xref: /onnv-gate/usr/src/lib/auditd_plugins/binfile/binfile.c (revision 12918:32a41a5f8110)
10Sstevel@tonic-gate /*
20Sstevel@tonic-gate  * CDDL HEADER START
30Sstevel@tonic-gate  *
40Sstevel@tonic-gate  * The contents of this file are subject to the terms of the
55007Spaulson  * Common Development and Distribution License (the "License").
65007Spaulson  * You may not use this file except in compliance with the License.
70Sstevel@tonic-gate  *
80Sstevel@tonic-gate  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
90Sstevel@tonic-gate  * or http://www.opensolaris.org/os/licensing.
100Sstevel@tonic-gate  * See the License for the specific language governing permissions
110Sstevel@tonic-gate  * and limitations under the License.
120Sstevel@tonic-gate  *
130Sstevel@tonic-gate  * When distributing Covered Code, include this CDDL HEADER in each
140Sstevel@tonic-gate  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
150Sstevel@tonic-gate  * If applicable, add the following below this CDDL HEADER, with the
160Sstevel@tonic-gate  * fields enclosed by brackets "[]" replaced with your own identifying
170Sstevel@tonic-gate  * information: Portions Copyright [yyyy] [name of copyright owner]
180Sstevel@tonic-gate  *
190Sstevel@tonic-gate  * CDDL HEADER END
200Sstevel@tonic-gate  */
210Sstevel@tonic-gate /*
22*12918SJan.Friedel@Sun.COM  * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
230Sstevel@tonic-gate  *
240Sstevel@tonic-gate  * write binary audit records directly to a file.
250Sstevel@tonic-gate  */
260Sstevel@tonic-gate 
270Sstevel@tonic-gate #define	DEBUG   0
280Sstevel@tonic-gate 
290Sstevel@tonic-gate #if DEBUG
3011706SJan.Friedel@Sun.COM #define	DPRINT(x) { (void) fprintf x; }
310Sstevel@tonic-gate #else
320Sstevel@tonic-gate #define	DPRINT(x)
330Sstevel@tonic-gate #endif
340Sstevel@tonic-gate 
350Sstevel@tonic-gate /*
360Sstevel@tonic-gate  * auditd_plugin_open(), auditd_plugin() and auditd_plugin_close()
370Sstevel@tonic-gate  * implement a replacable library for use by auditd; they are a
380Sstevel@tonic-gate  * project private interface and may change without notice.
390Sstevel@tonic-gate  *
400Sstevel@tonic-gate  */
410Sstevel@tonic-gate 
420Sstevel@tonic-gate #include <assert.h>
430Sstevel@tonic-gate #include <bsm/audit.h>
440Sstevel@tonic-gate #include <bsm/audit_record.h>
450Sstevel@tonic-gate #include <bsm/libbsm.h>
460Sstevel@tonic-gate #include <errno.h>
470Sstevel@tonic-gate #include <fcntl.h>
480Sstevel@tonic-gate #include <libintl.h>
490Sstevel@tonic-gate #include <netdb.h>
500Sstevel@tonic-gate #include <pthread.h>
510Sstevel@tonic-gate #include <secdb.h>
520Sstevel@tonic-gate #include <signal.h>
530Sstevel@tonic-gate #include <stdio.h>
540Sstevel@tonic-gate #include <stdlib.h>
550Sstevel@tonic-gate #include <string.h>
560Sstevel@tonic-gate #include <sys/param.h>
570Sstevel@tonic-gate #include <sys/types.h>
580Sstevel@tonic-gate #include <time.h>
590Sstevel@tonic-gate #include <tzfile.h>
600Sstevel@tonic-gate #include <unistd.h>
610Sstevel@tonic-gate #include <sys/vfs.h>
626697Spr131582 #include <limits.h>
636697Spr131582 #include <syslog.h>
640Sstevel@tonic-gate #include <security/auditd.h>
650Sstevel@tonic-gate #include <audit_plugin.h>
660Sstevel@tonic-gate 
670Sstevel@tonic-gate #define	AUDIT_DATE_SZ	14
680Sstevel@tonic-gate #define	AUDIT_FNAME_SZ	2 * AUDIT_DATE_SZ + 2 + MAXHOSTNAMELEN
690Sstevel@tonic-gate 
700Sstevel@tonic-gate 			/* per-directory status */
710Sstevel@tonic-gate #define	SOFT_SPACE	0	/* minfree or less space available	*/
720Sstevel@tonic-gate #define	PLENTY_SPACE	1	/* more than minfree available		*/
730Sstevel@tonic-gate #define	SPACE_FULL	2	/* out of space				*/
740Sstevel@tonic-gate 
750Sstevel@tonic-gate #define	AVAIL_MIN	50	/* If there are less that this number	*/
760Sstevel@tonic-gate 				/* of blocks avail, the filesystem is	*/
770Sstevel@tonic-gate 				/* presumed full.			*/
780Sstevel@tonic-gate 
795007Spaulson #define	ALLHARD_DELAY	20	/* Call audit_warn(allhard) every 20 seconds */
805007Spaulson 
816697Spr131582 /* minimum reasonable size in bytes to roll over an audit file */
826697Spr131582 #define	FSIZE_MIN	512000
830Sstevel@tonic-gate 
840Sstevel@tonic-gate /*
850Sstevel@tonic-gate  * The directory list is a circular linked list.  It is pointed into by
860Sstevel@tonic-gate  * activeDir.  Each element contains the pointer to the next
870Sstevel@tonic-gate  * element, the directory pathname, a flag for how much space there is
880Sstevel@tonic-gate  * in the directory's filesystem, and a file handle.  Since a new
890Sstevel@tonic-gate  * directory list can be created from auditd_plugin_open() while the
900Sstevel@tonic-gate  * current list is in use, activeDir is protected by log_mutex.
910Sstevel@tonic-gate  */
920Sstevel@tonic-gate typedef struct dirlist_s dirlist_t;
930Sstevel@tonic-gate struct dirlist_s {
940Sstevel@tonic-gate 	dirlist_t	*dl_next;
950Sstevel@tonic-gate 	int		dl_space;
960Sstevel@tonic-gate 	int		dl_flags;
970Sstevel@tonic-gate 	char		*dl_dirname;
980Sstevel@tonic-gate 	char		*dl_filename;	/* file name (not path) if open */
990Sstevel@tonic-gate 	int		dl_fd;		/* file handle, -1 unless open */
1000Sstevel@tonic-gate };
1010Sstevel@tonic-gate /*
1020Sstevel@tonic-gate  * Defines for dl_flags
1030Sstevel@tonic-gate  */
1040Sstevel@tonic-gate #define	SOFT_WARNED	0x0001	/* already did soft warning for this dir */
1050Sstevel@tonic-gate #define	HARD_WARNED	0x0002	/* already did hard warning for this dir */
1060Sstevel@tonic-gate 
1070Sstevel@tonic-gate #if DEBUG
1080Sstevel@tonic-gate static FILE		*dbfp;			/* debug file */
1090Sstevel@tonic-gate #endif
1100Sstevel@tonic-gate 
1110Sstevel@tonic-gate static pthread_mutex_t	log_mutex;
1120Sstevel@tonic-gate static int		binfile_is_open = 0;
1130Sstevel@tonic-gate 
1140Sstevel@tonic-gate static int		minfree = -1;
1150Sstevel@tonic-gate static int		minfreeblocks;		/* minfree in blocks */
1160Sstevel@tonic-gate 
117*12918SJan.Friedel@Sun.COM static dirlist_t	*lastOpenDir = NULL;    /* last activeDir */
118*12918SJan.Friedel@Sun.COM static dirlist_t	*activeDir = NULL;	/* to be current directory */
1195007Spaulson static dirlist_t	*startdir;		/* first dir in the ring */
1200Sstevel@tonic-gate static int		activeCount = 0;	/* number of dirs in the ring */
1210Sstevel@tonic-gate 
1225007Spaulson static int		openNewFile = 0;	/* need to open a new file */
1230Sstevel@tonic-gate static int		hung_count = 0;		/* count of audit_warn hard */
1240Sstevel@tonic-gate 
1250Sstevel@tonic-gate /* flag from audit_plugin_open to audit_plugin_close */
1260Sstevel@tonic-gate static int		am_open = 0;
1270Sstevel@tonic-gate /* preferred dir state */
1280Sstevel@tonic-gate static int		fullness_state = PLENTY_SPACE;
1290Sstevel@tonic-gate 
1306697Spr131582 /*
1316697Spr131582  * These are used to implement a maximum size for the auditing
1326697Spr131582  * file. binfile_maxsize is set via the 'p_fsize' parameter to the
1336697Spr131582  * audit_binfile plugin.
