sys/security/audit/audit_bsm.c

   1 /*
   2  * Copyright (c) 1999-2009 Apple Inc.
   3  * All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions
   7  * are met:
   8  * 1.  Redistributions of source code must retain the above copyright
   9  *     notice, this list of conditions and the following disclaimer.
  10  * 2.  Redistributions in binary form must reproduce the above copyright
  11  *     notice, this list of conditions and the following disclaimer in the
  12  *     documentation and/or other materials provided with the distribution.
  13  * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
  14  *     its contributors may be used to endorse or promote products derived
  15  *     from this software without specific prior written permission.
  16  *
  17  * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND
  18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  20  * ARE DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR
  21  * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
  25  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
  26  * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  27  * POSSIBILITY OF SUCH DAMAGE.
  28  */
  29
  30 #include <sys/cdefs.h>
  31 __FBSDID("$FreeBSD$");
  32
  33 #include <sys/param.h>
  34 #include <sys/vnode.h>
  35 #include <sys/ipc.h>
  36 #include <sys/lock.h>
  37 #include <sys/malloc.h>
  38 #include <sys/mutex.h>
  39 #include <sys/socket.h>
  40 #include <sys/extattr.h>
  41 #include <sys/fcntl.h>
  42 #include <sys/user.h>
  43 #include <sys/systm.h>
  44
  45 #include <bsm/audit.h>
  46 #include <bsm/audit_internal.h>
  47 #include <bsm/audit_record.h>
  48 #include <bsm/audit_kevents.h>
  49
  50 #include <security/audit/audit.h>
  51 #include <security/audit/audit_private.h>
  52
  53 #include <netinet/in_systm.h>
  54 #include <netinet/in.h>
  55 #include <netinet/ip.h>
  56
  57 MALLOC_DEFINE(M_AUDITBSM, "audit_bsm", "Audit BSM data");
  58
  59 static void     audit_sys_auditon(struct audit_record *ar,
  60                     struct au_record *rec);
  61
  62 /*
  63  * Initialize the BSM auditing subsystem.
  64  */
  65 void
  66 kau_init(void)
  67 {
  68
  69         au_evclassmap_init();
  70 }
  71
  72 /*
  73  * This call reserves memory for the audit record.  Memory must be guaranteed
  74  * before any auditable event can be generated.  The au_record structure
  75  * maintains a reference to the memory allocated above and also the list of
  76  * tokens associated with this record.
  77  */
  78 static struct au_record *
  79 kau_open(void)
  80 {
  81         struct au_record *rec;
  82
  83         rec = malloc(sizeof(*rec), M_AUDITBSM, M_WAITOK);
  84         rec->data = NULL;
  85         TAILQ_INIT(&rec->token_q);
  86         rec->len = 0;
  87         rec->used = 1;
  88
  89         return (rec);
  90 }
  91
  92 /*
  93  * Store the token with the record descriptor.
  94  */
  95 static void
  96 kau_write(struct au_record *rec, struct au_token *tok)
  97 {
  98
  99         KASSERT(tok != NULL, ("kau_write: tok == NULL"));
 100
 101         TAILQ_INSERT_TAIL(&rec->token_q, tok, tokens);
 102         rec->len += tok->len;
 103 }
 104
 105 /*
 106  * Close out the audit record by adding the header token, identifying any
 107  * missing tokens.  Write out the tokens to the record memory.
 108  */
 109 static void
 110 kau_close(struct au_record *rec, struct timespec *ctime, short event)
 111 {
 112         u_char *dptr;
 113         size_t tot_rec_size;
 114         token_t *cur, *hdr, *trail;
 115         struct timeval tm;
 116         size_t hdrsize;
 117         struct auditinfo_addr ak;
 118         struct in6_addr *ap;
 119
 120         audit_get_kinfo(&ak);
 121         hdrsize = 0;
 122         switch (ak.ai_termid.at_type) {
 123         case AU_IPv4:
 124                 hdrsize = (ak.ai_termid.at_addr[0] == INADDR_ANY) ?
 125                     AUDIT_HEADER_SIZE : AUDIT_HEADER_EX_SIZE(&ak);
 126                 break;
 127         case AU_IPv6:
 128                 ap = (struct in6_addr *)&ak.ai_termid.at_addr[0];
 129                 hdrsize = (IN6_IS_ADDR_UNSPECIFIED(ap)) ? AUDIT_HEADER_SIZE :
 130                     AUDIT_HEADER_EX_SIZE(&ak);
 131                 break;
 132         default:
 133                 panic("kau_close: invalid address family");
 134         }
 135         tot_rec_size = rec->len + hdrsize + AUDIT_TRAILER_SIZE;
 136         rec->data = malloc(tot_rec_size, M_AUDITBSM, M_WAITOK | M_ZERO);
 137
 138         tm.tv_usec = ctime->tv_nsec / 1000;
 139         tm.tv_sec = ctime->tv_sec;
 140         if (hdrsize != AUDIT_HEADER_SIZE)
 141                 hdr = au_to_header32_ex_tm(tot_rec_size, event, 0, tm, &ak);
 142         else
 143                 hdr = au_to_header32_tm(tot_rec_size, event, 0, tm);
 144         TAILQ_INSERT_HEAD(&rec->token_q, hdr, tokens);
 145
 146         trail = au_to_trailer(tot_rec_size);
 147         TAILQ_INSERT_TAIL(&rec->token_q, trail, tokens);
 148
 149         rec->len = tot_rec_size;
 150         dptr = rec->data;
 151         TAILQ_FOREACH(cur, &rec->token_q, tokens) {
 152                 memcpy(dptr, cur->t_data, cur->len);
 153                 dptr += cur->len;
 154         }
 155 }
 156
 157 /*
 158  * Free a BSM audit record by releasing all the tokens and clearing the audit
 159  * record information.
 160  */
 161 void
 162 kau_free(struct au_record *rec)
 163 {
 164         struct au_token *tok;
 165
 166         /* Free the token list. */
 167         while ((tok = TAILQ_FIRST(&rec->token_q))) {
 168                 TAILQ_REMOVE(&rec->token_q, tok, tokens);
 169                 free(tok->t_data, M_AUDITBSM);
 170                 free(tok, M_AUDITBSM);
 171         }
 172
 173         rec->used = 0;
 174         rec->len = 0;
 175         free(rec->data, M_AUDITBSM);
 176         free(rec, M_AUDITBSM);
 177 }
 178
 179 /*
 180  * XXX: May want turn some (or all) of these macros into functions in order
 181  * to reduce the generated code size.
 182  *
 183  * XXXAUDIT: These macros assume that 'kar', 'ar', 'rec', and 'tok' in the
 184  * caller are OK with this.
