1159248Srwatson/*- 2159248Srwatson * Copyright (c) 2006 Robert N. M. Watson 3159248Srwatson * All rights reserved. 4159248Srwatson * 5159248Srwatson * This software was developed by Robert Watson for the TrustedBSD Project. 6159248Srwatson * 7159248Srwatson * Redistribution and use in source and binary forms, with or without 8159248Srwatson * modification, are permitted provided that the following conditions 9159248Srwatson * are met: 10159248Srwatson * 1. Redistributions of source code must retain the above copyright 11159248Srwatson * notice, this list of conditions and the following disclaimer. 12159248Srwatson * 2. Redistributions in binary form must reproduce the above copyright 13159248Srwatson * notice, this list of conditions and the following disclaimer in the 14159248Srwatson * documentation and/or other materials provided with the distribution. 15159248Srwatson * 16159248Srwatson * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 17159248Srwatson * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18159248Srwatson * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19159248Srwatson * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 20159248Srwatson * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 21159248Srwatson * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 22159248Srwatson * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 23159248Srwatson * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 24159248Srwatson * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 25159248Srwatson * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26159248Srwatson * SUCH DAMAGE. 27159248Srwatson */ 28159248Srwatson 29159248Srwatson/* 30159248Srwatson * Configuration file parser for auditfilterd. The configuration file is a 31159248Srwatson * very simple format, similar to other BSM configuration files, consisting 32159248Srwatson * of configuration entries of one line each. The configuration function is 33159248Srwatson * aware of previous runs, and will update the current configuration as 34159248Srwatson * needed. 35159248Srwatson * 36159248Srwatson * Modules are in one of two states: attached, or detached. If attach fails, 37159248Srwatson * detach is not called because it was not attached. If a module is attached 38159248Srwatson * and a call to its reinit method fails, we will detach it. 39161630Srwatson * 40161630Srwatson * Modules are passed a (void *) reference to their configuration state so 41161630Srwatson * that they may pass this into any common APIs we provide which may rely on 42161630Srwatson * that state. Currently, the only such API is the cookie API, which allows 43161630Srwatson * per-instance state to be maintained by a module. In the future, this will 44161630Srwatson * also be used to support per-instance preselection state. 45159248Srwatson */ 46159248Srwatson 47159248Srwatson#include <sys/types.h> 48159248Srwatson 49159248Srwatson#include <config/config.h> 50159248Srwatson#ifdef HAVE_FULL_QUEUE_H 51159248Srwatson#include <sys/queue.h> 52159248Srwatson#else 53159248Srwatson#include <compat/queue.h> 54159248Srwatson#endif 55159248Srwatson 56159248Srwatson#include <bsm/libbsm.h> 57159248Srwatson#include <bsm/audit_filter.h> 58159248Srwatson 59159248Srwatson#include <dlfcn.h> 60159248Srwatson#include <err.h> 61159248Srwatson#include <errno.h> 62159248Srwatson#include <limits.h> 63159248Srwatson#include <stdio.h> 64159248Srwatson#include <stdlib.h> 65159248Srwatson#include <string.h> 66159248Srwatson 67159248Srwatson#include "auditfilterd.h" 68159248Srwatson 69159248Srwatson/* 70159248Srwatson * Free an individual auditfilter_module structure. Will not shut down the 71159248Srwatson * module, just frees the memory. Does so conditional on pointers being 72159248Srwatson * non-NULL so that it can be used on partially allocated structures. 