OpenSolaris_b135/cmd/auditreduce/option.c
/*
* CDDL HEADER START
*
* The contents of this file are subject to the terms of the
* Common Development and Distribution License (the "License").
* You may not use this file except in compliance with the License.
*
* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
* or http://www.opensolaris.org/os/licensing.
* See the License for the specific language governing permissions
* and limitations under the License.
*
* When distributing Covered Code, include this CDDL HEADER in each
* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
* If applicable, add the following below this CDDL HEADER, with the
* fields enclosed by brackets "[]" replaced with your own identifying
* information: Portions Copyright [yyyy] [name of copyright owner]
*
* CDDL HEADER END
*/
/*
* Copyright 2009 Sun Microsystems, Inc. All rights reserved.
* Use is subject to license terms.
*/
/*
* Command line option processing for auditreduce.
* The entry point is process_options(), which is called by main().
* Process_options() is the only function visible outside this module.
*/
#include <locale.h>
#include <sys/zone.h> /* for max zonename length */
#include "auditr.h"
/*
* Object entry.
* Maps object strings specified on the command line to a flag
* used when searching by object type.
*/
struct obj_ent {
char *obj_str; /* string specified on the command line */
int obj_flag; /* flag used when searching */
};
typedef struct obj_ent obj_ent_t;
/*
* Supports searches by object type.
*/
static obj_ent_t obj_tbl[] = {
{ "file", OBJ_PATH },
{ "filegroup", OBJ_FGROUP },
{ "fileowner", OBJ_FOWNER },
{ "fmri", OBJ_FMRI },
{ "lp", OBJ_LP },
{ "msgqid", OBJ_MSG },
{ "msgqgroup", OBJ_MSGGROUP },
{ "msgqowner", OBJ_MSGOWNER },
{ "path", OBJ_PATH },
{ "pid", OBJ_PROC },
{ "procgroup", OBJ_PGROUP },
{ "procowner", OBJ_POWNER },
{ "semid", OBJ_SEM },
{ "semgroup", OBJ_SEMGROUP },
{ "semowner", OBJ_SEMOWNER },
{ "shmid", OBJ_SHM },
{ "shmgroup", OBJ_SHMGROUP },
{ "shmowner", OBJ_SHMOWNER },
{ "sock", OBJ_SOCK } };
extern int derive_date(char *, struct tm *);
extern int parse_time(char *, int);
extern char *re_comp2(char *);
extern time_t tm_to_secs(struct tm *);
static int a_isnum(char *, int);
static int check_file(audit_fcb_t *, int);
static int gather_dir(char *);
static audit_pcb_t *get_next_pcb(char *);
static obj_ent_t *obj_lkup(char *);
static int proc_class(char *);
static int proc_date(char *, int);
static int proc_file(char *, int);
static int process_fileopt(int, char *argv[], int);
static int proc_group(char *, gid_t *);
static int proc_id(char *, int);
static int proc_object(char *);
static void proc_pcb(audit_pcb_t *, char *, int);
static int proc_label(char *);
static int proc_subject(char *);
static int proc_sid(char *);
static int proc_type(char *);
static int proc_user(char *, uid_t *);
static int proc_zonename(char *);
static int proc_fmri(char *);
/*
* .func process_options - process command line options.
* .desc Process the user's command line options. These are of two types:
* single letter flags that are denoted by '-', and filenames. Some
* of the flags have arguments. Getopt() is used to get the flags.
* When this is done it calls process_fileopt() to handle any filenames
* that were there.
* .call ret = process_options(argc, argv).
* .arg argc - the original value.
* .arg argv - the original value.
* .ret 0 - no errors detected.
* .ret -1 - command line error detected (message already printed).
*/
int
process_options(int argc, char **argv)
{
int opt;
int error = FALSE;
int error_combo = FALSE;
extern int optind; /* in getopt() */
extern char *optarg; /* in getopt() - holds arg to flag */
static char *options = "ACD:M:NQR:S:VO:"
"a:b:c:d:e:g:j:l:m:o:r:s:t:u:z:";
error_str = gettext("general error");
zonename = NULL;
/*
* Big switch to process the flags.
* Start_over: is for handling the '-' for standard input. Getopt()
* doesn't recognize it.
