sys/security/audit/audit_bsm.c

   1 /*
   2  * SPDX-License-Identifier: BSD-3-Clause
   3  *
   4  * Copyright (c) 1999-2009 Apple Inc.
   5  * Copyright (c) 2016-2017 Robert N. M. Watson
   6  * All rights reserved.
   7  *
   8  * Portions of this software were developed by BAE Systems, the University of
   9  * Cambridge Computer Laboratory, and Memorial University under DARPA/AFRL
  10  * contract FA8650-15-C-7558 ("CADETS"), as part of the DARPA Transparent
  11  * Computing (TC) research program.
  12  *
  13  * Redistribution and use in source and binary forms, with or without
  14  * modification, are permitted provided that the following conditions
  15  * are met:
  16  * 1.  Redistributions of source code must retain the above copyright
  17  *     notice, this list of conditions and the following disclaimer.
  18  * 2.  Redistributions in binary form must reproduce the above copyright
  19  *     notice, this list of conditions and the following disclaimer in the
  20  *     documentation and/or other materials provided with the distribution.
  21  * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
  22  *     its contributors may be used to endorse or promote products derived
  23  *     from this software without specific prior written permission.
  24  *
  25  * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND
  26  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  27  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  28  * ARE DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR
  29  * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  30  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  31  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  32  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
  33  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
  34  * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  35  * POSSIBILITY OF SUCH DAMAGE.
  36  */
  37
  38 #include <sys/cdefs.h>
  39 __FBSDID("$FreeBSD$");
  40
  41 #include <sys/param.h>
  42 #include <sys/vnode.h>
  43 #include <sys/ipc.h>
  44 #include <sys/lock.h>
  45 #include <sys/malloc.h>
  46 #include <sys/mutex.h>
  47 #include <sys/socket.h>
  48 #include <sys/extattr.h>
  49 #include <sys/fcntl.h>
  50 #include <sys/user.h>
  51 #include <sys/systm.h>
  52
  53 #include <bsm/audit.h>
  54 #include <bsm/audit_internal.h>
  55 #include <bsm/audit_record.h>
  56 #include <bsm/audit_kevents.h>
  57
  58 #include <security/audit/audit.h>
  59 #include <security/audit/audit_private.h>
  60
  61 #include <netinet/in_systm.h>
  62 #include <netinet/in.h>
  63 #include <netinet/ip.h>
  64
  65 MALLOC_DEFINE(M_AUDITBSM, "audit_bsm", "Audit BSM data");
  66
  67 static void     audit_sys_auditon(struct audit_record *ar,
  68                     struct au_record *rec);
  69
  70 /*
  71  * Initialize the BSM auditing subsystem.
  72  */
  73 void
  74 kau_init(void)
  75 {
  76
  77         au_evclassmap_init();
  78         au_evnamemap_init();
  79 }
  80
  81 /*
  82  * This call reserves memory for the audit record.  Memory must be guaranteed
  83  * before any auditable event can be generated.  The au_record structure
  84  * maintains a reference to the memory allocated above and also the list of
  85  * tokens associated with this record.
  86  */
  87 static struct au_record *
  88 kau_open(void)
  89 {
  90         struct au_record *rec;
  91
  92         rec = malloc(sizeof(*rec), M_AUDITBSM, M_WAITOK);
  93         rec->data = NULL;
  94         TAILQ_INIT(&rec->token_q);
  95         rec->len = 0;
  96         rec->used = 1;
  97
  98         return (rec);
  99 }
 100
 101 /*
 102  * Store the token with the record descriptor.
 103  */
 104 static void
 105 kau_write(struct au_record *rec, struct au_token *tok)
 106 {
 107
 108         KASSERT(tok != NULL, ("kau_write: tok == NULL"));
 109
 110         TAILQ_INSERT_TAIL(&rec->token_q, tok, tokens);
 111         rec->len += tok->len;
 112 }
 113
 114 /*
 115  * Close out the audit record by adding the header token, identifying any
 116  * missing tokens.  Write out the tokens to the record memory.
 117  */
 118 static void
 119 kau_close(struct au_record *rec, struct timespec *ctime, short event)
 120 {
 121         u_char *dptr;
 122         size_t tot_rec_size;
 123         token_t *cur, *hdr, *trail;
 124         struct timeval tm;
 125         size_t hdrsize;
 126         struct auditinfo_addr ak;
 127         struct in6_addr *ap;
 128
 129         audit_get_kinfo(&ak);
 130         hdrsize = 0;
 131         switch (ak.ai_termid.at_type) {
 132         case AU_IPv4:
 133                 hdrsize = (ak.ai_termid.at_addr[0] == INADDR_ANY) ?
 134                     AUDIT_HEADER_SIZE : AUDIT_HEADER_EX_SIZE(&ak);
 135                 break;
 136         case AU_IPv6:
 137                 ap = (struct in6_addr *)&ak.ai_termid.at_addr[0];
 138                 hdrsize = (IN6_IS_ADDR_UNSPECIFIED(ap)) ? AUDIT_HEADER_SIZE :
 139                     AUDIT_HEADER_EX_SIZE(&ak);
 140                 break;
 141         default:
 142                 panic("kau_close: invalid address family");
 143         }
 144         tot_rec_size = rec->len + hdrsize + AUDIT_TRAILER_SIZE;
 145         rec->data = malloc(tot_rec_size, M_AUDITBSM, M_WAITOK | M_ZERO);
 146
 147         tm.tv_usec = ctime->tv_nsec / 1000;
 148         tm.tv_sec = ctime->tv_sec;
 149         if (hdrsize != AUDIT_HEADER_SIZE)
 150                 hdr = au_to_header32_ex_tm(tot_rec_size, event, 0, tm, &ak);
 151         else
 152                 hdr = au_to_header32_tm(tot_rec_size, event, 0, tm);
 153         TAILQ_INSERT_HEAD(&rec->token_q, hdr, tokens);
 154
 155         trail = au_to_trailer(tot_rec_size);
 156         TAILQ_INSERT_TAIL(&rec->token_q, trail, tokens);
 157
 158         rec->len = tot_rec_size;
 159         dptr = rec->data;
 160         TAILQ_FOREACH(cur, &rec->token_q, tokens) {
 161                 memcpy(dptr, cur->t_data, cur->len);
 162                 dptr += cur->len;
 163         }
 164 }
 165
 166 /*
 167  * Free a BSM audit record by releasing all the tokens and clearing the audit
 168  * record information.
 169  */
 170 void
 171 kau_free(struct au_record *rec)
 172 {
 173         struct au_token *tok;
 174
 175         /* Free the token list. */
 176         while ((tok = TAILQ_FIRST(&rec->token_q))) {
 177                 TAILQ_REMOVE(&rec->token_q, tok, tokens);
 178                 free(tok->t_data, M_AUDITBSM);
 179                 free(tok, M_AUDITBSM);
 180         }
 181
 182         rec->used = 0;
 183         rec->len = 0;
 184         free(rec->data, M_AUDITBSM);
 185         free(rec, M_AUDITBSM);
 186 }
 187
 188 /*
 189  * XXX: May want turn some (or all) of these macros into functions in order
 190  * to reduce the generated code size.
 191  *
 192  * XXXAUDIT: These macros assume that 'kar', 'ar', 'rec', and 'tok' in the
 193  * caller are OK with this.
