1155192Srwatson/* 2188311Srwatson * Copyright (c) 1999-2009 Apple Inc. 3155192Srwatson * All rights reserved. 4155192Srwatson * 5155192Srwatson * Redistribution and use in source and binary forms, with or without 6155192Srwatson * modification, are permitted provided that the following conditions 7155192Srwatson * are met: 8155192Srwatson * 1. Redistributions of source code must retain the above copyright 9155192Srwatson * notice, this list of conditions and the following disclaimer. 10155192Srwatson * 2. Redistributions in binary form must reproduce the above copyright 11155192Srwatson * notice, this list of conditions and the following disclaimer in the 12155192Srwatson * documentation and/or other materials provided with the distribution. 13180701Srwatson * 3. Neither the name of Apple Inc. ("Apple") nor the names of 14155192Srwatson * its contributors may be used to endorse or promote products derived 15155192Srwatson * from this software without specific prior written permission. 16155192Srwatson * 17155192Srwatson * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND 18155192Srwatson * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 19155192Srwatson * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 20155192Srwatson * ARE DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR 21155192Srwatson * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 22155192Srwatson * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 23155192Srwatson * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 24155192Srwatson * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 25155192Srwatson * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING 26155192Srwatson * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 27155192Srwatson * POSSIBILITY OF SUCH DAMAGE. 28155192Srwatson */ 29155192Srwatson 30178186Srwatson#include <sys/cdefs.h> 31178186Srwatson__FBSDID("$FreeBSD$"); 32178186Srwatson 33155192Srwatson#include <sys/param.h> 34155192Srwatson#include <sys/vnode.h> 35155192Srwatson#include <sys/ipc.h> 36155192Srwatson#include <sys/lock.h> 37155192Srwatson#include <sys/malloc.h> 38155192Srwatson#include <sys/mutex.h> 39155192Srwatson#include <sys/socket.h> 40160136Swsalamon#include <sys/extattr.h> 41155192Srwatson#include <sys/fcntl.h> 42155192Srwatson#include <sys/user.h> 43155192Srwatson#include <sys/systm.h> 44155192Srwatson 45155192Srwatson#include <bsm/audit.h> 46155192Srwatson#include <bsm/audit_internal.h> 47155192Srwatson#include <bsm/audit_record.h> 48155192Srwatson#include <bsm/audit_kevents.h> 49155192Srwatson 50155192Srwatson#include <security/audit/audit.h> 51155192Srwatson#include <security/audit/audit_private.h> 52155192Srwatson 53155192Srwatson#include <netinet/in_systm.h> 54155192Srwatson#include <netinet/in.h> 55155192Srwatson#include <netinet/ip.h> 56155192Srwatson 57155192SrwatsonMALLOC_DEFINE(M_AUDITBSM, "audit_bsm", "Audit BSM data"); 58155192Srwatson 59155192Srwatsonstatic void audit_sys_auditon(struct audit_record *ar, 60155192Srwatson struct au_record *rec); 61155192Srwatson 62155192Srwatson/* 63155192Srwatson * Initialize the BSM auditing subsystem. 64155192Srwatson */ 65155192Srwatsonvoid 66155192Srwatsonkau_init(void) 67155192Srwatson{ 68155192Srwatson 69155192Srwatson au_evclassmap_init(); 70155192Srwatson} 71155192Srwatson 72155192Srwatson/* 73156889Srwatson * This call reserves memory for the audit record. Memory must be guaranteed 74156889Srwatson * before any auditable event can be generated. The au_record structure 75156889Srwatson * maintains a reference to the memory allocated above and also the list of 76180706Srwatson * tokens associated with this record. 77156889Srwatson */ 78156889Srwatsonstatic struct au_record * 79155192Srwatsonkau_open(void) 80156889Srwatson{ 81155192Srwatson struct au_record *rec; 82156889Srwatson 83155192Srwatson rec = malloc(sizeof(*rec), M_AUDITBSM, M_WAITOK); 84162466Srwatson rec->data = NULL; 85155192Srwatson TAILQ_INIT(&rec->token_q); 86155192Srwatson rec->len = 0; 87155192Srwatson rec->used = 1; 88155192Srwatson 89155192Srwatson return (rec); 90155192Srwatson} 91155192Srwatson 92155192Srwatson/* 93155192Srwatson * Store the token with the record descriptor. 94156889Srwatson */ 95155192Srwatsonstatic void 96155192Srwatsonkau_write(struct au_record *rec, struct au_token *tok) 97155192Srwatson{ 98155192Srwatson 99155192Srwatson KASSERT(tok != NULL, ("kau_write: tok == NULL")); 100155192Srwatson 101155192Srwatson TAILQ_INSERT_TAIL(&rec->token_q, tok, tokens); 102155192Srwatson rec->len += tok->len; 103155192Srwatson} 104155192Srwatson 105155192Srwatson/* 106155192Srwatson * Close out the audit record by adding the header token, identifying any 107155192Srwatson * missing tokens. Write out the tokens to the record memory. 108155192Srwatson */ 109155192Srwatsonstatic void 110155192Srwatsonkau_close(struct au_record *rec, struct timespec *ctime, short event) 111155192Srwatson{ 112155192Srwatson u_char *dptr; 113155192Srwatson size_t tot_rec_size; 114155192Srwatson token_t *cur, *hdr, *trail; 115155192Srwatson struct timeval tm; 116184856Scsjp size_t hdrsize; 117184856Scsjp struct auditinfo_addr ak; 118184856Scsjp struct in6_addr *ap; 119156889Srwatson 120184856Scsjp audit_get_kinfo(&ak); 121184856Scsjp hdrsize = 0; 122184856Scsjp switch (ak.ai_termid.at_type) { 123184856Scsjp case AU_IPv4: 124184856Scsjp hdrsize = (ak.ai_termid.at_addr[0] == INADDR_ANY) ? 125184856Scsjp AUDIT_HEADER_SIZE : AUDIT_HEADER_EX_SIZE(&ak); 126184856Scsjp break; 127184856Scsjp case AU_IPv6: 128184856Scsjp ap = (struct in6_addr *)&ak.ai_termid.at_addr[0]; 129184856Scsjp hdrsize = (IN6_IS_ADDR_UNSPECIFIED(ap)) ? AUDIT_HEADER_SIZE : 130184856Scsjp AUDIT_HEADER_EX_SIZE(&ak); 131184856Scsjp break; 132184856Scsjp default: 133184856Scsjp panic("kau_close: invalid address family"); 134184856Scsjp } 135184856Scsjp tot_rec_size = rec->len + hdrsize + AUDIT_TRAILER_SIZE; 136162466Srwatson rec->data = malloc(tot_rec_size, M_AUDITBSM, M_WAITOK | M_ZERO); 137170196Srwatson 138162466Srwatson tm.tv_usec = ctime->tv_nsec / 1000; 139162466Srwatson tm.tv_sec = ctime->tv_sec; 140184856Scsjp if (hdrsize != AUDIT_HEADER_SIZE) 141184856Scsjp hdr = au_to_header32_ex_tm(tot_rec_size, event, 0, tm, &ak); 142184856Scsjp else 143184856Scsjp hdr = au_to_header32_tm(tot_rec_size, event, 0, tm); 144162466Srwatson TAILQ_INSERT_HEAD(&rec->token_q, hdr, tokens); 145155192Srwatson 146162466Srwatson trail = au_to_trailer(tot_rec_size); 147162466Srwatson TAILQ_INSERT_TAIL(&rec->token_q, trail, tokens); 148155192Srwatson 149162466Srwatson rec->len = tot_rec_size; 150162466Srwatson dptr = rec->data; 151162466Srwatson TAILQ_FOREACH(cur, &rec->token_q, tokens) { 152162466Srwatson memcpy(dptr, cur->t_data, cur->len); 153162466Srwatson dptr += cur->len; 154155192Srwatson } 155155192Srwatson} 156155192Srwatson 157155192Srwatson/* 158156889Srwatson * Free a BSM audit record by releasing all the tokens and clearing the audit 159156889Srwatson * record information. 160155192Srwatson */ 161155192Srwatsonvoid 162155192Srwatsonkau_free(struct au_record *rec) 163155192Srwatson{ 164155192Srwatson struct au_token *tok; 165155192Srwatson 166156889Srwatson /* Free the token list. */ 167155192Srwatson while ((tok = TAILQ_FIRST(&rec->token_q))) { 168155192Srwatson TAILQ_REMOVE(&rec->token_q, tok, tokens); 169155192Srwatson free(tok->t_data, M_AUDITBSM); 170155192Srwatson free(tok, M_AUDITBSM); 171156889Srwatson } 172155192Srwatson 173155192Srwatson rec->used = 0; 174156889Srwatson rec->len = 0; 175155192Srwatson free(rec->data, M_AUDITBSM); 176155192Srwatson free(rec, M_AUDITBSM); 177155192Srwatson} 178155192Srwatson 179155192Srwatson/* 180170196Srwatson * XXX: May want turn some (or all) of these macros into functions in order 181180704Srwatson * to reduce the generated code size. 182155192Srwatson * 183155192Srwatson * XXXAUDIT: These macros assume that 'kar', 'ar', 'rec', and 'tok' in the 184155192Srwatson * caller are OK with this. 185155192Srwatson */ 186195925Srwatson#define ATFD1_TOKENS(argnum) do { \ 187195925Srwatson if (ARG_IS_VALID(kar, ARG_ATFD1)) { \ 188195925Srwatson tok = au_to_arg32(argnum, "at fd 1", ar->ar_arg_atfd1); \ 189195925Srwatson kau_write(rec, tok); \ 190195925Srwatson } \ 191195925Srwatson} while (0) 192195925Srwatson 193195925Srwatson#define ATFD2_TOKENS(argnum) do { \ 194195925Srwatson if (ARG_IS_VALID(kar, ARG_ATFD2)) { \ 195195925Srwatson tok = au_to_arg32(argnum, "at