test: rmaudit.c Source File

Main Page | Class Hierarchy | Class List | File List | Class Members | File Members

# rmaudit.c

Go to the documentation of this file.

    00001 /*++
    00002
    00003 Copyright (c) 1989  Microsoft Corporation
    00004
    00005 Module Name:
    00006
    00007     rmaudit.c
    00008
    00009 Abstract:
    00010
    00011    This module contains the Reference Monitor Auditing Command Workers.
    00012    These workers call functions in the Auditing sub-component to do the real
    00013    work.
    00014
    00015 Author:
    00016
    00017     Scott Birrell      (ScottBi)        November 14,1991
    00018
    00019 Environment:
    00020
    00021     Kernel mode only.
    00022
    00023 Revision History:
    00024
    00025 --*/
    00026
    00027 #include <nt.h>
    00028 #include <ntlsa.h>
    00029 #include <ntos.h>
    00030 #include <ntrmlsa.h>
    00031 #include "sep.h"
    00032 #include "adt.h"
    00033 #include "adtp.h"
    00034 #include "rmp.h"
    00035
    00036 VOID
    00037 SepRmSetAuditLogWrkr(
    00038     IN PRM_COMMAND_MESSAGE CommandMessage,
    00039     OUT PRM_REPLY_MESSAGE ReplyMessage
    00040     );
    00041
    00042
    00043 #ifdef ALLOC_PRAGMA
    00044 #pragma alloc_text(PAGE,SepRmSetAuditEventWrkr)
    00045 #pragma alloc_text(PAGE,SepRmSetAuditLogWrkr)
    00046 #endif
    00047
    00048
    00049
    00050 VOID
    00051 SepRmSetAuditEventWrkr(
    00052     IN PRM_COMMAND_MESSAGE CommandMessage,
    00053     OUT PRM_REPLY_MESSAGE ReplyMessage
    00054     )
    00055
    00056 /*++
    00057
    00058 Routine Description:
    00059
    00060     This function carries out the Reference Monitor Set Audit Event
    00061     Command.  This command enables or disables auditing and optionally
    00062     sets the auditing events.
    00063
    00064
    00065 Arguments:
    00066
    00067     CommandMessage - Pointer to structure containing RM command message
    00068         information consisting of an LPC PORT_MESSAGE structure followed
    00069         by the command number (RmSetAuditStateCommand) and a single command
    00070         parameter in structure form.
    00071
    00072     ReplyMessage - Pointer to structure containing RM reply message
    00073         information consisting of an LPC PORT_MESSAGE structure followed
    00074         by the command ReturnedStatus field in which a status code from the
    00075         command will be returned.
    00076
    00077 Return Value:
    00078
    00079     VOID
    00080
    00081 --*/
    00082
    00083 {
    00084
    00085     PPOLICY_AUDIT_EVENT_OPTIONS EventAuditingOptions;
    00086     POLICY_AUDIT_EVENT_TYPE EventType;
    00087
    00088     PAGED_CODE();
    00089
    00090     SepAdtInitializeBounds();
    00091
    00092     ReplyMessage->ReturnedStatus = STATUS_SUCCESS;
    00093
    00094     //
    00095     // Strict check that command is correct one for this worker.
    00096     //
    00097
    00098     ASSERT( CommandMessage->CommandNumber == RmAuditSetCommand );
    00099
    00100     //
    00101     // Extract the AuditingMode flag and put it in the right place.
    00102     //
    00103
    00104     SepAdtAuditingEnabled = (((PLSARM_POLICY_AUDIT_EVENTS_INFO) CommandMessage->CommandParams)->
    00105                                 AuditingMode);
    00106
    00107     //
    00108     // For each element in the passed array, process changes to audit
    00109     // nothing, and then success or failure flags.
    00110     //
    00111
    00112     EventAuditingOptions = ((PLSARM_POLICY_AUDIT_EVENTS_INFO) CommandMessage->CommandParams)->
    00113                            EventAuditingOptions;
    00114
    00115
