OpenSolaris_b135/lib/auditd_plugins/syslog/sysplugin.c
/*
* CDDL HEADER START
*
* The contents of this file are subject to the terms of the
* Common Development and Distribution License (the "License").
* You may not use this file except in compliance with the License.
*
* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
* or http://www.opensolaris.org/os/licensing.
* See the License for the specific language governing permissions
* and limitations under the License.
*
* When distributing Covered Code, include this CDDL HEADER in each
* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
* If applicable, add the following below this CDDL HEADER, with the
* fields enclosed by brackets "[]" replaced with your own identifying
* information: Portions Copyright [yyyy] [name of copyright owner]
*
* CDDL HEADER END
*/
/*
* Copyright 2010 Sun Microsystems, Inc. All rights reserved.
* Use is subject to license terms.
*
* convert binary audit records to syslog messages and
* send them off to syslog
*
*/
/*
* auditd_plugin_open(), auditd_plugin() and auditd_plugin_close()
* implement a replacable library for use by auditd; they are a
* project private interface and may change without notice.
*
*/
#define DEBUG 0
#if DEBUG
#define DPRINT(x) { (void) fprintf x; }
#else
#define DPRINT(x)
#endif
#include <arpa/inet.h>
#include <assert.h>
#include <errno.h>
#include <fcntl.h>
#include <grp.h>
#include <libintl.h>
#include <netdb.h>
#include <netinet/in.h>
#include <pthread.h>
#include <pwd.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <time.h>
#include <syslog.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <unistd.h>
#include <bsm/audit.h>
#include <bsm/audit_record.h>
#include <security/auditd.h>
#include "toktable.h"
#include "sysplugin.h"
#include "systoken.h"
#include <audit_plugin.h>
/* gettext() obfuscation routine for lint */
#ifdef __lint
#define gettext(x) x
#endif
#if DEBUG
static FILE *dbfp; /* debug file */
#endif
extern void init_tokens();
extern int parse_token(parse_context_t *);
static au_mask_t mask;
static int initialized = 0;
static size_t maxavail;
static pthread_mutex_t log_mutex;
#define ELLIPSIS "..."
#define ELLIPSIS_SIZE (sizeof (ELLIPSIS) - 1)
/*
* simple hashing for uid and hostname lookup
*
* performance tests showed that cacheing the hostname, uid, and gid
* make about a 40% difference for short audit records and regularly
* repeating hostname, uid, etc
*
* ht_type and ht_ip are only used for hostname lookup cacheing.
*/
typedef struct hashtable {
uint32_t ht_key;
uint32_t ht_type;
uint32_t ht_ip[4];
char *ht_value;
size_t ht_length;
} hashtable_t;
#define HOSTHASHSIZE 128
#define UIDHASHSIZE 128
#define GIDHASHSIZE 32
static hashtable_t uidhash[UIDHASHSIZE];
static hashtable_t gidhash[GIDHASHSIZE];
static hashtable_t hosthash[HOSTHASHSIZE];
#define STRCONSTARGS(s) (s), (sizeof (s) - 1)
/*
* the hash "handles" collisions by overwriting the old
* hash entry with the new. Perfection is not the goal.
*
* the key (s) is a 32 bit integer, handled here as
* four bytes. If the hash size is increased beyond
* 256, this macro will need some work.
*/
#define HASH(s, r, m) {\
uint32_t _mush = 0;\
int _i;\
for (_i = 0; _i < 4; _i++) {\
_mush ^= *(s)++;\
}\
r = _mush % m;\
}
/*
* The default mask for sysplugin is to reject all record types.
* The parameters input here select which classes to allow.
*
* getauditflgsbin() outputs error messages to syslog.
