Date: Fri, 18 May 2018 12:36:56 GMT From: aniketp@FreeBSD.org To: svn-soc-all@FreeBSD.org Subject: socsvn commit: r337237 - in soc2018/aniketp/audittestsuite: . docs src test test/filesystem test/filesystem/src test/filesystem/src/file-create test/filesystem/src/file-delete test/filesystem/src/f... Message-ID: <201805181236.w4ICauin095226@socsvn.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: aniketp Date: Fri May 18 12:36:55 2018 New Revision: 337237 URL: http://svnweb.FreeBSD.org/socsvn/?view=rev&rev=337237 Log: Import Audit Test-Suite from github Added: soc2018/aniketp/audittestsuite/LICENSE soc2018/aniketp/audittestsuite/README.md soc2018/aniketp/audittestsuite/docs/ soc2018/aniketp/audittestsuite/docs/Proposal.pdf (contents, props changed) soc2018/aniketp/audittestsuite/docs/Report1.pdf (contents, props changed) soc2018/aniketp/audittestsuite/docs/Report2.pdf (contents, props changed) soc2018/aniketp/audittestsuite/docs/Report3.pdf (contents, props changed) soc2018/aniketp/audittestsuite/docs/Test-Scenarios.pdf (contents, props changed) soc2018/aniketp/audittestsuite/src/ soc2018/aniketp/audittestsuite/src/Makefile soc2018/aniketp/audittestsuite/src/file-attribute-access.c soc2018/aniketp/audittestsuite/src/file-attribute-modify.c soc2018/aniketp/audittestsuite/src/file-create.c soc2018/aniketp/audittestsuite/src/file-delete.c soc2018/aniketp/audittestsuite/src/file-read.c soc2018/aniketp/audittestsuite/src/file-write.c soc2018/aniketp/audittestsuite/src/utils.c soc2018/aniketp/audittestsuite/src/utils.h soc2018/aniketp/audittestsuite/test/ soc2018/aniketp/audittestsuite/test/filesystem/ soc2018/aniketp/audittestsuite/test/filesystem/Makefile soc2018/aniketp/audittestsuite/test/filesystem/README.md soc2018/aniketp/audittestsuite/test/filesystem/run_tests (contents, props changed) soc2018/aniketp/audittestsuite/test/filesystem/src/ soc2018/aniketp/audittestsuite/test/filesystem/src/file-create/ soc2018/aniketp/audittestsuite/test/filesystem/src/file-create/link.c soc2018/aniketp/audittestsuite/test/filesystem/src/file-create/mkdir.c soc2018/aniketp/audittestsuite/test/filesystem/src/file-create/mkfifo.c soc2018/aniketp/audittestsuite/test/filesystem/src/file-create/mknod.c soc2018/aniketp/audittestsuite/test/filesystem/src/file-create/open.c soc2018/aniketp/audittestsuite/test/filesystem/src/file-create/rename.c soc2018/aniketp/audittestsuite/test/filesystem/src/file-create/symlink.c soc2018/aniketp/audittestsuite/test/filesystem/src/file-delete/ soc2018/aniketp/audittestsuite/test/filesystem/src/file-delete/open.c soc2018/aniketp/audittestsuite/test/filesystem/src/file-delete/rename.c soc2018/aniketp/audittestsuite/test/filesystem/src/file-read/ soc2018/aniketp/audittestsuite/test/filesystem/src/file-read/open.c soc2018/aniketp/audittestsuite/test/filesystem/src/file-read/readlink.c soc2018/aniketp/audittestsuite/test/filesystem/src/file-write/ soc2018/aniketp/audittestsuite/test/filesystem/src/file-write/open.c soc2018/aniketp/audittestsuite/test/filesystem/src/file-write/truncate.c soc2018/aniketp/audittestsuite/test/filesystem/tests/ soc2018/aniketp/audittestsuite/test/filesystem/tests/mkdir-atf0.c soc2018/aniketp/audittestsuite/test/scripts/ soc2018/aniketp/audittestsuite/test/scripts/setup (contents, props changed) soc2018/aniketp/audittestsuite/test/scripts/syscalls soc2018/aniketp/audittestsuite/test/scripts/syscalls.sh (contents, props changed) soc2018/aniketp/audittestsuite/test/sockets/ soc2018/aniketp/audittestsuite/test/sockets/Makefile soc2018/aniketp/audittestsuite/test/sockets/README.md soc2018/aniketp/audittestsuite/test/sockets/run_tests (contents, props changed) soc2018/aniketp/audittestsuite/test/sockets/src/ soc2018/aniketp/audittestsuite/test/sockets/src/tcp_socket.c soc2018/aniketp/audittestsuite/test/sockets/src/udp_client.c soc2018/aniketp/audittestsuite/test/sockets/src/udp_server.c Added: soc2018/aniketp/audittestsuite/LICENSE ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ soc2018/aniketp/audittestsuite/LICENSE Fri May 18 12:36:55 2018 (r337237) @@ -0,0 +1,23 @@ +Copyright (c) 2018, Aniket Pandey +All rights reserved. + +Redistribution and use in source and binary