1/*-
2 * SPDX-License-Identifier: BSD-3-Clause
3 *
4 * Copyright (c) 1999-2005 Apple Inc.
5 * Copyright (c) 2016-2018 Robert N. M. Watson
6 * All rights reserved.
7 *
8 * This software was developed by BAE Systems, the University of Cambridge
9 * Computer Laboratory, and Memorial University under DARPA/AFRL contract
10 * FA8650-15-C-7558 ("CADETS"), as part of the DARPA Transparent Computing
11 * (TC) research program.
12 *
13 * Redistribution and use in source and binary forms, with or without
14 * modification, are permitted provided that the following conditions
15 * are met:
16 * 1. Redistributions of source code must retain the above copyright
17 * notice, this list of conditions and the following disclaimer.
18 * 2. Redistributions in binary form must reproduce the above copyright
19 * notice, this list of conditions and the following disclaimer in the
20 * documentation and/or other materials provided with the distribution.
21 * 3. Neither the name of Apple Inc. ("Apple") nor the names of
22 * its contributors may be used to endorse or promote products derived
23 * from this software without specific prior written permission.
24 *
25 * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND
26 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
27 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
28 * ARE DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR
29 * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
30 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
31 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
32 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
33 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
34 * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
35 * POSSIBILITY OF SUCH DAMAGE.
36 */
37
38/*
39 * This header includes function prototypes and type definitions that are
40 * necessary for the kernel as a whole to interact with the audit subsystem.
41 */
42
43#ifndef _SECURITY_AUDIT_KERNEL_H_
44#define _SECURITY_AUDIT_KERNEL_H_
45
46#ifndef _KERNEL
47#error "no user-serviceable parts inside"
48#endif
49
50#include <bsm/audit.h>
51
52#include <sys/file.h>
53#include <sys/sysctl.h>
54
55/*
56 * Audit subsystem condition flags. The audit_trail_enabled flag is set and
57 * removed automatically as a result of configuring log files, and can be
58 * observed but should not be directly manipulated. The audit suspension
59 * flag permits audit to be temporarily disabled without reconfiguring the
60 * audit target.
61 *
62 * As DTrace can also request system-call auditing, a further
63 * audit_syscalls_enabled flag tracks whether newly entering system calls
64 * should be considered for auditing or not.
65 *
66 * XXXRW: Move trail flags to audit_private.h, as they no longer need to be
67 * visible outside the audit code...?
68 */
69extern u_int audit_dtrace_enabled;
70extern int audit_trail_enabled;
71extern int audit_trail_suspended;
72extern bool audit_syscalls_enabled;
73
74void audit_syscall_enter(unsigned short code, struct thread *td);
75void audit_syscall_exit(int error, struct thread *td);
76
77/*
78 * The remaining kernel functions are conditionally compiled in as they are
79 * wrapped by a macro, and the macro should be the only place in the source
80 * tree where these functions are referenced.
