Print this page
7029 want per-process exploit mitigation features (secflags)
7030 want basic address space layout randomization (aslr)
7031 noexec_user_stack should be a secflag
7032 want a means to forbid mappings around NULL.
| Split |
Close |
| Expand all |
| Collapse all |
--- old/usr/src/uts/common/c2/audit_record.h
+++ new/usr/src/uts/common/c2/audit_record.h
1 1 /*
2 2 * CDDL HEADER START
3 3 *
4 4 * The contents of this file are subject to the terms of the
5 5 * Common Development and Distribution License (the "License").
6 6 * You may not use this file except in compliance with the License.
7 7 *
8 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 9 * or http://www.opensolaris.org/os/licensing.
10 10 * See the License for the specific language governing permissions
11 11 * and limitations under the License.
12 12 *
13 13 * When distributing Covered Code, include this CDDL HEADER in each
14 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 15 * If applicable, add the following below this CDDL HEADER, with the
16 16 * fields enclosed by brackets "[]" replaced with your own identifying
17 17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 18 *
19 19 * CDDL HEADER END
20 20 */
21 21 /*
22 22 * Copyright 2010 Sun Microsystems, Inc. All rights reserved.
23 23 * Use is subject to license terms.
24 24 */
25 25
26 26 #ifndef _BSM_AUDIT_RECORD_H
27 27 #define _BSM_AUDIT_RECORD_H
28 28
29 29
30 30 #ifdef _KERNEL
31 31 #include <sys/priv.h>
32 32 #else
33 33 #include <priv.h>
34 34 #endif
35 35 #include <sys/socket.h>
36 36 #include <sys/acl.h>
37 37
38 38 #include <sys/tsol/label.h>
39 39
40 40 #ifdef __cplusplus
41 41 extern "C" {
42 42 #endif
43 43
44 44 /*
45 45 * Version of audit attributes
46 46 *
47 47 * OS Release Version Number Comments
48 48 * ========== ============== ========
49 49 * SunOS 5.1 2 Unbundled Package
50 50 * SunOS 5.3 2 Bundled into the base OS
51 51 * SunOS 5.4-5.x 2
52 52 * Trusted Solaris 2.5 3 To distinguish potential new tokens
53 53 * Trusted Solaris 7-8 4 Redefine X tokens that overlap with
54 54 * SunOS 5.7
55 55 */
56 56
57 57 #define TOKEN_VERSION 2
58 58
59 59 /*
60 60 * Audit record token type codes
61 61 */
62 62
63 63 /*
64 64 * Control token types
65 65 */
66 66
67 67 #define AUT_INVALID ((char)0x00)
68 68 #define AUT_OTHER_FILE ((char)0x11)
69 69 #define AUT_OTHER_FILE32 AUT_OTHER_FILE
70 70 #define AUT_OHEADER ((char)0x12)
71 71 #define AUT_TRAILER ((char)0x13)
72 72 #define AUT_HEADER ((char)0x14)
73 73 #define AUT_HEADER32 AUT_HEADER
74 74 #define AUT_HEADER32_EX ((char)0x15)
75 75 #define AUT_TRAILER_MAGIC ((short)0xB105)
76 76
77 77 /*
78 78 * Data token types
79 79 */
80 80
81 81 #define AUT_FMRI ((char)0x20)
82 82 #define AUT_DATA ((char)0x21)
83 83 #define AUT_IPC ((char)0x22)
84 84 #define AUT_PATH ((char)0x23)
85 85 #define AUT_SUBJECT ((char)0x24)
86 86 #define AUT_SUBJECT32 AUT_SUBJECT
87 87 #define AUT_XATPATH ((char)0x25)
88 88 #define AUT_PROCESS ((char)0x26)
89 89 #define AUT_PROCESS32 AUT_PROCESS
90 90 #define AUT_RETURN ((char)0x27)
91 91 #define AUT_RETURN32 AUT_RETURN
92 92 #define AUT_TEXT ((char)0x28)
93 93 #define AUT_OPAQUE ((char)0x29)
94 94 #define AUT_IN_ADDR ((char)0x2A)