forms, with or without +modification, are permitted provided that the following conditions are met: + +* Redistributions of source code must retain the above copyright notice, this + list of conditions and the following disclaimer. + +* Redistributions in binary form must reproduce the above copyright notice, + this list of conditions and the following disclaimer in the documentation + and/or other materials provided with the distribution. + +THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" +AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE +DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE +FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR +SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER +CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, +OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE +OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. Added: soc2018/aniketp/audittestsuite/README.md ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ soc2018/aniketp/audittestsuite/README.md Fri May 18 12:36:55 2018 (r337237) @@ -0,0 +1,86 @@ +# Regression Test-Suite for Audit Framework + +## Overview +FreeBSD is a rapidly developing operating system with an extreme focus on advanced security & networking features. For an OS with a widespread usage and development, testing and monitoring of security regressions becomes a critical measure. FreeBSD has an audit subsystem which is responsible for monitoring a variety of security-relevant system events, such as user-logins, configuration changes, file system & network access. Although the audit framework is indispensable for security conscious organisations running FreeBSD servers, currently there is no tool to test its reliability and the intended behaviour. + +## Project Description +The project aims to develop a regression test-suite, which will evaluate the audit framework for proper logging of most auditable system calls classified in TCP/IP & UDP sockets, File I/O, process control and device management, along with the semantics of audit trail's BSM/XML/text output. + +BSM tokens can be obtained via I/O multiplexing on a special clonable device `/dev/auditpipe`, by configuring various preselection parameters for local mode auditing with the provided IOCTLs. Several `libbsm(3)` APIs and functions within the FreeBSD kernel can be used to analyse syscall tokens in the audit record. Finally, `kyua(1)`'s run-time engine will be used to automate regression testing of entire operating system at once, `audit(4)` included. + +## Intricacies of Event-Auditing + +#### How is event auditing implemented +FreeBSD uses OpenBSM, an implementation of Sun's BSM event auditing file format and API. OpenBSM is made up of a plethora of tools including audit-viewer applications, e.g `praudit(1)` & `auditreduce(1)` as well as the `libbsm(3)` library to provide an interface to BSM audit record stream. The `auditd(8)` daemon is responsible for managing the kernel’s `audit(4)` mechanism and also rotates the log files whenever required. + +#### How to enable event auditing +FreeBSD already has userspace support for audit system. The audit daemon, `auditd(8)` can be enabled by adding the following line to `/etc/rc.conf`: +``` bash + echo ‘auditd_enable=“YES”’ >> /etc/rc.conf +``` +A safer way is to use `sysrc(8)` +``` bash + sysrc auditd_enable=“YES” +``` +Then start (and stop) the audit daemon, with a new audit trail: +``` bash + service auditd {one}start && audit -n; + service auditd {one}stop +``` + +#### Various configuration options in audit framework +``` bash + dir=‘/etc/security’ +``` +Audit configuration is defined in `${dir}/audit_control`. Various event selection expressions are defined here, also found in `${dir}/audit_class`, which lets a user configure the events to be audited. For example, +* **lo** for login-logout +* **nt** for network communication +* **pc** for process control +* **ad** for administration + +`${dir}/audit_user` specifies events to be audited for each system user, like login attempts. `${dir}/audit_event` contains a list of all auditable system events. + +## Implementation details +The tests will span from simple permission