fd 2", ar->ar_arg_atfd2); \ 196195925Srwatson kau_write(rec, tok); \ 197195925Srwatson } \ 198195925Srwatson} while (0) 199195925Srwatson 200180708Srwatson#define UPATH1_TOKENS do { \ 201155192Srwatson if (ARG_IS_VALID(kar, ARG_UPATH1)) { \ 202155192Srwatson tok = au_to_path(ar->ar_arg_upath1); \ 203155192Srwatson kau_write(rec, tok); \ 204155192Srwatson } \ 205155192Srwatson} while (0) 206155192Srwatson 207180708Srwatson#define UPATH2_TOKENS do { \ 208155192Srwatson if (ARG_IS_VALID(kar, ARG_UPATH2)) { \ 209155192Srwatson tok = au_to_path(ar->ar_arg_upath2); \ 210155192Srwatson kau_write(rec, tok); \ 211155192Srwatson } \ 212155192Srwatson} while (0) 213155192Srwatson 214180708Srwatson#define VNODE1_TOKENS do { \ 215195925Srwatson if (ARG_IS_VALID(kar, ARG_ATFD)) { \ 216195925Srwatson tok = au_to_arg32(1, "at fd", ar->ar_arg_atfd); \ 217195925Srwatson kau_write(rec, tok); \ 218195925Srwatson } \ 219180709Srwatson if (ARG_IS_VALID(kar, ARG_VNODE1)) { \ 220155192Srwatson tok = au_to_attr32(&ar->ar_arg_vnode1); \ 221155192Srwatson kau_write(rec, tok); \ 222155192Srwatson } \ 223155192Srwatson} while (0) 224155192Srwatson 225180708Srwatson#define UPATH1_VNODE1_TOKENS do { \ 226180709Srwatson if (ARG_IS_VALID(kar, ARG_UPATH1)) { \ 227155192Srwatson UPATH1_TOKENS; \ 228155192Srwatson } \ 229180709Srwatson if (ARG_IS_VALID(kar, ARG_VNODE1)) { \ 230155192Srwatson tok = au_to_attr32(&ar->ar_arg_vnode1); \ 231155192Srwatson kau_write(rec, tok); \ 232155192Srwatson } \ 233155192Srwatson} while (0) 234155192Srwatson 235180708Srwatson#define VNODE2_TOKENS do { \ 236180709Srwatson if (ARG_IS_VALID(kar, ARG_VNODE2)) { \ 237155192Srwatson tok = au_to_attr32(&ar->ar_arg_vnode2); \ 238155192Srwatson kau_write(rec, tok); \ 239155192Srwatson } \ 240155192Srwatson} while (0) 241155192Srwatson 242180711Srwatson#define FD_VNODE1_TOKENS do { \ 243155192Srwatson if (ARG_IS_VALID(kar, ARG_VNODE1)) { \ 244155192Srwatson if (ARG_IS_VALID(kar, ARG_FD)) { \ 245155192Srwatson tok = au_to_arg32(1, "fd", ar->ar_arg_fd); \ 246155192Srwatson kau_write(rec, tok); \ 247155192Srwatson } \ 248155192Srwatson tok = au_to_attr32(&ar->ar_arg_vnode1); \ 249155192Srwatson kau_write(rec, tok); \ 250155192Srwatson } else { \ 251155192Srwatson if (ARG_IS_VALID(kar, ARG_FD)) { \ 252156889Srwatson tok = au_to_arg32(1, "non-file: fd", \ 253156889Srwatson ar->ar_arg_fd); \ 254155192Srwatson kau_write(rec, tok); \ 255155192Srwatson } \ 256155192Srwatson } \ 257155192Srwatson} while (0) 258155192Srwatson 259180708Srwatson#define PROCESS_PID_TOKENS(argn) do { \ 260159277Srwatson if ((ar->ar_arg_pid > 0) /* Reference a single process */ \ 261159277Srwatson && (ARG_IS_VALID(kar, ARG_PROCESS))) { \ 262172915Scsjp tok = au_to_process32_ex(ar->ar_arg_auid, \ 263159277Srwatson ar->ar_arg_euid, ar->ar_arg_egid, \ 264159277Srwatson ar->ar_arg_ruid, ar->ar_arg_rgid, \ 265159277Srwatson ar->ar_arg_pid, ar->ar_arg_asid, \ 266172915Scsjp &ar->ar_arg_termid_addr); \ 267159277Srwatson kau_write(rec, tok); \ 268159277Srwatson } else if (ARG_IS_VALID(kar, ARG_PID)) { \ 269159277Srwatson tok = au_to_arg32(argn, "process", ar->ar_arg_pid); \ 270159277Srwatson kau_write(rec, tok); \ 271155192Srwatson } \ 272180712Srwatson} while (0) 273155192Srwatson 274195280Srwatson#define EXTATTR_TOKENS(namespace_argnum) do { \ 275160136Swsalamon if (ARG_IS_VALID(kar, ARG_VALUE)) { \ 276160136Swsalamon switch (ar->ar_arg_value) { \ 277160136Swsalamon case EXTATTR_NAMESPACE_USER: \ 278160136Swsalamon tok = au_to_text(EXTATTR_NAMESPACE_USER_STRING);\ 279160136Swsalamon break; \ 280160136Swsalamon case EXTATTR_NAMESPACE_SYSTEM: \ 281160136Swsalamon tok = au_to_text(EXTATTR_NAMESPACE_SYSTEM_STRING);\ 282160136Swsalamon break; \ 283160136Swsalamon default: \ 284195280Srwatson tok = au_to_arg32((namespace_argnum), \ 285195280Srwatson "attrnamespace", ar->ar_arg_value); \ 286160136Swsalamon break; \ 287160136Swsalamon } \ 288160136Swsalamon kau_write(rec, tok); \ 289160136Swsalamon } \ 290160136Swsalamon /* attrname is in the text field */ \ 291160136Swsalamon if (ARG_IS_VALID(kar, ARG_TEXT)) { \ 292160136Swsalamon tok = au_to_text(ar->ar_arg_text); \ 293160136Swsalamon kau_write(rec, tok); \ 294160136Swsalamon } \ 295160136Swsalamon} while (0) 296160136Swsalamon 297155192Srwatson/* 298195280Srwatson * Not all pointer arguments to system calls are of interest, but in some 299195282Srwatson * cases they reflect delegation of rights, such as mmap(2) followed by 300195280Srwatson * minherit(2) before execve(2), so do the best we can. 301195280Srwatson */ 302195280Srwatson#define ADDR_TOKEN(argnum, argname) do { \ 303195280Srwatson if (ARG_IS_VALID(kar, ARG_ADDR)) { \ 304195280Srwatson if (sizeof(void *) == sizeof(uint32_t)) \ 305195280Srwatson tok = au_to_arg32((argnum), (argname), \ 306195280Srwatson (uint32_t)(uintptr_t)ar->ar_arg_addr); \ 307195280Srwatson else \ 308195280Srwatson tok = au_to_arg64((argnum), (argname), \ 309195280Srwatson (uint64_t)(uintptr_t)ar->ar_arg_addr); \ 310195280Srwatson kau_write(rec, tok); \ 311195280Srwatson } \ 312195280Srwatson} while (0) 313195280Srwatson 314195280Srwatson 315195280Srwatson/* 316155192Srwatson * Implement auditing for the auditon() system call. The audit tokens that 317155192Srwatson * are generated depend on the command that was sent into the auditon() 318155192Srwatson * system call. 319155192Srwatson */ 320155192Srwatsonstatic void 321155192Srwatsonaudit_sys_auditon(struct audit_record *ar, struct au_record *rec) 322155192Srwatson{ 323155192Srwatson struct au_token *tok; 324155192Srwatson 325195280Srwatson tok = au_to_arg32(3, "length", ar->ar_arg_len); 326195280Srwatson kau_write(rec, tok); 327155192Srwatson switch (ar->ar_arg_cmd) { 328191270Srwatson case A_OLDSETPOLICY: 329191270Srwatson if ((size_t)ar->ar_arg_len == sizeof(int64_t)) { 330191270Srwatson tok = au_to_arg64(2, "policy", 331191270Srwatson ar->ar_arg_auditon.au_policy64); 332191270Srwatson kau_write(rec, tok); 333191270Srwatson break; 334191270Srwatson } 335191270Srwatson /* FALLTHROUGH */ 336195280Srwatson 337156889Srwatson case A_SETPOLICY: 338195280Srwatson tok = au_to_arg32(2, "policy", ar->ar_arg_auditon.au_policy); 339155192Srwatson kau_write(rec, tok); 340155192Srwatson break; 341155192Srwatson 342156889Srwatson case A_SETKMASK: 343156889Srwatson tok = au_to_arg32(2, "setkmask:as_success", 344156889Srwatson ar->ar_arg_auditon.au_mask.am_success); 345155192Srwatson kau_write(rec, tok); 346156889Srwatson tok = au_to_arg32(2, "setkmask:as_failure", 347156889Srwatson ar->ar_arg_auditon.au_mask.am_failure); 348155192Srwatson kau_write(rec, tok); 349155192Srwatson break; 350155192Srwatson 351191270Srwatson case A_OLDSETQCTRL: 352191270Srwatson if ((size_t)ar->ar_arg_len == sizeof(au_qctrl64_t)) { 353191270Srwatson tok = au_to_arg64(2, "setqctrl:aq_hiwater", 354191270Srwatson ar->ar_arg_auditon.au_qctrl64.aq64_hiwater); 355191270Srwatson kau_write(rec, tok); 356191270Srwatson tok = au_to_arg64(2, "setqctrl:aq_lowater", 357191270Srwatson ar->ar_arg_auditon.au_qctrl64.aq64_lowater); 358191270Srwatson kau_write(rec, tok); 359191270Srwatson tok = au_to_arg64(2, "setqctrl:aq_bufsz", 360191270Srwatson ar->ar_arg_auditon.au_qctrl64.aq64_bufsz); 361191270Srwatson kau_write(rec, tok); 362191270Srwatson tok = au_to_arg64(2, "setqctrl:aq_delay", 363191270Srwatson ar->ar_arg_auditon.au_qctrl64.aq64_delay); 364191270Srwatson kau_write(rec, tok); 365191270Srwatson tok = au_to_arg64(2, "setqctrl:aq_minfree", 366191270Srwatson ar->ar_arg_auditon.au_qctrl64.aq64_minfree); 367191270Srwatson kau_write(rec, tok); 368191270Srwatson break; 369191270Srwatson } 370191270Srwatson /* FALLTHROUGH */ 371195280Srwatson 372156889Srwatson case A_SETQCTRL: 373195280Srwatson tok = au_to_arg32(2, "setqctrl:aq_hiwater", 374156889Srwatson ar->ar_arg_auditon.au_qctrl.aq_hiwater); 375155192Srwatson kau_write(rec, tok); 376191270Srwatson tok = au_to_arg32(2, "setqctrl:aq_lowater", 377156889Srwatson ar->ar_arg_auditon.au_qctrl.aq_lowater); 378155192Srwatson kau_write(rec, tok); 379191270Srwatson tok = au_to_arg32(2, "setqctrl:aq_bufsz", 380156889Srwatson ar->ar_arg_auditon.au_qctrl.aq_bufsz); 381155192Srwatson kau_write(rec, tok); 382191270Srwatson tok = au_to_arg32(2, "setqctrl:aq_delay", 383156889Srwatson ar->ar_arg_auditon.au_qctrl.aq_delay); 384155192Srwatson kau_write(rec, tok); 385191270Srwatson tok = au_to_arg32(2, "setqctrl:aq_minfree", 386156889Srwatson ar->ar_arg_auditon.au_qctrl.aq_minfree); 