 185  */
 186 #define ATFD1_TOKENS(argnum) do {                                       \
 187         if (ARG_IS_VALID(kar, ARG_ATFD1)) {                             \
 188                 tok = au_to_arg32(argnum, "at fd 1", ar->ar_arg_atfd1); \
 189                 kau_write(rec, tok);                                    \
 190         }                                                               \
 191 } while (0)
 192
 193 #define ATFD2_TOKENS(argnum) do {                                       \
 194         if (ARG_IS_VALID(kar, ARG_ATFD2)) {                             \
 195                 tok = au_to_arg32(argnum, "at fd 2", ar->ar_arg_atfd2); \
 196                 kau_write(rec, tok);                                    \
 197         }                                                               \
 198 } while (0)
 199
 200 #define UPATH1_TOKENS do {                                              \
 201         if (ARG_IS_VALID(kar, ARG_UPATH1)) {                            \
 202                 tok = au_to_path(ar->ar_arg_upath1);                    \
 203                 kau_write(rec, tok);                                    \
 204         }                                                               \
 205 } while (0)
 206
 207 #define UPATH2_TOKENS do {                                              \
 208         if (ARG_IS_VALID(kar, ARG_UPATH2)) {                            \
 209                 tok = au_to_path(ar->ar_arg_upath2);                    \
 210                 kau_write(rec, tok);                                    \
 211         }                                                               \
 212 } while (0)
 213
 214 #define VNODE1_TOKENS do {                                              \
 215         if (ARG_IS_VALID(kar, ARG_ATFD)) {                              \
 216                 tok = au_to_arg32(1, "at fd", ar->ar_arg_atfd);         \
 217                 kau_write(rec, tok);                                    \
 218         }                                                               \
 219         if (ARG_IS_VALID(kar, ARG_VNODE1)) {                            \
 220                 tok = au_to_attr32(&ar->ar_arg_vnode1);                 \
 221                 kau_write(rec, tok);                                    \
 222         }                                                               \
 223 } while (0)
 224
 225 #define UPATH1_VNODE1_TOKENS do {                                       \
 226         if (ARG_IS_VALID(kar, ARG_UPATH1)) {                            \
 227                 UPATH1_TOKENS;                                          \
 228         }                                                               \
 229         if (ARG_IS_VALID(kar, ARG_VNODE1)) {                            \
 230                 tok = au_to_attr32(&ar->ar_arg_vnode1);                 \
 231                 kau_write(rec, tok);                                    \
 232         }                                                               \
 233 } while (0)
 234
 235 #define VNODE2_TOKENS do {                                              \
 236         if (ARG_IS_VALID(kar, ARG_VNODE2)) {                            \
 237                 tok = au_to_attr32(&ar->ar_arg_vnode2);                 \
 238                 kau_write(rec, tok);                                    \
 239         }                                                               \
 240 } while (0)
 241
 242 #define FD_VNODE1_TOKENS do {                                           \
 243         if (ARG_IS_VALID(kar, ARG_VNODE1)) {                            \
 244                 if (ARG_IS_VALID(kar, ARG_FD)) {                        \
 245                         tok = au_to_arg32(1, "fd", ar->ar_arg_fd);      \
 246                         kau_write(rec, tok);                            \
 247                 }                                                       \
 248                 tok = au_to_attr32(&ar->ar_arg_vnode1);                 \
 249                 kau_write(rec, tok);                                    \
 250         } else {                                                        \
 251                 if (ARG_IS_VALID(kar, ARG_FD)) {                        \
 252                         tok = au_to_arg32(1, "non-file: fd",            \
 253                             ar->ar_arg_fd);                             \
 254                         kau_write(rec, tok);                            \
 255                 }                                                       \
 256         }                                                               \
 257 } while (0)
 258
 259 #define PROCESS_PID_TOKENS(argn) do {                                   \
 260         if ((ar->ar_arg_pid > 0) /* Reference a single process */       \
 261             && (ARG_IS_VALID(kar, ARG_PROCESS))) {                      \
 262                 tok = au_to_process32_ex(ar->ar_arg_auid,               \
 263                     ar->ar_arg_euid, ar->ar_arg_egid,                   \
 264                     ar->ar_arg_ruid, ar->ar_arg_rgid,                   \
 265                     ar->ar_arg_pid, ar->ar_arg_asid,                    \
 266                     &ar->ar_arg_termid_addr);                           \
 267                 kau_write(rec, tok);                                    \
 268         } else if (ARG_IS_VALID(kar, ARG_PID)) {                        \
 269                 tok = au_to_arg32(argn, "process", ar->ar_arg_pid);     \
 270                 kau_write(rec, tok);                                    \
 271         }                                                               \
 272 } while (0)
 273
 274 #define EXTATTR_TOKENS(namespace_argnum) do {                           \
 275         if (ARG_IS_VALID(kar, ARG_VALUE)) {                             \
 276                 switch (ar->ar_arg_value) {                             \
 277                 case EXTATTR_NAMESPACE_USER:                            \
 278                         tok = au_to_text(EXTATTR_NAMESPACE_USER_STRING);\
 279                         break;                                          \
 280                 case EXTATTR_NAMESPACE_SYSTEM:                          \
 281                         tok = au_to_text(EXTATTR_NAMESPACE_SYSTEM_STRING);\
 282                         break;                                          \
 283                 default:                                                \
 284                         tok = au_to_arg32((namespace_argnum),           \
 285                             "attrnamespace", ar->ar_arg_value);         \
 286                         break;                                          \
 287                 }                                                       \
 288                 kau_write(rec, tok);                                    \
 289         }                                                               \
 290         /* attrname is in the text field */                             \
 291         if (ARG_IS_VALID(kar, ARG_TEXT)) {                              \
 292                 tok = au_to_text(ar->ar_arg_text);                      \
 293                 kau_write(rec, tok);                                    \
 294         }                                                               \
 295 } while (0)
 296
 297 /*
 298  * Not all pointer arguments to system calls are of interest, but in some
 299  * cases they reflect delegation of rights, such as mmap(2) followed by
 300  * minherit(2) before execve(2), so do the best we can.
 301  */
 302 #define ADDR_TOKEN(argnum, argname) do {                                \
 303         if (ARG_IS_VALID(kar, ARG_ADDR)) {                              \
 304                 if (sizeof(void *) == sizeof(uint32_t))                 \
 305                         tok = au_to_arg32((argnum), (argname),          \
 306                             (uint32_t)(uintptr_t)ar->ar_arg_addr);      \
 307                 else                                                    \
 308                         tok = au_to_arg64((argnum), (argname),          \
 309                             (uint64_t)(uintptr_t)ar->ar_arg_addr);      \
 310                 kau_write(rec, tok);                                    \
 311         }                                                               \
 312 } while (0)
 313
 314
 315 /*
 316  * Implement auditing for the auditon() system call. The audit tokens that
 317  * are generated depend on the command that was sent into the auditon()
 318  * system call.
 319  */
 320 static void
 321 audit_sys_auditon(struct audit_record *ar, struct au_record *rec)
 322 {
 323         struct au_token *tok;
 324
 325         tok = au_to_arg32(3, "length", ar->ar_arg_len);
 326         kau_write(rec, tok);
 327         switch (ar->ar_arg_cmd) {
 328         case A_OLDSETPOLICY:
 329                 if ((size_t)ar->ar_arg_len == sizeof(int64_t)) {
 330                         tok = au_to_arg64(2, "policy",
 331                             ar->ar_arg_auditon.au_policy64);
 332                         kau_write(rec, tok);
 333                         break;
 334                 }
 335                 /* FALLTHROUGH */
 336
 337         case A_SETPOLICY:
 338                 tok = au_to_arg32(2, "policy", ar->ar_arg_auditon.au_policy);
 339                 kau_write(rec, tok);
 340                 break;
 341
 342         case A_SETKMASK:
 343                 tok = au_to_arg32(2, "setkmask:as_success",
 344                     ar->ar_arg_auditon.au_mask.am_success);
 345                 kau_write(rec, tok);
 346                 tok = au_to_arg32(2, "setkmask:as_failure",
 347                     ar->ar_arg_auditon.au_mask.am_failure);
 348                 kau_write(rec, tok);
 349                 break;
 350
 351         case A_OLDSETQCTRL:
 352                 if ((size_t)ar->ar_arg_len == sizeof(au_qctrl64_t)) {
 353                         tok = au_to_arg64(2, "setqctrl:aq_hiwater",
 354                             ar->ar_arg_auditon.au_qctrl64.aq64_hiwater);
 355                         kau_write(rec, tok);
 356                         tok = au_to_arg64(2, "setqctrl:aq_lowater",
 357                             ar->ar_arg_auditon.au_qctrl64.aq64_lowater);
 358                         kau_write(rec, tok);
 359                         tok = au_to_arg64(2, "setqctrl:aq_bufsz",
 360                             ar->ar_arg_auditon.au_qctrl64.aq64_bufsz);
 361                         kau_write(rec, tok);
 362                         tok = au_to_arg64(2, "setqctrl:aq_delay",
 363                             ar->ar_arg_auditon.au_qctrl64.aq64_delay);
 364                         kau_write(rec, tok);
 365                         tok = au_to_arg64(2, "setqctrl:aq_minfree",
 366                             ar->ar_arg_auditon.au_qctrl64.aq64_minfree);
 367                         kau_write(rec, tok);
 368                         break;
 369                 }
 370                 /* FALLTHROUGH */
 371
 372         case A_SETQCTRL:
 373                 tok = au_to_arg32(2, "setqctrl:aq_hiwater",
 374                     ar->ar_arg_auditon.au_qctrl.aq_hiwater);
 375                 kau_write(rec, tok);
 376                 tok = au_to_arg32(2, "setqctrl:aq_lowater",
 377                     ar->ar_arg_auditon.au_qctrl.aq_lowater);
 378                 kau_write(rec, tok);
 379                 tok = au_to_arg32(2, "setqctrl:aq_bufsz",
 380                     ar->ar_arg_auditon.au_qctrl.aq_bufsz);
 381                 kau_write(rec, tok);
 382                 tok = au_to_arg32(2, "setqctrl:aq_delay",
 383                     ar->ar_arg_auditon.au_qctrl.aq_delay);
 384                 kau_write(rec, tok);
 385                 tok = au_to_arg32(2, "setqctrl:aq_minfree",
 386                     ar->ar_arg_auditon.au_qctrl.aq_minfree);
 387                 kau_write(rec, tok);
 388                 break;
 389
 390         case A_SETUMASK:
 391                 tok = au_to_arg32(2, "setumask:as_success",
 392                     ar->ar_arg_auditon.au_auinfo.ai_mask.am_success);
 393                 kau_write(rec, tok);
 394                 tok = au_to_arg32(2, "setumask:as_failure",
 395                     ar->ar_arg_auditon.au_auinfo.ai_mask.am_failure);
 396                 kau_write(rec, tok);
 397                 break;
 398
 399         case A_SETSMASK:
 400                 tok = au_to_arg32(2, "setsmask:as_success",
 401                     ar->ar_arg_auditon.au_auinfo.ai_mask.am_success);
 402                 kau_write(rec, tok);
 403                 tok = au_to_arg32(2, "setsmask:as_failure",
 404                     ar->ar_arg_auditon.au_auinfo.ai_mask.am_failure);
 405                 kau_write(rec, tok);
 406                 break;
 407
 408         case A_OLDSETCOND:
 409                 if ((size_t)ar->ar_arg_len == sizeof(int64_t)) {
 410                         tok = au_to_arg64(2, "setcond",
 411                             ar->ar_arg_auditon.au_cond64);
 412                         kau_write(rec, tok);
 413                         break;
 414                 }
 415                 /* FALLTHROUGH */
 416
 417         case A_SETCOND:
 418                 tok = au_to_arg32(2, "setcond", ar->ar_arg_auditon.au_cond);
 419                 kau_write(rec, tok);
 420                 break;
 421
 422         case A_SETCLASS:
 423                 kau_write(rec, tok);
 424                 tok = au_to_arg32(2, "setclass:ec_event",
 425                     ar->ar_arg_auditon.au_evclass.ec_number);
 426                 kau_write(rec, tok);
 427                 tok = au_to_arg32(2, "setclass:ec_class",
 428                     ar->ar_arg_auditon.au_evclass.ec_class);
 429                 kau_write(rec, tok);
 430                 break;
 431
 432         case A_SETPMASK:
 433                 tok = au_to_arg32(2, "setpmask:as_success",
 434                     ar->ar_arg_auditon.au_aupinfo.ap_mask.am_success);
 435                 kau_write(rec, tok);
 436                 tok = au_to_arg32(2, "setpmask:as_failure",
 437                     ar->ar_arg_auditon.au_aupinfo.ap_mask.am_failure);
 438                 kau_write(rec, tok);
 439                 break;
 440
 441         case A_SETFSIZE:
 442                 tok = au_to_arg32(2, "setfsize:filesize",
 443                     ar->ar_arg_auditon.au_fstat.af_filesz);
 444                 kau_write(rec, tok);
 445                 break;
 446
 447         default:
 448                 break;
 449         }
 450 }
 451
 452 /*
 453  * Convert an internal kernel audit record to a BSM record and return a
 454  * success/failure indicator. The BSM record is passed as an out parameter to
 455  * this function.
