Lines Matching defs:ar
226 audit_record_ctor(proc_t p, struct kaudit_record *ar)
230 bzero(ar, sizeof(*ar));
231 ar->k_ar.ar_magic = AUDIT_RECORD_MAGIC;
232 nanotime(&ar->k_ar.ar_starttime);
240 cru2x(cred, &ar->k_ar.ar_subj_cred);
241 ar->k_ar.ar_subj_ruid = kauth_cred_getruid(cred);
242 ar->k_ar.ar_subj_rgid = kauth_cred_getrgid(cred);
243 ar->k_ar.ar_subj_egid = kauth_cred_getgid(cred);
244 ar->k_ar.ar_subj_pid = p->p_pid;
245 ar->k_ar.ar_subj_auid = cred->cr_audit.as_aia_p->ai_auid;
246 ar->k_ar.ar_subj_asid = cred->cr_audit.as_aia_p->ai_asid;
247 bcopy(&cred->cr_audit.as_mask, &ar->k_ar.ar_subj_amask,
250 &ar->k_ar.ar_subj_term_addr, sizeof(struct au_tid_addr));
256 audit_record_dtor(struct kaudit_record *ar)
259 if (ar->k_ar.ar_arg_upath1 != NULL)
260 free(ar->k_ar.ar_arg_upath1, M_AUDITPATH);
261 if (ar->k_ar.ar_arg_upath2 != NULL)
262 free(ar->k_ar.ar_arg_upath2, M_AUDITPATH);
263 if (ar->k_ar.ar_arg_kpath1 != NULL)
264 free(ar->k_ar.ar_arg_kpath1, M_AUDITPATH);
265 if (ar->k_ar.ar_arg_kpath2 != NULL)
266 free(ar->k_ar.ar_arg_kpath2, M_AUDITPATH);
267 if (ar->k_ar.ar_arg_text != NULL)
268 free(ar->k_ar.ar_arg_text, M_AUDITTEXT);
269 if (ar->k_ar.ar_arg_opaque != NULL)
270 free(ar->k_ar.ar_arg_opaque, M_AUDITDATA);
271 if (ar->k_ar.ar_arg_data != NULL)
272 free(ar->k_ar.ar_arg_data, M_AUDITDATA);
273 if (ar->k_udata != NULL)
274 free(ar->k_udata, M_AUDITDATA);
275 if (ar->k_ar.ar_arg_argv != NULL)
276 free(ar->k_ar.ar_arg_argv, M_AUDITTEXT);
277 if (ar->k_ar.ar_arg_envv != NULL)
278 free(ar->k_ar.ar_arg_envv, M_AUDITTEXT);
377 struct kaudit_record *ar;
407 ar = zalloc(audit_record_zone);
408 if (ar == NULL)
410 audit_record_ctor(p, ar);
411 ar->k_ar.ar_event = event;
415 if (audit_mac_new(p, ar) != 0) {
416 zfree(audit_record_zone, ar);
420 ar->k_ar.ar_mac_records = NULL;
427 return (ar);
431 audit_free(struct kaudit_record *ar)
434 audit_record_dtor(ar);
436 if (NULL != ar->k_ar.ar_mac_records)
437 audit_mac_free(ar);
439 zfree(audit_record_zone, ar);
443 audit_commit(struct kaudit_record *ar, int error, int retval)
452 if (ar == NULL)
459 if (ar->k_ar.ar_subj_auid == AU_DEFAUDITID)
462 aumask = &ar->k_ar.ar_subj_amask;
469 switch(ar->k_ar.ar_event) {
476 ar->k_ar.ar_event = audit_flags_and_error_to_openevent(
477 ar->k_ar.ar_arg_fflags, error);
486 ar->k_ar.ar_event = audit_flags_and_error_to_openextendedevent(
487 ar->k_ar.ar_arg_fflags, error);
491 ar->k_ar.ar_event = audit_ctlname_to_sysctlevent(
492 ar->k_ar.ar_arg_ctlname, ar->k_ar.ar_valid_arg);
497 ar->k_ar.ar_event = auditon_command_event(ar->k_ar.ar_arg_cmd);
502 ar->k_ar.ar_event = audit_fcntl_command_event(
503 ar->k_ar.ar_arg_cmd, ar->k_ar.ar_arg_fflags, error);
507 auid = ar->k_ar.ar_subj_auid;
508 event = ar->k_ar.ar_event;
522 ar->k_ar_commit |= AR_COMMIT_KERNEL;
524 ar->k_ar_commit |= AR_PRESELECT_TRAIL;
526 ar->k_ar_commit & AR_PRESELECT_TRAIL) != 0)
527 ar->k_ar_commit |= AR_PRESELECT_PIPE;
528 if ((ar->k_ar_commit & (AR_PRESELECT_TRAIL | AR_PRESELECT_PIPE |
534 audit_free(ar);
538 ar->k_ar.ar_errno = error;
539 ar->k_ar.ar_retval = retval;
540 nanotime(&ar->k_ar.ar_endtime);
550 audit_free(ar);
561 TAILQ_INSERT_TAIL(&audit_q, ar, k_q);
780 struct kaudit_record *ar;
819 ar = audit_new(AUE_CORE, proc, uthread);
821 pathp = &ar->k_ar.ar_arg_upath1;
827 ARG_SET_VALID(ar, ARG_UPATH1);
829 ar->k_ar.ar_arg_signum = proc->p_sigacts->ps_sig;
830 ARG_SET_VALID(ar, ARG_SIGNUM);
833 audit_commit(ar, errcode, ret);