2 * SPDX-License-Identifier: BSD-3-Clause
4 * Copyright (c) 1999-2009 Apple Inc.
5 * Copyright (c) 2016-2017 Robert N. M. Watson
8 * Portions of this software were developed by BAE Systems, the University of
9 * Cambridge Computer Laboratory, and Memorial University under DARPA/AFRL
10 * contract FA8650-15-C-7558 ("CADETS"), as part of the DARPA Transparent
11 * Computing (TC) research program.
13 * Redistribution and use in source and binary forms, with or without
14 * modification, are permitted provided that the following conditions
16 * 1. Redistributions of source code must retain the above copyright
17 * notice, this list of conditions and the following disclaimer.
18 * 2. Redistributions in binary form must reproduce the above copyright
19 * notice, this list of conditions and the following disclaimer in the
20 * documentation and/or other materials provided with the distribution.
21 * 3. Neither the name of Apple Inc. ("Apple") nor the names of
22 * its contributors may be used to endorse or promote products derived
23 * from this software without specific prior written permission.
25 * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND
26 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
27 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
28 * ARE DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR
29 * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
30 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
31 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
32 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
33 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
34 * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
35 * POSSIBILITY OF SUCH DAMAGE.
38 #include <sys/cdefs.h>
39 __FBSDID("$FreeBSD$");
41 #include <sys/param.h>
42 #include <sys/vnode.h>
45 #include <sys/malloc.h>
46 #include <sys/mutex.h>
47 #include <sys/socket.h>
48 #include <sys/extattr.h>
49 #include <sys/fcntl.h>
51 #include <sys/systm.h>
53 #include <bsm/audit.h>
54 #include <bsm/audit_internal.h>
55 #include <bsm/audit_record.h>
56 #include <bsm/audit_kevents.h>
58 #include <security/audit/audit.h>
59 #include <security/audit/audit_private.h>
61 #include <netinet/in_systm.h>
62 #include <netinet/in.h>
63 #include <netinet/ip.h>
65 MALLOC_DEFINE(M_AUDITBSM, "audit_bsm", "Audit BSM data");
67 static void audit_sys_auditon(struct audit_record *ar,
68 struct au_record *rec);
71 * Initialize the BSM auditing subsystem.
82 * This call reserves memory for the audit record. Memory must be guaranteed
83 * before any auditable event can be generated. The au_record structure
84 * maintains a reference to the memory allocated above and also the list of
85 * tokens associated with this record.
87 static struct au_record *
90 struct au_record *rec;
92 rec = malloc(sizeof(*rec), M_AUDITBSM, M_WAITOK);
94 TAILQ_INIT(&rec->token_q);
102 * Store the token with the record descriptor.
105 kau_write(struct au_record *rec, struct au_token *tok)
108 KASSERT(tok != NULL, ("kau_write: tok == NULL"));
110 TAILQ_INSERT_TAIL(&rec->token_q, tok, tokens);
111 rec->len += tok->len;
115 * Close out the audit record by adding the header token, identifying any
116 * missing tokens. Write out the tokens to the record memory.
119 kau_close(struct au_record *rec, struct timespec *ctime, short event)
123 token_t *cur, *hdr, *trail;
126 struct auditinfo_addr ak;
129 audit_get_kinfo(&ak);
131 switch (ak.ai_termid.at_type) {
133 hdrsize = (ak.ai_termid.at_addr[0] == INADDR_ANY) ?
134 AUDIT_HEADER_SIZE : AUDIT_HEADER_EX_SIZE(&ak);
137 ap = (struct in6_addr *)&ak.ai_termid.at_addr[0];
138 hdrsize = (IN6_IS_ADDR_UNSPECIFIED(ap)) ? AUDIT_HEADER_SIZE :
139 AUDIT_HEADER_EX_SIZE(&ak);
142 panic("kau_close: invalid address family");
144 tot_rec_size = rec->len + hdrsize + AUDIT_TRAILER_SIZE;
145 rec->data = malloc(tot_rec_size, M_AUDITBSM, M_WAITOK | M_ZERO);
147 tm.tv_usec = ctime->tv_nsec / 1000;
148 tm.tv_sec = ctime->tv_sec;
149 if (hdrsize != AUDIT_HEADER_SIZE)
150 hdr = au_to_header32_ex_tm(tot_rec_size, event, 0, tm, &ak);
152 hdr = au_to_header32_tm(tot_rec_size, event, 0, tm);
153 TAILQ_INSERT_HEAD(&rec->token_q, hdr, tokens);
155 trail = au_to_trailer(tot_rec_size);
156 TAILQ_INSERT_TAIL(&rec->token_q, trail, tokens);
158 rec->len = tot_rec_size;
160 TAILQ_FOREACH(cur, &rec->token_q, tokens) {
161 memcpy(dptr, cur->t_data, cur->len);
167 * Free a BSM audit record by releasing all the tokens and clearing the audit
168 * record information.
171 kau_free(struct au_record *rec)
173 struct au_token *tok;
175 /* Free the token list. */
176 while ((tok = TAILQ_FIRST(&rec->token_q))) {
177 TAILQ_REMOVE(&rec->token_q, tok, tokens);
178 free(tok->t_data, M_AUDITBSM);
179 free(tok, M_AUDITBSM);
184 free(rec->data, M_AUDITBSM);
185 free(rec, M_AUDITBSM);
189 * XXX: May want turn some (or all) of these macros into functions in order
190 * to reduce the generated code size.
192 * XXXAUDIT: These macros assume that 'kar', 'ar', 'rec', and 'tok' in the
193 * caller are OK with this.