 456  *
 457  * Return conditions:
 458  *   BSM_SUCCESS: The BSM record is valid
 459  *   BSM_FAILURE: Failure; the BSM record is NULL.
 460  *   BSM_NOAUDIT: The event is not auditable for BSM; the BSM record is NULL.
 461  */
 462 int
 463 kaudit_to_bsm(struct kaudit_record *kar, struct au_record **pau)
 464 {
 465         struct au_token *tok, *subj_tok;
 466         struct au_record *rec;
 467         au_tid_t tid;
 468         struct audit_record *ar;
 469         int ctr;
 470
 471         KASSERT(kar != NULL, ("kaudit_to_bsm: kar == NULL"));
 472
 473         *pau = NULL;
 474         ar = &kar->k_ar;
 475         rec = kau_open();
 476
 477         /*
 478          * Create the subject token.
 479          */
 480         switch (ar->ar_subj_term_addr.at_type) {
 481         case AU_IPv4:
 482                 tid.port = ar->ar_subj_term_addr.at_port;
 483                 tid.machine = ar->ar_subj_term_addr.at_addr[0];
 484                 subj_tok = au_to_subject32(ar->ar_subj_auid,  /* audit ID */
 485                     ar->ar_subj_cred.cr_uid, /* eff uid */
 486                     ar->ar_subj_egid,   /* eff group id */
 487                     ar->ar_subj_ruid,   /* real uid */
 488                     ar->ar_subj_rgid,   /* real group id */
 489                     ar->ar_subj_pid,    /* process id */
 490                     ar->ar_subj_asid,   /* session ID */
 491                     &tid);
 492                 break;
 493         case AU_IPv6:
 494                 subj_tok = au_to_subject32_ex(ar->ar_subj_auid,
 495                     ar->ar_subj_cred.cr_uid,
 496                     ar->ar_subj_egid,
 497                     ar->ar_subj_ruid,
 498                     ar->ar_subj_rgid,
 499                     ar->ar_subj_pid,
 500                     ar->ar_subj_asid,
 501                     &ar->ar_subj_term_addr);
 502                 break;
 503         default:
 504                 bzero(&tid, sizeof(tid));
 505                 subj_tok = au_to_subject32(ar->ar_subj_auid,
 506                     ar->ar_subj_cred.cr_uid,
 507                     ar->ar_subj_egid,
 508                     ar->ar_subj_ruid,
 509                     ar->ar_subj_rgid,
 510                     ar->ar_subj_pid,
 511                     ar->ar_subj_asid,
 512                     &tid);
 513         }
 514
 515         /*
 516          * The logic inside each case fills in the tokens required for the
 517          * event, except for the header, trailer, and return tokens.  The
 518          * header and trailer tokens are added by the kau_close() function.
 519          * The return token is added outside of the switch statement.
 520          */
 521         switch(ar->ar_event) {
 522         case AUE_ACCEPT:
 523         case AUE_BIND:
 524         case AUE_LISTEN:
 525         case AUE_CONNECT:
 526         case AUE_RECV:
 527         case AUE_RECVFROM:
 528         case AUE_RECVMSG:
 529         case AUE_SEND:
 530         case AUE_SENDFILE:
 531         case AUE_SENDMSG:
 532         case AUE_SENDTO:
 533                 /*
 534                  * Socket-related events.
 535                  */
 536                 if (ARG_IS_VALID(kar, ARG_FD)) {
 537                         tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
 538                         kau_write(rec, tok);
 539                 }
 540                 if (ARG_IS_VALID(kar, ARG_SADDRINET)) {
 541                         tok = au_to_sock_inet((struct sockaddr_in *)
 542                             &ar->ar_arg_sockaddr);
 543                         kau_write(rec, tok);
 544                 }
 545                 if (ARG_IS_VALID(kar, ARG_SADDRUNIX)) {
 546                         tok = au_to_sock_unix((struct sockaddr_un *)
 547                             &ar->ar_arg_sockaddr);
 548                         kau_write(rec, tok);
 549                         UPATH1_TOKENS;
 550                 }
 551                 /* XXX Need to handle ARG_SADDRINET6 */
 552                 break;
 553
 554         case AUE_SOCKET:
 555         case AUE_SOCKETPAIR:
 556                 if (ARG_IS_VALID(kar, ARG_SOCKINFO)) {
 557                         tok = au_to_arg32(1, "domain",
 558                             ar->ar_arg_sockinfo.so_domain);
 559                         kau_write(rec, tok);
 560                         tok = au_to_arg32(2, "type",
 561                             ar->ar_arg_sockinfo.so_type);
 562                         kau_write(rec, tok);
 563                         tok = au_to_arg32(3, "protocol",
 564                             ar->ar_arg_sockinfo.so_protocol);
 565                         kau_write(rec, tok);
 566                 }
 567                 break;
 568
 569         case AUE_SETSOCKOPT:
 570         case AUE_SHUTDOWN:
 571                 if (ARG_IS_VALID(kar, ARG_FD)) {
 572                         tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
 573                         kau_write(rec, tok);
 574                 }
 575                 break;
 576
 577         case AUE_ACCT:
 578                 if (ARG_IS_VALID(kar, ARG_UPATH1)) {
 579                         UPATH1_VNODE1_TOKENS;
 580                 } else {
 581                         tok = au_to_arg32(1, "accounting off", 0);
 582                         kau_write(rec, tok);
 583                 }
 584                 break;
 585
 586         case AUE_SETAUID:
 587                 if (ARG_IS_VALID(kar, ARG_AUID)) {
 588                         tok = au_to_arg32(2, "setauid", ar->ar_arg_auid);
 589                         kau_write(rec, tok);
 590                 }
 591                 break;
 592
 593         case AUE_SETAUDIT:
 594                 if (ARG_IS_VALID(kar, ARG_AUID) &&
 595                     ARG_IS_VALID(kar, ARG_ASID) &&
 596                     ARG_IS_VALID(kar, ARG_AMASK) &&
 597                     ARG_IS_VALID(kar, ARG_TERMID)) {
 598                         tok = au_to_arg32(1, "setaudit:auid",
 599                             ar->ar_arg_auid);
 600                         kau_write(rec, tok);
 601                         tok = au_to_arg32(1, "setaudit:port",
 602                             ar->ar_arg_termid.port);
 603                         kau_write(rec, tok);
 604                         tok = au_to_arg32(1, "setaudit:machine",
 605                             ar->ar_arg_termid.machine);
 606                         kau_write(rec, tok);
 607                         tok = au_to_arg32(1, "setaudit:as_success",
 608                             ar->ar_arg_amask.am_success);
 609                         kau_write(rec, tok);
 610                         tok = au_to_arg32(1, "setaudit:as_failure",
 611                             ar->ar_arg_amask.am_failure);
 612                         kau_write(rec, tok);
 613                         tok = au_to_arg32(1, "setaudit:asid",
 614                             ar->ar_arg_asid);
 615                         kau_write(rec, tok);
 616                 }
 617                 break;
 618
 619         case AUE_SETAUDIT_ADDR:
 620                 if (ARG_IS_VALID(kar, ARG_AUID) &&
 621                     ARG_IS_VALID(kar, ARG_ASID) &&
 622                     ARG_IS_VALID(kar, ARG_AMASK) &&
 623                     ARG_IS_VALID(kar, ARG_TERMID_ADDR)) {
 624                         tok = au_to_arg32(1, "setaudit_addr:auid",
 625                             ar->ar_arg_auid);
 626                         kau_write(rec, tok);
 627                         tok = au_to_arg32(1, "setaudit_addr:as_success",
 628                             ar->ar_arg_amask.am_success);
 629                         kau_write(rec, tok);
 630                         tok = au_to_arg32(1, "setaudit_addr:as_failure",
 631                             ar->ar_arg_amask.am_failure);
 632                         kau_write(rec, tok);
 633                         tok = au_to_arg32(1, "setaudit_addr:asid",
 634                             ar->ar_arg_asid);
 635                         kau_write(rec, tok);
 636                         tok = au_to_arg32(1, "setaudit_addr:type",
 637                             ar->ar_arg_termid_addr.at_type);