95 95 #define AUT_IP ((char)0x2B)
96 96 #define AUT_IPORT ((char)0x2C)
97 97 #define AUT_ARG ((char)0x2D)
98 98 #define AUT_ARG32 AUT_ARG
99 99 #define AUT_SOCKET ((char)0x2E)
100 100 #define AUT_SEQ ((char)0x2F)
101 101 #define AUT_USER ((char)0x36) /* out of order */
102 102 #define AUT_TID ((char)0x61) /* out of order */
103 103
104 104 /*
105 105 * Modifier token types
106 106 */
107 107
108 108 #define AUT_ACL ((char)0x30)
109 109 #define AUT_ATTR ((char)0x31)
110 110 #define AUT_IPC_PERM ((char)0x32)
111 111 #define AUT_LABEL ((char)0x33)
112 112 #define AUT_GROUPS ((char)0x34)
113 113 #define AUT_ACE ((char)0x35)
|
↓ open down ↓ |
113 lines elided |
↑ open up ↑ |
114 114 /* 0x37 unused */
115 115 #define AUT_PRIV ((char)0x38)
116 116 #define AUT_UPRIV ((char)0x39)
117 117 #define AUT_LIAISON ((char)0x3A)
118 118 #define AUT_NEWGROUPS ((char)0x3B)
119 119 #define AUT_EXEC_ARGS ((char)0x3C)
120 120 #define AUT_EXEC_ENV ((char)0x3D)
121 121 #define AUT_ATTR32 ((char)0x3E)
122 122 #define AUT_UAUTH ((char)0x3F)
123 123 #define AUT_ZONENAME ((char)0x60) /* out of order */
124 +#define AUT_SECFLAGS ((char)0x62) /* out of order */
124 125
125 126 /*
126 127 * X windows token types
127 128 */
128 129
129 130 #define AUT_XATOM ((char)0x40)
130 131 #define AUT_XOBJ ((char)0x41)
131 132 #define AUT_XPROTO ((char)0x42)
132 133 #define AUT_XSELECT ((char)0x43)
133 134
134 135 #if TOKEN_VERSION != 3
135 136 #define AUT_XCOLORMAP ((char)0x44)
136 137 #define AUT_XCURSOR ((char)0x45)
137 138 #define AUT_XFONT ((char)0x46)
138 139 #define AUT_XGC ((char)0x47)
139 140 #define AUT_XPIXMAP ((char)0x48)
140 141 #define AUT_XPROPERTY ((char)0x49)
141 142 #define AUT_XWINDOW ((char)0x4A)
142 143 #define AUT_XCLIENT ((char)0x4B)
143 144 #else /* TOKEN_VERSION == 3 */
144 145 #define AUT_XCOLORMAP ((char)0x74)
145 146 #define AUT_XCURSOR ((char)0x75)
146 147 #define AUT_XFONT ((char)0x76)
147 148 #define AUT_XGC ((char)0x77)
148 149 #define AUT_XPIXMAP ((char)0x78)
149 150 #define AUT_XPROPERTY ((char)0x79)
150 151 #define AUT_XWINDOW ((char)0x7A)
151 152 #define AUT_XCLIENT ((char)0x7B)
152 153 #endif /* TOKEN_VERSION != 3 */
153 154
154 155 /*
155 156 * Command token types
156 157 */
157 158
158 159 #define AUT_CMD ((char)0x51)
159 160 #define AUT_EXIT ((char)0x52)
160 161
161 162 /*
162 163 * Miscellaneous token types
163 164 */
164 165
165 166 #define AUT_HOST ((char)0x70)
166 167
167 168 /*
168 169 * Solaris64 token types
169 170 */
170 171
171 172 #define AUT_ARG64 ((char)0x71)
172 173 #define AUT_RETURN64 ((char)0x72)
173 174 #define AUT_ATTR64 ((char)0x73)
174 175 #define AUT_HEADER64 ((char)0x74)
175 176 #define AUT_SUBJECT64 ((char)0x75)
176 177 #define AUT_PROCESS64 ((char)0x77)
177 178 #define AUT_OTHER_FILE64 ((char)0x78)
178 179
179 180 /*
180 181 * Extended network address token types
181 182 */
182 183
183 184 #define AUT_HEADER64_EX ((char)0x79)
184 185 #define AUT_SUBJECT32_EX ((char)0x7a)
185 186 #define AUT_PROCESS32_EX ((char)0x7b)
186 187 #define AUT_SUBJECT64_EX ((char)0x7c)
187 188 #define AUT_PROCESS64_EX ((char)0x7d)
188 189 #define AUT_IN_ADDR_EX ((char)0x7e)
189 190 #define AUT_SOCKET_EX ((char)0x7f)
190 191
191 192
192 193 /*
193 194 * Audit print suggestion types.
