1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21 /*
22 * Copyright 2010 Sun Microsystems, Inc. All rights reserved.
23 * Use is subject to license terms.
24 *
25 * Copyright 2018 Nexenta Systems, Inc. All rights reserved.
26 */
27
28 #ifndef _AUDITRT_H
29 #define _AUDITRT_H
30
31 #ifdef __cplusplus
32 extern "C" {
33 #endif
34
35 /*
36 * Auditreduce data structures.
37 */
38
39 /*
40 * File Control Block
41 * Controls a single file.
42 * These are held by the pcb's in audit_pcbs[] in a linked list.
43 * There is one fcb for each file controlled by the pcb,
44 * and all of the files in a list have the same suffix in their names.
45 */
46 struct audit_fcb {
47 struct audit_fcb *fcb_next; /* ptr to next fcb in list */
48 int fcb_flags; /* flags - see below */
49 time_t fcb_start; /* start time from filename */
50 time_t fcb_end; /* end time from filename */
51 char *fcb_suffix; /* ptr to suffix in fcb_file */
52 char *fcb_name; /* ptr to name in fcb_file */
53 char fcb_file[1]; /* full path and name string */
54 };
55
56 typedef struct audit_fcb audit_fcb_t;
57
58 /*
59 * Flags for fcb_flags.
60 */
61 #define FF_NOTTERM 0x01 /* file is "not_terminated" */
62 #define FF_DELETE 0x02 /* we may delete this file if requested */
63
64 /*
65 * Process Control Block
66 * A pcb comes in two types:
67 * It controls either:
68 *
69 * 1. A single group of pcbs (processes that are lower on the process tree).
70 * These are the pcb's that the process tree is built from.
71 * These are allocated as needed while the process tree is being built.
72 *
73 * 2. A single group of files (fcbs).
74 * All of the files in one pcb have the same suffix in their filename.
75 * They are controlled by the leaf nodes of the process tree.
76 * They are found in audit_pcbs[].
77 * They are initially setup by process_fileopt() when the files to be
78 * processes are gathered together. Then they are parsed out to
79 * the leaf nodes by mfork().
80 * A particular leaf node's range of audit_pcbs[] is determined
81 * in the call to mfork() by the lo and hi paramters.
82 */
83 struct audit_pcb {
84 struct audit_pcb *pcb_below; /* ptr to group of pcb's */
85 struct audit_pcb *pcb_next; /* ptr to next - for list in mproc() */
86 int pcb_procno; /* subprocess # */
87 int pcb_nrecs; /* how many records read (current pcb/file) */
88 int pcb_nprecs; /* how many records put (current pcb/file) */
89 int pcb_flags; /* flags - see below */
90 int pcb_count; /* count of active pcb's */
91 int pcb_lo; /* low index for pcb's */
92 int pcb_hi; /* hi index for pcb's */
93 int pcb_size; /* size of current record buffer */
94 time_t pcb_time; /* time of current record */
95 time_t pcb_otime; /* time of previous record */
96 char *pcb_rec; /* ptr to current record buffer */
97 char *pcb_suffix; /* ptr to suffix name (string) */
98 audit_fcb_t *pcb_first; /* ptr to first fcb_ */
99 audit_fcb_t *pcb_last; /* ptr to last fcb_ */
100 audit_fcb_t *pcb_cur; /* ptr to current fcb_ */
101 audit_fcb_t *pcb_dfirst; /* ptr to first fcb_ for deleting */
102 audit_fcb_t *pcb_dlast; /* ptr to last fcb_ for deleting */
103 FILE *pcb_fpr; /* read stream */
104 FILE *pcb_fpw; /* write stream */
105 };
106
107 typedef struct audit_pcb audit_pcb_t;
108
109 /*
110 * Flags for pcb_flags
111 */
112 #define PF_ROOT 0x01 /* current pcb is the root of process tree */
113 #define PF_LEAF 0x02 /* current pcb is a leaf of process tree */
114 #define PF_USEFILE 0x04 /* current pcb uses files as input, not pipes */
115
116 /*
117 * Message selection options
118 */
119 #define M_AFTER 0x0001 /* 'a' after a time */
120 #define M_BEFORE 0x0002 /* 'b' before a time */
121 #define M_CLASS 0x0004 /* 'c' event class */
122 #define M_GROUPE 0x0008 /* 'f' effective group-id */
123 #define M_GROUPR 0x0010 /* 'g' real group-id */
124 #define M_OBJECT 0x0020 /* 'o' object */
125 #define M_SUBJECT 0x0040 /* 'j' subject */
126 #define M_TYPE 0x0080 /* 'm' event type */
127 #define M_USERA 0x0100 /* 'u' audit user */
128 #define M_USERE 0x0200 /* 'e' effective user */
129 #define M_USERR 0x0400 /* 'r' real user */
130 #define M_LABEL 0x0800 /* 'l' mandatory label range */
131 #define M_ZONENAME 0x1000 /* 'z' zone name */
132 #define M_SID 0x2000 /* 's' session ID */
133 #define M_SORF 0x4000 /* success or failure of event */
134 #define M_TID 0x8000 /* 't' terminal ID */
135 /*
136 * object types
137 */
138
139 /* XXX Why is this a bit map? There can be only one M_OBJECT. */
140
141 #define OBJ_LP 0x00001 /* 'o' lp object */
142 #define OBJ_MSG 0x00002 /* 'o' msgq object */
143 #define OBJ_PATH 0x00004 /* 'o' file system object */
144 #define OBJ_PROC 0x00008 /* 'o' process object */
145 #define OBJ_SEM 0x00010 /* 'o' semaphore object */
