libbsm/common/audit_rexecd.c

/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */
#pragma ident	"%Z%%M%	%I%	%E% SMI"

#include <sys/types.h>
#include <stdio.h>
#include <unistd.h>
#include <sys/fcntl.h>
#include <bsm/audit.h>
#include <bsm/audit_record.h>
#include <bsm/audit_uevents.h>
#include <bsm/libbsm.h>
#include <bsm/audit_private.h>
#include <stdlib.h>
#include <string.h>
#include <syslog.h>
#include <pwd.h>
#include <netinet/in.h>
#include <tsol/label.h>
#include <locale.h>
#include "generic.h"

#ifdef C2_DEBUG
#define	dprintf(x) { printf x; }
#else
#define	dprintf(x)
#endif

static au_event_t	event;
static int		audit_rexecd_status = 0;

static int
selected(uid, user, event, sf)
uid_t uid;
char	*user;
au_event_t	event;
int	sf;
{
	int	rc, sorf;
	char	naflags[512];
	struct au_mask mask;

	mask.am_success = mask.am_failure = 0;
	if (uid > MAXEPHUID) {
		rc = getacna(naflags, 256); /* get non-attrib flags */
		if (rc == 0)
			(void) getauditflagsbin(naflags, &mask);
	} else {
		rc = au_user_mask(user, &mask);
	}

	if (sf == 0)
		sorf = AU_PRS_SUCCESS;
	else if (sf == -1)
		sorf = AU_PRS_FAILURE;
	else
		sorf = AU_PRS_BOTH;
	rc = au_preselect(event, &mask, sorf, AU_PRS_REREAD);
	return (rc);
}

void
audit_rexecd_setup()
{
	dprintf(("audit_rexecd_setup()\n"));

	event = AUE_rexecd;
}


static void
audit_rexecd_session_setup(char *name, char *mach, uid_t uid)
{
	int			rc;
	au_mask_t		mask;
	struct auditinfo_addr	info;
	uint32_t addr[4], type;

	info.ai_auid = uid;
	info.ai_asid = getpid();

	mask.am_success = 0;
	mask.am_failure = 0;

	(void) au_user_mask(name, &mask);

	info.ai_mask.am_success  = mask.am_success;
	info.ai_mask.am_failure  = mask.am_failure;

	rc = aug_get_machine(mach, addr, &type);
	if (rc < 0) {
		perror("get address");
	}
	info.ai_termid.at_port = aug_get_port();
	info.ai_termid.at_type    = type;
	info.ai_termid.at_addr[0] = addr[0];
	info.ai_termid.at_addr[1] = addr[1];
	info.ai_termid.at_addr[2] = addr[2];
	info.ai_termid.at_addr[3] = addr[3];

	rc = setaudit_addr(&info, sizeof (info));
	if (rc < 0) {
		perror("setaudit");
	}
}

void
audit_rexecd_fail(msg, hostname, user, cmdbuf)
char	*msg;		/* message containing failure information */
char	*hostname;	/* hostname of machine requesting service */
char	*user;		/* username of user requesting service */
char	*cmdbuf;	/* command line to be executed locally */
{
	int	rd;		/* audit record descriptor */
	char	buf[256];	/* temporary buffer */
	char	*tbuf;		/* temporary buffer */
	int	tlen;
	const char *gtxt;
	uid_t 	uid;
	gid_t	gid;
	pid_t	pid;
	au_tid_addr_t	tid;
	struct passwd	*pwd;
	uint32_t addr[4], type;
	int rc;

	dprintf(("audit_rexecd_fail()\n"));

	/*
	 * check if audit_rexecd_fail() or audit_rexecd_success()
	 * have been called already.
	 */
	if (audit_rexecd_status == 1) {
		return;
	}

	if (cannot_audit(0)) {
		return;
	}

	/*
	 * set status to prevent multiple calls
	 * to audit_rexecd_fail() and audit_rexecd_success()
	 */
	audit_rexecd_status = 1;

	pwd = getpwnam(user);
	if (pwd == NULL) {
		uid = (uid_t)-1;
		gid = (gid_t)-1;
	} else {
		uid = pwd->pw_uid;
		gid = pwd->pw_gid;
	}

	/* determine if we're preselected */
	if (!selected(uid, user, event, -1))
		return;

	pid = getpid();
	rc = aug_get_machine(hostname, addr, &type);
	if (rc < 0) {
		perror("get address");
	}

	tid.at_port    = aug_get_port();
	tid.at_addr[0] = addr[0];
	tid.at_addr[1] = addr[1];
	tid.at_addr[2] = addr[2];
	tid.at_addr[3] = addr[3];
	tid.at_type    = type;

	rd = au_open();

	/* add subject token */
	(void) au_write(rd,
		au_to_subject_ex(uid, uid, gid, uid, gid, pid, pid, &tid));
	if (is_system_labeled())
		(void) au_write(rd, au_to_mylabel());