195 #define ATFD1_TOKENS(argnum) do { \
196 if (ARG_IS_VALID(kar, ARG_ATFD1)) { \
197 tok = au_to_arg32(argnum, "at fd 1", ar->ar_arg_atfd1); \
198 kau_write(rec, tok); \
202 #define ATFD2_TOKENS(argnum) do { \
203 if (ARG_IS_VALID(kar, ARG_ATFD2)) { \
204 tok = au_to_arg32(argnum, "at fd 2", ar->ar_arg_atfd2); \
205 kau_write(rec, tok); \
209 #define UPATH1_TOKENS do { \
210 if (ARG_IS_VALID(kar, ARG_UPATH1)) { \
211 tok = au_to_path(ar->ar_arg_upath1); \
212 kau_write(rec, tok); \
216 #define UPATH2_TOKENS do { \
217 if (ARG_IS_VALID(kar, ARG_UPATH2)) { \
218 tok = au_to_path(ar->ar_arg_upath2); \
219 kau_write(rec, tok); \
223 #define VNODE1_TOKENS do { \
224 if (ARG_IS_VALID(kar, ARG_ATFD)) { \
225 tok = au_to_arg32(1, "at fd", ar->ar_arg_atfd); \
226 kau_write(rec, tok); \
228 if (ARG_IS_VALID(kar, ARG_VNODE1)) { \
229 tok = au_to_attr32(&ar->ar_arg_vnode1); \
230 kau_write(rec, tok); \
234 #define UPATH1_VNODE1_TOKENS do { \
236 if (ARG_IS_VALID(kar, ARG_VNODE1)) { \
237 tok = au_to_attr32(&ar->ar_arg_vnode1); \
238 kau_write(rec, tok); \
242 #define VNODE2_TOKENS do { \
243 if (ARG_IS_VALID(kar, ARG_VNODE2)) { \
244 tok = au_to_attr32(&ar->ar_arg_vnode2); \
245 kau_write(rec, tok); \
249 #define FD_VNODE1_TOKENS do { \
250 if (ARG_IS_VALID(kar, ARG_VNODE1)) { \
251 if (ARG_IS_VALID(kar, ARG_FD)) { \
252 tok = au_to_arg32(1, "fd", ar->ar_arg_fd); \
253 kau_write(rec, tok); \
255 tok = au_to_attr32(&ar->ar_arg_vnode1); \
256 kau_write(rec, tok); \
258 if (ARG_IS_VALID(kar, ARG_FD)) { \
259 tok = au_to_arg32(1, "non-file: fd", \
261 kau_write(rec, tok); \
266 #define PROCESS_PID_TOKENS(argn) do { \
267 if ((ar->ar_arg_pid > 0) /* Reference a single process */ \
268 && (ARG_IS_VALID(kar, ARG_PROCESS))) { \
269 tok = au_to_process32_ex(ar->ar_arg_auid, \
270 ar->ar_arg_euid, ar->ar_arg_egid, \
271 ar->ar_arg_ruid, ar->ar_arg_rgid, \
272 ar->ar_arg_pid, ar->ar_arg_asid, \
273 &ar->ar_arg_termid_addr); \
274 kau_write(rec, tok); \
275 } else if (ARG_IS_VALID(kar, ARG_PID)) { \
276 tok = au_to_arg32(argn, "process", ar->ar_arg_pid); \
277 kau_write(rec, tok); \
281 #define EXTATTR_TOKENS(namespace_argnum) do { \
282 if (ARG_IS_VALID(kar, ARG_VALUE)) { \
283 switch (ar->ar_arg_value) { \
284 case EXTATTR_NAMESPACE_USER: \
285 tok = au_to_text(EXTATTR_NAMESPACE_USER_STRING);\
287 case EXTATTR_NAMESPACE_SYSTEM: \
288 tok = au_to_text(EXTATTR_NAMESPACE_SYSTEM_STRING);\
291 tok = au_to_arg32((namespace_argnum), \
292 "attrnamespace", ar->ar_arg_value); \
295 kau_write(rec, tok); \
297 /* attrname is in the text field */ \
298 if (ARG_IS_VALID(kar, ARG_TEXT)) { \
299 tok = au_to_text(ar->ar_arg_text); \
300 kau_write(rec, tok); \
305 * Not all pointer arguments to system calls are of interest, but in some
306 * cases they reflect delegation of rights, such as mmap(2) followed by
307 * minherit(2) before execve(2), so do the best we can.
309 #define ADDR_TOKEN(argnum, argname) do { \
310 if (ARG_IS_VALID(kar, ARG_ADDR)) { \
311 if (sizeof(void *) == sizeof(uint32_t)) \
312 tok = au_to_arg32((argnum), (argname), \
313 (uint32_t)(uintptr_t)ar->ar_arg_addr); \
315 tok = au_to_arg64((argnum), (argname), \
316 (uint64_t)(uintptr_t)ar->ar_arg_addr); \
317 kau_write(rec, tok); \
323 * Implement auditing for the auditon() system call. The audit tokens that
324 * are generated depend on the command that was sent into the auditon()
328 audit_sys_auditon(struct audit_record *ar, struct au_record *rec)
330 struct au_token *tok;
332 tok = au_to_arg32(3, "length", ar->ar_arg_len);
334 switch (ar->ar_arg_cmd) {
336 if ((size_t)ar->ar_arg_len == sizeof(int64_t)) {
337 tok = au_to_arg64(2, "policy",
338 ar->ar_arg_auditon.au_policy64);
345 tok = au_to_arg32(2, "policy", ar->ar_arg_auditon.au_policy);
350 tok = au_to_arg32(2, "setkmask:as_success",
351 ar->ar_arg_auditon.au_mask.am_success);
353 tok = au_to_arg32(2, "setkmask:as_failure",
354 ar->ar_arg_auditon.au_mask.am_failure);
359 if ((size_t)ar->ar_arg_len == sizeof(au_qctrl64_t)) {
360 tok = au_to_arg64(2, "setqctrl:aq_hiwater",