*/
start_over:
while ((opt = getopt(argc, argv, options)) != EOF) {
switch (opt) {
case 'A': /* all records from the files */
f_all = TRUE;
break;
case 'C': /* process only completed files */
f_complete = TRUE;
break;
case 'D': /* delete the files when done */
/* force 'A' 'C' 'O' to be active */
f_all = f_complete = TRUE;
f_outfile = optarg;
f_delete = TRUE;
break;
case 'M': /* only files from a certain machine */
f_machine = optarg;
break;
case 'N': /* new object selection mode */
new_mode = TRUE;
break;
case 'Q': /* no file error reporting */
f_quiet = TRUE;
break;
case 'R': /* from specified root */
f_root = optarg;
break;
case 'S': /* from specified server */
f_server = optarg;
break;
case 'V': /* list all files as they are opened */
f_verbose = TRUE;
break;
case 'O': /* write to outfile */
f_outfile = optarg;
break;
case 'a': /* after 'date' */
case 'b': /* before 'date' */
case 'd': /* from 'day' */
if (proc_date(optarg, opt))
error = TRUE;
break;
case 'j': /* subject */
if (proc_subject(optarg))
error = TRUE;
break;
case 'm': /* message 'type' */
if (proc_type(optarg))
error = TRUE;
break;
case 'o': /* object type */
if (proc_object(optarg))
error = TRUE;
break;
case 'c': /* message class */
if (proc_class(optarg))
error = TRUE;
break;
case 'u': /* form audit user */
case 'e': /* form effective user */
case 'r': /* form real user */
case 'f': /* form effective group */
case 'g': /* form real group */
if (proc_id(optarg, opt))
error = TRUE;
break;
case 'l': /* TX label range */
if (!is_system_labeled()) {
(void) fprintf(stderr,
gettext("%s option 'l' requires "
"Trusted Extensions.\n"), ar);
return (-1);
}
if (proc_label(optarg))
error = TRUE;
break;
case 's': /* session ID */
if (proc_sid(optarg))
error = TRUE;
break;
case 'z': /* zone name */
if (proc_zonename(optarg))
error = TRUE;
break;
case 't': /* termial ID reserved for later */
default:
return (-1);
}
if (error) {
(void) fprintf(stderr,
gettext("%s command line error - %s.\n"),
ar, error_str);
return (-1);
}
}
/* catch '-' option for stdin processing - getopt() won't see it */
if (optind < argc) {
if (argv[optind][0] == '-' && argv[optind][1] == '\0') {
optind++;
f_stdin = TRUE;
goto start_over;
}
}
/*
* Give a default value for 'b' option if not specified.
*/
if (m_before == 0)
m_before = MAXLONG; /* forever */
/*
* Validate combinations of options.
* The following are done:
* 1. Can't have 'M' or 'S' or 'R' with filenames.
* 2. Can't have an after ('a') time after a before ('b') time.
* 3. Delete ('D') must have 'C' and 'A' and 'O' with it.
* 4. Input from stdin ('-') can't have filenames too.
*/
if ((f_machine || f_server || f_root) && (argc != optind)) {
error_str = gettext(
"no filenames allowed with 'M' or 'S' or 'R' options");
error_combo = TRUE;
}
if (m_after >= m_before) {
error_str =
gettext("'a' parameter must be before 'b' parameter");
error_combo = TRUE;
}
if (f_delete &&
(!f_complete || !f_all || !f_outfile)) {
error_str = gettext(
"'C', 'A', and 'O' must be specified with 'D'");
error_combo = TRUE;
}
if (f_stdin && (argc != optind)) {
error_str = gettext("no filenames allowed with '-' option");
error_combo = TRUE;
}
/*
* If error with option combos then print message and exit.
* If there was an error with just an option then exit.
*/
if (error_combo) {
(void) fprintf(stderr,
gettext("%s command line error - %s.\n"), ar, error_str);
return (-1);
}
if (f_root == NULL)
f_root = "/etc/security/audit";
/*
* Now handle any filenames included in the command line.