194 195 */
195 196
196 197 #define AUP_BINARY ((char)0)
197 198 #define AUP_OCTAL ((char)1)
198 199 #define AUP_DECIMAL ((char)2)
199 200 #define AUP_HEX ((char)3)
200 201 #define AUP_STRING ((char)4)
201 202
202 203 /*
203 204 * Audit data member types.
204 205 */
205 206
206 207 #define AUR_BYTE ((char)0)
207 208 #define AUR_CHAR ((char)0)
208 209 #define AUR_SHORT ((char)1)
209 210 #define AUR_INT ((char)2)
210 211 #define AUR_INT32 ((char)2)
211 212 #define AUR_INT64 ((char)3)
212 213
213 214 /*
214 215 * Adr structures
215 216 */
216 217
217 218 struct adr_s {
218 219 char *adr_stream; /* The base of the stream */
219 220 char *adr_now; /* The location within the stream */
220 221 };
221 222
222 223 typedef struct adr_s adr_t;
223 224
224 225
225 226 #ifdef _KERNEL
226 227
227 228 #include <sys/param.h>
228 229 #include <sys/systm.h> /* for rval */
229 230 #include <sys/time.h>
230 231 #include <sys/types.h>
231 232 #include <sys/vnode.h>
232 233 #include <sys/mode.h>
233 234 #include <sys/user.h>
234 235 #include <sys/session.h>
235 236 #include <sys/ipc_impl.h>
236 237 #include <netinet/in_systm.h>
237 238 #include <netinet/in.h>
238 239 #include <netinet/ip.h>
239 240 #include <sys/socket.h>
240 241 #include <net/route.h>
241 242 #include <netinet/in_pcb.h>
242 243
243 244 /*
244 245 * au_close flag arguments
245 246 */
246 247
247 248 #define AU_OK 0x1 /* Good audit record */
248 249 #define AU_DONTBLOCK 0x2 /* Don't block or discard if queue full */
249 250 #define AU_DEFER 0x4 /* Defer record queueing to syscall end */
250 251
251 252 /*
252 253 * Audit token type is really an au_membuf pointer
253 254 */
254 255 typedef au_buff_t token_t;
255 256 /*
256 257 * token generation functions
257 258 */
258 259 token_t *au_append_token(token_t *, token_t *);
259 260 token_t *au_set(caddr_t, uint_t);
260 261
261 262 void au_free_rec(au_buff_t *);
262 263
263 264 #define au_getclr() ((token_t *)au_get_buff())
264 265 #define au_toss_token(tok) (au_free_rec((au_buff_t *)(tok)))
265 266
266 267 token_t *au_to_acl();
267 268 token_t *au_to_ace();
268 269 token_t *au_to_attr(struct vattr *);
269 270 token_t *au_to_data(char, char, char, char *);
270 271 token_t *au_to_header(int, au_event_t, au_emod_t);
271 272 token_t *au_to_header_ex(int, au_event_t, au_emod_t);
272 273 token_t *au_to_ipc(char, int);
273 274 token_t *au_to_ipc_perm(kipc_perm_t *);
274 275 token_t *au_to_iport(ushort_t);
275 276 token_t *au_to_in_addr(struct in_addr *);
276 277 token_t *au_to_in_addr_ex(int32_t *);
277 278 token_t *au_to_ip(struct ip *);
278 279 token_t *au_to_groups(const gid_t *, uint_t);
279 280 token_t *au_to_path(struct audit_path *);
280 281 token_t *au_to_seq();
281 282 token_t *au_to_process(uid_t, gid_t, uid_t, gid_t, pid_t,
282 283 au_id_t, au_asid_t, const au_tid_addr_t *);
283 284 token_t *au_to_subject(uid_t, gid_t, uid_t, gid_t, pid_t,
