sys/security/audit/audit_bsm.c

   1 /*
   2  * Copyright (c) 1999-2009 Apple Inc.
   3  * All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions
   7  * are met:
   8  * 1.  Redistributions of source code must retain the above copyright
   9  *     notice, this list of conditions and the following disclaimer.
  10  * 2.  Redistributions in binary form must reproduce the above copyright
  11  *     notice, this list of conditions and the following disclaimer in the
  12  *     documentation and/or other materials provided with the distribution.
  13  * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
  14  *     its contributors may be used to endorse or promote products derived
  15  *     from this software without specific prior written permission.
  16  *
  17  * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND
  18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  20  * ARE DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR
  21  * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
  25  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
  26  * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  27  * POSSIBILITY OF SUCH DAMAGE.
  28  */
  29
  30 #include <sys/cdefs.h>
  31 __FBSDID("$FreeBSD$");
  32
  33 #include <sys/param.h>
  34 #include <sys/vnode.h>
  35 #include <sys/ipc.h>
  36 #include <sys/lock.h>
  37 #include <sys/malloc.h>
  38 #include <sys/mutex.h>
  39 #include <sys/socket.h>
  40 #include <sys/extattr.h>
  41 #include <sys/fcntl.h>
  42 #include <sys/user.h>
  43 #include <sys/systm.h>
  44
  45 #include <bsm/audit.h>
  46 #include <bsm/audit_internal.h>
  47 #include <bsm/audit_record.h>
  48 #include <bsm/audit_kevents.h>
  49
  50 #include <security/audit/audit.h>
  51 #include <security/audit/audit_private.h>
  52
  53 #include <netinet/in_systm.h>
  54 #include <netinet/in.h>
  55 #include <netinet/ip.h>
  56
  57 MALLOC_DEFINE(M_AUDITBSM, "audit_bsm", "Audit BSM data");
  58
  59 static void     audit_sys_auditon(struct audit_record *ar,
  60                     struct au_record *rec);
  61
  62 /*
  63  * Initialize the BSM auditing subsystem.
  64  */
  65 void
  66 kau_init(void)
  67 {
  68
  69         au_evclassmap_init();
  70 }
  71
  72 /*
  73  * This call reserves memory for the audit record.  Memory must be guaranteed
  74  * before any auditable event can be generated.  The au_record structure
  75  * maintains a reference to the memory allocated above and also the list of
  76  * tokens associated with this record.
  77  */
  78 static struct au_record *
  79 kau_open(void)
  80 {
  81         struct au_record *rec;
  82
  83         rec = malloc(sizeof(*rec), M_AUDITBSM, M_WAITOK);
  84         rec->data = NULL;
  85         TAILQ_INIT(&rec->token_q);
  86         rec->len = 0;
  87         rec->used = 1;
  88
  89         return (rec);
  90 }
  91
  92 /*
  93  * Store the token with the record descriptor.
  94  */
  95 static void
  96 kau_write(struct au_record *rec, struct au_token *tok)
  97 {
  98
  99         KASSERT(tok != NULL, ("kau_write: tok == NULL"));
 100
 101         TAILQ_INSERT_TAIL(&rec->token_q, tok, tokens);
 102         rec->len += tok->len;
 103 }
 104
 105 /*
 106  * Close out the audit record by adding the header token, identifying any
 107  * missing tokens.  Write out the tokens to the record memory.
 108  */
 109 static void
 110 kau_close(struct au_record *rec, struct timespec *ctime, short event)
 111 {
 112         u_char *dptr;
 113         size_t tot_rec_size;
 114         token_t *cur, *hdr, *trail;
 115         struct timeval tm;
 116         size_t hdrsize;
 117         struct auditinfo_addr ak;
 118         struct in6_addr *ap;
 119
 120         audit_get_kinfo(&ak);
 121         hdrsize = 0;
 122         switch (ak.ai_termid.at_type) {
 123         case AU_IPv4:
 124                 hdrsize = (ak.ai_termid.at_addr[0] == INADDR_ANY) ?
 125                     AUDIT_HEADER_SIZE : AUDIT_HEADER_EX_SIZE(&ak);
 126                 break;
 127         case AU_IPv6:
 128                 ap = (struct in6_addr *)&ak.ai_termid.at_addr[0];
 129                 hdrsize = (IN6_IS_ADDR_UNSPECIFIED(ap)) ? AUDIT_HEADER_SIZE :
 130                     AUDIT_HEADER_EX_SIZE(&ak);
 131                 break;
 132         default:
 133                 panic("kau_close: invalid address family");
 134         }
 135         tot_rec_size = rec->len + hdrsize + AUDIT_TRAILER_SIZE;
 136         rec->data = malloc(tot_rec_size, M_AUDITBSM, M_WAITOK | M_ZERO);
 137
 138         tm.tv_usec = ctime->tv_nsec / 1000;
 139         tm.tv_sec = ctime->tv_sec;
 140         if (hdrsize != AUDIT_HEADER_SIZE)
 141                 hdr = au_to_header32_ex_tm(tot_rec_size, event, 0, tm, &ak);
 142         else
 143                 hdr = au_to_header32_tm(tot_rec_size, event, 0, tm);
 144         TAILQ_INSERT_HEAD(&rec->token_q, hdr, tokens);
 145
 146         trail = au_to_trailer(tot_rec_size);
 147         TAILQ_INSERT_TAIL(&rec->token_q, trail, tokens);
 148
 149         rec->len = tot_rec_size;
 150         dptr = rec->data;
 151         TAILQ_FOREACH(cur, &rec->token_q, tokens) {
 152                 memcpy(dptr, cur->t_data, cur->len);
 153                 dptr += cur->len;
 154         }
 155 }
 156
 157 /*
 158  * Free a BSM audit record by releasing all the tokens and clearing the audit
 159  * record information.
 160  */
 161 void
 162 kau_free(struct au_record *rec)
 163 {
 164         struct au_token *tok;
 165
 166         /* Free the token list. */
 167         while ((tok = TAILQ_FIRST(&rec->token_q))) {
 168                 TAILQ_REMOVE(&rec->token_q, tok, tokens);
 169                 free(tok->t_data, M_AUDITBSM);
 170                 free(tok, M_AUDITBSM);
 171         }
 172
 173         rec->used = 0;
 174         rec->len = 0;
 175         free(rec->data, M_AUDITBSM);
 176         free(rec, M_AUDITBSM);
 177 }
 178
 179 /*
 180  * XXX: May want turn some (or all) of these macros into functions in order
 181  * to reduce the generated code size.
 182  *
 183  * XXXAUDIT: These macros assume that 'kar', 'ar', 'rec', and 'tok' in the
 184  * caller are OK with this.