*/
return (process_fileopt(argc, argv, optind));
}
int
proc_subject(char *optarg)
{
if (flags & M_SUBJECT) {
error_str = gettext("'j' option specified multiple times");
return (-1);
}
flags |= M_SUBJECT;
subj_id = atol(optarg);
return (0);
}
int
proc_sid(char *optarg)
{
if (flags & M_SID) {
error_str = gettext("'s' option specified multiple times");
return (-1);
}
flags |= M_SID;
m_sid = (au_asid_t)atol(optarg);
return (0);
}
int
proc_object(char *optarg)
{
char *obj_str;
char *obj_val;
char *obj_arg;
int err;
obj_ent_t *oep;
struct hostent *he;
if (flags & M_OBJECT) {
error_str = gettext("'o' option specified multiple times");
return (-1);
}
flags |= M_OBJECT;
if ((obj_arg = strdup(optarg)) == (char *)0)
return (-1);
if ((obj_str = strtok(optarg, "=")) == (char *)0 ||
(oep = obj_lkup(obj_str)) == (obj_ent_t *)0 ||
(obj_val = strtok((char *)0, "=")) == (char *)0) {
(void) sprintf(errbuf, gettext("invalid object arg (%s)"),
obj_arg);
error_str = errbuf;
return (-1);
}
obj_flag = oep->obj_flag;
switch (obj_flag) {
case OBJ_PATH:
if ((error_str = re_comp2(obj_val)) != (char *)NULL) {
return (-1);
}
return (0);
/* NOTREACHED */
case OBJ_SOCK:
if (!a_isnum(obj_val, TRUE)) {
obj_id = atol(obj_val);
socket_flag = SOCKFLG_PORT;
return (0);
}
if (*obj_val == '0') {
(void) sscanf(obj_val, "%x", (uint_t *)&obj_id);
socket_flag = SOCKFLG_PORT;
return (0);
}
he = getipnodebyname((const void *)obj_val, AF_INET6, 0, &err);
if (he == 0) {
he = getipnodebyname((const void *)obj_val, AF_INET,
0, &err);
if (he == 0) {
(void) sprintf(errbuf,
gettext("invalid machine name (%s)"),
obj_val);
error_str = errbuf;
return (-1);
}
}
if (he->h_addrtype == AF_INET6) {
/* LINTED */
if (IN6_IS_ADDR_V4MAPPED(
(in6_addr_t *)he->h_addr_list[0])) {
/* address is IPv4 (32 bits) */
(void) memcpy(&obj_id,
he->h_addr_list[0] + 12, 4);
ip_type = AU_IPv4;
} else {
(void) memcpy(ip_ipv6, he->h_addr_list[0], 16);
ip_type = AU_IPv6;
}
} else {
/* address is IPv4 (32 bits) */
(void) memcpy(&obj_id, he->h_addr_list[0], 4);
ip_type = AU_IPv4;
}
freehostent(he);
socket_flag = SOCKFLG_MACHINE;
return (0);
break;
case OBJ_MSG:
case OBJ_SEM:
case OBJ_SHM:
case OBJ_PROC:
obj_id = atol(obj_val);
return (0);
/* NOTREACHED */
case OBJ_FGROUP:
case OBJ_MSGGROUP:
case OBJ_SEMGROUP:
case OBJ_SHMGROUP:
case OBJ_PGROUP:
return (proc_group(obj_val, &obj_group));
/* NOTREACHED */
case OBJ_FOWNER:
case OBJ_MSGOWNER:
case OBJ_SEMOWNER:
case OBJ_SHMOWNER:
case OBJ_POWNER:
return (proc_user(obj_val, &obj_owner));
/* NOTREACHED */
case OBJ_FMRI:
return (proc_fmri(obj_val));
/* NOTREACHED */
case OBJ_LP: /* lp objects have not yet been defined */
default: /* impossible */
(void) sprintf(errbuf, gettext("invalid object type (%s)"),
obj_str);
error_str = errbuf;
return (-1);
/* NOTREACHED */
} /* switch */
/*NOTREACHED*/
}
obj_ent_t *
obj_lkup(char *obj_str)
{
int i;
for (i = 0; i < sizeof (obj_tbl) / sizeof (obj_ent_t); i++)
if (strcmp(obj_str, obj_tbl[i].obj_str) == 0)
return (&obj_tbl[i]);
/* not in table */
return (NULL);
}
/*
* .func proc_type - process record type.
* .desc Process a record type. It is either as a number or a mnemonic.
* .call ret = proc_type(optstr).
* .arg optstr - ptr to name or number.
* .ret 0 - no errors detected.
* .ret -1 - error detected (error_str contains description).
*/
int
proc_type(char *optstr)
{
struct au_event_ent *aep;
/*
* Either a number or a name.
*/
if (flags & M_TYPE) {
error_str = gettext("'m' option specified multiple times");
return (-1);
}
flags |= M_TYPE;
m_type = 0;
if (a_isnum(optstr, TRUE)) {
if ((aep = getauevnam(optstr)) != NULL)
m_type = aep->ae_number;
} else {
if ((aep = getauevnum((au_event_t)atoi(optstr))) !=
(struct au_event_ent *)NULL)
m_type = aep->ae_number;
}
if ((m_type == 0)) {
(void) sprintf(errbuf, gettext("invalid event (%s)"), optstr);
error_str = errbuf;
return (-1);
}
return (0);
}
/*
* .func a_isnum - is it a number?
* .desc Determine if a string is a number or a name.
* A number may have a leading '+' or '-', but then must be
* all digits.
* .call ret = a_isnum(str).
* .arg str - ptr to the string.
* .arg leading - TRUE if leading '+-' allowed.
* .ret 0 - is a number.
* .ret 1 - is not a number.
*/
int
a_isnum(char *str, int leading)
{
char *strs;
if ((leading == TRUE) && (*str == '-' || *str == '+'))
strs = str + 1;
else
strs = str;
if (strlen(strs) == strspn(strs, "0123456789"))
return (0);
else
return (1);
}
/*
* .func proc_id - process user/group id's/
* .desc Process either a user number/name or group number/name.