361 ar->ar_arg_auditon.au_qctrl64.aq64_hiwater);
363 tok = au_to_arg64(2, "setqctrl:aq_lowater",
364 ar->ar_arg_auditon.au_qctrl64.aq64_lowater);
366 tok = au_to_arg64(2, "setqctrl:aq_bufsz",
367 ar->ar_arg_auditon.au_qctrl64.aq64_bufsz);
369 tok = au_to_arg64(2, "setqctrl:aq_delay",
370 ar->ar_arg_auditon.au_qctrl64.aq64_delay);
372 tok = au_to_arg64(2, "setqctrl:aq_minfree",
373 ar->ar_arg_auditon.au_qctrl64.aq64_minfree);
380 tok = au_to_arg32(2, "setqctrl:aq_hiwater",
381 ar->ar_arg_auditon.au_qctrl.aq_hiwater);
383 tok = au_to_arg32(2, "setqctrl:aq_lowater",
384 ar->ar_arg_auditon.au_qctrl.aq_lowater);
386 tok = au_to_arg32(2, "setqctrl:aq_bufsz",
387 ar->ar_arg_auditon.au_qctrl.aq_bufsz);
389 tok = au_to_arg32(2, "setqctrl:aq_delay",
390 ar->ar_arg_auditon.au_qctrl.aq_delay);
392 tok = au_to_arg32(2, "setqctrl:aq_minfree",
393 ar->ar_arg_auditon.au_qctrl.aq_minfree);
398 tok = au_to_arg32(2, "setumask:as_success",
399 ar->ar_arg_auditon.au_auinfo.ai_mask.am_success);
401 tok = au_to_arg32(2, "setumask:as_failure",
402 ar->ar_arg_auditon.au_auinfo.ai_mask.am_failure);
407 tok = au_to_arg32(2, "setsmask:as_success",
408 ar->ar_arg_auditon.au_auinfo.ai_mask.am_success);
410 tok = au_to_arg32(2, "setsmask:as_failure",
411 ar->ar_arg_auditon.au_auinfo.ai_mask.am_failure);
416 if ((size_t)ar->ar_arg_len == sizeof(int64_t)) {
417 tok = au_to_arg64(2, "setcond",
418 ar->ar_arg_auditon.au_cond64);
425 tok = au_to_arg32(2, "setcond", ar->ar_arg_auditon.au_cond);
431 tok = au_to_arg32(2, "setclass:ec_event",
432 ar->ar_arg_auditon.au_evclass.ec_number);
434 tok = au_to_arg32(2, "setclass:ec_class",
435 ar->ar_arg_auditon.au_evclass.ec_class);
440 tok = au_to_arg32(2, "setpmask:as_success",
441 ar->ar_arg_auditon.au_aupinfo.ap_mask.am_success);
443 tok = au_to_arg32(2, "setpmask:as_failure",
444 ar->ar_arg_auditon.au_aupinfo.ap_mask.am_failure);
449 tok = au_to_arg32(2, "setfsize:filesize",
450 ar->ar_arg_auditon.au_fstat.af_filesz);
460 * Convert an internal kernel audit record to a BSM record and return a
461 * success/failure indicator. The BSM record is passed as an out parameter to
465 * BSM_SUCCESS: The BSM record is valid
466 * BSM_FAILURE: Failure; the BSM record is NULL.
467 * BSM_NOAUDIT: The event is not auditable for BSM; the BSM record is NULL.
470 kaudit_to_bsm(struct kaudit_record *kar, struct au_record **pau)
472 struct au_token *tok, *subj_tok, *jail_tok;
473 struct au_record *rec;
475 struct audit_record *ar;
478 KASSERT(kar != NULL, ("kaudit_to_bsm: kar == NULL"));
485 * Create the subject token. If this credential was jailed be sure to
486 * generate a zonename token.
488 if (ar->ar_jailname[0] != '\0')
489 jail_tok = au_to_zonename(ar->ar_jailname);
492 switch (ar->ar_subj_term_addr.at_type) {
494 tid.port = ar->ar_subj_term_addr.at_port;
495 tid.machine = ar->ar_subj_term_addr.at_addr[0];
496 subj_tok = au_to_subject32(ar->ar_subj_auid, /* audit ID */
497 ar->ar_subj_cred.cr_uid, /* eff uid */
498 ar->ar_subj_egid, /* eff group id */
499 ar->ar_subj_ruid, /* real uid */
500 ar->ar_subj_rgid, /* real group id */
501 ar->ar_subj_pid, /* process id */
502 ar->ar_subj_asid, /* session ID */
506 subj_tok = au_to_subject32_ex(ar->ar_subj_auid,
507 ar->ar_subj_cred.cr_uid,
513 &ar->ar_subj_term_addr);
516 bzero(&tid, sizeof(tid));
517 subj_tok = au_to_subject32(ar->ar_subj_auid,
518 ar->ar_subj_cred.cr_uid,
528 * The logic inside each case fills in the tokens required for the
529 * event, except for the header, trailer, and return tokens. The
530 * header and trailer tokens are added by the kau_close() function.
531 * The return token is added outside of the switch statement.
533 switch(ar->ar_event) {
535 if (ARG_IS_VALID(kar, ARG_FD)) {
536 tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
539 if (ARG_IS_VALID(kar, ARG_SADDRINET)) {
540 tok = au_to_sock_inet((struct sockaddr_in *)
541 &ar->ar_arg_sockaddr);
544 if (ARG_IS_VALID(kar, ARG_SADDRUNIX)) {
545 tok = au_to_sock_unix((struct sockaddr_un *)
546 &ar->ar_arg_sockaddr);
562 * Socket-related events.
