND
18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20 * ARE DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR
21 * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
25 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
26 * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
27 * POSSIBILITY OF SUCH DAMAGE.
28 */
29/*
30 * NOTICE: This file was modified by SPARTA, Inc. in 2005 to introduce
31 * support for mandatory and extensible security protections. This notice
32 * is included in support of clause 2.2 (b) of the Apple Public License,
33 * Version 2.0.
34 */
35
36/*
37 * This include file contains function prototypes and type definitions used
38 * within the audit implementation.
39 */
40
41#ifndef _SECURITY_AUDIT_PRIVATE_H_
42#define _SECURITY_AUDIT_PRIVATE_H_
43
44#if defined(_KERNEL) || defined(KERNEL)
45
46#if CONFIG_MACF
47#include <sys/queue.h>
48#include <security/mac_framework.h>
49#endif
50
51#include <sys/ipc.h>
52#include <sys/proc_internal.h> /* for PID_MAX */
53#include <sys/socket.h>
54#include <sys/ucred.h>
55
56#ifdef MALLOC_DECLARE
57MALLOC_DECLARE(M_AUDITBSM);
58MALLOC_DECLARE(M_AUDITDATA);
59MALLOC_DECLARE(M_AUDITPATH);
60MALLOC_DECLARE(M_AUDITTEXT);
61#endif
62
63/*
64 * Audit control variables that are usually set/read via system calls and
65 * used to control various aspects of auditing.
66 */
67extern struct au_qctrl audit_qctrl;
68extern struct audit_fstat audit_fstat;
69extern struct au_mask audit_nae_mask;
70extern int audit_panic_on_write_fail;
71extern int audit_fail_stop;
72extern int audit_argv;
73extern int audit_arge;
74extern au_ctlmode_t audit_ctl_mode;
75extern au_expire_after_t audit_expire_after;
76
77/*
78 * Kernel mask that is used to check to see if system calls need to be audited.
79 */
80extern au_class_t audit_kevent_mask;
81
82/*
83 * The macro used to check to see if the system calls need to be auditing.
84 * This will pessimisticly set the audit syscalls flag if the audit kevent
85 * mask has not been created yet. User code should build the event/class
86 * mapping table before setting preselection masks to avoid this.
87 */
88#define AUDIT_CHECK_IF_KEVENTS_MASK(m) do { \
89 if ((m).am_success || (m).am_failure) \
90 if (!audit_kevent_mask || \
91 (audit_kevent_mask & (m).am_success) || \
92 (audit_kevent_mask & (m).am_failure)) \
93 audit_syscalls = 1; \
94} while (0)
95
96/*
97 * Success/failure conditions for the conversion of a kernel audit record to
98 * BSM format.
99 */
100#define BSM_SUCCESS 0
101#define BSM_FAILURE 1
102#define BSM_NOAUDIT 2
103
104/*
105 * Defines for the kernel audit record k_ar_commit field. Flags are set to
106 * indicate what sort of record it is, and which preselection mechanism
107 * selected it.
108 */
109#define AR_COMMIT_KERNEL 0x00000001U
110#define AR_COMMIT_USER 0x00000010U
111
112#define AR_PRESELECT_TRAIL 0x00001000U
113#define AR_PRESELECT_PIPE 0x00002000U
114
115#define AR_PRESELECT_USER_TRAIL 0x00004000U
116#define AR_PRESELECT_USER_PIPE 0x00008000U
117
118#define AR_PRESELECT_FILTER 0x00010000U
119
120#define AR_DRAIN_QUEUE 0x80000000U
121
122/*
123 * Audit data is generated as a stream of struct audit_record structures,
124 * linked by struct kaudit_record, and contain storage for possible audit so
125 * that it will not need to be allocated during the processing of a system
126 * call, both improving efficiency and avoiding sleeping at untimely moments.
127 * This structure is converted to BSM format before being written to disk.
128 */
129struct vnode_au_info {
130 mode_t vn_mode;
131 uid_t vn_uid;
132 gid_t vn_gid;
133 dev_t vn_dev;
134 long vn_fsid;
135 long vn_fileid;
136 long vn_gen;
137};
138
139struct groupset {
140 gid_t gidset[NGROUPS];
141 u_int gidset_size;
142};
143
144struct socket_au_info {
145 int sai_domain;
146 int sai_type;
147 int sai_protocol;
148
149 /* Foreign (remote) address/port. */
150 struct sockaddr_storage sai_faddr;
151
152 /* Local address/port. */
153 struct sockaddr_storage sai_laddr;
154};
155
156/*
157 * The following is used for A_OLDSETQCTRL and A_OLDGETQCTRL and a 64-bit
158 * userland.