	/* add reason for failure */
	(void) au_write(rd, au_to_text(msg));

	/* add hostname of machine requesting service */
	(void) snprintf(buf, sizeof (buf), dgettext(bsm_dom,
		"Remote execution requested by: %s"), hostname);
	(void) au_write(rd, au_to_text(buf));

	/* add username of user requesting service */
	(void) snprintf(buf, sizeof (buf), dgettext(bsm_dom,
		"Username: %s"), user);
	(void) au_write(rd, au_to_text(buf));

	/* add command line to be executed locally */
	gtxt = dgettext(bsm_dom, "Command line: %s");
	tlen = strlen(gtxt) + strlen(cmdbuf) + 1;
	if ((tbuf = malloc(tlen)) == NULL) {
		(void) au_close(rd, 0, 0);
		return;
	}
	(void) snprintf(tbuf, tlen, gtxt, cmdbuf);
	(void) au_write(rd, au_to_text(tbuf));
	(void) free(tbuf);

	/* add return token */
#ifdef _LP64
	(void) au_write(rd, au_to_return64(-1, (int64_t)0));
#else
	(void) au_write(rd, au_to_return32(-1, (int32_t)0));
#endif

	/* write audit record */
	if (au_close(rd, 1, event) < 0) {
		(void) au_close(rd, 0, 0);
		return;
	}
}

void
audit_rexecd_success(hostname, user, cmdbuf)
char	*hostname;	/* hostname of machine requesting service */
char	*user;		/* username of user requesting service */
char	*cmdbuf;	/* command line to be executed locally */
{
	int	rd;		/* audit record descriptor */
	char	buf[256];	/* temporary buffer */
	char	*tbuf;		/* temporary buffer */
	int	tlen;
	const char *gtxt;
	uid_t 	uid;
	gid_t	gid;
	pid_t	pid;
	au_tid_addr_t	tid;
	struct passwd	*pwd;
	uint32_t addr[4], type;
	int rc;

	dprintf(("audit_rexecd_success()\n"));

	/*
	 * check if audit_rexecd_fail() or audit_rexecd_success()
	 * have been called already.
	 */
	if (audit_rexecd_status == 1) {
		return;
	}

	if (cannot_audit(0)) {
		return;
	}

	/*
	 * set status to prevent multiple calls
	 * to audit_rexecd_fail() and audit_rexecd_success()
	 */
	audit_rexecd_status = 1;

	pwd = getpwnam(user);
	if (pwd == NULL) {
		uid = (uid_t)-1;
		gid = (gid_t)-1;
	} else {
		uid = pwd->pw_uid;
		gid = pwd->pw_gid;
	}

	/* determine if we're preselected */
	if (!selected(uid, user, event, 0))
		goto rexecd_audit_session;

	pid = getpid();
	rc = aug_get_machine(hostname, addr, &type);
	if (rc < 0) {
		perror("get address");
	}

	tid.at_port    = aug_get_port();
	tid.at_addr[0] = addr[0];
	tid.at_addr[1] = addr[1];
	tid.at_addr[2] = addr[2];
	tid.at_addr[3] = addr[3];
	tid.at_type    = type;

	rd = au_open();

	/* add subject token */
	(void) au_write(rd,
		au_to_subject_ex(uid, uid, gid, uid, gid, pid, pid, &tid));
	if (is_system_labeled())
		(void) au_write(rd, au_to_mylabel());

	/* add hostname of machine requesting service */
	(void) snprintf(buf, sizeof (buf), dgettext(bsm_dom,
		"Remote execution requested by: %s"), hostname);
	(void) au_write(rd, au_to_text(buf));

	/* add username at machine requesting service */
	(void) snprintf(buf, sizeof (buf), dgettext(bsm_dom,
	    "Username: %s"), user);
	(void) au_write(rd, au_to_text(buf));

	/* add command line to be executed locally */
	gtxt = dgettext(bsm_dom, "Command line: %s");
	tlen = strlen(gtxt) + strlen(cmdbuf) + 1;
	if ((tbuf = malloc(tlen)) == NULL) {
		(void) au_close(rd, 0, 0);
	} else {
		(void) snprintf(tbuf, tlen, gtxt, cmdbuf);
		(void) au_write(rd, au_to_text(tbuf));
		(void) free(tbuf);

		/* add return token */
#ifdef _LP64
		(void) au_write(rd, au_to_return64(0, (int64_t)0));
#else
		(void) au_write(rd, au_to_return32(0, (int32_t)0));
#endif

		/* write audit record */
		if (au_close(rd, 1, event) < 0) {
			(void) au_close(rd, 0, 0);
		}
	}

rexecd_audit_session:
	audit_rexecd_session_setup(user, hostname, uid);
}