564 if (ARG_IS_VALID(kar, ARG_FD)) {
565 tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
568 if (ARG_IS_VALID(kar, ARG_SADDRINET)) {
569 tok = au_to_sock_inet((struct sockaddr_in *)
570 &ar->ar_arg_sockaddr);
573 if (ARG_IS_VALID(kar, ARG_SADDRUNIX)) {
574 tok = au_to_sock_unix((struct sockaddr_un *)
575 &ar->ar_arg_sockaddr);
579 /* XXX Need to handle ARG_SADDRINET6 */
585 if (ARG_IS_VALID(kar, ARG_FD)) {
586 tok = au_to_arg32(2, "fd", ar->ar_arg_fd);
589 if (ARG_IS_VALID(kar, ARG_SADDRUNIX)) {
590 tok = au_to_sock_unix((struct sockaddr_un *)
591 &ar->ar_arg_sockaddr);
599 if (ARG_IS_VALID(kar, ARG_SADDRINET)) {
600 tok = au_to_sock_inet((struct sockaddr_in *)
601 &ar->ar_arg_sockaddr);
604 if (ARG_IS_VALID(kar, ARG_SADDRUNIX)) {
605 tok = au_to_sock_unix((struct sockaddr_un *)
606 &ar->ar_arg_sockaddr);
610 /* XXX Need to handle ARG_SADDRINET6 */
615 if (ARG_IS_VALID(kar, ARG_SOCKINFO)) {
616 tok = au_to_arg32(1, "domain",
617 ar->ar_arg_sockinfo.so_domain);
619 tok = au_to_arg32(2, "type",
620 ar->ar_arg_sockinfo.so_type);
622 tok = au_to_arg32(3, "protocol",
623 ar->ar_arg_sockinfo.so_protocol);
630 if (ARG_IS_VALID(kar, ARG_FD)) {
631 tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
637 if (ARG_IS_VALID(kar, ARG_UPATH1)) {
638 UPATH1_VNODE1_TOKENS;
640 tok = au_to_arg32(1, "accounting off", 0);
646 if (ARG_IS_VALID(kar, ARG_AUID)) {
647 tok = au_to_arg32(2, "setauid", ar->ar_arg_auid);
653 if (ARG_IS_VALID(kar, ARG_AUID) &&
654 ARG_IS_VALID(kar, ARG_ASID) &&
655 ARG_IS_VALID(kar, ARG_AMASK) &&
656 ARG_IS_VALID(kar, ARG_TERMID)) {
657 tok = au_to_arg32(1, "setaudit:auid",
660 tok = au_to_arg32(1, "setaudit:port",
661 ar->ar_arg_termid.port);
663 tok = au_to_arg32(1, "setaudit:machine",
664 ar->ar_arg_termid.machine);
666 tok = au_to_arg32(1, "setaudit:as_success",
667 ar->ar_arg_amask.am_success);
669 tok = au_to_arg32(1, "setaudit:as_failure",
670 ar->ar_arg_amask.am_failure);
672 tok = au_to_arg32(1, "setaudit:asid",
678 case AUE_SETAUDIT_ADDR:
679 if (ARG_IS_VALID(kar, ARG_AUID) &&
680 ARG_IS_VALID(kar, ARG_ASID) &&
681 ARG_IS_VALID(kar, ARG_AMASK) &&
682 ARG_IS_VALID(kar, ARG_TERMID_ADDR)) {
683 tok = au_to_arg32(1, "setaudit_addr:auid",
686 tok = au_to_arg32(1, "setaudit_addr:as_success",
687 ar->ar_arg_amask.am_success);
689 tok = au_to_arg32(1, "setaudit_addr:as_failure",
690 ar->ar_arg_amask.am_failure);
692 tok = au_to_arg32(1, "setaudit_addr:asid",
695 tok = au_to_arg32(1, "setaudit_addr:type",
696 ar->ar_arg_termid_addr.at_type);
698 tok = au_to_arg32(1, "setaudit_addr:port",
699 ar->ar_arg_termid_addr.at_port);
701 if (ar->ar_arg_termid_addr.at_type == AU_IPv6)
702 tok = au_to_in_addr_ex((struct in6_addr *)
703 &ar->ar_arg_termid_addr.at_addr[0]);
704 if (ar->ar_arg_termid_addr.at_type == AU_IPv4)
705 tok = au_to_in_addr((struct in_addr *)
706 &ar->ar_arg_termid_addr.at_addr[0]);
713 * For AUDITON commands without own event, audit the cmd.
715 if (ARG_IS_VALID(kar, ARG_CMD)) {
716 tok = au_to_arg32(1, "cmd", ar->ar_arg_cmd);
721 case AUE_AUDITON_GETCAR:
722 case AUE_AUDITON_GETCLASS:
723 case AUE_AUDITON_GETCOND:
724 case AUE_AUDITON_GETCWD:
725 case AUE_AUDITON_GETKMASK:
726 case AUE_AUDITON_GETSTAT:
727 case AUE_AUDITON_GPOLICY:
728 case AUE_AUDITON_GQCTRL:
729 case AUE_AUDITON_SETCLASS:
730 case AUE_AUDITON_SETCOND:
731 case AUE_AUDITON_SETKMASK:
732 case AUE_AUDITON_SETSMASK:
733 case AUE_AUDITON_SETSTAT:
734 case AUE_AUDITON_SETUMASK:
735 case AUE_AUDITON_SPOLICY:
736 case AUE_AUDITON_SQCTRL:
737 if (ARG_IS_VALID(kar, ARG_AUDITON))
738 audit_sys_auditon(ar, rec);
742 UPATH1_VNODE1_TOKENS;
746 if (ARG_IS_VALID(kar, ARG_EXIT)) {
747 tok = au_to_exit(ar->ar_arg_exitretval,
748 ar->ar_arg_exitstatus);
754 case AUE_CLOCK_SETTIME:
758 case AUE_GETAUDIT_ADDR:
768 case AUE_NTP_ADJTIME:
770 case AUE_POSIX_OPENPT:
778 case AUE_SETTIMEOFDAY:
782 * Header, subject, and return tokens added at end.
786 case AUE_ACL_DELETE_FD:
787 case AUE_ACL_DELETE_FILE:
788 case AUE_ACL_CHECK_FD:
789 case AUE_ACL_CHECK_FILE:
790 case AUE_ACL_CHECK_LINK:
791 case AUE_ACL_DELETE_LINK:
793 case AUE_ACL_GET_FILE:
794 case AUE_ACL_GET_LINK:
796 case AUE_ACL_SET_FILE:
797 case AUE_ACL_SET_LINK:
798 if (ARG_IS_VALID(kar, ARG_VALUE)) {
799 tok = au_to_arg32(1, "type", ar->ar_arg_value);
803 UPATH1_VNODE1_TOKENS;
810 case AUE_GETATTRLIST:
822 case AUE_SETATTRLIST:
833 UPATH1_VNODE1_TOKENS;