73159248Srwatson */ 74159248Srwatsonstatic void 75159248Srwatsonauditfilter_module_free(struct auditfilter_module *am) 76159248Srwatson{ 77159248Srwatson 78159248Srwatson if (am->am_modulename != NULL) 79159248Srwatson free(am->am_modulename); 80159248Srwatson if (am->am_arg_buffer != NULL) 81159248Srwatson free(am->am_arg_buffer); 82159248Srwatson if (am->am_argv != NULL) 83159248Srwatson free(am->am_argv); 84159248Srwatson} 85159248Srwatson 86159248Srwatson/* 87159248Srwatson * Free all memory associated with an auditfilter_module list. Does not 88159248Srwatson * dlclose() or shut down the modules, just free the memory. Use 89159248Srwatson * auditfilter_module_list_detach() for that, if required. 90159248Srwatson */ 91159248Srwatsonstatic void 92159248Srwatsonauditfilter_module_list_free(struct auditfilter_module_list *list) 93159248Srwatson{ 94159248Srwatson struct auditfilter_module *am; 95159248Srwatson 96159248Srwatson while (!(TAILQ_EMPTY(list))) { 97159248Srwatson am = TAILQ_FIRST(list); 98159248Srwatson TAILQ_REMOVE(list, am, am_list); 99159248Srwatson auditfilter_module_free(am); 100159248Srwatson } 101159248Srwatson} 102159248Srwatson 103159248Srwatson/* 104159248Srwatson * Detach an attached module from an auditfilter_module structure. Does not 105159248Srwatson * free the data structure itself. 106159248Srwatson */ 107159248Srwatsonstatic void 108159248Srwatsonauditfilter_module_detach(struct auditfilter_module *am) 109159248Srwatson{ 110159248Srwatson 111159248Srwatson if (am->am_detach != NULL) 112161630Srwatson am->am_detach(am); 113161630Srwatson am->am_cookie = NULL; 114159248Srwatson (void)dlclose(am->am_dlhandle); 115159248Srwatson am->am_dlhandle = NULL; 116159248Srwatson} 117159248Srwatson 118159248Srwatson/* 119159248Srwatson * Walk an auditfilter_module list, detaching each module. Intended to be 120159248Srwatson * combined with auditfilter_module_list_free(). 121159248Srwatson */ 122159248Srwatsonstatic void 123159248Srwatsonauditfilter_module_list_detach(struct auditfilter_module_list *list) 124159248Srwatson{ 125159248Srwatson struct auditfilter_module *am; 126159248Srwatson 127159248Srwatson TAILQ_FOREACH(am, list, am_list) 128159248Srwatson auditfilter_module_detach(am); 129159248Srwatson} 130159248Srwatson 131159248Srwatson/* 132159248Srwatson * Given a filled out auditfilter_module, use dlopen() and dlsym() to attach 133159248Srwatson * the module. If we fail, leave fields in the state we found them. 134159248Srwatson * 135159248Srwatson * XXXRW: Need a better way to report errors. 136159248Srwatson */ 137159248Srwatsonstatic int 138159248Srwatsonauditfilter_module_attach(struct auditfilter_module *am) 139159248Srwatson{ 140159248Srwatson 141159248Srwatson am->am_dlhandle = dlopen(am->am_modulename, RTLD_NOW); 142159248Srwatson if (am->am_dlhandle == NULL) { 143159248Srwatson warnx("auditfilter_module_attach: %s: %s", am->am_modulename, 144159248Srwatson dlerror()); 145159248Srwatson return (-1); 146159248Srwatson } 147159248Srwatson 148159248Srwatson /* 149159248Srwatson * Not implementing these is not considered a failure condition, 150159248Srwatson * although we might want to consider warning if obvious stuff is 151159248Srwatson * not implemented, such as am_record. 