10Sstevel@tonic-gate /*
20Sstevel@tonic-gate * CDDL HEADER START
30Sstevel@tonic-gate *
40Sstevel@tonic-gate * The contents of this file are subject to the terms of the
55007Spaulson * Common Development and Distribution License (the "License").
65007Spaulson * You may not use this file except in compliance with the License.
70Sstevel@tonic-gate *
80Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
90Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing.
100Sstevel@tonic-gate * See the License for the specific language governing permissions
110Sstevel@tonic-gate * and limitations under the License.
120Sstevel@tonic-gate *
130Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each
140Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
150Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the
160Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying
170Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner]
180Sstevel@tonic-gate *
190Sstevel@tonic-gate * CDDL HEADER END
200Sstevel@tonic-gate */
210Sstevel@tonic-gate /*
22*12918SJan.Friedel@Sun.COM * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
230Sstevel@tonic-gate *
240Sstevel@tonic-gate * write binary audit records directly to a file.
250Sstevel@tonic-gate */
260Sstevel@tonic-gate
270Sstevel@tonic-gate #define DEBUG 0
280Sstevel@tonic-gate
290Sstevel@tonic-gate #if DEBUG
3011706SJan.Friedel@Sun.COM #define DPRINT(x) { (void) fprintf x; }
310Sstevel@tonic-gate #else
320Sstevel@tonic-gate #define DPRINT(x)
330Sstevel@tonic-gate #endif
340Sstevel@tonic-gate
350Sstevel@tonic-gate /*
360Sstevel@tonic-gate * auditd_plugin_open(), auditd_plugin() and auditd_plugin_close()
370Sstevel@tonic-gate * implement a replacable library for use by auditd; they are a
380Sstevel@tonic-gate * project private interface and may change without notice.
390Sstevel@tonic-gate *
400Sstevel@tonic-gate */
410Sstevel@tonic-gate
420Sstevel@tonic-gate #include <assert.h>
430Sstevel@tonic-gate #include <bsm/audit.h>
440Sstevel@tonic-gate #include <bsm/audit_record.h>
450Sstevel@tonic-gate #include <bsm/libbsm.h>
460Sstevel@tonic-gate #include <errno.h>
470Sstevel@tonic-gate #include <fcntl.h>
480Sstevel@tonic-gate #include <libintl.h>
490Sstevel@tonic-gate #include <netdb.h>
500Sstevel@tonic-gate #include <pthread.h>
510Sstevel@tonic-gate #include <secdb.h>
520Sstevel@tonic-gate #include <signal.h>
530Sstevel@tonic-gate #include <stdio.h>
540Sstevel@tonic-gate #include <stdlib.h>
550Sstevel@tonic-gate #include <string.h>
560Sstevel@tonic-gate #include <sys/param.h>
570Sstevel@tonic-gate #include <sys/types.h>
580Sstevel@tonic-gate #include <time.h>
590Sstevel@tonic-gate #include <tzfile.h>
600Sstevel@tonic-gate #include <unistd.h>
610Sstevel@tonic-gate #include <sys/vfs.h>
626697Spr131582 #include <limits.h>
636697Spr131582 #include <syslog.h>
640Sstevel@tonic-gate #include <security/auditd.h>
650Sstevel@tonic-gate #include <audit_plugin.h>
660Sstevel@tonic-gate
670Sstevel@tonic-gate #define AUDIT_DATE_SZ 14
680Sstevel@tonic-gate #define AUDIT_FNAME_SZ 2 * AUDIT_DATE_SZ + 2 + MAXHOSTNAMELEN
690Sstevel@tonic-gate
700Sstevel@tonic-gate /* per-directory status */
710Sstevel@tonic-gate #define SOFT_SPACE 0 /* minfree or less space available */
720Sstevel@tonic-gate #define PLENTY_SPACE 1 /* more than minfree available */
730Sstevel@tonic-gate #define SPACE_FULL 2 /* out of space */
740Sstevel@tonic-gate
750Sstevel@tonic-gate #define AVAIL_MIN 50 /* If there are less that this number */
760Sstevel@tonic-gate /* of blocks avail, the filesystem is */
770Sstevel@tonic-gate /* presumed full. */
780Sstevel@tonic-gate
795007Spaulson #define ALLHARD_DELAY 20 /* Call audit_warn(allhard) every 20 seconds */
805007Spaulson
816697Spr131582 /* minimum reasonable size in bytes to roll over an audit file */
826697Spr131582 #define FSIZE_MIN 512000
830Sstevel@tonic-gate
840Sstevel@tonic-gate /*
850Sstevel@tonic-gate * The directory list is a circular linked list. It is pointed into by
860Sstevel@tonic-gate * activeDir. Each element contains the pointer to the next
870Sstevel@tonic-gate * element, the directory pathname, a flag for how much space there is
880Sstevel@tonic-gate * in the directory's filesystem, and a file handle. Since a new
890Sstevel@tonic-gate * directory list can be created from auditd_plugin_open() while the
900Sstevel@tonic-gate * current list is in use, activeDir is protected by log_mutex.
910Sstevel@tonic-gate */
920Sstevel@tonic-gate typedef struct dirlist_s dirlist_t;
930Sstevel@tonic-gate struct dirlist_s {
940Sstevel@tonic-gate dirlist_t *dl_next;
950Sstevel@tonic-gate int dl_space;
960Sstevel@tonic-gate int dl_flags;
970Sstevel@tonic-gate char *dl_dirname;
980Sstevel@tonic-gate char *dl_filename; /* file name (not path) if open */
990Sstevel@tonic-gate int dl_fd; /* file handle, -1 unless open */
1000Sstevel@tonic-gate };
1010Sstevel@tonic-gate /*
1020Sstevel@tonic-gate * Defines for dl_flags
1030Sstevel@tonic-gate */
1040Sstevel@tonic-gate #define SOFT_WARNED 0x0001 /* already did soft warning for this dir */
1050Sstevel@tonic-gate #define HARD_WARNED 0x0002 /* already did hard warning for this dir */
1060Sstevel@tonic-gate
1070Sstevel@tonic-gate #if DEBUG
1080Sstevel@tonic-gate static FILE *dbfp; /* debug file */
1090Sstevel@tonic-gate #endif
1100Sstevel@tonic-gate
1110Sstevel@tonic-gate static pthread_mutex_t log_mutex;
1120Sstevel@tonic-gate static int binfile_is_open = 0;
1130Sstevel@tonic-gate
1140Sstevel@tonic-gate static int minfree = -1;
1150Sstevel@tonic-gate static int minfreeblocks; /* minfree in blocks */
1160Sstevel@tonic-gate
117*12918SJan.Friedel@Sun.COM static dirlist_t *lastOpenDir = NULL; /* last activeDir */
118*12918SJan.Friedel@Sun.COM static dirlist_t *activeDir = NULL; /* to be current directory */
1195007Spaulson static dirlist_t *startdir; /* first dir in the ring */
1200Sstevel@tonic-gate static int activeCount = 0; /* number of dirs in the ring */
1210Sstevel@tonic-gate
1225007Spaulson static int openNewFile = 0; /* need to open a new file */
1230Sstevel@tonic-gate static int hung_count = 0; /* count of audit_warn hard */
1240Sstevel@tonic-gate
1250Sstevel@tonic-gate /* flag from audit_plugin_open to audit_plugin_close */
1260Sstevel@tonic-gate static int am_open = 0;
1270Sstevel@tonic-gate /* preferred dir state */
1280Sstevel@tonic-gate static int fullness_state = PLENTY_SPACE;
1290Sstevel@tonic-gate
1306697Spr131582 /*
1316697Spr131582 * These are used to implement a maximum size for the auditing
1326697Spr131582 * file. binfile_maxsize is set via the 'p_fsize' parameter to the
1336697Spr131582 * audit_binfile plugin.
