usr/src/cmd/praudit/toktable.c

   1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21 /*
  22  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
  23  * Use is subject to license terms.
  24  */
  25
  26 /*
  27  * Solaris Audit Token Table.
  28  */
  29
  30 #include <locale.h>
  31
  32 #include <stdio.h>
  33 #include <stdlib.h>
  34 #include <string.h>
  35 #include <bsm/audit.h>
  36 #include <bsm/audit_record.h>
  37 #include <bsm/libbsm.h>
  38
  39 #include "praudit.h"
  40 #include "toktable.h"
  41
  42 token_desc_t tokentable[MAXTAG + 1];
  43
  44 #define table_init(i, n, f, t) \
  45         tokentable[(int)(i)].t_name = (n); \
  46         tokentable[(int)(i)].t_tagname = (n); \
  47         tokentable[(int)(i)].func = (f); \
  48         tokentable[(int)(i)].t_type = (t);
  49
  50 /* table_initx is for entries which need name different from tagname */
  51 #define table_initx(i, n, tn, f, t) \
  52         tokentable[(int)(i)].t_name = (n); \
  53         tokentable[(int)(i)].t_tagname = (tn); \
  54         tokentable[(int)(i)].func = (f); \
  55         tokentable[(int)(i)].t_type = (t);
  56
  57 /*
  58  * Initialize the table of tokens & other tags.
  59  */
  60 void
  61 init_tokens(void)
  62 {
  63         /*
  64          * TRANSLATION_NOTE
  65          * These names refer to different type of audit tokens.
  66          * To gain a better understanding of each token, read
  67          * System Administration Guide: Security Services >> Solaris Auditing
  68          * at http://docs.sun.com.
  69          */
  70
  71         (void) gettext("file"); /* to force out the translation note */
  72
  73         /*
  74          * Control token types
  75          */
  76
  77         table_init(AUT_INVALID, (char *)0, NOFUNC, T_UNKNOWN);
  78         table_init(AUT_OTHER_FILE32, "file", file_token, T_EXTENDED);
  79         table_init(AUT_OHEADER, "old_header", NOFUNC, T_EXTENDED);
  80         table_init(AUT_TRAILER, "trailer", trailer_token, T_UNKNOWN);
  81         table_initx(AUT_HEADER32, "header", "record",
  82             header_token, T_EXTENDED);
  83         table_initx(AUT_HEADER32_EX, "header", "record",
  84             header32_ex_token, T_EXTENDED);
  85
  86         /*
  87          * Data token types
  88          */
  89
  90         table_init(AUT_DATA, "arbitrary", arbitrary_data_token, T_EXTENDED);
  91         table_init(AUT_FMRI, "fmri", fmri_token, T_ELEMENT);
  92         table_init(AUT_IPC, "IPC", s5_IPC_token, T_ENCLOSED);
  93         table_init(AUT_PATH, "path", path_token, T_ELEMENT);
  94         table_init(AUT_XATPATH, "path_attr", path_attr_token, T_ELEMENT);
  95         table_init(AUT_SUBJECT32, "subject", subject32_token, T_ENCLOSED);
  96         table_init(AUT_PROCESS32, "process", process32_token, T_ENCLOSED);
  97         table_init(AUT_RETURN32, "return", return_value32_token, T_ENCLOSED);
  98         table_init(AUT_TEXT, "text", text_token, T_ELEMENT);
  99         table_init(AUT_OPAQUE, "opaque", opaque_token, T_ELEMENT);
 100         table_initx(AUT_IN_ADDR, "ip address", "ip_address",
 101             ip_addr_token, T_ELEMENT);
 102         table_init(AUT_IP, "ip", ip_token, T_ENCLOSED);
 103         table_initx(AUT_IPORT, "ip port", "ip_port",
 104             iport_token, T_ELEMENT);
 105         table_init(AUT_ARG32, "argument", argument32_token, T_ENCLOSED);
 106         table_initx(AUT_SOCKET, "socket", "old_socket",
 107             socket_token, T_ENCLOSED);
 108         table_init(AUT_SEQ, "sequence", sequence_token, T_ENCLOSED);
 109
 110         /*
 111          * Modifier token types
 112          */
 113
 114         table_init(AUT_ACL, "acl", acl_token, T_ENCLOSED);
 115         table_init(AUT_ACE, "acl", ace_token, T_ENCLOSED);
 116         table_init(AUT_ATTR, "attribute", attribute_token, T_ENCLOSED);
 117         table_init(AUT_IPC_PERM, "IPC_perm", s5_IPC_perm_token, T_ENCLOSED);
 118         table_init(AUT_GROUPS, "group", group_token, T_ELEMENT);
 119         table_init(AUT_PRIV, "privilege", privilege_token, T_EXTENDED);