* For names check to see if the name is active in the system
* to derive the number. If it is not active then fail. For a number
* also check to see if it is active, but only print a warning if it
* is not. An administrator may be looking at activity of a 'phantom'
* user.
* .call ret = proc_id(optstr, opt).
* .arg optstr - ptr to name or number.
* .arg opt - 'u' - audit user, 'e' - effective user, 'r' - real user,
* 'g' - group, 'f' - effective group.
* .ret 0 - no errors detected.
* .ret -1 - error detected (error_str contains description).
*/
int
proc_id(char *optstr, int opt)
{
switch (opt) {
case 'e': /* effective user id */
if (flags & M_USERE) {
error_str = gettext(
"'e' option specified multiple times");
return (-1);
}
flags |= M_USERE;
return (proc_user(optstr, &m_usere));
/* NOTREACHED */
case 'f': /* effective group id */
if (flags & M_GROUPE) {
error_str = gettext(
"'f' option specified multiple times");
return (-1);
}
flags |= M_GROUPE;
return (proc_group(optstr, &m_groupe));
/* NOTREACHED */
case 'r': /* real user id */
if (flags & M_USERR) {
error_str = gettext(
"'r' option specified multiple times");
return (-1);
}
flags |= M_USERR;
return (proc_user(optstr, &m_userr));
/* NOTREACHED */
case 'u': /* audit user id */
if (flags & M_USERA) {
error_str = gettext(
"'u' option specified multiple times");
return (-1);
}
flags |= M_USERA;
return (proc_user(optstr, &m_usera));
/* NOTREACHED */
case 'g': /* real group id */
if (flags & M_GROUPR) {
error_str = gettext(
"'g' option specified multiple times");
return (-1);
}
flags |= M_GROUPR;
return (proc_group(optstr, &m_groupr));
/* NOTREACHED */
default: /* impossible */
(void) sprintf(errbuf, gettext("'%c' unknown option"), opt);
error_str = errbuf;
return (-1);
/* NOTREACHED */
}
/*NOTREACHED*/
}
int
proc_group(char *optstr, gid_t *gid)
{
struct group *grp;
if ((grp = getgrnam(optstr)) == NULL) {
if (!a_isnum(optstr, TRUE)) {
*gid = (gid_t)atoi(optstr);
return (0);
}
(void) sprintf(errbuf, gettext("group name invalid (%s)"),
optstr);
error_str = errbuf;
return (-1);
}
*gid = grp->gr_gid;
return (0);
}
int
proc_user(char *optstr, uid_t *uid)
{
struct passwd *usr;
if ((usr = getpwnam(optstr)) == NULL) {
if (!a_isnum(optstr, TRUE)) {
*uid = (uid_t)atoi(optstr);
return (0);
}
(void) sprintf(errbuf, gettext("user name invalid (%s)"),
optstr);
error_str = errbuf;
return (-1);
}
*uid = usr->pw_uid;
return (0);
}
/*
* .func proc_date - process date argument.
* .desc Handle a date/time argument. See if the user has erred in combining
* the types of date arguments. Then parse the string and check for
* validity of each part.
* .call ret = proc_date(optstr, opt).
* .arg optstr - ptr to date/time string.
* .arg opt - 'd' for day, 'a' for after, or 'b' for before.
* .ret 0 - no errors detected.
* .ret -1 - errors detected (error_str knows what it is).
*/
int
proc_date(char *optstr, int opt)
{
static int m_day = FALSE;
if (opt == 'd') {
if (m_day == TRUE) {
error_str = gettext(
"'d' option may not be used with 'a' or 'b'");
return (-1);
}
m_day = TRUE;
}
if ((opt == 'd') && (m_before || m_after)) {
error_str = gettext(
"'d' option may not be used with 'a' or 'b'");
return (-1);
}
if ((opt == 'a' || opt == 'b') && m_day) {
error_str = gettext(
"'a' or 'b' option may not be used with 'd'");
return (-1);
}
if ((opt == 'a') && (m_after != 0)) {
error_str = gettext("'a' option specified multiple times");
return (-1);
}
if ((opt == 'b') && (m_before != 0)) {
error_str = gettext("'b' option specified multiple times");
return (-1);
}
if (parse_time(optstr, opt))
return (-1);
return (0);
}
/*
* .func proc_class - process message class argument.
* .desc Process class type and see if it is for real.
* .call ret = proc_class(optstr).
* .arg optstr - ptr to class.
* .ret 0 - class has class.
* .ret -1 - class in no good.
