PERFORCE change 98281 for review

Robert Watson rwatson at FreeBSD.org
Thu Jun 1 15:16:12 PDT 2006


http://perforce.freebsd.org/chv.cgi?CH=98281

Change 98281 by rwatson at rwatson_zoo on 2006/06/01 22:11:59

	Modify auditfilterd to separately handle pipe files vs. audit trail
	files, as their buffering semantics are quite different.

Affected files ...

.. //depot/projects/trustedbsd/openbsm/bin/auditfilterd/auditfilterd.c#6 edit
.. //depot/projects/trustedbsd/openbsm/bin/auditfilterd/auditfilterd.h#3 edit
.. //depot/projects/trustedbsd/openbsm/bsm/audit_filter.h#2 edit

Differences ...

==== //depot/projects/trustedbsd/openbsm/bin/auditfilterd/auditfilterd.c#6 (text+ko) ====

@@ -25,10 +25,11 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $P4: //depot/projects/trustedbsd/openbsm/bin/auditfilterd/auditfilterd.c#5 $
+ * $P4: //depot/projects/trustedbsd/openbsm/bin/auditfilterd/auditfilterd.c#6 $
  */
 
 #include <sys/types.h>
+#include <sys/stat.h>
 #include <sys/time.h>
 
 #include <config/config.h>
@@ -66,12 +67,14 @@
 usage(void)
 {
 
-	fprintf(stderr, "auditfilterd [-c conffile] [-d] [-t trailfile]\n");
+	fprintf(stderr, "auditfilterd [-c conffile] [-d] [-p pipefile]"
+	    " [-t trailfile]\n");
 	fprintf(stderr, "  -c    Specify configuration file (default: %s)\n",
 	    AUDITFILTERD_CONFFILE);
 	fprintf(stderr, "  -d    Debugging mode, don't daemonize\n");
-	fprintf(stderr, "  -t    Specify audit trail file (default: %s)",
-	    AUDITFILTERD_TRAILFILE);
+	fprintf(stderr, "  -p    Specify pipe file (default: %s)\n",
+	    AUDITFILTERD_PIPEFILE);
+	fprintf(stderr, "  -t    Specify audit trail file (default: none)\n");
 	exit(-1);
 }
 
@@ -147,7 +150,7 @@
  * them to modules for processing.
  */
 static void
-mainloop(const char *conffile, const char *trailfile, FILE *trail_fp)
+mainloop_file(const char *conffile, const char *trailfile, FILE *trail_fp)
 {
 	struct timespec ts;
 	FILE *conf_fp;
@@ -184,10 +187,8 @@
 		 * more at the right blocking and signal behavior here.
 		 */
 		reclen = au_read_rec(trail_fp, &buf);
-		if (reclen == -1) {
-			sleep(1);
+		if (reclen == -1)
 			continue;
-		}
 		if (clock_gettime(CLOCK_REALTIME, &ts) < 0)
 			err(-1, "clock_gettime");
 		present_bsmrecord(&ts, buf, reclen);
@@ -196,16 +197,68 @@
 	}
 }
 
+/*
+ * The main loop spins pulling records out of the record source and passing
+ * them to modules for processing.  This version of the function accepts
+ * discrete record input from a file descriptor, as opposed to buffered input
+ * from a file stream.
+ */
+static void
+mainloop_pipe(const char *conffile, const char *pipefile, int pipe_fd)
+{
+	u_char record[MAX_AUDIT_RECORD_SIZE];
+	struct timespec ts;
+	FILE *conf_fp;
+	int reclen;
+
+	while (1) {
+		/*
+		 * On SIGHUP, we reread the configuration file.  Unlike with
+		 * a trail file, we don't reopen the pipe, as we don't want
+		 * to miss records which will be flushed if we do.
+		 */
+		if (reread_config) {
+			reread_config = 0;
+			warnx("rereading configuration");
+			conf_fp = fopen(conffile, "r");
+			if (conf_fp == NULL)
+				err(-1, "%s", conffile);
+			auditfilterd_conf(conffile, conf_fp);
+			fclose(conf_fp);
+		}
+		if (quit) {
+			warnx("quitting");
+			break;
+		}
+
+		/*
+		 * For now, be relatively unrobust about incomplete records,
+		 * but in the future will want to do better.  Need to look
+		 * more at the right blocking and signal behavior here.
+		 */
+		reclen = read(pipe_fd, record, MAX_AUDIT_RECORD_SIZE);
+		if (reclen < 0)
+			continue;
+		if (clock_gettime(CLOCK_REALTIME, &ts) < 0)
+			err(-1, "clock_gettime");
+		present_bsmrecord(&ts, record, reclen);
+		present_tokens(&ts, record, reclen);
+	}
+}
+
 int
 main(int argc, char *argv[])
 {
-	const char *trailfile, *conffile;
+	const char *pipefile, *trailfile, *conffile;
 	FILE *trail_fp, *conf_fp;
+	struct stat sb;
+	int pipe_fd;
 	int ch;
 