1346697Spr131582  */
1356697Spr131582 static uint_t		binfile_cursize = 0;
1366697Spr131582 static uint_t		binfile_maxsize = 0;
1376697Spr131582 
1380Sstevel@tonic-gate static int open_log(dirlist_t *);
1390Sstevel@tonic-gate 
1400Sstevel@tonic-gate static void
freedirlist(dirlist_t * head)1410Sstevel@tonic-gate freedirlist(dirlist_t *head)
1420Sstevel@tonic-gate {
1430Sstevel@tonic-gate 	dirlist_t	 *n1, *n2;
1440Sstevel@tonic-gate 	/*
1450Sstevel@tonic-gate 	 * Free up the old directory list if any
1460Sstevel@tonic-gate 	 */
1470Sstevel@tonic-gate 	if (head != NULL) {
1480Sstevel@tonic-gate 		n1 = head;
1490Sstevel@tonic-gate 		do {
1500Sstevel@tonic-gate 			n2 = n1->dl_next;
1510Sstevel@tonic-gate 			free(n1->dl_dirname);
1520Sstevel@tonic-gate 			free(n1->dl_filename);
1530Sstevel@tonic-gate 			free(n1);
1540Sstevel@tonic-gate 			n1 = n2;
1550Sstevel@tonic-gate 		} while (n1 != head);
1560Sstevel@tonic-gate 	}
1570Sstevel@tonic-gate }
1580Sstevel@tonic-gate 
159*12918SJan.Friedel@Sun.COM dirlist_t *
dupdirnode(dirlist_t * node_orig)160*12918SJan.Friedel@Sun.COM dupdirnode(dirlist_t *node_orig)
161*12918SJan.Friedel@Sun.COM {
162*12918SJan.Friedel@Sun.COM 	dirlist_t	*node_new;
163*12918SJan.Friedel@Sun.COM 
164*12918SJan.Friedel@Sun.COM 	if ((node_new = calloc(1, sizeof (dirlist_t))) == NULL) {
165*12918SJan.Friedel@Sun.COM 		return (NULL);
166*12918SJan.Friedel@Sun.COM 	}
167*12918SJan.Friedel@Sun.COM 
168*12918SJan.Friedel@Sun.COM 	if (node_orig->dl_dirname != NULL &&
169*12918SJan.Friedel@Sun.COM 	    (node_new->dl_dirname = strdup(node_orig->dl_dirname)) == NULL ||
170*12918SJan.Friedel@Sun.COM 	    node_orig->dl_filename != NULL &&
171*12918SJan.Friedel@Sun.COM 	    (node_new->dl_filename = strdup(node_orig->dl_filename)) == NULL) {
172*12918SJan.Friedel@Sun.COM 		freedirlist(node_new);
173*12918SJan.Friedel@Sun.COM 		return (NULL);
174*12918SJan.Friedel@Sun.COM 	}
175*12918SJan.Friedel@Sun.COM 
176*12918SJan.Friedel@Sun.COM 	node_new->dl_next = node_new;
177*12918SJan.Friedel@Sun.COM 	node_new->dl_space = node_orig->dl_space;
178*12918SJan.Friedel@Sun.COM 	node_new->dl_flags = node_orig->dl_flags;
179*12918SJan.Friedel@Sun.COM 	node_new->dl_fd = node_orig->dl_fd;
180*12918SJan.Friedel@Sun.COM 
181*12918SJan.Friedel@Sun.COM 	return (node_new);
182*12918SJan.Friedel@Sun.COM }
1830Sstevel@tonic-gate 
1840Sstevel@tonic-gate /*
1850Sstevel@tonic-gate  * add to a linked list of directories available for writing
1860Sstevel@tonic-gate  *
1870Sstevel@tonic-gate  */
1880Sstevel@tonic-gate static int
growauditlist(dirlist_t ** listhead,char * dirlist,dirlist_t * endnode,int * count)1890Sstevel@tonic-gate growauditlist(dirlist_t **listhead, char *dirlist,
1900Sstevel@tonic-gate     dirlist_t *endnode, int *count)
1910Sstevel@tonic-gate {
1920Sstevel@tonic-gate 	dirlist_t	*node;
1930Sstevel@tonic-gate 	char		*bs, *be;
1940Sstevel@tonic-gate 	dirlist_t	**node_p;
1950Sstevel@tonic-gate 	char		*dirname;
1960Sstevel@tonic-gate 	char		*remainder;
1970Sstevel@tonic-gate 
1980Sstevel@tonic-gate 	DPRINT((dbfp, "binfile: dirlist=%s\n", dirlist));
1990Sstevel@tonic-gate 
2000Sstevel@tonic-gate 	if (*listhead == NULL)
2010Sstevel@tonic-gate 		node_p = listhead;
2020Sstevel@tonic-gate 	else
2030Sstevel@tonic-gate 		node_p = &(endnode->dl_next);
2040Sstevel@tonic-gate 
2050Sstevel@tonic-gate 	node = NULL;
2060Sstevel@tonic-gate 	while ((dirname = strtok_r(dirlist, ",", &remainder)) != NULL) {
2070Sstevel@tonic-gate 		dirlist = NULL;
2080Sstevel@tonic-gate 
2090Sstevel@tonic-gate 		DPRINT((dbfp, "binfile: p_dir = %s\n", dirname));
2100Sstevel@tonic-gate 
2110Sstevel@tonic-gate 		(*count)++;
2120Sstevel@tonic-gate 		node = malloc(sizeof (dirlist_t));
2130Sstevel@tonic-gate 		if (node == NULL)
2140Sstevel@tonic-gate 			return (AUDITD_NO_MEMORY);
2150Sstevel@tonic-gate 
2160Sstevel@tonic-gate 		node->dl_flags = 0;
2170Sstevel@tonic-gate 		node->dl_filename = NULL;
2180Sstevel@tonic-gate 		node->dl_fd = -1;
2190Sstevel@tonic-gate 		node->dl_space = PLENTY_SPACE;
2200Sstevel@tonic-gate 
2210Sstevel@tonic-gate 		node->dl_dirname = malloc((unsigned)strlen(dirname) + 1);
2220Sstevel@tonic-gate 		if (node->dl_dirname == NULL)
2230Sstevel@tonic-gate 			return (AUDITD_NO_MEMORY);
2240Sstevel@tonic-gate 
2250Sstevel@tonic-gate 		bs = dirname;
2260Sstevel@tonic-gate 		while ((*bs == ' ') || (*bs == '\t'))	/* trim blanks */
2270Sstevel@tonic-gate 			bs++;
2280Sstevel@tonic-gate 		be = bs + strlen(bs) - 1;
2290Sstevel@tonic-gate 		while (be > bs) {	/* trim trailing blanks */
2300Sstevel@tonic-gate 			if ((*bs != ' ') && (*bs != '\t'))
2310Sstevel@tonic-gate 				break;
2320Sstevel@tonic-gate 			be--;
2330Sstevel@tonic-gate 		}
2340Sstevel@tonic-gate 		*(be + 1) = '\0';
2350Sstevel@tonic-gate 		(void) strlcpy(node->dl_dirname, bs, AUDIT_FNAME_SZ);
2360Sstevel@tonic-gate 
2370Sstevel@tonic-gate 		if (*listhead != NULL)
2380Sstevel@tonic-gate 			node->dl_next = *listhead;
2390Sstevel@tonic-gate 		else
2400Sstevel@tonic-gate 			node->dl_next = node;
2410Sstevel@tonic-gate 		*node_p = node;
2420Sstevel@tonic-gate 		node_p = &(node->dl_next);
2430Sstevel@tonic-gate 
2440Sstevel@tonic-gate 	}
2450Sstevel@tonic-gate 	return (0);
2460Sstevel@tonic-gate }
2470Sstevel@tonic-gate 
2480Sstevel@tonic-gate /*
2490Sstevel@tonic-gate  * create a linked list of directories available for writing
2500Sstevel@tonic-gate  *
2510Sstevel@tonic-gate  * if a list already exists, the two are compared and the new one is
2520Sstevel@tonic-gate  * used only if it is different than the old.
