1*0Sstevel@tonic-gate /*
2*0Sstevel@tonic-gate  * CDDL HEADER START
3*0Sstevel@tonic-gate  *
4*0Sstevel@tonic-gate  * The contents of this file are subject to the terms of the
5*0Sstevel@tonic-gate  * Common Development and Distribution License, Version 1.0 only
6*0Sstevel@tonic-gate  * (the "License").  You may not use this file except in compliance
7*0Sstevel@tonic-gate  * with the License.
8*0Sstevel@tonic-gate  *
9*0Sstevel@tonic-gate  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
10*0Sstevel@tonic-gate  * or http://www.opensolaris.org/os/licensing.
11*0Sstevel@tonic-gate  * See the License for the specific language governing permissions
12*0Sstevel@tonic-gate  * and limitations under the License.
13*0Sstevel@tonic-gate  *
14*0Sstevel@tonic-gate  * When distributing Covered Code, include this CDDL HEADER in each
15*0Sstevel@tonic-gate  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
16*0Sstevel@tonic-gate  * If applicable, add the following below this CDDL HEADER, with the
17*0Sstevel@tonic-gate  * fields enclosed by brackets "[]" replaced with your own identifying
18*0Sstevel@tonic-gate  * information: Portions Copyright [yyyy] [name of copyright owner]
19*0Sstevel@tonic-gate  *
20*0Sstevel@tonic-gate  * CDDL HEADER END
21*0Sstevel@tonic-gate  */
22*0Sstevel@tonic-gate /*
23*0Sstevel@tonic-gate  * Copyright (c) 2000 by Sun Microsystems, Inc.
24*0Sstevel@tonic-gate  * All rights reserved.
25*0Sstevel@tonic-gate  */
26*0Sstevel@tonic-gate 
27*0Sstevel@tonic-gate #pragma ident	"%Z%%M%	%I%	%E% SMI"
28*0Sstevel@tonic-gate 
29*0Sstevel@tonic-gate #include <sys/types.h>
30*0Sstevel@tonic-gate #include <sys/param.h>
31*0Sstevel@tonic-gate #include <stdio.h>
32*0Sstevel@tonic-gate #include <sys/fcntl.h>
33*0Sstevel@tonic-gate #include <bsm/audit.h>
34*0Sstevel@tonic-gate #include <bsm/audit_record.h>
35*0Sstevel@tonic-gate #include <bsm/audit_uevents.h>
36*0Sstevel@tonic-gate #include <bsm/libbsm.h>
37*0Sstevel@tonic-gate #include <stdlib.h>
38*0Sstevel@tonic-gate #include <string.h>
39*0Sstevel@tonic-gate #include <syslog.h>
40*0Sstevel@tonic-gate #include <netinet/in.h>
41*0Sstevel@tonic-gate #include <sys/socket.h>
42*0Sstevel@tonic-gate #include <rpc/rpc.h>
43*0Sstevel@tonic-gate #include <tiuser.h>
44*0Sstevel@tonic-gate #include <unistd.h>
45*0Sstevel@tonic-gate #include <generic.h>
46*0Sstevel@tonic-gate #include <note.h>
47*0Sstevel@tonic-gate 
48*0Sstevel@tonic-gate #ifdef C2_DEBUG2
49*0Sstevel@tonic-gate #define	dprintf(x) { printf x; }
50*0Sstevel@tonic-gate #else
51*0Sstevel@tonic-gate #define	dprintf(x)
52*0Sstevel@tonic-gate #endif
53*0Sstevel@tonic-gate 
54*0Sstevel@tonic-gate /*
55*0Sstevel@tonic-gate  * netbuf2pm()
56*0Sstevel@tonic-gate  *
57*0Sstevel@tonic-gate  * Given an endpt in netbuf form,  return the port and machine.
58*0Sstevel@tonic-gate  * kadmind (currently) only works over IPv4, so only handle IPv4 addresses.
