usr/src/lib/libbsm/common/audit_rshd.c

   1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21 /*
  22  * Copyright (c) 1992, 2010, Oracle and/or its affiliates. All rights reserved.
  23  */
  24
  25 #include <sys/types.h>
  26 #include <sys/param.h>
  27 #include <stdio.h>
  28 #include <sys/fcntl.h>
  29 #include <bsm/audit.h>
  30 #include <bsm/audit_record.h>
  31 #include <bsm/audit_uevents.h>
  32 #include <bsm/libbsm.h>
  33 #include <bsm/audit_private.h>
  34 #include <stdlib.h>
  35 #include <string.h>
  36 #include <syslog.h>
  37 #include <netinet/in.h>
  38 #include <tsol/label.h>
  39 #include <locale.h>
  40 #include <unistd.h>
  41 #include <generic.h>
  42
  43 static au_event_t       rshd_event;     /* audit event number */
  44 static uint32_t         rshd_addr[4];   /* peer address */
  45
  46 static void generate_record(char *, char *, char *, int, char *);
  47 static void setup_session(char *);
  48 static int selected(uid_t, char *, au_event_t, int);
  49
  50 int
  51 audit_rshd_setup()
  52 {
  53         rshd_event = AUE_rshd;
  54         return (0);
  55 }
  56
  57 /* ARGSUSED */
  58 int
  59 audit_rshd_fail(msg, hostname, remuser, locuser, cmdbuf)
  60 char    *msg;           /* message containing failure information */
  61 char    *hostname;              /* hostname of machine requesting service */
  62 char    *remuser;               /* username at machine requesting service */
  63 char    *locuser;               /* username of local machine */
  64 char    *cmdbuf;                /* command line to be executed locally */
  65 {
  66         if (cannot_audit(0)) {
  67                 return (0);
  68         }
  69         generate_record(remuser, locuser, cmdbuf, -1, msg);
  70         return (0);
  71 }
  72
  73 /* ARGSUSED */
  74 int
  75 audit_rshd_success(hostname, remuser, locuser, cmdbuf)
  76 char    *hostname;              /* hostname of machine requesting service */
  77 char    *remuser;               /* username at machine requesting service */
  78 char    *locuser;               /* username at local machine */
  79 char    *cmdbuf;                /* command line to be executed locally */
  80 {
  81         if (cannot_audit(0)) {
  82                 return (0);
  83         }
  84         generate_record(remuser, locuser, cmdbuf, 0, "");
  85         setup_session(locuser);
  86         return (0);
  87 }
  88
  89
  90 #include <pwd.h>
  91
  92 static void
  93 generate_record(char *remuser,  /* username at machine requesting service */
  94                 char *locuser,  /* username of local machine */
  95                 char *cmdbuf,   /* command line to be executed locally */
  96                 int sf_flag,    /* success (0) or failure (-1) flag */
  97                 char *msg)      /* message containing failure information */
  98 {
  99         int     rd;             /* audit record descriptor */
 100         char    buf[256];       /* temporary buffer */
 101         char    *tbuf;          /* temporary buffer */
 102         int     tlen;
 103         const char *gtxt;
 104         uid_t   uid;
 105         gid_t   gid;
 106         pid_t   pid;
 107         struct passwd *pwd;
 108         struct auditinfo_addr info;
 109
 110         if (cannot_audit(0)) {
 111                 return;
 112         }
 113
 114         pwd = getpwnam(locuser);
 115         if (pwd == NULL) {
 116                 uid = (uid_t)-1;
 117                 gid = (gid_t)-1;
 118         } else {
 119                 uid = pwd->pw_uid;
 120                 gid = pwd->pw_gid;
 121         }
 122
 123         if (!selected(uid, locuser, rshd_event, sf_flag))
 124                 return;
 125
 126         pid = getpid();
 127
