common/c2/audit_start.c

73 	t_audit_data_t *tad = U2A(u);
103 	ASSERT(tad->tad_errjmp == NULL);
104 	tad->tad_errjmp = (void *)&jb;
105 	tad->tad_ctrl |= TAD_ERRJMP;
130 	struct t_audit_data	*tad;
133 	tad = U2A(u);
134 	ASSERT(tad != NULL);
137 	tad->tad_audit = audit_state;
140 		tad->tad_ctrl = 0;
141 		tad->tad_flag = 0;
152 		tad->tad_ctrl = 0;
153 		tad->tad_flag = 0;
173 	tad->tad_ctrl   = audit_s2e[scid].au_ctrl;
174 	tad->tad_scid   = scid;
177 	tad->tad_event = audit_s2e[scid].au_event;
180 		tad->tad_event = (*audit_s2e[scid].au_init)(tad->tad_event);
186 	if ((tad->tad_flag = auditme(kctx, tad,
187 	    kctx->auk_ets[tad->tad_event])) == 0) {
202 		tad->tad_flag = 0;
215 			tad->tad_flag = 0;
224 	tad->tad_evmod  = 0;
228 		(*audit_s2e[scid].au_start)(tad);
246 	struct t_audit_data *tad;
251 	tad = U2A(u);
256 	attr = tad->tad_defer_head;
266 	tad->tad_defer_head = tad->tad_defer_tail = NULL;
268 	if (tad->tad_flag == 0 && !(tad->tad_ctrl & TAD_SAVPATH)) {
273 		tad->tad_scid  = 0;
274 		tad->tad_event = 0;
275 		tad->tad_evmod = 0;
276 		tad->tad_ctrl  = 0;
277 		tad->tad_audit = AUC_UNSET;
278 		ASSERT(tad->tad_aupath == NULL);
282 	scid = tad->tad_scid;
290 		(*audit_s2e[scid].au_finish)(tad, error, rval);
292 	if (tad->tad_flag) {
293 		tad->tad_flag = 0;
295 		if (flag = audit_success(kctx, tad, error, NULL)) {
305 			if (tad->tad_evmod & PAD_SPRIVUSE) {
307 				    au_to_privset("", &tad->tad_sprivs,
311 			if (tad->tad_evmod & PAD_FPRIVUSE) {
313 				    au_to_privset("", &tad->tad_fprivs,
368 		au_close(kctx, &(u_ad), flag, tad->tad_event, tad->tad_evmod,
375 	if (tad->tad_aupath != NULL) {
376 		au_pathrele(tad->tad_aupath);
377 		tad->tad_aupath = NULL;
381 	if (tad->tad_atpath) {
382 		au_pathrele(tad->tad_atpath);
383 		tad->tad_atpath = NULL;
390 	tad->tad_scid  = 0;
391 	tad->tad_event = 0;
392 	tad->tad_evmod = 0;
393 	tad->tad_ctrl  = 0;
394 	tad->tad_audit = AUC_UNSET;
398 audit_success(au_kcontext_t *kctx, struct t_audit_data *tad, int error,
406 	ess = esf = kctx->auk_ets[tad->tad_event];
409 		tad->tad_evmod |= PAD_FAILURE;
412 	if (tad->tad_ctrl & TAD_NOAUDIT)
435 auditme(au_kcontext_t *kctx, struct t_audit_data *tad, au_state_t estate)
450 	} else if ((tad->tad_scid == SYS_putmsg) ||
451 	    (tad->tad_scid == SYS_getmsg)) {
458 	} else if (tad->tad_scid == SYS_execve &&