sys/security/audit/audit_bsm.c

   1 /*
   2  * Copyright (c) 1999-2009 Apple Inc.
   3  * All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions
   7  * are met:
   8  * 1.  Redistributions of source code must retain the above copyright
   9  *     notice, this list of conditions and the following disclaimer.
  10  * 2.  Redistributions in binary form must reproduce the above copyright
  11  *     notice, this list of conditions and the following disclaimer in the
  12  *     documentation and/or other materials provided with the distribution.
  13  * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
  14  *     its contributors may be used to endorse or promote products derived
  15  *     from this software without specific prior written permission.
  16  *
  17  * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND
  18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  20  * ARE DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR
  21  * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
  25  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
  26  * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  27  * POSSIBILITY OF SUCH DAMAGE.
  28  */
  29
  30 #include <sys/cdefs.h>
  31 __FBSDID("$FreeBSD$");
  32
  33 #include <sys/param.h>
  34 #include <sys/vnode.h>
  35 #include <sys/ipc.h>
  36 #include <sys/lock.h>
  37 #include <sys/malloc.h>
  38 #include <sys/mutex.h>
  39 #include <sys/socket.h>
  40 #include <sys/extattr.h>
  41 #include <sys/fcntl.h>
  42 #include <sys/user.h>
  43 #include <sys/systm.h>
  44
  45 #include <bsm/audit.h>
  46 #include <bsm/audit_internal.h>
  47 #include <bsm/audit_record.h>
  48 #include <bsm/audit_kevents.h>
  49
  50 #include <security/audit/audit.h>
  51 #include <security/audit/audit_private.h>
  52
  53 #include <netinet/in_systm.h>
  54 #include <netinet/in.h>
  55 #include <netinet/ip.h>
  56
  57 MALLOC_DEFINE(M_AUDITBSM, "audit_bsm", "Audit BSM data");
  58
  59 static void     audit_sys_auditon(struct audit_record *ar,
  60                     struct au_record *rec);
  61
  62 /*
  63  * Initialize the BSM auditing subsystem.
  64  */
  65 void
  66 kau_init(void)
  67 {
  68
  69         au_evclassmap_init();
  70 }
  71
  72 /*
  73  * This call reserves memory for the audit record.  Memory must be guaranteed
  74  * before any auditable event can be generated.  The au_record structure
  75  * maintains a reference to the memory allocated above and also the list of
  76  * tokens associated with this record.
  77  */
  78 static struct au_record *
  79 kau_open(void)
  80 {
  81         struct au_record *rec;
  82
  83         rec = malloc(sizeof(*rec), M_AUDITBSM, M_WAITOK);
  84         rec->data = NULL;
  85         TAILQ_INIT(&rec->token_q);
  86         rec->len = 0;
  87         rec->used = 1;
  88
  89         return (rec);
  90 }
  91
  92 /*
  93  * Store the token with the record descriptor.
  94  */
  95 static void
  96 kau_write(struct au_record *rec, struct au_token *tok)
  97 {
  98
  99         KASSERT(tok != NULL, ("kau_write: tok == NULL"));
 100
 101         TAILQ_INSERT_TAIL(&rec->token_q, tok, tokens);
 102         rec->len += tok->len;
 103 }
 104
 105 /*
 106  * Close out the audit record by adding the header token, identifying any
 107  * missing tokens.  Write out the tokens to the record memory.
 108  */
 109 static void
 110 kau_close(struct au_record *rec, struct timespec *ctime, short event)
 111 {
 112         u_char *dptr;
 113         size_t tot_rec_size;
 114         token_t *cur, *hdr, *trail;
 115         struct timeval tm;
 116         size_t hdrsize;
 117         struct auditinfo_addr ak;
 118         struct in6_addr *ap;
 119
 120         audit_get_kinfo(&ak);
 121         hdrsize = 0;
 122         switch (ak.ai_termid.at_type) {
 123         case AU_IPv4:
 124                 hdrsize = (ak.ai_termid.at_addr[0] == INADDR_ANY) ?
 125                     AUDIT_HEADER_SIZE : AUDIT_HEADER_EX_SIZE(&ak);
 126                 break;
 127         case AU_IPv6:
 128                 ap = (struct in6_addr *)&ak.ai_termid.at_addr[0];
 129                 hdrsize = (IN6_IS_ADDR_UNSPECIFIED(ap)) ? AUDIT_HEADER_SIZE :
 130                     AUDIT_HEADER_EX_SIZE(&ak);
 131                 break;
 132         default:
 133                 panic("kau_close: invalid address family");
 134         }
 135         tot_rec_size = rec->len + hdrsize + AUDIT_TRAILER_SIZE;
 136         rec->data = malloc(tot_rec_size, M_AUDITBSM, M_WAITOK | M_ZERO);
 137
 138         tm.tv_usec = ctime->tv_nsec / 1000;
 139         tm.tv_sec = ctime->tv_sec;
 140         if (hdrsize != AUDIT_HEADER_SIZE)
 141                 hdr = au_to_header32_ex_tm(tot_rec_size, event, 0, tm, &ak);
 142         else
 143                 hdr = au_to_header32_tm(tot_rec_size, event, 0, tm);
 144         TAILQ_INSERT_HEAD(&rec->token_q, hdr, tokens);
 145
 146         trail = au_to_trailer(tot_rec_size);
 147         TAILQ_INSERT_TAIL(&rec->token_q, trail, tokens);
 148
 149         rec->len = tot_rec_size;
 150         dptr = rec->data;
 151         TAILQ_FOREACH(cur, &rec->token_q, tokens) {
 152                 memcpy(dptr, cur->t_data, cur->len);
 153                 dptr += cur->len;
 154         }
 155 }
 156
 157 /*
 158  * Free a BSM audit record by releasing all the tokens and clearing the audit
 159  * record information.
 160  */
 161 void
 162 kau_free(struct au_record *rec)
 163 {
 164         struct au_token *tok;
 165
 166         /* Free the token list. */
 167         while ((tok = TAILQ_FIRST(&rec->token_q))) {
 168                 TAILQ_REMOVE(&rec->token_q, tok, tokens);
 169                 free(tok->t_data, M_AUDITBSM);
 170                 free(tok, M_AUDITBSM);
 171         }
 172
 173         rec->used = 0;
 174         rec->len = 0;
 175         free(rec->data, M_AUDITBSM);
 176         free(rec, M_AUDITBSM);
 177 }
 178
 179 /*
 180  * XXX: May want turn some (or all) of these macros into functions in order
 181  * to reduce the generated code size.
 182  *
 183  * XXXAUDIT: These macros assume that 'kar', 'ar', 'rec', and 'tok' in the
 184  * caller are OK with this.