387155192Srwatson kau_write(rec, tok); 388155192Srwatson break; 389155192Srwatson 390156889Srwatson case A_SETUMASK: 391195280Srwatson tok = au_to_arg32(2, "setumask:as_success", 392156889Srwatson ar->ar_arg_auditon.au_auinfo.ai_mask.am_success); 393155192Srwatson kau_write(rec, tok); 394195280Srwatson tok = au_to_arg32(2, "setumask:as_failure", 395156889Srwatson ar->ar_arg_auditon.au_auinfo.ai_mask.am_failure); 396155192Srwatson kau_write(rec, tok); 397155192Srwatson break; 398155192Srwatson 399156889Srwatson case A_SETSMASK: 400191270Srwatson tok = au_to_arg32(2, "setsmask:as_success", 401156889Srwatson ar->ar_arg_auditon.au_auinfo.ai_mask.am_success); 402155192Srwatson kau_write(rec, tok); 403191270Srwatson tok = au_to_arg32(2, "setsmask:as_failure", 404156889Srwatson ar->ar_arg_auditon.au_auinfo.ai_mask.am_failure); 405155192Srwatson kau_write(rec, tok); 406155192Srwatson break; 407155192Srwatson 408191270Srwatson case A_OLDSETCOND: 409191270Srwatson if ((size_t)ar->ar_arg_len == sizeof(int64_t)) { 410191270Srwatson tok = au_to_arg64(2, "setcond", 411191270Srwatson ar->ar_arg_auditon.au_cond64); 412191270Srwatson kau_write(rec, tok); 413191270Srwatson break; 414191270Srwatson } 415191270Srwatson /* FALLTHROUGH */ 416195280Srwatson 417156889Srwatson case A_SETCOND: 418195280Srwatson tok = au_to_arg32(2, "setcond", ar->ar_arg_auditon.au_cond); 419155192Srwatson kau_write(rec, tok); 420155192Srwatson break; 421155192Srwatson 422156889Srwatson case A_SETCLASS: 423191270Srwatson kau_write(rec, tok); 424155192Srwatson tok = au_to_arg32(2, "setclass:ec_event", 425156889Srwatson ar->ar_arg_auditon.au_evclass.ec_number); 426155192Srwatson kau_write(rec, tok); 427191270Srwatson tok = au_to_arg32(2, "setclass:ec_class", 428156889Srwatson ar->ar_arg_auditon.au_evclass.ec_class); 429155192Srwatson kau_write(rec, tok); 430155192Srwatson break; 431155192Srwatson 432156889Srwatson case A_SETPMASK: 433156889Srwatson tok = au_to_arg32(2, "setpmask:as_success", 434156889Srwatson ar->ar_arg_auditon.au_aupinfo.ap_mask.am_success); 435155192Srwatson kau_write(rec, tok); 436156889Srwatson tok = au_to_arg32(2, "setpmask:as_failure", 437156889Srwatson ar->ar_arg_auditon.au_aupinfo.ap_mask.am_failure); 438155192Srwatson kau_write(rec, tok); 439155192Srwatson break; 440155192Srwatson 441156889Srwatson case A_SETFSIZE: 442156889Srwatson tok = au_to_arg32(2, "setfsize:filesize", 443156889Srwatson ar->ar_arg_auditon.au_fstat.af_filesz); 444155192Srwatson kau_write(rec, tok); 445155192Srwatson break; 446155192Srwatson 447155192Srwatson default: 448155192Srwatson break; 449155192Srwatson } 450155192Srwatson} 451155192Srwatson 452155192Srwatson/* 453156889Srwatson * Convert an internal kernel audit record to a BSM record and return a 454156889Srwatson * success/failure indicator. The BSM record is passed as an out parameter to 455156889Srwatson * this function. 456156889Srwatson * 457155192Srwatson * Return conditions: 458155192Srwatson * BSM_SUCCESS: The BSM record is valid 459155192Srwatson * BSM_FAILURE: Failure; the BSM record is NULL. 460156889Srwatson * BSM_NOAUDIT: The event is not auditable for BSM; the BSM record is NULL. 461155192Srwatson */ 462155192Srwatsonint 463155192Srwatsonkaudit_to_bsm(struct kaudit_record *kar, struct au_record **pau) 464155192Srwatson{ 465155192Srwatson struct au_token *tok, *subj_tok; 466155192Srwatson struct au_record *rec; 467155192Srwatson au_tid_t tid; 468155192Srwatson struct audit_record *ar; 469155192Srwatson int ctr; 470155192Srwatson 471155192Srwatson KASSERT(kar != NULL, ("kaudit_to_bsm: kar == NULL")); 472155192Srwatson 473155192Srwatson *pau = NULL; 474155192Srwatson ar = &kar->k_ar; 475155192Srwatson rec = kau_open(); 476155192Srwatson 477180715Srwatson /* 478180715Srwatson * Create the subject token. 479180715Srwatson */ 480168688Scsjp switch (ar->ar_subj_term_addr.at_type) { 481168688Scsjp case AU_IPv4: 482168688Scsjp tid.port = ar->ar_subj_term_addr.at_port; 483168688Scsjp tid.machine = ar->ar_subj_term_addr.at_addr[0]; 484168688Scsjp subj_tok = au_to_subject32(ar->ar_subj_auid, /* audit ID */ 485168688Scsjp ar->ar_subj_cred.cr_uid, /* eff uid */ 486168688Scsjp ar->ar_subj_egid, /* eff group id */ 487180709Srwatson ar->ar_subj_ruid, /* real uid */ 488180709Srwatson ar->ar_subj_rgid, /* real group id */ 489168688Scsjp ar->ar_subj_pid, /* process id */ 490168688Scsjp ar->ar_subj_asid, /* session ID */ 491168688Scsjp &tid); 492168688Scsjp break; 493168688Scsjp case AU_IPv6: 494168688Scsjp subj_tok = au_to_subject32_ex(ar->ar_subj_auid, 495168688Scsjp ar->ar_subj_cred.cr_uid, 496168688Scsjp ar->ar_subj_egid, 497168688Scsjp ar->ar_subj_ruid, 498168688Scsjp ar->ar_subj_rgid, 499168688Scsjp ar->ar_subj_pid, 500168688Scsjp ar->ar_subj_asid, 501168688Scsjp &ar->ar_subj_term_addr); 502168688Scsjp break; 503168688Scsjp default: 504168688Scsjp bzero(&tid, sizeof(tid)); 505168688Scsjp subj_tok = au_to_subject32(ar->ar_subj_auid, 506168688Scsjp ar->ar_subj_cred.cr_uid, 507168688Scsjp ar->ar_subj_egid, 508168688Scsjp ar->ar_subj_ruid, 509168688Scsjp ar->ar_subj_rgid, 510168688Scsjp ar->ar_subj_pid, 511168688Scsjp ar->ar_subj_asid, 512168688Scsjp &tid); 513168688Scsjp } 514155192Srwatson 515156889Srwatson /* 516156889Srwatson * The logic inside each case fills in the tokens required for the 517156889Srwatson * event, except for the header, trailer, and return tokens. The 518155192Srwatson * header and trailer tokens are added by the kau_close() function. 519155192Srwatson * The return token is added outside of the switch statement. 520156889Srwatson */ 521155192Srwatson switch(ar->ar_event) { 522155192Srwatson case AUE_ACCEPT: 523155192Srwatson case AUE_BIND: 524175455Scsjp case AUE_LISTEN: 525155192Srwatson case AUE_CONNECT: 526162990Srwatson case AUE_RECV: 527155192Srwatson case AUE_RECVFROM: 528156889Srwatson case AUE_RECVMSG: 529162990Srwatson case AUE_SEND: 530162990Srwatson case AUE_SENDFILE: 531155192Srwatson case AUE_SENDMSG: 532155192Srwatson case AUE_SENDTO: 533156889Srwatson /* 534156889Srwatson * Socket-related events. 535156889Srwatson */ 536155192Srwatson if (ARG_IS_VALID(kar, ARG_FD)) { 537155192Srwatson tok = au_to_arg32(1, "fd", ar->ar_arg_fd); 538155192Srwatson kau_write(rec, tok); 539155192Srwatson } 540155192Srwatson if (ARG_IS_VALID(kar, ARG_SADDRINET)) { 541156889Srwatson tok = au_to_sock_inet((struct sockaddr_in *) 542156889Srwatson &ar->ar_arg_sockaddr); 543155192Srwatson kau_write(rec, tok); 544155192Srwatson } 545155192Srwatson if (ARG_IS_VALID(kar, ARG_SADDRUNIX)) { 546156889Srwatson tok = au_to_sock_unix((struct sockaddr_un *) 547156889Srwatson &ar->ar_arg_sockaddr); 548155192Srwatson kau_write(rec, tok); 549155192Srwatson UPATH1_TOKENS; 550155192Srwatson } 551155192Srwatson /* XXX Need to handle ARG_SADDRINET6 */ 552155192Srwatson break; 553155192Srwatson 554155192Srwatson case AUE_SOCKET: 555155192Srwatson case AUE_SOCKETPAIR: 556155192Srwatson if (ARG_IS_VALID(kar, ARG_SOCKINFO)) { 557195280Srwatson tok = au_to_arg32(1, "domain", 558155192Srwatson ar->ar_arg_sockinfo.so_domain); 559155192Srwatson kau_write(rec, tok); 560195280Srwatson tok = au_to_arg32(2, "type", 561155192Srwatson ar->ar_arg_sockinfo.so_type); 562155192Srwatson kau_write(rec, tok); 563195280Srwatson tok = au_to_arg32(3, "protocol", 564155192Srwatson ar->ar_arg_sockinfo.so_protocol); 565155192Srwatson kau_write(rec, tok); 566155192Srwatson } 567155192Srwatson break; 568155192Srwatson 569155192Srwatson case AUE_SETSOCKOPT: 570155192Srwatson case AUE_SHUTDOWN: 571155192Srwatson if (ARG_IS_VALID(kar, ARG_FD)) { 572155192Srwatson tok = au_to_arg32(1, "fd", ar->ar_arg_fd); 573155192Srwatson kau_write(rec, tok); 574155192Srwatson } 575155192Srwatson break; 576155192Srwatson 577155192Srwatson case AUE_ACCT: 578155192Srwatson if (ARG_IS_VALID(kar, ARG_UPATH1)) { 579155192Srwatson UPATH1_VNODE1_TOKENS; 580155192Srwatson } else { 581155192Srwatson tok = au_to_arg32(1, "accounting off", 0); 582155192Srwatson kau_write(rec, tok); 583155192Srwatson } 584155192Srwatson break; 585155192Srwatson 586155192Srwatson case AUE_SETAUID: 587155192Srwatson if (ARG_IS_VALID(kar, ARG_AUID)) { 588155192Srwatson tok = au_to_arg32(2, "setauid", ar->ar_arg_auid); 589155192Srwatson kau_write(rec, tok); 590155192Srwatson } 591155192Srwatson break; 592155192Srwatson 593155192Srwatson case AUE_SETAUDIT: 594171066Scsjp if (ARG_IS_VALID(kar, ARG_AUID) && 595171066Scsjp ARG_IS_VALID(kar, ARG_ASID) && 