/*

 * CDDL HEADER START

 *

 * The contents of this file are subject to the terms of the

 * Common Development and Distribution License, Version 1.0 only

 * (the "License").  You may not use this file except in compliance

 * with the License.

 *

 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE

 * or http://www.opensolaris.org/os/licensing.

 * See the License for the specific language governing permissions

 * and limitations under the License.

 *

 * When distributing Covered Code, include this CDDL HEADER in each

 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.

 * If applicable, add the following below this CDDL HEADER, with the

 * fields enclosed by brackets "[]" replaced with your own identifying

 * information: Portions Copyright [yyyy] [name of copyright owner]

 *

 * CDDL HEADER END

 */

/*

 * Use is subject to license terms.

 */

/*

 * This file contains the audit hook support code for auditing.

 */

#pragma ident	"%Z%%M%	%I%	%E% SMI"

#include <sys/types.h>

#include <sys/proc.h>

#include <sys/vnode.h>

#include <sys/vfs.h>

#include <sys/file.h>

#include <sys/user.h>

#include <sys/stropts.h>

#include <sys/systm.h>

#include <sys/pathname.h>

#include <sys/syscall.h>

#include <sys/fcntl.h>

#include <sys/ipc_impl.h>

#include <sys/msg_impl.h>

#include <sys/sem_impl.h>

#include <sys/shm_impl.h>

#include <sys/kmem.h>		/* for KM_SLEEP */

#include <sys/socket.h>

#include <sys/cmn_err.h>	/* snprintf... */

#include <sys/debug.h>

#include <sys/thread.h>

#include <netinet/in.h>

#include <c2/audit.h>		/* needs to be included before user.h */

#include <c2/audit_kernel.h>	/* for M_DONTWAIT */

#include <c2/audit_kevents.h>

#include <c2/audit_record.h>

#include <sys/strsubr.h>

#include <sys/tihdr.h>

#include <sys/tiuser.h>

#include <sys/timod.h>

#include <sys/model.h>		/* for model_t */

#include <sys/disp.h>		/* for servicing_interrupt() */

#include <sys/devpolicy.h>

#include <sys/crypto/ioctladmin.h>

static void add_return_token(caddr_t *, unsigned int scid, int err, int rval);

static void audit_pathbuild(struct pathname *pnp);

/*

 * ROUTINE:	AUDIT_NEWPROC

 * PURPOSE:	initialize the child p_audit_data structure

 * CALLBY:	GETPROC

 * NOTE:	All threads for the parent process are locked at this point.

 *		We are essentially running singled threaded for this reason.

 *		GETPROC is called when system creates a new process.

 *		By the time AUDIT_NEWPROC is called, the child proc

 *		structure has already been initialized. What we need

 *		to do is to allocate the child p_audit_data and

 *		initialize it with the content of current parent process.

 */

void

audit_newproc(struct proc *cp)	/* initialized child proc structure */

{

	p_audit_data_t *pad;	/* child process audit data */

	p_audit_data_t *opad;	/* parent process audit data */

	pad = kmem_cache_alloc(au_pad_cache, KM_SLEEP);

	P2A(cp) = pad;

	opad = P2A(curproc);

	/*

	 * copy the audit data. Note that all threads of current

	 *   process have been "held". Thus there is no race condition

	 *   here with mutiple threads trying to alter the cwrd

	 *   structure (such as releasing it).

	 *

	 *   The audit context in the cred is "duplicated" for the new

	 *   proc by elsewhere crhold'ing the parent's cred which it shares.

	 *

	 *   We still want to hold things since auditon() [A_SETUMASK,

	 *   A_SETSMASK] could be walking through the processes to

	 *   update things.

	 */

	mutex_enter(&opad->pad_lock);	/* lock opad structure during copy */

	pad->pad_data = opad->pad_data;	/* copy parent's process audit data */

	au_pathhold(pad->pad_root);

	au_pathhold(pad->pad_cwd);

	mutex_exit(&opad->pad_lock);	/* current proc will keep cwrd open */

	/*

	 * finish auditing of parent here so that it will be done

	 * before child has a chance to run. We include the child

	 * pid since the return value in the return token is a dummy

	 * one and contains no useful information (it is included to

	 * make the audit record structure consistant).

	 *

	 * tad_flag is set if auditing is on

	 */

	if (((t_audit_data_t *)T2A(curthread))->tad_flag)

		au_uwrite(au_to_arg32(0, "child PID", (uint32_t)cp->p_pid));

	/*

	 * finish up audit record generation here because child process

	 * is set to run before parent process. We distinguish here

	 * between FORK, FORK1, or VFORK by the saved system call ID.