284 285 au_id_t, au_asid_t, const au_tid_addr_t *);
285 286 token_t *au_to_return32(int, int32_t);
286 287 token_t *au_to_return64(int, int64_t);
287 288 token_t *au_to_text(const char *);
288 289 /* token_t *au_to_tid(au_generic_tid_t *); no kernel implementation */
289 290 token_t *au_to_trailer(int);
290 291 token_t *au_to_uauth(char *);
|
↓ open down ↓ |
157 lines elided |
↑ open up ↑ |
291 292 size_t au_zonename_length(zone_t *);
292 293 token_t *au_to_zonename(size_t, zone_t *);
293 294 token_t *au_to_arg32(char, char *, uint32_t);
294 295 token_t *au_to_arg64(char, char *, uint64_t);
295 296 token_t *au_to_socket_ex(short, short, char *, char *);
296 297 token_t *au_to_sock_inet(struct sockaddr_in *);
297 298 token_t *au_to_exec_args(const char *, ssize_t);
298 299 token_t *au_to_exec_env(const char *, ssize_t);
299 300 token_t *au_to_label(bslabel_t *);
300 301 token_t *au_to_privset(const char *, const priv_set_t *, char, int);
302 +token_t *au_to_secflags(const char *, secflagset_t);
301 303
302 304 void au_uwrite();
303 305 void au_close(au_kcontext_t *, caddr_t *, int, au_event_t, au_emod_t,
304 306 timestruc_t *);
305 307 void au_close_defer(token_t *, int, au_event_t, au_emod_t, timestruc_t *);
306 308 void au_close_time(au_kcontext_t *, token_t *, int, au_event_t, au_emod_t,
307 309 timestruc_t *);
308 310 void au_free_rec(au_buff_t *);
309 311 void au_write(caddr_t *, token_t *);
310 312 void au_mem_init(void);
311 313 void au_zone_setup();
312 314 void au_enqueue(au_kcontext_t *, au_buff_t *, adr_t *, adr_t *, int, int);
313 315 int au_doorio(au_kcontext_t *);
314 316 int au_doormsg(au_kcontext_t *, uint32_t, void *);
315 317 int au_token_size(token_t *);
316 318 int au_append_rec(au_buff_t *, au_buff_t *, int);
317 319 int au_append_buf(const char *, int, au_buff_t *);
318 320
319 321 #else /* !_KERNEL */
320 322
321 323 #include <limits.h>
322 324 #include <sys/types.h>
323 325 #include <sys/vnode.h>
324 326 #include <netinet/in_systm.h>
325 327 #include <netinet/in.h>
326 328 #include <netinet/ip.h>
327 329 #include <sys/ipc.h>
328 330
329 331 struct token_s {
330 332 struct token_s *tt_next; /* Next in the list */
331 333 short tt_size; /* Size of data */
332 334 char *tt_data; /* The data */
333 335 };
334 336 typedef struct token_s token_t;
335 337
336 338 /*
337 339 * Old socket structure definition, formerly in <sys/socketvar.h>
338 340 */
339 341 struct oldsocket {
340 342 short so_type; /* generic type, see socket.h */
341 343 short so_options; /* from socket call, see socket.h */
342 344 short so_linger; /* time to linger while closing */
343 345 short so_state; /* internal state flags SS_*, below */
344 346 struct inpcb *so_pcb; /* protocol control block */
345 347 struct protosw *so_proto; /* protocol handle */
346 348 /*
347 349 * Variables for connection queueing.
