1 files changed, 137 insertions, 75 deletions

diff --git a/sys/security/audit/audit_bsm_token.c b/sys/security/audit/audit_bsm_token.c
index ad9ffcc5902d..b1d977d252ce 100644
--- a/sys/security/audit/audit_bsm_token.c
+++ b/sys/security/audit/audit_bsm_token.c
@@ -1,5 +1,5 @@
 /*-
- * Copyright (c) 2004 Apple Inc.
+ * Copyright (c) 2004-2008 Apple Inc.
  * Copyright (c) 2005 SPARTA, Inc.
  * All rights reserved.
  *
@@ -29,6 +29,8 @@
  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
  * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  * POSSIBILITY OF SUCH DAMAGE.
+ *
+ * P4: //depot/projects/trustedbsd/openbsm/libbsm/bsm_token.c#72
  */
 
 #include <sys/cdefs.h>
@@ -71,7 +73,7 @@ __FBSDID("$FreeBSD$");
  * text                    N bytes + 1 terminating NULL byte
  */
 token_t *
-au_to_arg32(char n, char *text, u_int32_t v)
+au_to_arg32(char n, const char *text, u_int32_t v)
 {
 	token_t *t;
 	u_char *dptr = NULL;
@@ -90,11 +92,10 @@ au_to_arg32(char n, char *text, u_int32_t v)
 	ADD_STRING(dptr, text, textlen);
 
 	return (t);
-
 }
 
 token_t *
-au_to_arg64(char n, char *text, u_int64_t v)
+au_to_arg64(char n, const char *text, u_int64_t v)
 {
 	token_t *t;
 	u_char *dptr = NULL;
@@ -113,11 +114,10 @@ au_to_arg64(char n, char *text, u_int64_t v)
 	ADD_STRING(dptr, text, textlen);
 
 	return (t);
-
 }
 
 token_t *
-au_to_arg(char n, char *text, u_int32_t v)
+au_to_arg(char n, const char *text, u_int32_t v)
 {
 
 	return (au_to_arg32(n, text, v));
@@ -147,8 +147,8 @@ au_to_attr32(struct vnode_au_info *vni)
 	ADD_U_CHAR(dptr, AUT_ATTR32);
 
 	/*
-	 * Darwin defines the size for the file mode
-	 * as 2 bytes; BSM defines 4 so pad with 0
+	 * Darwin defines the size for the file mode as 2 bytes; BSM defines
+	 * 4 so pad with 0.
 	 */
 	ADD_U_INT16(dptr, pad0_16);
 	ADD_U_INT16(dptr, vni->vn_mode);
@@ -190,8 +190,8 @@ au_to_attr64(struct vnode_au_info *vni)
 	ADD_U_CHAR(dptr, AUT_ATTR64);
 
 	/*
-	 * Darwin defines the size for the file mode
-	 * as 2 bytes; BSM defines 4 so pad with 0
+	 * Darwin defines the size for the file mode as 2 bytes; BSM defines
+	 * 4 so pad with 0.
 	 */
 	ADD_U_INT16(dptr, pad0_16);
 	ADD_U_INT16(dptr, vni->vn_mode);
@@ -235,7 +235,7 @@ au_to_attr(struct vnode_au_info *vni)
  * data items              (depends on basic unit)
  */
 token_t *
-au_to_data(char unit_print, char unit_type, char unit_count, char *p)
+au_to_data(char unit_print, char unit_type, char unit_count, const char *p)
 {
 	token_t *t;
 	u_char *dptr = NULL;
@@ -305,7 +305,7 @@ token_t *
 au_to_groups(int *groups)
 {
 
-	return (au_to_newgroups(AUDIT_MAX_GROUPS, (gid_t*)groups));
+	return (au_to_newgroups(AUDIT_MAX_GROUPS, (gid_t *)groups));
 }
 
 /*
@@ -352,7 +352,7 @@ au_to_in_addr(struct in_addr *internet_addr)
 /*
  * token ID                1 byte
  * address type/length     4 bytes
- * Address                16 bytes
+ * address                16 bytes
  */
 token_t *
 au_to_in_addr_ex(struct in6_addr *internet_addr)
@@ -432,8 +432,8 @@ au_to_ipc_perm(struct ipc_perm *perm)
 	ADD_U_CHAR(dptr, AUT_IPC_PERM);
 