 185  */
 186 #define ATFD1_TOKENS(argnum) do {                                       \
 187         if (ARG_IS_VALID(kar, ARG_ATFD1)) {                             \
 188                 tok = au_to_arg32(argnum, "at fd 1", ar->ar_arg_atfd1); \
 189                 kau_write(rec, tok);                                    \
 190         }                                                               \
 191 } while (0)
 192
 193 #define ATFD2_TOKENS(argnum) do {                                       \
 194         if (ARG_IS_VALID(kar, ARG_ATFD2)) {                             \
 195                 tok = au_to_arg32(argnum, "at fd 2", ar->ar_arg_atfd2); \
 196                 kau_write(rec, tok);                                    \
 197         }                                                               \
 198 } while (0)
 199
 200 #define UPATH1_TOKENS do {                                              \
 201         if (ARG_IS_VALID(kar, ARG_UPATH1)) {                            \
 202                 tok = au_to_path(ar->ar_arg_upath1);                    \
 203                 kau_write(rec, tok);                                    \
 204         }                                                               \
 205 } while (0)
 206
 207 #define UPATH2_TOKENS do {                                              \
 208         if (ARG_IS_VALID(kar, ARG_UPATH2)) {                            \
 209                 tok = au_to_path(ar->ar_arg_upath2);                    \
 210                 kau_write(rec, tok);                                    \
 211         }                                                               \
 212 } while (0)
 213
 214 #define VNODE1_TOKENS do {                                              \
 215         if (ARG_IS_VALID(kar, ARG_ATFD)) {                              \
 216                 tok = au_to_arg32(1, "at fd", ar->ar_arg_atfd);         \
 217                 kau_write(rec, tok);                                    \
 218         }                                                               \
 219         if (ARG_IS_VALID(kar, ARG_VNODE1)) {                            \
 220                 tok = au_to_attr32(&ar->ar_arg_vnode1);                 \
 221                 kau_write(rec, tok);                                    \
 222         }                                                               \
 223 } while (0)
 224
 225 #define UPATH1_VNODE1_TOKENS do {                                       \
 226         UPATH1_TOKENS;                                                  \
 227         if (ARG_IS_VALID(kar, ARG_VNODE1)) {                            \
 228                 tok = au_to_attr32(&ar->ar_arg_vnode1);                 \
 229                 kau_write(rec, tok);                                    \
 230         }                                                               \
 231 } while (0)
 232
 233 #define VNODE2_TOKENS do {                                              \
 234         if (ARG_IS_VALID(kar, ARG_VNODE2)) {                            \
 235                 tok = au_to_attr32(&ar->ar_arg_vnode2);                 \
 236                 kau_write(rec, tok);                                    \
 237         }                                                               \
 238 } while (0)
 239
 240 #define FD_VNODE1_TOKENS do {                                           \
 241         if (ARG_IS_VALID(kar, ARG_VNODE1)) {                            \
 242                 if (ARG_IS_VALID(kar, ARG_FD)) {                        \
 243                         tok = au_to_arg32(1, "fd", ar->ar_arg_fd);      \
 244                         kau_write(rec, tok);                            \
 245                 }                                                       \
 246                 tok = au_to_attr32(&ar->ar_arg_vnode1);                 \
 247                 kau_write(rec, tok);                                    \
 248         } else {                                                        \
 249                 if (ARG_IS_VALID(kar, ARG_FD)) {                        \
 250                         tok = au_to_arg32(1, "non-file: fd",            \
 251                             ar->ar_arg_fd);                             \
 252                         kau_write(rec, tok);                            \
 253                 }                                                       \
 254         }                                                               \
 255 } while (0)
 256
 257 #define PROCESS_PID_TOKENS(argn) do {                                   \
 258         if ((ar->ar_arg_pid > 0) /* Reference a single process */       \
 259             && (ARG_IS_VALID(kar, ARG_PROCESS))) {                      \
 260                 tok = au_to_process32_ex(ar->ar_arg_auid,               \
 261                     ar->ar_arg_euid, ar->ar_arg_egid,                   \
 262                     ar->ar_arg_ruid, ar->ar_arg_rgid,                   \
 263                     ar->ar_arg_pid, ar->ar_arg_asid,                    \
 264                     &ar->ar_arg_termid_addr);                           \
 265                 kau_write(rec, tok);                                    \
 266         } else if (ARG_IS_VALID(kar, ARG_PID)) {                        \
 267                 tok = au_to_arg32(argn, "process", ar->ar_arg_pid);     \
 268                 kau_write(rec, tok);                                    \
 269         }                                                               \
 270 } while (0)
 271
 272 #define EXTATTR_TOKENS(namespace_argnum) do {                           \
 273         if (ARG_IS_VALID(kar, ARG_VALUE)) {                             \
 274                 switch (ar->ar_arg_value) {                             \
 275                 case EXTATTR_NAMESPACE_USER:                            \
 276                         tok = au_to_text(EXTATTR_NAMESPACE_USER_STRING);\
 277                         break;                                          \
 278                 case EXTATTR_NAMESPACE_SYSTEM:                          \
 279                         tok = au_to_text(EXTATTR_NAMESPACE_SYSTEM_STRING);\
 280                         break;                                          \
 281                 default:                                                \
 282                         tok = au_to_arg32((namespace_argnum),           \
 283                             "attrnamespace", ar->ar_arg_value);         \
 284                         break;                                          \
 285                 }                                                       \
 286                 kau_write(rec, tok);                                    \
 287         }                                                               \
 288         /* attrname is in the text field */                             \
 289         if (ARG_IS_VALID(kar, ARG_TEXT)) {                              \
 290                 tok = au_to_text(ar->ar_arg_text);                      \
 291                 kau_write(rec, tok);                                    \
 292         }                                                               \
 293 } while (0)
 294
 295 /*
 296  * Not all pointer arguments to system calls are of interest, but in some
 297  * cases they reflect delegation of rights, such as mmap(2) followed by
 298  * minherit(2) before execve(2), so do the best we can.
 299  */
 300 #define ADDR_TOKEN(argnum, argname) do {                                \
 301         if (ARG_IS_VALID(kar, ARG_ADDR)) {                              \
 302                 if (sizeof(void *) == sizeof(uint32_t))                 \
 303                         tok = au_to_arg32((argnum), (argname),          \
 304                             (uint32_t)(uintptr_t)ar->ar_arg_addr);      \
 305                 else                                                    \
 306                         tok = au_to_arg64((argnum), (argname),          \
 307                             (uint64_t)(uintptr_t)ar->ar_arg_addr);      \
 308                 kau_write(rec, tok);                                    \
 309         }                                                               \
 310 } while (0)
 311
 312
 313 /*
 314  * Implement auditing for the auditon() system call. The audit tokens that
 315  * are generated depend on the command that was sent into the auditon()
 316  * system call.
 317  */
 318 static void
 319 audit_sys_auditon(struct audit_record *ar, struct au_record *rec)
 320 {
 321         struct au_token *tok;
 322
 323         tok = au_to_arg32(3, "length", ar->ar_arg_len);
 324         kau_write(rec, tok);
 325         switch (ar->ar_arg_cmd) {
 326         case A_OLDSETPOLICY:
 327                 if ((size_t)ar->ar_arg_len == sizeof(int64_t)) {
 328                         tok = au_to_arg64(2, "policy",
 329                             ar->ar_arg_auditon.au_policy64);
 330                         kau_write(rec, tok);
 331                         break;
 332                 }
 333                 /* FALLTHROUGH */
 334
 335         case A_SETPOLICY:
 336                 tok = au_to_arg32(2, "policy", ar->ar_arg_auditon.au_policy);
 337                 kau_write(rec, tok);
 338                 break;
 339
 340         case A_SETKMASK:
 341                 tok = au_to_arg32(2, "setkmask:as_success",
 342                     ar->ar_arg_auditon.au_mask.am_success);
 343                 kau_write(rec, tok);
 344                 tok = au_to_arg32(2, "setkmask:as_failure",
 345                     ar->ar_arg_auditon.au_mask.am_failure);
 346                 kau_write(rec, tok);
 347                 break;
 348
 349         case A_OLDSETQCTRL:
 350                 if ((size_t)ar->ar_arg_len == sizeof(au_qctrl64_t)) {
 351                         tok = au_to_arg64(2, "setqctrl:aq_hiwater",
 352                             ar->ar_arg_auditon.au_qctrl64.aq64_hiwater);
 353                         kau_write(rec, tok);
 354                         tok = au_to_arg64(2, "setqctrl:aq_lowater",
 355                             ar->ar_arg_auditon.au_qctrl64.aq64_lowater);
 356                         kau_write(rec, tok);
 357                         tok = au_to_arg64(2, "setqctrl:aq_bufsz",
 358                             ar->ar_arg_auditon.au_qctrl64.aq64_bufsz);
 359                         kau_write(rec, tok);
 360                         tok = au_to_arg64(2, "setqctrl:aq_delay",
 361                             ar->ar_arg_auditon.au_qctrl64.aq64_delay);
 362                         kau_write(rec, tok);
 363                         tok = au_to_arg64(2, "setqctrl:aq_minfree",
 364                             ar->ar_arg_auditon.au_qctrl64.aq64_minfree);
 365                         kau_write(rec, tok);
 366                         break;
 367                 }
 368                 /* FALLTHROUGH */
 369
 370         case A_SETQCTRL:
 371                 tok = au_to_arg32(2, "setqctrl:aq_hiwater",
 372                     ar->ar_arg_auditon.au_qctrl.aq_hiwater);
 373                 kau_write(rec, tok);
 374                 tok = au_to_arg32(2, "setqctrl:aq_lowater",
 375                     ar->ar_arg_auditon.au_qctrl.aq_lowater);
 376                 kau_write(rec, tok);
 377                 tok = au_to_arg32(2, "setqctrl:aq_bufsz",
 378                     ar->ar_arg_auditon.au_qctrl.aq_bufsz);
 379                 kau_write(rec, tok);
 380                 tok = au_to_arg32(2, "setqctrl:aq_delay",
 381                     ar->ar_arg_auditon.au_qctrl.aq_delay);
 382                 kau_write(rec, tok);
 383                 tok = au_to_arg32(2, "setqctrl:aq_minfree",
 384                     ar->ar_arg_auditon.au_qctrl.aq_minfree);
 385                 kau_write(rec, tok);
 386                 break;
 387
 388         case A_SETUMASK:
 389                 tok = au_to_arg32(2, "setumask:as_success",
 390                     ar->ar_arg_auditon.au_auinfo.ai_mask.am_success);
 391                 kau_write(rec, tok);
 392                 tok = au_to_arg32(2, "setumask:as_failure",
 393                     ar->ar_arg_auditon.au_auinfo.ai_mask.am_failure);
 394                 kau_write(rec, tok);
 395                 break;
 396
 397         case A_SETSMASK:
 398                 tok = au_to_arg32(2, "setsmask:as_success",
 399                     ar->ar_arg_auditon.au_auinfo.ai_mask.am_success);
 400                 kau_write(rec, tok);
 401                 tok = au_to_arg32(2, "setsmask:as_failure",
 402                     ar->ar_arg_auditon.au_auinfo.ai_mask.am_failure);
 403                 kau_write(rec, tok);
 404                 break;
 405
 406         case A_OLDSETCOND:
 407                 if ((size_t)ar->ar_arg_len == sizeof(int64_t)) {
 408                         tok = au_to_arg64(2, "setcond",
 409                             ar->ar_arg_auditon.au_cond64);
 410                         kau_write(rec, tok);
 411                         break;
 412                 }
 413                 /* FALLTHROUGH */
 414
 415         case A_SETCOND:
 416                 tok = au_to_arg32(2, "setcond", ar->ar_arg_auditon.au_cond);
 417                 kau_write(rec, tok);
 418                 break;
 419
 420         case A_SETCLASS:
 421                 kau_write(rec, tok);
 422                 tok = au_to_arg32(2, "setclass:ec_event",
 423                     ar->ar_arg_auditon.au_evclass.ec_number);
 424                 kau_write(rec, tok);
 425                 tok = au_to_arg32(2, "setclass:ec_class",
 426                     ar->ar_arg_auditon.au_evclass.ec_class);
 427                 kau_write(rec, tok);
 428                 break;
 429
 430         case A_SETPMASK:
 431                 tok = au_to_arg32(2, "setpmask:as_success",
 432                     ar->ar_arg_auditon.au_aupinfo.ap_mask.am_success);
 433                 kau_write(rec, tok);
 434                 tok = au_to_arg32(2, "setpmask:as_failure",
 435                     ar->ar_arg_auditon.au_aupinfo.ap_mask.am_failure);
 436                 kau_write(rec, tok);
 437                 break;
 438
 439         case A_SETFSIZE:
 440                 tok = au_to_arg32(2, "setfsize:filesize",
 441                     ar->ar_arg_auditon.au_fstat.af_filesz);
 442                 kau_write(rec, tok);
 443                 break;
 444
 445         default:
 446                 break;
 447         }
 448 }
 449
 450 /*
 451  * Convert an internal kernel audit record to a BSM record and return a
 452  * success/failure indicator. The BSM record is passed as an out parameter to
 453  * this function.