*
* caller must hold log_mutex
*/
static auditd_rc_t
setmask(const char *flags)
{
au_mask_t tmask;
char *input, *ip, c;
auditd_rc_t rc = AUDITD_SUCCESS;
mask.am_success = 0x0;
mask.am_failure = 0x0;
if (flags != NULL) {
/*
* getauditflagsbin doesn't like blanks, but admins do
*/
input = malloc(strlen(flags) + 1);
if (input == NULL)
return (AUDITD_NO_MEMORY);
ip = input;
for (; (c = *flags) != '\0'; flags++) {
if (c == ' ')
continue;
*ip++ = c;
}
*ip = '\0';
if (getauditflagsbin(input, &tmask) == 0) {
mask.am_success |= tmask.am_success;
mask.am_failure |= tmask.am_failure;
}
}
if ((mask.am_success | mask.am_failure) == 0) {
rc = AUDITD_INVALID;
__audit_syslog("audit_syslog.so", LOG_CONS | LOG_NDELAY,
LOG_DAEMON, LOG_ERR,
gettext("plugin is configured with empty class mask\n"));
}
free(input);
return (rc);
}
/*
* based on the current value of mask, either keep or toss the
* current audit record. The input is 1 for success, -1 for
* failure. 0 means no exit or return token was seen.
*
* au_preselect returns 1 for keep it, 0 for delete it, and
* -1 for some sort of error. Here, 1 and -1 are considered
* equivalent. tossit() returns 1 for delete it and 0 for
* keep it.
*/
static int
tossit(au_event_t id, int passfail)
{
int rc;
int selFlag;
switch (passfail) {
case 1:
selFlag = AU_PRS_SUCCESS;
break;
case -1:
selFlag = AU_PRS_FAILURE;
break;
default: /* no exit or return token */
selFlag = AU_PRS_BOTH;
break;
}
(void) pthread_mutex_lock(&log_mutex);
rc = au_preselect(id, &mask, selFlag, AU_PRS_USECACHE);
(void) pthread_mutex_unlock(&log_mutex);
return (rc == 0);
}
/*
* the three bytes for ellipsis could potentially be longer than the
* space available for text if maxavail is within two bytes of
* OUTPUT_BUF_SIZE, which can happen if the hostname is one or two
* characters long. If there isn't room for ellipsis, there isn't
* room for the data, so it is simply dropped.
*/
static size_t
fromleft(char *p, size_t avail, char *attrname, size_t attrlen, char *txt,
size_t txtlen)
{
size_t len;
if (avail < attrlen + ELLIPSIS_SIZE)
return (0);
(void) memcpy(p, attrname, attrlen);
p += attrlen;
avail -= attrlen;
if (txtlen > avail) {
(void) memcpy(p, ELLIPSIS, ELLIPSIS_SIZE);
txt += txtlen - (avail - ELLIPSIS_SIZE);
(void) memcpy(p + ELLIPSIS_SIZE, txt, avail - ELLIPSIS_SIZE);
len = attrlen + avail;
p += avail;
} else {
(void) memcpy(p, txt, txtlen);
len = attrlen + txtlen;
p += txtlen;
}
*p = '\0';
return (len);
}
static size_t
fromright(char *p, size_t avail, char *attrname, size_t attrlen, char *txt,
size_t txtlen)
{
size_t len;
if (avail < attrlen + ELLIPSIS_SIZE)
return (0);
(void) memcpy(p, attrname, attrlen);
p += attrlen;
avail -= attrlen;
