audit_record.h revision 1780:baba427bca27
1/* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21/* 22 * Copyright 2006 Sun Microsystems, Inc. All rights reserved. 23 * Use is subject to license terms. 24 */ 25 26#ifndef _BSM_AUDIT_RECORD_H 27#define _BSM_AUDIT_RECORD_H 28 29#pragma ident "%Z%%M% %I% %E% SMI" 30 31#ifdef _KERNEL 32#include <sys/priv.h> 33#else 34#include <priv.h> 35#endif 36#include <sys/socket.h> 37#include <sys/acl.h> 38 39#include <sys/tsol/label.h> 40 41#ifdef __cplusplus 42extern "C" { 43#endif 44 45/* 46 * Version of audit attributes 47 * 48 * OS Release Version Number Comments 49 * ========== ============== ======== 50 * SunOS 5.1 2 Unbundled Package 51 * SunOS 5.3 2 Bundled into the base OS 52 * SunOS 5.4-5.x 2 53 * Trusted Solaris 2.5 3 To distinguish potential new tokens 54 * Trusted Solaris 7-8 4 Redefine X tokens that overlap with 55 * SunOS 5.7 56 */ 57 58#ifdef TSOL 59#define TOKEN_VERSION 4 60#else /* !TSOL */ 61#define TOKEN_VERSION 2 62#endif /* TSOL */ 63 64/* 65 * Audit record token type codes 66 */ 67 68/* 69 * Control token types 70 */ 71 72#define AUT_INVALID ((char)0x00) 73#define AUT_OTHER_FILE ((char)0x11) 74#define AUT_OTHER_FILE32 AUT_OTHER_FILE 75#define AUT_OHEADER ((char)0x12) 76#define AUT_TRAILER ((char)0x13) 77#define AUT_HEADER ((char)0x14) 78#define AUT_HEADER32 AUT_HEADER 79#define AUT_HEADER32_EX ((char)0x15) 80#define AUT_TRAILER_MAGIC ((short)0xB105) 81 82/* 83 * Data token types 84 */ 85 86#define AUT_FMRI ((char)0x20) 87#define AUT_DATA ((char)0x21) 88#define AUT_IPC ((char)0x22) 89#define AUT_PATH ((char)0x23) 90#define AUT_SUBJECT ((char)0x24) 91#define AUT_SUBJECT32 AUT_SUBJECT 92#define AUT_XATPATH ((char)0x25) 93#define AUT_PROCESS ((char)0x26) 94#define AUT_PROCESS32 AUT_PROCESS 95#define AUT_RETURN ((char)0x27) 96#define AUT_RETURN32 AUT_RETURN 97#define AUT_TEXT ((char)0x28) 98#define AUT_OPAQUE ((char)0x29) 99#define AUT_IN_ADDR ((char)0x2A) 100#define AUT_IP ((char)0x2B) 101#define AUT_IPORT ((char)0x2C) 102#define AUT_ARG ((char)0x2D) 103#define AUT_ARG32 AUT_ARG 104#define AUT_SOCKET ((char)0x2E) 105#define AUT_SEQ ((char)0x2F) 106#define AUT_TID ((char)0x61) 107 108/* 109 * Modifier token types 110 */ 111 112#define AUT_ACL ((char)0x30) 113#define AUT_ATTR ((char)0x31) 114#define AUT_IPC_PERM ((char)0x32) 115#define AUT_LABEL ((char)0x33) 116#define AUT_GROUPS ((char)0x34) 117#define AUT_ILABEL ((char)0x35) 118#define AUT_SLABEL ((char)0x36) 119#define AUT_CLEAR ((char)0x37) 120#define AUT_PRIV ((char)0x38) 121#define AUT_UPRIV ((char)0x39) 122#define AUT_LIAISON ((char)0x3A) 123#define AUT_NEWGROUPS ((char)0x3B) 124#define AUT_EXEC_ARGS ((char)0x3C) 125#define AUT_EXEC_ENV ((char)0x3D) 126#define AUT_ATTR32 ((char)0x3E) 127#define AUT_UAUTH ((char)0x3F) 128#define AUT_ZONENAME ((char)0x60) 129 130/* 131 * X windows token types 132 */ 133 134#define AUT_XATOM ((char)0x40) 135#define AUT_XOBJ ((char)0x41) 136#define AUT_XPROTO ((char)0x42) 137#define AUT_XSELECT ((char)0x43) 138 139#if TOKEN_VERSION != 3 140#define