 185  */
 186 #define ATFD1_TOKENS(argnum) do {                                       \
 187         if (ARG_IS_VALID(kar, ARG_ATFD1)) {                             \
 188                 tok = au_to_arg32(argnum, "at fd 1", ar->ar_arg_atfd1); \
 189                 kau_write(rec, tok);                                    \
 190         }                                                               \
 191 } while (0)
 192
 193 #define ATFD2_TOKENS(argnum) do {                                       \
 194         if (ARG_IS_VALID(kar, ARG_ATFD2)) {                             \
 195                 tok = au_to_arg32(argnum, "at fd 2", ar->ar_arg_atfd2); \
 196                 kau_write(rec, tok);                                    \
 197         }                                                               \
 198 } while (0)
 199
 200 #define UPATH1_TOKENS do {                                              \
 201         if (ARG_IS_VALID(kar, ARG_UPATH1)) {                            \
 202                 tok = au_to_path(ar->ar_arg_upath1);                    \
 203                 kau_write(rec, tok);                                    \
 204         }                                                               \
 205 } while (0)
 206
 207 #define UPATH2_TOKENS do {                                              \
 208         if (ARG_IS_VALID(kar, ARG_UPATH2)) {                            \
 209                 tok = au_to_path(ar->ar_arg_upath2);                    \
 210                 kau_write(rec, tok);                                    \
 211         }                                                               \
 212 } while (0)
 213
 214 #define VNODE1_TOKENS do {                                              \
 215         if (ARG_IS_VALID(kar, ARG_ATFD)) {                              \
 216                 tok = au_to_arg32(1, "at fd", ar->ar_arg_atfd);         \
 217                 kau_write(rec, tok);                                    \
 218         }                                                               \
 219         if (ARG_IS_VALID(kar, ARG_VNODE1)) {                            \
 220                 tok = au_to_attr32(&ar->ar_arg_vnode1);                 \
 221                 kau_write(rec, tok);                                    \
 222         }                                                               \
 223 } while (0)
 224
 225 #define UPATH1_VNODE1_TOKENS do {                                       \
 226         if (ARG_IS_VALID(kar, ARG_UPATH1)) {                            \
 227                 UPATH1_TOKENS;                                          \
 228         }                                                               \
 229         if (ARG_IS_VALID(kar, ARG_VNODE1)) {                            \
 230                 tok = au_to_attr32(&ar->ar_arg_vnode1);                 \
 231                 kau_write(rec, tok);                                    \
 232         }                                                               \
 233 } while (0)
 234
 235 #define VNODE2_TOKENS do {                                              \
 236         if (ARG_IS_VALID(kar, ARG_VNODE2)) {                            \
 237                 tok = au_to_attr32(&ar->ar_arg_vnode2);                 \
 238                 kau_write(rec, tok);                                    \
 239         }                                                               \
 240 } while (0)
 241
 242 #define FD_VNODE1_TOKENS do {                                           \
 243         if (ARG_IS_VALID(kar, ARG_VNODE1)) {                            \
 244                 if (ARG_IS_VALID(kar, ARG_FD)) {                        \
 245                         tok = au_to_arg32(1, "fd", ar->ar_arg_fd);      \
 246                         kau_write(rec, tok);                            \
 247                 }                                                       \
 248                 tok = au_to_attr32(&ar->ar_arg_vnode1);                 \
 249                 kau_write(rec, tok);                                    \
 250         } else {                                                        \
 251                 if (ARG_IS_VALID(kar, ARG_FD)) {                        \
 252                         tok = au_to_arg32(1, "non-file: fd",            \
 253                             ar->ar_arg_fd);                             \
 254                         kau_write(rec, tok);                            \
 255                 }                                                       \
 256         }                                                               \
 257 } while (0)
 258
 259 #define PROCESS_PID_TOKENS(argn) do {                                   \
 260         if ((ar->ar_arg_pid > 0) /* Reference a single process */       \
 261             && (ARG_IS_VALID(kar, ARG_PROCESS))) {                      \
 262                 tok = au_to_process32_ex(ar->ar_arg_auid,               \
 263                     ar->ar_arg_euid, ar->ar_arg_egid,                   \
 264                     ar->ar_arg_ruid, ar->ar_arg_rgid,                   \
 265                     ar->ar_arg_pid, ar->ar_arg_asid,                    \
 266                     &ar->ar_arg_termid_addr);                           \
 267                 kau_write(rec, tok);                                    \
 268         } else if (ARG_IS_VALID(kar, ARG_PID)) {                        \
 269                 tok = au_to_arg32(argn, "process", ar->ar_arg_pid);     \
 270                 kau_write(rec, tok);                                    \
 271         }                                                               \
 272 } while (0)
 273
 274 #define EXTATTR_TOKENS(namespace_argnum) do {                           \
 275         if (ARG_IS_VALID(kar, ARG_VALUE)) {                             \
 276                 switch (ar->ar_arg_value) {                             \
 277                 case EXTATTR_NAMESPACE_USER:                            \
 278                         tok = au_to_text(EXTATTR_NAMESPACE_USER_STRING);\
 279                         break;                                          \
 280                 case EXTATTR_NAMESPACE_SYSTEM:                          \
 281                         tok = au_to_text(EXTATTR_NAMESPACE_SYSTEM_STRING);\
 282                         break;                                          \
 283                 default:                                                \
 284                         tok = au_to_arg32((namespace_argnum),           \
 285                             "attrnamespace", ar->ar_arg_value);         \
 286                         break;                                          \
 287                 }                                                       \
 288                 kau_write(rec, tok);                                    \
 289         }                                                               \
 290         /* attrname is in the text field */                             \
 291         if (ARG_IS_VALID(kar, ARG_TEXT)) {                              \
 292                 tok = au_to_text(ar->ar_arg_text);                      \
 293                 kau_write(rec, tok);                                    \
 294         }                                                               \
 295 } while (0)
 296
 297 /*
 298  * Not all pointer arguments to system calls are of interest, but in some
 299  * cases they reflect delegation of rights, such as mmap(2) followed by
 300  * minherit(2) before execve(2), so do the best we can.
 301  */
 302 #define ADDR_TOKEN(argnum, argname) do {                                \
 303         if (ARG_IS_VALID(kar, ARG_ADDR)) {                              \
 304                 if (sizeof(void *) == sizeof(uint32_t))                 \
 305                         tok = au_to_arg32((argnum), (argname),          \
 306                             (uint32_t)(uintptr_t)ar->ar_arg_addr);      \
 307                 else                                                    \
 308                         tok = au_to_arg64((argnum), (argname),          \
 309                             (uint64_t)(uintptr_t)ar->ar_arg_addr);      \
 310                 kau_write(rec, tok);                                    \
 311         }                                                               \
 312 } while (0)
 313
 314
 315 /*
 316  * Implement auditing for the auditon() system call. The audit tokens that
 317  * are generated depend on the command that was sent into the auditon()
 318  * system call.
 319  */
 320 static void
 321 audit_sys_auditon(struct audit_record *ar, struct au_record *rec)
 322 {
 323         struct au_token *tok;
 324
 325         tok = au_to_arg32(3, "length", ar->ar_arg_len);
 326         kau_write(rec, tok);
 327         switch (ar->ar_arg_cmd) {
 328         case A_OLDSETPOLICY:
 329                 if ((size_t)ar->ar_arg_len == sizeof(int64_t)) {
 330                         tok = au_to_arg64(2, "policy",
 331                             ar->ar_arg_auditon.au_policy64);
 332                         kau_write(rec, tok);
 333                         break;
 334                 }
 335                 /* FALLTHROUGH */
 336
 337         case A_SETPOLICY:
 338                 tok = au_to_arg32(2, "policy", ar->ar_arg_auditon.au_policy);
 339                 kau_write(rec, tok);
 340                 break;
 341
 342         case A_SETKMASK:
 343                 tok = au_to_arg32(2, "setkmask:as_success",
 344                     ar->ar_arg_auditon.au_mask.am_success);
 345                 kau_write(rec, tok);
 346                 tok = au_to_arg32(2, "setkmask:as_failure",
 347                     ar->ar_arg_auditon.au_mask.am_failure);
 348                 kau_write(rec, tok);
 349                 break;
 350
 351         case A_OLDSETQCTRL:
 352                 if ((size_t)ar->ar_arg_len == sizeof(au_qctrl64_t)) {
 353                         tok = au_to_arg64(2, "setqctrl:aq_hiwater",
 354                             ar->ar_arg_auditon.au_qctrl64.aq64_hiwater);
 355                         kau_write(rec, tok);
 356                         tok = au_to_arg64(2, "setqctrl:aq_lowater",
 357                             ar->ar_arg_auditon.au_qctrl64.aq64_lowater);
 358                         kau_write(rec, tok);
 359                         tok = au_to_arg64(2, "setqctrl:aq_bufsz",
 360                             ar->ar_arg_auditon.au_qctrl64.aq64_bufsz);
 361                         kau_write(rec, tok);
 362                         tok = au_to_arg64(2, "setqctrl:aq_delay",
 363                             ar->ar_arg_auditon.au_qctrl64.aq64_delay);
 364                         kau_write(rec, tok);
 365                         tok = au_to_arg64(2, "setqctrl:aq_minfree",
 366                             ar->ar_arg_auditon.au_qctrl64.aq64_minfree);
 367                         kau_write(rec, tok);
 368                         break;
 369                 }
 370                 /* FALLTHROUGH */
 371
 372         case A_SETQCTRL:
 373                 tok = au_to_arg32(2, "setqctrl:aq_hiwater",
 374                     ar->ar_arg_auditon.au_qctrl.aq_hiwater);
 375                 kau_write(rec, tok);
 376                 tok = au_to_arg32(2, "setqctrl:aq_lowater",
 377                     ar->ar_arg_auditon.au_qctrl.aq_lowater);
 378                 kau_write(rec, tok);
 379                 tok = au_to_arg32(2, "setqctrl:aq_bufsz",
 380                     ar->ar_arg_auditon.au_qctrl.aq_bufsz);
 381                 kau_write(rec, tok);
 382                 tok = au_to_arg32(2, "setqctrl:aq_delay",
 383                     ar->ar_arg_auditon.au_qctrl.aq_delay);
 384                 kau_write(rec, tok);
 385                 tok = au_to_arg32(2, "setqctrl:aq_minfree",
 386                     ar->ar_arg_auditon.au_qctrl.aq_minfree);
 387                 kau_write(rec, tok);
 388                 break;
 389
 390         case A_SETUMASK:
 391                 tok = au_to_arg32(2, "setumask:as_success",
 392                     ar->ar_arg_auditon.au_auinfo.ai_mask.am_success);
 393                 kau_write(rec, tok);
 394                 tok = au_to_arg32(2, "setumask:as_failure",
 395                     ar->ar_arg_auditon.au_auinfo.ai_mask.am_failure);
 396                 kau_write(rec, tok);
 397                 break;
 398
 399         case A_SETSMASK:
 400                 tok = au_to_arg32(2, "setsmask:as_success",
 401                     ar->ar_arg_auditon.au_auinfo.ai_mask.am_success);
 402                 kau_write(rec, tok);
 403                 tok = au_to_arg32(2, "setsmask:as_failure",
 404                     ar->ar_arg_auditon.au_auinfo.ai_mask.am_failure);
 405                 kau_write(rec, tok);
 406                 break;
 407
 408         case A_OLDSETCOND:
 409                 if ((size_t)ar->ar_arg_len == sizeof(int64_t)) {
 410                         tok = au_to_arg64(2, "setcond",
 411                             ar->ar_arg_auditon.au_cond64);
 412                         kau_write(rec, tok);
 413                         break;
 414                 }
 415                 /* FALLTHROUGH */
 416
 417         case A_SETCOND:
 418                 tok = au_to_arg32(2, "setcond", ar->ar_arg_auditon.au_cond);
 419                 kau_write(rec, tok);
 420                 break;
 421
 422         case A_SETCLASS:
 423                 kau_write(rec, tok);
 424                 tok = au_to_arg32(2, "setclass:ec_event",
 425                     ar->ar_arg_auditon.au_evclass.ec_number);
 426                 kau_write(rec, tok);
 427                 tok = au_to_arg32(2, "setclass:ec_class",
 428                     ar->ar_arg_auditon.au_evclass.ec_class);
 429                 kau_write(rec, tok);
 430                 break;
 431
 432         case A_SETPMASK:
 433                 tok = au_to_arg32(2, "setpmask:as_success",
 434                     ar->ar_arg_auditon.au_aupinfo.ap_mask.am_success);
 435                 kau_write(rec, tok);
 436                 tok = au_to_arg32(2, "setpmask:as_failure",
 437                     ar->ar_arg_auditon.au_aupinfo.ap_mask.am_failure);
 438                 kau_write(rec, tok);
 439                 break;
 440
 441         case A_SETFSIZE:
 442                 tok = au_to_arg32(2, "setfsize:filesize",
 443                     ar->ar_arg_auditon.au_fstat.af_filesz);
 444                 kau_write(rec, tok);
 445                 break;
 446
 447         default:
 448                 break;
 449         }
 450 }
 451
 452 /*
 453  * Convert an internal kernel audit record to a BSM record and return a
 454  * success/failure indicator. The BSM record is passed as an out parameter to
 455  * this function.