348 350 * Socket where accepts occur is so_head in all subsidiary sockets.
349 351 * If so_head is 0, socket is not related to an accept.
350 352 * For head socket so_q0 queues partially completed connections,
351 353 * while so_q is a queue of connections ready to be accepted.
352 354 * If a connection is aborted and it has so_head set, then
353 355 * it has to be pulled out of either so_q0 or so_q.
354 356 * We allow connections to queue up based on current queue lengths
355 357 * and limit on number of queued connections for this socket.
356 358 */
357 359 struct oldsocket *so_head; /* back pointer to accept socket */
358 360 struct oldsocket *so_q0; /* queue of partial connections */
359 361 struct oldsocket *so_q; /* queue of incoming connections */
360 362 short so_q0len; /* partials on so_q0 */
361 363 short so_qlen; /* number of connections on so_q */
362 364 short so_qlimit; /* max number queued connections */
363 365 short so_timeo; /* connection timeout */
364 366 ushort_t so_error; /* error affecting connection */
365 367 short so_pgrp; /* pgrp for signals */
366 368 ulong_t so_oobmark; /* chars to oob mark */
367 369 /*
368 370 * Variables for socket buffering.
369 371 */
370 372 struct sockbuf {
371 373 ulong_t sb_cc; /* actual chars in buffer */
372 374 ulong_t sb_hiwat; /* max actual char count */
373 375 ulong_t sb_mbcnt; /* chars of mbufs used */
374 376 ulong_t sb_mbmax; /* max chars of mbufs to use */
375 377 ulong_t sb_lowat; /* low water mark (not used yet) */
376 378 struct mbuf *sb_mb; /* the mbuf chain */
377 379 struct proc *sb_sel; /* process selecting read/write */
378 380 short sb_timeo; /* timeout (not used yet) */
379 381 short sb_flags; /* flags, see below */
380 382 } so_rcv, so_snd;
381 383 /*
382 384 * Hooks for alternative wakeup strategies.
383 385 * These are used by kernel subsystems wishing to access the socket
384 386 * abstraction. If so_wupfunc is nonnull, it is called in place of
385 387 * wakeup any time that wakeup would otherwise be called with an
386 388 * argument whose value is an address lying within a socket structure.
387 389 */
388 390 struct wupalt *so_wupalt;
389 391 };
390 392 extern token_t *au_to_arg32(char, char *, uint32_t);
391 393 extern token_t *au_to_arg64(char, char *, uint64_t);
392 394 extern token_t *au_to_acl(struct acl *);
393 395 extern token_t *au_to_attr(struct vattr *);
394 396 extern token_t *au_to_cmd(uint_t, char **, char **);
395 397 extern token_t *au_to_data(char, char, char, char *);
396 398 extern token_t *au_to_exec_args(char **);
397 399 extern token_t *au_to_exec_env(char **);
398 400 extern token_t *au_to_exit(int, int);
399 401 extern token_t *au_to_fmri(char *);
400 402 extern token_t *au_to_groups(int *);
401 403 extern token_t *au_to_newgroups(int, gid_t *);
402 404 extern token_t *au_to_header(au_event_t, au_emod_t);
403 405 extern token_t *au_to_header_ex(au_event_t, au_emod_t);
404 406 extern token_t *au_to_in_addr(struct in_addr *);
405 407 extern token_t *au_to_in_addr_ex(struct in6_addr *);
406 408 extern token_t *au_to_ipc(char, int);
