30c30
< * $FreeBSD: head/sys/security/audit/audit_worker.c 159265 2006-06-05 14:09:59Z rwatson $
---
> * $FreeBSD: head/sys/security/audit/audit_worker.c 159269 2006-06-05 14:48:17Z rwatson $
317a318,319
> au_class_t class;
> au_event_t event;
318a321,322
> au_id_t auid;
> int sorf;
320c324,325
< if (ar->k_ar_commit & AR_COMMIT_USER) {
---
> if ((ar->k_ar_commit & AR_COMMIT_USER) &&
> (ar->k_ar_commit & AR_PRESELECT_TRAIL)) {
327d331
< audit_pipe_submit(ar->k_udata, ar->k_ulen);
328a333,335
> if ((ar->k_ar_commit & AR_COMMIT_USER) &&
> (ar->k_ar_commit & AR_PRESELECT_PIPE))
> audit_pipe_submit_user(ar->k_udata, ar->k_ulen);
330,334c337,338
< if (ar->k_ar_commit & AR_COMMIT_KERNEL) {
< ret = kaudit_to_bsm(ar, &bsm);
< switch (ret) {
< case BSM_NOAUDIT:
< break;
---
> if (!(ar->k_ar_commit & AR_COMMIT_KERNEL))
> return;
336,338c340,346
< case BSM_FAILURE:
< printf("audit_worker_process_record: BSM_FAILURE\n");
< break;
---
> auid = ar->k_ar.ar_subj_auid;
> event = ar->k_ar.ar_event;
> class = au_event_class(event);
> if (ar->k_ar.ar_errno == 0)
> sorf = AU_PRS_SUCCESS;
> else
> sorf = AU_PRS_FAILURE;
340,351c348,351
< case BSM_SUCCESS:
< error = audit_record_write(audit_vp, audit_cred,
< audit_td, bsm->data, bsm->len);
< if (error && audit_panic_on_write_fail)
< panic("audit_worker: write error %d\n",
< error);
< else if (error)
< printf("audit_worker: write error %d\n",
< error);
< audit_pipe_submit(bsm->data, bsm->len);
< kau_free(bsm);
< break;
---
> ret = kaudit_to_bsm(ar, &bsm);
> switch (ret) {
> case BSM_NOAUDIT:
> return;
353,355c353,361
< default:
< panic("kaudit_to_bsm returned %d", ret);
< }
---
> case BSM_FAILURE:
> printf("audit_worker_process_record: BSM_FAILURE\n");
> return;
>
> case BSM_SUCCESS:
> break;
>
> default:
> panic("kaudit_to_bsm returned %d", ret);
356a363,378
>
> if (ar->k_ar_commit & AR_PRESELECT_TRAIL) {
> error = audit_record_write(audit_vp, audit_cred,
> audit_td, bsm->data, bsm->len);
> if (error && audit_panic_on_write_fail)
> panic("audit_worker: write error %d\n",
> error);
> else if (error)
> printf("audit_worker: write error %d\n",
> error);
> }
> if (ar->k_ar_commit & AR_PRESELECT_PIPE)
> audit_pipe_submit(auid, event, class, sorf,
> ar->k_ar_commit & AR_PRESELECT_TRAIL, bsm->data,
> bsm->len);
> kau_free(bsm);