152159248Srwatson */ 153159248Srwatson am->am_attach = dlsym(am->am_dlhandle, AUDIT_FILTER_ATTACH_STRING); 154159248Srwatson am->am_reinit = dlsym(am->am_dlhandle, AUDIT_FILTER_REINIT_STRING); 155159248Srwatson am->am_record = dlsym(am->am_dlhandle, AUDIT_FILTER_RECORD_STRING); 156161630Srwatson am->am_rawrecord = dlsym(am->am_dlhandle, 157161630Srwatson AUDIT_FILTER_RAWRECORD_STRING); 158159248Srwatson am->am_detach = dlsym(am->am_dlhandle, AUDIT_FILTER_DETACH_STRING); 159159248Srwatson 160159248Srwatson if (am->am_attach != NULL) { 161161630Srwatson if (am->am_attach(am, am->am_argc, am->am_argv) 162159248Srwatson != AUDIT_FILTER_SUCCESS) { 163159248Srwatson warnx("auditfilter_module_attach: %s: failed", 164159248Srwatson am->am_modulename); 165159248Srwatson dlclose(am->am_dlhandle); 166159248Srwatson am->am_dlhandle = NULL; 167161630Srwatson am->am_cookie = NULL; 168159248Srwatson am->am_attach = NULL; 169159248Srwatson am->am_reinit = NULL; 170159248Srwatson am->am_record = NULL; 171161630Srwatson am->am_rawrecord = NULL; 172159248Srwatson am->am_detach = NULL; 173159248Srwatson return (-1); 174159248Srwatson } 175159248Srwatson } 176159248Srwatson 177159248Srwatson return (0); 178159248Srwatson} 179159248Srwatson 180159248Srwatson/* 181159248Srwatson * When the arguments for a module are changed, we notify the module through 182159248Srwatson * a call to its reinit method, if any. Return 0 on success, or -1 on 183159248Srwatson * failure. 184159248Srwatson */ 185159248Srwatsonstatic int 186159248Srwatsonauditfilter_module_reinit(struct auditfilter_module *am) 187159248Srwatson{ 188159248Srwatson 189159248Srwatson if (am->am_reinit == NULL) 190159248Srwatson return (0); 191159248Srwatson 192161630Srwatson if (am->am_reinit(am, am->am_argc, am->am_argv) != 193159248Srwatson AUDIT_FILTER_SUCCESS) { 194159248Srwatson warnx("auditfilter_module_reinit: %s: failed", 195159248Srwatson am->am_modulename); 196159248Srwatson return (-1); 197159248Srwatson } 198159248Srwatson 199159248Srwatson return (0); 200159248Srwatson} 201159248Srwatson 202159248Srwatson/* 203159248Srwatson * Given a configuration line, generate an auditfilter_module structure that 204159248Srwatson * describes it; caller will not pass comments in, so they are not looked 205159248Srwatson * for. Do not attempt to instantiate it. Will destroy the contents of 206159248Srwatson * 'buffer'. 207159248Srwatson * 208159248Srwatson * Configuration lines consist of two parts: the module name and arguments 209159248Srwatson * separated by a ':', and then a ','-delimited list of arguments. 210159248Srwatson * 211159248Srwatson * XXXRW: Need to decide where to send the warning output -- stderr for now. 212159248Srwatson */ 213159248Srwatsonstruct auditfilter_module * 214159248Srwatsonauditfilter_module_parse(const char *filename, int linenumber, char *buffer) 215159248Srwatson{ 216159248Srwatson char *arguments, *module, **ap; 217159248Srwatson struct auditfilter_module *am; 218159248Srwatson 219159248Srwatson am = malloc(sizeof(*am)); 220159248Srwatson if (am == NULL) { 221159248Srwatson warn("auditfilter_module_parse: %s:%d", filename, linenumber); 222159248Srwatson return (NULL); 223159248Srwatson } 224159248Srwatson bzero(am, sizeof(*am)); 225159248Srwatson 226159248Srwatson /* 227159248Srwatson * First, break out the module and arguments strings. We look for 228159248Srwatson * one extra argument to make sure there are no more :'s in the line. 229159248Srwatson * That way, we prevent modules from using argument strings that, in 230159248Srwatson * the future, may cause problems for adding additional columns. 