xref: /freebsd/sys/security/audit/audit_bsm.c (revision 16de94eaf09b75a9a1e90254a6fe5812f55f4cab)
1 /*
2  * SPDX-License-Identifier: BSD-3-Clause
3  *
4  * Copyright (c) 1999-2009 Apple Inc.
5  * Copyright (c) 2016-2017 Robert N. M. Watson
6  * All rights reserved.
7  *
8  * Portions of this software were developed by BAE Systems, the University of
9  * Cambridge Computer Laboratory, and Memorial University under DARPA/AFRL
10  * contract FA8650-15-C-7558 ("CADETS"), as part of the DARPA Transparent
11  * Computing (TC) research program.
12  *
13  * Redistribution and use in source and binary forms, with or without
14  * modification, are permitted provided that the following conditions
15  * are met:
16  * 1.  Redistributions of source code must retain the above copyright
17  *     notice, this list of conditions and the following disclaimer.
18  * 2.  Redistributions in binary form must reproduce the above copyright
19  *     notice, this list of conditions and the following disclaimer in the
20  *     documentation and/or other materials provided with the distribution.
21  * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
22  *     its contributors may be used to endorse or promote products derived
23  *     from this software without specific prior written permission.
24  *
25  * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND
26  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
27  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
28  * ARE DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR
29  * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
30  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
31  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
32  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
33  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
34  * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
35  * POSSIBILITY OF SUCH DAMAGE.
36  */
37 
38 #include <sys/param.h>
39 #include <sys/vnode.h>
40 #include <sys/ipc.h>
41 #include <sys/lock.h>
42 #include <sys/malloc.h>
43 #include <sys/mutex.h>
44 #include <sys/socket.h>
45 #include <sys/extattr.h>
46 #include <sys/fcntl.h>
47 #include <sys/user.h>
48 #include <sys/systm.h>
49 
50 #include <bsm/audit.h>
51 #include <bsm/audit_internal.h>
52 #include <bsm/audit_record.h>
53 #include <bsm/audit_kevents.h>
54 
55 #include <security/audit/audit.h>
56 #include <security/audit/audit_private.h>
57 
58 #include <netinet/in_systm.h>
59 #include <netinet/in.h>
60 #include <netinet/ip.h>
61 
62 MALLOC_DEFINE(M_AUDITBSM, "audit_bsm", "Audit BSM data");
63 
64 static void	audit_sys_auditon(struct audit_record *ar,
65 		    struct au_record *rec);
66 
67 /*
68  * Initialize the BSM auditing subsystem.
69  */
70 void
kau_init(void)71 kau_init(void)
72 {
73 
74 	au_evclassmap_init();
75 	au_evnamemap_init();
76 }
77 
78 /*
79  * This call reserves memory for the audit record.  Memory must be guaranteed
80  * before any auditable event can be generated.  The au_record structure
81  * maintains a reference to the memory allocated above and also the list of
82  * tokens associated with this record.
83  */
84 static struct au_record *
kau_open(void)85 kau_open(void)
86 {
87 	struct au_record *rec;
88 
89 	rec = malloc(sizeof(*rec), M_AUDITBSM, M_WAITOK);
90 	rec->data = NULL;
91 	TAILQ_INIT(&rec->token_q);
92 	rec->len = 0;
93 	rec->used = 1;
94 
95 	return (rec);
96 }
97 
98 /*
99  * Store the token with the record descriptor.
100  */
101 static void
kau_write(struct au_record * rec,struct au_token * tok)102 kau_write(struct au_record *rec, struct au_token *tok)
103 {
104 
105 	KASSERT(tok != NULL, ("kau_write: tok == NULL"));
106 
107 	TAILQ_INSERT_TAIL(&rec->token_q, tok, tokens);
108 	rec->len += tok->len;
109 }
110 
111 /*
112  * Close out the audit record by adding the header token, identifying any
113  * missing tokens.  Write out the tokens to the record memory.
114  */
115 static void
kau_close(struct au_record * rec,struct timespec * ctime,short event)116 kau_close(struct au_record *rec, struct timespec *ctime, short event)
117 {
118 	u_char *dptr;
119 	size_t tot_rec_size;
120 	token_t *cur, *hdr, *trail;
121 	struct timeval tm;
122 	size_t hdrsize;
123 	struct auditinfo_addr ak;
124 	struct in6_addr *ap;
125 
126 	audit_get_kinfo(&ak);
127 	hdrsize = 0;
128 	switch (ak.ai_termid.at_type) {
129 	case AU_IPv4:
130 		hdrsize = (ak.ai_termid.at_addr[0] == INADDR_ANY) ?