159 */
160struct au_qctrl64 {
161 u_int64_t aq64_hiwater;
162 u_int64_t aq64_lowater;
163 u_int64_t aq64_bufsz;
164 u_int64_t aq64_delay;
165 int64_t aq64_minfree;
166};
167typedef struct au_qctrl64 au_qctrl64_t;
168
169union auditon_udata {
170 char *au_path;
171 int au_cond;
172 int au_policy;
173 int64_t au_cond64;
174 int64_t au_policy64;
175 int au_trigger;
176 au_evclass_map_t au_evclass;
177 au_mask_t au_mask;
178 au_asflgs_t au_flags;
179 auditinfo_t au_auinfo;
180 auditpinfo_t au_aupinfo;
181 auditpinfo_addr_t au_aupinfo_addr;
182 au_qctrl_t au_qctrl;
183 au_qctrl64_t au_qctrl64;
184 au_stat_t au_stat;
185 au_fstat_t au_fstat;
186 auditinfo_addr_t au_kau_info;
187 au_ctlmode_t au_ctl_mode;
188 au_expire_after_t au_expire_after;
189};
190
191struct posix_ipc_perm {
192 uid_t pipc_uid;
193 gid_t pipc_gid;
194 mode_t pipc_mode;
195};
196
197struct au_identity_info {
198 u_int32_t signer_type;
199 char *signing_id;
200 u_char signing_id_trunc;
201 char *team_id;
202 u_char team_id_trunc;
203 u_int8_t *cdhash;
204 u_int16_t cdhash_len;
205};
206
207struct audit_record {
208 /* Audit record header. */
209 u_int32_t ar_magic;
210 int ar_event;
211 int ar_retval; /* value returned to the process */
212 int ar_errno; /* return status of system call */
213 struct timespec ar_starttime;
214 struct timespec ar_endtime;
215 u_int64_t ar_valid_arg; /* Bitmask of valid arguments */
216
217 /* Audit subject information. */
218 struct xucred ar_subj_cred;
219 uid_t ar_subj_ruid;
220 gid_t ar_subj_rgid;
221 gid_t ar_subj_egid;
222 uid_t ar_subj_auid; /* Audit user ID */
223 pid_t ar_subj_asid; /* Audit session ID */
224 pid_t ar_subj_pid;
225 struct au_tid ar_subj_term;
226 struct au_tid_addr ar_subj_term_addr;
227 struct au_mask ar_subj_amask;
228
229 /* Operation arguments. */
230 uid_t ar_arg_euid;
231 uid_t ar_arg_ruid;
232 uid_t ar_arg_suid;
233 gid_t ar_arg_egid;
234 gid_t ar_arg_rgid;
235 gid_t ar_arg_sgid;
236 pid_t ar_arg_pid;
237 pid_t ar_arg_asid;
238 struct au_tid ar_arg_termid;
239 struct au_tid_addr ar_arg_termid_addr;
240 uid_t ar_arg_uid;
241 uid_t ar_arg_auid;
242 gid_t ar_arg_gid;
243 struct groupset ar_arg_groups;
244 int ar_arg_fd;
245 int ar_arg_fflags;
246 mode_t ar_arg_mode;
247 uint32_t ar_arg_value32;
248 uint64_t ar_arg_value64;
249 user_addr_t ar_arg_addr;
250 user_size_t ar_arg_len;
251 int ar_arg_mask;
252 u_int ar_arg_signum;
253 char ar_arg_login[MAXLOGNAME];
254 int ar_arg_ctlname[CTL_MAXNAME];
255 struct socket_au_info ar_arg_sockinfo;
256 char *ar_arg_upath1;
257 char *ar_arg_upath2;
258 char *ar_arg_kpath1; /* darwin-only */
259 char *ar_arg_kpath2; /* darwin-only */
260#if CONFIG_MACF
261 char *ar_vnode1_mac_labels;
262 char *ar_vnode2_mac_labels;
263 char *ar_cred_mac_labels;
264 char *ar_arg_mac_string;
265#endif
266 char *ar_arg_text;
267 void *ar_arg_opaque; /* darwin-only */
268 void *ar_arg_data; /* darwin-only */
269 u_int16_t ar_arg_opq_size; /* darwin-only */
270 u_char ar_arg_data_type; /* darwin-only */
271 u_char ar_arg_data_count; /* darwin-only */
272 struct au_mask ar_arg_amask;
273 struct vnode_au_info ar_arg_vnode1;
274 struct vnode_au_info ar_arg_vnode2;
275 int ar_arg_cmd;
276 int ar_arg_svipc_cmd;
277 struct ipc_perm ar_arg_svipc_perm;
278 int ar_arg_svipc_id;
279 user_addr_t ar_arg_svipc_addr;
280 struct posix_ipc_perm ar_arg_pipc_perm;
281 mach_port_name_t ar_arg_mach_port1; /* darwin-only */
282 mach_port_name_t ar_arg_mach_port2; /* darwin-only */
283 union auditon_udata ar_arg_auditon;
284 char *ar_arg_argv;
285 int ar_arg_argc;
286 char *ar_arg_envv;
287 int ar_arg_envc;
288 int ar_arg_exitstatus;
289 int ar_arg_exitretval;
290 struct sockaddr_storage ar_arg_sockaddr;
291 int ar_arg_fd2;
292
293#if CONFIG_MACF
294 /*
295 * MAC security related fields added by MAC policies ar_forced_by_mac
296 * is 1 if mac_audit_check_preselect() forced this call to be audited,
297 * 0 otherwise.