81 */
82#ifdef AUDIT
83struct ipc_perm;
84struct sockaddr;
85union auditon_udata;
86void audit_arg_addr(void * addr);
87void audit_arg_exit(int status, int retval);
88void audit_arg_len(int len);
89void audit_arg_atfd1(int atfd);
90void audit_arg_atfd2(int atfd);
91void audit_arg_fd(int fd);
92void audit_arg_fflags(int fflags);
93void audit_arg_gid(gid_t gid);
94void audit_arg_uid(uid_t uid);
95void audit_arg_egid(gid_t egid);
96void audit_arg_euid(uid_t euid);
97void audit_arg_rgid(gid_t rgid);
98void audit_arg_ruid(uid_t ruid);
99void audit_arg_sgid(gid_t sgid);
100void audit_arg_suid(uid_t suid);
101void audit_arg_groupset(gid_t *gidset, int gidset_size);
102void audit_arg_login(char *login);
103void audit_arg_ctlname(int *name, int namelen);
104void audit_arg_mask(int mask);
105void audit_arg_mode(mode_t mode);
106void audit_arg_dev(int dev);
107void audit_arg_value(long value);
108void audit_arg_owner(uid_t uid, gid_t gid);
109void audit_arg_pid(pid_t pid);
110void audit_arg_process(struct proc *p);
111void audit_arg_signum(u_int signum);
112void audit_arg_socket(int sodomain, int sotype, int soprotocol);
113void audit_arg_sockaddr(struct thread *td, int dirfd, struct sockaddr *sa);
114void audit_arg_auid(uid_t auid);
115void audit_arg_auditinfo(struct auditinfo *au_info);
116void audit_arg_auditinfo_addr(struct auditinfo_addr *au_info);
117void audit_arg_upath1(struct thread *td, int dirfd, char *upath);
118void audit_arg_upath1_canon(char *upath);
119void audit_arg_upath2(struct thread *td, int dirfd, char *upath);
120void audit_arg_upath2_canon(char *upath);
121void audit_arg_upath1_vp(struct thread *td, struct vnode *rdir,
122 struct vnode *cdir, char *upath);
123void audit_arg_upath2_vp(struct thread *td, struct vnode *rdir,
124 struct vnode *cdir, char *upath);
125void audit_arg_vnode1(struct vnode *vp);
126void audit_arg_vnode2(struct vnode *vp);
127void audit_arg_text(const char *text);
128void audit_arg_cmd(int cmd);
129void audit_arg_svipc_cmd(int cmd);
130void audit_arg_svipc_perm(struct ipc_perm *perm);
131void audit_arg_svipc_id(int id);
132void audit_arg_svipc_addr(void *addr);
133void audit_arg_svipc_which(int which);
134void audit_arg_posix_ipc_perm(uid_t uid, gid_t gid, mode_t mode);
135void audit_arg_auditon(union auditon_udata *udata);
136void audit_arg_file(struct proc *p, struct file *fp);
137void audit_arg_argv(char *argv, int argc, int length);
138void audit_arg_envv(char *envv, int envc, int length);
139void audit_arg_rights(cap_rights_t *rightsp);
140void audit_arg_fcntl_rights(uint32_t fcntlrights);
141void audit_sysclose(struct thread *td, int fd, struct file *fp);
142void audit_cred_copy(struct ucred *src, struct ucred *dest);
143void audit_cred_destroy(struct ucred *cred);
144void audit_cred_init(struct ucred *cred);
145void audit_cred_kproc0(struct ucred *cred);
146void audit_cred_proc1(struct ucred *cred);
147void audit_proc_coredump(struct thread *td, char *path, int errcode);
148void audit_thread_alloc(struct thread *td);
149void audit_thread_free(struct thread *td);
150
151/*
152 * Define macros to wrap the audit_arg_* calls by checking the global
153 * audit_syscalls_enabled flag before performing the actual call.
154 */
155#define AUDITING_TD(td) (__predict_false((td)->td_pflags & TDP_AUDITREC))
156
157#define AUDIT_ARG_ADDR(addr) do { \
158 if (AUDITING_TD(curthread)) \