*/
int
proc_class(char *optstr)
{
if (flags & M_CLASS) {
error_str = gettext("'c' option specified multiple times");
return (-1);
}
flags |= M_CLASS;
if (getauditflagsbin(optstr, &mask) != 0) {
(void) sprintf(errbuf, gettext("unknown class (%s)"), optstr);
error_str = errbuf;
return (-1);
}
if (mask.am_success != mask.am_failure) {
flags |= M_SORF;
}
return (0);
}
/*
* .func process_fileopt - process command line file options.
* .desc Process the command line file options and gather the specified files
* together in file groups based upon file name suffix. The user can
* specify files explicitly on the command line or via a directory.
* This is called after the command line flags are processed (as
* denoted by '-').
* .call ret = process_fileopt(argc, argv, optindex).
* .arg argc - current value of argc.
* .arg argv - current value of argv.
* .arg optindex- current index into argv (as setup by getopt()).
* .ret 0 - no errors detected.
* .ret -1 - error detected (message already printed).
*/
int
process_fileopt(int argc, char **argv, int optindex)
{
int f_mode = FM_ALLDIR;
char f_dr[MAXNAMLEN+1];
char *f_dir = f_dr;
char *fname;
static char *std = "standard input";
audit_fcb_t *fcb;
DIR * dirp;
struct dirent *dp;
audit_pcb_t *pcb;
/*
* Take input from stdin, not any files.
* Use a single fcb to do this.
*/
if (f_stdin) {
fcb = (audit_fcb_t *)a_calloc(1, sizeof (*fcb) + strlen(std));
(void) strcpy(fcb->fcb_file, std);
fcb->fcb_suffix = fcb->fcb_name = fcb->fcb_file;
fcb->fcb_next = NULL;
fcb->fcb_start = 0;
fcb->fcb_end = MAXLONG; /* forever */
if ((pcb = get_next_pcb((char *)NULL)) == (audit_pcb_t *)NULL)
return (-1);
pcb->pcb_suffix = fcb->fcb_file;
pcb->pcb_dfirst = pcb->pcb_first = fcb; /* one-item list */
pcb->pcb_dlast = pcb->pcb_last = fcb;
pcb->pcb_cur = fcb;
}
/*
* No files specified on the command line.
* Process a directory of files or subdirectories.
*/
else if (argc == optindex) {
/*
* A specific server directory was requested.
*/
if (f_server) {
if (strchr(f_server, '/')) { /* given full path */
f_dir = f_server;
f_mode = FM_ALLFILE; /* all files here */
} else { /* directory off audit root */
f_dir[0] = '\0';
(void) strcat(f_dir, f_root);
(void) strcat(f_dir, "/");
(void) strcat(f_dir, f_server);
f_mode = FM_ALLFILE;
}
}
/*
* Gather all of the files in the directory 'f_dir'.
*/
if (f_mode == FM_ALLFILE) {
if (gather_dir(f_dir)) { /* get those files together */
return (-1);
}
} else {
/*
* Gather all of the files in all of the
* directories in 'f_root'.
*/
if ((dirp = opendir(f_root)) == NULL) {
(void) sprintf(errbuf, gettext(
"%s can't open directory %s"), ar, f_root);
perror(errbuf);
return (-1);
}
/* read the directory and process all of the subs */
for (dp = readdir(dirp);
dp != NULL; dp = readdir(dirp)) {
if (dp->d_name[0] == '.')
continue;
f_dir[0] = '\0';
(void) strcat(f_dir, f_root);
(void) strcat(f_dir, "/");
(void) strcat(f_dir, dp->d_name);
if (gather_dir(f_dir)) /* process a sub */
return (-1);
}
(void) closedir(dirp);
}
} else {
/*
* User specified filenames on the comm and line.
*/
f_cmdline = TRUE;
for (; optindex < argc; optindex++) {
fname = argv[optindex]; /* get a filename */
if (proc_file(fname, FALSE))
return (-1);
}
}
return (0);
}
/*
* .func gather_dir - gather a directory's files together.
* .desc Process all of the files in a specific directory. The files may
* be checked for adherence to the file name form at.
* If the directory can't be opened that is ok - just print
* a message and continue.
* .call ret = gather_dir(dir).
* .arg dir - ptr to full pathname of directory.
* .ret 0 - no errors detected.
* .ret -1 - error detected (message already printed).
*/
int
gather_dir(char *dir)
{
char dname[MAXNAMLEN+1];
char fname[MAXNAMLEN+1];
DIR * dirp;
struct dirent *dp;
(void) snprintf(dname, sizeof (dname), "%s/files", dir);
if ((dirp = opendir(dname)) == NULL) {
if (errno != ENOTDIR) {
(void) sprintf(errbuf,
gettext("%s can't open directory - %s"), ar, dname);
perror(errbuf);
}
return (0);
}
for (dp = readdir(dirp); dp != NULL; dp = readdir(dirp)) {
if (dp->d_name[0] == '.') /* can't see hidden files */
continue;
fname[0] = '\0';
(void) strcat(fname, dname); /* create pathname of file */
(void) strcat(fname, "/");
(void) strcat(fname, dp->d_name);
if (proc_file(fname, TRUE))
return (-1);
}
(void) closedir(dirp);
return (0);
}
/*
* .func proc_file - process a single candidate file.