if (txtlen > avail) {
(void) memcpy(p, txt, avail - ELLIPSIS_SIZE);
(void) memcpy(p + (avail - ELLIPSIS_SIZE),
ELLIPSIS, ELLIPSIS_SIZE);
len = attrlen + avail;
p += avail;
} else {
(void) memcpy(p, txt, txtlen);
p += txtlen;
len = attrlen + txtlen;
}
*p = '\0';
return (len);
}
static int
init_hash(hashtable_t *table, int bad_key, int table_length,
size_t max_value)
{
int i;
for (i = 0; i < table_length; i++) {
table[i].ht_value = malloc(max_value + 1);
table[i].ht_key = bad_key;
table[i].ht_length = 0;
if (table[i].ht_value == NULL) {
int j;
for (j = 0; j < i; j++)
free(table[j].ht_value);
return (-1);
}
*(table[i].ht_value) = '\0';
}
return (0);
}
static void
free_hash(hashtable_t *table, int table_length)
{
int i;
for (i = 0; i < table_length; i++) {
free(table[i].ht_value);
}
}
/*
* do IP -> hostname lookup
*/
#define UNKNOWN "unknown"
#define UNKNOWN_LEN (sizeof (UNKNOWN))
static size_t
gethname(au_tid_addr_t *tid, char *p, size_t max, char *prefix,
size_t prefix_len)
{
size_t len, l;
struct hostent *host;
int rc;
int af;
int ix;
char *hash_key;
uint32_t key;
int match;
if (prefix_len > max)
return (0);
(void) memcpy(p, prefix, prefix_len);
p += prefix_len;
max -= prefix_len;
if (tid->at_type == AU_IPv6) {
key = tid->at_addr[0] ^
tid->at_addr[1] ^
tid->at_addr[2] ^
tid->at_addr[3];
} else
key = (tid->at_addr[0]);
hash_key = (char *)&key;
HASH(hash_key, ix, HOSTHASHSIZE);
match = 0;
if (key == 0) {
l = UNKNOWN_LEN; /* includes end of string */
if (l > max)
l = max;
len = prefix_len + strlcpy(p, UNKNOWN, l);
return (len);
}
if (tid->at_type == AU_IPv6) {
if ((key == hosthash[ix].ht_key) &&
(hosthash[ix].ht_type == tid->at_type)) {
int i;
match = 1;
for (i = 0; i < 4; i++) {
if (hosthash[ix].ht_ip[i] != tid->at_addr[i]) {
match = 0;
break;
}
}
}
} else if (key == hosthash[ix].ht_key) {
match = 1;
}
if (!match) {
hosthash[ix].ht_key = key;
hosthash[ix].ht_type = tid->at_type;
if (tid->at_type == AU_IPv4) {
hosthash[ix].ht_ip[0] = tid->at_addr[0];
af = AF_INET;
} else {
(void) memcpy((char *)hosthash[ix].ht_ip,
(char *)tid->at_addr, AU_IPv6);
af = AF_INET6;
}
host = getipnodebyaddr((const void *)tid->at_addr,
tid->at_type, af, &rc);
if (host == NULL) {
(void) inet_ntop(af, (void *)tid->at_addr,
hosthash[ix].ht_value, MAXHOSTNAMELEN);
hosthash[ix].ht_length = strlen(hosthash[ix].ht_value);
} else {
hosthash[ix].ht_length = strlcpy(hosthash[ix].ht_value,
host->h_name, MAXHOSTNAMELEN);
freehostent(host);
}
}
l = hosthash[ix].ht_length + 1;
if (l > max)
l = max;
len = prefix_len + strlcpy(p, hosthash[ix].ht_value, l);
return (len);
}
/*
* the appropriate buffer length for getpwuid_r() isn't documented;
* 1024 should be enough.
