William Roberts | 210c584 | 2013-02-08 09:45:26 +0900 | [diff] [blame] | 1 | /* |
| 2 | * Copyright (C) 2014 The Android Open Source Project |
| 3 | * |
| 4 | * Licensed under the Apache License, Version 2.0 (the "License"); |
| 5 | * you may not use this file except in compliance with the License. |
| 6 | * You may obtain a copy of the License at |
| 7 | * |
| 8 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 9 | * |
| 10 | * Unless required by applicable law or agreed to in writing, software |
| 11 | * distributed under the License is distributed on an "AS IS" BASIS, |
| 12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 13 | * See the License for the specific language governing permissions and |
| 14 | * limitations under the License. |
| 15 | */ |
| 16 | |
Tom Cherry | 479b503 | 2020-05-07 14:44:43 -0700 | [diff] [blame] | 17 | #include "LogAudit.h" |
| 18 | |
William Roberts | 210c584 | 2013-02-08 09:45:26 +0900 | [diff] [blame] | 19 | #include <ctype.h> |
Mark Salyzyn | 64679af | 2015-03-03 16:21:27 -0800 | [diff] [blame] | 20 | #include <endian.h> |
William Roberts | 210c584 | 2013-02-08 09:45:26 +0900 | [diff] [blame] | 21 | #include <errno.h> |
Mark Salyzyn | 59d0910 | 2014-04-28 16:39:04 -0700 | [diff] [blame] | 22 | #include <limits.h> |
William Roberts | 210c584 | 2013-02-08 09:45:26 +0900 | [diff] [blame] | 23 | #include <stdarg.h> |
Chih-Hung Hsieh | 9ff8155 | 2018-08-13 14:22:56 -0700 | [diff] [blame] | 24 | #include <stdint.h> |
William Roberts | 210c584 | 2013-02-08 09:45:26 +0900 | [diff] [blame] | 25 | #include <stdlib.h> |
Mark Salyzyn | a92051d | 2016-02-23 08:55:43 -0800 | [diff] [blame] | 26 | #include <string.h> |
Mark Salyzyn | 4e5efdc | 2014-04-28 14:07:23 -0700 | [diff] [blame] | 27 | #include <sys/prctl.h> |
Mark Salyzyn | ae0a7bf | 2014-04-03 09:55:26 -0700 | [diff] [blame] | 28 | #include <sys/uio.h> |
Mark Salyzyn | aa773a8 | 2014-09-28 14:41:50 -0700 | [diff] [blame] | 29 | #include <syslog.h> |
William Roberts | 210c584 | 2013-02-08 09:45:26 +0900 | [diff] [blame] | 30 | |
Max Bires | 9cf521b | 2017-08-15 11:07:49 -0700 | [diff] [blame] | 31 | #include <fstream> |
| 32 | #include <sstream> |
| 33 | |
Mark Salyzyn | 071f469 | 2016-11-03 10:29:23 -0700 | [diff] [blame] | 34 | #include <android-base/macros.h> |
Max Bires | 9cf521b | 2017-08-15 11:07:49 -0700 | [diff] [blame] | 35 | #include <log/log_properties.h> |
Mark Salyzyn | b485395 | 2015-03-17 07:56:32 -0700 | [diff] [blame] | 36 | #include <private/android_filesystem_config.h> |
Mark Salyzyn | 64679af | 2015-03-03 16:21:27 -0800 | [diff] [blame] | 37 | #include <private/android_logger.h> |
| 38 | |
Mark Salyzyn | e73a18b | 2014-10-15 08:49:39 -0700 | [diff] [blame] | 39 | #include "LogKlog.h" |
Mark Salyzyn | 24a57dc | 2016-12-13 10:31:29 -0800 | [diff] [blame] | 40 | #include "LogUtils.h" |
Mark Salyzyn | 6505953 | 2017-03-10 14:31:54 -0800 | [diff] [blame] | 41 | #include "libaudit.h" |
William Roberts | 210c584 | 2013-02-08 09:45:26 +0900 | [diff] [blame] | 42 | |
Mark Salyzyn | 6505953 | 2017-03-10 14:31:54 -0800 | [diff] [blame] | 43 | #define KMSG_PRIORITY(PRI) \ |
| 44 | '<', '0' + LOG_MAKEPRI(LOG_AUTH, LOG_PRI(PRI)) / 10, \ |
| 45 | '0' + LOG_MAKEPRI(LOG_AUTH, LOG_PRI(PRI)) % 10, '>' |
Mark Salyzyn | aa773a8 | 2014-09-28 14:41:50 -0700 | [diff] [blame] | 46 | |
Tom Cherry | 5ecfbf0 | 2020-05-11 16:29:29 -0700 | [diff] [blame^] | 47 | LogAudit::LogAudit(LogBuffer* buf, int fdDmesg, LogStatistics* stats) |
Jeff Vander Stoep | b66ed0f | 2018-01-03 11:04:26 -0800 | [diff] [blame] | 48 | : SocketListener(getLogSocket(), false), |
Mark Salyzyn | 6505953 | 2017-03-10 14:31:54 -0800 | [diff] [blame] | 49 | logbuf(buf), |
Mark Salyzyn | 6505953 | 2017-03-10 14:31:54 -0800 | [diff] [blame] | 50 | fdDmesg(fdDmesg), |
Tom Cherry | 479b503 | 2020-05-07 14:44:43 -0700 | [diff] [blame] | 51 | main(__android_logger_property_get_bool("ro.logd.auditd.main", BOOL_DEFAULT_TRUE)), |
| 52 | events(__android_logger_property_get_bool("ro.logd.auditd.events", BOOL_DEFAULT_TRUE)), |
| 53 | initialized(false), |
| 54 | stats_(stats) { |
Sami Tolvanen | ba23953 | 2016-06-14 18:04:43 +0000 | [diff] [blame] | 55 | static const char auditd_message[] = { KMSG_PRIORITY(LOG_INFO), |
Mark Salyzyn | 6505953 | 2017-03-10 14:31:54 -0800 | [diff] [blame] | 56 | 'l', |
| 57 | 'o', |
| 58 | 'g', |
| 59 | 'd', |
| 60 | '.', |
| 61 | 'a', |
| 62 | 'u', |
| 63 | 'd', |
| 64 | 'i', |
| 65 | 't', |
| 66 | 'd', |
| 67 | ':', |
| 68 | ' ', |
| 69 | 's', |
| 70 | 't', |
| 71 | 'a', |
| 72 | 'r', |
| 73 | 't', |
| 74 | '\n' }; |
Sami Tolvanen | ba23953 | 2016-06-14 18:04:43 +0000 | [diff] [blame] | 75 | write(fdDmesg, auditd_message, sizeof(auditd_message)); |
William Roberts | 210c584 | 2013-02-08 09:45:26 +0900 | [diff] [blame] | 76 | } |
| 77 | |
Mark Salyzyn | 6505953 | 2017-03-10 14:31:54 -0800 | [diff] [blame] | 78 | bool LogAudit::onDataAvailable(SocketClient* cli) { |
Mark Salyzyn | 78956ab | 2014-10-13 09:59:37 -0700 | [diff] [blame] | 79 | if (!initialized) { |
| 80 | prctl(PR_SET_NAME, "logd.auditd"); |
| 81 | initialized = true; |
| 82 | } |
Mark Salyzyn | 4e5efdc | 2014-04-28 14:07:23 -0700 | [diff] [blame] | 83 | |
William Roberts | 210c584 | 2013-02-08 09:45:26 +0900 | [diff] [blame] | 84 | struct audit_message rep; |
| 85 | |
Mark Salyzyn | 59d0910 | 2014-04-28 16:39:04 -0700 | [diff] [blame] | 86 | rep.nlh.nlmsg_type = 0; |
| 87 | rep.nlh.nlmsg_len = 0; |
| 88 | rep.data[0] = '\0'; |
| 89 | |
William Roberts | 210c584 | 2013-02-08 09:45:26 +0900 | [diff] [blame] | 90 | if (audit_get_reply(cli->getSocket(), &rep, GET_REPLY_BLOCKING, 0) < 0) { |
| 91 | SLOGE("Failed on audit_get_reply with error: %s", strerror(errno)); |
| 92 | return false; |
| 93 | } |
| 94 | |
Mark Salyzyn | ec9b9ad | 2017-01-03 14:00:19 -0800 | [diff] [blame] | 95 | logPrint("type=%d %.*s", rep.nlh.nlmsg_type, rep.nlh.nlmsg_len, rep.data); |
William Roberts | 210c584 | 2013-02-08 09:45:26 +0900 | [diff] [blame] | 96 | |
| 97 | return true; |
| 98 | } |
| 99 | |
Max Bires | 9cf521b | 2017-08-15 11:07:49 -0700 | [diff] [blame] | 100 | static inline bool hasMetadata(char* str, int str_len) { |
| 101 | // need to check and see if str already contains bug metadata from |
| 102 | // possibility of stuttering if log audit crashes and then reloads kernel |
| 103 | // messages. Kernel denials that contain metadata will either end in |
| 104 | // "b/[0-9]+$" or "b/[0-9]+ duplicate messages suppressed$" which will put |
| 105 | // a '/' character at either 9 or 39 indices away from the end of the str. |
| 106 | return str_len >= 39 && |
| 107 | (str[str_len - 9] == '/' || str[str_len - 39] == '/'); |
| 108 | } |
| 109 | |
| 110 | std::map<std::string, std::string> LogAudit::populateDenialMap() { |
Tri Vo | 66d7b61 | 2019-01-23 09:58:35 -0800 | [diff] [blame] | 111 | std::ifstream bug_file("/vendor/etc/selinux/selinux_denial_metadata"); |
Max Bires | 9cf521b | 2017-08-15 11:07:49 -0700 | [diff] [blame] | 112 | std::string line; |
Jeff Vander Stoep | 78beb5e | 2018-05-03 14:57:39 -0700 | [diff] [blame] | 113 | // allocate a map for the static map pointer in auditParse to keep track of, |
Max Bires | 9cf521b | 2017-08-15 11:07:49 -0700 | [diff] [blame] | 114 | // this function only runs once |
| 115 | std::map<std::string, std::string> denial_to_bug; |
| 116 | if (bug_file.good()) { |
| 117 | std::string scontext; |
| 118 | std::string tcontext; |
| 119 | std::string tclass; |
| 120 | std::string bug_num; |
| 121 | while (std::getline(bug_file, line)) { |
| 122 | std::stringstream split_line(line); |
| 123 | split_line >> scontext >> tcontext >> tclass >> bug_num; |
| 124 | denial_to_bug.emplace(scontext + tcontext + tclass, bug_num); |
| 125 | } |
| 126 | } |
| 127 | return denial_to_bug; |
| 128 | } |
| 129 | |
| 130 | std::string LogAudit::denialParse(const std::string& denial, char terminator, |
| 131 | const std::string& search_term) { |
| 132 | size_t start_index = denial.find(search_term); |
| 133 | if (start_index != std::string::npos) { |
| 134 | start_index += search_term.length(); |
| 135 | return denial.substr( |
| 136 | start_index, denial.find(terminator, start_index) - start_index); |
| 137 | } |
| 138 | return ""; |
| 139 | } |
| 140 | |
Jeff Vander Stoep | 78beb5e | 2018-05-03 14:57:39 -0700 | [diff] [blame] | 141 | void LogAudit::auditParse(const std::string& string, uid_t uid, |
| 142 | std::string* bug_num) { |
Max Bires | 9cf521b | 2017-08-15 11:07:49 -0700 | [diff] [blame] | 143 | static std::map<std::string, std::string> denial_to_bug = |
| 144 | populateDenialMap(); |
| 145 | std::string scontext = denialParse(string, ':', "scontext=u:object_r:"); |
| 146 | std::string tcontext = denialParse(string, ':', "tcontext=u:object_r:"); |
| 147 | std::string tclass = denialParse(string, ' ', "tclass="); |
| 148 | if (scontext.empty()) { |
| 149 | scontext = denialParse(string, ':', "scontext=u:r:"); |
| 150 | } |
| 151 | if (tcontext.empty()) { |
| 152 | tcontext = denialParse(string, ':', "tcontext=u:r:"); |
| 153 | } |
| 154 | auto search = denial_to_bug.find(scontext + tcontext + tclass); |
| 155 | if (search != denial_to_bug.end()) { |
Ashwini Oruganti | aeeea0d | 2019-09-18 14:25:26 -0700 | [diff] [blame] | 156 | bug_num->assign(" " + search->second); |
Max Bires | 9cf521b | 2017-08-15 11:07:49 -0700 | [diff] [blame] | 157 | } else { |
| 158 | bug_num->assign(""); |
| 159 | } |
Jeff Vander Stoep | 78beb5e | 2018-05-03 14:57:39 -0700 | [diff] [blame] | 160 | |
Dan Austin | 491b824 | 2018-11-27 07:30:11 -0800 | [diff] [blame] | 161 | // Ensure the uid name is not null before passing it to the bug string. |
Jeff Vander Stoep | 78beb5e | 2018-05-03 14:57:39 -0700 | [diff] [blame] | 162 | if (uid >= AID_APP_START && uid <= AID_APP_END) { |
Dan Austin | 491b824 | 2018-11-27 07:30:11 -0800 | [diff] [blame] | 163 | char* uidname = android::uidToName(uid); |
| 164 | if (uidname) { |
| 165 | bug_num->append(" app="); |
| 166 | bug_num->append(uidname); |
| 167 | free(uidname); |
| 168 | } |
Jeff Vander Stoep | 78beb5e | 2018-05-03 14:57:39 -0700 | [diff] [blame] | 169 | } |
Max Bires | 9cf521b | 2017-08-15 11:07:49 -0700 | [diff] [blame] | 170 | } |
| 171 | |
Mark Salyzyn | 6505953 | 2017-03-10 14:31:54 -0800 | [diff] [blame] | 172 | int LogAudit::logPrint(const char* fmt, ...) { |
Yi Kong | 36feb15 | 2018-07-13 17:39:22 -0700 | [diff] [blame] | 173 | if (fmt == nullptr) { |
William Roberts | 210c584 | 2013-02-08 09:45:26 +0900 | [diff] [blame] | 174 | return -EINVAL; |
| 175 | } |
| 176 | |
| 177 | va_list args; |
| 178 | |
Yi Kong | 36feb15 | 2018-07-13 17:39:22 -0700 | [diff] [blame] | 179 | char* str = nullptr; |
William Roberts | 210c584 | 2013-02-08 09:45:26 +0900 | [diff] [blame] | 180 | va_start(args, fmt); |
| 181 | int rc = vasprintf(&str, fmt, args); |
| 182 | va_end(args); |
| 183 | |
| 184 | if (rc < 0) { |
| 185 | return rc; |
| 186 | } |
Mark Salyzyn | 6505953 | 2017-03-10 14:31:54 -0800 | [diff] [blame] | 187 | char* cp; |
Nick Kralevich | 908486f | 2017-01-03 10:35:34 -0800 | [diff] [blame] | 188 | // Work around kernels missing |
| 189 | // https://github.com/torvalds/linux/commit/b8f89caafeb55fba75b74bea25adc4e4cd91be67 |
| 190 | // Such kernels improperly add newlines inside audit messages. |
| 191 | while ((cp = strchr(str, '\n'))) { |
| 192 | *cp = ' '; |
| 193 | } |
| 194 | |
Mark Salyzyn | 380423a | 2014-05-27 10:06:34 -0700 | [diff] [blame] | 195 | while ((cp = strstr(str, " "))) { |
| 196 | memmove(cp, cp + 1, strlen(cp + 1) + 1); |
| 197 | } |
Jeff Vander Stoep | 78beb5e | 2018-05-03 14:57:39 -0700 | [diff] [blame] | 198 | pid_t pid = getpid(); |
| 199 | pid_t tid = gettid(); |
| 200 | uid_t uid = AID_LOGD; |
| 201 | static const char pid_str[] = " pid="; |
| 202 | char* pidptr = strstr(str, pid_str); |
| 203 | if (pidptr && isdigit(pidptr[sizeof(pid_str) - 1])) { |
| 204 | cp = pidptr + sizeof(pid_str) - 1; |
| 205 | pid = 0; |
| 206 | while (isdigit(*cp)) { |
| 207 | pid = (pid * 10) + (*cp - '0'); |
| 208 | ++cp; |
| 209 | } |
| 210 | tid = pid; |
Tom Cherry | 479b503 | 2020-05-07 14:44:43 -0700 | [diff] [blame] | 211 | uid = stats_->PidToUid(pid); |
Jeff Vander Stoep | 78beb5e | 2018-05-03 14:57:39 -0700 | [diff] [blame] | 212 | memmove(pidptr, cp, strlen(cp) + 1); |
| 213 | } |
| 214 | |
Sami Tolvanen | ba23953 | 2016-06-14 18:04:43 +0000 | [diff] [blame] | 215 | bool info = strstr(str, " permissive=1") || strstr(str, " policy loaded "); |
Jeff Vander Stoep | 78beb5e | 2018-05-03 14:57:39 -0700 | [diff] [blame] | 216 | static std::string denial_metadata; |
Mark Salyzyn | 78956ab | 2014-10-13 09:59:37 -0700 | [diff] [blame] | 217 | if ((fdDmesg >= 0) && initialized) { |
Max Bires | 9cf521b | 2017-08-15 11:07:49 -0700 | [diff] [blame] | 218 | struct iovec iov[4]; |
Mark Salyzyn | aa773a8 | 2014-09-28 14:41:50 -0700 | [diff] [blame] | 219 | static const char log_info[] = { KMSG_PRIORITY(LOG_INFO) }; |
| 220 | static const char log_warning[] = { KMSG_PRIORITY(LOG_WARNING) }; |
Mark Salyzyn | f815ca7 | 2016-07-15 15:45:58 -0700 | [diff] [blame] | 221 | static const char newline[] = "\n"; |
Mark Salyzyn | ae0a7bf | 2014-04-03 09:55:26 -0700 | [diff] [blame] | 222 | |
Nick Kralevich | ba406b2 | 2019-04-24 13:29:35 -0700 | [diff] [blame] | 223 | auditParse(str, uid, &denial_metadata); |
| 224 | iov[0].iov_base = info ? const_cast<char*>(log_info) : const_cast<char*>(log_warning); |
| 225 | iov[0].iov_len = info ? sizeof(log_info) : sizeof(log_warning); |
| 226 | iov[1].iov_base = str; |
| 227 | iov[1].iov_len = strlen(str); |
| 228 | iov[2].iov_base = const_cast<char*>(denial_metadata.c_str()); |
| 229 | iov[2].iov_len = denial_metadata.length(); |
| 230 | iov[3].iov_base = const_cast<char*>(newline); |
| 231 | iov[3].iov_len = strlen(newline); |
Mark Salyzyn | ae0a7bf | 2014-04-03 09:55:26 -0700 | [diff] [blame] | 232 | |
Nick Kralevich | ba406b2 | 2019-04-24 13:29:35 -0700 | [diff] [blame] | 233 | writev(fdDmesg, iov, arraysize(iov)); |
Mark Salyzyn | ae0a7bf | 2014-04-03 09:55:26 -0700 | [diff] [blame] | 234 | } |
| 235 | |
Mark Salyzyn | caf4386 | 2016-12-29 15:16:06 -0800 | [diff] [blame] | 236 | if (!main && !events) { |
| 237 | free(str); |
| 238 | return 0; |
| 239 | } |
| 240 | |
Bernie Innocenti | 440e035 | 2019-01-16 15:25:18 +0900 | [diff] [blame] | 241 | log_time now(log_time::EPOCH); |
William Roberts | 210c584 | 2013-02-08 09:45:26 +0900 | [diff] [blame] | 242 | |
| 243 | static const char audit_str[] = " audit("; |
Mark Salyzyn | 6505953 | 2017-03-10 14:31:54 -0800 | [diff] [blame] | 244 | char* timeptr = strstr(str, audit_str); |
Tom Cherry | a5ff7ae | 2020-04-08 14:36:05 -0700 | [diff] [blame] | 245 | if (timeptr && ((cp = now.strptime(timeptr + sizeof(audit_str) - 1, "%s.%q"))) && |
Mark Salyzyn | 6505953 | 2017-03-10 14:31:54 -0800 | [diff] [blame] | 246 | (*cp == ':')) { |
William Roberts | 210c584 | 2013-02-08 09:45:26 +0900 | [diff] [blame] | 247 | memcpy(timeptr + sizeof(audit_str) - 1, "0.0", 3); |
Mark Salyzyn | 380423a | 2014-05-27 10:06:34 -0700 | [diff] [blame] | 248 | memmove(timeptr + sizeof(audit_str) - 1 + 3, cp, strlen(cp) + 1); |
William Roberts | 210c584 | 2013-02-08 09:45:26 +0900 | [diff] [blame] | 249 | } else { |
Mark Salyzyn | 0e2fe42 | 2015-09-08 08:56:32 -0700 | [diff] [blame] | 250 | now = log_time(CLOCK_REALTIME); |
William Roberts | 210c584 | 2013-02-08 09:45:26 +0900 | [diff] [blame] | 251 | } |
| 252 | |
Mark Salyzyn | 380423a | 2014-05-27 10:06:34 -0700 | [diff] [blame] | 253 | // log to events |
| 254 | |
Max Bires | 9cf521b | 2017-08-15 11:07:49 -0700 | [diff] [blame] | 255 | size_t str_len = strnlen(str, LOGGER_ENTRY_MAX_PAYLOAD); |
| 256 | if (((fdDmesg < 0) || !initialized) && !hasMetadata(str, str_len)) |
Jeff Vander Stoep | 78beb5e | 2018-05-03 14:57:39 -0700 | [diff] [blame] | 257 | auditParse(str, uid, &denial_metadata); |
| 258 | str_len = (str_len + denial_metadata.length() <= LOGGER_ENTRY_MAX_PAYLOAD) |
| 259 | ? str_len + denial_metadata.length() |
Max Bires | 9cf521b | 2017-08-15 11:07:49 -0700 | [diff] [blame] | 260 | : LOGGER_ENTRY_MAX_PAYLOAD; |
| 261 | size_t message_len = str_len + sizeof(android_log_event_string_t); |
Mark Salyzyn | 380423a | 2014-05-27 10:06:34 -0700 | [diff] [blame] | 262 | |
Tom Cherry | 7e3bc96 | 2020-05-04 17:10:16 -0700 | [diff] [blame] | 263 | unsigned int notify = 0; |
William Roberts | 210c584 | 2013-02-08 09:45:26 +0900 | [diff] [blame] | 264 | |
Mark Salyzyn | 6505953 | 2017-03-10 14:31:54 -0800 | [diff] [blame] | 265 | if (events) { // begin scope for event buffer |
Max Bires | 9cf521b | 2017-08-15 11:07:49 -0700 | [diff] [blame] | 266 | uint32_t buffer[(message_len + sizeof(uint32_t) - 1) / sizeof(uint32_t)]; |
Mark Salyzyn | ebaf2d6 | 2015-10-02 09:22:52 -0700 | [diff] [blame] | 267 | |
Mark Salyzyn | 6505953 | 2017-03-10 14:31:54 -0800 | [diff] [blame] | 268 | android_log_event_string_t* event = |
| 269 | reinterpret_cast<android_log_event_string_t*>(buffer); |
Mark Salyzyn | 64679af | 2015-03-03 16:21:27 -0800 | [diff] [blame] | 270 | event->header.tag = htole32(AUDITD_LOG_TAG); |
Nick Kralevich | 253374f | 2015-04-07 01:25:43 -0700 | [diff] [blame] | 271 | event->type = EVENT_TYPE_STRING; |
Max Bires | 42ec64b | 2017-09-14 13:01:28 -0700 | [diff] [blame] | 272 | event->length = htole32(str_len); |
Jeff Vander Stoep | 78beb5e | 2018-05-03 14:57:39 -0700 | [diff] [blame] | 273 | memcpy(event->data, str, str_len - denial_metadata.length()); |
| 274 | memcpy(event->data + str_len - denial_metadata.length(), |
| 275 | denial_metadata.c_str(), denial_metadata.length()); |
Mark Salyzyn | 380423a | 2014-05-27 10:06:34 -0700 | [diff] [blame] | 276 | |
Max Bires | 9cf521b | 2017-08-15 11:07:49 -0700 | [diff] [blame] | 277 | rc = logbuf->log( |
| 278 | LOG_ID_EVENTS, now, uid, pid, tid, reinterpret_cast<char*>(event), |
Chih-Hung Hsieh | 9ff8155 | 2018-08-13 14:22:56 -0700 | [diff] [blame] | 279 | (message_len <= UINT16_MAX) ? (uint16_t)message_len : UINT16_MAX); |
Mark Salyzyn | 88fe7cc | 2015-02-09 08:21:05 -0800 | [diff] [blame] | 280 | if (rc >= 0) { |
Hao Wang | 10d19f6 | 2017-12-04 14:10:40 +0800 | [diff] [blame] | 281 | notify |= 1 << LOG_ID_EVENTS; |
Mark Salyzyn | 88fe7cc | 2015-02-09 08:21:05 -0800 | [diff] [blame] | 282 | } |
Mark Salyzyn | ebaf2d6 | 2015-10-02 09:22:52 -0700 | [diff] [blame] | 283 | // end scope for event buffer |
William Roberts | 210c584 | 2013-02-08 09:45:26 +0900 | [diff] [blame] | 284 | } |
| 285 | |
Mark Salyzyn | 380423a | 2014-05-27 10:06:34 -0700 | [diff] [blame] | 286 | // log to main |
| 287 | |
| 288 | static const char comm_str[] = " comm=\""; |
Mark Salyzyn | 6505953 | 2017-03-10 14:31:54 -0800 | [diff] [blame] | 289 | const char* comm = strstr(str, comm_str); |
| 290 | const char* estr = str + strlen(str); |
Yi Kong | 36feb15 | 2018-07-13 17:39:22 -0700 | [diff] [blame] | 291 | const char* commfree = nullptr; |
Mark Salyzyn | 380423a | 2014-05-27 10:06:34 -0700 | [diff] [blame] | 292 | if (comm) { |
| 293 | estr = comm; |
| 294 | comm += sizeof(comm_str) - 1; |
| 295 | } else if (pid == getpid()) { |
| 296 | pid = tid; |
| 297 | comm = "auditd"; |
Mark Salyzyn | 059b758 | 2015-06-24 16:22:54 -0700 | [diff] [blame] | 298 | } else { |
Tom Cherry | 479b503 | 2020-05-07 14:44:43 -0700 | [diff] [blame] | 299 | comm = commfree = stats_->PidToName(pid); |
Mark Salyzyn | 059b758 | 2015-06-24 16:22:54 -0700 | [diff] [blame] | 300 | if (!comm) { |
| 301 | comm = "unknown"; |
| 302 | } |
Mark Salyzyn | 380423a | 2014-05-27 10:06:34 -0700 | [diff] [blame] | 303 | } |
| 304 | |
Mark Salyzyn | 6505953 | 2017-03-10 14:31:54 -0800 | [diff] [blame] | 305 | const char* ecomm = strchr(comm, '"'); |
Mark Salyzyn | 380423a | 2014-05-27 10:06:34 -0700 | [diff] [blame] | 306 | if (ecomm) { |
| 307 | ++ecomm; |
Max Bires | 9cf521b | 2017-08-15 11:07:49 -0700 | [diff] [blame] | 308 | str_len = ecomm - comm; |
Mark Salyzyn | 380423a | 2014-05-27 10:06:34 -0700 | [diff] [blame] | 309 | } else { |
Max Bires | 9cf521b | 2017-08-15 11:07:49 -0700 | [diff] [blame] | 310 | str_len = strlen(comm) + 1; |
Mark Salyzyn | 380423a | 2014-05-27 10:06:34 -0700 | [diff] [blame] | 311 | ecomm = ""; |
| 312 | } |
Max Bires | 9cf521b | 2017-08-15 11:07:49 -0700 | [diff] [blame] | 313 | size_t prefix_len = estr - str; |
| 314 | if (prefix_len > LOGGER_ENTRY_MAX_PAYLOAD) { |
| 315 | prefix_len = LOGGER_ENTRY_MAX_PAYLOAD; |
Mark Salyzyn | ebaf2d6 | 2015-10-02 09:22:52 -0700 | [diff] [blame] | 316 | } |
Max Bires | 9cf521b | 2017-08-15 11:07:49 -0700 | [diff] [blame] | 317 | size_t suffix_len = strnlen(ecomm, LOGGER_ENTRY_MAX_PAYLOAD - prefix_len); |
Jeff Vander Stoep | 78beb5e | 2018-05-03 14:57:39 -0700 | [diff] [blame] | 318 | message_len = |
| 319 | str_len + prefix_len + suffix_len + denial_metadata.length() + 2; |
Mark Salyzyn | 380423a | 2014-05-27 10:06:34 -0700 | [diff] [blame] | 320 | |
Mark Salyzyn | 6505953 | 2017-03-10 14:31:54 -0800 | [diff] [blame] | 321 | if (main) { // begin scope for main buffer |
Max Bires | 9cf521b | 2017-08-15 11:07:49 -0700 | [diff] [blame] | 322 | char newstr[message_len]; |
Mark Salyzyn | ebaf2d6 | 2015-10-02 09:22:52 -0700 | [diff] [blame] | 323 | |
Mark Salyzyn | 2904c7f | 2014-09-19 11:59:42 -0700 | [diff] [blame] | 324 | *newstr = info ? ANDROID_LOG_INFO : ANDROID_LOG_WARN; |
Max Bires | 9cf521b | 2017-08-15 11:07:49 -0700 | [diff] [blame] | 325 | strlcpy(newstr + 1, comm, str_len); |
| 326 | strncpy(newstr + 1 + str_len, str, prefix_len); |
| 327 | strncpy(newstr + 1 + str_len + prefix_len, ecomm, suffix_len); |
| 328 | strncpy(newstr + 1 + str_len + prefix_len + suffix_len, |
Jeff Vander Stoep | 78beb5e | 2018-05-03 14:57:39 -0700 | [diff] [blame] | 329 | denial_metadata.c_str(), denial_metadata.length()); |
Mark Salyzyn | 380423a | 2014-05-27 10:06:34 -0700 | [diff] [blame] | 330 | |
Chih-Hung Hsieh | 9ff8155 | 2018-08-13 14:22:56 -0700 | [diff] [blame] | 331 | rc = logbuf->log( |
| 332 | LOG_ID_MAIN, now, uid, pid, tid, newstr, |
| 333 | (message_len <= UINT16_MAX) ? (uint16_t)message_len : UINT16_MAX); |
Mark Salyzyn | 380423a | 2014-05-27 10:06:34 -0700 | [diff] [blame] | 334 | |
Mark Salyzyn | 88fe7cc | 2015-02-09 08:21:05 -0800 | [diff] [blame] | 335 | if (rc >= 0) { |
Hao Wang | 10d19f6 | 2017-12-04 14:10:40 +0800 | [diff] [blame] | 336 | notify |= 1 << LOG_ID_MAIN; |
Mark Salyzyn | 88fe7cc | 2015-02-09 08:21:05 -0800 | [diff] [blame] | 337 | } |
Mark Salyzyn | ebaf2d6 | 2015-10-02 09:22:52 -0700 | [diff] [blame] | 338 | // end scope for main buffer |
Mark Salyzyn | 380423a | 2014-05-27 10:06:34 -0700 | [diff] [blame] | 339 | } |
| 340 | |
Mark Salyzyn | 6505953 | 2017-03-10 14:31:54 -0800 | [diff] [blame] | 341 | free(const_cast<char*>(commfree)); |
William Roberts | 210c584 | 2013-02-08 09:45:26 +0900 | [diff] [blame] | 342 | free(str); |
| 343 | |
Mark Salyzyn | 380423a | 2014-05-27 10:06:34 -0700 | [diff] [blame] | 344 | if (notify) { |
Mark Salyzyn | 88fe7cc | 2015-02-09 08:21:05 -0800 | [diff] [blame] | 345 | if (rc < 0) { |
Max Bires | 9cf521b | 2017-08-15 11:07:49 -0700 | [diff] [blame] | 346 | rc = message_len; |
Mark Salyzyn | 88fe7cc | 2015-02-09 08:21:05 -0800 | [diff] [blame] | 347 | } |
Mark Salyzyn | 380423a | 2014-05-27 10:06:34 -0700 | [diff] [blame] | 348 | } |
William Roberts | 210c584 | 2013-02-08 09:45:26 +0900 | [diff] [blame] | 349 | |
| 350 | return rc; |
| 351 | } |
| 352 | |
Mark Salyzyn | 6505953 | 2017-03-10 14:31:54 -0800 | [diff] [blame] | 353 | int LogAudit::log(char* buf, size_t len) { |
| 354 | char* audit = strstr(buf, " audit("); |
Mark Salyzyn | fd2c1cc | 2015-09-04 11:37:42 -0700 | [diff] [blame] | 355 | if (!audit || (audit >= &buf[len])) { |
Mark Salyzyn | e73a18b | 2014-10-15 08:49:39 -0700 | [diff] [blame] | 356 | return 0; |
William Roberts | 210c584 | 2013-02-08 09:45:26 +0900 | [diff] [blame] | 357 | } |
| 358 | |
Mark Salyzyn | 78956ab | 2014-10-13 09:59:37 -0700 | [diff] [blame] | 359 | *audit = '\0'; |
William Roberts | 210c584 | 2013-02-08 09:45:26 +0900 | [diff] [blame] | 360 | |
Mark Salyzyn | 78956ab | 2014-10-13 09:59:37 -0700 | [diff] [blame] | 361 | int rc; |
Mark Salyzyn | 6505953 | 2017-03-10 14:31:54 -0800 | [diff] [blame] | 362 | char* type = strstr(buf, "type="); |
Mark Salyzyn | fd2c1cc | 2015-09-04 11:37:42 -0700 | [diff] [blame] | 363 | if (type && (type < &buf[len])) { |
Mark Salyzyn | 78956ab | 2014-10-13 09:59:37 -0700 | [diff] [blame] | 364 | rc = logPrint("%s %s", type, audit + 1); |
| 365 | } else { |
| 366 | rc = logPrint("%s", audit + 1); |
William Roberts | 210c584 | 2013-02-08 09:45:26 +0900 | [diff] [blame] | 367 | } |
Mark Salyzyn | 78956ab | 2014-10-13 09:59:37 -0700 | [diff] [blame] | 368 | *audit = ' '; |
| 369 | return rc; |
William Roberts | 210c584 | 2013-02-08 09:45:26 +0900 | [diff] [blame] | 370 | } |
| 371 | |
| 372 | int LogAudit::getLogSocket() { |
| 373 | int fd = audit_open(); |
| 374 | if (fd < 0) { |
| 375 | return fd; |
| 376 | } |
Nick Kralevich | d877405 | 2014-11-19 13:33:22 -0800 | [diff] [blame] | 377 | if (audit_setup(fd, getpid()) < 0) { |
William Roberts | 210c584 | 2013-02-08 09:45:26 +0900 | [diff] [blame] | 378 | audit_close(fd); |
| 379 | fd = -1; |
| 380 | } |
William Roberts | 210c584 | 2013-02-08 09:45:26 +0900 | [diff] [blame] | 381 | return fd; |
| 382 | } |