1*0Sstevel@tonic-gate /* 2*0Sstevel@tonic-gate * CDDL HEADER START 3*0Sstevel@tonic-gate * 4*0Sstevel@tonic-gate * The contents of this file are subject to the terms of the 5*0Sstevel@tonic-gate * Common Development and Distribution License, Version 1.0 only 6*0Sstevel@tonic-gate * (the "License"). You may not use this file except in compliance 7*0Sstevel@tonic-gate * with the License. 8*0Sstevel@tonic-gate * 9*0Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 10*0Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing. 11*0Sstevel@tonic-gate * See the License for the specific language governing permissions 12*0Sstevel@tonic-gate * and limitations under the License. 13*0Sstevel@tonic-gate * 14*0Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each 15*0Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 16*0Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the 17*0Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying 18*0Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner] 19*0Sstevel@tonic-gate * 20*0Sstevel@tonic-gate * CDDL HEADER END 21*0Sstevel@tonic-gate */ 22*0Sstevel@tonic-gate /* 23*0Sstevel@tonic-gate * Copyright (c) 2000 by Sun Microsystems, Inc. 24*0Sstevel@tonic-gate * All rights reserved. 25*0Sstevel@tonic-gate */ 26*0Sstevel@tonic-gate 27*0Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI" 28*0Sstevel@tonic-gate 29*0Sstevel@tonic-gate #include <sys/types.h> 30*0Sstevel@tonic-gate #include <sys/param.h> 31*0Sstevel@tonic-gate #include <stdio.h> 32*0Sstevel@tonic-gate #include <sys/fcntl.h> 33*0Sstevel@tonic-gate #include <bsm/audit.h> 34*0Sstevel@tonic-gate #include <bsm/audit_record.h> 35*0Sstevel@tonic-gate #include <bsm/audit_uevents.h> 36*0Sstevel@tonic-gate #include <bsm/libbsm.h> 37*0Sstevel@tonic-gate #include <stdlib.h> 38*0Sstevel@tonic-gate #include <string.h> 39*0Sstevel@tonic-gate #include <syslog.h> 40*0Sstevel@tonic-gate #include <netinet/in.h> 41*0Sstevel@tonic-gate #include <sys/socket.h> 42*0Sstevel@tonic-gate #include <rpc/rpc.h> 43*0Sstevel@tonic-gate #include <tiuser.h> 44*0Sstevel@tonic-gate #include <unistd.h> 45*0Sstevel@tonic-gate #include <generic.h> 46*0Sstevel@tonic-gate #include <note.h> 47*0Sstevel@tonic-gate 48*0Sstevel@tonic-gate #ifdef C2_DEBUG2 49*0Sstevel@tonic-gate #define dprintf(x) { printf x; } 50*0Sstevel@tonic-gate #else 51*0Sstevel@tonic-gate #define dprintf(x) 52*0Sstevel@tonic-gate #endif 53*0Sstevel@tonic-gate 54*0Sstevel@tonic-gate /* 55*0Sstevel@tonic-gate * netbuf2pm() 56*0Sstevel@tonic-gate * 57*0Sstevel@tonic-gate * Given an endpt in netbuf form, return the port and machine. 58*0Sstevel@tonic-gate * kadmind (currently) only works over IPv4, so only handle IPv4 addresses. 