 456  *
 457  * Return conditions:
 458  *   BSM_SUCCESS: The BSM record is valid
 459  *   BSM_FAILURE: Failure; the BSM record is NULL.
 460  *   BSM_NOAUDIT: The event is not auditable for BSM; the BSM record is NULL.
 461  */
 462 int
 463 kaudit_to_bsm(struct kaudit_record *kar, struct au_record **pau)
 464 {
 465         struct au_token *tok, *subj_tok;
 466         struct au_record *rec;
 467         au_tid_t tid;
 468         struct audit_record *ar;
 469         int ctr;
 470
 471         KASSERT(kar != NULL, ("kaudit_to_bsm: kar == NULL"));
 472
 473         *pau = NULL;
 474         ar = &kar->k_ar;
 475         rec = kau_open();
 476
 477         /*
 478          * Create the subject token.
 479          */
 480         switch (ar->ar_subj_term_addr.at_type) {
 481         case AU_IPv4:
 482                 tid.port = ar->ar_subj_term_addr.at_port;
 483                 tid.machine = ar->ar_subj_term_addr.at_addr[0];
 484                 subj_tok = au_to_subject32(ar->ar_subj_auid,  /* audit ID */
 485                     ar->ar_subj_cred.cr_uid, /* eff uid */
 486                     ar->ar_subj_egid,   /* eff group id */
 487                     ar->ar_subj_ruid,   /* real uid */
 488                     ar->ar_subj_rgid,   /* real group id */
 489                     ar->ar_subj_pid,    /* process id */
 490                     ar->ar_subj_asid,   /* session ID */
 491                     &tid);
 492                 break;
 493         case AU_IPv6:
 494                 subj_tok = au_to_subject32_ex(ar->ar_subj_auid,
 495                     ar->ar_subj_cred.cr_uid,
 496                     ar->ar_subj_egid,
 497                     ar->ar_subj_ruid,
 498                     ar->ar_subj_rgid,
 499                     ar->ar_subj_pid,
 500                     ar->ar_subj_asid,
 501                     &ar->ar_subj_term_addr);
 502                 break;
 503         default:
 504                 bzero(&tid, sizeof(tid));
 505                 subj_tok = au_to_subject32(ar->ar_subj_auid,
 506                     ar->ar_subj_cred.cr_uid,
 507                     ar->ar_subj_egid,
 508                     ar->ar_subj_ruid,
 509                     ar->ar_subj_rgid,
 510                     ar->ar_subj_pid,
 511                     ar->ar_subj_asid,
 512                     &tid);
 513         }
 514
 515         /*
 516          * The logic inside each case fills in the tokens required for the
 517          * event, except for the header, trailer, and return tokens.  The
 518          * header and trailer tokens are added by the kau_close() function.
 519          * The return token is added outside of the switch statement.
 520          */
 521         switch(ar->ar_event) {
 522         case AUE_ACCEPT:
 523         case AUE_BIND:
 524         case AUE_LISTEN:
 525         case AUE_CONNECT:
 526         case AUE_RECV:
 527         case AUE_RECVFROM:
 528         case AUE_RECVMSG:
 529         case AUE_SEND:
 530         case AUE_SENDFILE:
 531         case AUE_SENDMSG:
 532         case AUE_SENDTO:
 533                 /*
 534                  * Socket-related events.
 535                  */
 536                 if (ARG_IS_VALID(kar, ARG_FD)) {
 537                         tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
 538                         kau_write(rec, tok);
 539                 }
 540                 if (ARG_IS_VALID(kar, ARG_SADDRINET)) {
 541                         tok = au_to_sock_inet((struct sockaddr_in *)
 542                             &ar->ar_arg_sockaddr);
 543                         kau_write(rec, tok);
 544                 }
 545                 if (ARG_IS_VALID(kar, ARG_SADDRUNIX)) {
 546                         tok = au_to_sock_unix((struct sockaddr_un *)
 547                             &ar->ar_arg_sockaddr);
 548                         kau_write(rec, tok);
 549                         UPATH1_TOKENS;
 550                 }
 551                 /* XXX Need to handle ARG_SADDRINET6 */
 552                 break;
 553
 554         case AUE_SOCKET:
 555         case AUE_SOCKETPAIR:
 556                 if (ARG_IS_VALID(kar, ARG_SOCKINFO)) {
 557                         tok = au_to_arg32(1, "domain",
 558                             ar->ar_arg_sockinfo.so_domain);
 559                         kau_write(rec, tok);
 560                         tok = au_to_arg32(2, "type",
 561                             ar->ar_arg_sockinfo.so_type);
 562                         kau_write(rec, tok);
 563                         tok = au_to_arg32(3, "protocol",
 564                             ar->ar_arg_sockinfo.so_protocol);
 565                         kau_write(rec, tok);
 566                 }
 567                 break;
 568
 569         case AUE_SETSOCKOPT:
 570         case AUE_SHUTDOWN:
 571                 if (ARG_IS_VALID(kar, ARG_FD)) {
 572                         tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
 573                         kau_write(rec, tok);
 574                 }
 575                 break;
 576
 577         case AUE_ACCT:
 578                 if (ARG_IS_VALID(kar, ARG_UPATH1)) {
 579                         UPATH1_VNODE1_TOKENS;
 580                 } else {
 581                         tok = au_to_arg32(1, "accounting off", 0);
 582                         kau_write(rec, tok);
 583                 }
 584                 break;
 585
 586         case AUE_SETAUID:
 587                 if (ARG_IS_VALID(kar, ARG_AUID)) {
 588                         tok = au_to_arg32(2, "setauid", ar->ar_arg_auid);
 589                         kau_write(rec, tok);
 590                 }
 591                 break;
 592
 593         case AUE_SETAUDIT:
 594                 if (ARG_IS_VALID(kar, ARG_AUID) &&
 595                     ARG_IS_VALID(kar, ARG_ASID) &&
 596                     ARG_IS_VALID(kar, ARG_AMASK) &&
 597                     ARG_IS_VALID(kar, ARG_TERMID)) {
 598                         tok = au_to_arg32(1, "setaudit:auid",
 599                             ar->ar_arg_auid);
 600                         kau_write(rec, tok);
 601                         tok = au_to_arg32(1, "setaudit:port",
 602                             ar->ar_arg_termid.port);
 603                         kau_write(rec, tok);
 604                         tok = au_to_arg32(1, "setaudit:machine",
 605                             ar->ar_arg_termid.machine);
 606                         kau_write(rec, tok);
 607                         tok = au_to_arg32(1, "setaudit:as_success",
 608                             ar->ar_arg_amask.am_success);
 609                         kau_write(rec, tok);
 610                         tok = au_to_arg32(1, "setaudit:as_failure",
 611                             ar->ar_arg_amask.am_failure);
 612                         kau_write(rec, tok);
 613                         tok = au_to_arg32(1, "setaudit:asid",
 614                             ar->ar_arg_asid);
 615                         kau_write(rec, tok);
 616                 }
 617                 break;
 618
 619         case AUE_SETAUDIT_ADDR:
 620                 if (ARG_IS_VALID(kar, ARG_AUID) &&
 621                     ARG_IS_VALID(kar, ARG_ASID) &&
 622                     ARG_IS_VALID(kar, ARG_AMASK) &&
 623                     ARG_IS_VALID(kar, ARG_TERMID_ADDR)) {
 624                         tok = au_to_arg32(1, "setaudit_addr:auid",
 625                             ar->ar_arg_auid);
 626                         kau_write(rec, tok);
 627                         tok = au_to_arg32(1, "setaudit_addr:as_success",
 628                             ar->ar_arg_amask.am_success);
 629                         kau_write(rec, tok);
 630                         tok = au_to_arg32(1, "setaudit_addr:as_failure",
 631                             ar->ar_arg_amask.am_failure);
 632                         kau_write(rec, tok);
 633                         tok = au_to_arg32(1, "setaudit_addr:asid",
 634                             ar->ar_arg_asid);
 635                         kau_write(rec, tok);
 636                         tok = au_to_arg32(1, "setaudit_addr:type",
 637                             ar->ar_arg_termid_addr.at_type);