131 		    AUDIT_HEADER_SIZE : AUDIT_HEADER_EX_SIZE(&ak);
132 		break;
133 	case AU_IPv6:
134 		ap = (struct in6_addr *)&ak.ai_termid.at_addr[0];
135 		hdrsize = (IN6_IS_ADDR_UNSPECIFIED(ap)) ? AUDIT_HEADER_SIZE :
136 		    AUDIT_HEADER_EX_SIZE(&ak);
137 		break;
138 	default:
139 		panic("kau_close: invalid address family");
140 	}
141 	tot_rec_size = rec->len + hdrsize + AUDIT_TRAILER_SIZE;
142 	rec->data = malloc(tot_rec_size, M_AUDITBSM, M_WAITOK | M_ZERO);
143 
144 	tm.tv_usec = ctime->tv_nsec / 1000;
145 	tm.tv_sec = ctime->tv_sec;
146 	if (hdrsize != AUDIT_HEADER_SIZE)
147 		hdr = au_to_header32_ex_tm(tot_rec_size, event, 0, tm, &ak);
148 	else
149 		hdr = au_to_header32_tm(tot_rec_size, event, 0, tm);
150 	TAILQ_INSERT_HEAD(&rec->token_q, hdr, tokens);
151 
152 	trail = au_to_trailer(tot_rec_size);
153 	TAILQ_INSERT_TAIL(&rec->token_q, trail, tokens);
154 
155 	rec->len = tot_rec_size;
156 	dptr = rec->data;
157 	TAILQ_FOREACH(cur, &rec->token_q, tokens) {
158 		memcpy(dptr, cur->t_data, cur->len);
159 		dptr += cur->len;
160 	}
161 }
162 
163 /*
164  * Free a BSM audit record by releasing all the tokens and clearing the audit
165  * record information.
166  */
167 void
kau_free(struct au_record * rec)168 kau_free(struct au_record *rec)
169 {
170 	struct au_token *tok;
171 
172 	/* Free the token list. */
173 	while ((tok = TAILQ_FIRST(&rec->token_q))) {
174 		TAILQ_REMOVE(&rec->token_q, tok, tokens);
175 		free(tok->t_data, M_AUDITBSM);
176 		free(tok, M_AUDITBSM);
177 	}
178 
179 	rec->used = 0;
180 	rec->len = 0;
181 	free(rec->data, M_AUDITBSM);
182 	free(rec, M_AUDITBSM);
183 }
184 
185 /*
186  * XXX: May want turn some (or all) of these macros into functions in order
187  * to reduce the generated code size.
188  *
189  * XXXAUDIT: These macros assume that 'kar', 'ar', 'rec', and 'tok' in the
190  * caller are OK with this.
191  */
192 #define	ATFD1_TOKENS(argnum) do {					\
193 	if (ARG_IS_VALID(kar, ARG_ATFD1)) {				\
194 		tok = au_to_arg32(argnum, "at fd 1", ar->ar_arg_atfd1);	\
195 		kau_write(rec, tok);					\
196 	}								\
197 } while (0)
198 
199 #define	ATFD2_TOKENS(argnum) do {					\
200 	if (ARG_IS_VALID(kar, ARG_ATFD2)) {				\
201 		tok = au_to_arg32(argnum, "at fd 2", ar->ar_arg_atfd2);	\
202 		kau_write(rec, tok);					\
203 	}								\
204 } while (0)
205 
206 #define	UPATH1_TOKENS do {						\
207 	if (ARG_IS_VALID(kar, ARG_UPATH1)) {				\
208 		tok = au_to_path(ar->ar_arg_upath1);			\
209 		kau_write(rec, tok);					\
210 	}								\
211 } while (0)
212 
213 #define	UPATH2_TOKENS do {						\
214 	if (ARG_IS_VALID(kar, ARG_UPATH2)) {				\
215 		tok = au_to_path(ar->ar_arg_upath2);			\
216 		kau_write(rec, tok);					\
217 	}								\
218 } while (0)
219 
220 #define	VNODE1_TOKENS do {						\
221 	if (ARG_IS_VALID(kar, ARG_ATFD)) {				\
222 		tok = au_to_arg32(1, "at fd", ar->ar_arg_atfd);		\
223 		kau_write(rec, tok);					\
224 	}								\
225 	if (ARG_IS_VALID(kar, ARG_VNODE1)) {				\
226 		tok = au_to_attr32(&ar->ar_arg_vnode1);			\
227 		kau_write(rec, tok);					\
228 	}								\
229 } while (0)
230 
231 #define	UPATH1_VNODE1_TOKENS do {					\
232 	UPATH1_TOKENS;							\
233 	if (ARG_IS_VALID(kar, ARG_VNODE1)) {				\
234 		tok = au_to_attr32(&ar->ar_arg_vnode1);			\
235 		kau_write(rec, tok);					\
236 	}								\
237 } while (0)
238 
239 #define	VNODE2_TOKENS do {						\
240 	if (ARG_IS_VALID(kar, ARG_VNODE2)) {				\
241 		tok = au_to_attr32(&ar->ar_arg_vnode2);			\
242 		kau_write(rec, tok);					\
243 	}								\
244 } while (0)
245 
246 #define	FD_VNODE1_TOKENS do {						\
247 	if (ARG_IS_VALID(kar, ARG_VNODE1)) {				\
248 		if (ARG_IS_VALID(kar, ARG_FD)) {			\
249 			tok = au_to_arg32(1, "fd", ar->ar_arg_fd);	\
250 			kau_write(rec, tok);				\
251 		}							\
252 		tok = au_to_attr32(&ar->ar_arg_vnode1);			\
253 		kau_write(rec, tok);					\