check of the configuration files to exhaustive system call testing. The system calls in question will be categorized in TCP/UDP network sockets, process control, file & IO management. + +In addition to the application program which triggers all processes, there will be a set of ATF test cases which will be created in accordance with FreeBSD Test Suite. A self-contained automation infrastructure will be developed which will enable the independent and ad-hoc testing of the audit system. + +## Explicit System Call Testing +This application would consist of a set of test programs written in `atf-c(3)`, containing independent test cases for triggering similar system calls, e.g open(2) & openat(2). Each program would test a wide variety of functionalities of corresponding system calls. Testing scenarios would ensure that the audit record contains all expected parameters, e.g the arguments, valid argument types, return values etc. The testing will be done for various success and failure modes, with cross-checking for appropriate errno codes in case of failure mode. + +## Test Plan and Current Approach +1. In a situation where the system does not have the audit system enabled, the tests would usually fail or skip. However, the audit daemon can be started (and stopped) by “service auditd one{start, stop}” without modifying `/etc/rc.conf`. This eliminates the need for a setup script as described in the deprecated test plan. + +2. Create separate functions for the startup and termination of the audit daemon. This step also takes into account the possibility of `auditd(8)` running beforehand. If so, the process termination is avoided to maintain the current state of the machine. The running status can be checked by “service auditd onestatus”. + +3. Audit system also allows live auditing via `auditpipe(4)` for IDS and testing purpose. This enables us to open `/dev/auditpipe` and verify the proper audit of the system call in question. Usually in cases like these, `poll(2)` helps in confirming if the opened file descriptor is ready to perform I/O operations. + +4. The system may not have the proper settings in `/etc/security`. This would fail the events not covered by “audit_control” configuration file. However, `auditpipe(4)` describes quite a few `ioctl(2)` requests in audit_ioctl.h for such scenarios. `getauclassnam(3)` can be used to obtain required information from the `audit_class(5)` database. + +## Workplan Report +* [Report1: Network System Call testing](https://gist.github.com/aniketp/4311599ab72efe73d8a3d3e1c93f3759) +* [Report2: File-read System Call testing](https://gist.github.com/aniketp/ada457f284c362da5b4ecae8929a807e) +* [Report3: atf-c(3) test program for mkdir(2)](https://gist.github.com/aniketp/498b0e39b52485d50b67736779622dd6) + +## Directory Structure + +``` + ├── docs --------------------- Relevant documentations and project proposal + ├── src ---------------------- Actual atf-c test-programs for audit(4) + │ ├── file-create.c + │ ├── setup.c -------------- Source file for setup and helper functions + │ └── setup.h + └── test + ├── filesystem + │ ├── run_tests -------- [Automation Script] + │ ├── src + │ │ └── -------------- Source files for testing "fc/fr/fa" audit_class + │ └── tests + │ └── mkdir-atf0.c - Initial test-program for File I/O system calls + ├── sockets + │ ├── run_tests -------- [Automation Script] + │ └── src + │ └── -------------- Source files for testing "nt" audit_class + └── scripts -------------- Helper scripts for collecting stuff from trails +``` +1 Added: soc2018/aniketp/audittestsuite/docs/Proposal.pdf ============================================================================== Binary file. No diff available. Added: soc2018/aniketp/audittestsuite/docs/Report1.pdf ============================================================================== Binary file. No diff available. Added: soc2018/aniketp/audittestsuite/docs/Report2.pdf ============================================================================== Binary file. No diff available. Added: soc2018/aniketp/audittestsuite/docs/Report3.pdf ============================================================================== Binary