1346697Spr131582 */
1356697Spr131582 static uint_t binfile_cursize = 0;
1366697Spr131582 static uint_t binfile_maxsize = 0;
1376697Spr131582
1380Sstevel@tonic-gate static int open_log(dirlist_t *);
1390Sstevel@tonic-gate
1400Sstevel@tonic-gate static void
freedirlist(dirlist_t * head)1410Sstevel@tonic-gate freedirlist(dirlist_t *head)
1420Sstevel@tonic-gate {
1430Sstevel@tonic-gate dirlist_t *n1, *n2;
1440Sstevel@tonic-gate /*
1450Sstevel@tonic-gate * Free up the old directory list if any
1460Sstevel@tonic-gate */
1470Sstevel@tonic-gate if (head != NULL) {
1480Sstevel@tonic-gate n1 = head;
1490Sstevel@tonic-gate do {
1500Sstevel@tonic-gate n2 = n1->dl_next;
1510Sstevel@tonic-gate free(n1->dl_dirname);
1520Sstevel@tonic-gate free(n1->dl_filename);
1530Sstevel@tonic-gate free(n1);
1540Sstevel@tonic-gate n1 = n2;
1550Sstevel@tonic-gate } while (n1 != head);
1560Sstevel@tonic-gate }
1570Sstevel@tonic-gate }
1580Sstevel@tonic-gate
159*12918SJan.Friedel@Sun.COM dirlist_t *
dupdirnode(dirlist_t * node_orig)160*12918SJan.Friedel@Sun.COM dupdirnode(dirlist_t *node_orig)
161*12918SJan.Friedel@Sun.COM {
162*12918SJan.Friedel@Sun.COM dirlist_t *node_new;
163*12918SJan.Friedel@Sun.COM
164*12918SJan.Friedel@Sun.COM if ((node_new = calloc(1, sizeof (dirlist_t))) == NULL) {
165*12918SJan.Friedel@Sun.COM return (NULL);
166*12918SJan.Friedel@Sun.COM }
167*12918SJan.Friedel@Sun.COM
168*12918SJan.Friedel@Sun.COM if (node_orig->dl_dirname != NULL &&
169*12918SJan.Friedel@Sun.COM (node_new->dl_dirname = strdup(node_orig->dl_dirname)) == NULL ||
170*12918SJan.Friedel@Sun.COM node_orig->dl_filename != NULL &&
171*12918SJan.Friedel@Sun.COM (node_new->dl_filename = strdup(node_orig->dl_filename)) == NULL) {
172*12918SJan.Friedel@Sun.COM freedirlist(node_new);
173*12918SJan.Friedel@Sun.COM return (NULL);
174*12918SJan.Friedel@Sun.COM }
175*12918SJan.Friedel@Sun.COM
176*12918SJan.Friedel@Sun.COM node_new->dl_next = node_new;
177*12918SJan.Friedel@Sun.COM node_new->dl_space = node_orig->dl_space;
178*12918SJan.Friedel@Sun.COM node_new->dl_flags = node_orig->dl_flags;
179*12918SJan.Friedel@Sun.COM node_new->dl_fd = node_orig->dl_fd;
180*12918SJan.Friedel@Sun.COM
181*12918SJan.Friedel@Sun.COM return (node_new);
182*12918SJan.Friedel@Sun.COM }
1830Sstevel@tonic-gate
1840Sstevel@tonic-gate /*
1850Sstevel@tonic-gate * add to a linked list of directories available for writing
1860Sstevel@tonic-gate *
1870Sstevel@tonic-gate */
1880Sstevel@tonic-gate static int
growauditlist(dirlist_t ** listhead,char * dirlist,dirlist_t * endnode,int * count)1890Sstevel@tonic-gate growauditlist(dirlist_t **listhead, char *dirlist,
1900Sstevel@tonic-gate dirlist_t *endnode, int *count)
1910Sstevel@tonic-gate {
1920Sstevel@tonic-gate dirlist_t *node;
1930Sstevel@tonic-gate char *bs, *be;
1940Sstevel@tonic-gate dirlist_t **node_p;
1950Sstevel@tonic-gate char *dirname;
1960Sstevel@tonic-gate char *remainder;
1970Sstevel@tonic-gate
1980Sstevel@tonic-gate DPRINT((dbfp, "binfile: dirlist=%s\n", dirlist));
1990Sstevel@tonic-gate
2000Sstevel@tonic-gate if (*listhead == NULL)
2010Sstevel@tonic-gate node_p = listhead;
2020Sstevel@tonic-gate else
2030Sstevel@tonic-gate node_p = &(endnode->dl_next);
2040Sstevel@tonic-gate
2050Sstevel@tonic-gate node = NULL;
2060Sstevel@tonic-gate while ((dirname = strtok_r(dirlist, ",", &remainder)) != NULL) {
2070Sstevel@tonic-gate dirlist = NULL;
2080Sstevel@tonic-gate
2090Sstevel@tonic-gate DPRINT((dbfp, "binfile: p_dir = %s\n", dirname));
2100Sstevel@tonic-gate
2110Sstevel@tonic-gate (*count)++;
2120Sstevel@tonic-gate node = malloc(sizeof (dirlist_t));
2130Sstevel@tonic-gate if (node == NULL)
2140Sstevel@tonic-gate return (AUDITD_NO_MEMORY);
2150Sstevel@tonic-gate
2160Sstevel@tonic-gate node->dl_flags = 0;
2170Sstevel@tonic-gate node->dl_filename = NULL;
2180Sstevel@tonic-gate node->dl_fd = -1;
2190Sstevel@tonic-gate node->dl_space = PLENTY_SPACE;
2200Sstevel@tonic-gate
2210Sstevel@tonic-gate node->dl_dirname = malloc((unsigned)strlen(dirname) + 1);
2220Sstevel@tonic-gate if (node->dl_dirname == NULL)
2230Sstevel@tonic-gate return (AUDITD_NO_MEMORY);
2240Sstevel@tonic-gate
2250Sstevel@tonic-gate bs = dirname;
2260Sstevel@tonic-gate while ((*bs == ' ') || (*bs == '\t')) /* trim blanks */
2270Sstevel@tonic-gate bs++;
2280Sstevel@tonic-gate be = bs + strlen(bs) - 1;
2290Sstevel@tonic-gate while (be > bs) { /* trim trailing blanks */
2300Sstevel@tonic-gate if ((*bs != ' ') && (*bs != '\t'))
2310Sstevel@tonic-gate break;
2320Sstevel@tonic-gate be--;
2330Sstevel@tonic-gate }
2340Sstevel@tonic-gate *(be + 1) = '\0';
2350Sstevel@tonic-gate (void) strlcpy(node->dl_dirname, bs, AUDIT_FNAME_SZ);
2360Sstevel@tonic-gate
2370Sstevel@tonic-gate if (*listhead != NULL)
2380Sstevel@tonic-gate node->dl_next = *listhead;
2390Sstevel@tonic-gate else
2400Sstevel@tonic-gate node->dl_next = node;
2410Sstevel@tonic-gate *node_p = node;
2420Sstevel@tonic-gate node_p = &(node->dl_next);
2430Sstevel@tonic-gate
2440Sstevel@tonic-gate }
2450Sstevel@tonic-gate return (0);
2460Sstevel@tonic-gate }
2470Sstevel@tonic-gate
2480Sstevel@tonic-gate /*
2490Sstevel@tonic-gate * create a linked list of directories available for writing
2500Sstevel@tonic-gate *
2510Sstevel@tonic-gate * if a list already exists, the two are compared and the new one is
2520Sstevel@tonic-gate * used only if it is different than the old.