254 	} else {							\
255 		if (ARG_IS_VALID(kar, ARG_FD)) {			\
256 			tok = au_to_arg32(1, "non-file: fd",		\
257 			    ar->ar_arg_fd);				\
258 			kau_write(rec, tok);				\
259 		}							\
260 	}								\
261 } while (0)
262 
263 #define	PROCESS_PID_TOKENS(argn) do {					\
264 	if ((ar->ar_arg_pid > 0) /* Reference a single process */	\
265 	    && (ARG_IS_VALID(kar, ARG_PROCESS))) {			\
266 		tok = au_to_process32_ex(ar->ar_arg_auid,		\
267 		    ar->ar_arg_euid, ar->ar_arg_egid,			\
268 		    ar->ar_arg_ruid, ar->ar_arg_rgid,			\
269 		    ar->ar_arg_pid, ar->ar_arg_asid,			\
270 		    &ar->ar_arg_termid_addr);				\
271 		kau_write(rec, tok);					\
272 	} else if (ARG_IS_VALID(kar, ARG_PID)) {			\
273 		tok = au_to_arg32(argn, "process", ar->ar_arg_pid);	\
274 		kau_write(rec, tok);					\
275 	}								\
276 } while (0)
277 
278 #define	EXTATTR_TOKENS(namespace_argnum) do {				\
279 	if (ARG_IS_VALID(kar, ARG_VALUE)) {				\
280 		switch (ar->ar_arg_value) {				\
281 		case EXTATTR_NAMESPACE_USER:				\
282 			tok = au_to_text(EXTATTR_NAMESPACE_USER_STRING);\
283 			break;						\
284 		case EXTATTR_NAMESPACE_SYSTEM:				\
285 			tok = au_to_text(EXTATTR_NAMESPACE_SYSTEM_STRING);\
286 			break;						\
287 		default:						\
288 			tok = au_to_arg32((namespace_argnum),		\
289 			    "attrnamespace", ar->ar_arg_value);		\
290 			break;						\
291 		}							\
292 		kau_write(rec, tok);					\
293 	}								\
294 	/* attrname is in the text field */				\
295 	if (ARG_IS_VALID(kar, ARG_TEXT)) {				\
296 		tok = au_to_text(ar->ar_arg_text);			\
297 		kau_write(rec, tok);					\
298 	}								\
299 } while (0)
300 
301 /*
302  * Not all pointer arguments to system calls are of interest, but in some
303  * cases they reflect delegation of rights, such as mmap(2) followed by
304  * minherit(2) before execve(2), so do the best we can.
305  */
306 #define	ADDR_TOKEN(argnum, argname) do {				\
307 	if (ARG_IS_VALID(kar, ARG_ADDR)) {				\
308 		if (sizeof(void *) == sizeof(uint32_t))			\
309 			tok = au_to_arg32((argnum), (argname),		\
310 			    (uint32_t)(uintptr_t)ar->ar_arg_addr);	\
311 		else							\
312 			tok = au_to_arg64((argnum), (argname),		\
313 			    (uint64_t)(uintptr_t)ar->ar_arg_addr);	\
314 		kau_write(rec, tok);					\
315 	}								\
316 } while (0)
317 
318 /*
319  * Implement auditing for the auditon() system call. The audit tokens that
320  * are generated depend on the command that was sent into the auditon()
321  * system call.
322  */
323 static void
audit_sys_auditon(struct audit_record * ar,struct au_record * rec)324 audit_sys_auditon(struct audit_record *ar, struct au_record *rec)
325 {
326 	struct au_token *tok;
327 
328 	tok = au_to_arg32(3, "length", ar->ar_arg_len);
329 	kau_write(rec, tok);
330 	switch (ar->ar_arg_cmd) {
331 	case A_OLDSETPOLICY:
332 		if ((size_t)ar->ar_arg_len == sizeof(int64_t)) {
333 			tok = au_to_arg64(2, "policy",
334 			    ar->ar_arg_auditon.au_policy64);
335 			kau_write(rec, tok);
336 			break;
337 		}
338 		/* FALLTHROUGH */
339 
340 	case A_SETPOLICY:
341 		tok = au_to_arg32(2, "policy", ar->ar_arg_auditon.au_policy);
342 		kau_write(rec, tok);
343 		break;
344 
345 	case A_SETKMASK:
346 		tok = au_to_arg32(2, "setkmask:as_success",
347 		    ar->ar_arg_auditon.au_mask.am_success);
348 		kau_write(rec, tok);
349 		tok = au_to_arg32(2, "setkmask:as_failure",
350 		    ar->ar_arg_auditon.au_mask.am_failure);
351 		kau_write(rec, tok);
352 		break;
353 
354 	case A_OLDSETQCTRL:
355 		if ((size_t)ar->ar_arg_len == sizeof(au_qctrl64_t)) {
356 			tok = au_to_arg64(2, "setqctrl:aq_hiwater",
357 			    ar->ar_arg_auditon.au_qctrl64.aq64_hiwater);
358 			kau_write(rec, tok);
359 			tok = au_to_arg64(2, "setqctrl:aq_lowater",
360 			    ar->ar_arg_auditon.au_qctrl64.aq64_lowater);
361 			kau_write(rec, tok);
362 			tok = au_to_arg64(2, "setqctrl:aq_bufsz",
