Print this page 
NEX-13644 File access audit logging
Reviewed by: Gordon Ross <gordon.ross@nexenta.com>
Reviewed by: Roman Strashkin <roman.strashkin@nexenta.com>
Reviewed by: Saso Kiselkov <saso.kiselkov@nexenta.com>
Reviewed by: Rick McNeal <rick.mcneal@nexenta.com>
Reviewed by: Yuri Pankov <yuri.pankov@nexenta.com>
Split Close
Expand all
Collapse all
          --- old/usr/src/uts/common/c2/audit_token.c
          +++ new/usr/src/uts/common/c2/audit_token.c
↓ open down ↓ 13 lines elided ↑ open up ↑ 
  14   14   * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15   15   * If applicable, add the following below this CDDL HEADER, with the
  16   16   * fields enclosed by brackets "[]" replaced with your own identifying
  17   17   * information: Portions Copyright [yyyy] [name of copyright owner]
  18   18   *
  19   19   * CDDL HEADER END
  20   20   */
  21   21  /*
  22   22   * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
  23   23   * Use is subject to license terms.
       24 + *
       25 + * Copyright 2018 Nexenta Systems, Inc.  All rights reserved.
  24   26   */
  25   27  
  26   28  /*
  27   29   * Support routines for building audit records.
  28   30   */
  29   31  
  30   32  #include <sys/param.h>
  31   33  #include <sys/systm.h>          /* for rval */
  32   34  #include <sys/time.h>
  33   35  #include <sys/types.h>
↓ open down ↓ 11 lines elided ↑ open up ↑ 
  45   47  #include <netinet/in_pcb.h>
  46   48  #include <c2/audit.h>
  47   49  #include <c2/audit_kernel.h>
  48   50  #include <c2/audit_record.h>
  49   51  #include <sys/model.h>          /* for model_t */
  50   52  #include <sys/vmparam.h>        /* for USRSTACK/USRSTACK32 */
  51   53  #include <sys/vfs.h>            /* for sonode */
  52   54  #include <sys/socketvar.h>      /* for sonode */
  53   55  #include <sys/zone.h>
  54   56  #include <sys/tsol/label.h>
       57 +#include <sys/cmn_err.h>
  55   58  
  56   59  /*
  57   60   * These are the control tokens
  58   61   */
  59   62  
  60   63  /*
  61   64   * au_to_header
  62   65   * returns:
  63   66   *      pointer to au_membuf chain containing a header token.
  64   67   */
↓ open down ↓ 533 lines elided ↑ open up ↑ 
 598  601                  m = au_to_strings(AUT_XATPATH, app->audp_sect[1],
 599  602                      app->audp_cnt - 1);
 600  603  
 601  604                  token = au_append_token(token, m);
 602  605          }
 603  606  
 604  607          return (token);
 605  608  }
 606  609  
 607  610  /*
      611 + * au_to_path_string
      612 + * returns:
      613 + *      pointer to au_membuf chain containing a path token.
      614 + */
      615 +token_t *
      616 +au_to_path_string(const char *path)
      617 +{
      618 +        token_t *token;                 /* local au_membuf */
      619 +        adr_t adr;                      /* adr memory stream header */
      620 +        char data_header = AUT_PATH;    /* header for this token */
      621 +        short bytes;                    /* length of string */
      622 +
      623 +        bytes = strlen(path) + 1;
      624 +
      625 +        /*
      626 +         * generate path token header
      627 +         */
      628 +        token = au_getclr();
      629 +        adr_start(&adr, memtod(token, char *));
      630 +        adr_char(&adr, &data_header, 1);
      631 +        adr_short(&adr, &bytes, 1);
      632 +        token->len = adr_count(&adr);
      633 +
      634 +        /* append path string */
      635 +        (void) au_append_buf(path, bytes, token);
      636 +
      637 +        return (token);
      638 +}
      639 +
      640 +/*
 608  641   * au_to_ipc
 609  642   * returns:
 610  643   *      pointer to au_membuf chain containing a System V IPC token.
 611  644   */
 612  645  token_t *
 613  646  au_to_ipc(char type, int id)
 614  647  {
 615  648          token_t *m;                     /* local au_membuf */
 616  649          adr_t adr;                      /* adr memory stream header */
 617  650          char data_header = AUT_IPC;     /* header for this token */
↓ open down ↓ 579 lines elided ↑ open up ↑ 
1197 1230  
1198 1231          m = au_getclr();
1199 1232  
1200 1233          adr_start(&adr, memtod(m, char *));
1201 1234          adr_char(&adr, &data_header, 1);
1202 1235          adr_char(&adr, (char *)label, sizeof (_mac_label_impl_t));
1203 1236  
1204 1237          m->len = adr_count(&adr);
1205 1238  
1206 1239          return (m);
     1240 +}
     1241 +
     1242 +token_t *
     1243 +au_to_access_mask(uint32_t access)
     1244 +{
     1245 +        token_t *m;                             /* local au_membuf */
     1246 +        adr_t adr;                              /* adr memory stream header */
     1247 +        char data_header = AUT_ACCESS_MASK;     /* header for this token */
     1248 +
     1249 +        m = au_getclr();
     1250 +
     1251 +        adr_start(&adr, memtod(m, char *));
     1252 +        adr_char(&adr, &data_header, 1);
     1253 +
     1254 +        adr_uint32(&adr, &access, 1);
     1255 +
     1256 +        m->len = adr_count(&adr);
     1257 +        return (m);
     1258 +}
     1259 +
     1260 +token_t *
     1261 +au_to_wsid(ksid_t *ks)
     1262 +{
     1263 +        token_t *token;                 /* local au_membuf */
     1264 +        adr_t adr;                      /* adr memory stream header */
     1265 +        char data_header = AUT_WSID;    /* header for this token */
     1266 +        short bytes;                    /* length of string */
     1267 +        char sidbuf[256]; /* SMB_SID_STRSZ */
     1268 +
     1269 +        sidbuf[0] = '\0';
     1270 +        (void) snprintf(sidbuf, sizeof (sidbuf), "%s-%u",
     1271 +            ksid_getdomain(ks), ksid_getrid(ks));
     1272 +
     1273 +        token = au_getclr();
     1274 +
     1275 +        bytes = (short)strlen(sidbuf) + 1;
     1276 +        adr_start(&adr, memtod(token, char *));
     1277 +        adr_char(&adr, &data_header, 1);
     1278 +        adr_short(&adr, &bytes, 1);
     1279 +
     1280 +        token->len = (char)adr_count(&adr);
     1281 +        (void) au_append_buf(sidbuf, bytes, token);
     1282 +
     1283 +        return (token);
1207 1284  }
    
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX