sys/security/audit/audit_syscalls.c

   1 /*-
   2  * SPDX-License-Identifier: BSD-3-Clause
   3  *
   4  * Copyright (c) 1999-2009 Apple Inc.
   5  * Copyright (c) 2016, 2018 Robert N. M. Watson
   6  * All rights reserved.
   7  *
   8  * Portions of this software were developed by BAE Systems, the University of
   9  * Cambridge Computer Laboratory, and Memorial University under DARPA/AFRL
  10  * contract FA8650-15-C-7558 ("CADETS"), as part of the DARPA Transparent
  11  * Computing (TC) research program.
  12  *
  13  * Redistribution and use in source and binary forms, with or without
  14  * modification, are permitted provided that the following conditions
  15  * are met:
  16  * 1.  Redistributions of source code must retain the above copyright
  17  *     notice, this list of conditions and the following disclaimer.
  18  * 2.  Redistributions in binary form must reproduce the above copyright
  19  *     notice, this list of conditions and the following disclaimer in the
  20  *     documentation and/or other materials provided with the distribution.
  21  * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
  22  *     its contributors may be used to endorse or promote products derived
  23  *     from this software without specific prior written permission.
  24  *
  25  * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND
  26  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  27  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  28  * ARE DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR
  29  * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  30  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  31  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  32  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
  33  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
  34  * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  35  * POSSIBILITY OF SUCH DAMAGE.
  36  */
  37
  38 #include <sys/cdefs.h>
  39 __FBSDID("$FreeBSD$");
  40
  41 #include <sys/param.h>
  42 #include <sys/mount.h>
  43 #include <sys/namei.h>
  44 #include <sys/priv.h>
  45 #include <sys/proc.h>
  46 #include <sys/sysproto.h>
  47 #include <sys/systm.h>
  48 #include <sys/vnode.h>
  49 #include <sys/jail.h>
  50
  51 #include <bsm/audit.h>
  52 #include <bsm/audit_kevents.h>
  53
  54 #include <security/audit/audit.h>
  55 #include <security/audit/audit_private.h>
  56 #include <security/mac/mac_framework.h>
  57
  58 #ifdef AUDIT
  59
  60 /*
  61  * System call to allow a user space application to submit a BSM audit record
  62  * to the kernel for inclusion in the audit log.  This function does little
  63  * verification on the audit record that is submitted.
  64  *
  65  * XXXAUDIT: Audit preselection for user records does not currently work,
  66  * since we pre-select only based on the AUE_audit event type, not the event
  67  * type submitted as part of the user audit data.
  68  */
  69 /* ARGSUSED */
  70 int
  71 sys_audit(struct thread *td, struct audit_args *uap)
  72 {
  73         int error;
  74         void * rec;
  75         struct kaudit_record *ar;
  76
  77         if (jailed(td->td_ucred))
  78                 return (ENOSYS);
  79         error = priv_check(td, PRIV_AUDIT_SUBMIT);
  80         if (error)
  81                 return (error);
  82
  83         if ((uap->length <= 0) || (uap->length > audit_qctrl.aq_bufsz))
  84                 return (EINVAL);
  85
  86         ar = currecord();
  87
  88         /*
  89          * If there's no current audit record (audit() itself not audited)
  90          * commit the user audit record.
  91          */
  92         if (ar == NULL) {
  93                 /*
  94                  * This is not very efficient; we're required to allocate a
  95                  * complete kernel audit record just so the user record can
  96                  * tag along.
  97                  *
  98                  * XXXAUDIT: Maybe AUE_AUDIT in the system call context and
  99                  * special pre-select handling?
 100                  */
 101                 td->td_ar = audit_new(AUE_NULL, td);
 102                 if (td->td_ar == NULL)
 103                         return (ENOTSUP);
 104                 td->td_pflags |= TDP_AUDITREC;
 105                 ar = td->td_ar;
 106         }
 107
 108         if (uap->length > MAX_AUDIT_RECORD_SIZE)
 109                 return (EINVAL);
 110
 111         rec = malloc(uap->length, M_AUDITDATA, M_WAITOK);
 112
 113         error = copyin(uap->record, rec, uap->length);
 114         if (error)
 115                 goto free_out;
 116
 117         /* Verify the record. */
 118         if (bsm_rec_verify(rec) == 0) {
 119                 error = EINVAL;
 120                 goto free_out;
 121         }
 122
 123 #ifdef MAC
 124         error = mac_system_check_audit(td->td_ucred, rec, uap->length);
 125         if (error)
 126                 goto free_out;
 127 #endif
 128
 129         /*
 130          * Attach the user audit record to the kernel audit record.  Because
 131          * this system call is an auditable event, we will write the user
 132          * record along with the record for this audit event.
