Lines Matching refs:k_ar
230 ar->k_ar.ar_magic = AUDIT_RECORD_MAGIC;
231 nanotime(&ar->k_ar.ar_starttime);
239 cru2x(cred, &ar->k_ar.ar_subj_cred);
240 ar->k_ar.ar_subj_ruid = kauth_cred_getruid(cred);
241 ar->k_ar.ar_subj_rgid = kauth_cred_getrgid(cred);
242 ar->k_ar.ar_subj_egid = kauth_cred_getgid(cred);
243 ar->k_ar.ar_subj_pid = p->p_pid;
244 ar->k_ar.ar_subj_auid = cred->cr_audit.as_aia_p->ai_auid;
245 ar->k_ar.ar_subj_asid = cred->cr_audit.as_aia_p->ai_asid;
246 bcopy(&cred->cr_audit.as_mask, &ar->k_ar.ar_subj_amask,
249 &ar->k_ar.ar_subj_term_addr, sizeof(struct au_tid_addr));
258 if (ar->k_ar.ar_arg_upath1 != NULL)
259 free(ar->k_ar.ar_arg_upath1, M_AUDITPATH);
260 if (ar->k_ar.ar_arg_upath2 != NULL)
261 free(ar->k_ar.ar_arg_upath2, M_AUDITPATH);
262 if (ar->k_ar.ar_arg_kpath1 != NULL)
263 free(ar->k_ar.ar_arg_kpath1, M_AUDITPATH);
264 if (ar->k_ar.ar_arg_kpath2 != NULL)
265 free(ar->k_ar.ar_arg_kpath2, M_AUDITPATH);
266 if (ar->k_ar.ar_arg_text != NULL)
267 free(ar->k_ar.ar_arg_text, M_AUDITTEXT);
268 if (ar->k_ar.ar_arg_opaque != NULL)
269 free(ar->k_ar.ar_arg_opaque, M_AUDITDATA);
270 if (ar->k_ar.ar_arg_data != NULL)
271 free(ar->k_ar.ar_arg_data, M_AUDITDATA);
274 if (ar->k_ar.ar_arg_argv != NULL)
275 free(ar->k_ar.ar_arg_argv, M_AUDITTEXT);
276 if (ar->k_ar.ar_arg_envv != NULL)
277 free(ar->k_ar.ar_arg_envv, M_AUDITTEXT);
410 ar->k_ar.ar_event = event;
419 ar->k_ar.ar_mac_records = NULL;
435 if (NULL != ar->k_ar.ar_mac_records)
458 if (ar->k_ar.ar_subj_auid == AU_DEFAUDITID)
461 aumask = &ar->k_ar.ar_subj_amask;
468 switch(ar->k_ar.ar_event) {
475 ar->k_ar.ar_event = audit_flags_and_error_to_openevent(
476 ar->k_ar.ar_arg_fflags, error);
485 ar->k_ar.ar_event = audit_flags_and_error_to_openextendedevent(
486 ar->k_ar.ar_arg_fflags, error);
495 ar->k_ar.ar_event = audit_flags_and_error_to_openatevent(
496 ar->k_ar.ar_arg_fflags, error);
505 ar->k_ar.ar_event = audit_flags_and_error_to_openbyidevent(
506 ar->k_ar.ar_arg_fflags, error);
510 ar->k_ar.ar_event = audit_ctlname_to_sysctlevent(
511 ar->k_ar.ar_arg_ctlname, ar->k_ar.ar_valid_arg);
516 ar->k_ar.ar_event = auditon_command_event(ar->k_ar.ar_arg_cmd);
521 ar->k_ar.ar_event = audit_fcntl_command_event(
522 ar->k_ar.ar_arg_cmd, ar->k_ar.ar_arg_fflags, error);
526 auid = ar->k_ar.ar_subj_auid;
527 event = ar->k_ar.ar_event;
557 ar->k_ar.ar_errno = error;
558 ar->k_ar.ar_retval = retval;
559 nanotime(&ar->k_ar.ar_endtime);
840 pathp = &ar->k_ar.ar_arg_upath1;
848 ar->k_ar.ar_arg_signum = proc->p_sigacts->ps_sig;