 638                         kau_write(rec, tok);
 639                         tok = au_to_arg32(1, "setaudit_addr:port",
 640                             ar->ar_arg_termid_addr.at_port);
 641                         kau_write(rec, tok);
 642                         if (ar->ar_arg_termid_addr.at_type == AU_IPv6)
 643                                 tok = au_to_in_addr_ex((struct in6_addr *)
 644                                     &ar->ar_arg_termid_addr.at_addr[0]);
 645                         if (ar->ar_arg_termid_addr.at_type == AU_IPv4)
 646                                 tok = au_to_in_addr((struct in_addr *)
 647                                     &ar->ar_arg_termid_addr.at_addr[0]);
 648                         kau_write(rec, tok);
 649                 }
 650                 break;
 651
 652         case AUE_AUDITON:
 653                 /*
 654                  * For AUDITON commands without own event, audit the cmd.
 655                  */
 656                 if (ARG_IS_VALID(kar, ARG_CMD)) {
 657                         tok = au_to_arg32(1, "cmd", ar->ar_arg_cmd);
 658                         kau_write(rec, tok);
 659                 }
 660                 /* FALLTHROUGH */
 661
 662         case AUE_AUDITON_GETCAR:
 663         case AUE_AUDITON_GETCLASS:
 664         case AUE_AUDITON_GETCOND:
 665         case AUE_AUDITON_GETCWD:
 666         case AUE_AUDITON_GETKMASK:
 667         case AUE_AUDITON_GETSTAT:
 668         case AUE_AUDITON_GPOLICY:
 669         case AUE_AUDITON_GQCTRL:
 670         case AUE_AUDITON_SETCLASS:
 671         case AUE_AUDITON_SETCOND:
 672         case AUE_AUDITON_SETKMASK:
 673         case AUE_AUDITON_SETSMASK:
 674         case AUE_AUDITON_SETSTAT:
 675         case AUE_AUDITON_SETUMASK:
 676         case AUE_AUDITON_SPOLICY:
 677         case AUE_AUDITON_SQCTRL:
 678                 if (ARG_IS_VALID(kar, ARG_AUDITON))
 679                         audit_sys_auditon(ar, rec);
 680                 break;
 681
 682         case AUE_AUDITCTL:
 683                 UPATH1_VNODE1_TOKENS;
 684                 break;
 685
 686         case AUE_EXIT:
 687                 if (ARG_IS_VALID(kar, ARG_EXIT)) {
 688                         tok = au_to_exit(ar->ar_arg_exitretval,
 689                             ar->ar_arg_exitstatus);
 690                         kau_write(rec, tok);
 691                 }
 692                 break;
 693
 694         case AUE_ADJTIME:
 695         case AUE_CLOCK_SETTIME:
 696         case AUE_AUDIT:
 697         case AUE_DUP2:
 698         case AUE_GETAUDIT:
 699         case AUE_GETAUDIT_ADDR:
 700         case AUE_GETAUID:
 701         case AUE_GETCWD:
 702         case AUE_GETFSSTAT:
 703         case AUE_GETRESUID:
 704         case AUE_GETRESGID:
 705         case AUE_KQUEUE:
 706         case AUE_MODLOAD:
 707         case AUE_MODUNLOAD:
 708         case AUE_MSGSYS:
 709         case AUE_NTP_ADJTIME:
 710         case AUE_PIPE:
 711         case AUE_POSIX_OPENPT:
 712         case AUE_PROFILE:
 713         case AUE_RTPRIO:
 714         case AUE_SEMSYS:
 715         case AUE_SHMSYS:
 716         case AUE_SETPGRP:
 717         case AUE_SETRLIMIT:
 718         case AUE_SETSID:
 719         case AUE_SETTIMEOFDAY:
 720         case AUE_SYSARCH:
 721
 722                 /*
 723                  * Header, subject, and return tokens added at end.
 724                  */
 725                 break;
 726
 727         case AUE_MKFIFO:
 728                 if (ARG_IS_VALID(kar, ARG_MODE)) {
 729                         tok = au_to_arg32(2, "mode", ar->ar_arg_mode);
 730                         kau_write(rec, tok);
 731                 }
 732                 /* FALLTHROUGH */
 733
 734         case AUE_CHDIR:
 735         case AUE_CHROOT:
 736         case AUE_FSTATAT:
 737         case AUE_FUTIMESAT:
 738         case AUE_GETATTRLIST:
 739         case AUE_JAIL:
 740         case AUE_LUTIMES:
 741         case AUE_NFS_GETFH:
 742         case AUE_LSTAT:
 743         case AUE_PATHCONF:
 744         case AUE_READLINK:
 745         case AUE_REVOKE:
 746         case AUE_RMDIR:
 747         case AUE_SEARCHFS:
 748         case AUE_SETATTRLIST:
 749         case AUE_STAT:
 750         case AUE_STATFS:
 751         case AUE_SWAPON:
 752         case AUE_SWAPOFF:
 753         case AUE_TRUNCATE:
 754         case AUE_UNDELETE:
 755         case AUE_UNLINK:
 756         case AUE_UNLINKAT:
 757         case AUE_UTIMES:
 758                 ATFD1_TOKENS(1);
 759                 UPATH1_VNODE1_TOKENS;
 760                 break;
 761
 762         case AUE_ACCESS:
 763         case AUE_EACCESS:
 764                 UPATH1_VNODE1_TOKENS;
 765                 if (ARG_IS_VALID(kar, ARG_VALUE)) {
 766                         tok = au_to_arg32(2, "mode", ar->ar_arg_value);
 767                         kau_write(rec, tok);
 768                 }
 769                 break;
 770
 771         case AUE_FHSTATFS:
 772         case AUE_FHOPEN:
 773         case AUE_FHSTAT:
 774                 /* XXXRW: Need to audit vnode argument. */
 775                 break;
 776
 777         case AUE_CHFLAGS:
 778         case AUE_LCHFLAGS:
 779                 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
 780                         tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
 781                         kau_write(rec, tok);
 782                 }
 783                 UPATH1_VNODE1_TOKENS;
 784                 break;
 785
 786         case AUE_CHMOD:
 787         case AUE_LCHMOD:
 788                 if (ARG_IS_VALID(kar, ARG_MODE)) {
 789                         tok = au_to_arg32(2, "new file mode",
 790                             ar->ar_arg_mode);
 791                         kau_write(rec, tok);
 792                 }
 793                 UPATH1_VNODE1_TOKENS;
 794                 break;
 795
 796         case AUE_FCHMODAT:
 797                 ATFD1_TOKENS(1);
 798                 if (ARG_IS_VALID(kar, ARG_MODE)) {
 799                         tok = au_to_arg32(3, "new file mode",
 800                             ar->ar_arg_mode);
 801                         kau_write(rec, tok);
 802                 }
 803                 UPATH1_VNODE1_TOKENS;
 804                 break;
 805
 806         case AUE_CHOWN:
 807         case AUE_LCHOWN:
 808                 if (ARG_IS_VALID(kar, ARG_UID)) {
 809                         tok = au_to_arg32(2, "new file uid", ar->ar_arg_uid);
 810                         kau_write(rec, tok);
 811                 }
 812                 if (ARG_IS_VALID(kar, ARG_GID)) {
 813                         tok = au_to_arg32(3, "new file gid", ar->ar_arg_gid);
 814                         kau_write(rec, tok);
 815                 }
 816                 UPATH1_VNODE1_TOKENS;
 817                 break;
 818
 819         case AUE_FCHOWNAT:
 820                 ATFD1_TOKENS(1);
 821                 if (ARG_IS_VALID(kar, ARG_UID)) {
 822                         tok = au_to_arg32(3, "new file uid", ar->ar_arg_uid);
 823                         kau_write(rec, tok);
 824                 }
 825                 if (ARG_IS_VALID(kar, ARG_GID)) {
 826                         tok = au_to_arg32(4, "new file gid", ar->ar_arg_gid);
 827                         kau_write(rec, tok);
 828                 }
 829                 UPATH1_VNODE1_TOKENS;
 830                 break;
 831
 832         case AUE_EXCHANGEDATA:
 833                 UPATH1_VNODE1_TOKENS;
 834                 UPATH2_TOKENS;
 835                 break;
 836
 837         case AUE_CLOSE:
 838                 if (ARG_IS_VALID(kar, ARG_FD)) {
 839                         tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
 840                         kau_write(rec, tok);
 841                 }
 842                 UPATH1_VNODE1_TOKENS;
 843                 break;
 844
 845         case AUE_CORE:
 846                 if (ARG_IS_VALID(kar, ARG_SIGNUM)) {
 847                         tok = au_to_arg32(1, "signal", ar->ar_arg_signum);
 848                         kau_write(rec, tok);
 849                 }
 850                 UPATH1_VNODE1_TOKENS;
 851                 break;
 852
 853         case AUE_EXTATTRCTL:
 854                 UPATH1_VNODE1_TOKENS;
 855                 if (ARG_IS_VALID(kar, ARG_CMD)) {
 856                         tok = au_to_arg32(2, "cmd", ar->ar_arg_cmd);
 857                         kau_write(rec, tok);
 858                 }
 859                 /* extattrctl(2) filename parameter is in upath2/vnode2 */
 860                 UPATH2_TOKENS;
 861                 VNODE2_TOKENS;
 862                 EXTATTR_TOKENS(4);
 863                 break;
 864
 865         case AUE_EXTATTR_GET_FILE:
 866         case AUE_EXTATTR_SET_FILE:
 867         case AUE_EXTATTR_LIST_FILE:
 868         case AUE_EXTATTR_DELETE_FILE:
 869         case AUE_EXTATTR_GET_LINK:
 870         case AUE_EXTATTR_SET_LINK:
 871         case AUE_EXTATTR_LIST_LINK:
 872         case AUE_EXTATTR_DELETE_LINK:
 873                 UPATH1_VNODE1_TOKENS;
 874                 EXTATTR_TOKENS(2);
 875                 break;
 876
 877         case AUE_EXTATTR_GET_FD:
 878         case AUE_EXTATTR_SET_FD:
 879         case AUE_EXTATTR_LIST_FD:
 880         case AUE_EXTATTR_DELETE_FD:
 881                 if (ARG_IS_VALID(kar, ARG_FD)) {
 882                         tok = au_to_arg32(2, "fd", ar->ar_arg_fd);
 883                         kau_write(rec, tok);
 884                 }
 885                 EXTATTR_TOKENS(2);
 886                 break;
 887
 888         case AUE_FEXECVE:
 889                 if (ARG_IS_VALID(kar, ARG_FD)) {
 890                         tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
 891                         kau_write(rec, tok);
 892                 }
 893                 /* FALLTHROUGH */
 894
 895         case AUE_EXECVE:
 896         case AUE_MAC_EXECVE:
 897                 if (ARG_IS_VALID(kar, ARG_ARGV)) {
 898                         tok = au_to_exec_args(ar->ar_arg_argv,
 899                             ar->ar_arg_argc);
 900                         kau_write(rec, tok);
 901                 }
 902                 if (ARG_IS_VALID(kar, ARG_ENVV)) {
 903                         tok = au_to_exec_env(ar->ar_arg_envv,
 904                             ar->ar_arg_envc);
 905                         kau_write(rec, tok);
 906                 }
 907                 UPATH1_VNODE1_TOKENS;
 908                 break;
 909
 910         case AUE_FCHMOD:
 911                 if (ARG_IS_VALID(kar, ARG_MODE)) {
 912                         tok = au_to_arg32(2, "new file mode",
 913                             ar->ar_arg_mode);
 914                         kau_write(rec, tok);
 915                 }
 916                 FD_VNODE1_TOKENS;
 917                 break;
 918
 919         /*
 920          * XXXRW: Some of these need to handle non-vnode cases as well.
 921          */
 922         case AUE_FCHDIR:
 923         case AUE_FPATHCONF:
 924         case AUE_FSTAT:
 925         case AUE_FSTATFS:
 926         case AUE_FSYNC:
 927         case AUE_FTRUNCATE:
 928         case AUE_FUTIMES:
 929         case AUE_GETDIRENTRIES:
 930         case AUE_GETDIRENTRIESATTR:
 931         case AUE_LSEEK:
 932         case AUE_POLL:
 933         case AUE_READ:
 934         case AUE_READV:
 935         case AUE_WRITE:
 936         case AUE_WRITEV:
 937                 FD_VNODE1_TOKENS;
 938                 break;
 939
 940         case AUE_FCHOWN:
 941                 if (ARG_IS_VALID(kar, ARG_UID)) {
 942                         tok = au_to_arg32(2, "new file uid", ar->ar_arg_uid);
 943                         kau_write(rec, tok);
 944                 }
 945                 if (ARG_IS_VALID(kar, ARG_GID)) {
 946                         tok = au_to_arg32(3, "new file gid", ar->ar_arg_gid);
 947                         kau_write(rec, tok);
 948                 }
 949                 FD_VNODE1_TOKENS;
 950                 break;
 951
 952         case AUE_FCNTL:
 953                 if (ARG_IS_VALID(kar, ARG_CMD)) {
 954                         tok = au_to_arg32(2, "cmd",
 955                             au_fcntl_cmd_to_bsm(ar->ar_arg_cmd));
 956                         kau_write(rec, tok);
 957                 }
 958                 if (ar->ar_arg_cmd == F_GETLK || ar->ar_arg_cmd == F_SETLK ||
 959                     ar->ar_arg_cmd == F_SETLKW) {
 960                         FD_VNODE1_TOKENS;
 961                 }
 962                 break;
 963
 964         case AUE_FCHFLAGS:
 965                 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
 966                         tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
 967                         kau_write(rec, tok);
 968                 }
 969                 FD_VNODE1_TOKENS;
 970                 break;
 971
 972         case AUE_FLOCK:
 973                 if (ARG_IS_VALID(kar, ARG_CMD)) {
 974                         tok = au_to_arg32(2, "operation", ar->ar_arg_cmd);
 975                         kau_write(rec, tok);
 976                 }
 977                 FD_VNODE1_TOKENS;
 978                 break;
 979
 980         case AUE_RFORK:
 981                 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
 982                         tok = au_to_arg32(1, "flags", ar->ar_arg_fflags);
 983                         kau_write(rec, tok);
 984                 }
 985                 /* FALLTHROUGH */
 986
 987         case AUE_FORK:
 988         case AUE_VFORK:
 989                 if (ARG_IS_VALID(kar, ARG_PID)) {
 990                         tok = au_to_arg32(0, "child PID", ar->ar_arg_pid);
 991                         kau_write(rec, tok);
 992                 }
 993                 break;
 994
 995         case AUE_IOCTL:
 996                 if (ARG_IS_VALID(kar, ARG_CMD)) {
 997                         tok = au_to_arg32(2, "cmd", ar->ar_arg_cmd);
 998                         kau_write(rec, tok);
 999                 }
1000                 if (ARG_IS_VALID(kar, ARG_VNODE1))
1001                         FD_VNODE1_TOKENS;
1002                 else {
1003                         if (ARG_IS_VALID(kar, ARG_SOCKINFO)) {
1004                                 tok = kau_to_socket(&ar->ar_arg_sockinfo);
1005                                 kau_write(rec, tok);
1006                         } else {
1007                                 if (ARG_IS_VALID(kar, ARG_FD)) {
1008                                         tok = au_to_arg32(1, "fd",
1009                                             ar->ar_arg_fd);
1010                                         kau_write(rec, tok);
1011                                 }
1012                         }
1013                 }
1014                 break;
1015
1016         case AUE_KILL:
1017         case AUE_KILLPG:
1018                 if (ARG_IS_VALID(kar, ARG_SIGNUM)) {
1019                         tok = au_to_arg32(2, "signal", ar->ar_arg_signum);
1020                         kau_write(rec, tok);
1021                 }
1022                 PROCESS_PID_TOKENS(1);
1023                 break;
1024
1025         case AUE_KTRACE:
1026                 if (ARG_IS_VALID(kar, ARG_CMD)) {
1027                         tok = au_to_arg32(2, "ops", ar->ar_arg_cmd);
1028                         kau_write(rec, tok);
1029                 }
1030                 if (ARG_IS_VALID(kar, ARG_VALUE)) {
1031                         tok = au_to_arg32(3, "trpoints", ar->ar_arg_value);
1032                         kau_write(rec, tok);
1033                 }
1034                 PROCESS_PID_TOKENS(4);
1035                 UPATH1_VNODE1_TOKENS;
1036                 break;
1037
1038         case AUE_LINK:
1039         case AUE_LINKAT:
1040         case AUE_RENAME:
1041         case AUE_RENAMEAT:
1042                 ATFD1_TOKENS(1);
1043                 UPATH1_VNODE1_TOKENS;
1044                 ATFD2_TOKENS(3);
1045                 UPATH2_TOKENS;
1046                 break;
1047
1048         case AUE_LOADSHFILE:
1049                 ADDR_TOKEN(4, "base addr");
1050                 UPATH1_VNODE1_TOKENS;
1051                 break;
1052
1053         case AUE_MKDIR:
1054                 if (ARG_IS_VALID(kar, ARG_MODE)) {
1055                         tok = au_to_arg32(2, "mode", ar->ar_arg_mode);
1056                         kau_write(rec, tok);
1057                 }
