usr/src/cmd/auditd/svc-auditd

   1 #! /sbin/sh
   2 #
   3 # CDDL HEADER START
   4 #
   5 # The contents of this file are subject to the terms of the
   6 # Common Development and Distribution License (the "License").
   7 # You may not use this file except in compliance with the License.
   8 #
   9 # You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
  10 # or http://www.opensolaris.org/os/licensing.
  11 # See the License for the specific language governing permissions
  12 # and limitations under the License.
  13 #
  14 # When distributing Covered Code, include this CDDL HEADER in each
  15 # file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  16 # If applicable, add the following below this CDDL HEADER, with the
  17 # fields enclosed by brackets "[]" replaced with your own identifying
  18 # information: Portions Copyright [yyyy] [name of copyright owner]
  19 #
  20 # CDDL HEADER END
  21 #
  22
  23 #
  24 # Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
  25 #
  26
  27 . /lib/svc/share/smf_include.sh
  28
  29 AUDIT=/usr/sbin/audit
  30 AUDITCONFIG=/usr/sbin/auditconfig
  31 AUDITD=/usr/sbin/auditd
  32 AWK=/usr/bin/awk
  33 EGREP=/usr/bin/egrep
  34 MV=/usr/bin/mv
  35 PKILL=/usr/bin/pkill
  36 SLEEP=/usr/bin/sleep
  37 SVCADM=/usr/sbin/svcadm
  38 SVCCFG=/usr/sbin/svccfg
  39 SVCS=/usr/bin/svcs
  40
  41 AUDIT_STARTUP=/etc/security/audit_startup
  42 AUDITD_FMRI="system/auditd:default"
  43
  44 #
  45 # main - the execution starts there.
  46 main()
  47 {
  48         #
  49         # Do the basic argument inspection and take the appropriate action.
  50         case "$SMF_METHOD" in
  51         start)
  52                 do_common
  53                 do_start
  54                 ;;
  55         refresh)
  56                 do_common
  57                 do_refresh
  58                 ;;
  59         *)
  60                 if [ -z "$SMF_METHOD" ]; then
  61                         echo "$0:  No SMF method defined."
  62                 else
  63                         echo "$0:  Unsupported SMF method: $SMF_METHOD."
  64                 fi
  65                 exit $SMF_EXIT_ERR_NOSMF
  66                 ;;
  67         esac
  68 }
  69
  70 #
  71 # do_common - executes all the code common to all supported service methods.
  72 do_common()
  73 {
  74         #
  75         # If the audit state is "disabled" auditconfig returns non-zero exit
  76         # status unless the c2audit module is loaded; if c2audit is loaded,
  77         # "disabled" becomes "noaudit" early in the boot cycle and "auditing"
  78         # only after auditd starts.
  79         AUDITCOND="`$AUDITCONFIG -getcond 2>/dev/null`"
  80         if [ $? -ne 0 ]; then
  81                 # The decision whether to start
  82                 # auditing is driven by bsmconv(8) / bsmunconv(8)
  83                 echo "$0: Unable to get current kernel auditing condition."
  84                 $SVCADM mark maintenance $AUDITD_FMRI
  85                 exit $SMF_EXIT_MON_OFFLINE
  86         fi
  87         #
  88         # In a non-global zone, auditd is started/refreshed only if the
  89         # "perzone" audit policy has been set.
  90         if smf_is_nonglobalzone; then
  91                 $AUDITCONFIG -t -getpolicy | \
  92                     $EGREP "perzone|all" 1>/dev/null 2>&1
  93                 if [ $? -eq 1 ]; then
  94                         echo "$0: auditd(8) is not configured to run in"
  95                         echo "   a local zone, perzone policy not set" \
  96                             "(see auditconfig(8))."