840 UPATH1_VNODE1_TOKENS;
841 if (ARG_IS_VALID(kar, ARG_VALUE)) {
842 tok = au_to_arg32(2, "mode", ar->ar_arg_value);
850 /* XXXRW: Need to audit vnode argument. */
855 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
856 tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
859 UPATH1_VNODE1_TOKENS;
864 if (ARG_IS_VALID(kar, ARG_MODE)) {
865 tok = au_to_arg32(2, "new file mode",
869 UPATH1_VNODE1_TOKENS;
874 if (ARG_IS_VALID(kar, ARG_MODE)) {
875 tok = au_to_arg32(3, "new file mode",
879 UPATH1_VNODE1_TOKENS;
884 if (ARG_IS_VALID(kar, ARG_UID)) {
885 tok = au_to_arg32(2, "new file uid", ar->ar_arg_uid);
888 if (ARG_IS_VALID(kar, ARG_GID)) {
889 tok = au_to_arg32(3, "new file gid", ar->ar_arg_gid);
892 UPATH1_VNODE1_TOKENS;
897 if (ARG_IS_VALID(kar, ARG_UID)) {
898 tok = au_to_arg32(3, "new file uid", ar->ar_arg_uid);
901 if (ARG_IS_VALID(kar, ARG_GID)) {
902 tok = au_to_arg32(4, "new file gid", ar->ar_arg_gid);
905 UPATH1_VNODE1_TOKENS;
908 case AUE_EXCHANGEDATA:
909 UPATH1_VNODE1_TOKENS;
914 if (ARG_IS_VALID(kar, ARG_FD)) {
915 tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
918 UPATH1_VNODE1_TOKENS;
922 if (ARG_IS_VALID(kar, ARG_FD)) {
923 tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
929 if (ARG_IS_VALID(kar, ARG_SIGNUM)) {
930 tok = au_to_arg32(1, "signal", ar->ar_arg_signum);
933 UPATH1_VNODE1_TOKENS;
937 UPATH1_VNODE1_TOKENS;
938 if (ARG_IS_VALID(kar, ARG_CMD)) {
939 tok = au_to_arg32(2, "cmd", ar->ar_arg_cmd);
942 /* extattrctl(2) filename parameter is in upath2/vnode2 */
948 case AUE_EXTATTR_GET_FILE:
949 case AUE_EXTATTR_SET_FILE:
950 case AUE_EXTATTR_LIST_FILE:
951 case AUE_EXTATTR_DELETE_FILE:
952 case AUE_EXTATTR_GET_LINK:
953 case AUE_EXTATTR_SET_LINK:
954 case AUE_EXTATTR_LIST_LINK:
955 case AUE_EXTATTR_DELETE_LINK:
956 UPATH1_VNODE1_TOKENS;
960 case AUE_EXTATTR_GET_FD:
961 case AUE_EXTATTR_SET_FD:
962 case AUE_EXTATTR_LIST_FD:
963 case AUE_EXTATTR_DELETE_FD:
964 if (ARG_IS_VALID(kar, ARG_FD)) {
965 tok = au_to_arg32(2, "fd", ar->ar_arg_fd);
972 if (ARG_IS_VALID(kar, ARG_FD)) {
973 tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
980 if (ARG_IS_VALID(kar, ARG_ARGV)) {
981 tok = au_to_exec_args(ar->ar_arg_argv,
985 if (ARG_IS_VALID(kar, ARG_ENVV)) {
986 tok = au_to_exec_env(ar->ar_arg_envv,
990 UPATH1_VNODE1_TOKENS;
994 if (ARG_IS_VALID(kar, ARG_MODE)) {
995 tok = au_to_arg32(2, "new file mode",
1003 * XXXRW: Some of these need to handle non-vnode cases as well.
1012 case AUE_GETDIRENTRIES:
1013 case AUE_GETDIRENTRIESATTR:
1016 case AUE_POSIX_FALLOCATE:
1027 if (ARG_IS_VALID(kar, ARG_UID)) {
1028 tok = au_to_arg32(2, "new file uid", ar->ar_arg_uid);
1029 kau_write(rec, tok);
1031 if (ARG_IS_VALID(kar, ARG_GID)) {
1032 tok = au_to_arg32(3, "new file gid", ar->ar_arg_gid);
1033 kau_write(rec, tok);
1039 if (ARG_IS_VALID(kar, ARG_CMD)) {
1040 tok = au_to_arg32(2, "cmd",
1041 au_fcntl_cmd_to_bsm(ar->ar_arg_cmd));
1042 kau_write(rec, tok);
1048 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1049 tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
1050 kau_write(rec, tok);
1056 if (ARG_IS_VALID(kar, ARG_CMD)) {
1057 tok = au_to_arg32(2, "operation", ar->ar_arg_cmd);
1058 kau_write(rec, tok);
1064 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1065 tok = au_to_arg32(1, "flags", ar->ar_arg_fflags);
1066 kau_write(rec, tok);
1072 if (ARG_IS_VALID(kar, ARG_PID)) {
1073 tok = au_to_arg32(0, "child PID", ar->ar_arg_pid);
1074 kau_write(rec, tok);
1079 if (ARG_IS_VALID(kar, ARG_CMD)) {
1080 tok = au_to_arg32(2, "cmd", ar->ar_arg_cmd);
1081 kau_write(rec, tok);
1083 if (ARG_IS_VALID(kar, ARG_VNODE1))
1086 if (ARG_IS_VALID(kar, ARG_SOCKINFO)) {
1087 tok = kau_to_socket(&ar->ar_arg_sockinfo);
1088 kau_write(rec, tok);
1090 if (ARG_IS_VALID(kar, ARG_FD)) {
1091 tok = au_to_arg32(1, "fd",
1093 kau_write(rec, tok);
1101 if (ARG_IS_VALID(kar, ARG_SIGNUM)) {
1102 tok = au_to_arg32(2, "signal", ar->ar_arg_signum);
1103 kau_write(rec, tok);
1105 PROCESS_PID_TOKENS(1);
1109 if (ARG_IS_VALID(kar, ARG_CMD)) {
1110 tok = au_to_arg32(2, "ops", ar->ar_arg_cmd);
1111 kau_write(rec, tok);
1113 if (ARG_IS_VALID(kar, ARG_VALUE)) {
1114 tok = au_to_arg32(3, "trpoints", ar->ar_arg_value);
1115 kau_write(rec, tok);
1117 PROCESS_PID_TOKENS(4);
1118 UPATH1_VNODE1_TOKENS;
1126 UPATH1_VNODE1_TOKENS;
1131 case AUE_LOADSHFILE:
1132 ADDR_TOKEN(4, "base addr");