 638                         kau_write(rec, tok);
 639                         tok = au_to_arg32(1, "setaudit_addr:port",
 640                             ar->ar_arg_termid_addr.at_port);
 641                         kau_write(rec, tok);
 642                         if (ar->ar_arg_termid_addr.at_type == AU_IPv6)
 643                                 tok = au_to_in_addr_ex((struct in6_addr *)
 644                                     &ar->ar_arg_termid_addr.at_addr[0]);
 645                         if (ar->ar_arg_termid_addr.at_type == AU_IPv4)
 646                                 tok = au_to_in_addr((struct in_addr *)
 647                                     &ar->ar_arg_termid_addr.at_addr[0]);
 648                         kau_write(rec, tok);
 649                 }
 650                 break;
 651
 652         case AUE_AUDITON:
 653                 /*
 654                  * For AUDITON commands without own event, audit the cmd.
 655                  */
 656                 if (ARG_IS_VALID(kar, ARG_CMD)) {
 657                         tok = au_to_arg32(1, "cmd", ar->ar_arg_cmd);
 658                         kau_write(rec, tok);
 659                 }
 660                 /* FALLTHROUGH */
 661
 662         case AUE_AUDITON_GETCAR:
 663         case AUE_AUDITON_GETCLASS:
 664         case AUE_AUDITON_GETCOND:
 665         case AUE_AUDITON_GETCWD:
 666         case AUE_AUDITON_GETKMASK:
 667         case AUE_AUDITON_GETSTAT:
 668         case AUE_AUDITON_GPOLICY:
 669         case AUE_AUDITON_GQCTRL:
 670         case AUE_AUDITON_SETCLASS:
 671         case AUE_AUDITON_SETCOND:
 672         case AUE_AUDITON_SETKMASK:
 673         case AUE_AUDITON_SETSMASK:
 674         case AUE_AUDITON_SETSTAT:
 675         case AUE_AUDITON_SETUMASK:
 676         case AUE_AUDITON_SPOLICY:
 677         case AUE_AUDITON_SQCTRL:
 678                 if (ARG_IS_VALID(kar, ARG_AUDITON))
 679                         audit_sys_auditon(ar, rec);
 680                 break;
 681
 682         case AUE_AUDITCTL:
 683                 UPATH1_VNODE1_TOKENS;
 684                 break;
 685
 686         case AUE_EXIT:
 687                 if (ARG_IS_VALID(kar, ARG_EXIT)) {
 688                         tok = au_to_exit(ar->ar_arg_exitretval,
 689                             ar->ar_arg_exitstatus);
 690                         kau_write(rec, tok);
 691                 }
 692                 break;
 693
 694         case AUE_ADJTIME:
 695         case AUE_CLOCK_SETTIME:
 696         case AUE_AUDIT:
 697         case AUE_DUP2:
 698         case AUE_GETAUDIT:
 699         case AUE_GETAUDIT_ADDR:
 700         case AUE_GETAUID:
 701         case AUE_GETCWD:
 702         case AUE_GETFSSTAT:
 703         case AUE_GETRESUID:
 704         case AUE_GETRESGID:
 705         case AUE_KQUEUE:
 706         case AUE_MODLOAD:
 707         case AUE_MODUNLOAD:
 708         case AUE_MSGSYS:
 709         case AUE_NTP_ADJTIME:
 710         case AUE_PIPE:
 711         case AUE_POSIX_OPENPT:
 712         case AUE_PROFILE:
 713         case AUE_RTPRIO:
 714         case AUE_SEMSYS:
 715         case AUE_SHMSYS:
 716         case AUE_SETPGRP:
 717         case AUE_SETRLIMIT:
 718         case AUE_SETSID:
 719         case AUE_SETTIMEOFDAY:
 720         case AUE_SYSARCH:
 721
 722                 /*
 723                  * Header, subject, and return tokens added at end.
 724                  */
 725                 break;
 726
 727         case AUE_MKFIFO:
 728                 if (ARG_IS_VALID(kar, ARG_MODE)) {
 729                         tok = au_to_arg32(2, "mode", ar->ar_arg_mode);
 730                         kau_write(rec, tok);
 731                 }
 732                 /* FALLTHROUGH */
 733
 734         case AUE_CHDIR:
 735         case AUE_CHROOT:
 736         case AUE_FSTATAT:
 737         case AUE_FUTIMESAT:
 738         case AUE_GETATTRLIST:
 739         case AUE_JAIL:
 740         case AUE_LUTIMES:
 741         case AUE_NFS_GETFH:
 742         case AUE_LSTAT:
 743         case AUE_LPATHCONF:
 744         case AUE_PATHCONF:
 745         case AUE_READLINK:
 746         case AUE_REVOKE:
 747         case AUE_RMDIR:
 748         case AUE_SEARCHFS:
 749         case AUE_SETATTRLIST:
 750         case AUE_STAT:
 751         case AUE_STATFS:
 752         case AUE_SWAPON:
 753         case AUE_SWAPOFF:
 754         case AUE_TRUNCATE:
 755         case AUE_UNDELETE:
 756         case AUE_UNLINK:
 757         case AUE_UNLINKAT:
 758         case AUE_UTIMES:
 759                 ATFD1_TOKENS(1);
 760                 UPATH1_VNODE1_TOKENS;
 761                 break;
 762
 763         case AUE_ACCESS:
 764         case AUE_EACCESS:
 765                 UPATH1_VNODE1_TOKENS;
 766                 if (ARG_IS_VALID(kar, ARG_VALUE)) {
 767                         tok = au_to_arg32(2, "mode", ar->ar_arg_value);
 768                         kau_write(rec, tok);
 769                 }
 770                 break;
 771
 772         case AUE_FHSTATFS:
 773         case AUE_FHOPEN:
 774         case AUE_FHSTAT:
 775                 /* XXXRW: Need to audit vnode argument. */
 776                 break;
 777
 778         case AUE_CHFLAGS:
 779         case AUE_LCHFLAGS:
 780                 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
 781                         tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
 782                         kau_write(rec, tok);
 783                 }
 784                 UPATH1_VNODE1_TOKENS;
 785                 break;
 786
 787         case AUE_CHMOD:
 788         case AUE_LCHMOD:
 789                 if (ARG_IS_VALID(kar, ARG_MODE)) {
 790                         tok = au_to_arg32(2, "new file mode",
 791                             ar->ar_arg_mode);
 792                         kau_write(rec, tok);
 793                 }
 794                 UPATH1_VNODE1_TOKENS;
 795                 break;
 796
 797         case AUE_FCHMODAT:
 798                 ATFD1_TOKENS(1);
 799                 if (ARG_IS_VALID(kar, ARG_MODE)) {
 800                         tok = au_to_arg32(3, "new file mode",
 801                             ar->ar_arg_mode);
 802                         kau_write(rec, tok);
 803                 }
 804                 UPATH1_VNODE1_TOKENS;
 805                 break;
 806
 807         case AUE_CHOWN:
 808         case AUE_LCHOWN:
 809                 if (ARG_IS_VALID(kar, ARG_UID)) {
 810                         tok = au_to_arg32(2, "new file uid", ar->ar_arg_uid);
 811                         kau_write(rec, tok);
 812                 }
 813                 if (ARG_IS_VALID(kar, ARG_GID)) {
 814                         tok = au_to_arg32(3, "new file gid", ar->ar_arg_gid);
 815                         kau_write(rec, tok);
 816                 }
 817                 UPATH1_VNODE1_TOKENS;
 818                 break;
 819
 820         case AUE_FCHOWNAT:
 821                 ATFD1_TOKENS(1);
 822                 if (ARG_IS_VALID(kar, ARG_UID)) {
 823                         tok = au_to_arg32(3, "new file uid", ar->ar_arg_uid);
 824                         kau_write(rec, tok);
 825                 }
 826                 if (ARG_IS_VALID(kar, ARG_GID)) {
 827                         tok = au_to_arg32(4, "new file gid", ar->ar_arg_gid);
 828                         kau_write(rec, tok);
 829                 }
 830                 UPATH1_VNODE1_TOKENS;
 831                 break;
 832
 833         case AUE_EXCHANGEDATA:
 834                 UPATH1_VNODE1_TOKENS;
 835                 UPATH2_TOKENS;
 836                 break;
 837
 838         case AUE_CLOSE:
 839                 if (ARG_IS_VALID(kar, ARG_FD)) {
 840                         tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
 841                         kau_write(rec, tok);
 842                 }
 843                 UPATH1_VNODE1_TOKENS;
 844                 break;
 845
 846         case AUE_CORE:
 847                 if (ARG_IS_VALID(kar, ARG_SIGNUM)) {
 848                         tok = au_to_arg32(1, "signal", ar->ar_arg_signum);
 849                         kau_write(rec, tok);
 850                 }
 851                 UPATH1_VNODE1_TOKENS;
 852                 break;
 853