363 			    ar->ar_arg_auditon.au_qctrl64.aq64_bufsz);
364 			kau_write(rec, tok);
365 			tok = au_to_arg64(2, "setqctrl:aq_delay",
366 			    ar->ar_arg_auditon.au_qctrl64.aq64_delay);
367 			kau_write(rec, tok);
368 			tok = au_to_arg64(2, "setqctrl:aq_minfree",
369 			    ar->ar_arg_auditon.au_qctrl64.aq64_minfree);
370 			kau_write(rec, tok);
371 			break;
372 		}
373 		/* FALLTHROUGH */
374 
375 	case A_SETQCTRL:
376 		tok = au_to_arg32(2, "setqctrl:aq_hiwater",
377 		    ar->ar_arg_auditon.au_qctrl.aq_hiwater);
378 		kau_write(rec, tok);
379 		tok = au_to_arg32(2, "setqctrl:aq_lowater",
380 		    ar->ar_arg_auditon.au_qctrl.aq_lowater);
381 		kau_write(rec, tok);
382 		tok = au_to_arg32(2, "setqctrl:aq_bufsz",
383 		    ar->ar_arg_auditon.au_qctrl.aq_bufsz);
384 		kau_write(rec, tok);
385 		tok = au_to_arg32(2, "setqctrl:aq_delay",
386 		    ar->ar_arg_auditon.au_qctrl.aq_delay);
387 		kau_write(rec, tok);
388 		tok = au_to_arg32(2, "setqctrl:aq_minfree",
389 		    ar->ar_arg_auditon.au_qctrl.aq_minfree);
390 		kau_write(rec, tok);
391 		break;
392 
393 	case A_SETUMASK:
394 		tok = au_to_arg32(2, "setumask:as_success",
395 		    ar->ar_arg_auditon.au_auinfo.ai_mask.am_success);
396 		kau_write(rec, tok);
397 		tok = au_to_arg32(2, "setumask:as_failure",
398 		    ar->ar_arg_auditon.au_auinfo.ai_mask.am_failure);
399 		kau_write(rec, tok);
400 		break;
401 
402 	case A_SETSMASK:
403 		tok = au_to_arg32(2, "setsmask:as_success",
404 		    ar->ar_arg_auditon.au_auinfo.ai_mask.am_success);
405 		kau_write(rec, tok);
406 		tok = au_to_arg32(2, "setsmask:as_failure",
407 		    ar->ar_arg_auditon.au_auinfo.ai_mask.am_failure);
408 		kau_write(rec, tok);
409 		break;
410 
411 	case A_OLDSETCOND:
412 		if ((size_t)ar->ar_arg_len == sizeof(int64_t)) {
413 			tok = au_to_arg64(2, "setcond",
414 			    ar->ar_arg_auditon.au_cond64);
415 			kau_write(rec, tok);
416 			break;
417 		}
418 		/* FALLTHROUGH */
419 
420 	case A_SETCOND:
421 		tok = au_to_arg32(2, "setcond", ar->ar_arg_auditon.au_cond);
422 		kau_write(rec, tok);
423 		break;
424 
425 	case A_SETCLASS:
426 		tok = au_to_arg32(2, "setclass:ec_event",
427 		    ar->ar_arg_auditon.au_evclass.ec_number);
428 		kau_write(rec, tok);
429 		tok = au_to_arg32(2, "setclass:ec_class",
430 		    ar->ar_arg_auditon.au_evclass.ec_class);
431 		kau_write(rec, tok);
432 		break;
433 
434 	case A_SETPMASK:
435 		tok = au_to_arg32(2, "setpmask:as_success",
436 		    ar->ar_arg_auditon.au_aupinfo.ap_mask.am_success);
437 		kau_write(rec, tok);
438 		tok = au_to_arg32(2, "setpmask:as_failure",
439 		    ar->ar_arg_auditon.au_aupinfo.ap_mask.am_failure);
440 		kau_write(rec, tok);
441 		break;
442 
443 	case A_SETFSIZE:
444 		tok = au_to_arg32(2, "setfsize:filesize",
445 		    ar->ar_arg_auditon.au_fstat.af_filesz);
446 		kau_write(rec, tok);
447 		break;
448 
449 	default:
450 		break;
451 	}
452 }
453 
454 /*
455  * Convert an internal kernel audit record to a BSM record and return a
456  * success/failure indicator. The BSM record is passed as an out parameter to
457  * this function.
458  *
459  * Return conditions:
460  *   BSM_SUCCESS: The BSM record is valid
461  *   BSM_FAILURE: Failure; the BSM record is NULL.
462  *   BSM_NOAUDIT: The event is not auditable for BSM; the BSM record is NULL.
463  */
464 int
kaudit_to_bsm(struct kaudit_record * kar,struct au_record ** pau)465 kaudit_to_bsm(struct kaudit_record *kar, struct au_record **pau)
466 {
467 	struct au_token *tok, *subj_tok, *jail_tok;
468 	struct au_record *rec;
469 	au_tid_t tid;
470 	struct audit_record *ar;
471 	int ctr;
472 
473 	KASSERT(kar != NULL, ("kaudit_to_bsm: kar == NULL"));
474 
475 	*pau = NULL;
476 	ar = &kar->k_ar;
477 	rec = kau_open();
478 
479 	/*
480 	 * Create the subject token.  If this credential was jailed be sure to
481 	 * generate a zonename token.
