William Roberts | 29d238d | 2013-02-08 09:45:26 +0900 | [diff] [blame] | 1 | /* |
| 2 | * Copyright 2012, Samsung Telecommunications of America |
| 3 | * Copyright (C) 2014 The Android Open Source Project |
| 4 | * |
| 5 | * Licensed under the Apache License, Version 2.0 (the "License"); |
| 6 | * you may not use this file except in compliance with the License. |
| 7 | * You may obtain a copy of the License at |
| 8 | * |
| 9 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 10 | * |
| 11 | * Unless required by applicable law or agreed to in writing, software |
| 12 | * distributed under the License is distributed on an "AS IS" BASIS, |
| 13 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 14 | * See the License for the specific language governing permissions and |
| 15 | * limitations under the License. |
| 16 | * |
| 17 | * Written by William Roberts <w.roberts@sta.samsung.com> |
| 18 | * |
| 19 | */ |
| 20 | |
| 21 | #include <errno.h> |
| 22 | #include <string.h> |
| 23 | #include <unistd.h> |
| 24 | |
| 25 | #define LOG_TAG "libaudit" |
| 26 | #include <log/log.h> |
| 27 | |
| 28 | #include "libaudit.h" |
| 29 | |
| 30 | /** |
| 31 | * Waits for an ack from the kernel |
| 32 | * @param fd |
| 33 | * The netlink socket fd |
| 34 | * @param seq |
| 35 | * The current sequence number were acking on |
| 36 | * @return |
| 37 | * This function returns 0 on success, else -errno. |
| 38 | */ |
| 39 | static int get_ack(int fd, int16_t seq) |
| 40 | { |
| 41 | int rc; |
| 42 | struct audit_message rep; |
| 43 | |
| 44 | /* Sanity check, this is an internal interface this shouldn't happen */ |
| 45 | if (fd < 0) { |
| 46 | return -EINVAL; |
| 47 | } |
| 48 | |
| 49 | rc = audit_get_reply(fd, &rep, GET_REPLY_BLOCKING, MSG_PEEK); |
| 50 | if (rc < 0) { |
| 51 | return rc; |
| 52 | } |
| 53 | |
| 54 | if (rep.nlh.nlmsg_type == NLMSG_ERROR) { |
| 55 | audit_get_reply(fd, &rep, GET_REPLY_BLOCKING, 0); |
| 56 | rc = ((struct nlmsgerr *)rep.data)->error; |
| 57 | if (rc) { |
| 58 | return -rc; |
| 59 | } |
| 60 | } |
| 61 | |
| 62 | if ((int16_t)rep.nlh.nlmsg_seq != seq) { |
| 63 | SLOGW("Expected sequence number between user space and kernel space is out of skew, " |
| 64 | "expected %u got %u", seq, rep.nlh.nlmsg_seq); |
| 65 | } |
| 66 | |
| 67 | return 0; |
| 68 | } |
| 69 | |
| 70 | /** |
| 71 | * |
| 72 | * @param fd |
| 73 | * The netlink socket fd |
| 74 | * @param type |
| 75 | * The type of netlink message |
| 76 | * @param data |
| 77 | * The data to send |
| 78 | * @param size |
| 79 | * The length of the data in bytes |
| 80 | * @return |
| 81 | * This function returns a positive sequence number on success, else -errno. |
| 82 | */ |
| 83 | static int audit_send(int fd, int type, const void *data, size_t size) |
| 84 | { |
| 85 | int rc; |
| 86 | static int16_t sequence = 0; |
| 87 | struct audit_message req; |
| 88 | struct sockaddr_nl addr; |
| 89 | |
| 90 | memset(&req, 0, sizeof(req)); |
| 91 | memset(&addr, 0, sizeof(addr)); |
| 92 | |
| 93 | /* We always send netlink messaged */ |
| 94 | addr.nl_family = AF_NETLINK; |
| 95 | |
| 96 | /* Set up the netlink headers */ |