AUT_XCOLORMAP ((char)0x44) 141#define AUT_XCURSOR ((char)0x45) 142#define AUT_XFONT ((char)0x46) 143#define AUT_XGC ((char)0x47) 144#define AUT_XPIXMAP ((char)0x48) 145#define AUT_XPROPERTY ((char)0x49) 146#define AUT_XWINDOW ((char)0x4A) 147#define AUT_XCLIENT ((char)0x4B) 148#else /* TOKEN_VERSION == 3 */ 149#define AUT_XCOLORMAP ((char)0x74) 150#define AUT_XCURSOR ((char)0x75) 151#define AUT_XFONT ((char)0x76) 152#define AUT_XGC ((char)0x77) 153#define AUT_XPIXMAP ((char)0x78) 154#define AUT_XPROPERTY ((char)0x79) 155#define AUT_XWINDOW ((char)0x7A) 156#define AUT_XCLIENT ((char)0x7B) 157#endif /* TOKEN_VERSION != 3 */ 158 159/* 160 * Command token types 161 */ 162 163#define AUT_CMD ((char)0x51) 164#define AUT_EXIT ((char)0x52) 165 166/* 167 * Miscellaneous token types 168 */ 169 170#define AUT_HOST ((char)0x70) 171 172/* 173 * Solaris64 token types 174 */ 175 176#define AUT_ARG64 ((char)0x71) 177#define AUT_RETURN64 ((char)0x72) 178#define AUT_ATTR64 ((char)0x73) 179#define AUT_HEADER64 ((char)0x74) 180#define AUT_SUBJECT64 ((char)0x75) 181#define AUT_PROCESS64 ((char)0x77) 182#define AUT_OTHER_FILE64 ((char)0x78) 183 184/* 185 * Extended network address token types 186 */ 187 188#define AUT_HEADER64_EX ((char)0x79) 189#define AUT_SUBJECT32_EX ((char)0x7a) 190#define AUT_PROCESS32_EX ((char)0x7b) 191#define AUT_SUBJECT64_EX ((char)0x7c) 192#define AUT_PROCESS64_EX ((char)0x7d) 193#define AUT_IN_ADDR_EX ((char)0x7e) 194#define AUT_SOCKET_EX ((char)0x7f) 195 196 197/* 198 * Audit print suggestion types. 199 */ 200 201#define AUP_BINARY ((char)0) 202#define AUP_OCTAL ((char)1) 203#define AUP_DECIMAL ((char)2) 204#define AUP_HEX ((char)3) 205#define AUP_STRING ((char)4) 206 207/* 208 * Audit data member types. 209 */ 210 211#define AUR_BYTE ((char)0) 212#define AUR_CHAR ((char)0) 213#define AUR_SHORT ((char)1) 214#define AUR_INT ((char)2) 215#define AUR_INT32 ((char)2) 216#define AUR_INT64 ((char)3) 217 218/* 219 * Adr structures 220 */ 221 222struct adr_s { 223 char *adr_stream; /* The base of the stream */ 224 char *adr_now; /* The location within the stream */ 225}; 226 227typedef struct adr_s adr_t; 228 229 230#ifdef _KERNEL 231 232#include <sys/param.h> 233#include <sys/systm.h> /* for rval */ 234#include <sys/time.h> 235#include <sys/types.h> 236#include <sys/vnode.h> 237#include <sys/mode.h> 238#include <sys/user.h> 239#include <sys/session.h> 240#include <sys/ipc_impl.h> 241#include <netinet/in_systm.h> 242#include <netinet/in.h> 243#include <netinet/ip.h> 244#include <sys/socket.h> 245#include <net/route.h> 246#include <netinet/in_pcb.h> 247 248/* 249 * au_close flag arguments 250 */ 251 252#define AU_OK 0x1 /* Good audit record */ 253#define AU_DONTBLOCK 0x2 /* Don't block or discard if queue full */ 254#define AU_DEFER 0x4 /* Defer record queueing to syscall end */ 255 256/* 257 * Audit token type is really an au_membuf pointer 258 */ 259typedef au_buff_t token_t; 260/* 261 * token generation functions 262 */ 263token_t *au_append_token(token_t *, token_t *); 264token_t *au_set(caddr_t, uint_t); 265 266void au_free_rec(au_buff_t *); 267 268#define au_getclr() ((token_t *)au_get_buff()) 269#define au_toss_token(tok) (au_free_rec((au_buff_t *)(tok))) 270 271token_t *au_to_acl(); 272token_t *au_to_attr(struct vattr *); 273token_t *au_to_data(char, char, char, char *); 274token_t *au_to_header(int, au_event_t, au_emod_t); 275token_t *au_to_header_ex(int, au_event_t, au_emod_t); 276token_t *au_to_ipc(char, int); 277token_t *au_to_ipc_perm(kipc_perm_t *); 278token_t *au_to_iport(ushort_t); 279token_t *au_to_in_addr(struct in_addr *); 280token_t *au_to_in_addr_ex(int32_t *); 281token_t *au_to_ip(struct ip *); 282token_t *au_to_groups(const gid_t *, uint_t); 283token_t *au_to_path(struct audit_path *); 284token_t *au_to_seq(); 285token_t *au_to_process(uid_t, gid_t, uid_t, gid_t, pid_t, 286 au_id_t, au_asid_t, const au_tid_addr_t *); 287token_t *au_to_subject(uid_t, gid_t, uid_t, gid_t, pid_t, 288 au_id_t, au_asid_t, const au_tid_addr_t *); 289token_t *au_to_return32(int, int32_t); 290token_t *au_to_return64(int, int64_t); 291token_t *au_to_text(const char *); 292/* token_t *au_to_tid(au_generic_tid_t *); no kernel implementation */ 293token_t *au_to_trailer(int); 294token_t *au_to_uauth(char *); 295size_t au_zonename_length(void); 296token_t *au_to_zonename(size_t); 297token_t *au_to_arg32(char, char *, uint32_t); 298token_t *au_to_arg64(char, char *, uint64_t); 299token_t *au_to_socket(struct socket *); 300token_t *au_to_socket_ex(short, short, char *, char *); 301token_t *au_to_sock_inet(struct sockaddr_in *); 302token_t *au_to_exec_args(const char *, ssize_t); 303token_t *au_to_exec_env(const char *, ssize_t); 304token_t *au_to_label(bslabel_t *); 305token_t *au_to_privset(const char *, const priv_set_t *, char, int); 306 307void au_uwrite(); 308void au_close(au_kcontext_t *, caddr_t *, int, au_event_t, au_emod_t); 309void au_close_defer(token_t *, int, au_event_t, au_emod_t); 310void au_close_time(au_kcontext_t *, token_t *, int, au_event_t, au_emod_t, 311 timestruc_t *); 312void au_free_rec(au_buff_t *); 313void au_write(caddr_t *, token_t *); 314void au_mem_init(void); 315void au_zone_setup(); 316void au_enqueue(au_kcontext_t *, au_buff_t *, adr_t *, adr_t *, int, int); 317int au_doorio(au_kcontext_t *); 318int au_doormsg(au_kcontext_t *, uint32_t, void *); 319int au_doio(struct vnode *, int); 320int au_token_size(token_t *); 321int au_append_rec(au_buff_t *, au_buff_t *, int); 322int au_append_buf(const char *, int, au_buff_t *); 323 324#else /* !_KERNEL */ 325 326#include <limits.h> 327#include <sys/types.h> 328#include <sys/vnode.h> 329#include <netinet/in_systm.h> 330#include <netinet/in.h> 331#include <netinet/ip.h> 332#include <sys/ipc.h> 333 334struct token_s { 335 struct token_s *tt_next; /* Next in the list */ 336 short tt_size; /* Size of data */ 337 char *tt_data; /* The data */ 338}; 339typedef struct token_s token_t; 340 341struct au_arg32_tok { 342 uchar_t num; 343 uint32_t val; 344 ushort_t length; 345 char *data; 346}; 347typedef struct