security/audit/audit.c

375 audit_new(int event, proc_t p, __unused struct uthread *uthread)
389 	audit_override = (AUE_SESSION_START == event ||
390 	    AUE_SESSION_UPDATE == event || AUE_SESSION_END == event ||
391 	    AUE_SESSION_CLOSE == event);
411 	ar->k_ar.ar_event = event;
445 	au_event_t event;
472 		 * The open syscall always writes a AUE_OPEN_RWTC event;
473 		 * change it to the proper type of event based on the flags
483 		 * AUE_OPEN_EXTENDEDRWTC event; change it to the proper type of
484 		 * event based on the flags and the error value.
496 		/* Convert the auditon() command to an event. */
508 	event = ar->k_ar.ar_event;
509 	class = au_event_class(event);
518 	audit_override = (AUE_SESSION_START == event ||
519 	    AUE_SESSION_UPDATE == event || AUE_SESSION_END == event ||
520 	    AUE_SESSION_CLOSE == event);
523 	if (au_preselect(event, class, aumask, sorf) != 0)
525 	if (audit_pipe_preselect(auid, event, class, sorf,
579 	au_event_t event;
586 	 * an audit event identifier using the process system call table
597 	event = sys_au_event[code];
598 	if (event == AUE_NULL)
606 	 * event mask or the process audit mask.
619 	class = au_event_class(event);
625 	if (audit_mac_syscall_enter(code, proc, uthread, cred, event) == 0)
628 	if (au_preselect(event, class, aumask, AU_PRS_BOTH)) {
638 		 * audit record is still required for this event by
647 			uthread->uu_ar = audit_new(event, proc, uthread);
648 	} else if (audit_pipe_preselect(auid, event, class, AU_PRS_BOTH, 0)) {
650 			uthread->uu_ar = audit_new(event, proc, uthread);
659  * the event of exit1(), during the execution of exit1().  It is responsible
703 audit_mach_syscall_enter(unsigned short event)
712 	if (event == AUE_NULL)
731 	 * event mask or the process audit mask.
742 	class = au_event_class(event);
743 	if (au_preselect(event, class, aumask, AU_PRS_BOTH))
744 		uthread->uu_ar = audit_new(event, proc, uthread);
745 	else if (audit_pipe_preselect(auid, event, class, AU_PRS_BOTH, 0))
746 		uthread->uu_ar = audit_new(event, proc, uthread);