2530Sstevel@tonic-gate  *
2540Sstevel@tonic-gate  * returns -2 for new or changed list, 0 for unchanged list and -1 for
2550Sstevel@tonic-gate  * error.  (Positive returns are for AUDITD_<error code> values)
2560Sstevel@tonic-gate  *
2570Sstevel@tonic-gate  */
2580Sstevel@tonic-gate static int
loadauditlist(char * dirstr,char * minfreestr)2590Sstevel@tonic-gate loadauditlist(char *dirstr, char *minfreestr)
2600Sstevel@tonic-gate {
261*12918SJan.Friedel@Sun.COM 	dirlist_t	*n1, *n2;
2620Sstevel@tonic-gate 	dirlist_t	*listhead = NULL;
2630Sstevel@tonic-gate 	dirlist_t	*thisdir;
2640Sstevel@tonic-gate 	int		node_count = 0;
2650Sstevel@tonic-gate 	int		rc;
2660Sstevel@tonic-gate 	int		temp_minfree;
2670Sstevel@tonic-gate 
2680Sstevel@tonic-gate 	static dirlist_t	*activeList = NULL;	/* directory list */
2690Sstevel@tonic-gate 
270*12918SJan.Friedel@Sun.COM 	DPRINT((dbfp, "binfile: Loading audit list from audit service "
271*12918SJan.Friedel@Sun.COM 	    "(audit_binfile)\n"));
2720Sstevel@tonic-gate 
273*12918SJan.Friedel@Sun.COM 	if (dirstr == NULL || minfreestr == NULL) {
274*12918SJan.Friedel@Sun.COM 		DPRINT((dbfp, "binfile: internal error"));
275*12918SJan.Friedel@Sun.COM 		return (-1);
276*12918SJan.Friedel@Sun.COM 	}
277*12918SJan.Friedel@Sun.COM 	if ((rc = growauditlist(&listhead, dirstr, NULL, &node_count)) != 0) {
278*12918SJan.Friedel@Sun.COM 		return (rc);
2790Sstevel@tonic-gate 	}
2800Sstevel@tonic-gate 	if (node_count == 0) {
2810Sstevel@tonic-gate 		/*
2820Sstevel@tonic-gate 		 * there was a problem getting the directory
283*12918SJan.Friedel@Sun.COM 		 * list or remote host info from the audit_binfile
284*12918SJan.Friedel@Sun.COM 		 * configuration even though auditd thought there was
285*12918SJan.Friedel@Sun.COM 		 * at least 1 good entry
2860Sstevel@tonic-gate 		 */
2870Sstevel@tonic-gate 		DPRINT((dbfp, "binfile: "
2880Sstevel@tonic-gate 		    "problem getting directory / libpath list "
289*12918SJan.Friedel@Sun.COM 		    "from audit_binfile configuration.\n"));
2900Sstevel@tonic-gate 		return (-1);
2910Sstevel@tonic-gate 	}
292*12918SJan.Friedel@Sun.COM 
2930Sstevel@tonic-gate #if DEBUG
2940Sstevel@tonic-gate 	/* print out directory list */
2950Sstevel@tonic-gate 	if (listhead != NULL) {
29611706SJan.Friedel@Sun.COM 		(void) fprintf(dbfp, "Directory list:\n\t%s\n",
29711706SJan.Friedel@Sun.COM 		    listhead->dl_dirname);
2980Sstevel@tonic-gate 		thisdir = listhead->dl_next;
2990Sstevel@tonic-gate 
3000Sstevel@tonic-gate 		while (thisdir != listhead) {
30111706SJan.Friedel@Sun.COM 			(void) fprintf(dbfp, "\t%s\n", thisdir->dl_dirname);
3020Sstevel@tonic-gate 			thisdir = thisdir->dl_next;
3030Sstevel@tonic-gate 		}
3040Sstevel@tonic-gate 	}
3050Sstevel@tonic-gate #endif	/* DEBUG */
306*12918SJan.Friedel@Sun.COM 
3070Sstevel@tonic-gate 	thisdir = listhead;
3080Sstevel@tonic-gate 
309*12918SJan.Friedel@Sun.COM 	/* See if the list has changed (rc = 0 if no change, else 1) */
310*12918SJan.Friedel@Sun.COM 	rc = 0;
3110Sstevel@tonic-gate 	if (node_count == activeCount) {
3120Sstevel@tonic-gate 		n1 = listhead;
3130Sstevel@tonic-gate 		n2 = activeList;
3140Sstevel@tonic-gate 		do {
3150Sstevel@tonic-gate 			if (strcmp(n1->dl_dirname, n2->dl_dirname) != 0) {
3160Sstevel@tonic-gate 				DPRINT((dbfp,
3170Sstevel@tonic-gate 				    "binfile: new dirname = %s\n"
3180Sstevel@tonic-gate 				    "binfile: old dirname = %s\n",
3190Sstevel@tonic-gate 				    n1->dl_dirname,
3200Sstevel@tonic-gate 				    n2->dl_dirname));
3210Sstevel@tonic-gate 				rc = -2;
3220Sstevel@tonic-gate 				break;
3230Sstevel@tonic-gate 			}
3240Sstevel@tonic-gate 			n1 = n1->dl_next;
3250Sstevel@tonic-gate 			n2 = n2->dl_next;
3260Sstevel@tonic-gate 		} while ((n1 != listhead) && (n2 != activeList));
3270Sstevel@tonic-gate 	} else {
328*12918SJan.Friedel@Sun.COM 		DPRINT((dbfp, "binfile: dir counts differs\n"
329*12918SJan.Friedel@Sun.COM 		    "binfile:  old dir count = %d\n"
3300Sstevel@tonic-gate 		    "binfile:  new dir count = %d\n",
3310Sstevel@tonic-gate 		    activeCount, node_count));
3320Sstevel@tonic-gate 		rc = -2;
3330Sstevel@tonic-gate 	}
3340Sstevel@tonic-gate 	if (rc == -2) {
3350Sstevel@tonic-gate 		(void) pthread_mutex_lock(&log_mutex);
336*12918SJan.Friedel@Sun.COM 		DPRINT((dbfp, "loadauditlist:  close / open audit.log(4)\n"));
3375007Spaulson 		if (open_log(listhead) == 0) {
3380Sstevel@tonic-gate 			openNewFile = 1;	/* try again later */
3395007Spaulson 		} else {
3405007Spaulson 			openNewFile = 0;
3415007Spaulson 		}
3420Sstevel@tonic-gate 		freedirlist(activeList);	/* old list */
3430Sstevel@tonic-gate 		activeList = listhead;		/* new list */
3445007Spaulson 		activeDir = startdir = thisdir;
3450Sstevel@tonic-gate 		activeCount = node_count;
3460Sstevel@tonic-gate 		(void) pthread_mutex_unlock(&log_mutex);
347*12918SJan.Friedel@Sun.COM 	} else {
3480Sstevel@tonic-gate 		freedirlist(listhead);
349*12918SJan.Friedel@Sun.COM 	}
350*12918SJan.Friedel@Sun.COM 
351*12918SJan.Friedel@Sun.COM 	/* Get the minfree value. */
3520Sstevel@tonic-gate 	if (minfreestr != NULL)
3530Sstevel@tonic-gate 		temp_minfree = atoi(minfreestr);
3540Sstevel@tonic-gate 
3550Sstevel@tonic-gate 	if ((temp_minfree < 0) || (temp_minfree > 100))
3560Sstevel@tonic-gate 		temp_minfree = 0;
3570Sstevel@tonic-gate 
3580Sstevel@tonic-gate 	if (minfree != temp_minfree) {
3590Sstevel@tonic-gate 		DPRINT((dbfp, "minfree:  old = %d, new = %d\n",
3600Sstevel@tonic-gate 		    minfree, temp_minfree));
3610Sstevel@tonic-gate 		rc = -2;		/* data change */
3620Sstevel@tonic-gate 		minfree = temp_minfree;
3630Sstevel@tonic-gate 	}
3640Sstevel@tonic-gate 
3650Sstevel@tonic-gate 	return (rc);
3660Sstevel@tonic-gate }
3670Sstevel@tonic-gate 
3680Sstevel@tonic-gate /*
3690Sstevel@tonic-gate  * getauditdate - get the current time (GMT) and put it in the form
3700Sstevel@tonic-gate  *		  yyyymmddHHMMSS .
3710Sstevel@tonic-gate  */
3720Sstevel@tonic-gate static void
getauditdate(char * date)3730Sstevel@tonic-gate getauditdate(char *date)
3740Sstevel@tonic-gate {
3750Sstevel@tonic-gate 	struct timeval tp;
3760Sstevel@tonic-gate 	struct timezone tzp;
3770Sstevel@tonic-gate 	struct tm tm;
3780Sstevel@tonic-gate 
3790Sstevel@tonic-gate 	(void) gettimeofday(&tp, &tzp);
3800Sstevel@tonic-gate 	tm = *gmtime(&tp.tv_sec);
3810Sstevel@tonic-gate 	/*
3820Sstevel@tonic-gate 	 * NOTE:  if we want to use gmtime, we have to be aware that the
3830Sstevel@tonic-gate 	 *	structure only keeps the year as an offset from TM_YEAR_BASE.
3840Sstevel@tonic-gate 	 *	I have used TM_YEAR_BASE in this code so that if they change
3850Sstevel@tonic-gate 	 *	this base from 1900 to 2000, it will hopefully mean that this
3860Sstevel@tonic-gate 	 *	code does not have to change.  TM_YEAR_BASE is defined in
3870Sstevel@tonic-gate 	 *	tzfile.h .