au_arg32_tok au_arg32_tok_t; 348 349struct au_acl_tok { 350 ulong_t type; 351 ulong_t id; 352 ulong_t mode; 353}; 354typedef struct au_acl_tok au_acl_tok_t; 355 356struct au_arg64_tok { 357 uchar_t num; 358 uint64_t val; 359 ushort_t length; 360 char *data; 361}; 362typedef struct au_arg64_tok au_arg64_tok_t; 363 364struct au_attr_tok { 365 uint_t mode; 366 uint_t uid; 367 uint_t gid; 368 int fs; 369 int32_t node; 370 uint32_t dev; 371}; 372typedef struct au_attr_tok au_attr_tok_t; 373 374struct au_attr32_tok { 375 uint_t mode; 376 uint_t uid; 377 uint_t gid; 378 int fs; 379 int64_t node; 380 uint32_t dev; 381}; 382typedef struct au_attr32_tok au_attr32_tok_t; 383 384struct au_attr64_tok { 385 uint_t mode; 386 uint_t uid; 387 uint_t gid; 388 int fs; 389 int64_t node; 390 uint64_t dev; 391}; 392typedef struct au_attr64_tok au_attr64_tok_t; 393 394struct au_data_tok { 395 uchar_t pfmt; 396 uchar_t size; 397 uchar_t number; 398 char *data; 399}; 400typedef struct au_data_tok au_data_tok_t; 401 402struct au_exit_tok { 403 int status; 404 int retval; 405}; 406typedef struct au_exit_tok au_exit_tok_t; 407 408struct au_file32_tok { 409 /* really struct timeval from gettimeofday() */ 410 int32_t sec; /* seconds since epoc */ 411 int32_t usec; /* microseconds */ 412 ushort_t length; 413 char *fname; 414}; 415typedef struct au_file32_tok au_file32_tok_t; 416 417struct au_file64_tok { 418 /* really struct timeval */ 419 int64_t sec; /* seconds since epoc */ 420 int64_t usec; /* microseconds */ 421 ushort_t length; 422 char *fname; 423}; 424typedef struct au_file64_tok au_file64_tok_t; 425 426 427struct au_groups_tok { 428 gid_t groups[NGROUPS_MAX]; 429}; 430typedef struct au_groups_tok au_groups_tok_t; 431 432struct au_header32_tok { 433 uint_t length; 434 uchar_t version; 435 au_event_t event; 436 ushort_t emod; 437 /* really timestruct_t (struct timespec) from hrestime */ 438 int32_t sec; /* seconds since epoc */ 439 int32_t nsec; /* nanoseconds */ 440}; 441typedef struct au_header32_tok au_header32_tok_t; 442 443struct au_header64_tok { 444 uint_t length; 445 uchar_t version; 446 au_event_t event; 447 ushort_t emod; 448 /* really timestruct_t (struct timespec) from hrestime */ 449 int64_t sec; /* seconds since epoc */ 450 int64_t nsec; /* nanoseconds */ 451}; 452typedef struct au_header64_tok au_header64_tok_t; 453 454struct au_inaddr_tok { 455 struct in_addr ia; 456}; 457typedef struct au_inaddr_tok au_inaddr_tok_t; 458 459struct au_ip_tok { 460 uchar_t version; 461 struct ip ip; 462}; 463typedef struct au_ip_tok au_ip_tok_t; 464 465struct au_ipc_tok { 466 key_t id; 467}; 468typedef struct au_ipc_tok au_ipc_tok_t; 469 470struct au_ipc_perm_tok { 471 struct ipc_perm ipc_perm; 472}; 473typedef struct au_ipc_perm_tok au_ipc_perm_tok_t; 474 475struct au_iport_tok { 476 ushort_t iport; 477}; 478typedef struct au_iport_tok au_iport_tok_t; 479 480struct au_invalid_tok { 481 ushort_t length; 482 char *data; 483}; 484typedef struct au_invalid_tok au_invalid_tok_t; 485 486struct au_opaque_tok { 487 