 454  *
 455  * Return conditions:
 456  *   BSM_SUCCESS: The BSM record is valid
 457  *   BSM_FAILURE: Failure; the BSM record is NULL.
 458  *   BSM_NOAUDIT: The event is not auditable for BSM; the BSM record is NULL.
 459  */
 460 int
 461 kaudit_to_bsm(struct kaudit_record *kar, struct au_record **pau)
 462 {
 463         struct au_token *tok, *subj_tok, *jail_tok;
 464         struct au_record *rec;
 465         au_tid_t tid;
 466         struct audit_record *ar;
 467         int ctr;
 468
 469         KASSERT(kar != NULL, ("kaudit_to_bsm: kar == NULL"));
 470
 471         *pau = NULL;
 472         ar = &kar->k_ar;
 473         rec = kau_open();
 474
 475         /*
 476          * Create the subject token.  If this credential was jailed be sure to
 477          * generate a zonename token.
 478          */
 479         if (ar->ar_jailname[0] != '\0')
 480                 jail_tok = au_to_zonename(ar->ar_jailname);
 481         else
 482                 jail_tok = NULL;
 483         switch (ar->ar_subj_term_addr.at_type) {
 484         case AU_IPv4:
 485                 tid.port = ar->ar_subj_term_addr.at_port;
 486                 tid.machine = ar->ar_subj_term_addr.at_addr[0];
 487                 subj_tok = au_to_subject32(ar->ar_subj_auid,  /* audit ID */
 488                     ar->ar_subj_cred.cr_uid, /* eff uid */
 489                     ar->ar_subj_egid,   /* eff group id */
 490                     ar->ar_subj_ruid,   /* real uid */
 491                     ar->ar_subj_rgid,   /* real group id */
 492                     ar->ar_subj_pid,    /* process id */
 493                     ar->ar_subj_asid,   /* session ID */
 494                     &tid);
 495                 break;
 496         case AU_IPv6:
 497                 subj_tok = au_to_subject32_ex(ar->ar_subj_auid,
 498                     ar->ar_subj_cred.cr_uid,
 499                     ar->ar_subj_egid,
 500                     ar->ar_subj_ruid,
 501                     ar->ar_subj_rgid,
 502                     ar->ar_subj_pid,
 503                     ar->ar_subj_asid,
 504                     &ar->ar_subj_term_addr);
 505                 break;
 506         default:
 507                 bzero(&tid, sizeof(tid));
 508                 subj_tok = au_to_subject32(ar->ar_subj_auid,
 509                     ar->ar_subj_cred.cr_uid,
 510                     ar->ar_subj_egid,
 511                     ar->ar_subj_ruid,
 512                     ar->ar_subj_rgid,
 513                     ar->ar_subj_pid,
 514                     ar->ar_subj_asid,
 515                     &tid);
 516         }
 517
 518         /*
 519          * The logic inside each case fills in the tokens required for the
 520          * event, except for the header, trailer, and return tokens.  The
 521          * header and trailer tokens are added by the kau_close() function.
 522          * The return token is added outside of the switch statement.
 523          */
 524         switch(ar->ar_event) {
 525         case AUE_ACCEPT:
 526         case AUE_BIND:
 527         case AUE_LISTEN:
 528         case AUE_CONNECT:
 529         case AUE_RECV:
 530         case AUE_RECVFROM:
 531         case AUE_RECVMSG:
 532         case AUE_SEND:
 533         case AUE_SENDFILE:
 534         case AUE_SENDMSG:
 535         case AUE_SENDTO:
 536                 /*
 537                  * Socket-related events.
 538                  */
 539                 if (ARG_IS_VALID(kar, ARG_FD)) {
 540                         tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
 541                         kau_write(rec, tok);
 542                 }
 543                 if (ARG_IS_VALID(kar, ARG_SADDRINET)) {
 544                         tok = au_to_sock_inet((struct sockaddr_in *)
 545                             &ar->ar_arg_sockaddr);
 546                         kau_write(rec, tok);
 547                 }
 548                 if (ARG_IS_VALID(kar, ARG_SADDRUNIX)) {
 549                         tok = au_to_sock_unix((struct sockaddr_un *)
 550                             &ar->ar_arg_sockaddr);
 551                         kau_write(rec, tok);
 552                         UPATH1_TOKENS;
 553                 }
 554                 /* XXX Need to handle ARG_SADDRINET6 */
 555                 break;
 556
 557         case AUE_BINDAT:
 558         case AUE_CONNECTAT:
 559                 ATFD1_TOKENS(1);
 560                 if (ARG_IS_VALID(kar, ARG_FD)) {
 561                         tok = au_to_arg32(2, "fd", ar->ar_arg_fd);
 562                         kau_write(rec, tok);
 563                 }
 564                 if (ARG_IS_VALID(kar, ARG_SADDRUNIX)) {
 565                         tok = au_to_sock_unix((struct sockaddr_un *)
 566                             &ar->ar_arg_sockaddr);
 567                         kau_write(rec, tok);
 568                         UPATH1_TOKENS;
 569                 }
 570                 break;
 571
 572         case AUE_SOCKET:
 573         case AUE_SOCKETPAIR:
 574                 if (ARG_IS_VALID(kar, ARG_SOCKINFO)) {
 575                         tok = au_to_arg32(1, "domain",
 576                             ar->ar_arg_sockinfo.so_domain);
 577                         kau_write(rec, tok);
 578                         tok = au_to_arg32(2, "type",
 579                             ar->ar_arg_sockinfo.so_type);
 580                         kau_write(rec, tok);
 581                         tok = au_to_arg32(3, "protocol",
 582                             ar->ar_arg_sockinfo.so_protocol);
 583                         kau_write(rec, tok);
 584                 }
 585                 break;
 586
 587         case AUE_SETSOCKOPT:
 588         case AUE_SHUTDOWN:
 589                 if (ARG_IS_VALID(kar, ARG_FD)) {
 590                         tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
 591                         kau_write(rec, tok);
 592                 }
 593                 break;
 594
 595         case AUE_ACCT:
 596                 if (ARG_IS_VALID(kar, ARG_UPATH1)) {
 597                         UPATH1_VNODE1_TOKENS;
 598                 } else {
 599                         tok = au_to_arg32(1, "accounting off", 0);
 600                         kau_write(rec, tok);
 601                 }
 602                 break;
 603
 604         case AUE_SETAUID:
 605                 if (ARG_IS_VALID(kar, ARG_AUID)) {
 606                         tok = au_to_arg32(2, "setauid", ar->ar_arg_auid);
 607                         kau_write(rec, tok);
 608                 }
 609                 break;
 610
 611         case AUE_SETAUDIT:
 612                 if (ARG_IS_VALID(kar, ARG_AUID) &&
 613                     ARG_IS_VALID(kar, ARG_ASID) &&
 614                     ARG_IS_VALID(kar, ARG_AMASK) &&
 615                     ARG_IS_VALID(kar, ARG_TERMID)) {
 616                         tok = au_to_arg32(1, "setaudit:auid",
 617                             ar->ar_arg_auid);
 618                         kau_write(rec, tok);
 619                         tok = au_to_arg32(1, "setaudit:port",
 620                             ar->ar_arg_termid.port);
 621                         kau_write(rec, tok);
 622                         tok = au_to_arg32(1, "setaudit:machine",
 623                             ar->ar_arg_termid.machine);
 624                         kau_write(rec, tok);
 625                         tok = au_to_arg32(1, "setaudit:as_success",
 626                             ar->ar_arg_amask.am_success);
 627                         kau_write(rec, tok);
 628                         tok = au_to_arg32(1, "setaudit:as_failure",
 629                             ar->ar_arg_amask.am_failure);
 630                         kau_write(rec, tok);
 631                         tok = au_to_arg32(1, "setaudit:asid",
 632                             ar->ar_arg_asid);
 633                         kau_write(rec, tok);
 634                 }
 635                 break;
 636
 637         case AUE_SETAUDIT_ADDR:
 638                 if (ARG_IS_VALID(kar, ARG_AUID) &&
 639                     ARG_IS_VALID(kar, ARG_ASID) &&
 640                     ARG_IS_VALID(kar, ARG_AMASK) &&
 641                     ARG_IS_VALID(kar, ARG_TERMID_ADDR)) {
 642                         tok = au_to_arg32(1, "setaudit_addr:auid",
 643                             ar->ar_arg_auid);
 644                         kau_write(rec, tok);
 645                         tok = au_to_arg32(1, "setaudit_addr:as_success",
 646                             ar->ar_arg_amask.am_success);
 647                         kau_write(rec, tok);
 648                         tok = au_to_arg32(1, "setaudit_addr:as_failure",
 649                             ar->ar_arg_amask.am_failure);
 650                         kau_write(rec, tok);
 651                         tok = au_to_arg32(1, "setaudit_addr:asid",
 652                             ar->ar_arg_asid);
 653                         kau_write(rec, tok);
 654                         tok = au_to_arg32(1, "setaudit_addr:type",
 655                             ar->ar_arg_termid_addr.at_type);
 656                         kau_write(rec, tok);
 657                         tok = au_to_arg32(1, "setaudit_addr:port",
 658                             ar->ar_arg_termid_addr.at_port);
 659                         kau_write(rec, tok);
 660                         if (ar->ar_arg_termid_addr.at_type == AU_IPv6)
 661                                 tok = au_to_in_addr_ex((struct in6_addr *)
 662                                     &ar->ar_arg_termid_addr.at_addr[0]);
 663                         if (ar->ar_arg_termid_addr.at_type == AU_IPv4)
 664                                 tok = au_to_in_addr((struct in_addr *)
 665                                     &ar->ar_arg_termid_addr.at_addr[0]);
 666                         kau_write(rec, tok);
 667                 }
 668                 break;
 669
 670         case AUE_AUDITON:
 671                 /*
 672                  * For AUDITON commands without own event, audit the cmd.
