audit_bsm.c revision 186649
1155192Srwatson/* 2180701Srwatson * Copyright (c) 1999-2005 Apple Inc. 3155192Srwatson * All rights reserved. 4155192Srwatson * 5155192Srwatson * Redistribution and use in source and binary forms, with or without 6155192Srwatson * modification, are permitted provided that the following conditions 7155192Srwatson * are met: 8155192Srwatson * 1. Redistributions of source code must retain the above copyright 9155192Srwatson * notice, this list of conditions and the following disclaimer. 10155192Srwatson * 2. Redistributions in binary form must reproduce the above copyright 11155192Srwatson * notice, this list of conditions and the following disclaimer in the 12155192Srwatson * documentation and/or other materials provided with the distribution. 13180701Srwatson * 3. Neither the name of Apple Inc. ("Apple") nor the names of 14155192Srwatson * its contributors may be used to endorse or promote products derived 15155192Srwatson * from this software without specific prior written permission. 16155192Srwatson * 17155192Srwatson * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND 18155192Srwatson * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 19155192Srwatson * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 20155192Srwatson * ARE DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR 21155192Srwatson * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 22155192Srwatson * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 23155192Srwatson * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 24155192Srwatson * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 25155192Srwatson * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING 26155192Srwatson * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 27155192Srwatson * POSSIBILITY OF SUCH DAMAGE. 28155192Srwatson */ 29155192Srwatson 30178186Srwatson#include <sys/cdefs.h> 31178186Srwatson__FBSDID("$FreeBSD: head/sys/security/audit/audit_bsm.c 186649 2008-12-31 11:56:35Z rwatson $"); 32178186Srwatson 33155192Srwatson#include <sys/param.h> 34155192Srwatson#include <sys/vnode.h> 35155192Srwatson#include <sys/ipc.h> 36155192Srwatson#include <sys/lock.h> 37155192Srwatson#include <sys/malloc.h> 38155192Srwatson#include <sys/mutex.h> 39155192Srwatson#include <sys/socket.h> 40160136Swsalamon#include <sys/extattr.h> 41155192Srwatson#include <sys/fcntl.h> 42155192Srwatson#include <sys/user.h> 43155192Srwatson#include <sys/systm.h> 44155192Srwatson 45155192Srwatson#include <bsm/audit.h> 46155192Srwatson#include <bsm/audit_internal.h> 47155192Srwatson#include <bsm/audit_record.h> 48155192Srwatson#include <bsm/audit_kevents.h> 49155192Srwatson 50155192Srwatson#include <security/audit/audit.h> 51155192Srwatson#include <security/audit/audit_private.h> 52155192Srwatson 53155192Srwatson#include <netinet/in_systm.h> 54155192Srwatson#include <netinet/in.h> 55155192Srwatson#include <netinet/ip.h> 56155192Srwatson 57155192SrwatsonMALLOC_DEFINE(M_AUDITBSM, "audit_bsm", "Audit BSM data"); 58155192Srwatson 59155192Srwatsonstatic void audit_sys_auditon(struct audit_record *ar, 60155192Srwatson struct au_record *rec); 61155192Srwatson 62155192Srwatson/* 63155192Srwatson * Initialize the BSM auditing subsystem. 64155192Srwatson */ 65155192Srwatsonvoid 66155192Srwatsonkau_init(void) 67155192Srwatson{ 68155192Srwatson 69155192Srwatson au_evclassmap_init(); 70155192Srwatson} 71155192Srwatson 72155192Srwatson/* 73156889Srwatson * This call reserves memory for the audit record. Memory must be guaranteed 74156889Srwatson * before any auditable event can be generated. The au_record structure 75156889Srwatson * maintains a reference to the memory allocated above and also the list of 76180706Srwatson * tokens associated with this record. 77156889Srwatson */ 78156889Srwatsonstatic struct au_record * 79155192Srwatsonkau_open(void) 80156889Srwatson{ 81155192Srwatson struct au_record *rec; 82156889Srwatson 83155192Srwatson rec = malloc(sizeof(*rec), M_AUDITBSM, M_WAITOK); 84162466Srwatson rec->data = NULL; 85155192Srwatson TAILQ_INIT(&rec->token_q); 86155192Srwatson rec->len = 0; 87155192Srwatson rec->used = 1; 88155192Srwatson 89155192Srwatson return (rec); 90155192Srwatson} 91155192Srwatson 92155192Srwatson/* 93155192Srwatson * Store the token with the record descriptor. 94156889Srwatson */ 95155192Srwatsonstatic void 96155192Srwatsonkau_write(struct au_record *rec, struct au_token *tok) 97155192Srwatson{ 98155192Srwatson 99155192Srwatson KASSERT(tok != NULL, ("kau_write: tok == NULL")); 100155192Srwatson 101155192Srwatson TAILQ_INSERT_TAIL(&rec->token_q, tok, tokens); 102155192Srwatson rec->len += tok->len; 103155192Srwatson} 104155192Srwatson 105155192Srwatson/* 106155192Srwatson * Close out the audit record by adding the header token, identifying any 107155192Srwatson * missing tokens. Write out the tokens to the record memory. 108155192Srwatson */ 109155192Srwatsonstatic void 110155192Srwatsonkau_close(struct au_record *rec, struct timespec *ctime, short event) 111155192Srwatson{ 112155192Srwatson u_char *dptr; 113155192Srwatson size_t tot_rec_size; 114155192Srwatson token_t *cur, *hdr, *trail; 115155192Srwatson struct timeval tm; 116184856Scsjp size_t hdrsize; 117184856Scsjp struct auditinfo_addr ak; 118184856Scsjp struct in6_addr *ap; 119156889Srwatson 120184856Scsjp audit_get_kinfo(&ak); 121184856Scsjp hdrsize = 0; 122184856Scsjp switch (ak.ai_termid.at_type) { 123184856Scsjp case AU_IPv4: 124184856Scsjp hdrsize = (ak.ai_termid.at_addr[0] == INADDR_ANY) ? 125184856Scsjp AUDIT_HEADER_SIZE : AUDIT_HEADER_EX_SIZE(&ak); 126184856Scsjp break; 127184856Scsjp case AU_IPv6: 128184856Scsjp ap = (struct in6_addr *)&ak.ai_termid.at_addr[0]; 129184856Scsjp hdrsize = (IN6_IS_ADDR_UNSPECIFIED(ap)) ? AUDIT_HEADER_SIZE : 130184856Scsjp AUDIT_HEADER_EX_SIZE(&ak); 131184856Scsjp break; 132184856Scsjp default: 133184856Scsjp panic("kau_close: invalid address family"); 134184856Scsjp } 135184856Scsjp tot_rec_size = rec->len + hdrsize + AUDIT_TRAILER_SIZE; 136162466Srwatson rec->data = malloc(tot_rec_size, M_AUDITBSM, M_WAITOK | M_ZERO); 137170196Srwatson 138162466Srwatson tm.tv_usec = ctime->tv_nsec / 1000; 139162466Srwatson tm.tv_sec = ctime->tv_sec; 140184856Scsjp if (hdrsize != AUDIT_HEADER_SIZE) 141184856Scsjp hdr = au_to_header32_ex_tm(tot_rec_size, event, 0, tm, &ak); 142184856Scsjp else 143184856Scsjp hdr = au_to_header32_tm(tot_rec_size, event, 0, tm); 144162466Srwatson TAILQ_INSERT_HEAD(&rec->token_q, hdr, tokens); 145155192Srwatson 146162466Srwatson trail = au_to_trailer(tot_rec_size); 147162466Srwatson TAILQ_INSERT_TAIL(&rec->token_q, trail, tokens); 148155192Srwatson 149162466Srwatson rec->len = tot_rec_size; 150162466Srwatson dptr = rec->data; 151162466Srwatson TAILQ_FOREACH(cur, &rec->token_q, tokens) { 152162466Srwatson memcpy(dptr, cur->t_data, cur->len); 153162466Srwatson dptr += cur->len; 154155192Srwatson } 155155192Srwatson} 156155192Srwatson 157155192Srwatson/* 158156889Srwatson * Free a BSM audit record by releasing all the tokens and clearing the audit 159156889Srwatson * record information. 