 133          *
 134          * XXXAUDIT: KASSERT appropriate starting values of k_udata, k_ulen,
 135          * k_ar_commit & AR_COMMIT_USER?
 136          */
 137         ar->k_udata = rec;
 138         ar->k_ulen  = uap->length;
 139         ar->k_ar_commit |= AR_COMMIT_USER;
 140
 141         /*
 142          * Currently we assume that all preselection has been performed in
 143          * userspace.  We unconditionally set these masks so that the records
 144          * get committed both to the trail and pipe.  In the future we will
 145          * want to setup kernel based preselection.
 146          */
 147         ar->k_ar_commit |= (AR_PRESELECT_USER_TRAIL | AR_PRESELECT_USER_PIPE);
 148         return (0);
 149
 150 free_out:
 151         /*
 152          * audit_syscall_exit() will free the audit record on the thread even
 153          * if we allocated it above.
 154          */
 155         free(rec, M_AUDITDATA);
 156         return (error);
 157 }
 158
 159 /*
 160  *  System call to manipulate auditing.
 161  */
 162 /* ARGSUSED */
 163 int
 164 sys_auditon(struct thread *td, struct auditon_args *uap)
 165 {
 166         struct ucred *cred, *newcred, *oldcred;
 167         int error;
 168         union auditon_udata udata;
 169         struct proc *tp;
 170
 171         if (jailed(td->td_ucred))
 172                 return (ENOSYS);
 173         AUDIT_ARG_CMD(uap->cmd);
 174
 175 #ifdef MAC
 176         error = mac_system_check_auditon(td->td_ucred, uap->cmd);
 177         if (error)
 178                 return (error);
 179 #endif
 180
 181         error = priv_check(td, PRIV_AUDIT_CONTROL);
 182         if (error)
 183                 return (error);
 184
 185         if ((uap->length <= 0) || (uap->length > sizeof(union auditon_udata)))
 186                 return (EINVAL);
 187
 188         memset((void *)&udata, 0, sizeof(udata));
 189
 190         /*
 191          * Some of the GET commands use the arguments too.
 192          */
 193         switch (uap->cmd) {
 194         case A_SETPOLICY:
 195         case A_OLDSETPOLICY:
 196         case A_SETKMASK:
 197         case A_SETQCTRL:
 198         case A_OLDSETQCTRL:
 199         case A_SETSTAT:
 200         case A_SETUMASK:
 201         case A_SETSMASK:
 202         case A_SETCOND:
 203         case A_OLDSETCOND:
 204         case A_SETCLASS:
 205         case A_SETEVENT:
 206         case A_SETPMASK:
 207         case A_SETFSIZE:
 208         case A_SETKAUDIT:
 209         case A_GETCLASS:
 210         case A_GETEVENT:
 211         case A_GETPINFO:
 212         case A_GETPINFO_ADDR:
 213         case A_SENDTRIGGER:
 214                 error = copyin(uap->data, (void *)&udata, uap->length);
 215                 if (error)
 216                         return (error);
 217                 AUDIT_ARG_AUDITON(&udata);
 218                 break;
 219         }
 220
 221         /*
 222          * XXXAUDIT: Locking?