file. No diff available. Added: soc2018/aniketp/audittestsuite/docs/Test-Scenarios.pdf ============================================================================== Binary file. No diff available. Added: soc2018/aniketp/audittestsuite/src/Makefile ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ soc2018/aniketp/audittestsuite/src/Makefile Fri May 18 12:36:55 2018 (r337237) @@ -0,0 +1,43 @@ +# $FreeBSD$ + +TESTSDIR= ${TESTSBASE}/sys/audit + +ATF_TESTS_C= file-create +ATF_TESTS_C+= file-delete +ATF_TESTS_C+= file-read +ATF_TESTS_C+= file-write +ATF_TESTS_C+= file-attribute-access +ATF_TESTS_C+= file-attribute-modify + +SRCS.file-create+= file-create.c +SRCS.file-create+= utils.c +SRCS.file-delete+= file-delete.c +SRCS.file-delete+= utils.c +SRCS.file-read+= file-read.c +SRCS.file-read+= utils.c +SRCS.file-write+= file-write.c +SRCS.file-write+= utils.c +SRCS.file-attribute-access+= file-attribute-access.c +SRCS.file-attribute-access+= utils.c +SRCS.file-attribute-modify+= file-attribute-modify.c +SRCS.file-attribute-modify+= utils.c + +TEST_METADATA.file-create+= timeout="30" +TEST_METADATA.file-create+= required_user="root" +TEST_METADATA.file-delete+= timeout="30" +TEST_METADATA.file-delete+= required_user="root" +TEST_METADATA.file-read+= timeout="30" +TEST_METADATA.file-read+= required_user="root" +TEST_METADATA.file-write+= timeout="30" +TEST_METADATA.file-write+= required_user="root" +TEST_METADATA.file-attribute-access+= timeout="30" +TEST_METADATA.file-attribute-access+= required_user="root" +TEST_METADATA.file-attribute-modify+= timeout="30" +TEST_METADATA.file-attribute-modify+= required_user="root" + +WARNS?= 6 + +CFLAGS+= -I${.CURDIR:H:H} +LDFLAGS+= -lbsm + +.include <bsd.test.mk> Added: soc2018/aniketp/audittestsuite/src/file-attribute-access.c ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ soc2018/aniketp/audittestsuite/src/file-attribute-access.c Fri May 18 12:36:55 2018 (r337237) @@ -0,0 +1,1985 @@ +/*- + * Copyright 2018 Aniket Pandey + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * SUCH DAMAGE. + * + * $FreeBSD$ + */ + +#include <sys/stat.h> +#include <sys/types.h> +#include <sys/param.h> +#include <sys/ucred.h> +#include <sys/mount.h> +#include <sys/syscall.h> +#include <sys/extattr.h> + +#include <atf-c.h> +#include <fcntl.h> +#include <stdlib.h> +#include <string.h> +#include <unistd.h> + +#include "utils.h" + +static struct pollfd fds[1]; + +static fhandle_t fht; +static mode_t mode = 0777; +static char extregex[80]; +static struct stat statbuff; +static struct statfs statfsbuff; +static const char *name = "authorname"; +static const char *path = "fileforaudit"; +static const char *errpath = "dirdoesnotexist/fileforaudit"; +static const char *successreg = "fileforaudit.*return,success"; +static const char *failurereg = "fileforaudit.*return,failure"; + + +ATF_TC_WITH_CLEANUP(stat_success); +ATF_TC_HEAD(stat_success, tc) +{ + atf_tc_set_md_var(tc, "descr", "Tests the audit of a successful " + "stat(2) call"); +} + +ATF_TC_BODY(stat_success, tc) +{ + /* File needs to exist to call stat(2) */ + ATF_REQUIRE(open(path, O_CREAT, mode) != -1); + FILE *pipefd = setup(fds, "fa"); + ATF_REQUIRE_EQ(0, stat(path, &statbuff)); + check_audit(fds, successreg, pipefd); +} + +ATF_TC_CLEANUP(stat_success, tc) +{ + cleanup(); +} + + +ATF_TC_WITH_CLEANUP(stat_failure); +ATF_TC_HEAD(stat_failure, tc) +{ + atf_tc_set_md_var(tc, "descr", "Tests the audit of an unsuccessful " + "stat(2) call"); +} + +ATF_TC_BODY(stat_failure, tc) +{ + FILE *pipefd = setup(fds, "fa"); + /* Failure reason: file does not exist */ + ATF_REQUIRE_EQ(-1, stat(errpath, &statbuff)); + check_audit(fds, failurereg, pipefd); +} + +ATF_TC_CLEANUP(stat_failure, tc) +{ + cleanup(); +} + + +ATF_TC_WITH_CLEANUP(lstat_success); +ATF_TC_HEAD(lstat_success, tc) +{ + atf_tc_set_md_var(tc, "descr", "Tests the audit of a successful " + "lstat(2) call"); +} + +ATF_TC_BODY(lstat_success, tc) +{ + /* Symbolic link needs to exist to call lstat(2) */ + ATF_REQUIRE_EQ(0, symlink("symlink", path)); + FILE *pipefd = setup(fds, "fa"); + ATF_REQUIRE_EQ(0, lstat(path, &statbuff)); + check_audit(fds, successreg, pipefd); +} + +ATF_TC_CLEANUP(lstat_success, tc) +{ + cleanup(); +} + + +ATF_TC_WITH_CLEANUP(lstat_failure); +ATF_TC_HEAD(lstat_failure, tc) +{ + atf_tc_set_md_var(tc, "descr", "Tests the audit of an unsuccessful " + "lstat(2) call"); +} + +ATF_TC_BODY(lstat_failure, tc) +{ + FILE *pipefd = setup(fds, "fa"); + /* Failure reason: symbolic link does not exist */ + ATF_REQUIRE_EQ(-1, lstat(errpath, &statbuff)); + check_audit(fds, failurereg, pipefd); +} + +ATF_TC_CLEANUP(lstat_failure, tc) +{ + cleanup(); +} + + +ATF_TC_WITH_CLEANUP(fstat_success); +ATF_TC_HEAD(fstat_success, tc) +{ + atf_tc_set_md_var(tc, "descr", "Tests the audit of a successful " + "fstat(2) call"); +} + +ATF_TC_BODY(fstat_success, tc) +{ + int filedesc; + char regex[30]; + + /* File needs to exist to call fstat(2) */ + ATF_REQUIRE((filedesc = open(path, O_CREAT | O_RDWR, mode)) != -1); + FILE *pipefd = setup(fds, "fa"); + ATF_REQUIRE_EQ(0, fstat(filedesc, &statbuff)); + + snprintf(regex, 30, "fstat.*%u.*return,success", statbuff.st_ino); + check_audit(fds, regex, pipefd); +} + +ATF_TC_CLEANUP(fstat_success, tc) +{ + cleanup(); +} + + +ATF_TC_WITH_CLEANUP(fstat_failure); +ATF_TC_HEAD(fstat_failure, tc) +{ + atf_tc_set_md_var(tc, "descr", "Tests the audit of an unsuccessful " + "fstat(2) call"); +} + +ATF_TC_BODY(fstat_failure, tc) +{ + FILE *pipefd = setup(fds, "fa"); + const char *regex = "fstat.*return,failure : Bad file descriptor"; + /* Failure reason: bad file descriptor */ + ATF_REQUIRE_EQ(-1, fstat(-1, &statbuff)); + check_audit(fds, regex, pipefd); +} + +ATF_TC_CLEANUP(fstat_failure, tc) +{ + cleanup(); +} + + +ATF_TC_WITH_CLEANUP(fstatat_success); +ATF_TC_HEAD(fstatat_success, tc) +{ + atf_tc_set_md_var(tc, "descr", "Tests the audit of a successful " + "fstatat(2) call"); +} + +ATF_TC_BODY(fstatat_success, tc) +{ + /* File or Symbolic link needs to exist to call lstat(2) */ + ATF_REQUIRE_EQ(0, symlink("symlink", path)); + FILE *pipefd = setup(fds, "fa"); + ATF_REQUIRE_EQ(0, fstatat(AT_FDCWD, path, &statbuff, \ + AT_SYMLINK_NOFOLLOW)); + check_audit(fds, successreg, pipefd); +} + +ATF_TC_CLEANUP(fstatat_success, tc) +{ + cleanup(); +} + + +ATF_TC_WITH_CLEANUP(fstatat_failure); +ATF_TC_HEAD(fstatat_failure, tc) +{ + atf_tc_set_md_var(tc, "descr", "Tests the audit of an unsuccessful " + "fstatat(2) call"); +} + +ATF_TC_BODY(fstatat_failure, tc) +{ + FILE *pipefd = setup(fds, "fa"); + /* Failure reason: symbolic link does not exist */ + ATF_REQUIRE_EQ(-1, fstatat(AT_FDCWD, path, &statbuff, \ + AT_SYMLINK_NOFOLLOW)); + check_audit(fds, failurereg, pipefd); +} + +ATF_TC_CLEANUP(fstatat_failure, tc) +{ + cleanup(); +} + + +ATF_TC_WITH_CLEANUP(statfs_success); +ATF_TC_HEAD(statfs_success, tc) +{ + atf_tc_set_md_var(tc, "descr", "Tests the audit of a successful " + "statfs(2) call"); +} + +ATF_TC_BODY(statfs_success, tc) +{ + /* File needs to exist to call statfs(2) */ + ATF_REQUIRE(open(path, O_CREAT, mode) != -1); + FILE *pipefd = setup(fds, "fa"); + ATF_REQUIRE_EQ(0, statfs(path, &statfsbuff)); + check_audit(fds, successreg, pipefd); +} + +ATF_TC_CLEANUP(statfs_success, tc) +{ + cleanup(); +} + + +ATF_TC_WITH_CLEANUP(statfs_failure); +ATF_TC_HEAD(statfs_failure, tc) +{ + atf_tc_set_md_var(tc, "descr", "Tests the audit of an unsuccessful " + "statfs(2) call"); +} + +ATF_TC_BODY(statfs_failure, tc) +{ + FILE *pipefd = setup(fds, "fa"); + /* Failure reason: file does not exist */ + ATF_REQUIRE_EQ(-1, statfs(errpath, &statfsbuff)); + check_audit(fds, failurereg, pipefd); +} + +ATF_TC_CLEANUP(statfs_failure, tc) +{ + cleanup(); +} + + +ATF_TC_WITH_CLEANUP(fstatfs_success); +ATF_TC_HEAD(fstatfs_success, tc) +{ + atf_tc_set_md_var(tc, "descr", "Tests the audit of a successful " + "fstatfs(2) call"); +} + +ATF_TC_BODY(fstatfs_success, tc) +{ + int filedesc; + char regex[30]; + + /* File needs to exist to call fstat(2) */ + ATF_REQUIRE((filedesc = open(path, O_CREAT | O_RDWR, mode)) != -1); + /* Call stat(2) to store the Inode number of 'path' */ + ATF_REQUIRE_EQ(0, stat(path, &statbuff)); + FILE *pipefd = setup(fds, "fa"); + ATF_REQUIRE_EQ(0, fstatfs(filedesc, &statfsbuff)); + + snprintf(regex, 30, "fstatfs.*%u.