 194  */
 195 #define ATFD1_TOKENS(argnum) do {                                       \
 196         if (ARG_IS_VALID(kar, ARG_ATFD1)) {                             \
 197                 tok = au_to_arg32(argnum, "at fd 1", ar->ar_arg_atfd1); \
 198                 kau_write(rec, tok);                                    \
 199         }                                                               \
 200 } while (0)
 201
 202 #define ATFD2_TOKENS(argnum) do {                                       \
 203         if (ARG_IS_VALID(kar, ARG_ATFD2)) {                             \
 204                 tok = au_to_arg32(argnum, "at fd 2", ar->ar_arg_atfd2); \
 205                 kau_write(rec, tok);                                    \
 206         }                                                               \
 207 } while (0)
 208
 209 #define UPATH1_TOKENS do {                                              \
 210         if (ARG_IS_VALID(kar, ARG_UPATH1)) {                            \
 211                 tok = au_to_path(ar->ar_arg_upath1);                    \
 212                 kau_write(rec, tok);                                    \
 213         }                                                               \
 214 } while (0)
 215
 216 #define UPATH2_TOKENS do {                                              \
 217         if (ARG_IS_VALID(kar, ARG_UPATH2)) {                            \
 218                 tok = au_to_path(ar->ar_arg_upath2);                    \
 219                 kau_write(rec, tok);                                    \
 220         }                                                               \
 221 } while (0)
 222
 223 #define VNODE1_TOKENS do {                                              \
 224         if (ARG_IS_VALID(kar, ARG_ATFD)) {                              \
 225                 tok = au_to_arg32(1, "at fd", ar->ar_arg_atfd);         \
 226                 kau_write(rec, tok);                                    \
 227         }                                                               \
 228         if (ARG_IS_VALID(kar, ARG_VNODE1)) {                            \
 229                 tok = au_to_attr32(&ar->ar_arg_vnode1);                 \
 230                 kau_write(rec, tok);                                    \
 231         }                                                               \
 232 } while (0)
 233
 234 #define UPATH1_VNODE1_TOKENS do {                                       \
 235         UPATH1_TOKENS;                                                  \
 236         if (ARG_IS_VALID(kar, ARG_VNODE1)) {                            \
 237                 tok = au_to_attr32(&ar->ar_arg_vnode1);                 \
 238                 kau_write(rec, tok);                                    \
 239         }                                                               \
 240 } while (0)
 241
 242 #define VNODE2_TOKENS do {                                              \
 243         if (ARG_IS_VALID(kar, ARG_VNODE2)) {                            \
 244                 tok = au_to_attr32(&ar->ar_arg_vnode2);                 \
 245                 kau_write(rec, tok);                                    \
 246         }                                                               \
 247 } while (0)
 248
 249 #define FD_VNODE1_TOKENS do {                                           \
 250         if (ARG_IS_VALID(kar, ARG_VNODE1)) {                            \
 251                 if (ARG_IS_VALID(kar, ARG_FD)) {                        \
 252                         tok = au_to_arg32(1, "fd", ar->ar_arg_fd);      \
 253                         kau_write(rec, tok);                            \
 254                 }                                                       \
 255                 tok = au_to_attr32(&ar->ar_arg_vnode1);                 \
 256                 kau_write(rec, tok);                                    \
 257         } else {                                                        \
 258                 if (ARG_IS_VALID(kar, ARG_FD)) {                        \
 259                         tok = au_to_arg32(1, "non-file: fd",            \
 260                             ar->ar_arg_fd);                             \
 261                         kau_write(rec, tok);                            \
 262                 }                                                       \
 263         }                                                               \
 264 } while (0)
 265
 266 #define PROCESS_PID_TOKENS(argn) do {                                   \
 267         if ((ar->ar_arg_pid > 0) /* Reference a single process */       \
 268             && (ARG_IS_VALID(kar, ARG_PROCESS))) {                      \
 269                 tok = au_to_process32_ex(ar->ar_arg_auid,               \
 270                     ar->ar_arg_euid, ar->ar_arg_egid,                   \
 271                     ar->ar_arg_ruid, ar->ar_arg_rgid,                   \
 272                     ar->ar_arg_pid, ar->ar_arg_asid,                    \
 273                     &ar->ar_arg_termid_addr);                           \
 274                 kau_write(rec, tok);                                    \
 275         } else if (ARG_IS_VALID(kar, ARG_PID)) {                        \
 276                 tok = au_to_arg32(argn, "process", ar->ar_arg_pid);     \
 277                 kau_write(rec, tok);                                    \
 278         }                                                               \
 279 } while (0)
 280
 281 #define EXTATTR_TOKENS(namespace_argnum) do {                           \
 282         if (ARG_IS_VALID(kar, ARG_VALUE)) {                             \
 283                 switch (ar->ar_arg_value) {                             \
 284                 case EXTATTR_NAMESPACE_USER:                            \
 285                         tok = au_to_text(EXTATTR_NAMESPACE_USER_STRING);\
 286                         break;                                          \
 287                 case EXTATTR_NAMESPACE_SYSTEM:                          \
 288                         tok = au_to_text(EXTATTR_NAMESPACE_SYSTEM_STRING);\
 289                         break;                                          \
 290                 default:                                                \
 291                         tok = au_to_arg32((namespace_argnum),           \
 292                             "attrnamespace", ar->ar_arg_value);         \
 293                         break;                                          \
 294                 }                                                       \
 295                 kau_write(rec, tok);                                    \
 296         }                                                               \
 297         /* attrname is in the text field */                             \
 298         if (ARG_IS_VALID(kar, ARG_TEXT)) {                              \
 299                 tok = au_to_text(ar->ar_arg_text);                      \
 300                 kau_write(rec, tok);                                    \
 301         }                                                               \
 302 } while (0)
 303
 304 /*
 305  * Not all pointer arguments to system calls are of interest, but in some
 306  * cases they reflect delegation of rights, such as mmap(2) followed by
 307  * minherit(2) before execve(2), so do the best we can.
 308  */
 309 #define ADDR_TOKEN(argnum, argname) do {                                \
 310         if (ARG_IS_VALID(kar, ARG_ADDR)) {                              \
 311                 if (sizeof(void *) == sizeof(uint32_t))                 \
 312                         tok = au_to_arg32((argnum), (argname),          \
 313                             (uint32_t)(uintptr_t)ar->ar_arg_addr);      \
 314                 else                                                    \
 315                         tok = au_to_arg64((argnum), (argname),          \
 316                             (uint64_t)(uintptr_t)ar->ar_arg_addr);      \
 317                 kau_write(rec, tok);                                    \
 318         }                                                               \
 319 } while (0)
 320
 321
 322 /*
 323  * Implement auditing for the auditon() system call. The audit tokens that
 324  * are generated depend on the command that was sent into the auditon()
 325  * system call.
 326  */
 327 static void
 328 audit_sys_auditon(struct audit_record *ar, struct au_record *rec)
 329 {
 330         struct au_token *tok;
 331
 332         tok = au_to_arg32(3, "length", ar->ar_arg_len);
 333         kau_write(rec, tok);
 334         switch (ar->ar_arg_cmd) {
 335         case A_OLDSETPOLICY:
 336                 if ((size_t)ar->ar_arg_len == sizeof(int64_t)) {
 337                         tok = au_to_arg64(2, "policy",
 338                             ar->ar_arg_auditon.au_policy64);
 339                         kau_write(rec, tok);
 340                         break;
 341                 }
 342                 /* FALLTHROUGH */
 343
 344         case A_SETPOLICY:
 345                 tok = au_to_arg32(2, "policy", ar->ar_arg_auditon.au_policy);
 346                 kau_write(rec, tok);
 347                 break;
 348
 349         case A_SETKMASK:
 350                 tok = au_to_arg32(2, "setkmask:as_success",
 351                     ar->ar_arg_auditon.au_mask.am_success);
 352                 kau_write(rec, tok);
 353                 tok = au_to_arg32(2, "setkmask:as_failure",
 354                     ar->ar_arg_auditon.au_mask.am_failure);
 355                 kau_write(rec, tok);
 356                 break;
 357
 358         case A_OLDSETQCTRL:
 359                 if ((size_t)ar->ar_arg_len == sizeof(au_qctrl64_t)) {
 360                         tok = au_to_arg64(2, "setqctrl:aq_hiwater",
 361                             ar->ar_arg_auditon.au_qctrl64.aq64_hiwater);
 362                         kau_write(rec, tok);
 363                         tok = au_to_arg64(2, "setqctrl:aq_lowater",
 364                             ar->ar_arg_auditon.au_qctrl64.aq64_lowater);
 365                         kau_write(rec, tok);
 366                         tok = au_to_arg64(2, "setqctrl:aq_bufsz",
 367                             ar->ar_arg_auditon.au_qctrl64.aq64_bufsz);
 368                         kau_write(rec, tok);
 369                         tok = au_to_arg64(2, "setqctrl:aq_delay",
 370                             ar->ar_arg_auditon.au_qctrl64.aq64_delay);
 371                         kau_write(rec, tok);
 372                         tok = au_to_arg64(2, "setqctrl:aq_minfree",
 373                             ar->ar_arg_auditon.au_qctrl64.aq64_minfree);
 374                         kau_write(rec, tok);
 375                         break;
 376                 }
 377                 /* FALLTHROUGH */
 378
 379         case A_SETQCTRL:
 380                 tok = au_to_arg32(2, "setqctrl:aq_hiwater",
 381                     ar->ar_arg_auditon.au_qctrl.aq_hiwater);
 382                 kau_write(rec, tok);
 383                 tok = au_to_arg32(2, "setqctrl:aq_lowater",
 384                     ar->ar_arg_auditon.au_qctrl.aq_lowater);
 385                 kau_write(rec, tok);
 386                 tok = au_to_arg32(2, "setqctrl:aq_bufsz",
 387                     ar->ar_arg_auditon.au_qctrl.aq_bufsz);
 388                 kau_write(rec, tok);
 389                 tok = au_to_arg32(2, "setqctrl:aq_delay",
 390                     ar->ar_arg_auditon.au_qctrl.aq_delay);
 391                 kau_write(rec, tok);
 392                 tok = au_to_arg32(2, "setqctrl:aq_minfree",
 393                     ar->ar_arg_auditon.au_qctrl.aq_minfree);
 394                 kau_write(rec, tok);
 395                 break;
 396
 397         case A_SETUMASK:
 398                 tok = au_to_arg32(2, "setumask:as_success",
 399                     ar->ar_arg_auditon.au_auinfo.ai_mask.am_success);
 400                 kau_write(rec, tok);
 401                 tok = au_to_arg32(2, "setumask:as_failure",
 402                     ar->ar_arg_auditon.au_auinfo.ai_mask.am_failure);
 403                 kau_write(rec, tok);
 404                 break;
 405
 406         case A_SETSMASK:
 407                 tok = au_to_arg32(2, "setsmask:as_success",
 408                     ar->ar_arg_auditon.au_auinfo.ai_mask.am_success);
 409                 kau_write(rec, tok);
 410                 tok = au_to_arg32(2, "setsmask:as_failure",
 411                     ar->ar_arg_auditon.au_auinfo.ai_mask.am_failure);
 412                 kau_write(rec, tok);
 413                 break;
 414
 415         case A_OLDSETCOND:
 416                 if ((size_t)ar->ar_arg_len == sizeof(int64_t)) {
 417                         tok = au_to_arg64(2, "setcond",
 418                             ar->ar_arg_auditon.au_cond64);
 419                         kau_write(rec, tok);
 420                         break;
 421                 }
 422                 /* FALLTHROUGH */
 423
 424         case A_SETCOND:
 425                 tok = au_to_arg32(2, "setcond", ar->ar_arg_auditon.au_cond);
 426                 kau_write(rec, tok);
 427                 break;
 428
 429         case A_SETCLASS:
 430                 tok = au_to_arg32(2, "setclass:ec_event",
 431                     ar->ar_arg_auditon.au_evclass.ec_number);
 432                 kau_write(rec, tok);
 433                 tok = au_to_arg32(2, "setclass:ec_class",
 434                     ar->ar_arg_auditon.au_evclass.ec_class);
 435                 kau_write(rec, tok);
 436                 break;
 437
 438         case A_SETPMASK:
 439                 tok = au_to_arg32(2, "setpmask:as_success",
 440                     ar->ar_arg_auditon.au_aupinfo.ap_mask.am_success);
 441                 kau_write(rec, tok);
 442                 tok = au_to_arg32(2, "setpmask:as_failure",
 443                     ar->ar_arg_auditon.au_aupinfo.ap_mask.am_failure);
 444                 kau_write(rec, tok);
 445                 break;
 446
 447         case A_SETFSIZE:
 448                 tok = au_to_arg32(2, "setfsize:filesize",
 449                     ar->ar_arg_auditon.au_fstat.af_filesz);
 450                 kau_write(rec, tok);
 451                 break;
 452
 453         default:
 454                 break;
 455         }
 456 }
 457
 458 /*
 459  * Convert an internal kernel audit record to a BSM record and return a
 460  * success/failure indicator. The BSM record is passed as an out parameter to
 461  * this function.