 	/*
-	 * Darwin defines the sizes for ipc_perm members
-	 * as 2 bytes; BSM defines 4 so pad with 0
+	 * Darwin defines the sizes for ipc_perm members as 2 bytes; BSM
+	 * defines 4 so pad with 0.
 	 */
 	ADD_U_INT16(dptr, pad0);
 	ADD_U_INT16(dptr, perm->uid);
@@ -482,7 +482,7 @@ au_to_iport(u_int16_t iport)
  * data                    size bytes
  */
 token_t *
-au_to_opaque(char *data, u_int16_t bytes)
+au_to_opaque(const char *data, u_int16_t bytes)
 {
 	token_t *t;
 	u_char *dptr = NULL;
@@ -504,7 +504,7 @@ au_to_opaque(char *data, u_int16_t bytes)
  * file pathname           N bytes + 1 terminating NULL byte
  */
 token_t *
-au_to_file(char *file, struct timeval tm)
+au_to_file(const char *file, struct timeval tm)
 {
 	token_t *t;
 	u_char *dptr = NULL;
@@ -534,7 +534,7 @@ au_to_file(char *file, struct timeval tm)
  * text                    N bytes + 1 terminating NULL byte
  */
 token_t *
-au_to_text(char *text)
+au_to_text(const char *text)
 {
 	token_t *t;
 	u_char *dptr = NULL;
@@ -558,7 +558,7 @@ au_to_text(char *text)
  * path                    N bytes + 1 terminating NULL byte
  */
 token_t *
-au_to_path(char *text)
+au_to_path(const char *text)
 {
 	token_t *t;
 	u_char *dptr = NULL;
@@ -657,7 +657,7 @@ au_to_process(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid, gid_t rgid,
  * terminal ID
  *   port ID               4 bytes/8 bytes (32-bit/64-bit value)
  *   address type-len      4 bytes
- *   machine address    4/16 bytes
+ *   machine address      16 bytes
  */
 token_t *
 au_to_process32_ex(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
@@ -668,12 +668,12 @@ au_to_process32_ex(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
 
 	KASSERT((tid->at_type == AU_IPv4) || (tid->at_type == AU_IPv6),
 	    ("au_to_process32_ex: type %u", (unsigned int)tid->at_type));
-	if (tid->at_type == AU_IPv6)
-		GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 13 *
-		    sizeof(u_int32_t));
+	if (tid->at_type == AU_IPv4)
+		GET_TOKEN_AREA(t, dptr, sizeof(u_char) +
+		    10 * sizeof(u_int32_t));
 	else
-		GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 10 *
-		    sizeof(u_int32_t));
+		GET_TOKEN_AREA(t, dptr, sizeof(u_char) +
+		    13 * sizeof(u_int32_t));
 
 	ADD_U_CHAR(dptr, AUT_PROCESS32_EX);
 	ADD_U_INT32(dptr, auid);
@@ -685,10 +685,12 @@ au_to_process32_ex(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
 	ADD_U_INT32(dptr, sid);
 	ADD_U_INT32(dptr, tid->at_port);
 	ADD_U_INT32(dptr, tid->at_type);
-        if (tid->at_type == AU_IPv6)
-                ADD_MEM(dptr, &tid->at_addr[0], 4 * sizeof(u_int32_t));
-        else
-                ADD_MEM(dptr, &tid->at_addr[0], sizeof(u_int32_t));
+	ADD_MEM(dptr, &tid->at_addr[0], sizeof(u_int32_t));
+	if (tid->at_type == AU_IPv6) {
+		ADD_MEM(dptr, &tid->at_addr[1], sizeof(u_int32_t));
+		ADD_MEM(dptr, &tid->at_addr[2], sizeof(u_int32_t));
+		ADD_MEM(dptr, &tid->at_addr[3], sizeof(u_int32_t));
+	}
 
 	return (t);
 }
@@ -831,7 +833,7 @@ kau_to_socket(struct socket_au_info *soi)
 	GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 2 * sizeof(u_int16_t) +
 	    sizeof(u_int32_t) + sizeof(u_int16_t) + sizeof(u_int32_t));
 						 
