PERFORCE change 63119 for review
Andrew R. Reiter
arr at watson.org
Wed Oct 13 15:07:51 GMT 2004
Is this p4 tree available via cvsup? If so, just curious if you could
let me know the label. I'd like to help out where I can.
Cheers,
Andrew
On Wed, 13 Oct 2004, Wayne Salamon wrote:
:http://perforce.freebsd.org/chv.cgi?CH=63119
:
:Change 63119 by wsalamon at wsalamon_epi on 2004/10/13 01:14:20
:
: Change the auditctl() system call to take just a path.
: Enable the kerne->auditd IPC for audit log full and disk full
: messages. Uses a FIFO for this communication.
: Note: auditd still needs work when rotating the audit log.
:
:Affected files ...
:
:.. //depot/projects/trustedbsd/audit3/contrib/audit_supt/auditd/auditd.c#5 edit
:.. //depot/projects/trustedbsd/audit3/sys/bsm/audit.h#6 edit
:.. //depot/projects/trustedbsd/audit3/sys/kern/init_sysent.c#5 edit
:.. //depot/projects/trustedbsd/audit3/sys/kern/syscalls.c#5 edit
:.. //depot/projects/trustedbsd/audit3/sys/kern/syscalls.master#5 edit
:.. //depot/projects/trustedbsd/audit3/sys/security/audit/kern_audit.c#10 edit
:.. //depot/projects/trustedbsd/audit3/sys/sys/syscall.h#5 edit
:.. //depot/projects/trustedbsd/audit3/sys/sys/syscall.mk#5 edit
:.. //depot/projects/trustedbsd/audit3/sys/sys/sysproto.h#6 edit
:
:Differences ...
:
:==== //depot/projects/trustedbsd/audit3/contrib/audit_supt/auditd/auditd.c#5 (text+ko) ====
:
:@@ -185,9 +185,8 @@
: if (open(fn, O_RDONLY | O_CREAT, S_IRUSR | S_IRGRP) < 0) {
: perror("File open");
: }
:- /* else if (auditctl(AC_SETLOGFILE, fn, strlen(fn)) != 0) { */
:- else if (syscall(SYS_auditctl, AC_SETLOGFILE, fn,
:- strlen(fn)) != 0) {
:+ /* else if (auditctl(AC_SETLOGFILE, fn)) != 0) { */
:+ else if (syscall(SYS_auditctl, AC_SETLOGFILE, fn) != 0) {
: syslog(LOG_ERR,
: "auditctl failed setting log file! : %s\n",
: strerror(errno));
:@@ -307,7 +306,7 @@
:
: /* flush contents */
: /* err_ret = auditctl(NULL); */
:- err_ret = syscall(SYS_auditctl, NULL, sizeof(char));
:+ err_ret = syscall(SYS_auditctl, AC_SETLOGFILE, NULL);
: if (err_ret != 0) {
: syslog(LOG_ERR, "auditctl failed! : %s\n",
: strerror(errno));
:@@ -326,6 +325,10 @@
: return (1);
: }
: endac();
:+
:+ if(close(controlfd) != 0) {
:+ syslog(LOG_ERR, "Error closing control file\n");
:+ }
: syslog(LOG_INFO, "Finished.\n");
: return (0);
: }
:@@ -350,13 +353,19 @@
:
: /* Set up the signal hander */
: if (signal(SIGTERM, relay_signal) == SIG_ERR) {
:+ syslog(LOG_ERR,
:+ "Could not set signal handler for SIGTERM\n");
: fail_exit();
: }
: if (signal(SIGCHLD, relay_signal) == SIG_ERR) {
:+ syslog(LOG_ERR,
:+ "Could not set signal handler for SIGCHLD\n");
: fail_exit();
: }
:
: if ((pidfile = fopen(AUDITD_PIDFILE, "a")) == NULL) {
:+ syslog(LOG_ERR,
:+ "Could not open PID file\n");
: audit_warn_tmpfile();
: return -1;
: }
:@@ -364,7 +373,8 @@
: /* attempt to lock the pid file; if a lock is present, exit */
: fd = fileno(pidfile);
: if(flock(fd, LOCK_EX | LOCK_NB) < 0) {
:- syslog(LOG_ERR, "PID file is locked (is another auditd running?).\n");
:+ syslog(LOG_ERR,
:+ "PID file is locked (is another auditd running?).\n");
: audit_warn_ebusy();
: return -1;
: }
:@@ -560,7 +570,8 @@
: evc_map.ec_number = ev->ae_number;