231159248Srwatson */ 232159248Srwatson arguments = buffer; 233159248Srwatson module = strsep(&arguments, ":"); 234159248Srwatson if (module == NULL || arguments == NULL) { 235159248Srwatson warnx("auditfilter_module_parse: %s:%d: parse error", 236159248Srwatson filename, linenumber); 237159248Srwatson return (NULL); 238159248Srwatson } 239159248Srwatson 240159248Srwatson am->am_modulename = strdup(module); 241159248Srwatson if (am->am_modulename == NULL) { 242159248Srwatson warn("auditfilter_module_parse: %s:%d", filename, linenumber); 243159248Srwatson auditfilter_module_free(am); 244159248Srwatson return (NULL); 245159248Srwatson } 246159248Srwatson 247159248Srwatson am->am_arg_buffer = strdup(buffer); 248159248Srwatson if (am->am_arg_buffer == NULL) { 249159248Srwatson warn("auditfilter_module_parse: %s:%d", filename, linenumber); 250159248Srwatson auditfilter_module_free(am); 251159248Srwatson return (NULL); 252159248Srwatson } 253159248Srwatson 254159248Srwatson /* 255159248Srwatson * Now, break out the arguments string into a series of arguments. 256159248Srwatson * This is a bit more complicated, and requires cleanup if things go 257159248Srwatson * wrong. 258159248Srwatson */ 259159248Srwatson am->am_argv = malloc(sizeof(char *) * AUDITFILTERD_CONF_MAXARGS); 260159248Srwatson if (am->am_argv == NULL) { 261159248Srwatson warn("auditfilter_module_parse: %s:%d", filename, linenumber); 262159248Srwatson auditfilter_module_free(am); 263159248Srwatson return (NULL); 264159248Srwatson } 265159248Srwatson bzero(am->am_argv, sizeof(char *) * AUDITFILTERD_CONF_MAXARGS); 266159248Srwatson am->am_argc = 0; 267159248Srwatson for (ap = am->am_argv; (*ap = strsep(&arguments, " \t")) != NULL;) { 268159248Srwatson if (**ap != '\0') { 269159248Srwatson am->am_argc++; 270159248Srwatson if (++ap >= &am->am_argv[AUDITFILTERD_CONF_MAXARGS]) 271159248Srwatson break; 272159248Srwatson } 273159248Srwatson } 274159248Srwatson if (ap >= &am->am_argv[AUDITFILTERD_CONF_MAXARGS]) { 275159248Srwatson warnx("auditfilter_module_parse: %s:%d: too many arguments", 276159248Srwatson filename, linenumber); 277159248Srwatson auditfilter_module_free(am); 278159248Srwatson return (NULL); 279159248Srwatson } 280159248Srwatson 281159248Srwatson return (am); 282159248Srwatson} 283159248Srwatson 284159248Srwatson/* 285159248Srwatson * Read a configuration file, and populate 'list' with the configuration 286159248Srwatson * lines. Does not attempt to instantiate the configuration, just read it 287159248Srwatson * into a useful set of data structures. 288159248Srwatson */ 289159248Srwatsonstatic int 290159248Srwatsonauditfilterd_conf_read(const char *filename, FILE *fp, 291159248Srwatson struct auditfilter_module_list *list) 292159248Srwatson{ 293159248Srwatson int error, linenumber, syntaxerror; 294159248Srwatson struct auditfilter_module *am; 295159248Srwatson char buffer[LINE_MAX]; 296159248Srwatson 297159248Srwatson syntaxerror = 0; 298159248Srwatson linenumber = 0; 299159248Srwatson while (!feof(fp) && !ferror(fp)) { 300159248Srwatson if (fgets(buffer, LINE_MAX, fp) == NULL) 301159248Srwatson break; 302159248Srwatson linenumber++; 303159248Srwatson if (buffer[0] == '#' || strlen(buffer) < 1) 304159248Srwatson continue; 305159248Srwatson buffer[strlen(buffer)-1] = '\0'; 306159248Srwatson am = auditfilter_module_parse(filename, linenumber, buffer); 307159248Srwatson if (am == NULL) { 308159248Srwatson syntaxerror = 1; 309159248Srwatson break; 310159248Srwatson } 311159248Srwatson TAILQ_INSERT_HEAD(list, am, am_list); 312159248Srwatson } 313159248Srwatson 314159248Srwatson /* 315159248Srwatson * File I/O error. 316159248Srwatson */ 317159248Srwatson if (ferror(fp)) { 318159248Srwatson error = errno; 319159248Srwatson auditfilter_module_list_free(list); 320159248Srwatson errno = error; 321159248Srwatson return (-1); 322159248Srwatson } 323159248Srwatson 324159248Srwatson /* 325159248Srwatson * Syntax error. 