* .desc Check out a file to see if it should be used in the merge.
* This includes checking the name (mode is TRUE) against the
* file format, checking access rights to the file, and thence
* getting and fcb and installing the fcb into the correct pcb.
* If the file fails then the fcb is not installed into a pcb
* and the file dissapears from view.
* .call proc_file(fname, mode).
* .arg fname - ptr to full pathna me of file.
* .arg mode - TRUE if checking adherence to file name format.
* .ret 0 - no fatal errors detected.
* .ret -1 - fatal error detected - quit altogether
* (message already printed).
*/
int
proc_file(char *fname, int mode)
{
int reject = FALSE;
size_t len;
struct stat stat_buf;
audit_fcb_t *fcb, *fcbp, *fcbprev;
audit_pcb_t *pcb;
/*
* See if it is a weird file like a directory or
* character special (around here?).
*/
if (stat(fname, &stat_buf)) {
return (0);
}
if (!S_ISREG(stat_buf.st_mode))
return (0);
/*
* Allocate a new fcb to hold fcb and full filename.
*/
len = sizeof (audit_fcb_t) + strlen(fname);
fcb = (audit_fcb_t *)a_calloc(1, len);
(void) strcpy(fcb->fcb_file, fname);
if (check_file(fcb, mode)) { /* check file name */
if (!f_quiet) {
(void) fprintf(stderr, "%s %s:\n %s.\n", ar,
error_str, fname);
}
reject = TRUE;
} else {
/*
* Check against file criteria.
* Check finish-time here, and start-time later on
* while processing.
* This is because the start time on a file can be after
* the first record(s).
*/
if (f_complete && (fcb->fcb_flags & FF_NOTTERM) && !f_cmdline)
reject = TRUE;
if (!f_all && (fcb->fcb_end < m_after))
reject = TRUE;
if (f_machine) {
if (strlen(fcb->fcb_suffix) != strlen(f_machine) ||
(strcmp(fcb->fcb_suffix, f_machine) != 0)) {
reject = TRUE;
}
}
}
if (reject == FALSE) {
filenum++; /* count of total files to be processed */
fcb->fcb_next = NULL;
if ((pcb = get_next_pcb(fcb->fcb_suffix)) == NULL) {
return (-1);
}
/* Place FCB into the PCB in order - oldest first. */
fcbp = pcb->pcb_first;
fcbprev = NULL;
while (fcbp != NULL) {
if (fcb->fcb_start < fcbp->fcb_start) {
if (fcbprev)
fcbprev->fcb_next = fcb;
else
pcb->pcb_dfirst = pcb->pcb_first = fcb;
fcb->fcb_next = fcbp;
break;
}
fcbprev = fcbp;
fcbp = fcbp->fcb_next;
}
/* younger than all || empty list */
if (!fcb->fcb_next) {
if (pcb->pcb_first == NULL)
pcb->pcb_dfirst = pcb->pcb_first = fcb;
pcb->pcb_dlast = pcb->pcb_last = fcb;
if (fcbprev)
fcbprev->fcb_next = fcb;
}
} else {
free((char *)fcb); /* rejected */
}
return (0);
}
/*
* .func check_file - check filename and setup fcb.
* .desc Check adherence to the file format (do_check is TRUE) and setup
* the fcb with useful information.
* filename format: yyyymmddhhmmss.yyyymmddhhmmss.suffix
* yyyymmddhhmmss.not_terminated.suffix
* If do_check is FALSE then still see if the filename does confirm
* to the format. If it does then extract useful information from
* it (start time and end time). But if it doesn't then don't print
* any error messages.
* .call ret = check_file(fcb, do_check).
* .arg fcb - ptr to fcb that holds the file.
* .arg do_check - if TRUE do check adherence to file format.
* .ret 0 - no errors detected.
* .ret -1 - file failed somehow (error_str tells why).
*/
int
check_file(audit_fcb_t *fcb, int do_check)
{
int ret;
char *namep, *slp;
char errb[256]; /* build error message */
struct tm tme;
errb[0] = '\0';
/* get just the filename */
for (slp = namep = fcb->fcb_file; *namep; namep++) {
if (*namep == '/')
slp = namep + 1; /* slp -> the filename itself */
}
if (do_check == FALSE) {
fcb->fcb_end = MAXLONG; /* forever */
fcb->fcb_suffix = NULL;
fcb->fcb_name = slp;
ret = 0;
} else {
ret = -1;
}
if ((int)strlen(slp) < 31) {
(void) sprintf(errbuf, gettext("filename too short (%d)"),
strlen(slp));
error_str = errbuf;
return (ret);
}
/*
* Get working copy of filename.