 120         table_init(AUT_SECFLAGS, "secflags", secflags_token, T_EXTENDED);
 121         table_initx(AUT_UPRIV, "use of privilege", "use_of_privilege",
 122             useofpriv_token, T_EXTENDED);
 123         table_init(AUT_LIAISON, "liaison", liaison_token, T_ELEMENT);
 124         table_init(AUT_NEWGROUPS, "group", newgroup_token, T_ELEMENT);
 125         table_init(AUT_EXEC_ARGS, "exec_args", exec_args_token, T_ELEMENT);
 126         table_init(AUT_EXEC_ENV, "exec_env", exec_env_token, T_ELEMENT);
 127         table_init(AUT_ATTR32, "attribute", attribute32_token, T_ENCLOSED);
 128         table_initx(AUT_UAUTH, "use of authorization",
 129             "use_of_authorization", useofauth_token, T_ELEMENT);
 130         table_init(AUT_USER, "user", user_token, T_ENCLOSED);
 131         table_init(AUT_ZONENAME, "zone", zonename_token, T_ENCLOSED);
 132
 133         /*
 134          * X windows token types
 135          */
 136         table_initx(AUT_XATOM, "X atom", "X_atom", xatom_token, T_ELEMENT);
 137         table_initx(AUT_XOBJ, "X object", "X_object", NOFUNC, T_UNKNOWN);
 138         table_initx(AUT_XPROTO, "X protocol", "X_protocol", NOFUNC, T_UNKNOWN);
 139         table_initx(AUT_XSELECT, "X selection", "X_selection",
 140             xselect_token, T_ELEMENT);
 141         table_initx(AUT_XCOLORMAP, "X color map", "X_color_map",
 142             xcolormap_token, T_ENCLOSED);
 143         table_initx(AUT_XCURSOR, "X cursor", "X_cursor",
 144             xcursor_token, T_ENCLOSED);
 145         table_initx(AUT_XFONT, "X font", "X_font", xfont_token, T_ENCLOSED);
 146         table_initx(AUT_XGC, "X graphic context", "X_graphic_context",
 147             xgc_token, T_ENCLOSED);
 148         table_initx(AUT_XPIXMAP, "X pixmap", "X_pixmap",
 149             xpixmap_token, T_ENCLOSED);
 150         table_initx(AUT_XPROPERTY, "X property", "X_property",
 151             xproperty_token, T_EXTENDED);
 152         table_initx(AUT_XWINDOW, "X window", "X_window",
 153             xwindow_token, T_ENCLOSED);
 154         table_initx(AUT_XCLIENT, "X client", "X_client",
 155             xclient_token, T_ELEMENT);
 156
 157         /*
 158          * Command token types
 159          */
 160
 161         table_init(AUT_CMD, "cmd", cmd_token, T_ELEMENT);
 162         table_init(AUT_EXIT, "exit", exit_token, T_ENCLOSED);
 163
 164         /*
 165          * Miscellaneous token types
 166          */
 167
 168         table_init(AUT_HOST, "host", host_token, T_ELEMENT);
 169
 170         /*
 171          * Solaris64 token types
 172          */
 173
 174         table_init(AUT_ARG64, "argument", argument64_token, T_ENCLOSED);
 175         table_init(AUT_RETURN64, "return", return_value64_token, T_ENCLOSED);
 176         table_init(AUT_ATTR64, "attribute", attribute64_token, T_ENCLOSED);
 177         table_initx(AUT_HEADER64, "header", "record",
 178             header64_token, T_EXTENDED);
 179         table_init(AUT_SUBJECT64, "subject", subject64_token, T_ENCLOSED);
 180         table_init(AUT_PROCESS64, "process", process64_token, T_ENCLOSED);
 181         table_init(AUT_OTHER_FILE64, "file", file64_token, T_EXTENDED);
 182
 183         /*
 184          * Extended network address token types
 185          */
 186
 187         table_initx(AUT_HEADER64_EX, "header", "record",
 188             header64_ex_token, T_EXTENDED);
 189         table_init(AUT_SUBJECT32_EX, "subject", subject32_ex_token, T_ENCLOSED);
 190         table_init(AUT_PROCESS32_EX, "process", process32_ex_token, T_ENCLOSED);
 191         table_init(AUT_SUBJECT64_EX, "subject", subject64_ex_token, T_ENCLOSED);
 192         table_init(AUT_PROCESS64_EX, "process", process64_ex_token, T_ENCLOSED);
 193         table_initx(AUT_IN_ADDR_EX, "ip address", "ip_address",
 194             ip_addr_ex_token, T_ELEMENT);
 195         table_init(AUT_SOCKET_EX, "socket", socket_ex_token, T_ENCLOSED);
 196         table_init(AUT_TID, "tid", tid_token, T_EXTENDED);
 197
 198 #ifdef _PRAUDIT
 199         /*
 200          * Done with tokens above here. Now do remaining tags.
