1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21
22 /*
23 * Copyright (c) 1992, 2010, Oracle and/or its affiliates. All rights reserved.
24 */
25
26 /*
27 * Copyright (c) 2018, Joyent, Inc.
28 */
29
30 #include <fcntl.h>
31 #include <libscf.h>
32 #include <secdb.h>
33 #include <stdlib.h>
34 #include <stdio.h>
35 #include <string.h>
36 #include <sys/file.h>
37 #include <sys/stat.h>
38 #include <sys/types.h>
39 #include <sys/wait.h>
40 #include <signal.h>
41 #include <sys/param.h>
42 #include <unistd.h>
43 #include <bsm/audit.h>
44 #include <bsm/libbsm.h>
45 #include <locale.h>
46 #include <zone.h>
47 #include <audit_scf.h>
48
49 #if !defined(TEXT_DOMAIN)
50 #define TEXT_DOMAIN "SUNW_OST_OSCMD"
51 #endif
52
53 #define VERIFY -1
54
55 /* GLOBALS */
56 static char *progname = "audit";
57 static char *usage = "audit [-n] | [-s] | [-t] | [-v]";
58 static int silent = 0;
59
60 static void display_smf_error();
61
62 static boolean_t is_audit_config_ok(); /* config validation */
63 static boolean_t is_valid_zone(boolean_t); /* operation ok in this zone? */
64 static boolean_t contains_valid_dirs(char *); /* p_dir contents validation */
65 static boolean_t validate_path(char *); /* is it path to dir? */
66 static void start_auditd(); /* start audit daemon */
67 static int sig_auditd(int); /* send signal to auditd */
68
69 /*
70 * audit() - This program serves as a general administrator's interface to
71 * the audit trail. Only one option is valid at a time.
72 *
73 * input:
74 * audit -s
75 * - signal audit daemon to read audit configuration and
76 * start auditd if needed.
77 * audit -n
78 * - signal audit daemon to use next audit_binfile directory.
79 * audit -t
80 * - signal audit daemon to disable auditing.
81 * audit -T
82 * - signal audit daemon to temporarily disable auditing reporting
83 * no errors.
84 * audit -v
85 * - validate audit configuration parameters;
86 * Print errors or "configuration ok".
87 *
88 *
89 * output:
90 *
91 * returns: 0 - command successful
92 * >0 - command failed
93 */
94
95 int
96 main(int argc, char *argv[])
97 {
98 int c;
99
100 /* Internationalization */
101 (void) setlocale(LC_ALL, "");
102 (void) textdomain(TEXT_DOMAIN);
103
104 /* second or more options not allowed; please pick one */
105 if (argc > 2) {
106 (void) fprintf(stderr, gettext("usage: %s\n"), usage);
107 exit(1);
108 }
109
110 /* first option required */
111 if ((c = getopt(argc, argv, "nstTv")) == -1) {
112 (void) fprintf(stderr, gettext("usage: %s\n"), usage);
113 exit(1);
114 }
115
116 switch (c) {
117 case 'n':
118 if (!is_valid_zone(1)) /* 1 == display error if any */
119 exit(1);
120
121 if (sig_auditd(SIGUSR1) != 0)
122 exit(1);
123 break;
124 case 's':
125 if (!is_valid_zone(1)) /* 1 == display error if any */
126 exit(1);
127 else if (!is_audit_config_ok())
128 exit(1);
129
130 start_auditd();
131 return (0);
132 case 't':
133 if (!is_valid_zone(0)) /* 0 == no error message display */
134 exit(1);
135 if (smf_disable_instance(AUDITD_FMRI, 0) != 0) {
136 display_smf_error();
137 exit(1);
138 }
139 break;
140 case 'T':
141 silent = 1;
142 if (!is_valid_zone(0)) /* 0 == no error message display */
143 exit(1);
144 if (smf_disable_instance(AUDITD_FMRI, SMF_TEMPORARY) != 0) {
145 exit(1);
146 }