 462  *
 463  * Return conditions:
 464  *   BSM_SUCCESS: The BSM record is valid
 465  *   BSM_FAILURE: Failure; the BSM record is NULL.
 466  *   BSM_NOAUDIT: The event is not auditable for BSM; the BSM record is NULL.
 467  */
 468 int
 469 kaudit_to_bsm(struct kaudit_record *kar, struct au_record **pau)
 470 {
 471         struct au_token *tok, *subj_tok, *jail_tok;
 472         struct au_record *rec;
 473         au_tid_t tid;
 474         struct audit_record *ar;
 475         int ctr;
 476
 477         KASSERT(kar != NULL, ("kaudit_to_bsm: kar == NULL"));
 478
 479         *pau = NULL;
 480         ar = &kar->k_ar;
 481         rec = kau_open();
 482
 483         /*
 484          * Create the subject token.  If this credential was jailed be sure to
 485          * generate a zonename token.
 486          */
 487         if (ar->ar_jailname[0] != '\0')
 488                 jail_tok = au_to_zonename(ar->ar_jailname);
 489         else
 490                 jail_tok = NULL;
 491         switch (ar->ar_subj_term_addr.at_type) {
 492         case AU_IPv4:
 493                 tid.port = ar->ar_subj_term_addr.at_port;
 494                 tid.machine = ar->ar_subj_term_addr.at_addr[0];
 495                 subj_tok = au_to_subject32(ar->ar_subj_auid,  /* audit ID */
 496                     ar->ar_subj_cred.cr_uid, /* eff uid */
 497                     ar->ar_subj_egid,   /* eff group id */
 498                     ar->ar_subj_ruid,   /* real uid */
 499                     ar->ar_subj_rgid,   /* real group id */
 500                     ar->ar_subj_pid,    /* process id */
 501                     ar->ar_subj_asid,   /* session ID */
 502                     &tid);
 503                 break;
 504         case AU_IPv6:
 505                 subj_tok = au_to_subject32_ex(ar->ar_subj_auid,
 506                     ar->ar_subj_cred.cr_uid,
 507                     ar->ar_subj_egid,
 508                     ar->ar_subj_ruid,
 509                     ar->ar_subj_rgid,
 510                     ar->ar_subj_pid,
 511                     ar->ar_subj_asid,
 512                     &ar->ar_subj_term_addr);
 513                 break;
 514         default:
 515                 bzero(&tid, sizeof(tid));
 516                 subj_tok = au_to_subject32(ar->ar_subj_auid,
 517                     ar->ar_subj_cred.cr_uid,
 518                     ar->ar_subj_egid,
 519                     ar->ar_subj_ruid,
 520                     ar->ar_subj_rgid,
 521                     ar->ar_subj_pid,
 522                     ar->ar_subj_asid,
 523                     &tid);
 524         }
 525
 526         /*
 527          * The logic inside each case fills in the tokens required for the
 528          * event, except for the header, trailer, and return tokens.  The
 529          * header and trailer tokens are added by the kau_close() function.
 530          * The return token is added outside of the switch statement.
 531          */
 532         switch(ar->ar_event) {
 533         case AUE_ACCEPT:
 534                 if (ARG_IS_VALID(kar, ARG_FD)) {
 535                         tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
 536                         kau_write(rec, tok);
 537                 }
 538                 if (ARG_IS_VALID(kar, ARG_SADDRINET)) {
 539                         tok = au_to_sock_inet((struct sockaddr_in *)
 540                             &ar->ar_arg_sockaddr);
 541                         kau_write(rec, tok);
 542                 }
 543                 if (ARG_IS_VALID(kar, ARG_SADDRUNIX)) {
 544                         tok = au_to_sock_unix((struct sockaddr_un *)
 545                             &ar->ar_arg_sockaddr);
 546                         kau_write(rec, tok);
 547                         UPATH1_TOKENS;
 548                 }
 549                 break;
 550
 551         case AUE_BIND:
 552         case AUE_LISTEN:
 553         case AUE_CONNECT:
 554         case AUE_RECV:
 555         case AUE_RECVFROM:
 556         case AUE_RECVMSG:
 557         case AUE_SEND:
 558         case AUE_SENDMSG:
 559         case AUE_SENDTO:
 560                 /*
 561                  * Socket-related events.
 562                  */
 563                 if (ARG_IS_VALID(kar, ARG_FD)) {
 564                         tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
 565                         kau_write(rec, tok);
 566                 }
 567                 if (ARG_IS_VALID(kar, ARG_SADDRINET)) {
 568                         tok = au_to_sock_inet((struct sockaddr_in *)
 569                             &ar->ar_arg_sockaddr);
 570                         kau_write(rec, tok);
 571                 }
 572                 if (ARG_IS_VALID(kar, ARG_SADDRUNIX)) {
 573                         tok = au_to_sock_unix((struct sockaddr_un *)
 574                             &ar->ar_arg_sockaddr);
 575                         kau_write(rec, tok);
 576                         UPATH1_TOKENS;
 577                 }
 578                 /* XXX Need to handle ARG_SADDRINET6 */
 579                 break;
 580
 581         case AUE_BINDAT:
 582         case AUE_CONNECTAT:
 583                 ATFD1_TOKENS(1);
 584                 if (ARG_IS_VALID(kar, ARG_FD)) {
 585                         tok = au_to_arg32(2, "fd", ar->ar_arg_fd);
 586                         kau_write(rec, tok);
 587                 }
 588                 if (ARG_IS_VALID(kar, ARG_SADDRUNIX)) {
 589                         tok = au_to_sock_unix((struct sockaddr_un *)
 590                             &ar->ar_arg_sockaddr);
 591                         kau_write(rec, tok);
 592                         UPATH1_TOKENS;
 593                 }
 594                 break;
 595
 596         case AUE_SENDFILE:
 597                 FD_VNODE1_TOKENS;
 598                 if (ARG_IS_VALID(kar, ARG_SADDRINET)) {
 599                         tok = au_to_sock_inet((struct sockaddr_in *)
 600                             &ar->ar_arg_sockaddr);
 601                         kau_write(rec, tok);
 602                 }
 603                 if (ARG_IS_VALID(kar, ARG_SADDRUNIX)) {
 604                         tok = au_to_sock_unix((struct sockaddr_un *)
 605                             &ar->ar_arg_sockaddr);
 606                         kau_write(rec, tok);
 607                         UPATH1_TOKENS;
 608                 }
 609                 /* XXX Need to handle ARG_SADDRINET6 */
 610                 break;
 611
 612         case AUE_SOCKET:
 613         case AUE_SOCKETPAIR:
 614                 if (ARG_IS_VALID(kar, ARG_SOCKINFO)) {
 615                         tok = au_to_arg32(1, "domain",
 616                             ar->ar_arg_sockinfo.so_domain);
 617                         kau_write(rec, tok);
 618                         tok = au_to_arg32(2, "type",
 619                             ar->ar_arg_sockinfo.so_type);
 620                         kau_write(rec, tok);
 621                         tok = au_to_arg32(3, "protocol",
 622                             ar->ar_arg_sockinfo.so_protocol);
 623                         kau_write(rec, tok);
 624                 }
 625                 break;
 626
 627         case AUE_SETSOCKOPT:
 628         case AUE_SHUTDOWN:
 629                 if (ARG_IS_VALID(kar, ARG_FD)) {
 630                         tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
 631                         kau_write(rec, tok);
 632                 }
 633                 break;
 634
 635         case AUE_ACCT:
 636                 if (ARG_IS_VALID(kar, ARG_UPATH1)) {
 637                         UPATH1_VNODE1_TOKENS;
 638                 } else {
 639                         tok = au_to_arg32(1, "accounting off", 0);
 640                         kau_write(rec, tok);
 641                 }
 642                 break;
 643
 644         case AUE_SETAUID:
 645                 if (ARG_IS_VALID(kar, ARG_AUID)) {
 646                         tok = au_to_arg32(2, "setauid", ar->ar_arg_auid);
 647                         kau_write(rec, tok);
 648                 }
 649                 break;
 650
 651         case AUE_SETAUDIT:
 652                 if (ARG_IS_VALID(kar, ARG_AUID) &&
 653                     ARG_IS_VALID(kar, ARG_ASID) &&
 654                     ARG_IS_VALID(kar, ARG_AMASK) &&
 655                     ARG_IS_VALID(kar, ARG_TERMID)) {
 656                         tok = au_to_arg32(1, "setaudit:auid",
 657                             ar->ar_arg_auid);
 658                         kau_write(rec, tok);
 659                         tok = au_to_arg32(1, "setaudit:port",
 660                             ar->ar_arg_termid.port);
 661                         kau_write(rec, tok);
 662                         tok = au_to_arg32(1, "setaudit:machine",
 663                             ar->ar_arg_termid.machine);
 664                         kau_write(rec, tok);
 665                         tok = au_to_arg32(1, "setaudit:as_success",
 666                             ar->ar_arg_amask.am_success);
 667                         kau_write(rec, tok);
 668                         tok = au_to_arg32(1, "setaudit:as_failure",
 669                             ar->ar_arg_amask.am_failure);
