William Roberts | 29d238d | 2013-02-08 09:45:26 +0900 | [diff] [blame] | 1 | /* |
| 2 | * Copyright (C) 2014 The Android Open Source Project |
| 3 | * |
| 4 | * Licensed under the Apache License, Version 2.0 (the "License"); |
| 5 | * you may not use this file except in compliance with the License. |
| 6 | * You may obtain a copy of the License at |
| 7 | * |
| 8 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 9 | * |
| 10 | * Unless required by applicable law or agreed to in writing, software |
| 11 | * distributed under the License is distributed on an "AS IS" BASIS, |
| 12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 13 | * See the License for the specific language governing permissions and |
| 14 | * limitations under the License. |
| 15 | */ |
| 16 | |
| 17 | #include <ctype.h> |
Mark Salyzyn | 29eb570 | 2015-03-03 16:21:27 -0800 | [diff] [blame] | 18 | #include <endian.h> |
William Roberts | 29d238d | 2013-02-08 09:45:26 +0900 | [diff] [blame] | 19 | #include <errno.h> |
Mark Salyzyn | e0fa291 | 2014-04-28 16:39:04 -0700 | [diff] [blame] | 20 | #include <limits.h> |
William Roberts | 29d238d | 2013-02-08 09:45:26 +0900 | [diff] [blame] | 21 | #include <stdarg.h> |
| 22 | #include <stdlib.h> |
Mark Salyzyn | 8daa9af | 2014-04-28 14:07:23 -0700 | [diff] [blame] | 23 | #include <sys/prctl.h> |
Mark Salyzyn | e9bebd0 | 2014-04-03 09:55:26 -0700 | [diff] [blame] | 24 | #include <sys/uio.h> |
Mark Salyzyn | 7ee2aef | 2014-09-28 14:41:50 -0700 | [diff] [blame] | 25 | #include <syslog.h> |
William Roberts | 29d238d | 2013-02-08 09:45:26 +0900 | [diff] [blame] | 26 | |
Mark Salyzyn | 29eb570 | 2015-03-03 16:21:27 -0800 | [diff] [blame] | 27 | #include <private/android_logger.h> |
| 28 | |
William Roberts | 29d238d | 2013-02-08 09:45:26 +0900 | [diff] [blame] | 29 | #include "libaudit.h" |
| 30 | #include "LogAudit.h" |
| 31 | |
Mark Salyzyn | ccbadc6 | 2015-03-12 12:25:35 -0700 | [diff] [blame^] | 32 | #define KMSG_PRIORITY(PRI) \ |
| 33 | '<', \ |
| 34 | '0' + LOG_MAKEPRI(LOG_AUTH, LOG_PRI(PRI)) / 10, \ |
| 35 | '0' + LOG_MAKEPRI(LOG_AUTH, LOG_PRI(PRI)) % 10, \ |
Mark Salyzyn | 7ee2aef | 2014-09-28 14:41:50 -0700 | [diff] [blame] | 36 | '>' |
| 37 | |
Mark Salyzyn | eb06de7 | 2014-10-13 09:59:37 -0700 | [diff] [blame] | 38 | LogAudit::LogAudit(LogBuffer *buf, LogReader *reader, int fdDmesg) |
William Roberts | 29d238d | 2013-02-08 09:45:26 +0900 | [diff] [blame] | 39 | : SocketListener(getLogSocket(), false) |
| 40 | , logbuf(buf) |
Mark Salyzyn | e9bebd0 | 2014-04-03 09:55:26 -0700 | [diff] [blame] | 41 | , reader(reader) |
Mark Salyzyn | eb06de7 | 2014-10-13 09:59:37 -0700 | [diff] [blame] | 42 | , fdDmesg(fdDmesg) |
| 43 | , initialized(false) { |
Mark Salyzyn | 7ee2aef | 2014-09-28 14:41:50 -0700 | [diff] [blame] | 44 | static const char auditd_message[] = { KMSG_PRIORITY(LOG_INFO), |
| 45 | 'l', 'o', 'g', 'd', '.', 'a', 'u', 'd', 'i', 't', 'd', ':', |
| 46 | ' ', 's', 't', 'a', 'r', 't', '\n' }; |
Mark Salyzyn | eb06de7 | 2014-10-13 09:59:37 -0700 | [diff] [blame] | 47 | write(fdDmesg, auditd_message, sizeof(auditd_message)); |
William Roberts | 29d238d | 2013-02-08 09:45:26 +0900 | [diff] [blame] | 48 | } |
| 49 | |
| 50 | bool LogAudit::onDataAvailable(SocketClient *cli) { |
Mark Salyzyn | eb06de7 | 2014-10-13 09:59:37 -0700 | [diff] [blame] | 51 | if (!initialized) { |
| 52 | prctl(PR_SET_NAME, "logd.auditd"); |
| 53 | initialized = true; |
| 54 | } |
Mark Salyzyn | 8daa9af | 2014-04-28 14:07:23 -0700 | [diff] [blame] | 55 | |
William Roberts | 29d238d | 2013-02-08 09:45:26 +0900 | [diff] [blame] | 56 | struct audit_message rep; |
| 57 | |
Mark Salyzyn | e0fa291 | 2014-04-28 16:39:04 -0700 | [diff] [blame] | 58 | rep.nlh.nlmsg_type = 0; |
| 59 | rep.nlh.nlmsg_len = 0; |
| 60 | rep.data[0] = '\0'; |
| 61 | |
William Roberts | 29d238d | 2013-02-08 09:45:26 +0900 | [diff] [blame] | 62 | if (audit_get_reply(cli->getSocket(), &rep, GET_REPLY_BLOCKING, 0) < 0) { |
| 63 | SLOGE("Failed on audit_get_reply with error: %s", strerror(errno)); |
| 64 | return false; |
| 65 | } |
| 66 | |
Mark Salyzyn | eb06de7 | 2014-10-13 09:59:37 -0700 | [diff] [blame] | 67 | logPrint("type=%d %.*s", |
| 68 | rep.nlh.nlmsg_type, rep.nlh.nlmsg_len, rep.data); |
William Roberts | 29d238d | 2013-02-08 09:45:26 +0900 | [diff] [blame] | 69 | |
| 70 | return true; |
| 71 | } |
| 72 | |
William Roberts | 29d238d | 2013-02-08 09:45:26 +0900 | [diff] [blame] | 73 | int LogAudit::logPrint(const char *fmt, ...) { |
| 74 | if (fmt == NULL) { |
| 75 | return -EINVAL; |
| 76 | } |
| 77 | |
| 78 | va_list args; |
| 79 | |
| 80 | char *str = NULL; |
| 81 | va_start(args, fmt); |
| 82 | int rc = vasprintf(&str, fmt, args); |
| 83 | va_end(args); |
| 84 | |
| 85 | if (rc < 0) { |
| 86 | return rc; |
| 87 | } |
| 88 | |
Mark Salyzyn | e4369d6 | 2014-05-27 10:06:34 -0700 | [diff] [blame] | 89 | char *cp; |
| 90 | while ((cp = strstr(str, " "))) { |
| 91 | memmove(cp, cp + 1, strlen(cp + 1) + 1); |
| 92 | } |
| 93 | |
Mark Salyzyn | 6bdeee0 | 2014-09-19 11:59:42 -0700 | [diff] [blame] | 94 | bool info = strstr(str, " permissive=1") || strstr(str, " policy loaded "); |
Mark Salyzyn | eb06de7 | 2014-10-13 09:59:37 -0700 | [diff] [blame] | 95 | if ((fdDmesg >= 0) && initialized) { |
Mark Salyzyn | 6bdeee0 | 2014-09-19 11:59:42 -0700 | [diff] [blame] | 96 | struct iovec iov[3]; |
Mark Salyzyn | 7ee2aef | 2014-09-28 14:41:50 -0700 | [diff] [blame] | 97 | static const char log_info[] = { KMSG_PRIORITY(LOG_INFO) }; |
| 98 | static const char log_warning[] = { KMSG_PRIORITY(LOG_WARNING) }; |
Mark Salyzyn | e9bebd0 | 2014-04-03 09:55:26 -0700 | [diff] [blame] | 99 | |
Mark Salyzyn | 7ee2aef | 2014-09-28 14:41:50 -0700 | [diff] [blame] | 100 | iov[0].iov_base = info ? const_cast<char *>(log_info) |
| 101 | : const_cast<char *>(log_warning); |
| 102 | iov[0].iov_len = info ? sizeof(log_info) : sizeof(log_warning); |
Mark Salyzyn | 6bdeee0 | 2014-09-19 11:59:42 -0700 | [diff] [blame] | 103 | iov[1].iov_base = str; |
| 104 | iov[1].iov_len = strlen(str); |
| 105 | iov[2].iov_base = const_cast<char *>("\n"); |
| 106 | iov[2].iov_len = 1; |
Mark Salyzyn | e9bebd0 | 2014-04-03 09:55:26 -0700 | [diff] [blame] | 107 | |
| 108 | writev(fdDmesg, iov, sizeof(iov) / sizeof(iov[0])); |
| 109 | } |
| 110 | |
William Roberts | 29d238d | 2013-02-08 09:45:26 +0900 | [diff] [blame] | 111 | pid_t pid = getpid(); |
| 112 | pid_t tid = gettid(); |
| 113 | uid_t uid = getuid(); |
| 114 | log_time now; |
| 115 | |
| 116 | static const char audit_str[] = " audit("; |
| 117 | char *timeptr = strstr(str, audit_str); |
William Roberts | 29d238d | 2013-02-08 09:45:26 +0900 | [diff] [blame] | 118 | if (timeptr |
| 119 | && ((cp = now.strptime(timeptr + sizeof(audit_str) - 1, "%s.%q"))) |
| 120 | && (*cp == ':')) { |
| 121 | memcpy(timeptr + sizeof(audit_str) - 1, "0.0", 3); |
Mark Salyzyn | e4369d6 | 2014-05-27 10:06:34 -0700 | [diff] [blame] | 122 | memmove(timeptr + sizeof(audit_str) - 1 + 3, cp, strlen(cp) + 1); |
William Roberts | 29d238d | 2013-02-08 09:45:26 +0900 | [diff] [blame] | 123 | } else { |
| 124 | now.strptime("", ""); // side effect of setting CLOCK_REALTIME |
| 125 | } |
| 126 | |
| 127 | static const char pid_str[] = " pid="; |
| 128 | char *pidptr = strstr(str, pid_str); |
| 129 | if (pidptr && isdigit(pidptr[sizeof(pid_str) - 1])) { |
| 130 | cp = pidptr + sizeof(pid_str) - 1; |
| 131 | pid = 0; |
| 132 | while (isdigit(*cp)) { |
| 133 | pid = (pid * 10) + (*cp - '0'); |
| 134 | ++cp; |
| 135 | } |
| 136 | tid = pid; |
| 137 | uid = logbuf->pidToUid(pid); |
Mark Salyzyn | e4369d6 | 2014-05-27 10:06:34 -0700 | [diff] [blame] | 138 | memmove(pidptr, cp, strlen(cp) + 1); |
William Roberts | 29d238d | 2013-02-08 09:45:26 +0900 | [diff] [blame] | 139 | } |
| 140 | |
Mark Salyzyn | e4369d6 | 2014-05-27 10:06:34 -0700 | [diff] [blame] | 141 | // log to events |
| 142 | |
| 143 | size_t l = strlen(str); |
Mark Salyzyn | 29eb570 | 2015-03-03 16:21:27 -0800 | [diff] [blame] | 144 | size_t n = l + sizeof(android_log_event_string_t); |
Mark Salyzyn | e4369d6 | 2014-05-27 10:06:34 -0700 | [diff] [blame] | 145 | |
| 146 | bool notify = false; |
William Roberts | 29d238d | 2013-02-08 09:45:26 +0900 | [diff] [blame] | 147 | |
Mark Salyzyn | 29eb570 | 2015-03-03 16:21:27 -0800 | [diff] [blame] | 148 | android_log_event_string_t *event = static_cast<android_log_event_string_t *>(malloc(n)); |
| 149 | if (!event) { |
Mark Salyzyn | e4369d6 | 2014-05-27 10:06:34 -0700 | [diff] [blame] | 150 | rc = -ENOMEM; |
| 151 | } else { |
Mark Salyzyn | 29eb570 | 2015-03-03 16:21:27 -0800 | [diff] [blame] | 152 | event->header.tag = htole32(AUDITD_LOG_TAG); |
| 153 | event->payload.type = EVENT_TYPE_STRING; |
| 154 | event->payload.length = htole32(l); |
| 155 | memcpy(event->payload.data, str, l); |
Mark Salyzyn | e4369d6 | 2014-05-27 10:06:34 -0700 | [diff] [blame] | 156 | |
Mark Salyzyn | 29eb570 | 2015-03-03 16:21:27 -0800 | [diff] [blame] | 157 | logbuf->log(LOG_ID_EVENTS, now, uid, pid, tid, |
| 158 | reinterpret_cast<char *>(event), |
Mark Salyzyn | e4369d6 | 2014-05-27 10:06:34 -0700 | [diff] [blame] | 159 | (n <= USHRT_MAX) ? (unsigned short) n : USHRT_MAX); |
Mark Salyzyn | 29eb570 | 2015-03-03 16:21:27 -0800 | [diff] [blame] | 160 | free(event); |
Mark Salyzyn | e4369d6 | 2014-05-27 10:06:34 -0700 | [diff] [blame] | 161 | |
| 162 | notify = true; |
William Roberts | 29d238d | 2013-02-08 09:45:26 +0900 | [diff] [blame] | 163 | } |
| 164 | |
Mark Salyzyn | e4369d6 | 2014-05-27 10:06:34 -0700 | [diff] [blame] | 165 | // log to main |
| 166 | |
| 167 | static const char comm_str[] = " comm=\""; |
| 168 | const char *comm = strstr(str, comm_str); |
| 169 | const char *estr = str + strlen(str); |
| 170 | if (comm) { |
| 171 | estr = comm; |
| 172 | comm += sizeof(comm_str) - 1; |
| 173 | } else if (pid == getpid()) { |
| 174 | pid = tid; |
| 175 | comm = "auditd"; |
| 176 | } else if (!(comm = logbuf->pidToName(pid))) { |
| 177 | comm = "unknown"; |
| 178 | } |
| 179 | |
| 180 | const char *ecomm = strchr(comm, '"'); |
| 181 | if (ecomm) { |
| 182 | ++ecomm; |
| 183 | l = ecomm - comm; |
| 184 | } else { |
| 185 | l = strlen(comm) + 1; |
| 186 | ecomm = ""; |
| 187 | } |
| 188 | n = (estr - str) + strlen(ecomm) + l + 2; |
| 189 | |
Mark Salyzyn | 29eb570 | 2015-03-03 16:21:27 -0800 | [diff] [blame] | 190 | char *newstr = static_cast<char *>(malloc(n)); |
Mark Salyzyn | e4369d6 | 2014-05-27 10:06:34 -0700 | [diff] [blame] | 191 | if (!newstr) { |
| 192 | rc = -ENOMEM; |
| 193 | } else { |
Mark Salyzyn | 6bdeee0 | 2014-09-19 11:59:42 -0700 | [diff] [blame] | 194 | *newstr = info ? ANDROID_LOG_INFO : ANDROID_LOG_WARN; |
Mark Salyzyn | e4369d6 | 2014-05-27 10:06:34 -0700 | [diff] [blame] | 195 | strlcpy(newstr + 1, comm, l); |
| 196 | strncpy(newstr + 1 + l, str, estr - str); |
| 197 | strcpy(newstr + 1 + l + (estr - str), ecomm); |
| 198 | |
| 199 | logbuf->log(LOG_ID_MAIN, now, uid, pid, tid, newstr, |
| 200 | (n <= USHRT_MAX) ? (unsigned short) n : USHRT_MAX); |
| 201 | free(newstr); |
| 202 | |
| 203 | notify = true; |
| 204 | } |
| 205 | |
William Roberts | 29d238d | 2013-02-08 09:45:26 +0900 | [diff] [blame] | 206 | free(str); |
| 207 | |
Mark Salyzyn | e4369d6 | 2014-05-27 10:06:34 -0700 | [diff] [blame] | 208 | if (notify) { |
| 209 | reader->notifyNewLog(); |
| 210 | } |
William Roberts | 29d238d | 2013-02-08 09:45:26 +0900 | [diff] [blame] | 211 | |
| 212 | return rc; |
| 213 | } |
| 214 | |
Mark Salyzyn | eb06de7 | 2014-10-13 09:59:37 -0700 | [diff] [blame] | 215 | int LogAudit::log(char *buf) { |
| 216 | char *audit = strstr(buf, " audit("); |
| 217 | if (!audit) { |
| 218 | return 0; |
William Roberts | 29d238d | 2013-02-08 09:45:26 +0900 | [diff] [blame] | 219 | } |
| 220 | |
Mark Salyzyn | eb06de7 | 2014-10-13 09:59:37 -0700 | [diff] [blame] | 221 | *audit = '\0'; |
William Roberts | 29d238d | 2013-02-08 09:45:26 +0900 | [diff] [blame] | 222 | |
Mark Salyzyn | eb06de7 | 2014-10-13 09:59:37 -0700 | [diff] [blame] | 223 | int rc; |
| 224 | char *type = strstr(buf, "type="); |
| 225 | if (type) { |
| 226 | rc = logPrint("%s %s", type, audit + 1); |
| 227 | } else { |
| 228 | rc = logPrint("%s", audit + 1); |
William Roberts | 29d238d | 2013-02-08 09:45:26 +0900 | [diff] [blame] | 229 | } |
Mark Salyzyn | eb06de7 | 2014-10-13 09:59:37 -0700 | [diff] [blame] | 230 | *audit = ' '; |
| 231 | return rc; |
William Roberts | 29d238d | 2013-02-08 09:45:26 +0900 | [diff] [blame] | 232 | } |
| 233 | |
| 234 | int LogAudit::getLogSocket() { |
| 235 | int fd = audit_open(); |
| 236 | if (fd < 0) { |
| 237 | return fd; |
| 238 | } |
Nick Kralevich | c234a1b | 2014-11-19 13:33:22 -0800 | [diff] [blame] | 239 | if (audit_setup(fd, getpid()) < 0) { |
William Roberts | 29d238d | 2013-02-08 09:45:26 +0900 | [diff] [blame] | 240 | audit_close(fd); |
| 241 | fd = -1; |
| 242 | } |
| 243 | return fd; |
| 244 | } |