: evc_map.ec_class = ev->ae_class;
: /* if (auditon(A_SETCLASS, &evc_map, sizeof(au_evclass_map_t)) != 0) { */
:- if (syscall(SYS_auditon,A_SETCLASS, &evc_map, sizeof(au_evclass_map_t)) != 0) {
:+ if (syscall(SYS_auditon, A_SETCLASS, &evc_map,
:+ sizeof(au_evclass_map_t)) != 0) {
: syslog(LOG_ERR,
: "Failed to register class mapping for event %s",
: ev->ae_name);
:@@ -630,15 +641,6 @@
: return rc;
: }
:
:- /* Tell the kernel the name of the auditd control file */
:- /*else if (auditctl(AC_SETCTLFILE, fn, strlen(fn)) != 0) { */
:- if (syscall(SYS_auditctl, AC_SETCTLFILE, AUDITD_CTL_FILE,
:- strlen(AUDITD_CTL_FILE)) != 0) {
:- syslog(LOG_ERR,
:- "config_auditd_ipc() : failed sending control file "
:- " name to the kernel: %s\n",
:- strerror(errno));
:- }
: /* Set up the signal hander */
: if (signal(SIGIO, sigio_handler) == SIG_ERR) {
: syslog(LOG_ERR,
:@@ -646,7 +648,7 @@
: return -1;
: }
:
:- controlfd = open(AUDITD_CTL_FILE, O_RDONLY);
:+ controlfd = open(AUDITD_CTL_FILE, O_RDONLY | O_NONBLOCK);
: if (controlfd < 0) {
: syslog(LOG_ERR,
: "config_auditd_ipc() : error opening control file\n");
:@@ -663,6 +665,14 @@
: "config_auditd_ipc() : error setting file ASYNC\n");
: return -1;
: }
:+ /* Tell the kernel the name of the auditd control file */
:+ /*if (auditctl(AC_SETCTLFILE, fn) != 0) { */
:+ if (syscall(SYS_auditctl, AC_SETCTLFILE, AUDITD_CTL_FILE) != 0) {
:+ syslog(LOG_ERR,
:+ "config_auditd_ipc() : failed sending control file "
:+ "name to the kernel: %s\n",
:+ strerror(errno));
:+ }
: return 0;
: }
:
:@@ -735,7 +745,7 @@
: }
: }
:
:- openlog("auditd", LOG_CONS | LOG_PID, LOG_DAEMON);
:+ openlog("auditd", LOG_CONS | LOG_PID, LOG_SECURITY);
: syslog(LOG_INFO, "starting...\n");
:
: if (debug == 0 && daemon(0, 0) == -1) {
:
:==== //depot/projects/trustedbsd/audit3/sys/bsm/audit.h#6 (text+ko) ====
:
:@@ -302,7 +302,7 @@
:
: int audit (const void *, int);
: int auditon (int, void *, int);
:-int auditctl (int, void *, int);
:+int auditctl (int, const char *);
: int getauid (au_id_t *);
: int setauid (const au_id_t *);
: int getaudit (struct auditinfo *);
:
:==== //depot/projects/trustedbsd/audit3/sys/kern/init_sysent.c#5 (text+ko) ====
:
:
:==== //depot/projects/trustedbsd/audit3/sys/kern/syscalls.c#5 (text+ko) ====
:
:
:==== //depot/projects/trustedbsd/audit3/sys/kern/syscalls.master#5 (text+ko) ====
:
:@@ -705,6 +705,6 @@
: *auditinfo_addr, u_int length); } AUE_GETAUDIT_ADDR
: 451 MSTD { int setaudit_addr(struct auditinfo_addr \
: *auditinfo_addr, u_int length); } AUE_SETAUDIT_ADDR
:-452 MSTD { int auditctl(int cmd, void *data, u_int length); } AUE_AUDITCTL
:+452 MSTD { int auditctl(int cmd, char *path); } AUE_AUDITCTL
: ; Please copy any additions and changes to the following compatability tables:
: ; sys/compat/freebsd32/syscalls.master
:
:==== //depot/projects/trustedbsd/audit3/sys/security/audit/kern_audit.c#10 (text+ko) ====
:
:@@ -29,6 +29,7 @@
: #include <sys/kernel.h>
: #include <sys/kthread.h>
: #include <sys/malloc.h>
:+#include <sys/mount.h>
: #include <sys/namei.h>
: #include <sys/proc.h>
: #include <sys/queue.h>
:@@ -63,7 +64,7 @@
: * volume, it should be left off unless you want your system
: * to churn a lot whenever the audit record flow gets high.