 670                         kau_write(rec, tok);
 671                         tok = au_to_arg32(1, "setaudit:asid",
 672                             ar->ar_arg_asid);
 673                         kau_write(rec, tok);
 674                 }
 675                 break;
 676
 677         case AUE_SETAUDIT_ADDR:
 678                 if (ARG_IS_VALID(kar, ARG_AUID) &&
 679                     ARG_IS_VALID(kar, ARG_ASID) &&
 680                     ARG_IS_VALID(kar, ARG_AMASK) &&
 681                     ARG_IS_VALID(kar, ARG_TERMID_ADDR)) {
 682                         tok = au_to_arg32(1, "setaudit_addr:auid",
 683                             ar->ar_arg_auid);
 684                         kau_write(rec, tok);
 685                         tok = au_to_arg32(1, "setaudit_addr:as_success",
 686                             ar->ar_arg_amask.am_success);
 687                         kau_write(rec, tok);
 688                         tok = au_to_arg32(1, "setaudit_addr:as_failure",
 689                             ar->ar_arg_amask.am_failure);
 690                         kau_write(rec, tok);
 691                         tok = au_to_arg32(1, "setaudit_addr:asid",
 692                             ar->ar_arg_asid);
 693                         kau_write(rec, tok);
 694                         tok = au_to_arg32(1, "setaudit_addr:type",
 695                             ar->ar_arg_termid_addr.at_type);
 696                         kau_write(rec, tok);
 697                         tok = au_to_arg32(1, "setaudit_addr:port",
 698                             ar->ar_arg_termid_addr.at_port);
 699                         kau_write(rec, tok);
 700                         if (ar->ar_arg_termid_addr.at_type == AU_IPv6)
 701                                 tok = au_to_in_addr_ex((struct in6_addr *)
 702                                     &ar->ar_arg_termid_addr.at_addr[0]);
 703                         if (ar->ar_arg_termid_addr.at_type == AU_IPv4)
 704                                 tok = au_to_in_addr((struct in_addr *)
 705                                     &ar->ar_arg_termid_addr.at_addr[0]);
 706                         kau_write(rec, tok);
 707                 }
 708                 break;
 709
 710         case AUE_AUDITON:
 711                 /*
 712                  * For AUDITON commands without own event, audit the cmd.
 713                  */
 714                 if (ARG_IS_VALID(kar, ARG_CMD)) {
 715                         tok = au_to_arg32(1, "cmd", ar->ar_arg_cmd);
 716                         kau_write(rec, tok);
 717                 }
 718                 /* FALLTHROUGH */
 719
 720         case AUE_AUDITON_GETCAR:
 721         case AUE_AUDITON_GETCLASS:
 722         case AUE_AUDITON_GETCOND:
 723         case AUE_AUDITON_GETCWD:
 724         case AUE_AUDITON_GETKMASK:
 725         case AUE_AUDITON_GETSTAT:
 726         case AUE_AUDITON_GPOLICY:
 727         case AUE_AUDITON_GQCTRL:
 728         case AUE_AUDITON_SETCLASS:
 729         case AUE_AUDITON_SETCOND:
 730         case AUE_AUDITON_SETKMASK:
 731         case AUE_AUDITON_SETSMASK:
 732         case AUE_AUDITON_SETSTAT:
 733         case AUE_AUDITON_SETUMASK:
 734         case AUE_AUDITON_SPOLICY:
 735         case AUE_AUDITON_SQCTRL:
 736                 if (ARG_IS_VALID(kar, ARG_AUDITON))
 737                         audit_sys_auditon(ar, rec);
 738                 break;
 739
 740         case AUE_AUDITCTL:
 741                 UPATH1_VNODE1_TOKENS;
 742                 break;
 743
 744         case AUE_EXIT:
 745                 if (ARG_IS_VALID(kar, ARG_EXIT)) {
 746                         tok = au_to_exit(ar->ar_arg_exitretval,
 747                             ar->ar_arg_exitstatus);
 748                         kau_write(rec, tok);
 749                 }
 750                 break;
 751
 752         case AUE_ADJTIME:
 753         case AUE_CLOCK_SETTIME:
 754         case AUE_AUDIT:
 755         case AUE_DUP2:
 756         case AUE_GETAUDIT:
 757         case AUE_GETAUDIT_ADDR:
 758         case AUE_GETAUID:
 759         case AUE_GETCWD:
 760         case AUE_GETFSSTAT:
 761         case AUE_GETRESUID:
 762         case AUE_GETRESGID:
 763         case AUE_KQUEUE:
 764         case AUE_MODLOAD:
 765         case AUE_MODUNLOAD:
 766         case AUE_MSGSYS:
 767         case AUE_NTP_ADJTIME:
 768         case AUE_PIPE:
 769         case AUE_POSIX_OPENPT:
 770         case AUE_PROFILE:
 771         case AUE_RTPRIO:
 772         case AUE_SEMSYS:
 773         case AUE_SETFIB:
 774         case AUE_SHMSYS:
 775         case AUE_SETPGRP:
 776         case AUE_SETRLIMIT:
 777         case AUE_SETSID:
 778         case AUE_SETTIMEOFDAY:
 779         case AUE_SYSARCH:
 780
 781                 /*
 782                  * Header, subject, and return tokens added at end.
 783                  */
 784                 break;
 785
 786         case AUE_ACL_DELETE_FD:
 787         case AUE_ACL_DELETE_FILE:
 788         case AUE_ACL_CHECK_FD:
 789         case AUE_ACL_CHECK_FILE:
 790         case AUE_ACL_CHECK_LINK:
 791         case AUE_ACL_DELETE_LINK:
 792         case AUE_ACL_GET_FD:
 793         case AUE_ACL_GET_FILE:
 794         case AUE_ACL_GET_LINK:
 795         case AUE_ACL_SET_FD:
 796         case AUE_ACL_SET_FILE:
 797         case AUE_ACL_SET_LINK:
 798                 if (ARG_IS_VALID(kar, ARG_VALUE)) {
 799                         tok = au_to_arg32(1, "type", ar->ar_arg_value);
 800                         kau_write(rec, tok);
 801                 }
 802                 ATFD1_TOKENS(1);
 803                 UPATH1_VNODE1_TOKENS;
 804                 break;
 805
 806         case AUE_CHDIR:
 807         case AUE_CHROOT:
 808         case AUE_FSTATAT:
 809         case AUE_FUTIMESAT:
 810         case AUE_GETATTRLIST:
 811         case AUE_JAIL:
 812         case AUE_LUTIMES:
 813         case AUE_NFS_GETFH:
 814         case AUE_LGETFH:
 815         case AUE_LSTAT:
 816         case AUE_LPATHCONF:
 817         case AUE_PATHCONF:
 818         case AUE_READLINK:
 819         case AUE_READLINKAT:
 820         case AUE_REVOKE:
 821         case AUE_RMDIR:
 822         case AUE_SEARCHFS:
 823         case AUE_SETATTRLIST:
 824         case AUE_STAT:
 825         case AUE_STATFS:
 826         case AUE_SWAPON:
 827         case AUE_SWAPOFF:
 828         case AUE_TRUNCATE:
 829         case AUE_UNDELETE:
 830         case AUE_UNLINK:
 831         case AUE_UNLINKAT:
 832         case AUE_UTIMES:
 833         case AUE_REALPATHAT:
 834                 ATFD1_TOKENS(1);
 835                 UPATH1_VNODE1_TOKENS;
 836                 break;
 837
 838         case AUE_ACCESS:
 839         case AUE_EACCESS:
 840         case AUE_FACCESSAT:
 841                 ATFD1_TOKENS(1);
 842                 UPATH1_VNODE1_TOKENS;
 843                 if (ARG_IS_VALID(kar, ARG_VALUE)) {
 844                         tok = au_to_arg32(2, "mode", ar->ar_arg_value);
 845                         kau_write(rec, tok);
 846                 }
 847                 break;
 848
 849         case AUE_FHSTATFS:
 850         case AUE_FHOPEN:
 851         case AUE_FHSTAT:
 852                 /* XXXRW: Need to audit vnode argument. */
 853                 break;
 854
 855         case AUE_CHFLAGS:
 856         case AUE_LCHFLAGS:
 857         case AUE_CHFLAGSAT:
 858                 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
 859                         tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
 860                         kau_write(rec, tok);
 861                 }
 862                 UPATH1_VNODE1_TOKENS;
 863                 break;
 864
 865         case AUE_CHMOD:
 866         case AUE_LCHMOD:
 867                 if (ARG_IS_VALID(kar, ARG_MODE)) {
 868                         tok = au_to_arg32(2, "new file mode",
 869                             ar->ar_arg_mode);
 870                         kau_write(rec, tok);
 871                 }
 872                 UPATH1_VNODE1_TOKENS;
 873                 break;
 874
 875         case AUE_FCHMODAT:
 876                 ATFD1_TOKENS(1);
 877                 if (ARG_IS_VALID(kar, ARG_MODE)) {
 878                         tok = au_to_arg32(3, "new file mode",
 879                             ar->ar_arg_mode);
 880                         kau_write(rec, tok);
 881                 }
 882                 UPATH1_VNODE1_TOKENS;
 883                 break;
 884
 885         case AUE_CHOWN:
 886         case AUE_LCHOWN:
 887                 if (ARG_IS_VALID(kar, ARG_UID)) {
 888                         tok = au_to_arg32(2, "new file uid", ar->ar_arg_uid);
 889                         kau_write(rec, tok);
 890                 }
 891                 if (ARG_IS_VALID(kar, ARG_GID)) {
 892                         tok = au_to_arg32(3, "new file gid", ar->ar_arg_gid);
 893                         kau_write(rec, tok);
 894                 }
 895                 UPATH1_VNODE1_TOKENS;
 896                 break;
 897
 898         case AUE_FCHOWNAT:
 899                 ATFD1_TOKENS(1);
 900                 if (ARG_IS_VALID(kar, ARG_UID)) {
 901                         tok = au_to_arg32(3, "new file uid", ar->ar_arg_uid);