 854         case AUE_EXTATTRCTL:
 855                 UPATH1_VNODE1_TOKENS;
 856                 if (ARG_IS_VALID(kar, ARG_CMD)) {
 857                         tok = au_to_arg32(2, "cmd", ar->ar_arg_cmd);
 858                         kau_write(rec, tok);
 859                 }
 860                 /* extattrctl(2) filename parameter is in upath2/vnode2 */
 861                 UPATH2_TOKENS;
 862                 VNODE2_TOKENS;
 863                 EXTATTR_TOKENS(4);
 864                 break;
 865
 866         case AUE_EXTATTR_GET_FILE:
 867         case AUE_EXTATTR_SET_FILE:
 868         case AUE_EXTATTR_LIST_FILE:
 869         case AUE_EXTATTR_DELETE_FILE:
 870         case AUE_EXTATTR_GET_LINK:
 871         case AUE_EXTATTR_SET_LINK:
 872         case AUE_EXTATTR_LIST_LINK:
 873         case AUE_EXTATTR_DELETE_LINK:
 874                 UPATH1_VNODE1_TOKENS;
 875                 EXTATTR_TOKENS(2);
 876                 break;
 877
 878         case AUE_EXTATTR_GET_FD:
 879         case AUE_EXTATTR_SET_FD:
 880         case AUE_EXTATTR_LIST_FD:
 881         case AUE_EXTATTR_DELETE_FD:
 882                 if (ARG_IS_VALID(kar, ARG_FD)) {
 883                         tok = au_to_arg32(2, "fd", ar->ar_arg_fd);
 884                         kau_write(rec, tok);
 885                 }
 886                 EXTATTR_TOKENS(2);
 887                 break;
 888
 889         case AUE_FEXECVE:
 890                 if (ARG_IS_VALID(kar, ARG_FD)) {
 891                         tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
 892                         kau_write(rec, tok);
 893                 }
 894                 /* FALLTHROUGH */
 895
 896         case AUE_EXECVE:
 897         case AUE_MAC_EXECVE:
 898                 if (ARG_IS_VALID(kar, ARG_ARGV)) {
 899                         tok = au_to_exec_args(ar->ar_arg_argv,
 900                             ar->ar_arg_argc);
 901                         kau_write(rec, tok);
 902                 }
 903                 if (ARG_IS_VALID(kar, ARG_ENVV)) {
 904                         tok = au_to_exec_env(ar->ar_arg_envv,
 905                             ar->ar_arg_envc);
 906                         kau_write(rec, tok);
 907                 }
 908                 UPATH1_VNODE1_TOKENS;
 909                 break;
 910
 911         case AUE_FCHMOD:
 912                 if (ARG_IS_VALID(kar, ARG_MODE)) {
 913                         tok = au_to_arg32(2, "new file mode",
 914                             ar->ar_arg_mode);
 915                         kau_write(rec, tok);
 916                 }
 917                 FD_VNODE1_TOKENS;
 918                 break;
 919
 920         /*
 921          * XXXRW: Some of these need to handle non-vnode cases as well.
 922          */
 923         case AUE_FCHDIR:
 924         case AUE_FPATHCONF:
 925         case AUE_FSTAT:
 926         case AUE_FSTATFS:
 927         case AUE_FSYNC:
 928         case AUE_FTRUNCATE:
 929         case AUE_FUTIMES:
 930         case AUE_GETDIRENTRIES:
 931         case AUE_GETDIRENTRIESATTR:
 932         case AUE_LSEEK:
 933         case AUE_POLL:
 934         case AUE_READ:
 935         case AUE_READV:
 936         case AUE_WRITE:
 937         case AUE_WRITEV:
 938                 FD_VNODE1_TOKENS;
 939                 break;
 940
 941         case AUE_FCHOWN:
 942                 if (ARG_IS_VALID(kar, ARG_UID)) {
 943                         tok = au_to_arg32(2, "new file uid", ar->ar_arg_uid);
 944                         kau_write(rec, tok);
 945                 }
 946                 if (ARG_IS_VALID(kar, ARG_GID)) {
 947                         tok = au_to_arg32(3, "new file gid", ar->ar_arg_gid);
 948                         kau_write(rec, tok);
 949                 }
 950                 FD_VNODE1_TOKENS;
 951                 break;
 952
 953         case AUE_FCNTL:
 954                 if (ARG_IS_VALID(kar, ARG_CMD)) {
 955                         tok = au_to_arg32(2, "cmd",
 956                             au_fcntl_cmd_to_bsm(ar->ar_arg_cmd));
 957                         kau_write(rec, tok);
 958                 }
 959                 if (ar->ar_arg_cmd == F_GETLK || ar->ar_arg_cmd == F_SETLK ||
 960                     ar->ar_arg_cmd == F_SETLKW) {
 961                         FD_VNODE1_TOKENS;
 962                 }
 963                 break;
 964
 965         case AUE_FCHFLAGS:
 966                 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
 967                         tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
 968                         kau_write(rec, tok);
 969                 }
 970                 FD_VNODE1_TOKENS;
 971                 break;
 972
 973         case AUE_FLOCK:
 974                 if (ARG_IS_VALID(kar, ARG_CMD)) {
 975                         tok = au_to_arg32(2, "operation", ar->ar_arg_cmd);
 976                         kau_write(rec, tok);
 977                 }
 978                 FD_VNODE1_TOKENS;
 979                 break;
 980
 981         case AUE_RFORK:
 982                 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
 983                         tok = au_to_arg32(1, "flags", ar->ar_arg_fflags);
 984                         kau_write(rec, tok);
 985                 }
 986                 /* FALLTHROUGH */
 987
 988         case AUE_FORK:
 989         case AUE_VFORK:
 990                 if (ARG_IS_VALID(kar, ARG_PID)) {
 991                         tok = au_to_arg32(0, "child PID", ar->ar_arg_pid);
 992                         kau_write(rec, tok);
 993                 }
 994                 break;
 995
 996         case AUE_IOCTL:
 997                 if (ARG_IS_VALID(kar, ARG_CMD)) {
 998                         tok = au_to_arg32(2, "cmd", ar->ar_arg_cmd);
 999                         kau_write(rec, tok);
1000                 }
1001                 if (ARG_IS_VALID(kar, ARG_VNODE1))
1002                         FD_VNODE1_TOKENS;
1003                 else {
1004                         if (ARG_IS_VALID(kar, ARG_SOCKINFO)) {
1005                                 tok = kau_to_socket(&ar->ar_arg_sockinfo);
1006                                 kau_write(rec, tok);
1007                         } else {
1008                                 if (ARG_IS_VALID(kar, ARG_FD)) {
1009                                         tok = au_to_arg32(1, "fd",
1010                                             ar->ar_arg_fd);
1011                                         kau_write(rec, tok);
1012                                 }
1013                         }
1014                 }
1015                 break;
1016
1017         case AUE_KILL:
1018         case AUE_KILLPG:
1019                 if (ARG_IS_VALID(kar, ARG_SIGNUM)) {
1020                         tok = au_to_arg32(2, "signal", ar->ar_arg_signum);
1021                         kau_write(rec, tok);
1022                 }
1023                 PROCESS_PID_TOKENS(1);
1024                 break;
1025
1026         case AUE_KTRACE:
1027                 if (ARG_IS_VALID(kar, ARG_CMD)) {
1028                         tok = au_to_arg32(2, "ops", ar->ar_arg_cmd);
1029                         kau_write(rec, tok);
1030                 }
1031                 if (ARG_IS_VALID(kar, ARG_VALUE)) {
1032                         tok = au_to_arg32(3, "trpoints", ar->ar_arg_value);
1033                         kau_write(rec, tok);
1034                 }
1035                 PROCESS_PID_TOKENS(4);
1036                 UPATH1_VNODE1_TOKENS;
1037                 break;
1038
1039         case AUE_LINK:
1040         case AUE_LINKAT:
1041         case AUE_RENAME:
1042         case AUE_RENAMEAT:
1043                 ATFD1_TOKENS(1);
1044                 UPATH1_VNODE1_TOKENS;
1045                 ATFD2_TOKENS(3);
1046                 UPATH2_TOKENS;
1047                 break;
1048
1049         case AUE_LOADSHFILE:
1050                 ADDR_TOKEN(4, "base addr");
1051                 UPATH1_VNODE1_TOKENS;
1052                 break;
1053
1054         case AUE_MKDIR:
1055                 if (ARG_IS_VALID(kar, ARG_MODE)) {
1056                         tok = au_to_arg32(2, "mode", ar->ar_arg_mode);
1057                         kau_write(rec, tok);