-	ADD_U_CHAR(dptr, AU_SOCK_TOKEN);
+	ADD_U_CHAR(dptr, AUT_SOCKET);
 	/* Coerce the socket type into a short value */
 	so_type = soi->so_type;
 	ADD_U_INT16(dptr, so_type);
@@ -883,7 +885,7 @@ au_to_sock_unix(struct sockaddr_un *so)
 
 	GET_TOKEN_AREA(t, dptr, 3 * sizeof(u_char) + strlen(so->sun_path) + 1);
 
-	ADD_U_CHAR(dptr, AU_SOCK_UNIX_TOKEN);
+	ADD_U_CHAR(dptr, AUT_SOCKUNIX);
 	/* BSM token has two bytes for family */
 	ADD_U_CHAR(dptr, 0);
 	ADD_U_CHAR(dptr, so->sun_family);
@@ -925,7 +927,6 @@ au_to_sock_inet32(struct sockaddr_in *so)
 	ADD_MEM(dptr, &so->sin_addr.s_addr, sizeof(uint32_t));
 
 	return (t);
-
 }
 
 token_t *
@@ -949,7 +950,6 @@ au_to_sock_inet128(struct sockaddr_in6 *so)
 	ADD_MEM(dptr, &so->sin6_addr, 4 * sizeof(uint32_t));
 
 	return (t);
-
 }
 
 token_t *
@@ -1040,7 +1040,7 @@ au_to_subject(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid, gid_t rgid,
  * terminal ID
  *   port ID               4 bytes/8 bytes (32-bit/64-bit value)
  *   address type/length   4 bytes
- *   machine address    4/16 bytes
+ *   machine address      16 bytes
  */
 token_t *
 au_to_subject32_ex(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
@@ -1051,11 +1051,12 @@ au_to_subject32_ex(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
 
 	KASSERT((tid->at_type == AU_IPv4) || (tid->at_type == AU_IPv6),
 	    ("au_to_subject32_ex: type %u", (unsigned int)tid->at_type));
-	if (tid->at_type == AU_IPv6)
-		GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 13 *
+
+	if (tid->at_type == AU_IPv4)
+		GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 10 *
 		    sizeof(u_int32_t));
 	else
-		GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 10 *
+		GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 13 *
 		    sizeof(u_int32_t));
 
 	ADD_U_CHAR(dptr, AUT_SUBJECT32_EX);
@@ -1068,9 +1069,9 @@ au_to_subject32_ex(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
 	ADD_U_INT32(dptr, sid);
 	ADD_U_INT32(dptr, tid->at_port);
 	ADD_U_INT32(dptr, tid->at_type);
-	if (tid->at_type == AU_IPv6)  
+	if (tid->at_type == AU_IPv6)
 		ADD_MEM(dptr, &tid->at_addr[0], 4 * sizeof(u_int32_t));
-	else    
+	else
 		ADD_MEM(dptr, &tid->at_addr[0], sizeof(u_int32_t));
 
 	return (t);
@@ -1083,17 +1084,17 @@ au_to_subject64_ex(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
 	token_t *t;
 	u_char *dptr = NULL;
 
+	KASSERT((tid->at_type == AU_IPv4) || (tid->at_type == AU_IPv6),
+	    ("au_to_subject64_ex: type %u", (unsigned int)tid->at_type));
+
 	if (tid->at_type == AU_IPv4)
 		GET_TOKEN_AREA(t, dptr, sizeof(u_char) +
 		    7 * sizeof(u_int32_t) + sizeof(u_int64_t) +
 		    2 * sizeof(u_int32_t));
-	else if (tid->at_type == AU_IPv6)
+	else
 		GET_TOKEN_AREA(t, dptr, sizeof(u_char) +
 		    7 * sizeof(u_int32_t) + sizeof(u_int64_t) +
 		    5 * sizeof(u_int32_t));
-	else
-		panic("au_to_subject64_ex: invalid at_type (%d)",
-		    tid->at_type);
 
 	ADD_U_CHAR(dptr, AUT_SUBJECT64_EX);
 	ADD_U_INT32(dptr, auid);
@@ -1124,8 +1125,8 @@ au_to_subject_ex(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
 