 223          */
 224         switch (uap->cmd) {
 225         case A_OLDGETPOLICY:
 226         case A_GETPOLICY:
 227                 if (uap->length == sizeof(udata.au_policy64)) {
 228                         if (!audit_fail_stop)
 229                                 udata.au_policy64 |= AUDIT_CNT;
 230                         if (audit_panic_on_write_fail)
 231                                 udata.au_policy64 |= AUDIT_AHLT;
 232                         if (audit_argv)
 233                                 udata.au_policy64 |= AUDIT_ARGV;
 234                         if (audit_arge)
 235                                 udata.au_policy64 |= AUDIT_ARGE;
 236                         break;
 237                 }
 238                 if (uap->length != sizeof(udata.au_policy))
 239                         return (EINVAL);
 240                 if (!audit_fail_stop)
 241                         udata.au_policy |= AUDIT_CNT;
 242                 if (audit_panic_on_write_fail)
 243                         udata.au_policy |= AUDIT_AHLT;
 244                 if (audit_argv)
 245                         udata.au_policy |= AUDIT_ARGV;
 246                 if (audit_arge)
 247                         udata.au_policy |= AUDIT_ARGE;
 248                 break;
 249
 250         case A_OLDSETPOLICY:
 251         case A_SETPOLICY:
 252                 if (uap->length == sizeof(udata.au_policy64)) {
 253                         if (udata.au_policy & ~(AUDIT_CNT|AUDIT_AHLT|
 254                             AUDIT_ARGV|AUDIT_ARGE))
 255                                 return (EINVAL);
 256                         audit_fail_stop = ((udata.au_policy64 & AUDIT_CNT) ==
 257                             0);
 258                         audit_panic_on_write_fail = (udata.au_policy64 &
 259                             AUDIT_AHLT);
 260                         audit_argv = (udata.au_policy64 & AUDIT_ARGV);
 261                         audit_arge = (udata.au_policy64 & AUDIT_ARGE);
 262                         break;
 263                 }
 264                 if (uap->length != sizeof(udata.au_policy))
 265                         return (EINVAL);
 266                 if (udata.au_policy & ~(AUDIT_CNT|AUDIT_AHLT|AUDIT_ARGV|
 267                     AUDIT_ARGE))
 268                         return (EINVAL);
 269                 /*
 270                  * XXX - Need to wake up waiters if the policy relaxes?
 271                  */
 272                 audit_fail_stop = ((udata.au_policy & AUDIT_CNT) == 0);
 273                 audit_panic_on_write_fail = (udata.au_policy & AUDIT_AHLT);
 274                 audit_argv = (udata.au_policy & AUDIT_ARGV);
 275                 audit_arge = (udata.au_policy & AUDIT_ARGE);
 276                 break;
 277
 278         case A_GETKMASK:
 279                 if (uap->length != sizeof(udata.au_mask))
 280                         return (EINVAL);
 281                 udata.au_mask = audit_nae_mask;
 282                 break;
 283
 284         case A_SETKMASK:
 285                 if (uap->length != sizeof(udata.au_mask))
 286                         return (EINVAL);
 287                 audit_nae_mask = udata.au_mask;
 288                 break;
 289
 290         case A_OLDGETQCTRL:
 291         case A_GETQCTRL:
 292                 if (uap->length == sizeof(udata.au_qctrl64)) {
 293                         udata.au_qctrl64.aq64_hiwater =
 294                             (u_int64_t)audit_qctrl.aq_hiwater;
 295                         udata.au_qctrl64.aq64_lowater =
 296                             (u_int64_t)audit_qctrl.aq_lowater;
 297                         udata.au_qctrl64.aq64_bufsz =
 298                             (u_int64_t)audit_qctrl.aq_bufsz;
 299                         udata.au_qctrl64.aq64_minfree =
 300                             (u_int64_t)audit_qctrl.aq_minfree;
 301                         break;
 302                 }
 303                 if (uap->length != sizeof(udata.au_qctrl))
 304                         return (EINVAL);
 305                 udata.au_qctrl = audit_qctrl;
 306                 break;
 307
 308         case A_OLDSETQCTRL:
 309         case A_SETQCTRL:
 310                 if (uap->length == sizeof(udata.au_qctrl64)) {
 311                         /* NB: aq64_minfree is unsigned unlike aq_minfree. */
 312                         if ((udata.au_qctrl64.aq64_hiwater > AQ_MAXHIGH) ||
 313                             (udata.au_qctrl64.aq64_lowater >=
 314                             udata.au_qctrl.aq_hiwater) ||
 315                             (udata.au_qctrl64.aq64_bufsz > AQ_MAXBUFSZ) ||
