return AUDIT_TRAIL_ERROR_NONE;
}
+
+int audit_trail_enable_dac(audit_trail_h handle, bool en)
+{
+ RET_ON_FAILURE(handle, AUDIT_TRAIL_ERROR_INVALID_PARAMETER);
+
+ AuditTrailContext &client = GetAuditTrailContext(handle);
+ auto dac = client.createInterface<DiscretionaryAccessControl>();
+
+ int ret = dac.enable(en);
+ if (ret)
+ return AUDIT_TRAIL_ERROR_INVALID_PARAMETER;
+
+ return AUDIT_TRAIL_ERROR_NONE;
+}
+
+int audit_trail_is_enabled_dac(audit_trail_h handle, bool *en)
+{
+ RET_ON_FAILURE(handle, AUDIT_TRAIL_ERROR_INVALID_PARAMETER);
+ RET_ON_FAILURE(en, AUDIT_TRAIL_ERROR_INVALID_PARAMETER);
+
+ AuditTrailContext &client = GetAuditTrailContext(handle);
+ auto dac = client.createInterface<DiscretionaryAccessControl>();
+ *en = dac.isEnabled();
+
+ return AUDIT_TRAIL_ERROR_NONE;
+}
/**
* @brief Retrieves all DAC logs that occured in system.
* @details This API calls audit_trail_string_cb() once for each DAC
- * (Discretionary Access Control) logs.
+ * (Discretionary Access Control) logs collected by audit-trail
+ * when DAC auditing is enabled.
* @since_tizen 5.0
* @param[in] handle The audit-trail handle
* @param[in] callback The iteration callback function
* @pre The handle must be created by audit_trail_create().
* @see audit_trail_create()
* @see audit_trail_destroy()
+ * @see audit_trail_enable_dac()
*/
AUDIT_TRAIL_API int audit_trail_foreach_dac(audit_trail_h handle, audit_trail_string_cb callback, void *user_data);
* @retval #AUDIT_TRAIL_ERROR_INVALID_PARAMETER Invalid parameter
* @retval #AUDIT_TRAIL_ERROR_TIMED_OUT Time out
* @pre The handle must be created by audit_trail_create().
+ * @pre DAC auditing must be enabled by audit_trail_enable_dac().
* @see audit_trail_create()
* @see audit_trail_destroy()
+ * @see audit_trail_enable_dac()
* @see audit_trail_remove_dac_cb()
*/
AUDIT_TRAIL_API int audit_trail_add_dac_cb(audit_trail_h handle,
*/
AUDIT_TRAIL_API int audit_trail_remove_dac_cb(audit_trail_h handle, int id);
+/**
+ * @brief Enables DAC auditing.
+ * @details This API can be used to enable to collect the DAC(Discretionary
+ * Access Control) logs. Any DAC log will not be collected
+ * until auditing is enabled
+ * @since_tizen 5.0
+ * @param[in] handle The audit-trail handle
+ * @param[in] en True enables DAC auditing, Otherwise disables
+ * @return #AUDIT_TRAIL_ERROR_NONE on success, otherwise a negative value
+ * @retval #AUDIT_TRAIL_ERROR_NONE Successful
+ * @retval #AUDIT_TRAIL_ERROR_TIMED_OUT Time out
+ * @retval #AUDIT_TRAIL_ERROR_INVALID_PARAMETER Invalid parameter
+ * @pre The handle must be created by audit_trail_create().
+ * @see audit_trail_create()
+ * @see audit_trail_destroy()
+ * @see audit_trail_foreach_dac()
+ * @see audit_trail_add_dac_cb()
+ */
+AUDIT_TRAIL_API int audit_trail_enable_dac(audit_trail_h handle, bool en);
+
+/**
+ * @brief Retrieves if DAC auditing is enabled.
+ * @details This API can be used to know if DAC(Discretionary Access
+ * Control) auditing is enabled now.