	 */

	audit_finish(0, ((t_audit_data_t *)T2A(curthread))->tad_scid, 0, 0);

}

/*

 * ROUTINE:	AUDIT_PFREE

 * PURPOSE:	deallocate the per-process udit data structure

 * CALLBY:	EXIT

 *		FORK_FAIL

 * NOTE:	all lwp except current one have stopped in SEXITLWPS

 * 		why we are single threaded?

 *		. all lwp except current one have stopped in SEXITLWPS.

 */

void

audit_pfree(struct proc *p)		/* proc structure to be freed */

{	/* AUDIT_PFREE */

	p_audit_data_t *pad;

	pad = P2A(p);

	/* better be a per process audit data structure */

	ASSERT(pad != (p_audit_data_t *)0);

	if (pad == pad0) {

		return;

	}

	/* deallocate all auditing resources for this process */

	au_pathrele(pad->pad_root);

	au_pathrele(pad->pad_cwd);

	/*

	 * Since the pad structure is completely overwritten after alloc,

	 * we don't bother to clear it.

	 */

	kmem_cache_free(au_pad_cache, pad);

}

/*

 * ROUTINE:	AUDIT_THREAD_CREATE

 * PURPOSE:	allocate per-process thread audit data structure

 * CALLBY:	THREAD_CREATE

 * NOTE:	This is called just after *t was bzero'd.

 *		We are single threaded in this routine.

 * TODO:

 * QUESTION:

 */

void

audit_thread_create(kthread_id_t t)

{

	t_audit_data_t *tad;	/* per-thread audit data */

	tad = kmem_zalloc(sizeof (struct t_audit_data), KM_SLEEP);

	T2A(t) = tad;		/* set up thread audit data ptr */

	tad->tad_thread = t;	/* back ptr to thread: DEBUG */

}

/*

 * ROUTINE:	AUDIT_THREAD_FREE

 * PURPOSE:	free the per-thread audit data structure

 * CALLBY:	THREAD_FREE

 * NOTE:	most thread data is clear after return

 */

void

audit_thread_free(kthread_t *t)

{

	t_audit_data_t *tad;

	au_defer_info_t	*attr;

	tad = T2A(t);

	/* thread audit data must still be set */

	if (tad == tad0) {

		return;

	}

	if (tad == NULL) {

		return;

	}

	t->t_audit_data = 0;

	/* must not have any audit record residual */

	ASSERT(tad->tad_ad == NULL);

	/* saved path must be empty */

	ASSERT(tad->tad_aupath == NULL);

	if (tad->tad_atpath)

		au_pathrele(tad->tad_atpath);

	attr = tad->tad_defer_head;

	while (attr != NULL) {

		au_defer_info_t	*tmp_attr = attr;

		au_free_rec(attr->audi_ad);

		attr = attr->audi_next;

		kmem_free(tmp_attr, sizeof (au_defer_info_t));

	}

	kmem_free(tad, sizeof (*tad));

}

/*

 * ROUTINE:	AUDIT_SAVEPATH

 * PURPOSE:

 * CALLBY:	LOOKUPPN

 *

 * NOTE:	We have reached the end of a path in fs/lookup.c.

 *		We get two pieces of information here:

 *		the vnode of the last component (vp) and

 *		the status of the last access (flag).

 * TODO:

 * QUESTION:

 */

/*ARGSUSED*/

int

audit_savepath(

	struct pathname *pnp,		/* pathname to lookup */

	struct vnode *vp,		/* vnode of the last component */

	int    flag,			/* status of the last access */

	cred_t *cr)			/* cred of requestor */

{

	t_audit_data_t *tad;	/* current thread */

	p_audit_data_t *pad;	/* current process */

	au_kcontext_t	*kctx = SET_KCTX_PZ;

	if (kctx == NULL) {

		zone_status_t zstate = zone_status_get(curproc->p_zone);

		ASSERT(zstate != ZONE_IS_READY);

		return (0);

	}

	tad = U2A(u);

	ASSERT(tad != (t_audit_data_t *)0);

	pad = P2A(curproc);

	ASSERT(pad != (p_audit_data_t *)0);

	/*

	 * this event being audited or do we need path information

	 * later? This might be for a chdir/chroot or open (add path

	 * to file pointer. If the path has already been found for an

	 * open/creat then we don't need to process the path.