1133 UPATH1_VNODE1_TOKENS;
1141 if (ARG_IS_VALID(kar, ARG_MODE)) {
1142 tok = au_to_arg32(2, "mode", ar->ar_arg_mode);
1143 kau_write(rec, tok);
1145 UPATH1_VNODE1_TOKENS;
1151 if (ARG_IS_VALID(kar, ARG_MODE)) {
1152 tok = au_to_arg32(2, "mode", ar->ar_arg_mode);
1153 kau_write(rec, tok);
1155 if (ARG_IS_VALID(kar, ARG_DEV)) {
1156 tok = au_to_arg32(3, "dev", ar->ar_arg_dev);
1157 kau_write(rec, tok);
1159 UPATH1_VNODE1_TOKENS;
1168 ADDR_TOKEN(1, "addr");
1169 if (ARG_IS_VALID(kar, ARG_LEN)) {
1170 tok = au_to_arg32(2, "len", ar->ar_arg_len);
1171 kau_write(rec, tok);
1173 if (ar->ar_event == AUE_MMAP)
1175 if (ar->ar_event == AUE_MPROTECT) {
1176 if (ARG_IS_VALID(kar, ARG_VALUE)) {
1177 tok = au_to_arg32(3, "protection",
1179 kau_write(rec, tok);
1182 if (ar->ar_event == AUE_MINHERIT) {
1183 if (ARG_IS_VALID(kar, ARG_VALUE)) {
1184 tok = au_to_arg32(3, "inherit",
1186 kau_write(rec, tok);
1193 /* XXX Need to handle NFS mounts */
1194 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1195 tok = au_to_arg32(3, "flags", ar->ar_arg_fflags);
1196 kau_write(rec, tok);
1198 if (ARG_IS_VALID(kar, ARG_TEXT)) {
1199 tok = au_to_text(ar->ar_arg_text);
1200 kau_write(rec, tok);
1205 if (ARG_IS_VALID(kar, ARG_CMD)) {
1206 tok = au_to_arg32(1, "flags", ar->ar_arg_cmd);
1207 kau_write(rec, tok);
1212 if (ARG_IS_VALID(kar, ARG_VALUE)) {
1213 tok = au_to_arg32(2, "flags", ar->ar_arg_value);
1214 kau_write(rec, tok);
1216 UPATH1_VNODE1_TOKENS;
1217 if (ARG_IS_VALID(kar, ARG_TEXT)) {
1218 tok = au_to_text(ar->ar_arg_text);
1219 kau_write(rec, tok);
1224 ar->ar_event = audit_msgctl_to_event(ar->ar_arg_svipc_cmd);
1229 tok = au_to_arg32(1, "msg ID", ar->ar_arg_svipc_id);
1230 kau_write(rec, tok);
1231 if (ar->ar_errno != EINVAL) {
1232 tok = au_to_ipc(AT_IPC_MSG, ar->ar_arg_svipc_id);
1233 kau_write(rec, tok);
1238 if (ar->ar_errno == 0) {
1239 if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
1240 tok = au_to_ipc(AT_IPC_MSG,
1241 ar->ar_arg_svipc_id);
1242 kau_write(rec, tok);
1247 case AUE_RESETSHFILE:
1248 ADDR_TOKEN(1, "base addr");
1258 if (ARG_IS_VALID(kar, ARG_MODE)) {
1259 tok = au_to_arg32(3, "mode", ar->ar_arg_mode);
1260 kau_write(rec, tok);
1270 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1271 tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
1272 kau_write(rec, tok);
1274 UPATH1_VNODE1_TOKENS;
1278 case AUE_OPENAT_RTC:
1279 case AUE_OPENAT_RWC:
1280 case AUE_OPENAT_RWTC:
1282 case AUE_OPENAT_WTC:
1283 if (ARG_IS_VALID(kar, ARG_MODE)) {
1284 tok = au_to_arg32(3, "mode", ar->ar_arg_mode);
1285 kau_write(rec, tok);
1292 case AUE_OPENAT_RWT:
1295 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1296 tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
1297 kau_write(rec, tok);
1300 UPATH1_VNODE1_TOKENS;
1304 if (ARG_IS_VALID(kar, ARG_VALUE)) {
1305 tok = au_to_arg32(1, "idtype", ar->ar_arg_value);
1306 kau_write(rec, tok);
1308 if (ARG_IS_VALID(kar, ARG_CMD)) {
1309 tok = au_to_arg32(2, "com", ar->ar_arg_cmd);
1310 kau_write(rec, tok);
1312 PROCESS_PID_TOKENS(3);
1316 if (ARG_IS_VALID(kar, ARG_CMD)) {
1317 tok = au_to_arg32(1, "request", ar->ar_arg_cmd);
1318 kau_write(rec, tok);
1320 if (ARG_IS_VALID(kar, ARG_VALUE)) {
1321 tok = au_to_arg32(4, "data", ar->ar_arg_value);
1322 kau_write(rec, tok);
1324 PROCESS_PID_TOKENS(2);
1328 if (ARG_IS_VALID(kar, ARG_CMD)) {
1329 tok = au_to_arg32(2, "command", ar->ar_arg_cmd);
1330 kau_write(rec, tok);
1332 if (ARG_IS_VALID(kar, ARG_UID)) {
1333 tok = au_to_arg32(3, "uid", ar->ar_arg_uid);
1334 kau_write(rec, tok);
1336 if (ARG_IS_VALID(kar, ARG_GID)) {
1337 tok = au_to_arg32(3, "gid", ar->ar_arg_gid);
1338 kau_write(rec, tok);
1340 UPATH1_VNODE1_TOKENS;
1344 if (ARG_IS_VALID(kar, ARG_CMD)) {
1345 tok = au_to_arg32(1, "howto", ar->ar_arg_cmd);
1346 kau_write(rec, tok);
1351 ar->ar_event = audit_semctl_to_event(ar->ar_arg_svipc_cmd);
1355 if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
1356 tok = au_to_arg32(1, "sem ID", ar->ar_arg_svipc_id);
1357 kau_write(rec, tok);
1358 if (ar->ar_errno != EINVAL) {
1359 tok = au_to_ipc(AT_IPC_SEM,
1360 ar->ar_arg_svipc_id);
1361 kau_write(rec, tok);
1367 if (ar->ar_errno == 0) {
1368 if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
1369 tok = au_to_ipc(AT_IPC_SEM,
1370 ar->ar_arg_svipc_id);
1371 kau_write(rec, tok);
1377 if (ARG_IS_VALID(kar, ARG_EGID)) {