146 #define OBJ_SHM 0x00020 /* 'o' shared memory object */
147 #define OBJ_SOCK 0x00040 /* 'o' socket object */
148 #define OBJ_FGROUP 0x00080 /* 'o' file group */
149 #define OBJ_FOWNER 0x00100 /* 'o' file owner */
150 #define OBJ_MSGGROUP 0x00200 /* 'o' msgq [c]group */
151 #define OBJ_MSGOWNER 0x00400 /* 'o' msgq [c]owner */
152 #define OBJ_PGROUP 0x00800 /* 'o' process [e]group */
153 #define OBJ_POWNER 0x01000 /* 'o' process [e]owner */
154 #define OBJ_SEMGROUP 0x02000 /* 'o' semaphore [c]group */
155 #define OBJ_SEMOWNER 0x04000 /* 'o' semaphore [c]owner */
156 #define OBJ_SHMGROUP 0x08000 /* 'o' shared memory [c]group */
157 #define OBJ_SHMOWNER 0x10000 /* 'o' shared memory [c]owner */
158 #define OBJ_FMRI 0x20000 /* 'o' fmri object */
159 #define OBJ_USER 0x40000 /* 'o' user object */
160 #define OBJ_WSID 0x80000 /* 'o' windows sid object */
161
162 #define SOCKFLG_MACHINE 0 /* search socket token by machine name */
163 #define SOCKFLG_PORT 1 /* search socket token by port number */
164
165 /*
166 * Global variables
167 */
168 extern unsigned short m_type; /* 'm' message type */
169 extern gid_t m_groupr; /* 'g' real group-id */
170 extern gid_t m_groupe; /* 'f' effective group-id */
171 extern uid_t m_usera; /* 'u' audit user */
172 extern uid_t m_userr; /* 'r' real user */
173 extern uid_t m_usere; /* 'f' effective user */
174 extern au_asid_t m_sid; /* 's' session-id */
175 extern time_t m_after; /* 'a' after a time */
176 extern time_t m_before; /* 'b' before a time */
177 extern audit_state_t mask; /* used with m_class */
178 extern char *zonename; /* 'z' zonename */
179
180 extern m_range_t *m_label; /* 'l' mandatory label range */
181 extern int flags;
182 extern int checkflags;
183 extern int socket_flag;
184 extern int ip_type;
185 extern uchar_t ip_ipv6[16]; /* ip ipv6 object identifier */
186 extern int obj_flag; /* 'o' object type */
187 extern int obj_id; /* object identifier */
188 extern gid_t obj_group; /* object group */
189 extern uid_t obj_owner; /* object owner */
190 extern int subj_id; /* subject identifier */
191 extern char ipc_type; /* 'o' object type - tell what type of IPC */
192 extern scf_pattern_t fmri; /* 'o' fmri value */
193 extern uid_t obj_user; /* 'o' user value */
194
195 /*
196 * File selection options
197 */
198 extern char *f_machine; /* 'M' machine (suffix) type */
199 extern char *f_root; /* 'R' audit root */
200 extern char *f_server; /* 'S' server */
201 extern char *f_outfile; /* 'W' output file */
202 extern int f_all; /* 'A' all records from a file */
203 extern int f_complete; /* 'C' only completed files */
204 extern int f_delete; /* 'D' delete when done */
205 extern int f_quiet; /* 'Q' sshhhh! */
206 extern int f_verbose; /* 'V' verbose */
207 extern int f_stdin; /* '-' read from stdin */
208 extern int f_cmdline; /* files specified on the command line */
209 extern int new_mode; /* 'N' new object selection mode */
210
211 /*
212 * Error reporting
213 * Error_str is set whenever an error occurs to point to a string describing
214 * the error. When the error message is printed error_str is also
215 * printed to describe exactly what went wrong.
216 * Errbuf is used to build messages with variables in them.
217 */
218 extern char *error_str; /* current error message */
219 extern char errbuf[]; /* buffer for building error message */
220 extern char *ar; /* => "auditreduce:" */
221
222 /*
223 * Control blocks
224 * Audit_pcbs[] is an array of pcbs that control files directly.
225 * In the program's initialization phase it will gather all of the input
226 * files it needs to process. Each file will have one fcb allocated for it,
227 * and each fcb will belong to one pcb from audit_pcbs[]. All of the files
228 * in a single pcb will have the same suffix in their filenames. If the
229 * number of active pcbs in audit_pcbs[] is greater that the number of open
230 * files a single process can have then the program will need to fork
231 * subprocesses to handle all of the files.
232 */
233 extern audit_pcb_t *audit_pcbs; /* file-holding pcb's */
234 extern int pcbsize; /* current size of audit_pcbs[] */
235 extern int pcbnum; /* total # of active pcbs in audit_pcbs[] */
236
237 /*
238 * Time values
239 */
240 extern time_t f_start; /* time of start rec for outfile */
241 extern time_t f_end; /* time of end rec for outfile */
242 extern time_t time_now; /* time program began */
243
244 /*
245 * Counting vars
246 */
247 extern int filenum; /* number of files total */
248
249 /*
250 * Global variable, class of current record being processed.
251 */
252 extern int global_class;
253
254 #ifdef __cplusplus
255 }
256 #endif
257
258 #endif /* _AUDITRT_H */