Attachment 16212 Details for Bug 15740 – Enhancement for Solaris auditing

[patch] Enhancement for Solaris auditing

dbus-02-getauditsessiondata.diff (text/plain), 17.71 KB, created by simon zheng on 2008-04-28 03:37:52 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: simon zheng

Created: 2008-04-28 03:37:52 UTC

Size: 17.71 KB

patch

obsolete

>diff -Nur dbus-1.2.1/bus/driver.c dbus-1.2.1-new/bus/driver.c
>--- dbus-1.2.1/bus/driver.c	2008-04-04 23:24:08.000000000 +0800
>+++ dbus-1.2.1-new/bus/driver.c	2008-04-28 16:50:51.514783000 +0800
>@@ -34,6 +34,9 @@
> #include <dbus/dbus-internals.h>
> #include <dbus/dbus-marshal-recursive.h>
> #include <string.h>
>+#ifdef HAVE_ADT
>+#include <bsm/adt.h>
>+#endif
> 
> static dbus_bool_t bus_driver_send_welcome_message (DBusConnection *connection,
>                                                     DBusMessage    *hello_message,
>@@ -1272,6 +1275,84 @@
>   return FALSE;
> }
> 
>+#ifdef HAVE_ADT
>+static dbus_bool_t
>+bus_driver_handle_get_audit_session_data (DBusConnection *connection,
>+					  BusTransaction *transaction,
>+					  DBusMessage    *message,
>+					  DBusError      *error)
>+{
>+  const char *service;
>+  DBusString str;
>+  BusRegistry *registry;
>+  BusService *serv;
>+  DBusConnection *conn;
>+  DBusMessage *reply;
>+  adt_export_data_t *data = NULL;
>+  size_t data_size;
>+  unsigned char *data_bytes = (unsigned char *)&data;
>+
>+  _DBUS_ASSERT_ERROR_IS_CLEAR (error);
>+
>+  registry = bus_connection_get_registry (connection);
>+
>+  service = NULL;
>+  reply = NULL;
>+
>+  if (! dbus_message_get_args (message, error,
>+			       DBUS_TYPE_STRING, &service,
>+			       DBUS_TYPE_INVALID))
>+      goto failed;
>+
>+  _dbus_verbose ("asked for audit session data for connection %s\n", service);
>+
>+  _dbus_string_init_const (&str, service);
>+  serv = bus_registry_lookup (registry, &str);
>+  if (serv == NULL)
>+    {
>+      dbus_set_error (error, 
>+		      DBUS_ERROR_NAME_HAS_NO_OWNER,
>+		      "Could not get audit session data for name '%s': no such name", service);
>+      goto failed;
>+    }
>+
>+  conn = bus_service_get_primary_owners_connection (serv);
>+
>+  reply = dbus_message_new_method_return (message);
>+  if (reply == NULL)
>+    goto oom;
>+
>+  if (!dbus_connection_get_audit_session_data (conn, &data, &data_size))
>+    {
>+      dbus_set_error (error,
>+                      DBUS_ERROR_SOLARIS_AUDIT_DATA_UNKNOWN,
>+                      "Could not determine audit session data for '%s'", service);
>+      goto failed;
>+    }
>+
>+  if (! dbus_message_append_args (reply,
>+                                  DBUS_TYPE_ARRAY, DBUS_TYPE_BYTE, &data, data_size,
>+                                  DBUS_TYPE_INVALID))
>+    goto oom;
>+
>+  if (! bus_transaction_send_from_driver (transaction, connection, reply))
>+    goto oom;
>+
>+  dbus_message_unref (reply);
>+
>+  return TRUE;
>+
>+ oom:
>+  BUS_SET_OOM (error);
>+
>+ failed:
>+  _DBUS_ASSERT_ERROR_IS_SET (error);
>+  if (reply)
>+    dbus_message_unref (reply);
>+  return FALSE;
>+}
>+#endif /* HAVE_ADT */
>+
> static dbus_bool_t
> bus_driver_handle_get_connection_selinux_security_context (DBusConnection *connection,
> 							   BusTransaction *transaction,
>@@ -1503,6 +1584,12 @@
>     DBUS_TYPE_STRING_AS_STRING,
>     DBUS_TYPE_UINT32_AS_STRING,
>     bus_driver_handle_get_connection_unix_process_id },
>+#ifdef HAVE_ADT
>+  { "GetAuditSessionData",
>+    DBUS_TYPE_STRING_AS_STRING,
>+    DBUS_TYPE_ARRAY_AS_STRING DBUS_TYPE_BYTE_AS_STRING,
>+    bus_driver_handle_get_audit_session_data },
>+#endif
>   { "GetConnectionSELinuxSecurityContext",
>     DBUS_TYPE_STRING_AS_STRING,
>     DBUS_TYPE_ARRAY_AS_STRING DBUS_TYPE_BYTE_AS_STRING,
>diff -Nur dbus-1.2.1/configure.in dbus-1.2.1-new/configure.in
>--- dbus-1.2.1/configure.in	2008-04-05 02:23:23.000000000 +0800
>+++ dbus-1.2.1-new/configure.in	2008-04-28 16:33:31.365258000 +0800
>@@ -1028,6 +1028,24 @@
>     AC_DEFINE(HAVE_LIBAUDIT,1,[audit daemon SELinux support])
> fi
> 
>+# Check for Solaris auditing API
>+AC_MSG_CHECKING(for Solaris auditing API)
>+AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
>+#include <bsm/adt.h>
>+adt_user_context = ADT_USER;
>+]], [[]])], [ check_solaris_audit=yes ], [ check_solaris_audit=no ])
>+
>+if test ${check_solaris_audit} = yes
>+then
>+   AC_DEFINE([HAVE_ADT], [], [Solaris auditing API])
>+   SOLARISAUDIT_LIBS="-lbsm"
>+   LIBS="-lbsm $LIBS"
>+   AC_MSG_RESULT(yes)
>+else
>+   AC_MSG_RESULT(no)
>+fi
>+
>+
> #### Set up final flags
> DBUS_CLIENT_CFLAGS=
> DBUS_CLIENT_LIBS="$THREAD_LIBS"
>@@ -1035,7 +1053,7 @@
> AC_SUBST(DBUS_CLIENT_LIBS)
> 
> DBUS_BUS_CFLAGS="$XML_CFLAGS"
>-DBUS_BUS_LIBS="$XML_LIBS $SELINUX_LIBS $INTLLIBS $THREAD_LIBS"
>+DBUS_BUS_LIBS="$XML_LIBS $SELINUX_LIBS $INTLLIBS $THREAD_LIBS $SOLARISAUDIT_LIBS"
> AC_SUBST(DBUS_BUS_CFLAGS)
> AC_SUBST(DBUS_BUS_LIBS)
> 
>diff -Nur dbus-1.2.1/dbus/dbus-auth.c dbus-1.2.1-new/dbus/dbus-auth.c
>--- dbus-1.2.1/dbus/dbus-auth.c	2008-04-04 23:24:08.000000000 +0800
>+++ dbus-1.2.1-new/dbus/dbus-auth.c	2008-04-28 16:33:31.367148000 +0800
>@@ -1094,6 +1094,15 @@
>                                              DBUS_CREDENTIAL_UNIX_PROCESS_ID,
>                                              auth->credentials))
>         return FALSE;
>+
>+#ifdef HAVE_ADT
>+      /* also copy audit data from the socket credentials
>+       */
>+      if (!_dbus_credentials_add_credential (auth->authorized_identity,
>+                                             DBUS_CREDENTIAL_AUDIT_DATA_ID,
>+                                             auth->credentials))
>+        return FALSE;
>+#endif
>       
>       if (!send_ok (auth))
>         return FALSE;
>diff -Nur dbus-1.2.1/dbus/dbus-connection.c dbus-1.2.1-new/dbus/dbus-connection.c
>--- dbus-1.2.1/dbus/dbus-connection.c	2008-04-04 23:24:08.000000000 +0800
>+++ dbus-1.2.1-new/dbus/dbus-connection.c	2008-04-28 16:33:31.370742000 +0800
>@@ -4963,6 +4963,42 @@
>   return result;
> }
> 
>+#ifdef HAVE_ADT
>+/**
>+ * Gets the Solaris audit data of the connection.
