William Roberts | 29d238d | 2013-02-08 09:45:26 +0900 | [diff] [blame] | 1 | /* |
| 2 | * Copyright (C) 2014 The Android Open Source Project |
| 3 | * |
| 4 | * Licensed under the Apache License, Version 2.0 (the "License"); |
| 5 | * you may not use this file except in compliance with the License. |
| 6 | * You may obtain a copy of the License at |
| 7 | * |
| 8 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 9 | * |
| 10 | * Unless required by applicable law or agreed to in writing, software |
| 11 | * distributed under the License is distributed on an "AS IS" BASIS, |
| 12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 13 | * See the License for the specific language governing permissions and |
| 14 | * limitations under the License. |
| 15 | */ |
| 16 | |
| 17 | #include <ctype.h> |
| 18 | #include <errno.h> |
| 19 | #include <stdarg.h> |
| 20 | #include <stdlib.h> |
| 21 | #include <sys/klog.h> |
Mark Salyzyn | 8daa9af | 2014-04-28 14:07:23 -0700 | [diff] [blame^] | 22 | #include <sys/prctl.h> |
Mark Salyzyn | e9bebd0 | 2014-04-03 09:55:26 -0700 | [diff] [blame] | 23 | #include <sys/uio.h> |
William Roberts | 29d238d | 2013-02-08 09:45:26 +0900 | [diff] [blame] | 24 | |
| 25 | #include "libaudit.h" |
| 26 | #include "LogAudit.h" |
| 27 | |
Mark Salyzyn | e9bebd0 | 2014-04-03 09:55:26 -0700 | [diff] [blame] | 28 | LogAudit::LogAudit(LogBuffer *buf, LogReader *reader, int fdDmsg) |
William Roberts | 29d238d | 2013-02-08 09:45:26 +0900 | [diff] [blame] | 29 | : SocketListener(getLogSocket(), false) |
| 30 | , logbuf(buf) |
Mark Salyzyn | e9bebd0 | 2014-04-03 09:55:26 -0700 | [diff] [blame] | 31 | , reader(reader) |
| 32 | , fdDmesg(-1) { |
| 33 | logDmesg(); |
| 34 | fdDmesg = fdDmsg; |
William Roberts | 29d238d | 2013-02-08 09:45:26 +0900 | [diff] [blame] | 35 | } |
| 36 | |
| 37 | bool LogAudit::onDataAvailable(SocketClient *cli) { |
Mark Salyzyn | 8daa9af | 2014-04-28 14:07:23 -0700 | [diff] [blame^] | 38 | prctl(PR_SET_NAME, "logd.auditd"); |
| 39 | |
William Roberts | 29d238d | 2013-02-08 09:45:26 +0900 | [diff] [blame] | 40 | struct audit_message rep; |
| 41 | |
| 42 | if (audit_get_reply(cli->getSocket(), &rep, GET_REPLY_BLOCKING, 0) < 0) { |
| 43 | SLOGE("Failed on audit_get_reply with error: %s", strerror(errno)); |
| 44 | return false; |
| 45 | } |
| 46 | |
| 47 | logPrint("type=%d %.*s", rep.nlh.nlmsg_type, rep.nlh.nlmsg_len, rep.data); |
| 48 | |
| 49 | return true; |
| 50 | } |
| 51 | |
| 52 | #define AUDIT_LOG_ID LOG_ID_MAIN |
| 53 | #define AUDIT_LOG_PRIO ANDROID_LOG_WARN |
| 54 | |
| 55 | int LogAudit::logPrint(const char *fmt, ...) { |
| 56 | if (fmt == NULL) { |
| 57 | return -EINVAL; |
| 58 | } |
| 59 | |
| 60 | va_list args; |
| 61 | |
| 62 | char *str = NULL; |
| 63 | va_start(args, fmt); |
| 64 | int rc = vasprintf(&str, fmt, args); |
| 65 | va_end(args); |
| 66 | |
| 67 | if (rc < 0) { |
| 68 | return rc; |
| 69 | } |
| 70 | |
Mark Salyzyn | e9bebd0 | 2014-04-03 09:55:26 -0700 | [diff] [blame] | 71 | if (fdDmesg >= 0) { |
| 72 | struct iovec iov[2]; |
| 73 | |
| 74 | iov[0].iov_base = str; |
| 75 | iov[0].iov_len = strlen(str); |
| 76 | iov[1].iov_base = const_cast<char *>("\n"); |
| 77 | iov[1].iov_len = 1; |
| 78 | |
| 79 | writev(fdDmesg, iov, sizeof(iov) / sizeof(iov[0])); |
| 80 | } |
| 81 | |
William Roberts | 29d238d | 2013-02-08 09:45:26 +0900 | [diff] [blame] | 82 | pid_t pid = getpid(); |
| 83 | pid_t tid = gettid(); |
| 84 | uid_t uid = getuid(); |