    00116     for ( EventType=AuditEventMinType;
    00117           EventType <= AuditEventMaxType;
    00118           EventType++ ) {
    00119
    00120         SeAuditingState[EventType].AuditOnSuccess = FALSE;
    00121         SeAuditingState[EventType].AuditOnFailure = FALSE;
    00122
    00123         if ( EventAuditingOptions[EventType] & POLICY_AUDIT_EVENT_SUCCESS ) {
    00124
    00125             SeAuditingState[EventType].AuditOnSuccess = TRUE;
    00126         }
    00127
    00128         if ( EventAuditingOptions[EventType] & POLICY_AUDIT_EVENT_FAILURE ) {
    00129
    00130             SeAuditingState[EventType].AuditOnFailure = TRUE;
    00131         }
    00132     }
    00133
    00134     //
    00135     // Set the flag to indicate that we're auditing detailed events.
    00136     // This is merely a timesaver so we can skip auditing setup in
    00137     // time critical places like process creation.
    00138     //
    00139
    00140     //
    00141     // Despite what the UI may imply, we never audit failures for detailed events, since
    00142     // none of them can fail for security related reasons, and we're not interested in
    00143     // auditing out of memory errors and stuff like that.  So just set this flag when
    00144     // they want to see successes and ignore the failure case.
    00145     //
    00146     // We may have to revisit this someday.
    00147     //
    00148
    00149     if ( SeAuditingState[AuditCategoryDetailedTracking].AuditOnSuccess && SepAdtAuditingEnabled ) {
    00150
    00151         SeDetailedAuditing = TRUE;
    00152
    00153     } else {
    00154
    00155         SeDetailedAuditing = FALSE;
    00156     }
    00157
    00158     return;
    00159 }
    00160
    00161
    00162
    00163 VOID
    00164 SepRmSetAuditLogWrkr(
    00165     IN PRM_COMMAND_MESSAGE CommandMessage,
    00166     OUT PRM_REPLY_MESSAGE ReplyMessage
    00167     )
    00168
    00169 /*++
    00170
    00171 Routine Description:
    00172
    00173     This function carries out the Reference Monitor Set Audit Log
    00174     Command.  This command stores parameters related to the Audit Log.
    00175
    00176 Arguments:
    00177
    00178     CommandMessage - Pointer to structure containing RM command message
    00179         information consisting of an LPC PORT_MESSAGE structure followed
    00180         by the command number (RmSetAuditStateCommand) and a single command
    00181         parameter in structure form.
    00182
    00183     ReplyMessage - Pointer to structure containing RM reply message
    00184         information consisting of an LPC PORT_MESSAGE structure followed
    00185         by the command ReturnedStatus field in which a status code from the
    00186         command will be returned.
    00187
    00188 Return Value:
    00189
    00190     None.  A status code is returned in ReplyMessage->ReturnedStatus
    00191
    00192 --*/
    00193
    00194 {
    00195     //
    00196     // Strict check that command is correct one for this worker.
    00197     //
    00198
    00199 /* BUGWARNING - SCOTTBI - Auditing is disabled
    00200
    00201     ASSERT( CommandMessage->CommandNumber == RmSetAuditLogCommand );
    00202
    00203 */
    00204
    00205     PAGED_CODE();
    00206
    00207 #if DBG
    00208     DbgPrint("Security: RM Set Audit Log Command Received\n");
    00209 #endif
    00210
    00211     //
    00212     // Call private function in Auditing Sub-component to do the work.
    00213     //
    00214
    00215     SepAdtSetAuditLogInformation(
    00216         (PPOLICY_AUDIT_LOG_INFO) CommandMessage->CommandParams
    00217         );
    00218
    00219     ReplyMessage->ReturnedStatus = STATUS_SUCCESS;
    00220 }
    00221