482 	 */
483 	if (ar->ar_jailname[0] != '\0')
484 		jail_tok = au_to_zonename(ar->ar_jailname);
485 	else
486 		jail_tok = NULL;
487 	switch (ar->ar_subj_term_addr.at_type) {
488 	case AU_IPv4:
489 		tid.port = ar->ar_subj_term_addr.at_port;
490 		tid.machine = ar->ar_subj_term_addr.at_addr[0];
491 		subj_tok = au_to_subject32(ar->ar_subj_auid,  /* audit ID */
492 		    ar->ar_subj_cred.cr_uid, /* eff uid */
493 		    ar->ar_subj_egid,	/* eff group id */
494 		    ar->ar_subj_ruid,	/* real uid */
495 		    ar->ar_subj_rgid,	/* real group id */
496 		    ar->ar_subj_pid,	/* process id */
497 		    ar->ar_subj_asid,	/* session ID */
498 		    &tid);
499 		break;
500 	case AU_IPv6:
501 		subj_tok = au_to_subject32_ex(ar->ar_subj_auid,
502 		    ar->ar_subj_cred.cr_uid,
503 		    ar->ar_subj_egid,
504 		    ar->ar_subj_ruid,
505 		    ar->ar_subj_rgid,
506 		    ar->ar_subj_pid,
507 		    ar->ar_subj_asid,
508 		    &ar->ar_subj_term_addr);
509 		break;
510 	default:
511 		bzero(&tid, sizeof(tid));
512 		subj_tok = au_to_subject32(ar->ar_subj_auid,
513 		    ar->ar_subj_cred.cr_uid,
514 		    ar->ar_subj_egid,
515 		    ar->ar_subj_ruid,
516 		    ar->ar_subj_rgid,
517 		    ar->ar_subj_pid,
518 		    ar->ar_subj_asid,
519 		    &tid);
520 	}
521 
522 	/*
523 	 * The logic inside each case fills in the tokens required for the
524 	 * event, except for the header, trailer, and return tokens.  The
525 	 * header and trailer tokens are added by the kau_close() function.
526 	 * The return token is added outside of the switch statement.
527 	 */
528 	switch(ar->ar_event) {
529 	case AUE_ACCEPT:
530 		if (ARG_IS_VALID(kar, ARG_FD)) {
531 			tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
532 			kau_write(rec, tok);
533 		}
534 		if (ARG_IS_VALID(kar, ARG_SADDRINET)) {
535 			tok = au_to_sock_inet((struct sockaddr_in *)
536 			    &ar->ar_arg_sockaddr);
537 			kau_write(rec, tok);
538 		}
539 		if (ARG_IS_VALID(kar, ARG_SADDRUNIX)) {
540 			tok = au_to_sock_unix((struct sockaddr_un *)
541 			    &ar->ar_arg_sockaddr);
542 			kau_write(rec, tok);
543 			UPATH1_TOKENS;
544 		}
545 		if (ARG_IS_VALID(kar, ARG_SADDRINET6)) {
546 			tok = au_to_sock_inet128((struct sockaddr_in6 *)
547 			    &ar->ar_arg_sockaddr);
548 			kau_write(rec, tok);
549 		}
550 		break;
551 
552 	case AUE_BIND:
553 	case AUE_LISTEN:
554 	case AUE_CONNECT:
555 	case AUE_RECV:
556 	case AUE_RECVFROM:
557 	case AUE_RECVMSG:
558 	case AUE_SEND:
559 	case AUE_SENDMSG:
560 	case AUE_SENDTO:
561 		/*
562 		 * Socket-related events.
563 		 */
564 		if (ARG_IS_VALID(kar, ARG_FD)) {
565 			tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
566 			kau_write(rec, tok);
567 		}
568 		if (ARG_IS_VALID(kar, ARG_SADDRINET)) {
569 			tok = au_to_sock_inet((struct sockaddr_in *)
570 			    &ar->ar_arg_sockaddr);
571 			kau_write(rec, tok);
572 		}
573 		if (ARG_IS_VALID(kar, ARG_SADDRUNIX)) {
574 			tok = au_to_sock_unix((struct sockaddr_un *)
575 			    &ar->ar_arg_sockaddr);
576 			kau_write(rec, tok);
577 			UPATH1_TOKENS;
578 		}
579 		if (ARG_IS_VALID(kar, ARG_SADDRINET6)) {
580 			tok = au_to_sock_inet128((struct sockaddr_in6 *)
581 			    &ar->ar_arg_sockaddr);
582 			kau_write(rec, tok);
583 		}
584 		break;
585 
586 	case AUE_BINDAT:
587 	case AUE_CONNECTAT:
588 		ATFD1_TOKENS(1);
589 		if (ARG_IS_VALID(kar, ARG_FD)) {
590 			tok = au_to_arg32(2, "fd", ar->ar_arg_fd);
591 			kau_write(rec, tok);
592 		}
593 		if (ARG_IS_VALID(kar, ARG_SADDRUNIX)) {
594 			tok = au_to_sock_unix((struct sockaddr_un *)
595 			    &ar->ar_arg_sockaddr);
596 			kau_write(rec, tok);
597 			UPATH1_TOKENS;
598 		}
599 		break;
600 
601 	case AUE_SENDFILE:
602 		FD_VNODE1_TOKENS;
603 		if (ARG_IS_VALID(kar, ARG_SADDRINET)) {
604 			tok = au_to_sock_inet((struct sockaddr_in *)