1058                 UPATH1_VNODE1_TOKENS;
1059                 break;
1060
1061         case AUE_MKNOD:
1062                 if (ARG_IS_VALID(kar, ARG_MODE)) {
1063                         tok = au_to_arg32(2, "mode", ar->ar_arg_mode);
1064                         kau_write(rec, tok);
1065                 }
1066                 if (ARG_IS_VALID(kar, ARG_DEV)) {
1067                         tok = au_to_arg32(3, "dev", ar->ar_arg_dev);
1068                         kau_write(rec, tok);
1069                 }
1070                 UPATH1_VNODE1_TOKENS;
1071                 break;
1072
1073         case AUE_MMAP:
1074         case AUE_MUNMAP:
1075         case AUE_MPROTECT:
1076         case AUE_MLOCK:
1077         case AUE_MUNLOCK:
1078         case AUE_MINHERIT:
1079                 ADDR_TOKEN(1, "addr");
1080                 if (ARG_IS_VALID(kar, ARG_LEN)) {
1081                         tok = au_to_arg32(2, "len", ar->ar_arg_len);
1082                         kau_write(rec, tok);
1083                 }
1084                 if (ar->ar_event == AUE_MMAP)
1085                         FD_VNODE1_TOKENS;
1086                 if (ar->ar_event == AUE_MPROTECT) {
1087                         if (ARG_IS_VALID(kar, ARG_VALUE)) {
1088                                 tok = au_to_arg32(3, "protection",
1089                                     ar->ar_arg_value);
1090                                 kau_write(rec, tok);
1091                         }
1092                 }
1093                 if (ar->ar_event == AUE_MINHERIT) {
1094                         if (ARG_IS_VALID(kar, ARG_VALUE)) {
1095                                 tok = au_to_arg32(3, "inherit",
1096                                     ar->ar_arg_value);
1097                                 kau_write(rec, tok);
1098                         }
1099                 }
1100                 break;
1101
1102         case AUE_MOUNT:
1103         case AUE_NMOUNT:
1104                 /* XXX Need to handle NFS mounts */
1105                 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1106                         tok = au_to_arg32(3, "flags", ar->ar_arg_fflags);
1107                         kau_write(rec, tok);
1108                 }
1109                 if (ARG_IS_VALID(kar, ARG_TEXT)) {
1110                         tok = au_to_text(ar->ar_arg_text);
1111                         kau_write(rec, tok);
1112                 }
1113                 /* FALLTHROUGH */
1114
1115         case AUE_NFS_SVC:
1116                 if (ARG_IS_VALID(kar, ARG_CMD)) {
1117                         tok = au_to_arg32(1, "flags", ar->ar_arg_cmd);
1118                         kau_write(rec, tok);
1119                 }
1120                 break;
1121
1122         case AUE_UMOUNT:
1123                 if (ARG_IS_VALID(kar, ARG_VALUE)) {
1124                         tok = au_to_arg32(2, "flags", ar->ar_arg_value);
1125                         kau_write(rec, tok);
1126                 }
1127                 UPATH1_VNODE1_TOKENS;
1128                 if (ARG_IS_VALID(kar, ARG_TEXT)) {
1129                         tok = au_to_text(ar->ar_arg_text);
1130                         kau_write(rec, tok);
1131                 }
1132                 break;
1133
1134         case AUE_MSGCTL:
1135                 ar->ar_event = audit_msgctl_to_event(ar->ar_arg_svipc_cmd);
1136                 /* Fall through */
1137
1138         case AUE_MSGRCV:
1139         case AUE_MSGSND:
1140                 tok = au_to_arg32(1, "msg ID", ar->ar_arg_svipc_id);
1141                 kau_write(rec, tok);
1142                 if (ar->ar_errno != EINVAL) {
1143                         tok = au_to_ipc(AT_IPC_MSG, ar->ar_arg_svipc_id);
1144                         kau_write(rec, tok);
1145                 }
1146                 break;
1147
1148         case AUE_MSGGET:
1149                 if (ar->ar_errno == 0) {
1150                         if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
1151                                 tok = au_to_ipc(AT_IPC_MSG,
1152                                     ar->ar_arg_svipc_id);
1153                                 kau_write(rec, tok);
1154                         }
1155                 }
1156                 break;
1157
1158         case AUE_RESETSHFILE:
1159                 ADDR_TOKEN(1, "base addr");
1160                 break;
1161
1162         case AUE_OPEN_RC:
1163         case AUE_OPEN_RTC:
1164         case AUE_OPEN_RWC:
1165         case AUE_OPEN_RWTC:
1166         case AUE_OPEN_WC:
1167         case AUE_OPEN_WTC:
1168         case AUE_CREAT:
1169                 if (ARG_IS_VALID(kar, ARG_MODE)) {
1170                         tok = au_to_arg32(3, "mode", ar->ar_arg_mode);
1171                         kau_write(rec, tok);
1172                 }
1173                 /* FALLTHROUGH */
1174
1175         case AUE_OPEN_R:
1176         case AUE_OPEN_RT:
1177         case AUE_OPEN_RW:
1178         case AUE_OPEN_RWT:
1179         case AUE_OPEN_W:
1180         case AUE_OPEN_WT:
1181                 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1182                         tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
1183                         kau_write(rec, tok);
1184                 }
1185                 UPATH1_VNODE1_TOKENS;
1186                 break;
1187
1188         case AUE_OPENAT_RC:
1189         case AUE_OPENAT_RTC:
1190         case AUE_OPENAT_RWC:
1191         case AUE_OPENAT_RWTC:
1192         case AUE_OPENAT_WC:
1193         case AUE_OPENAT_WTC:
1194                 if (ARG_IS_VALID(kar, ARG_MODE)) {
1195                         tok = au_to_arg32(3, "mode", ar->ar_arg_mode);
1196                         kau_write(rec, tok);
1197                 }
1198                 /* FALLTHROUGH */
1199
1200         case AUE_OPENAT_R:
1201         case AUE_OPENAT_RT:
1202         case AUE_OPENAT_RW:
1203         case AUE_OPENAT_RWT:
1204         case AUE_OPENAT_W:
1205         case AUE_OPENAT_WT:
1206                 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1207                         tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
1208                         kau_write(rec, tok);
1209                 }
1210                 ATFD1_TOKENS(1);
1211                 UPATH1_VNODE1_TOKENS;
1212                 break;
1213
1214         case AUE_PTRACE:
1215                 if (ARG_IS_VALID(kar, ARG_CMD)) {
1216                         tok = au_to_arg32(1, "request", ar->ar_arg_cmd);
1217                         kau_write(rec, tok);
1218                 }
1219                 if (ARG_IS_VALID(kar, ARG_VALUE)) {
1220                         tok = au_to_arg32(4, "data", ar->ar_arg_value);
1221                         kau_write(rec, tok);
1222                 }
1223                 PROCESS_PID_TOKENS(2);
1224                 break;
1225
1226         case AUE_QUOTACTL:
1227                 if (ARG_IS_VALID(kar, ARG_CMD)) {
1228                         tok = au_to_arg32(2, "command", ar->ar_arg_cmd);
1229                         kau_write(rec, tok);
1230                 }
1231                 if (ARG_IS_VALID(kar, ARG_UID)) {
1232                         tok = au_to_arg32(3, "uid", ar->ar_arg_uid);
1233                         kau_write(rec, tok);
1234                 }
1235                 if (ARG_IS_VALID(kar, ARG_GID)) {
1236                         tok = au_to_arg32(3, "gid", ar->ar_arg_gid);
1237                         kau_write(rec, tok);
1238                 }
1239                 UPATH1_VNODE1_TOKENS;
1240                 break;
1241
1242         case AUE_REBOOT:
1243                 if (ARG_IS_VALID(kar, ARG_CMD)) {
1244                         tok = au_to_arg32(1, "howto", ar->ar_arg_cmd);
1245                         kau_write(rec, tok);
1246                 }
1247                 break;
1248
1249         case AUE_SEMCTL:
1250                 ar->ar_event = audit_semctl_to_event(ar->ar_arg_svipc_cmd);
1251                 /* Fall through */
1252
1253         case AUE_SEMOP:
1254                 if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
1255                         tok = au_to_arg32(1, "sem ID", ar->ar_arg_svipc_id);