59*0Sstevel@tonic-gate  */
60*0Sstevel@tonic-gate static void
61*0Sstevel@tonic-gate netbuf2pm(
62*0Sstevel@tonic-gate 	struct netbuf *addr,
63*0Sstevel@tonic-gate 	in_port_t *port,
64*0Sstevel@tonic-gate 	uint32_t *machine)
65*0Sstevel@tonic-gate {
66*0Sstevel@tonic-gate 	struct sockaddr_in sin4;
67*0Sstevel@tonic-gate 
68*0Sstevel@tonic-gate 	if (!addr) {
69*0Sstevel@tonic-gate 		syslog(LOG_DEBUG, "netbuf2pm: addr == NULL");
70*0Sstevel@tonic-gate 		return;
71*0Sstevel@tonic-gate 	}
72*0Sstevel@tonic-gate 
73*0Sstevel@tonic-gate 	if (!addr->buf) {
74*0Sstevel@tonic-gate 		syslog(LOG_DEBUG, "netbuf2pm: addr->buf == NULL");
75*0Sstevel@tonic-gate 		return;
76*0Sstevel@tonic-gate 	}
77*0Sstevel@tonic-gate 
78*0Sstevel@tonic-gate 	(void) memcpy(&sin4, addr->buf, sizeof (struct sockaddr_in));
79*0Sstevel@tonic-gate 	if (sin4.sin_family == AF_INET) {
80*0Sstevel@tonic-gate 		if (machine)
81*0Sstevel@tonic-gate 			*machine = sin4.sin_addr.s_addr;
82*0Sstevel@tonic-gate 		if (port)
83*0Sstevel@tonic-gate 			*port = sin4.sin_port;
84*0Sstevel@tonic-gate 	} else {
85*0Sstevel@tonic-gate 		dprintf(("netbuf2pm: unknown caller IP address family %d",
86*0Sstevel@tonic-gate 			sin4.sin_family));
87*0Sstevel@tonic-gate 		syslog(LOG_DEBUG,
88*0Sstevel@tonic-gate 		    "netbuf2pm: unknown caller IP address family %d",
89*0Sstevel@tonic-gate 		    sin4.sin_family);
90*0Sstevel@tonic-gate 	}
91*0Sstevel@tonic-gate }
92*0Sstevel@tonic-gate 
93*0Sstevel@tonic-gate #define	AUD_NULL_STR(s)		((s) ? (s) : "(null)")
94*0Sstevel@tonic-gate 
95*0Sstevel@tonic-gate static void
96*0Sstevel@tonic-gate common_audit(
97*0Sstevel@tonic-gate 	au_event_t event,	/* audit event */
98*0Sstevel@tonic-gate 	SVCXPRT *xprt,		/* net transport handle */
99*0Sstevel@tonic-gate 	in_port_t l_port,	/* local port */
100*0Sstevel@tonic-gate 	char *op,		/* requested operation */
101*0Sstevel@tonic-gate 	char *prime_arg,	/* argument for op */
102*0Sstevel@tonic-gate 	char *clnt_name,	/* client principal name */
103*0Sstevel@tonic-gate 	int sorf) 		/* flag for success or failure */
104*0Sstevel@tonic-gate 
105*0Sstevel@tonic-gate {
106*0Sstevel@tonic-gate 	auditinfo_t ai;
107*0Sstevel@tonic-gate 	in_port_t r_port = 0;
108*0Sstevel@tonic-gate 	dev_t port;
109*0Sstevel@tonic-gate 	uint32_t machine = 0;
110*0Sstevel@tonic-gate 	char text_buf[512];
111*0Sstevel@tonic-gate 
112*0Sstevel@tonic-gate 	dprintf(("common_audit() start\n"));
113*0Sstevel@tonic-gate 
114*0Sstevel@tonic-gate 	/* if auditing turned off, then don't do anything */
115*0Sstevel@tonic-gate 	if (cannot_audit(0))
116*0Sstevel@tonic-gate 		return;
117*0Sstevel@tonic-gate 
118*0Sstevel@tonic-gate 	(void) aug_save_namask();
119*0Sstevel@tonic-gate 
120*0Sstevel@tonic-gate 	/*
121*0Sstevel@tonic-gate 	 * set default values. We will overwrite them if appropriate.