*return,success", statbuff.st_ino); + check_audit(fds, regex, pipefd); +} + +ATF_TC_CLEANUP(fstatfs_success, tc) +{ + cleanup(); +} + + +ATF_TC_WITH_CLEANUP(fstatfs_failure); +ATF_TC_HEAD(fstatfs_failure, tc) +{ + atf_tc_set_md_var(tc, "descr", "Tests the audit of an unsuccessful " + "fstatfs(2) call"); +} + +ATF_TC_BODY(fstatfs_failure, tc) +{ + FILE *pipefd = setup(fds, "fa"); + const char *regex = "fstatfs.*return,failure : Bad file descriptor"; + /* Failure reason: bad file descriptor */ + ATF_REQUIRE_EQ(-1, fstatfs(-1, &statfsbuff)); + check_audit(fds, regex, pipefd); +} + +ATF_TC_CLEANUP(fstatfs_failure, tc) +{ + cleanup(); +} + + +ATF_TC_WITH_CLEANUP(getfsstat_success); +ATF_TC_HEAD(getfsstat_success, tc) +{ + atf_tc_set_md_var(tc, "descr", "Tests the audit of a successful " + "getfsstat(2) call"); +} + +ATF_TC_BODY(getfsstat_success, tc) +{ + const char *regex = "getfsstat.*return,success"; + FILE *pipefd = setup(fds, "fa"); + ATF_REQUIRE(getfsstat(NULL, 0, MNT_NOWAIT) != -1); + check_audit(fds, regex, pipefd); +} + +ATF_TC_CLEANUP(getfsstat_success, tc) +{ + cleanup(); +} + + +ATF_TC_WITH_CLEANUP(getfsstat_failure); +ATF_TC_HEAD(getfsstat_failure, tc) +{ + atf_tc_set_md_var(tc, "descr", "Tests the audit of an unsuccessful " + "getfsstat(2) call"); +} + +ATF_TC_BODY(getfsstat_failure, tc) +{ + const char *regex = "getfsstat.*return,failure : Invalid argument"; + FILE *pipefd = setup(fds, "fa"); + /* Failure reason: Invalid value for mode */ + ATF_REQUIRE_EQ(-1, getfsstat(NULL, 0, -1)); + check_audit(fds, regex, pipefd); +} + +ATF_TC_CLEANUP(getfsstat_failure, tc) +{ + cleanup(); +} + + +ATF_TC_WITH_CLEANUP(fhopen_success); +ATF_TC_HEAD(fhopen_success, tc) +{ + atf_tc_set_md_var(tc, "descr", "Tests the audit of a successful " + "fhopen(2) call"); +} + +ATF_TC_BODY(fhopen_success, tc) +{ + const char *regex = "fhopen.*return,success"; + /* File needs to exist to get a file-handle */ + ATF_REQUIRE(open(path, O_CREAT, mode) != -1); + /* Get the file handle to be passed to fhopen(2) */ + ATF_REQUIRE_EQ(0, getfh(path, &fht)); + + FILE *pipefd = setup(fds, "fa"); + ATF_REQUIRE(fhopen(&fht, O_RDWR) != -1); + check_audit(fds, regex, pipefd); +} + +ATF_TC_CLEANUP(fhopen_success, tc) +{ + cleanup(); +} + + +ATF_TC_WITH_CLEANUP(fhopen_failure); +ATF_TC_HEAD(fhopen_failure, tc) +{ + atf_tc_set_md_var(tc, "descr", "Tests the audit of an unsuccessful " + "fhopen(2) call"); +} + +ATF_TC_BODY(fhopen_failure, tc) +{ + const char *regex = "fhopen.*return,failure : Stale NFS file handle"; + FILE *pipefd = setup(fds, "fa"); + /* Failure reason: fht does not represent any file */ + ATF_REQUIRE_EQ(-1, fhopen(&fht, O_RDWR)); + check_audit(fds, regex, pipefd); +} + +ATF_TC_CLEANUP(fhopen_failure, tc) +{ + cleanup(); +} + + +ATF_TC_WITH_CLEANUP(fhstat_success); +ATF_TC_HEAD(fhstat_success, tc) +{ + atf_tc_set_md_var(tc, "descr", "Tests the audit of a successful " + "fstat(2) call"); +} + +ATF_TC_BODY(fhstat_success, tc) +{ + const char *regex = "fhstat.*return,success"; + /* File needs to exist to get a file-handle */ + ATF_REQUIRE(open(path, O_CREAT, mode) != -1); + /* Get the file handle to be passed to fhstat(2) */ + ATF_REQUIRE_EQ(0, getfh(path, &fht)); + + FILE *pipefd = setup(fds, "fa"); + ATF_REQUIRE_EQ(0, fhstat(&fht, &statbuff)); + check_audit(fds, regex, pipefd); +} + +ATF_TC_CLEANUP(fhstat_success, tc) +{ + cleanup(); +} + + +ATF_TC_WITH_CLEANUP(fhstat_failure); +ATF_TC_HEAD(fhstat_failure, tc) +{ + atf_tc_set_md_var(tc, "descr", "Tests the audit of an unsuccessful " + "fhstat(2) call"); +} + +ATF_TC_BODY(fhstat_failure, tc) +{ + const char *regex = "fhstat.*return,failure : Stale NFS file handle"; + FILE *pipefd = setup(fds, "fa"); + /* Failure reason: fht does not represent any file */ + ATF_REQUIRE_EQ(-1, fhstat(&fht, &statbuff)); + check_audit(fds, regex, pipefd); +} + +ATF_TC_CLEANUP(fhstat_failure, tc) +{ + cleanup(); +} + + +ATF_TC_WITH_CLEANUP(fhstatfs_success); +ATF_TC_HEAD(fhstatfs_success, tc) +{ + atf_tc_set_md_var(tc, "descr", "Tests the audit of a successful " + "fstatfs(2) call"); +} + +ATF_TC_BODY(fhstatfs_success, tc) +{ + const char *regex = "fhstatfs.