NuKVM/libvirt
3
0
Fork 0
mirror of https://github.com/libvirt/libvirt.git synced 2026-08-02 09:29:35 -05:00
Code Issues Packages Projects Releases Wiki Activity

Basic framework for auditing integration

Browse Source 
Integrate with libaudit.so for auditing of important operations.
libvirtd gains a couple of config entries for auditing. By
default it will enable auditing, if its enabled on the host.
It can be configured to force exit if auditing is disabled
on the host. It will can also send audit messages via libvirt
internal logging API

Places requiring audit reporting can use the VIR_AUDIT
macro to report data. This is a no-op unless auditing is
enabled

* autobuild.sh, mingw32-libvirt.spec.in: Disable audit
  on mingw
* configure.ac: Add check for libaudit
* daemon/libvirtd.aug, daemon/libvirtd.conf,
  daemon/test_libvirtd.aug, daemon/libvirtd.c: Add config
  options to enable auditing
* include/libvirt/virterror.h, src/util/virterror.c: Add
  VIR_FROM_AUDIT source
* libvirt.spec.in: Enable audit
* src/util/virtaudit.h, src/util/virtaudit.c: Simple internal
  API for auditing messages
This commit is contained in:
Daniel P. Berrange
2010-10-19 17:31:31 +01:00
parent ba5c9afffa
commit 8f680ad3b8
14 changed files with 327 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/Makefile.am
+8 -5
View File
@@ -59,6 +59,7 @@ UTIL_SOURCES = \
util/conf.c util/conf.h \
util/cgroup.c util/cgroup.h \
util/event.c util/event.h \
util/files.c util/files.h \
util/hash.c util/hash.h \
util/hooks.c util/hooks.h \
util/iptables.c util/iptables.h \
@@ -82,8 +83,8 @@ UTIL_SOURCES = \
util/uuid.c util/uuid.h \
util/util.c util/util.h \
util/xml.c util/xml.h \
util/virterror.c util/virterror_internal.h \
util/files.c util/files.h
util/virtaudit.c util/virtaudit.h \
util/virterror.c util/virterror_internal.h
EXTRA_DIST += util/threads-pthread.c util/threads-win32.c
@@ -426,8 +427,9 @@ libvirt_la_BUILT_LIBADD = libvirt_util.la
libvirt_util_la_SOURCES = \
$(UTIL_SOURCES)
libvirt_util_la_CFLAGS = $(CAPNG_CFLAGS) $(YAJL_CFLAGS) $(LIBNL_CFLAGS) \
$(AM_CFLAGS)
libvirt_util_la_LIBADD = $(CAPNG_LIBS) $(YAJL_LIBS) $(LIBNL_LIBS) $(LIB_PTHREAD)
$(AM_CFLAGS) $(AUDIT_CFLAGS)
libvirt_util_la_LIBADD = $(CAPNG_LIBS) $(YAJL_LIBS) $(LIBNL_LIBS) \
$(LIB_PTHREAD) $(AUDIT_LIBS)
noinst_LTLIBRARIES += libvirt_conf.la
@@ -1120,12 +1122,13 @@ libvirt_lxc_SOURCES = \
libvirt_lxc_LDFLAGS = $(WARN_CFLAGS) $(AM_LDFLAGS)
libvirt_lxc_LDADD = $(CAPNG_LIBS) $(YAJL_LIBS) \
$(LIBXML_LIBS) $(NUMACTL_LIBS) $(LIB_PTHREAD) \
$(LIBNL_LIBS) ../gnulib/lib/libgnu.la
$(LIBNL_LIBS) $(AUDIT_LIBS) ../gnulib/lib/libgnu.la
libvirt_lxc_CFLAGS = \
$(LIBPARTED_CFLAGS) \
$(NUMACTL_CFLAGS) \
$(CAPNG_CFLAGS) \
$(YAJL_CFLAGS) \
$(AUDIT_CFLAGS) \
-I@top_srcdir@/src/conf \
$(AM_CFLAGS)
endif
src/util/virtaudit.c
+144
View File
@@ -0,0 +1,144 @@
/*
* audit.h: auditing support
*
* Copyright (C) 2010 Red Hat, Inc.
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation; either
* version 2.1 of the License, or (at your option) any later version.
*
* This library is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public
* License along with this library; if not, write to the Free Software
* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
*
*/
#include <config.h>
#ifdef HAVE_AUDIT
# include <libaudit.h>
#endif
#include <stdio.h>
#include <unistd.h>
#include "virterror_internal.h"
#include "logging.h"
#include "virtaudit.h"
/* Provide the macros in case the header file is old.
FIXME: should be removed. */
#ifndef AUDIT_VIRT_CONTROL
# define AUDIT_VIRT_CONTROL 2500 /* Start, Pause, Stop VM */
#endif
#ifndef AUDIT_VIRT_RESOURCE
# define AUDIT_VIRT_RESOURCE 2501 /* Resource assignment */
#endif