*/
#define GETPWUID_BUFF_LEN 1024
#define USERNAMELEN 256
#define GIDNAMELEN 256
static size_t
getuname(uid_t uid, gid_t gid, char *p, size_t max, char *prefix,
size_t prefix_len)
{
struct passwd pw;
char pw_buf[GETPWUID_BUFF_LEN];
size_t len, l;
struct group gr;
int ix;
char *hash_key;
if (prefix_len > max)
return (0);
len = prefix_len;
(void) memcpy(p, prefix, len);
p += len;
max -= len;
hash_key = (char *)&uid;
HASH(hash_key, ix, UIDHASHSIZE);
if (uid != uidhash[ix].ht_key) {
uidhash[ix].ht_key = uid;
if ((getpwuid_r(uid, &pw, pw_buf, GETPWUID_BUFF_LEN)) == NULL)
l = snprintf(uidhash[ix].ht_value, USERNAMELEN,
"%d", uid);
else
l = strlcpy(uidhash[ix].ht_value, pw.pw_name,
USERNAMELEN);
uidhash[ix].ht_length = l;
}
l = uidhash[ix].ht_length + 1;
if (l > max)
l = max;
(void) memcpy(p, uidhash[ix].ht_value, l);
len += l - 1;
if (gid != (gid_t)-2) {
p += l - 1;
max -= l - 1;
if (max < 2)
return (len);
hash_key = (char *)&gid;
HASH(hash_key, ix, GIDHASHSIZE);
if (gid != gidhash[ix].ht_key) {
gidhash[ix].ht_key = gid;
if (getgrgid_r(gid, &gr, pw_buf, GETPWUID_BUFF_LEN) ==
NULL)
gidhash[ix].ht_length =
snprintf(gidhash[ix].ht_value, GIDNAMELEN,
"%d", gid);
else
gidhash[ix].ht_length =
strlcpy(gidhash[ix].ht_value,
gr.gr_name, GIDNAMELEN);
}
*p++ = ':';
len++;
max--;
l = gidhash[ix].ht_length + 1;
if (l > max)
l = max;
(void) memcpy(p, gidhash[ix].ht_value, l);
len += l - 1;
}
return (len);
}
/*
* filter() parse input; toss if not wanted.
*
* the input value sequence is a number generated when the buffer
* was queued. ctx.out.sf_sequence, if not -1, is the sequence number
* generated in c2audit. It is not part of the "official" syslog
* output but is included if DEBUG is on.
*/
#define EVENT_NAME_LEN 32
static auditd_rc_t
filter(const char *input, uint64_t sequence, char *output,
size_t in_len, size_t out_len)
{
parse_context_t ctx;
char *bp;
auditd_rc_t rc = AUDITD_SUCCESS;
auditd_rc_t rc_ret = AUDITD_SUCCESS;
size_t used, remaining;
char *last_adr; /* infinite loop check */
int token_count = 0;
int parse_rc;
static parse_context_t initial_ctx;
static int first = 1;
if (first) {
first = 0;
/*
* Any member or submember of parse_context_t which utilizes
* allocated memory must free() the memory after calling
* parse_token() for both the preselected and non-preselected
* cases.
* New additions to parse_context_t or its submembers need to
* have this same treatment.
*/
initial_ctx.out.sf_eventid = 0;
initial_ctx.out.sf_reclen = 0;
initial_ctx.out.sf_pass = 0;
initial_ctx.out.sf_asid = 0;
initial_ctx.out.sf_auid = (uid_t)-2;
initial_ctx.out.sf_euid = (uid_t)-2;
initial_ctx.out.sf_egid = (gid_t)-2;
initial_ctx.out.sf_tid.at_type = 0;
initial_ctx.out.sf_pauid = (uid_t)-2;
initial_ctx.out.sf_peuid = (uid_t)2;
initial_ctx.out.sf_uauthlen = 0;
initial_ctx.out.sf_uauth = NULL;
initial_ctx.out.sf_pathlen = 0;
initial_ctx.out.sf_path = NULL;
initial_ctx.out.sf_atpathlen = 0;
initial_ctx.out.sf_atpath = NULL;
initial_ctx.out.sf_textlen = 0;
initial_ctx.out.sf_text = NULL;