| 97 | req.nlh.nlmsg_type = type; |
| 98 | req.nlh.nlmsg_len = NLMSG_SPACE(size); |
| 99 | req.nlh.nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK; |
| 100 | |
| 101 | /* |
| 102 | * Check for a valid fd, even though sendto would catch this, its easier |
| 103 | * to always blindly increment the sequence number |
| 104 | */ |
| 105 | if (fd < 0) { |
| 106 | return -EBADF; |
| 107 | } |
| 108 | |
| 109 | /* Ensure the message is not too big */ |
| 110 | if (NLMSG_SPACE(size) > MAX_AUDIT_MESSAGE_LENGTH) { |
| 111 | SLOGE("netlink message is too large"); |
| 112 | return -EINVAL; |
| 113 | } |
| 114 | |
| 115 | /* Only memcpy in the data if it was specified */ |
| 116 | if (size && data) { |
| 117 | memcpy(NLMSG_DATA(&req.nlh), data, size); |
| 118 | } |
| 119 | |
| 120 | /* |
| 121 | * Only increment the sequence number on a guarantee |
| 122 | * you will send it to the kernel. |
| 123 | * |
| 124 | * Also, the sequence is defined as a u32 in the kernel |
| 125 | * struct. Using an int here might not work on 32/64 bit splits. A |
| 126 | * signed 64 bit value can overflow a u32..but a u32 |
| 127 | * might not fit in the response, so we need to use s32. |
| 128 | * Which is still kind of hackish since int could be 16 bits |
| 129 | * in size. The only safe type to use here is a signed 16 |
| 130 | * bit value. |
| 131 | */ |
| 132 | req.nlh.nlmsg_seq = ++sequence; |
| 133 | |
| 134 | /* While failing and its due to interrupts */ |
| 135 | |
| 136 | rc = TEMP_FAILURE_RETRY(sendto(fd, &req, req.nlh.nlmsg_len, 0, |
| 137 | (struct sockaddr*) &addr, sizeof(addr))); |
| 138 | |
| 139 | /* Not all the bytes were sent */ |
| 140 | if (rc < 0) { |
| 141 | rc = -errno; |
| 142 | SLOGE("Error sending data over the netlink socket: %s", strerror(-errno)); |
| 143 | goto out; |
| 144 | } else if ((uint32_t) rc != req.nlh.nlmsg_len) { |
| 145 | rc = -EPROTO; |
| 146 | goto out; |
| 147 | } |
| 148 | |
| 149 | /* We sent all the bytes, get the ack */ |
| 150 | rc = get_ack(fd, sequence); |
| 151 | |
| 152 | /* If the ack failed, return the error, else return the sequence number */ |
| 153 | rc = (rc == 0) ? (int) sequence : rc; |
| 154 | |
| 155 | out: |
| 156 | /* Don't let sequence roll to negative */ |
| 157 | if (sequence < 0) { |
| 158 | SLOGW("Auditd to Kernel sequence number has rolled over"); |
| 159 | sequence = 0; |
| 160 | } |
| 161 | |
| 162 | return rc; |
| 163 | } |
| 164 | |
| 165 | int audit_set_pid(int fd, uint32_t pid, rep_wait_t wmode) |
| 166 | { |
| 167 | int rc; |
| 168 | struct audit_message rep; |
| 169 | struct audit_status status; |
| 170 | |
| 171 | memset(&status, 0, sizeof(status)); |
| 172 | |
| 173 | /* |
| 174 | * In order to set the auditd PID we send an audit message over the netlink |
| 175 | * socket with the pid field of the status struct set to our current pid, |
| 176 | * and the the mask set to AUDIT_STATUS_PID |
| 177 | */ |
| 178 | status.pid = pid; |
| 179 | status.mask = AUDIT_STATUS_PID; |
| 180 | |
| 181 | /* Let the kernel know this pid will be registering for audit events */ |
| 182 | rc = audit_send(fd, AUDIT_SET, &status, sizeof(status)); |
| 183 | if (rc < 0) { |
| 184 | SLOGE("Could net set pid for audit events, error: %s", strerror(-rc)); |
| 185 | return rc; |
| 186 | } |
| 187 | |
| 188 | /* |
| 189 | * In a request where we need to wait for a response, wait for the message |
| 190 | * and discard it. This message confirms and sync's us with the kernel. |
| 191 | * This daemon is now registered as the audit logger. Only wait if the |
| 192 | * wmode is != WAIT_NO |
| 193 | */ |
| 194 | if (wmode != WAIT_NO) { |
| 195 | /* TODO |
| 196 | * If the daemon dies and restarts the message didn't come back, |
| 197 | * so I went to non-blocking and it seemed to fix the bug. |
| 198 | * Need to investigate further. |
| 199 | */ |
| 200 | audit_get_reply(fd, &rep, GET_REPLY_NONBLOCKING, 0); |
| 201 | } |
| 202 | |
| 203 | return 0; |
| 204 | } |
| 205 | |
| 206 | int audit_open() |
| 207 | { |
| 208 | return socket(PF_NETLINK, SOCK_RAW, NETLINK_AUDIT); |
| 209 | } |
| 210 | |
| 211 | int audit_get_reply(int fd, struct audit_message *rep, reply_t block, int peek) |
| 212 | { |
| 213 | ssize_t len; |
| 214 | int flags; |
| 215 | int rc = 0; |
| 216 | |
| 217 | struct sockaddr_nl nladdr; |
| 218 | socklen_t nladdrlen = sizeof(nladdr); |
| 219 | |
| 220 | if (fd < 0) { |
| 221 | return -EBADF; |
| 222 | } |
| 223 | |
| 224 | /* Set up the flags for recv from */ |
| 225 | flags = (block == GET_REPLY_NONBLOCKING) ? MSG_DONTWAIT : 0; |
| 226 | flags |= peek; |
| 227 | |
| 228 | /* |
| 229 | * Get the data from the netlink socket but on error we need to be carefull, |
| 230 | * the interface shows that EINTR can never be returned, other errors, |
| 231 | * however, can be returned. |
| 232 | */ |
| 233 | len = TEMP_FAILURE_RETRY(recvfrom(fd, rep, sizeof(*rep), flags, |
| 234 | (struct sockaddr*) &nladdr, &nladdrlen)); |
| 235 | |
| 236 | /* |
| 237 | * EAGAIN should be re-tried until success or another error manifests. |
| 238 | */ |
| 239 | if (len < 0) { |
| 240 | rc = -errno; |
| 241 | if (block == GET_REPLY_NONBLOCKING && rc == -EAGAIN) { |
| 242 | /* If request is non blocking and errno is EAGAIN, just return 0 */ |
| 243 | return 0; |
| 244 | } |
| 245 | SLOGE("Error receiving from netlink socket, error: %s", strerror(-rc)); |
| 246 | return rc; |
| 247 | } |
| 248 | |
| 249 | if (nladdrlen != sizeof(nladdr)) { |
| 250 | SLOGE("Protocol fault, error: %s", strerror(EPROTO)); |
| 251 | return -EPROTO; |
| 252 | } |
| 253 | |
| 254 | /* Make sure the netlink message was not spoof'd */ |
| 255 | if (nladdr.nl_pid) { |
| 256 | SLOGE("Invalid netlink pid received, expected 0 got: %d", nladdr.nl_pid); |
| 257 | return -EINVAL; |
| 258 | } |
| 259 | |
| 260 | /* Check if the reply from the kernel was ok */ |
| 261 | if (!NLMSG_OK(&rep->nlh, (size_t)len)) { |
| 262 | rc = (len == sizeof(*rep)) ? -EFBIG : -EBADE; |
| 263 | SLOGE("Bad kernel response %s", strerror(-rc)); |
| 264 | } |
| 265 | |
| 266 | return rc; |
| 267 | } |
| 268 | |
| 269 | void audit_close(int fd) |
| 270 | { |
| 271 | int rc = close(fd); |
| 272 | if (rc < 0) { |
| 273 | SLOGE("Attempting to close invalid fd %d, error: %s", fd, strerror(errno)); |
| 274 | } |
| 275 | return; |
| 276 | } |