2530Sstevel@tonic-gate *
2540Sstevel@tonic-gate * returns -2 for new or changed list, 0 for unchanged list and -1 for
2550Sstevel@tonic-gate * error. (Positive returns are for AUDITD_<error code> values)
2560Sstevel@tonic-gate *
2570Sstevel@tonic-gate */
2580Sstevel@tonic-gate static int
loadauditlist(char * dirstr,char * minfreestr)2590Sstevel@tonic-gate loadauditlist(char *dirstr, char *minfreestr)
2600Sstevel@tonic-gate {
261*12918SJan.Friedel@Sun.COM dirlist_t *n1, *n2;
2620Sstevel@tonic-gate dirlist_t *listhead = NULL;
2630Sstevel@tonic-gate dirlist_t *thisdir;
2640Sstevel@tonic-gate int node_count = 0;
2650Sstevel@tonic-gate int rc;
2660Sstevel@tonic-gate int temp_minfree;
2670Sstevel@tonic-gate
2680Sstevel@tonic-gate static dirlist_t *activeList = NULL; /* directory list */
2690Sstevel@tonic-gate
270*12918SJan.Friedel@Sun.COM DPRINT((dbfp, "binfile: Loading audit list from audit service "
271*12918SJan.Friedel@Sun.COM "(audit_binfile)\n"));
2720Sstevel@tonic-gate
273*12918SJan.Friedel@Sun.COM if (dirstr == NULL || minfreestr == NULL) {
274*12918SJan.Friedel@Sun.COM DPRINT((dbfp, "binfile: internal error"));
275*12918SJan.Friedel@Sun.COM return (-1);
276*12918SJan.Friedel@Sun.COM }
277*12918SJan.Friedel@Sun.COM if ((rc = growauditlist(&listhead, dirstr, NULL, &node_count)) != 0) {
278*12918SJan.Friedel@Sun.COM return (rc);
2790Sstevel@tonic-gate }
2800Sstevel@tonic-gate if (node_count == 0) {
2810Sstevel@tonic-gate /*
2820Sstevel@tonic-gate * there was a problem getting the directory
283*12918SJan.Friedel@Sun.COM * list or remote host info from the audit_binfile
284*12918SJan.Friedel@Sun.COM * configuration even though auditd thought there was
285*12918SJan.Friedel@Sun.COM * at least 1 good entry
2860Sstevel@tonic-gate */
2870Sstevel@tonic-gate DPRINT((dbfp, "binfile: "
2880Sstevel@tonic-gate "problem getting directory / libpath list "
289*12918SJan.Friedel@Sun.COM "from audit_binfile configuration.\n"));
2900Sstevel@tonic-gate return (-1);
2910Sstevel@tonic-gate }
292*12918SJan.Friedel@Sun.COM
2930Sstevel@tonic-gate #if DEBUG
2940Sstevel@tonic-gate /* print out directory list */
2950Sstevel@tonic-gate if (listhead != NULL) {
29611706SJan.Friedel@Sun.COM (void) fprintf(dbfp, "Directory list:\n\t%s\n",
29711706SJan.Friedel@Sun.COM listhead->dl_dirname);
2980Sstevel@tonic-gate thisdir = listhead->dl_next;
2990Sstevel@tonic-gate
3000Sstevel@tonic-gate while (thisdir != listhead) {
30111706SJan.Friedel@Sun.COM (void) fprintf(dbfp, "\t%s\n", thisdir->dl_dirname);
3020Sstevel@tonic-gate thisdir = thisdir->dl_next;
3030Sstevel@tonic-gate }
3040Sstevel@tonic-gate }
3050Sstevel@tonic-gate #endif /* DEBUG */
306*12918SJan.Friedel@Sun.COM
3070Sstevel@tonic-gate thisdir = listhead;
3080Sstevel@tonic-gate
309*12918SJan.Friedel@Sun.COM /* See if the list has changed (rc = 0 if no change, else 1) */
310*12918SJan.Friedel@Sun.COM rc = 0;
3110Sstevel@tonic-gate if (node_count == activeCount) {
3120Sstevel@tonic-gate n1 = listhead;
3130Sstevel@tonic-gate n2 = activeList;
3140Sstevel@tonic-gate do {
3150Sstevel@tonic-gate if (strcmp(n1->dl_dirname, n2->dl_dirname) != 0) {
3160Sstevel@tonic-gate DPRINT((dbfp,
3170Sstevel@tonic-gate "binfile: new dirname = %s\n"
3180Sstevel@tonic-gate "binfile: old dirname = %s\n",
3190Sstevel@tonic-gate n1->dl_dirname,
3200Sstevel@tonic-gate n2->dl_dirname));
3210Sstevel@tonic-gate rc = -2;
3220Sstevel@tonic-gate break;
3230Sstevel@tonic-gate }
3240Sstevel@tonic-gate n1 = n1->dl_next;
3250Sstevel@tonic-gate n2 = n2->dl_next;
3260Sstevel@tonic-gate } while ((n1 != listhead) && (n2 != activeList));
3270Sstevel@tonic-gate } else {
328*12918SJan.Friedel@Sun.COM DPRINT((dbfp, "binfile: dir counts differs\n"
329*12918SJan.Friedel@Sun.COM "binfile: old dir count = %d\n"
3300Sstevel@tonic-gate "binfile: new dir count = %d\n",
3310Sstevel@tonic-gate activeCount, node_count));
3320Sstevel@tonic-gate rc = -2;
3330Sstevel@tonic-gate }
3340Sstevel@tonic-gate if (rc == -2) {
3350Sstevel@tonic-gate (void) pthread_mutex_lock(&log_mutex);
336*12918SJan.Friedel@Sun.COM DPRINT((dbfp, "loadauditlist: close / open audit.log(4)\n"));
3375007Spaulson if (open_log(listhead) == 0) {
3380Sstevel@tonic-gate openNewFile = 1; /* try again later */
3395007Spaulson } else {
3405007Spaulson openNewFile = 0;
3415007Spaulson }
3420Sstevel@tonic-gate freedirlist(activeList); /* old list */
3430Sstevel@tonic-gate activeList = listhead; /* new list */
3445007Spaulson activeDir = startdir = thisdir;
3450Sstevel@tonic-gate activeCount = node_count;
3460Sstevel@tonic-gate (void) pthread_mutex_unlock(&log_mutex);
347*12918SJan.Friedel@Sun.COM } else {
3480Sstevel@tonic-gate freedirlist(listhead);
349*12918SJan.Friedel@Sun.COM }
350*12918SJan.Friedel@Sun.COM
351*12918SJan.Friedel@Sun.COM /* Get the minfree value. */
3520Sstevel@tonic-gate if (minfreestr != NULL)
3530Sstevel@tonic-gate temp_minfree = atoi(minfreestr);
3540Sstevel@tonic-gate
3550Sstevel@tonic-gate if ((temp_minfree < 0) || (temp_minfree > 100))
3560Sstevel@tonic-gate temp_minfree = 0;
3570Sstevel@tonic-gate
3580Sstevel@tonic-gate if (minfree != temp_minfree) {
3590Sstevel@tonic-gate DPRINT((dbfp, "minfree: old = %d, new = %d\n",
3600Sstevel@tonic-gate minfree, temp_minfree));
3610Sstevel@tonic-gate rc = -2; /* data change */
3620Sstevel@tonic-gate minfree = temp_minfree;
3630Sstevel@tonic-gate }
3640Sstevel@tonic-gate
3650Sstevel@tonic-gate return (rc);
3660Sstevel@tonic-gate }
3670Sstevel@tonic-gate
3680Sstevel@tonic-gate /*
3690Sstevel@tonic-gate * getauditdate - get the current time (GMT) and put it in the form
3700Sstevel@tonic-gate * yyyymmddHHMMSS .
3710Sstevel@tonic-gate */
3720Sstevel@tonic-gate static void
getauditdate(char * date)3730Sstevel@tonic-gate getauditdate(char *date)
3740Sstevel@tonic-gate {
3750Sstevel@tonic-gate struct timeval tp;
3760Sstevel@tonic-gate struct timezone tzp;
3770Sstevel@tonic-gate struct tm tm;
3780Sstevel@tonic-gate
3790Sstevel@tonic-gate (void) gettimeofday(&tp, &tzp);
3800Sstevel@tonic-gate tm = *gmtime(&tp.tv_sec);
3810Sstevel@tonic-gate /*
3820Sstevel@tonic-gate * NOTE: if we want to use gmtime, we have to be aware that the
3830Sstevel@tonic-gate * structure only keeps the year as an offset from TM_YEAR_BASE.
3840Sstevel@tonic-gate * I have used TM_YEAR_BASE in this code so that if they change
3850Sstevel@tonic-gate * this base from 1900 to 2000, it will hopefully mean that this
3860Sstevel@tonic-gate * code does not have to change. TM_YEAR_BASE is defined in
3870Sstevel@tonic-gate * tzfile.h .
