security/audit/audit.c

226 audit_record_ctor(proc_t p, struct kaudit_record *ar)
230 	bzero(ar, sizeof(*ar));
231 	ar->k_ar.ar_magic = AUDIT_RECORD_MAGIC;
232 	nanotime(&ar->k_ar.ar_starttime);
240 		cru2x(cred, &ar->k_ar.ar_subj_cred);
241 		ar->k_ar.ar_subj_ruid = kauth_cred_getruid(cred);
242 		ar->k_ar.ar_subj_rgid = kauth_cred_getrgid(cred);
243 		ar->k_ar.ar_subj_egid = kauth_cred_getgid(cred);
244 		ar->k_ar.ar_subj_pid = p->p_pid;
245 		ar->k_ar.ar_subj_auid = cred->cr_audit.as_aia_p->ai_auid;
246 		ar->k_ar.ar_subj_asid = cred->cr_audit.as_aia_p->ai_asid;
247 		bcopy(&cred->cr_audit.as_mask, &ar->k_ar.ar_subj_amask,
250 		    &ar->k_ar.ar_subj_term_addr, sizeof(struct au_tid_addr));
256 audit_record_dtor(struct kaudit_record *ar)
259 	if (ar->k_ar.ar_arg_upath1 != NULL)
260 		free(ar->k_ar.ar_arg_upath1, M_AUDITPATH);
261 	if (ar->k_ar.ar_arg_upath2 != NULL)
262 		free(ar->k_ar.ar_arg_upath2, M_AUDITPATH);
263 	if (ar->k_ar.ar_arg_kpath1 != NULL)
264 		free(ar->k_ar.ar_arg_kpath1, M_AUDITPATH);
265 	if (ar->k_ar.ar_arg_kpath2 != NULL)
266 		free(ar->k_ar.ar_arg_kpath2, M_AUDITPATH);
267 	if (ar->k_ar.ar_arg_text != NULL)
268 		free(ar->k_ar.ar_arg_text, M_AUDITTEXT);
269 	if (ar->k_ar.ar_arg_opaque != NULL)
270 		free(ar->k_ar.ar_arg_opaque, M_AUDITDATA);
271 	if (ar->k_ar.ar_arg_data != NULL)
272 		free(ar->k_ar.ar_arg_data, M_AUDITDATA);
273 	if (ar->k_udata != NULL)
274 		free(ar->k_udata, M_AUDITDATA);
275 	if (ar->k_ar.ar_arg_argv != NULL)
276 		free(ar->k_ar.ar_arg_argv, M_AUDITTEXT);
277 	if (ar->k_ar.ar_arg_envv != NULL)
278 		free(ar->k_ar.ar_arg_envv, M_AUDITTEXT);
377 	struct kaudit_record *ar;
407 	ar = zalloc(audit_record_zone);
408 	if (ar == NULL)
410 	audit_record_ctor(p, ar);
411 	ar->k_ar.ar_event = event;
415 		if (audit_mac_new(p, ar) != 0) {
416 			zfree(audit_record_zone, ar);
420 		ar->k_ar.ar_mac_records = NULL;
427 	return (ar);
431 audit_free(struct kaudit_record *ar)
434 	audit_record_dtor(ar);
436 	if (NULL != ar->k_ar.ar_mac_records)
437 		audit_mac_free(ar);
439 	zfree(audit_record_zone, ar);
443 audit_commit(struct kaudit_record *ar, int error, int retval)
452 	if (ar == NULL)
459 	if (ar->k_ar.ar_subj_auid == AU_DEFAUDITID)
462 		aumask = &ar->k_ar.ar_subj_amask;
469 	switch(ar->k_ar.ar_event) {
476 		ar->k_ar.ar_event = audit_flags_and_error_to_openevent(
477 		    ar->k_ar.ar_arg_fflags, error);
486 		ar->k_ar.ar_event = audit_flags_and_error_to_openextendedevent(
487 		    ar->k_ar.ar_arg_fflags, error);
491 		ar->k_ar.ar_event = audit_ctlname_to_sysctlevent(
492 		    ar->k_ar.ar_arg_ctlname, ar->k_ar.ar_valid_arg);
497 		ar->k_ar.ar_event = auditon_command_event(ar->k_ar.ar_arg_cmd);
502 		ar->k_ar.ar_event = audit_fcntl_command_event(
503 		    ar->k_ar.ar_arg_cmd, ar->k_ar.ar_arg_fflags, error);
507 	auid = ar->k_ar.ar_subj_auid;
508 	event = ar->k_ar.ar_event;
522 	ar->k_ar_commit |= AR_COMMIT_KERNEL;
524 		ar->k_ar_commit |= AR_PRESELECT_TRAIL;
526 	    ar->k_ar_commit & AR_PRESELECT_TRAIL) != 0)
527 		ar->k_ar_commit |= AR_PRESELECT_PIPE;
528 	if ((ar->k_ar_commit & (AR_PRESELECT_TRAIL | AR_PRESELECT_PIPE |
534 		audit_free(ar);
538 	ar->k_ar.ar_errno = error;
539 	ar->k_ar.ar_retval = retval;
540 	nanotime(&ar->k_ar.ar_endtime);
550 		audit_free(ar);
561 	TAILQ_INSERT_TAIL(&audit_q, ar, k_q);
780 	struct kaudit_record *ar;
819 	ar = audit_new(AUE_CORE, proc, uthread);
821 		pathp = &ar->k_ar.ar_arg_upath1;
827 			ARG_SET_VALID(ar, ARG_UPATH1);
829 	ar->k_ar.ar_arg_signum = proc->p_sigacts->ps_sig;
830 	ARG_SET_VALID(ar, ARG_SIGNUM);
833 	audit_commit(ar, errcode, ret);