+ * @since_tizen 5.0
+ * @param[in] handle The audit-trail handle
+ * @param[out] en If true, DAC auditing was enabled, Otherwise disabled
+ * @return #AUDIT_TRAIL_ERROR_NONE on success, otherwise a negative value
+ * @retval #AUDIT_TRAIL_ERROR_NONE Successful
+ * @retval #AUDIT_TRAIL_ERROR_TIMED_OUT Time out
+ * @retval #AUDIT_TRAIL_ERROR_INVALID_PARAMETER Invalid parameter
+ * @pre The handle must be created by audit_trail_create().
+ * @see audit_trail_create()
+ * @see audit_trail_destroy()
+ */
+AUDIT_TRAIL_API int audit_trail_is_enabled_dac(audit_trail_h handle, bool *en);
+
/**
* @}
*/
return AUDIT_TRAIL_ERROR_NONE;
}
+
+int audit_trail_enable_mac(audit_trail_h handle, bool en)
+{
+ RET_ON_FAILURE(handle, AUDIT_TRAIL_ERROR_INVALID_PARAMETER);
+
+ AuditTrailContext &client = GetAuditTrailContext(handle);
+ auto mac = client.createInterface<MandatoryAccessControl>();
+
+ int ret = mac.enable(en);
+ if (ret)
+ return AUDIT_TRAIL_ERROR_INVALID_PARAMETER;
+
+ return AUDIT_TRAIL_ERROR_NONE;
+}
+
+int audit_trail_is_enabled_mac(audit_trail_h handle, bool *en)
+{
+ RET_ON_FAILURE(handle, AUDIT_TRAIL_ERROR_INVALID_PARAMETER);
+ RET_ON_FAILURE(en, AUDIT_TRAIL_ERROR_INVALID_PARAMETER);
+
+ AuditTrailContext &client = GetAuditTrailContext(handle);
+ auto mac = client.createInterface<MandatoryAccessControl>();
+ *en = mac.isEnabled();
+
+ return AUDIT_TRAIL_ERROR_NONE;
+}
/**
* @brief Retrieves all MAC logs that occured in system.
* @details This API calls audit_trail_string_cb() once for each MAC
- * (Mandatory Access Control) logs.
+ * (Mandatory Access Control) logs collected by audit-trail
+ * when MAC auditing is enabled.
* @since_tizen 5.0
* @param[in] handle The audit-trail handle
* @param[in] callback The iteration callback function
* @pre The handle must be created by audit_trail_create().
* @see audit_trail_create()
* @see audit_trail_destroy()
+ * @see audit_trail_enable_mac()
*/
AUDIT_TRAIL_API int audit_trail_foreach_mac(audit_trail_h handle, audit_trail_string_cb callback, void *user_data);
* @retval #AUDIT_TRAIL_ERROR_INVALID_PARAMETER Invalid parameter
* @retval #AUDIT_TRAIL_ERROR_TIMED_OUT Time out
* @pre The handle must be created by audit_trail_create().
+ * @pre MAC auditing must be enabled by audit_trail_enable_mac().
* @see audit_trail_create()
* @see audit_trail_destroy()
* @see audit_trail_remove_mac_cb()
*/
AUDIT_TRAIL_API int audit_trail_remove_mac_cb(audit_trail_h handle, int id);
+/**
+ * @brief Enables MAC auditing.
+ * @details This API can be used to enable to collect the MAC(Mandatory
+ * Access Control) logs. Any MAC log will not be collected
+ * until auditing is enabled
+ * @since_tizen 5.0
+ * @param[in] handle The audit-trail handle
+ * @param[in] en True enables MAC auditing, Otherwise disables
+ * @return #AUDIT_TRAIL_ERROR_NONE on success, otherwise a negative value
+ * @retval #AUDIT_TRAIL_ERROR_NONE Successful
+ * @retval #AUDIT_TRAIL_ERROR_TIMED_OUT Time out
+ * @retval #AUDIT_TRAIL_ERROR_INVALID_PARAMETER Invalid parameter
+ * @pre The handle must be created by audit_trail_create().
+ * @see audit_trail_create()
+ * @see audit_trail_destroy()
+ * @see audit_trail_mac_syscall()
+ * @see audit_trail_add_mac_cb()
+ */
+AUDIT_TRAIL_API int audit_trail_enable_mac(audit_trail_h handle, bool en);
+
+/**
+ * @brief Retrieves if MAC auditing is enabled.
+ * @details This API can be used to know if MAC(Mandatory Access Control)
+ * auditing is enabled now.
+ * @since_tizen 5.0
+ * @param[in] handle The audit-trail handle
+ * @param[out] en If true, MAC auditing was enabled, Otherwise disabled
+ * @return #AUDIT_TRAIL_ERROR_NONE on success, otherwise a negative value
+ * @retval #AUDIT_TRAIL_ERROR_NONE Successful
+ * @retval #AUDIT_TRAIL_ERROR_TIMED_OUT Time out
+ * @retval #AUDIT_TRAIL_ERROR_INVALID_PARAMETER Invalid parameter
+ * @pre The handle must be created by audit_trail_create().
+ * @see audit_trail_create()
+ * @see audit_trail_destroy()
+ */
+AUDIT_TRAIL_API int audit_trail_is_enabled_mac(audit_trail_h handle, bool *en);
+
/**
* @}
*/
return AUDIT_TRAIL_ERROR_NONE;
}
+
+int audit_trail_enable_syscall(audit_trail_h handle, bool en)
+{
+ RET_ON_FAILURE(handle, AUDIT_TRAIL_ERROR_INVALID_PARAMETER);
+
+ AuditTrailContext &client = GetAuditTrailContext(handle);
+ auto syscall = client.createInterface<SystemCall>();
+
+ int ret = syscall.enable(en);
+ if (ret)
+ return AUDIT_TRAIL_ERROR_INVALID_PARAMETER;
+
+ return AUDIT_TRAIL_ERROR_NONE;
+}
+
+int audit_trail_is_enabled_syscall(audit_trail_h handle, bool *en)
+{
+ RET_ON_FAILURE(handle, AUDIT_TRAIL_ERROR_INVALID_PARAMETER);
+ RET_ON_FAILURE(en, AUDIT_TRAIL_ERROR_INVALID_PARAMETER);
+
+ AuditTrailContext &client = GetAuditTrailContext(handle);
+ auto syscall = client.createInterface<SystemCall>();
+ *en = syscall.isEnabled();
+
+ return AUDIT_TRAIL_ERROR_NONE;
+}
#include <audit-trail/audit-trail.h>
/**
- * @file dac.h
+ * @file syscall.h
* @brief This file provides APIs to get system call logs
*/
/**
* @brief Retrieves all system call logs that occured in system.
* @details This API calls audit_trail_strimg_cb() once for each system call
- * logs.
+ * logs collected by audit-trail when system call auditing is enabled.
* @since_tizen 5.0
* @param[in] handle The audit-trail handle
* @param[in] callback The iteration callback function
* @pre The handle must be created by audit_trail_create().
* @see audit_trail_create()
* @see audit_trail_destroy()
+ * @see audit_trail_enable_syscall()
*/
AUDIT_TRAIL_API int audit_trail_foreach_syscall(audit_trail_h handle, audit_trail_string_cb callback, void *user_data);
* @retval #AUDIT_TRAIL_ERROR_INVALID_PARAMETER Invalid parameter
* @retval #AUDIT_TRAIL_ERROR_TIMED_OUT Time out
* @pre The handle must be created by audit_trail_create().
+ * @pre System call auditing must be enabled by
+ * audit_trail_enable_syscall().
* @see audit_trail_create()
* @see audit_trail_destroy()
+ * @see audit_trail_enable_syscall()
* @see audit_trail_remove_syscall_cb()
*/
AUDIT_TRAIL_API int audit_trail_add_syscall_cb(audit_trail_h handle,
*/
AUDIT_TRAIL_API int audit_trail_remove_syscall_cb(audit_trail_h handle, int id);
+/**
+ * @brief Enables system call auditing.
+ * @details This API can be used to enable to collect the system call logs.
