auditd: Support logging directly to syslog

Every tenth call to auditwarnlog(), check that the audit_warn(5) script
exists and is executable by us.  If it is, execute it as previously;
otherwise, fall back to calling syslog(3) directly.

Additionally, if we choose to use the script and fail, also log the
original message to syslogd, not just the fact that we failed to log.

We could record the result of trying to execute the script, but that
would require pausing while it runs (or at least until the execve(2)
call has completed).

Retesting every tenth call is a little clunky but avoids having to
restart or signal auditd(8) to force it to notice a change in
availability, or adding a command-line option and / or modifying the
audit_control(5) syntax to let the user express a preference.

MFC after:	1 week
Sponsored by:	Klara, Inc.
Sponsored by:	Qualys, Inc.
Reviewed by:	kevans
Differential Revision:	https://reviews.freebsd.org/D60172

contrib/openbsm/bin/auditd/audit_warn.c

@@ -36,16 +36,52 @@
 
 #include "auditd.h"
 
+#define USE_SCRIPT_RECHECK 10
+
 /*
  * Write an audit-related error to the system log via syslog(3).
  */
 static int
+auditwarnsyslog(char *args[])
+{
+	/*
+	 * Don't waste time and memory assembling a log message in a
+	 * buffer before calling syslog(3); none of our callers pass more
+	 * than two arguments.  Note that main() always calls openlog(3),
+	 * so no additional setup is required.
+	 */
+	// assert(args[0] != NULL);
+	if (args[1] == NULL) {
+		syslog(LOG_WARNING, "audit warning: %s", args[0]);
+	} else {
+		syslog(LOG_WARNING, "audit warning: %s %s", args[0], args[1]);
+		// assert(args[2] == NULL);
+	}
+	return (0);
+}
+
+/*
+ * Log an audit-related error
+ */
+static int
 auditwarnlog(char *args[])
 {
+	static int use_script;
 	char *loc_args[9];
 	pid_t pid;
 	int i;
 
+	if (use_script == 0) {
+		if (eaccess(AUDITWARN_SCRIPT, X_OK) == 0)
+			use_script = USE_SCRIPT_RECHECK;
+		else
+			use_script = -USE_SCRIPT_RECHECK;
+	}
+	if (use_script < 0) {
+		use_script++;
+		return (auditwarnsyslog(args));
+	}
+	use_script--;
 	loc_args[0] = AUDITWARN_SCRIPT;
 	for (i = 0; args[i] != NULL && i < 8; i++)
 		loc_args[i+1] = args[i];
@@ -64,7 +100,8 @@ auditwarnlog(char *args[])
 		execv(AUDITWARN_SCRIPT, loc_args);
 		syslog(LOG_ERR, "Could not exec %s (%m)\n",
 		    AUDITWARN_SCRIPT);
-		exit(1);
+		(void)auditwarnsyslog(args);
+		_Exit(1);
 	}
 	/*
 	 * Parent.

contrib/openbsm/man/audit_warn.5

@@ -47,6 +47,11 @@ Administrators may replace this script: a more comprehensive one would take
 different actions based on the type of warning.
 For example, a low-space warning
 could result in an email message being sent to the administrator.
+.Pp
+If the script does not exist or is not executable,
+.Xr auditd 8
+will log directly to
+.Xr syslogd 8 .
 .Sh FILES
 .Bl -tag -width "/etc/security/audit_warn" -compact
 .It Pa /etc/security/audit_warn
@@ -54,7 +59,8 @@ could result in an email message being sent to the administrator.
 .Sh SEE ALSO
 .Xr logger 1 ,
 .Xr audit 4 ,
-.Xr auditd 8
+.Xr auditd 8 ,
+.Xr syslogd 8
 .Sh HISTORY
 The OpenBSM implementation was created by McAfee Research, the security
 division of McAfee Inc., under contract to Apple Computer Inc.\& in 2004.