initial_ctx.out.sf_sequence = -1;
initial_ctx.out.sf_zonelen = 0;
initial_ctx.out.sf_zonename = NULL;
init_tokens(); /* cmd/praudit/toktable.c */
}
(void) memcpy(&ctx, &initial_ctx, sizeof (parse_context_t));
ctx.id = sequence;
ctx.adr.adr_stream = (char *)input;
ctx.adr.adr_now = (char *)input;
last_adr = NULL;
while ((ctx.adr.adr_now - ctx.adr.adr_stream) < in_len) {
assert(last_adr != ctx.adr.adr_now);
token_count++;
last_adr = ctx.adr.adr_now;
if ((parse_rc = parse_token(&ctx)) != 0) {
char message[256];
au_event_ent_t *event;
char event_name[EVENT_NAME_LEN];
char sequence_str[EVENT_NAME_LEN];
if (cacheauevent(&event, ctx.out.sf_eventid) < 0)
(void) snprintf(event_name, EVENT_NAME_LEN,
"%hu", ctx.out.sf_eventid);
else
(void) strlcpy(event_name, event->ae_desc,
EVENT_NAME_LEN);
if (token_count < 2)
/* leave rc_ret unchanged */
rc = AUDITD_INVALID;
if (ctx.out.sf_sequence != -1)
(void) snprintf(sequence_str, EVENT_NAME_LEN,
" (seq=%u) ", ctx.out.sf_sequence);
else
sequence_str[0] = '\0';
(void) snprintf(message, 256,
gettext("error before token %d (previous token=%d)"
" of record type %s%s\n"),
token_count, parse_rc, event_name, sequence_str);
#if DEBUG
/*LINTED*/
(void) fprintf(dbfp, message);
#endif
__audit_syslog("audit_syslog.so",
LOG_PID | LOG_ODELAY | LOG_CONS,
LOG_DAEMON, LOG_ALERT, message);
break;
}
}
if (rc == AUDITD_SUCCESS) {
if (tossit(ctx.out.sf_eventid, ctx.out.sf_pass)) {
#if DEBUG
if (ctx.out.sf_sequence != -1)
(void) fprintf(dbfp,
"syslog tossed (event=%hu) record %u "
"/ buffer %llu\n",
ctx.out.sf_eventid, ctx.out.sf_sequence,
sequence);
else
(void) fprintf(dbfp,
"syslog tossed (event=%hu) buffer %llu\n",
ctx.out.sf_eventid, sequence);
#endif
/*
* Members or submembers of parse_context_t which
* utilize allocated memory need to free() the memory
* here to handle the case of not being preselected as
* well as below for when the event is preselected.
* New additions to parse_context_t or any of its
* submembers need to get the same treatment.
*/
if (ctx.out.sf_uauthlen > 0) {
free(ctx.out.sf_uauth);
ctx.out.sf_uauth = NULL;
ctx.out.sf_uauthlen = 0;
}
if (ctx.out.sf_pathlen > 0) {
free(ctx.out.sf_path);
ctx.out.sf_path = NULL;
ctx.out.sf_pathlen = 0;
}
if (ctx.out.sf_atpathlen > 0) {
free(ctx.out.sf_atpath);
ctx.out.sf_atpath = NULL;
ctx.out.sf_atpathlen = 0;
}
if (ctx.out.sf_textlen > 0) {
free(ctx.out.sf_text);
ctx.out.sf_text = NULL;
ctx.out.sf_textlen = 0;
}
if (ctx.out.sf_zonelen > 0) {
free(ctx.out.sf_zonename);
ctx.out.sf_zonename = NULL;
ctx.out.sf_zonelen = 0;
}
return (-1); /* tell caller it was tossed */
}
bp = output;
remaining = out_len;
if (ctx.out.sf_eventid != 0) {
au_event_ent_t *event;
if (cacheauevent(&event, ctx.out.sf_eventid) < 0)
used = snprintf(bp, remaining, "%hu",
ctx.out.sf_eventid);
else
used = strlcpy(bp, event->ae_desc, remaining);
bp += used;
remaining -= used;
}
if (ctx.out.sf_pass != 0) {
if (ctx.out.sf_pass < 0)
used = strlcpy(bp, " failed", remaining);
else
used = strlcpy(bp, " ok", remaining);