3880Sstevel@tonic-gate */
3890Sstevel@tonic-gate (void) sprintf(date, "%.4d%.2d%.2d%.2d%.2d%.2d",
3905007Spaulson tm.tm_year + TM_YEAR_BASE, tm.tm_mon + 1, tm.tm_mday,
3915007Spaulson tm.tm_hour, tm.tm_min, tm.tm_sec);
3920Sstevel@tonic-gate }
3930Sstevel@tonic-gate
3940Sstevel@tonic-gate
3950Sstevel@tonic-gate
3960Sstevel@tonic-gate /*
3970Sstevel@tonic-gate * write_file_token - put the file token into the audit log
3980Sstevel@tonic-gate */
3990Sstevel@tonic-gate static int
write_file_token(int fd,char * name)4000Sstevel@tonic-gate write_file_token(int fd, char *name)
4010Sstevel@tonic-gate {
4020Sstevel@tonic-gate adr_t adr; /* xdr ptr */
4030Sstevel@tonic-gate struct timeval tv; /* time now */
4040Sstevel@tonic-gate char for_adr[AUDIT_FNAME_SZ + AUDIT_FNAME_SZ]; /* plenty of room */
4050Sstevel@tonic-gate char token_id;
4060Sstevel@tonic-gate short i;
4070Sstevel@tonic-gate
4080Sstevel@tonic-gate (void) gettimeofday(&tv, (struct timezone *)0);
4090Sstevel@tonic-gate i = strlen(name) + 1;
4100Sstevel@tonic-gate adr_start(&adr, for_adr);
4110Sstevel@tonic-gate #ifdef _LP64
4120Sstevel@tonic-gate token_id = AUT_OTHER_FILE64;
4130Sstevel@tonic-gate adr_char(&adr, &token_id, 1);
4140Sstevel@tonic-gate adr_int64(&adr, (int64_t *)& tv, 2);
4150Sstevel@tonic-gate #else
4160Sstevel@tonic-gate token_id = AUT_OTHER_FILE32;
4170Sstevel@tonic-gate adr_char(&adr, &token_id, 1);
4180Sstevel@tonic-gate adr_int32(&adr, (int32_t *)& tv, 2);
4190Sstevel@tonic-gate #endif
4200Sstevel@tonic-gate
4210Sstevel@tonic-gate adr_short(&adr, &i, 1);
4220Sstevel@tonic-gate adr_char(&adr, name, i);
4230Sstevel@tonic-gate
4240Sstevel@tonic-gate if (write(fd, for_adr, adr_count(&adr)) < 0) {
4250Sstevel@tonic-gate DPRINT((dbfp, "binfile: Bad write\n"));
4260Sstevel@tonic-gate return (errno);
4270Sstevel@tonic-gate }
4280Sstevel@tonic-gate return (0);
4290Sstevel@tonic-gate }
4300Sstevel@tonic-gate
4310Sstevel@tonic-gate /*
4320Sstevel@tonic-gate * close_log - close the file if open. Also put the name of the
4330Sstevel@tonic-gate * new log file in the trailer, and rename the old file
4340Sstevel@tonic-gate * to oldname. The caller must hold log_mutext while calling
4350Sstevel@tonic-gate * close_log since any change to activeDir is a complete redo
4360Sstevel@tonic-gate * of all it points to.
4370Sstevel@tonic-gate * arguments -
4380Sstevel@tonic-gate * oldname - the new name for the file to be closed
4390Sstevel@tonic-gate * newname - the name of the new log file (for the trailer)
4400Sstevel@tonic-gate */
4410Sstevel@tonic-gate static void
close_log(dirlist_t ** lastOpenDir_ptr,char * oname,char * newname)442*12918SJan.Friedel@Sun.COM close_log(dirlist_t **lastOpenDir_ptr, char *oname, char *newname)
4430Sstevel@tonic-gate {
444*12918SJan.Friedel@Sun.COM char auditdate[AUDIT_DATE_SZ+1];
445*12918SJan.Friedel@Sun.COM char *name;
446*12918SJan.Friedel@Sun.COM char oldname[AUDIT_FNAME_SZ+1];
447*12918SJan.Friedel@Sun.COM dirlist_t *currentdir = *lastOpenDir_ptr;
4480Sstevel@tonic-gate
4490Sstevel@tonic-gate if ((currentdir == NULL) || (currentdir->dl_fd == -1))
4500Sstevel@tonic-gate return;
4510Sstevel@tonic-gate /*
4520Sstevel@tonic-gate * If oldname is blank, we were called by auditd_plugin_close()
4530Sstevel@tonic-gate * instead of by open_log, so we need to update our name.
4540Sstevel@tonic-gate */
4550Sstevel@tonic-gate (void) strlcpy(oldname, oname, AUDIT_FNAME_SZ);
4560Sstevel@tonic-gate
4570Sstevel@tonic-gate if (strcmp(oldname, "") == 0) {
4580Sstevel@tonic-gate getauditdate(auditdate);
4590Sstevel@tonic-gate
4600Sstevel@tonic-gate assert(currentdir->dl_filename != NULL);
4610Sstevel@tonic-gate
4620Sstevel@tonic-gate (void) strlcpy(oldname, currentdir->dl_filename,
4630Sstevel@tonic-gate AUDIT_FNAME_SZ);
4640Sstevel@tonic-gate
4650Sstevel@tonic-gate name = strrchr(oldname, '/') + 1;
4660Sstevel@tonic-gate (void) memcpy(name + AUDIT_DATE_SZ + 1, auditdate,
4670Sstevel@tonic-gate AUDIT_DATE_SZ);
4680Sstevel@tonic-gate }
4690Sstevel@tonic-gate /*
4700Sstevel@tonic-gate * Write the trailer record and rename and close the file.
4710Sstevel@tonic-gate * If any of the write, rename, or close fail, ignore it
4720Sstevel@tonic-gate * since there is not much else we can do and the next open()
4730Sstevel@tonic-gate * will trigger the necessary full directory logic.
4740Sstevel@tonic-gate *
4750Sstevel@tonic-gate * newname is "" if binfile is being closed down.
4760Sstevel@tonic-gate */
4770Sstevel@tonic-gate (void) write_file_token(currentdir->dl_fd, newname);
4785319Stz204579 if (currentdir->dl_fd >= 0) {
4795319Stz204579 (void) fsync(currentdir->dl_fd);
4800Sstevel@tonic-gate (void) close(currentdir->dl_fd);
4815319Stz204579 }
4820Sstevel@tonic-gate currentdir->dl_fd = -1;
4830Sstevel@tonic-gate (void) rename(currentdir->dl_filename, oldname);
4840Sstevel@tonic-gate
4850Sstevel@tonic-gate DPRINT((dbfp, "binfile: Log closed %s\n", oldname));
4860Sstevel@tonic-gate
487*12918SJan.Friedel@Sun.COM freedirlist(currentdir);
488*12918SJan.Friedel@Sun.COM *lastOpenDir_ptr = NULL;
4890Sstevel@tonic-gate }
4900Sstevel@tonic-gate
4910Sstevel@tonic-gate
4920Sstevel@tonic-gate /*
4930Sstevel@tonic-gate * open_log - open a new file in the current directory. If a
4940Sstevel@tonic-gate * file is already open, close it.
4950Sstevel@tonic-gate *
4960Sstevel@tonic-gate * return 1 if ok, 0 if all directories are full.
4970Sstevel@tonic-gate *
4980Sstevel@tonic-gate * lastOpenDir - used to get the oldfile name (and change it),
4990Sstevel@tonic-gate * to close the oldfile.
5000Sstevel@tonic-gate *
5010Sstevel@tonic-gate * The caller must hold log_mutex while calling open_log.