298 */
299 LIST_HEAD(mac_audit_record_list_t, mac_audit_record) *ar_mac_records;
300 int ar_forced_by_mac;
301#endif
302 struct au_identity_info ar_arg_identity;
303};
304
305/*
306 * Arguments in the audit record are initially not defined; flags are set to
307 * indicate if they are present so they can be included in the audit log
308 * stream only if defined.
309 */
310#define ARG_IS_VALID(kar, arg) ((kar)->k_ar.ar_valid_arg & (arg))
311#define ARG_SET_VALID(kar, arg) do { \
312 (kar)->k_ar.ar_valid_arg |= (arg); \
313} while (0)
314
315/*
316 * Current thread macro. get_bsdthread_info() returns a void ptr for some
317 * reason.
318 */
319#define curthread() ((struct uthread *)get_bsdthread_info(current_thread()))
320
321/*
322 * In-kernel version of audit record; the basic record plus queue meta-data.
323 * This record can also have a pointer set to some opaque data that will be
324 * passed through to the audit writing mechanism.
325 */
326struct kaudit_record {
327 struct audit_record k_ar;
328 u_int32_t k_ar_commit;
329 void *k_udata; /* User data. */
330 u_int k_ulen; /* User data length. */
331 struct uthread *k_uthread; /* Audited thread. */
332 TAILQ_ENTRY(kaudit_record) k_q;
333};
334TAILQ_HEAD(kaudit_queue, kaudit_record);
335
336/*
337 * Functions to manage the allocation, release, and commit of kernel audit
338 * records.
339 */
340void audit_abort(struct kaudit_record *ar);
341void audit_commit(struct kaudit_record *ar, int error,
342 int retval);
343struct kaudit_record *audit_new(int event, proc_t p, struct uthread *td);
344
345/*
346 * Functions relating to the conversion of internal kernel audit records to
347 * the BSM file format.
348 */
349struct au_record;
350int kaudit_to_bsm(struct kaudit_record *kar, struct au_record **pau);
351int bsm_rec_verify(void *rec, int length);
352
353/*
354 * Kernel versions of the libbsm audit record functions.
355 */
356void kau_free(struct au_record *rec);
357void kau_init(void);
358
359/*
360 * Return values for pre-selection and post-selection decisions.
361 */
362#define AU_PRS_SUCCESS 1
363#define AU_PRS_FAILURE 2
364#define AU_PRS_BOTH (AU_PRS_SUCCESS|AU_PRS_FAILURE)
365
366/*
367 * Data structures relating to the kernel audit queue. Ideally, these might
368 * be abstracted so that only accessor methods are exposed.
369 */
370extern struct mtx audit_mtx;
371extern struct cv audit_watermark_cv;
372extern struct cv audit_worker_cv;
373extern struct cv audit_drain_cv;
374extern struct kaudit_queue audit_q;
375extern int audit_q_len;
376extern int audit_pre_q_len;
377extern int audit_in_failure;
378
379/*
380 * Flags to use on audit files when opening and closing.
381 */
382#define AUDIT_OPEN_FLAGS (FWRITE | O_APPEND)
383#define AUDIT_CLOSE_FLAGS (FWRITE | O_APPEND)
384
385#include <sys/fcntl.h>
386#include <sys/kernel.h>
387#include <sys/malloc.h>
388
389/*
390 * Some of the BSM tokenizer functions take different parameters in the
391 * kernel implementations in order to save the copying of large kernel data
392 * structures. The prototypes of these functions are declared here.