160155192Srwatson */ 161155192Srwatsonvoid 162155192Srwatsonkau_free(struct au_record *rec) 163155192Srwatson{ 164155192Srwatson struct au_token *tok; 165155192Srwatson 166156889Srwatson /* Free the token list. */ 167155192Srwatson while ((tok = TAILQ_FIRST(&rec->token_q))) { 168155192Srwatson TAILQ_REMOVE(&rec->token_q, tok, tokens); 169155192Srwatson free(tok->t_data, M_AUDITBSM); 170155192Srwatson free(tok, M_AUDITBSM); 171156889Srwatson } 172155192Srwatson 173155192Srwatson rec->used = 0; 174156889Srwatson rec->len = 0; 175155192Srwatson free(rec->data, M_AUDITBSM); 176155192Srwatson free(rec, M_AUDITBSM); 177155192Srwatson} 178155192Srwatson 179155192Srwatson/* 180170196Srwatson * XXX: May want turn some (or all) of these macros into functions in order 181180704Srwatson * to reduce the generated code size. 182155192Srwatson * 183155192Srwatson * XXXAUDIT: These macros assume that 'kar', 'ar', 'rec', and 'tok' in the 184155192Srwatson * caller are OK with this. 185155192Srwatson */ 186180708Srwatson#define UPATH1_TOKENS do { \ 187155192Srwatson if (ARG_IS_VALID(kar, ARG_UPATH1)) { \ 188155192Srwatson tok = au_to_path(ar->ar_arg_upath1); \ 189155192Srwatson kau_write(rec, tok); \ 190155192Srwatson } \ 191155192Srwatson} while (0) 192155192Srwatson 193180708Srwatson#define UPATH2_TOKENS do { \ 194155192Srwatson if (ARG_IS_VALID(kar, ARG_UPATH2)) { \ 195155192Srwatson tok = au_to_path(ar->ar_arg_upath2); \ 196155192Srwatson kau_write(rec, tok); \ 197155192Srwatson } \ 198155192Srwatson} while (0) 199155192Srwatson 200180708Srwatson#define VNODE1_TOKENS do { \ 201180709Srwatson if (ARG_IS_VALID(kar, ARG_VNODE1)) { \ 202155192Srwatson tok = au_to_attr32(&ar->ar_arg_vnode1); \ 203155192Srwatson kau_write(rec, tok); \ 204155192Srwatson } \ 205155192Srwatson} while (0) 206155192Srwatson 207180708Srwatson#define UPATH1_VNODE1_TOKENS do { \ 208180709Srwatson if (ARG_IS_VALID(kar, ARG_UPATH1)) { \ 209155192Srwatson UPATH1_TOKENS; \ 210155192Srwatson } \ 211180709Srwatson if (ARG_IS_VALID(kar, ARG_VNODE1)) { \ 212155192Srwatson tok = au_to_attr32(&ar->ar_arg_vnode1); \ 213155192Srwatson kau_write(rec, tok); \ 214155192Srwatson } \ 215155192Srwatson} while (0) 216155192Srwatson 217180708Srwatson#define VNODE2_TOKENS do { \ 218180709Srwatson if (ARG_IS_VALID(kar, ARG_VNODE2)) { \ 219155192Srwatson tok = au_to_attr32(&ar->ar_arg_vnode2); \ 220155192Srwatson kau_write(rec, tok); \ 221155192Srwatson } \ 222155192Srwatson} while (0) 223155192Srwatson 224180711Srwatson#define FD_VNODE1_TOKENS do { \ 225155192Srwatson if (ARG_IS_VALID(kar, ARG_VNODE1)) { \ 226155192Srwatson if (ARG_IS_VALID(kar, ARG_FD)) { \ 227155192Srwatson tok = au_to_arg32(1, "fd", ar->ar_arg_fd); \ 228155192Srwatson kau_write(rec, tok); \ 229155192Srwatson } \ 230155192Srwatson tok = au_to_attr32(&ar->ar_arg_vnode1); \ 231155192Srwatson kau_write(rec, tok); \ 232155192Srwatson } else { \ 233155192Srwatson if (ARG_IS_VALID(kar, ARG_FD)) { \ 234156889Srwatson tok = au_to_arg32(1, "non-file: fd", \ 235156889Srwatson ar->ar_arg_fd); \ 236155192Srwatson kau_write(rec, tok); \ 237155192Srwatson } \ 238155192Srwatson } \ 239155192Srwatson} while (0) 240155192Srwatson 241180708Srwatson#define PROCESS_PID_TOKENS(argn) do { \ 242159277Srwatson if ((ar->ar_arg_pid > 0) /* Reference a single process */ \ 243159277Srwatson && (ARG_IS_VALID(kar, ARG_PROCESS))) { \ 244172915Scsjp tok = au_to_process32_ex(ar->ar_arg_auid, \ 245159277Srwatson ar->ar_arg_euid, ar->ar_arg_egid, \ 246159277Srwatson ar->ar_arg_ruid, ar->ar_arg_rgid, \ 247159277Srwatson ar->ar_arg_pid, ar->ar_arg_asid, \ 248172915Scsjp &ar->ar_arg_termid_addr); \ 249159277Srwatson kau_write(rec, tok); \ 250159277Srwatson } else if (ARG_IS_VALID(kar, ARG_PID)) { \ 251159277Srwatson tok = au_to_arg32(argn, "process", ar->ar_arg_pid); \ 252159277Srwatson kau_write(rec, tok); \ 253155192Srwatson } \ 254180712Srwatson} while (0) 255155192Srwatson 256180711Srwatson#define EXTATTR_TOKENS do { \ 257160136Swsalamon if (ARG_IS_VALID(kar, ARG_VALUE)) { \ 258160136Swsalamon switch (ar->ar_arg_value) { \ 259160136Swsalamon case EXTATTR_NAMESPACE_USER: \ 260160136Swsalamon tok = au_to_text(EXTATTR_NAMESPACE_USER_STRING);\ 261160136Swsalamon break; \ 262160136Swsalamon case EXTATTR_NAMESPACE_SYSTEM: \ 263160136Swsalamon tok = au_to_text(EXTATTR_NAMESPACE_SYSTEM_STRING);\ 264160136Swsalamon break; \ 265160136Swsalamon default: \ 266160136Swsalamon tok = au_to_arg32(3, "attrnamespace", \ 267160136Swsalamon ar->ar_arg_value); \ 268160136Swsalamon break; \ 269160136Swsalamon } \ 270160136Swsalamon kau_write(rec, tok); \ 271160136Swsalamon } \ 272160136Swsalamon /* attrname is in the text field */ \ 273160136Swsalamon if (ARG_IS_VALID(kar, ARG_TEXT)) { \ 274160136Swsalamon tok = au_to_text(ar->ar_arg_text); \ 275160136Swsalamon kau_write(rec, tok); \ 276160136Swsalamon } \ 277160136Swsalamon} while (0) 278160136Swsalamon 279155192Srwatson/* 280155192Srwatson * Implement auditing for the auditon() system call. The audit tokens that 281155192Srwatson * are generated depend on the command that was sent into the auditon() 282155192Srwatson * system call. 283155192Srwatson */ 284155192Srwatsonstatic void 285155192Srwatsonaudit_sys_auditon(struct audit_record *ar, struct au_record *rec) 286155192Srwatson{ 287155192Srwatson struct au_token *tok; 288155192Srwatson 289155192Srwatson switch (ar->ar_arg_cmd) { 290156889Srwatson case A_SETPOLICY: 291155192Srwatson if (sizeof(ar->ar_arg_auditon.au_flags) > 4) 292156889Srwatson tok = au_to_arg64(1, "policy", 293156889Srwatson ar->ar_arg_auditon.au_flags); 294155192Srwatson else 295156889Srwatson tok = au_to_arg32(1, "policy", 296156889Srwatson ar->ar_arg_auditon.au_flags); 297155192Srwatson kau_write(rec, tok); 298155192Srwatson break; 299155192Srwatson 300156889Srwatson case A_SETKMASK: 301156889Srwatson tok = au_to_arg32(2, "setkmask:as_success", 302156889Srwatson ar->ar_arg_auditon.au_mask.am_success); 303155192Srwatson kau_write(rec, tok); 304156889Srwatson tok = au_to_arg32(2, "setkmask:as_failure", 305156889Srwatson ar->ar_arg_auditon.au_mask.am_failure); 306155192Srwatson kau_write(rec, tok); 307155192Srwatson break; 308155192Srwatson 309156889Srwatson case A_SETQCTRL: 310156889Srwatson tok = au_to_arg32(3, "setqctrl:aq_hiwater", 311156889Srwatson ar->ar_arg_auditon.au_qctrl.aq_hiwater); 312155192Srwatson kau_write(rec, tok); 313156889Srwatson tok = au_to_arg32(3, "setqctrl:aq_lowater", 314156889Srwatson ar->ar_arg_auditon.au_qctrl.aq_lowater); 315155192Srwatson kau_write(rec, tok); 316156889Srwatson tok = au_to_arg32(3, "setqctrl:aq_bufsz", 317156889Srwatson ar->ar_arg_auditon.au_qctrl.aq_bufsz); 318155192Srwatson kau_write(rec, tok); 319156889Srwatson tok = au_to_arg32(3, "setqctrl:aq_delay", 320156889Srwatson ar->ar_arg_auditon.au_qctrl.aq_delay); 321155192Srwatson kau_write(rec, tok); 322156889Srwatson tok = au_to_arg32(3, "setqctrl:aq_minfree", 323156889Srwatson ar->ar_arg_auditon.au_qctrl.aq_minfree); 324155192Srwatson kau_write(rec, tok); 325155192Srwatson break; 326155192Srwatson 327156889Srwatson case A_SETUMASK: 328156889Srwatson tok = au_to_arg32(3, "setumask:as_success", 329156889Srwatson ar->ar_arg_auditon.au_auinfo.ai_mask.am_success); 330155192Srwatson kau_write(rec, tok); 331156889Srwatson tok = au_to_arg32(3, "setumask:as_failure", 332156889Srwatson ar->ar_arg_auditon.au_auinfo.ai_mask.am_failure); 333155192Srwatson kau_write(rec, tok); 334155192Srwatson break; 335155192Srwatson 336156889Srwatson case A_SETSMASK: 337156889Srwatson tok = au_to_arg32(3, "setsmask:as_success", 338156889Srwatson ar->ar_arg_auditon.au_auinfo.ai_mask.am_success); 339155192Srwatson kau_write(rec, tok); 340156889Srwatson tok = au_to_arg32(3, "setsmask:as_failure", 341156889Srwatson ar->ar_arg_auditon.au_auinfo.ai_mask.am_failure); 342155192Srwatson kau_write(rec, tok); 343155192Srwatson break; 344155192Srwatson 345156889Srwatson case A_SETCOND: 346155192Srwatson if (sizeof(ar->ar_arg_auditon.au_cond) > 4) 347156889Srwatson tok = au_to_arg64(3, "setcond", 348156889Srwatson ar->ar_arg_auditon.au_cond); 349155192Srwatson else 