libbsm/common/audit_cron.c

/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

#include <sys/types.h>
#include <sys/systeminfo.h>
#include <bsm/audit.h>
#include <bsm/libbsm.h>
#include <bsm/audit_uevents.h>
#include <bsm/audit_private.h>
#include <unistd.h>
#include <wait.h>
#include <fcntl.h>
#include <pwd.h>
#include <string.h>
#include <stdlib.h>
#include <errno.h>
#include <syslog.h>
#include <sys/stat.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <libgen.h>

#include <locale.h>
#include "generic.h"

#define	F_AUID	"%u\n"
#define	F_SMASK	"%x\n"
#define	F_FMASK	"%x\n"
#define	F_PORT	"%lx\n"
#define	F_TYPE	"%x\n"
#define	F_MACH	"%x %x %x %x\n"
#define	F_ASID	"%u\n"

#define	AU_SUFFIX	".au"

#define	ANC_BAD_FILE	-1
#define	ANC_BAD_FORMAT	-2

#define	AUDIT_CRON_TEXTBUF	256
static char	textbuf[AUDIT_CRON_TEXTBUF];

int
audit_cron_mode()
{
	return (!cannot_audit(0));
}

static void
audit_cron_syslog(const char *message) {
	static	int	is_open = 0;

	if (!is_open) {
		openlog("Solaris_Audit", LOG_ODELAY, LOG_CRON);
		is_open = 1;
	}
	syslog(LOG_WARNING, "%s", message);
}

/*
 * audit_cron_getinfo returns the audit characteristics from the relevant
 * auxiliary file, it if exists.  If not, it creates them from the crontab
 * or atjob uid.
 */

static int
audit_cron_getinfo(char *fname, char *fname_aux, struct auditinfo_addr *info)
{
	int		fd;
	struct stat	st;
	au_mask_t mask;
	struct passwd	pwd;
	char		pwd_buff[1024];
	static char	*msg =
	    "Used defaults instead of ancilary audit file";

	if ((fd = open(fname_aux, O_RDONLY)) == -1) {
		/* no syslog here; common case */
		goto make_it_up;
	}
	if (fstat(fd, &st) == -1) {
		/* no syslog here either; common case */
		goto delete_first;
	}

	if (read(fd, textbuf, st.st_size) != st.st_size) {
		audit_cron_syslog(msg);
		goto delete_first;
	}

	if (sscanf(textbuf,
	    F_AUID
	    F_SMASK
	    F_FMASK
	    F_PORT
	    F_TYPE
	    F_MACH
	    F_ASID,
	    &(info->ai_auid),
	    &(info->ai_mask.am_success),
	    &(info->ai_mask.am_failure),
	    &(info->ai_termid.at_port),
	    &(info->ai_termid.at_type),
	    &(info->ai_termid.at_addr[0]),
	    &(info->ai_termid.at_addr[1]),
	    &(info->ai_termid.at_addr[2]),
	    &(info->ai_termid.at_addr[3]),
	    &(info->ai_asid)) != 10) {
		audit_cron_syslog(msg);
		goto delete_first;
	}
	(void) close(fd);
	return (0);

delete_first:
	(void) close(fd);
	if (unlink(fname_aux)) {
		if (errno != ENOENT)
			audit_cron_syslog(
			    "Failed to remove invalid ancilary audit file");
	}
	/* intentionally falls through */

make_it_up:
	if (stat(fname, &st))
		return (-1);

	/* port and IP are zero */
	(void) memset(&(info->ai_termid), 0, sizeof (au_tid_addr_t));
	info->ai_termid.at_type = AU_IPv4;

	/* the caller is the child of cron which will run the job. */
	info->ai_asid = getpid();

	info->ai_mask.am_success = 0;	/* cover error case */
	info->ai_mask.am_failure = 0;

	if (strstr(fname, "crontabs") != NULL) {
		if (getpwnam_r(basename(fname), &pwd, pwd_buff,
		    sizeof (pwd_buff)) == NULL)
			return (-1); /* getpwnam_r sets errno */
	} else {
		if (getpwuid_r(st.st_uid, &pwd, pwd_buff, sizeof (pwd_buff)) ==
		    NULL)
			return (-1); /* getpwuid_r sets errno */
	}

	info->ai_auid = pwd.pw_uid;

	if (au_user_mask(pwd.pw_name, &mask)) {
		errno = EINVAL; /* pw_name lookup failed */
		return (-1);
	}
	info->ai_mask.am_success = mask.am_success;
	info->ai_mask.am_failure = mask.am_failure;