 902                         kau_write(rec, tok);
 903                 }
 904                 if (ARG_IS_VALID(kar, ARG_GID)) {
 905                         tok = au_to_arg32(4, "new file gid", ar->ar_arg_gid);
 906                         kau_write(rec, tok);
 907                 }
 908                 UPATH1_VNODE1_TOKENS;
 909                 break;
 910
 911         case AUE_EXCHANGEDATA:
 912                 UPATH1_VNODE1_TOKENS;
 913                 UPATH2_TOKENS;
 914                 break;
 915
 916         case AUE_CLOSE:
 917                 if (ARG_IS_VALID(kar, ARG_FD)) {
 918                         tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
 919                         kau_write(rec, tok);
 920                 }
 921                 UPATH1_VNODE1_TOKENS;
 922                 break;
 923
 924         case AUE_CLOSEFROM:
 925                 if (ARG_IS_VALID(kar, ARG_FD)) {
 926                         tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
 927                         kau_write(rec, tok);
 928                 }
 929                 break;
 930
 931         case AUE_CORE:
 932                 if (ARG_IS_VALID(kar, ARG_SIGNUM)) {
 933                         tok = au_to_arg32(1, "signal", ar->ar_arg_signum);
 934                         kau_write(rec, tok);
 935                 }
 936                 UPATH1_VNODE1_TOKENS;
 937                 break;
 938
 939         case AUE_EXTATTRCTL:
 940                 UPATH1_VNODE1_TOKENS;
 941                 if (ARG_IS_VALID(kar, ARG_CMD)) {
 942                         tok = au_to_arg32(2, "cmd", ar->ar_arg_cmd);
 943                         kau_write(rec, tok);
 944                 }
 945                 /* extattrctl(2) filename parameter is in upath2/vnode2 */
 946                 UPATH2_TOKENS;
 947                 VNODE2_TOKENS;
 948                 EXTATTR_TOKENS(4);
 949                 break;
 950
 951         case AUE_EXTATTR_GET_FILE:
 952         case AUE_EXTATTR_SET_FILE:
 953         case AUE_EXTATTR_LIST_FILE:
 954         case AUE_EXTATTR_DELETE_FILE:
 955         case AUE_EXTATTR_GET_LINK:
 956         case AUE_EXTATTR_SET_LINK:
 957         case AUE_EXTATTR_LIST_LINK:
 958         case AUE_EXTATTR_DELETE_LINK:
 959                 UPATH1_VNODE1_TOKENS;
 960                 EXTATTR_TOKENS(2);
 961                 break;
 962
 963         case AUE_EXTATTR_GET_FD:
 964         case AUE_EXTATTR_SET_FD:
 965         case AUE_EXTATTR_LIST_FD:
 966         case AUE_EXTATTR_DELETE_FD:
 967                 if (ARG_IS_VALID(kar, ARG_FD)) {
 968                         tok = au_to_arg32(2, "fd", ar->ar_arg_fd);
 969                         kau_write(rec, tok);
 970                 }
 971                 EXTATTR_TOKENS(2);
 972                 break;
 973
 974         case AUE_FEXECVE:
 975                 if (ARG_IS_VALID(kar, ARG_FD)) {
 976                         tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
 977                         kau_write(rec, tok);
 978                 }
 979                 /* FALLTHROUGH */
 980
 981         case AUE_EXECVE:
 982         case AUE_MAC_EXECVE:
 983                 if (ARG_IS_VALID(kar, ARG_ARGV)) {
 984                         tok = au_to_exec_args(ar->ar_arg_argv,
 985                             ar->ar_arg_argc);
 986                         kau_write(rec, tok);
 987                 }
 988                 if (ARG_IS_VALID(kar, ARG_ENVV)) {
 989                         tok = au_to_exec_env(ar->ar_arg_envv,
 990                             ar->ar_arg_envc);
 991                         kau_write(rec, tok);
 992                 }
 993                 UPATH1_VNODE1_TOKENS;
 994                 break;
 995
 996         case AUE_FCHMOD:
 997                 if (ARG_IS_VALID(kar, ARG_MODE)) {
 998                         tok = au_to_arg32(2, "new file mode",
 999                             ar->ar_arg_mode);
1000                         kau_write(rec, tok);
1001                 }
1002                 FD_VNODE1_TOKENS;
1003                 break;
1004
1005         /*
1006          * XXXRW: Some of these need to handle non-vnode cases as well.
1007          */
1008         case AUE_FCHDIR:
1009         case AUE_FPATHCONF:
1010         case AUE_FSTAT:
1011         case AUE_FSTATFS:
1012         case AUE_FSYNC:
1013         case AUE_FTRUNCATE:
1014         case AUE_FUTIMES:
1015         case AUE_GETDIRENTRIES:
1016         case AUE_GETDIRENTRIESATTR:
1017         case AUE_LSEEK:
1018         case AUE_POLL:
1019         case AUE_POSIX_FALLOCATE:
1020         case AUE_PREAD:
1021         case AUE_PWRITE:
1022         case AUE_READ:
1023         case AUE_READV:
1024         case AUE_WRITE:
1025         case AUE_WRITEV:
1026                 FD_VNODE1_TOKENS;
1027                 break;
1028
1029         case AUE_FCHOWN:
1030                 if (ARG_IS_VALID(kar, ARG_UID)) {
1031                         tok = au_to_arg32(2, "new file uid", ar->ar_arg_uid);
1032                         kau_write(rec, tok);
1033                 }
1034                 if (ARG_IS_VALID(kar, ARG_GID)) {
1035                         tok = au_to_arg32(3, "new file gid", ar->ar_arg_gid);
1036                         kau_write(rec, tok);
1037                 }
1038                 FD_VNODE1_TOKENS;
1039                 break;
1040
1041         case AUE_FCNTL:
1042                 if (ARG_IS_VALID(kar, ARG_CMD)) {
1043                         tok = au_to_arg32(2, "cmd",
1044                             au_fcntl_cmd_to_bsm(ar->ar_arg_cmd));
1045                         kau_write(rec, tok);
1046                 }
1047                 FD_VNODE1_TOKENS;
1048                 break;
1049
1050         case AUE_FCHFLAGS:
1051                 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1052                         tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
1053                         kau_write(rec, tok);
1054                 }
1055                 FD_VNODE1_TOKENS;
1056                 break;
1057
1058         case AUE_FLOCK:
1059                 if (ARG_IS_VALID(kar, ARG_CMD)) {
1060                         tok = au_to_arg32(2, "operation", ar->ar_arg_cmd);
1061                         kau_write(rec, tok);
1062                 }
1063                 FD_VNODE1_TOKENS;
1064                 break;
1065
1066         case AUE_RFORK:
1067                 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1068                         tok = au_to_arg32(1, "flags", ar->ar_arg_fflags);
1069                         kau_write(rec, tok);
1070                 }
1071                 /* FALLTHROUGH */
1072
1073         case AUE_FORK:
1074         case AUE_VFORK:
1075                 if (ARG_IS_VALID(kar, ARG_PID)) {
1076                         tok = au_to_arg32(0, "child PID", ar->ar_arg_pid);
1077                         kau_write(rec, tok);
1078                 }
1079                 break;
1080
1081         case AUE_IOCTL:
1082                 if (ARG_IS_VALID(kar, ARG_CMD)) {
1083                         tok = au_to_arg32(2, "cmd", ar->ar_arg_cmd);
1084                         kau_write(rec, tok);
1085                 }
1086                 if (ARG_IS_VALID(kar, ARG_VNODE1))
1087                         FD_VNODE1_TOKENS;
1088                 else {
1089                         if (ARG_IS_VALID(kar, ARG_SOCKINFO)) {
1090                                 tok = kau_to_socket(&ar->ar_arg_sockinfo);
1091                                 kau_write(rec, tok);
1092                         } else {
1093                                 if (ARG_IS_VALID(kar, ARG_FD)) {
1094                                         tok = au_to_arg32(1, "fd",
1095                                             ar->ar_arg_fd);
1096                                         kau_write(rec, tok);
1097                                 }
1098                         }
1099                 }
1100                 break;
1101
1102         case AUE_KILL:
1103         case AUE_KILLPG:
1104                 if (ARG_IS_VALID(kar, ARG_SIGNUM)) {
1105                         tok = au_to_arg32(2, "signal", ar->ar_arg_signum);
1106                         kau_write(rec, tok);
1107                 }
1108                 PROCESS_PID_TOKENS(1);
1109                 break;
1110
1111         case AUE_KTRACE:
1112                 if (ARG_IS_VALID(kar, ARG_CMD)) {
1113                         tok = au_to_arg32(2, "ops", ar->ar_arg_cmd);
1114                         kau_write(rec, tok);
1115                 }
1116                 if (ARG_IS_VALID(kar, ARG_VALUE)) {
1117                         tok = au_to_arg32(3, "trpoints", ar->ar_arg_value);
1118                         kau_write(rec, tok);
1119                 }
1120                 PROCESS_PID_TOKENS(4);
1121                 UPATH1_VNODE1_TOKENS;
1122                 break;
1123
1124         case AUE_LINK:
1125         case AUE_LINKAT:
1126         case AUE_RENAME:
1127         case AUE_RENAMEAT:
1128                 ATFD1_TOKENS(1);
1129                 UPATH1_VNODE1_TOKENS;
1130                 ATFD2_TOKENS(3);
1131                 UPATH2_TOKENS;
1132                 break;
1133
1134         case AUE_LOADSHFILE:
1135                 ADDR_TOKEN(4, "base addr");
1136                 UPATH1_VNODE1_TOKENS;
1137                 break;
1138
1139         case AUE_MKDIR:
1140         case AUE_MKDIRAT:
1141         case AUE_MKFIFO:
1142         case AUE_MKFIFOAT:
1143                 ATFD1_TOKENS(1);
1144                 if (ARG_IS_VALID(kar, ARG_MODE)) {
1145                         tok = au_to_arg32(2, "mode", ar->ar_arg_mode);
1146                         kau_write(rec, tok);
1147                 }
1148                 UPATH1_VNODE1_TOKENS;
1149                 break;
1150
1151         case AUE_MKNOD:
1152         case AUE_MKNODAT:
1153                 ATFD1_TOKENS(1);
1154                 if (ARG_IS_VALID(kar, ARG_MODE)) {
1155                         tok = au_to_arg32(2, "mode", ar->ar_arg_mode);
1156                         kau_write(rec, tok);
1157                 }
1158                 if (ARG_IS_VALID(kar, ARG_DEV)) {
1159                         tok = au_to_arg32(3, "dev", ar->ar_arg_dev);
1160                         kau_write(rec, tok);
1161                 }
1162                 UPATH1_VNODE1_TOKENS;
1163                 break;
1164
1165         case AUE_MMAP:
1166         case AUE_MUNMAP:
1167         case AUE_MPROTECT:
1168         case AUE_MLOCK:
1169         case AUE_MUNLOCK:
1170         case AUE_MINHERIT:
1171                 ADDR_TOKEN(1, "addr");
1172                 if (ARG_IS_VALID(kar, ARG_LEN)) {
1173                         tok = au_to_arg32(2, "len", ar->ar_arg_len);
1174                         kau_write(rec, tok);
1175                 }
1176                 if (ar->ar_event == AUE_MMAP)
1177                         FD_VNODE1_TOKENS;
1178                 if (ar->ar_event == AUE_MPROTECT) {
1179                         if (ARG_IS_VALID(kar, ARG_VALUE)) {
1180                                 tok = au_to_arg32(3, "protection",
1181                                     ar->ar_arg_value);
1182                                 kau_write(rec, tok);
1183                         }
1184                 }
1185                 if (ar->ar_event == AUE_MINHERIT) {
1186                         if (ARG_IS_VALID(kar, ARG_VALUE)) {
1187                                 tok = au_to_arg32(3, "inherit",
1188                                     ar->ar_arg_value);
1189                                 kau_write(rec, tok);
1190                         }
1191                 }
1192                 break;
1193
1194         case AUE_MOUNT:
1195         case AUE_NMOUNT:
1196                 /* XXX Need to handle NFS mounts */
1197                 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1198                         tok = au_to_arg32(3, "flags", ar->ar_arg_fflags);
1199                         kau_write(rec, tok);
1200                 }
1201                 if (ARG_IS_VALID(kar, ARG_TEXT)) {
1202                         tok = au_to_text(ar->ar_arg_text);
1203                         kau_write(rec, tok);
1204                 }
1205                 /* FALLTHROUGH */
1206
1207         case AUE_NFS_SVC:
1208                 if (ARG_IS_VALID(kar, ARG_CMD)) {
1209                         tok = au_to_arg32(1, "flags", ar->ar_arg_cmd);
1210                         kau_write(rec, tok);
1211                 }
1212                 break;
1213
1214         case AUE_UMOUNT:
1215                 if (ARG_IS_VALID(kar, ARG_VALUE)) {
1216                         tok = au_to_arg32(2, "flags", ar->ar_arg_value);
1217                         kau_write(rec, tok);
1218                 }
1219                 UPATH1_VNODE1_TOKENS;
1220                 if (ARG_IS_VALID(kar, ARG_TEXT)) {
1221                         tok = au_to_text(ar->ar_arg_text);
1222                         kau_write(rec, tok);
1223                 }
1224                 break;
1225
1226         case AUE_MSGCTL:
1227                 ar->ar_event = audit_msgctl_to_event(ar->ar_arg_svipc_cmd);
1228                 /* Fall through */
1229
1230         case AUE_MSGRCV:
1231         case AUE_MSGSND:
1232                 tok = au_to_arg32(1, "msg ID", ar->ar_arg_svipc_id);
1233                 kau_write(rec, tok);
1234                 if (ar->ar_errno != EINVAL) {
1235                         tok = au_to_ipc(AT_IPC_MSG, ar->ar_arg_svipc_id);
1236                         kau_write(rec, tok);
1237                 }
1238                 break;
1239
1240         case AUE_MSGGET:
1241                 if (ar->ar_errno == 0) {
1242                         if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
1243                                 tok = au_to_ipc(AT_IPC_MSG,
1244                                     ar->ar_arg_svipc_id);
1245                                 kau_write(rec, tok);
1246                         }
1247                 }
1248                 break;
1249
1250         case AUE_RESETSHFILE:
1251                 ADDR_TOKEN(1, "base addr");
1252                 break;
1253
1254         case AUE_OPEN_RC:
1255         case AUE_OPEN_RTC:
1256         case AUE_OPEN_RWC:
1257         case AUE_OPEN_RWTC:
1258         case AUE_OPEN_WC:
1259         case AUE_OPEN_WTC:
1260         case AUE_CREAT:
1261                 if (ARG_IS_VALID(kar, ARG_MODE)) {
1262                         tok = au_to_arg32(3, "mode", ar->ar_arg_mode);
1263                         kau_write(rec, tok);
1264                 }
1265                 /* FALLTHROUGH */
1266
1267         case AUE_OPEN_R:
1268         case AUE_OPEN_RT:
1269         case AUE_OPEN_RW:
1270         case AUE_OPEN_RWT:
1271         case AUE_OPEN_W:
1272         case AUE_OPEN_WT:
1273                 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1274                         tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
1275                         kau_write(rec, tok);
1276                 }
1277                 UPATH1_VNODE1_TOKENS;
1278                 break;
1279
1280         case AUE_OPENAT_RC:
1281         case AUE_OPENAT_RTC:
1282         case AUE_OPENAT_RWC:
1283         case AUE_OPENAT_RWTC:
1284         case AUE_OPENAT_WC:
1285         case AUE_OPENAT_WTC:
1286                 if (ARG_IS_VALID(kar, ARG_MODE)) {
1287                         tok = au_to_arg32(3, "mode", ar->ar_arg_mode);
1288                         kau_write(rec, tok);
1289                 }
1290                 /* FALLTHROUGH */
1291
1292         case AUE_OPENAT_R:
1293         case AUE_OPENAT_RT:
1294         case AUE_OPENAT_RW:
1295         case AUE_OPENAT_RWT:
1296         case AUE_OPENAT_W:
1297         case AUE_OPENAT_WT:
1298                 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1299                         tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
1300                         kau_write(rec, tok);
1301                 }
1302                 ATFD1_TOKENS(1);
1303                 UPATH1_VNODE1_TOKENS;
1304                 break;
1305
1306         case AUE_PROCCTL:
1307                 if (ARG_IS_VALID(kar, ARG_VALUE)) {
1308                         tok = au_to_arg32(1, "idtype", ar->ar_arg_value);
1309                         kau_write(rec, tok);
1310                 }
1311                 if (ARG_IS_VALID(kar, ARG_CMD)) {
1312                         tok = au_to_arg32(2, "com", ar->ar_arg_cmd);
1313                         kau_write(rec, tok);
1314                 }
1315                 PROCESS_PID_TOKENS(3);
1316                 break;
1317
1318         case AUE_PTRACE:
1319                 if (ARG_IS_VALID(kar, ARG_CMD)) {
1320                         tok = au_to_arg32(1, "request", ar->ar_arg_cmd);
1321                         kau_write(rec, tok);
1322                 }
1323                 if (ARG_IS_VALID(kar, ARG_VALUE)) {
1324                         tok = au_to_arg32(4, "data", ar->ar_arg_value);
1325                         kau_write(rec, tok);
1326                 }
1327                 PROCESS_PID_TOKENS(2);
1328                 break;
1329
1330         case AUE_QUOTACTL:
1331                 if (ARG_IS_VALID(kar, ARG_CMD)) {
1332                         tok = au_to_arg32(2, "command", ar->ar_arg_cmd);
1333                         kau_write(rec, tok);
1334                 }
1335                 if (ARG_IS_VALID(kar, ARG_UID)) {
1336                         tok = au_to_arg32(3, "uid", ar->ar_arg_uid);
1337                         kau_write(rec, tok);
1338                 }
1339                 if (ARG_IS_VALID(kar, ARG_GID)) {
1340                         tok = au_to_arg32(3, "gid", ar->ar_arg_gid);
1341                         kau_write(rec, tok);
1342                 }
1343                 UPATH1_VNODE1_TOKENS;
1344                 break;
1345
1346         case AUE_REBOOT:
1347                 if (ARG_IS_VALID(kar, ARG_CMD)) {
1348                         tok = au_to_arg32(1, "howto", ar->ar_arg_cmd);
1349                         kau_write(rec, tok);
1350                 }
1351                 break;
1352
1353         case AUE_SEMCTL:
1354                 ar->ar_event = audit_semctl_to_event(ar->ar_arg_svipc_cmd);
1355                 /* Fall through */
1356
1357         case AUE_SEMOP:
1358                 if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