1058                 }
1059                 UPATH1_VNODE1_TOKENS;
1060                 break;
1061
1062         case AUE_MKNOD:
1063                 if (ARG_IS_VALID(kar, ARG_MODE)) {
1064                         tok = au_to_arg32(2, "mode", ar->ar_arg_mode);
1065                         kau_write(rec, tok);
1066                 }
1067                 if (ARG_IS_VALID(kar, ARG_DEV)) {
1068                         tok = au_to_arg32(3, "dev", ar->ar_arg_dev);
1069                         kau_write(rec, tok);
1070                 }
1071                 UPATH1_VNODE1_TOKENS;
1072                 break;
1073
1074         case AUE_MMAP:
1075         case AUE_MUNMAP:
1076         case AUE_MPROTECT:
1077         case AUE_MLOCK:
1078         case AUE_MUNLOCK:
1079         case AUE_MINHERIT:
1080                 ADDR_TOKEN(1, "addr");
1081                 if (ARG_IS_VALID(kar, ARG_LEN)) {
1082                         tok = au_to_arg32(2, "len", ar->ar_arg_len);
1083                         kau_write(rec, tok);
1084                 }
1085                 if (ar->ar_event == AUE_MMAP)
1086                         FD_VNODE1_TOKENS;
1087                 if (ar->ar_event == AUE_MPROTECT) {
1088                         if (ARG_IS_VALID(kar, ARG_VALUE)) {
1089                                 tok = au_to_arg32(3, "protection",
1090                                     ar->ar_arg_value);
1091                                 kau_write(rec, tok);
1092                         }
1093                 }
1094                 if (ar->ar_event == AUE_MINHERIT) {
1095                         if (ARG_IS_VALID(kar, ARG_VALUE)) {
1096                                 tok = au_to_arg32(3, "inherit",
1097                                     ar->ar_arg_value);
1098                                 kau_write(rec, tok);
1099                         }
1100                 }
1101                 break;
1102
1103         case AUE_MOUNT:
1104         case AUE_NMOUNT:
1105                 /* XXX Need to handle NFS mounts */
1106                 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1107                         tok = au_to_arg32(3, "flags", ar->ar_arg_fflags);
1108                         kau_write(rec, tok);
1109                 }
1110                 if (ARG_IS_VALID(kar, ARG_TEXT)) {
1111                         tok = au_to_text(ar->ar_arg_text);
1112                         kau_write(rec, tok);
1113                 }
1114                 /* FALLTHROUGH */
1115
1116         case AUE_NFS_SVC:
1117                 if (ARG_IS_VALID(kar, ARG_CMD)) {
1118                         tok = au_to_arg32(1, "flags", ar->ar_arg_cmd);
1119                         kau_write(rec, tok);
1120                 }
1121                 break;
1122
1123         case AUE_UMOUNT:
1124                 if (ARG_IS_VALID(kar, ARG_VALUE)) {
1125                         tok = au_to_arg32(2, "flags", ar->ar_arg_value);
1126                         kau_write(rec, tok);
1127                 }
1128                 UPATH1_VNODE1_TOKENS;
1129                 if (ARG_IS_VALID(kar, ARG_TEXT)) {
1130                         tok = au_to_text(ar->ar_arg_text);
1131                         kau_write(rec, tok);
1132                 }
1133                 break;
1134
1135         case AUE_MSGCTL:
1136                 ar->ar_event = audit_msgctl_to_event(ar->ar_arg_svipc_cmd);
1137                 /* Fall through */
1138
1139         case AUE_MSGRCV:
1140         case AUE_MSGSND:
1141                 tok = au_to_arg32(1, "msg ID", ar->ar_arg_svipc_id);
1142                 kau_write(rec, tok);
1143                 if (ar->ar_errno != EINVAL) {
1144                         tok = au_to_ipc(AT_IPC_MSG, ar->ar_arg_svipc_id);
1145                         kau_write(rec, tok);
1146                 }
1147                 break;
1148
1149         case AUE_MSGGET:
1150                 if (ar->ar_errno == 0) {
1151                         if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
1152                                 tok = au_to_ipc(AT_IPC_MSG,
1153                                     ar->ar_arg_svipc_id);
1154                                 kau_write(rec, tok);
1155                         }
1156                 }
1157                 break;
1158
1159         case AUE_RESETSHFILE:
1160                 ADDR_TOKEN(1, "base addr");
1161                 break;
1162
1163         case AUE_OPEN_RC:
1164         case AUE_OPEN_RTC:
1165         case AUE_OPEN_RWC:
1166         case AUE_OPEN_RWTC:
1167         case AUE_OPEN_WC:
1168         case AUE_OPEN_WTC:
1169         case AUE_CREAT:
1170                 if (ARG_IS_VALID(kar, ARG_MODE)) {
1171                         tok = au_to_arg32(3, "mode", ar->ar_arg_mode);
1172                         kau_write(rec, tok);
1173                 }
1174                 /* FALLTHROUGH */
1175
1176         case AUE_OPEN_R:
1177         case AUE_OPEN_RT:
1178         case AUE_OPEN_RW:
1179         case AUE_OPEN_RWT:
1180         case AUE_OPEN_W:
1181         case AUE_OPEN_WT:
1182                 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1183                         tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
1184                         kau_write(rec, tok);
1185                 }
1186                 UPATH1_VNODE1_TOKENS;
1187                 break;
1188
1189         case AUE_OPENAT_RC:
1190         case AUE_OPENAT_RTC:
1191         case AUE_OPENAT_RWC:
1192         case AUE_OPENAT_RWTC:
1193         case AUE_OPENAT_WC:
1194         case AUE_OPENAT_WTC:
1195                 if (ARG_IS_VALID(kar, ARG_MODE)) {
1196                         tok = au_to_arg32(3, "mode", ar->ar_arg_mode);
1197                         kau_write(rec, tok);
1198                 }
1199                 /* FALLTHROUGH */
1200
1201         case AUE_OPENAT_R:
1202         case AUE_OPENAT_RT:
1203         case AUE_OPENAT_RW:
1204         case AUE_OPENAT_RWT:
1205         case AUE_OPENAT_W:
1206         case AUE_OPENAT_WT:
1207                 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1208                         tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
1209                         kau_write(rec, tok);
1210                 }
1211                 ATFD1_TOKENS(1);
1212                 UPATH1_VNODE1_TOKENS;
1213                 break;
1214
1215         case AUE_PTRACE:
1216                 if (ARG_IS_VALID(kar, ARG_CMD)) {
1217                         tok = au_to_arg32(1, "request", ar->ar_arg_cmd);
1218                         kau_write(rec, tok);
1219                 }
1220                 if (ARG_IS_VALID(kar, ARG_VALUE)) {
1221                         tok = au_to_arg32(4, "data", ar->ar_arg_value);
1222                         kau_write(rec, tok);
1223                 }
1224                 PROCESS_PID_TOKENS(2);
1225                 break;
1226
1227         case AUE_QUOTACTL:
1228                 if (ARG_IS_VALID(kar, ARG_CMD)) {
1229                         tok = au_to_arg32(2, "command", ar->ar_arg_cmd);
1230                         kau_write(rec, tok);
1231                 }
1232                 if (ARG_IS_VALID(kar, ARG_UID)) {
1233                         tok = au_to_arg32(3, "uid", ar->ar_arg_uid);
1234                         kau_write(rec, tok);
1235                 }
1236                 if (ARG_IS_VALID(kar, ARG_GID)) {
1237                         tok = au_to_arg32(3, "gid", ar->ar_arg_gid);
1238                         kau_write(rec, tok);
1239                 }
1240                 UPATH1_VNODE1_TOKENS;
1241                 break;
1242
1243         case AUE_REBOOT:
1244                 if (ARG_IS_VALID(kar, ARG_CMD)) {
1245                         tok = au_to_arg32(1, "howto", ar->ar_arg_cmd);
1246                         kau_write(rec, tok);
1247                 }
1248                 break;
1249
1250         case AUE_SEMCTL:
1251                 ar->ar_event = audit_semctl_to_event(ar->ar_arg_svipc_cmd);
1252                 /* Fall through */
1253
1254         case AUE_SEMOP:
1255                 if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
1256                         tok = au_to_arg32(1, "sem ID", ar->ar_arg_svipc_id);