#ifndef AUDIT_VIRT_MACHINE_ID
# define AUDIT_VIRT_MACHINE_ID 2502 /* Binding of label to VM */
#endif
#define VIR_FROM_THIS VIR_FROM_AUDIT
#if HAVE_AUDIT
static int auditfd = -1;
#endif
static int auditlog = 0;
int virAuditOpen(void)
{
#if HAVE_AUDIT
if ((auditfd = audit_open()) < 0) {
virReportSystemError(errno, "%s", _("Unable to initialize audit layer"));
return -1;
}
return 0;
#else
return -1;
#endif
}
void virAuditLog(int logging)
{
auditlog = logging;
}
#if HAVE_AUDIT
void virAuditSend(const char *file ATTRIBUTE_UNUSED, const char *func, size_t linenr,
const char *clienttty, const char *clientaddr,
enum virAuditRecordType type, bool success,
const char *fmt, ...)
#else
void virAuditSend(const char *file ATTRIBUTE_UNUSED, const char *func, size_t linenr,
const char *clienttty ATTRIBUTE_UNUSED,
const char *clientaddr ATTRIBUTE_UNUSED,
enum virAuditRecordType type, bool success,
const char *fmt, ...)
#endif
{
char *str = NULL;
va_list args;
/* Duplicate later checks, to short circuit & avoid printf overhead
* when nothing is enabled */
#if HAVE_AUDIT
if (!auditlog && auditfd < 0)
return;
#else
if (!auditlog)
return;
#endif
va_start(args, fmt);
if (vasprintf(&str, fmt, args) < 0) {
VIR_WARN0("Out of memory while formatting audit message");
str = NULL;
}
va_end(args);
if (auditlog && str) {
if (success)
virLogMessage("audit", VIR_LOG_INFO, func, linenr, 0,
"success=yes %s", str);
else
virLogMessage("audit", VIR_LOG_WARN, func, linenr, 0,
"success=no %s", str);
}
#if HAVE_AUDIT
if (auditfd < 0)
return;
if (str) {
static const int record_types[] = {
[VIR_AUDIT_RECORD_MACHINE_CONTROL] = AUDIT_VIRT_CONTROL,
[VIR_AUDIT_RECORD_MACHINE_ID] = AUDIT_VIRT_MACHINE_ID,
[VIR_AUDIT_RECORD_RESOURCE] = AUDIT_VIRT_RESOURCE,
};
if (type > ARRAY_CARDINALITY(record_types) || record_types[type] == 0)
VIR_WARN("Unknown audit record type %d", type);
else if (audit_log_user_message(auditfd, record_types[type], str, NULL,
clientaddr, clienttty, success) < 0) {
char ebuf[1024];
VIR_WARN("Failed to send audit message %s: %s",
NULLSTR(str), virStrerror(errno, ebuf, sizeof ebuf));
}
}
#endif
}
void virAuditClose(void)
{
#if HAVE_AUDIT
close(auditfd);
#endif
}
src/util/virtaudit.h
+55
View File
@@ -0,0 +1,55 @@
/*
* audit.h: auditing support
*
* Copyright (C) 2010 Red Hat, Inc.
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation; either
* version 2.1 of the License, or (at your option) any later version.
*
* This library is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public
* License along with this library; if not, write to the Free Software
* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
*
*/
#ifndef __LIBVIRT_AUDIT_H__
# define __LIBVIRT_AUDIT_H__
# include "internal.h"
# include <stdbool.h>
enum virAuditRecordType {
VIR_AUDIT_RECORD_MACHINE_CONTROL,
VIR_AUDIT_RECORD_MACHINE_ID,
VIR_AUDIT_RECORD_RESOURCE,
};
int virAuditOpen(void);
void virAuditLog(int enabled);
void virAuditSend(const char *file, const char *func, size_t linenr,
const char *clienttty, const char *clientaddr,
enum virAuditRecordType type, bool success,
const char *fmt, ...);
void virAuditClose(void);
# define VIR_AUDIT(type, success, ...) \
virAuditSend(__FILE__, __func__, __LINE__, \
NULL, NULL, type, success, __VA_ARGS__);
# define VIR_AUDIT_USER(type, success, clienttty, clientaddr, ...) \
virAuditSend(__FILE__, __func__, __LINE__, \
clienttty, clientaddr, type, success, __VA_ARGS__);
#endif /* __LIBVIRT_AUDIT_H__ */
src/util/virterror.c
+3
View File
@@ -187,6 +187,9 @@ static const char *virErrorDomainName(virErrorDomain domain) {
case VIR_FROM_DOMAIN_SNAPSHOT:
dom = "Domain Snapshot ";
break;
case VIR_FROM_AUDIT:
dom = "Audit";
break;
}
return(dom);
}