1359                         tok = au_to_arg32(1, "sem ID", ar->ar_arg_svipc_id);
1360                         kau_write(rec, tok);
1361                         if (ar->ar_errno != EINVAL) {
1362                                 tok = au_to_ipc(AT_IPC_SEM,
1363                                     ar->ar_arg_svipc_id);
1364                                 kau_write(rec, tok);
1365                         }
1366                 }
1367                 break;
1368
1369         case AUE_SEMGET:
1370                 if (ar->ar_errno == 0) {
1371                         if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
1372                                 tok = au_to_ipc(AT_IPC_SEM,
1373                                     ar->ar_arg_svipc_id);
1374                                 kau_write(rec, tok);
1375                         }
1376                 }
1377                 break;
1378
1379         case AUE_SETEGID:
1380                 if (ARG_IS_VALID(kar, ARG_EGID)) {
1381                         tok = au_to_arg32(1, "egid", ar->ar_arg_egid);
1382                         kau_write(rec, tok);
1383                 }
1384                 break;
1385
1386         case AUE_SETEUID:
1387                 if (ARG_IS_VALID(kar, ARG_EUID)) {
1388                         tok = au_to_arg32(1, "euid", ar->ar_arg_euid);
1389                         kau_write(rec, tok);
1390                 }
1391                 break;
1392
1393         case AUE_SETREGID:
1394                 if (ARG_IS_VALID(kar, ARG_RGID)) {
1395                         tok = au_to_arg32(1, "rgid", ar->ar_arg_rgid);
1396                         kau_write(rec, tok);
1397                 }
1398                 if (ARG_IS_VALID(kar, ARG_EGID)) {
1399                         tok = au_to_arg32(2, "egid", ar->ar_arg_egid);
1400                         kau_write(rec, tok);
1401                 }
1402                 break;
1403
1404         case AUE_SETREUID:
1405                 if (ARG_IS_VALID(kar, ARG_RUID)) {
1406                         tok = au_to_arg32(1, "ruid", ar->ar_arg_ruid);
1407                         kau_write(rec, tok);
1408                 }
1409                 if (ARG_IS_VALID(kar, ARG_EUID)) {
1410                         tok = au_to_arg32(2, "euid", ar->ar_arg_euid);
1411                         kau_write(rec, tok);
1412                 }
1413                 break;
1414
1415         case AUE_SETRESGID:
1416                 if (ARG_IS_VALID(kar, ARG_RGID)) {
1417                         tok = au_to_arg32(1, "rgid", ar->ar_arg_rgid);
1418                         kau_write(rec, tok);
1419                 }
1420                 if (ARG_IS_VALID(kar, ARG_EGID)) {
1421                         tok = au_to_arg32(2, "egid", ar->ar_arg_egid);
1422                         kau_write(rec, tok);
1423                 }
1424                 if (ARG_IS_VALID(kar, ARG_SGID)) {
1425                         tok = au_to_arg32(3, "sgid", ar->ar_arg_sgid);
1426                         kau_write(rec, tok);
1427                 }
1428                 break;
1429
1430         case AUE_SETRESUID:
1431                 if (ARG_IS_VALID(kar, ARG_RUID)) {
1432                         tok = au_to_arg32(1, "ruid", ar->ar_arg_ruid);
1433                         kau_write(rec, tok);
1434                 }
1435                 if (ARG_IS_VALID(kar, ARG_EUID)) {
1436                         tok = au_to_arg32(2, "euid", ar->ar_arg_euid);
1437                         kau_write(rec, tok);
1438                 }
1439                 if (ARG_IS_VALID(kar, ARG_SUID)) {
1440                         tok = au_to_arg32(3, "suid", ar->ar_arg_suid);
1441                         kau_write(rec, tok);
1442                 }
1443                 break;
1444
1445         case AUE_SETGID:
1446                 if (ARG_IS_VALID(kar, ARG_GID)) {
1447                         tok = au_to_arg32(1, "gid", ar->ar_arg_gid);
1448                         kau_write(rec, tok);
1449                 }
1450                 break;
1451
1452         case AUE_SETUID:
1453                 if (ARG_IS_VALID(kar, ARG_UID)) {
1454                         tok = au_to_arg32(1, "uid", ar->ar_arg_uid);
1455                         kau_write(rec, tok);
1456                 }
1457                 break;
1458
1459         case AUE_SETGROUPS:
1460                 if (ARG_IS_VALID(kar, ARG_GROUPSET)) {
1461                         for(ctr = 0; ctr < ar->ar_arg_groups.gidset_size; ctr++)
1462                         {
1463                                 tok = au_to_arg32(1, "setgroups",
1464                                     ar->ar_arg_groups.gidset[ctr]);
1465                                 kau_write(rec, tok);
1466                         }
1467                 }
1468                 break;
1469
1470         case AUE_SETLOGIN:
1471                 if (ARG_IS_VALID(kar, ARG_LOGIN)) {
1472                         tok = au_to_text(ar->ar_arg_login);
1473                         kau_write(rec, tok);
1474                 }
1475                 break;
1476
1477         case AUE_SETPRIORITY:
1478                 if (ARG_IS_VALID(kar, ARG_CMD)) {
1479                         tok = au_to_arg32(1, "which", ar->ar_arg_cmd);
1480                         kau_write(rec, tok);
1481                 }
1482                 if (ARG_IS_VALID(kar, ARG_UID)) {
1483                         tok = au_to_arg32(2, "who", ar->ar_arg_uid);
1484                         kau_write(rec, tok);
1485                 }
1486                 PROCESS_PID_TOKENS(2);
1487                 if (ARG_IS_VALID(kar, ARG_VALUE)) {
1488                         tok = au_to_arg32(3, "priority", ar->ar_arg_value);
1489                         kau_write(rec, tok);
1490                 }
1491                 break;
1492
1493         case AUE_SETPRIVEXEC:
1494                 if (ARG_IS_VALID(kar, ARG_VALUE)) {
1495                         tok = au_to_arg32(1, "flag", ar->ar_arg_value);
1496                         kau_write(rec, tok);
1497                 }
1498                 break;
1499
1500         /* AUE_SHMAT, AUE_SHMCTL, AUE_SHMDT and AUE_SHMGET are SysV IPC */
1501         case AUE_SHMAT:
1502                 if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
1503                         tok = au_to_arg32(1, "shmid", ar->ar_arg_svipc_id);
1504                         kau_write(rec, tok);
1505                         /* XXXAUDIT: Does having the ipc token make sense? */
1506                         tok = au_to_ipc(AT_IPC_SHM, ar->ar_arg_svipc_id);
1507                         kau_write(rec, tok);
1508                 }
1509                 if (ARG_IS_VALID(kar, ARG_SVIPC_ADDR)) {
1510                         tok = au_to_arg32(2, "shmaddr",
1511                             (int)(uintptr_t)ar->ar_arg_svipc_addr);
1512                         kau_write(rec, tok);
1513                 }
1514                 if (ARG_IS_VALID(kar, ARG_SVIPC_PERM)) {
1515                         tok = au_to_ipc_perm(&ar->ar_arg_svipc_perm);
1516                         kau_write(rec, tok);
1517                 }
1518                 break;
1519
1520         case AUE_SHMCTL:
1521                 if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
1522                         tok = au_to_arg32(1, "shmid", ar->ar_arg_svipc_id);
1523                         kau_write(rec, tok);
1524                         /* XXXAUDIT: Does having the ipc token make sense? */
1525                         tok = au_to_ipc(AT_IPC_SHM, ar->ar_arg_svipc_id);
1526                         kau_write(rec, tok);
1527                 }
1528                 switch (ar->ar_arg_svipc_cmd) {
1529                 case IPC_STAT:
1530                         ar->ar_event = AUE_SHMCTL_STAT;
1531                         break;
1532                 case IPC_RMID:
1533                         ar->ar_event = AUE_SHMCTL_RMID;
1534                         break;
1535                 case IPC_SET:
1536                         ar->ar_event = AUE_SHMCTL_SET;
1537                         if (ARG_IS_VALID(kar, ARG_SVIPC_PERM)) {
1538                                 tok = au_to_ipc_perm(&ar->ar_arg_svipc_perm);
1539                                 kau_write(rec, tok);
1540                         }
1541                         break;
1542                 default:
1543                         break;  /* We will audit a bad command */
1544                 }
1545                 break;
1546
1547         case AUE_SHMDT:
1548                 if (ARG_IS_VALID(kar, ARG_SVIPC_ADDR)) {
1549                         tok = au_to_arg32(1, "shmaddr",
1550                             (int)(uintptr_t)ar->ar_arg_svipc_addr);
1551                         kau_write(rec, tok);
1552                 }
1553                 break;
1554
1555         case AUE_SHMGET:
1556                 /* This is unusual; the return value is in an argument token */
1557                 if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
1558                         tok = au_to_arg32(0, "shmid", ar->ar_arg_svipc_id);
1559                         kau_write(rec, tok);
1560                         tok = au_to_ipc(AT_IPC_SHM, ar->ar_arg_svipc_id);
1561                         kau_write(rec, tok);