3880Sstevel@tonic-gate 	 */
3890Sstevel@tonic-gate 	(void) sprintf(date, "%.4d%.2d%.2d%.2d%.2d%.2d",
3905007Spaulson 	    tm.tm_year + TM_YEAR_BASE, tm.tm_mon + 1, tm.tm_mday,
3915007Spaulson 	    tm.tm_hour, tm.tm_min, tm.tm_sec);
3920Sstevel@tonic-gate }
3930Sstevel@tonic-gate 
3940Sstevel@tonic-gate 
3950Sstevel@tonic-gate 
3960Sstevel@tonic-gate /*
3970Sstevel@tonic-gate  * write_file_token - put the file token into the audit log
3980Sstevel@tonic-gate  */
3990Sstevel@tonic-gate static int
write_file_token(int fd,char * name)4000Sstevel@tonic-gate write_file_token(int fd, char *name)
4010Sstevel@tonic-gate {
4020Sstevel@tonic-gate 	adr_t adr;					/* xdr ptr */
4030Sstevel@tonic-gate 	struct timeval tv;				/* time now */
4040Sstevel@tonic-gate 	char for_adr[AUDIT_FNAME_SZ + AUDIT_FNAME_SZ];	/* plenty of room */
4050Sstevel@tonic-gate 	char	token_id;
4060Sstevel@tonic-gate 	short	i;
4070Sstevel@tonic-gate 
4080Sstevel@tonic-gate 	(void) gettimeofday(&tv, (struct timezone *)0);
4090Sstevel@tonic-gate 	i = strlen(name) + 1;
4100Sstevel@tonic-gate 	adr_start(&adr, for_adr);
4110Sstevel@tonic-gate #ifdef _LP64
4120Sstevel@tonic-gate 		token_id = AUT_OTHER_FILE64;
4130Sstevel@tonic-gate 		adr_char(&adr, &token_id, 1);
4140Sstevel@tonic-gate 		adr_int64(&adr, (int64_t *)& tv, 2);
4150Sstevel@tonic-gate #else
4160Sstevel@tonic-gate 		token_id = AUT_OTHER_FILE32;
4170Sstevel@tonic-gate 		adr_char(&adr, &token_id, 1);
4180Sstevel@tonic-gate 		adr_int32(&adr, (int32_t *)& tv, 2);
4190Sstevel@tonic-gate #endif
4200Sstevel@tonic-gate 
4210Sstevel@tonic-gate 	adr_short(&adr, &i, 1);
4220Sstevel@tonic-gate 	adr_char(&adr, name, i);
4230Sstevel@tonic-gate 
4240Sstevel@tonic-gate 	if (write(fd, for_adr, adr_count(&adr)) < 0) {
4250Sstevel@tonic-gate 		DPRINT((dbfp, "binfile: Bad write\n"));
4260Sstevel@tonic-gate 		return (errno);
4270Sstevel@tonic-gate 	}
4280Sstevel@tonic-gate 	return (0);
4290Sstevel@tonic-gate }
4300Sstevel@tonic-gate 
4310Sstevel@tonic-gate /*
4320Sstevel@tonic-gate  * close_log - close the file if open.  Also put the name of the
4330Sstevel@tonic-gate  *	new log file in the trailer, and rename the old file
4340Sstevel@tonic-gate  *	to oldname.  The caller must hold log_mutext while calling
4350Sstevel@tonic-gate  *      close_log since any change to activeDir is a complete redo
4360Sstevel@tonic-gate  *	of all it points to.
4370Sstevel@tonic-gate  * arguments -
4380Sstevel@tonic-gate  *	oldname - the new name for the file to be closed
4390Sstevel@tonic-gate  *	newname - the name of the new log file (for the trailer)
4400Sstevel@tonic-gate  */
4410Sstevel@tonic-gate static void
close_log(dirlist_t ** lastOpenDir_ptr,char * oname,char * newname)442*12918SJan.Friedel@Sun.COM close_log(dirlist_t **lastOpenDir_ptr, char *oname, char *newname)
4430Sstevel@tonic-gate {
444*12918SJan.Friedel@Sun.COM 	char		auditdate[AUDIT_DATE_SZ+1];
445*12918SJan.Friedel@Sun.COM 	char		*name;
446*12918SJan.Friedel@Sun.COM 	char		oldname[AUDIT_FNAME_SZ+1];
447*12918SJan.Friedel@Sun.COM 	dirlist_t 	*currentdir = *lastOpenDir_ptr;
4480Sstevel@tonic-gate 
4490Sstevel@tonic-gate 	if ((currentdir == NULL) || (currentdir->dl_fd == -1))
4500Sstevel@tonic-gate 		return;
4510Sstevel@tonic-gate 	/*
4520Sstevel@tonic-gate 	 * If oldname is blank, we were called by auditd_plugin_close()
4530Sstevel@tonic-gate 	 * instead of by open_log, so we need to update our name.
4540Sstevel@tonic-gate 	 */
4550Sstevel@tonic-gate 	(void) strlcpy(oldname, oname, AUDIT_FNAME_SZ);
4560Sstevel@tonic-gate 
4570Sstevel@tonic-gate 	if (strcmp(oldname, "") == 0) {
4580Sstevel@tonic-gate 		getauditdate(auditdate);
4590Sstevel@tonic-gate 
4600Sstevel@tonic-gate 		assert(currentdir->dl_filename != NULL);
4610Sstevel@tonic-gate 
4620Sstevel@tonic-gate 		(void) strlcpy(oldname, currentdir->dl_filename,
4630Sstevel@tonic-gate 		    AUDIT_FNAME_SZ);
4640Sstevel@tonic-gate 
4650Sstevel@tonic-gate 		name = strrchr(oldname, '/') + 1;
4660Sstevel@tonic-gate 		(void) memcpy(name + AUDIT_DATE_SZ + 1, auditdate,
4670Sstevel@tonic-gate 		    AUDIT_DATE_SZ);
4680Sstevel@tonic-gate 	}
4690Sstevel@tonic-gate 	/*
4700Sstevel@tonic-gate 	 * Write the trailer record and rename and close the file.
4710Sstevel@tonic-gate 	 * If any of the write, rename, or close fail, ignore it
4720Sstevel@tonic-gate 	 * since there is not much else we can do and the next open()
4730Sstevel@tonic-gate 	 * will trigger the necessary full directory logic.
4740Sstevel@tonic-gate 	 *
4750Sstevel@tonic-gate 	 * newname is "" if binfile is being closed down.
4760Sstevel@tonic-gate 	 */
4770Sstevel@tonic-gate 	(void) write_file_token(currentdir->dl_fd, newname);
4785319Stz204579 	if (currentdir->dl_fd >= 0) {
4795319Stz204579 		(void) fsync(currentdir->dl_fd);
4800Sstevel@tonic-gate 		(void) close(currentdir->dl_fd);
4815319Stz204579 	}
4820Sstevel@tonic-gate 	currentdir->dl_fd = -1;
4830Sstevel@tonic-gate 	(void) rename(currentdir->dl_filename, oldname);
4840Sstevel@tonic-gate 
4850Sstevel@tonic-gate 	DPRINT((dbfp, "binfile: Log closed %s\n", oldname));
4860Sstevel@tonic-gate 
487*12918SJan.Friedel@Sun.COM 	freedirlist(currentdir);
488*12918SJan.Friedel@Sun.COM 	*lastOpenDir_ptr = NULL;
4890Sstevel@tonic-gate }
4900Sstevel@tonic-gate 
4910Sstevel@tonic-gate 
4920Sstevel@tonic-gate /*
4930Sstevel@tonic-gate  * open_log - open a new file in the current directory.  If a
4940Sstevel@tonic-gate  *	file is already open, close it.
4950Sstevel@tonic-gate  *
4960Sstevel@tonic-gate  *	return 1 if ok, 0 if all directories are full.
4970Sstevel@tonic-gate  *
4980Sstevel@tonic-gate  *	lastOpenDir - used to get the oldfile name (and change it),
4990Sstevel@tonic-gate  *		to close the oldfile.
5000Sstevel@tonic-gate  *
5010Sstevel@tonic-gate  * The caller must hold log_mutex while calling open_log.