 	conffile = AUDITFILTERD_CONFFILE;
-	trailfile = AUDITFILTERD_TRAILFILE;
-	while ((ch = getopt(argc, argv, "c:dt:")) != -1) {
+	trailfile = NULL;
+	pipefile = NULL;
+	while ((ch = getopt(argc, argv, "c:dp:t:")) != -1) {
 		switch (ch) {
 		case 'c':
 			conffile = optarg;
@@ -216,9 +269,17 @@
 			break;
 
 		case 't':
+			if (trailfile != NULL || pipefile != NULL)
+				usage();
 			trailfile = optarg;
 			break;
 
+		case 'p':
+			if (pipefile != NULL || trailfile != NULL)
+				usage();
+			pipefile = optarg;
+			break;
+
 		default:
 			usage();
 		}
@@ -230,9 +291,26 @@
 	if (argc != 0)
 		usage();
 
-	trail_fp = fopen(trailfile, "r");
-	if (trail_fp == NULL)
-		err(-1, "%s", trailfile);
+	/*
+	 * We allow only one of a pipe or a trail to be used.  If none is
+	 * specified, we provide a default pipe path.
+	 */
+	if (pipefile == NULL && trailfile == NULL)
+		pipefile = AUDITFILTERD_PIPEFILE;
+
+	if (pipefile != NULL) {
+		pipe_fd = open(pipefile, O_RDONLY);
+		if (pipe_fd < 0)
+			err(-1, "open:%s", pipefile);
+		if (fstat(pipe_fd, &sb) < 0)
+			err(-1, "stat: %s", pipefile);
+		if (!S_ISCHR(sb.st_mode))
+			errx(-1, "fstat: %s not device", pipefile);
+	} else {
+		trail_fp = fopen(trailfile, "r");
+		if (trail_fp == NULL)
+			err(-1, "%s", trailfile);
+	}
 
 	conf_fp = fopen(conffile, "r");
 	if (conf_fp == NULL)
@@ -253,7 +331,10 @@
 	signal(SIGQUIT, signal_handler);
 	signal(SIGTERM, signal_handler);
 
-	mainloop(conffile, trailfile, trail_fp);
+	if (pipefile != NULL)
+		mainloop_pipe(conffile, pipefile, pipe_fd);
+	else
+		mainloop_file(conffile, trailfile, trail_fp);
 
 	auditfilterd_conf_shutdown();
 	return (0);

==== //depot/projects/trustedbsd/openbsm/bin/auditfilterd/auditfilterd.h#3 (text+ko) ====

@@ -25,11 +25,11 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $P4: //depot/projects/trustedbsd/openbsm/bin/auditfilterd/auditfilterd.h#2 $
+ * $P4: //depot/projects/trustedbsd/openbsm/bin/auditfilterd/auditfilterd.h#3 $
  */
 
 #define	AUDITFILTERD_CONFFILE	"/etc/security/audit_filter"
-#define	AUDITFILTERD_TRAILFILE	"/dev/auditpipe"
+#define	AUDITFILTERD_PIPEFILE	"/dev/auditpipe"
 
 /*
  * Limit on the number of arguments that can appear in an audit_filterd

==== //depot/projects/trustedbsd/openbsm/bsm/audit_filter.h#2 (text+ko) ====

@@ -25,7 +25,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $P4: //depot/projects/trustedbsd/openbsm/bsm/audit_filter.h#1 $
+ * $P4: //depot/projects/trustedbsd/openbsm/bsm/audit_filter.h#2 $
  */
 
 #ifndef _BSM_AUDIT_FILTER_H_
@@ -48,7 +48,7 @@
 typedef int (*audit_filter_attach_t)(void **instance, int argc, char *argv[]);
 typedef int (*audit_filter_reinit_t)(void *instance, int argc, char *argv[]);
 typedef void (*audit_filter_record_t)(void *instance, struct timespec *ts,
-	    int token_count, const tokenstr_t *tok[]);
+	    int token_count, const tokenstr_t tok[]);
 typedef void (*audit_filter_bsmrecord_t)(void *instance, struct timespec *ts,
 	    void *data, u_int len);
 typedef void (*audit_filter_detach_t)(void *instance);


More information about the trustedbsd-cvs mailing list