5020Sstevel@tonic-gate *
5030Sstevel@tonic-gate */
5040Sstevel@tonic-gate static int
open_log(dirlist_t * current_dir)5050Sstevel@tonic-gate open_log(dirlist_t *current_dir)
5060Sstevel@tonic-gate {
5070Sstevel@tonic-gate char auditdate[AUDIT_DATE_SZ + 1];
5080Sstevel@tonic-gate char oldname[AUDIT_FNAME_SZ + 1] = "";
5090Sstevel@tonic-gate char newname[AUDIT_FNAME_SZ + 1];
5100Sstevel@tonic-gate char *name; /* pointer into oldname */
511*12918SJan.Friedel@Sun.COM int opened = 0;
5120Sstevel@tonic-gate int error = 0;
5130Sstevel@tonic-gate int newfd = 0;
5140Sstevel@tonic-gate
5150Sstevel@tonic-gate static char host[MAXHOSTNAMELEN + 1] = "";
5160Sstevel@tonic-gate /* previous directory with open log file */
5170Sstevel@tonic-gate
5180Sstevel@tonic-gate if (host[0] == '\0')
5190Sstevel@tonic-gate (void) gethostname(host, MAXHOSTNAMELEN);
5200Sstevel@tonic-gate
5210Sstevel@tonic-gate /* Get a filename which does not already exist */
5220Sstevel@tonic-gate while (!opened) {
5230Sstevel@tonic-gate getauditdate(auditdate);
5240Sstevel@tonic-gate (void) snprintf(newname, AUDIT_FNAME_SZ,
5250Sstevel@tonic-gate "%s/%s.not_terminated.%s",
5260Sstevel@tonic-gate current_dir->dl_dirname, auditdate, host);
5270Sstevel@tonic-gate newfd = open(newname,
528832Sme23304 O_RDWR | O_APPEND | O_CREAT | O_EXCL, 0640);
5290Sstevel@tonic-gate if (newfd < 0) {
5300Sstevel@tonic-gate switch (errno) {
5310Sstevel@tonic-gate case EEXIST:
5320Sstevel@tonic-gate DPRINT((dbfp,
5330Sstevel@tonic-gate "open_log says duplicate for %s "
5340Sstevel@tonic-gate "(will try another)\n", newname));
5350Sstevel@tonic-gate (void) sleep(1);
5360Sstevel@tonic-gate break;
537*12918SJan.Friedel@Sun.COM case ENOENT: {
538*12918SJan.Friedel@Sun.COM /* invalid path */
539*12918SJan.Friedel@Sun.COM char *msg;
540*12918SJan.Friedel@Sun.COM (void) asprintf(&msg,
541*12918SJan.Friedel@Sun.COM gettext("No such p_dir: %s\n"),
542*12918SJan.Friedel@Sun.COM current_dir->dl_dirname);
543*12918SJan.Friedel@Sun.COM DPRINT((dbfp,
544*12918SJan.Friedel@Sun.COM "open_log says about %s: %s\n",
545*12918SJan.Friedel@Sun.COM newname, strerror(errno)));
546*12918SJan.Friedel@Sun.COM __audit_syslog("audit_binfile.so",
547*12918SJan.Friedel@Sun.COM LOG_CONS | LOG_NDELAY,
548*12918SJan.Friedel@Sun.COM LOG_DAEMON, LOG_ERR, msg);
549*12918SJan.Friedel@Sun.COM free(msg);
550*12918SJan.Friedel@Sun.COM current_dir = current_dir->dl_next;
551*12918SJan.Friedel@Sun.COM return (0);
552*12918SJan.Friedel@Sun.COM }
5530Sstevel@tonic-gate default:
5540Sstevel@tonic-gate /* open failed */
5550Sstevel@tonic-gate DPRINT((dbfp,
5560Sstevel@tonic-gate "open_log says full for %s: %s\n",
5570Sstevel@tonic-gate newname, strerror(errno)));
5580Sstevel@tonic-gate current_dir->dl_space = SPACE_FULL;
5590Sstevel@tonic-gate current_dir = current_dir->dl_next;
5600Sstevel@tonic-gate return (0);
5610Sstevel@tonic-gate } /* switch */
5620Sstevel@tonic-gate } else
5630Sstevel@tonic-gate opened = 1;
5640Sstevel@tonic-gate } /* while */
5650Sstevel@tonic-gate
5660Sstevel@tonic-gate /*
5670Sstevel@tonic-gate * When we get here, we have opened our new log file.
5680Sstevel@tonic-gate * Now we need to update the name of the old file to
5690Sstevel@tonic-gate * store in this file's header. lastOpenDir may point
5700Sstevel@tonic-gate * to current_dir if the list is only one entry long and
5710Sstevel@tonic-gate * there is only one list.
5720Sstevel@tonic-gate */
5730Sstevel@tonic-gate if ((lastOpenDir != NULL) && (lastOpenDir->dl_filename != NULL)) {
5740Sstevel@tonic-gate (void) strlcpy(oldname, lastOpenDir->dl_filename,
5750Sstevel@tonic-gate AUDIT_FNAME_SZ);
5760Sstevel@tonic-gate name = (char *)strrchr(oldname, '/') + 1;
5770Sstevel@tonic-gate
5780Sstevel@tonic-gate (void) memcpy(name + AUDIT_DATE_SZ + 1, auditdate,
5795007Spaulson AUDIT_DATE_SZ);
5800Sstevel@tonic-gate
581*12918SJan.Friedel@Sun.COM close_log(&lastOpenDir, oldname, newname);
5820Sstevel@tonic-gate }
5830Sstevel@tonic-gate error = write_file_token(newfd, oldname);
5840Sstevel@tonic-gate if (error) {
5850Sstevel@tonic-gate /* write token failed */
5860Sstevel@tonic-gate (void) close(newfd);
5870Sstevel@tonic-gate
5880Sstevel@tonic-gate current_dir->dl_space = SPACE_FULL;
5890Sstevel@tonic-gate current_dir->dl_fd = -1;
5900Sstevel@tonic-gate free(current_dir->dl_filename);
5910Sstevel@tonic-gate current_dir->dl_filename = NULL;
5920Sstevel@tonic-gate current_dir = current_dir->dl_next;
5930Sstevel@tonic-gate return (0);
5940Sstevel@tonic-gate } else {
595*12918SJan.Friedel@Sun.COM if (current_dir->dl_filename != NULL) {
596*12918SJan.Friedel@Sun.COM free(current_dir->dl_filename);
597*12918SJan.Friedel@Sun.COM }
598*12918SJan.Friedel@Sun.COM current_dir->dl_filename = strdup(newname);
5990Sstevel@tonic-gate current_dir->dl_fd = newfd;
600*12918SJan.Friedel@Sun.COM
601*12918SJan.Friedel@Sun.COM if (lastOpenDir == NULL) {
602*12918SJan.Friedel@Sun.COM freedirlist(lastOpenDir);
603*12918SJan.Friedel@Sun.COM if ((lastOpenDir = dupdirnode(current_dir)) == NULL) {
604*12918SJan.Friedel@Sun.COM __audit_syslog("audit_binfile.so",
605*12918SJan.Friedel@Sun.COM LOG_CONS | LOG_NDELAY,
606*12918SJan.Friedel@Sun.COM LOG_DAEMON, LOG_ERR, gettext("no memory"));
607*12918SJan.Friedel@Sun.COM return (0);
608*12918SJan.Friedel@Sun.COM }
609*12918SJan.Friedel@Sun.COM DPRINT((dbfp, "open_log created new lastOpenDir "
610*12918SJan.Friedel@Sun.COM "(%s, %s [fd: %d])\n",
611*12918SJan.Friedel@Sun.COM lastOpenDir->dl_dirname == NULL ? "" :
612*12918SJan.Friedel@Sun.COM lastOpenDir->dl_dirname,
613*12918SJan.Friedel@Sun.COM lastOpenDir->dl_filename == NULL ? "" :
614*12918SJan.Friedel@Sun.COM lastOpenDir->dl_filename, lastOpenDir->dl_fd));
615*12918SJan.Friedel@Sun.COM }
6160Sstevel@tonic-gate
6176697Spr131582 /*
6186697Spr131582 * New file opened, so reset file size statistic (used
6196697Spr131582 * to ensure audit log does not grow above size limit
6206697Spr131582 * set by p_fsize).
6216697Spr131582 */
6226697Spr131582 binfile_cursize = 0;
6236697Spr131582
62411411SSurya.Prakki@Sun.COM (void) __logpost(newname);
6250Sstevel@tonic-gate
6260Sstevel@tonic-gate DPRINT((dbfp, "binfile: Log opened: %s\n", newname));
6270Sstevel@tonic-gate return (1);
6280Sstevel@tonic-gate }
6290Sstevel@tonic-gate }
6300Sstevel@tonic-gate
6310Sstevel@tonic-gate #define IGNORE_SIZE 8192
6320Sstevel@tonic-gate /*
6330Sstevel@tonic-gate * spacecheck - determine whether the given directory's filesystem
6340Sstevel@tonic-gate * has the at least the space requested. Also set the space
6350Sstevel@tonic-gate * value in the directory list structure. If the caller
6360Sstevel@tonic-gate * passes other than PLENTY_SPACE or SOFT_SPACE, the caller should
6370Sstevel@tonic-gate * ignore the return value. Otherwise, 0 = less than the
6380Sstevel@tonic-gate * requested space is available, 1 = at least the requested space
6390Sstevel@tonic-gate * is available.
6400Sstevel@tonic-gate *
6410Sstevel@tonic-gate * log_mutex must be held by the caller
6420Sstevel@tonic-gate *
6430Sstevel@tonic-gate * -1 is returned if stat fails
6440Sstevel@tonic-gate *
6450Sstevel@tonic-gate * IGNORE_SIZE is one page (Sol 9 / 10 timeframe) and is the default
6460Sstevel@tonic-gate * buffer size written for Sol 9 and earlier. To keep the same accuracy
6470Sstevel@tonic-gate * for the soft limit check as before, spacecheck checks for space
6480Sstevel@tonic-gate * remaining IGNORE_SIZE bytes. This reduces the number of statvfs()
6490Sstevel@tonic-gate * calls and related math.