147 break;
148 case 'v':
149 if (is_audit_config_ok()) {
150 (void) fprintf(stderr, gettext("configuration ok\n"));
151 exit(0);
152 } else {
153 exit(1);
154 }
155 break;
156 default:
157 (void) fprintf(stderr, gettext("usage: %s\n"), usage);
158 exit(1);
159 }
160
161 return (0);
162 }
163
164 /*
165 * sig_auditd(sig)
166 *
167 * send a signal to auditd service
168 *
169 * returns: 0 - successful
170 * 1 - error
171 */
172
173 static int
174 sig_auditd(int sig)
175 {
176 scf_simple_prop_t *prop = NULL;
177 uint64_t *cid = NULL;
178
179 if ((prop = scf_simple_prop_get(NULL, AUDITD_FMRI, SCF_PG_RESTARTER,
180 SCF_PROPERTY_CONTRACT)) == NULL) {
181 display_smf_error();
182 return (1);
183 }
184 if ((scf_simple_prop_numvalues(prop) < 0) ||
185 (cid = scf_simple_prop_next_count(prop)) == NULL) {
186 scf_simple_prop_free(prop);
187 display_smf_error();
188 return (1);
189 }
190 if (sigsend(P_CTID, (ctid_t)*cid, sig) != 0) {
191 perror("audit: can't signal auditd");
192 scf_simple_prop_free(prop);
193 return (1);
194 }
195 scf_simple_prop_free(prop);
196 return (0);
197 }
198
199 /*
200 * perform reasonableness check on audit configuration
201 */
202
203 static boolean_t
204 is_audit_config_ok() {
205 int state = B_TRUE; /* B_TRUE/B_FALSE = ok/not_ok */
206 char *cval_str;
207 int cval_int;
208 kva_t *kvlist;
209 scf_plugin_kva_node_t *plugin_kva_ll;
210 scf_plugin_kva_node_t *plugin_kva_ll_head;
211 boolean_t one_plugin_enabled = B_FALSE;
212
213 /*
214 * There must be at least one active plugin configured; if the
215 * configured plugin is audit_binfile(5), then the p_dir must not be
216 * empty.
217 */
218 if (!do_getpluginconfig_scf(NULL, &plugin_kva_ll)) {
219 (void) fprintf(stderr,
220 gettext("Could not get plugin configuration.\n"));
221 exit(1);
222 }
223
224 plugin_kva_ll_head = plugin_kva_ll;
225
226 while (plugin_kva_ll != NULL) {
227 kvlist = plugin_kva_ll->plugin_kva;
228
229 if (!one_plugin_enabled) {
230 cval_str = kva_match(kvlist, "active");
231 if (atoi(cval_str) == 1) {
232 one_plugin_enabled = B_TRUE;
233 }
234 }
235
236 if (strcmp((char *)&(*plugin_kva_ll).plugin_name,
237 "audit_binfile") == 0) {
238 cval_str = kva_match(kvlist, "p_dir");
239 if (cval_str == NULL || cval_str[0] == '\0') {
240 (void) fprintf(stderr,
241 gettext("%s: audit_binfile(5) \"p_dir:\" "
242 "attribute empty\n"), progname);
243 state = B_FALSE;
244 } else if (!contains_valid_dirs(cval_str)) {
245 (void) fprintf(stderr,
246 gettext("%s: audit_binfile(5) \"p_dir:\" "
247 "attribute invalid\n"), progname);
248 state = B_FALSE;
249 }
250
251 cval_str = kva_match(kvlist, "p_minfree");
252 cval_int = atoi(cval_str);
253 if (cval_int < 0 || cval_int > 100) {
254 (void) fprintf(stderr,
255 gettext("%s: audit_binfile(5) "
256 "\"p_minfree:\" attribute invalid\n"),
257 progname);
258 state = B_FALSE;
259 }
260 }
261
262 plugin_kva_ll = plugin_kva_ll->next;
263 }
264
265 plugin_kva_ll_free(plugin_kva_ll_head);
266
267 if (!one_plugin_enabled) {
268 (void) fprintf(stderr, gettext("%s: no active plugin found\n"),
269 progname);
270 state = B_FALSE;
271 }
272
273 return (state);
274 }
275
276 /*
277 * The operations that call this function are only valid in the global
278 * zone unless the perzone audit policy is set.