| 85 | log_time now; |
| 86 | |
| 87 | static const char audit_str[] = " audit("; |
| 88 | char *timeptr = strstr(str, audit_str); |
| 89 | char *cp; |
| 90 | if (timeptr |
| 91 | && ((cp = now.strptime(timeptr + sizeof(audit_str) - 1, "%s.%q"))) |
| 92 | && (*cp == ':')) { |
| 93 | memcpy(timeptr + sizeof(audit_str) - 1, "0.0", 3); |
| 94 | strcpy(timeptr + sizeof(audit_str) - 1 + 3, cp); |
| 95 | } else { |
| 96 | now.strptime("", ""); // side effect of setting CLOCK_REALTIME |
| 97 | } |
| 98 | |
| 99 | static const char pid_str[] = " pid="; |
| 100 | char *pidptr = strstr(str, pid_str); |
| 101 | if (pidptr && isdigit(pidptr[sizeof(pid_str) - 1])) { |
| 102 | cp = pidptr + sizeof(pid_str) - 1; |
| 103 | pid = 0; |
| 104 | while (isdigit(*cp)) { |
| 105 | pid = (pid * 10) + (*cp - '0'); |
| 106 | ++cp; |
| 107 | } |
| 108 | tid = pid; |
| 109 | uid = logbuf->pidToUid(pid); |
| 110 | strcpy(pidptr, cp); |
| 111 | } |
| 112 | |
| 113 | static const char comm_str[] = " comm=\""; |
| 114 | char *comm = strstr(str, comm_str); |
| 115 | if (comm) { |
| 116 | cp = comm; |
| 117 | comm += sizeof(comm_str) - 1; |
| 118 | char *ecomm = strchr(comm, '"'); |
| 119 | if (ecomm) { |
| 120 | *ecomm = '\0'; |
| 121 | } |
| 122 | comm = strdup(comm); |
| 123 | if (ecomm) { |
| 124 | strcpy(cp, ecomm + 1); |
| 125 | } |
| 126 | } else if (pid == getpid()) { |
| 127 | pid = tid; |
| 128 | comm = strdup("auditd"); |
| 129 | } else if (!(comm = logbuf->pidToName(pid))) { |
| 130 | comm = strdup("unknown"); |
| 131 | } |
| 132 | |
| 133 | size_t l = strlen(comm) + 1; |
| 134 | size_t n = l + strlen(str) + 2; |
| 135 | |
| 136 | char *newstr = reinterpret_cast<char *>(malloc(n)); |
| 137 | if (!newstr) { |
| 138 | free(comm); |
| 139 | free(str); |
| 140 | return -ENOMEM; |
| 141 | } |
| 142 | |
| 143 | *newstr = AUDIT_LOG_PRIO; |
| 144 | strcpy(newstr + 1, comm); |
| 145 | free(comm); |
| 146 | strcpy(newstr + 1 + l, str); |
| 147 | free(str); |
| 148 | |
| 149 | unsigned short len = n; // cap to internal maximum |
| 150 | if (len != n) { |
| 151 | len = -1; |
| 152 | } |
| 153 | logbuf->log(AUDIT_LOG_ID, now, uid, pid, tid, newstr, len); |
| 154 | reader->notifyNewLog(); |
| 155 | |
| 156 | free(newstr); |
| 157 | |
| 158 | return rc; |
| 159 | } |
| 160 | |
Mark Salyzyn | e9bebd0 | 2014-04-03 09:55:26 -0700 | [diff] [blame] | 161 | void LogAudit::logDmesg() { |
William Roberts | 29d238d | 2013-02-08 09:45:26 +0900 | [diff] [blame] | 162 | int len = klogctl(KLOG_SIZE_BUFFER, NULL, 0); |
| 163 | if (len <= 0) { |
| 164 | return; |
| 165 | } |
| 166 | |
| 167 | len++; |
| 168 | char buf[len]; |
| 169 | |
| 170 | int rc = klogctl(KLOG_READ_ALL, buf, len); |
| 171 | |
| 172 | buf[len - 1] = '\0'; |
| 173 | |
| 174 | for(char *tok = buf; (rc >= 0) && ((tok = strtok(tok, "\r\n"))); tok = NULL) { |
| 175 | char *audit = strstr(tok, " audit("); |
| 176 | if (!audit) { |
| 177 | continue; |
| 178 | } |
| 179 | |
| 180 | *audit++ = '\0'; |
| 181 | |
| 182 | char *type = strstr(tok, "type="); |
| 183 | if (type) { |
| 184 | rc = logPrint("%s %s", type, audit); |
| 185 | } else { |
| 186 | rc = logPrint("%s", audit); |
| 187 | } |
| 188 | } |
| 189 | } |
| 190 | |
| 191 | int LogAudit::getLogSocket() { |
| 192 | int fd = audit_open(); |
| 193 | if (fd < 0) { |
| 194 | return fd; |
| 195 | } |
| 196 | if (audit_set_pid(fd, getpid(), WAIT_YES) < 0) { |
| 197 | audit_close(fd); |
| 198 | fd = -1; |
| 199 | } |
| 200 | return fd; |
| 201 | } |