+ * Any system call log will not be collected until auditing is
+ * enabled
+ * @since_tizen 5.0
+ * @param[in] handle The audit-trail handle
+ * @param[in] en True enables system call auditing, Otherwise disables
+ * @return #AUDIT_TRAIL_ERROR_NONE on success, otherwise a negative value
+ * @retval #AUDIT_TRAIL_ERROR_NONE Successful
+ * @retval #AUDIT_TRAIL_ERROR_TIMED_OUT Time out
+ * @retval #AUDIT_TRAIL_ERROR_INVALID_PARAMETER Invalid parameter
+ * @pre The handle must be created by audit_trail_create().
+ * @see audit_trail_create()
+ * @see audit_trail_destroy()
+ * @see audit_trail_foreach_syscall()
+ * @see audit_trail_add_syscall_cb()
+ */
+AUDIT_TRAIL_API int audit_trail_enable_syscall(audit_trail_h handle, bool en);
+
+/**
+ * @brief Retrieves if system call auditing is enabled.
+ * @details This API can be used to know if system call auditing is
+ * enabled now.
+ * @since_tizen 5.0
+ * @param[in] handle The audit-trail handle
+ * @param[out] en If true, system call auditing was enabled, Otherwise disabled
+ * @return #AUDIT_TRAIL_ERROR_NONE on success, otherwise a negative value
+ * @retval #AUDIT_TRAIL_ERROR_NONE Successful
+ * @retval #AUDIT_TRAIL_ERROR_TIMED_OUT Time out
+ * @retval #AUDIT_TRAIL_ERROR_INVALID_PARAMETER Invalid parameter
+ * @pre The handle must be created by audit_trail_create().
+ * @see audit_trail_create()
+ * @see audit_trail_destroy()
+ */
+AUDIT_TRAIL_API int audit_trail_is_enabled_syscall(audit_trail_h handle, bool *en);
/**
* @}
*/
return 0;
}
+int DiscretionaryAccessControl::enable(bool en)
+{
+ try {
+ return context->methodCall<int>("DiscretionaryAccessControl::enable", en);
+ } catch (runtime::Exception& e) {}
+ return 0;
+}
+
+bool DiscretionaryAccessControl::isEnabled()
+{
+ try {
+ return context->methodCall<bool>("DiscretionaryAccessControl::isEnabled");
+ } catch (runtime::Exception& e) {}
+ return false;
+}
+
} // namespace AuditTrail
return 0;
}
+int MandatoryAccessControl::enable(bool en)
+{
+ try {
+ return context->methodCall<int>("MandatoryAccessControl::enable", en);
+ } catch (runtime::Exception& e) {}
+ return 0;
+}
+
+bool MandatoryAccessControl::isEnabled()
+{
+ try {
+ return context->methodCall<bool>("MandatoryAccessControl::isEnabled");
+ } catch (runtime::Exception& e) {}
+ return false;
+}
+
} // namespace AuditTrail
return 0;
}
+int SystemCall::enable(bool en)
+{
+ try {
+ return context->methodCall<int>("SystemCall::enable", en);
+ } catch (runtime::Exception& e) {}
+ return 0;
+}
+
+bool SystemCall::isEnabled()
+{
+ try {
+ return context->methodCall<bool>("SystemCall::isEnabled");
+ } catch (runtime::Exception& e) {}
+ return false;
+}
+
} // namespace AuditTrail
int clear();
+ int enable(bool en);
+ bool isEnabled();
+
private:
AuditTrailControlContext& context;
};
int clear();
+ int enable(bool en);
+ bool isEnabled();
+
private:
AuditTrailControlContext& context;
};
int clear();
+ int enable(bool en);
+ bool isEnabled();
+
private:
AuditTrailControlContext& context;
};
const std::string keyString = " key=\"" AUDIT_RULE_KEY "\"";
+netlink::AuditRule ruleDacAccess, ruleDacPerm;
+bool enabled;
+
} // namespace
context.expose(this, "", (bool)(DiscretionaryAccessControl::nextIterator)(int));