 673                  */
 674                 if (ARG_IS_VALID(kar, ARG_CMD)) {
 675                         tok = au_to_arg32(1, "cmd", ar->ar_arg_cmd);
 676                         kau_write(rec, tok);
 677                 }
 678                 /* FALLTHROUGH */
 679
 680         case AUE_AUDITON_GETCAR:
 681         case AUE_AUDITON_GETCLASS:
 682         case AUE_AUDITON_GETCOND:
 683         case AUE_AUDITON_GETCWD:
 684         case AUE_AUDITON_GETKMASK:
 685         case AUE_AUDITON_GETSTAT:
 686         case AUE_AUDITON_GPOLICY:
 687         case AUE_AUDITON_GQCTRL:
 688         case AUE_AUDITON_SETCLASS:
 689         case AUE_AUDITON_SETCOND:
 690         case AUE_AUDITON_SETKMASK:
 691         case AUE_AUDITON_SETSMASK:
 692         case AUE_AUDITON_SETSTAT:
 693         case AUE_AUDITON_SETUMASK:
 694         case AUE_AUDITON_SPOLICY:
 695         case AUE_AUDITON_SQCTRL:
 696                 if (ARG_IS_VALID(kar, ARG_AUDITON))
 697                         audit_sys_auditon(ar, rec);
 698                 break;
 699
 700         case AUE_AUDITCTL:
 701                 UPATH1_VNODE1_TOKENS;
 702                 break;
 703
 704         case AUE_EXIT:
 705                 if (ARG_IS_VALID(kar, ARG_EXIT)) {
 706                         tok = au_to_exit(ar->ar_arg_exitretval,
 707                             ar->ar_arg_exitstatus);
 708                         kau_write(rec, tok);
 709                 }
 710                 break;
 711
 712         case AUE_ADJTIME:
 713         case AUE_CLOCK_SETTIME:
 714         case AUE_AUDIT:
 715         case AUE_DUP2:
 716         case AUE_GETAUDIT:
 717         case AUE_GETAUDIT_ADDR:
 718         case AUE_GETAUID:
 719         case AUE_GETCWD:
 720         case AUE_GETFSSTAT:
 721         case AUE_GETRESUID:
 722         case AUE_GETRESGID:
 723         case AUE_KQUEUE:
 724         case AUE_MODLOAD:
 725         case AUE_MODUNLOAD:
 726         case AUE_MSGSYS:
 727         case AUE_NTP_ADJTIME:
 728         case AUE_PIPE:
 729         case AUE_POSIX_OPENPT:
 730         case AUE_PROFILE:
 731         case AUE_RTPRIO:
 732         case AUE_SEMSYS:
 733         case AUE_SHMSYS:
 734         case AUE_SETPGRP:
 735         case AUE_SETRLIMIT:
 736         case AUE_SETSID:
 737         case AUE_SETTIMEOFDAY:
 738         case AUE_SYSARCH:
 739
 740                 /*
 741                  * Header, subject, and return tokens added at end.
 742                  */
 743                 break;
 744
 745         case AUE_CHDIR:
 746         case AUE_CHROOT:
 747         case AUE_FSTATAT:
 748         case AUE_FUTIMESAT:
 749         case AUE_GETATTRLIST:
 750         case AUE_JAIL:
 751         case AUE_LUTIMES:
 752         case AUE_NFS_GETFH:
 753         case AUE_LSTAT:
 754         case AUE_LPATHCONF:
 755         case AUE_PATHCONF:
 756         case AUE_READLINK:
 757         case AUE_READLINKAT:
 758         case AUE_REVOKE:
 759         case AUE_RMDIR:
 760         case AUE_SEARCHFS:
 761         case AUE_SETATTRLIST:
 762         case AUE_STAT:
 763         case AUE_STATFS:
 764         case AUE_SWAPON:
 765         case AUE_SWAPOFF:
 766         case AUE_TRUNCATE:
 767         case AUE_UNDELETE:
 768         case AUE_UNLINK:
 769         case AUE_UNLINKAT:
 770         case AUE_UTIMES:
 771                 ATFD1_TOKENS(1);
 772                 UPATH1_VNODE1_TOKENS;
 773                 break;
 774
 775         case AUE_ACCESS:
 776         case AUE_EACCESS:
 777         case AUE_FACCESSAT:
 778                 ATFD1_TOKENS(1);
 779                 UPATH1_VNODE1_TOKENS;
 780                 if (ARG_IS_VALID(kar, ARG_VALUE)) {
 781                         tok = au_to_arg32(2, "mode", ar->ar_arg_value);
 782                         kau_write(rec, tok);
 783                 }
 784                 break;
 785
 786         case AUE_FHSTATFS:
 787         case AUE_FHOPEN:
 788         case AUE_FHSTAT:
 789                 /* XXXRW: Need to audit vnode argument. */
 790                 break;
 791
 792         case AUE_CHFLAGS:
 793         case AUE_LCHFLAGS:
 794                 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
 795                         tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
 796                         kau_write(rec, tok);
 797                 }
 798                 UPATH1_VNODE1_TOKENS;
 799                 break;
 800
 801         case AUE_CHMOD:
 802         case AUE_LCHMOD:
 803                 if (ARG_IS_VALID(kar, ARG_MODE)) {
 804                         tok = au_to_arg32(2, "new file mode",
 805                             ar->ar_arg_mode);
 806                         kau_write(rec, tok);
 807                 }
 808                 UPATH1_VNODE1_TOKENS;
 809                 break;
 810
 811         case AUE_FCHMODAT:
 812                 ATFD1_TOKENS(1);
 813                 if (ARG_IS_VALID(kar, ARG_MODE)) {
 814                         tok = au_to_arg32(3, "new file mode",
 815                             ar->ar_arg_mode);
 816                         kau_write(rec, tok);
 817                 }
 818                 UPATH1_VNODE1_TOKENS;
 819                 break;
 820
 821         case AUE_CHOWN:
 822         case AUE_LCHOWN:
 823                 if (ARG_IS_VALID(kar, ARG_UID)) {
 824                         tok = au_to_arg32(2, "new file uid", ar->ar_arg_uid);
 825                         kau_write(rec, tok);
 826                 }
 827                 if (ARG_IS_VALID(kar, ARG_GID)) {
 828                         tok = au_to_arg32(3, "new file gid", ar->ar_arg_gid);
 829                         kau_write(rec, tok);
 830                 }
 831                 UPATH1_VNODE1_TOKENS;
 832                 break;
 833
 834         case AUE_FCHOWNAT:
 835                 ATFD1_TOKENS(1);
 836                 if (ARG_IS_VALID(kar, ARG_UID)) {
 837                         tok = au_to_arg32(3, "new file uid", ar->ar_arg_uid);
 838                         kau_write(rec, tok);
 839                 }
 840                 if (ARG_IS_VALID(kar, ARG_GID)) {
 841                         tok = au_to_arg32(4, "new file gid", ar->ar_arg_gid);
 842                         kau_write(rec, tok);
 843                 }
 844                 UPATH1_VNODE1_TOKENS;
 845                 break;
 846
 847         case AUE_EXCHANGEDATA:
 848                 UPATH1_VNODE1_TOKENS;
 849                 UPATH2_TOKENS;
 850                 break;
 851
 852         case AUE_CLOSE:
 853                 if (ARG_IS_VALID(kar, ARG_FD)) {
 854                         tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
 855                         kau_write(rec, tok);
 856                 }
 857                 UPATH1_VNODE1_TOKENS;
 858                 break;
 859
 860         case AUE_CLOSEFROM:
 861                 if (ARG_IS_VALID(kar, ARG_FD)) {
 862                         tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
 863                         kau_write(rec, tok);
 864                 }
 865                 break;
 866
 867         case AUE_CORE:
 868                 if (ARG_IS_VALID(kar, ARG_SIGNUM)) {
 869                         tok = au_to_arg32(1, "signal", ar->ar_arg_signum);
 870                         kau_write(rec, tok);
 871                 }
 872                 UPATH1_VNODE1_TOKENS;
 873                 break;
 874
 875         case AUE_EXTATTRCTL:
 876                 UPATH1_VNODE1_TOKENS;
 877                 if (ARG_IS_VALID(kar, ARG_CMD)) {
 878                         tok = au_to_arg32(2, "cmd", ar->ar_arg_cmd);
 879                         kau_write(rec, tok);
 880                 }
 881                 /* extattrctl(2) filename parameter is in upath2/vnode2 */
 882                 UPATH2_TOKENS;
 883                 VNODE2_TOKENS;
 884                 EXTATTR_TOKENS(4);
 885                 break;
 886
 887         case AUE_EXTATTR_GET_FILE:
 888         case AUE_EXTATTR_SET_FILE:
 889         case AUE_EXTATTR_LIST_FILE:
 890         case AUE_EXTATTR_DELETE_FILE:
 891         case AUE_EXTATTR_GET_LINK:
 892         case AUE_EXTATTR_SET_LINK:
 893         case AUE_EXTATTR_LIST_LINK:
 894         case AUE_EXTATTR_DELETE_LINK:
 895                 UPATH1_VNODE1_TOKENS;
 896                 EXTATTR_TOKENS(2);
 897                 break;
 898
 899         case AUE_EXTATTR_GET_FD:
 900         case AUE_EXTATTR_SET_FD:
 901         case AUE_EXTATTR_LIST_FD:
 902         case AUE_EXTATTR_DELETE_FD:
 903                 if (ARG_IS_VALID(kar, ARG_FD)) {
 904                         tok = au_to_arg32(2, "fd", ar->ar_arg_fd);
 905                         kau_write(rec, tok);
 906                 }
 907                 EXTATTR_TOKENS(2);
 908                 break;
 909
 910         case AUE_FEXECVE:
 911                 if (ARG_IS_VALID(kar, ARG_FD)) {
 912                         tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
 913                         kau_write(rec, tok);
 914                 }
 915                 /* FALLTHROUGH */
 916
 917         case AUE_EXECVE:
 918         case AUE_MAC_EXECVE:
 919                 if (ARG_IS_VALID(kar, ARG_ARGV)) {
 920                         tok = au_to_exec_args(ar->ar_arg_argv,
 921                             ar->ar_arg_argc);
 922                         kau_write(rec, tok);
 923                 }
 924                 if (ARG_IS_VALID(kar, ARG_ENVV)) {
 925                         tok = au_to_exec_env(ar->ar_arg_envv,
 926                             ar->ar_arg_envc);
 927                         kau_write(rec, tok);
 928                 }
 929                 UPATH1_VNODE1_TOKENS;
 930                 break;
 931
 932         case AUE_FCHMOD:
 933                 if (ARG_IS_VALID(kar, ARG_MODE)) {
 934                         tok = au_to_arg32(2, "new file mode",
 935                             ar->ar_arg_mode);
 936                         kau_write(rec, tok);
 937                 }
 938                 FD_VNODE1_TOKENS;
 939                 break;
 940
 941         /*
 942          * XXXRW: Some of these need to handle non-vnode cases as well.
 943          */
 944         case AUE_FCHDIR:
 945         case AUE_FPATHCONF:
 946         case AUE_FSTAT:
 947         case AUE_FSTATFS:
 948         case AUE_FSYNC:
 949         case AUE_FTRUNCATE:
 950         case AUE_FUTIMES:
 951         case AUE_GETDIRENTRIES:
 952         case AUE_GETDIRENTRIESATTR:
 953         case AUE_LSEEK:
 954         case AUE_POLL:
 955         case AUE_READ:
 956         case AUE_READV:
 957         case AUE_WRITE:
 958         case AUE_WRITEV:
 959                 FD_VNODE1_TOKENS;
 960                 break;
 961
 962         case AUE_FCHOWN:
 963                 if (ARG_IS_VALID(kar, ARG_UID)) {
 964                         tok = au_to_arg32(2, "new file uid", ar->ar_arg_uid);
 965                         kau_write(rec, tok);
 966                 }
 967                 if (ARG_IS_VALID(kar, ARG_GID)) {
 968                         tok = au_to_arg32(3, "new file gid", ar->ar_arg_gid);
 969                         kau_write(rec, tok);
 970                 }
 971                 FD_VNODE1_TOKENS;
 972                 break;
 973
 974         case AUE_FCNTL:
 975                 if (ARG_IS_VALID(kar, ARG_CMD)) {
 976                         tok = au_to_arg32(2, "cmd",
 977                             au_fcntl_cmd_to_bsm(ar->ar_arg_cmd));
 978                         kau_write(rec, tok);
 979                 }
 980                 if (ar->ar_arg_cmd == F_GETLK || ar->ar_arg_cmd == F_SETLK ||
 981                     ar->ar_arg_cmd == F_SETLKW) {
 982                         FD_VNODE1_TOKENS;
 983                 }
 984                 break;
 985
 986         case AUE_FCHFLAGS:
 987                 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
 988                         tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
 989                         kau_write(rec, tok);
 990                 }
 991                 FD_VNODE1_TOKENS;
 992                 break;
 993
 994         case AUE_FLOCK:
 995                 if (ARG_IS_VALID(kar, ARG_CMD)) {
 996                         tok = au_to_arg32(2, "operation", ar->ar_arg_cmd);
 997                         kau_write(rec, tok);
 998                 }
 999                 FD_VNODE1_TOKENS;
1000                 break;
1001
1002         case AUE_RFORK:
1003                 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1004                         tok = au_to_arg32(1, "flags", ar->ar_arg_fflags);
1005                         kau_write(rec, tok);
1006                 }
1007                 /* FALLTHROUGH */
1008
1009         case AUE_FORK:
1010         case AUE_VFORK:
1011                 if (ARG_IS_VALID(kar, ARG_PID)) {
1012                         tok = au_to_arg32(0, "child PID", ar->ar_arg_pid);
1013                         kau_write(rec, tok);
1014                 }
1015                 break;
1016
1017         case AUE_IOCTL:
1018                 if (ARG_IS_VALID(kar, ARG_CMD)) {
1019                         tok = au_to_arg32(2, "cmd", ar->ar_arg_cmd);
1020                         kau_write(rec, tok);
1021                 }
1022                 if (ARG_IS_VALID(kar, ARG_VNODE1))
1023                         FD_VNODE1_TOKENS;
1024                 else {
1025                         if (ARG_IS_VALID(kar, ARG_SOCKINFO)) {
1026                                 tok = kau_to_socket(&ar->ar_arg_sockinfo);
1027                                 kau_write(rec, tok);
1028                         } else {
1029                                 if (ARG_IS_VALID(kar, ARG_FD)) {
1030                                         tok = au_to_arg32(1, "fd",
1031                                             ar->ar_arg_fd);
1032                                         kau_write(rec, tok);
1033                                 }
1034                         }
1035                 }
1036                 break;
1037
1038         case AUE_KILL:
1039         case AUE_KILLPG:
1040                 if (ARG_IS_VALID(kar, ARG_SIGNUM)) {
1041                         tok = au_to_arg32(2, "signal", ar->ar_arg_signum);
1042                         kau_write(rec, tok);
1043                 }
1044                 PROCESS_PID_TOKENS(1);
1045                 break;
1046
1047         case AUE_KTRACE:
1048                 if (ARG_IS_VALID(kar, ARG_CMD)) {
1049                         tok = au_to_arg32(2, "ops", ar->ar_arg_cmd);
1050                         kau_write(rec, tok);
1051                 }
1052                 if (ARG_IS_VALID(kar, ARG_VALUE)) {
1053                         tok = au_to_arg32(3, "trpoints", ar->ar_arg_value);
1054                         kau_write(rec, tok);
1055                 }
1056                 PROCESS_PID_TOKENS(4);
1057                 UPATH1_VNODE1_TOKENS;
1058                 break;
1059
1060         case AUE_LINK:
1061         case AUE_LINKAT:
1062         case AUE_RENAME:
1063         case AUE_RENAMEAT:
1064                 ATFD1_TOKENS(1);
1065                 UPATH1_VNODE1_TOKENS;
1066                 ATFD2_TOKENS(3);
1067                 UPATH2_TOKENS;
1068                 break;
1069
1070         case AUE_LOADSHFILE:
1071                 ADDR_TOKEN(4, "base addr");
1072                 UPATH1_VNODE1_TOKENS;
1073                 break;
1074
1075         case AUE_MKDIR:
1076         case AUE_MKDIRAT:
1077         case AUE_MKFIFO:
1078         case AUE_MKFIFOAT:
1079                 ATFD1_TOKENS(1);
1080                 if (ARG_IS_VALID(kar, ARG_MODE)) {
1081                         tok = au_to_arg32(2, "mode", ar->ar_arg_mode);
1082                         kau_write(rec, tok);
1083                 }
1084                 UPATH1_VNODE1_TOKENS;
1085                 break;
1086
1087         case AUE_MKNOD:
1088         case AUE_MKNODAT:
1089                 ATFD1_TOKENS(1);
1090                 if (ARG_IS_VALID(kar, ARG_MODE)) {
1091                         tok = au_to_arg32(2, "mode", ar->ar_arg_mode);
1092                         kau_write(rec, tok);
1093                 }
1094                 if (ARG_IS_VALID(kar, ARG_DEV)) {
1095                         tok = au_to_arg32(3, "dev", ar->ar_arg_dev);
1096                         kau_write(rec, tok);
1097                 }
1098                 UPATH1_VNODE1_TOKENS;
1099                 break;
1100
1101         case AUE_MMAP:
1102         case AUE_MUNMAP:
1103         case AUE_MPROTECT:
1104         case AUE_MLOCK:
1105         case AUE_MUNLOCK:
1106         case AUE_MINHERIT:
1107                 ADDR_TOKEN(1, "addr");
1108                 if (ARG_IS_VALID(kar, ARG_LEN)) {
1109                         tok = au_to_arg32(2, "len", ar->ar_arg_len);
1110                         kau_write(rec, tok);
