From gww@sac.sfbay.sun.com Mon Jul 20 09:42:32 2009 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n6KGgV2J027076 for ; Mon, 20 Jul 2009 09:42:31 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id n6KGgFwO029845; Mon, 20 Jul 2009 17:42:30 +0100 (BST) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KN300805AETJR00@brm-avmta-1.central.sun.com>; Mon, 20 Jul 2009 10:42:29 -0600 (MDT) Received: from dm-sfbay-01.sfbay.sun.com ([129.145.155.118]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KN300KJXAESQ460@brm-avmta-1.central.sun.com>; Mon, 20 Jul 2009 10:42:28 -0600 (MDT) Received: from sac.sfbay.sun.com (sac.SFBay.Sun.COM [129.146.226.132]) by dm-sfbay-01.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id n6KGgSdI040796; Mon, 20 Jul 2009 09:42:28 -0700 (PDT) Received: from sac.sfbay.sun.com (localhost [127.0.0.1]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n6KGgPNE027071; Mon, 20 Jul 2009 09:42:25 -0700 (PDT) Received: (from gww@localhost) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8/Submit) id n6KGgPLw027067; Mon, 20 Jul 2009 09:42:25 -0700 (PDT) Date: Mon, 20 Jul 2009 09:42:25 -0700 (PDT) From: Gary Winiger Subject: adt_alloc_event update [PSARC/2009/400 Self Review] To: PSARC-ext@sun.com Cc: audit-core@sun.com Message-id: <200907201642.n6KGgPLw027067@sac.sfbay.sun.com> Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 Status: RO Content-Length: 2986 I'm self sponsoring this case. I believe it qualifies for self-review and am marking it "closed approved automatic." I am happy to turn it into a fast track and set the timer if anyone believes I've misjudged. The case requests a Patch Release Binding and an unchanged Contracted Project Private Interface Taxonomy. The project team has no current plan to backport. No current uses of adt_alloc_event() are affected by this change. A full diffmarked man page is in the case directory. Gary.. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Background: ========== PSARC/2000/517 "Thread-safe audit API" introduced a number of user land (Contracted) Project Private interfaces for generating Solaris Audit records. PSARC/2003/397 "Contracted audit interfaces for open source" further discussed the Contracts for those interfaces. The interfaces can be used without checking whether Solaris Audit is enable or that the audit service, auditd(1m) is active. In looking over the code, I noticed that adt_alloc_event() should be able to return an error for invalid parameters. Doing so has the potential to save applications from a segment fault. adt_event_data_t *adt_alloc_event(const adt_session_data_t *session_data, au_event_t event_id); returns an event structure to be filled in by the application based on the event (event_id) passed to it. Even if audit is off, it always returns the structure. If for some reason the event_id passed in isn't valid, adt_alloc_event will presently return a adt_event_data_t pointer (adt_event_data_t is a union of the defined events). This could lead the application to try to fill in memory outside of the memory allocated. While this should never happen because the use is contracted, thus the application and structure should always be in sync, it is easy to return an error if it does occur. Proposal: ========= Add EINVAL to the returns for adt_alloc_event. adt_alloc_event(3adt) DESCRIPTION This set of three functions are used to generate audit records within the current audit session context defined by the session_data parameter to adt_alloc_event(). See the union adt_event_data definition in adt_event.h for the name of the structure that corresponds to the event_id. For example, event_id ADT_login structure name is adt_login_t. adt_alloc_event() returns a pointer to memory allocated for an event of type event_id. This structure is to be filled in by the caller to provide the user-specific data contained in the audit record. The allocated memory structure includes linkage to the audit session handle. It is the responsibility of the caller to free the event memory by calling adt_free_event() when it is no longer needed. RETURN VALUES adt_alloc_event(): != NULL OK == NULL error; errno is set to one of the following: + EINVAL -- invalid event_id value ENOMEM unable to allocate memory From gdamore@sun.com Mon Jul 20 11:01:12 2009 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n6KI1CwC029928 for ; Mon, 20 Jul 2009 11:01:12 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n6KI1AWR053457; Mon, 20 Jul 2009 12:01:11 -0600 (MDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KN30060DE1ZQY00@nwk-avmta-1.sfbay.Sun.COM>; Mon, 20 Jul 2009 11:01:11 -0700 (PDT) Received: from sca-es-mail-2.sun.com ([192.18.43.133]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KN300LOOE1XDU20@nwk-avmta-1.sfbay.Sun.COM>; Mon, 20 Jul 2009 11:01:09 -0700 (PDT) Received: from fe-sfbay-09.sun.com ([192.18.43.129]) by sca-es-mail-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id n6KI19ij000518; Mon, 20 Jul 2009 11:01:09 -0700 (PDT) Received: from conversion-daemon.fe-sfbay-09.sun.com by fe-sfbay-09.