/*- * Copyright 2018 Aniket Pandey * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY * SUCH DAMAGE. */ #include <sys/types.h> #include <sys/extattr.h> #include <sys/ioctl.h> #include <bsm/libbsm.h> #include <bsm/auditd_lib.h> #include <security/audit/audit_ioctl.h> #include <atf-c.h> #include <errno.h> #include <fcntl.h> #include <stdlib.h> #include <string.h> #include <time.h> #include <unistd.h> #include "utils.h" /* * Checks the presence of "auditregex" in auditpipe(4) after the * corresponding system call has been triggered. */ static bool get_records(const char *auditregex, FILE *pipestream) { uint8_t *buff; tokenstr_t token; ssize_t size = 1024; char membuff[size]; char del[] = ","; int reclen, bytes = 0; FILE *memstream; /* * Open a stream on 'membuff' (address to memory buffer) for storing * the audit records in the default mode.'reclen' is the length of the * available records from auditpipe which is passed to the functions * au_fetch_tok(3) and au_print_flags_tok(3) for further use. */ ATF_REQUIRE((memstream = fmemopen(membuff, size, "w")) != NULL); ATF_REQUIRE((reclen = au_read_rec(pipestream, &buff)) != -1); /* * Iterate through each BSM token, extracting the bits that are * required to start processing the token sequences. */ while (bytes < reclen) { if (au_fetch_tok(&token, buff + bytes, reclen - bytes) == -1) { perror("au_read_rec"); atf_tc_fail("Incomplete Audit Record"); } /* Print the tokens as they are obtained, in the default form */ au_print_flags_tok(memstream, &token, del, AU_OFLAG_NONE); fputc(',', memstream); bytes += token.len; } free(buff); ATF_REQUIRE_EQ(0, fclose(memstream)); return (atf_utils_grep_string("%s", membuff, auditregex)); } /* * Override the system-wide audit mask settings in /etc/security/audit_control * and set the auditpipe's maximum allowed queue length limit */ static void set_preselect_mode(int filedesc, au_mask_t *fmask) { int qlimit_max; int fmode = AUDITPIPE_PRESELECT_MODE_LOCAL; /* Set local preselection mode for auditing */ if (ioctl(filedesc, AUDITPIPE_SET_PRESELECT_MODE, &fmode) < 0) atf_tc_fail("Preselection mode: %s", strerror(errno)); /* Set local preselection flag corresponding to the audit_event */ if (ioctl(filedesc, AUDITPIPE_SET_PRESELECT_FLAGS, fmask) < 0) atf_tc_fail("Preselection flag: %s", strerror(errno)); /* Set local preselection flag for non-attributable audit_events */ if (ioctl(filedesc, AUDITPIPE_SET_PRESELECT_NAFLAGS, fmask) < 0) atf_tc_fail("Preselection naflag: %s", strerror(errno)); /* Query the maximum possible queue length limit for auditpipe */ if (ioctl(filedesc, AUDITPIPE_GET_QLIMIT_MAX, &qlimit_max) < 0) atf_tc_fail("Query max-limit: %s", strerror(errno)); /* Set the queue length limit as obtained from previous step */ if (ioctl(filedesc, AUDITPIPE_SET_QLIMIT, &qlimit_max) < 0) atf_tc_fail("Set max-qlimit: %s", strerror(errno)); /* This removes any outstanding record on the auditpipe */ if (ioctl(filedesc, AUDITPIPE_FLUSH) < 0) atf_tc_fail("Auditpipe flush: %s", strerror(errno)); } /* * Get the corresponding audit_mask for class-name "name" then set the * success and failure bits for fmask to be used as the ioctl argument */ static au_mask_t get_audit_mask(const char *name) { au_mask_t fmask; au_class_ent_t *class; ATF_REQUIRE((class = getauclassnam(name)) != NULL); fmask.am_success = class->ac_class; fmask.am_failure = class->ac_class; return (fmask); } /* * Loop until the auditpipe returns something, check if it is what * we want, else repeat the procedure until ppoll(2) times out. */ static void check_auditpipe(struct pollfd fd[], const char *auditregex, FILE *pipestream) { struct timespec currtime, endtime, timeout; /* Set the expire time for poll(2) while waiting for syscall audit */ ATF_REQUIRE_EQ(0, clock_gettime(CLOCK_MONOTONIC, &endtime)); /* Set limit to 30 seconds total and ~10s without an event. */ endtime.tv_sec += 30; for (;;) { /* Update the time left for auditpipe to return any event */ ATF_REQUIRE_EQ(0, clock_gettime(CLOCK_MONOTONIC, &currtime)); timespecsub(&endtime, &currtime, &timeout); timeout.tv_sec = MIN(timeout.tv_sec, 9); if (timeout.tv_sec < 0) { atf_tc_fail("%s not found in auditpipe within the " "time limit", auditregex); } switch (ppoll(fd, 1, &timeout, NULL)) { /* ppoll(2) returns, check if it's what we want */ case 1: if (fd[0].revents & POLLIN) { if (get_records(auditregex, pipestream)) return; } else { atf_tc_fail("Auditpipe returned an " "unknown event %#x", fd[0].revents); } break; /* poll(2) timed out */ case 0: atf_tc_fail("%s not found in auditpipe within the " "time limit", auditregex); break; /* poll(2) standard error */ case -1: atf_tc_fail("Poll: %s", strerror(errno)); break; default: atf_tc_fail("Poll returned too many file descriptors"); } } } /* * Wrapper functions around static "check_auditpipe" */ static void check_audit_startup(struct pollfd fd[], const char *auditrgx, FILE *pipestream){ check_auditpipe(fd, auditrgx, pipestream); } void check_audit(struct pollfd fd[], const char *auditrgx, FILE *pipestream) { check_auditpipe(fd, auditrgx, pipestream); /* Teardown: /dev/auditpipe's instance opened for this test-suite */ ATF_REQUIRE_EQ(0, fclose(pipestream)); } void skip_if_extattr_not_supported(const char *path) { ssize_t result; /* * Some file systems (e.g. tmpfs) do not support extattr, so we need * skip tests that use extattrs. To detect this we can check whether * the extattr_list_file returns EOPNOTSUPP. */ result = extattr_list_file(path, EXTATTR_NAMESPACE_USER, NULL, 0); if (result == -1 && errno == EOPNOTSUPP) { atf_tc_skip("File system does not support extattrs."); } } static bool is_auditd_running(void) { int trigger; int err; /* * AUDIT_TRIGGER_INITIALIZE is a no-op message on FreeBSD and can * therefore be used to check whether auditd has already been started. * This is significantly cheaper than running `service auditd onestatus` * for each test case. It is also slightly less racy since it will only * return true once auditd() has opened the trigger file rather than * just when the pidfile has been created. */ trigger = AUDIT_TRIGGER_INITIALIZE; err = auditon(A_SENDTRIGGER, &trigger, sizeof(trigger)); if (err == 0) { fprintf(stderr, "auditd(8) is running.\n"); return (true); } else { /* * A_SENDTRIGGER returns ENODEV if auditd isn't listening, * all other error codes indicate a fatal error. */ ATF_REQUIRE_MSG(errno == ENODEV, "Unexpected error from auditon(2): %s", strerror(errno)); return (false); } } FILE * setup(struct pollfd fd[], const char *name) { au_mask_t fmask, nomask; FILE *pipestream; fmask = get_audit_mask(name); nomask = get_audit_mask("no"); ATF_REQUIRE((fd[0].fd = open("/dev/auditpipe", O_RDONLY)) != -1); ATF_REQUIRE((pipestream = fdopen(fd[0].fd, "r")) != NULL); fd[0].events = POLLIN; /* * Disable stream buffering for read operations from /dev/auditpipe. * Otherwise it is possible that fread(3), called via au_read_rec(3), * can store buffered data in user-space unbeknown to ppoll(2), which * as a result, reports that /dev/auditpipe is empty. */ ATF_REQUIRE_EQ(0, setvbuf(pipestream, NULL, _IONBF, 0)); /* Set local preselection audit_class as "no" for audit startup */ set_preselect_mode(fd[0].fd, &nomask); if (!is_auditd_running()) { fprintf(stderr, "Running audit_quick_start() for testing... "); /* * Previously, this test started auditd using * `service auditd onestart`. However, there is a race condition * there since service can return before auditd(8) has * fully started (once the daemon parent process has forked) * and this can cause check_audit_startup() to fail sometimes. * * In the CheriBSD CI this caused the first test executed by * kyua (administrative:acct_failure) to fail every time, but * subsequent ones would almost always succeed. * * To avoid this problem (and as a nice side-effect this speeds * up the test quite a bit), we register this process as a * "fake" auditd(8) using the audit_quick_start() function from * libauditd. */ atf_utils_create_file("started_fake_auditd", "yes\n"); ATF_REQUIRE(atf_utils_file_exists("started_fake_auditd")); ATF_REQUIRE_EQ_MSG(0, audit_quick_start(), "Failed to start fake auditd: %m"); fprintf(stderr, "done.\n"); /* audit_quick_start() should log an audit start event. */ check_audit_startup(fd, "audit startup", pipestream); /* * If we exit cleanly shutdown audit_quick_start(), if not * cleanup() will take care of it. * This is not required, but makes it easier to run individual * tests outside of kyua. */ atexit(cleanup); } /* Set local preselection parameters specific to "name" audit_class */ set_preselect_mode(fd[0].fd, &fmask); return (pipestream); } void cleanup(void) { if (atf_utils_file_exists("started_fake_auditd")) { fprintf(stderr, "Running audit_quick_stop()... "); if (audit_quick_stop() != 0) { fprintf(stderr, "Failed to stop fake auditd: %m\n"); abort(); } fprintf(stderr, "done.\n"); unlink("started_fake_auditd"); } }