 201          */
 202         table_init(TAG_AUID, "audit-uid", pa_pw_uid, T_ATTRIBUTE);
 203         table_init(TAG_UID, "uid", pa_pw_uid, T_ATTRIBUTE);
 204         table_init(TAG_GID, "gid", pa_gr_uid, T_ATTRIBUTE);
 205         table_init(TAG_RUID, "ruid", pa_pw_uid, T_ATTRIBUTE);
 206         table_init(TAG_RGID, "rgid", pa_gr_uid, T_ATTRIBUTE);
 207
 208         table_init(TAG_PID, "pid", pa_adr_u_int32, T_ATTRIBUTE);
 209         table_init(TAG_SID, "sid", pa_adr_u_int32, T_ATTRIBUTE);
 210
 211         table_init(TAG_TID32, "tid", pa_tid32, T_ATTRIBUTE);
 212         table_init(TAG_TID64, "tid", pa_tid64, T_ATTRIBUTE);
 213         table_init(TAG_TID32_EX, "tid", pa_tid32_ex, T_ATTRIBUTE);
 214         table_init(TAG_TID64_EX, "tid", pa_tid64_ex, T_ATTRIBUTE);
 215         table_init(TAG_TID_TYPE, "type", NOFUNC, T_ATTRIBUTE);
 216         table_init(TAG_IP, "ipadr", NOFUNC, T_ENCLOSED);
 217         table_init(TAG_IP_LOCAL, "local-port", pa_adr_u_short, T_ATTRIBUTE);
 218         table_init(TAG_IP_REMOTE, "remote-port", pa_adr_u_short, T_ATTRIBUTE);
 219         table_init(TAG_IP_ADR, "host", pa_ip_addr, T_ATTRIBUTE);
 220
 221         table_initx(TAG_EVMOD, "event-modifier", "modifier",
 222             pa_event_modifier, T_ATTRIBUTE);
 223         table_initx(TAG_EVTYPE, "event-type", "event",
 224             pa_event_type, T_ATTRIBUTE);
 225         table_initx(TAG_TOKVERS, "token-version", "version",
 226             pa_adr_byte, T_ATTRIBUTE);
 227
 228         table_init(TAG_ISO, "iso8601", NOFUNC, T_ATTRIBUTE);
 229
 230         table_init(TAG_ERRVAL, "errval", NOFUNC, T_ATTRIBUTE);
 231         table_init(TAG_RETVAL, "retval", pa_adr_int32, T_ATTRIBUTE);
 232
 233         table_init(TAG_SETTYPE, "set-type", pa_adr_string, T_ATTRIBUTE);
 234         /* Sub-element of groups & newgroups token: */
 235         table_init(TAG_GROUPID, "gid", pa_gr_uid, T_ELEMENT);
 236
 237         table_init(TAG_XID, "xid", pa_xid, T_ATTRIBUTE);
 238         table_init(TAG_XCUID, "xcreator-uid", pa_pw_uid, T_ATTRIBUTE);
 239
 240         table_init(TAG_XSELTEXT, "x_sel_text", pa_adr_string, T_ELEMENT);
 241         table_init(TAG_XSELTYPE, "x_sel_type", pa_adr_string, T_ELEMENT);
 242         table_init(TAG_XSELDATA, "x_sel_data", pa_adr_string, T_ELEMENT);
 243
 244         table_init(TAG_ARGNUM, "arg-num", pa_adr_byte, T_ATTRIBUTE);
 245         table_init(TAG_ARGVAL32, "value", pa_adr_int32hex, T_ATTRIBUTE);
 246         table_init(TAG_ARGVAL64, "value", pa_adr_int64hex, T_ATTRIBUTE);
 247         table_init(TAG_ARGDESC, "desc", pa_adr_string, T_ATTRIBUTE);
 248
 249         table_init(TAG_MODE, "mode", pa_mode, T_ATTRIBUTE);
 250         table_init(TAG_FSID, "fsid", pa_adr_int32, T_ATTRIBUTE);
 251         table_init(TAG_NODEID32, "nodeid", pa_adr_int32, T_ATTRIBUTE);
 252         table_init(TAG_NODEID64, "nodeid", pa_adr_int64, T_ATTRIBUTE);
 253         table_init(TAG_DEVICE32, "device", pa_adr_u_int32, T_ATTRIBUTE);
 254         table_init(TAG_DEVICE64, "device", pa_adr_u_int64, T_ATTRIBUTE);
 255
 256         table_init(TAG_SEQNUM, "seq-num", pa_adr_u_int32, T_ATTRIBUTE);