5020Sstevel@tonic-gate  *
5030Sstevel@tonic-gate  */
5040Sstevel@tonic-gate static int
open_log(dirlist_t * current_dir)5050Sstevel@tonic-gate open_log(dirlist_t *current_dir)
5060Sstevel@tonic-gate {
5070Sstevel@tonic-gate 	char	auditdate[AUDIT_DATE_SZ + 1];
5080Sstevel@tonic-gate 	char	oldname[AUDIT_FNAME_SZ + 1] = "";
5090Sstevel@tonic-gate 	char	newname[AUDIT_FNAME_SZ + 1];
5100Sstevel@tonic-gate 	char	*name;			/* pointer into oldname */
511*12918SJan.Friedel@Sun.COM 	int	opened = 0;
5120Sstevel@tonic-gate 	int	error = 0;
5130Sstevel@tonic-gate 	int	newfd = 0;
5140Sstevel@tonic-gate 
5150Sstevel@tonic-gate 	static char		host[MAXHOSTNAMELEN + 1] = "";
5160Sstevel@tonic-gate 	/* previous directory with open log file */
5170Sstevel@tonic-gate 
5180Sstevel@tonic-gate 	if (host[0] == '\0')
5190Sstevel@tonic-gate 		(void) gethostname(host, MAXHOSTNAMELEN);
5200Sstevel@tonic-gate 
5210Sstevel@tonic-gate 	/* Get a filename which does not already exist */
5220Sstevel@tonic-gate 	while (!opened) {
5230Sstevel@tonic-gate 		getauditdate(auditdate);
5240Sstevel@tonic-gate 		(void) snprintf(newname, AUDIT_FNAME_SZ,
5250Sstevel@tonic-gate 		    "%s/%s.not_terminated.%s",
5260Sstevel@tonic-gate 		    current_dir->dl_dirname, auditdate, host);
5270Sstevel@tonic-gate 		newfd = open(newname,
528832Sme23304 		    O_RDWR | O_APPEND | O_CREAT | O_EXCL, 0640);
5290Sstevel@tonic-gate 		if (newfd < 0) {
5300Sstevel@tonic-gate 			switch (errno) {
5310Sstevel@tonic-gate 			case EEXIST:
5320Sstevel@tonic-gate 				DPRINT((dbfp,
5330Sstevel@tonic-gate 				    "open_log says duplicate for %s "
5340Sstevel@tonic-gate 				    "(will try another)\n", newname));
5350Sstevel@tonic-gate 				(void) sleep(1);
5360Sstevel@tonic-gate 				break;
537*12918SJan.Friedel@Sun.COM 			case ENOENT: {
538*12918SJan.Friedel@Sun.COM 				/* invalid path */
539*12918SJan.Friedel@Sun.COM 				char	*msg;
540*12918SJan.Friedel@Sun.COM 				(void) asprintf(&msg,
541*12918SJan.Friedel@Sun.COM 				    gettext("No such p_dir: %s\n"),
542*12918SJan.Friedel@Sun.COM 				    current_dir->dl_dirname);
543*12918SJan.Friedel@Sun.COM 				DPRINT((dbfp,
544*12918SJan.Friedel@Sun.COM 				    "open_log says about %s: %s\n",
545*12918SJan.Friedel@Sun.COM 				    newname, strerror(errno)));
546*12918SJan.Friedel@Sun.COM 				__audit_syslog("audit_binfile.so",
547*12918SJan.Friedel@Sun.COM 				    LOG_CONS | LOG_NDELAY,
548*12918SJan.Friedel@Sun.COM 				    LOG_DAEMON, LOG_ERR, msg);
549*12918SJan.Friedel@Sun.COM 				free(msg);
550*12918SJan.Friedel@Sun.COM 				current_dir = current_dir->dl_next;
551*12918SJan.Friedel@Sun.COM 				return (0);
552*12918SJan.Friedel@Sun.COM 			}
5530Sstevel@tonic-gate 			default:
5540Sstevel@tonic-gate 				/* open failed */
5550Sstevel@tonic-gate 				DPRINT((dbfp,
5560Sstevel@tonic-gate 				    "open_log says full for %s: %s\n",
5570Sstevel@tonic-gate 				    newname, strerror(errno)));
5580Sstevel@tonic-gate 				current_dir->dl_space = SPACE_FULL;
5590Sstevel@tonic-gate 				current_dir = current_dir->dl_next;
5600Sstevel@tonic-gate 				return (0);
5610Sstevel@tonic-gate 			} /* switch */
5620Sstevel@tonic-gate 		} else
5630Sstevel@tonic-gate 			opened = 1;
5640Sstevel@tonic-gate 	} /* while */
5650Sstevel@tonic-gate 
5660Sstevel@tonic-gate 	/*
5670Sstevel@tonic-gate 	 * When we get here, we have opened our new log file.
5680Sstevel@tonic-gate 	 * Now we need to update the name of the old file to
5690Sstevel@tonic-gate 	 * store in this file's header.  lastOpenDir may point
5700Sstevel@tonic-gate 	 * to current_dir if the list is only one entry long and
5710Sstevel@tonic-gate 	 * there is only one list.
5720Sstevel@tonic-gate 	 */
5730Sstevel@tonic-gate 	if ((lastOpenDir != NULL) && (lastOpenDir->dl_filename != NULL)) {
5740Sstevel@tonic-gate 		(void) strlcpy(oldname, lastOpenDir->dl_filename,
5750Sstevel@tonic-gate 		    AUDIT_FNAME_SZ);
5760Sstevel@tonic-gate 		name = (char *)strrchr(oldname, '/') + 1;
5770Sstevel@tonic-gate 
5780Sstevel@tonic-gate 		(void) memcpy(name + AUDIT_DATE_SZ + 1, auditdate,
5795007Spaulson 		    AUDIT_DATE_SZ);
5800Sstevel@tonic-gate 
581*12918SJan.Friedel@Sun.COM 		close_log(&lastOpenDir, oldname, newname);
5820Sstevel@tonic-gate 	}
5830Sstevel@tonic-gate 	error = write_file_token(newfd, oldname);
5840Sstevel@tonic-gate 	if (error) {
5850Sstevel@tonic-gate 		/* write token failed */
5860Sstevel@tonic-gate 		(void) close(newfd);
5870Sstevel@tonic-gate 
5880Sstevel@tonic-gate 		current_dir->dl_space = SPACE_FULL;
5890Sstevel@tonic-gate 		current_dir->dl_fd = -1;
5900Sstevel@tonic-gate 		free(current_dir->dl_filename);
5910Sstevel@tonic-gate 		current_dir->dl_filename = NULL;
5920Sstevel@tonic-gate 		current_dir = current_dir->dl_next;
5930Sstevel@tonic-gate 		return (0);
5940Sstevel@tonic-gate 	} else {
595*12918SJan.Friedel@Sun.COM 		if (current_dir->dl_filename != NULL) {
596*12918SJan.Friedel@Sun.COM 			free(current_dir->dl_filename);
597*12918SJan.Friedel@Sun.COM 		}
598*12918SJan.Friedel@Sun.COM 		current_dir->dl_filename = strdup(newname);
5990Sstevel@tonic-gate 		current_dir->dl_fd = newfd;
600*12918SJan.Friedel@Sun.COM 
601*12918SJan.Friedel@Sun.COM 		if (lastOpenDir == NULL) {
602*12918SJan.Friedel@Sun.COM 			freedirlist(lastOpenDir);
603*12918SJan.Friedel@Sun.COM 			if ((lastOpenDir = dupdirnode(current_dir)) == NULL) {
604*12918SJan.Friedel@Sun.COM 				__audit_syslog("audit_binfile.so",
605*12918SJan.Friedel@Sun.COM 				    LOG_CONS | LOG_NDELAY,
606*12918SJan.Friedel@Sun.COM 				    LOG_DAEMON, LOG_ERR, gettext("no memory"));
607*12918SJan.Friedel@Sun.COM 				return (0);
608*12918SJan.Friedel@Sun.COM 			}
609*12918SJan.Friedel@Sun.COM 			DPRINT((dbfp, "open_log created new lastOpenDir "
610*12918SJan.Friedel@Sun.COM 			    "(%s, %s [fd: %d])\n",
611*12918SJan.Friedel@Sun.COM 			    lastOpenDir->dl_dirname == NULL ? "" :
612*12918SJan.Friedel@Sun.COM 			    lastOpenDir->dl_dirname,
613*12918SJan.Friedel@Sun.COM 			    lastOpenDir->dl_filename == NULL ? "" :
614*12918SJan.Friedel@Sun.COM 			    lastOpenDir->dl_filename, lastOpenDir->dl_fd));
615*12918SJan.Friedel@Sun.COM 		}
6160Sstevel@tonic-gate 
6176697Spr131582 		/*
6186697Spr131582 		 * New file opened, so reset file size statistic (used
6196697Spr131582 		 * to ensure audit log does not grow above size limit
6206697Spr131582 		 * set by p_fsize).
6216697Spr131582 		 */
6226697Spr131582 		binfile_cursize = 0;
6236697Spr131582 
62411411SSurya.Prakki@Sun.COM 		(void) __logpost(newname);
6250Sstevel@tonic-gate 
6260Sstevel@tonic-gate 		DPRINT((dbfp, "binfile: Log opened: %s\n", newname));
6270Sstevel@tonic-gate 		return (1);
6280Sstevel@tonic-gate 	}
6290Sstevel@tonic-gate }
6300Sstevel@tonic-gate 
6310Sstevel@tonic-gate #define	IGNORE_SIZE	8192
6320Sstevel@tonic-gate /*
6330Sstevel@tonic-gate  * spacecheck - determine whether the given directory's filesystem
6340Sstevel@tonic-gate  *	has the at least the space requested.  Also set the space
6350Sstevel@tonic-gate  *	value in the directory list structure.  If the caller
6360Sstevel@tonic-gate  *	passes other than PLENTY_SPACE or SOFT_SPACE, the caller should
6370Sstevel@tonic-gate  *	ignore the return value.  Otherwise, 0 = less than the
6380Sstevel@tonic-gate  *	requested space is available, 1 = at least the requested space
6390Sstevel@tonic-gate  *	is available.
6400Sstevel@tonic-gate  *
6410Sstevel@tonic-gate  *	log_mutex must be held by the caller
6420Sstevel@tonic-gate  *
6430Sstevel@tonic-gate  *	-1 is returned if stat fails
6440Sstevel@tonic-gate  *
6450Sstevel@tonic-gate  * IGNORE_SIZE is one page (Sol 9 / 10 timeframe) and is the default
6460Sstevel@tonic-gate  * buffer size written for Sol 9 and earlier.  To keep the same accuracy
6470Sstevel@tonic-gate  * for the soft limit check as before, spacecheck checks for space
6480Sstevel@tonic-gate  * remaining IGNORE_SIZE bytes.  This reduces the number of statvfs()
6490Sstevel@tonic-gate  * calls and related math.