1378 tok = au_to_arg32(1, "egid", ar->ar_arg_egid);
1379 kau_write(rec, tok);
1384 if (ARG_IS_VALID(kar, ARG_EUID)) {
1385 tok = au_to_arg32(1, "euid", ar->ar_arg_euid);
1386 kau_write(rec, tok);
1391 if (ARG_IS_VALID(kar, ARG_RGID)) {
1392 tok = au_to_arg32(1, "rgid", ar->ar_arg_rgid);
1393 kau_write(rec, tok);
1395 if (ARG_IS_VALID(kar, ARG_EGID)) {
1396 tok = au_to_arg32(2, "egid", ar->ar_arg_egid);
1397 kau_write(rec, tok);
1402 if (ARG_IS_VALID(kar, ARG_RUID)) {
1403 tok = au_to_arg32(1, "ruid", ar->ar_arg_ruid);
1404 kau_write(rec, tok);
1406 if (ARG_IS_VALID(kar, ARG_EUID)) {
1407 tok = au_to_arg32(2, "euid", ar->ar_arg_euid);
1408 kau_write(rec, tok);
1413 if (ARG_IS_VALID(kar, ARG_RGID)) {
1414 tok = au_to_arg32(1, "rgid", ar->ar_arg_rgid);
1415 kau_write(rec, tok);
1417 if (ARG_IS_VALID(kar, ARG_EGID)) {
1418 tok = au_to_arg32(2, "egid", ar->ar_arg_egid);
1419 kau_write(rec, tok);
1421 if (ARG_IS_VALID(kar, ARG_SGID)) {
1422 tok = au_to_arg32(3, "sgid", ar->ar_arg_sgid);
1423 kau_write(rec, tok);
1428 if (ARG_IS_VALID(kar, ARG_RUID)) {
1429 tok = au_to_arg32(1, "ruid", ar->ar_arg_ruid);
1430 kau_write(rec, tok);
1432 if (ARG_IS_VALID(kar, ARG_EUID)) {
1433 tok = au_to_arg32(2, "euid", ar->ar_arg_euid);
1434 kau_write(rec, tok);
1436 if (ARG_IS_VALID(kar, ARG_SUID)) {
1437 tok = au_to_arg32(3, "suid", ar->ar_arg_suid);
1438 kau_write(rec, tok);
1443 if (ARG_IS_VALID(kar, ARG_GID)) {
1444 tok = au_to_arg32(1, "gid", ar->ar_arg_gid);
1445 kau_write(rec, tok);
1450 if (ARG_IS_VALID(kar, ARG_UID)) {
1451 tok = au_to_arg32(1, "uid", ar->ar_arg_uid);
1452 kau_write(rec, tok);
1457 if (ARG_IS_VALID(kar, ARG_GROUPSET)) {
1458 for(ctr = 0; ctr < ar->ar_arg_groups.gidset_size; ctr++)
1460 tok = au_to_arg32(1, "setgroups",
1461 ar->ar_arg_groups.gidset[ctr]);
1462 kau_write(rec, tok);
1468 if (ARG_IS_VALID(kar, ARG_LOGIN)) {
1469 tok = au_to_text(ar->ar_arg_login);
1470 kau_write(rec, tok);
1474 case AUE_SETPRIORITY:
1475 if (ARG_IS_VALID(kar, ARG_CMD)) {
1476 tok = au_to_arg32(1, "which", ar->ar_arg_cmd);
1477 kau_write(rec, tok);
1479 if (ARG_IS_VALID(kar, ARG_UID)) {
1480 tok = au_to_arg32(2, "who", ar->ar_arg_uid);
1481 kau_write(rec, tok);
1483 PROCESS_PID_TOKENS(2);
1484 if (ARG_IS_VALID(kar, ARG_VALUE)) {
1485 tok = au_to_arg32(3, "priority", ar->ar_arg_value);
1486 kau_write(rec, tok);
1490 case AUE_SETPRIVEXEC:
1491 if (ARG_IS_VALID(kar, ARG_VALUE)) {
1492 tok = au_to_arg32(1, "flag", ar->ar_arg_value);
1493 kau_write(rec, tok);
1497 /* AUE_SHMAT, AUE_SHMCTL, AUE_SHMDT and AUE_SHMGET are SysV IPC */
1499 if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
1500 tok = au_to_arg32(1, "shmid", ar->ar_arg_svipc_id);
1501 kau_write(rec, tok);
1502 /* XXXAUDIT: Does having the ipc token make sense? */
1503 tok = au_to_ipc(AT_IPC_SHM, ar->ar_arg_svipc_id);
1504 kau_write(rec, tok);
1506 if (ARG_IS_VALID(kar, ARG_SVIPC_ADDR)) {
1507 tok = au_to_arg32(2, "shmaddr",
1508 (int)(uintptr_t)ar->ar_arg_svipc_addr);
1509 kau_write(rec, tok);
1511 if (ARG_IS_VALID(kar, ARG_SVIPC_PERM)) {
1512 tok = au_to_ipc_perm(&ar->ar_arg_svipc_perm);
1513 kau_write(rec, tok);
1518 if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
1519 tok = au_to_arg32(1, "shmid", ar->ar_arg_svipc_id);
1520 kau_write(rec, tok);
1521 /* XXXAUDIT: Does having the ipc token make sense? */
1522 tok = au_to_ipc(AT_IPC_SHM, ar->ar_arg_svipc_id);
1523 kau_write(rec, tok);
1525 switch (ar->ar_arg_svipc_cmd) {
1527 ar->ar_event = AUE_SHMCTL_STAT;
1530 ar->ar_event = AUE_SHMCTL_RMID;
1533 ar->ar_event = AUE_SHMCTL_SET;
1534 if (ARG_IS_VALID(kar, ARG_SVIPC_PERM)) {
1535 tok = au_to_ipc_perm(&ar->ar_arg_svipc_perm);
1536 kau_write(rec, tok);
1540 break; /* We will audit a bad command */
1545 if (ARG_IS_VALID(kar, ARG_SVIPC_ADDR)) {
1546 tok = au_to_arg32(1, "shmaddr",
1547 (int)(uintptr_t)ar->ar_arg_svipc_addr);
1548 kau_write(rec, tok);
1553 /* This is unusual; the return value is in an argument token */
1554 if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
1555 tok = au_to_arg32(0, "shmid", ar->ar_arg_svipc_id);
1556 kau_write(rec, tok);
1557 tok = au_to_ipc(AT_IPC_SHM, ar->ar_arg_svipc_id);
1558 kau_write(rec, tok);
1560 if (ARG_IS_VALID(kar, ARG_SVIPC_PERM)) {
1561 tok = au_to_ipc_perm(&ar->ar_arg_svipc_perm);
1562 kau_write(rec, tok);
1566 /* AUE_SHMOPEN, AUE_SHMUNLINK, AUE_SEMOPEN, AUE_SEMCLOSE