 128         /* see if terminal id already set */
 129         if (getaudit_addr(&info, sizeof (info)) < 0) {
 130                 perror("getaudit");
 131         }
 132         rd = au_open();
 133
 134         (void) au_write(rd, au_to_subject_ex(uid, uid, gid, uid, gid, pid, pid,
 135             &info.ai_termid));
 136         if (is_system_labeled())
 137                 (void) au_write(rd, au_to_mylabel());
 138
 139         gtxt = dgettext(bsm_dom, "cmd %s");
 140         tlen = strlen(gtxt) + strlen(cmdbuf) + 1;
 141         if ((tbuf = malloc(tlen)) == NULL) {
 142                 (void) au_close(rd, 0, 0);
 143                 return;
 144         }
 145         (void) snprintf(tbuf, tlen, gtxt, cmdbuf);
 146         (void) au_write(rd, au_to_text(tbuf));
 147         (void) free(tbuf);
 148
 149         if (strcmp(remuser, locuser) != 0) {
 150                 (void) snprintf(buf, sizeof (buf), dgettext(bsm_dom,
 151                     "remote user %s"), remuser);
 152                 (void) au_write(rd, au_to_text(buf));
 153         }
 154
 155         if (sf_flag == -1) {
 156                 (void) snprintf(buf, sizeof (buf), dgettext(bsm_dom,
 157                     "local user %s"), locuser);
 158                 (void) au_write(rd, au_to_text(buf));
 159                 (void) au_write(rd, au_to_text(msg));
 160         }
 161
 162 #ifdef _LP64
 163         (void) au_write(rd, au_to_return64(sf_flag, (int64_t)0));
 164 #else
 165         (void) au_write(rd, au_to_return32(sf_flag, (int32_t)0));
 166 #endif
 167
 168         if (au_close(rd, 1, rshd_event) < 0) {
 169                 (void) au_close(rd, 0, 0);
 170         }
 171 }
 172
 173 static int
 174 selected(uid_t uid, char *locuser, au_event_t event, int sf)
 175 {
 176         int             sorf;
 177         struct au_mask  mask;
 178
 179         mask.am_success = mask.am_failure = 0;
 180         if (uid > MAXEPHUID) {
 181                 /* get non-attrib flags */
 182                 (void) auditon(A_GETKMASK, (caddr_t)&mask, sizeof (mask));
 183         } else {
 184                 (void) au_user_mask(locuser, &mask);
 185         }
 186
 187         if (sf == 0) {
 188                 sorf = AU_PRS_SUCCESS;
 189         } else if (sf == -1) {
 190                 sorf = AU_PRS_FAILURE;
 191         } else {
 192                 sorf = AU_PRS_BOTH;
 193         }
 194
 195         return (au_preselect(event, &mask, sorf, AU_PRS_REREAD));
 196 }
 197
 198 static void
 199 setup_session(char *locuser)
 200 {
 201         int     rc;
 202         struct auditinfo_addr info;
 203         au_mask_t               mask;
 204         uid_t                   uid;
 205         struct passwd *pwd;
 206
 207         pwd = getpwnam(locuser);
 208         if (pwd == NULL)
 209                 uid = (uid_t)-1;
 210         else
 211                 uid = pwd->pw_uid;
 212
 213         /* see if terminal id already set */
 214         if (getaudit_addr(&info, sizeof (info)) < 0) {
 215                 perror("getaudit");
 216         }
 217
 218         info.ai_auid = uid;
 219         info.ai_asid = getpid();
 220
 221         mask.am_success = 0;
 222         mask.am_failure = 0;
 223         (void) au_user_mask(locuser, &mask);
 224
 225         info.ai_mask.am_success = mask.am_success;
 226         info.ai_mask.am_failure = mask.am_failure;
 227
 228         rshd_addr[0] = info.ai_termid.at_addr[0];
 229         rshd_addr[1] = info.ai_termid.at_addr[1];
 230         rshd_addr[2] = info.ai_termid.at_addr[2];
 231         rshd_addr[3] = info.ai_termid.at_addr[3];
 232
 233         rc = setaudit_addr(&info, sizeof (info));
 234         if (rc < 0) {
 235                 perror("setaudit");
 236         }
 237 }