279 *
280 * "!silent" and "show_err" are slightly different; silent is from
281 * -T for which no error messages should be displayed and show_err
282 * applies to more options (including -T)
283 *
284 */
285
286 static boolean_t
287 is_valid_zone(boolean_t show_err)
288 {
289 uint32_t policy;
290
291 if (auditon(A_GETPOLICY, (char *)&policy, 0) == -1) {
292 if (!silent) {
293 (void) fprintf(stderr, gettext(
294 "%s: Cannot read audit policy: %s\n"),
295 progname, strerror(errno));
296 }
297 return (0);
298 }
299 if (policy & AUDIT_PERZONE)
300 return (1);
301
302 if (getzoneid() != GLOBAL_ZONEID) {
303 if (show_err)
304 (void) fprintf(stderr,
305 gettext("%s: Not valid in a local zone.\n"),
306 progname);
307 return (0);
308 } else {
309 return (1);
310 }
311 }
312
313 /*
314 * Verify, whether the dirs_str contains at least one currently valid path to
315 * the directory. All invalid paths are reported. In case no valid directory
316 * path is found function returns B_FALSE, otherwise B_TRUE.
317 */
318
319 static boolean_t
320 contains_valid_dirs(char *dirs_str)
321 {
322 boolean_t rc = B_FALSE;
323 boolean_t rc_validate_path = B_TRUE;
324 char *tok_ptr;
325 char *tok_lasts;
326
327 if (dirs_str == NULL) {
328 return (rc);
329 }
330
331 if ((tok_ptr = strtok_r(dirs_str, ",", &tok_lasts)) != NULL) {
332 if (validate_path(tok_ptr)) {
333 rc = B_TRUE;
334 } else {
335 rc_validate_path = B_FALSE;
336 }
337 while ((tok_ptr = strtok_r(NULL, ",", &tok_lasts)) != NULL) {
338 if (validate_path(tok_ptr)) {
339 rc = B_TRUE;
340 } else {
341 rc_validate_path = B_FALSE;
342 }
343 }
344 }
345
346 if (rc && !rc_validate_path) {
347 (void) fprintf(stderr, gettext("%s: at least one valid "
348 "directory path found\n"), progname);
349 }
350
351 return (rc);
352 }
353
354 /*
355 * Verify, that the dir_path is path to a directory.
356 */
357
358 static boolean_t
359 validate_path(char *dir_path)
360 {
361 boolean_t rc = B_FALSE;
362 struct stat statbuf;
363
364 if (dir_path == NULL) {
365 return (rc);
366 }
367
368 if (stat(dir_path, &statbuf) == -1) {
369 (void) fprintf(stderr, gettext("%s: %s error: %s\n"), progname,
370 dir_path, strerror(errno));
371 } else if (statbuf.st_mode & S_IFDIR) {
372 rc = B_TRUE;
373 } else {
374 (void) fprintf(stderr, gettext("%s: %s is not a directory\n"),
375 progname, dir_path);
376 }
377
378 return (rc);
379 }
380
381 /*
382 * if auditd isn't running, start it. Otherwise refresh.
383 * First check to see if c2audit is loaded via the auditon()
384 * system call, then check SMF state.
385 */
386 static void
387 start_auditd()
388 {
389 int audit_state;
390 char *state;
391
392 if (auditon(A_GETCOND, (caddr_t)&audit_state,
393 sizeof (audit_state)) != 0)
394 exit(1);
395
396 if ((state = smf_get_state(AUDITD_FMRI)) == NULL) {
397 display_smf_error();
398 exit(1);
399 }
400 if (strcmp(SCF_STATE_STRING_ONLINE, state) != 0) {
401 if (smf_enable_instance(AUDITD_FMRI, 0) != 0) {
402 display_smf_error();
403 free(state);
404 exit(1);
405 }
406 } else {
407 if (smf_refresh_instance(AUDITD_FMRI) != 0) {
408 display_smf_error();
409 free(state);
410 exit(1);
411 }
412 }
413 free(state);
414 }
415
416 static void
417 display_smf_error()
418 {
419 scf_error_t rc = scf_error();
420
421 switch (rc) {
422 case SCF_ERROR_NOT_FOUND:
423 (void) fprintf(stderr,
424 "SMF error: \"%s\" not found.\n",
425 AUDITD_FMRI);
426 break;
427 default:
428 (void) fprintf(stderr, "SMF error: %s\n", scf_strerror(rc));
429 break;
430 }
431 }