 316                             (udata.au_qctrl64.aq64_minfree > 100))
 317                                 return (EINVAL);
 318                         audit_qctrl.aq_hiwater =
 319                             (int)udata.au_qctrl64.aq64_hiwater;
 320                         audit_qctrl.aq_lowater =
 321                             (int)udata.au_qctrl64.aq64_lowater;
 322                         audit_qctrl.aq_bufsz =
 323                             (int)udata.au_qctrl64.aq64_bufsz;
 324                         audit_qctrl.aq_minfree =
 325                             (int)udata.au_qctrl64.aq64_minfree;
 326                         audit_qctrl.aq_delay = -1;      /* Not used. */
 327                         break;
 328                 }
 329                 if (uap->length != sizeof(udata.au_qctrl))
 330                         return (EINVAL);
 331                 if ((udata.au_qctrl.aq_hiwater > AQ_MAXHIGH) ||
 332                     (udata.au_qctrl.aq_lowater >= udata.au_qctrl.aq_hiwater) ||
 333                     (udata.au_qctrl.aq_bufsz > AQ_MAXBUFSZ) ||
 334                     (udata.au_qctrl.aq_minfree < 0) ||
 335                     (udata.au_qctrl.aq_minfree > 100))
 336                         return (EINVAL);
 337
 338                 audit_qctrl = udata.au_qctrl;
 339                 /* XXX The queue delay value isn't used with the kernel. */
 340                 audit_qctrl.aq_delay = -1;
 341                 break;
 342
 343         case A_GETCWD:
 344                 return (ENOSYS);
 345                 break;
 346
 347         case A_GETCAR:
 348                 return (ENOSYS);
 349                 break;
 350
 351         case A_GETSTAT:
 352                 return (ENOSYS);
 353                 break;
 354
 355         case A_SETSTAT:
 356                 return (ENOSYS);
 357                 break;
 358
 359         case A_SETUMASK:
 360                 return (ENOSYS);
 361                 break;
 362
 363         case A_SETSMASK:
 364                 return (ENOSYS);
 365                 break;
 366
 367         case A_OLDGETCOND:
 368         case A_GETCOND:
 369                 if (uap->length == sizeof(udata.au_cond64)) {
 370                         if (audit_trail_enabled && !audit_trail_suspended)
 371                                 udata.au_cond64 = AUC_AUDITING;
 372                         else
 373                                 udata.au_cond64 = AUC_NOAUDIT;
 374                         break;
 375                 }
 376                 if (uap->length != sizeof(udata.au_cond))
 377                         return (EINVAL);
 378                 if (audit_trail_enabled && !audit_trail_suspended)
 379                         udata.au_cond = AUC_AUDITING;
 380                 else
 381                         udata.au_cond = AUC_NOAUDIT;
 382                 break;
 383
 384         case A_OLDSETCOND:
 385         case A_SETCOND:
 386                 if (uap->length == sizeof(udata.au_cond64)) {
 387                         if (udata.au_cond64 == AUC_NOAUDIT)
 388                                 audit_trail_suspended = 1;
 389                         if (udata.au_cond64 == AUC_AUDITING)
 390                                 audit_trail_suspended = 0;
 391                         if (udata.au_cond64 == AUC_DISABLED) {
 392                                 audit_trail_suspended = 1;
 393                                 audit_shutdown(NULL, 0);
 394                         }
 395                         audit_syscalls_enabled_update();
 396                         break;
 397                 }
 398                 if (uap->length != sizeof(udata.au_cond))
 399                         return (EINVAL);
 400                 if (udata.au_cond == AUC_NOAUDIT)
 401                         audit_trail_suspended = 1;
 402                 if (udata.au_cond == AUC_AUDITING)
 403                         audit_trail_suspended = 0;
 404                 if (udata.au_cond == AUC_DISABLED) {
 405                         audit_trail_suspended = 1;
 406                         audit_shutdown(NULL, 0);
 407                 }
 408                 audit_syscalls_enabled_update();
 409                 break;
 410
 411         case A_GETCLASS:
 412                 if (uap->length != sizeof(udata.au_evclass))
 413                         return (EINVAL);
 414                 udata.au_evclass.ec_class = au_event_class(
 415                     udata.au_evclass.ec_number);
 416                 break;
 417
 418         case A_GETEVENT:
 419                 if (uap->length != sizeof(udata.au_evname))
 420                         return (EINVAL);
 421                 error = au_event_name(udata.au_evname.en_number,
 422                     udata.au_evname.en_name);
 423                 if (error != 0)
 424                         return (error);
 425                 break;
 426
 427         case A_SETCLASS:
 428                 if (uap->length != sizeof(udata.au_evclass))
 429                         return (EINVAL);
 430                 au_evclassmap_insert(udata.au_evclass.ec_number,
 431                     udata.au_evclass.ec_class);
 432                 break;
 433
 434         case A_SETEVENT:
 435                 if (uap->length != sizeof(udata.au_evname))
 436                         return (EINVAL);
 437
 438                 /* Ensure nul termination from userspace. */
 439                 udata.au_evname.en_name[sizeof(udata.au_evname.en_name) - 1]
 440                     = 0;
 441                 au_evnamemap_insert(udata.au_evname.en_number,
 442                     udata.au_evname.en_name);
 443                 break;
 444
 445         case A_GETPINFO:
 446                 if (uap->length != sizeof(udata.au_aupinfo))
 447                         return (EINVAL);
 448                 if (udata.au_aupinfo.ap_pid < 1)
 449                         return (ESRCH);
 450                 if ((tp = pfind(udata.au_aupinfo.ap_pid)) == NULL)
 451                         return (ESRCH);
 452                 if ((error = p_cansee(td, tp)) != 0) {
 453                         PROC_UNLOCK(tp);
 454                         return (error);
 455                 }
 456                 cred = tp->p_ucred;
 457                 if (cred->cr_audit.ai_termid.at_type == AU_IPv6) {
 458                         PROC_UNLOCK(tp);
 459                         return (EINVAL);
 460                 }
 461                 udata.au_aupinfo.ap_auid = cred->cr_audit.ai_auid;
 462                 udata.au_aupinfo.ap_mask.am_success =
 463                     cred->cr_audit.ai_mask.am_success;
 464                 udata.au_aupinfo.ap_mask.am_failure =
 465                     cred->cr_audit.ai_mask.am_failure;
 466                 udata.au_aupinfo.ap_termid.machine =
 467                     cred->cr_audit.ai_termid.at_addr[0];
 468                 udata.au_aupinfo.ap_termid.port =
 469                     (dev_t)cred->cr_audit.ai_termid.at_port;
 470                 udata.au_aupinfo.ap_asid = cred->cr_audit.ai_asid;
 471                 PROC_UNLOCK(tp);
 472                 break;
 473
 474         case A_SETPMASK:
 475                 if (uap->length != sizeof(udata.au_aupinfo))
 476                         return (EINVAL);
 477                 if (udata.au_aupinfo.ap_pid < 1)
 478                         return (ESRCH);
 479                 newcred = crget();
 480                 if ((tp = pfind(udata.au_aupinfo.ap_pid)) == NULL) {
 481                         crfree(newcred);
 482                         return (ESRCH);
 483                 }
 484                 if ((error = p_cansee(td, tp)) != 0) {
 485                         PROC_UNLOCK(tp);
 486                         crfree(newcred);
 487                         return (error);
 488                 }
 489                 oldcred = tp->p_ucred;
 490                 crcopy(newcred, oldcred);
 491                 newcred->cr_audit.ai_mask.am_success =
 492                     udata.au_aupinfo.ap_mask.am_success;
 493                 newcred->cr_audit.ai_mask.am_failure =
 494                     udata.au_aupinfo.ap_mask.am_failure;
 495                 proc_set_cred(tp, newcred);
 496                 PROC_UNLOCK(tp);
 497                 crfree(oldcred);
 498                 break;
 499
 500         case A_SETFSIZE:
 501                 if (uap->length != sizeof(udata.au_fstat))
 502                         return (EINVAL);
 503                 if ((udata.au_fstat.af_filesz != 0) &&
 504                    (udata.au_fstat.af_filesz < MIN_AUDIT_FILE_SIZE))
 505                         return (EINVAL);
 506                 audit_fstat.af_filesz = udata.au_fstat.af_filesz;
 507                 break;
 508
 509         case A_GETFSIZE:
 510                 if (uap->length != sizeof(udata.au_fstat))
 511                         return (EINVAL);
 512                 udata.au_fstat.af_filesz = audit_fstat.af_filesz;
 513                 udata.au_fstat.af_currsz = audit_fstat.af_currsz;
 514                 break;
 515
 516         case A_GETPINFO_ADDR:
 517                 if (uap->length != sizeof(udata.au_aupinfo_addr))