1111                 }
1112                 if (ar->ar_event == AUE_MMAP)
1113                         FD_VNODE1_TOKENS;
1114                 if (ar->ar_event == AUE_MPROTECT) {
1115                         if (ARG_IS_VALID(kar, ARG_VALUE)) {
1116                                 tok = au_to_arg32(3, "protection",
1117                                     ar->ar_arg_value);
1118                                 kau_write(rec, tok);
1119                         }
1120                 }
1121                 if (ar->ar_event == AUE_MINHERIT) {
1122                         if (ARG_IS_VALID(kar, ARG_VALUE)) {
1123                                 tok = au_to_arg32(3, "inherit",
1124                                     ar->ar_arg_value);
1125                                 kau_write(rec, tok);
1126                         }
1127                 }
1128                 break;
1129
1130         case AUE_MOUNT:
1131         case AUE_NMOUNT:
1132                 /* XXX Need to handle NFS mounts */
1133                 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1134                         tok = au_to_arg32(3, "flags", ar->ar_arg_fflags);
1135                         kau_write(rec, tok);
1136                 }
1137                 if (ARG_IS_VALID(kar, ARG_TEXT)) {
1138                         tok = au_to_text(ar->ar_arg_text);
1139                         kau_write(rec, tok);
1140                 }
1141                 /* FALLTHROUGH */
1142
1143         case AUE_NFS_SVC:
1144                 if (ARG_IS_VALID(kar, ARG_CMD)) {
1145                         tok = au_to_arg32(1, "flags", ar->ar_arg_cmd);
1146                         kau_write(rec, tok);
1147                 }
1148                 break;
1149
1150         case AUE_UMOUNT:
1151                 if (ARG_IS_VALID(kar, ARG_VALUE)) {
1152                         tok = au_to_arg32(2, "flags", ar->ar_arg_value);
1153                         kau_write(rec, tok);
1154                 }
1155                 UPATH1_VNODE1_TOKENS;
1156                 if (ARG_IS_VALID(kar, ARG_TEXT)) {
1157                         tok = au_to_text(ar->ar_arg_text);
1158                         kau_write(rec, tok);
1159                 }
1160                 break;
1161
1162         case AUE_MSGCTL:
1163                 ar->ar_event = audit_msgctl_to_event(ar->ar_arg_svipc_cmd);
1164                 /* Fall through */
1165
1166         case AUE_MSGRCV:
1167         case AUE_MSGSND:
1168                 tok = au_to_arg32(1, "msg ID", ar->ar_arg_svipc_id);
1169                 kau_write(rec, tok);
1170                 if (ar->ar_errno != EINVAL) {
1171                         tok = au_to_ipc(AT_IPC_MSG, ar->ar_arg_svipc_id);
1172                         kau_write(rec, tok);
1173                 }
1174                 break;
1175
1176         case AUE_MSGGET:
1177                 if (ar->ar_errno == 0) {
1178                         if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
1179                                 tok = au_to_ipc(AT_IPC_MSG,
1180                                     ar->ar_arg_svipc_id);
1181                                 kau_write(rec, tok);
1182                         }
1183                 }
1184                 break;
1185
1186         case AUE_RESETSHFILE:
1187                 ADDR_TOKEN(1, "base addr");
1188                 break;
1189
1190         case AUE_OPEN_RC:
1191         case AUE_OPEN_RTC:
1192         case AUE_OPEN_RWC:
1193         case AUE_OPEN_RWTC:
1194         case AUE_OPEN_WC:
1195         case AUE_OPEN_WTC:
1196         case AUE_CREAT:
1197                 if (ARG_IS_VALID(kar, ARG_MODE)) {
1198                         tok = au_to_arg32(3, "mode", ar->ar_arg_mode);
1199                         kau_write(rec, tok);
1200                 }
1201                 /* FALLTHROUGH */
1202
1203         case AUE_OPEN_R:
1204         case AUE_OPEN_RT:
1205         case AUE_OPEN_RW:
1206         case AUE_OPEN_RWT:
1207         case AUE_OPEN_W:
1208         case AUE_OPEN_WT:
1209                 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1210                         tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
1211                         kau_write(rec, tok);
1212                 }
1213                 UPATH1_VNODE1_TOKENS;
1214                 break;
1215
1216         case AUE_OPENAT_RC:
1217         case AUE_OPENAT_RTC:
1218         case AUE_OPENAT_RWC:
1219         case AUE_OPENAT_RWTC:
1220         case AUE_OPENAT_WC:
1221         case AUE_OPENAT_WTC:
1222                 if (ARG_IS_VALID(kar, ARG_MODE)) {
1223                         tok = au_to_arg32(3, "mode", ar->ar_arg_mode);
1224                         kau_write(rec, tok);
1225                 }
1226                 /* FALLTHROUGH */
1227
1228         case AUE_OPENAT_R:
1229         case AUE_OPENAT_RT:
1230         case AUE_OPENAT_RW:
1231         case AUE_OPENAT_RWT:
1232         case AUE_OPENAT_W:
1233         case AUE_OPENAT_WT:
1234                 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1235                         tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
1236                         kau_write(rec, tok);
1237                 }
1238                 ATFD1_TOKENS(1);
1239                 UPATH1_VNODE1_TOKENS;
1240                 break;
1241
1242         case AUE_PTRACE:
1243                 if (ARG_IS_VALID(kar, ARG_CMD)) {
1244                         tok = au_to_arg32(1, "request", ar->ar_arg_cmd);
1245                         kau_write(rec, tok);
1246                 }
1247                 if (ARG_IS_VALID(kar, ARG_VALUE)) {
1248                         tok = au_to_arg32(4, "data", ar->ar_arg_value);
1249                         kau_write(rec, tok);
1250                 }
1251                 PROCESS_PID_TOKENS(2);
1252                 break;
1253
1254         case AUE_QUOTACTL:
1255                 if (ARG_IS_VALID(kar, ARG_CMD)) {
1256                         tok = au_to_arg32(2, "command", ar->ar_arg_cmd);
1257                         kau_write(rec, tok);
1258                 }
1259                 if (ARG_IS_VALID(kar, ARG_UID)) {
1260                         tok = au_to_arg32(3, "uid", ar->ar_arg_uid);
1261                         kau_write(rec, tok);
1262                 }
1263                 if (ARG_IS_VALID(kar, ARG_GID)) {
1264                         tok = au_to_arg32(3, "gid", ar->ar_arg_gid);
1265                         kau_write(rec, tok);
1266                 }
1267                 UPATH1_VNODE1_TOKENS;
1268                 break;
1269
1270         case AUE_REBOOT:
1271                 if (ARG_IS_VALID(kar, ARG_CMD)) {
1272                         tok = au_to_arg32(1, "howto", ar->ar_arg_cmd);
1273                         kau_write(rec, tok);
1274                 }
1275                 break;
1276
1277         case AUE_SEMCTL:
1278                 ar->ar_event = audit_semctl_to_event(ar->ar_arg_svipc_cmd);
1279                 /* Fall through */
1280
1281         case AUE_SEMOP:
1282                 if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
1283                         tok = au_to_arg32(1, "sem ID", ar->ar_arg_svipc_id);
1284                         kau_write(rec, tok);
1285                         if (ar->ar_errno != EINVAL) {
1286                                 tok = au_to_ipc(AT_IPC_SEM,
1287                                     ar->ar_arg_svipc_id);
1288                                 kau_write(rec, tok);
1289                         }
1290                 }
1291                 break;
1292
1293         case AUE_SEMGET:
1294                 if (ar->ar_errno == 0) {
1295                         if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
1296                                 tok = au_to_ipc(AT_IPC_SEM,
1297                                     ar->ar_arg_svipc_id);
1298                                 kau_write(rec, tok);
1299                         }
1300                 }
1301                 break;
1302
1303         case AUE_SETEGID:
1304                 if (ARG_IS_VALID(kar, ARG_EGID)) {
1305                         tok = au_to_arg32(1, "egid", ar->ar_arg_egid);
1306                         kau_write(rec, tok);
1307                 }
1308                 break;
1309
1310         case AUE_SETEUID:
1311                 if (ARG_IS_VALID(kar, ARG_EUID)) {