>+ * Returns #TRUE if the structure pointer is returned.
>+ * Always returns #FALSE prior to authenticating the
>+ * connection.
>+ *
>+ * @param connection the connection
>+ * @param ucred return location for Solaris audit data 
>+ * @returns #TRUE if audit data is filled in with a valid ucred pointer
>+ */
>+dbus_bool_t
>+dbus_connection_get_audit_session_data (DBusConnection *connection,
>+				        adt_export_data_t **data,
>+					size_t *data_size)
>+{
>+  dbus_bool_t result;
>+
>+  _dbus_return_val_if_fail (connection != NULL, FALSE);
>+  _dbus_return_val_if_fail (data != NULL, FALSE);
>+  _dbus_return_val_if_fail (data_size != NULL, FALSE);
>+  
>+  CONNECTION_LOCK (connection);
>+
>+  if (!_dbus_transport_get_is_authenticated (connection->transport))
>+    result = FALSE;
>+  else
>+    result = _dbus_transport_get_audit_session_data (connection->transport,
>+						     data,
>+			  			     data_size);
>+  CONNECTION_UNLOCK (connection);
>+
>+  return result;
>+}
>+#endif /* HAVE_ADT */
>+
> /**
>  * Sets a predicate function used to determine whether a given user ID
>  * is allowed to connect. When an incoming connection has
>diff -Nur dbus-1.2.1/dbus/dbus-connection.h dbus-1.2.1-new/dbus/dbus-connection.h
>--- dbus-1.2.1/dbus/dbus-connection.h	2008-04-04 23:24:08.000000000 +0800
>+++ dbus-1.2.1-new/dbus/dbus-connection.h	2008-04-28 16:33:31.371696000 +0800
>@@ -31,6 +31,10 @@
> #include <dbus/dbus-memory.h>
> #include <dbus/dbus-message.h>
> #include <dbus/dbus-shared.h>
>+#include <dbus/dbus-sysdeps.h>
>+#ifdef HAVE_ADT
>+#include <bsm/adt.h>
>+#endif
> 
> DBUS_BEGIN_DECLS
> 
>@@ -231,6 +235,11 @@
>                                                                  unsigned long              *uid);
> dbus_bool_t        dbus_connection_get_unix_process_id          (DBusConnection             *connection,
>                                                                  unsigned long              *pid);
>+#ifdef HAVE_ADT
>+dbus_bool_t        dbus_connection_get_audit_session_data       (DBusConnection             *connection,
>+                                                                 adt_export_data_t          **data,
>+                                                                 size_t                     *data_size);
>+#endif
> void               dbus_connection_set_unix_user_function       (DBusConnection             *connection,
>                                                                  DBusAllowUnixUserFunction   function,
>                                                                  void                       *data,
>diff -Nur dbus-1.2.1/dbus/dbus-credentials.c dbus-1.2.1-new/dbus/dbus-credentials.c
>--- dbus-1.2.1/dbus/dbus-credentials.c	2008-04-04 23:24:08.000000000 +0800
>+++ dbus-1.2.1-new/dbus/dbus-credentials.c	2008-04-28 16:33:31.373552000 +0800
>@@ -50,6 +50,10 @@
>   dbus_uid_t unix_uid;
>   dbus_pid_t unix_pid;
>   char *windows_sid;
>+#ifdef HAVE_ADT
>+  adt_export_data_t *audit_data;
>+  size_t audit_data_size;
>+#endif
> };
> 
> /** @} */
>@@ -77,6 +81,10 @@
>   creds->unix_uid = DBUS_UID_UNSET;
>   creds->unix_pid = DBUS_PID_UNSET;
>   creds->windows_sid = NULL;
>+#ifdef HAVE_ADT
>+  creds->audit_data = NULL;
>+  creds->audit_data_size = 0;
>+#endif
> 
>   return creds;
> }
>@@ -129,6 +137,9 @@
>   if (credentials->refcount == 0)
>     {
>       dbus_free (credentials->windows_sid);
>+#ifdef HAVE_ADT
>+      dbus_free (credentials->audit_data);
>+#endif
>       dbus_free (credentials);
>     }
> }
>@@ -187,6 +198,33 @@
>   return TRUE;
> }
> 
>+#ifdef HAVE_ADT
>+/**
>+ * Add Solaris audit data to the credentials.