393 */
394token_t *kau_to_socket(struct socket_au_info *soi);
395
396/*
397 * audit_klib prototypes
398 */
399int au_preselect(au_event_t event, au_class_t class,
400 au_mask_t *mask_p, int sorf);
401void au_evclassmap_init(void);
402void au_evclassmap_insert(au_event_t event, au_class_t class);
403au_class_t au_event_class(au_event_t event);
404au_event_t audit_ctlname_to_sysctlevent(int name[], uint64_t valid_arg);
405au_event_t audit_flags_and_error_to_openevent(int oflags, int error);
406au_event_t audit_flags_and_error_to_openextendedevent(int oflags,
407 int error);
408au_event_t audit_flags_and_error_to_openatevent(int oflags,
409 int error);
410au_event_t audit_flags_and_error_to_openbyidevent(int oflags,
411 int error);
412au_event_t audit_msgctl_to_event(int cmd);
413au_event_t audit_semctl_to_event(int cmr);
414int audit_canon_path(struct vnode *cwd_vp, char *path,
415 char *cpath);
416au_event_t auditon_command_event(int cmd);
417au_event_t audit_fcntl_command_event(int cmd, int oflags, int error);
418
419/*
420 * Audit trigger events notify user space of kernel audit conditions
421 * asynchronously.
422 */
423int audit_send_trigger(unsigned int trigger);
424
425/*
426 * Accessor functions to manage global audit state.
427 */
428void audit_set_kinfo(struct auditinfo_addr *);
429void audit_get_kinfo(struct auditinfo_addr *);
430
431/*
432 * General audit related functions.
433 */
434struct kaudit_record *currecord(void);
435void audit_free(struct kaudit_record *ar);
436void audit_rotate_vnode(struct ucred *cred,
437 struct vnode *vp);
438void audit_worker_init(void);
439void audit_identity_info_construct(
440 struct au_identity_info *id_info);
441void audit_identity_info_destruct(
442 struct au_identity_info *id_info);
443
444/*
445 * Audit pipe functions.
446 */
447int audit_pipe_init(void);
448int audit_pipe_shutdown(void);
449int audit_pipe_preselect(au_id_t auid, au_event_t event,
450 au_class_t class, int sorf, int trail_select);
451void audit_pipe_submit(au_id_t auid, au_event_t event, au_class_t class,
452 int sorf, int trail_select, void *record, u_int record_len);
453void audit_pipe_submit_user(void *record, u_int record_len);
454
455/*
456 * Audit MAC prototypes.
457 */
458void audit_mac_init(void);
459int audit_mac_new(proc_t p, struct kaudit_record *ar);
460void audit_mac_free(struct kaudit_record *ar);
461int audit_mac_syscall_enter(unsigned short code, proc_t p,
462 struct uthread *uthread, kauth_cred_t my_cred, au_event_t event);
463int audit_mac_syscall_exit(unsigned short code, struct uthread *uthread,
464 int error, int retval);
465
466/*
467 * Audit Session.
468 */
469void audit_session_init(void);
470int audit_session_setaia(proc_t p, auditinfo_addr_t *aia_p);
471auditinfo_addr_t *audit_session_update(auditinfo_addr_t *new_aia);
472int audit_session_lookup(au_asid_t asid, auditinfo_addr_t *ret_aia);
473
474/*
475 * Kernel assigned audit session IDs start at PID_MAX + 1 and ends at
476 * ASSIGNED_ASID_MAX.
477 */
478#define ASSIGNED_ASID_MIN (PID_MAX + 1)
479#define ASSIGNED_ASID_MAX (0xFFFFFFFF - 1)
480
481/*
482 * Entitlement required to control various audit subsystem settings
483 */
484#define AU_CLASS_RESERVED_ENTITLEMENT "com.apple.private.dz.audit"
485
486/*
487 * Entitlement required to control auditctl sys call
488 */
489#define AU_AUDITCTL_RESERVED_ENTITLEMENT "com.apple.private.protected-audit-control"
490
491/*
492 * Max sizes used by the kernel for signing id and team id values of the
493 * identity tokens. These lengths include space for the null terminator.
494 */
495#define MAX_AU_IDENTITY_SIGNING_ID_LENGTH 129
496#define MAX_AU_IDENTITY_TEAM_ID_LENGTH 17
497
498struct __attribute__((__packed__)) hdr_tok_partial {
499 u_char type;
500 uint32_t len;
501};
502static_assert(sizeof(struct hdr_tok_partial) == 5);
503
504struct __attribute__((__packed__)) trl_tok_partial {
505 u_char type;
506 uint16_t magic;
507 uint32_t len;
508};
509static_assert(sizeof(struct trl_tok_partial) == 7);
510
511#endif /* defined(KERNEL) || defined(_KERNEL) */
512
513#endif /* ! _SECURITY_AUDIT_PRIVATE_H_ */
514