 257         table_init(TAG_ZONENAME, "name", pa_adr_string, T_ATTRIBUTE);
 258         table_init(TAG_ARGV, "argv", pa_cmd, T_ELEMENT);
 259         table_init(TAG_ARGE, "arge", pa_cmd, T_ELEMENT);
 260         table_init(TAG_ARG, "arg", pa_string, T_ELEMENT);
 261         table_init(TAG_ENV, "env", pa_string, T_ELEMENT);
 262         table_init(TAG_XAT, "xattr", pa_string, T_ELEMENT);
 263
 264         table_init(TAG_RESULT, "result", NOFUNC, T_ATTRIBUTE);
 265         table_init(TAG_CUID, "creator-uid", pa_pw_uid, T_ATTRIBUTE);
 266         table_init(TAG_CGID, "creator-gid", pa_gr_uid, T_ATTRIBUTE);
 267         table_init(TAG_SEQ, "seq", pa_adr_u_int32, T_ATTRIBUTE);
 268         table_init(TAG_KEY, "key", pa_adr_int32hex, T_ATTRIBUTE);
 269
 270         table_init(TAG_IPVERS, "version", pa_adr_charhex, T_ATTRIBUTE);
 271         table_init(TAG_IPSERV, "service_type", pa_adr_charhex, T_ATTRIBUTE);
 272         table_init(TAG_IPLEN, "len", pa_adr_short, T_ATTRIBUTE);
 273         table_init(TAG_IPID, "id", pa_adr_u_short, T_ATTRIBUTE);
 274         table_init(TAG_IPOFFS, "offset", pa_adr_u_short, T_ATTRIBUTE);
 275         table_init(TAG_IPTTL, "time_to_live", pa_adr_charhex, T_ATTRIBUTE);
 276         table_init(TAG_IPPROTO, "protocol", pa_adr_charhex, T_ATTRIBUTE);
 277         table_init(TAG_IPCKSUM, "cksum", pa_adr_u_short, T_ATTRIBUTE);
 278         table_init(TAG_IPSRC, "src_addr", pa_adr_int32hex, T_ATTRIBUTE);
 279         table_init(TAG_IPDEST, "dest_addr", pa_adr_int32hex, T_ATTRIBUTE);
 280
 281         table_init(TAG_ACLTYPE, "type", NOFUNC, T_ATTRIBUTE);
 282         table_init(TAG_ACLVAL, "value", NOFUNC, T_ATTRIBUTE);
 283         table_init(TAG_ACEMASK, "access_mask", NOFUNC, T_ATTRIBUTE);
 284         table_init(TAG_ACEFLAGS, "flags", NOFUNC, T_ATTRIBUTE);
 285         table_init(TAG_ACETYPE, "type", NOFUNC, T_ATTRIBUTE);
 286         table_init(TAG_ACEID, "id", NOFUNC, T_ATTRIBUTE);
 287         table_init(TAG_SOCKTYPE, "type", pa_adr_shorthex, T_ATTRIBUTE);
 288         table_init(TAG_SOCKPORT, "port", pa_adr_shorthex, T_ATTRIBUTE);
 289         table_init(TAG_SOCKADDR, "addr", NOFUNC, T_ATTRIBUTE);
 290
 291         table_init(TAG_SOCKEXDOM, "sock_domain", pa_adr_shorthex, T_ATTRIBUTE);
 292         table_init(TAG_SOCKEXTYPE, "sock_type", pa_adr_shorthex, T_ATTRIBUTE);
 293         table_init(TAG_SOCKEXLPORT, "lport", NOFUNC, T_ATTRIBUTE);
 294         table_init(TAG_SOCKEXLADDR, "laddr", NOFUNC, T_ATTRIBUTE);
 295         table_init(TAG_SOCKEXFPORT, "fport", NOFUNC, T_ATTRIBUTE);
 296         table_init(TAG_SOCKEXFADDR, "faddr", NOFUNC, T_ATTRIBUTE);
 297
 298         table_init(TAG_IPCTYPE, "ipc-type", NOFUNC, T_ATTRIBUTE);
 299         table_init(TAG_IPCID, "ipc-id", pa_adr_int32, T_ATTRIBUTE);
 300
 301         table_init(TAG_ARBPRINT, "print", NOFUNC, T_ATTRIBUTE);
 302         table_init(TAG_ARBTYPE, "type", NOFUNC, T_ATTRIBUTE);
 303         table_init(TAG_ARBCOUNT, "count", NOFUNC, T_ATTRIBUTE);
 304
 305         table_init(TAG_HOSTID, "host", NOFUNC, T_ATTRIBUTE);
 306         table_init(TAG_USERNAME, "username", pa_adr_string, T_ATTRIBUTE);
 307 #endif  /* _PRAUDIT */
 308 }