audit_bsm.c revision 168688
1155192Srwatson/* 2155192Srwatson * Copyright (c) 1999-2005 Apple Computer, Inc. 3155192Srwatson * All rights reserved. 4155192Srwatson * 5155192Srwatson * Redistribution and use in source and binary forms, with or without 6155192Srwatson * modification, are permitted provided that the following conditions 7155192Srwatson * are met: 8155192Srwatson * 1. Redistributions of source code must retain the above copyright 9155192Srwatson * notice, this list of conditions and the following disclaimer. 10155192Srwatson * 2. Redistributions in binary form must reproduce the above copyright 11155192Srwatson * notice, this list of conditions and the following disclaimer in the 12155192Srwatson * documentation and/or other materials provided with the distribution. 13155192Srwatson * 3. Neither the name of Apple Computer, Inc. ("Apple") nor the names of 14155192Srwatson * its contributors may be used to endorse or promote products derived 15155192Srwatson * from this software without specific prior written permission. 16155192Srwatson * 17155192Srwatson * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND 18155192Srwatson * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 19155192Srwatson * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 20155192Srwatson * ARE DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR 21155192Srwatson * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 22155192Srwatson * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 23155192Srwatson * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 24155192Srwatson * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 25155192Srwatson * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING 26155192Srwatson * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 27155192Srwatson * POSSIBILITY OF SUCH DAMAGE. 28155192Srwatson * 29155192Srwatson * $FreeBSD: head/sys/security/audit/audit_bsm.c 168688 2007-04-13 14:55:19Z csjp $ 30155192Srwatson */ 31155192Srwatson 32155192Srwatson#include <sys/param.h> 33155192Srwatson#include <sys/vnode.h> 34155192Srwatson#include <sys/ipc.h> 35155192Srwatson#include <sys/lock.h> 36155192Srwatson#include <sys/malloc.h> 37155192Srwatson#include <sys/mutex.h> 38155192Srwatson#include <sys/socket.h> 39160136Swsalamon#include <sys/extattr.h> 40155192Srwatson#include <sys/fcntl.h> 41155192Srwatson#include <sys/user.h> 42155192Srwatson#include <sys/systm.h> 43155192Srwatson 44155192Srwatson#include <bsm/audit.h> 45155192Srwatson#include <bsm/audit_internal.h> 46155192Srwatson#include <bsm/audit_record.h> 47155192Srwatson#include <bsm/audit_kevents.h> 48155192Srwatson 49155192Srwatson#include <security/audit/audit.h> 50155192Srwatson#include <security/audit/audit_private.h> 51155192Srwatson 52155192Srwatson#include <netinet/in_systm.h> 53155192Srwatson#include <netinet/in.h> 54155192Srwatson#include <netinet/ip.h> 55155192Srwatson 56155192SrwatsonMALLOC_DEFINE(M_AUDITBSM, "audit_bsm", "Audit BSM data"); 57155192Srwatson 58156889Srwatson/* 59155192Srwatson * Forward declares. 60155192Srwatson */ 61155192Srwatsonstatic void audit_sys_auditon(struct audit_record *ar, 62155192Srwatson struct au_record *rec); 63155192Srwatson 64155192Srwatson/* 65155192Srwatson * Initialize the BSM auditing subsystem. 66155192Srwatson */ 67155192Srwatsonvoid 68155192Srwatsonkau_init(void) 69155192Srwatson{ 70155192Srwatson 71155192Srwatson printf("BSM auditing present\n"); 72155192Srwatson au_evclassmap_init(); 73155192Srwatson} 74155192Srwatson 75155192Srwatson/* 76156889Srwatson * This call reserves memory for the audit record. Memory must be guaranteed 77156889Srwatson * before any auditable event can be generated. The au_record structure 78156889Srwatson * maintains a reference to the memory allocated above and also the list of 79156889Srwatson * tokens associated with this record 80156889Srwatson */ 81156889Srwatsonstatic struct au_record * 82155192Srwatsonkau_open(void) 83156889Srwatson{ 84155192Srwatson struct au_record *rec; 85156889Srwatson 86155192Srwatson rec = malloc(sizeof(*rec), M_AUDITBSM, M_WAITOK); 87162466Srwatson rec->data = NULL; 88155192Srwatson TAILQ_INIT(&rec->token_q); 89155192Srwatson rec->len = 0; 90155192Srwatson rec->used = 1; 91155192Srwatson 92155192Srwatson return (rec); 93155192Srwatson} 94155192Srwatson 95155192Srwatson/* 96155192Srwatson * Store the token with the record descriptor. 97156889Srwatson */ 98155192Srwatsonstatic void 99155192Srwatsonkau_write(struct au_record *rec, struct au_token *tok) 100155192Srwatson{ 101155192Srwatson 102155192Srwatson KASSERT(tok != NULL, ("kau_write: tok == NULL")); 103155192Srwatson 104155192Srwatson TAILQ_INSERT_TAIL(&rec->token_q, tok, tokens); 105155192Srwatson rec->len += tok->len; 106155192Srwatson} 107155192Srwatson 108155192Srwatson/* 109155192Srwatson * Close out the audit record by adding the header token, identifying any 110155192Srwatson * missing tokens. Write out the tokens to the record memory. 111155192Srwatson */ 112155192Srwatsonstatic void 113155192Srwatsonkau_close(struct au_record *rec, struct timespec *ctime, short event) 114155192Srwatson{ 115155192Srwatson u_char *dptr; 116155192Srwatson size_t tot_rec_size; 117155192Srwatson token_t *cur, *hdr, *trail; 118155192Srwatson struct timeval tm; 119156889Srwatson 120161635Srwatson tot_rec_size = rec->len + AUDIT_HEADER_SIZE + AUDIT_TRAILER_SIZE; 121162466Srwatson rec->data = malloc(tot_rec_size, M_AUDITBSM, M_WAITOK | M_ZERO); 122162466Srwatson /* Create the header token */ 123162466Srwatson tm.tv_usec = ctime->tv_nsec / 1000; 124162466Srwatson tm.tv_sec = ctime->tv_sec; 125162466Srwatson hdr = au_to_header32_tm(tot_rec_size, event, 0, tm); 126162466Srwatson TAILQ_INSERT_HEAD(&rec->token_q, hdr, tokens); 127155192Srwatson 128162466Srwatson trail = au_to_trailer(tot_rec_size); 129162466Srwatson TAILQ_INSERT_TAIL(&rec->token_q, trail, tokens); 130155192Srwatson 131162466Srwatson /* Serialize token data to the record. */ 132162466Srwatson rec->len = tot_rec_size; 133162466Srwatson dptr = rec->data; 134162466Srwatson TAILQ_FOREACH(cur, &rec->token_q, tokens) { 135162466Srwatson memcpy(dptr, cur->t_data, cur->len); 136162466Srwatson dptr += cur->len; 137155192Srwatson } 138155192Srwatson} 139155192Srwatson 140155192Srwatson/* 141156889Srwatson * Free a BSM audit record by releasing all the tokens and clearing the audit 142156889Srwatson * record information. 143155192Srwatson */ 144155192Srwatsonvoid 145155192Srwatsonkau_free(struct au_record *rec) 146155192Srwatson{ 147155192Srwatson struct au_token *tok; 148155192Srwatson 149156889Srwatson /* Free the token list. */ 150155192Srwatson while ((tok = TAILQ_FIRST(&rec->token_q))) { 151155192Srwatson TAILQ_REMOVE(&rec->token_q, tok, tokens); 152155192Srwatson free(tok->t_data, M_AUDITBSM); 153155192Srwatson free(tok, M_AUDITBSM); 154156889Srwatson } 155155192Srwatson 156155192Srwatson rec->used = 0; 157156889Srwatson rec->len = 0; 158155192Srwatson free(rec->data, M_AUDITBSM); 159155192Srwatson free(rec, M_AUDITBSM); 160155192Srwatson} 161155192Srwatson 162155192Srwatson/* 163155192Srwatson * XXX May want turn some (or all) of these macros into functions in order 164155192Srwatson * to reduce the generated code sized. 