 518                         return (EINVAL);
 519                 if (udata.au_aupinfo_addr.ap_pid < 1)
 520                         return (ESRCH);
 521                 if ((tp = pfind(udata.au_aupinfo_addr.ap_pid)) == NULL)
 522                         return (ESRCH);
 523                 cred = tp->p_ucred;
 524                 udata.au_aupinfo_addr.ap_auid = cred->cr_audit.ai_auid;
 525                 udata.au_aupinfo_addr.ap_mask.am_success =
 526                     cred->cr_audit.ai_mask.am_success;
 527                 udata.au_aupinfo_addr.ap_mask.am_failure =
 528                     cred->cr_audit.ai_mask.am_failure;
 529                 udata.au_aupinfo_addr.ap_termid = cred->cr_audit.ai_termid;
 530                 udata.au_aupinfo_addr.ap_asid = cred->cr_audit.ai_asid;
 531                 PROC_UNLOCK(tp);
 532                 break;
 533
 534         case A_GETKAUDIT:
 535                 if (uap->length != sizeof(udata.au_kau_info))
 536                         return (EINVAL);
 537                 audit_get_kinfo(&udata.au_kau_info);
 538                 break;
 539
 540         case A_SETKAUDIT:
 541                 if (uap->length != sizeof(udata.au_kau_info))
 542                         return (EINVAL);
 543                 if (udata.au_kau_info.ai_termid.at_type != AU_IPv4 &&
 544                     udata.au_kau_info.ai_termid.at_type != AU_IPv6)
 545                         return (EINVAL);
 546                 audit_set_kinfo(&udata.au_kau_info);
 547                 break;
 548
 549         case A_SENDTRIGGER:
 550                 if (uap->length != sizeof(udata.au_trigger))
 551                         return (EINVAL);
 552                 if ((udata.au_trigger < AUDIT_TRIGGER_MIN) ||
 553                     (udata.au_trigger > AUDIT_TRIGGER_MAX))
 554                         return (EINVAL);
 555                 return (audit_send_trigger(udata.au_trigger));
 556
 557         default:
 558                 return (EINVAL);
 559         }
 560
 561         /*
 562          * Copy data back to userspace for the GET comands.
 563          */
 564         switch (uap->cmd) {
 565         case A_GETPOLICY:
 566         case A_OLDGETPOLICY:
 567         case A_GETKMASK:
 568         case A_GETQCTRL:
 569         case A_OLDGETQCTRL:
 570         case A_GETCWD:
 571         case A_GETCAR:
 572         case A_GETSTAT:
 573         case A_GETCOND:
 574         case A_OLDGETCOND:
 575         case A_GETCLASS:
 576         case A_GETPINFO:
 577         case A_GETFSIZE:
 578         case A_GETPINFO_ADDR:
 579         case A_GETKAUDIT:
 580                 error = copyout((void *)&udata, uap->data, uap->length);
 581                 if (error)
 582                         return (error);
 583                 break;
 584         }
 585
 586         return (0);
 587 }
 588
 589 /*
 590  * System calls to manage the user audit information.
 591  */
 592 /* ARGSUSED */
 593 int
 594 sys_getauid(struct thread *td, struct getauid_args *uap)
 595 {
 596         int error;
 597
 598         if (jailed(td->td_ucred))
 599                 return (ENOSYS);
 600         error = priv_check(td, PRIV_AUDIT_GETAUDIT);
 601         if (error)
 602                 return (error);
 603         return (copyout(&td->td_ucred->cr_audit.ai_auid, uap->auid,
 604             sizeof(td->td_ucred->cr_audit.ai_auid)));
 605 }
 606
 607 /* ARGSUSED */
 608 int
 609 sys_setauid(struct thread *td, struct setauid_args *uap)
 610 {
 611         struct ucred *newcred, *oldcred;
 612         au_id_t id;
 613         int error;
 614
 615         if (jailed(td->td_ucred))
 616                 return (ENOSYS);
 617         error = copyin(uap->auid, &id, sizeof(id));
 618         if (error)
 619                 return (error);
 620         audit_arg_auid(id);
 621         newcred = crget();
 622         PROC_LOCK(td->td_proc);
 623         oldcred = td->td_proc->p_ucred;
 624         crcopy(newcred, oldcred);
 625 #ifdef MAC
 626         error = mac_cred_check_setauid(oldcred, id);
 627         if (error)
 628                 goto fail;
 629 #endif
 630         error = priv_check_cred(oldcred, PRIV_AUDIT_SETAUDIT);
 631         if (error)
 632                 goto fail;
 633         newcred->cr_audit.ai_auid = id;
 634         proc_set_cred(td->td_proc, newcred);
 635         PROC_UNLOCK(td->td_proc);
 636         crfree(oldcred);
 637         return (0);
 638 fail:
 639         PROC_UNLOCK(td->td_proc);
 640         crfree(newcred);
 641         return (error);
 642 }
 643
 644 /*
 645  * System calls to get and set process audit information.