159 audit_arg_addr((addr)); \
160} while (0)
161
162#define AUDIT_ARG_ARGV(argv, argc, length) do { \
163 if (AUDITING_TD(curthread)) \
164 audit_arg_argv((argv), (argc), (length)); \
165} while (0)
166
167#define AUDIT_ARG_ATFD1(atfd) do { \
168 if (AUDITING_TD(curthread)) \
169 audit_arg_atfd1((atfd)); \
170} while (0)
171
172#define AUDIT_ARG_ATFD2(atfd) do { \
173 if (AUDITING_TD(curthread)) \
174 audit_arg_atfd2((atfd)); \
175} while (0)
176
177#define AUDIT_ARG_AUDITON(udata) do { \
178 if (AUDITING_TD(curthread)) \
179 audit_arg_auditon((udata)); \
180} while (0)
181
182#define AUDIT_ARG_CMD(cmd) do { \
183 if (AUDITING_TD(curthread)) \
184 audit_arg_cmd((cmd)); \
185} while (0)
186
187#define AUDIT_ARG_DEV(dev) do { \
188 if (AUDITING_TD(curthread)) \
189 audit_arg_dev((dev)); \
190} while (0)
191
192#define AUDIT_ARG_EGID(egid) do { \
193 if (AUDITING_TD(curthread)) \
194 audit_arg_egid((egid)); \
195} while (0)
196
197#define AUDIT_ARG_ENVV(envv, envc, length) do { \
198 if (AUDITING_TD(curthread)) \
199 audit_arg_envv((envv), (envc), (length)); \
200} while (0)
201
202#define AUDIT_ARG_EXIT(status, retval) do { \
203 if (AUDITING_TD(curthread)) \
204 audit_arg_exit((status), (retval)); \
205} while (0)
206
207#define AUDIT_ARG_EUID(euid) do { \
208 if (AUDITING_TD(curthread)) \
209 audit_arg_euid((euid)); \
210} while (0)
211
212#define AUDIT_ARG_FD(fd) do { \
213 if (AUDITING_TD(curthread)) \
214 audit_arg_fd((fd)); \
215} while (0)
216
217#define AUDIT_ARG_FILE(p, fp) do { \
218 if (AUDITING_TD(curthread)) \
219 audit_arg_file((p), (fp)); \
220} while (0)
221
222#define AUDIT_ARG_FFLAGS(fflags) do { \
223 if (AUDITING_TD(curthread)) \
224 audit_arg_fflags((fflags)); \
225} while (0)
226
227#define AUDIT_ARG_GID(gid) do { \
228 if (AUDITING_TD(curthread)) \
229 audit_arg_gid((gid)); \
230} while (0)
231
232#define AUDIT_ARG_GROUPSET(gidset, gidset_size) do { \
233 if (AUDITING_TD(curthread)) \
234 audit_arg_groupset((gidset), (gidset_size)); \
235} while (0)
236
237#define AUDIT_ARG_LOGIN(login) do { \
238 if (AUDITING_TD(curthread)) \
239 audit_arg_login((login)); \
240} while (0)
241
242#define AUDIT_ARG_MODE(mode) do { \
243 if (AUDITING_TD(curthread)) \
244 audit_arg_mode((mode)); \
245} while (0)
246
247#define AUDIT_ARG_OWNER(uid, gid) do { \
248 if (AUDITING_TD(curthread)) \
249 audit_arg_owner((uid), (gid)); \
250} while (0)
251
252#define AUDIT_ARG_PID(pid) do { \
253 if (AUDITING_TD(curthread)) \
254 audit_arg_pid((pid)); \
255} while (0)
256
257#define AUDIT_ARG_POSIX_IPC_PERM(uid, gid, mode) do { \
258 if (AUDITING_TD(curthread)) \
259 audit_arg_posix_ipc_perm((uid), (gid), (mod)); \
260} while (0)
261
262#define AUDIT_ARG_PROCESS(p) do { \
263 if (AUDITING_TD(curthread)) \
264 audit_arg_process((p)); \
265} while (0)
266
267#define AUDIT_ARG_RGID(rgid) do { \
268 if (AUDITING_TD(curthread)) \
269 audit_arg_rgid((rgid)); \
270} while (0)
271
272#define AUDIT_ARG_RIGHTS(rights) do { \
273 if (AUDITING_TD(curthread)) \
274 audit_arg_rights((rights)); \
275} while (0)
276
277#define AUDIT_ARG_FCNTL_RIGHTS(fcntlrights) do { \
278 if (AUDITING_TD(curthread)) \
279 audit_arg_fcntl_rights((fcntlrights)); \
280} while (0)
281
282#define AUDIT_ARG_RUID(ruid) do { \
283 if (AUDITING_TD(curthread)) \
284 audit_arg_ruid((ruid)); \
285} while (0)
286
287#define AUDIT_ARG_SIGNUM(signum) do { \