6500Sstevel@tonic-gate *
6510Sstevel@tonic-gate * globals -
6520Sstevel@tonic-gate * minfree - the soft limit, i.e., the % of filesystem to reserve
6530Sstevel@tonic-gate */
6540Sstevel@tonic-gate static int
spacecheck(dirlist_t * thisdir,int test_limit,size_t next_buf_size)6550Sstevel@tonic-gate spacecheck(dirlist_t *thisdir, int test_limit, size_t next_buf_size)
6560Sstevel@tonic-gate {
6570Sstevel@tonic-gate struct statvfs sb;
6580Sstevel@tonic-gate static int ignore_size = 0;
6590Sstevel@tonic-gate
6600Sstevel@tonic-gate ignore_size += next_buf_size;
6610Sstevel@tonic-gate
6620Sstevel@tonic-gate if ((test_limit == PLENTY_SPACE) && (ignore_size < IGNORE_SIZE))
6630Sstevel@tonic-gate return (1);
6640Sstevel@tonic-gate
6650Sstevel@tonic-gate assert(thisdir != NULL);
6660Sstevel@tonic-gate
6675007Spaulson if (statvfs(thisdir->dl_dirname, &sb) < 0) {
6680Sstevel@tonic-gate thisdir->dl_space = SPACE_FULL;
6690Sstevel@tonic-gate minfreeblocks = AVAIL_MIN;
6700Sstevel@tonic-gate return (-1);
6710Sstevel@tonic-gate } else {
6720Sstevel@tonic-gate minfreeblocks = ((minfree * sb.f_blocks) / 100) + AVAIL_MIN;
6730Sstevel@tonic-gate
6740Sstevel@tonic-gate if (sb.f_bavail < AVAIL_MIN)
6750Sstevel@tonic-gate thisdir->dl_space = SPACE_FULL;
6765007Spaulson else if (sb.f_bavail > minfreeblocks) {
6775007Spaulson thisdir->dl_space = fullness_state = PLENTY_SPACE;
6785007Spaulson ignore_size = 0;
6795007Spaulson } else
6800Sstevel@tonic-gate thisdir->dl_space = SOFT_SPACE;
6810Sstevel@tonic-gate }
6820Sstevel@tonic-gate if (thisdir->dl_space == PLENTY_SPACE)
6830Sstevel@tonic-gate return (1);
6840Sstevel@tonic-gate
6850Sstevel@tonic-gate return (thisdir->dl_space == test_limit);
6860Sstevel@tonic-gate }
6870Sstevel@tonic-gate
6880Sstevel@tonic-gate /*
6896697Spr131582 * Parses p_fsize value and contains it within the range FSIZE_MIN and
6906697Spr131582 * INT_MAX so using uints won't cause an undetected overflow of
6916697Spr131582 * INT_MAX. Defaults to 0 if the value is invalid or is missing.
6926697Spr131582 */
6936697Spr131582 static void
save_maxsize(char * maxsize)6946697Spr131582 save_maxsize(char *maxsize) {
6956697Spr131582 /*
6966697Spr131582 * strtol() returns a long which could be larger than int so
6976697Spr131582 * store here for sanity checking first
6986697Spr131582 */
6996697Spr131582 long proposed_maxsize;
7006697Spr131582
7016697Spr131582 if (maxsize != NULL) {
7026697Spr131582 /*
7036697Spr131582 * There is no explicit error return from strtol() so
7046697Spr131582 * we may need to depend on the value of errno.
7056697Spr131582 */
7066697Spr131582 errno = 0;
7076697Spr131582 proposed_maxsize = strtol(maxsize, (char **)NULL, 10);
7086697Spr131582
7096697Spr131582 /*
7106697Spr131582 * If sizeof(long) is greater than sizeof(int) on this
7116697Spr131582 * platform, proposed_maxsize might be greater than
7126697Spr131582 * INT_MAX without it being reported as ERANGE.
7136697Spr131582 */
7146697Spr131582 if ((errno == ERANGE) ||
7156697Spr131582 ((proposed_maxsize != 0) &&
7166697Spr131582 (proposed_maxsize < FSIZE_MIN)) ||
7176697Spr131582 (proposed_maxsize > INT_MAX)) {
7186697Spr131582 binfile_maxsize = 0;
7196697Spr131582 DPRINT((dbfp, "binfile: p_fsize parameter out of "
7206697Spr131582 "range: %s\n", maxsize));
7216697Spr131582 /*
7226697Spr131582 * Inform administrator of the error via
7236697Spr131582 * syslog
7246697Spr131582 */
7256697Spr131582 __audit_syslog("audit_binfile.so",
7266697Spr131582 LOG_CONS | LOG_NDELAY,
7276697Spr131582 LOG_DAEMON, LOG_ERR,
7286697Spr131582 gettext("p_fsize parameter out of range\n"));
7296697Spr131582 } else {
7306697Spr131582 binfile_maxsize = proposed_maxsize;
7316697Spr131582 }
7326697Spr131582 } else { /* p_fsize string was not present */
7336697Spr131582 binfile_maxsize = 0;
7346697Spr131582 }
7356697Spr131582
7366697Spr131582 DPRINT((dbfp, "binfile: set maxsize to %d\n", binfile_maxsize));
7376697Spr131582 }
7386697Spr131582
7396697Spr131582 /*
7405007Spaulson * auditd_plugin() writes a buffer to the currently open file. The
7416697Spr131582 * global "openNewFile" is used to force a new log file for cases such
7426697Spr131582 * as the initial open, when minfree is reached, the p_fsize value is
7436697Spr131582 * exceeded or the current file system fills up, and "audit -s" with
7446697Spr131582 * changed parameters. For "audit -n" a new log file is opened
7456697Spr131582 * immediately in auditd_plugin_open().
7460Sstevel@tonic-gate *
7470Sstevel@tonic-gate * This function manages one or more audit directories as follows:
7480Sstevel@tonic-gate *
7490Sstevel@tonic-gate * If the current open file is in a directory that has not
7500Sstevel@tonic-gate * reached the soft limit, write the input data and return.
7510Sstevel@tonic-gate *
7520Sstevel@tonic-gate * Scan the list of directories for one which has not reached
7530Sstevel@tonic-gate * the soft limit; if one is found, write and return. Such
7540Sstevel@tonic-gate * a writable directory is in "PLENTY_SPACE" state.
7550Sstevel@tonic-gate *
7560Sstevel@tonic-gate * Scan the list of directories for one which has not reached
7570Sstevel@tonic-gate * the hard limit; if one is found, write and return. This
7580Sstevel@tonic-gate * directory in in "SOFT_SPACE" state.
7590Sstevel@tonic-gate *
7600Sstevel@tonic-gate * Oh, and if a write fails, handle it like a hard space limit.
7610Sstevel@tonic-gate *
7620Sstevel@tonic-gate * audit_warn (via __audit_dowarn()) is used to alert an operator
7630Sstevel@tonic-gate * at various levels of fullness.
7640Sstevel@tonic-gate */
7650Sstevel@tonic-gate /* ARGSUSED */
7660Sstevel@tonic-gate auditd_rc_t
auditd_plugin(const char * input,size_t in_len,uint64_t sequence,char ** error)76711704SJan.Friedel@Sun.COM auditd_plugin(const char *input, size_t in_len, uint64_t sequence, char **error)
7680Sstevel@tonic-gate {
7690Sstevel@tonic-gate auditd_rc_t rc = AUDITD_FAIL;
7700Sstevel@tonic-gate int open_status;
7710Sstevel@tonic-gate size_t out_len;
7720Sstevel@tonic-gate /* avoid excess audit_warnage */
7730Sstevel@tonic-gate static int allsoftfull_warning = 0;
7745007Spaulson static int allhard_pause = 0;
7755007Spaulson static struct timeval next_allhard;
7765007Spaulson struct timeval now;
7770Sstevel@tonic-gate #if DEBUG
77811706SJan.Friedel@Sun.COM int statrc;
7790Sstevel@tonic-gate static char *last_file_written_to = NULL;
78011704SJan.Friedel@Sun.COM static uint64_t last_sequence = 0;
78111704SJan.Friedel@Sun.COM static uint64_t write_count = 0;
7820Sstevel@tonic-gate
7830Sstevel@tonic-gate if ((last_sequence > 0) && (sequence != last_sequence + 1))
78411706SJan.Friedel@Sun.COM (void) fprintf(dbfp,
78511706SJan.Friedel@Sun.COM "binfile: buffer sequence=%llu but prev=%llu=n",
7865007Spaulson sequence, last_sequence);
7870Sstevel@tonic-gate last_sequence = sequence;
7880Sstevel@tonic-gate
78911706SJan.Friedel@Sun.COM (void) fprintf(dbfp, "binfile: input seq=%llu, len=%d\n",
79011706SJan.Friedel@Sun.COM sequence, in_len);
7910Sstevel@tonic-gate #endif
7920Sstevel@tonic-gate *error = NULL;
7930Sstevel@tonic-gate /*
7940Sstevel@tonic-gate * lock is for activeDir, referenced by open_log() and close_log()
7950Sstevel@tonic-gate */
7960Sstevel@tonic-gate (void) pthread_mutex_lock(&log_mutex);
7976697Spr131582
7986697Spr131582 /*
7996697Spr131582 * If this would take us over the maximum size, open a new
8006697Spr131582 * file, unless maxsize is 0, in which case growth of the
8016697Spr131582 * audit log is unrestricted.
