OpenSolaris_b135/lib/libbsm/common/audit_kadmind.c

/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 *
 */
#include <sys/types.h>
#include <sys/param.h>
#include <stdio.h>
#include <sys/fcntl.h>
#include <bsm/audit.h>
#include <bsm/audit_record.h>
#include <bsm/audit_uevents.h>
#include <bsm/libbsm.h>
#include <stdlib.h>
#include <string.h>
#include <syslog.h>
#include <netinet/in.h>
#include <sys/socket.h>
#include <rpc/rpc.h>
#include <tiuser.h>
#include <unistd.h>
#include <generic.h>
#include <note.h>

#ifdef C2_DEBUG2
#define	dprintf(x) { (void) printf x; }
#else
#define	dprintf(x)
#endif

/*
 * netbuf2pm()
 *
 * Given an endpt in netbuf form,  return the port and machine.
 * kadmind (currently) only works over IPv4, so only handle IPv4 addresses.
 */
static void
netbuf2pm(
	struct netbuf *addr,
	in_port_t *port,
	uint32_t *machine)
{
	struct sockaddr_in sin4;

	if (!addr) {
		syslog(LOG_DEBUG, "netbuf2pm: addr == NULL");
		return;
	}

	if (!addr->buf) {
		syslog(LOG_DEBUG, "netbuf2pm: addr->buf == NULL");
		return;
	}

	(void) memcpy(&sin4, addr->buf, sizeof (struct sockaddr_in));
	if (sin4.sin_family == AF_INET) {
		if (machine)
			*machine = sin4.sin_addr.s_addr;
		if (port)
			*port = sin4.sin_port;
	} else {
		dprintf(("netbuf2pm: unknown caller IP address family %d",
		    sin4.sin_family));
		syslog(LOG_DEBUG,
		    "netbuf2pm: unknown caller IP address family %d",
		    sin4.sin_family);
	}
}

#define	AUD_NULL_STR(s)		((s) ? (s) : "(null)")

static void
common_audit(
	au_event_t event,	/* audit event */
	SVCXPRT *xprt,		/* net transport handle */
	in_port_t l_port,	/* local port */
	char *op,		/* requested operation */
	char *prime_arg,	/* argument for op */
	char *clnt_name,	/* client principal name */
	int sorf) 		/* flag for success or failure */

{
	auditinfo_t ai;
	in_port_t r_port = 0;
	dev_t port;
	uint32_t machine = 0;
	char text_buf[512];

	dprintf(("common_audit() start\n"));

	/* if auditing turned off, then don't do anything */
	if (cannot_audit(0))
		return;

	(void) aug_save_namask();

	/*
	 * set default values. We will overwrite them if appropriate.
	 */
	if (getaudit(&ai)) {
		perror("kadmind");
		return;
	}
	aug_save_auid(ai.ai_auid);	/* Audit ID */
	aug_save_uid(getuid());		/* User ID */
	aug_save_euid(geteuid());	/* Effective User ID */
	aug_save_gid(getgid());		/* Group ID */
	aug_save_egid(getegid());	/* Effective Group ID */
	aug_save_pid(getpid());		/* process ID */
	aug_save_asid(getpid());	/* session ID */

	aug_save_event(event);
	aug_save_sorf(sorf);

	(void) snprintf(text_buf, sizeof (text_buf), "Op: %s",
		AUD_NULL_STR(op));
	aug_save_text(text_buf);
	(void) snprintf(text_buf, sizeof (text_buf), "Arg: %s",
		AUD_NULL_STR(prime_arg));
	aug_save_text1(text_buf);
	(void) snprintf(text_buf, sizeof (text_buf), "Client: %s",
		AUD_NULL_STR(clnt_name));
	aug_save_text2(text_buf);

	netbuf2pm(svc_getrpccaller(xprt), &r_port, &machine);

	dprintf(("common_audit(): l_port=%d, r_port=%d,\n",
		ntohs(l_port), ntohs(r_port)));

	port = (r_port<<16 | l_port);

	aug_save_tid_ex(port,  &machine, AU_IPv4);

	(void) aug_audit();
}

void
audit_kadmind_auth(
	SVCXPRT *xprt,
	in_port_t l_port,
	char *op,
	char *prime_arg,
	char *clnt_name,
	int sorf)
{
	common_audit(AUE_kadmind_auth, xprt, l_port, op, prime_arg,
	    clnt_name, sorf);
}

void
audit_kadmind_unauth(
	SVCXPRT *xprt,
	in_port_t l_port,
	char *op,
	char *prime_arg,
	char *clnt_name)
{
	common_audit(AUE_kadmind_unauth, xprt, l_port, op, prime_arg,
	    clnt_name, 1);
}