326159248Srwatson */ 327159248Srwatson if (syntaxerror) { 328159248Srwatson auditfilter_module_list_free(list); 329159248Srwatson errno = EINVAL; 330159248Srwatson return (-1); 331159248Srwatson } 332159248Srwatson return (0); 333159248Srwatson} 334159248Srwatson 335159248Srwatson/* 336159248Srwatson * Apply changes necessary to bring a new configuration into force. The new 337159248Srwatson * configuration data is passed in, and the current configuration is updated 338159248Srwatson * to match it. The contents of 'list' are freed or otherwise disposed of 339159248Srwatson * before return. 340159248Srwatson * 341159248Srwatson * The algorithms here are not very efficient, but this is an infrequent 342159248Srwatson * operation on very short lists. 343159248Srwatson */ 344159248Srwatsonstatic void 345159248Srwatsonauditfilterd_conf_apply(struct auditfilter_module_list *list) 346159248Srwatson{ 347159248Srwatson struct auditfilter_module *am1, *am2, *am_tmp; 348159248Srwatson int argc_tmp, found; 349159248Srwatson char **argv_tmp; 350159248Srwatson 351159248Srwatson /* 352159248Srwatson * First, remove remove and detach any entries that appear in the 353159248Srwatson * current configuration, but not the new configuration. 354159248Srwatson */ 355159248Srwatson TAILQ_FOREACH_SAFE(am1, &filter_list, am_list, am_tmp) { 356159248Srwatson found = 0; 357159248Srwatson TAILQ_FOREACH(am2, list, am_list) { 358159248Srwatson if (strcmp(am1->am_modulename, am2->am_modulename) 359159248Srwatson == 0) { 360159248Srwatson found = 1; 361159248Srwatson break; 362159248Srwatson } 363159248Srwatson } 364159248Srwatson if (found) 365159248Srwatson continue; 366159248Srwatson 367159248Srwatson /* 368159248Srwatson * am1 appears in filter_list, but not the new list, detach 369159248Srwatson * and free the module. 370159248Srwatson */ 371159248Srwatson warnx("detaching module %s", am1->am_modulename); 372159248Srwatson TAILQ_REMOVE(&filter_list, am1, am_list); 373159248Srwatson auditfilter_module_detach(am1); 374159248Srwatson auditfilter_module_free(am1); 375159248Srwatson } 376159248Srwatson 377159248Srwatson /* 378159248Srwatson * Next, update the configuration of any modules that appear in both 379159248Srwatson * lists. We do this by swapping the two argc and argv values and 380159248Srwatson * freeing the new one, rather than detaching the old one and 381159248Srwatson * attaching the new one. That way module state is preserved. 382159248Srwatson */ 383159248Srwatson TAILQ_FOREACH(am1, &filter_list, am_list) { 384159248Srwatson found = 0; 385159248Srwatson TAILQ_FOREACH(am2, list, am_list) { 386159248Srwatson if (strcmp(am1->am_modulename, am2->am_modulename) 387159248Srwatson == 0) { 388159248Srwatson found = 1; 389159248Srwatson break; 390159248Srwatson } 391159248Srwatson } 392159248Srwatson if (!found) 393159248Srwatson continue; 394159248Srwatson 395159248Srwatson /* 396159248Srwatson * Swap the arguments. 397159248Srwatson */ 398159248Srwatson argc_tmp = am1->am_argc; 399159248Srwatson argv_tmp = am1->am_argv; 400159248Srwatson am1->am_argc = am2->am_argc; 401159248Srwatson am1->am_argv = am2->am_argv; 402159248Srwatson am2->am_argc = argc_tmp; 403159248Srwatson am2->am_argv = argv_tmp; 404159248Srwatson 405159248Srwatson /* 406159248Srwatson * The reinit is a bit tricky: if reinit fails, we actually 407159248Srwatson * remove the old entry and detach that, as we don't allow 408159248Srwatson * running modules to be out of sync with the configuration 409159248Srwatson * file. 410159248Srwatson */ 411159248Srwatson warnx("reiniting module %s", am1->am_modulename); 412159248Srwatson if (auditfilter_module_reinit(am1) != 0) { 413159248Srwatson warnx("reinit failed for module %s, detaching", 414159248Srwatson am1->am_modulename); 415159248Srwatson TAILQ_REMOVE(&filter_list, am1, am_list); 416159248Srwatson auditfilter_module_detach(am1); 417159248Srwatson auditfilter_module_free(am1); 418159248Srwatson } 419159248Srwatson 420159248Srwatson /* 421159248Srwatson * Free the entry from the new list, which will discard the 422159248Srwatson * old arguments. No need to detach, as it was never 423159248Srwatson * attached in the first place. 