*return,success"; + /* File needs to exist to get a file-handle */ + ATF_REQUIRE(open(path, O_CREAT, mode) != -1); + /* Get the file handle to be passed to fhstatfs(2) */ + ATF_REQUIRE_EQ(0, getfh(path, &fht)); + + FILE *pipefd = setup(fds, "fa"); + ATF_REQUIRE_EQ(0, fhstatfs(&fht, &statfsbuff)); + check_audit(fds, regex, pipefd); +} + +ATF_TC_CLEANUP(fhstatfs_success, tc) +{ + cleanup(); +} + + +ATF_TC_WITH_CLEANUP(fhstatfs_failure); +ATF_TC_HEAD(fhstatfs_failure, tc) +{ + atf_tc_set_md_var(tc, "descr", "Tests the audit of an unsuccessful " + "fhstatfs(2) call"); +} + +ATF_TC_BODY(fhstatfs_failure, tc) +{ + const char *regex = "fhstatfs.*return,failure : Stale NFS file handle"; + FILE *pipefd = setup(fds, "fa"); + /* Failure reason: fht does not represent any file */ + ATF_REQUIRE_EQ(-1, fhstatfs(&fht, &statfsbuff)); + check_audit(fds, regex, pipefd); +} + +ATF_TC_CLEANUP(fhstatfs_failure, tc) +{ + cleanup(); +} + + +ATF_TC_WITH_CLEANUP(access_success); +ATF_TC_HEAD(access_success, tc) +{ + atf_tc_set_md_var(tc, "descr", "Tests the audit of a successful " + "access(2) call"); +} + +ATF_TC_BODY(access_success, tc) +{ + /* File needs to exist to call access(2) */ + ATF_REQUIRE(open(path, O_CREAT, mode) != -1); + FILE *pipefd = setup(fds, "fa"); + ATF_REQUIRE_EQ(0, access(path, F_OK)); + check_audit(fds, successreg, pipefd); +} + +ATF_TC_CLEANUP(access_success, tc) +{ + cleanup(); +} + + +ATF_TC_WITH_CLEANUP(access_failure); +ATF_TC_HEAD(access_failure, tc) +{ + atf_tc_set_md_var(tc, "descr", "Tests the audit of an unsuccessful " + "access(2) call"); +} + +ATF_TC_BODY(access_failure, tc) +{ + FILE *pipefd = setup(fds, "fa"); + /* Failure reason: file does not exist */ + ATF_REQUIRE_EQ(-1, access(errpath, F_OK)); + check_audit(fds, failurereg, pipefd); +} + +ATF_TC_CLEANUP(access_failure, tc) +{ + cleanup(); +} + + +ATF_TC_WITH_CLEANUP(eaccess_success); +ATF_TC_HEAD(eaccess_success, tc) +{ + atf_tc_set_md_var(tc, "descr", "Tests the audit of a successful " + "eaccess(2) call"); +} + +ATF_TC_BODY(eaccess_success, tc) +{ + /* File needs to exist to call eaccess(2) */ + ATF_REQUIRE(open(path, O_CREAT, mode) != -1); + FILE *pipefd = setup(fds, "fa"); + ATF_REQUIRE_EQ(0, eaccess(path, F_OK)); + check_audit(fds, successreg, pipefd); +} + +ATF_TC_CLEANUP(eaccess_success, tc) +{ + cleanup(); +} + + +ATF_TC_WITH_CLEANUP(eaccess_failure); +ATF_TC_HEAD(eaccess_failure, tc) +{ + atf_tc_set_md_var(tc, "descr", "Tests the audit of an unsuccessful " + "eaccess(2) call"); +} + +ATF_TC_BODY(eaccess_failure, tc) +{ + FILE *pipefd = setup(fds, "fa"); + /* Failure reason: file does not exist */ + ATF_REQUIRE_EQ(-1, eaccess(errpath, F_OK)); + check_audit(fds, failurereg, pipefd); +} + +ATF_TC_CLEANUP(eaccess_failure, tc) +{ + cleanup(); +} + + +ATF_TC_WITH_CLEANUP(faccessat_success); +ATF_TC_HEAD(faccessat_success, tc) +{ + atf_tc_set_md_var(tc, "descr", "Tests the audit of a successful " + "faccessat(2) call"); +} + +ATF_TC_BODY(faccessat_success, tc) +{ + /* File needs to exist to call faccessat(2) */ + ATF_REQUIRE(open(path, O_CREAT, mode) != -1); + FILE *pipefd = setup(fds, "fa"); + ATF_REQUIRE_EQ(0, faccessat(AT_FDCWD, path, F_OK, AT_EACCESS)); + check_audit(fds, successreg, pipefd); +} + +ATF_TC_CLEANUP(faccessat_success, tc) +{ + cleanup(); +} + + +ATF_TC_WITH_CLEANUP(faccessat_failure); +ATF_TC_HEAD(faccessat_failure, tc) +{ + atf_tc_set_md_var(tc, "descr", "Tests the audit of an unsuccessful " + "faccessat(2) call"); +} + +ATF_TC_BODY(faccessat_failure, tc) +{ + FILE *pipefd = setup(fds, "fa"); + /* Failure reason: file does not exist */ + ATF_REQUIRE_EQ(-1, faccessat(AT_FDCWD, errpath, F_OK, AT_EACCESS)); + check_audit(fds, failurereg, pipefd); +} + +ATF_TC_CLEANUP(faccessat_failure, tc) +{ + cleanup(); +} + + +ATF_TC_WITH_CLEANUP(pathconf_success); +ATF_TC_HEAD(pathconf_success, tc) +{ + atf_tc_set_md_var(tc, "descr", "Tests the audit of a successful " + "pathconf(2) call"); +} + +ATF_TC_BODY(pathconf_success, tc) +{ + /* File needs to exist to call pathconf(2) */ + ATF_REQUIRE(open(path, O_CREAT, mode) != -1); + FILE *pipefd = setup(fds, "fa"); + ATF_REQUIRE(pathconf(path, _PC_NAME_MAX) != -1); + check_audit(fds, successreg, pipefd); +} + +ATF_TC_CLEANUP(pathconf_success, tc) +{ + cleanup(); +} + + +ATF_TC_WITH_CLEANUP(pathconf_failure); +ATF_TC_HEAD(pathconf_failure, tc) +{ + atf_tc_set_md_var(tc, "descr", "Tests the audit of an unsuccessful " + "pathconf(2) call"); +} + +ATF_TC_BODY(pathconf_failure, tc) +{ + FILE *pipefd = setup(fds, "fa"); + /* Failure reason: file does not exist */ + ATF_REQUIRE_EQ(-1, pathconf(errpath, _PC_NAME_MAX)); + check_audit(fds, failurereg, pipefd); +} + +ATF_TC_CLEANUP(pathconf_failure, tc) +{ + cleanup(); +} + + +ATF_TC_WITH_CLEANUP(lpathconf_success); +ATF_TC_HEAD(lpathconf_success, tc) +{ + atf_tc_set_md_var(tc, "descr", "Tests the audit of a successful " + "lpathconf(2) call"); +} + +ATF_TC_BODY(lpathconf_success, tc) +{ + /* Symbolic link needs to exist to call lpathconf(2) */ + ATF_REQUIRE_EQ(0, symlink("symlink", path)); + FILE *pipefd = setup(fds, "fa"); + ATF_REQUIRE(lpathconf(path, _PC_SYMLINK_MAX) != -1); + check_audit(fds, successreg, pipefd); +} + +ATF_TC_CLEANUP(lpathconf_success, tc) +{ + cleanup(); +} + + +ATF_TC_WITH_CLEANUP(lpathconf_failure); +ATF_TC_HEAD(lpathconf_failure, tc) +{ + atf_tc_set_md_var(tc, "descr", "Tests the audit of an unsuccessful " + "lpathconf(2) call"); +} + +ATF_TC_BODY(lpathconf_failure, tc) +{ + FILE *pipefd = setup(fds, "fa"); + /* Failure reason: symbolic link does not exist */ + ATF_REQUIRE_EQ(-1, lpathconf(errpath, _PC_SYMLINK_MAX)); + check_audit(fds, failurereg, pipefd); +} + +ATF_TC_CLEANUP(lpathconf_failure, tc) +{ + cleanup(); +} + + +ATF_TC_WITH_CLEANUP(fpathconf_success); +ATF_TC_HEAD(fpathconf_success, tc) +{ + atf_tc_set_md_var(tc, "descr", "Tests the audit of a successful " + "fpathconf(2) call"); +} + +ATF_TC_BODY(fpathconf_success, tc) +{ + int filedesc; + const char *regex = "fpathconf.*return,success"; + /* File needs to exist to call fpathconf(2) */ + ATF_REQUIRE((filedesc = open(path, O_CREAT, mode)) != -1); + FILE *pipefd = setup(fds, "fa"); + ATF_REQUIRE(fpathconf(filedesc, _PC_NAME_MAX) != -1); + check_audit(fds, regex, pipefd); +} + +ATF_TC_CLEANUP(fpathconf_success, tc) +{ + cleanup(); +} + + +ATF_TC_WITH_CLEANUP(fpathconf_failure); +ATF_TC_HEAD(fpathconf_failure, tc) +{ + atf_tc_set_md_var(tc, "descr", "Tests the audit of an unsuccessful " + "fpathconf(2) call"); +} + +ATF_TC_BODY(fpathconf_failure, tc) +{ + FILE *pipefd = setup(fds, "fa"); + const char *regex = "fpathconf.*return,failure : Bad file descriptor"; + /* Failure reason: Bad file descriptor */ + ATF_REQUIRE_EQ(-1, fpathconf(-1, _PC_NAME_MAX)); + check_audit(fds, regex, pipefd); +} + +ATF_TC_CLEANUP(fpathconf_failure, tc) +{ + cleanup(); +} + + +ATF_TC_WITH_CLEANUP(extattr_get_file_success); +ATF_TC_HEAD(extattr_get_file_success, tc) +{ + atf_tc_set_md_var(tc, "descr", "Tests the audit of a successful " + "extattr_get_file(2) call"); +} + +ATF_TC_BODY(extattr_get_file_success, tc) +{ + const char *buff = "ezio"; + /* File needs to exist to call extattr_get_file(2) */ + ATF_REQUIRE(open(path, O_CREAT, mode) != -1); + ATF_REQUIRE_EQ(sizeof(buff), extattr_set_file(path, \ + EXTATTR_NAMESPACE_USER, name, buff, sizeof(buff))); + + /* Prepare the regex to be checked in the audit record */ + snprintf(extregex, 80, "extattr_get_file.*%s.*%s.*return,success,%lu", \ + path, name, sizeof(buff)); + + FILE *pipefd = setup(fds, "fa"); + ATF_REQUIRE_EQ(sizeof(buff), extattr_get_file(path, \ + EXTATTR_NAMESPACE_USER, name, NULL, 0)); + check_audit(fds, extregex, pipefd); +} + +ATF_TC_CLEANUP(extattr_get_file_success, tc) +{ + cleanup(); +} + + +ATF_TC_WITH_CLEANUP(extattr_get_file_failure); +ATF_TC_HEAD(extattr_get_file_failure, tc) +{ + atf_tc_set_md_var(tc, "descr", "Tests the audit of an unsuccessful " + "extattr_get_file(2) call"); +} + +ATF_TC_BODY(extattr_get_file_failure, tc) +{ + /* Prepare the regex to be checked in the audit record */ + snprintf(extregex, 80, "extattr_get_file.*%s.*%s.*failure", path, name); + + FILE *pipefd = setup(fds, "fa"); + /* Failure reason: file does not exist */ + ATF_REQUIRE_EQ(-1, extattr_get_file(path, \ + EXTATTR_NAMESPACE_USER, name, NULL, 0)); + check_audit(fds, extregex, pipefd); +} + +ATF_TC_CLEANUP(extattr_get_file_failure, tc) +{ + cleanup(); +} + + *** DIFF OUTPUT TRUNCATED AT 1000 LINES ***
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201805181236.w4ICauin095226>