605 			    &ar->ar_arg_sockaddr);
606 			kau_write(rec, tok);
607 		}
608 		if (ARG_IS_VALID(kar, ARG_SADDRUNIX)) {
609 			tok = au_to_sock_unix((struct sockaddr_un *)
610 			    &ar->ar_arg_sockaddr);
611 			kau_write(rec, tok);
612 			UPATH1_TOKENS;
613 		}
614 		if (ARG_IS_VALID(kar, ARG_SADDRINET6)) {
615 			tok = au_to_sock_inet128((struct sockaddr_in6 *)
616 			    &ar->ar_arg_sockaddr);
617 			kau_write(rec, tok);
618 		}
619 		break;
620 
621 	case AUE_SOCKET:
622 	case AUE_SOCKETPAIR:
623 		if (ARG_IS_VALID(kar, ARG_SOCKINFO)) {
624 			tok = au_to_arg32(1, "domain",
625 			    ar->ar_arg_sockinfo.so_domain);
626 			kau_write(rec, tok);
627 			tok = au_to_arg32(2, "type",
628 			    ar->ar_arg_sockinfo.so_type);
629 			kau_write(rec, tok);
630 			tok = au_to_arg32(3, "protocol",
631 			    ar->ar_arg_sockinfo.so_protocol);
632 			kau_write(rec, tok);
633 		}
634 		break;
635 
636 	case AUE_SETSOCKOPT:
637 	case AUE_SHUTDOWN:
638 		if (ARG_IS_VALID(kar, ARG_FD)) {
639 			tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
640 			kau_write(rec, tok);
641 		}
642 		break;
643 
644 	case AUE_ACCT:
645 		if (ARG_IS_VALID(kar, ARG_UPATH1)) {
646 			UPATH1_VNODE1_TOKENS;
647 		} else {
648 			tok = au_to_arg32(1, "accounting off", 0);
649 			kau_write(rec, tok);
650 		}
651 		break;
652 
653 	case AUE_SETAUID:
654 		if (ARG_IS_VALID(kar, ARG_AUID)) {
655 			tok = au_to_arg32(2, "setauid", ar->ar_arg_auid);
656 			kau_write(rec, tok);
657 		}
658 		break;
659 
660 	case AUE_SETAUDIT:
661 		if (ARG_IS_VALID(kar, ARG_AUID) &&
662 		    ARG_IS_VALID(kar, ARG_ASID) &&
663 		    ARG_IS_VALID(kar, ARG_AMASK) &&
664 		    ARG_IS_VALID(kar, ARG_TERMID)) {
665 			tok = au_to_arg32(1, "setaudit:auid",
666 			    ar->ar_arg_auid);
667 			kau_write(rec, tok);
668 			tok = au_to_arg32(1, "setaudit:port",
669 			    ar->ar_arg_termid.port);
670 			kau_write(rec, tok);
671 			tok = au_to_arg32(1, "setaudit:machine",
672 			    ar->ar_arg_termid.machine);
673 			kau_write(rec, tok);
674 			tok = au_to_arg32(1, "setaudit:as_success",
675 			    ar->ar_arg_amask.am_success);
676 			kau_write(rec, tok);
677 			tok = au_to_arg32(1, "setaudit:as_failure",
678 			    ar->ar_arg_amask.am_failure);
679 			kau_write(rec, tok);
680 			tok = au_to_arg32(1, "setaudit:asid",
681 			    ar->ar_arg_asid);
682 			kau_write(rec, tok);
683 		}
684 		break;
685 
686 	case AUE_SETAUDIT_ADDR:
687 		if (ARG_IS_VALID(kar, ARG_AUID) &&
688 		    ARG_IS_VALID(kar, ARG_ASID) &&
689 		    ARG_IS_VALID(kar, ARG_AMASK) &&
690 		    ARG_IS_VALID(kar, ARG_TERMID_ADDR)) {
691 			tok = au_to_arg32(1, "setaudit_addr:auid",
692 			    ar->ar_arg_auid);
693 			kau_write(rec, tok);
694 			tok = au_to_arg32(1, "setaudit_addr:as_success",
695 			    ar->ar_arg_amask.am_success);
696 			kau_write(rec, tok);
697 			tok = au_to_arg32(1, "setaudit_addr:as_failure",
698 			    ar->ar_arg_amask.am_failure);
699 			kau_write(rec, tok);
700 			tok = au_to_arg32(1, "setaudit_addr:asid",
701 			    ar->ar_arg_asid);
702 			kau_write(rec, tok);
703 			tok = au_to_arg32(1, "setaudit_addr:type",
704 			    ar->ar_arg_termid_addr.at_type);
705 			kau_write(rec, tok);
706 			tok = au_to_arg32(1, "setaudit_addr:port",
707 			    ar->ar_arg_termid_addr.at_port);
708 			kau_write(rec, tok);
709 			if (ar->ar_arg_termid_addr.at_type == AU_IPv6)
710 				tok = au_to_in_addr_ex((struct in6_addr *)
711 				    &ar->ar_arg_termid_addr.at_addr[0]);
712 			if (ar->ar_arg_termid_addr.at_type == AU_IPv4)
713 				tok = au_to_in_addr((struct in_addr *)
714 				    &ar->ar_arg_termid_addr.at_addr[0]);
715 			kau_write(rec, tok);
716 		}
717 		break;
718 
719 	case AUE_AUDITON:
720 		/*
721 		 * For AUDITON commands without own event, audit the cmd.