context.expose(this, "", (int)(DiscretionaryAccessControl::destroyIterator)(int));
context.expose(this, PRIVILEGE_PLATFORM, (int)(DiscretionaryAccessControl::clear)());
+ context.expose(this, PRIVILEGE_PLATFORM, (int)(DiscretionaryAccessControl::enable)(bool));
+ context.expose(this, "", (bool)(DiscretionaryAccessControl::isEnabled)());
context.createNotification("DiscretionaryAccessControl");
- netlink::AuditRule dacAccess, dacPerm;
-
- dacAccess.setKey(AUDIT_RULE_KEY);
- dacAccess.setSystemCall(__NR_open);
- dacAccess.setSystemCall(__NR_openat);
- dacAccess.setSystemCall(__NR_getxattr);
- dacAccess.setReturn(-EACCES);
+ ruleDacAccess.setKey(AUDIT_RULE_KEY);
+ ruleDacAccess.setSystemCall(__NR_open);
+ ruleDacAccess.setSystemCall(__NR_openat);
+ ruleDacAccess.setSystemCall(__NR_getxattr);
+ ruleDacAccess.setReturn(-EACCES);
- dacPerm = dacAccess;
- dacPerm.setReturn(-EPERM);
-
- try {
- context.addAuditRule(dacAccess);
- } catch (runtime::Exception& e) {
- INFO("Failed to add audit rule");
- }
+ ruleDacPerm = ruleDacAccess;
+ ruleDacPerm.setReturn(-EPERM);
try {
- context.addAuditRule(dacPerm);
- } catch (runtime::Exception& e) {
- INFO("Failed to add audit rule");
- }
+ context.removeAuditRule(ruleDacAccess);
+ context.removeAuditRule(ruleDacPerm);
+ } catch (runtime::Exception& e) {}
+ enabled = false;
context.setAuditHandler([&ctx] (int type, std::vector<char> &buf) {
if (type == AUDIT_SYSCALL) {
return 0;
}
+bool DiscretionaryAccessControl::isEnabled()
+{
+ return enabled;
+}
+
+int DiscretionaryAccessControl::enable(bool en)
+{
+ if (en != enabled) {
+ enabled = en;
+ try {
+ if (en) {
+ context.addAuditRule(ruleDacAccess);
+ context.addAuditRule(ruleDacPerm);
+ } else {
+ context.removeAuditRule(ruleDacAccess);
+ context.removeAuditRule(ruleDacPerm);
+ }
+ } catch (runtime::Exception& e) {
+ return -1;
+ }
+ }
+ return 0;
+}
+
} // namespace AuditTrail
std::unordered_map<int, unsigned long long> iteratorMap;
int newIteratorId = 0;
+bool enabled;
+
} // namespace
context.expose(this, "", (bool)(MandatoryAccessControl::nextIterator)(int));
context.expose(this, "", (int)(MandatoryAccessControl::destroyIterator)(int));
context.expose(this, PRIVILEGE_PLATFORM, (int)(MandatoryAccessControl::clear)());
+ context.expose(this, PRIVILEGE_PLATFORM, (int)(MandatoryAccessControl::enable)(bool));
+ context.expose(this, "", (bool)(MandatoryAccessControl::isEnabled)());
context.createNotification("MandatoryAccessControl");
+ enabled = false;
+
context.setAuditHandler([&ctx] (int type, std::vector<char> &buf) {
- if (type == AUDIT_AVC) {
+ if (type == AUDIT_AVC && enabled) {
std::string log(buf.begin(), buf.end());
logs.push_back(log);
ctx.notify("MandatoryAccessControl", log);
return 0;
}
+bool MandatoryAccessControl::isEnabled()
+{
+ return enabled;
+}
+
+int MandatoryAccessControl::enable(bool en)
+{
+ enabled = en;
+ return 0;
+}
+
} // namespace AuditTrail
const std::string keyString = " key=\"" AUDIT_RULE_KEY "\"";
+netlink::AuditRule ruleAllSyscall;
+bool enabled;
+
} // namespace
context.expose(this, "", (bool)(SystemCall::nextIterator)(int));
context.expose(this, "", (int)(SystemCall::destroyIterator)(int));
context.expose(this, PRIVILEGE_PLATFORM, (int)(SystemCall::clear)());
+ context.expose(this, PRIVILEGE_PLATFORM, (int)(SystemCall::enable)(bool));
+ context.expose(this, "", (bool)(SystemCall::isEnabled)());
context.createNotification("SystemCall");
- netlink::AuditRule allSyscall;
- allSyscall.setKey(AUDIT_RULE_KEY);
- allSyscall.setAllSystemCalls();
+ ruleAllSyscall.setKey(AUDIT_RULE_KEY);
+ ruleAllSyscall.setAllSystemCalls();
try {
- context.addAuditRule(allSyscall);
- } catch (runtime::Exception& e) {
- INFO("Failed to add audit rule");
- }
+ context.removeAuditRule(ruleAllSyscall);
+ } catch (runtime::Exception& e) {}
+ enabled = false;
context.setAuditHandler([&ctx] (int type, std::vector<char> &buf) {
if (type == AUDIT_SYSCALL) {
return 0;
}
+bool SystemCall::isEnabled()
+{
+ return enabled;
+}
+
+int SystemCall::enable(bool en)
+{
+ if (en != enabled) {
+ enabled = en;
+ try {
+ if (en) {
+ context.addAuditRule(ruleAllSyscall);
+ } else {
+ context.removeAuditRule(ruleAllSyscall);
+ }
+ } catch (runtime::Exception& e) {
+ return -1;
+ }
+ }
+ return 0;
+}
+
} // namespace AuditTrail
<< "Options :" << std::endl
<< " -s, --show=[dac|mac|syscall] show the audit logs" << std::endl
<< " -c, --clear=[dac|mac|syscall] clear the audit logs" << std::endl
+ << " -d, --disable=[dac|mac|syscall] disable to collect logs" << std::endl
+ << " -e, --enable=[dac|mac|syscall] enable to collect logs" << std::endl
<< " -m, --monitor monitor for all audit logs" << std::endl
<< " -h, --help show this" << std::endl
<< std::endl;
return 0;
}
+
+int enableLog(const std::string type, bool en)
+{
+ std::stringstream tok(type);
+ std::string word;
+
+ audit_trail_h auditTrail;
+ audit_trail_create(&auditTrail);
+
+ while (getline(tok, word, '|')) {
+ if (word == "dac") {
+ audit_trail_enable_dac(auditTrail, en);
+ } else if (word == "mac") {
+ audit_trail_enable_mac(auditTrail, en);
+ } else if (word == "syscall") {
+ audit_trail_enable_syscall(auditTrail, en);
+ }
+ }
+
+ std::cout << "Enabled : ";
+
+ en = false;
+ audit_trail_is_enabled_dac(auditTrail, &en);
+ if (en) {
+ std::cout << "dac ";
+ }
+
+ en = false;
+ audit_trail_is_enabled_mac(auditTrail, &en);
+ if (en) {
+ std::cout << "mac ";
+ }
+
+ en = false;
+ audit_trail_is_enabled_syscall(auditTrail, &en);
+ if (en) {
+ std::cout << "syscall ";
+ }
+ std::cout << std::endl;
+
+ audit_trail_destroy(auditTrail);
+ return 0;
+}
+
void monitorSigHandler(int sig)
{
g_main_loop_quit(gmainloop);
{"help", no_argument, 0, 'h'},
{"show", required_argument, 0, 's'},
{"clear", required_argument, 0, 'c'},
+ {"enable", required_argument, 0, 'e'},
+ {"disable", required_argument, 0, 'd'},
{"monitor", no_argument, 0, 'm'},
{0, 0, 0, 0}
};
return EXIT_SUCCESS;
}
- while ((opt = getopt_long(argc, argv, "s:c:mh", options, &index)) != -1) {
+ while ((opt = getopt_long(argc, argv, "s:c:d:e:mh", options, &index)) != -1) {
switch (opt) {
case 's':
ret = showLog(optarg);
case 'c':
ret = clearLog(optarg);
break;
+ case 'd':
+ ret = enableLog(optarg, false);
+ break;
+ case 'e':
+ ret = enableLog(optarg, true);
+ break;
case 'm':
ret = monitorLog();
break;
projects / platform / core / security / audit-trail.git / commitdiff