: */
:-#define AUDIT_EXCESSIVELY_VERBOSE
:+//#define AUDIT_EXCESSIVELY_VERBOSE
: #ifdef AUDIT_EXCESSIVELY_VERBOSE
: #define AUDIT_PRINTF(x) printf x
: #else
:@@ -177,6 +178,10 @@
: static int audit_file_rotate_wait;
:
: /*
:+ * vnode for the audit daemon control file
:+ */
:+static struct vnode *auditd_ctl_vp;
:+/*
: * Flags controlling behavior in low storage situations.
: * Should we panic if a write fails? Should we fail stop
: * if we're out of disk space? Are we currently "failing
:@@ -215,7 +220,10 @@
: struct thread *td)
: {
: int ret;
:+ int trigger;
: struct au_record *bsm;
:+ struct vattr vattr;
:+ struct statfs *mnt_stat = &vp->v_mount->mnt_stat;
:
: mtx_assert(&Giant, MA_OWNED);
:
:@@ -226,14 +234,11 @@
: * and return. However, this is arguably an assertion failure.
: * XXX Need a FreeBSD equivalent.
: */
:-#if DARWIN_FOO
:- struct vattr vattr;
:- struct statfs *mnt_stat = &vp->v_mount->mnt_stat;
:- ret = VFS_STATFS(vp->v_mount, mnt_stat, p);
:+ ret = VFS_STATFS(vp->v_mount, mnt_stat, td);
: if (ret)
: goto out;
:
:- ret = VOP_GETATTR(vp, &vattr, cred, p);
:+ ret = VOP_GETATTR(vp, &vattr, cred, td);
: if (ret)
: goto out;
:
:@@ -246,11 +251,7 @@
: * XXX Need to decide what to do if the trigger to the audit daemon
: * fails.
: */
:- if(host_get_audit_control_port(host_priv_self(), &audit_port)
:- != KERN_SUCCESS)
:- printf("Cannot get audit control port\n");
:-
:- if (audit_port != MACH_PORT_NULL) {
:+ if (auditd_ctl_vp != NULL) {
: long temp;
:
: /*
:@@ -260,9 +261,12 @@
: if (audit_qctrl.aq_minfree != 0) {
: temp = mnt_stat->f_blocks / (100 / audit_qctrl.aq_minfree);
: if (mnt_stat->f_bfree < temp) {
:- ret = audit_triggers(audit_port,
:- AUDIT_TRIGGER_LOW_SPACE);
:- if (ret != KERN_SUCCESS) {
:+ trigger = AUDITD_TRIGGER_LOW_SPACE;
:+ ret = vn_rdwr(UIO_WRITE, auditd_ctl_vp,
:+ (void *)&trigger, sizeof(trigger),
:+ (off_t)0, UIO_SYSSPACE, IO_APPEND|IO_UNIT,
:+ cred, NULL, NULL, td);
:+ if (ret != 0) {
: printf(
: "Failed audit_triggers(AUDIT_TRIGGER_LOW_SPACE): %d\n", ret);
: /*
:@@ -281,9 +285,12 @@
: (audit_file_rotate_wait == 0) &&
: (vattr.va_size >= audit_fstat.af_filesz)) {
: audit_file_rotate_wait = 1;
:- ret = audit_triggers(audit_port,
:- AUDIT_TRIGGER_FILE_FULL);
:- if (ret != KERN_SUCCESS) {
:+ trigger = AUDITD_TRIGGER_FILE_FULL;
:+ ret = vn_rdwr(UIO_WRITE, auditd_ctl_vp,
:+ (void *)&trigger, sizeof(trigger),
:+ (off_t)0, UIO_SYSSPACE, IO_APPEND|IO_UNIT,
:+ cred, NULL, NULL, td);
:+ if (ret != 0) {
: printf(
: "Failed audit_triggers(AUDIT_TRIGGER_FILE_FULL): %d\n", ret);
: /* XXX what to do here? */
:@@ -312,7 +319,6 @@
: audit_in_failure = 1;
: }
:
:-#endif
: /*
: * If there is a user audit record attached to the kernel record,
: * then write the user record.