6500Sstevel@tonic-gate  *
6510Sstevel@tonic-gate  * globals -
6520Sstevel@tonic-gate  *	minfree - the soft limit, i.e., the % of filesystem to reserve
6530Sstevel@tonic-gate  */
6540Sstevel@tonic-gate static int
spacecheck(dirlist_t * thisdir,int test_limit,size_t next_buf_size)6550Sstevel@tonic-gate spacecheck(dirlist_t *thisdir, int test_limit, size_t next_buf_size)
6560Sstevel@tonic-gate {
6570Sstevel@tonic-gate 	struct statvfs	sb;
6580Sstevel@tonic-gate 	static int	ignore_size = 0;
6590Sstevel@tonic-gate 
6600Sstevel@tonic-gate 	ignore_size += next_buf_size;
6610Sstevel@tonic-gate 
6620Sstevel@tonic-gate 	if ((test_limit == PLENTY_SPACE) && (ignore_size < IGNORE_SIZE))
6630Sstevel@tonic-gate 		return (1);
6640Sstevel@tonic-gate 
6650Sstevel@tonic-gate 	assert(thisdir != NULL);
6660Sstevel@tonic-gate 
6675007Spaulson 	if (statvfs(thisdir->dl_dirname, &sb) < 0) {
6680Sstevel@tonic-gate 		thisdir->dl_space = SPACE_FULL;
6690Sstevel@tonic-gate 		minfreeblocks = AVAIL_MIN;
6700Sstevel@tonic-gate 		return (-1);
6710Sstevel@tonic-gate 	} else {
6720Sstevel@tonic-gate 		minfreeblocks = ((minfree * sb.f_blocks) / 100) + AVAIL_MIN;
6730Sstevel@tonic-gate 
6740Sstevel@tonic-gate 		if (sb.f_bavail < AVAIL_MIN)
6750Sstevel@tonic-gate 			thisdir->dl_space = SPACE_FULL;
6765007Spaulson 		else if (sb.f_bavail > minfreeblocks) {
6775007Spaulson 			thisdir->dl_space = fullness_state = PLENTY_SPACE;
6785007Spaulson 			ignore_size = 0;
6795007Spaulson 		} else
6800Sstevel@tonic-gate 			thisdir->dl_space = SOFT_SPACE;
6810Sstevel@tonic-gate 	}
6820Sstevel@tonic-gate 	if (thisdir->dl_space == PLENTY_SPACE)
6830Sstevel@tonic-gate 		return (1);
6840Sstevel@tonic-gate 
6850Sstevel@tonic-gate 	return (thisdir->dl_space == test_limit);
6860Sstevel@tonic-gate }
6870Sstevel@tonic-gate 
6880Sstevel@tonic-gate /*
6896697Spr131582  * Parses p_fsize value and contains it within the range FSIZE_MIN and
6906697Spr131582  * INT_MAX so using uints won't cause an undetected overflow of
6916697Spr131582  * INT_MAX.  Defaults to 0 if the value is invalid or is missing.
6926697Spr131582  */
6936697Spr131582 static void
save_maxsize(char * maxsize)6946697Spr131582 save_maxsize(char *maxsize) {
6956697Spr131582 	/*
6966697Spr131582 	 * strtol() returns a long which could be larger than int so
6976697Spr131582 	 * store here for sanity checking first
6986697Spr131582 	 */
6996697Spr131582 	long proposed_maxsize;
7006697Spr131582 
7016697Spr131582 	if (maxsize != NULL) {
7026697Spr131582 		/*
7036697Spr131582 		 * There is no explicit error return from strtol() so
7046697Spr131582 		 * we may need to depend on the value of errno.
7056697Spr131582 		 */
7066697Spr131582 		errno = 0;
7076697Spr131582 		proposed_maxsize = strtol(maxsize, (char **)NULL, 10);
7086697Spr131582 
7096697Spr131582 		/*
7106697Spr131582 		 * If sizeof(long) is greater than sizeof(int) on this
7116697Spr131582 		 * platform, proposed_maxsize might be greater than
7126697Spr131582 		 * INT_MAX without it being reported as ERANGE.
7136697Spr131582 		 */
7146697Spr131582 		if ((errno == ERANGE) ||
7156697Spr131582 		    ((proposed_maxsize != 0) &&
7166697Spr131582 			(proposed_maxsize < FSIZE_MIN)) ||
7176697Spr131582 		    (proposed_maxsize > INT_MAX)) {
7186697Spr131582 			binfile_maxsize = 0;
7196697Spr131582 			DPRINT((dbfp, "binfile: p_fsize parameter out of "
7206697Spr131582 					"range: %s\n", maxsize));
7216697Spr131582 			/*
7226697Spr131582 			 * Inform administrator of the error via
7236697Spr131582 			 * syslog
7246697Spr131582 			 */
7256697Spr131582 			__audit_syslog("audit_binfile.so",
7266697Spr131582 			    LOG_CONS | LOG_NDELAY,
7276697Spr131582 			    LOG_DAEMON, LOG_ERR,
7286697Spr131582 			    gettext("p_fsize parameter out of range\n"));
7296697Spr131582 		} else {
7306697Spr131582 			binfile_maxsize = proposed_maxsize;
7316697Spr131582 		}
7326697Spr131582 	} else { /* p_fsize string was not present */
7336697Spr131582 		binfile_maxsize = 0;
7346697Spr131582 	}
7356697Spr131582 
7366697Spr131582 	DPRINT((dbfp, "binfile: set maxsize to %d\n", binfile_maxsize));
7376697Spr131582 }
7386697Spr131582 
7396697Spr131582 /*
7405007Spaulson  * auditd_plugin() writes a buffer to the currently open file. The
7416697Spr131582  * global "openNewFile" is used to force a new log file for cases such
7426697Spr131582  * as the initial open, when minfree is reached, the p_fsize value is
7436697Spr131582  * exceeded or the current file system fills up, and "audit -s" with
7446697Spr131582  * changed parameters.  For "audit -n" a new log file is opened
7456697Spr131582  * immediately in auditd_plugin_open().
7460Sstevel@tonic-gate  *
7470Sstevel@tonic-gate  * This function manages one or more audit directories as follows:
7480Sstevel@tonic-gate  *
7490Sstevel@tonic-gate  * 	If the current open file is in a directory that has not
7500Sstevel@tonic-gate  *	reached the soft limit, write the input data and return.
7510Sstevel@tonic-gate  *
7520Sstevel@tonic-gate  *	Scan the list of directories for one which has not reached
7530Sstevel@tonic-gate  *	the soft limit; if one is found, write and return.  Such
7540Sstevel@tonic-gate  *	a writable directory is in "PLENTY_SPACE" state.
7550Sstevel@tonic-gate  *
7560Sstevel@tonic-gate  *	Scan the list of directories for one which has not reached
7570Sstevel@tonic-gate  *	the hard limit; if one is found, write and return.  This
7580Sstevel@tonic-gate  *	directory in in "SOFT_SPACE" state.
7590Sstevel@tonic-gate  *
7600Sstevel@tonic-gate  * Oh, and if a write fails, handle it like a hard space limit.
7610Sstevel@tonic-gate  *
7620Sstevel@tonic-gate  * audit_warn (via __audit_dowarn()) is used to alert an operator
7630Sstevel@tonic-gate  * at various levels of fullness.
7640Sstevel@tonic-gate  */
7650Sstevel@tonic-gate /* ARGSUSED */
7660Sstevel@tonic-gate auditd_rc_t
auditd_plugin(const char * input,size_t in_len,uint64_t sequence,char ** error)76711704SJan.Friedel@Sun.COM auditd_plugin(const char *input, size_t in_len, uint64_t sequence, char **error)
7680Sstevel@tonic-gate {
7690Sstevel@tonic-gate 	auditd_rc_t	rc = AUDITD_FAIL;
7700Sstevel@tonic-gate 	int		open_status;
7710Sstevel@tonic-gate 	size_t		out_len;
7720Sstevel@tonic-gate 	/* avoid excess audit_warnage */
7730Sstevel@tonic-gate 	static int	allsoftfull_warning = 0;
7745007Spaulson 	static int	allhard_pause = 0;
7755007Spaulson 	static struct timeval	next_allhard;
7765007Spaulson 	struct timeval	now;
7770Sstevel@tonic-gate #if DEBUG
77811706SJan.Friedel@Sun.COM 	int		statrc;
7790Sstevel@tonic-gate 	static char	*last_file_written_to = NULL;
78011704SJan.Friedel@Sun.COM 	static uint64_t	last_sequence = 0;
78111704SJan.Friedel@Sun.COM 	static uint64_t	write_count = 0;
7820Sstevel@tonic-gate 
7830Sstevel@tonic-gate 	if ((last_sequence > 0) && (sequence != last_sequence + 1))
78411706SJan.Friedel@Sun.COM 		(void) fprintf(dbfp,
78511706SJan.Friedel@Sun.COM 		    "binfile: buffer sequence=%llu but prev=%llu=n",
7865007Spaulson 		    sequence, last_sequence);
7870Sstevel@tonic-gate 	last_sequence = sequence;
7880Sstevel@tonic-gate 
78911706SJan.Friedel@Sun.COM 	(void) fprintf(dbfp, "binfile: input seq=%llu, len=%d\n",
79011706SJan.Friedel@Sun.COM 	    sequence, in_len);
7910Sstevel@tonic-gate #endif
7920Sstevel@tonic-gate 	*error = NULL;
7930Sstevel@tonic-gate 	/*
7940Sstevel@tonic-gate 	 * lock is for activeDir, referenced by open_log() and close_log()
7950Sstevel@tonic-gate 	 */
7960Sstevel@tonic-gate 	(void) pthread_mutex_lock(&log_mutex);
7976697Spr131582 
7986697Spr131582 	/*
7996697Spr131582 	 * If this would take us over the maximum size, open a new
8006697Spr131582 	 * file, unless maxsize is 0, in which case growth of the
8016697Spr131582 	 * audit log is unrestricted.