1256                         kau_write(rec, tok);
1257                         if (ar->ar_errno != EINVAL) {
1258                                 tok = au_to_ipc(AT_IPC_SEM,
1259                                     ar->ar_arg_svipc_id);
1260                                 kau_write(rec, tok);
1261                         }
1262                 }
1263                 break;
1264
1265         case AUE_SEMGET:
1266                 if (ar->ar_errno == 0) {
1267                         if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
1268                                 tok = au_to_ipc(AT_IPC_SEM,
1269                                     ar->ar_arg_svipc_id);
1270                                 kau_write(rec, tok);
1271                         }
1272                 }
1273                 break;
1274
1275         case AUE_SETEGID:
1276                 if (ARG_IS_VALID(kar, ARG_EGID)) {
1277                         tok = au_to_arg32(1, "egid", ar->ar_arg_egid);
1278                         kau_write(rec, tok);
1279                 }
1280                 break;
1281
1282         case AUE_SETEUID:
1283                 if (ARG_IS_VALID(kar, ARG_EUID)) {
1284                         tok = au_to_arg32(1, "euid", ar->ar_arg_euid);
1285                         kau_write(rec, tok);
1286                 }
1287                 break;
1288
1289         case AUE_SETREGID:
1290                 if (ARG_IS_VALID(kar, ARG_RGID)) {
1291                         tok = au_to_arg32(1, "rgid", ar->ar_arg_rgid);
1292                         kau_write(rec, tok);
1293                 }
1294                 if (ARG_IS_VALID(kar, ARG_EGID)) {
1295                         tok = au_to_arg32(2, "egid", ar->ar_arg_egid);
1296                         kau_write(rec, tok);
1297                 }
1298                 break;
1299
1300         case AUE_SETREUID:
1301                 if (ARG_IS_VALID(kar, ARG_RUID)) {
1302                         tok = au_to_arg32(1, "ruid", ar->ar_arg_ruid);
1303                         kau_write(rec, tok);
1304                 }
1305                 if (ARG_IS_VALID(kar, ARG_EUID)) {
1306                         tok = au_to_arg32(2, "euid", ar->ar_arg_euid);
1307                         kau_write(rec, tok);
1308                 }
1309                 break;
1310
1311         case AUE_SETRESGID:
1312                 if (ARG_IS_VALID(kar, ARG_RGID)) {
1313                         tok = au_to_arg32(1, "rgid", ar->ar_arg_rgid);
1314                         kau_write(rec, tok);
1315                 }
1316                 if (ARG_IS_VALID(kar, ARG_EGID)) {
1317                         tok = au_to_arg32(2, "egid", ar->ar_arg_egid);
1318                         kau_write(rec, tok);
1319                 }
1320                 if (ARG_IS_VALID(kar, ARG_SGID)) {
1321                         tok = au_to_arg32(3, "sgid", ar->ar_arg_sgid);
1322                         kau_write(rec, tok);
1323                 }
1324                 break;
1325
1326         case AUE_SETRESUID:
1327                 if (ARG_IS_VALID(kar, ARG_RUID)) {
1328                         tok = au_to_arg32(1, "ruid", ar->ar_arg_ruid);
1329                         kau_write(rec, tok);
1330                 }
1331                 if (ARG_IS_VALID(kar, ARG_EUID)) {
1332                         tok = au_to_arg32(2, "euid", ar->ar_arg_euid);
1333                         kau_write(rec, tok);
1334                 }
1335                 if (ARG_IS_VALID(kar, ARG_SUID)) {
1336                         tok = au_to_arg32(3, "suid", ar->ar_arg_suid);
1337                         kau_write(rec, tok);
1338                 }
1339                 break;
1340
1341         case AUE_SETGID:
1342                 if (ARG_IS_VALID(kar, ARG_GID)) {
1343                         tok = au_to_arg32(1, "gid", ar->ar_arg_gid);
1344                         kau_write(rec, tok);
1345                 }
1346                 break;
1347
1348         case AUE_SETUID:
1349                 if (ARG_IS_VALID(kar, ARG_UID)) {
1350                         tok = au_to_arg32(1, "uid", ar->ar_arg_uid);
1351                         kau_write(rec, tok);
1352                 }
1353                 break;
1354
1355         case AUE_SETGROUPS:
1356                 if (ARG_IS_VALID(kar, ARG_GROUPSET)) {
1357                         for(ctr = 0; ctr < ar->ar_arg_groups.gidset_size; ctr++)
1358                         {
1359                                 tok = au_to_arg32(1, "setgroups",
1360                                     ar->ar_arg_groups.gidset[ctr]);
1361                                 kau_write(rec, tok);
1362                         }
1363                 }
1364                 break;
1365
1366         case AUE_SETLOGIN:
1367                 if (ARG_IS_VALID(kar, ARG_TEXT)) {
1368                         tok = au_to_text(ar->ar_arg_text);
1369                         kau_write(rec, tok);
1370                 }
1371                 break;
1372
1373         case AUE_SETPRIORITY:
1374                 if (ARG_IS_VALID(kar, ARG_CMD)) {
1375                         tok = au_to_arg32(1, "which", ar->ar_arg_cmd);
1376                         kau_write(rec, tok);
1377                 }
1378                 if (ARG_IS_VALID(kar, ARG_UID)) {
1379                         tok = au_to_arg32(2, "who", ar->ar_arg_uid);
1380                         kau_write(rec, tok);
1381                 }
1382                 PROCESS_PID_TOKENS(2);
1383                 if (ARG_IS_VALID(kar, ARG_VALUE)) {
1384                         tok = au_to_arg32(3, "priority", ar->ar_arg_value);
1385                         kau_write(rec, tok);
1386                 }
1387                 break;
1388
1389         case AUE_SETPRIVEXEC:
1390                 if (ARG_IS_VALID(kar, ARG_VALUE)) {
1391                         tok = au_to_arg32(1, "flag", ar->ar_arg_value);
1392                         kau_write(rec, tok);
1393                 }
1394                 break;
1395
1396         /* AUE_SHMAT, AUE_SHMCTL, AUE_SHMDT and AUE_SHMGET are SysV IPC */
1397         case AUE_SHMAT:
1398                 if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
1399                         tok = au_to_arg32(1, "shmid", ar->ar_arg_svipc_id);
1400                         kau_write(rec, tok);
1401                         /* XXXAUDIT: Does having the ipc token make sense? */
1402                         tok = au_to_ipc(AT_IPC_SHM, ar->ar_arg_svipc_id);
1403                         kau_write(rec, tok);
1404                 }
1405                 if (ARG_IS_VALID(kar, ARG_SVIPC_ADDR)) {
1406                         tok = au_to_arg32(2, "shmaddr",
1407                             (int)(uintptr_t)ar->ar_arg_svipc_addr);
1408                         kau_write(rec, tok);
1409                 }
1410                 if (ARG_IS_VALID(kar, ARG_SVIPC_PERM)) {
1411                         tok = au_to_ipc_perm(&ar->ar_arg_svipc_perm);
1412                         kau_write(rec, tok);
1413                 }
1414                 break;
1415
1416         case AUE_SHMCTL:
1417                 if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
1418                         tok = au_to_arg32(1, "shmid", ar->ar_arg_svipc_id);
1419                         kau_write(rec, tok);
1420                         /* XXXAUDIT: Does having the ipc token make sense? */
1421                         tok = au_to_ipc(AT_IPC_SHM, ar->ar_arg_svipc_id);
1422                         kau_write(rec, tok);
1423                 }
1424                 switch (ar->ar_arg_svipc_cmd) {
1425                 case IPC_STAT:
1426                         ar->ar_event = AUE_SHMCTL_STAT;
1427                         break;
1428                 case IPC_RMID:
1429                         ar->ar_event = AUE_SHMCTL_RMID;
1430                         break;
1431                 case IPC_SET:
1432                         ar->ar_event = AUE_SHMCTL_SET;
1433                         if (ARG_IS_VALID(kar, ARG_SVIPC_PERM)) {
1434                                 tok = au_to_ipc_perm(&ar->ar_arg_svipc_perm);
1435                                 kau_write(rec, tok);
1436                         }
1437                         break;
