security/audit/audit.c

231 	ar->k_ar.ar_magic = AUDIT_RECORD_MAGIC;
232 	nanotime(&ar->k_ar.ar_starttime);
240 		cru2x(cred, &ar->k_ar.ar_subj_cred);
241 		ar->k_ar.ar_subj_ruid = kauth_cred_getruid(cred);
242 		ar->k_ar.ar_subj_rgid = kauth_cred_getrgid(cred);
243 		ar->k_ar.ar_subj_egid = kauth_cred_getgid(cred);
244 		ar->k_ar.ar_subj_pid = p->p_pid;
245 		ar->k_ar.ar_subj_auid = cred->cr_audit.as_aia_p->ai_auid;
246 		ar->k_ar.ar_subj_asid = cred->cr_audit.as_aia_p->ai_asid;
247 		bcopy(&cred->cr_audit.as_mask, &ar->k_ar.ar_subj_amask,
250 		    &ar->k_ar.ar_subj_term_addr, sizeof(struct au_tid_addr));
259 	if (ar->k_ar.ar_arg_upath1 != NULL)
260 		free(ar->k_ar.ar_arg_upath1, M_AUDITPATH);
261 	if (ar->k_ar.ar_arg_upath2 != NULL)
262 		free(ar->k_ar.ar_arg_upath2, M_AUDITPATH);
263 	if (ar->k_ar.ar_arg_kpath1 != NULL)
264 		free(ar->k_ar.ar_arg_kpath1, M_AUDITPATH);
265 	if (ar->k_ar.ar_arg_kpath2 != NULL)
266 		free(ar->k_ar.ar_arg_kpath2, M_AUDITPATH);
267 	if (ar->k_ar.ar_arg_text != NULL)
268 		free(ar->k_ar.ar_arg_text, M_AUDITTEXT);
269 	if (ar->k_ar.ar_arg_opaque != NULL)
270 		free(ar->k_ar.ar_arg_opaque, M_AUDITDATA);
271 	if (ar->k_ar.ar_arg_data != NULL)
272 		free(ar->k_ar.ar_arg_data, M_AUDITDATA);
275 	if (ar->k_ar.ar_arg_argv != NULL)
276 		free(ar->k_ar.ar_arg_argv, M_AUDITTEXT);
277 	if (ar->k_ar.ar_arg_envv != NULL)
278 		free(ar->k_ar.ar_arg_envv, M_AUDITTEXT);
411 	ar->k_ar.ar_event = event;
420 		ar->k_ar.ar_mac_records = NULL;
436 	if (NULL != ar->k_ar.ar_mac_records)
459 	if (ar->k_ar.ar_subj_auid == AU_DEFAUDITID)
462 		aumask = &ar->k_ar.ar_subj_amask;
469 	switch(ar->k_ar.ar_event) {
476 		ar->k_ar.ar_event = audit_flags_and_error_to_openevent(
477 		    ar->k_ar.ar_arg_fflags, error);
486 		ar->k_ar.ar_event = audit_flags_and_error_to_openextendedevent(
487 		    ar->k_ar.ar_arg_fflags, error);
491 		ar->k_ar.ar_event = audit_ctlname_to_sysctlevent(
492 		    ar->k_ar.ar_arg_ctlname, ar->k_ar.ar_valid_arg);
497 		ar->k_ar.ar_event = auditon_command_event(ar->k_ar.ar_arg_cmd);
502 		ar->k_ar.ar_event = audit_fcntl_command_event(
503 		    ar->k_ar.ar_arg_cmd, ar->k_ar.ar_arg_fflags, error);
507 	auid = ar->k_ar.ar_subj_auid;
508 	event = ar->k_ar.ar_event;
538 	ar->k_ar.ar_errno = error;
539 	ar->k_ar.ar_retval = retval;
540 	nanotime(&ar->k_ar.ar_endtime);
821 		pathp = &ar->k_ar.ar_arg_upath1;
829 	ar->k_ar.ar_arg_signum = proc->p_sigacts->ps_sig;