8026697Spr131582 	 */
8036697Spr131582 	if ((binfile_maxsize != 0) &&
8046697Spr131582 	    ((binfile_cursize + in_len) > binfile_maxsize)) {
8056697Spr131582 		DPRINT((dbfp, "binfile: maxsize exceeded, opening new audit "
8066697Spr131582 		    "file.\n"));
8076697Spr131582 		openNewFile = 1;
8086697Spr131582 	}
8096697Spr131582 
8100Sstevel@tonic-gate 	while (rc == AUDITD_FAIL) {
8110Sstevel@tonic-gate 		open_status = 1;
8120Sstevel@tonic-gate 		if (openNewFile) {
8130Sstevel@tonic-gate 			open_status = open_log(activeDir);
8140Sstevel@tonic-gate 			if (open_status == 1)	/* ok */
8150Sstevel@tonic-gate 				openNewFile = 0;
8160Sstevel@tonic-gate 		}
8170Sstevel@tonic-gate 		/*
8180Sstevel@tonic-gate 		 * consider "space ok" return and error return the same;
8190Sstevel@tonic-gate 		 * a -1 means spacecheck couldn't check for space.
8200Sstevel@tonic-gate 		 */
82111706SJan.Friedel@Sun.COM #if !DEBUG
82211706SJan.Friedel@Sun.COM 		if ((open_status == 1) &&
82311706SJan.Friedel@Sun.COM 		    (spacecheck(activeDir, fullness_state, in_len) != 0)) {
82411706SJan.Friedel@Sun.COM #else
8250Sstevel@tonic-gate 		if ((open_status == 1) &&
8260Sstevel@tonic-gate 		    (statrc = spacecheck(activeDir, fullness_state,
82711706SJan.Friedel@Sun.COM 		    in_len) != 0)) {
8280Sstevel@tonic-gate 			DPRINT((dbfp, "binfile: returned from spacecheck\n"));
8290Sstevel@tonic-gate 			/*
8300Sstevel@tonic-gate 			 * The last copy of last_file_written_to is
8310Sstevel@tonic-gate 			 * never free'd, so there will be one open
8320Sstevel@tonic-gate 			 * memory reference on exit.  It's debug only.
8330Sstevel@tonic-gate 			 */
8340Sstevel@tonic-gate 			if ((last_file_written_to != NULL) &&
8350Sstevel@tonic-gate 			    (strcmp(last_file_written_to,
8360Sstevel@tonic-gate 			    activeDir->dl_filename) != 0)) {
8370Sstevel@tonic-gate 				DPRINT((dbfp, "binfile:  now writing to %s\n",
8380Sstevel@tonic-gate 				    activeDir->dl_filename));
8390Sstevel@tonic-gate 				free(last_file_written_to);
8400Sstevel@tonic-gate 			}
8410Sstevel@tonic-gate 			DPRINT((dbfp, "binfile:  finished some debug stuff\n"));
8420Sstevel@tonic-gate 			last_file_written_to =
8430Sstevel@tonic-gate 			    strdup(activeDir->dl_filename);
8440Sstevel@tonic-gate #endif
8450Sstevel@tonic-gate 			out_len = write(activeDir->dl_fd, input, in_len);
8460Sstevel@tonic-gate 			DPRINT((dbfp, "binfile:  finished the write\n"));
8470Sstevel@tonic-gate 
8486697Spr131582 			binfile_cursize += out_len;
8496697Spr131582 
8500Sstevel@tonic-gate 			if (out_len == in_len) {
8510Sstevel@tonic-gate 				DPRINT((dbfp,
85211704SJan.Friedel@Sun.COM 				    "binfile: write_count=%llu, sequence=%llu,"
8530Sstevel@tonic-gate 				    " l=%u\n",
8540Sstevel@tonic-gate 				    ++write_count, sequence, out_len));
8550Sstevel@tonic-gate 				allsoftfull_warning = 0;
8565007Spaulson 				activeDir->dl_flags = 0;
8570Sstevel@tonic-gate 
8580Sstevel@tonic-gate 				rc = AUDITD_SUCCESS;
8590Sstevel@tonic-gate 				break;
8605007Spaulson 			} else if (!(activeDir->dl_flags & HARD_WARNED)) {
8610Sstevel@tonic-gate 				DPRINT((dbfp,
86211704SJan.Friedel@Sun.COM 				    "binfile: write failed, sequence=%llu, "
8630Sstevel@tonic-gate 				    "l=%u\n", sequence, out_len));
8640Sstevel@tonic-gate 				DPRINT((dbfp, "hard warning sent.\n"));
8650Sstevel@tonic-gate 				__audit_dowarn("hard", activeDir->dl_dirname,
8660Sstevel@tonic-gate 				    0);
8670Sstevel@tonic-gate 
8680Sstevel@tonic-gate 				activeDir->dl_flags |= HARD_WARNED;
8690Sstevel@tonic-gate 			}
8700Sstevel@tonic-gate 		} else {
8710Sstevel@tonic-gate 			DPRINT((dbfp, "binfile: statrc=%d, fullness_state=%d\n",
8720Sstevel@tonic-gate 			    statrc, fullness_state));
8735007Spaulson 			if (!(activeDir->dl_flags & SOFT_WARNED) &&
8745007Spaulson 			    (activeDir->dl_space == SOFT_SPACE)) {
8750Sstevel@tonic-gate 				DPRINT((dbfp, "soft warning sent\n"));
8760Sstevel@tonic-gate 				__audit_dowarn("soft",
8770Sstevel@tonic-gate 				    activeDir->dl_dirname, 0);
8780Sstevel@tonic-gate 				activeDir->dl_flags |= SOFT_WARNED;
8790Sstevel@tonic-gate 			}
8805007Spaulson 			if (!(activeDir->dl_flags & HARD_WARNED) &&
8815007Spaulson 			    (activeDir->dl_space == SPACE_FULL)) {
8820Sstevel@tonic-gate 				DPRINT((dbfp, "hard warning sent.\n"));
8830Sstevel@tonic-gate 				__audit_dowarn("hard",
8845007Spaulson 				    activeDir->dl_dirname, 0);
8850Sstevel@tonic-gate 				activeDir->dl_flags |= HARD_WARNED;
8860Sstevel@tonic-gate 			}
8870Sstevel@tonic-gate 		}
8880Sstevel@tonic-gate 		DPRINT((dbfp, "binfile: activeDir=%s, next=%s\n",
8890Sstevel@tonic-gate 		    activeDir->dl_dirname, activeDir->dl_next->dl_dirname));
8900Sstevel@tonic-gate 
8910Sstevel@tonic-gate 		activeDir = activeDir->dl_next;
8925007Spaulson 		openNewFile = 1;
8930Sstevel@tonic-gate 
8940Sstevel@tonic-gate 		if (activeDir == startdir) {		/* full circle */
8950Sstevel@tonic-gate 			if (fullness_state == PLENTY_SPACE) {	/* once */
8960Sstevel@tonic-gate 				fullness_state = SOFT_SPACE;
8970Sstevel@tonic-gate 				if (allsoftfull_warning == 0) {
8980Sstevel@tonic-gate 					allsoftfull_warning++;
8990Sstevel@tonic-gate 					__audit_dowarn("allsoft", "", 0);
9000Sstevel@tonic-gate 				}
9010Sstevel@tonic-gate 			} else {			/* full circle twice */
9025007Spaulson 				if ((hung_count > 0) && !allhard_pause) {
9035007Spaulson 					allhard_pause = 1;
9045007Spaulson 					(void) gettimeofday(&next_allhard,
9055007Spaulson 					    NULL);
9065007Spaulson 					next_allhard.tv_sec += ALLHARD_DELAY;
9075007Spaulson 				}
9085007Spaulson 
9095007Spaulson 				if (allhard_pause) {
9105007Spaulson 					(void) gettimeofday(&now, NULL);
9115007Spaulson 					if (now.tv_sec >= next_allhard.tv_sec) {
9125007Spaulson 						allhard_pause = 0;
9135007Spaulson 						__audit_dowarn("allhard", "",
9145007Spaulson 						    ++hung_count);
9155007Spaulson 					}
9165007Spaulson 				} else {
9175007Spaulson 					__audit_dowarn("allhard", "",
9185007Spaulson 					    ++hung_count);
9195007Spaulson 				}
9200Sstevel@tonic-gate 				minfreeblocks = AVAIL_MIN;
9210Sstevel@tonic-gate 				rc = AUDITD_RETRY;
9220Sstevel@tonic-gate 				*error = strdup(gettext(
9230Sstevel@tonic-gate 				    "all partitions full\n"));
92411411SSurya.Prakki@Sun.COM 				(void) __logpost("");
9250Sstevel@tonic-gate 			}
9260Sstevel@tonic-gate 		}
9270Sstevel@tonic-gate 	}
9280Sstevel@tonic-gate 	(void) pthread_mutex_unlock(&log_mutex);
9290Sstevel@tonic-gate 
9300Sstevel@tonic-gate 	return (rc);
9310Sstevel@tonic-gate }
9320Sstevel@tonic-gate 
9330Sstevel@tonic-gate 
9340Sstevel@tonic-gate /*
9350Sstevel@tonic-gate  * It may be called multiple times as auditd handles SIGHUP and SIGUSR1
9360Sstevel@tonic-gate  * corresponding to the audit(1M) flags -s and -n
9370Sstevel@tonic-gate  *
938*12918SJan.Friedel@Sun.COM  * kvlist is NULL only if auditd caught a SIGUSR1 (audit -n), so after the first
939*12918SJan.Friedel@Sun.COM  * time open is called; the reason is -s if kvlist != NULL and -n otherwise.