407 409 extern token_t *au_to_ipc_perm(struct ipc_perm *);
408 410 extern token_t *au_to_iport(ushort_t);
409 411 extern token_t *au_to_me(void);
410 412 extern token_t *au_to_mylabel(void);
411 413 extern token_t *au_to_opaque(char *, short);
412 414 extern token_t *au_to_path(char *);
413 415 extern token_t *au_to_privset(const char *, const priv_set_t *);
414 416 extern token_t *au_to_process(au_id_t, uid_t, gid_t, uid_t, gid_t,
415 417 pid_t, au_asid_t, au_tid_t *);
416 418 extern token_t *au_to_process_ex(au_id_t, uid_t, gid_t, uid_t, gid_t,
417 419 pid_t, au_asid_t, au_tid_addr_t *);
418 420 extern token_t *au_to_return32(char, uint32_t);
419 421 extern token_t *au_to_return64(char, uint64_t);
420 422 extern token_t *au_to_seq(int);
421 423 extern token_t *au_to_label(m_label_t *);
422 424 extern token_t *au_to_socket(struct oldsocket *);
423 425 extern token_t *au_to_subject(au_id_t, uid_t, gid_t, uid_t, gid_t,
424 426 pid_t, au_asid_t, au_tid_t *);
425 427 extern token_t *au_to_subject_ex(au_id_t, uid_t, gid_t, uid_t, gid_t,
426 428 pid_t, au_asid_t, au_tid_addr_t *);
427 429 extern token_t *au_to_text(char *);
428 430 extern token_t *au_to_tid(au_generic_tid_t *);
429 431 extern token_t *au_to_trailer(void);
430 432 extern token_t *au_to_uauth(char *);
431 433 extern token_t *au_to_upriv(char, char *);
432 434 extern token_t *au_to_user(uid_t, char *);
433 435 extern token_t *au_to_xatom(char *);
434 436 extern token_t *au_to_xselect(char *, char *, char *);
435 437 extern token_t *au_to_xcolormap(int32_t, uid_t);
436 438 extern token_t *au_to_xcursor(int32_t, uid_t);
437 439 extern token_t *au_to_xfont(int32_t, uid_t);
438 440 extern token_t *au_to_xgc(int32_t, uid_t);
439 441 extern token_t *au_to_xpixmap(int32_t, uid_t);
440 442 extern token_t *au_to_xwindow(int32_t, uid_t);
441 443 extern token_t *au_to_xproperty(int32_t, uid_t, char *);
442 444 extern token_t *au_to_xclient(uint32_t);
443 445 extern token_t *au_to_zonename(char *);
444 446 #endif /* _KERNEL */
445 447
446 448 #ifdef _KERNEL
447 449
448 450 void adr_char(adr_t *, char *, int);
449 451 void adr_int32(adr_t *, int32_t *, int);
450 452 void adr_uint32(adr_t *, uint32_t *, int);
451 453 void adr_int64(adr_t *, int64_t *, int);
452 454 void adr_uint64(adr_t *, uint64_t *, int);
453 455 void adr_short(adr_t *, short *, int);
454 456 void adr_ushort(adr_t *, ushort_t *, int);
455 457 void adr_start(adr_t *, char *);
456 458
457 459 char *adr_getchar(adr_t *, char *);
458 460 char *adr_getshort(adr_t *, short *);
459 461 char *adr_getushort(adr_t *, ushort_t *);
460 462 char *adr_getint32(adr_t *, int32_t *);
461 463 char *adr_getuint32(adr_t *, uint32_t *);
462 464 char *adr_getint64(adr_t *, int64_t *);
463 465 char *adr_getuint64(adr_t *, uint64_t *);
464 466
465 467 int adr_count(adr_t *);
466 468
467 469 #endif /* _KERNEL */
468 470
469 471 #ifdef __cplusplus
470 472 }
471 473 #endif
472 474
473 475 #endif /* _BSM_AUDIT_RECORD_H */
|
↓ open down ↓ |
163 lines elided |
↑ open up ↑ |
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX