33 changes: 0 additions & 33 deletions auditd/fieldtab.h
View file

This file was deleted.

169 changes: 6 additions & 163 deletions auditd/libaudit.c
View file
Expand Up @@ -22,18 +22,12 @@
#include <string.h>
#include <unistd.h>
#include <stdint.h>
#include <stdlib.h>
#include <sys/types.h>
#include <pwd.h>
#include <grp.h>
#include <ctype.h>

#define LOG_TAG "libaudit"
#include <cutils/log.h>
#include <cutils/klog.h>

#include "libaudit.h"
#include "fields.h"

/**
* Copies the netlink message data to the reply structure.
Expand Down Expand Up @@ -143,7 +137,7 @@ static int get_ack(int fd, int16_t seq)
* @return
* This function returns a positive sequence number on success, else -errno.
*/
int audit_send(int fd, int type, const void *data, unsigned int size)
static int audit_send(int fd, int type, const void *data, unsigned int size)
{
int rc;
static int16_t sequence = 0;
Expand Down Expand Up @@ -226,154 +220,6 @@ int audit_send(int fd, int type, const void *data, unsigned int size)
return rc;
}

int audit_update_watch_perms(struct audit_rule_data *rule, int perms)
{
uint32_t i;

if (rule == NULL) {
return -EINVAL;
}

for (i = 0; i < rule->field_count; i++) {
if (rule->fields[i] == AUDIT_PERM) {
rule->values[i] = perms;
break;
}
}

if (rule->fields[i] == AUDIT_PERM) {
return 0;
}

if (rule->field_count > AUDIT_MAX_FIELDS - 1) {
return -2;
}

rule->fields[rule->field_count] = AUDIT_PERM;
rule->fieldflags[rule->field_count] = AUDIT_EQUAL;
rule->values[rule->field_count] = perms;
rule->field_count++;

return 0;
}

int audit_add_field(struct audit_rule_data *rule, int field, int oper, char *value)
{
int i;
struct passwd *pw;
struct group *gr;

if (rule == NULL) {
return -EINVAL;
}

if (rule->field_count > AUDIT_MAX_FIELDS - 1) {
return -2;
}

rule->fields[rule->field_count] = field;
rule->fieldflags[rule->field_count] = oper;

switch(field) {
case AUDIT_UID:
case AUDIT_EUID:
case AUDIT_SUID:
case AUDIT_FSUID:
case AUDIT_LOGINUID:
if (isdigit(value[0])) {
rule->values[rule->field_count] = strtoul(value, NULL, 0);
} else {
pw = getpwnam(value);
if (pw == NULL) {
SLOGE("Unknown user %s", value);
return -1;
}
rule->values[rule->field_count] = pw->pw_uid;
}
break;
case AUDIT_GID:
case AUDIT_EGID:
case AUDIT_SGID:
case AUDIT_FSGID:
if (isdigit(value[0])) {
rule->values[rule->field_count] = strtoul(value, NULL, 0);
} else {
gr = getgrnam(value);
if (gr == NULL) {
SLOGE("Unknown group %s", value);
return -1;
}
rule->values[rule->field_count] = gr->gr_gid;
}
break;
case AUDIT_SUCCESS:
// According to the auditctl man page success should only have 0 or 1
if (strcmp(value, "0") == 0 || strcmp(value, "1") == 0) {
rule->values[rule->field_count] = strtoul(value, NULL, 0);
} else {
SLOGE("Invalid value %s for success field", value);
return -1;
}
break;
default:
SLOGE("Unsupported field: %s", audit_field_to_string(field));
return -1;
}

rule->field_count++;
return 0;
}

int audit_add_dir(struct audit_rule_data **rulep, const char *path)
{
int len = strlen(path);
struct audit_rule_data *rule;

if (rulep == NULL) {
return -EINVAL;
}
*rulep = calloc(1, sizeof(*rule) + len);
rule = *rulep;
if (!rule) {
SLOGE("Out of memory");
return -1;
}

rule->flags = AUDIT_FILTER_EXIT;
rule->action = AUDIT_ALWAYS;
rule->field_count = 2;

rule->mask[0] = ~0;
rule->fields[0] = AUDIT_DIR;
rule->fieldflags[0] = AUDIT_EQUAL;
rule->values[0] = len;