>+ *
>+ * @param credentials the object
>+ * @param audit_data the audit data
>+ * @param audit_data_size the length of audit data
>+ * @returns #FALSE if no memory
>+ */
>+dbus_bool_t
>+_dbus_credentials_add_audit_data (DBusCredentials    *credentials,
>+                                  adt_export_data_t  *audit_data,
>+                                  size_t              audit_data_size)
>+{
>+  void *copy;
>+  copy = _dbus_memdup (audit_data, audit_data_size);
>+  if (copy == NULL)
>+    return FALSE;
>+
>+  dbus_free (credentials->audit_data);
>+  credentials->audit_data = copy;
>+  credentials->audit_data_size = audit_data_size;
>+
>+  return TRUE;
>+}
>+#endif  /* HAVE_ADT */
>+
> /**
>  * Checks whether the given credential is present.
>  *
>@@ -251,6 +289,34 @@
>   return credentials->windows_sid;
> }
> 
>+#ifdef HAVE_ADT
>+/**
>+ * Gets the Solairs audit data in the credentials, or #NULL if
>+ * the credentials object doesn't contain Solaris audit data.
>+ *
>+ * @param credentials the object
>+ * @returns Solairs audit data 
>+ */
>+adt_export_data_t*
>+_dbus_credentials_get_audit_data (DBusCredentials    *credentials)
>+{
>+  return credentials->audit_data;
>+}
>+
>+/**
>+ * Gets the Solaris audit data size in the credentials, or 0 if
>+ * the credentials object doesn't contain Solaris audit data.
>+ *
>+ * @param credentials the object
>+ * @returns Solairs audit data size
>+ */
>+size_t 
>+_dbus_credentials_get_audit_data_size (DBusCredentials    *credentials)
>+{
>+  return credentials->audit_data_size;
>+}
>+#endif  /* HAVE_ADT */
>+
> /**
>  * Checks whether the first credentials object contains
>  * all the credentials found in the second credentials object.
>@@ -321,6 +387,11 @@
>     _dbus_credentials_add_credential (credentials,
>                                       DBUS_CREDENTIAL_UNIX_USER_ID,
>                                       other_credentials) &&
>+#ifdef HAVE_ADT
>+    _dbus_credentials_add_credential (credentials,
>+                                      DBUS_CREDENTIAL_AUDIT_DATA_ID,
>+                                      other_credentials) &&
>+#endif
>     _dbus_credentials_add_credential (credentials,
>                                       DBUS_CREDENTIAL_WINDOWS_SID,
>                                       other_credentials);
>@@ -360,7 +431,15 @@
>     {
>       if (!_dbus_credentials_add_windows_sid (credentials, other_credentials->windows_sid))
>         return FALSE;
>+    } 
>+#ifdef HAVE_ADT
>+  else if (which == DBUS_CREDENTIAL_AUDIT_DATA_ID &&
>+           other_credentials->audit_data != NULL) 
>+    {
>+      if (!_dbus_credentials_add_audit_data (credentials, other_credentials->audit_data, other_credentials->audit_data_size))
>+        return FALSE;
>     }
>+#endif
> 
>   return TRUE;
> }
>@@ -377,6 +456,11 @@
>   credentials->unix_uid = DBUS_UID_UNSET;
>   dbus_free (credentials->windows_sid);
>   credentials->windows_sid = NULL;
>+#ifdef HAVE_ADT
>+  dbus_free (credentials->audit_data);
>+  credentials->audit_data = NULL;
>+  credentials->audit_data_size = 0;
>+#endif
> }
> 
> /**
>diff -Nur dbus-1.2.1/dbus/dbus-credentials.h dbus-1.2.1-new/dbus/dbus-credentials.h