350156889Srwatson tok = au_to_arg32(3, "setcond", 351156889Srwatson ar->ar_arg_auditon.au_cond); 352155192Srwatson kau_write(rec, tok); 353155192Srwatson break; 354155192Srwatson 355156889Srwatson case A_SETCLASS: 356155192Srwatson tok = au_to_arg32(2, "setclass:ec_event", 357156889Srwatson ar->ar_arg_auditon.au_evclass.ec_number); 358155192Srwatson kau_write(rec, tok); 359155192Srwatson tok = au_to_arg32(3, "setclass:ec_class", 360156889Srwatson ar->ar_arg_auditon.au_evclass.ec_class); 361155192Srwatson kau_write(rec, tok); 362155192Srwatson break; 363155192Srwatson 364156889Srwatson case A_SETPMASK: 365156889Srwatson tok = au_to_arg32(2, "setpmask:as_success", 366156889Srwatson ar->ar_arg_auditon.au_aupinfo.ap_mask.am_success); 367155192Srwatson kau_write(rec, tok); 368156889Srwatson tok = au_to_arg32(2, "setpmask:as_failure", 369156889Srwatson ar->ar_arg_auditon.au_aupinfo.ap_mask.am_failure); 370155192Srwatson kau_write(rec, tok); 371155192Srwatson break; 372155192Srwatson 373156889Srwatson case A_SETFSIZE: 374156889Srwatson tok = au_to_arg32(2, "setfsize:filesize", 375156889Srwatson ar->ar_arg_auditon.au_fstat.af_filesz); 376155192Srwatson kau_write(rec, tok); 377155192Srwatson break; 378155192Srwatson 379155192Srwatson default: 380155192Srwatson break; 381155192Srwatson } 382155192Srwatson} 383155192Srwatson 384155192Srwatson/* 385156889Srwatson * Convert an internal kernel audit record to a BSM record and return a 386156889Srwatson * success/failure indicator. The BSM record is passed as an out parameter to 387156889Srwatson * this function. 388156889Srwatson * 389155192Srwatson * Return conditions: 390155192Srwatson * BSM_SUCCESS: The BSM record is valid 391155192Srwatson * BSM_FAILURE: Failure; the BSM record is NULL. 392156889Srwatson * BSM_NOAUDIT: The event is not auditable for BSM; the BSM record is NULL. 393155192Srwatson */ 394155192Srwatsonint 395155192Srwatsonkaudit_to_bsm(struct kaudit_record *kar, struct au_record **pau) 396155192Srwatson{ 397155192Srwatson struct au_token *tok, *subj_tok; 398155192Srwatson struct au_record *rec; 399155192Srwatson au_tid_t tid; 400155192Srwatson struct audit_record *ar; 401155192Srwatson int ctr; 402155192Srwatson 403155192Srwatson KASSERT(kar != NULL, ("kaudit_to_bsm: kar == NULL")); 404155192Srwatson 405155192Srwatson *pau = NULL; 406155192Srwatson ar = &kar->k_ar; 407155192Srwatson rec = kau_open(); 408155192Srwatson 409180715Srwatson /* 410180715Srwatson * Create the subject token. 411180715Srwatson */ 412168688Scsjp switch (ar->ar_subj_term_addr.at_type) { 413168688Scsjp case AU_IPv4: 414168688Scsjp tid.port = ar->ar_subj_term_addr.at_port; 415168688Scsjp tid.machine = ar->ar_subj_term_addr.at_addr[0]; 416168688Scsjp subj_tok = au_to_subject32(ar->ar_subj_auid, /* audit ID */ 417168688Scsjp ar->ar_subj_cred.cr_uid, /* eff uid */ 418168688Scsjp ar->ar_subj_egid, /* eff group id */ 419180709Srwatson ar->ar_subj_ruid, /* real uid */ 420180709Srwatson ar->ar_subj_rgid, /* real group id */ 421168688Scsjp ar->ar_subj_pid, /* process id */ 422168688Scsjp ar->ar_subj_asid, /* session ID */ 423168688Scsjp &tid); 424168688Scsjp break; 425168688Scsjp case AU_IPv6: 426168688Scsjp subj_tok = au_to_subject32_ex(ar->ar_subj_auid, 427168688Scsjp ar->ar_subj_cred.cr_uid, 428168688Scsjp ar->ar_subj_egid, 429168688Scsjp ar->ar_subj_ruid, 430168688Scsjp ar->ar_subj_rgid, 431168688Scsjp ar->ar_subj_pid, 432168688Scsjp ar->ar_subj_asid, 433168688Scsjp &ar->ar_subj_term_addr); 434168688Scsjp break; 435168688Scsjp default: 436168688Scsjp bzero(&tid, sizeof(tid)); 437168688Scsjp subj_tok = au_to_subject32(ar->ar_subj_auid, 438168688Scsjp ar->ar_subj_cred.cr_uid, 439168688Scsjp ar->ar_subj_egid, 440168688Scsjp ar->ar_subj_ruid, 441168688Scsjp ar->ar_subj_rgid, 442168688Scsjp ar->ar_subj_pid, 443168688Scsjp ar->ar_subj_asid, 444168688Scsjp &tid); 445168688Scsjp } 446155192Srwatson 447156889Srwatson /* 448156889Srwatson * The logic inside each case fills in the tokens required for the 449156889Srwatson * event, except for the header, trailer, and return tokens. The 450155192Srwatson * header and trailer tokens are added by the kau_close() function. 451155192Srwatson * The return token is added outside of the switch statement. 452156889Srwatson */ 453155192Srwatson switch(ar->ar_event) { 454155192Srwatson case AUE_ACCEPT: 455155192Srwatson case AUE_BIND: 456175455Scsjp case AUE_LISTEN: 457155192Srwatson case AUE_CONNECT: 458162990Srwatson case AUE_RECV: 459155192Srwatson case AUE_RECVFROM: 460156889Srwatson case AUE_RECVMSG: 461162990Srwatson case AUE_SEND: 462162990Srwatson case AUE_SENDFILE: 463155192Srwatson case AUE_SENDMSG: 464155192Srwatson case AUE_SENDTO: 465156889Srwatson /* 466156889Srwatson * Socket-related events. 467156889Srwatson */ 468155192Srwatson if (ARG_IS_VALID(kar, ARG_FD)) { 469155192Srwatson tok = au_to_arg32(1, "fd", ar->ar_arg_fd); 470155192Srwatson kau_write(rec, tok); 471155192Srwatson } 472155192Srwatson if (ARG_IS_VALID(kar, ARG_SADDRINET)) { 473156889Srwatson tok = au_to_sock_inet((struct sockaddr_in *) 474156889Srwatson &ar->ar_arg_sockaddr); 475155192Srwatson kau_write(rec, tok); 476155192Srwatson } 477155192Srwatson if (ARG_IS_VALID(kar, ARG_SADDRUNIX)) { 478156889Srwatson tok = au_to_sock_unix((struct sockaddr_un *) 479156889Srwatson &ar->ar_arg_sockaddr); 480155192Srwatson kau_write(rec, tok); 481155192Srwatson UPATH1_TOKENS; 482155192Srwatson } 483155192Srwatson /* XXX Need to handle ARG_SADDRINET6 */ 484155192Srwatson break; 485155192Srwatson 486155192Srwatson case AUE_SOCKET: 487155192Srwatson case AUE_SOCKETPAIR: 488155192Srwatson if (ARG_IS_VALID(kar, ARG_SOCKINFO)) { 489155192Srwatson tok = au_to_arg32(1,"domain", 490155192Srwatson ar->ar_arg_sockinfo.so_domain); 491155192Srwatson kau_write(rec, tok); 492155192Srwatson tok = au_to_arg32(2,"type", 493155192Srwatson ar->ar_arg_sockinfo.so_type); 494155192Srwatson kau_write(rec, tok); 495155192Srwatson tok = au_to_arg32(3,"protocol", 496155192Srwatson ar->ar_arg_sockinfo.so_protocol); 497155192Srwatson kau_write(rec, tok); 498155192Srwatson } 499155192Srwatson break; 500155192Srwatson 501155192Srwatson case AUE_SETSOCKOPT: 502155192Srwatson case AUE_SHUTDOWN: 503155192Srwatson if (ARG_IS_VALID(kar, ARG_FD)) { 504155192Srwatson tok = au_to_arg32(1, "fd", ar->ar_arg_fd); 505155192Srwatson kau_write(rec, tok); 506155192Srwatson } 507155192Srwatson break; 508155192Srwatson 509155192Srwatson case AUE_ACCT: 510155192Srwatson if (ARG_IS_VALID(kar, ARG_UPATH1)) { 511155192Srwatson UPATH1_VNODE1_TOKENS; 512155192Srwatson } else { 513155192Srwatson tok = au_to_arg32(1, "accounting off", 0); 514155192Srwatson kau_write(rec, tok); 515155192Srwatson } 516155192Srwatson break; 517155192Srwatson 518155192Srwatson case AUE_SETAUID: 519155192Srwatson if (ARG_IS_VALID(kar, ARG_AUID)) { 520155192Srwatson tok = au_to_arg32(2, "setauid", ar->ar_arg_auid); 521155192Srwatson kau_write(rec, tok); 522155192Srwatson } 523155192Srwatson break; 524155192Srwatson 525155192Srwatson case AUE_SETAUDIT: 526171066Scsjp if (ARG_IS_VALID(kar, ARG_AUID) && 527171066Scsjp ARG_IS_VALID(kar, ARG_ASID) && 528171066Scsjp ARG_IS_VALID(kar, ARG_AMASK) && 529171066Scsjp ARG_IS_VALID(kar, ARG_TERMID)) { 530156889Srwatson tok = au_to_arg32(1, "setaudit:auid", 531156889Srwatson ar->ar_arg_auid); 532155192Srwatson kau_write(rec, tok); 533156889Srwatson tok = au_to_arg32(1, "setaudit:port", 534156889Srwatson ar->ar_arg_termid.port); 535155192Srwatson kau_write(rec, tok); 536156889Srwatson tok = au_to_arg32(1, "setaudit:machine", 537156889Srwatson ar->ar_arg_termid.machine); 538155192Srwatson