1438                 default:
1439                         break;  /* We will audit a bad command */
1440                 }
1441                 break;
1442
1443         case AUE_SHMDT:
1444                 if (ARG_IS_VALID(kar, ARG_SVIPC_ADDR)) {
1445                         tok = au_to_arg32(1, "shmaddr",
1446                             (int)(uintptr_t)ar->ar_arg_svipc_addr);
1447                         kau_write(rec, tok);
1448                 }
1449                 break;
1450
1451         case AUE_SHMGET:
1452                 /* This is unusual; the return value is in an argument token */
1453                 if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
1454                         tok = au_to_arg32(0, "shmid", ar->ar_arg_svipc_id);
1455                         kau_write(rec, tok);
1456                         tok = au_to_ipc(AT_IPC_SHM, ar->ar_arg_svipc_id);
1457                         kau_write(rec, tok);
1458                 }
1459                 if (ARG_IS_VALID(kar, ARG_SVIPC_PERM)) {
1460                         tok = au_to_ipc_perm(&ar->ar_arg_svipc_perm);
1461                         kau_write(rec, tok);
1462                 }
1463                 break;
1464
1465         /* AUE_SHMOPEN, AUE_SHMUNLINK, AUE_SEMOPEN, AUE_SEMCLOSE
1466          * and AUE_SEMUNLINK are Posix IPC */
1467         case AUE_SHMOPEN:
1468                 if (ARG_IS_VALID(kar, ARG_SVIPC_ADDR)) {
1469                         tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
1470                         kau_write(rec, tok);
1471                 }
1472                 if (ARG_IS_VALID(kar, ARG_MODE)) {
1473                         tok = au_to_arg32(3, "mode", ar->ar_arg_mode);
1474                         kau_write(rec, tok);
1475                 }
1476                 /* FALLTHROUGH */
1477
1478         case AUE_SHMUNLINK:
1479                 if (ARG_IS_VALID(kar, ARG_TEXT)) {
1480                         tok = au_to_text(ar->ar_arg_text);
1481                         kau_write(rec, tok);
1482                 }
1483                 if (ARG_IS_VALID(kar, ARG_POSIX_IPC_PERM)) {
1484                         struct ipc_perm perm;
1485
1486                         perm.uid = ar->ar_arg_pipc_perm.pipc_uid;
1487                         perm.gid = ar->ar_arg_pipc_perm.pipc_gid;
1488                         perm.cuid = ar->ar_arg_pipc_perm.pipc_uid;
1489                         perm.cgid = ar->ar_arg_pipc_perm.pipc_gid;
1490                         perm.mode = ar->ar_arg_pipc_perm.pipc_mode;
1491                         perm.seq = 0;
1492                         perm.key = 0;
1493                         tok = au_to_ipc_perm(&perm);
1494                         kau_write(rec, tok);
1495                 }
1496                 break;
1497
1498         case AUE_SEMOPEN:
1499                 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1500                         tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
1501                         kau_write(rec, tok);
1502                 }
1503                 if (ARG_IS_VALID(kar, ARG_MODE)) {
1504                         tok = au_to_arg32(3, "mode", ar->ar_arg_mode);
1505                         kau_write(rec, tok);
1506                 }
1507                 if (ARG_IS_VALID(kar, ARG_VALUE)) {
1508                         tok = au_to_arg32(4, "value", ar->ar_arg_value);
1509                         kau_write(rec, tok);
1510                 }
1511                 /* FALLTHROUGH */
1512
1513         case AUE_SEMUNLINK:
1514                 if (ARG_IS_VALID(kar, ARG_TEXT)) {
1515                         tok = au_to_text(ar->ar_arg_text);
1516                         kau_write(rec, tok);
1517                 }
1518                 if (ARG_IS_VALID(kar, ARG_POSIX_IPC_PERM)) {
1519                         struct ipc_perm perm;
1520
1521                         perm.uid = ar->ar_arg_pipc_perm.pipc_uid;
1522                         perm.gid = ar->ar_arg_pipc_perm.pipc_gid;
1523                         perm.cuid = ar->ar_arg_pipc_perm.pipc_uid;
1524                         perm.cgid = ar->ar_arg_pipc_perm.pipc_gid;
1525                         perm.mode = ar->ar_arg_pipc_perm.pipc_mode;
1526                         perm.seq = 0;
1527                         perm.key = 0;
1528                         tok = au_to_ipc_perm(&perm);
1529                         kau_write(rec, tok);
1530                 }
1531                 break;
1532
1533         case AUE_SEMCLOSE:
1534                 if (ARG_IS_VALID(kar, ARG_FD)) {
1535                         tok = au_to_arg32(1, "sem", ar->ar_arg_fd);
1536                         kau_write(rec, tok);
1537                 }
1538                 break;
1539
1540         case AUE_SYMLINK:
1541                 if (ARG_IS_VALID(kar, ARG_TEXT)) {
1542                         tok = au_to_text(ar->ar_arg_text);
1543                         kau_write(rec, tok);
1544                 }
1545                 UPATH1_VNODE1_TOKENS;
1546                 break;
1547
1548         case AUE_SYSCTL:
1549         case AUE_SYSCTL_NONADMIN:
1550                 if (ARG_IS_VALID(kar, ARG_CTLNAME | ARG_LEN)) {
1551                         for (ctr = 0; ctr < ar->ar_arg_len; ctr++) {
1552                                 tok = au_to_arg32(1, "name",
1553                                     ar->ar_arg_ctlname[ctr]);
1554                                 kau_write(rec, tok);
1555                         }
1556                 }
1557                 if (ARG_IS_VALID(kar, ARG_VALUE)) {
1558                         tok = au_to_arg32(5, "newval", ar->ar_arg_value);
1559                         kau_write(rec, tok);
1560                 }
1561                 if (ARG_IS_VALID(kar, ARG_TEXT)) {
1562                         tok = au_to_text(ar->ar_arg_text);
1563                         kau_write(rec, tok);
1564                 }
1565                 break;
1566
1567         case AUE_UMASK:
1568                 if (ARG_IS_VALID(kar, ARG_MASK)) {
1569                         tok = au_to_arg32(1, "new mask", ar->ar_arg_mask);
1570                         kau_write(rec, tok);
1571                 }
1572                 tok = au_to_arg32(0, "prev mask", ar->ar_retval);
1573                 kau_write(rec, tok);
1574                 break;
1575
1576         case AUE_WAIT4:
1577                 PROCESS_PID_TOKENS(1);
1578                 if (ARG_IS_VALID(kar, ARG_VALUE)) {
1579                         tok = au_to_arg32(3, "options", ar->ar_arg_value);
1580                         kau_write(rec, tok);
1581                 }
1582                 break;
1583
1584         case AUE_NULL:
1585         default:
1586                 printf("BSM conversion requested for unknown event %d\n",
1587                     ar->ar_event);
1588
1589                 /*
1590                  * Write the subject token so it is properly freed here.
1591                  */
1592                 kau_write(rec, subj_tok);
1593                 kau_free(rec);
1594                 return (BSM_NOAUDIT);
1595         }
1596
1597         kau_write(rec, subj_tok);
1598         tok = au_to_return32(au_errno_to_bsm(ar->ar_errno), ar->ar_retval);
1599         kau_write(rec, tok);  /* Every record gets a return token */
1600
1601         kau_close(rec, &ar->ar_endtime, ar->ar_event);
1602
1603         *pau = rec;
1604         return (BSM_SUCCESS);
1605 }
1606
1607 /*
1608  * Verify that a record is a valid BSM record. This verification is simple
1609  * now, but may be expanded on sometime in the future.  Return 1 if the
1610  * record is good, 0 otherwise.
1611  */
1612 int
1613 bsm_rec_verify(void *rec)
1614 {
1615         char c = *(char *)rec;
1616
1617         /*
1618          * Check the token ID of the first token; it has to be a header
1619          * token.
1620          *
1621          * XXXAUDIT There needs to be a token structure to map a token.
1622          * XXXAUDIT 'Shouldn't be simply looking at the first char.
1623          */
1624         if ((c != AUT_HEADER32) && (c != AUT_HEADER32_EX) &&
1625             (c != AUT_HEADER64) && (c != AUT_HEADER64_EX))
1626                 return (0);
1627         return (1);
1628 }