596171066Scsjp ARG_IS_VALID(kar, ARG_AMASK) && 597171066Scsjp ARG_IS_VALID(kar, ARG_TERMID)) { 598156889Srwatson tok = au_to_arg32(1, "setaudit:auid", 599156889Srwatson ar->ar_arg_auid); 600155192Srwatson kau_write(rec, tok); 601156889Srwatson tok = au_to_arg32(1, "setaudit:port", 602156889Srwatson ar->ar_arg_termid.port); 603155192Srwatson kau_write(rec, tok); 604156889Srwatson tok = au_to_arg32(1, "setaudit:machine", 605156889Srwatson ar->ar_arg_termid.machine); 606155192Srwatson kau_write(rec, tok); 607156889Srwatson tok = au_to_arg32(1, "setaudit:as_success", 608156889Srwatson ar->ar_arg_amask.am_success); 609155192Srwatson kau_write(rec, tok); 610156889Srwatson tok = au_to_arg32(1, "setaudit:as_failure", 611156889Srwatson ar->ar_arg_amask.am_failure); 612155192Srwatson kau_write(rec, tok); 613156889Srwatson tok = au_to_arg32(1, "setaudit:asid", 614156889Srwatson ar->ar_arg_asid); 615155192Srwatson kau_write(rec, tok); 616155192Srwatson } 617155192Srwatson break; 618155192Srwatson 619155192Srwatson case AUE_SETAUDIT_ADDR: 620171066Scsjp if (ARG_IS_VALID(kar, ARG_AUID) && 621171066Scsjp ARG_IS_VALID(kar, ARG_ASID) && 622171066Scsjp ARG_IS_VALID(kar, ARG_AMASK) && 623171066Scsjp ARG_IS_VALID(kar, ARG_TERMID_ADDR)) { 624171066Scsjp tok = au_to_arg32(1, "setaudit_addr:auid", 625171066Scsjp ar->ar_arg_auid); 626171066Scsjp kau_write(rec, tok); 627171066Scsjp tok = au_to_arg32(1, "setaudit_addr:as_success", 628171066Scsjp ar->ar_arg_amask.am_success); 629171066Scsjp kau_write(rec, tok); 630171066Scsjp tok = au_to_arg32(1, "setaudit_addr:as_failure", 631171066Scsjp ar->ar_arg_amask.am_failure); 632171066Scsjp kau_write(rec, tok); 633171066Scsjp tok = au_to_arg32(1, "setaudit_addr:asid", 634171066Scsjp ar->ar_arg_asid); 635171066Scsjp kau_write(rec, tok); 636171066Scsjp tok = au_to_arg32(1, "setaudit_addr:type", 637171066Scsjp ar->ar_arg_termid_addr.at_type); 638171066Scsjp kau_write(rec, tok); 639171066Scsjp tok = au_to_arg32(1, "setaudit_addr:port", 640171066Scsjp ar->ar_arg_termid_addr.at_port); 641171066Scsjp kau_write(rec, tok); 642171066Scsjp if (ar->ar_arg_termid_addr.at_type == AU_IPv6) 643171066Scsjp tok = au_to_in_addr_ex((struct in6_addr *) 644171066Scsjp &ar->ar_arg_termid_addr.at_addr[0]); 645171066Scsjp if (ar->ar_arg_termid_addr.at_type == AU_IPv4) 646171066Scsjp tok = au_to_in_addr((struct in_addr *) 647171066Scsjp &ar->ar_arg_termid_addr.at_addr[0]); 648171066Scsjp kau_write(rec, tok); 649171066Scsjp } 650171066Scsjp break; 651155192Srwatson 652155192Srwatson case AUE_AUDITON: 653156889Srwatson /* 654156889Srwatson * For AUDITON commands without own event, audit the cmd. 655156889Srwatson */ 656155192Srwatson if (ARG_IS_VALID(kar, ARG_CMD)) { 657155192Srwatson tok = au_to_arg32(1, "cmd", ar->ar_arg_cmd); 658155192Srwatson kau_write(rec, tok); 659155192Srwatson } 660185293Srwatson /* FALLTHROUGH */ 661155192Srwatson 662155192Srwatson case AUE_AUDITON_GETCAR: 663155192Srwatson case AUE_AUDITON_GETCLASS: 664155192Srwatson case AUE_AUDITON_GETCOND: 665155192Srwatson case AUE_AUDITON_GETCWD: 666155192Srwatson case AUE_AUDITON_GETKMASK: 667155192Srwatson case AUE_AUDITON_GETSTAT: 668155192Srwatson case AUE_AUDITON_GPOLICY: 669155192Srwatson case AUE_AUDITON_GQCTRL: 670155192Srwatson case AUE_AUDITON_SETCLASS: 671155192Srwatson case AUE_AUDITON_SETCOND: 672155192Srwatson case AUE_AUDITON_SETKMASK: 673155192Srwatson case AUE_AUDITON_SETSMASK: 674155192Srwatson case AUE_AUDITON_SETSTAT: 675155192Srwatson case AUE_AUDITON_SETUMASK: 676155192Srwatson case AUE_AUDITON_SPOLICY: 677155192Srwatson case AUE_AUDITON_SQCTRL: 678156889Srwatson if (ARG_IS_VALID(kar, ARG_AUDITON)) 679155192Srwatson audit_sys_auditon(ar, rec); 680155192Srwatson break; 681156889Srwatson 682155192Srwatson case AUE_AUDITCTL: 683155192Srwatson UPATH1_VNODE1_TOKENS; 684155192Srwatson break; 685155192Srwatson 686155192Srwatson case AUE_EXIT: 687155192Srwatson if (ARG_IS_VALID(kar, ARG_EXIT)) { 688155192Srwatson tok = au_to_exit(ar->ar_arg_exitretval, 689155192Srwatson ar->ar_arg_exitstatus); 690155192Srwatson kau_write(rec, tok); 691155192Srwatson } 692155192Srwatson break; 693155192Srwatson 694155192Srwatson case AUE_ADJTIME: 695162990Srwatson case AUE_CLOCK_SETTIME: 696155192Srwatson case AUE_AUDIT: 697162990Srwatson case AUE_DUP2: 698155192Srwatson case AUE_GETAUDIT: 699155192Srwatson case AUE_GETAUDIT_ADDR: 700155192Srwatson case AUE_GETAUID: 701162990Srwatson case AUE_GETCWD: 702155192Srwatson case AUE_GETFSSTAT: 703162990Srwatson case AUE_GETRESUID: 704162990Srwatson case AUE_GETRESGID: 705162990Srwatson case AUE_KQUEUE: 706162990Srwatson case AUE_MODLOAD: 707162990Srwatson case AUE_MODUNLOAD: 708162990Srwatson case AUE_MSGSYS: 709162990Srwatson case AUE_NTP_ADJTIME: 710155192Srwatson case AUE_PIPE: 711195291Srwatson case AUE_POSIX_OPENPT: 712162990Srwatson case AUE_PROFILE: 713162990Srwatson case AUE_RTPRIO: 714162990Srwatson case AUE_SEMSYS: 715162990Srwatson case AUE_SHMSYS: 716155192Srwatson case AUE_SETPGRP: 717155192Srwatson case AUE_SETRLIMIT: 718155192Srwatson case AUE_SETSID: 719155192Srwatson case AUE_SETTIMEOFDAY: 720162990Srwatson case AUE_SYSARCH: 721162990Srwatson 722156889Srwatson /* 723156889Srwatson * Header, subject, and return tokens added at end. 724156889Srwatson */ 725155192Srwatson break; 726155192Srwatson 727155192Srwatson case AUE_CHDIR: 728155192Srwatson case AUE_CHROOT: 729195925Srwatson case AUE_FSTATAT: 730195925Srwatson case AUE_FUTIMESAT: 731155192Srwatson case AUE_GETATTRLIST: 732162990Srwatson case AUE_JAIL: 733162419Scsjp case AUE_LUTIMES: 734155192Srwatson case AUE_NFS_GETFH: 735155192Srwatson case AUE_LSTAT: 736207615Scsjp case AUE_LPATHCONF: 737155192Srwatson case AUE_PATHCONF: 738155192Srwatson case AUE_READLINK: 739244324Spjd case AUE_READLINKAT: 740155192Srwatson case AUE_REVOKE: 741155192Srwatson case AUE_RMDIR: 742155192Srwatson case AUE_SEARCHFS: 743155192Srwatson case AUE_SETATTRLIST: 744155192Srwatson case AUE_STAT: 745155192Srwatson case AUE_STATFS: 746162990Srwatson case AUE_SWAPON: 747162990Srwatson case AUE_SWAPOFF: 748155192Srwatson case AUE_TRUNCATE: 749155192Srwatson case AUE_UNDELETE: 750155192Srwatson case AUE_UNLINK: 751195925Srwatson case AUE_UNLINKAT: 752155192Srwatson case AUE_UTIMES: 753195925Srwatson ATFD1_TOKENS(1); 754155192Srwatson UPATH1_VNODE1_TOKENS; 755155192Srwatson break; 756155192Srwatson 757195267Srwatson case AUE_ACCESS: 758195267Srwatson case AUE_EACCESS: 759244324Spjd case AUE_FACCESSAT: 760244324Spjd ATFD1_TOKENS(1); 761195267Srwatson UPATH1_VNODE1_TOKENS; 762195267Srwatson if (ARG_IS_VALID(kar, ARG_VALUE)) { 763195280Srwatson tok = au_to_arg32(2, "mode", ar->ar_arg_value); 764195267Srwatson kau_write(rec, tok); 765195267Srwatson } 766195267Srwatson break; 767195267Srwatson 768162990Srwatson case AUE_FHSTATFS: 769162990Srwatson case AUE_FHOPEN: 770162990Srwatson case AUE_FHSTAT: 771162990Srwatson /* XXXRW: Need to audit vnode argument. */ 772162990Srwatson break; 773162990Srwatson 774155192Srwatson case AUE_CHFLAGS: 775155192Srwatson case AUE_LCHFLAGS: 776155192Srwatson if (ARG_IS_VALID(kar, ARG_FFLAGS)) { 777155192Srwatson tok = au_to_arg32(2, "flags", ar->ar_arg_fflags); 778155192Srwatson kau_write(rec, tok); 779155192Srwatson } 780155192Srwatson UPATH1_VNODE1_TOKENS; 781155192Srwatson break; 782156889Srwatson 783155192Srwatson case AUE_CHMOD: 784155192Srwatson case AUE_LCHMOD: 785155192Srwatson if (ARG_IS_VALID(kar, ARG_MODE)) { 786156889Srwatson tok = au_to_arg32(2, "new file mode", 787156889Srwatson ar->ar_arg_mode); 788155192Srwatson kau_write(rec, tok); 789155192Srwatson } 790155192Srwatson UPATH1_VNODE1_TOKENS; 791155192Srwatson break; 792156889Srwatson 793195925Srwatson case AUE_FCHMODAT: 794195925Srwatson ATFD1_TOKENS(1); 795195925Srwatson if (ARG_IS_VALID(kar, ARG_MODE)) { 796195925Srwatson tok = au_to_arg32(3, "new file mode", 797195925Srwatson ar->ar_arg_mode); 798195925Srwatson kau_write(rec, tok); 799195925Srwatson } 800195925Srwatson UPATH1_VNODE1_TOKENS; 801195925Srwatson break; 802195925Srwatson 803155192Srwatson case AUE_CHOWN: 804155192Srwatson case AUE_LCHOWN: 805155192Srwatson if (ARG_IS_VALID(kar, ARG_UID)) { 806155192Srwatson tok = au_to_arg32(2, "new file uid", ar->ar_arg_uid); 807155192Srwatson kau_write(rec, tok); 808155192Srwatson } 809155192Srwatson if (ARG_IS_VALID(kar, ARG_GID)) { 810155192Srwatson tok = au_to_arg32(3, "new file gid", ar->ar_arg_gid); 811155192Srwatson kau_write(rec, tok); 812155192Srwatson } 813155192Srwatson UPATH1_VNODE1_TOKENS; 814155192Srwatson break; 815156889Srwatson 816195925Srwatson case AUE_FCHOWNAT: 817195925Srwatson ATFD1_TOKENS(1); 818195925Srwatson if (ARG_IS_VALID(kar, ARG_UID)) { 819195925Srwatson tok = au_to_arg32(3, "new file uid", ar->ar_arg_uid); 820195925Srwatson kau_write(rec, tok); 821195925Srwatson } 822195925Srwatson if (ARG_IS_VALID(kar, ARG_GID)) { 823195925Srwatson tok = au_to_arg32(4, "new file gid", ar->ar_arg_gid); 824195925Srwatson kau_write(rec, tok); 825195925Srwatson } 826195925Srwatson UPATH1_VNODE1_TOKENS; 827195925Srwatson break; 828195925Srwatson 829155192Srwatson case AUE_EXCHANGEDATA: 830155192Srwatson UPATH1_VNODE1_TOKENS; 831155192Srwatson UPATH2_TOKENS; 832155192Srwatson break; 833155192Srwatson 834155192Srwatson case AUE_CLOSE: 835155192Srwatson if (ARG_IS_VALID(kar, ARG_FD)) { 836195280Srwatson tok = au_to_arg32(1, "fd", ar->ar_arg_fd); 837155192Srwatson kau_write(rec, tok); 838155192Srwatson } 839155192Srwatson UPATH1_VNODE1_TOKENS; 840155192Srwatson break; 841155192Srwatson 842203328Scsjp case AUE_CLOSEFROM: 843203328Scsjp if (ARG_IS_VALID(kar, ARG_FD)) { 844203328Scsjp tok = au_to_arg32(1, "fd", ar->ar_arg_fd); 845203328Scsjp kau_write(rec, tok); 846203328Scsjp } 847203328Scsjp break; 848203328Scsjp 849172995Scsjp case AUE_CORE: 850172995Scsjp if (ARG_IS_VALID(kar, ARG_SIGNUM)) { 851195280Srwatson tok = au_to_arg32(1, "signal", ar->ar_arg_signum); 852172995Scsjp kau_write(rec, tok); 853172995Scsjp } 854172995Scsjp UPATH1_VNODE1_TOKENS; 855172995Scsjp break; 856172995Scsjp 857160136Swsalamon case AUE_EXTATTRCTL: 858160136Swsalamon UPATH1_VNODE1_TOKENS; 859160136Swsalamon if (ARG_IS_VALID(kar, ARG_CMD)) { 860160136Swsalamon tok = au_to_arg32(2, "cmd", ar->ar_arg_cmd); 861160136Swsalamon kau_write(rec, tok); 862160136Swsalamon } 863160136Swsalamon /* extattrctl(2) filename parameter is in upath2/vnode2 */ 864160136Swsalamon UPATH2_TOKENS; 865160136Swsalamon VNODE2_TOKENS; 866195280Srwatson EXTATTR_TOKENS(4); 867160136Swsalamon break; 868160136Swsalamon 869160136Swsalamon case AUE_EXTATTR_GET_FILE: 870160136Swsalamon case AUE_EXTATTR_SET_FILE: 871160136Swsalamon case AUE_EXTATTR_LIST_FILE: 872160136Swsalamon case AUE_EXTATTR_DELETE_FILE: 873160136Swsalamon case AUE_EXTATTR_GET_LINK: 874160136Swsalamon case AUE_EXTATTR_SET_LINK: 875160136Swsalamon case AUE_EXTATTR_LIST_LINK: 876160136Swsalamon case AUE_EXTATTR_DELETE_LINK: 877160136Swsalamon UPATH1_VNODE1_TOKENS; 878195280Srwatson EXTATTR_TOKENS(2); 879160136Swsalamon break; 880160136Swsalamon 881160136Swsalamon case AUE_EXTATTR_GET_FD: 882160136Swsalamon case AUE_EXTATTR_SET_FD: 883160136Swsalamon case AUE_EXTATTR_LIST_FD: 884160136Swsalamon case AUE_EXTATTR_DELETE_FD: 885160136Swsalamon if (ARG_IS_VALID(kar, ARG_FD)) { 886160136Swsalamon tok = au_to_arg32(2, "fd", ar->ar_arg_fd); 887160136Swsalamon kau_write(rec, tok); 888160136Swsalamon } 889195280Srwatson EXTATTR_TOKENS(2); 890160136Swsalamon break; 891160136Swsalamon 892182158Srwatson case AUE_FEXECVE: 893182158Srwatson if (ARG_IS_VALID(kar, ARG_FD)) { 894182158Srwatson tok = au_to_arg32(1, "fd", ar->ar_arg_fd); 895182158Srwatson kau_write(rec, tok); 896182158Srwatson } 897182158Srwatson /* FALLTHROUGH */ 898182158Srwatson 899161813Swsalamon case AUE_EXECVE: 900188312Srwatson case AUE_MAC_EXECVE: 901161813Swsalamon if (ARG_IS_VALID(kar, ARG_ARGV)) { 902161813Swsalamon tok = au_to_exec_args(ar->ar_arg_argv, 903161813Swsalamon ar->ar_arg_argc); 904161813Swsalamon kau_write(rec, tok); 905161813Swsalamon } 906161813Swsalamon if (ARG_IS_VALID(kar, ARG_ENVV)) { 907161813Swsalamon tok = au_to_exec_env(ar->ar_arg_envv, 908161813Swsalamon ar->ar_arg_envc); 909161813Swsalamon kau_write(rec, tok); 910161813Swsalamon } 911161813Swsalamon UPATH1_VNODE1_TOKENS; 912161813Swsalamon break; 913161813Swsalamon 914155192Srwatson case AUE_FCHMOD: 915155192Srwatson if (ARG_IS_VALID(kar, ARG_MODE)) { 916156889Srwatson tok = au_to_arg32(2, "new file mode", 917156889Srwatson ar->ar_arg_mode); 918155192Srwatson kau_write(rec, tok); 919155192Srwatson } 920155192Srwatson FD_VNODE1_TOKENS; 921155192Srwatson break; 922156889Srwatson 923162990Srwatson /* 924162990Srwatson * XXXRW: Some of these need to handle non-vnode cases as well. 925162990Srwatson */ 926155192Srwatson case AUE_FCHDIR: 927155192Srwatson case AUE_FPATHCONF: 928162990Srwatson case AUE_FSTAT: 929155192Srwatson case AUE_FSTATFS: 930155192Srwatson case AUE_FSYNC: 931155192Srwatson case AUE_FTRUNCATE: 932155192Srwatson case AUE_FUTIMES: 933155192Srwatson case AUE_GETDIRENTRIES: 934155192Srwatson case AUE_GETDIRENTRIESATTR: 935195242Srwatson case AUE_LSEEK: 936162990Srwatson case AUE_POLL: 937162990Srwatson case AUE_READ: 938162990Srwatson case AUE_READV: 939162990Srwatson case AUE_WRITE: 940162990Srwatson case AUE_WRITEV: 941155192Srwatson FD_VNODE1_TOKENS; 942155192Srwatson break; 943156889Srwatson 944155192Srwatson case AUE_FCHOWN: 945155192Srwatson if (ARG_IS_VALID(kar, ARG_UID)) { 946155192Srwatson tok = au_to_arg32(2, "new file uid", ar->ar_arg_uid); 947155192Srwatson kau_write(rec, tok); 948155192Srwatson } 949155192Srwatson if (ARG_IS_VALID(kar, ARG_GID)) { 950155192Srwatson tok = au_to_arg32(3, "new file gid", ar->ar_arg_gid); 951155192Srwatson kau_write(rec, tok); 952155192Srwatson } 953155192Srwatson FD_VNODE1_TOKENS; 954155192Srwatson break; 955156889Srwatson 956155192Srwatson case AUE_FCNTL: 957191270Srwatson if (ARG_IS_VALID(kar, ARG_CMD)) { 958191270Srwatson tok = au_to_arg32(2, "cmd", 959191270Srwatson au_fcntl_cmd_to_bsm(ar->ar_arg_cmd)); 960191270Srwatson kau_write(rec, tok); 961191270Srwatson } 962155192Srwatson if (ar->ar_arg_cmd == F_GETLK || ar->ar_arg_cmd == F_SETLK || 963180715Srwatson ar->ar_arg_cmd == F_SETLKW) { 964155192Srwatson FD_VNODE1_TOKENS; 965155192Srwatson } 966155192Srwatson break; 967156889Srwatson 968155192Srwatson case AUE_FCHFLAGS: 969155192Srwatson if (ARG_IS_VALID(kar, ARG_FFLAGS)) { 970155192Srwatson tok = au_to_arg32(2, "flags", ar->ar_arg_fflags); 971155192Srwatson kau_write(rec, tok); 972155192Srwatson } 973155192Srwatson FD_VNODE1_TOKENS; 974155192Srwatson break; 975156889Srwatson 976155192Srwatson case AUE_FLOCK: 977155192Srwatson if (ARG_IS_VALID(kar, ARG_CMD)) { 978155192Srwatson tok = au_to_arg32(2, "operation", ar->ar_arg_cmd); 979155192Srwatson kau_write(rec, tok); 980155192Srwatson } 981155192Srwatson FD_VNODE1_TOKENS; 982155192Srwatson break; 983156889Srwatson 984155192Srwatson case AUE_RFORK: 985155192Srwatson if (ARG_IS_VALID(kar, ARG_FFLAGS)) { 986155192Srwatson tok = au_to_arg32(1, "flags", ar->ar_arg_fflags); 987155192Srwatson kau_write(rec, tok); 988155192Srwatson } 989185293Srwatson /* FALLTHROUGH */ 990185293Srwatson 991155192Srwatson case AUE_FORK: 992155192Srwatson case AUE_VFORK: 993155192Srwatson if (ARG_IS_VALID(kar, ARG_PID)) { 994155192Srwatson tok = au_to_arg32(0, "child PID", ar->ar_arg_pid); 995155192Srwatson kau_write(rec, tok); 996155192Srwatson } 997155192Srwatson break; 998156889Srwatson 999155192Srwatson case AUE_IOCTL: 1000155192Srwatson if (ARG_IS_VALID(kar, ARG_CMD)) { 1001155192Srwatson tok = au_to_arg32(2, "cmd", ar->ar_arg_cmd); 1002155192Srwatson kau_write(rec, tok); 1003155192Srwatson } 1004156889Srwatson if (ARG_IS_VALID(kar, ARG_VNODE1)) 1005155192Srwatson FD_VNODE1_TOKENS; 1006156889Srwatson else { 1007155192Srwatson if (ARG_IS_VALID(kar, ARG_SOCKINFO)) { 1008156889Srwatson tok = kau_to_socket(&ar->ar_arg_sockinfo); 1009155192Srwatson kau_write(rec, tok); 1010155192Srwatson } else { 1011155192Srwatson if (ARG_IS_VALID(kar, ARG_FD)) { 1012155192Srwatson tok = au_to_arg32(1, "fd", 1013155192Srwatson ar->ar_arg_fd); 1014180709Srwatson kau_write(rec, tok); 1015155192Srwatson } 1016155192Srwatson } 1017155192Srwatson } 1018155192Srwatson break; 1019155192Srwatson 1020155192Srwatson case AUE_KILL: 1021162990Srwatson case AUE_KILLPG: 1022155192Srwatson if (ARG_IS_VALID(kar, ARG_SIGNUM)) { 1023155192Srwatson tok = au_to_arg32(2, "signal", ar->ar_arg_signum); 1024155192Srwatson kau_write(rec, tok); 1025155192Srwatson } 1026155192Srwatson PROCESS_PID_TOKENS(1); 1027155192Srwatson break; 1028155192Srwatson 1029155192Srwatson case AUE_KTRACE: 1030155192Srwatson if (ARG_IS_VALID(kar, ARG_CMD)) { 1031155192Srwatson tok = au_to_arg32(2, "ops", ar->ar_arg_cmd); 1032155192Srwatson kau_write(rec, tok); 1033155192Srwatson } 1034155192Srwatson if (ARG_IS_VALID(kar, ARG_VALUE)) { 1035155192Srwatson tok = au_to_arg32(3, "trpoints", ar->ar_arg_value); 1036155192Srwatson kau_write(rec, tok); 1037155192Srwatson } 1038155192Srwatson PROCESS_PID_TOKENS(4); 1039155192Srwatson UPATH1_VNODE1_TOKENS; 1040155192Srwatson break; 1041155192Srwatson 1042155192Srwatson case AUE_LINK: 1043195925Srwatson case AUE_LINKAT: 1044155192Srwatson case AUE_RENAME: 1045195925Srwatson case AUE_RENAMEAT: 1046195925Srwatson ATFD1_TOKENS(1); 1047155192Srwatson UPATH1_VNODE1_TOKENS; 1048195925Srwatson ATFD2_TOKENS(3); 1049155192Srwatson UPATH2_TOKENS; 1050155192Srwatson break; 1051155192Srwatson 1052155192Srwatson case AUE_LOADSHFILE: 1053195280Srwatson ADDR_TOKEN(4, "base addr"); 1054155192Srwatson UPATH1_VNODE1_TOKENS; 1055155192Srwatson break; 1056156889Srwatson 1057155192Srwatson case AUE_MKDIR: 1058244324Spjd case AUE_MKDIRAT: 1059244324Spjd case AUE_MKFIFO: 1060244324Spjd case AUE_MKFIFOAT: 1061244324Spjd ATFD1_TOKENS(1); 1062155192Srwatson if (ARG_IS_VALID(kar, ARG_MODE)) { 1063155192Srwatson tok = au_to_arg32(2, "mode", ar->ar_arg_mode); 1064155192Srwatson kau_write(rec, tok); 1065155192Srwatson } 1066155192Srwatson UPATH1_VNODE1_TOKENS; 1067155192Srwatson break; 1068155192Srwatson 1069155192Srwatson case AUE_MKNOD: 1070244324Spjd case AUE_MKNODAT: 1071244324Spjd ATFD1_TOKENS(1); 1072155192Srwatson if (ARG_IS_VALID(kar, ARG_MODE)) { 1073155192Srwatson tok = au_to_arg32(2, "mode", ar->ar_arg_mode); 1074155192Srwatson kau_write(rec, tok); 1075155192Srwatson } 1076155192Srwatson if (ARG_IS_VALID(kar, ARG_DEV)) { 1077155192Srwatson tok = au_to_arg32(3, "dev", ar->ar_arg_dev); 1078155192Srwatson kau_write(rec, tok); 1079155192Srwatson } 1080155192Srwatson UPATH1_VNODE1_TOKENS; 1081155192Srwatson break; 1082155192Srwatson 1083155192Srwatson case AUE_MMAP: 1084155192Srwatson case AUE_MUNMAP: 1085155192Srwatson case AUE_MPROTECT: 1086155192Srwatson case AUE_MLOCK: 1087155192Srwatson case AUE_MUNLOCK: 1088155192Srwatson case AUE_MINHERIT: 1089195280Srwatson ADDR_TOKEN(1, "addr"); 1090155192Srwatson if (ARG_IS_VALID(kar, ARG_LEN)) { 1091155192Srwatson tok = au_to_arg32(2, "len", ar->ar_arg_len); 1092155192Srwatson kau_write(rec, tok); 1093155192Srwatson } 1094155192Srwatson if (ar->ar_event == AUE_MMAP) 1095155192Srwatson FD_VNODE1_TOKENS; 1096155192Srwatson if (ar->ar_event == AUE_MPROTECT) { 1097155192Srwatson if (ARG_IS_VALID(kar, ARG_VALUE)) { 1098155192Srwatson tok = au_to_arg32(3, "protection", 1099155192Srwatson ar->ar_arg_value); 1100155192Srwatson kau_write(rec, tok); 1101155192Srwatson } 1102155192Srwatson } 1103155192Srwatson if (ar->ar_event == AUE_MINHERIT) { 1104155192Srwatson if (ARG_IS_VALID(kar, ARG_VALUE)) { 1105155192Srwatson tok = au_to_arg32(3, "inherit", 1106155192Srwatson ar->ar_arg_value); 1107155192Srwatson kau_write(rec, tok); 1108155192Srwatson } 1109155192Srwatson } 1110155192Srwatson break; 1111155192Srwatson 1112155192Srwatson case AUE_MOUNT: 1113162990Srwatson case AUE_NMOUNT: 1114155192Srwatson /* XXX Need to handle NFS mounts */ 1115155192Srwatson if (ARG_IS_VALID(kar, ARG_FFLAGS)) { 1116155192Srwatson tok = au_to_arg32(3, "flags", ar->ar_arg_fflags); 1117155192Srwatson kau_write(rec, tok); 1118155192Srwatson } 1119155192Srwatson if (ARG_IS_VALID(kar, ARG_TEXT)) { 1120155192Srwatson tok = au_to_text(ar->ar_arg_text); 1121155192Srwatson kau_write(rec, tok); 1122155192Srwatson } 1123185293Srwatson /* FALLTHROUGH */ 1124156889Srwatson 1125188311Srwatson case AUE_NFS_SVC: 1126188311Srwatson if (ARG_IS_VALID(kar, ARG_CMD)) { 1127195280Srwatson tok = au_to_arg32(1, "flags", ar->ar_arg_cmd); 1128188311Srwatson kau_write(rec, tok); 1129188311Srwatson } 1130188311Srwatson break; 1131188311Srwatson 1132155192Srwatson case AUE_UMOUNT: 1133195247Srwatson if (ARG_IS_VALID(kar, ARG_VALUE)) { 1134195280Srwatson tok = au_to_arg32(2, "flags", ar->ar_arg_value); 1135195247Srwatson kau_write(rec, tok); 1136195247Srwatson } 1137155192Srwatson UPATH1_VNODE1_TOKENS; 1138195247Srwatson if (ARG_IS_VALID(kar, ARG_TEXT)) { 1139195247Srwatson tok = au_to_text(ar->ar_arg_text); 1140195247Srwatson kau_write(rec, tok); 1141195247Srwatson } 1142155192Srwatson break; 1143155192Srwatson 1144155192Srwatson case AUE_MSGCTL: 1145176565Srwatson ar->ar_event = audit_msgctl_to_event(ar->ar_arg_svipc_cmd); 1146155192Srwatson /* Fall through */ 1147156889Srwatson 1148155192Srwatson case AUE_MSGRCV: 1149155192Srwatson case AUE_MSGSND: 1150155192Srwatson tok = au_to_arg32(1, "msg ID", ar->ar_arg_svipc_id); 1151155192Srwatson kau_write(rec, tok); 1152155192Srwatson if (ar->ar_errno != EINVAL) { 1153155192Srwatson tok = au_to_ipc(AT_IPC_MSG, ar->ar_arg_svipc_id); 1154155192Srwatson kau_write(rec, tok); 1155155192Srwatson } 1156155192Srwatson break; 1157155192Srwatson 1158155192Srwatson case AUE_MSGGET: 1159155192Srwatson if (ar->ar_errno == 0) { 1160155192Srwatson if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) { 1161155192Srwatson tok = au_to_ipc(AT_IPC_MSG, 1162155192Srwatson ar->ar_arg_svipc_id); 1163155192Srwatson kau_write(rec, tok); 1164155192Srwatson } 1165155192Srwatson } 1166155192Srwatson break; 1167155192Srwatson 1168155192Srwatson case AUE_RESETSHFILE: 1169195280Srwatson ADDR_TOKEN(1, "base addr"); 1170155192Srwatson break; 1171156889Srwatson 1172155192Srwatson case AUE_OPEN_RC: 1173155192Srwatson case AUE_OPEN_RTC: 1174155192Srwatson case AUE_OPEN_RWC: 1175155192Srwatson case AUE_OPEN_RWTC: 1176155192Srwatson case AUE_OPEN_WC: 1177155192Srwatson case AUE_OPEN_WTC: 1178162990Srwatson case AUE_CREAT: 1179155192Srwatson if (ARG_IS_VALID(kar, ARG_MODE)) { 1180155192Srwatson tok = au_to_arg32(3, "mode", ar->ar_arg_mode); 1181155192Srwatson kau_write(rec, tok); 1182155192Srwatson } 1183185293Srwatson /* FALLTHROUGH */ 1184155192Srwatson 1185155192Srwatson case AUE_OPEN_R: 1186155192Srwatson case AUE_OPEN_RT: 1187155192Srwatson case AUE_OPEN_RW: 1188155192Srwatson case AUE_OPEN_RWT: 1189155192Srwatson case AUE_OPEN_W: 1190155192Srwatson case AUE_OPEN_WT: 1191155192Srwatson if (ARG_IS_VALID(kar, ARG_FFLAGS)) { 1192155192Srwatson tok = au_to_arg32(2, "flags", ar->ar_arg_fflags); 1193155192Srwatson kau_write(rec, tok); 1194155192Srwatson } 1195155192Srwatson UPATH1_VNODE1_TOKENS; 1196155192Srwatson break; 1197155192Srwatson 1198195925Srwatson case AUE_OPENAT_RC: 1199195925Srwatson case AUE_OPENAT_RTC: 1200195925Srwatson case AUE_OPENAT_RWC: 1201195925Srwatson case AUE_OPENAT_RWTC: 1202195925Srwatson case AUE_OPENAT_WC: 1203195925Srwatson case AUE_OPENAT_WTC: 1204195925Srwatson if (ARG_IS_VALID(kar, ARG_MODE)) { 1205195925Srwatson tok = au_to_arg32(3, "mode", ar->ar_arg_mode); 1206195925Srwatson kau_write(rec, tok); 1207195925Srwatson } 1208195925Srwatson /* FALLTHROUGH */ 1209195925Srwatson 1210195925Srwatson case AUE_OPENAT_R: 1211195925Srwatson case AUE_OPENAT_RT: 1212195925Srwatson case AUE_OPENAT_RW: 1213195925Srwatson case AUE_OPENAT_RWT: 1214195925Srwatson case AUE_OPENAT_W: 1215195925Srwatson case AUE_OPENAT_WT: 1216195925Srwatson if (ARG_IS_VALID(kar, ARG_FFLAGS)) { 1217195925Srwatson tok = au_to_arg32(2, "flags", ar->ar_arg_fflags); 1218195925Srwatson kau_write(rec, tok); 1219195925Srwatson } 1220195925Srwatson ATFD1_TOKENS(1); 1221195925Srwatson UPATH1_VNODE1_TOKENS; 1222195925Srwatson break; 1223195925Srwatson 1224155192Srwatson case AUE_PTRACE: 1225155192Srwatson if (ARG_IS_VALID(kar, ARG_CMD)) { 1226155192Srwatson tok = au_to_arg32(1, "request", ar->ar_arg_cmd); 1227155192Srwatson kau_write(rec, tok); 1228155192Srwatson } 1229155192Srwatson if (ARG_IS_VALID(kar, ARG_VALUE)) { 1230155192Srwatson tok = au_to_arg32(4, "data", ar->ar_arg_value); 1231155192Srwatson kau_write(rec, tok); 1232155192Srwatson } 1233155192Srwatson PROCESS_PID_TOKENS(2); 1234155192Srwatson break; 1235155192Srwatson 1236155192Srwatson case AUE_QUOTACTL: 1237155192Srwatson if (ARG_IS_VALID(kar, ARG_CMD)) { 1238155192Srwatson tok = au_to_arg32(2, "command", ar->ar_arg_cmd); 1239155192Srwatson kau_write(rec, tok); 1240155192Srwatson } 1241155192Srwatson if (ARG_IS_VALID(kar, ARG_UID)) { 1242155192Srwatson tok = au_to_arg32(3, "uid", ar->ar_arg_uid); 1243155192Srwatson kau_write(rec, tok); 1244155192Srwatson } 1245195280Srwatson if (ARG_IS_VALID(kar, ARG_GID)) { 1246195280Srwatson tok = au_to_arg32(3, "gid", ar->ar_arg_gid); 1247195280Srwatson kau_write(rec, tok); 1248195280Srwatson } 1249155192Srwatson UPATH1_VNODE1_TOKENS; 1250155192Srwatson break; 1251155192Srwatson 1252155192Srwatson case AUE_REBOOT: 1253155192Srwatson if (ARG_IS_VALID(kar, ARG_CMD)) { 1254155192Srwatson tok = au_to_arg32(1, "howto", ar->ar_arg_cmd); 1255155192Srwatson kau_write(rec, tok); 1256155192Srwatson } 1257155192Srwatson break; 1258155192Srwatson 1259155192Srwatson case AUE_SEMCTL: 1260176565Srwatson ar->ar_event = audit_semctl_to_event(ar->ar_arg_svipc_cmd); 1261155192Srwatson /* Fall through */ 1262156889Srwatson 1263155192Srwatson case AUE_SEMOP: 1264155192Srwatson if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) { 1265155192Srwatson tok = au_to_arg32(1, "sem ID", ar->ar_arg_svipc_id); 1266155192Srwatson kau_write(rec, tok); 1267155192Srwatson if (ar->ar_errno != EINVAL) { 1268155192Srwatson tok = au_to_ipc(AT_IPC_SEM, 1269155192Srwatson ar->ar_arg_svipc_id); 1270155192Srwatson kau_write(rec, tok); 1271155192Srwatson } 1272155192Srwatson } 1273155192Srwatson break; 1274156889Srwatson 1275155192Srwatson case AUE_SEMGET: 1276155192Srwatson if (ar->ar_errno == 0) { 1277155192Srwatson if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) { 1278155192Srwatson tok = au_to_ipc(AT_IPC_SEM, 1279155192Srwatson ar->ar_arg_svipc_id); 1280155192Srwatson kau_write(rec, tok); 1281155192Srwatson } 1282155192Srwatson } 1283155192Srwatson break; 1284156889Srwatson 1285155192Srwatson case AUE_SETEGID: 1286155192Srwatson if (ARG_IS_VALID(kar, ARG_EGID)) { 1287195280Srwatson tok = au_to_arg32(1, "egid", ar->ar_arg_egid); 1288155192Srwatson kau_write(rec, tok); 1289155192Srwatson } 1290155192Srwatson break; 1291156889Srwatson 1292155192Srwatson case AUE_SETEUID: 1293155192Srwatson if (ARG_IS_VALID(kar, ARG_EUID)) { 1294195280Srwatson tok = au_to_arg32(1, "euid", ar->ar_arg_euid); 1295155192Srwatson kau_write(rec, tok); 1296155192Srwatson } 1297155192Srwatson break; 1298156889Srwatson 1299155192Srwatson case AUE_SETREGID: 1300155192Srwatson if (ARG_IS_VALID(kar, ARG_RGID)) { 1301155192Srwatson tok = au_to_arg32(1, "rgid", ar->ar_arg_rgid); 1302155192Srwatson kau_write(rec, tok); 1303155192Srwatson } 1304155192Srwatson if (ARG_IS_VALID(kar, ARG_EGID)) { 1305155192Srwatson tok = au_to_arg32(2, "egid", ar->ar_arg_egid); 1306155192Srwatson kau_write(rec, tok); 1307155192Srwatson } 1308155192Srwatson break; 1309156889Srwatson 1310155192Srwatson case AUE_SETREUID: 1311155192Srwatson if (ARG_IS_VALID(kar, ARG_RUID)) { 1312155192Srwatson tok = au_to_arg32(1, "ruid", ar->ar_arg_ruid); 1313155192Srwatson kau_write(rec, tok); 1314155192Srwatson } 1315155192Srwatson if (ARG_IS_VALID(kar, ARG_EUID)) { 1316155192Srwatson tok = au_to_arg32(2, "euid", ar->ar_arg_euid); 1317155192Srwatson kau_write(rec, tok); 1318155192Srwatson } 1319155192Srwatson break; 1320156889Srwatson 1321155192Srwatson case AUE_SETRESGID: 1322155192Srwatson if (ARG_IS_VALID(kar, ARG_RGID)) { 1323155192Srwatson tok = au_to_arg32(1, "rgid", ar->ar_arg_rgid); 1324155192Srwatson kau_write(rec, tok); 1325155192Srwatson } 1326155192Srwatson if (ARG_IS_VALID(kar, ARG_EGID)) { 1327155192Srwatson tok = au_to_arg32(2, "egid", ar->ar_arg_egid); 1328155192Srwatson kau_write(rec, tok); 1329155192Srwatson } 1330155192Srwatson if (ARG_IS_VALID(kar, ARG_SGID)) { 1331155192Srwatson tok = au_to_arg32(3, "sgid", ar->ar_arg_sgid); 1332155192Srwatson kau_write(rec, tok); 1333155192Srwatson } 1334155192Srwatson break; 1335156889Srwatson 1336155192Srwatson case AUE_SETRESUID: 1337155192Srwatson if (ARG_IS_VALID(kar, ARG_RUID)) { 1338155192Srwatson tok = au_to_arg32(1, "ruid", ar->ar_arg_ruid); 1339155192Srwatson kau_write(rec, tok); 1340155192Srwatson } 1341155192Srwatson if (ARG_IS_VALID(kar, ARG_EUID)) { 1342155192Srwatson tok = au_to_arg32(2, "euid", ar->ar_arg_euid); 1343155192Srwatson kau_write(rec, tok); 1344155192Srwatson } 1345155192Srwatson if (ARG_IS_VALID(kar, ARG_SUID)) { 1346155192Srwatson tok = au_to_arg32(3, "suid", ar->ar_arg_suid); 1347155192Srwatson kau_write(rec, tok); 1348155192Srwatson } 1349155192Srwatson break; 1350156889Srwatson 1351155192Srwatson case AUE_SETGID: 1352155192Srwatson if (ARG_IS_VALID(kar, ARG_GID)) { 1353155192Srwatson tok = au_to_arg32(1, "gid", ar->ar_arg_gid); 1354155192Srwatson kau_write(rec, tok); 1355155192Srwatson } 1356155192Srwatson break; 1357156889Srwatson 1358155192Srwatson case AUE_SETUID: 1359155192Srwatson if (ARG_IS_VALID(kar, ARG_UID)) { 1360155192Srwatson tok = au_to_arg32(1, "uid", ar->ar_arg_uid); 1361155192Srwatson kau_write(rec, tok); 1362155192Srwatson } 1363155192Srwatson break; 1364156889Srwatson 1365155192Srwatson case AUE_SETGROUPS: 1366155192Srwatson if (ARG_IS_VALID(kar, ARG_GROUPSET)) { 1367155192Srwatson for(ctr = 0; ctr < ar->ar_arg_groups.gidset_size; ctr++) 1368155192Srwatson { 1369175456Scsjp tok = au_to_arg32(1, "setgroups", 1370175456Scsjp ar->ar_arg_groups.gidset[ctr]); 1371155192Srwatson kau_write(rec, tok); 1372155192Srwatson } 1373155192Srwatson } 1374155192Srwatson break; 1375155192Srwatson 1376155192Srwatson case AUE_SETLOGIN: 1377155192Srwatson if (ARG_IS_VALID(kar, ARG_TEXT)) { 1378155192Srwatson tok = au_to_text(ar->ar_arg_text); 1379155192Srwatson kau_write(rec, tok); 1380155192Srwatson } 1381155192Srwatson break; 1382155192Srwatson 1383155192Srwatson case AUE_SETPRIORITY: 1384155192Srwatson if (ARG_IS_VALID(kar, ARG_CMD)) { 1385155192Srwatson tok = au_to_arg32(1, "which", ar->ar_arg_cmd); 1386155192Srwatson kau_write(rec, tok); 1387155192Srwatson } 1388155192Srwatson if (ARG_IS_VALID(kar, ARG_UID)) { 1389155192Srwatson tok = au_to_arg32(2, "who", ar->ar_arg_uid); 1390155192Srwatson kau_write(rec, tok); 1391155192Srwatson } 1392195280Srwatson PROCESS_PID_TOKENS(2); 1393155192Srwatson if (ARG_IS_VALID(kar, ARG_VALUE)) { 1394195280Srwatson tok = au_to_arg32(3, "priority", ar->ar_arg_value); 1395155192Srwatson kau_write(rec, tok); 1396155192Srwatson } 1397155192Srwatson break; 1398155192Srwatson 1399155192Srwatson case AUE_SETPRIVEXEC: 1400155192Srwatson if (ARG_IS_VALID(kar, ARG_VALUE)) { 1401155192Srwatson tok = au_to_arg32(1, "flag", ar->ar_arg_value); 1402155192Srwatson kau_write(rec, tok); 1403155192Srwatson } 1404155192Srwatson break; 1405155192Srwatson 1406155192Srwatson /* AUE_SHMAT, AUE_SHMCTL, AUE_SHMDT and AUE_SHMGET are SysV IPC */ 1407155192Srwatson case AUE_SHMAT: 1408155192Srwatson if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) { 1409155192Srwatson tok = au_to_arg32(1, "shmid", ar->ar_arg_svipc_id); 1410155192Srwatson kau_write(rec, tok); 1411155192Srwatson /* XXXAUDIT: Does having the ipc token make sense? */ 1412155192Srwatson tok = au_to_ipc(AT_IPC_SHM, ar->ar_arg_svipc_id); 1413155192Srwatson kau_write(rec, tok); 1414155192Srwatson } 1415155192Srwatson if (ARG_IS_VALID(kar, ARG_SVIPC_ADDR)) { 1416155192Srwatson tok = au_to_arg32(2, "shmaddr", 1417155271Srwatson (int)(uintptr_t)ar->ar_arg_svipc_addr); 1418155192Srwatson kau_write(rec, tok); 1419155192Srwatson } 1420155192Srwatson if (ARG_IS_VALID(kar, ARG_SVIPC_PERM)) { 1421155192Srwatson tok = au_to_ipc_perm(&ar->ar_arg_svipc_perm); 1422155192Srwatson kau_write(rec, tok); 1423155192Srwatson } 1424155192Srwatson break; 1425155192Srwatson 1426155192Srwatson case AUE_SHMCTL: 1427155192Srwatson if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) { 1428155192Srwatson tok = au_to_arg32(1, "shmid", ar->ar_arg_svipc_id); 1429155192Srwatson kau_write(rec, tok); 1430155192Srwatson /* XXXAUDIT: Does having the ipc token make sense? */ 1431155192Srwatson tok = au_to_ipc(AT_IPC_SHM, ar->ar_arg_svipc_id); 1432155192Srwatson kau_write(rec, tok); 1433155192Srwatson } 1434155192Srwatson switch (ar->ar_arg_svipc_cmd) { 1435155192Srwatson case IPC_STAT: 1436155192Srwatson ar->ar_event = AUE_SHMCTL_STAT; 1437155192Srwatson break; 1438155192Srwatson case IPC_RMID: 1439155192Srwatson ar->ar_event = AUE_SHMCTL_RMID; 1440155192Srwatson break; 1441155192Srwatson case IPC_SET: 1442155192Srwatson ar->ar_event = AUE_SHMCTL_SET; 1443155192Srwatson if (ARG_IS_VALID(kar, ARG_SVIPC_PERM)) { 1444155192Srwatson tok = au_to_ipc_perm(&ar->ar_arg_svipc_perm); 1445155192Srwatson kau_write(rec, tok); 1446155192Srwatson } 1447155192Srwatson break; 1448155192Srwatson default: 1449155192Srwatson break; /* We will audit a bad command */ 1450155192Srwatson } 1451155192Srwatson break; 1452155192Srwatson 1453155192Srwatson case AUE_SHMDT: 1454155192Srwatson if (ARG_IS_VALID(kar, ARG_SVIPC_ADDR)) { 1455155192Srwatson tok = au_to_arg32(1, "shmaddr", 1456155271Srwatson (int)(uintptr_t)ar->ar_arg_svipc_addr); 1457155192Srwatson kau_write(rec, tok); 1458155192Srwatson } 1459155192Srwatson break; 1460155192Srwatson 