8026697Spr131582 */
8036697Spr131582 if ((binfile_maxsize != 0) &&
8046697Spr131582 ((binfile_cursize + in_len) > binfile_maxsize)) {
8056697Spr131582 DPRINT((dbfp, "binfile: maxsize exceeded, opening new audit "
8066697Spr131582 "file.\n"));
8076697Spr131582 openNewFile = 1;
8086697Spr131582 }
8096697Spr131582
8100Sstevel@tonic-gate while (rc == AUDITD_FAIL) {
8110Sstevel@tonic-gate open_status = 1;
8120Sstevel@tonic-gate if (openNewFile) {
8130Sstevel@tonic-gate open_status = open_log(activeDir);
8140Sstevel@tonic-gate if (open_status == 1) /* ok */
8150Sstevel@tonic-gate openNewFile = 0;
8160Sstevel@tonic-gate }
8170Sstevel@tonic-gate /*
8180Sstevel@tonic-gate * consider "space ok" return and error return the same;
8190Sstevel@tonic-gate * a -1 means spacecheck couldn't check for space.
8200Sstevel@tonic-gate */
82111706SJan.Friedel@Sun.COM #if !DEBUG
82211706SJan.Friedel@Sun.COM if ((open_status == 1) &&
82311706SJan.Friedel@Sun.COM (spacecheck(activeDir, fullness_state, in_len) != 0)) {
82411706SJan.Friedel@Sun.COM #else
8250Sstevel@tonic-gate if ((open_status == 1) &&
8260Sstevel@tonic-gate (statrc = spacecheck(activeDir, fullness_state,
82711706SJan.Friedel@Sun.COM in_len) != 0)) {
8280Sstevel@tonic-gate DPRINT((dbfp, "binfile: returned from spacecheck\n"));
8290Sstevel@tonic-gate /*
8300Sstevel@tonic-gate * The last copy of last_file_written_to is
8310Sstevel@tonic-gate * never free'd, so there will be one open
8320Sstevel@tonic-gate * memory reference on exit. It's debug only.
8330Sstevel@tonic-gate */
8340Sstevel@tonic-gate if ((last_file_written_to != NULL) &&
8350Sstevel@tonic-gate (strcmp(last_file_written_to,
8360Sstevel@tonic-gate activeDir->dl_filename) != 0)) {
8370Sstevel@tonic-gate DPRINT((dbfp, "binfile: now writing to %s\n",
8380Sstevel@tonic-gate activeDir->dl_filename));
8390Sstevel@tonic-gate free(last_file_written_to);
8400Sstevel@tonic-gate }
8410Sstevel@tonic-gate DPRINT((dbfp, "binfile: finished some debug stuff\n"));
8420Sstevel@tonic-gate last_file_written_to =
8430Sstevel@tonic-gate strdup(activeDir->dl_filename);
8440Sstevel@tonic-gate #endif
8450Sstevel@tonic-gate out_len = write(activeDir->dl_fd, input, in_len);
8460Sstevel@tonic-gate DPRINT((dbfp, "binfile: finished the write\n"));
8470Sstevel@tonic-gate
8486697Spr131582 binfile_cursize += out_len;
8496697Spr131582
8500Sstevel@tonic-gate if (out_len == in_len) {
8510Sstevel@tonic-gate DPRINT((dbfp,
85211704SJan.Friedel@Sun.COM "binfile: write_count=%llu, sequence=%llu,"
8530Sstevel@tonic-gate " l=%u\n",
8540Sstevel@tonic-gate ++write_count, sequence, out_len));
8550Sstevel@tonic-gate allsoftfull_warning = 0;
8565007Spaulson activeDir->dl_flags = 0;
8570Sstevel@tonic-gate
8580Sstevel@tonic-gate rc = AUDITD_SUCCESS;
8590Sstevel@tonic-gate break;
8605007Spaulson } else if (!(activeDir->dl_flags & HARD_WARNED)) {
8610Sstevel@tonic-gate DPRINT((dbfp,
86211704SJan.Friedel@Sun.COM "binfile: write failed, sequence=%llu, "
8630Sstevel@tonic-gate "l=%u\n", sequence, out_len));
8640Sstevel@tonic-gate DPRINT((dbfp, "hard warning sent.\n"));
8650Sstevel@tonic-gate __audit_dowarn("hard", activeDir->dl_dirname,
8660Sstevel@tonic-gate 0);
8670Sstevel@tonic-gate
8680Sstevel@tonic-gate activeDir->dl_flags |= HARD_WARNED;
8690Sstevel@tonic-gate }
8700Sstevel@tonic-gate } else {
8710Sstevel@tonic-gate DPRINT((dbfp, "binfile: statrc=%d, fullness_state=%d\n",
8720Sstevel@tonic-gate statrc, fullness_state));
8735007Spaulson if (!(activeDir->dl_flags & SOFT_WARNED) &&
8745007Spaulson (activeDir->dl_space == SOFT_SPACE)) {
8750Sstevel@tonic-gate DPRINT((dbfp, "soft warning sent\n"));
8760Sstevel@tonic-gate __audit_dowarn("soft",
8770Sstevel@tonic-gate activeDir->dl_dirname, 0);
8780Sstevel@tonic-gate activeDir->dl_flags |= SOFT_WARNED;
8790Sstevel@tonic-gate }
8805007Spaulson if (!(activeDir->dl_flags & HARD_WARNED) &&
8815007Spaulson (activeDir->dl_space == SPACE_FULL)) {
8820Sstevel@tonic-gate DPRINT((dbfp, "hard warning sent.\n"));
8830Sstevel@tonic-gate __audit_dowarn("hard",
8845007Spaulson activeDir->dl_dirname, 0);
8850Sstevel@tonic-gate activeDir->dl_flags |= HARD_WARNED;
8860Sstevel@tonic-gate }
8870Sstevel@tonic-gate }
8880Sstevel@tonic-gate DPRINT((dbfp, "binfile: activeDir=%s, next=%s\n",
8890Sstevel@tonic-gate activeDir->dl_dirname, activeDir->dl_next->dl_dirname));
8900Sstevel@tonic-gate
8910Sstevel@tonic-gate activeDir = activeDir->dl_next;
8925007Spaulson openNewFile = 1;
8930Sstevel@tonic-gate
8940Sstevel@tonic-gate if (activeDir == startdir) { /* full circle */
8950Sstevel@tonic-gate if (fullness_state == PLENTY_SPACE) { /* once */
8960Sstevel@tonic-gate fullness_state = SOFT_SPACE;
8970Sstevel@tonic-gate if (allsoftfull_warning == 0) {
8980Sstevel@tonic-gate allsoftfull_warning++;
8990Sstevel@tonic-gate __audit_dowarn("allsoft", "", 0);
9000Sstevel@tonic-gate }
9010Sstevel@tonic-gate } else { /* full circle twice */
9025007Spaulson if ((hung_count > 0) && !allhard_pause) {
9035007Spaulson allhard_pause = 1;
9045007Spaulson (void) gettimeofday(&next_allhard,
9055007Spaulson NULL);
9065007Spaulson next_allhard.tv_sec += ALLHARD_DELAY;
9075007Spaulson }
9085007Spaulson
9095007Spaulson if (allhard_pause) {
9105007Spaulson (void) gettimeofday(&now, NULL);
9115007Spaulson if (now.tv_sec >= next_allhard.tv_sec) {
9125007Spaulson allhard_pause = 0;
9135007Spaulson __audit_dowarn("allhard", "",
9145007Spaulson ++hung_count);
9155007Spaulson }
9165007Spaulson } else {
9175007Spaulson __audit_dowarn("allhard", "",
9185007Spaulson ++hung_count);
9195007Spaulson }
9200Sstevel@tonic-gate minfreeblocks = AVAIL_MIN;
9210Sstevel@tonic-gate rc = AUDITD_RETRY;
9220Sstevel@tonic-gate *error = strdup(gettext(
9230Sstevel@tonic-gate "all partitions full\n"));
92411411SSurya.Prakki@Sun.COM (void) __logpost("");
9250Sstevel@tonic-gate }
9260Sstevel@tonic-gate }
9270Sstevel@tonic-gate }
9280Sstevel@tonic-gate (void) pthread_mutex_unlock(&log_mutex);
9290Sstevel@tonic-gate
9300Sstevel@tonic-gate return (rc);
9310Sstevel@tonic-gate }
9320Sstevel@tonic-gate
9330Sstevel@tonic-gate
9340Sstevel@tonic-gate /*
9350Sstevel@tonic-gate * It may be called multiple times as auditd handles SIGHUP and SIGUSR1
9360Sstevel@tonic-gate * corresponding to the audit(1M) flags -s and -n
9370Sstevel@tonic-gate *
938*12918SJan.Friedel@Sun.COM * kvlist is NULL only if auditd caught a SIGUSR1 (audit -n), so after the first
939*12918SJan.Friedel@Sun.COM * time open is called; the reason is -s if kvlist != NULL and -n otherwise.