rule->mask[1] = ~0;
rule->fields[1] = AUDIT_PERM;
rule->fieldflags[1] = AUDIT_EQUAL;
rule->values[1] = AUDIT_PERM_READ | AUDIT_PERM_WRITE |
AUDIT_PERM_EXEC | AUDIT_PERM_ATTR;

rule->buflen = len;
memcpy(&rule->buf[0], path, len);

return 0;
}

int audit_set_enabled(int fd, uint32_t state)
{
if (state > AUDIT_LOCKED) {
return -1;
}

struct audit_status s;
memset(&s, 0, sizeof(s));
s.mask = AUDIT_STATUS_ENABLED;
s.enabled = state;

return audit_send(fd, AUDIT_SET, &s, sizeof(s));
}

int audit_set_pid(int fd, uint32_t pid, rep_wait_t wmode)
{
int rc;
Expand Down Expand Up @@ -450,15 +296,12 @@ int audit_get_reply(int fd, struct audit_reply *rep, reply_t block, int peek)
* another error manifests.
*/
if (len < 0 && errno != EINTR) {
if (errno == EAGAIN) {
if (block == GET_REPLY_NONBLOCKING) {
/* If the request is non blocking and the errno is EAGAIN, just return 0 */
return 0;
}
} else {
SLOGE("Error receiving from netlink socket, error: %s", strerror(errno));
return -errno;
if (block == GET_REPLY_NONBLOCKING && errno == EAGAIN) {
/* If the request is non blocking and the errno is EAGAIN, just return 0 */
return 0;
}
SLOGE("Error receiving from netlink socket, error: %s", strerror(errno));
return -errno;
}

/* 0 or greater indicates success */
Expand Down
68 changes: 0 additions & 68 deletions auditd/libaudit.h
View file
Expand Up @@ -27,10 +27,6 @@

#define MAX_AUDIT_MESSAGE_LENGTH 8970

#define AUDIT_OFF 0
#define AUDIT_ON 1
#define AUDIT_LOCKED 2

typedef enum {
GET_REPLY_BLOCKING=0,
GET_REPLY_NONBLOCKING
Expand Down Expand Up @@ -112,68 +108,4 @@ extern int audit_get_reply(int fd, struct audit_reply *rep, reply_t block,
*/
extern int audit_set_pid(int fd, uint32_t pid, rep_wait_t wmode);

/**
* Sends a command to the audit netlink socket
* @param fd
* The fd returned by a call to audit_open()
* @param type
* message type, see audit.h in the kernel
* @param data
* opaque data pointer
* @param size
* size of data in *data
* @return
* This function returns 0 on success, -errno on error.
*/
extern int audit_send(int fd, int type, const void *data, unsigned int size);

/**
* Allocates a rule and adds a directory to watch, defaults to all permissions.
* Call audit_update_watch_perms() subsequently to update permissions.
* @param rulep
* double pointer to an unallocated audit_rule_data, which will be allocated. This must be freed
* @param path
* path to add to the rule
* @return
* This function returns 0 on success, -errno on error.
*/
extern int audit_add_dir(struct audit_rule_data **rulep, const char *path);

/**
* Sets enabled flag, 0 for audit off, 1 for audit on, 2 for audit locked
* @param fd
* file descripter returned by audit_open()
* @param state
* 0 for audit off, 1 for audit on, 2 for audit locked
* @return
* This function returns 0 on success, -errno on error, -1 if already locked
*/
extern int audit_set_enabled(int fd, uint32_t state);

/**
* Sets permissions for an already allocated watch rule
* @param rule
* rule to set permissions on
* @param perms
* permissions to set, AUDIT_PERM_{READ,WRITE,EXEC,ATTR}
* @return
* This function returns 0 on success, -1 if rule is NULL and -2 if there are too many fields
*/
extern int audit_update_watch_perms(struct audit_rule_data *rule, int perms);

/**
* Sets permissions for an already allocated watch rule
* @param rule
* rule to add field to
* @param field
* field from audit.h AUDIT_PID...AUDIT_FILETYPE
* @param oper
* operator from audit.h AUDIT_EQUAL|AUDIT_NOT_EQUAL|AUDIT_BIT_MASK
* @param value
* value to match for the field (e.g., uid=1000, 1000 is the value)
* @return
* This function returns 0 on success, -1 if rule is NULL and -2 if there are too many fields
*/
extern int audit_add_field(struct audit_rule_data *rule, int field, int oper, char *value);

#endif