 646  */
 647 /* ARGSUSED */
 648 int
 649 sys_getaudit(struct thread *td, struct getaudit_args *uap)
 650 {
 651         struct auditinfo ai;
 652         struct ucred *cred;
 653         int error;
 654
 655         cred = td->td_ucred;
 656         if (jailed(cred))
 657                 return (ENOSYS);
 658         error = priv_check(td, PRIV_AUDIT_GETAUDIT);
 659         if (error)
 660                 return (error);
 661         if (cred->cr_audit.ai_termid.at_type == AU_IPv6)
 662                 return (E2BIG);
 663         bzero(&ai, sizeof(ai));
 664         ai.ai_auid = cred->cr_audit.ai_auid;
 665         ai.ai_mask = cred->cr_audit.ai_mask;
 666         ai.ai_asid = cred->cr_audit.ai_asid;
 667         ai.ai_termid.machine = cred->cr_audit.ai_termid.at_addr[0];
 668         ai.ai_termid.port = cred->cr_audit.ai_termid.at_port;
 669         return (copyout(&ai, uap->auditinfo, sizeof(ai)));
 670 }
 671
 672 /* ARGSUSED */
 673 int
 674 sys_setaudit(struct thread *td, struct setaudit_args *uap)
 675 {
 676         struct ucred *newcred, *oldcred;
 677         struct auditinfo ai;
 678         int error;
 679
 680         if (jailed(td->td_ucred))
 681                 return (ENOSYS);
 682         error = copyin(uap->auditinfo, &ai, sizeof(ai));
 683         if (error)
 684                 return (error);
 685         audit_arg_auditinfo(&ai);
 686         newcred = crget();
 687         PROC_LOCK(td->td_proc);
 688         oldcred = td->td_proc->p_ucred;
 689         crcopy(newcred, oldcred);
 690 #ifdef MAC
 691         error = mac_cred_check_setaudit(oldcred, &ai);
 692         if (error)
 693                 goto fail;
 694 #endif
 695         error = priv_check_cred(oldcred, PRIV_AUDIT_SETAUDIT);
 696         if (error)
 697                 goto fail;
 698         bzero(&newcred->cr_audit, sizeof(newcred->cr_audit));
 699         newcred->cr_audit.ai_auid = ai.ai_auid;
 700         newcred->cr_audit.ai_mask = ai.ai_mask;
 701         newcred->cr_audit.ai_asid = ai.ai_asid;
 702         newcred->cr_audit.ai_termid.at_addr[0] = ai.ai_termid.machine;
 703         newcred->cr_audit.ai_termid.at_port = ai.ai_termid.port;
 704         newcred->cr_audit.ai_termid.at_type = AU_IPv4;
 705         proc_set_cred(td->td_proc, newcred);
 706         PROC_UNLOCK(td->td_proc);
 707         crfree(oldcred);
 708         return (0);
 709 fail:
 710         PROC_UNLOCK(td->td_proc);
 711         crfree(newcred);
 712         return (error);
 713 }
 714
 715 /* ARGSUSED */
 716 int
 717 sys_getaudit_addr(struct thread *td, struct getaudit_addr_args *uap)
 718 {
 719         int error;
 720
 721         if (jailed(td->td_ucred))
 722                 return (ENOSYS);
 723         if (uap->length < sizeof(*uap->auditinfo_addr))
 724                 return (EOVERFLOW);
 725         error = priv_check(td, PRIV_AUDIT_GETAUDIT);
 726         if (error)
 727                 return (error);
 728         return (copyout(&td->td_ucred->cr_audit, uap->auditinfo_addr,
 729             sizeof(*uap->auditinfo_addr)));
 730 }
 731
 732 /* ARGSUSED */
 733 int
 734 sys_setaudit_addr(struct thread *td, struct setaudit_addr_args *uap)
 735 {
 736         struct ucred *newcred, *oldcred;
 737         struct auditinfo_addr aia;
 738         int error;
 739
 740         if (jailed(td->td_ucred))
 741                 return (ENOSYS);
 742         error = copyin(uap->auditinfo_addr, &aia, sizeof(aia));
 743         if (error)
 744                 return (error);
 745         audit_arg_auditinfo_addr(&aia);
 746         if (aia.ai_termid.at_type != AU_IPv6 &&
 747             aia.ai_termid.at_type != AU_IPv4)
 748                 return (EINVAL);
 749         newcred = crget();
 750         PROC_LOCK(td->td_proc);
 751         oldcred = td->td_proc->p_ucred;
 752         crcopy(newcred, oldcred);
 753 #ifdef MAC
 754         error = mac_cred_check_setaudit_addr(oldcred, &aia);
 755         if (error)
 756                 goto fail;
 757 #endif
 758         error = priv_check_cred(oldcred, PRIV_AUDIT_SETAUDIT);
 759         if (error)
 760                 goto fail;
 761         newcred->cr_audit = aia;
 762         proc_set_cred(td->td_proc, newcred);
 763         PROC_UNLOCK(td->td_proc);
 764         crfree(oldcred);
 765         return (0);
 766 fail:
 767         PROC_UNLOCK(td->td_proc);
 768         crfree(newcred);
 769         return (error);
 770 }
 771
 772 /*
 773  * Syscall to manage audit files.
