logd/LogAudit.cpp

/*
 * Copyright (C) 2014 The Android Open Source Project
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

#include <ctype.h>
#include <errno.h>
#include <limits.h>
#include <stdarg.h>
#include <stdlib.h>
#include <sys/klog.h>
#include <sys/prctl.h>
#include <sys/uio.h>

#include "libaudit.h"
#include "LogAudit.h"

LogAudit::LogAudit(LogBuffer *buf, LogReader *reader, int fdDmsg)
        : SocketListener(getLogSocket(), false)
        , logbuf(buf)
        , reader(reader)
        , fdDmesg(-1) {
    logDmesg();
    fdDmesg = fdDmsg;
}

bool LogAudit::onDataAvailable(SocketClient *cli) {
    prctl(PR_SET_NAME, "logd.auditd");

    struct audit_message rep;

    rep.nlh.nlmsg_type = 0;
    rep.nlh.nlmsg_len = 0;
    rep.data[0] = '\0';

    if (audit_get_reply(cli->getSocket(), &rep, GET_REPLY_BLOCKING, 0) < 0) {
        SLOGE("Failed on audit_get_reply with error: %s", strerror(errno));
        return false;
    }

    logPrint("type=%d %.*s", rep.nlh.nlmsg_type, rep.nlh.nlmsg_len, rep.data);

    return true;
}

int LogAudit::logPrint(const char *fmt, ...) {
    if (fmt == NULL) {
        return -EINVAL;
    }

    va_list args;

    char *str = NULL;
    va_start(args, fmt);
    int rc = vasprintf(&str, fmt, args);
    va_end(args);

    if (rc < 0) {
        return rc;
    }

    char *cp;
    while ((cp = strstr(str, "  "))) {
        memmove(cp, cp + 1, strlen(cp + 1) + 1);
    }

    if (fdDmesg >= 0) {
        struct iovec iov[2];

        iov[0].iov_base = str;
        iov[0].iov_len = strlen(str);
        iov[1].iov_base = const_cast<char *>("\n");
        iov[1].iov_len = 1;

        writev(fdDmesg, iov, sizeof(iov) / sizeof(iov[0]));
    }

    pid_t pid = getpid();
    pid_t tid = gettid();
    uid_t uid = getuid();
    log_time now;

    static const char audit_str[] = " audit(";
    char *timeptr = strstr(str, audit_str);
    if (timeptr
            && ((cp = now.strptime(timeptr + sizeof(audit_str) - 1, "%s.%q")))
            && (*cp == ':')) {
        memcpy(timeptr + sizeof(audit_str) - 1, "0.0", 3);
        memmove(timeptr + sizeof(audit_str) - 1 + 3, cp, strlen(cp) + 1);
    } else {
        now.strptime("", ""); // side effect of setting CLOCK_REALTIME
    }

    static const char pid_str[] = " pid=";
    char *pidptr = strstr(str, pid_str);
    if (pidptr && isdigit(pidptr[sizeof(pid_str) - 1])) {
        cp = pidptr + sizeof(pid_str) - 1;
        pid = 0;
        while (isdigit(*cp)) {
            pid = (pid * 10) + (*cp - '0');
            ++cp;
        }
        tid = pid;
        uid = logbuf->pidToUid(pid);
        memmove(pidptr, cp, strlen(cp) + 1);
    }

    // log to events

    size_t l = strlen(str);
    size_t n = l + sizeof(uint32_t) + sizeof(uint8_t) + sizeof(uint32_t);

    bool notify = false;

    char *newstr = reinterpret_cast<char *>(malloc(n));
    if (!newstr) {
        rc = -ENOMEM;
    } else {
        cp = newstr;
        *cp++ = AUDITD_LOG_TAG & 0xFF;
        *cp++ = (AUDITD_LOG_TAG >> 8) & 0xFF;
        *cp++ = (AUDITD_LOG_TAG >> 16) & 0xFF;
        *cp++ = (AUDITD_LOG_TAG >> 24) & 0xFF;
        *cp++ = EVENT_TYPE_STRING;
        *cp++ = l & 0xFF;
        *cp++ = (l >> 8) & 0xFF;
        *cp++ = (l >> 16) & 0xFF;
        *cp++ = (l >> 24) & 0xFF;
        memcpy(cp, str, l);

        logbuf->log(LOG_ID_EVENTS, now, uid, pid, tid, newstr,
                    (n <= USHRT_MAX) ? (unsigned short) n : USHRT_MAX);
        free(newstr);

        notify = true;
    }

    // log to main

    static const char comm_str[] = " comm=\"";
    const char *comm = strstr(str, comm_str);
    const char *estr = str + strlen(str);
    if (comm) {
        estr = comm;
        comm += sizeof(comm_str) - 1;
    } else if (pid == getpid()) {
        pid = tid;
        comm = "auditd";
    } else if (!(comm = logbuf->pidToName(pid))) {
        comm = "unknown";
    }

    const char *ecomm = strchr(comm, '"');
    if (ecomm) {
        ++ecomm;
        l = ecomm - comm;
    } else {
        l = strlen(comm) + 1;
        ecomm = "";
    }
    n = (estr - str) + strlen(ecomm) + l + 2;

    newstr = reinterpret_cast<char *>(malloc(n));
    if (!newstr) {
        rc = -ENOMEM;
    } else {
        *newstr = (strstr(str, " permissive=1")
                || strstr(str, " policy loaded "))
                    ? ANDROID_LOG_INFO
                    : ANDROID_LOG_WARN;
        strlcpy(newstr + 1, comm, l);
        strncpy(newstr + 1 + l, str, estr - str);
        strcpy(newstr + 1 + l + (estr - str), ecomm);

        logbuf->log(LOG_ID_MAIN, now, uid, pid, tid, newstr,
                    (n <= USHRT_MAX) ? (unsigned short) n : USHRT_MAX);
        free(newstr);

        notify = true;
    }

    free(str);

    if (notify) {
        reader->notifyNewLog();
    }

    return rc;
}

void LogAudit::logDmesg() {
    int len = klogctl(KLOG_SIZE_BUFFER, NULL, 0);
    if (len <= 0) {
        return;
    }

    len++;
    char buf[len];

    int rc = klogctl(KLOG_READ_ALL, buf, len);

    buf[len - 1] = '\0';

    for(char *tok = buf; (rc >= 0) && ((tok = strtok(tok, "\r\n"))); tok = NULL) {
        char *audit = strstr(tok, " audit(");
        if (!audit) {
            continue;
        }

        *audit++ = '\0';

        char *type = strstr(tok, "type=");
        if (type) {
            rc = logPrint("%s %s", type, audit);
        } else {
            rc = logPrint("%s", audit);
        }
    }
}

int LogAudit::getLogSocket() {
    int fd = audit_open();
    if (fd < 0) {
        return fd;
    }
    if (audit_set_pid(fd, getpid(), WAIT_YES) < 0) {
        audit_close(fd);
        fd = -1;
    }
    return fd;
}