  97                         $SVCADM disable $AUDITD_FMRI
  98                         $SLEEP 5 &
  99                         exit $SMF_EXIT_OK
 100                 fi
 101         fi
 102         #
 103         # Validate the audit service configuration
 104         val_err="`$AUDIT -v 2>&1`"
 105         if [ $? -ne 0 ]; then
 106                 echo "$0: audit service misconfiguration detected (${val_err})"
 107                 $SVCADM mark maintenance $AUDITD_FMRI
 108                 exit $SMF_EXIT_MON_OFFLINE
 109         fi
 110 }
 111
 112 #
 113 # do_start - service start method helper.
 114 do_start()
 115 {
 116         #
 117         # The transition of the audit_startup(8) has to be performed.
 118         if [ -f "$AUDIT_STARTUP" ]; then
 119
 120                 if [ -x "$AUDIT_STARTUP" ]; then
 121                         $AUDIT_STARTUP
 122                 else
 123                         echo "$0: Unable to execute $AUDIT_STARTUP"
 124                         $SVCADM mark maintenance $AUDITD_FMRI
 125                         exit $SMF_EXIT_MON_OFFLINE
 126                 fi
 127
 128                 echo "$0: Transition of audit_startup(8) started."
 129
 130                 $MV $AUDIT_STARTUP $AUDIT_STARTUP._transitioned_
 131                 if [ $? -ne 0 ]; then
 132                         # Unable to perform the backup of $AUDIT_STARTUP
 133                         echo "$0: The $AUDIT_STARTUP was not moved to"
 134                         echo "   $AUDIT_STARTUP._transitioned_"
 135                 fi
 136
 137                 #
 138                 # Refreshing service to make the newly created properties
 139                 # available for any other consequent svcprop(1).
 140                 $SVCCFG -s $AUDITD_FMRI refresh
 141                 if [ $? -ne 0 ]; then
 142                         echo "$0: Refresh of $AUDITD_FMRI configuration failed."
 143                         $SVCADM mark maintenance $AUDITD_FMRI
 144                         exit $SMF_EXIT_ERR_CONFIG
 145                 fi
 146
 147                 echo "$0: Transition of audit_startup(8) finished."
 148         fi
 149
 150         #
 151         # Daemon forks, parent exits when child says it's ready.
 152         exec $AUDITD
 153 }
 154
 155 #
 156 # do_refresh - service refresh method helper.
 157 do_refresh()
 158 {
 159         #
 160         # The refresh capability is available only for those systems
 161         # with already transformed audit_startup(8) into $AUDITD_FMRI
 162         # service properties. See do_start() for more information.
 163         if [ ! -f "$AUDIT_STARTUP" ]; then
 164                 #
 165                 # Find the contract_id.
 166                 contract_id=`$SVCS -l $AUDITD_FMRI | \
 167                     $AWK '/^contract_id/ {print $2}'`
 168                 if [ -z "${contract_id}" ]; then
 169                         echo "$0: Service $AUDITD_FMRI has no associated" \
 170                             "contract. Service cannot be refreshed."
 171                         exit $SMF_EXIT_ERR_FATAL
 172                 fi
 173                 #
 174                 # signal to auditd(8):
 175                 $PKILL -HUP -c ${contract_id}
 176                 if [ $? -ne 0 ]; then
 177                         echo "$0: SIGHUP was not successfully delivered to" \
 178                             "the related contract (${contract_id}/err:$?)."
 179                         $SVCADM mark maintenance $AUDITD_FMRI
 180                         exit $SMF_EXIT_ERR_FATAL
 181                 fi
 182                 $SLEEP 5 &
 183         else
 184                 echo "$0: Service refresh method not supported on systems" \
 185                    "without converted audit_startup(8) into auditd service" \
 186                    "SMF configuration. Clear the service (svcadm(8))."
 187                 $SVCADM mark maintenance $AUDITD_FMRI
 188                 exit $SMF_EXIT_ERR_CONFIG
 189         fi
 190 }
 191
 192 #
 193 # Call main() to start the own script execution.
 194 main