288 if (AUDITING_TD(curthread)) \
289 audit_arg_signum((signum)); \
290} while (0)
291
292#define AUDIT_ARG_SGID(sgid) do { \
293 if (AUDITING_TD(curthread)) \
294 audit_arg_sgid((sgid)); \
295} while (0)
296
297#define AUDIT_ARG_SOCKET(sodomain, sotype, soprotocol) do { \
298 if (AUDITING_TD(curthread)) \
299 audit_arg_socket((sodomain), (sotype), (soprotocol)); \
300} while (0)
301
302#define AUDIT_ARG_SOCKADDR(td, dirfd, sa) do { \
303 if (AUDITING_TD(curthread)) \
304 audit_arg_sockaddr((td), (dirfd), (sa)); \
305} while (0)
306
307#define AUDIT_ARG_SUID(suid) do { \
308 if (AUDITING_TD(curthread)) \
309 audit_arg_suid((suid)); \
310} while (0)
311
312#define AUDIT_ARG_SVIPC_CMD(cmd) do { \
313 if (AUDITING_TD(curthread)) \
314 audit_arg_svipc_cmd((cmd)); \
315} while (0)
316
317#define AUDIT_ARG_SVIPC_PERM(perm) do { \
318 if (AUDITING_TD(curthread)) \
319 audit_arg_svipc_perm((perm)); \
320} while (0)
321
322#define AUDIT_ARG_SVIPC_ID(id) do { \
323 if (AUDITING_TD(curthread)) \
324 audit_arg_svipc_id((id)); \
325} while (0)
326
327#define AUDIT_ARG_SVIPC_ADDR(addr) do { \
328 if (AUDITING_TD(curthread)) \
329 audit_arg_svipc_addr((addr)); \
330} while (0)
331
332#define AUDIT_ARG_SVIPC_WHICH(which) do { \
333 if (AUDITING_TD(curthread)) \
334 audit_arg_svipc_which((which)); \
335} while (0)
336
337#define AUDIT_ARG_TEXT(text) do { \
338 if (AUDITING_TD(curthread)) \
339 audit_arg_text((text)); \
340} while (0)
341
342#define AUDIT_ARG_UID(uid) do { \
343 if (AUDITING_TD(curthread)) \
344 audit_arg_uid((uid)); \
345} while (0)
346
347#define AUDIT_ARG_UPATH1(td, dirfd, upath) do { \
348 if (AUDITING_TD(curthread)) \
349 audit_arg_upath1((td), (dirfd), (upath)); \
350} while (0)
351
352#define AUDIT_ARG_UPATH1_CANON(upath) do { \
353 if (AUDITING_TD(curthread)) \
354 audit_arg_upath1_canon((upath)); \
355} while (0)
356
357#define AUDIT_ARG_UPATH2(td, dirfd, upath) do { \
358 if (AUDITING_TD(curthread)) \
359 audit_arg_upath2((td), (dirfd), (upath)); \
360} while (0)
361
362#define AUDIT_ARG_UPATH2_CANON(upath) do { \
363 if (AUDITING_TD(curthread)) \
364 audit_arg_upath2_canon((upath)); \
365} while (0)
366
367#define AUDIT_ARG_UPATH1_VP(td, rdir, cdir, upath) do { \
368 if (AUDITING_TD(curthread)) \
369 audit_arg_upath1_vp((td), (rdir), (cdir), (upath)); \
370} while (0)
371
372#define AUDIT_ARG_UPATH2_VP(td, rdir, cdir, upath) do { \
373 if (AUDITING_TD(curthread)) \
374 audit_arg_upath2_vp((td), (rdir), (cdir), (upath)); \
375} while (0)
376
377#define AUDIT_ARG_VALUE(value) do { \
378 if (AUDITING_TD(curthread)) \
379 audit_arg_value((value)); \
380} while (0)
381
382#define AUDIT_ARG_VNODE1(vp) do { \
383 if (AUDITING_TD(curthread)) \
384 audit_arg_vnode1((vp)); \
385} while (0)
386
387#define AUDIT_ARG_VNODE2(vp) do { \
388 if (AUDITING_TD(curthread)) \
389 audit_arg_vnode2((vp)); \
390} while (0)
391
392#define AUDIT_SYSCALL_ENABLED() audit_syscalls_enabled
393
394#define AUDIT_SYSCALL_ENTER(code, td) ({ \
395 bool _audit_entered = false; \
396 if (audit_syscalls_enabled) { \
397 audit_syscall_enter(code, td); \
398 _audit_entered = true; \
399 } \
400 _audit_entered; \
401})
402
403/*
404 * Wrap the audit_syscall_exit() function so that it is called only when
405 * we have a audit record on the thread. Audit records can persist after
406 * auditing is disabled, so we don't just check audit_syscalls_enabled here.