1257                         kau_write(rec, tok);
1258                         if (ar->ar_errno != EINVAL) {
1259                                 tok = au_to_ipc(AT_IPC_SEM,
1260                                     ar->ar_arg_svipc_id);
1261                                 kau_write(rec, tok);
1262                         }
1263                 }
1264                 break;
1265
1266         case AUE_SEMGET:
1267                 if (ar->ar_errno == 0) {
1268                         if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
1269                                 tok = au_to_ipc(AT_IPC_SEM,
1270                                     ar->ar_arg_svipc_id);
1271                                 kau_write(rec, tok);
1272                         }
1273                 }
1274                 break;
1275
1276         case AUE_SETEGID:
1277                 if (ARG_IS_VALID(kar, ARG_EGID)) {
1278                         tok = au_to_arg32(1, "egid", ar->ar_arg_egid);
1279                         kau_write(rec, tok);
1280                 }
1281                 break;
1282
1283         case AUE_SETEUID:
1284                 if (ARG_IS_VALID(kar, ARG_EUID)) {
1285                         tok = au_to_arg32(1, "euid", ar->ar_arg_euid);
1286                         kau_write(rec, tok);
1287                 }
1288                 break;
1289
1290         case AUE_SETREGID:
1291                 if (ARG_IS_VALID(kar, ARG_RGID)) {
1292                         tok = au_to_arg32(1, "rgid", ar->ar_arg_rgid);
1293                         kau_write(rec, tok);
1294                 }
1295                 if (ARG_IS_VALID(kar, ARG_EGID)) {
1296                         tok = au_to_arg32(2, "egid", ar->ar_arg_egid);
1297                         kau_write(rec, tok);
1298                 }
1299                 break;
1300
1301         case AUE_SETREUID:
1302                 if (ARG_IS_VALID(kar, ARG_RUID)) {
1303                         tok = au_to_arg32(1, "ruid", ar->ar_arg_ruid);
1304                         kau_write(rec, tok);
1305                 }
1306                 if (ARG_IS_VALID(kar, ARG_EUID)) {
1307                         tok = au_to_arg32(2, "euid", ar->ar_arg_euid);
1308                         kau_write(rec, tok);
1309                 }
1310                 break;
1311
1312         case AUE_SETRESGID:
1313                 if (ARG_IS_VALID(kar, ARG_RGID)) {
1314                         tok = au_to_arg32(1, "rgid", ar->ar_arg_rgid);
1315                         kau_write(rec, tok);
1316                 }
1317                 if (ARG_IS_VALID(kar, ARG_EGID)) {
1318                         tok = au_to_arg32(2, "egid", ar->ar_arg_egid);
1319                         kau_write(rec, tok);
1320                 }
1321                 if (ARG_IS_VALID(kar, ARG_SGID)) {
1322                         tok = au_to_arg32(3, "sgid", ar->ar_arg_sgid);
1323                         kau_write(rec, tok);
1324                 }
1325                 break;
1326
1327         case AUE_SETRESUID:
1328                 if (ARG_IS_VALID(kar, ARG_RUID)) {
1329                         tok = au_to_arg32(1, "ruid", ar->ar_arg_ruid);
1330                         kau_write(rec, tok);
1331                 }
1332                 if (ARG_IS_VALID(kar, ARG_EUID)) {
1333                         tok = au_to_arg32(2, "euid", ar->ar_arg_euid);
1334                         kau_write(rec, tok);
1335                 }
1336                 if (ARG_IS_VALID(kar, ARG_SUID)) {
1337                         tok = au_to_arg32(3, "suid", ar->ar_arg_suid);
1338                         kau_write(rec, tok);
1339                 }
1340                 break;
1341
1342         case AUE_SETGID:
1343                 if (ARG_IS_VALID(kar, ARG_GID)) {
1344                         tok = au_to_arg32(1, "gid", ar->ar_arg_gid);
1345                         kau_write(rec, tok);
1346                 }
1347                 break;
1348
1349         case AUE_SETUID:
1350                 if (ARG_IS_VALID(kar, ARG_UID)) {
1351                         tok = au_to_arg32(1, "uid", ar->ar_arg_uid);
1352                         kau_write(rec, tok);
1353                 }
1354                 break;
1355
1356         case AUE_SETGROUPS:
1357                 if (ARG_IS_VALID(kar, ARG_GROUPSET)) {
1358                         for(ctr = 0; ctr < ar->ar_arg_groups.gidset_size; ctr++)
1359                         {
1360                                 tok = au_to_arg32(1, "setgroups",
1361                                     ar->ar_arg_groups.gidset[ctr]);
1362                                 kau_write(rec, tok);
1363                         }
1364                 }
1365                 break;
1366
1367         case AUE_SETLOGIN:
1368                 if (ARG_IS_VALID(kar, ARG_TEXT)) {
1369                         tok = au_to_text(ar->ar_arg_text);
1370                         kau_write(rec, tok);
1371                 }
1372                 break;
1373
1374         case AUE_SETPRIORITY:
1375                 if (ARG_IS_VALID(kar, ARG_CMD)) {
1376                         tok = au_to_arg32(1, "which", ar->ar_arg_cmd);
1377                         kau_write(rec, tok);
1378                 }
1379                 if (ARG_IS_VALID(kar, ARG_UID)) {
1380                         tok = au_to_arg32(2, "who", ar->ar_arg_uid);
1381                         kau_write(rec, tok);
1382                 }
1383                 PROCESS_PID_TOKENS(2);
1384                 if (ARG_IS_VALID(kar, ARG_VALUE)) {
1385                         tok = au_to_arg32(3, "priority", ar->ar_arg_value);
1386                         kau_write(rec, tok);
1387                 }
1388                 break;
1389
1390         case AUE_SETPRIVEXEC:
1391                 if (ARG_IS_VALID(kar, ARG_VALUE)) {
1392                         tok = au_to_arg32(1, "flag", ar->ar_arg_value);
1393                         kau_write(rec, tok);
1394                 }
1395                 break;
1396
1397         /* AUE_SHMAT, AUE_SHMCTL, AUE_SHMDT and AUE_SHMGET are SysV IPC */
1398         case AUE_SHMAT:
1399                 if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
1400                         tok = au_to_arg32(1, "shmid", ar->ar_arg_svipc_id);
1401                         kau_write(rec, tok);
1402                         /* XXXAUDIT: Does having the ipc token make sense? */
1403                         tok = au_to_ipc(AT_IPC_SHM, ar->ar_arg_svipc_id);
1404                         kau_write(rec, tok);
1405                 }
1406                 if (ARG_IS_VALID(kar, ARG_SVIPC_ADDR)) {
1407                         tok = au_to_arg32(2, "shmaddr",
1408                             (int)(uintptr_t)ar->ar_arg_svipc_addr);
1409                         kau_write(rec, tok);
1410                 }
1411                 if (ARG_IS_VALID(kar, ARG_SVIPC_PERM)) {
1412                         tok = au_to_ipc_perm(&ar->ar_arg_svipc_perm);
1413                         kau_write(rec, tok);
1414                 }
1415                 break;
1416
1417         case AUE_SHMCTL:
1418                 if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
1419                         tok = au_to_arg32(1, "shmid", ar->ar_arg_svipc_id);
1420                         kau_write(rec, tok);
1421                         /* XXXAUDIT: Does having the ipc token make sense? */
1422                         tok = au_to_ipc(AT_IPC_SHM, ar->ar_arg_svipc_id);
1423                         kau_write(rec, tok);
1424                 }
1425                 switch (ar->ar_arg_svipc_cmd) {
1426                 case IPC_STAT:
1427                         ar->ar_event = AUE_SHMCTL_STAT;
1428                         break;
1429                 case IPC_RMID:
1430                         ar->ar_event = AUE_SHMCTL_RMID;
1431                         break;
1432                 case IPC_SET:
1433                         ar->ar_event = AUE_SHMCTL_SET;
1434                         if (ARG_IS_VALID(kar, ARG_SVIPC_PERM)) {
1435                                 tok = au_to_ipc_perm(&ar->ar_arg_svipc_perm);
1436                                 kau_write(rec, tok);
1437                         }
1438                         break;