	 *

	 * S2E_SP (PAD_SAVPATH) flag comes from audit_s2e[].au_ctrl. Used with

	 *	chroot, chdir, open, creat system call processing. It determines

	 *	if audit_savepath() will discard the path or we need it later.

	 * PAD_PATHFND means path already included in this audit record. It

	 *	is used in cases where multiple path lookups are done per

	 *	system call. The policy flag, AUDIT_PATH, controls if multiple

	 *	paths are allowed.

	 * S2E_NPT (PAD_NOPATH) flag comes from audit_s2e[].au_ctrl. Used with

	 *	exit processing to inhibit any paths that may be added due to

	 *	closes.

	 */

	if ((tad->tad_flag == 0 && !(tad->tad_ctrl & PAD_SAVPATH)) ||

		((tad->tad_ctrl & PAD_PATHFND) &&

		!(kctx->auk_policy & AUDIT_PATH)) ||

		(tad->tad_ctrl & PAD_NOPATH)) {

			return (0);

	}

	audit_pathbuild(pnp);

	tad->tad_vn = vp;

	/*

	 * are we auditing only if error, or if it is not open or create

	 * otherwise audit_setf will do it

	 */

	if (tad->tad_flag) {

		if (flag && (tad->tad_scid == SYS_open ||

		    tad->tad_scid == SYS_open64 ||

		    tad->tad_scid == SYS_creat ||

		    tad->tad_scid == SYS_creat64 ||

		    tad->tad_scid == SYS_fsat)) {

			tad->tad_ctrl |= PAD_TRUE_CREATE;

		}

		/* add token to audit record for this name */

		au_uwrite(au_to_path(tad->tad_aupath));

		/* add the attributes of the object */

		if (vp) {

			/*

			 * only capture attributes when there is no error

			 * lookup will not return the vnode of the failing

			 * component.

			 *

			 * if there was a lookup error, then don't add

			 * attribute. if lookup in vn_create(),

			 * then don't add attribute,

			 * it will be added at end of vn_create().

			 */

			if (!flag && !(tad->tad_ctrl & PAD_NOATTRB))

				audit_attributes(vp);

		}

	}

	/* free up space if we're not going to save path (open, crate) */

	if ((tad->tad_ctrl & PAD_SAVPATH) == 0) {

		if (tad->tad_aupath != NULL) {

			au_pathrele(tad->tad_aupath);

			tad->tad_aupath = NULL;

			tad->tad_vn = NULL;

		}

	}

	if (tad->tad_ctrl & PAD_MLD)

		tad->tad_ctrl |= PAD_PATHFND;

	return (0);

}

static void

audit_pathbuild(struct pathname *pnp)

{

	char *pp;	/* pointer to path */

	int len;	/* length of incoming segment */

	int newsect;	/* path requires a new section */

	struct audit_path	*pfxapp;	/* prefix for path */

	struct audit_path	*newapp;	/* new audit_path */

	t_audit_data_t *tad;	/* current thread */

	p_audit_data_t *pad;	/* current process */

	tad = U2A(u);

	ASSERT(tad != NULL);

	pad = P2A(curproc);

	ASSERT(pad != NULL);

	len = (pnp->pn_path - pnp->pn_buf) + 1;		/* +1 for terminator */

	ASSERT(len > 0);

	/* adjust for path prefix: tad_aupath, ATPATH, CRD, or CWD */

	mutex_enter(&pad->pad_lock);

	if (tad->tad_aupath != NULL) {

		pfxapp = tad->tad_aupath;

	} else if (tad->tad_scid == SYS_fsat && pnp->pn_buf[0] != '/') {

		ASSERT(tad->tad_atpath != NULL);

		pfxapp = tad->tad_atpath;

	} else if (tad->tad_ctrl & PAD_ABSPATH) {

		pfxapp = pad->pad_root;

	} else {

		pfxapp = pad->pad_cwd;

	}

	au_pathhold(pfxapp);

	mutex_exit(&pad->pad_lock);

	/* get an expanded buffer to hold the anchored path */

	newsect = tad->tad_ctrl & PAD_ATPATH;

	newapp = au_pathdup(pfxapp, newsect, len);

	au_pathrele(pfxapp);

	pp = newapp->audp_sect[newapp->audp_cnt] - len;

	if (!newsect) {

		/* overlay previous NUL terminator */

		*(pp - 1) = '/';

	}

	/* now add string of processed path */

	bcopy(pnp->pn_buf, pp, len);

	pp[len - 1] = '\0';