407 */
408#define AUDIT_SYSCALL_EXIT(error, td) do { \
409 if (AUDITING_TD(td)) \
410 audit_syscall_exit(error, td); \
411} while (0)
412
413/*
414 * A Macro to wrap the audit_sysclose() function.
415 */
416#define AUDIT_SYSCLOSE(td, fd) do { \
417 if (AUDITING_TD(td)) \
418 audit_sysclose(td, fd); \
419} while (0)
420
421#else /* !AUDIT */
422
423#define AUDIT_ARG_ADDR(addr)
424#define AUDIT_ARG_ARGV(argv, argc, length)
425#define AUDIT_ARG_ATFD1(atfd)
426#define AUDIT_ARG_ATFD2(atfd)
427#define AUDIT_ARG_AUDITON(udata)
428#define AUDIT_ARG_CMD(cmd)
429#define AUDIT_ARG_DEV(dev)
430#define AUDIT_ARG_EGID(egid)
431#define AUDIT_ARG_ENVV(envv, envc, length)
432#define AUDIT_ARG_EXIT(status, retval)
433#define AUDIT_ARG_EUID(euid)
434#define AUDIT_ARG_FD(fd)
435#define AUDIT_ARG_FILE(p, fp)
436#define AUDIT_ARG_FFLAGS(fflags)
437#define AUDIT_ARG_GID(gid)
438#define AUDIT_ARG_GROUPSET(gidset, gidset_size)
439#define AUDIT_ARG_LOGIN(login)
440#define AUDIT_ARG_MODE(mode)
441#define AUDIT_ARG_OWNER(uid, gid)
442#define AUDIT_ARG_PID(pid)
443#define AUDIT_ARG_POSIX_IPC_PERM(uid, gid, mode)
444#define AUDIT_ARG_PROCESS(p)
445#define AUDIT_ARG_RGID(rgid)
446#define AUDIT_ARG_RIGHTS(rights)
447#define AUDIT_ARG_FCNTL_RIGHTS(fcntlrights)
448#define AUDIT_ARG_RUID(ruid)
449#define AUDIT_ARG_SIGNUM(signum)
450#define AUDIT_ARG_SGID(sgid)
451#define AUDIT_ARG_SOCKET(sodomain, sotype, soprotocol)
452#define AUDIT_ARG_SOCKADDR(td, dirfd, sa)
453#define AUDIT_ARG_SUID(suid)
454#define AUDIT_ARG_SVIPC_CMD(cmd)
455#define AUDIT_ARG_SVIPC_PERM(perm)
456#define AUDIT_ARG_SVIPC_ID(id)
457#define AUDIT_ARG_SVIPC_ADDR(addr)
458#define AUDIT_ARG_SVIPC_WHICH(which)
459#define AUDIT_ARG_TEXT(text)
460#define AUDIT_ARG_UID(uid)
461#define AUDIT_ARG_UPATH1(td, dirfd, upath)
462#define AUDIT_ARG_UPATH1_CANON(upath)
463#define AUDIT_ARG_UPATH2(td, dirfd, upath)
464#define AUDIT_ARG_UPATH2_CANON(upath)
465#define AUDIT_ARG_UPATH1_VP(td, rdir, cdir, upath)
466#define AUDIT_ARG_UPATH2_VP(td, rdir, cdir, upath)
467#define AUDIT_ARG_VALUE(value)
468#define AUDIT_ARG_VNODE1(vp)
469#define AUDIT_ARG_VNODE2(vp)
470
471#define AUDITING_TD(td) 0
472
473#define AUDIT_SYSCALL_ENABLED() 0
474#define AUDIT_SYSCALL_ENTER(code, td) 0
475#define AUDIT_SYSCALL_EXIT(error, td)
476
477#define AUDIT_SYSCLOSE(p, fd)
478
479#endif /* AUDIT */
480
481#endif /* !_SECURITY_AUDIT_KERNEL_H_ */