1 /*-
2 * Copyright (c) 2004-2009 Apple Inc.
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 * 3. Neither the name of Apple Inc. ("Apple") nor the names of
14 * its contributors may be used to endorse or promote products derived
15 * from this software without specific prior written permission.
16 *
17 * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND
18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20 * ARE DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR
21 * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
25 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
26 * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
27 * POSSIBILITY OF SUCH DAMAGE.
28 *
29 * $P4: //depot/projects/trustedbsd/openbsm/libbsm/bsm_notify.c#17 $
30 */
31
32 /*
33 * Based on sample code from Marc Majka.
34 */
35 #include <sys/types.h>
36
37 #include <config/config.h>
38 #ifdef HAVE_FULL_QUEUE_H
39 #include <sys/queue.h>
40 #else /* !HAVE_FULL_QUEUE_H */
41 #include <compat/queue.h>
42 #endif /* !HAVE_FULL_QUEUE_H */
43
44 #include <bsm/audit_internal.h>
45 #include <bsm/libbsm.h>
46
47 #include <errno.h>
48 #include <inttypes.h>
49 #include <stdarg.h>
50 #include <string.h>
51 #include <syslog.h>
52
53
54 #ifdef __APPLE__
55 #include <notify.h>
56 /* If 1, assumes a kernel that sends the right notification. */
57 #define AUDIT_NOTIFICATION_ENABLED 1
58
59 #if AUDIT_NOTIFICATION_ENABLED
60 static int token = 0;
61 #endif /* AUDIT_NOTIFICATION_ENABLED */
62
63 static int au_cond = AUC_UNSET; /* <bsm/audit.h> */
64
65 uint32_t
au_notify_initialize(void)66 au_notify_initialize(void)
67 {
68 #if AUDIT_NOTIFICATION_ENABLED
69 uint32_t status;
70 int ignore_first;
71
72 status = notify_register_check(__BSM_INTERNAL_NOTIFY_KEY, &token);
73 if (status != NOTIFY_STATUS_OK)
74 return (status);
75 status = notify_check(token, &ignore_first);
76 if (status != NOTIFY_STATUS_OK)
77 return (status);
78 #endif
79
80 if (audit_get_cond(&au_cond) != 0) {
81 syslog(LOG_ERR, "Initial audit status check failed (%s)",
82 strerror(errno));
83 if (errno == ENOSYS) /* auditon() unimplemented. */
84 return (AU_UNIMPL);
85 return (NOTIFY_STATUS_FAILED); /* Is there a better code? */
86 }
87 return (NOTIFY_STATUS_OK);
88 }
89
90 int
au_notify_terminate(void)91 au_notify_terminate(void)
92 {
93
94 #if AUDIT_NOTIFICATION_ENABLED
95 return ((notify_cancel(token) == NOTIFY_STATUS_OK) ? 0 : -1);
96 #else
97 return (0);
98 #endif
99 }
100
101 /*
102 * On error of any notify(3) call, reset 'au_cond' to ensure we re-run
103 * au_notify_initialize() next time 'round--but assume auditing is on. This
104 * is a slight performance hit if auditing is off, but at least the system
105 * will behave correctly. The notification calls are unlikely to fail,
106 * anyway.
107 */
108 int
au_get_state(void)109 au_get_state(void)
110 {
111 #if AUDIT_NOTIFICATION_ENABLED
112 int did_notify;
113 #endif
114 int status;
115
116 /*
117 * Don't make the client initialize this set of routines, but take the
118 * slight performance hit by checking ourselves every time.
119 */
120 if (au_cond == AUC_UNSET) {
121 status = au_notify_initialize();
122 if (status != NOTIFY_STATUS_OK) {
123 if (status == AU_UNIMPL)
124 return (AU_UNIMPL);
125 return (AUC_AUDITING);
126 } else
127 return (au_cond);
128 }
129 #if AUDIT_NOTIFICATION_ENABLED
130 status = notify_check(token, &did_notify);
131 if (status != NOTIFY_STATUS_OK) {
132 au_cond = AUC_UNSET;
133 return (AUC_AUDITING);
134 }
135
136 if (did_notify == 0)
137 return (au_cond);
138 #endif
139
140 if (audit_get_cond(&au_cond) != 0) {
141 /* XXX Reset au_cond to AUC_UNSET? */
142 syslog(LOG_ERR, "Audit status check failed (%s)",
143 strerror(errno));
144 if (errno == ENOSYS) /* Function unimplemented. */
145 return (AU_UNIMPL);
146 return (errno);
147 }
148
149 switch (au_cond) {
150 case AUC_NOAUDIT: /* Auditing suspended. */
151 case AUC_DISABLED: /* Auditing shut off. */
152 return (AUC_NOAUDIT);
153
154 case AUC_UNSET: /* Uninitialized; shouldn't get here. */
155 case AUC_AUDITING: /* Audit on. */
156 default:
157 return (AUC_AUDITING);
158 }
159 }
160 #endif /* !__APPLE__ */
161
162 int
cannot_audit(int val __unused)163 cannot_audit(int val __unused)
164 {
165 #ifdef __APPLE__
166 return (!(au_get_state() == AUC_AUDITING));
167 #else
168 int cond;
169
170 if (audit_get_cond(&cond) != 0) {
171 if (errno != ENOSYS) {
172 syslog(LOG_ERR, "Audit status check failed (%s)",
173 strerror(errno));
174 }
175 return (1);
176 }
177 if (cond == AUC_NOAUDIT || cond == AUC_DISABLED)
178 return (1);
179 return (0);
180 #endif /* !__APPLE__ */
181 }
182