 774  */
 775 /* ARGSUSED */
 776 int
 777 sys_auditctl(struct thread *td, struct auditctl_args *uap)
 778 {
 779         struct nameidata nd;
 780         struct ucred *cred;
 781         struct vnode *vp;
 782         int error = 0;
 783         int flags;
 784
 785         if (jailed(td->td_ucred))
 786                 return (ENOSYS);
 787         error = priv_check(td, PRIV_AUDIT_CONTROL);
 788         if (error)
 789                 return (error);
 790
 791         vp = NULL;
 792         cred = NULL;
 793
 794         /*
 795          * If a path is specified, open the replacement vnode, perform
 796          * validity checks, and grab another reference to the current
 797          * credential.
 798          *
 799          * On Darwin, a NULL path argument is also used to disable audit.
 800          */
 801         if (uap->path == NULL)
 802                 return (EINVAL);
 803
 804         NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF | AUDITVNODE1,
 805             UIO_USERSPACE, uap->path, td);
 806         flags = AUDIT_OPEN_FLAGS;
 807         error = vn_open(&nd, &flags, 0, NULL);
 808         if (error)
 809                 return (error);
 810         vp = nd.ni_vp;
 811 #ifdef MAC
 812         error = mac_system_check_auditctl(td->td_ucred, vp);
 813         VOP_UNLOCK(vp);
 814         if (error) {
 815                 vn_close(vp, AUDIT_CLOSE_FLAGS, td->td_ucred, td);
 816                 return (error);
 817         }
 818 #else
 819         VOP_UNLOCK(vp);
 820 #endif
 821         NDFREE(&nd, NDF_ONLY_PNBUF);
 822         if (vp->v_type != VREG) {
 823                 vn_close(vp, AUDIT_CLOSE_FLAGS, td->td_ucred, td);
 824                 return (EINVAL);
 825         }
 826         cred = td->td_ucred;
 827         crhold(cred);
 828
 829         /*
 830          * XXXAUDIT: Should audit_trail_suspended actually be cleared by
 831          * audit_worker?
 832          */
 833         audit_trail_suspended = 0;
 834         audit_syscalls_enabled_update();
 835
 836         audit_rotate_vnode(cred, vp);
 837
 838         return (error);
 839 }
 840
 841 #else /* !AUDIT */
 842
 843 int
 844 sys_audit(struct thread *td, struct audit_args *uap)
 845 {
 846
 847         return (ENOSYS);
 848 }
 849
 850 int
 851 sys_auditon(struct thread *td, struct auditon_args *uap)
 852 {
 853
 854         return (ENOSYS);
 855 }
 856
 857 int
 858 sys_getauid(struct thread *td, struct getauid_args *uap)
 859 {
 860
 861         return (ENOSYS);
 862 }
 863
 864 int
 865 sys_setauid(struct thread *td, struct setauid_args *uap)
 866 {
 867
 868         return (ENOSYS);
 869 }
 870
 871 int
 872 sys_getaudit(struct thread *td, struct getaudit_args *uap)
 873 {
 874
 875         return (ENOSYS);
 876 }
 877
 878 int
 879 sys_setaudit(struct thread *td, struct setaudit_args *uap)
 880 {
 881
 882         return (ENOSYS);
 883 }
 884
 885 int
 886 sys_getaudit_addr(struct thread *td, struct getaudit_addr_args *uap)
 887 {
 888
 889         return (ENOSYS);
 890 }
 891
 892 int
 893 sys_setaudit_addr(struct thread *td, struct setaudit_addr_args *uap)
 894 {
 895
 896         return (ENOSYS);
 897 }
 898
 899 int
 900 sys_auditctl(struct thread *td, struct auditctl_args *uap)
 901 {
 902
 903         return (ENOSYS);
 904 }
 905 #endif /* AUDIT */