>--- dbus-1.2.1/dbus/dbus-credentials.h	2008-04-04 23:24:08.000000000 +0800
>+++ dbus-1.2.1-new/dbus/dbus-credentials.h	2008-04-28 16:33:31.374790000 +0800
>@@ -27,12 +27,18 @@
> #include <dbus/dbus-errors.h>
> #include <dbus/dbus-string.h>
> #include <dbus/dbus-sysdeps.h>
>+#ifdef HAVE_ADT
>+#include <bsm/adt.h>
>+#endif
> 
> DBUS_BEGIN_DECLS
> 
> typedef enum {
>   DBUS_CREDENTIAL_UNIX_PROCESS_ID,
>   DBUS_CREDENTIAL_UNIX_USER_ID,
>+#ifdef HAVE_ADT
>+  DBUS_CREDENTIAL_AUDIT_DATA_ID,
>+#endif
>   DBUS_CREDENTIAL_WINDOWS_SID
> } DBusCredentialType;
> 
>@@ -51,6 +57,10 @@
> dbus_pid_t       _dbus_credentials_get_unix_pid             (DBusCredentials    *credentials);
> dbus_uid_t       _dbus_credentials_get_unix_uid             (DBusCredentials    *credentials);
> const char*      _dbus_credentials_get_windows_sid          (DBusCredentials    *credentials);
>+#ifdef HAVE_ADT
>+adt_export_data_t* _dbus_credentials_get_audit_data         (DBusCredentials    *credentials);
>+size_t           _dbus_credentials_get_audit_data_size      (DBusCredentials    *credentials);
>+#endif
> dbus_bool_t      _dbus_credentials_are_superset             (DBusCredentials    *credentials,
>                                                              DBusCredentials    *possible_subset);
> dbus_bool_t      _dbus_credentials_are_empty                (DBusCredentials    *credentials);
>diff -Nur dbus-1.2.1/dbus/dbus-protocol.h dbus-1.2.1-new/dbus/dbus-protocol.h
>--- dbus-1.2.1/dbus/dbus-protocol.h	2008-04-04 23:24:08.000000000 +0800
>+++ dbus-1.2.1-new/dbus/dbus-protocol.h	2008-04-28 16:50:26.875419000 +0800
>@@ -411,6 +411,8 @@
> #define DBUS_ERROR_INVALID_FILE_CONTENT       "org.freedesktop.DBus.Error.InvalidFileContent"
> /** Asked for SELinux security context and it wasn't available. */
> #define DBUS_ERROR_SELINUX_SECURITY_CONTEXT_UNKNOWN    "org.freedesktop.DBus.Error.SELinuxSecurityContextUnknown"
>+/** Asked for Solaris audit data and it wasn't available. */
>+#define DBUS_ERROR_SOLARIS_AUDIT_DATA_UNKNOWN     "org.freedesktop.DBus.Error.SolarisAuditDataUnknown"
> /** There's already an object with the requested object path. */
> #define DBUS_ERROR_OBJECT_PATH_IN_USE         "org.freedesktop.DBus.Error.ObjectPathInUse"
> 
>diff -Nur dbus-1.2.1/dbus/dbus-sysdeps-unix.c dbus-1.2.1-new/dbus/dbus-sysdeps-unix.c
>--- dbus-1.2.1/dbus/dbus-sysdeps-unix.c	2008-04-04 23:24:08.000000000 +0800
>+++ dbus-1.2.1-new/dbus/dbus-sysdeps-unix.c	2008-04-28 16:33:31.376793000 +0800
>@@ -1260,6 +1260,37 @@
>       {
>         pid_read = ucred_getpid (ucred);
>         uid_read = ucred_geteuid (ucred);
>+#ifdef HAVE_ADT
>+        /* generate audit session data based on socket ucred */
>+        adt_session_data_t *adth = NULL;
>+        adt_export_data_t *data = NULL;
>+        size_t size = 0;
>+        if (adt_start_session (&adth, NULL, 0))
>+          {
>+            _dbus_verbose ("Failed to adt_start_session(): %s\n", _dbus_strerror (errno));
>+          }
>+        else if (adth != NULL)
>+          {
>+            if (adt_set_from_ucred (adth, ucred, ADT_NEW)) 
>+              {