kau_write(rec, tok); 539156889Srwatson tok = au_to_arg32(1, "setaudit:as_success", 540156889Srwatson ar->ar_arg_amask.am_success); 541155192Srwatson kau_write(rec, tok); 542156889Srwatson tok = au_to_arg32(1, "setaudit:as_failure", 543156889Srwatson ar->ar_arg_amask.am_failure); 544155192Srwatson kau_write(rec, tok); 545156889Srwatson tok = au_to_arg32(1, "setaudit:asid", 546156889Srwatson ar->ar_arg_asid); 547155192Srwatson kau_write(rec, tok); 548155192Srwatson } 549155192Srwatson break; 550155192Srwatson 551155192Srwatson case AUE_SETAUDIT_ADDR: 552171066Scsjp if (ARG_IS_VALID(kar, ARG_AUID) && 553171066Scsjp ARG_IS_VALID(kar, ARG_ASID) && 554171066Scsjp ARG_IS_VALID(kar, ARG_AMASK) && 555171066Scsjp ARG_IS_VALID(kar, ARG_TERMID_ADDR)) { 556171066Scsjp tok = au_to_arg32(1, "setaudit_addr:auid", 557171066Scsjp ar->ar_arg_auid); 558171066Scsjp kau_write(rec, tok); 559171066Scsjp tok = au_to_arg32(1, "setaudit_addr:as_success", 560171066Scsjp ar->ar_arg_amask.am_success); 561171066Scsjp kau_write(rec, tok); 562171066Scsjp tok = au_to_arg32(1, "setaudit_addr:as_failure", 563171066Scsjp ar->ar_arg_amask.am_failure); 564171066Scsjp kau_write(rec, tok); 565171066Scsjp tok = au_to_arg32(1, "setaudit_addr:asid", 566171066Scsjp ar->ar_arg_asid); 567171066Scsjp kau_write(rec, tok); 568171066Scsjp tok = au_to_arg32(1, "setaudit_addr:type", 569171066Scsjp ar->ar_arg_termid_addr.at_type); 570171066Scsjp kau_write(rec, tok); 571171066Scsjp tok = au_to_arg32(1, "setaudit_addr:port", 572171066Scsjp ar->ar_arg_termid_addr.at_port); 573171066Scsjp kau_write(rec, tok); 574171066Scsjp if (ar->ar_arg_termid_addr.at_type == AU_IPv6) 575171066Scsjp tok = au_to_in_addr_ex((struct in6_addr *) 576171066Scsjp &ar->ar_arg_termid_addr.at_addr[0]); 577171066Scsjp if (ar->ar_arg_termid_addr.at_type == AU_IPv4) 578171066Scsjp tok = au_to_in_addr((struct in_addr *) 579171066Scsjp &ar->ar_arg_termid_addr.at_addr[0]); 580171066Scsjp kau_write(rec, tok); 581171066Scsjp } 582171066Scsjp break; 583155192Srwatson 584155192Srwatson case AUE_AUDITON: 585156889Srwatson /* 586156889Srwatson * For AUDITON commands without own event, audit the cmd. 587156889Srwatson */ 588155192Srwatson if (ARG_IS_VALID(kar, ARG_CMD)) { 589155192Srwatson tok = au_to_arg32(1, "cmd", ar->ar_arg_cmd); 590155192Srwatson kau_write(rec, tok); 591155192Srwatson } 592185293Srwatson /* FALLTHROUGH */ 593155192Srwatson 594155192Srwatson case AUE_AUDITON_GETCAR: 595155192Srwatson case AUE_AUDITON_GETCLASS: 596155192Srwatson case AUE_AUDITON_GETCOND: 597155192Srwatson case AUE_AUDITON_GETCWD: 598155192Srwatson case AUE_AUDITON_GETKMASK: 599155192Srwatson case AUE_AUDITON_GETSTAT: 600155192Srwatson case AUE_AUDITON_GPOLICY: 601155192Srwatson case AUE_AUDITON_GQCTRL: 602155192Srwatson case AUE_AUDITON_SETCLASS: 603155192Srwatson case AUE_AUDITON_SETCOND: 604155192Srwatson case AUE_AUDITON_SETKMASK: 605155192Srwatson case AUE_AUDITON_SETSMASK: 606155192Srwatson case AUE_AUDITON_SETSTAT: 607155192Srwatson case AUE_AUDITON_SETUMASK: 608155192Srwatson case AUE_AUDITON_SPOLICY: 609155192Srwatson case AUE_AUDITON_SQCTRL: 610156889Srwatson if (ARG_IS_VALID(kar, ARG_AUDITON)) 611155192Srwatson audit_sys_auditon(ar, rec); 612155192Srwatson break; 613156889Srwatson 614155192Srwatson case AUE_AUDITCTL: 615155192Srwatson UPATH1_VNODE1_TOKENS; 616155192Srwatson break; 617155192Srwatson 618155192Srwatson case AUE_EXIT: 619155192Srwatson if (ARG_IS_VALID(kar, ARG_EXIT)) { 620155192Srwatson tok = au_to_exit(ar->ar_arg_exitretval, 621155192Srwatson ar->ar_arg_exitstatus); 622155192Srwatson kau_write(rec, tok); 623155192Srwatson } 624155192Srwatson break; 625155192Srwatson 626155192Srwatson case AUE_ADJTIME: 627162990Srwatson case AUE_CLOCK_SETTIME: 628155192Srwatson case AUE_AUDIT: 629162990Srwatson case AUE_DUP2: 630155192Srwatson case AUE_GETAUDIT: 631155192Srwatson case AUE_GETAUDIT_ADDR: 632155192Srwatson case AUE_GETAUID: 633162990Srwatson case AUE_GETCWD: 634155192Srwatson case AUE_GETFSSTAT: 635162990Srwatson case AUE_GETRESUID: 636162990Srwatson case AUE_GETRESGID: 637162990Srwatson case AUE_KQUEUE: 638162990Srwatson case AUE_LSEEK: 639162990Srwatson case AUE_MODLOAD: 640162990Srwatson case AUE_MODUNLOAD: 641162990Srwatson case AUE_MSGSYS: 642162990Srwatson case AUE_NFS_SVC: 643162990Srwatson case AUE_NTP_ADJTIME: 644155192Srwatson case AUE_PIPE: 645162990Srwatson case AUE_PROFILE: 646162990Srwatson case AUE_RTPRIO: 647162990Srwatson case AUE_SEMSYS: 648162990Srwatson case AUE_SHMSYS: 649155192Srwatson case AUE_SETPGRP: 650155192Srwatson case AUE_SETRLIMIT: 651155192Srwatson case AUE_SETSID: 652155192Srwatson case AUE_SETTIMEOFDAY: 653162990Srwatson case AUE_SYSARCH: 654162990Srwatson 655156889Srwatson /* 656156889Srwatson * Header, subject, and return tokens added at end. 657156889Srwatson */ 658155192Srwatson break; 659155192Srwatson 660159278Srwatson case AUE_MKFIFO: 661159278Srwatson if (ARG_IS_VALID(kar, ARG_MODE)) { 662159278Srwatson tok = au_to_arg32(2, "mode", ar->ar_arg_mode); 663159278Srwatson kau_write(rec, tok); 664159278Srwatson } 665185293Srwatson /* FALLTHROUGH */ 666185293Srwatson 667155192Srwatson case AUE_ACCESS: 668155192Srwatson case AUE_CHDIR: 669155192Srwatson case AUE_CHROOT: 670155559Srwatson case AUE_EACCESS: 671155192Srwatson case AUE_GETATTRLIST: 672162990Srwatson case AUE_JAIL: 673162419Scsjp case AUE_LUTIMES: 674155192Srwatson case AUE_NFS_GETFH: 675155192Srwatson case AUE_LSTAT: 676155192Srwatson case AUE_PATHCONF: 677155192Srwatson case AUE_READLINK: 678155192Srwatson case AUE_REVOKE: 679155192Srwatson case AUE_RMDIR: 680155192Srwatson case AUE_SEARCHFS: 681155192Srwatson case AUE_SETATTRLIST: 682155192Srwatson case AUE_STAT: 683155192Srwatson case AUE_STATFS: 684162990Srwatson case AUE_SWAPON: 685162990Srwatson case AUE_SWAPOFF: 686155192Srwatson case AUE_TRUNCATE: 687155192Srwatson case AUE_UNDELETE: 688155192Srwatson case AUE_UNLINK: 689155192Srwatson case AUE_UTIMES: 690155192Srwatson UPATH1_VNODE1_TOKENS; 691155192Srwatson break; 692155192Srwatson 693162990Srwatson case AUE_FHSTATFS: 694162990Srwatson case AUE_FHOPEN: 695162990Srwatson case AUE_FHSTAT: 696162990Srwatson /* XXXRW: Need to audit vnode argument. */ 697162990Srwatson break; 698162990Srwatson 699155192Srwatson case AUE_CHFLAGS: 700155192Srwatson case AUE_LCHFLAGS: 701155192Srwatson if (ARG_IS_VALID(kar, ARG_FFLAGS)) { 702155192Srwatson tok = au_to_arg32(2, "flags", ar->ar_arg_fflags); 703155192Srwatson kau_write(rec, tok); 704155192Srwatson } 705155192Srwatson UPATH1_VNODE1_TOKENS; 706155192Srwatson break; 707156889Srwatson 708155192Srwatson case AUE_CHMOD: 709155192Srwatson case AUE_LCHMOD: 710155192Srwatson if (ARG_IS_VALID(kar, ARG_MODE)) { 711156889Srwatson tok = au_to_arg32(2, "new file mode", 712156889Srwatson ar->ar_arg_mode); 713155192Srwatson kau_write(rec, tok); 714155192Srwatson } 715155192Srwatson UPATH1_VNODE1_TOKENS; 716155192Srwatson break; 717156889Srwatson 718155192Srwatson case AUE_CHOWN: 719155192Srwatson case AUE_LCHOWN: 720155192Srwatson if (ARG_IS_VALID(kar, ARG_UID)) { 721155192Srwatson tok = au_to_arg32(2, "new file uid", ar->ar_arg_uid); 722155192Srwatson kau_write(rec, tok); 723155192Srwatson } 724155192Srwatson if (ARG_IS_VALID(kar, ARG_GID)) { 725155192Srwatson tok = au_to_arg32(3, "new file gid", ar->ar_arg_gid); 726155192Srwatson kau_write(rec, tok); 727155192Srwatson } 728155192Srwatson UPATH1_VNODE1_TOKENS; 729155192Srwatson break; 730156889Srwatson 731155192Srwatson case AUE_EXCHANGEDATA: 732155192Srwatson UPATH1_VNODE1_TOKENS; 733155192Srwatson UPATH2_TOKENS; 734155192Srwatson break; 735155192Srwatson 736155192Srwatson case AUE_CLOSE: 737155192Srwatson if (ARG_IS_VALID(kar, ARG_FD)) { 738155192Srwatson tok = au_to_arg32(2, "fd", ar->ar_arg_fd); 739155192Srwatson kau_write(rec, tok); 740155192Srwatson } 741155192Srwatson UPATH1_VNODE1_TOKENS; 742155192Srwatson break; 743155192Srwatson 744172995Scsjp case AUE_CORE: 745172995Scsjp if (ARG_IS_VALID(kar, ARG_SIGNUM)) { 746172995Scsjp tok = au_to_arg32(0, "signal", ar->ar_arg_signum); 747172995Scsjp kau_write(rec, tok); 748172995Scsjp } 749172995Scsjp UPATH1_VNODE1_TOKENS; 750172995Scsjp break; 751172995Scsjp 752160136Swsalamon case AUE_EXTATTRCTL: 753160136Swsalamon UPATH1_VNODE1_TOKENS; 754160136Swsalamon if (ARG_IS_VALID(kar, ARG_CMD)) { 755160136Swsalamon tok = au_to_arg32(2, "cmd", ar->ar_arg_cmd); 756160136Swsalamon kau_write(rec, tok); 757160136Swsalamon } 758160136Swsalamon /* extattrctl(2) filename parameter is in upath2/vnode2 */ 759160136Swsalamon UPATH2_TOKENS; 760160136Swsalamon VNODE2_TOKENS; 761160136Swsalamon EXTATTR_TOKENS; 762160136Swsalamon break; 763160136Swsalamon 764160136Swsalamon case AUE_EXTATTR_GET_FILE: 765160136Swsalamon case AUE_EXTATTR_SET_FILE: 766160136Swsalamon case AUE_EXTATTR_LIST_FILE: 767160136Swsalamon case AUE_EXTATTR_DELETE_FILE: 768160136Swsalamon case AUE_EXTATTR_GET_LINK: 769160136Swsalamon case AUE_EXTATTR_SET_LINK: 770160136Swsalamon case AUE_EXTATTR_LIST_LINK: 771160136Swsalamon case AUE_EXTATTR_DELETE_LINK: 772160136Swsalamon UPATH1_VNODE1_TOKENS; 773160136Swsalamon EXTATTR_TOKENS; 774160136Swsalamon break; 775160136Swsalamon 776160136Swsalamon case AUE_EXTATTR_GET_FD: 777160136Swsalamon case AUE_EXTATTR_SET_FD: 778160136Swsalamon case AUE_EXTATTR_LIST_FD: 779160136Swsalamon case AUE_EXTATTR_DELETE_FD: 780160136Swsalamon if (ARG_IS_VALID(kar, ARG_FD)) { 781160136Swsalamon tok = au_to_arg32(2, "fd", ar->ar_arg_fd); 782160136Swsalamon kau_write(rec, tok); 783160136Swsalamon } 784160136Swsalamon EXTATTR_TOKENS; 785160136Swsalamon break; 786160136Swsalamon 787182158Srwatson case AUE_FEXECVE: 788182158Srwatson if (ARG_IS_VALID(kar, ARG_FD)) { 789182158Srwatson tok = au_to_arg32(1, "fd", ar->ar_arg_fd); 790182158Srwatson kau_write(rec, tok); 791182158Srwatson } 792182158Srwatson /* FALLTHROUGH */ 793182158Srwatson 794161813Swsalamon case AUE_EXECVE: 795161813Swsalamon if (ARG_IS_VALID(kar, ARG_ARGV)) { 796161813Swsalamon tok = au_to_exec_args(ar->ar_arg_argv, 797161813Swsalamon ar->ar_arg_argc); 798161813Swsalamon kau_write(rec, tok); 799161813Swsalamon } 800161813Swsalamon if (ARG_IS_VALID(kar, ARG_ENVV)) { 801161813Swsalamon tok = au_to_exec_env(ar->ar_arg_envv, 802161813Swsalamon ar->ar_arg_envc); 803161813Swsalamon kau_write(rec, tok); 804161813Swsalamon } 805161813Swsalamon UPATH1_VNODE1_TOKENS; 806161813Swsalamon break; 807161813Swsalamon 808155192Srwatson case AUE_FCHMOD: 809155192Srwatson if (ARG_IS_VALID(kar, ARG_MODE)) { 810156889Srwatson tok = au_to_arg32(2, "new file mode", 811156889Srwatson ar->ar_arg_mode); 812155192Srwatson kau_write(rec, tok); 813155192Srwatson } 814155192Srwatson FD_VNODE1_TOKENS; 815155192Srwatson break; 816156889Srwatson 817162990Srwatson /* 818162990Srwatson * XXXRW: Some of these need to handle non-vnode cases as well. 819162990Srwatson */ 820155192Srwatson case AUE_FCHDIR: 821155192Srwatson case AUE_FPATHCONF: 822162990Srwatson case AUE_FSTAT: 823155192Srwatson case AUE_FSTATFS: 824155192Srwatson case AUE_FSYNC: 825155192Srwatson case AUE_FTRUNCATE: 826155192Srwatson case AUE_FUTIMES: 827155192Srwatson case AUE_GETDIRENTRIES: 828155192Srwatson case AUE_GETDIRENTRIESATTR: 829162990Srwatson case AUE_POLL: 830162990Srwatson case AUE_READ: 831162990Srwatson case AUE_READV: 832162990Srwatson case AUE_WRITE: 833162990Srwatson case AUE_WRITEV: 834155192Srwatson FD_VNODE1_TOKENS; 835155192Srwatson break; 836156889Srwatson 837155192Srwatson case AUE_FCHOWN: 838155192Srwatson if (ARG_IS_VALID(kar, ARG_UID)) { 839155192Srwatson tok = au_to_arg32(2, "new file uid", ar->ar_arg_uid); 840155192Srwatson kau_write(rec, tok); 841155192Srwatson } 842155192Srwatson if (ARG_IS_VALID(kar, ARG_GID)) { 843155192Srwatson tok = au_to_arg32(3, "new file gid", ar->ar_arg_gid); 844155192Srwatson kau_write(rec, tok); 845155192Srwatson } 846155192Srwatson FD_VNODE1_TOKENS; 847155192Srwatson break; 848156889Srwatson 849155192Srwatson case AUE_FCNTL: 850155192Srwatson if (ar->ar_arg_cmd == F_GETLK || ar->ar_arg_cmd == F_SETLK || 851180715Srwatson ar->ar_arg_cmd == F_SETLKW) { 852155192Srwatson if (ARG_IS_VALID(kar, ARG_CMD)) { 853155192Srwatson tok = au_to_arg32(2, "cmd", ar->ar_arg_cmd); 854155192Srwatson kau_write(rec, tok); 855155192Srwatson } 856155192Srwatson FD_VNODE1_TOKENS; 857155192Srwatson } 858155192Srwatson break; 859156889Srwatson 860155192Srwatson case AUE_FCHFLAGS: 861155192Srwatson if (ARG_IS_VALID(kar, ARG_FFLAGS)) { 862155192Srwatson tok = au_to_arg32(2, "flags", ar->ar_arg_fflags); 863155192Srwatson kau_write(rec, tok); 864155192Srwatson } 865155192Srwatson FD_VNODE1_TOKENS; 866155192Srwatson break; 867156889Srwatson 868155192Srwatson case AUE_FLOCK: 869155192Srwatson if (ARG_IS_VALID(kar, ARG_CMD)) { 870155192Srwatson tok = au_to_arg32(2, "operation", ar->ar_arg_cmd); 871155192Srwatson kau_write(rec, tok); 872155192Srwatson } 873155192Srwatson FD_VNODE1_TOKENS; 874155192Srwatson break; 875156889Srwatson 876155192Srwatson case AUE_RFORK: 877155192Srwatson if (ARG_IS_VALID(kar, ARG_FFLAGS)) { 878155192Srwatson tok = au_to_arg32(1, "flags", ar->ar_arg_fflags); 879155192Srwatson kau_write(rec, tok); 880155192Srwatson } 881185293Srwatson /* FALLTHROUGH */ 882185293Srwatson 883155192Srwatson case AUE_FORK: 884155192Srwatson case AUE_VFORK: 885155192Srwatson if (ARG_IS_VALID(kar, ARG_PID)) { 886155192Srwatson tok = au_to_arg32(0, "child PID", ar->ar_arg_pid); 887155192Srwatson kau_write(rec, tok); 888155192Srwatson } 889155192Srwatson break; 890156889Srwatson 891155192Srwatson case AUE_IOCTL: 892155192Srwatson if (ARG_IS_VALID(kar, ARG_CMD)) { 893155192Srwatson tok = au_to_arg32(2, "cmd", ar->ar_arg_cmd); 894155192Srwatson kau_write(rec, tok); 895155192Srwatson } 896155192Srwatson if (ARG_IS_VALID(kar, ARG_ADDR)) { 897155271Srwatson tok = au_to_arg32(1, "arg", 898155271Srwatson (u_int32_t)(uintptr_t)ar->ar_arg_addr); 899155192Srwatson kau_write(rec, tok); 900155192Srwatson } 901156889Srwatson if (ARG_IS_VALID(kar, ARG_VNODE1)) 902155192Srwatson FD_VNODE1_TOKENS; 903156889Srwatson else { 904155192Srwatson if (ARG_IS_VALID(kar, ARG_SOCKINFO)) { 905156889Srwatson tok = kau_to_socket(&ar->ar_arg_sockinfo); 906155192Srwatson kau_write(rec, tok); 907155192Srwatson } else { 908155192Srwatson if (ARG_IS_VALID(kar, ARG_FD)) { 909155192Srwatson tok = au_to_arg32(1, "fd", 910155192Srwatson ar->ar_arg_fd); 911180709Srwatson kau_write(rec, tok); 912155192Srwatson } 913155192Srwatson } 914155192Srwatson } 915155192Srwatson break; 916155192Srwatson 917155192Srwatson case AUE_KILL: 918162990Srwatson case AUE_KILLPG: 919155192Srwatson if (ARG_IS_VALID(kar, ARG_SIGNUM)) { 920155192Srwatson tok = au_to_arg32(2, "signal", ar->ar_arg_signum); 921155192Srwatson kau_write(rec, tok); 922155192Srwatson } 923155192Srwatson PROCESS_PID_TOKENS(1); 924155192Srwatson break; 925155192Srwatson 926155192Srwatson case AUE_KTRACE: 927155192Srwatson if (ARG_IS_VALID(kar, ARG_CMD)) { 928155192Srwatson tok = au_to_arg32(2, "ops", ar->ar_arg_cmd); 929155192Srwatson kau_write(rec, tok); 930155192Srwatson } 931155192Srwatson if (ARG_IS_VALID(kar, ARG_VALUE)) { 932155192Srwatson tok = au_to_arg32(3, "trpoints", ar->ar_arg_value); 933155192Srwatson kau_write(rec, tok); 934155192Srwatson } 935155192Srwatson PROCESS_PID_TOKENS(4); 936155192Srwatson UPATH1_VNODE1_TOKENS; 937155192Srwatson break; 938155192Srwatson 939155192Srwatson case AUE_LINK: 940155192Srwatson case AUE_RENAME: 941155192Srwatson UPATH1_VNODE1_TOKENS; 942155192Srwatson UPATH2_TOKENS; 943155192Srwatson break; 944155192Srwatson 945155192Srwatson case AUE_LOADSHFILE: 946155192Srwatson if (ARG_IS_VALID(kar, ARG_ADDR)) { 947155192Srwatson tok = au_to_arg32(4, "base addr", 948155271Srwatson (u_int32_t)(uintptr_t)ar->ar_arg_addr); 949155192Srwatson kau_write(rec, tok); 950155192Srwatson } 951155192Srwatson UPATH1_VNODE1_TOKENS; 952155192Srwatson break; 953156889Srwatson 954155192Srwatson case AUE_MKDIR: 955155192Srwatson if (ARG_IS_VALID(kar, ARG_MODE)) { 956155192Srwatson tok = au_to_arg32(2, "mode", ar->ar_arg_mode); 957155192Srwatson kau_write(rec, tok); 958155192Srwatson } 959155192Srwatson UPATH1_VNODE1_TOKENS; 960155192Srwatson break; 961155192Srwatson 962155192Srwatson case AUE_MKNOD: 963155192Srwatson if (ARG_IS_VALID(kar, ARG_MODE)) { 964155192Srwatson tok = au_to_arg32(2, "mode", ar->ar_arg_mode); 965155192Srwatson kau_write(rec, tok); 966155192Srwatson } 967155192Srwatson if (ARG_IS_VALID(kar, ARG_DEV)) { 968155192Srwatson tok = au_to_arg32(3, "dev", ar->ar_arg_dev); 969155192Srwatson kau_write(rec, tok); 970155192Srwatson } 971155192Srwatson UPATH1_VNODE1_TOKENS; 972155192Srwatson break; 973155192Srwatson 974155192Srwatson case AUE_MMAP: 975155192Srwatson case AUE_MUNMAP: 976155192Srwatson case AUE_MPROTECT: 977155192Srwatson case AUE_MLOCK: 978155192Srwatson case AUE_MUNLOCK: 979155192Srwatson case AUE_MINHERIT: 980155192Srwatson if (ARG_IS_VALID(kar, ARG_ADDR)) { 981155192Srwatson tok = au_to_arg32(1, "addr", 982155271Srwatson (u_int32_t)(uintptr_t)ar->ar_arg_addr); 983155192Srwatson kau_write(rec, tok); 984155192Srwatson } 985155192Srwatson if (ARG_IS_VALID(kar, ARG_LEN)) { 986155192Srwatson tok = au_to_arg32(2, "len", ar->ar_arg_len); 987155192Srwatson kau_write(rec, tok); 988155192Srwatson } 989155192Srwatson if (ar->ar_event == AUE_MMAP) 990155192Srwatson FD_VNODE1_TOKENS; 991155192Srwatson if (ar->ar_event == AUE_MPROTECT) { 992155192Srwatson if (ARG_IS_VALID(kar, ARG_VALUE)) { 993155192Srwatson tok = au_to_arg32(3, "protection", 994155192Srwatson ar->ar_arg_value); 995155192Srwatson kau_write(rec, tok); 996155192Srwatson } 997155192Srwatson } 998155192Srwatson if (ar->ar_event == AUE_MINHERIT) { 999155192Srwatson if (ARG_IS_VALID(kar, ARG_VALUE)) { 1000155192Srwatson tok = au_to_arg32(3, "inherit", 1001155192Srwatson ar->ar_arg_value); 1002155192Srwatson kau_write(rec, tok); 1003155192Srwatson } 1004155192Srwatson } 1005155192Srwatson break; 1006155192Srwatson 1007155192Srwatson case AUE_MOUNT: 1008162990Srwatson case AUE_NMOUNT: 1009155192Srwatson /* XXX Need to handle NFS mounts */ 1010155192Srwatson if (ARG_IS_VALID(kar, ARG_FFLAGS)) { 1011155192Srwatson tok = au_to_arg32(3, "flags", ar->ar_arg_fflags); 1012155192Srwatson kau_write(rec, tok); 1013155192Srwatson } 1014155192Srwatson if (ARG_IS_VALID(kar, ARG_TEXT)) { 1015155192Srwatson tok = au_to_text(ar->ar_arg_text); 1016155192Srwatson kau_write(rec, tok); 1017155192Srwatson } 1018185293Srwatson /* FALLTHROUGH */ 1019156889Srwatson 1020155192Srwatson case AUE_UMOUNT: 1021155192Srwatson UPATH1_VNODE1_TOKENS; 1022155192Srwatson break; 1023155192Srwatson 1024155192Srwatson case AUE_MSGCTL: 1025176565Srwatson ar->ar_event = audit_msgctl_to_event(ar->ar_arg_svipc_cmd); 1026155192Srwatson /* Fall through */ 1027156889Srwatson 1028155192Srwatson case AUE_MSGRCV: 1029155192Srwatson case AUE_MSGSND: 1030155192Srwatson tok = au_to_arg32(1, "msg ID", ar->ar_arg_svipc_id); 1031155192Srwatson kau_write(rec, tok); 1032155192Srwatson if (ar->ar_errno != EINVAL) { 1033155192Srwatson tok = au_to_ipc(AT_IPC_MSG, ar->ar_arg_svipc_id); 1034155192Srwatson kau_write(rec, tok); 1035155192Srwatson } 1036155192Srwatson break; 1037155192Srwatson 1038155192Srwatson case AUE_MSGGET: 1039155192Srwatson if (ar->ar_errno == 0) { 1040155192Srwatson if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) { 1041155192Srwatson tok = au_to_ipc(AT_IPC_MSG, 1042155192Srwatson ar->ar_arg_svipc_id); 1043155192Srwatson kau_write(rec, tok); 1044155192Srwatson } 1045155192Srwatson } 1046155192Srwatson break; 1047155192Srwatson 1048155192Srwatson case AUE_RESETSHFILE: 1049155192Srwatson if (ARG_IS_VALID(kar, ARG_ADDR)) { 1050155192Srwatson tok = au_to_arg32(1, "base addr", 1051155271Srwatson (u_int32_t)(uintptr_t)ar->ar_arg_addr); 1052155192Srwatson kau_write(rec, tok); 1053155192Srwatson } 1054155192Srwatson break; 1055156889Srwatson 1056155192Srwatson case AUE_OPEN_RC: 1057155192Srwatson case AUE_OPEN_RTC: 1058155192Srwatson case AUE_OPEN_RWC: 1059155192Srwatson case AUE_OPEN_RWTC: 1060155192Srwatson case AUE_OPEN_WC: 1061155192Srwatson case AUE_OPEN_WTC: 1062162990Srwatson case AUE_CREAT: 1063155192Srwatson if (ARG_IS_VALID(kar, ARG_MODE)) { 1064155192Srwatson tok = au_to_arg32(3, "mode", ar->ar_arg_mode); 1065155192Srwatson kau_write(rec, tok); 1066155192Srwatson } 1067185293Srwatson /* FALLTHROUGH */ 1068155192Srwatson 1069155192Srwatson case AUE_OPEN_R: 1070155192Srwatson case AUE_OPEN_RT: 1071155192Srwatson case AUE_OPEN_RW: 1072155192Srwatson case AUE_OPEN_RWT: 1073155192Srwatson case AUE_OPEN_W: 1074155192Srwatson case AUE_OPEN_WT: 1075155192Srwatson if (ARG_IS_VALID(kar, ARG_FFLAGS)) { 1076155192Srwatson tok = au_to_arg32(2, "flags", ar->ar_arg_fflags); 1077155192Srwatson kau_write(rec, tok); 1078155192Srwatson } 1079155192Srwatson UPATH1_VNODE1_TOKENS; 1080155192Srwatson break; 1081155192Srwatson 1082155192Srwatson case AUE_PTRACE: 1083155192Srwatson if (ARG_IS_VALID(kar, ARG_CMD)) { 1084155192Srwatson tok = au_to_arg32(1, "request", ar->ar_arg_cmd); 1085155192Srwatson kau_write(rec, tok); 1086155192Srwatson } 1087155192Srwatson if (ARG_IS_VALID(kar, ARG_ADDR)) { 1088155192Srwatson tok = au_to_arg32(3, "addr", 1089155271Srwatson (u_int32_t)(uintptr_t)ar->ar_arg_addr); 1090155192Srwatson kau_write(rec, tok); 1091155192Srwatson } 1092155192Srwatson if (ARG_IS_VALID(kar, ARG_VALUE)) { 1093155192Srwatson tok = au_to_arg32(4, "data", ar->ar_arg_value); 1094155192Srwatson kau_write(rec, tok); 1095155192Srwatson } 1096155192Srwatson PROCESS_PID_TOKENS(2); 1097155192Srwatson break; 1098155192Srwatson 1099155192Srwatson case AUE_QUOTACTL: 1100155192Srwatson if (ARG_IS_VALID(kar, ARG_CMD)) { 1101155192Srwatson tok = au_to_arg32(2, "command", ar->ar_arg_cmd); 1102155192Srwatson kau_write(rec, tok); 1103155192Srwatson } 1104155192Srwatson if (ARG_IS_VALID(kar, ARG_UID)) { 1105155192Srwatson tok = au_to_arg32(3, "uid", ar->ar_arg_uid); 1106155192Srwatson kau_write(rec, tok); 1107155192Srwatson } 1108155192Srwatson UPATH1_VNODE1_TOKENS; 1109155192Srwatson break; 1110155192Srwatson 1111155192Srwatson case AUE_REBOOT: 1112155192Srwatson if (ARG_IS_VALID(kar, ARG_CMD)) { 1113155192Srwatson tok = au_to_arg32(1, "howto", ar->ar_arg_cmd); 1114155192Srwatson kau_write(rec, tok); 1115155192Srwatson } 1116155192Srwatson break; 1117155192Srwatson 1118155192Srwatson case AUE_SEMCTL: 1119176565Srwatson ar->ar_event = audit_semctl_to_event(ar->ar_arg_svipc_cmd); 1120155192Srwatson /* Fall through */ 1121156889Srwatson 1122155192Srwatson case AUE_SEMOP: 1123155192Srwatson if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) { 1124155192Srwatson tok = au_to_arg32(1, "sem ID", ar->ar_arg_svipc_id); 1125155192Srwatson kau_write(rec, tok); 1126155192Srwatson if (ar->ar_errno != EINVAL) { 1127155192Srwatson tok = au_to_ipc(AT_IPC_SEM, 1128155192Srwatson