*/
namep = (char *)a_calloc(1, strlen(slp) + 1);
(void) strcpy(namep, slp);
if (namep[14] != '.' || namep[29] != '.') {
(void) sprintf(errbuf,
gettext("invalid filename format (%c or %c)"), namep[14],
namep[29]);
error_str = errbuf;
free(namep);
return (ret);
}
namep[14] = '\0'; /* mark off start time */
namep[29] = '\0'; /* mark off finish time */
if (derive_date(namep, &tme)) {
(void) strcat(errb, gettext("starting time-stamp invalid - "));
(void) strcat(errb, error_str);
(void) strcpy(errbuf, errb);
error_str = errbuf;
free(namep);
return (ret);
}
/*
* Keep start time from filename. Use it to order files in
* the file list. Later we will update this when we read
* the first record from the file.
*/
fcb->fcb_start = tm_to_secs(&tme);
if (strcmp(&namep[15], "not_terminated") == 0) {
fcb->fcb_end = MAXLONG; /* forever */
/*
* Only treat a 'not_terminated' file as such if
* it is not on the command line.
*/
if (do_check == TRUE)
fcb->fcb_flags |= FF_NOTTERM;
} else if (derive_date(&namep[15], &tme)) {
(void) strcat(errb, gettext("ending time-stamp invalid - "));
(void) strcat(errb, error_str);
(void) strcpy(errbuf, errb);
error_str = errbuf;
free(namep);
return (ret);
} else {
fcb->fcb_end = tm_to_secs(&tme);
}
fcb->fcb_name = slp;
fcb->fcb_suffix = &slp[30];
free(namep);
return (0);
}
/*
* .func get_next_pcb - get a pcb to use.
* .desc The pcb's in the array audit_pcbs are used to hold single file
* groups in the form of a linked list. Each pcb holds files that
* are tied together by a common suffix in the file name. Here we
* get either 1. the existing pcb holding a specified sufix or
* 2. a new pcb if we can't find an existing one.
* .call pcb = get_next_pcb(suffix).
* .arg suffix - ptr to suffix we are seeking.
* .ret pcb - ptr to pcb that hold s the sought suffix.
* .ret NULL- serious failure in memory allocation. Quit processing.
*/
audit_pcb_t *
get_next_pcb(char *suffix)
{
int i = 0;
int zerosize;
unsigned int size;
audit_pcb_t *pcb;
/* Search through (maybe) entire array. */
while (i < pcbsize) {
pcb = &audit_pcbs[i++];
if (pcb->pcb_first == NULL) {
proc_pcb(pcb, suffix, i);
return (pcb); /* came to an unused one */
}
if (suffix) {
if (strcmp(pcb->pcb_suffix, suffix) == 0)
return (pcb); /* matched one with suffix */
}
}
/*
* Uh-oh, the entire array is used and we haven't gotten one yet.
* Allocate a bigger array.
*/
pcbsize += PCB_INC;
size = pcbsize * sizeof (audit_pcb_t);
zerosize = size - ((pcbsize - PCB_INC) * sizeof (audit_pcb_t));
if ((audit_pcbs = (audit_pcb_t *)realloc((char *)audit_pcbs, size)) ==
NULL) {
(void) sprintf(errbuf,
gettext("%s memory reallocation failed (%d bytes)"), ar,
size);
perror(errbuf);
audit_stats(); /* give user statistics on usage */
return (NULL); /* really bad thing to have happen */
}
/*
* Don't know if realloc clears the new memory like calloc would.
*/
(void) memset((void *) & audit_pcbs[pcbsize-PCB_INC], 0,
(size_t)zerosize);
pcb = &audit_pcbs[pcbsize-PCB_INC]; /* allocate the first new one */
proc_pcb(pcb, suffix, pcbsize - PCB_INC);
return (pcb);
}
/*
* .func proc_pcb - process pcb.
* .desc Common pcb processing for above routine.
* .call proc_pcb(pcb, suffix, i).
* .arg pcb - ptr to pcb.
* .arg suffix - prt to suffix tha t ties this group together.
* .arg i - index into audit_pcbs[ ].
* .ret void.
*/
void
proc_pcb(audit_pcb_t *pcb, char *suffix, int i)
{
if (suffix)
pcb->pcb_suffix = suffix;
pcbnum++; /* one more pcb in use */
pcb->pcb_size = AUDITBUFSIZE;
pcb->pcb_rec = (char *)a_calloc(1, AUDITBUFSIZE);
pcb->pcb_time = -1;
pcb->pcb_flags |= PF_USEFILE; /* note this one controls files */
pcb->pcb_procno = i; /* save index into audit_pcbs [] for id */
}
/*
* .func proc_label - process label range argument.