:@@ -370,7 +376,6 @@
: kau_free(bsm);
:
: out:
:-#if DARWIN_FOO
: /*
: * When we're done processing the current record, we have to
: * check to see if we're in a failure mode, and if so, whether
:@@ -379,12 +384,11 @@
: */
: if (audit_in_failure &&
: audit_q_len == 0 && audit_pre_q_len == 0) {
:- VOP_LOCK(vp, LK_DRAIN | LK_INTERLOCK, p);
:- (void)VOP_FSYNC(vp, cred, MNT_WAIT, p);
:- VOP_UNLOCK(vp, 0, p);
:+ VOP_LOCK(vp, LK_DRAIN | LK_INTERLOCK, td);
:+ (void)VOP_FSYNC(vp, cred, MNT_WAIT, td);
:+ VOP_UNLOCK(vp, 0, td);
: panic("Audit store overflow; record queue drained.");
: }
:-#endif
:
: return (ret);
: }
:@@ -585,6 +589,7 @@
: audit_replacement_flag = 0;
: audit_file_rotate_wait = 0;
: audit_replacement_vp = NULL;
:+ auditd_ctl_vp = NULL;
: audit_fstat.af_filesz = 0; /* '0' means unset, unbounded */
: audit_fstat.af_currsz = 0;
: audit_qctrl.aq_hiwater = AQ_HIWATER;
:@@ -1089,7 +1094,6 @@
: struct ucred *cred;
: struct vnode *vp;
: int error, flags;
:- union auditctl_udata udata;
:
: error = suser(td);
: if (error)
:@@ -1098,8 +1102,6 @@
: vp = NULL;
: cred = NULL;
:
:- memset((void *)&udata, 0, sizeof(udata));
:-
: switch (uap->cmd) {
: case AC_SETLOGFILE:
: /*
:@@ -1107,18 +1109,11 @@
: * validity checks, and grab another reference to the current
: * credential.
: */
:- if (uap->data != NULL) {
:+ if (uap->path != NULL) {
:
:- if ((uap->length <= 0) || (uap->length > MAXPATHLEN))
:- return (EINVAL);
:-
:- error = copyin(uap->data, (void *)&udata, uap->length);
:- if (error)
:- return (error);
:-
: mtx_lock(&Giant);
: NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF, UIO_SYSSPACE,
:- udata.ac_path, td);
:+ uap->path, td);
: flags = audit_open_flags;
: error = vn_open(&nd, &flags, 0, -1);
: if (error) {
:@@ -1141,7 +1136,29 @@
:
: audit_rotate_vnode(cred, vp);
: break;
:- case AC_SETCTLFD: /* Set control file descriptor */
:+
:+ case AC_SETCTLFILE: /* Set auditd control file */
:+ if (uap->path != NULL) {
:+ mtx_lock(&Giant);
:+ NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF, UIO_SYSSPACE,
:+ uap->path, td);
:+ flags = FWRITE | O_NONBLOCK;
:+ error = vn_open(&nd, &flags, 0, -1);
:+ if (error) {
:+ mtx_unlock(&Giant);
:+ return (error);
:+ }
:+ VOP_UNLOCK(nd.ni_vp, 0, td);
:+ vp = nd.ni_vp;
:+ if (vp->v_type != VFIFO) {
:+ vn_close(vp, audit_close_flags,
:+ td->td_ucred, td);
:+ mtx_unlock(&Giant);
:+ return (EINVAL);
:+ }
:+ auditd_ctl_vp = vp;
:+ mtx_unlock(&Giant);
:+ }
: break;
: }
: return (0);
:
:==== //depot/projects/trustedbsd/audit3/sys/sys/syscall.h#5 (text+ko) ====
:
:
:==== //depot/projects/trustedbsd/audit3/sys/sys/syscall.mk#5 (text+ko) ====
:
:
:==== //depot/projects/trustedbsd/audit3/sys/sys/sysproto.h#6 (text+ko) ====
:
:@@ -1334,8 +1334,7 @@
: };
: struct auditctl_args {
: char cmd_l_[PADL_(int)]; int cmd; char cmd_r_[PADR_(int)];
:- char data_l_[PADL_(void *)]; void * data; char data_r_[PADR_(void *)];
:- char length_l_[PADL_(u_int)]; u_int length; char length_r_[PADR_(u_int)];
:+ char path_l_[PADL_(char *)]; char * path; char path_r_[PADR_(char *)];
: };
: int nosys(struct thread *, struct nosys_args *);
: void sys_exit(struct thread *, struct sys_exit_args *);
:
:
--
Andrew R. Reiter
arr at watson.org
arr at FreeBSD.org
To Unsubscribe: send mail to majordomo at trustedbsd.org
with "unsubscribe trustedbsd-cvs" in the body of the message
More information about the trustedbsd-cvs
mailing list