1461155192Srwatson case AUE_SHMGET: 1462155192Srwatson /* This is unusual; the return value is in an argument token */ 1463155192Srwatson if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) { 1464155192Srwatson tok = au_to_arg32(0, "shmid", ar->ar_arg_svipc_id); 1465155192Srwatson kau_write(rec, tok); 1466155192Srwatson tok = au_to_ipc(AT_IPC_SHM, ar->ar_arg_svipc_id); 1467155192Srwatson kau_write(rec, tok); 1468155192Srwatson } 1469155192Srwatson if (ARG_IS_VALID(kar, ARG_SVIPC_PERM)) { 1470155192Srwatson tok = au_to_ipc_perm(&ar->ar_arg_svipc_perm); 1471155192Srwatson kau_write(rec, tok); 1472155192Srwatson } 1473155192Srwatson break; 1474155192Srwatson 1475156889Srwatson /* AUE_SHMOPEN, AUE_SHMUNLINK, AUE_SEMOPEN, AUE_SEMCLOSE 1476155192Srwatson * and AUE_SEMUNLINK are Posix IPC */ 1477155192Srwatson case AUE_SHMOPEN: 1478155192Srwatson if (ARG_IS_VALID(kar, ARG_SVIPC_ADDR)) { 1479155192Srwatson tok = au_to_arg32(2, "flags", ar->ar_arg_fflags); 1480155192Srwatson kau_write(rec, tok); 1481155192Srwatson } 1482155192Srwatson if (ARG_IS_VALID(kar, ARG_MODE)) { 1483155192Srwatson tok = au_to_arg32(3, "mode", ar->ar_arg_mode); 1484155192Srwatson kau_write(rec, tok); 1485155192Srwatson } 1486185293Srwatson /* FALLTHROUGH */ 1487185293Srwatson 1488155192Srwatson case AUE_SHMUNLINK: 1489155192Srwatson if (ARG_IS_VALID(kar, ARG_TEXT)) { 1490155192Srwatson tok = au_to_text(ar->ar_arg_text); 1491155192Srwatson kau_write(rec, tok); 1492155192Srwatson } 1493155192Srwatson if (ARG_IS_VALID(kar, ARG_POSIX_IPC_PERM)) { 1494155192Srwatson struct ipc_perm perm; 1495180715Srwatson 1496155192Srwatson perm.uid = ar->ar_arg_pipc_perm.pipc_uid; 1497155192Srwatson perm.gid = ar->ar_arg_pipc_perm.pipc_gid; 1498155192Srwatson perm.cuid = ar->ar_arg_pipc_perm.pipc_uid; 1499155192Srwatson perm.cgid = ar->ar_arg_pipc_perm.pipc_gid; 1500155192Srwatson perm.mode = ar->ar_arg_pipc_perm.pipc_mode; 1501155192Srwatson perm.seq = 0; 1502155192Srwatson perm.key = 0; 1503155192Srwatson tok = au_to_ipc_perm(&perm); 1504155192Srwatson kau_write(rec, tok); 1505155192Srwatson } 1506155192Srwatson break; 1507155192Srwatson 1508155192Srwatson case AUE_SEMOPEN: 1509155192Srwatson if (ARG_IS_VALID(kar, ARG_FFLAGS)) { 1510155192Srwatson tok = au_to_arg32(2, "flags", ar->ar_arg_fflags); 1511155192Srwatson kau_write(rec, tok); 1512155192Srwatson } 1513155192Srwatson if (ARG_IS_VALID(kar, ARG_MODE)) { 1514155192Srwatson tok = au_to_arg32(3, "mode", ar->ar_arg_mode); 1515155192Srwatson kau_write(rec, tok); 1516155192Srwatson } 1517155192Srwatson if (ARG_IS_VALID(kar, ARG_VALUE)) { 1518155192Srwatson tok = au_to_arg32(4, "value", ar->ar_arg_value); 1519155192Srwatson kau_write(rec, tok); 1520155192Srwatson } 1521185293Srwatson /* FALLTHROUGH */ 1522156889Srwatson 1523155192Srwatson case AUE_SEMUNLINK: 1524155192Srwatson if (ARG_IS_VALID(kar, ARG_TEXT)) { 1525155192Srwatson tok = au_to_text(ar->ar_arg_text); 1526155192Srwatson kau_write(rec, tok); 1527155192Srwatson } 1528155192Srwatson if (ARG_IS_VALID(kar, ARG_POSIX_IPC_PERM)) { 1529155192Srwatson struct ipc_perm perm; 1530180715Srwatson 1531155192Srwatson perm.uid = ar->ar_arg_pipc_perm.pipc_uid; 1532155192Srwatson perm.gid = ar->ar_arg_pipc_perm.pipc_gid; 1533155192Srwatson perm.cuid = ar->ar_arg_pipc_perm.pipc_uid; 1534155192Srwatson perm.cgid = ar->ar_arg_pipc_perm.pipc_gid; 1535155192Srwatson perm.mode = ar->ar_arg_pipc_perm.pipc_mode; 1536155192Srwatson perm.seq = 0; 1537155192Srwatson perm.key = 0; 1538155192Srwatson tok = au_to_ipc_perm(&perm); 1539155192Srwatson kau_write(rec, tok); 1540155192Srwatson } 1541155192Srwatson break; 1542155192Srwatson 1543155192Srwatson case AUE_SEMCLOSE: 1544155192Srwatson if (ARG_IS_VALID(kar, ARG_FD)) { 1545155192Srwatson tok = au_to_arg32(1, "sem", ar->ar_arg_fd); 1546155192Srwatson kau_write(rec, tok); 1547155192Srwatson } 1548155192Srwatson break; 1549155192Srwatson 1550155192Srwatson case AUE_SYMLINK: 1551244324Spjd case AUE_SYMLINKAT: 1552155192Srwatson if (ARG_IS_VALID(kar, ARG_TEXT)) { 1553155192Srwatson tok = au_to_text(ar->ar_arg_text); 1554155192Srwatson kau_write(rec, tok); 1555155192Srwatson } 1556244324Spjd ATFD1_TOKENS(1); 1557155192Srwatson UPATH1_VNODE1_TOKENS; 1558155192Srwatson break; 1559155192Srwatson 1560155192Srwatson case AUE_SYSCTL: 1561180716Srwatson case AUE_SYSCTL_NONADMIN: 1562155192Srwatson if (ARG_IS_VALID(kar, ARG_CTLNAME | ARG_LEN)) { 1563155192Srwatson for (ctr = 0; ctr < ar->ar_arg_len; ctr++) { 1564156889Srwatson tok = au_to_arg32(1, "name", 1565156889Srwatson ar->ar_arg_ctlname[ctr]); 1566156889Srwatson kau_write(rec, tok); 1567155192Srwatson } 1568155192Srwatson } 1569155192Srwatson if (ARG_IS_VALID(kar, ARG_VALUE)) { 1570155192Srwatson tok = au_to_arg32(5, "newval", ar->ar_arg_value); 1571155192Srwatson kau_write(rec, tok); 1572155192Srwatson } 1573155192Srwatson if (ARG_IS_VALID(kar, ARG_TEXT)) { 1574155192Srwatson tok = au_to_text(ar->ar_arg_text); 1575155192Srwatson kau_write(rec, tok); 1576155192Srwatson } 1577155192Srwatson break; 1578155192Srwatson 1579155192Srwatson case AUE_UMASK: 1580155192Srwatson if (ARG_IS_VALID(kar, ARG_MASK)) { 1581155192Srwatson tok = au_to_arg32(1, "new mask", ar->ar_arg_mask); 1582155192Srwatson kau_write(rec, tok); 1583155192Srwatson } 1584155192Srwatson tok = au_to_arg32(0, "prev mask", ar->ar_retval); 1585155192Srwatson kau_write(rec, tok); 1586155192Srwatson break; 1587155192Srwatson 1588155192Srwatson case AUE_WAIT4: 1589195280Srwatson PROCESS_PID_TOKENS(1); 1590195235Srwatson if (ARG_IS_VALID(kar, ARG_VALUE)) { 1591195280Srwatson tok = au_to_arg32(3, "options", ar->ar_arg_value); 1592195235Srwatson kau_write(rec, tok); 1593195235Srwatson } 1594155192Srwatson break; 1595155192Srwatson 1596224181Sjonathan case AUE_CAP_NEW: 1597224181Sjonathan /* 1598224181Sjonathan * XXXRW/XXXJA: Would be nice to audit socket/etc information. 1599224181Sjonathan */ 1600224181Sjonathan FD_VNODE1_TOKENS; 1601224181Sjonathan if (ARG_IS_VALID(kar, ARG_RIGHTS)) { 1602224181Sjonathan tok = au_to_arg64(2, "rights", ar->ar_arg_rights); 1603224181Sjonathan kau_write(rec, tok); 1604224181Sjonathan } 1605224181Sjonathan break; 1606224181Sjonathan 1607224181Sjonathan case AUE_CAP_GETRIGHTS: 1608224181Sjonathan if (ARG_IS_VALID(kar, ARG_FD)) { 1609224181Sjonathan tok = au_to_arg32(1, "fd", ar->ar_arg_fd); 1610224181Sjonathan kau_write(rec, tok); 1611224181Sjonathan } 1612224181Sjonathan break; 1613224181Sjonathan 1614224181Sjonathan case AUE_CAP_ENTER: 1615224181Sjonathan case AUE_CAP_GETMODE: 1616224181Sjonathan break; 1617224181Sjonathan 1618162990Srwatson case AUE_NULL: 1619156889Srwatson default: 1620155192Srwatson printf("BSM conversion requested for unknown event %d\n", 1621156889Srwatson ar->ar_event); 1622180715Srwatson 1623180715Srwatson /* 1624180715Srwatson * Write the subject token so it is properly freed here. 1625180715Srwatson */ 1626155192Srwatson kau_write(rec, subj_tok); 1627155192Srwatson kau_free(rec); 1628155192Srwatson return (BSM_NOAUDIT); 1629155192Srwatson } 1630155192Srwatson 1631156889Srwatson kau_write(rec, subj_tok); 1632186649Srwatson tok = au_to_return32(au_errno_to_bsm(ar->ar_errno), ar->ar_retval); 1633155192Srwatson kau_write(rec, tok); /* Every record gets a return token */ 1634155192Srwatson 1635155192Srwatson kau_close(rec, &ar->ar_endtime, ar->ar_event); 1636155192Srwatson 1637155192Srwatson *pau = rec; 1638155192Srwatson return (BSM_SUCCESS); 1639155192Srwatson} 1640155192Srwatson 1641155192Srwatson/* 1642156889Srwatson * Verify that a record is a valid BSM record. This verification is simple 1643156889Srwatson * now, but may be expanded on sometime in the future. Return 1 if the 1644156889Srwatson * record is good, 0 otherwise. 1645155192Srwatson */ 1646155192Srwatsonint 1647155192Srwatsonbsm_rec_verify(void *rec) 1648155192Srwatson{ 1649155192Srwatson char c = *(char *)rec; 1650156889Srwatson 1651156889Srwatson /* 1652155192Srwatson * Check the token ID of the first token; it has to be a header 1653155192Srwatson * token. 1654156889Srwatson * 1655156889Srwatson * XXXAUDIT There needs to be a token structure to map a token. 1656155192Srwatson * XXXAUDIT 'Shouldn't be simply looking at the first char. 1657155192Srwatson */ 1658156889Srwatson if ((c != AUT_HEADER32) && (c != AUT_HEADER32_EX) && 1659156889Srwatson (c != AUT_HEADER64) && (c != AUT_HEADER64_EX)) 1660155192Srwatson return (0); 1661155192Srwatson return (1); 1662155192Srwatson} 1663