722 		 */
723 		if (ARG_IS_VALID(kar, ARG_CMD)) {
724 			tok = au_to_arg32(1, "cmd", ar->ar_arg_cmd);
725 			kau_write(rec, tok);
726 		}
727 		/* FALLTHROUGH */
728 
729 	case AUE_AUDITON_GETCAR:
730 	case AUE_AUDITON_GETCLASS:
731 	case AUE_AUDITON_GETCOND:
732 	case AUE_AUDITON_GETCWD:
733 	case AUE_AUDITON_GETKMASK:
734 	case AUE_AUDITON_GETSTAT:
735 	case AUE_AUDITON_GPOLICY:
736 	case AUE_AUDITON_GQCTRL:
737 	case AUE_AUDITON_SETCLASS:
738 	case AUE_AUDITON_SETCOND:
739 	case AUE_AUDITON_SETKMASK:
740 	case AUE_AUDITON_SETSMASK:
741 	case AUE_AUDITON_SETSTAT:
742 	case AUE_AUDITON_SETUMASK:
743 	case AUE_AUDITON_SPOLICY:
744 	case AUE_AUDITON_SQCTRL:
745 		if (ARG_IS_VALID(kar, ARG_AUDITON))
746 			audit_sys_auditon(ar, rec);
747 		break;
748 
749 	case AUE_AUDITCTL:
750 		UPATH1_VNODE1_TOKENS;
751 		break;
752 
753 	case AUE_EXIT:
754 		if (ARG_IS_VALID(kar, ARG_EXIT)) {
755 			tok = au_to_exit(ar->ar_arg_exitretval,
756 			    ar->ar_arg_exitstatus);
757 			kau_write(rec, tok);
758 		}
759 		break;
760 
761 	case AUE_ADJTIME:
762 	case AUE_CLOCK_SETTIME:
763 	case AUE_AUDIT:
764 	case AUE_DUP2:
765 	case AUE_GETAUDIT:
766 	case AUE_GETAUDIT_ADDR:
767 	case AUE_GETAUID:
768 	case AUE_GETCWD:
769 	case AUE_GETFSSTAT:
770 	case AUE_GETRESUID:
771 	case AUE_GETRESGID:
772 	case AUE_KQUEUE:
773 	case AUE_MODLOAD:
774 	case AUE_MODUNLOAD:
775 	case AUE_MSGSYS:
776 	case AUE_NTP_ADJTIME:
777 	case AUE_PIPE:
778 	case AUE_POSIX_OPENPT:
779 	case AUE_PROFILE:
780 	case AUE_RTPRIO:
781 	case AUE_SEMSYS:
782 	case AUE_SETFIB:
783 	case AUE_SHMSYS:
784 	case AUE_SETPGRP:
785 	case AUE_SETRLIMIT:
786 	case AUE_SETSID:
787 	case AUE_SETTIMEOFDAY:
788 	case AUE_SYSARCH:
789 
790 		/*
791 		 * Header, subject, and return tokens added at end.
792 		 */
793 		break;
794 
795 	case AUE_ACL_DELETE_FD:
796 	case AUE_ACL_DELETE_FILE:
797 	case AUE_ACL_CHECK_FD:
798 	case AUE_ACL_CHECK_FILE:
799 	case AUE_ACL_CHECK_LINK:
800 	case AUE_ACL_DELETE_LINK:
801 	case AUE_ACL_GET_FD:
802 	case AUE_ACL_GET_FILE:
803 	case AUE_ACL_GET_LINK:
804 	case AUE_ACL_SET_FD:
805 	case AUE_ACL_SET_FILE:
806 	case AUE_ACL_SET_LINK:
807 		if (ARG_IS_VALID(kar, ARG_VALUE)) {
808 			tok = au_to_arg32(1, "type", ar->ar_arg_value);
809 			kau_write(rec, tok);
810 		}
811 		ATFD1_TOKENS(1);
812 		UPATH1_VNODE1_TOKENS;
813 		break;
814 
815 	/*
816 	 * NB: We may want to verify that the appropriate
817 	 * audit args are being processed here, but I think
818 	 * a bit analysis is required.
819 	 *
820 	 * Process AUE_JAIL_SET in the next block so we can pickup any path
821 	 * related tokens that might exist.
822 	 */
823 	case AUE_JAIL_GET:
824 	case AUE_JAIL_ATTACH:
825 	case AUE_JAIL_REMOVE:
826 		break;
827 
828 	case AUE_JAIL_SET:
829 	case AUE_CHDIR:
830 	case AUE_CHROOT:
831 	case AUE_FSTATAT:
832 	case AUE_FUTIMESAT:
833 	case AUE_GETATTRLIST:
834 	case AUE_JAIL:
835 	case AUE_LUTIMES:
836 	case AUE_NFS_GETFH:
837 	case AUE_LGETFH:
838 	case AUE_LSTAT:
839 	case AUE_LPATHCONF:
840 	case AUE_PATHCONF:
841 	case AUE_READLINK:
842 	case AUE_READLINKAT:
843 	case AUE_REVOKE:
844 	case AUE_RMDIR:
845 	case AUE_SEARCHFS:
846 	case AUE_SETATTRLIST:
847 	case AUE_STAT:
848 	case AUE_STATFS:
849 	case AUE_SWAPON:
850 	case AUE_SWAPOFF:
851 	case AUE_TRUNCATE:
852 	case AUE_UNDELETE:
853 	case AUE_UNLINK:
854 	case AUE_UNLINKAT:
855 	case AUE_UTIMES:
856 	case AUE_REALPATHAT:
857 		ATFD1_TOKENS(1);
858 		UPATH1_VNODE1_TOKENS;
859 		break;
860 
861 	case AUE_ACCESS:
862 	case AUE_EACCESS:
863 	case AUE_FACCESSAT:
864 		ATFD1_TOKENS(1);
865 		UPATH1_VNODE1_TOKENS;
866 		if (ARG_IS_VALID(kar, ARG_VALUE)) {