424159248Srwatson */ 425159248Srwatson TAILQ_REMOVE(list, am2, am_list); 426159248Srwatson auditfilter_module_free(am2); 427159248Srwatson } 428159248Srwatson 429159248Srwatson /* 430159248Srwatson * Finally, attach any new entries that don't appear in the old 431159248Srwatson * configuration, and if they attach successfully, move them to the 432159248Srwatson * real configuration list. 433159248Srwatson */ 434159248Srwatson TAILQ_FOREACH(am1, list, am_list) { 435159248Srwatson found = 0; 436159248Srwatson TAILQ_FOREACH(am2, &filter_list, am_list) { 437159248Srwatson if (strcmp(am1->am_modulename, am2->am_modulename) 438159248Srwatson == 0) { 439159248Srwatson found = 1; 440159248Srwatson break; 441159248Srwatson } 442159248Srwatson } 443159248Srwatson if (found) 444159248Srwatson continue; 445159248Srwatson /* 446159248Srwatson * Attach the entry. If it succeeds, add to filter_list, 447159248Srwatson * otherwise, free. No need to detach if attach failed. 448159248Srwatson */ 449159248Srwatson warnx("attaching module %s", am1->am_modulename); 450159248Srwatson TAILQ_REMOVE(list, am1, am_list); 451159248Srwatson if (auditfilter_module_attach(am1) != 0) { 452159248Srwatson warnx("attaching module %s failed", 453159248Srwatson am1->am_modulename); 454159248Srwatson auditfilter_module_free(am1); 455159248Srwatson } else 456159248Srwatson TAILQ_INSERT_HEAD(&filter_list, am1, am_list); 457159248Srwatson } 458159248Srwatson 459159248Srwatson if (TAILQ_FIRST(list) != NULL) 460159248Srwatson warnx("auditfilterd_conf_apply: new list not empty\n"); 461159248Srwatson} 462159248Srwatson 463159248Srwatson/* 464159248Srwatson * Read the new configuration file into a local list. If the configuration 465159248Srwatson * file is parsed OK, then apply the changes. 466159248Srwatson */ 467159248Srwatsonint 468159248Srwatsonauditfilterd_conf(const char *filename, FILE *fp) 469159248Srwatson{ 470159248Srwatson struct auditfilter_module_list list; 471159248Srwatson 472159248Srwatson TAILQ_INIT(&list); 473159248Srwatson if (auditfilterd_conf_read(filename, fp, &list) < 0) 474159248Srwatson return (-1); 475159248Srwatson 476159248Srwatson auditfilterd_conf_apply(&list); 477159248Srwatson 478159248Srwatson return (0); 479159248Srwatson} 480159248Srwatson 481159248Srwatson/* 482159248Srwatson * Detach and free all active filter modules for daemon shutdown. 483159248Srwatson */ 484159248Srwatsonvoid 485159248Srwatsonauditfilterd_conf_shutdown(void) 486159248Srwatson{ 487159248Srwatson 488159248Srwatson auditfilter_module_list_detach(&filter_list); 489159248Srwatson auditfilter_module_list_free(&filter_list); 490159248Srwatson} 491161630Srwatson 492161630Srwatson/* 493161630Srwatson * APIs to allow modules to query and set their per-instance cookie. 494161630Srwatson */ 495161630Srwatsonvoid 496161630Srwatsonaudit_filter_getcookie(void *instance, void **cookie) 497161630Srwatson{ 498161630Srwatson struct auditfilter_module *am; 499161630Srwatson 500161630Srwatson am = (struct auditfilter_module *)instance; 501161630Srwatson *cookie = am->am_cookie; 502161630Srwatson} 503161630Srwatson 504161630Srwatsonvoid 505161630Srwatsonaudit_filter_setcookie(void *instance, void *cookie) 506161630Srwatson{ 507161630Srwatson struct auditfilter_module *am; 508161630Srwatson 509161630Srwatson am = (struct auditfilter_module *)instance; 510161630Srwatson am->am_cookie = cookie; 511161630Srwatson} 512