| audit.c (171144) | audit.c (172995) |
|---|---|
| 1/* 2 * Copyright (c) 1999-2005 Apple Computer, Inc. 3 * Copyright (c) 2006-2007 Robert N. M. Watson 4 * All rights reserved. 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions 8 * are met: --- 13 unchanged lines hidden (view full) --- 22 * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 23 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 24 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 25 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 26 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING 27 * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 28 * POSSIBILITY OF SUCH DAMAGE. 29 * | 1/* 2 * Copyright (c) 1999-2005 Apple Computer, Inc. 3 * Copyright (c) 2006-2007 Robert N. M. Watson 4 * All rights reserved. 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions 8 * are met: --- 13 unchanged lines hidden (view full) --- 22 * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 23 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 24 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 25 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 26 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING 27 * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 28 * POSSIBILITY OF SUCH DAMAGE. 29 * |
| 30 * $FreeBSD: head/sys/security/audit/audit.c 171144 2007-07-01 20:51:30Z rwatson $ | 30 * $FreeBSD: head/sys/security/audit/audit.c 172995 2007-10-26 01:23:07Z csjp $ |
| 31 */ 32 33#include <sys/param.h> 34#include <sys/condvar.h> 35#include <sys/conf.h> 36#include <sys/file.h> 37#include <sys/filedesc.h> 38#include <sys/fcntl.h> --- 529 unchanged lines hidden (view full) --- 568} 569 570void 571audit_thread_free(struct thread *td) 572{ 573 574 KASSERT(td->td_ar == NULL, ("audit_thread_free: td_ar != NULL")); 575} | 31 */ 32 33#include <sys/param.h> 34#include <sys/condvar.h> 35#include <sys/conf.h> 36#include <sys/file.h> 37#include <sys/filedesc.h> 38#include <sys/fcntl.h> --- 529 unchanged lines hidden (view full) --- 568} 569 570void 571audit_thread_free(struct thread *td) 572{ 573 574 KASSERT(td->td_ar == NULL, ("audit_thread_free: td_ar != NULL")); 575} |
| 576 577void 578audit_proc_coredump(struct thread *td, char *path, int errcode) 579{ 580 struct kaudit_record *ar; 581 struct au_mask *aumask; 582 au_class_t class; 583 int ret, sorf; 584 char **pathp; 585 au_id_t auid; 586 587 /* 588 * Make sure we are using the correct preselection mask. 589 */ 590 auid = td->td_ucred->cr_audit.ai_auid; 591 if (auid == AU_DEFAUDITID) 592 aumask = &audit_nae_mask; 593 else 594 aumask = &td->td_ucred->cr_audit.ai_mask; 595 /* 596 * It's possible for coredump(9) generation to fail. Make sure that 597 * we handle this case correctly for preselection. 598 */ 599 if (errcode != 0) 600 sorf = AU_PRS_FAILURE; 601 else 602 sorf = AU_PRS_SUCCESS; 603 class = au_event_class(AUE_CORE); 604 if (au_preselect(AUE_CORE, class, aumask, sorf) == 0) 605 return; 606 /* 607 * If we are interested in seeing this audit record, allocate it. 608 * Where possible coredump records should contain a pathname and arg32 609 * (signal) tokens. 610 */ 611 ar = audit_new(AUE_CORE, td); 612 if (path != NULL) { 613 pathp = &ar->k_ar.ar_arg_upath1; 614 *pathp = malloc(MAXPATHLEN, M_AUDITPATH, M_WAITOK); 615 canon_path(td, path, *pathp); 616 ARG_SET_VALID(ar, ARG_UPATH1); 617 } 618 ar->k_ar.ar_arg_signum = td->td_proc->p_sig; 619 ARG_SET_VALID(ar, ARG_SIGNUM); 620 if (errcode != 0) 621 ret = 1; 622 audit_commit(ar, errcode, ret); 623} |
|