ar->ar_arg_svipc_id); 1129155192Srwatson kau_write(rec, tok); 1130155192Srwatson } 1131155192Srwatson } 1132155192Srwatson break; 1133156889Srwatson 1134155192Srwatson case AUE_SEMGET: 1135155192Srwatson if (ar->ar_errno == 0) { 1136155192Srwatson if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) { 1137155192Srwatson tok = au_to_ipc(AT_IPC_SEM, 1138155192Srwatson ar->ar_arg_svipc_id); 1139155192Srwatson kau_write(rec, tok); 1140155192Srwatson } 1141155192Srwatson } 1142155192Srwatson break; 1143156889Srwatson 1144155192Srwatson case AUE_SETEGID: 1145155192Srwatson if (ARG_IS_VALID(kar, ARG_EGID)) { 1146155192Srwatson tok = au_to_arg32(1, "gid", ar->ar_arg_egid); 1147155192Srwatson kau_write(rec, tok); 1148155192Srwatson } 1149155192Srwatson break; 1150156889Srwatson 1151155192Srwatson case AUE_SETEUID: 1152155192Srwatson if (ARG_IS_VALID(kar, ARG_EUID)) { 1153155192Srwatson tok = au_to_arg32(1, "uid", ar->ar_arg_euid); 1154155192Srwatson kau_write(rec, tok); 1155155192Srwatson } 1156155192Srwatson break; 1157156889Srwatson 1158155192Srwatson case AUE_SETREGID: 1159155192Srwatson if (ARG_IS_VALID(kar, ARG_RGID)) { 1160155192Srwatson tok = au_to_arg32(1, "rgid", ar->ar_arg_rgid); 1161155192Srwatson kau_write(rec, tok); 1162155192Srwatson } 1163155192Srwatson if (ARG_IS_VALID(kar, ARG_EGID)) { 1164155192Srwatson tok = au_to_arg32(2, "egid", ar->ar_arg_egid); 1165155192Srwatson kau_write(rec, tok); 1166155192Srwatson } 1167155192Srwatson break; 1168156889Srwatson 1169155192Srwatson case AUE_SETREUID: 1170155192Srwatson if (ARG_IS_VALID(kar, ARG_RUID)) { 1171155192Srwatson tok = au_to_arg32(1, "ruid", ar->ar_arg_ruid); 1172155192Srwatson kau_write(rec, tok); 1173155192Srwatson } 1174155192Srwatson if (ARG_IS_VALID(kar, ARG_EUID)) { 1175155192Srwatson tok = au_to_arg32(2, "euid", ar->ar_arg_euid); 1176155192Srwatson kau_write(rec, tok); 1177155192Srwatson } 1178155192Srwatson break; 1179156889Srwatson 1180155192Srwatson case AUE_SETRESGID: 1181155192Srwatson if (ARG_IS_VALID(kar, ARG_RGID)) { 1182155192Srwatson tok = au_to_arg32(1, "rgid", ar->ar_arg_rgid); 1183155192Srwatson kau_write(rec, tok); 1184155192Srwatson } 1185155192Srwatson if (ARG_IS_VALID(kar, ARG_EGID)) { 1186155192Srwatson tok = au_to_arg32(2, "egid", ar->ar_arg_egid); 1187155192Srwatson kau_write(rec, tok); 1188155192Srwatson } 1189155192Srwatson if (ARG_IS_VALID(kar, ARG_SGID)) { 1190155192Srwatson tok = au_to_arg32(3, "sgid", ar->ar_arg_sgid); 1191155192Srwatson kau_write(rec, tok); 1192155192Srwatson } 1193155192Srwatson break; 1194156889Srwatson 1195155192Srwatson case AUE_SETRESUID: 1196155192Srwatson if (ARG_IS_VALID(kar, ARG_RUID)) { 1197155192Srwatson tok = au_to_arg32(1, "ruid", ar->ar_arg_ruid); 1198155192Srwatson kau_write(rec, tok); 1199155192Srwatson } 1200155192Srwatson if (ARG_IS_VALID(kar, ARG_EUID)) { 1201155192Srwatson tok = au_to_arg32(2, "euid", ar->ar_arg_euid); 1202155192Srwatson kau_write(rec, tok); 1203155192Srwatson } 1204155192Srwatson if (ARG_IS_VALID(kar, ARG_SUID)) { 1205155192Srwatson tok = au_to_arg32(3, "suid", ar->ar_arg_suid); 1206155192Srwatson kau_write(rec, tok); 1207155192Srwatson } 1208155192Srwatson break; 1209156889Srwatson 1210155192Srwatson case AUE_SETGID: 1211155192Srwatson if (ARG_IS_VALID(kar, ARG_GID)) { 1212155192Srwatson tok = au_to_arg32(1, "gid", ar->ar_arg_gid); 1213155192Srwatson kau_write(rec, tok); 1214155192Srwatson } 1215155192Srwatson break; 1216156889Srwatson 1217155192Srwatson case AUE_SETUID: 1218155192Srwatson if (ARG_IS_VALID(kar, ARG_UID)) { 1219155192Srwatson tok = au_to_arg32(1, "uid", ar->ar_arg_uid); 1220155192Srwatson kau_write(rec, tok); 1221155192Srwatson } 1222155192Srwatson break; 1223156889Srwatson 1224155192Srwatson case AUE_SETGROUPS: 1225155192Srwatson if (ARG_IS_VALID(kar, ARG_GROUPSET)) { 1226155192Srwatson for(ctr = 0; ctr < ar->ar_arg_groups.gidset_size; ctr++) 1227155192Srwatson { 1228175456Scsjp tok = au_to_arg32(1, "setgroups", 1229175456Scsjp ar->ar_arg_groups.gidset[ctr]); 1230155192Srwatson kau_write(rec, tok); 1231155192Srwatson } 1232155192Srwatson } 1233155192Srwatson break; 1234155192Srwatson 1235155192Srwatson case AUE_SETLOGIN: 1236155192Srwatson if (ARG_IS_VALID(kar, ARG_TEXT)) { 1237155192Srwatson tok = au_to_text(ar->ar_arg_text); 1238155192Srwatson kau_write(rec, tok); 1239155192Srwatson } 1240155192Srwatson break; 1241155192Srwatson 1242155192Srwatson case AUE_SETPRIORITY: 1243155192Srwatson if (ARG_IS_VALID(kar, ARG_CMD)) { 1244155192Srwatson tok = au_to_arg32(1, "which", ar->ar_arg_cmd); 1245155192Srwatson kau_write(rec, tok); 1246155192Srwatson } 1247155192Srwatson if (ARG_IS_VALID(kar, ARG_UID)) { 1248155192Srwatson tok = au_to_arg32(2, "who", ar->ar_arg_uid); 1249155192Srwatson kau_write(rec, tok); 1250155192Srwatson } 1251155192Srwatson if (ARG_IS_VALID(kar, ARG_VALUE)) { 1252155192Srwatson tok = au_to_arg32(2, "priority", ar->ar_arg_value); 1253155192Srwatson kau_write(rec, tok); 1254155192Srwatson } 1255155192Srwatson break; 1256155192Srwatson 1257155192Srwatson case AUE_SETPRIVEXEC: 1258155192Srwatson if (ARG_IS_VALID(kar, ARG_VALUE)) { 1259155192Srwatson tok = au_to_arg32(1, "flag", ar->ar_arg_value); 1260155192Srwatson kau_write(rec, tok); 1261155192Srwatson } 1262155192Srwatson break; 1263155192Srwatson 1264155192Srwatson /* AUE_SHMAT, AUE_SHMCTL, AUE_SHMDT and AUE_SHMGET are SysV IPC */ 1265155192Srwatson case AUE_SHMAT: 1266155192Srwatson if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) { 1267155192Srwatson tok = au_to_arg32(1, "shmid", ar->ar_arg_svipc_id); 1268155192Srwatson kau_write(rec, tok); 1269155192Srwatson /* XXXAUDIT: Does having the ipc token make sense? */ 1270155192Srwatson tok = au_to_ipc(AT_IPC_SHM, ar->ar_arg_svipc_id); 1271155192Srwatson kau_write(rec, tok); 1272155192Srwatson } 1273155192Srwatson if (ARG_IS_VALID(kar, ARG_SVIPC_ADDR)) { 1274155192Srwatson tok = au_to_arg32(2, "shmaddr", 1275155271Srwatson (int)(uintptr_t)ar->ar_arg_svipc_addr); 1276155192Srwatson kau_write(rec, tok); 1277155192Srwatson } 1278155192Srwatson if (ARG_IS_VALID(kar, ARG_SVIPC_PERM)) { 1279155192Srwatson tok = au_to_ipc_perm(&ar->ar_arg_svipc_perm); 1280155192Srwatson kau_write(rec, tok); 1281155192Srwatson } 1282155192Srwatson break; 1283155192Srwatson 1284155192Srwatson case AUE_SHMCTL: 1285155192Srwatson if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) { 1286155192Srwatson tok = au_to_arg32(1, "shmid", ar->ar_arg_svipc_id); 1287155192Srwatson kau_write(rec, tok); 1288155192Srwatson /* XXXAUDIT: Does having the ipc token make sense? */ 1289155192Srwatson tok = au_to_ipc(AT_IPC_SHM, ar->ar_arg_svipc_id); 1290155192Srwatson kau_write(rec, tok); 1291155192Srwatson } 1292155192Srwatson switch (ar->ar_arg_svipc_cmd) { 1293155192Srwatson case IPC_STAT: 1294155192Srwatson ar->ar_event = AUE_SHMCTL_STAT; 1295155192Srwatson break; 1296155192Srwatson case IPC_RMID: 1297155192Srwatson ar->ar_event = AUE_SHMCTL_RMID; 1298155192Srwatson break; 1299155192Srwatson case IPC_SET: 1300155192Srwatson ar->ar_event = AUE_SHMCTL_SET; 1301155192Srwatson if (ARG_IS_VALID(kar, ARG_SVIPC_PERM)) { 1302155192Srwatson tok = au_to_ipc_perm(&ar->ar_arg_svipc_perm); 1303155192Srwatson kau_write(rec, tok); 1304155192Srwatson } 1305155192Srwatson break; 1306155192Srwatson default: 1307155192Srwatson break; /* We will audit a bad command */ 1308155192Srwatson } 1309155192Srwatson break; 1310155192Srwatson 1311155192Srwatson case AUE_SHMDT: 1312155192Srwatson if (ARG_IS_VALID(kar, ARG_SVIPC_ADDR)) { 1313155192Srwatson tok = au_to_arg32(1, "shmaddr", 1314155271Srwatson (int)(uintptr_t)ar->ar_arg_svipc_addr); 