 #if !defined(_KERNEL) && !defined(KERNEL) && defined(HAVE_AUDIT_SYSCALLS)
 /*
- * Collects audit information for the current process
- * and creates a subject token from it
+ * Collects audit information for the current process and creates a subject
+ * token from it.
  */
 token_t *
 au_to_me(void)
@@ -1227,6 +1228,7 @@ au_to_exec_args(char **argv)
 
 	return (t);
 }
+#endif
 
 /*
  * token ID                1 byte
@@ -1234,7 +1236,7 @@ au_to_exec_args(char **argv)
  * zonename                N bytes + 1 terminating NULL byte
  */
 token_t *
-au_to_zonename(char *zonename)
+au_to_zonename(const char *zonename)
 {
 	u_char *dptr = NULL;
 	u_int16_t textlen;
@@ -1249,6 +1251,7 @@ au_to_zonename(char *zonename)
 	return (t);
 }
 
+#if !defined(_KERNEL) && !defined(KERNEL)
 /*
  * token ID				1 byte
  * count				4 bytes
@@ -1292,45 +1295,34 @@ au_to_exec_env(char **envp)
 /*
  * token ID                1 byte
  * record byte count       4 bytes
- * version #               1 byte
+ * version #               1 byte    [2]
  * event type              2 bytes
  * event modifier          2 bytes
- * address type/length     4 bytes
- * machine address         4 bytes/16 bytes (IPv4/IPv6 address)
- * seconds of time         4 bytes/8 bytes  (32/64-bits)
- * milliseconds of time    4 bytes/8 bytes  (32/64-bits) 
+ * seconds of time         4 bytes/8 bytes (32-bit/64-bit value)
+ * milliseconds of time    4 bytes/8 bytes (32-bit/64-bit value)
  */
 token_t *
-au_to_header32_ex_tm(int rec_size, au_event_t e_type, au_emod_t e_mod,
-    struct timeval tm, struct auditinfo_addr *aia)
+au_to_header32_tm(int rec_size, au_event_t e_type, au_emod_t e_mod,
+    struct timeval tm)
 {
-	token_t *t;  
+	token_t *t;
 	u_char *dptr = NULL;
 	u_int32_t timems;
-	struct au_tid_addr *tid;
-
-	tid = &aia->ai_termid;
-	KASSERT(tid->at_type == AU_IPv4 || tid->at_type == AU_IPv6,
-	    ("au_to_header32_ex_tm: invalid address family"));
 
 	GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int32_t) +
-	    sizeof(u_char) + 2 * sizeof(u_int16_t) + 3 * sizeof(u_int32_t) +
-	    tid->at_type);
+	    sizeof(u_char) + 2 * sizeof(u_int16_t) + 2 * sizeof(u_int32_t));
 
-	ADD_U_CHAR(dptr, AUT_HEADER32_EX);
+	ADD_U_CHAR(dptr, AUT_HEADER32);
 	ADD_U_INT32(dptr, rec_size);
 	ADD_U_CHAR(dptr, AUDIT_HEADER_VERSION_OPENBSM);
 	ADD_U_INT16(dptr, e_type);
 	ADD_U_INT16(dptr, e_mod);
-	ADD_U_INT32(dptr, tid->at_type);
-	if (tid->at_type == AU_IPv6)
-		ADD_MEM(dptr, &tid->at_addr[0], 4 * sizeof(u_int32_t));
-	else
-		ADD_MEM(dptr, &tid->at_addr[0], sizeof(u_int32_t));
-	timems = tm.tv_usec / 1000;
+
+	timems = tm.tv_usec/1000;
 	/* Add the timestamp */
 	ADD_U_INT32(dptr, tm.tv_sec);
-	ADD_U_INT32(dptr, timems);      /* We need time in ms. */
+	ADD_U_INT32(dptr, timems);	/* We need time in ms. */
+
 	return (t);
 }
 
@@ -1340,32 +1332,45 @@ au_to_header32_ex_tm(int rec_size, au_event_t e_type, au_emod_t e_mod,
  * version #               1 byte    [2]
  * event type              2 bytes
  * event modifier          2 bytes
+ * address type/length     4 bytes
+ * machine address         4 bytes/16 bytes (IPv4/IPv6 address)
  * seconds of time         4 bytes/8 bytes (32-bit/64-bit value)
  * milliseconds of time    4 bytes/8 bytes (32-bit/64-bit value)
  */
 token_t *
-au_to_header32_tm(int rec_size, au_event_t e_type, au_emod_t e_mod,
-    struct timeval tm)
+au_to_header32_ex_tm(int rec_size, au_event_t e_type, au_emod_t e_mod,
+    struct timeval tm, struct auditinfo_addr *aia)
 {
 	token_t *t;
 	u_char *dptr = NULL;
 	u_int32_t timems;
+	au_tid_addr_t *tid;
+
+	tid = &aia->ai_termid;
+	KASSERT(tid->at_type == AU_IPv4 || tid->at_type == AU_IPv6,
+	    ("au_to_header32_ex_tm: invalid address family"));
 
