Lines Matching defs:event
180 void *(*dtaudit_hook_preselect)(au_id_t auid, au_event_t event,
183 au_event_t event, au_class_t class, int sorf);
185 au_event_t event, au_class_t class, int sorf,
420 audit_new(int event, struct thread *td)
430 ar->k_ar.ar_event = event;
449 au_event_t event;
477 * syscalls.master sometimes contains a prototype event number, which
478 * we will transform into a more specific event number now that we
498 /* Convert the auditon() command to an event. */
522 event = ar->k_ar.ar_event;
523 class = au_event_class(event);
526 if (au_preselect(event, class, aumask, sorf) != 0)
528 if (audit_pipe_preselect(auid, event, class, sorf,
538 if (dtaudit_hook_commit(ar, auid, event, class, sorf) != 0)
601 au_event_t event;
612 * an audit event identifier using the process system call table
620 event = td->td_proc->p_sysent->sv_table[code].sy_auevent;
621 if (event == AUE_NULL)
626 * event mask or the process audit mask.
638 class = au_event_class(event);
639 if (au_preselect(event, class, aumask, AU_PRS_BOTH)) {
649 * audit record is still required for this event by
658 } else if (audit_pipe_preselect(auid, event, class, AU_PRS_BOTH, 0)) {
671 * DTrace may want to stick event state onto a record we were going to
672 * produce due to the trail or pipes. The event state returned by the
679 dtaudit_state = dtaudit_hook_preselect(auid, event, class);
695 td->td_ar = audit_new(event, td);
708 * the event of exit1(), during the execution of exit1(). It is responsible