1439                 default:
1440                         break;  /* We will audit a bad command */
1441                 }
1442                 break;
1443
1444         case AUE_SHMDT:
1445                 if (ARG_IS_VALID(kar, ARG_SVIPC_ADDR)) {
1446                         tok = au_to_arg32(1, "shmaddr",
1447                             (int)(uintptr_t)ar->ar_arg_svipc_addr);
1448                         kau_write(rec, tok);
1449                 }
1450                 break;
1451
1452         case AUE_SHMGET:
1453                 /* This is unusual; the return value is in an argument token */
1454                 if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
1455                         tok = au_to_arg32(0, "shmid", ar->ar_arg_svipc_id);
1456                         kau_write(rec, tok);
1457                         tok = au_to_ipc(AT_IPC_SHM, ar->ar_arg_svipc_id);
1458                         kau_write(rec, tok);
1459                 }
1460                 if (ARG_IS_VALID(kar, ARG_SVIPC_PERM)) {
1461                         tok = au_to_ipc_perm(&ar->ar_arg_svipc_perm);
1462                         kau_write(rec, tok);
1463                 }
1464                 break;
1465
1466         /* AUE_SHMOPEN, AUE_SHMUNLINK, AUE_SEMOPEN, AUE_SEMCLOSE
1467          * and AUE_SEMUNLINK are Posix IPC */
1468         case AUE_SHMOPEN:
1469                 if (ARG_IS_VALID(kar, ARG_SVIPC_ADDR)) {
1470                         tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
1471                         kau_write(rec, tok);
1472                 }
1473                 if (ARG_IS_VALID(kar, ARG_MODE)) {
1474                         tok = au_to_arg32(3, "mode", ar->ar_arg_mode);
1475                         kau_write(rec, tok);
1476                 }
1477                 /* FALLTHROUGH */
1478
1479         case AUE_SHMUNLINK:
1480                 if (ARG_IS_VALID(kar, ARG_TEXT)) {
1481                         tok = au_to_text(ar->ar_arg_text);
1482                         kau_write(rec, tok);
1483                 }
1484                 if (ARG_IS_VALID(kar, ARG_POSIX_IPC_PERM)) {
1485                         struct ipc_perm perm;
1486
1487                         perm.uid = ar->ar_arg_pipc_perm.pipc_uid;
1488                         perm.gid = ar->ar_arg_pipc_perm.pipc_gid;
1489                         perm.cuid = ar->ar_arg_pipc_perm.pipc_uid;
1490                         perm.cgid = ar->ar_arg_pipc_perm.pipc_gid;
1491                         perm.mode = ar->ar_arg_pipc_perm.pipc_mode;
1492                         perm.seq = 0;
1493                         perm.key = 0;
1494                         tok = au_to_ipc_perm(&perm);
1495                         kau_write(rec, tok);
1496                 }
1497                 break;
1498
1499         case AUE_SEMOPEN:
1500                 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1501                         tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
1502                         kau_write(rec, tok);
1503                 }
1504                 if (ARG_IS_VALID(kar, ARG_MODE)) {
1505                         tok = au_to_arg32(3, "mode", ar->ar_arg_mode);
1506                         kau_write(rec, tok);
1507                 }
1508                 if (ARG_IS_VALID(kar, ARG_VALUE)) {
1509                         tok = au_to_arg32(4, "value", ar->ar_arg_value);
1510                         kau_write(rec, tok);
1511                 }
1512                 /* FALLTHROUGH */
1513
1514         case AUE_SEMUNLINK:
1515                 if (ARG_IS_VALID(kar, ARG_TEXT)) {
1516                         tok = au_to_text(ar->ar_arg_text);
1517                         kau_write(rec, tok);
1518                 }
1519                 if (ARG_IS_VALID(kar, ARG_POSIX_IPC_PERM)) {
1520                         struct ipc_perm perm;
1521
1522                         perm.uid = ar->ar_arg_pipc_perm.pipc_uid;
1523                         perm.gid = ar->ar_arg_pipc_perm.pipc_gid;
1524                         perm.cuid = ar->ar_arg_pipc_perm.pipc_uid;
1525                         perm.cgid = ar->ar_arg_pipc_perm.pipc_gid;
1526                         perm.mode = ar->ar_arg_pipc_perm.pipc_mode;
1527                         perm.seq = 0;
1528                         perm.key = 0;
1529                         tok = au_to_ipc_perm(&perm);
1530                         kau_write(rec, tok);
1531                 }
1532                 break;
1533
1534         case AUE_SEMCLOSE:
1535                 if (ARG_IS_VALID(kar, ARG_FD)) {
1536                         tok = au_to_arg32(1, "sem", ar->ar_arg_fd);
1537                         kau_write(rec, tok);
1538                 }
1539                 break;
1540
1541         case AUE_SYMLINK:
1542                 if (ARG_IS_VALID(kar, ARG_TEXT)) {
1543                         tok = au_to_text(ar->ar_arg_text);
1544                         kau_write(rec, tok);
1545                 }
1546                 UPATH1_VNODE1_TOKENS;
1547                 break;
1548
1549         case AUE_SYSCTL:
1550         case AUE_SYSCTL_NONADMIN:
1551                 if (ARG_IS_VALID(kar, ARG_CTLNAME | ARG_LEN)) {
1552                         for (ctr = 0; ctr < ar->ar_arg_len; ctr++) {
1553                                 tok = au_to_arg32(1, "name",
1554                                     ar->ar_arg_ctlname[ctr]);
1555                                 kau_write(rec, tok);
1556                         }
1557                 }
1558                 if (ARG_IS_VALID(kar, ARG_VALUE)) {
1559                         tok = au_to_arg32(5, "newval", ar->ar_arg_value);
1560                         kau_write(rec, tok);
1561                 }
1562                 if (ARG_IS_VALID(kar, ARG_TEXT)) {
1563                         tok = au_to_text(ar->ar_arg_text);
1564                         kau_write(rec, tok);
1565                 }
1566                 break;
1567
1568         case AUE_UMASK:
1569                 if (ARG_IS_VALID(kar, ARG_MASK)) {
1570                         tok = au_to_arg32(1, "new mask", ar->ar_arg_mask);
1571                         kau_write(rec, tok);
1572                 }
1573                 tok = au_to_arg32(0, "prev mask", ar->ar_retval);
1574                 kau_write(rec, tok);
1575                 break;
1576
1577         case AUE_WAIT4:
1578                 PROCESS_PID_TOKENS(1);
1579                 if (ARG_IS_VALID(kar, ARG_VALUE)) {
1580                         tok = au_to_arg32(3, "options", ar->ar_arg_value);
1581                         kau_write(rec, tok);
1582                 }
1583                 break;
1584
1585         case AUE_NULL:
1586         default:
1587                 printf("BSM conversion requested for unknown event %d\n",
1588                     ar->ar_event);
1589
1590                 /*
1591                  * Write the subject token so it is properly freed here.
1592                  */
1593                 kau_write(rec, subj_tok);
1594                 kau_free(rec);
1595                 return (BSM_NOAUDIT);
1596         }
1597
1598         kau_write(rec, subj_tok);
1599         tok = au_to_return32(au_errno_to_bsm(ar->ar_errno), ar->ar_retval);
1600         kau_write(rec, tok);  /* Every record gets a return token */
1601
1602         kau_close(rec, &ar->ar_endtime, ar->ar_event);
1603
1604         *pau = rec;
1605         return (BSM_SUCCESS);
1606 }
1607
1608 /*
1609  * Verify that a record is a valid BSM record. This verification is simple
1610  * now, but may be expanded on sometime in the future.  Return 1 if the
1611  * record is good, 0 otherwise.
1612  */
1613 int
1614 bsm_rec_verify(void *rec)
1615 {
1616         char c = *(char *)rec;
1617
1618         /*
1619          * Check the token ID of the first token; it has to be a header
1620          * token.
1621          *
1622          * XXXAUDIT There needs to be a token structure to map a token.
1623          * XXXAUDIT 'Shouldn't be simply looking at the first char.
1624          */
1625         if ((c != AUT_HEADER32) && (c != AUT_HEADER32_EX) &&
1626             (c != AUT_HEADER64) && (c != AUT_HEADER64_EX))
1627                 return (0);
1628         return (1);
1629 }