bp += used;
remaining -= used;
}
if (ctx.out.sf_asid != 0) {
used = snprintf(bp, remaining, " session %u",
ctx.out.sf_asid);
remaining -= used;
bp += used;
}
if (ctx.out.sf_auid != (uid_t)-2) {
used = getuname(ctx.out.sf_auid, -2, bp, remaining,
STRCONSTARGS(" by "));
bp += used;
remaining -= used;
}
if (ctx.out.sf_euid != (uid_t)-2) {
/* 4 = strlen(" as ") */
used = getuname(ctx.out.sf_euid, ctx.out.sf_egid, bp,
remaining, STRCONSTARGS(" as "));
bp += used;
remaining -= used;
}
if (ctx.out.sf_zonename != NULL) {
used = fromright(bp, remaining,
STRCONSTARGS(" in "),
ctx.out.sf_zonename, ctx.out.sf_zonelen);
free(ctx.out.sf_zonename);
bp += used;
remaining -= used;
}
if (ctx.out.sf_tid.at_type != 0) {
/* 6 = strlen(" from ") */
used = gethname(&(ctx.out.sf_tid), bp, remaining,
STRCONSTARGS(" from "));
bp += used;
remaining -= used;
}
if (ctx.out.sf_pauid != (uid_t)-2) {
/* 11 = strlen(" proc_auid ") */
used = getuname(ctx.out.sf_pauid, -2, bp, remaining,
STRCONSTARGS(" proc_auid "));
bp += used;
remaining -= used;
}
if (ctx.out.sf_peuid != (uid_t)-2) {
used = getuname(ctx.out.sf_peuid, -2, bp, remaining,
STRCONSTARGS(" proc_uid "));
bp += used;
remaining -= used;
}
#if DEBUG
/*
* with performance testing, this has the effect of
* making that each message is unique, so syslogd
* won't collect a series of messages as "last message
* repeated n times," another reason why DEBUG 0
* should perform better than DEBUG 1. However the
* intention is to help debug lost data problems
*/
if (ctx.out.sf_sequence != -1) {
(void) fprintf(dbfp,
"syslog writing record %u / buffer %llu\n",
ctx.out.sf_sequence, sequence);
used = snprintf(bp, remaining, " seq %u",
ctx.out.sf_sequence, sequence);
remaining -= used;
bp += used;
} else
(void) fprintf(dbfp, "syslog writing buffer %llu\n",
sequence);
#endif
/*
* Long fields that may need truncation go here in
* order of decreasing priority. Paths are truncated
* from the left, text from the right.
*/
if (ctx.out.sf_path != NULL) {
used = fromleft(bp, remaining, STRCONSTARGS(" obj "),
ctx.out.sf_path, ctx.out.sf_pathlen);
free(ctx.out.sf_path);
bp += used;
remaining -= used;
}
if (ctx.out.sf_atpath != NULL) {
used = fromleft(bp, remaining,
STRCONSTARGS(" attr_obj "),
ctx.out.sf_atpath, ctx.out.sf_atpathlen);
free(ctx.out.sf_atpath);
bp += used;
remaining -= used;
}
if (ctx.out.sf_uauth != NULL) {
used = fromright(bp, remaining, STRCONSTARGS(" uauth "),
ctx.out.sf_uauth, ctx.out.sf_uauthlen);
free(ctx.out.sf_path);
bp += used;
remaining -= used;
}
if (ctx.out.sf_text != NULL) {
used = fromright(bp, remaining,
STRCONSTARGS(AU_TEXT_NAME),
ctx.out.sf_text, ctx.out.sf_textlen);
free(ctx.out.sf_text);
bp += used;
remaining -= used;
}
}
return (rc_ret);
}
/*
* 1024 is max syslog record size, 48 is minimum header length,
* assuming a hostname length of 0. maxavail reduces use of the
* allocated space by the length of the hostname (see maxavail)
*/
#define OUTPUT_BUF_SIZE 1024 - 48
/* ARGSUSED */
auditd_rc_t