59*0Sstevel@tonic-gate */ 60*0Sstevel@tonic-gate static void 61*0Sstevel@tonic-gate netbuf2pm( 62*0Sstevel@tonic-gate struct netbuf *addr, 63*0Sstevel@tonic-gate in_port_t *port, 64*0Sstevel@tonic-gate uint32_t *machine) 65*0Sstevel@tonic-gate { 66*0Sstevel@tonic-gate struct sockaddr_in sin4; 67*0Sstevel@tonic-gate 68*0Sstevel@tonic-gate if (!addr) { 69*0Sstevel@tonic-gate syslog(LOG_DEBUG, "netbuf2pm: addr == NULL"); 70*0Sstevel@tonic-gate return; 71*0Sstevel@tonic-gate } 72*0Sstevel@tonic-gate 73*0Sstevel@tonic-gate if (!addr->buf) { 74*0Sstevel@tonic-gate syslog(LOG_DEBUG, "netbuf2pm: addr->buf == NULL"); 75*0Sstevel@tonic-gate return; 76*0Sstevel@tonic-gate } 77*0Sstevel@tonic-gate 78*0Sstevel@tonic-gate (void) memcpy(&sin4, addr->buf, sizeof (struct sockaddr_in)); 79*0Sstevel@tonic-gate if (sin4.sin_family == AF_INET) { 80*0Sstevel@tonic-gate if (machine) 81*0Sstevel@tonic-gate *machine = sin4.sin_addr.s_addr; 82*0Sstevel@tonic-gate if (port) 83*0Sstevel@tonic-gate *port = sin4.sin_port; 84*0Sstevel@tonic-gate } else { 85*0Sstevel@tonic-gate dprintf(("netbuf2pm: unknown caller IP address family %d", 86*0Sstevel@tonic-gate sin4.sin_family)); 87*0Sstevel@tonic-gate syslog(LOG_DEBUG, 88*0Sstevel@tonic-gate "netbuf2pm: unknown caller IP address family %d", 89*0Sstevel@tonic-gate sin4.sin_family); 90*0Sstevel@tonic-gate } 91*0Sstevel@tonic-gate } 92*0Sstevel@tonic-gate 93*0Sstevel@tonic-gate #define AUD_NULL_STR(s) ((s) ? (s) : "(null)") 94*0Sstevel@tonic-gate 95*0Sstevel@tonic-gate static void 96*0Sstevel@tonic-gate common_audit( 97*0Sstevel@tonic-gate au_event_t event, /* audit event */ 98*0Sstevel@tonic-gate SVCXPRT *xprt, /* net transport handle */ 99*0Sstevel@tonic-gate in_port_t l_port, /* local port */ 100*0Sstevel@tonic-gate char *op, /* requested operation */ 101*0Sstevel@tonic-gate char *prime_arg, /* argument for op */ 102*0Sstevel@tonic-gate char *clnt_name, /* client principal name */ 103*0Sstevel@tonic-gate int sorf) /* flag for success or failure */ 104*0Sstevel@tonic-gate 105*0Sstevel@tonic-gate { 106*0Sstevel@tonic-gate auditinfo_t ai; 107*0Sstevel@tonic-gate in_port_t r_port = 0; 108*0Sstevel@tonic-gate dev_t port; 109*0Sstevel@tonic-gate uint32_t machine = 0; 110*0Sstevel@tonic-gate char text_buf[512]; 111*0Sstevel@tonic-gate 112*0Sstevel@tonic-gate dprintf(("common_audit() start\n")); 113*0Sstevel@tonic-gate 114*0Sstevel@tonic-gate /* if auditing turned off, then don't do anything */ 115*0Sstevel@tonic-gate if (cannot_audit(0)) 116*0Sstevel@tonic-gate return; 117*0Sstevel@tonic-gate 118*0Sstevel@tonic-gate (void) aug_save_namask(); 119*0Sstevel@tonic-gate 120*0Sstevel@tonic-gate /* 121*0Sstevel@tonic-gate * set default values. We will overwrite them if appropriate. 