9400Sstevel@tonic-gate  *
9410Sstevel@tonic-gate  */
9420Sstevel@tonic-gate auditd_rc_t
9430Sstevel@tonic-gate auditd_plugin_open(const kva_t *kvlist, char **ret_list, char **error)
9440Sstevel@tonic-gate {
9450Sstevel@tonic-gate 	int		rc = 0;
9460Sstevel@tonic-gate 	int		status;
9470Sstevel@tonic-gate 	int		reason;
9480Sstevel@tonic-gate 	char		*dirlist;
9490Sstevel@tonic-gate 	char		*minfree;
9506697Spr131582 	char		*maxsize;
9510Sstevel@tonic-gate 	kva_t		*kv;
9520Sstevel@tonic-gate 
9530Sstevel@tonic-gate 	*error = NULL;
9540Sstevel@tonic-gate 	*ret_list = NULL;
9550Sstevel@tonic-gate 	kv = (kva_t *)kvlist;
9560Sstevel@tonic-gate 
9570Sstevel@tonic-gate 	if (am_open) {
9580Sstevel@tonic-gate 		if (kvlist == NULL)
9590Sstevel@tonic-gate 			reason = 1;	/* audit -n */
9600Sstevel@tonic-gate 		else
9610Sstevel@tonic-gate 			reason = 2;	/* audit -s */
9620Sstevel@tonic-gate 	} else {
9630Sstevel@tonic-gate 		reason = 0;		/* initial open */
9640Sstevel@tonic-gate #if DEBUG
9650Sstevel@tonic-gate 		dbfp = __auditd_debug_file_open();
9660Sstevel@tonic-gate #endif
9670Sstevel@tonic-gate 	}
9680Sstevel@tonic-gate 	DPRINT((dbfp, "binfile: am_open=%d, reason=%d\n", am_open, reason));
9690Sstevel@tonic-gate 
9700Sstevel@tonic-gate 	am_open = 1;
9710Sstevel@tonic-gate 
9720Sstevel@tonic-gate 	if (kvlist == NULL) {
9730Sstevel@tonic-gate 		dirlist = NULL;
9740Sstevel@tonic-gate 		minfree = NULL;
9756697Spr131582 		maxsize = NULL;
9760Sstevel@tonic-gate 	} else {
9770Sstevel@tonic-gate 		dirlist = kva_match(kv, "p_dir");
9780Sstevel@tonic-gate 		minfree = kva_match(kv, "p_minfree");
9796697Spr131582 		maxsize = kva_match(kv, "p_fsize");
9800Sstevel@tonic-gate 	}
9810Sstevel@tonic-gate 	switch (reason) {
9820Sstevel@tonic-gate 	case 0:			/* initial open */
9830Sstevel@tonic-gate 		if (!binfile_is_open)
9840Sstevel@tonic-gate 			(void) pthread_mutex_init(&log_mutex, NULL);
9850Sstevel@tonic-gate 		binfile_is_open = 1;
9860Sstevel@tonic-gate 		openNewFile = 1;
9870Sstevel@tonic-gate 		/* FALLTHRU */
9880Sstevel@tonic-gate 	case 2:			/* audit -s */
9896697Spr131582 		/* handle p_fsize parameter */
9906697Spr131582 		save_maxsize(maxsize);
9916697Spr131582 
9920Sstevel@tonic-gate 		fullness_state = PLENTY_SPACE;
9930Sstevel@tonic-gate 		status = loadauditlist(dirlist, minfree);
9940Sstevel@tonic-gate 
9950Sstevel@tonic-gate 		if (status == -1) {
99611411SSurya.Prakki@Sun.COM 			(void) __logpost("");
9970Sstevel@tonic-gate 			*error = strdup(gettext("no directories configured"));
9980Sstevel@tonic-gate 			return (AUDITD_RETRY);
9990Sstevel@tonic-gate 		} else if (status == AUDITD_NO_MEMORY) {
100011411SSurya.Prakki@Sun.COM 			(void) __logpost("");
10010Sstevel@tonic-gate 			*error = strdup(gettext("no memory"));
10020Sstevel@tonic-gate 			return (status);
10030Sstevel@tonic-gate 		} else {	/* status is 0 or -2 (no change or changed) */
10040Sstevel@tonic-gate 			hung_count = 0;
10050Sstevel@tonic-gate 			DPRINT((dbfp, "binfile: loadauditlist returned %d\n",
10065007Spaulson 			    status));
10070Sstevel@tonic-gate 		}
10080Sstevel@tonic-gate 		break;
10090Sstevel@tonic-gate 	case 1:			/* audit -n */
10100Sstevel@tonic-gate 		(void) pthread_mutex_lock(&log_mutex);
10110Sstevel@tonic-gate 		if (open_log(activeDir) == 1)	/* ok */
10120Sstevel@tonic-gate 			openNewFile = 0;
10130Sstevel@tonic-gate 		(void) pthread_mutex_unlock(&log_mutex);
10140Sstevel@tonic-gate 		break;
10150Sstevel@tonic-gate 	}
10160Sstevel@tonic-gate 
10170Sstevel@tonic-gate 	rc = AUDITD_SUCCESS;
10180Sstevel@tonic-gate 	*ret_list = NULL;
10190Sstevel@tonic-gate 
10200Sstevel@tonic-gate 	return (rc);
10210Sstevel@tonic-gate }
10220Sstevel@tonic-gate 
10230Sstevel@tonic-gate auditd_rc_t
10240Sstevel@tonic-gate auditd_plugin_close(char **error)
10250Sstevel@tonic-gate {
10260Sstevel@tonic-gate 	*error = NULL;
10270Sstevel@tonic-gate 
10280Sstevel@tonic-gate 	(void) pthread_mutex_lock(&log_mutex);
1029*12918SJan.Friedel@Sun.COM 	close_log(&lastOpenDir, "", "");
10300Sstevel@tonic-gate 	freedirlist(activeDir);
10310Sstevel@tonic-gate 	activeDir = NULL;
10320Sstevel@tonic-gate 	(void) pthread_mutex_unlock(&log_mutex);
10330Sstevel@tonic-gate 
10340Sstevel@tonic-gate 	DPRINT((dbfp, "binfile:  closed\n"));
10350Sstevel@tonic-gate 
103611700Sgww@eng.sun.com 	(void) __logpost("");
103711700Sgww@eng.sun.com 
10380Sstevel@tonic-gate 	if (binfile_is_open) {
10390Sstevel@tonic-gate 		(void) pthread_mutex_destroy(&log_mutex);
10400Sstevel@tonic-gate 		binfile_is_open = 0;
104111706SJan.Friedel@Sun.COM #if DEBUG
10420Sstevel@tonic-gate 	} else {
104311706SJan.Friedel@Sun.COM 		(void) fprintf(dbfp,
104411706SJan.Friedel@Sun.COM 		    "auditd_plugin_close() called when already closed.");
104511706SJan.Friedel@Sun.COM #endif
10460Sstevel@tonic-gate 	}
10470Sstevel@tonic-gate 	am_open = 0;
10480Sstevel@tonic-gate 	return (AUDITD_SUCCESS);
10490Sstevel@tonic-gate }
1050