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) id <0KN300100DXM3F00@fe-sfbay-09.sun.com>; Mon, 20 Jul 2009 11:01:09 -0700 (PDT) Received: from [192.168.251.11] ([unknown] [76.93.15.33]) by fe-sfbay-09.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) with ESMTPSA id <0KN300KL6E1VCB20@fe-sfbay-09.sun.com>; Mon, 20 Jul 2009 11:01:07 -0700 (PDT) Date: Mon, 20 Jul 2009 11:01:06 -0700 From: "Garrett D'Amore" Subject: Re: adt_alloc_event update [PSARC/2009/400 Self Review] In-reply-to: <200907201642.n6KGgPLw027067@sac.sfbay.sun.com> Sender: Garrett.Damore@sun.com To: Gary Winiger Cc: PSARC-ext@sun.com, audit-core@sun.com Message-id: <4A64B0E2.50005@sun.com> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200907201642.n6KGgPLw027067@sac.sfbay.sun.com> User-Agent: Thunderbird 2.0.0.18 (X11/20081201) Status: RO Content-Length: 3300 Gary Winiger wrote: > I'm self sponsoring this case. I believe it qualifies for self-review and > am marking it "closed approved automatic." I am happy to turn it into a > fast track and set the timer if anyone believes I've misjudged. > Looks good to me, and self-review in scope is appropriate. However, here's a proactive +1 in case anyone wants it to follow fast track rules. :-) - Garrett > The case requests a Patch Release Binding and an unchanged Contracted Project > Private Interface Taxonomy. The project team has no current plan to backport. > No current uses of adt_alloc_event() are affected by this change. > > A full diffmarked man page is in the case directory. > > Gary.. > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > Background: > ========== > PSARC/2000/517 "Thread-safe audit API" introduced a number of user land > (Contracted) Project Private interfaces for generating Solaris Audit > records. PSARC/2003/397 "Contracted audit interfaces for open source" > further discussed the Contracts for those interfaces. The interfaces can > be used without checking whether Solaris Audit is enable or that the audit > service, auditd(1m) is active. > > In looking over the code, I noticed that adt_alloc_event() should be able > to return an error for invalid parameters. Doing so has the potential to > save applications from a segment fault. > adt_event_data_t *adt_alloc_event(const adt_session_data_t > *session_data, au_event_t event_id); > returns an event structure to be filled in by the application based on the > event (event_id) passed to it. Even if audit is off, it always returns the > structure. If for some reason the event_id passed in isn't valid, > adt_alloc_event will presently return a adt_event_data_t pointer > (adt_event_data_t is a union of the defined events). This could lead the > application to try to fill in memory outside of the memory allocated. While > this should never happen because the use is contracted, thus the application > and structure should always be in sync, it is easy to return an error if it > does occur. > > Proposal: > ========= > Add EINVAL to the returns for adt_alloc_event. > > adt_alloc_event(3adt) > > DESCRIPTION > This set of three functions are used to generate audit records > within the current audit session context defined by the > session_data parameter to adt_alloc_event(). See the union > adt_event_data definition in adt_event.h for the name of the > structure that corresponds to the event_id. For example, > event_id ADT_login structure name is adt_login_t. > > adt_alloc_event() returns a pointer to memory allocated for an > event of type event_id. This structure is to be filled in by the > caller to provide the user-specific data contained in the audit > record. The allocated memory structure includes linkage to the > audit session handle. It is the responsibility of the caller to > free the event memory by calling adt_free_event() when it is > no longer needed. > > RETURN VALUES > adt_alloc_event(): > != NULL OK > == NULL error; errno is set to one of the following: > > + EINVAL -- invalid event_id value > ENOMEM unable to allocate memory >