ushort_t length; 488 char *data; 489}; 490typedef struct au_opaque_tok au_opaque_tok_t; 491 492struct au_path_tok { 493 ushort_t length; 494 char *name; 495}; 496typedef struct au_path_tok au_path_tok_t; 497 498struct au_tid32 { 499 uint32_t port; 500 uint32_t machine; 501}; 502typedef struct au_tid32 au_tid32_t; 503 504struct au_tid64 { 505 uint64_t port; 506 uint32_t machine; 507}; 508typedef struct au_tid64 au_tid64_t; 509 510struct au_proc32_tok { 511 au_id_t auid; 512 uid_t euid; 513 gid_t egid; 514 uid_t ruid; 515 gid_t rgid; 516 pid_t pid; 517 pid_t sid; 518 au_tid32_t tid; 519}; 520typedef struct au_proc32_tok au_proc32_tok_t; 521 522struct au_proc64_tok { 523 au_id_t auid; 524 uid_t euid; 525 gid_t egid; 526 uid_t ruid; 527 gid_t rgid; 528 pid_t pid; 529 pid_t sid; 530 au_tid64_t tid; 531}; 532typedef struct au_proc64_tok au_proc64_tok_t; 533 534struct au_ret32_tok { 535 uchar_t error; 536 uint32_t retval; 537}; 538typedef struct au_ret32_tok au_ret32_tok_t; 539 540struct au_ret64_tok { 541 uchar_t error; 542 uint64_t retval; 543}; 544typedef struct au_ret64_tok au_ret64_tok_t; 545 546struct au_seq_tok { 547 uint_t num; 548}; 549typedef struct au_seq_tok au_seq_tok_t; 550 551struct au_socket_tok { 552 short type; 553 ushort_t lport; 554 struct in_addr laddr; 555 ushort_t fport; 556 struct in_addr faddr; 557}; 558typedef struct au_socket_tok au_socket_tok_t; 559 560struct au_subj32_tok { 561 au_id_t auid; 562 uid_t euid; 563 gid_t egid; 564 uid_t ruid; 565 gid_t rgid; 566 pid_t pid; 567 pid_t sid; 568 au_tid32_t tid; 569}; 570typedef struct au_subj32_tok au_subj32_tok_t; 571 572struct au_subj64_tok { 573 au_id_t auid; 574 uid_t euid; 575 gid_t egid; 576 uid_t ruid; 577 gid_t rgid; 578 pid_t pid; 579 pid_t sid; 580 au_tid64_t tid; 581}; 582typedef struct au_subj64_tok au_subj64_tok_t; 583 584struct au_server_tok { 585 au_id_t auid; 586 uid_t euid; 587 uid_t ruid; 588 gid_t egid; 589 pid_t pid; 590}; 591typedef struct au_server_tok au_server_tok_t; 592 593struct au_text_tok { 594 ushort_t length; 595 char *data; 596}; 597typedef struct au_text_tok au_text_tok_t; 598 599struct au_trailer_tok { 600 ushort_t magic; 601 uint_t length; 602}; 603typedef struct au_trailer_tok au_trailer_tok_t; 604 605struct au_uauth_tok { 606 ushort_t length; 607 char *data; 608}; 609typedef struct au_uauth_tok au_uauth_tok_t; 610 611struct au_token { 612 char id; 613 struct au_token *next; 614 struct au_token *prev; 615 char *data; 616 ushort_t size; 617 union { 618 au_arg32_tok_t arg32; 619 au_arg64_tok_t arg64; 620 au_acl_tok_t acl; 621 au_attr32_tok_t attr32; 622 au_attr64_tok_t attr64; 623 au_data_tok_t data; 624 au_exit_tok_t exit; 625 au_file32_tok_t file32; 626 au_file64_tok_t file64; 627 au_groups_tok_t groups; 628 au_header32_tok_t header32; 629 au_header64_tok_t header64; 630 au_inaddr_tok_t inaddr; 631 au_ip_tok_t ip; 632 au_ipc_perm_tok_t ipc_perm; 633 au_ipc_tok_t ipc; 634 au_iport_tok_t iport; 635 au_invalid_tok_t invalid; 636 au_opaque_tok_t opaque; 637 au_path_tok_t path; 638 au_proc32_tok_t