9400Sstevel@tonic-gate *
9410Sstevel@tonic-gate */
9420Sstevel@tonic-gate auditd_rc_t
9430Sstevel@tonic-gate auditd_plugin_open(const kva_t *kvlist, char **ret_list, char **error)
9440Sstevel@tonic-gate {
9450Sstevel@tonic-gate int rc = 0;
9460Sstevel@tonic-gate int status;
9470Sstevel@tonic-gate int reason;
9480Sstevel@tonic-gate char *dirlist;
9490Sstevel@tonic-gate char *minfree;
9506697Spr131582 char *maxsize;
9510Sstevel@tonic-gate kva_t *kv;
9520Sstevel@tonic-gate
9530Sstevel@tonic-gate *error = NULL;
9540Sstevel@tonic-gate *ret_list = NULL;
9550Sstevel@tonic-gate kv = (kva_t *)kvlist;
9560Sstevel@tonic-gate
9570Sstevel@tonic-gate if (am_open) {
9580Sstevel@tonic-gate if (kvlist == NULL)
9590Sstevel@tonic-gate reason = 1; /* audit -n */
9600Sstevel@tonic-gate else
9610Sstevel@tonic-gate reason = 2; /* audit -s */
9620Sstevel@tonic-gate } else {
9630Sstevel@tonic-gate reason = 0; /* initial open */
9640Sstevel@tonic-gate #if DEBUG
9650Sstevel@tonic-gate dbfp = __auditd_debug_file_open();
9660Sstevel@tonic-gate #endif
9670Sstevel@tonic-gate }
9680Sstevel@tonic-gate DPRINT((dbfp, "binfile: am_open=%d, reason=%d\n", am_open, reason));
9690Sstevel@tonic-gate
9700Sstevel@tonic-gate am_open = 1;
9710Sstevel@tonic-gate
9720Sstevel@tonic-gate if (kvlist == NULL) {
9730Sstevel@tonic-gate dirlist = NULL;
9740Sstevel@tonic-gate minfree = NULL;
9756697Spr131582 maxsize = NULL;
9760Sstevel@tonic-gate } else {
9770Sstevel@tonic-gate dirlist = kva_match(kv, "p_dir");
9780Sstevel@tonic-gate minfree = kva_match(kv, "p_minfree");
9796697Spr131582 maxsize = kva_match(kv, "p_fsize");
9800Sstevel@tonic-gate }
9810Sstevel@tonic-gate switch (reason) {
9820Sstevel@tonic-gate case 0: /* initial open */
9830Sstevel@tonic-gate if (!binfile_is_open)
9840Sstevel@tonic-gate (void) pthread_mutex_init(&log_mutex, NULL);
9850Sstevel@tonic-gate binfile_is_open = 1;
9860Sstevel@tonic-gate openNewFile = 1;
9870Sstevel@tonic-gate /* FALLTHRU */
9880Sstevel@tonic-gate case 2: /* audit -s */
9896697Spr131582 /* handle p_fsize parameter */
9906697Spr131582 save_maxsize(maxsize);
9916697Spr131582
9920Sstevel@tonic-gate fullness_state = PLENTY_SPACE;
9930Sstevel@tonic-gate status = loadauditlist(dirlist, minfree);
9940Sstevel@tonic-gate
9950Sstevel@tonic-gate if (status == -1) {
99611411SSurya.Prakki@Sun.COM (void) __logpost("");
9970Sstevel@tonic-gate *error = strdup(gettext("no directories configured"));
9980Sstevel@tonic-gate return (AUDITD_RETRY);
9990Sstevel@tonic-gate } else if (status == AUDITD_NO_MEMORY) {
100011411SSurya.Prakki@Sun.COM (void) __logpost("");
10010Sstevel@tonic-gate *error = strdup(gettext("no memory"));
10020Sstevel@tonic-gate return (status);
10030Sstevel@tonic-gate } else { /* status is 0 or -2 (no change or changed) */
10040Sstevel@tonic-gate hung_count = 0;
10050Sstevel@tonic-gate DPRINT((dbfp, "binfile: loadauditlist returned %d\n",
10065007Spaulson status));
10070Sstevel@tonic-gate }
10080Sstevel@tonic-gate break;
10090Sstevel@tonic-gate case 1: /* audit -n */
10100Sstevel@tonic-gate (void) pthread_mutex_lock(&log_mutex);
10110Sstevel@tonic-gate if (open_log(activeDir) == 1) /* ok */
10120Sstevel@tonic-gate openNewFile = 0;
10130Sstevel@tonic-gate (void) pthread_mutex_unlock(&log_mutex);
10140Sstevel@tonic-gate break;
10150Sstevel@tonic-gate }
10160Sstevel@tonic-gate
10170Sstevel@tonic-gate rc = AUDITD_SUCCESS;
10180Sstevel@tonic-gate *ret_list = NULL;
10190Sstevel@tonic-gate
10200Sstevel@tonic-gate return (rc);
10210Sstevel@tonic-gate }
10220Sstevel@tonic-gate
10230Sstevel@tonic-gate auditd_rc_t
10240Sstevel@tonic-gate auditd_plugin_close(char **error)
10250Sstevel@tonic-gate {
10260Sstevel@tonic-gate *error = NULL;
10270Sstevel@tonic-gate
10280Sstevel@tonic-gate (void) pthread_mutex_lock(&log_mutex);
1029*12918SJan.Friedel@Sun.COM close_log(&lastOpenDir, "", "");
10300Sstevel@tonic-gate freedirlist(activeDir);
10310Sstevel@tonic-gate activeDir = NULL;
10320Sstevel@tonic-gate (void) pthread_mutex_unlock(&log_mutex);
10330Sstevel@tonic-gate
10340Sstevel@tonic-gate DPRINT((dbfp, "binfile: closed\n"));
10350Sstevel@tonic-gate
103611700Sgww@eng.sun.com (void) __logpost("");
103711700Sgww@eng.sun.com
10380Sstevel@tonic-gate if (binfile_is_open) {
10390Sstevel@tonic-gate (void) pthread_mutex_destroy(&log_mutex);
10400Sstevel@tonic-gate binfile_is_open = 0;
104111706SJan.Friedel@Sun.COM #if DEBUG
10420Sstevel@tonic-gate } else {
104311706SJan.Friedel@Sun.COM (void) fprintf(dbfp,
104411706SJan.Friedel@Sun.COM "auditd_plugin_close() called when already closed.");
104511706SJan.Friedel@Sun.COM #endif
10460Sstevel@tonic-gate }
10470Sstevel@tonic-gate am_open = 0;
10480Sstevel@tonic-gate return (AUDITD_SUCCESS);
10490Sstevel@tonic-gate }
1050