122*0Sstevel@tonic-gate 	 */
123*0Sstevel@tonic-gate 	if (getaudit(&ai)) {
124*0Sstevel@tonic-gate 		perror("kadmind");
125*0Sstevel@tonic-gate 		return;
126*0Sstevel@tonic-gate 	}
127*0Sstevel@tonic-gate 	aug_save_auid(ai.ai_auid);	/* Audit ID */
128*0Sstevel@tonic-gate 	aug_save_uid(getuid());		/* User ID */
129*0Sstevel@tonic-gate 	aug_save_euid(geteuid());	/* Effective User ID */
130*0Sstevel@tonic-gate 	aug_save_gid(getgid());		/* Group ID */
131*0Sstevel@tonic-gate 	aug_save_egid(getegid());	/* Effective Group ID */
132*0Sstevel@tonic-gate 	aug_save_pid(getpid());		/* process ID */
133*0Sstevel@tonic-gate 	aug_save_asid(getpid());	/* session ID */
134*0Sstevel@tonic-gate 
135*0Sstevel@tonic-gate 	aug_save_event(event);
136*0Sstevel@tonic-gate 	aug_save_sorf(sorf);
137*0Sstevel@tonic-gate 
138*0Sstevel@tonic-gate 	(void) snprintf(text_buf, sizeof (text_buf), "Op: %s",
139*0Sstevel@tonic-gate 		AUD_NULL_STR(op));
140*0Sstevel@tonic-gate 	aug_save_text(text_buf);
141*0Sstevel@tonic-gate 	(void) snprintf(text_buf, sizeof (text_buf), "Arg: %s",
142*0Sstevel@tonic-gate 		AUD_NULL_STR(prime_arg));
143*0Sstevel@tonic-gate 	aug_save_text1(text_buf);
144*0Sstevel@tonic-gate 	(void) snprintf(text_buf, sizeof (text_buf), "Client: %s",
145*0Sstevel@tonic-gate 		AUD_NULL_STR(clnt_name));
146*0Sstevel@tonic-gate 	aug_save_text2(text_buf);
147*0Sstevel@tonic-gate 
148*0Sstevel@tonic-gate 	netbuf2pm(svc_getrpccaller(xprt), &r_port, &machine);
149*0Sstevel@tonic-gate 
150*0Sstevel@tonic-gate 	dprintf(("common_audit(): l_port=%d, r_port=%d,\n",
151*0Sstevel@tonic-gate 		ntohs(l_port), ntohs(r_port)));
152*0Sstevel@tonic-gate 
153*0Sstevel@tonic-gate 	port = (r_port<<16 | l_port);
154*0Sstevel@tonic-gate 
155*0Sstevel@tonic-gate 	aug_save_tid_ex(port,  &machine, AU_IPv4);
156*0Sstevel@tonic-gate 
157*0Sstevel@tonic-gate 	(void) aug_audit();
158*0Sstevel@tonic-gate }
159*0Sstevel@tonic-gate 
160*0Sstevel@tonic-gate void
161*0Sstevel@tonic-gate audit_kadmind_auth(
162*0Sstevel@tonic-gate 	SVCXPRT *xprt,
163*0Sstevel@tonic-gate 	in_port_t l_port,
164*0Sstevel@tonic-gate 	char *op,
165*0Sstevel@tonic-gate 	char *prime_arg,
166*0Sstevel@tonic-gate 	char *clnt_name,
167*0Sstevel@tonic-gate 	int sorf)
168*0Sstevel@tonic-gate {
169*0Sstevel@tonic-gate 	common_audit(AUE_kadmind_auth, xprt, l_port, op, prime_arg,
170*0Sstevel@tonic-gate 		    clnt_name, sorf);
171*0Sstevel@tonic-gate }
172*0Sstevel@tonic-gate 
173*0Sstevel@tonic-gate void
174*0Sstevel@tonic-gate audit_kadmind_unauth(
175*0Sstevel@tonic-gate 	SVCXPRT *xprt,
176*0Sstevel@tonic-gate 	in_port_t l_port,
177*0Sstevel@tonic-gate 	char *op,
178*0Sstevel@tonic-gate 	char *prime_arg,
179*0Sstevel@tonic-gate 	char *clnt_name)
180*0Sstevel@tonic-gate {
181*0Sstevel@tonic-gate 	common_audit(AUE_kadmind_unauth, xprt, l_port, op, prime_arg,
182*0Sstevel@tonic-gate 		    clnt_name, 1);
183*0Sstevel@tonic-gate }
184