1315155192Srwatson kau_write(rec, tok); 1316155192Srwatson } 1317155192Srwatson break; 1318155192Srwatson 1319155192Srwatson case AUE_SHMGET: 1320155192Srwatson /* This is unusual; the return value is in an argument token */ 1321155192Srwatson if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) { 1322155192Srwatson tok = au_to_arg32(0, "shmid", ar->ar_arg_svipc_id); 1323155192Srwatson kau_write(rec, tok); 1324155192Srwatson tok = au_to_ipc(AT_IPC_SHM, ar->ar_arg_svipc_id); 1325155192Srwatson kau_write(rec, tok); 1326155192Srwatson } 1327155192Srwatson if (ARG_IS_VALID(kar, ARG_SVIPC_PERM)) { 1328155192Srwatson tok = au_to_ipc_perm(&ar->ar_arg_svipc_perm); 1329155192Srwatson kau_write(rec, tok); 1330155192Srwatson } 1331155192Srwatson break; 1332155192Srwatson 1333156889Srwatson /* AUE_SHMOPEN, AUE_SHMUNLINK, AUE_SEMOPEN, AUE_SEMCLOSE 1334155192Srwatson * and AUE_SEMUNLINK are Posix IPC */ 1335155192Srwatson case AUE_SHMOPEN: 1336155192Srwatson if (ARG_IS_VALID(kar, ARG_SVIPC_ADDR)) { 1337155192Srwatson tok = au_to_arg32(2, "flags", ar->ar_arg_fflags); 1338155192Srwatson kau_write(rec, tok); 1339155192Srwatson } 1340155192Srwatson if (ARG_IS_VALID(kar, ARG_MODE)) { 1341155192Srwatson tok = au_to_arg32(3, "mode", ar->ar_arg_mode); 1342155192Srwatson kau_write(rec, tok); 1343155192Srwatson } 1344185293Srwatson /* FALLTHROUGH */ 1345185293Srwatson 1346155192Srwatson case AUE_SHMUNLINK: 1347155192Srwatson if (ARG_IS_VALID(kar, ARG_TEXT)) { 1348155192Srwatson tok = au_to_text(ar->ar_arg_text); 1349155192Srwatson kau_write(rec, tok); 1350155192Srwatson } 1351155192Srwatson if (ARG_IS_VALID(kar, ARG_POSIX_IPC_PERM)) { 1352155192Srwatson struct ipc_perm perm; 1353180715Srwatson 1354155192Srwatson perm.uid = ar->ar_arg_pipc_perm.pipc_uid; 1355155192Srwatson perm.gid = ar->ar_arg_pipc_perm.pipc_gid; 1356155192Srwatson perm.cuid = ar->ar_arg_pipc_perm.pipc_uid; 1357155192Srwatson perm.cgid = ar->ar_arg_pipc_perm.pipc_gid; 1358155192Srwatson perm.mode = ar->ar_arg_pipc_perm.pipc_mode; 1359155192Srwatson perm.seq = 0; 1360155192Srwatson perm.key = 0; 1361155192Srwatson tok = au_to_ipc_perm(&perm); 1362155192Srwatson kau_write(rec, tok); 1363155192Srwatson } 1364155192Srwatson break; 1365155192Srwatson 1366155192Srwatson case AUE_SEMOPEN: 1367155192Srwatson if (ARG_IS_VALID(kar, ARG_FFLAGS)) { 1368155192Srwatson tok = au_to_arg32(2, "flags", ar->ar_arg_fflags); 1369155192Srwatson kau_write(rec, tok); 1370155192Srwatson } 1371155192Srwatson if (ARG_IS_VALID(kar, ARG_MODE)) { 1372155192Srwatson tok = au_to_arg32(3, "mode", ar->ar_arg_mode); 1373155192Srwatson kau_write(rec, tok); 1374155192Srwatson } 1375155192Srwatson if (ARG_IS_VALID(kar, ARG_VALUE)) { 1376155192Srwatson tok = au_to_arg32(4, "value", ar->ar_arg_value); 1377155192Srwatson kau_write(rec, tok); 1378155192Srwatson } 1379185293Srwatson /* FALLTHROUGH */ 1380156889Srwatson 1381155192Srwatson case AUE_SEMUNLINK: 1382155192Srwatson if (ARG_IS_VALID(kar, ARG_TEXT)) { 1383155192Srwatson tok = au_to_text(ar->ar_arg_text); 1384155192Srwatson kau_write(rec, tok); 1385155192Srwatson } 1386155192Srwatson if (ARG_IS_VALID(kar, ARG_POSIX_IPC_PERM)) { 1387155192Srwatson struct ipc_perm perm; 1388180715Srwatson 1389155192Srwatson perm.uid = ar->ar_arg_pipc_perm.pipc_uid; 1390155192Srwatson perm.gid = ar->ar_arg_pipc_perm.pipc_gid; 1391155192Srwatson perm.cuid = ar->ar_arg_pipc_perm.pipc_uid; 1392155192Srwatson perm.cgid = ar->ar_arg_pipc_perm.pipc_gid; 1393155192Srwatson perm.mode = ar->ar_arg_pipc_perm.pipc_mode; 1394155192Srwatson perm.seq = 0; 1395155192Srwatson perm.key = 0; 1396155192Srwatson tok = au_to_ipc_perm(&perm); 1397155192Srwatson kau_write(rec, tok); 1398155192Srwatson } 1399155192Srwatson break; 1400155192Srwatson 1401155192Srwatson case AUE_SEMCLOSE: 1402155192Srwatson if (ARG_IS_VALID(kar, ARG_FD)) { 1403155192Srwatson tok = au_to_arg32(1, "sem", ar->ar_arg_fd); 1404155192Srwatson kau_write(rec, tok); 1405155192Srwatson } 1406155192Srwatson break; 1407155192Srwatson 1408155192Srwatson case AUE_SYMLINK: 1409155192Srwatson if (ARG_IS_VALID(kar, ARG_TEXT)) { 1410155192Srwatson tok = au_to_text(ar->ar_arg_text); 1411155192Srwatson kau_write(rec, tok); 1412155192Srwatson } 1413155192Srwatson UPATH1_VNODE1_TOKENS; 1414155192Srwatson break; 1415155192Srwatson 1416155192Srwatson case AUE_SYSCTL: 1417180716Srwatson case AUE_SYSCTL_NONADMIN: 1418155192Srwatson if (ARG_IS_VALID(kar, ARG_CTLNAME | ARG_LEN)) { 1419155192Srwatson for (ctr = 0; ctr < ar->ar_arg_len; ctr++) { 1420156889Srwatson tok = au_to_arg32(1, "name", 1421156889Srwatson ar->ar_arg_ctlname[ctr]); 1422156889Srwatson kau_write(rec, tok); 1423155192Srwatson } 1424155192Srwatson } 1425155192Srwatson if (ARG_IS_VALID(kar, ARG_VALUE)) { 1426155192Srwatson tok = au_to_arg32(5, "newval", ar->ar_arg_value); 1427155192Srwatson kau_write(rec, tok); 1428155192Srwatson } 1429155192Srwatson if (ARG_IS_VALID(kar, ARG_TEXT)) { 1430155192Srwatson tok = au_to_text(ar->ar_arg_text); 1431155192Srwatson kau_write(rec, tok); 1432155192Srwatson } 1433155192Srwatson break; 1434155192Srwatson 1435155192Srwatson case AUE_UMASK: 1436155192Srwatson if (ARG_IS_VALID(kar, ARG_MASK)) { 1437155192Srwatson tok = au_to_arg32(1, "new mask", ar->ar_arg_mask); 1438155192Srwatson kau_write(rec, tok); 1439155192Srwatson } 1440155192Srwatson tok = au_to_arg32(0, "prev mask", ar->ar_retval); 1441155192Srwatson kau_write(rec, tok); 1442155192Srwatson break; 1443155192Srwatson 1444155192Srwatson case AUE_WAIT4: 1445155192Srwatson if (ARG_IS_VALID(kar, ARG_PID)) { 1446155192Srwatson tok = au_to_arg32(0, "pid", ar->ar_arg_pid); 1447155192Srwatson kau_write(rec, tok); 1448155192Srwatson } 1449155192Srwatson break; 1450155192Srwatson 1451162990Srwatson case AUE_NULL: 1452156889Srwatson default: 1453155192Srwatson printf("BSM conversion requested for unknown event %d\n", 1454156889Srwatson ar->ar_event); 1455180715Srwatson 1456180715Srwatson /* 1457180715Srwatson * Write the subject token so it is properly freed here. 1458180715Srwatson */ 1459155192Srwatson kau_write(rec, subj_tok); 1460155192Srwatson kau_free(rec); 1461155192Srwatson return (BSM_NOAUDIT); 1462155192Srwatson } 1463155192Srwatson 1464156889Srwatson kau_write(rec, subj_tok); 1465186649Srwatson tok = au_to_return32(au_errno_to_bsm(ar->ar_errno), ar->ar_retval); 1466155192Srwatson kau_write(rec, tok); /* Every record gets a return token */ 1467155192Srwatson 1468155192Srwatson kau_close(rec, &ar->ar_endtime, ar->ar_event); 1469155192Srwatson 1470155192Srwatson *pau = rec; 1471155192Srwatson return (BSM_SUCCESS); 1472155192Srwatson} 1473155192Srwatson 1474155192Srwatson/* 1475156889Srwatson * Verify that a record is a valid BSM record. This verification is simple 1476156889Srwatson * now, but may be expanded on sometime in the future. Return 1 if the 1477156889Srwatson * record is good, 0 otherwise. 1478155192Srwatson */ 1479155192Srwatsonint 1480155192Srwatsonbsm_rec_verify(void *rec) 1481155192Srwatson{ 1482155192Srwatson char c = *(char *)rec; 1483156889Srwatson 1484156889Srwatson /* 1485155192Srwatson * Check the token ID of the first token; it has to be a header 1486155192Srwatson * token. 1487156889Srwatson * 1488156889Srwatson * XXXAUDIT There needs to be a token structure to map a token. 1489155192Srwatson * XXXAUDIT 'Shouldn't be simply looking at the first char. 1490155192Srwatson */ 1491156889Srwatson if ((c != AUT_HEADER32) && (c != AUT_HEADER32_EX) && 1492156889Srwatson (c != AUT_HEADER64) && (c != AUT_HEADER64_EX)) 1493155192Srwatson return (0); 1494155192Srwatson return (1); 1495155192Srwatson} 1496