auditd_plugin(const char *input, size_t in_len, uint64_t sequence, char **error)
{
char *outbuf;
auditd_rc_t rc = AUDITD_SUCCESS;
#if DEBUG
static uint64_t last_sequence = 0;
static uint64_t write_count = 0;
static uint64_t toss_count = 0;
if ((last_sequence > 0) && (sequence != last_sequence + 1))
(void) fprintf(dbfp,
"syslog: buffer sequence=%llu but prev=%llu\n",
sequence, last_sequence);
last_sequence = sequence;
#endif
*error = NULL;
outbuf = malloc(OUTPUT_BUF_SIZE);
if (outbuf == NULL) {
DPRINT((dbfp, "syslog: out of memory; seq=%llu\n",
sequence));
rc = AUDITD_NO_MEMORY;
*error = strdup(gettext("Can't allocate buffers"));
} else {
rc = filter(input, sequence, outbuf, in_len, maxavail);
if (rc == AUDITD_SUCCESS) {
__audit_syslog("audit", LOG_NDELAY,
LOG_AUDIT, LOG_NOTICE, outbuf);
DPRINT((dbfp, "syslog: write_count=%llu, "
"buffer=%llu, tossed=%llu\n",
++write_count, sequence, toss_count));
} else if (rc > 0) { /* -1 == discard it */
DPRINT((dbfp, "syslog: parse failed for buffer %llu\n",
sequence));
*error = strdup(gettext(
"Unable to parse audit record"));
} else {
DPRINT((dbfp, "syslog: rc = %d (-1 is discard), "
"sequence=%llu, toss_count=%llu\n",
rc, sequence, ++toss_count));
rc = 0;
}
free(outbuf);
}
return (rc);
}
auditd_rc_t
auditd_plugin_open(const kva_t *kvlist, char **ret_list, char **error)
{
char localname[MAXHOSTNAMELEN + 1];
auditd_rc_t rc;
char *value;
/* kva_match doesn't do const, so copy the pointer */
kva_t *kva = (kva_t *)kvlist;
*error = NULL;
*ret_list = NULL;
if ((kvlist == NULL) || ((value = kva_match(kva, "p_flags")) == NULL)) {
*error = strdup(gettext(
"The \"p_flags\" attribute is missing."));
return (AUDITD_INVALID);
}
if (!initialized) {
#if DEBUG
dbfp = __auditd_debug_file_open();
#endif
initialized = 1;
(void) pthread_mutex_init(&log_mutex, NULL);
/*
* calculate length of the local hostname for adjusting the
* estimate of how much space is taken by the syslog header.
* If the local hostname isn't available, leave some room
* anyway. (The -2 is for the blanks on either side of the
* hostname in the syslog message.)
*/
(void) pthread_mutex_lock(&log_mutex);
if (gethostname(localname, MAXHOSTNAMELEN))
maxavail = OUTPUT_BUF_SIZE - 20;
else
maxavail = OUTPUT_BUF_SIZE - strlen(localname) - 2;
(void) pthread_mutex_unlock(&log_mutex);
if (init_hash(hosthash, 0, HOSTHASHSIZE, MAXHOSTNAMELEN))
return (AUDITD_NO_MEMORY);
if (init_hash(uidhash, -2, UIDHASHSIZE, USERNAMELEN))
return (AUDITD_NO_MEMORY);
if (init_hash(gidhash, -2, GIDHASHSIZE, GIDNAMELEN))
return (AUDITD_NO_MEMORY);
}
(void) pthread_mutex_lock(&log_mutex);
if ((rc = setmask(value)) != AUDITD_SUCCESS)
*error = strdup(gettext(
"incorrect p_flags setting; no records will be output"));
(void) pthread_mutex_unlock(&log_mutex);
return (rc);
}
auditd_rc_t
auditd_plugin_close(char **error)
{
*error = NULL;
if (initialized) {
(void) pthread_mutex_destroy(&log_mutex);
free_hash(hosthash, HOSTHASHSIZE);
free_hash(uidhash, UIDHASHSIZE);
free_hash(gidhash, GIDHASHSIZE);
}
initialized = 0;
return (AUDITD_SUCCESS);
}