165155192Srwatson * 166155192Srwatson * XXXAUDIT: These macros assume that 'kar', 'ar', 'rec', and 'tok' in the 167155192Srwatson * caller are OK with this. 168155192Srwatson */ 169155192Srwatson#define UPATH1_TOKENS do { \ 170155192Srwatson if (ARG_IS_VALID(kar, ARG_UPATH1)) { \ 171155192Srwatson tok = au_to_path(ar->ar_arg_upath1); \ 172155192Srwatson kau_write(rec, tok); \ 173155192Srwatson } \ 174155192Srwatson} while (0) 175155192Srwatson 176155192Srwatson#define UPATH2_TOKENS do { \ 177155192Srwatson if (ARG_IS_VALID(kar, ARG_UPATH2)) { \ 178155192Srwatson tok = au_to_path(ar->ar_arg_upath2); \ 179155192Srwatson kau_write(rec, tok); \ 180155192Srwatson } \ 181155192Srwatson} while (0) 182155192Srwatson 183155192Srwatson#define VNODE1_TOKENS do { \ 184155192Srwatson if (ARG_IS_VALID(kar, ARG_VNODE1)) { \ 185155192Srwatson tok = au_to_attr32(&ar->ar_arg_vnode1); \ 186155192Srwatson kau_write(rec, tok); \ 187155192Srwatson } \ 188155192Srwatson} while (0) 189155192Srwatson 190155192Srwatson#define UPATH1_VNODE1_TOKENS do { \ 191155192Srwatson if (ARG_IS_VALID(kar, ARG_UPATH1)) { \ 192155192Srwatson UPATH1_TOKENS; \ 193155192Srwatson } \ 194155192Srwatson if (ARG_IS_VALID(kar, ARG_VNODE1)) { \ 195155192Srwatson tok = au_to_attr32(&ar->ar_arg_vnode1); \ 196155192Srwatson kau_write(rec, tok); \ 197155192Srwatson } \ 198155192Srwatson} while (0) 199155192Srwatson 200155192Srwatson#define VNODE2_TOKENS do { \ 201155192Srwatson if (ARG_IS_VALID(kar, ARG_VNODE2)) { \ 202155192Srwatson tok = au_to_attr32(&ar->ar_arg_vnode2); \ 203155192Srwatson kau_write(rec, tok); \ 204155192Srwatson } \ 205155192Srwatson} while (0) 206155192Srwatson 207155192Srwatson#define FD_VNODE1_TOKENS do { \ 208155192Srwatson if (ARG_IS_VALID(kar, ARG_VNODE1)) { \ 209155192Srwatson if (ARG_IS_VALID(kar, ARG_FD)) { \ 210155192Srwatson tok = au_to_arg32(1, "fd", ar->ar_arg_fd); \ 211155192Srwatson kau_write(rec, tok); \ 212155192Srwatson } \ 213155192Srwatson tok = au_to_attr32(&ar->ar_arg_vnode1); \ 214155192Srwatson kau_write(rec, tok); \ 215155192Srwatson } else { \ 216155192Srwatson if (ARG_IS_VALID(kar, ARG_FD)) { \ 217156889Srwatson tok = au_to_arg32(1, "non-file: fd", \ 218156889Srwatson ar->ar_arg_fd); \ 219155192Srwatson kau_write(rec, tok); \ 220155192Srwatson } \ 221155192Srwatson } \ 222155192Srwatson} while (0) 223155192Srwatson 224155192Srwatson#define PROCESS_PID_TOKENS(argn) do { \ 225159277Srwatson if ((ar->ar_arg_pid > 0) /* Reference a single process */ \ 226159277Srwatson && (ARG_IS_VALID(kar, ARG_PROCESS))) { \ 227159277Srwatson tok = au_to_process(ar->ar_arg_auid, \ 228159277Srwatson ar->ar_arg_euid, ar->ar_arg_egid, \ 229159277Srwatson ar->ar_arg_ruid, ar->ar_arg_rgid, \ 230159277Srwatson ar->ar_arg_pid, ar->ar_arg_asid, \ 231159277Srwatson &ar->ar_arg_termid); \ 232159277Srwatson kau_write(rec, tok); \ 233159277Srwatson } else if (ARG_IS_VALID(kar, ARG_PID)) { \ 234159277Srwatson tok = au_to_arg32(argn, "process", ar->ar_arg_pid); \ 235159277Srwatson kau_write(rec, tok); \ 236155192Srwatson } \ 237155192Srwatson} while (0) \ 238155192Srwatson 239160136Swsalamon#define EXTATTR_TOKENS do { \ 240160136Swsalamon if (ARG_IS_VALID(kar, ARG_VALUE)) { \ 241160136Swsalamon switch (ar->ar_arg_value) { \ 242160136Swsalamon case EXTATTR_NAMESPACE_USER: \ 243160136Swsalamon tok = au_to_text(EXTATTR_NAMESPACE_USER_STRING);\ 244160136Swsalamon break; \ 245160136Swsalamon case EXTATTR_NAMESPACE_SYSTEM: \ 246160136Swsalamon tok = au_to_text(EXTATTR_NAMESPACE_SYSTEM_STRING);\ 247160136Swsalamon break; \ 248160136Swsalamon default: \ 249160136Swsalamon tok = au_to_arg32(3, "attrnamespace", \ 250160136Swsalamon ar->ar_arg_value); \ 251160136Swsalamon break; \ 252160136Swsalamon } \ 253160136Swsalamon kau_write(rec, tok); \ 254160136Swsalamon } \ 255160136Swsalamon /* attrname is in the text field */ \ 256160136Swsalamon if (ARG_IS_VALID(kar, ARG_TEXT)) { \ 257160136Swsalamon tok = au_to_text(ar->ar_arg_text); \ 258160136Swsalamon kau_write(rec, tok); \ 259160136Swsalamon } \ 260160136Swsalamon} while (0) 261160136Swsalamon 262155192Srwatson/* 263155192Srwatson * Implement auditing for the auditon() system call. The audit tokens that 264155192Srwatson * are generated depend on the command that was sent into the auditon() 265155192Srwatson * system call. 266155192Srwatson */ 267155192Srwatsonstatic void 268155192Srwatsonaudit_sys_auditon(struct audit_record *ar, struct au_record *rec) 269155192Srwatson{ 270155192Srwatson struct au_token *tok; 271155192Srwatson 272155192Srwatson switch (ar->ar_arg_cmd) { 273156889Srwatson case A_SETPOLICY: 274155192Srwatson if (sizeof(ar->ar_arg_auditon.au_flags) > 4) 275156889Srwatson tok = au_to_arg64(1, "policy", 276156889Srwatson ar->ar_arg_auditon.au_flags); 277155192Srwatson else 278156889Srwatson tok = au_to_arg32(1, "policy", 279156889Srwatson ar->ar_arg_auditon.au_flags); 280155192Srwatson kau_write(rec, tok); 281155192Srwatson break; 282155192Srwatson 283156889Srwatson case A_SETKMASK: 284156889Srwatson tok = au_to_arg32(2, "setkmask:as_success", 285156889Srwatson ar->ar_arg_auditon.au_mask.am_success); 286155192Srwatson kau_write(rec, tok); 287156889Srwatson tok = au_to_arg32(2, "setkmask:as_failure", 288156889Srwatson ar->ar_arg_auditon.au_mask.am_failure); 289155192Srwatson kau_write(rec, tok); 290155192Srwatson break; 291155192Srwatson 292156889Srwatson case A_SETQCTRL: 293156889Srwatson tok = au_to_arg32(3, "setqctrl:aq_hiwater", 294156889Srwatson ar->ar_arg_auditon.au_qctrl.aq_hiwater); 295155192Srwatson kau_write(rec, tok); 296156889Srwatson tok = au_to_arg32(3, "setqctrl:aq_lowater", 297156889Srwatson ar->ar_arg_auditon.au_qctrl.aq_lowater); 298155192Srwatson kau_write(rec, tok); 299156889Srwatson tok = au_to_arg32(3, "setqctrl:aq_bufsz", 300156889Srwatson ar->ar_arg_auditon.au_qctrl.aq_bufsz); 301155192Srwatson kau_write(rec, tok); 302156889Srwatson tok = au_to_arg32(3, "setqctrl:aq_delay", 303156889Srwatson ar->ar_arg_auditon.au_qctrl.aq_delay); 304155192Srwatson kau_write(rec, tok); 305156889Srwatson tok = au_to_arg32(3, "setqctrl:aq_minfree", 306156889Srwatson ar->ar_arg_auditon.au_qctrl.aq_minfree); 307155192Srwatson kau_write(rec, tok); 308155192Srwatson break; 309155192Srwatson 310156889Srwatson case A_SETUMASK: 311156889Srwatson tok = au_to_arg32(3, "setumask:as_success", 312156889Srwatson ar->ar_arg_auditon.au_auinfo.ai_mask.am_success); 313155192Srwatson kau_write(rec, tok); 314156889Srwatson tok = au_to_arg32(3, "setumask:as_failure", 315156889Srwatson ar->ar_arg_auditon.au_auinfo.ai_mask.am_failure); 316155192Srwatson kau_write(rec, tok); 317155192Srwatson break; 318155192Srwatson 319156889Srwatson case A_SETSMASK: 320156889Srwatson tok = au_to_arg32(3, "setsmask:as_success", 321156889Srwatson ar->ar_arg_auditon.au_auinfo.ai_mask.am_success); 322155192Srwatson kau_write(rec, tok); 323156889Srwatson tok = au_to_arg32(3, "setsmask:as_failure", 324156889Srwatson ar->ar_arg_auditon.au_auinfo.ai_mask.am_failure); 325155192Srwatson kau_write(rec, tok); 326155192Srwatson break; 327155192Srwatson 328156889Srwatson case A_SETCOND: 329155192Srwatson if (sizeof(ar->ar_arg_auditon.au_cond) > 4) 330156889Srwatson tok = au_to_arg64(3, "setcond", 331156889Srwatson ar->ar_arg_auditon.au_cond); 332155192Srwatson else 333156889Srwatson tok = au_to_arg32(3, "setcond", 334156889Srwatson ar->ar_arg_auditon.au_cond); 335155192Srwatson kau_write(rec, tok); 336155192Srwatson break; 337155192Srwatson 338156889Srwatson case A_SETCLASS: 339155192Srwatson tok = au_to_arg32(2, "setclass:ec_event", 340156889Srwatson ar->ar_arg_auditon.au_evclass.ec_number); 341155192Srwatson kau_write(rec, tok); 342155192Srwatson tok = au_to_arg32(3, "setclass:ec_class", 343156889Srwatson ar->ar_arg_auditon.au_evclass.ec_class); 344155192Srwatson kau_write(rec, tok); 345155192Srwatson break; 346155192Srwatson 347156889Srwatson case A_SETPMASK: 348156889Srwatson tok = au_to_arg32(2, "setpmask:as_success", 349156889Srwatson ar->ar_arg_auditon.au_aupinfo.ap_mask.am_success); 350155192Srwatson kau_write(rec, tok); 351156889Srwatson tok = au_to_arg32(2, "setpmask:as_failure", 352156889Srwatson ar->ar_arg_auditon.au_aupinfo.ap_mask.am_failure); 353155192Srwatson kau_write(rec, tok); 354155192Srwatson break; 355155192Srwatson 356156889Srwatson case A_SETFSIZE: 357156889Srwatson tok = au_to_arg32(2, "setfsize:filesize", 358156889Srwatson ar->ar_arg_auditon.au_fstat.af_filesz); 359155192Srwatson kau_write(rec, tok); 360155192Srwatson break; 361155192Srwatson 362155192Srwatson default: 363155192Srwatson break; 364155192Srwatson } 365155192Srwatson} 366155192Srwatson 367155192Srwatson/* 368156889Srwatson * Convert an internal kernel audit record to a BSM record and return a 369156889Srwatson * success/failure indicator. The BSM record is passed as an out parameter to 370156889Srwatson * this function. 371156889Srwatson * 372155192Srwatson * Return conditions: 373155192Srwatson * BSM_SUCCESS: The BSM record is valid 374155192Srwatson * BSM_FAILURE: Failure; the BSM record is NULL. 375156889Srwatson * BSM_NOAUDIT: The event is not auditable for BSM; the BSM record is NULL. 376155192Srwatson */ 377155192Srwatsonint 378155192Srwatsonkaudit_to_bsm(struct kaudit_record *kar, struct au_record **pau) 379155192Srwatson{ 380155192Srwatson struct au_token *tok, *subj_tok; 381155192Srwatson struct au_record *rec; 382155192Srwatson au_tid_t tid; 383155192Srwatson struct audit_record *ar; 384155192Srwatson int ctr; 385155192Srwatson 386155192Srwatson KASSERT(kar != NULL, ("kaudit_to_bsm: kar == NULL")); 387155192Srwatson 388155192Srwatson *pau = NULL; 389155192Srwatson ar = &kar->k_ar; 390155192Srwatson rec = kau_open(); 391155192Srwatson 392155192Srwatson /* Create the subject token */ 393168688Scsjp switch (ar->ar_subj_term_addr.at_type) { 394168688Scsjp case AU_IPv4: 395168688Scsjp tid.port = ar->ar_subj_term_addr.at_port; 396168688Scsjp tid.machine = ar->ar_subj_term_addr.at_addr[0]; 397168688Scsjp subj_tok = au_to_subject32(ar->ar_subj_auid, /* audit ID */ 398168688Scsjp ar->ar_subj_cred.cr_uid, /* eff uid */ 399168688Scsjp ar->ar_subj_egid, /* eff group id */ 400168688Scsjp ar->ar_subj_ruid, /* real uid */ 401168688Scsjp ar->ar_subj_rgid, /* real group id */ 402168688Scsjp ar->ar_subj_pid, /* process id */ 403168688Scsjp ar->ar_subj_asid, /* session ID */ 404168688Scsjp &tid); 405168688Scsjp break; 406168688Scsjp case AU_IPv6: 407168688Scsjp subj_tok = au_to_subject32_ex(ar->ar_subj_auid, 408168688Scsjp ar->ar_subj_cred.cr_uid, 409168688Scsjp ar->ar_subj_egid, 410168688Scsjp ar->ar_subj_ruid, 411168688Scsjp ar->ar_subj_rgid, 412168688Scsjp ar->ar_subj_pid, 413168688Scsjp ar->ar_subj_asid, 414168688Scsjp &ar->ar_subj_term_addr); 415168688Scsjp break; 416168688Scsjp default: 417168688Scsjp bzero(&tid, sizeof(tid)); 418168688Scsjp subj_tok = au_to_subject32(ar->ar_subj_auid, 419168688Scsjp ar->ar_subj_cred.cr_uid, 420168688Scsjp ar->ar_subj_egid, 421168688Scsjp ar->ar_subj_ruid, 422168688Scsjp ar->ar_subj_rgid, 423168688Scsjp ar->ar_subj_pid, 424168688Scsjp ar->ar_subj_asid, 425168688Scsjp &tid); 426168688Scsjp } 427155192Srwatson 428156889Srwatson /* 429156889Srwatson * The logic inside each case fills in the tokens required for the 430156889Srwatson * event, except for the header, trailer, and return tokens. The 431155192Srwatson * header and trailer tokens are added by the kau_close() function. 432155192Srwatson * The return token is added outside of the switch statement. 433156889Srwatson */ 434155192Srwatson switch(ar->ar_event) { 435155192Srwatson case AUE_ACCEPT: 436155192Srwatson case AUE_BIND: 437155192Srwatson case AUE_CONNECT: 438162990Srwatson case AUE_RECV: 439155192Srwatson case AUE_RECVFROM: 440156889Srwatson case AUE_RECVMSG: 441162990Srwatson case AUE_SEND: 442162990Srwatson case AUE_SENDFILE: 443155192Srwatson case AUE_SENDMSG: 444155192Srwatson case AUE_SENDTO: 445156889Srwatson /* 446156889Srwatson * Socket-related events. 447156889Srwatson */ 448155192Srwatson if (ARG_IS_VALID(kar, ARG_FD)) { 449155192Srwatson tok = au_to_arg32(1, "fd", ar->ar_arg_fd); 450155192Srwatson kau_write(rec, tok); 451155192Srwatson } 452155192Srwatson if (ARG_IS_VALID(kar, ARG_SADDRINET)) { 453156889Srwatson tok = au_to_sock_inet((struct sockaddr_in *) 454156889Srwatson &ar->ar_arg_sockaddr); 455155192Srwatson kau_write(rec, tok); 456155192Srwatson } 457155192Srwatson if (ARG_IS_VALID(kar, ARG_SADDRUNIX)) { 458156889Srwatson tok = au_to_sock_unix((struct sockaddr_un *) 459156889Srwatson &ar->ar_arg_sockaddr); 460155192Srwatson kau_write(rec, tok); 461155192Srwatson UPATH1_TOKENS; 462155192Srwatson } 463155192Srwatson /* XXX Need to handle ARG_SADDRINET6 */ 464155192Srwatson break; 465155192Srwatson 466155192Srwatson case AUE_SOCKET: 467155192Srwatson case AUE_SOCKETPAIR: 468155192Srwatson if (ARG_IS_VALID(kar, ARG_SOCKINFO)) { 469155192Srwatson tok = au_to_arg32(1,"domain", 470155192Srwatson ar->ar_arg_sockinfo.so_domain); 471155192Srwatson kau_write(rec, tok); 472155192Srwatson tok = au_to_arg32(2,"type", 473155192Srwatson ar->ar_arg_sockinfo.so_type); 474155192Srwatson kau_write(rec, tok); 475155192Srwatson tok = au_to_arg32(3,"protocol", 476155192Srwatson ar->ar_arg_sockinfo.so_protocol); 477155192Srwatson kau_write(rec, tok); 478155192Srwatson } 479155192Srwatson break; 480155192Srwatson 481155192Srwatson case AUE_SETSOCKOPT: 482155192Srwatson case AUE_SHUTDOWN: 483155192Srwatson if (ARG_IS_VALID(kar, ARG_FD)) { 484155192Srwatson tok = au_to_arg32(1, "fd", ar->ar_arg_fd); 485155192Srwatson kau_write(rec, tok); 486155192Srwatson } 487155192Srwatson break; 488155192Srwatson 489155192Srwatson case AUE_ACCT: 490155192Srwatson if (ARG_IS_VALID(kar, ARG_UPATH1)) { 491155192Srwatson UPATH1_VNODE1_TOKENS; 492155192Srwatson } else { 493155192Srwatson tok = au_to_arg32(1, "accounting off", 0); 494155192Srwatson kau_write(rec, tok); 495155192Srwatson } 496155192Srwatson break; 497155192Srwatson 498155192Srwatson case AUE_SETAUID: 499155192Srwatson if (ARG_IS_VALID(kar, ARG_AUID)) { 500155192Srwatson tok = au_to_arg32(2, "setauid", ar->ar_arg_auid); 501155192Srwatson kau_write(rec, tok); 502155192Srwatson } 503155192Srwatson break; 504155192Srwatson 505155192Srwatson case AUE_SETAUDIT: 506155192Srwatson if (ARG_IS_VALID(kar, ARG_AUID)) { 507156889Srwatson tok = au_to_arg32(1, "setaudit:auid", 508156889Srwatson ar->ar_arg_auid); 509155192Srwatson kau_write(rec, tok); 510156889Srwatson tok = au_to_arg32(1, "setaudit:port", 511156889Srwatson ar->ar_arg_termid.port); 512155192Srwatson kau_write(rec, tok); 513156889Srwatson tok = au_to_arg32(1, "setaudit:machine", 514156889Srwatson ar->ar_arg_termid.machine); 515155192Srwatson kau_write(rec, tok); 516156889Srwatson tok = au_to_arg32(1, "setaudit:as_success", 517156889Srwatson ar->ar_arg_amask.am_success); 518155192Srwatson kau_write(rec, tok); 519156889Srwatson tok = au_to_arg32(1, "setaudit:as_failure", 520156889Srwatson ar->ar_arg_amask.am_failure); 521155192Srwatson kau_write(rec, tok); 522156889Srwatson tok = au_to_arg32(1, "setaudit:asid", 523156889Srwatson ar->ar_arg_asid); 524155192Srwatson kau_write(rec, tok); 525155192Srwatson } 526155192Srwatson break; 527155192Srwatson 528155192Srwatson case AUE_SETAUDIT_ADDR: 529155192Srwatson break; /* XXX need to add arguments */ 530155192Srwatson 531155192Srwatson case AUE_AUDITON: 532156889Srwatson /* 533156889Srwatson * For AUDITON commands without own event, audit the cmd. 534156889Srwatson */ 535155192Srwatson if (ARG_IS_VALID(kar, ARG_CMD)) { 536155192Srwatson tok = au_to_arg32(1, "cmd", ar->ar_arg_cmd); 537155192Srwatson kau_write(rec, tok); 538155192Srwatson } 539155192Srwatson /* fall thru */ 540155192Srwatson 541155192Srwatson case AUE_AUDITON_GETCAR: 542155192Srwatson case AUE_AUDITON_GETCLASS: 543155192Srwatson case AUE_AUDITON_GETCOND: 544155192Srwatson case AUE_AUDITON_GETCWD: 545155192Srwatson case AUE_AUDITON_GETKMASK: 546155192Srwatson case AUE_AUDITON_GETSTAT: 547155192Srwatson case AUE_AUDITON_GPOLICY: 548155192Srwatson case AUE_AUDITON_GQCTRL: 549155192Srwatson case AUE_AUDITON_SETCLASS: 550155192Srwatson case AUE_AUDITON_SETCOND: 551155192Srwatson case AUE_AUDITON_SETKMASK: 552155192Srwatson case AUE_AUDITON_SETSMASK: 553155192Srwatson case AUE_AUDITON_SETSTAT: 554155192Srwatson case AUE_AUDITON_SETUMASK: 555155192Srwatson case AUE_AUDITON_SPOLICY: 556155192Srwatson case AUE_AUDITON_SQCTRL: 557156889Srwatson if (ARG_IS_VALID(kar, ARG_AUDITON)) 558155192Srwatson audit_sys_auditon(ar, rec); 559155192Srwatson break; 560156889Srwatson 561155192Srwatson case AUE_AUDITCTL: 562155192Srwatson UPATH1_VNODE1_TOKENS; 563155192Srwatson break; 564155192Srwatson 565155192Srwatson case AUE_EXIT: 566155192Srwatson if (ARG_IS_VALID(kar, ARG_EXIT)) { 567155192Srwatson tok = au_to_exit(ar->ar_arg_exitretval, 568155192Srwatson ar->ar_arg_exitstatus); 569155192Srwatson kau_write(rec, tok); 570155192Srwatson } 571155192Srwatson break; 572155192Srwatson 573155192Srwatson case AUE_ADJTIME: 574162990Srwatson case AUE_CLOCK_SETTIME: 575155192Srwatson case AUE_AUDIT: 576162990Srwatson case AUE_DUP2: 577155192Srwatson case AUE_GETAUDIT: 578155192Srwatson case AUE_GETAUDIT_ADDR: 579155192Srwatson case AUE_GETAUID: 580162990Srwatson case AUE_GETCWD: 581155192Srwatson case AUE_GETFSSTAT: 582162990Srwatson case AUE_GETRESUID: 583162990Srwatson case AUE_GETRESGID: 584162990Srwatson case AUE_KQUEUE: 585162990Srwatson case AUE_LSEEK: 586162990Srwatson case AUE_MODLOAD: 587162990Srwatson case AUE_MODUNLOAD: 588162990Srwatson case AUE_MSGSYS: 589162990Srwatson case AUE_NFS_SVC: 590162990Srwatson case AUE_NTP_ADJTIME: 591155192Srwatson case AUE_PIPE: 592162990Srwatson case AUE_PROFILE: 593162990Srwatson case AUE_RTPRIO: 594162990Srwatson case AUE_SEMSYS: 595162990Srwatson case AUE_SHMSYS: 596155192Srwatson case AUE_SETPGRP: 597155192Srwatson case AUE_SETRLIMIT: 598155192Srwatson case AUE_SETSID: 599155192Srwatson case AUE_SETTIMEOFDAY: 600162990Srwatson case AUE_SYSARCH: 601162990Srwatson 602156889Srwatson /* 603156889Srwatson * Header, subject, and return tokens added at end. 604156889Srwatson */ 605155192Srwatson break; 606155192Srwatson 607159278Srwatson case AUE_MKFIFO: 608159278Srwatson if (ARG_IS_VALID(kar, ARG_MODE)) { 609159278Srwatson tok = au_to_arg32(2, "mode", ar->ar_arg_mode); 610159278Srwatson kau_write(rec, tok); 611159278Srwatson } 612159278Srwatson /* fall through */ 613155192Srwatson case AUE_ACCESS: 614155192Srwatson case AUE_CHDIR: 615155192Srwatson case AUE_CHROOT: 616155559Srwatson case AUE_EACCESS: 617155192Srwatson case AUE_GETATTRLIST: 618162990Srwatson case AUE_JAIL: 619162419Scsjp case AUE_LUTIMES: 620155192Srwatson case AUE_NFS_GETFH: 621155192Srwatson case AUE_LSTAT: 622155192Srwatson case AUE_PATHCONF: 623155192Srwatson case AUE_READLINK: 624155192Srwatson case AUE_REVOKE: 625155192Srwatson case AUE_RMDIR: 626155192Srwatson case AUE_SEARCHFS: 627155192Srwatson case AUE_SETATTRLIST: 628155192Srwatson case AUE_STAT: 629155192Srwatson case AUE_STATFS: 630162990Srwatson case AUE_SWAPON: 631162990Srwatson case AUE_SWAPOFF: 632155192Srwatson case AUE_TRUNCATE: 633155192Srwatson case AUE_UNDELETE: 634155192Srwatson case AUE_UNLINK: 635155192Srwatson case AUE_UTIMES: 636155192Srwatson UPATH1_VNODE1_TOKENS; 637155192Srwatson break; 638155192Srwatson 639162990Srwatson case AUE_FHSTATFS: 640162990Srwatson case AUE_FHOPEN: 641162990Srwatson case AUE_FHSTAT: 642162990Srwatson /* XXXRW: Need to audit vnode argument. */ 643162990Srwatson break; 644162990Srwatson 645155192Srwatson case AUE_CHFLAGS: 646155192Srwatson case AUE_LCHFLAGS: 647155192Srwatson if (ARG_IS_VALID(kar, ARG_FFLAGS)) { 648155192Srwatson tok = au_to_arg32(2, "flags", ar->ar_arg_fflags); 649155192Srwatson kau_write(rec, tok); 650155192Srwatson } 651155192Srwatson UPATH1_VNODE1_TOKENS; 652155192Srwatson break; 653156889Srwatson 654155192Srwatson case AUE_CHMOD: 655155192Srwatson case AUE_LCHMOD: 656155192Srwatson if (ARG_IS_VALID(kar, ARG_MODE)) { 657156889Srwatson tok = au_to_arg32(2, "new file mode", 658156889Srwatson ar->ar_arg_mode); 659155192Srwatson kau_write(rec, tok); 660155192Srwatson } 661155192Srwatson UPATH1_VNODE1_TOKENS; 662155192Srwatson break; 663156889Srwatson 664155192Srwatson case AUE_CHOWN: 665155192Srwatson case AUE_LCHOWN: 666155192Srwatson if (ARG_IS_VALID(kar, ARG_UID)) { 667155192Srwatson tok = au_to_arg32(2, "new file uid", ar->ar_arg_uid); 668155192Srwatson kau_write(rec, tok); 669155192Srwatson } 670155192Srwatson if (ARG_IS_VALID(kar, ARG_GID)) { 671155192Srwatson tok = au_to_arg32(3, "new file gid", ar->ar_arg_gid); 672155192Srwatson kau_write(rec, tok); 673155192Srwatson } 674155192Srwatson UPATH1_VNODE1_TOKENS; 675155192Srwatson break; 676156889Srwatson 677155192Srwatson case AUE_EXCHANGEDATA: 678155192Srwatson UPATH1_VNODE1_TOKENS; 679155192Srwatson UPATH2_TOKENS; 680155192Srwatson break; 681155192Srwatson 682155192Srwatson case AUE_CLOSE: 683155192Srwatson if (ARG_IS_VALID(kar, ARG_FD)) { 684155192Srwatson tok = au_to_arg32(2, "fd", ar->ar_arg_fd); 685155192Srwatson kau_write(rec, tok); 686155192Srwatson } 687155192Srwatson UPATH1_VNODE1_TOKENS; 688155192Srwatson break; 689155192Srwatson 690160136Swsalamon case AUE_EXTATTRCTL: 691160136Swsalamon UPATH1_VNODE1_TOKENS; 692160136Swsalamon if (ARG_IS_VALID(kar, ARG_CMD)) { 693160136Swsalamon tok = au_to_arg32(2, "cmd", ar->ar_arg_cmd); 694160136Swsalamon kau_write(rec, tok); 695160136Swsalamon } 696160136Swsalamon /* extattrctl(2) filename parameter is in upath2/vnode2 */ 697160136Swsalamon UPATH2_TOKENS; 698160136Swsalamon VNODE2_TOKENS; 699160136Swsalamon EXTATTR_TOKENS; 700160136Swsalamon break; 701160136Swsalamon 702160136Swsalamon case AUE_EXTATTR_GET_FILE: 703160136Swsalamon case AUE_EXTATTR_SET_FILE: 704160136Swsalamon case AUE_EXTATTR_LIST_FILE: 705160136Swsalamon case AUE_EXTATTR_DELETE_FILE: 706160136Swsalamon case AUE_EXTATTR_GET_LINK: 707160136Swsalamon case AUE_EXTATTR_SET_LINK: 708160136Swsalamon case AUE_EXTATTR_LIST_LINK: 709160136Swsalamon case AUE_EXTATTR_DELETE_LINK: 710160136Swsalamon UPATH1_VNODE1_TOKENS; 711160136Swsalamon EXTATTR_TOKENS; 712160136Swsalamon break; 713160136Swsalamon 714160136Swsalamon case AUE_EXTATTR_GET_FD: 715160136Swsalamon case AUE_EXTATTR_SET_FD: 716160136Swsalamon case AUE_EXTATTR_LIST_FD: 717160136Swsalamon case AUE_EXTATTR_DELETE_FD: 718160136Swsalamon if (ARG_IS_VALID(kar, ARG_FD)) { 719160136Swsalamon tok = au_to_arg32(2, "fd", ar->ar_arg_fd); 720160136Swsalamon kau_write(rec, tok); 721160136Swsalamon } 722160136Swsalamon EXTATTR_TOKENS; 723160136Swsalamon break; 724160136Swsalamon 725161813Swsalamon case AUE_EXECVE: 726161813Swsalamon if (ARG_IS_VALID(kar, ARG_ARGV)) { 727161813Swsalamon tok = au_to_exec_args(ar->ar_arg_argv, 728161813Swsalamon ar->ar_arg_argc); 729161813Swsalamon kau_write(rec, tok); 730161813Swsalamon } 731161813Swsalamon if (ARG_IS_VALID(kar, ARG_ENVV)) { 732161813Swsalamon tok = au_to_exec_env(ar->ar_arg_envv, 733161813Swsalamon ar->ar_arg_envc); 734161813Swsalamon kau_write(rec, tok); 735161813Swsalamon } 736161813Swsalamon UPATH1_VNODE1_TOKENS; 737161813Swsalamon break; 738161813Swsalamon 739155192Srwatson case AUE_FCHMOD: 740155192Srwatson if (ARG_IS_VALID(kar, ARG_MODE)) { 741156889Srwatson tok = au_to_arg32(2, "new file mode", 742156889Srwatson ar->ar_arg_mode); 743155192Srwatson kau_write(rec, tok); 744155192Srwatson } 745155192Srwatson FD_VNODE1_TOKENS; 746155192Srwatson break; 747156889Srwatson 748162990Srwatson /* 749162990Srwatson * XXXRW: Some of these need to handle non-vnode cases as well. 750162990Srwatson */ 751155192Srwatson case AUE_FCHDIR: 752155192Srwatson case AUE_FPATHCONF: 753162990Srwatson case AUE_FSTAT: 754155192Srwatson case AUE_FSTATFS: 755155192Srwatson case AUE_FSYNC: 756155192Srwatson case AUE_FTRUNCATE: 757155192Srwatson case AUE_FUTIMES: 758155192Srwatson case AUE_GETDIRENTRIES: 759155192Srwatson case AUE_GETDIRENTRIESATTR: 760162990Srwatson case AUE_POLL: 761162990Srwatson case AUE_READ: 762162990Srwatson case AUE_READV: 763162990Srwatson case AUE_WRITE: 764162990Srwatson case AUE_WRITEV: 765155192Srwatson FD_VNODE1_TOKENS; 766155192Srwatson break; 767156889Srwatson 768155192Srwatson case AUE_FCHOWN: 769155192Srwatson if (ARG_IS_VALID(kar, ARG_UID)) { 770155192Srwatson tok = au_to_arg32(2, "new file uid", ar->ar_arg_uid); 771155192Srwatson kau_write(rec, tok); 772155192Srwatson } 773155192Srwatson if (ARG_IS_VALID(kar, ARG_GID)) { 774155192Srwatson tok = au_to_arg32(3, "new file gid", ar->ar_arg_gid); 775155192Srwatson kau_write(rec, tok); 776155192Srwatson } 777155192Srwatson FD_VNODE1_TOKENS; 778155192Srwatson break; 779156889Srwatson 780155192Srwatson case AUE_FCNTL: 781155192Srwatson if (ar->ar_arg_cmd == F_GETLK || ar->ar_arg_cmd == F_SETLK || 782155192Srwatson ar->ar_arg_cmd == F_SETLKW) { 783155192Srwatson if (ARG_IS_VALID(kar, ARG_CMD)) { 784155192Srwatson tok = au_to_arg32(2, "cmd", ar->ar_arg_cmd); 785155192Srwatson kau_write(rec, tok); 786155192Srwatson } 787155192Srwatson FD_VNODE1_TOKENS; 788155192Srwatson } 789155192Srwatson break; 790156889Srwatson 791155192Srwatson case AUE_FCHFLAGS: 792155192Srwatson if (ARG_IS_VALID(kar, ARG_FFLAGS)) { 793155192Srwatson tok = au_to_arg32(2, "flags", ar->ar_arg_fflags); 794155192Srwatson kau_write(rec, tok); 795155192Srwatson } 796155192Srwatson FD_VNODE1_TOKENS; 797155192Srwatson break; 798156889Srwatson 799155192Srwatson case AUE_FLOCK: 800155192Srwatson if (ARG_IS_VALID(kar, ARG_CMD)) { 801155192Srwatson tok = au_to_arg32(2, "operation", ar->ar_arg_cmd); 802155192Srwatson kau_write(rec, tok); 803155192Srwatson } 804155192Srwatson FD_VNODE1_TOKENS; 805155192Srwatson break; 806156889Srwatson 807155192Srwatson case AUE_RFORK: 808155192Srwatson if (ARG_IS_VALID(kar, ARG_FFLAGS)) { 809155192Srwatson tok = au_to_arg32(1, "flags", ar->ar_arg_fflags); 810155192Srwatson kau_write(rec, tok); 811155192Srwatson } 812155192Srwatson /* fall through */ 813155192Srwatson case AUE_FORK: 814155192Srwatson case AUE_VFORK: 815155192Srwatson if (ARG_IS_VALID(kar, ARG_PID)) { 816155192Srwatson tok = au_to_arg32(0, "child PID", ar->ar_arg_pid); 817155192Srwatson kau_write(rec, tok); 818155192Srwatson } 819155192Srwatson break; 820156889Srwatson 821155192Srwatson case AUE_IOCTL: 822155192Srwatson if (ARG_IS_VALID(kar, ARG_CMD)) { 823155192Srwatson tok = au_to_arg32(2, "cmd", ar->ar_arg_cmd); 824155192Srwatson kau_write(rec, tok); 825155192Srwatson } 826155192Srwatson if (ARG_IS_VALID(kar, ARG_ADDR)) { 827155271Srwatson tok = au_to_arg32(1, "arg", 828155271Srwatson (u_int32_t)(uintptr_t)ar->ar_arg_addr); 829155192Srwatson kau_write(rec, tok); 830155192Srwatson } 831156889Srwatson if (ARG_IS_VALID(kar, ARG_VNODE1)) 832155192Srwatson FD_VNODE1_TOKENS; 833156889Srwatson else { 834155192Srwatson if (ARG_IS_VALID(kar, ARG_SOCKINFO)) { 835156889Srwatson tok = kau_to_socket(&ar->ar_arg_sockinfo); 836155192Srwatson kau_write(rec, tok); 837155192Srwatson } else { 838155192Srwatson if (ARG_IS_VALID(kar, ARG_FD)) { 839155192Srwatson tok = au_to_arg32(1, "fd", 840155192Srwatson ar->ar_arg_fd); 841155192Srwatson kau_write(rec, tok); 842155192Srwatson } 843155192Srwatson } 844155192Srwatson } 845155192Srwatson break; 846155192Srwatson 847155192Srwatson case AUE_KILL: 848162990Srwatson case AUE_KILLPG: 849155192Srwatson if (ARG_IS_VALID(kar, ARG_SIGNUM)) { 850155192Srwatson tok = au_to_arg32(2, "signal", ar->ar_arg_signum); 851155192Srwatson kau_write(rec, tok); 852155192Srwatson } 853155192Srwatson PROCESS_PID_TOKENS(1); 854155192Srwatson break; 855155192Srwatson 856155192Srwatson case AUE_KTRACE: 857155192Srwatson if (ARG_IS_VALID(kar, ARG_CMD)) { 858155192Srwatson tok = au_to_arg32(2, "ops", ar->ar_arg_cmd); 859155192Srwatson kau_write(rec, tok); 860155192Srwatson } 861155192Srwatson if (ARG_IS_VALID(kar, ARG_VALUE)) { 862155192Srwatson tok = au_to_arg32(3, "trpoints", ar->ar_arg_value); 863155192Srwatson kau_write(rec, tok); 864155192Srwatson } 865155192Srwatson PROCESS_PID_TOKENS(4); 866155192Srwatson UPATH1_VNODE1_TOKENS; 867155192Srwatson break; 868155192Srwatson 869155192Srwatson case AUE_LINK: 870155192Srwatson case AUE_RENAME: 871155192Srwatson UPATH1_VNODE1_TOKENS; 872155192Srwatson UPATH2_TOKENS; 873155192Srwatson break; 874155192Srwatson 875155192Srwatson case AUE_LOADSHFILE: 876155192Srwatson if (ARG_IS_VALID(kar, ARG_ADDR)) { 877155192Srwatson tok = au_to_arg32(4, "base addr", 878155271Srwatson (u_int32_t)(uintptr_t)ar->ar_arg_addr); 879155192Srwatson kau_write(rec, tok); 880155192Srwatson } 881155192Srwatson UPATH1_VNODE1_TOKENS; 882155192Srwatson break; 883156889Srwatson 884155192Srwatson case AUE_MKDIR: 885155192Srwatson if (ARG_IS_VALID(kar, ARG_MODE)) { 886155192Srwatson tok = au_to_arg32(2, "mode", ar->ar_arg_mode); 887155192Srwatson kau_write(rec, tok); 888155192Srwatson } 889155192Srwatson UPATH1_VNODE1_TOKENS; 890155192Srwatson break; 891155192Srwatson 892155192Srwatson case AUE_MKNOD: 893155192Srwatson if (ARG_IS_VALID(kar, ARG_MODE)) { 894155192Srwatson tok = au_to_arg32(2, "mode", ar->ar_arg_mode); 895155192Srwatson kau_write(rec, tok); 896155192Srwatson } 897155192Srwatson if (ARG_IS_VALID(kar, ARG_DEV)) { 898155192Srwatson tok = au_to_arg32(3, "dev", ar->ar_arg_dev); 899155192Srwatson kau_write(rec, tok); 900155192Srwatson } 901155192Srwatson UPATH1_VNODE1_TOKENS; 902155192Srwatson break; 903155192Srwatson 904155192Srwatson case AUE_MMAP: 905155192Srwatson case AUE_MUNMAP: 906155192Srwatson case AUE_MPROTECT: 907155192Srwatson case AUE_MLOCK: 908155192Srwatson case AUE_MUNLOCK: 909155192Srwatson case AUE_MINHERIT: 910155192Srwatson if (ARG_IS_VALID(kar, ARG_ADDR)) { 911155192Srwatson tok = au_to_arg32(1, "addr", 912155271Srwatson (u_int32_t)(uintptr_t)ar->ar_arg_addr); 913155192Srwatson kau_write(rec, tok); 914155192Srwatson } 915155192Srwatson if (ARG_IS_VALID(kar, ARG_LEN)) { 916155192Srwatson tok = au_to_arg32(2, "len", ar->ar_arg_len); 917155192Srwatson kau_write(rec, tok); 918155192Srwatson } 919155192Srwatson if (ar->ar_event == AUE_MMAP) 920155192Srwatson FD_VNODE1_TOKENS; 921155192Srwatson if (ar->ar_event == AUE_MPROTECT) { 922155192Srwatson if (ARG_IS_VALID(kar, ARG_VALUE)) { 923155192Srwatson tok = au_to_arg32(3, "protection", 924155192Srwatson ar->ar_arg_value); 925155192Srwatson kau_write(rec, tok); 926155192Srwatson } 927155192Srwatson } 928155192Srwatson if (ar->ar_event == AUE_MINHERIT) { 929155192Srwatson if (ARG_IS_VALID(kar, ARG_VALUE)) { 930155192Srwatson tok = au_to_arg32(3, "inherit", 931155192Srwatson ar->ar_arg_value); 932155192Srwatson kau_write(rec, tok); 933155192Srwatson } 934155192Srwatson } 935155192Srwatson break; 936155192Srwatson 937155192Srwatson case AUE_MOUNT: 938162990Srwatson case AUE_NMOUNT: 939155192Srwatson /* XXX Need to handle NFS mounts */ 940155192Srwatson if (ARG_IS_VALID(kar, ARG_FFLAGS)) { 941155192Srwatson tok = au_to_arg32(3, "flags", ar->ar_arg_fflags); 942155192Srwatson kau_write(rec, tok); 943155192Srwatson } 944155192Srwatson if (ARG_IS_VALID(kar, ARG_TEXT)) { 945155192Srwatson tok = au_to_text(ar->ar_arg_text); 946155192Srwatson kau_write(rec, tok); 947155192Srwatson } 948155192Srwatson /* fall through */ 949156889Srwatson 950155192Srwatson case AUE_UMOUNT: 951155192Srwatson UPATH1_VNODE1_TOKENS; 952155192Srwatson break; 953155192Srwatson 954155192Srwatson case AUE_MSGCTL: 955155192Srwatson ar->ar_event = msgctl_to_event(ar->ar_arg_svipc_cmd); 956155192Srwatson /* Fall through */ 957156889Srwatson 958155192Srwatson case AUE_MSGRCV: 959155192Srwatson case AUE_MSGSND: 960155192Srwatson tok = au_to_arg32(1, "msg ID", ar->ar_arg_svipc_id); 961155192Srwatson kau_write(rec, tok); 962155192Srwatson if (ar->ar_errno != EINVAL) { 963155192Srwatson tok = au_to_ipc(AT_IPC_MSG, ar->ar_arg_svipc_id); 964155192Srwatson kau_write(rec, tok); 965155192Srwatson } 966155192Srwatson break; 967155192Srwatson 968155192Srwatson case AUE_MSGGET: 969155192Srwatson if (ar->ar_errno == 0) { 970155192Srwatson if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) { 971155192Srwatson tok = au_to_ipc(AT_IPC_MSG, 972155192Srwatson ar->ar_arg_svipc_id); 973155192Srwatson kau_write(rec, tok); 974155192Srwatson } 975155192Srwatson } 976155192Srwatson break; 977155192Srwatson 978155192Srwatson case AUE_RESETSHFILE: 979155192Srwatson if (ARG_IS_VALID(kar, ARG_ADDR)) { 980155192Srwatson tok = au_to_arg32(1, "base addr", 981155271Srwatson (u_int32_t)(uintptr_t)ar->ar_arg_addr); 982155192Srwatson kau_write(rec, tok); 983155192Srwatson } 984155192Srwatson break; 985156889Srwatson 986155192Srwatson case AUE_OPEN_RC: 987155192Srwatson case AUE_OPEN_RTC: 988155192Srwatson case AUE_OPEN_RWC: 989155192Srwatson case AUE_OPEN_RWTC: 990155192Srwatson case AUE_OPEN_WC: 991155192Srwatson case AUE_OPEN_WTC: 992162990Srwatson case AUE_CREAT: 993155192Srwatson if (ARG_IS_VALID(kar, ARG_MODE)) { 994155192Srwatson tok = au_to_arg32(3, "mode", ar->ar_arg_mode); 995155192Srwatson kau_write(rec, tok); 996155192Srwatson } 997155192Srwatson /* fall through */ 998155192Srwatson 999155192Srwatson case AUE_OPEN_R: 1000155192Srwatson case AUE_OPEN_RT: 1001155192Srwatson case AUE_OPEN_RW: 1002155192Srwatson case AUE_OPEN_RWT: 1003155192Srwatson case AUE_OPEN_W: 1004155192Srwatson case AUE_OPEN_WT: 1005155192Srwatson if (ARG_IS_VALID(kar, ARG_FFLAGS)) { 1006155192Srwatson tok = au_to_arg32(2, "flags", ar->ar_arg_fflags); 1007155192Srwatson kau_write(rec, tok); 1008155192Srwatson } 1009155192Srwatson UPATH1_VNODE1_TOKENS; 1010155192Srwatson break; 1011155192Srwatson 1012155192Srwatson case AUE_PTRACE: 1013155192Srwatson if (ARG_IS_VALID(kar, ARG_CMD)) { 1014155192Srwatson tok = au_to_arg32(1, "request", ar->ar_arg_cmd); 1015155192Srwatson kau_write(rec, tok); 1016155192Srwatson } 1017155192Srwatson if (ARG_IS_VALID(kar, ARG_ADDR)) { 1018155192Srwatson tok = au_to_arg32(3, "addr", 1019155271Srwatson (u_int32_t)(uintptr_t)ar->ar_arg_addr); 1020155192Srwatson kau_write(rec, tok); 1021155192Srwatson } 1022155192Srwatson if (ARG_IS_VALID(kar, ARG_VALUE)) { 1023155192Srwatson tok = au_to_arg32(4, "data", ar->ar_arg_value); 1024155192Srwatson kau_write(rec, tok); 1025155192Srwatson } 1026155192Srwatson PROCESS_PID_TOKENS(2); 1027155192Srwatson break; 1028155192Srwatson 1029155192Srwatson case AUE_QUOTACTL: 1030155192Srwatson if (ARG_IS_VALID(kar, ARG_CMD)) { 1031155192Srwatson tok = au_to_arg32(2, "command", ar->ar_arg_cmd); 1032155192Srwatson kau_write(rec, tok); 1033155192Srwatson } 1034155192Srwatson if (ARG_IS_VALID(kar, ARG_UID)) { 1035155192Srwatson tok = au_to_arg32(3, "uid", ar->ar_arg_uid); 1036155192Srwatson kau_write(rec, tok); 1037155192Srwatson } 1038155192Srwatson UPATH1_VNODE1_TOKENS; 1039155192Srwatson break; 1040155192Srwatson 1041155192Srwatson case AUE_REBOOT: 1042155192Srwatson if (ARG_IS_VALID(kar, ARG_CMD)) { 1043155192Srwatson tok = au_to_arg32(1, "howto", ar->ar_arg_cmd); 1044155192Srwatson kau_write(rec, tok); 1045155192Srwatson } 1046155192Srwatson break; 1047155192Srwatson 1048155192Srwatson case AUE_SEMCTL: 1049155192Srwatson ar->ar_event = semctl_to_event(ar->ar_arg_svipc_cmd); 1050155192Srwatson /* Fall through */ 1051156889Srwatson 1052155192Srwatson case AUE_SEMOP: 1053155192Srwatson if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) { 1054155192Srwatson tok = au_to_arg32(1, "sem ID", ar->ar_arg_svipc_id); 1055155192Srwatson kau_write(rec, tok); 1056155192Srwatson if (ar->ar_errno != EINVAL) { 1057155192Srwatson tok = au_to_ipc(AT_IPC_SEM, 1058155192Srwatson ar->ar_arg_svipc_id); 1059155192Srwatson kau_write(rec, tok); 1060155192Srwatson } 1061155192Srwatson } 1062155192Srwatson break; 1063156889Srwatson 1064155192Srwatson case AUE_SEMGET: 1065155192Srwatson if (ar->ar_errno == 0) { 1066155192Srwatson if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) { 1067155192Srwatson tok = au_to_ipc(AT_IPC_SEM, 1068155192Srwatson ar->ar_arg_svipc_id); 1069155192Srwatson kau_write(rec, tok); 1070155192Srwatson } 1071155192Srwatson } 1072155192Srwatson break; 1073156889Srwatson 1074155192Srwatson case AUE_SETEGID: 1075155192Srwatson if (ARG_IS_VALID(kar, ARG_EGID)) { 1076155192Srwatson tok = au_to_arg32(1, "gid", ar->ar_arg_egid); 1077155192Srwatson kau_write(rec, tok); 1078155192Srwatson } 1079155192Srwatson break; 1080156889Srwatson 1081155192Srwatson case AUE_SETEUID: 1082155192Srwatson if (ARG_IS_VALID(kar, ARG_EUID)) { 1083155192Srwatson tok = au_to_arg32(1, "uid", ar->ar_arg_euid); 1084155192Srwatson kau_write(rec, tok); 1085155192Srwatson } 1086155192Srwatson break; 1087156889Srwatson 1088155192Srwatson case AUE_SETREGID: 1089155192Srwatson if (ARG_IS_VALID(kar, ARG_RGID)) { 1090155192Srwatson tok = au_to_arg32(1, "rgid", ar->ar_arg_rgid); 1091155192Srwatson kau_write(rec, tok); 1092155192Srwatson } 1093155192Srwatson if (ARG_IS_VALID(kar, ARG_EGID)) { 1094155192Srwatson tok = au_to_arg32(2, "egid", ar->ar_arg_egid); 1095155192Srwatson kau_write(rec, tok); 1096155192Srwatson } 1097155192Srwatson break; 1098156889Srwatson 1099155192Srwatson case AUE_SETREUID: 1100155192Srwatson if (ARG_IS_VALID(kar, ARG_RUID)) { 1101155192Srwatson tok = au_to_arg32(1, "ruid", ar->ar_arg_ruid); 1102155192Srwatson kau_write(rec, tok); 1103155192Srwatson } 1104155192Srwatson if (ARG_IS_VALID(kar, ARG_EUID)) { 1105155192Srwatson tok = au_to_arg32(2, "euid", ar->ar_arg_euid); 1106155192Srwatson kau_write(rec, tok); 1107155192Srwatson } 1108155192Srwatson break; 1109156889Srwatson 1110155192Srwatson case AUE_SETRESGID: 1111155192Srwatson if (ARG_IS_VALID(kar, ARG_RGID)) { 1112155192Srwatson tok = au_to_arg32(1, "rgid", ar->ar_arg_rgid); 1113155192Srwatson kau_write(rec, tok); 1114155192Srwatson } 1115155192Srwatson if (ARG_IS_VALID(kar, ARG_EGID)) { 1116155192Srwatson tok = au_to_arg32(2, "egid", ar->ar_arg_egid); 1117155192Srwatson kau_write(rec, tok); 1118155192Srwatson } 1119155192Srwatson if (ARG_IS_VALID(kar, ARG_SGID)) { 1120155192Srwatson tok = au_to_arg32(3, "sgid", ar->ar_arg_sgid); 1121155192Srwatson kau_write(rec, tok); 1122155192Srwatson } 1123155192Srwatson break; 1124156889Srwatson 1125155192Srwatson case AUE_SETRESUID: 1126155192Srwatson if (ARG_IS_VALID(kar, ARG_RUID)) { 1127155192Srwatson tok = au_to_arg32(1, "ruid", ar->ar_arg_ruid); 1128155192Srwatson kau_write(rec, tok); 1129155192Srwatson } 1130155192Srwatson if (ARG_IS_VALID(kar, ARG_EUID)) { 1131155192Srwatson tok = au_to_arg32(2, "euid", ar->ar_arg_euid); 1132155192Srwatson kau_write(rec, tok); 1133155192Srwatson } 1134155192Srwatson if (ARG_IS_VALID(kar, ARG_SUID)) { 1135155192Srwatson tok = au_to_arg32(3, "suid", ar->ar_arg_suid); 1136155192Srwatson kau_write(rec, tok); 1137155192Srwatson } 1138155192Srwatson break; 1139156889Srwatson 1140155192Srwatson case AUE_SETGID: 1141155192Srwatson if (ARG_IS_VALID(kar, ARG_GID)) { 1142155192Srwatson tok = au_to_arg32(1, "gid", ar->ar_arg_gid); 1143155192Srwatson kau_write(rec, tok); 1144155192Srwatson } 1145155192Srwatson break; 1146156889Srwatson 1147155192Srwatson case AUE_SETUID: 1148155192Srwatson if (ARG_IS_VALID(kar, ARG_UID)) { 1149155192Srwatson tok = au_to_arg32(1, "uid", ar->ar_arg_uid); 1150155192Srwatson kau_write(rec, tok); 1151155192Srwatson } 1152155192Srwatson break; 1153156889Srwatson 1154155192Srwatson case AUE_SETGROUPS: 1155155192Srwatson if (ARG_IS_VALID(kar, ARG_GROUPSET)) { 1156155192Srwatson for(ctr = 0; ctr < ar->ar_arg_groups.gidset_size; ctr++) 1157155192Srwatson { 1158155192Srwatson tok = au_to_arg32(1, "setgroups", ar->ar_arg_groups.gidset[ctr]); 1159155192Srwatson kau_write(rec, tok); 1160155192Srwatson } 1161155192Srwatson } 1162155192Srwatson break; 1163155192Srwatson 1164155192Srwatson case AUE_SETLOGIN: 1165155192Srwatson if (ARG_IS_VALID(kar, ARG_TEXT)) { 1166155192Srwatson tok = au_to_text(ar->ar_arg_text); 1167155192Srwatson kau_write(rec, tok); 1168155192Srwatson } 1169155192Srwatson break; 1170155192Srwatson 1171155192Srwatson case AUE_SETPRIORITY: 1172155192Srwatson if (ARG_IS_VALID(kar, ARG_CMD)) { 1173155192Srwatson tok = au_to_arg32(1, "which", ar->ar_arg_cmd); 1174155192Srwatson kau_write(rec, tok); 1175155192Srwatson } 1176155192Srwatson if (ARG_IS_VALID(kar, ARG_UID)) { 1177155192Srwatson tok = au_to_arg32(2, "who", ar->ar_arg_uid); 1178155192Srwatson kau_write(rec, tok); 1179155192Srwatson } 1180155192Srwatson if (ARG_IS_VALID(kar, ARG_VALUE)) { 1181155192Srwatson tok = au_to_arg32(2, "priority", ar->ar_arg_value); 1182155192Srwatson kau_write(rec, tok); 1183155192Srwatson } 1184155192Srwatson break; 1185155192Srwatson 1186155192Srwatson case AUE_SETPRIVEXEC: 1187155192Srwatson if (ARG_IS_VALID(kar, ARG_VALUE)) { 1188155192Srwatson tok = au_to_arg32(1, "flag", ar->ar_arg_value); 1189155192Srwatson kau_write(rec, tok); 1190155192Srwatson } 1191155192Srwatson break; 1192155192Srwatson 1193155192Srwatson /* AUE_SHMAT, AUE_SHMCTL, AUE_SHMDT and AUE_SHMGET are SysV IPC */ 1194155192Srwatson case AUE_SHMAT: 1195155192Srwatson if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) { 1196155192Srwatson tok = au_to_arg32(1, "shmid", ar->ar_arg_svipc_id); 1197155192Srwatson kau_write(rec, tok); 1198155192Srwatson /* XXXAUDIT: Does having the ipc token make sense? */ 1199155192Srwatson tok = au_to_ipc(AT_IPC_SHM, ar->ar_arg_svipc_id); 1200155192Srwatson kau_write(rec, tok); 1201155192Srwatson } 1202155192Srwatson if (ARG_IS_VALID(kar, ARG_SVIPC_ADDR)) { 1203155192Srwatson tok = au_to_arg32(2, "shmaddr", 1204155271Srwatson (int)(uintptr_t)ar->ar_arg_svipc_addr); 1205155192Srwatson kau_write(rec, tok); 1206155192Srwatson } 1207155192Srwatson if (ARG_IS_VALID(kar, ARG_SVIPC_PERM)) { 1208155192Srwatson tok = au_to_ipc_perm(&ar->ar_arg_svipc_perm); 1209155192Srwatson kau_write(rec, tok); 1210155192Srwatson } 1211155192Srwatson break; 1212155192Srwatson 1213155192Srwatson case AUE_SHMCTL: 1214155192Srwatson if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) { 1215155192Srwatson tok = au_to_arg32(1, "shmid", ar->ar_arg_svipc_id); 1216155192Srwatson kau_write(rec, tok); 1217155192Srwatson /* XXXAUDIT: Does having the ipc token make sense? */ 1218155192Srwatson tok = au_to_ipc(AT_IPC_SHM, ar->ar_arg_svipc_id); 1219155192Srwatson kau_write(rec, tok); 1220155192Srwatson } 1221155192Srwatson switch (ar->ar_arg_svipc_cmd) { 1222155192Srwatson case IPC_STAT: 1223155192Srwatson ar->ar_event = AUE_SHMCTL_STAT; 1224155192Srwatson break; 1225155192Srwatson case IPC_RMID: 1226155192Srwatson ar->ar_event = AUE_SHMCTL_RMID; 1227155192Srwatson break; 1228155192Srwatson case IPC_SET: 1229155192Srwatson ar->ar_event = AUE_SHMCTL_SET; 1230155192Srwatson if (ARG_IS_VALID(kar, ARG_SVIPC_PERM)) { 1231155192Srwatson tok = au_to_ipc_perm(&ar->ar_arg_svipc_perm); 1232155192Srwatson kau_write(rec, tok); 1233155192Srwatson } 1234155192Srwatson break; 1235155192Srwatson default: 1236155192Srwatson break; /* We will audit a bad command */ 1237155192Srwatson } 1238155192Srwatson break; 1239155192Srwatson 1240155192Srwatson case AUE_SHMDT: 1241155192Srwatson if (ARG_IS_VALID(kar, ARG_SVIPC_ADDR)) { 1242155192Srwatson tok = au_to_arg32(1, "shmaddr", 1243155271Srwatson (int)(uintptr_t)ar->ar_arg_svipc_addr); 1244155192Srwatson kau_write(rec, tok); 1245155192Srwatson } 1246155192Srwatson break; 1247155192Srwatson 1248155192Srwatson case AUE_SHMGET: 1249155192Srwatson /* This is unusual; the return value is in an argument token */ 1250155192Srwatson if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) { 1251155192Srwatson tok = au_to_arg32(0, "shmid", ar->ar_arg_svipc_id); 1252155192Srwatson kau_write(rec, tok); 1253155192Srwatson tok = au_to_ipc(AT_IPC_SHM, ar->ar_arg_svipc_id); 1254155192Srwatson kau_write(rec, tok); 1255155192Srwatson } 1256155192Srwatson if (ARG_IS_VALID(kar, ARG_SVIPC_PERM)) { 1257155192Srwatson tok = au_to_ipc_perm(&ar->ar_arg_svipc_perm); 1258155192Srwatson kau_write(rec, tok); 1259155192Srwatson } 1260155192Srwatson break; 1261155192Srwatson 1262156889Srwatson /* AUE_SHMOPEN, AUE_SHMUNLINK, AUE_SEMOPEN, AUE_SEMCLOSE 1263155192Srwatson * and AUE_SEMUNLINK are Posix IPC */ 1264155192Srwatson case AUE_SHMOPEN: 1265155192Srwatson if (ARG_IS_VALID(kar, ARG_SVIPC_ADDR)) { 1266155192Srwatson tok = au_to_arg32(2, "flags", ar->ar_arg_fflags); 1267155192Srwatson kau_write(rec, tok); 1268155192Srwatson } 1269155192Srwatson if (ARG_IS_VALID(kar, ARG_MODE)) { 1270155192Srwatson tok = au_to_arg32(3, "mode", ar->ar_arg_mode); 1271155192Srwatson kau_write(rec, tok); 1272155192Srwatson } 1273155192Srwatson case AUE_SHMUNLINK: 1274155192Srwatson if (ARG_IS_VALID(kar, ARG_TEXT)) { 1275155192Srwatson tok = au_to_text(ar->ar_arg_text); 1276155192Srwatson kau_write(rec, tok); 1277155192Srwatson } 1278155192Srwatson if (ARG_IS_VALID(kar, ARG_POSIX_IPC_PERM)) { 1279155192Srwatson /* Create an ipc_perm token */ 1280155192Srwatson struct ipc_perm perm; 1281155192Srwatson perm.uid = ar->ar_arg_pipc_perm.pipc_uid; 1282155192Srwatson perm.gid = ar->ar_arg_pipc_perm.pipc_gid; 1283155192Srwatson perm.cuid = ar->ar_arg_pipc_perm.pipc_uid; 1284155192Srwatson perm.cgid = ar->ar_arg_pipc_perm.pipc_gid; 1285155192Srwatson perm.mode = ar->ar_arg_pipc_perm.pipc_mode; 1286155192Srwatson perm.seq = 0; 1287155192Srwatson perm.key = 0; 1288155192Srwatson tok = au_to_ipc_perm(&perm); 1289155192Srwatson kau_write(rec, tok); 1290155192Srwatson } 1291155192Srwatson break; 1292155192Srwatson 1293155192Srwatson case AUE_SEMOPEN: 1294155192Srwatson if (ARG_IS_VALID(kar, ARG_FFLAGS)) { 1295155192Srwatson tok = au_to_arg32(2, "flags", ar->ar_arg_fflags); 1296155192Srwatson kau_write(rec, tok); 1297155192Srwatson } 1298155192Srwatson if (ARG_IS_VALID(kar, ARG_MODE)) { 1299155192Srwatson tok = au_to_arg32(3, "mode", ar->ar_arg_mode); 1300155192Srwatson kau_write(rec, tok); 1301155192Srwatson } 1302155192Srwatson if (ARG_IS_VALID(kar, ARG_VALUE)) { 1303155192Srwatson tok = au_to_arg32(4, "value", ar->ar_arg_value); 1304155192Srwatson kau_write(rec, tok); 1305155192Srwatson } 1306155192Srwatson /* fall through */ 1307156889Srwatson 1308155192Srwatson case AUE_SEMUNLINK: 1309155192Srwatson if (ARG_IS_VALID(kar, ARG_TEXT)) { 1310155192Srwatson tok = au_to_text(ar->ar_arg_text); 1311155192Srwatson kau_write(rec, tok); 1312155192Srwatson } 1313155192Srwatson if (ARG_IS_VALID(kar, ARG_POSIX_IPC_PERM)) { 1314155192Srwatson /* Create an ipc_perm token */ 1315155192Srwatson struct ipc_perm perm; 1316155192Srwatson perm.uid = ar->ar_arg_pipc_perm.pipc_uid; 1317155192Srwatson perm.gid = ar->ar_arg_pipc_perm.pipc_gid; 1318155192Srwatson perm.cuid = ar->ar_arg_pipc_perm.pipc_uid; 1319155192Srwatson perm.cgid = ar->ar_arg_pipc_perm.pipc_gid; 1320155192Srwatson perm.mode = ar->ar_arg_pipc_perm.pipc_mode; 1321155192Srwatson perm.seq = 0; 1322155192Srwatson perm.key = 0; 1323155192Srwatson tok = au_to_ipc_perm(&perm); 1324155192Srwatson kau_write(rec, tok); 1325155192Srwatson } 1326155192Srwatson break; 1327155192Srwatson 1328155192Srwatson case AUE_SEMCLOSE: 1329155192Srwatson if (ARG_IS_VALID(kar, ARG_FD)) { 1330155192Srwatson tok = au_to_arg32(1, "sem", ar->ar_arg_fd); 1331155192Srwatson kau_write(rec, tok); 1332155192Srwatson } 1333155192Srwatson break; 1334155192Srwatson 1335155192Srwatson case AUE_SYMLINK: 1336155192Srwatson if (ARG_IS_VALID(kar, ARG_TEXT)) { 1337155192Srwatson tok = au_to_text(ar->ar_arg_text); 1338155192Srwatson kau_write(rec, tok); 1339155192Srwatson } 1340155192Srwatson UPATH1_VNODE1_TOKENS; 1341155192Srwatson break; 1342155192Srwatson 1343155192Srwatson case AUE_SYSCTL: 1344155192Srwatson if (ARG_IS_VALID(kar, ARG_CTLNAME | ARG_LEN)) { 1345155192Srwatson for (ctr = 0; ctr < ar->ar_arg_len; ctr++) { 1346156889Srwatson tok = au_to_arg32(1, "name", 1347156889Srwatson ar->ar_arg_ctlname[ctr]); 1348156889Srwatson kau_write(rec, tok); 1349155192Srwatson } 1350155192Srwatson } 1351155192Srwatson if (ARG_IS_VALID(kar, ARG_VALUE)) { 1352155192Srwatson tok = au_to_arg32(5, "newval", ar->ar_arg_value); 1353155192Srwatson kau_write(rec, tok); 1354155192Srwatson } 1355155192Srwatson if (ARG_IS_VALID(kar, ARG_TEXT)) { 1356155192Srwatson tok = au_to_text(ar->ar_arg_text); 1357155192Srwatson kau_write(rec, tok); 1358155192Srwatson } 1359155192Srwatson break; 1360155192Srwatson 1361155192Srwatson case AUE_UMASK: 1362155192Srwatson if (ARG_IS_VALID(kar, ARG_MASK)) { 1363155192Srwatson tok = au_to_arg32(1, "new mask", ar->ar_arg_mask); 1364155192Srwatson kau_write(rec, tok); 1365155192Srwatson } 1366155192Srwatson tok = au_to_arg32(0, "prev mask", ar->ar_retval); 1367155192Srwatson kau_write(rec, tok); 1368155192Srwatson break; 1369155192Srwatson 1370155192Srwatson case AUE_WAIT4: 1371155192Srwatson if (ARG_IS_VALID(kar, ARG_PID)) { 1372155192Srwatson tok = au_to_arg32(0, "pid", ar->ar_arg_pid); 1373155192Srwatson kau_write(rec, tok); 1374155192Srwatson } 1375155192Srwatson break; 1376155192Srwatson 1377162990Srwatson case AUE_NULL: 1378156889Srwatson default: 1379155192Srwatson printf("BSM conversion requested for unknown event %d\n", 1380156889Srwatson ar->ar_event); 1381155192Srwatson /* Write the subject token so it is properly freed here. */ 1382155192Srwatson kau_write(rec, subj_tok); 1383155192Srwatson kau_free(rec); 1384155192Srwatson return (BSM_NOAUDIT); 1385155192Srwatson } 1386155192Srwatson 1387156889Srwatson kau_write(rec, subj_tok); 1388155192Srwatson tok = au_to_return32((char)ar->ar_errno, ar->ar_retval); 1389155192Srwatson kau_write(rec, tok); /* Every record gets a return token */ 1390155192Srwatson 1391155192Srwatson kau_close(rec, &ar->ar_endtime, ar->ar_event); 1392155192Srwatson 1393155192Srwatson *pau = rec; 1394155192Srwatson return (BSM_SUCCESS); 1395155192Srwatson} 1396155192Srwatson 1397155192Srwatson/* 1398156889Srwatson * Verify that a record is a valid BSM record. This verification is simple 1399156889Srwatson * now, but may be expanded on sometime in the future. Return 1 if the 1400156889Srwatson * record is good, 0 otherwise. 1401155192Srwatson */ 1402155192Srwatsonint 1403155192Srwatsonbsm_rec_verify(void *rec) 1404155192Srwatson{ 1405155192Srwatson char c = *(char *)rec; 1406156889Srwatson 1407156889Srwatson /* 1408155192Srwatson * Check the token ID of the first token; it has to be a header 1409155192Srwatson * token. 1410156889Srwatson * 1411156889Srwatson * XXXAUDIT There needs to be a token structure to map a token. 1412155192Srwatson * XXXAUDIT 'Shouldn't be simply looking at the first char. 1413155192Srwatson */ 1414156889Srwatson if ((c != AUT_HEADER32) && (c != AUT_HEADER32_EX) && 1415156889Srwatson (c != AUT_HEADER64) && (c != AUT_HEADER64_EX)) 1416155192Srwatson return (0); 1417155192Srwatson return (1); 1418155192Srwatson} 1419