Author: rwatson
Date: Sun Jul 10 08:04:02 2016
New Revision: 302514
URL: https://svnweb.freebsd.org/changeset/base/302514
Log:
Audit file-descriptor arguments to I/O system calls such as
read(2), write(2), dup(2), and mmap(2). This auditing is not
required by the Common Criteria (and hence was not being
performed), but is valuable in both contemporary live analysis
and forensic use cases.
MFC after: 3 days
Sponsored by: DARPA, AFRL
Modified:
head/sys/kern/kern_descrip.c
head/sys/kern/sys_generic.c
head/sys/vm/vm_mmap.c
Modified: head/sys/kern/kern_descrip.c
==============================================================================
--- head/sys/kern/kern_descrip.c Sun Jul 10 04:33:16 2016
(r302513)
+++ head/sys/kern/kern_descrip.c Sun Jul 10 08:04:02 2016
(r302514)
@@ -820,6 +820,9 @@ kern_dup(struct thread *td, u_int mode,
MPASS((flags & ~(FDDUP_FLAG_CLOEXEC)) == 0);
MPASS(mode < FDDUP_LASTMODE);
+ AUDIT_ARG_FD(old);
+ /* XXXRW: if (flags & FDDUP_FIXED) AUDIT_ARG_FD2(new); */
+
/*
* Verify we have a valid descriptor to dup from and possibly to
* dup to. Unlike dup() and dup2(), fcntl()'s F_DUPFD should
Modified: head/sys/kern/sys_generic.c
==============================================================================
--- head/sys/kern/sys_generic.c Sun Jul 10 04:33:16 2016 (r302513)
+++ head/sys/kern/sys_generic.c Sun Jul 10 08:04:02 2016 (r302514)
@@ -363,6 +363,8 @@ dofileread(td, fd, fp, auio, offset, fla
struct uio *ktruio = NULL;
#endif
+ AUDIT_ARG_FD(fd);
+
/* Finish zero length reads right here */
if (auio->uio_resid == 0) {
td->td_retval[0] = 0;
@@ -576,6 +578,7 @@ dofilewrite(td, fd, fp, auio, offset, fl
struct uio *ktruio = NULL;
#endif
+ AUDIT_ARG_FD(fd);
auio->uio_rw = UIO_WRITE;
auio->uio_td = td;
auio->uio_offset = offset;
Modified: head/sys/vm/vm_mmap.c
==============================================================================
--- head/sys/vm/vm_mmap.c Sun Jul 10 04:33:16 2016 (r302513)
+++ head/sys/vm/vm_mmap.c Sun Jul 10 08:04:02 2016 (r302514)
@@ -74,6 +74,7 @@ __FBSDID("$FreeBSD$");
#include <sys/sysent.h>
#include <sys/vmmeter.h>
+#include <security/audit/audit.h>
#include <security/mac/mac_framework.h>
#include <vm/vm.h>
@@ -206,6 +207,7 @@ sys_mmap(td, uap)
pos = uap->pos;
fp = NULL;
+ AUDIT_ARG_FD(uap->fd);
/*
* Ignore old flags that used to be defined but did not do anything.
_______________________________________________
svn-src-all@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