proc32; 639 au_proc64_tok_t proc64; 640 au_ret32_tok_t ret32; 641 au_ret64_tok_t ret64; 642 au_server_tok_t server; 643 au_seq_tok_t seq; 644 au_socket_tok_t socket; 645 au_subj32_tok_t subj32; 646 au_subj64_tok_t subj64; 647 au_text_tok_t text; 648 au_trailer_tok_t trailer; 649 au_uauth_tok_t useofauth; 650 } un; 651}; 652typedef struct au_token au_token_t; 653 654 655/* 656 * Old socket structure definition, formerly in <sys/socketvar.h> 657 */ 658struct oldsocket { 659 short so_type; /* generic type, see socket.h */ 660 short so_options; /* from socket call, see socket.h */ 661 short so_linger; /* time to linger while closing */ 662 short so_state; /* internal state flags SS_*, below */ 663 struct inpcb *so_pcb; /* protocol control block */ 664 struct protosw *so_proto; /* protocol handle */ 665/* 666 * Variables for connection queueing. 667 * Socket where accepts occur is so_head in all subsidiary sockets. 668 * If so_head is 0, socket is not related to an accept. 669 * For head socket so_q0 queues partially completed connections, 670 * while so_q is a queue of connections ready to be accepted. 671 * If a connection is aborted and it has so_head set, then 672 * it has to be pulled out of either so_q0 or so_q. 673 * We allow connections to queue up based on current queue lengths 674 * and limit on number of queued connections for this socket. 675 */ 676 struct oldsocket *so_head; /* back pointer to accept socket */ 677 struct oldsocket *so_q0; /* queue of partial connections */ 678 struct oldsocket *so_q; /* queue of incoming connections */ 679 short so_q0len; /* partials on so_q0 */ 680 short so_qlen; /* number of connections on so_q */ 681 short so_qlimit; /* max number queued connections */ 682 short so_timeo; /* connection timeout */ 683 ushort_t so_error; /* error affecting connection */ 684 short so_pgrp; /* pgrp for signals */ 685 ulong_t so_oobmark; /* chars to oob mark */ 686/* 687 * Variables for socket buffering. 688 */ 689 struct sockbuf { 690 ulong_t sb_cc; /* actual chars in buffer */ 691 ulong_t sb_hiwat; /* max actual char count */ 692 ulong_t sb_mbcnt; /* chars of mbufs used */ 693 ulong_t sb_mbmax; /* max chars of mbufs to use */ 694 ulong_t sb_lowat; /* low water mark (not used yet) */ 695 struct mbuf *sb_mb; /* the mbuf chain */ 696 struct proc *sb_sel; /* process selecting read/write */ 697 short sb_timeo; /* timeout (not used yet) */ 698 short sb_flags; /* flags, see below */ 699 } so_rcv, so_snd; 700/* 701 * Hooks for alternative wakeup strategies. 702 * These are used by kernel subsystems wishing to access the socket 703 * abstraction. If so_wupfunc is nonnull, it is called in place of 704 * wakeup any time that wakeup would otherwise be called with an 705 * argument whose value is an address lying within a socket structure. 