122*0Sstevel@tonic-gate */ 123*0Sstevel@tonic-gate if (getaudit(&ai)) { 124*0Sstevel@tonic-gate perror("kadmind"); 125*0Sstevel@tonic-gate return; 126*0Sstevel@tonic-gate } 127*0Sstevel@tonic-gate aug_save_auid(ai.ai_auid); /* Audit ID */ 128*0Sstevel@tonic-gate aug_save_uid(getuid()); /* User ID */ 129*0Sstevel@tonic-gate aug_save_euid(geteuid()); /* Effective User ID */ 130*0Sstevel@tonic-gate aug_save_gid(getgid()); /* Group ID */ 131*0Sstevel@tonic-gate aug_save_egid(getegid()); /* Effective Group ID */ 132*0Sstevel@tonic-gate aug_save_pid(getpid()); /* process ID */ 133*0Sstevel@tonic-gate aug_save_asid(getpid()); /* session ID */ 134*0Sstevel@tonic-gate 135*0Sstevel@tonic-gate aug_save_event(event); 136*0Sstevel@tonic-gate aug_save_sorf(sorf); 137*0Sstevel@tonic-gate 138*0Sstevel@tonic-gate (void) snprintf(text_buf, sizeof (text_buf), "Op: %s", 139*0Sstevel@tonic-gate AUD_NULL_STR(op)); 140*0Sstevel@tonic-gate aug_save_text(text_buf); 141*0Sstevel@tonic-gate (void) snprintf(text_buf, sizeof (text_buf), "Arg: %s", 142*0Sstevel@tonic-gate AUD_NULL_STR(prime_arg)); 143*0Sstevel@tonic-gate aug_save_text1(text_buf); 144*0Sstevel@tonic-gate (void) snprintf(text_buf, sizeof (text_buf), "Client: %s", 145*0Sstevel@tonic-gate AUD_NULL_STR(clnt_name)); 146*0Sstevel@tonic-gate aug_save_text2(text_buf); 147*0Sstevel@tonic-gate 148*0Sstevel@tonic-gate netbuf2pm(svc_getrpccaller(xprt), &r_port, &machine); 149*0Sstevel@tonic-gate 150*0Sstevel@tonic-gate dprintf(("common_audit(): l_port=%d, r_port=%d,\n", 151*0Sstevel@tonic-gate ntohs(l_port), ntohs(r_port))); 152*0Sstevel@tonic-gate 153*0Sstevel@tonic-gate port = (r_port<<16 | l_port); 154*0Sstevel@tonic-gate 155*0Sstevel@tonic-gate aug_save_tid_ex(port, &machine, AU_IPv4); 156*0Sstevel@tonic-gate 157*0Sstevel@tonic-gate (void) aug_audit(); 158*0Sstevel@tonic-gate } 159*0Sstevel@tonic-gate 160*0Sstevel@tonic-gate void 161*0Sstevel@tonic-gate audit_kadmind_auth( 162*0Sstevel@tonic-gate SVCXPRT *xprt, 163*0Sstevel@tonic-gate in_port_t l_port, 164*0Sstevel@tonic-gate char *op, 165*0Sstevel@tonic-gate char *prime_arg, 166*0Sstevel@tonic-gate char *clnt_name, 167*0Sstevel@tonic-gate int sorf) 168*0Sstevel@tonic-gate { 169*0Sstevel@tonic-gate common_audit(AUE_kadmind_auth, xprt, l_port, op, prime_arg, 170*0Sstevel@tonic-gate clnt_name, sorf); 171*0Sstevel@tonic-gate } 172*0Sstevel@tonic-gate 173*0Sstevel@tonic-gate void 174*0Sstevel@tonic-gate audit_kadmind_unauth( 175*0Sstevel@tonic-gate SVCXPRT *xprt, 176*0Sstevel@tonic-gate in_port_t l_port, 177*0Sstevel@tonic-gate char *op, 178*0Sstevel@tonic-gate char *prime_arg, 179*0Sstevel@tonic-gate char *clnt_name) 180*0Sstevel@tonic-gate { 181*0Sstevel@tonic-gate common_audit(AUE_kadmind_unauth, xprt, l_port, op, prime_arg, 182*0Sstevel@tonic-gate clnt_name, 1); 183*0Sstevel@tonic-gate } 184