1312                         tok = au_to_arg32(1, "euid", ar->ar_arg_euid);
1313                         kau_write(rec, tok);
1314                 }
1315                 break;
1316
1317         case AUE_SETREGID:
1318                 if (ARG_IS_VALID(kar, ARG_RGID)) {
1319                         tok = au_to_arg32(1, "rgid", ar->ar_arg_rgid);
1320                         kau_write(rec, tok);
1321                 }
1322                 if (ARG_IS_VALID(kar, ARG_EGID)) {
1323                         tok = au_to_arg32(2, "egid", ar->ar_arg_egid);
1324                         kau_write(rec, tok);
1325                 }
1326                 break;
1327
1328         case AUE_SETREUID:
1329                 if (ARG_IS_VALID(kar, ARG_RUID)) {
1330                         tok = au_to_arg32(1, "ruid", ar->ar_arg_ruid);
1331                         kau_write(rec, tok);
1332                 }
1333                 if (ARG_IS_VALID(kar, ARG_EUID)) {
1334                         tok = au_to_arg32(2, "euid", ar->ar_arg_euid);
1335                         kau_write(rec, tok);
1336                 }
1337                 break;
1338
1339         case AUE_SETRESGID:
1340                 if (ARG_IS_VALID(kar, ARG_RGID)) {
1341                         tok = au_to_arg32(1, "rgid", ar->ar_arg_rgid);
1342                         kau_write(rec, tok);
1343                 }
1344                 if (ARG_IS_VALID(kar, ARG_EGID)) {
1345                         tok = au_to_arg32(2, "egid", ar->ar_arg_egid);
1346                         kau_write(rec, tok);
1347                 }
1348                 if (ARG_IS_VALID(kar, ARG_SGID)) {
1349                         tok = au_to_arg32(3, "sgid", ar->ar_arg_sgid);
1350                         kau_write(rec, tok);
1351                 }
1352                 break;
1353
1354         case AUE_SETRESUID:
1355                 if (ARG_IS_VALID(kar, ARG_RUID)) {
1356                         tok = au_to_arg32(1, "ruid", ar->ar_arg_ruid);
1357                         kau_write(rec, tok);
1358                 }
1359                 if (ARG_IS_VALID(kar, ARG_EUID)) {
1360                         tok = au_to_arg32(2, "euid", ar->ar_arg_euid);
1361                         kau_write(rec, tok);
1362                 }
1363                 if (ARG_IS_VALID(kar, ARG_SUID)) {
1364                         tok = au_to_arg32(3, "suid", ar->ar_arg_suid);
1365                         kau_write(rec, tok);
1366                 }
1367                 break;
1368
1369         case AUE_SETGID:
1370                 if (ARG_IS_VALID(kar, ARG_GID)) {
1371                         tok = au_to_arg32(1, "gid", ar->ar_arg_gid);
1372                         kau_write(rec, tok);
1373                 }
1374                 break;
1375
1376         case AUE_SETUID:
1377                 if (ARG_IS_VALID(kar, ARG_UID)) {
1378                         tok = au_to_arg32(1, "uid", ar->ar_arg_uid);
1379                         kau_write(rec, tok);
1380                 }
1381                 break;
1382
1383         case AUE_SETGROUPS:
1384                 if (ARG_IS_VALID(kar, ARG_GROUPSET)) {
1385                         for(ctr = 0; ctr < ar->ar_arg_groups.gidset_size; ctr++)
1386                         {
1387                                 tok = au_to_arg32(1, "setgroups",
1388                                     ar->ar_arg_groups.gidset[ctr]);
1389                                 kau_write(rec, tok);
1390                         }
1391                 }
1392                 break;
1393
1394         case AUE_SETLOGIN:
1395                 if (ARG_IS_VALID(kar, ARG_TEXT)) {
1396                         tok = au_to_text(ar->ar_arg_text);
1397                         kau_write(rec, tok);
1398                 }
1399                 break;
1400
1401         case AUE_SETPRIORITY:
1402                 if (ARG_IS_VALID(kar, ARG_CMD)) {
1403                         tok = au_to_arg32(1, "which", ar->ar_arg_cmd);
1404                         kau_write(rec, tok);
1405                 }
1406                 if (ARG_IS_VALID(kar, ARG_UID)) {
1407                         tok = au_to_arg32(2, "who", ar->ar_arg_uid);
1408                         kau_write(rec, tok);
1409                 }
1410                 PROCESS_PID_TOKENS(2);
1411                 if (ARG_IS_VALID(kar, ARG_VALUE)) {
1412                         tok = au_to_arg32(3, "priority", ar->ar_arg_value);
1413                         kau_write(rec, tok);
1414                 }
1415                 break;
1416
1417         case AUE_SETPRIVEXEC:
1418                 if (ARG_IS_VALID(kar, ARG_VALUE)) {
1419                         tok = au_to_arg32(1, "flag", ar->ar_arg_value);
1420                         kau_write(rec, tok);
1421                 }
1422                 break;
1423
1424         /* AUE_SHMAT, AUE_SHMCTL, AUE_SHMDT and AUE_SHMGET are SysV IPC */
1425         case AUE_SHMAT:
1426                 if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
1427                         tok = au_to_arg32(1, "shmid", ar->ar_arg_svipc_id);
1428                         kau_write(rec, tok);
1429                         /* XXXAUDIT: Does having the ipc token make sense? */
1430                         tok = au_to_ipc(AT_IPC_SHM, ar->ar_arg_svipc_id);
1431                         kau_write(rec, tok);
1432                 }
1433                 if (ARG_IS_VALID(kar, ARG_SVIPC_ADDR)) {
1434                         tok = au_to_arg32(2, "shmaddr",
1435                             (int)(uintptr_t)ar->ar_arg_svipc_addr);
1436                         kau_write(rec, tok);
1437                 }
1438                 if (ARG_IS_VALID(kar, ARG_SVIPC_PERM)) {
1439                         tok = au_to_ipc_perm(&ar->ar_arg_svipc_perm);
1440                         kau_write(rec, tok);
1441                 }
1442                 break;
1443
1444         case AUE_SHMCTL:
1445                 if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
1446                         tok = au_to_arg32(1, "shmid", ar->ar_arg_svipc_id);
1447                         kau_write(rec, tok);
1448                         /* XXXAUDIT: Does having the ipc token make sense? */
1449                         tok = au_to_ipc(AT_IPC_SHM, ar->ar_arg_svipc_id);
1450                         kau_write(rec, tok);
1451                 }
1452                 switch (ar->ar_arg_svipc_cmd) {
1453                 case IPC_STAT:
1454                         ar->ar_event = AUE_SHMCTL_STAT;
1455                         break;
1456                 case IPC_RMID:
1457                         ar->ar_event = AUE_SHMCTL_RMID;
1458                         break;
1459                 case IPC_SET:
1460                         ar->ar_event = AUE_SHMCTL_SET;
1461                         if (ARG_IS_VALID(kar, ARG_SVIPC_PERM)) {
1462                                 tok = au_to_ipc_perm(&ar->ar_arg_svipc_perm);
1463                                 kau_write(rec, tok);
1464                         }
1465                         break;
1466                 default:
1467                         break;  /* We will audit a bad command */
1468                 }
1469                 break;
1470
1471         case AUE_SHMDT:
1472                 if (ARG_IS_VALID(kar, ARG_SVIPC_ADDR)) {
1473                         tok = au_to_arg32(1, "shmaddr",
1474                             (int)(uintptr_t)ar->ar_arg_svipc_addr);
1475                         kau_write(rec, tok);
1476                 }
1477                 break;
1478
1479         case AUE_SHMGET:
1480                 /* This is unusual; the return value is in an argument token */
1481                 if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
1482                         tok = au_to_arg32(0, "shmid", ar->ar_arg_svipc_id);
1483                         kau_write(rec, tok);
1484                         tok = au_to_ipc(AT_IPC_SHM, ar->ar_arg_svipc_id);
1485                         kau_write(rec, tok);
1486                 }
1487                 if (ARG_IS_VALID(kar, ARG_SVIPC_PERM)) {
1488                         tok = au_to_ipc_perm(&ar->ar_arg_svipc_perm);
1489                         kau_write(rec, tok);
1490                 }
1491                 break;
1492
1493         /* AUE_SHMOPEN, AUE_SHMUNLINK, AUE_SEMOPEN, AUE_SEMCLOSE
1494          * and AUE_SEMUNLINK are Posix IPC */
1495         case AUE_SHMOPEN:
1496                 if (ARG_IS_VALID(kar, ARG_SVIPC_ADDR)) {