 	GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int32_t) +
-	    sizeof(u_char) + 2 * sizeof(u_int16_t) + 2 * sizeof(u_int32_t));
+	    sizeof(u_char) + 2 * sizeof(u_int16_t) + 3 *
+	    sizeof(u_int32_t) + tid->at_type);
 
-	ADD_U_CHAR(dptr, AUT_HEADER32);
+	ADD_U_CHAR(dptr, AUT_HEADER32_EX);
 	ADD_U_INT32(dptr, rec_size);
 	ADD_U_CHAR(dptr, AUDIT_HEADER_VERSION_OPENBSM);
 	ADD_U_INT16(dptr, e_type);
 	ADD_U_INT16(dptr, e_mod);
 
+	ADD_U_INT32(dptr, tid->at_type);
+	if (tid->at_type == AU_IPv6)
+		ADD_MEM(dptr, &tid->at_addr[0], 4 * sizeof(u_int32_t));
+	else
+		ADD_MEM(dptr, &tid->at_addr[0], sizeof(u_int32_t));
 	timems = tm.tv_usec/1000;
 	/* Add the timestamp */
 	ADD_U_INT32(dptr, tm.tv_sec);
-	ADD_U_INT32(dptr, timems);	/* We need time in ms. */
+	ADD_U_INT32(dptr, timems);      /* We need time in ms. */
 
-	return (t);
+	return (t);   
 }
 
 token_t *
@@ -1393,6 +1398,63 @@ au_to_header64_tm(int rec_size, au_event_t e_type, au_emod_t e_mod,
 	return (t);
 }
 
+#if !defined(KERNEL) && !defined(_KERNEL)
+#ifdef HAVE_AUDIT_SYSCALLS
+token_t *
+au_to_header32_ex(int rec_size, au_event_t e_type, au_emod_t e_mod)
+{
+	struct timeval tm;
+	struct auditinfo_addr aia;
+
+	if (gettimeofday(&tm, NULL) == -1)
+		return (NULL);
+	if (auditon(A_GETKAUDIT, &aia, sizeof(aia)) < 0) {
+		if (errno != ENOSYS)
+			return (NULL);
+		return (au_to_header32_tm(rec_size, e_type, e_mod, tm));
+	}
+	return (au_to_header32_ex_tm(rec_size, e_type, e_mod, tm, &aia));
+}
+#endif /* HAVE_AUDIT_SYSCALLS */
+
+token_t *
+au_to_header32(int rec_size, au_event_t e_type, au_emod_t e_mod)
+{
+	struct timeval tm;
+
+	if (gettimeofday(&tm, NULL) == -1)
+		return (NULL);
+	return (au_to_header32_tm(rec_size, e_type, e_mod, tm));
+}
+
+token_t *
+au_to_header64(__unused int rec_size, __unused au_event_t e_type,
+    __unused au_emod_t e_mod)
+{
+	struct timeval tm;
+
+	if (gettimeofday(&tm, NULL) == -1)
+		return (NULL);
+	return (au_to_header64_tm(rec_size, e_type, e_mod, tm));
+}
+
+token_t *
+au_to_header(int rec_size, au_event_t e_type, au_emod_t e_mod)
+{
+
+	return (au_to_header32(rec_size, e_type, e_mod));
+}
+
+#ifdef HAVE_AUDIT_SYSCALLS
+token_t *
+au_to_header_ex(int rec_size, au_event_t e_type, au_emod_t e_mod)
+{
+
+	return (au_to_header32_ex(rec_size, e_type, e_mod));
+}
+#endif /* HAVE_AUDIT_SYSCALLS */
+#endif /* !defined(KERNEL) && !defined(_KERNEL) */
+
 /*
  * token ID                1 byte
  * trailer magic number    2 bytes