	/* perform path simplification as necessary */

	audit_fixpath(newapp, len);

	if (tad->tad_aupath)

		au_pathrele(tad->tad_aupath);

	tad->tad_aupath = newapp;

	/* for case where multiple lookups in one syscall (rename) */

	tad->tad_ctrl &= ~(PAD_ABSPATH | PAD_ATPATH);

}

/*ARGSUSED*/

/*

 * ROUTINE:	AUDIT_ADDCOMPONENT

 * PURPOSE:	extend the path by the component accepted

 * CALLBY:	LOOKUPPN

 * NOTE:	This function is called only when there is an error in

 *		parsing a path component

 * TODO:	Add the error component to audit record

 * QUESTION:	what is this for

 */

void

audit_addcomponent(struct pathname *pnp)

{

	au_kcontext_t	*kctx = SET_KCTX_PZ;

	t_audit_data_t *tad;

	if (kctx == NULL) {

		zone_status_t zstate = zone_status_get(curproc->p_zone);

		ASSERT(zstate != ZONE_IS_READY);

		return;

	}

	tad = U2A(u);

	/*

	 * S2E_SP (PAD_SAVPATH) flag comes from audit_s2e[].au_ctrl. Used with

	 *	chroot, chdir, open, creat system call processing. It determines

	 *	if audit_savepath() will discard the path or we need it later.

	 * PAD_PATHFND means path already included in this audit record. It

	 *	is used in cases where multiple path lookups are done per

	 *	system call. The policy flag, AUDIT_PATH, controls if multiple

	 *	paths are allowed.

	 * S2E_NPT (PAD_NOPATH) flag comes from audit_s2e[].au_ctrl. Used with

	 *	exit processing to inhibit any paths that may be added due to

	 *	closes.

	 */

	if ((tad->tad_flag == 0 && !(tad->tad_ctrl & PAD_SAVPATH)) ||

		((tad->tad_ctrl & PAD_PATHFND) &&

		!(kctx->auk_policy & AUDIT_PATH)) ||

		(tad->tad_ctrl & PAD_NOPATH)) {

			return;

	}

	return;

}	/* AUDIT_ADDCOMPONENT */

/*

 * ROUTINE:	AUDIT_ANCHORPATH

 * PURPOSE:

 * CALLBY:	LOOKUPPN

 * NOTE:

 * anchor path at "/". We have seen a symbolic link or entering for the

 * first time we will throw away any saved path if path is anchored.

 *

 * flag = 0, path is relative.

 * flag = 1, path is absolute. Free any saved path and set flag to PAD_ABSPATH.

 *

 * If the (new) path is absolute, then we have to throw away whatever we have

 * already accumulated since it is being superceeded by new path which is

 * anchored at the root.

 *		Note that if the path is relative, this function does nothing

 * TODO:

 * QUESTION:

 */

/*ARGSUSED*/

void

audit_anchorpath(struct pathname *pnp, int flag)

{

	au_kcontext_t	*kctx = SET_KCTX_PZ;

	t_audit_data_t *tad;

	if (kctx == NULL) {

		zone_status_t zstate = zone_status_get(curproc->p_zone);

		ASSERT(zstate != ZONE_IS_READY);

		return;

	}

	tad = U2A(u);

	/*

	 * this event being audited or do we need path information

	 * later? This might be for a chdir/chroot or open (add path

	 * to file pointer. If the path has already been found for an

	 * open/creat then we don't need to process the path.

	 *

	 * S2E_SP (PAD_SAVPATH) flag comes from audit_s2e[].au_ctrl. Used with

	 *	chroot, chdir, open, creat system call processing. It determines

	 *	if audit_savepath() will discard the path or we need it later.

	 * PAD_PATHFND means path already included in this audit record. It

	 *	is used in cases where multiple path lookups are done per

	 *	system call. The policy flag, AUDIT_PATH, controls if multiple

	 *	paths are allowed.

	 * S2E_NPT (PAD_NOPATH) flag comes from audit_s2e[].au_ctrl. Used with

	 *	exit processing to inhibit any paths that may be added due to

	 *	closes.

	 */

	if ((tad->tad_flag == 0 && !(tad->tad_ctrl & PAD_SAVPATH)) ||

		((tad->tad_ctrl & PAD_PATHFND) &&

		!(kctx->auk_policy & AUDIT_PATH)) ||

		(tad->tad_ctrl & PAD_NOPATH)) {

			return;

	}

	if (flag) {