	return (0);
}

int
audit_cron_setinfo(char *fname, struct auditinfo_addr *info)
{
	int		fd, len, r;
	int		save_err;

	r = chmod(fname, 0200);
	if (r == -1 && errno != ENOENT)
		return (-1);

	if ((fd = open(fname, O_CREAT|O_WRONLY|O_TRUNC, 0200)) == -1)
		return (-1);

	len = sprintf(textbuf,
	    F_AUID
	    F_SMASK
	    F_FMASK
	    F_PORT
	    F_TYPE
	    F_MACH
	    F_ASID,
	    info->ai_auid,
	    info->ai_mask.am_success,
	    info->ai_mask.am_failure,
	    info->ai_termid.at_port,
	    info->ai_termid.at_type,
	    info->ai_termid.at_addr[0],
	    info->ai_termid.at_addr[1],
	    info->ai_termid.at_addr[2],
	    info->ai_termid.at_addr[3],
	    info->ai_asid);

	if (write(fd, textbuf, len) != len)
		goto audit_setinfo_clean;

	if (fchmod(fd, 0400) == -1)
		goto audit_setinfo_clean;

	(void) close(fd);
	return (0);

audit_setinfo_clean:
	save_err = errno;
	(void) close(fd);
	(void) unlink(fname);
	errno = save_err;
	return (-1);
}

char *
audit_cron_make_anc_name(char *fname)
{
	char *anc_name;

	anc_name = (char *)malloc(strlen(fname) + strlen(AU_SUFFIX) + 1);
	if (anc_name == NULL)
		return (NULL);

	(void) strcpy(anc_name, fname);
	(void) strcat(anc_name, AU_SUFFIX);
	return (anc_name);
}

int
audit_cron_is_anc_name(char *name)
{
	int	pos;

	pos = strlen(name) - strlen(AU_SUFFIX);
	if (pos <= 0)
		return (0);

	if (strcmp(name + pos, AU_SUFFIX) == 0)
		return (1);

	return (0);
}

static void
audit_cron_session_failure(char *name, int type, char *err_str)
{
	const char	*mess;

	if (type == 0)
		mess = dgettext(bsm_dom,
		"at-job session for user %s failed: ancillary file: %s");
	else
		mess = dgettext(bsm_dom,
		"crontab job session for user %s failed: ancillary file: %s");

	(void) snprintf(textbuf, sizeof (textbuf), mess, name, err_str);

	aug_save_event(AUE_cron_invoke);
	aug_save_sorf(4);
	aug_save_text(textbuf);
	(void) aug_audit();
}


int
audit_cron_session(
		char *name,
		char *path,
		uid_t uid,
		gid_t gid,
		char *at_jobname)
{
	struct auditinfo_addr	info;
	au_mask_t		mask;
	char			*anc_file, *fname;
	int			r = 0;
	char			full_path[PATH_MAX];

	if (cannot_audit(0)) {
		return (0);
	}

	/* get auditinfo from ancillary file */
	if (at_jobname == NULL) {
		/*
		 *	this is a cron-event, so we can get
		 *	filename from "name" arg
		 */
		fname = name;
		if (path != NULL) {
			if (strlen(path) + strlen(fname) + 2 > PATH_MAX) {
				errno = ENAMETOOLONG;
				r = -1;
			}
			(void) strcat(strcat(strcpy(full_path, path), "/"),
			    fname);
			fname = full_path;
		}
	} else {
		/* this is an at-event, use "at_jobname" */
		fname = at_jobname;
	}

	if (r == 0) {
		anc_file = audit_cron_make_anc_name(fname);
		if (anc_file == NULL) {
			r = -1;
		} else {
			r = audit_cron_getinfo(fname, anc_file, &info);
		}
	}

	if (r != 0) {
		char *err_str;

		if (r == ANC_BAD_FORMAT)
			err_str = dgettext(bsm_dom, "bad format");
		else
			err_str = strerror(errno);

		audit_cron_session_failure(name,
		    at_jobname == NULL,
		    err_str);
		if (anc_file != NULL)
			free(anc_file);
		return (r);
	}

	free(anc_file);
	aug_init();

	/* get current audit masks */
	if (au_user_mask(name, &mask) == 0) {
		info.ai_mask.am_success  |= mask.am_success;
		info.ai_mask.am_failure  |= mask.am_failure;
	}

	/* save audit attributes for further use in current process */
	aug_save_auid(info.ai_auid);
	aug_save_asid(info.ai_asid);
	aug_save_tid_ex(info.ai_termid.at_port, info.ai_termid.at_addr,
	    info.ai_termid.at_type);
	aug_save_pid(getpid());
	aug_save_uid(uid);
	aug_save_gid(gid);
	aug_save_euid(uid);
	aug_save_egid(gid);