706 */ 707 struct wupalt *so_wupalt; 708}; 709extern token_t *au_to_arg32(char, char *, uint32_t); 710extern token_t *au_to_arg64(char, char *, uint64_t); 711extern token_t *au_to_acl(struct acl *); 712extern token_t *au_to_attr(struct vattr *); 713extern token_t *au_to_cmd(uint_t, char **, char **); 714extern token_t *au_to_data(char, char, char, char *); 715extern token_t *au_to_exec_args(char **); 716extern token_t *au_to_exec_env(char **); 717extern token_t *au_to_exit(int, int); 718extern token_t *au_to_fmri(char *); 719extern token_t *au_to_groups(int *); 720extern token_t *au_to_newgroups(int, gid_t *); 721extern token_t *au_to_header(au_event_t, au_emod_t); 722extern token_t *au_to_header_ex(au_event_t, au_emod_t); 723extern token_t *au_to_in_addr(struct in_addr *); 724extern token_t *au_to_in_addr_ex(int32_t *); 725extern token_t *au_to_ipc(char, int); 726extern token_t *au_to_ipc_perm(struct ipc_perm *); 727extern token_t *au_to_iport(ushort_t); 728extern token_t *au_to_me(void); 729extern token_t *au_to_mylabel(void); 730extern token_t *au_to_opaque(char *, short); 731extern token_t *au_to_path(char *); 732extern token_t *au_to_privset(const char *, const priv_set_t *); 733extern token_t *au_to_process(au_id_t, uid_t, gid_t, uid_t, gid_t, 734 pid_t, au_asid_t, au_tid_t *); 735extern token_t *au_to_process_ex(au_id_t, uid_t, gid_t, uid_t, gid_t, 736 pid_t, au_asid_t, au_tid_addr_t *); 737extern token_t *au_to_return32(char, uint32_t); 738extern token_t *au_to_return64(char, uint64_t); 739extern token_t *au_to_seq(int); 740extern token_t *au_to_label(bslabel_t *); 741extern token_t *au_to_socket(struct oldsocket *); 742extern token_t *au_to_socket_ex(short, short, 743 struct sockaddr *, struct sockaddr *); 744extern token_t *au_to_sock_inet(struct sockaddr_in *); 745extern token_t *au_to_subject(au_id_t, uid_t, gid_t, uid_t, gid_t, 746 pid_t, au_asid_t, au_tid_t *); 747extern token_t *au_to_subject_ex(au_id_t, uid_t, gid_t, uid_t, gid_t, 748 pid_t, au_asid_t, au_tid_addr_t *); 749extern token_t *au_to_text(char *); 750extern token_t *au_to_tid(au_generic_tid_t *); 751extern token_t *au_to_trailer(void); 752extern token_t *au_to_uauth(char *); 753extern token_t *au_to_xatom(ushort_t, char *); 754extern token_t *au_to_xobj(int, int, int); 755extern token_t *au_to_xproto(pid_t); 756extern token_t *au_to_xselect(char *, char *, short, char *); 757extern token_t *au_to_zonename(char *); 758#endif /* _KERNEL */ 759 760#ifdef _KERNEL 761 762void adr_char(adr_t *, char *, int); 763void adr_int32(adr_t *, int32_t *, int); 764void adr_uint32(adr_t *, uint32_t *, int); 765void adr_int64(adr_t *, int64_t *, int); 766void adr_uint64(adr_t *, uint64_t *, int); 767void adr_short(adr_t *, short *, int); 768void adr_ushort(adr_t *, ushort_t *, int); 769void adr_start(adr_t *, char *); 770 771char *adr_getchar(adr_t *, char *); 772char *adr_getshort(adr_t *, short *); 773char *adr_getushort(adr_t *, ushort_t *); 774char *adr_getint32(adr_t *, int32_t *); 775char *adr_getuint32(adr_t *, uint32_t *); 776char *adr_getint64(adr_t *, int64_t *); 777char *adr_getuint64(adr_t *, uint64_t *); 778 779int adr_count(adr_t *); 780 781#endif /* _KERNEL */ 782 783#ifdef __cplusplus 784} 785#endif 786 787#endif /* _BSM_AUDIT_RECORD_H */ 788