* .desc Parse label range lower-bound[;upper-bound]
* .call ret = proc_label(optstr).
* .arg opstr - ptr to label range string
* .ret 0 - no errors detected.
* .ret -1 - errors detected (error_str set).
*/
int
proc_label(char *optstr)
{
char *p;
int error;
if (flags & M_LABEL) {
error_str = gettext("'l' option specified multiple times");
return (-1);
}
flags |= M_LABEL;
if ((m_label = malloc(sizeof (m_range_t))) == NULL) {
return (-1);
}
m_label->lower_bound = NULL;
m_label->upper_bound = NULL;
p = strchr(optstr, ';');
if (p == NULL) {
/* exact label match, lower and upper range bounds the same */
if (str_to_label(optstr, &m_label->lower_bound, MAC_LABEL,
L_NO_CORRECTION, &error) == -1) {
(void) sprintf(errbuf,
gettext("invalid sensitivity label (%s) err %d"),
optstr, error);
error_str = errbuf;
goto errout;
}
m_label->upper_bound = m_label->lower_bound;
return (0);
}
if (p == optstr) {
/* lower bound is not specified .. default is admin_low */
if (str_to_label(ADMIN_LOW, &m_label->lower_bound, MAC_LABEL,
L_NO_CORRECTION, &error) == -1) {
goto errout;
}
p++;
if (*p == '\0') {
/* upper bound not specified .. default is admin_high */
if (str_to_label(ADMIN_HIGH, &m_label->upper_bound,
MAC_LABEL, L_NO_CORRECTION, &error) == -1) {
goto errout;
}
} else {
if (str_to_label(p, &m_label->upper_bound, MAC_LABEL,
L_NO_CORRECTION, &error) == -1) {
(void) sprintf(errbuf, gettext(
"invalid sensitivity label (%s) err %d"),
p, error);
error_str = errbuf;
goto errout;
}
}
return (0);
}
*p++ = '\0';
if (str_to_label(optstr, &m_label->lower_bound, MAC_LABEL,
L_NO_CORRECTION, &error) == -1) {
(void) sprintf(errbuf,
gettext("invalid sensitivity label (%s) err %d"), optstr,
error);
error_str = errbuf;
goto errout;
}
if (*p == '\0') {
/* upper bound is not specified .. default is admin_high */
if (str_to_label(ADMIN_HIGH, &m_label->upper_bound,
MAC_LABEL, L_NO_CORRECTION, &error) == -1) {
goto errout;
}
} else {
if (str_to_label(p, &m_label->upper_bound, MAC_LABEL,
L_NO_CORRECTION, &error) == -1) {
(void) sprintf(errbuf,
gettext("invalid sensitivity label (%s) err %d"),
p, error);
error_str = errbuf;
goto errout;
}
}
/* make sure that upper bound dominates the lower bound */
if (!bldominates(m_label->upper_bound, m_label->lower_bound)) {
*--p = ';';
(void) sprintf(errbuf,
gettext("invalid sensitivity label range (%s)"), optstr);
error_str = errbuf;
goto errout;
}
return (0);
errout:
m_label_free(m_label->upper_bound);
m_label_free(m_label->lower_bound);
free(m_label);
return (-1);
}
/*
* proc_zonename - pick up zone name.
*
* all non-empty and not-too-long strings are valid since any name
* may be valid.
*
* ret 0: non-empty string
* ret -1: empty string or string is too long.
*/
static int
proc_zonename(char *optstr)
{
size_t length = strlen(optstr);
if ((length < 1) || (length > ZONENAME_MAX)) {
(void) sprintf(errbuf,
gettext("invalid zone name: %s"), optstr);
error_str = errbuf;
return (-1);
}
zonename = strdup(optstr);
flags |= M_ZONENAME;
return (0);
}
/*
* proc_frmi - set up frmi for pattern matching.
* Logic ripped off of scf_walk_fmri()
* Thanks to the smf team.
*
* ret 0: OK
* ret -1: error
*/
static int
proc_fmri(char *optstr)
{
if (strpbrk(optstr, "*?[") != NULL) {
/* have a pattern to glob for */
fmri.sp_type = PATTERN_GLOB;
if (optstr[0] == '*' ||
(strlen(optstr) >= 4 && optstr[3] == ':')) {
fmri.sp_arg = strdup(optstr);
} else if ((fmri.sp_arg = malloc(strlen(optstr) + 6)) != NULL) {
(void) snprintf(fmri.sp_arg, strlen(optstr) + 6,
"svc:/%s", optstr);
}
} else {
fmri.sp_type = PATTERN_PARTIAL;
fmri.sp_arg = strdup(optstr);
}
if (fmri.sp_arg == NULL)
return (-1);
return (0);
}