1497                         tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
1498                         kau_write(rec, tok);
1499                 }
1500                 if (ARG_IS_VALID(kar, ARG_MODE)) {
1501                         tok = au_to_arg32(3, "mode", ar->ar_arg_mode);
1502                         kau_write(rec, tok);
1503                 }
1504                 /* FALLTHROUGH */
1505
1506         case AUE_SHMUNLINK:
1507                 if (ARG_IS_VALID(kar, ARG_TEXT)) {
1508                         tok = au_to_text(ar->ar_arg_text);
1509                         kau_write(rec, tok);
1510                 }
1511                 if (ARG_IS_VALID(kar, ARG_POSIX_IPC_PERM)) {
1512                         struct ipc_perm perm;
1513
1514                         perm.uid = ar->ar_arg_pipc_perm.pipc_uid;
1515                         perm.gid = ar->ar_arg_pipc_perm.pipc_gid;
1516                         perm.cuid = ar->ar_arg_pipc_perm.pipc_uid;
1517                         perm.cgid = ar->ar_arg_pipc_perm.pipc_gid;
1518                         perm.mode = ar->ar_arg_pipc_perm.pipc_mode;
1519                         perm.seq = 0;
1520                         perm.key = 0;
1521                         tok = au_to_ipc_perm(&perm);
1522                         kau_write(rec, tok);
1523                 }
1524                 break;
1525
1526         case AUE_SEMOPEN:
1527                 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1528                         tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
1529                         kau_write(rec, tok);
1530                 }
1531                 if (ARG_IS_VALID(kar, ARG_MODE)) {
1532                         tok = au_to_arg32(3, "mode", ar->ar_arg_mode);
1533                         kau_write(rec, tok);
1534                 }
1535                 if (ARG_IS_VALID(kar, ARG_VALUE)) {
1536                         tok = au_to_arg32(4, "value", ar->ar_arg_value);
1537                         kau_write(rec, tok);
1538                 }
1539                 /* FALLTHROUGH */
1540
1541         case AUE_SEMUNLINK:
1542                 if (ARG_IS_VALID(kar, ARG_TEXT)) {
1543                         tok = au_to_text(ar->ar_arg_text);
1544                         kau_write(rec, tok);
1545                 }
1546                 if (ARG_IS_VALID(kar, ARG_POSIX_IPC_PERM)) {
1547                         struct ipc_perm perm;
1548
1549                         perm.uid = ar->ar_arg_pipc_perm.pipc_uid;
1550                         perm.gid = ar->ar_arg_pipc_perm.pipc_gid;
1551                         perm.cuid = ar->ar_arg_pipc_perm.pipc_uid;
1552                         perm.cgid = ar->ar_arg_pipc_perm.pipc_gid;
1553                         perm.mode = ar->ar_arg_pipc_perm.pipc_mode;
1554                         perm.seq = 0;
1555                         perm.key = 0;
1556                         tok = au_to_ipc_perm(&perm);
1557                         kau_write(rec, tok);
1558                 }
1559                 break;
1560
1561         case AUE_SEMCLOSE:
1562                 if (ARG_IS_VALID(kar, ARG_FD)) {
1563                         tok = au_to_arg32(1, "sem", ar->ar_arg_fd);
1564                         kau_write(rec, tok);
1565                 }
1566                 break;
1567
1568         case AUE_SYMLINK:
1569         case AUE_SYMLINKAT:
1570                 if (ARG_IS_VALID(kar, ARG_TEXT)) {
1571                         tok = au_to_text(ar->ar_arg_text);
1572                         kau_write(rec, tok);
1573                 }
1574                 ATFD1_TOKENS(1);
1575                 UPATH1_VNODE1_TOKENS;
1576                 break;
1577
1578         case AUE_SYSCTL:
1579         case AUE_SYSCTL_NONADMIN:
1580                 if (ARG_IS_VALID(kar, ARG_CTLNAME | ARG_LEN)) {
1581                         for (ctr = 0; ctr < ar->ar_arg_len; ctr++) {
1582                                 tok = au_to_arg32(1, "name",
1583                                     ar->ar_arg_ctlname[ctr]);
1584                                 kau_write(rec, tok);
1585                         }
1586                 }
1587                 if (ARG_IS_VALID(kar, ARG_VALUE)) {
1588                         tok = au_to_arg32(5, "newval", ar->ar_arg_value);
1589                         kau_write(rec, tok);
1590                 }
1591                 if (ARG_IS_VALID(kar, ARG_TEXT)) {
1592                         tok = au_to_text(ar->ar_arg_text);
1593                         kau_write(rec, tok);
1594                 }
1595                 break;
1596
1597         case AUE_UMASK:
1598                 if (ARG_IS_VALID(kar, ARG_MASK)) {
1599                         tok = au_to_arg32(1, "new mask", ar->ar_arg_mask);
1600                         kau_write(rec, tok);
1601                 }
1602                 tok = au_to_arg32(0, "prev mask", ar->ar_retval);
1603                 kau_write(rec, tok);
1604                 break;
1605
1606         case AUE_WAIT4:
1607                 PROCESS_PID_TOKENS(1);
1608                 if (ARG_IS_VALID(kar, ARG_VALUE)) {
1609                         tok = au_to_arg32(3, "options", ar->ar_arg_value);
1610                         kau_write(rec, tok);
1611                 }
1612                 break;
1613
1614         case AUE_CAP_RIGHTS_LIMIT:
1615                 /*
1616                  * XXXRW/XXXJA: Would be nice to audit socket/etc information.
1617                  */
1618                 FD_VNODE1_TOKENS;
1619                 if (ARG_IS_VALID(kar, ARG_RIGHTS)) {
1620                         tok = au_to_rights(&ar->ar_arg_rights);
1621                         kau_write(rec, tok);
1622                 }
1623                 break;
1624
1625         case AUE_CAP_FCNTLS_GET:
1626         case AUE_CAP_IOCTLS_GET:
1627         case AUE_CAP_IOCTLS_LIMIT:
1628         case AUE_CAP_RIGHTS_GET:
1629                 if (ARG_IS_VALID(kar, ARG_FD)) {
1630                         tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
1631                         kau_write(rec, tok);
1632                 }
1633                 break;
1634
1635         case AUE_CAP_FCNTLS_LIMIT:
1636                 FD_VNODE1_TOKENS;
1637                 if (ARG_IS_VALID(kar, ARG_FCNTL_RIGHTS)) {
1638                         tok = au_to_arg32(2, "fcntlrights",
1639                             ar->ar_arg_fcntl_rights);
1640                         kau_write(rec, tok);
1641                 }
1642                 break;
1643
1644         case AUE_CAP_ENTER:
1645         case AUE_CAP_GETMODE:
1646                 break;
1647
1648         case AUE_NULL:
1649         default:
1650                 printf("BSM conversion requested for unknown event %d\n",
1651                     ar->ar_event);
1652
1653                 /*
1654                  * Write the subject token so it is properly freed here.
1655                  */
1656                 if (jail_tok != NULL)
1657                         kau_write(rec, jail_tok);
1658                 kau_write(rec, subj_tok);
1659                 kau_free(rec);
1660                 return (BSM_NOAUDIT);
1661         }
1662
1663         if (jail_tok != NULL)
1664                 kau_write(rec, jail_tok);
1665         kau_write(rec, subj_tok);
1666         tok = au_to_return32(au_errno_to_bsm(ar->ar_errno), ar->ar_retval);
1667         kau_write(rec, tok);  /* Every record gets a return token */
1668
1669         kau_close(rec, &ar->ar_endtime, ar->ar_event);
1670
1671         *pau = rec;
1672         return (BSM_SUCCESS);
1673 }
1674
1675 /*
1676  * Verify that a record is a valid BSM record. This verification is simple
1677  * now, but may be expanded on sometime in the future.  Return 1 if the
1678  * record is good, 0 otherwise.
1679  */
1680 int
1681 bsm_rec_verify(void *rec)
1682 {
1683         char c = *(char *)rec;
1684
1685         /*
1686          * Check the token ID of the first token; it has to be a header
1687          * token.
1688          *
1689          * XXXAUDIT There needs to be a token structure to map a token.
1690          * XXXAUDIT 'Shouldn't be simply looking at the first char.
1691          */
1692         if ((c != AUT_HEADER32) && (c != AUT_HEADER32_EX) &&
1693             (c != AUT_HEADER64) && (c != AUT_HEADER64_EX))
1694                 return (0);
1695         return (1);
1696 }