1567 * and AUE_SEMUNLINK are Posix IPC */
1569 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1570 tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
1571 kau_write(rec, tok);
1573 if (ARG_IS_VALID(kar, ARG_MODE)) {
1574 tok = au_to_arg32(3, "mode", ar->ar_arg_mode);
1575 kau_write(rec, tok);
1581 if (ARG_IS_VALID(kar, ARG_POSIX_IPC_PERM)) {
1582 struct ipc_perm perm;
1584 perm.uid = ar->ar_arg_pipc_perm.pipc_uid;
1585 perm.gid = ar->ar_arg_pipc_perm.pipc_gid;
1586 perm.cuid = ar->ar_arg_pipc_perm.pipc_uid;
1587 perm.cgid = ar->ar_arg_pipc_perm.pipc_gid;
1588 perm.mode = ar->ar_arg_pipc_perm.pipc_mode;
1591 tok = au_to_ipc_perm(&perm);
1592 kau_write(rec, tok);
1597 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1598 tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
1599 kau_write(rec, tok);
1601 if (ARG_IS_VALID(kar, ARG_MODE)) {
1602 tok = au_to_arg32(3, "mode", ar->ar_arg_mode);
1603 kau_write(rec, tok);
1605 if (ARG_IS_VALID(kar, ARG_VALUE)) {
1606 tok = au_to_arg32(4, "value", ar->ar_arg_value);
1607 kau_write(rec, tok);
1612 if (ARG_IS_VALID(kar, ARG_TEXT)) {
1613 tok = au_to_text(ar->ar_arg_text);
1614 kau_write(rec, tok);
1616 if (ARG_IS_VALID(kar, ARG_POSIX_IPC_PERM)) {
1617 struct ipc_perm perm;
1619 perm.uid = ar->ar_arg_pipc_perm.pipc_uid;
1620 perm.gid = ar->ar_arg_pipc_perm.pipc_gid;
1621 perm.cuid = ar->ar_arg_pipc_perm.pipc_uid;
1622 perm.cgid = ar->ar_arg_pipc_perm.pipc_gid;
1623 perm.mode = ar->ar_arg_pipc_perm.pipc_mode;
1626 tok = au_to_ipc_perm(&perm);
1627 kau_write(rec, tok);
1632 if (ARG_IS_VALID(kar, ARG_FD)) {
1633 tok = au_to_arg32(1, "sem", ar->ar_arg_fd);
1634 kau_write(rec, tok);
1640 if (ARG_IS_VALID(kar, ARG_TEXT)) {
1641 tok = au_to_text(ar->ar_arg_text);
1642 kau_write(rec, tok);
1645 UPATH1_VNODE1_TOKENS;
1649 case AUE_SYSCTL_NONADMIN:
1650 if (ARG_IS_VALID(kar, ARG_CTLNAME | ARG_LEN)) {
1651 for (ctr = 0; ctr < ar->ar_arg_len; ctr++) {
1652 tok = au_to_arg32(1, "name",
1653 ar->ar_arg_ctlname[ctr]);
1654 kau_write(rec, tok);
1657 if (ARG_IS_VALID(kar, ARG_VALUE)) {
1658 tok = au_to_arg32(5, "newval", ar->ar_arg_value);
1659 kau_write(rec, tok);
1661 if (ARG_IS_VALID(kar, ARG_TEXT)) {
1662 tok = au_to_text(ar->ar_arg_text);
1663 kau_write(rec, tok);
1668 if (ARG_IS_VALID(kar, ARG_MASK)) {
1669 tok = au_to_arg32(1, "new mask", ar->ar_arg_mask);
1670 kau_write(rec, tok);
1672 tok = au_to_arg32(0, "prev mask", ar->ar_retval);
1673 kau_write(rec, tok);
1678 PROCESS_PID_TOKENS(1);
1679 if (ARG_IS_VALID(kar, ARG_VALUE)) {
1680 tok = au_to_arg32(3, "options", ar->ar_arg_value);
1681 kau_write(rec, tok);
1685 case AUE_CAP_RIGHTS_LIMIT:
1687 * XXXRW/XXXJA: Would be nice to audit socket/etc information.
1690 if (ARG_IS_VALID(kar, ARG_RIGHTS)) {
1691 tok = au_to_rights(&ar->ar_arg_rights);
1692 kau_write(rec, tok);
1696 case AUE_CAP_FCNTLS_GET:
1697 case AUE_CAP_IOCTLS_GET:
1698 case AUE_CAP_IOCTLS_LIMIT:
1699 case AUE_CAP_RIGHTS_GET:
1700 if (ARG_IS_VALID(kar, ARG_FD)) {
1701 tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
1702 kau_write(rec, tok);
1706 case AUE_CAP_FCNTLS_LIMIT:
1708 if (ARG_IS_VALID(kar, ARG_FCNTL_RIGHTS)) {
1709 tok = au_to_arg32(2, "fcntlrights",
1710 ar->ar_arg_fcntl_rights);
1711 kau_write(rec, tok);
1716 case AUE_CAP_GETMODE:
1721 printf("BSM conversion requested for unknown event %d\n",
1725 * Write the subject token so it is properly freed here.
1727 if (jail_tok != NULL)
1728 kau_write(rec, jail_tok);
1729 kau_write(rec, subj_tok);
1731 return (BSM_NOAUDIT);
1734 if (jail_tok != NULL)
1735 kau_write(rec, jail_tok);
1736 kau_write(rec, subj_tok);
1737 tok = au_to_return32(au_errno_to_bsm(ar->ar_errno), ar->ar_retval);
1738 kau_write(rec, tok); /* Every record gets a return token */
1740 kau_close(rec, &ar->ar_endtime, ar->ar_event);
1743 return (BSM_SUCCESS);
1747 * Verify that a record is a valid BSM record. This verification is simple
1748 * now, but may be expanded on sometime in the future. Return 1 if the
1749 * record is good, 0 otherwise.
1752 bsm_rec_verify(void *rec)
1754 char c = *(char *)rec;
1757 * Check the token ID of the first token; it has to be a header
1760 * XXXAUDIT There needs to be a token structure to map a token.
1761 * XXXAUDIT 'Shouldn't be simply looking at the first char.
1763 if ((c != AUT_HEADER32) && (c != AUT_HEADER32_EX) &&
1764 (c != AUT_HEADER64) && (c != AUT_HEADER64_EX))