1562                 }
1563                 if (ARG_IS_VALID(kar, ARG_SVIPC_PERM)) {
1564                         tok = au_to_ipc_perm(&ar->ar_arg_svipc_perm);
1565                         kau_write(rec, tok);
1566                 }
1567                 break;
1568
1569         /* shm_rename is a non-Posix extension to the Posix shm implementation */
1570         case AUE_SHMRENAME:
1571                 UPATH1_TOKENS;
1572                 UPATH2_TOKENS;
1573                 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1574                         tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
1575                         kau_write(rec, tok);
1576                 }
1577                 break;
1578
1579         /* AUE_SHMOPEN, AUE_SHMUNLINK, AUE_SEMOPEN, AUE_SEMCLOSE
1580          * and AUE_SEMUNLINK are Posix IPC */
1581         case AUE_SHMOPEN:
1582                 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1583                         tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
1584                         kau_write(rec, tok);
1585                 }
1586                 if (ARG_IS_VALID(kar, ARG_MODE)) {
1587                         tok = au_to_arg32(3, "mode", ar->ar_arg_mode);
1588                         kau_write(rec, tok);
1589                 }
1590                 /* FALLTHROUGH */
1591
1592         case AUE_SHMUNLINK:
1593                 UPATH1_TOKENS;
1594                 if (ARG_IS_VALID(kar, ARG_POSIX_IPC_PERM)) {
1595                         struct ipc_perm perm;
1596
1597                         perm.uid = ar->ar_arg_pipc_perm.pipc_uid;
1598                         perm.gid = ar->ar_arg_pipc_perm.pipc_gid;
1599                         perm.cuid = ar->ar_arg_pipc_perm.pipc_uid;
1600                         perm.cgid = ar->ar_arg_pipc_perm.pipc_gid;
1601                         perm.mode = ar->ar_arg_pipc_perm.pipc_mode;
1602                         perm.seq = 0;
1603                         perm.key = 0;
1604                         tok = au_to_ipc_perm(&perm);
1605                         kau_write(rec, tok);
1606                 }
1607                 break;
1608
1609         case AUE_SEMOPEN:
1610                 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1611                         tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
1612                         kau_write(rec, tok);
1613                 }
1614                 if (ARG_IS_VALID(kar, ARG_MODE)) {
1615                         tok = au_to_arg32(3, "mode", ar->ar_arg_mode);
1616                         kau_write(rec, tok);
1617                 }
1618                 if (ARG_IS_VALID(kar, ARG_VALUE)) {
1619                         tok = au_to_arg32(4, "value", ar->ar_arg_value);
1620                         kau_write(rec, tok);
1621                 }
1622                 /* FALLTHROUGH */
1623
1624         case AUE_SEMUNLINK:
1625                 if (ARG_IS_VALID(kar, ARG_TEXT)) {
1626                         tok = au_to_text(ar->ar_arg_text);
1627                         kau_write(rec, tok);
1628                 }
1629                 if (ARG_IS_VALID(kar, ARG_POSIX_IPC_PERM)) {
1630                         struct ipc_perm perm;
1631
1632                         perm.uid = ar->ar_arg_pipc_perm.pipc_uid;
1633                         perm.gid = ar->ar_arg_pipc_perm.pipc_gid;
1634                         perm.cuid = ar->ar_arg_pipc_perm.pipc_uid;
1635                         perm.cgid = ar->ar_arg_pipc_perm.pipc_gid;
1636                         perm.mode = ar->ar_arg_pipc_perm.pipc_mode;
1637                         perm.seq = 0;
1638                         perm.key = 0;
1639                         tok = au_to_ipc_perm(&perm);
1640                         kau_write(rec, tok);
1641                 }
1642                 break;
1643
1644         case AUE_SEMCLOSE:
1645                 if (ARG_IS_VALID(kar, ARG_FD)) {
1646                         tok = au_to_arg32(1, "sem", ar->ar_arg_fd);
1647                         kau_write(rec, tok);
1648                 }
1649                 break;
1650
1651         case AUE_SYMLINK:
1652         case AUE_SYMLINKAT:
1653                 if (ARG_IS_VALID(kar, ARG_TEXT)) {
1654                         tok = au_to_text(ar->ar_arg_text);
1655                         kau_write(rec, tok);
1656                 }
1657                 ATFD1_TOKENS(1);
1658                 UPATH1_VNODE1_TOKENS;
1659                 break;
1660
1661         case AUE_SYSCTL:
1662         case AUE_SYSCTL_NONADMIN:
1663                 if (ARG_IS_VALID(kar, ARG_CTLNAME | ARG_LEN)) {
1664                         for (ctr = 0; ctr < ar->ar_arg_len; ctr++) {
1665                                 tok = au_to_arg32(1, "name",
1666                                     ar->ar_arg_ctlname[ctr]);
1667                                 kau_write(rec, tok);
1668                         }
1669                 }
1670                 if (ARG_IS_VALID(kar, ARG_VALUE)) {
1671                         tok = au_to_arg32(5, "newval", ar->ar_arg_value);
1672                         kau_write(rec, tok);
1673                 }
1674                 if (ARG_IS_VALID(kar, ARG_TEXT)) {
1675                         tok = au_to_text(ar->ar_arg_text);
1676                         kau_write(rec, tok);
1677                 }
1678                 break;
1679
1680         case AUE_UMASK:
1681                 if (ARG_IS_VALID(kar, ARG_MASK)) {
1682                         tok = au_to_arg32(1, "new mask", ar->ar_arg_mask);
1683                         kau_write(rec, tok);
1684                 }
1685                 tok = au_to_arg32(0, "prev mask", ar->ar_retval);
1686                 kau_write(rec, tok);
1687                 break;
1688
1689         case AUE_WAIT4:
1690         case AUE_WAIT6:
1691                 PROCESS_PID_TOKENS(1);
1692                 if (ARG_IS_VALID(kar, ARG_VALUE)) {
1693                         tok = au_to_arg32(3, "options", ar->ar_arg_value);
1694                         kau_write(rec, tok);
1695                 }
1696                 break;
1697
1698         case AUE_CAP_RIGHTS_LIMIT:
1699                 /*
1700                  * XXXRW/XXXJA: Would be nice to audit socket/etc information.
1701                  */
1702                 FD_VNODE1_TOKENS;
1703                 if (ARG_IS_VALID(kar, ARG_RIGHTS)) {
1704                         tok = au_to_rights(&ar->ar_arg_rights);
1705                         kau_write(rec, tok);
1706                 }
1707                 break;
1708
1709         case AUE_CAP_FCNTLS_GET:
1710         case AUE_CAP_IOCTLS_GET:
1711         case AUE_CAP_IOCTLS_LIMIT:
1712         case AUE_CAP_RIGHTS_GET:
1713                 if (ARG_IS_VALID(kar, ARG_FD)) {
1714                         tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
1715                         kau_write(rec, tok);
1716                 }
1717                 break;
1718
1719         case AUE_CAP_FCNTLS_LIMIT:
1720                 FD_VNODE1_TOKENS;
1721                 if (ARG_IS_VALID(kar, ARG_FCNTL_RIGHTS)) {
1722                         tok = au_to_arg32(2, "fcntlrights",
1723                             ar->ar_arg_fcntl_rights);
1724                         kau_write(rec, tok);
1725                 }
1726                 break;
1727
1728         case AUE_CAP_ENTER:
1729         case AUE_CAP_GETMODE:
1730                 break;
1731
1732         case AUE_NULL:
1733         default:
1734                 printf("BSM conversion requested for unknown event %d\n",
1735                     ar->ar_event);
1736
1737                 /*
1738                  * Write the subject token so it is properly freed here.
1739                  */
1740                 if (jail_tok != NULL)
1741                         kau_write(rec, jail_tok);
1742                 kau_write(rec, subj_tok);
1743                 kau_free(rec);
1744                 return (BSM_NOAUDIT);
1745         }
1746
1747         if (jail_tok != NULL)
1748                 kau_write(rec, jail_tok);
1749         kau_write(rec, subj_tok);
1750         tok = au_to_return32(au_errno_to_bsm(ar->ar_errno), ar->ar_retval);
1751         kau_write(rec, tok);  /* Every record gets a return token */
1752
1753         kau_close(rec, &ar->ar_endtime, ar->ar_event);
1754
1755         *pau = rec;
1756         return (BSM_SUCCESS);
1757 }
1758
1759 /*
1760  * Verify that a record is a valid BSM record. This verification is simple
1761  * now, but may be expanded on sometime in the future.  Return 1 if the
1762  * record is good, 0 otherwise.
1763  */
1764 int
1765 bsm_rec_verify(void *rec)
1766 {
1767         char c = *(char *)rec;
1768
1769         /*
1770          * Check the token ID of the first token; it has to be a header
1771          * token.
1772          *
1773          * XXXAUDIT There needs to be a token structure to map a token.
1774          * XXXAUDIT 'Shouldn't be simply looking at the first char.
1775          */
1776         if ((c != AUT_HEADER32) && (c != AUT_HEADER32_EX) &&
1777             (c != AUT_HEADER64) && (c != AUT_HEADER64_EX))
1778                 return (0);
1779         return (1);
1780 }