[PATCH] Updated audit failure query functionality

[Lisa Smith <lisa.m.smith@hp.com>]

This is an updated patch for the audit failure query 
functionality.  The patch has been completely rewritten
to match the programming style and algorithms used in
auditd-config.c.

This patch introduces a new query function,
get_auditfail_action(enum auditfail_t *failmode), which 
can be called to determine what action should be taken by 
a service after audit_open() fails. The function will 
read the tunable "failure_action" from the new 
/etc/libaudit.conf file to determine what action should be
taken.

This patch provides easy expansion of the /etc/libaudit.conf
file to introduce new libaudit tunables if the need arises 
in the future.

The audit_open() man page will be updated to reference this
query function, and a new man page will also be created for
get_auditfail_action().

Lisa

-------------------

 libaudit.c |  246 +++++++++++++++++++++++++++++++++++++++++++++++++++++
 libaudit.h |   11 ++
 2 files changed, 257 insertions(+)

diff -burN orig/libaudit.c src/libaudit.c
--- orig/libaudit.c     2006-05-25 17:39:52.000000000 -0400
+++ src/libaudit.c      2006-06-26 15:00:56.000000000 -0400
@@ -42,13 +42,56 @@
 #include "libaudit.h"
 #include "private.h"

+/* Local prototypes */
+struct nv_pair
+{
+        const char *name;
+        const char *value;
+};
+
+struct kw_pair
+{
+        const char *name;
+        int (*parser)(const char *, int);
+};
+
+struct nv_list
+{
+        const char *name;
+        int option;
+};
+
+struct libaudit_conf
+{
+        auditfail_t failure_action;
+};

 int audit_archadded = 0;
 int audit_syscalladded = 0;
 unsigned int audit_elf = 0U;
+static struct libaudit_conf config;
+static int load_libaudit_config();
+static char *get_line(FILE *f, char *buf);
+static int nv_split(char *buf, struct nv_pair *nv);
+static const struct kw_pair *kw_lookup(const char *val);
+static int audit_failure_parser(const char *val, int line);
 static int name_to_uid(const char *name, uid_t *uid);
 static int name_to_gid(const char *name, gid_t *gid);

+static const struct kw_pair keywords[] =
+{
+  {"failure_action",           audit_failure_parser },
+  { NULL,                      NULL }
+};
+
+static const struct nv_list failure_actions[] =
+{
+  {"ignore",                   FA_IGNORE },
+  {"log",                      FA_LOG },
+  {"terminate",                FA_TERMINATE },
+  { NULL,                      0 }
+};
+

 int audit_request_status(int fd)
 {
@@ -68,6 +111,209 @@
        return rc;
 }

+/*
+ * Set everything to its default value
+*/
+static void clear_config()
+{
+        config.failure_action = FA_IGNORE;
+}
+
+static int load_libaudit_config()
+{
+        int fd, rc, lineno = 1;
+        struct stat st;
+        FILE *f;
+        char buf[128];
+
+        clear_config();
+
+        /* open the file */
+        rc = open(CONFIG_FILE, O_NOFOLLOW|O_RDONLY);
+        if (rc < 0) {
+                if (errno != ENOENT) {
+                        audit_msg(LOG_ERR, "Error opening config file (%s)",
+                                strerror(errno));
+                        return 1;
+                }
+                audit_msg(LOG_WARNING,
+                        "Config file %s doesn't exist, skipping", CONFIG_FILE);
+                return 0;
+        }
+        fd = rc;
+
+        /* check the file's permissions: owned by root, not world writable,
+         * not symlink.
+         */
+        audit_msg(LOG_DEBUG, "Config file %s opened for parsing",
+                        CONFIG_FILE);
+        if (fstat(fd, &st) < 0) {
+                audit_msg(LOG_ERR, "Error fstat'ing config file (%s)",
+                        strerror(errno));
+                return 1;
+        }
+        if (st.st_uid != 0) {
+                audit_msg(LOG_ERR, "Error - %s isn't owned by root",
+                        CONFIG_FILE);
+                return 1;
+        }
+        if ((st.st_mode & S_IWOTH) == S_IWOTH) {
+                audit_msg(LOG_ERR, "Error - %s is world writable",
+                        CONFIG_FILE);
+                return 1;
+        }
+        if (!S_ISREG(st.st_mode)) {
+                audit_msg(LOG_ERR, "Error - %s is not a regular file",
+                        CONFIG_FILE);
+                return 1;
+        }
+
+        /* it's ok, read line by line */
+        f = fdopen(fd, "r");
+        if (f == NULL) {
+                audit_msg(LOG_ERR, "Error - fdopen failed (%s)",
+                        strerror(errno));
+                return 1;
+        }
+
+        while (get_line(f, buf)) {
+                // convert line into name-value pair
+                const struct kw_pair *kw;
+                struct nv_pair nv;
+                rc = nv_split(buf, &nv);
+                switch (rc) {
+                        case 0: // fine
+                                break;
+                        case 1: // not the right number of tokens.
+                                audit_msg(LOG_ERR,
+                                "Wrong number of arguments for line %d in %s",
+                                        lineno, CONFIG_FILE);
+                                break;
+                        case 2: // no '=' sign
+                                audit_msg(LOG_ERR,
+                                        "Missing equal sign for line %d in %s",
+                                        lineno, CONFIG_FILE);
+                                break;
+                        default: // something else went wrong...
+                                audit_msg(LOG_ERR,
+                                        "Unknown error for line %d in %s",
+                                        lineno, CONFIG_FILE);
+                                break;
+                }
+                if (nv.name == NULL) {
+                        lineno++;
+                        continue;
+                }
+
+                /* identify keyword or error */
+                kw = kw_lookup(nv.name);
+                if (kw->name == NULL) {
+                        audit_msg(LOG_ERR,
+                                "Unknown keyword \"%s\" in line %d of %s",
+                                nv.name, lineno, CONFIG_FILE);
+                        fclose(f);
+                        return 1;
+                }
+
+                /* dispatch to keyword's local parser */
+                rc = kw->parser(nv.value, lineno);
+                if (rc != 0) {
+                        fclose(f);
+                        return 1; // local parser puts message out
+                }
+
+                lineno++;
+        }
+
+        fclose(f);
+        return 0;
+}
+
+int get_auditfail_action(auditfail_t *failmode)
+{
+       if (load_libaudit_config())
+               *failmode = config.failure_action;
+               return 1;
+
+       *failmode = config.failure_action;
+       return 0;
+}
+
+
+static char *get_line(FILE *f, char *buf)
+{
+        if (fgets_unlocked(buf, 128, f)) {
+                /* remove newline */
+                char *ptr = strchr(buf, 0x0a);
+                if (ptr)
+                        *ptr = 0;
+                return buf;
+        }
+        return NULL;
+}
+
+static int nv_split(char *buf, struct nv_pair *nv)
+{
+        /* Get the name part */
+        char *ptr;
+
+        nv->name = NULL;
+        nv->value = NULL;
+        ptr = strtok(buf, " ");
+        if (ptr == NULL)
+                return 0; /* If there's nothing, go to next line */
+        if (ptr[0] == '#')
+                return 0; /* If there's a comment, go to next line */
+        nv->name = ptr;
+
+        /* Check for a '=' */
+        ptr = strtok(NULL, " ");
+        if (ptr == NULL)
+                return 1;
+        if (strcmp(ptr, "=") != 0)
+                return 2;
+
+        /* get the value */
+        ptr = strtok(NULL, " ");
+        if (ptr == NULL)
+                return 1;
+        nv->value = ptr;
+
+        /* Make sure there's nothing else */
+        ptr = strtok(NULL, " ");
+        if (ptr)
+                return 1;
+
+        /* Everything is OK */
+        return 0;
+}
+
+static const struct kw_pair *kw_lookup(const char *val)
+{
+        int i = 0;
+        while (keywords[i].name != NULL) {
+                if (strcasecmp(keywords[i].name, val) == 0)
+                        break;
+                i++;
+        }
+        return &keywords[i];
+}
+
+static int audit_failure_parser(const char *val, int line)
+{
+        int i;
+
+        audit_msg(LOG_DEBUG, "audit_failure_parser called with: %s", val);
+        for (i=0; failure_actions[i].name != NULL; i++) {
+                if (strcasecmp(val, failure_actions[i].name) == 0) {
+                        config.failure_action = failure_actions[i].option;
+                        return 0;
+                }
+        }
+        audit_msg(LOG_ERR, "Option %s not found - line %d", val, line);
+        return 1;
+}
+
 int audit_set_enabled(int fd, uint32_t enabled)
 {
        int rc;
diff -burN orig/libaudit.h src/libaudit.h
--- orig/libaudit.h     2006-05-25 17:38:21.000000000 -0400
+++ src/libaudit.h      2006-06-26 14:58:53.000000000 -0400
@@ -248,6 +248,16 @@
         MACH_ALPHA
 } machine_t;

+/* These are the valid audit failure tunable enum values */
+typedef enum {
+       FA_IGNORE=0,
+       FA_LOG,
+       FA_TERMINATE
+} auditfail_t;
+
+/* #defines for the audit failure query  */
+#define CONFIG_FILE "/etc/libaudit.conf"
+
 /*
  * audit_rule_data supports filter rules with both integer and string
  * fields. It corresponds with AUDIT_ADD_RULE, AUDIT_DEL_RULE and
@@ -362,6 +372,7 @@
 /* AUDIT_GET */
 extern int audit_request_status(int fd);
 extern int audit_is_enabled(int fd);
+extern int get_auditfail_action(auditfail_t *failmode);

 /* AUDIT_SET */
 typedef enum { WAIT_NO, WAIT_YES } rep_wait_t;