>+                _dbus_verbose ("Failed to adt_set_from_ucred(): %s\n", _dbus_strerror (errno));
>+              }
>+            else
>+              {
>+                size = adt_export_session_data (adth, &data);
>+                if (size <= 0)
>+                  {
>+                    _dbus_verbose ("Failed to adt_export_session_data(): %s\n", _dbus_strerror (errno));
>+                  }
>+                else
>+                  {
>+                    _dbus_credentials_add_audit_data (credentials, data, size);
>+                    free (data);
>+                  }
>+              }
>+            (void) adt_end_session(adth);
>+          }
>+#endif /* HAVE_ADT */
>       }
>     else
>       {
>diff -Nur dbus-1.2.1/dbus/dbus-transport.c dbus-1.2.1-new/dbus/dbus-transport.c
>--- dbus-1.2.1/dbus/dbus-transport.c	2008-04-04 23:24:08.000000000 +0800
>+++ dbus-1.2.1-new/dbus/dbus-transport.c	2008-04-28 16:33:31.377934000 +0800
>@@ -1261,6 +1261,41 @@
>     return FALSE;
> }
> 
>+#ifdef HAVE_ADT
>+/**
>+ * See dbus_connection_get_audit_session_data().
>+ *
>+ * @param transport the transport
>+ * @param data return location for the Solaris audit data 
>+ * @param data_size return length of Solaris audit data
>+ * @returns #TRUE if audit data is filled in with a valid ucred
>+ */
>+dbus_bool_t
>+_dbus_transport_get_audit_session_data (DBusTransport *transport,
>+				        adt_export_data_t **data,
>+					size_t *data_size)
>+{
>+  DBusCredentials *auth_identity;
>+
>+  *data = NULL;
>+  *data_size = 0;
>+  
>+  if (!transport->authenticated)
>+    return FALSE;
>+  
>+  auth_identity = _dbus_auth_get_identity (transport->auth);
>+
>+  if (_dbus_credentials_get_audit_data (auth_identity) != NULL)
>+    {
>+      *data = _dbus_credentials_get_audit_data (auth_identity);
>+      *data_size = _dbus_credentials_get_audit_data_size (auth_identity);
>+      return TRUE;
>+    }
>+  else
>+    return FALSE;
>+}
>+#endif /* HAVE_ADT */
>+
> /**
>  * See dbus_connection_set_unix_user_function().
>  *
>diff -Nur dbus-1.2.1/dbus/dbus-transport.h dbus-1.2.1-new/dbus/dbus-transport.h
>--- dbus-1.2.1/dbus/dbus-transport.h	2008-04-04 23:24:08.000000000 +0800
>+++ dbus-1.2.1-new/dbus/dbus-transport.h	2008-04-28 16:33:31.379323000 +0800
>@@ -64,6 +64,11 @@
>                                                            unsigned long              *uid);
> dbus_bool_t        _dbus_transport_get_unix_process_id     (DBusTransport              *transport,
>                                                            unsigned long              *pid);
>+#ifdef HAVE_ADT
>+dbus_bool_t        _dbus_transport_get_audit_session_data (DBusTransport *transport,
>+							   adt_export_data_t **data,
>+							   size_t *data_size);
>+#endif
> void               _dbus_transport_set_unix_user_function (DBusTransport              *transport,
>                                                            DBusAllowUnixUserFunction   function,
>                                                            void                       *data,

Actions: View | Splinter Review

Attachments on bug 15740: 16212 | 16260 | 16525 | 16838

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.