	/* set mixed audit masks */
	return (setaudit_addr(&info, sizeof (info)));
}

/*
 * audit_cron_new_job - create audit record with an information
 *			about new job started by cron.
 *	args:
 *	cmd  - command being run by cron daemon.
 *	type - type of job (0 - at-job, 1 - crontab job).
 *	event - not used. pointer to cron event structure.
 */
/*ARGSUSED*/
void
audit_cron_new_job(char *cmd, int type, void *event)
{
	if (cannot_audit(0))
		return;

	if (type == 0) {
		(void) snprintf(textbuf, sizeof (textbuf),
		    dgettext(bsm_dom, "at-job"));
	} else if (type == 1) {
		(void) snprintf(textbuf, sizeof (textbuf),
		    dgettext(bsm_dom, "batch-job"));
	} else if (type == 2) {
		(void) snprintf(textbuf, sizeof (textbuf),
		    dgettext(bsm_dom, "crontab-job"));
	} else if ((type > 2) && (type <= 25)) {	/* 25 from cron.h */
		(void) snprintf(textbuf, sizeof (textbuf),
		    dgettext(bsm_dom, "queue-job (%c)"), (type+'a'));
	} else {
		(void) snprintf(textbuf, sizeof (textbuf),
		    dgettext(bsm_dom, "unknown job type (%d)"), type);
	}

	aug_save_event(AUE_cron_invoke);
	aug_save_sorf(0);
	aug_save_text(textbuf);
	aug_save_text1(cmd);
	(void) aug_audit();
}

void
audit_cron_bad_user(char *name)
{
	if (cannot_audit(0))
		return;

	(void) snprintf(textbuf, sizeof (textbuf),
	    dgettext(bsm_dom, "bad user %s"), name);

	aug_save_event(AUE_cron_invoke);
	aug_save_sorf(2);
	aug_save_text(textbuf);
	(void) aug_audit();
}

void
audit_cron_user_acct_expired(char *name)
{
	if (cannot_audit(0))
		return;

	(void) snprintf(textbuf, sizeof (textbuf),
	    dgettext(bsm_dom,
	    "user %s account expired"), name);

	aug_save_event(AUE_cron_invoke);
	aug_save_sorf(3);
	aug_save_text(textbuf);
	(void) aug_audit();
}

int
audit_cron_create_anc_file(char *name, char *path, char *uname, uid_t uid)
{
	au_mask_t	msk;
	auditinfo_addr_t ai;
	int		pid;
	char		*anc_name;
	char		full_path[PATH_MAX];

	if (cannot_audit(0))
		return (0);

	if (name == NULL)
		return (0);

	if (path != NULL) {
		if (strlen(path) + strlen(name) + 2 > PATH_MAX)
			return (-1);
		(void) strcat(strcat(strcpy(full_path, path), "/"), name);
		name = full_path;
	}
	anc_name = audit_cron_make_anc_name(name);

	if (access(anc_name, F_OK) != 0) {
		if (au_user_mask(uname, &msk) != 0) {
			free(anc_name);
			return (-1);
		}

		ai.ai_mask = msk;
		ai.ai_auid = uid;
		ai.ai_termid.at_port = 0;
		ai.ai_termid.at_type = AU_IPv4;
		ai.ai_termid.at_addr[0] = 0;
		ai.ai_termid.at_addr[1] = 0;
		ai.ai_termid.at_addr[2] = 0;
		ai.ai_termid.at_addr[3] = 0;
		/* generate new pid to use it as asid */
		pid = vfork();
		if (pid == -1) {
			free(anc_name);
			return (-1);
		}
		if (pid == 0)
			exit(0);
		else {
		/*
		 * we need to clear status of children for
		 * wait() call in "cron"
		 */
			int lock;

			(void) waitpid(pid, &lock, 0);
		}
		ai.ai_asid = pid;
		if (audit_cron_setinfo(anc_name, &ai) != 0) {
			free(anc_name);
			return (-1);
		}
	}

	free(anc_name);
	return (0);
}

int
audit_cron_delete_anc_file(char *name, char *path)
{
	char	*anc_name;
	char	full_path[PATH_MAX];
	int	r;

	if (name == NULL)
		return (0);

	if (path != NULL) {
		if (strlen(path) + strlen(name) + 2 > PATH_MAX)
			return (-1);
		(void) strcat(strcat(strcpy(full_path, path), "/"), name);
		name = full_path;
	}
	anc_name = audit_cron_make_anc_name(name);
	r = unlink(anc_name);
	free(anc_name);
	return (r);
}