867 			tok = au_to_arg32(2, "mode", ar->ar_arg_value);
868 			kau_write(rec, tok);
869 		}
870 		break;
871 
872 	case AUE_FHSTATFS:
873 	case AUE_FHOPEN:
874 	case AUE_FHSTAT:
875 		/* XXXRW: Need to audit vnode argument. */
876 		break;
877 
878 	case AUE_CHFLAGS:
879 	case AUE_LCHFLAGS:
880 	case AUE_CHFLAGSAT:
881 		if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
882 			tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
883 			kau_write(rec, tok);
884 		}
885 		UPATH1_VNODE1_TOKENS;
886 		break;
887 
888 	case AUE_CHMOD:
889 	case AUE_LCHMOD:
890 		if (ARG_IS_VALID(kar, ARG_MODE)) {
891 			tok = au_to_arg32(2, "new file mode",
892 			    ar->ar_arg_mode);
893 			kau_write(rec, tok);
894 		}
895 		UPATH1_VNODE1_TOKENS;
896 		break;
897 
898 	case AUE_FCHMODAT:
899 		ATFD1_TOKENS(1);
900 		if (ARG_IS_VALID(kar, ARG_MODE)) {
901 			tok = au_to_arg32(3, "new file mode",
902 			    ar->ar_arg_mode);
903 			kau_write(rec, tok);
904 		}
905 		UPATH1_VNODE1_TOKENS;
906 		break;
907 
908 	case AUE_CHOWN:
909 	case AUE_LCHOWN:
910 		if (ARG_IS_VALID(kar, ARG_UID)) {
911 			tok = au_to_arg32(2, "new file uid", ar->ar_arg_uid);
912 			kau_write(rec, tok);
913 		}
914 		if (ARG_IS_VALID(kar, ARG_GID)) {
915 			tok = au_to_arg32(3, "new file gid", ar->ar_arg_gid);
916 			kau_write(rec, tok);
917 		}
918 		UPATH1_VNODE1_TOKENS;
919 		break;
920 
921 	case AUE_FCHOWNAT:
922 		ATFD1_TOKENS(1);
923 		if (ARG_IS_VALID(kar, ARG_UID)) {
924 			tok = au_to_arg32(3, "new file uid", ar->ar_arg_uid);
925 			kau_write(rec, tok);
926 		}
927 		if (ARG_IS_VALID(kar, ARG_GID)) {
928 			tok = au_to_arg32(4, "new file gid", ar->ar_arg_gid);
929 			kau_write(rec, tok);
930 		}
931 		UPATH1_VNODE1_TOKENS;
932 		break;
933 
934 	case AUE_EXCHANGEDATA:
935 		UPATH1_VNODE1_TOKENS;
936 		UPATH2_TOKENS;
937 		break;
938 
939 	case AUE_CLOSE:
940 		if (ARG_IS_VALID(kar, ARG_FD)) {
941 			tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
942 			kau_write(rec, tok);
943 		}
944 		UPATH1_VNODE1_TOKENS;
945 		break;
946 
947 	case AUE_CLOSEFROM:
948 		if (ARG_IS_VALID(kar, ARG_FD)) {
949 			tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
950 			kau_write(rec, tok);
951 		}
952 		break;
953 
954 	case AUE_CLOSERANGE:
955 		if (ARG_IS_VALID(kar, ARG_FD)) {
956 			tok = au_to_arg32(1, "lowfd", ar->ar_arg_fd);
957 			kau_write(rec, tok);
958 		}
959 		if (ARG_IS_VALID(kar, ARG_CMD)) {
960 			tok = au_to_arg32(2, "highfd", ar->ar_arg_cmd);
961 			kau_write(rec, tok);
962 		}
963 		if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
964 			tok = au_to_arg32(3, "flags", ar->ar_arg_fflags);
965 			kau_write(rec, tok);
966 		}
967 		break;
968 
969 	case AUE_CORE:
970 		if (ARG_IS_VALID(kar, ARG_SIGNUM)) {
971 			tok = au_to_arg32(1, "signal", ar->ar_arg_signum);
972 			kau_write(rec, tok);
973 		}
974 		UPATH1_VNODE1_TOKENS;
975 		break;
976 
977 	case AUE_EXTATTRCTL:
978 		UPATH1_VNODE1_TOKENS;
979 		if (ARG_IS_VALID(kar, ARG_CMD)) {
980 			tok = au_to_arg32(2, "cmd", ar->ar_arg_cmd);
981 			kau_write(rec, tok);
982 		}
983 		/* extattrctl(2) filename parameter is in upath2/vnode2 */
984 		UPATH2_TOKENS;
985 		VNODE2_TOKENS;
986 		EXTATTR_TOKENS(4);
987 		break;
988 
989 	case AUE_EXTATTR_GET_FILE:
990 	case AUE_EXTATTR_SET_FILE:
991 	case AUE_EXTATTR_LIST_FILE:
992 	case AUE_EXTATTR_DELETE_FILE:
993 	case AUE_EXTATTR_GET_LINK:
994 	case AUE_EXTATTR_SET_LINK:
995 	case AUE_EXTATTR_LIST_LINK:
996 	case AUE_EXTATTR_DELETE_LINK:
997 		UPATH1_VNODE1_TOKENS;
998 		EXTATTR_TOKENS(2);
999 		break;
1000 
1001 	case AUE_EXTATTR_GET_FD:
1002 	case AUE_EXTATTR_SET_FD:
1003 	case AUE_EXTATTR_LIST_FD:
1004 	case AUE_EXTATTR_DELETE_FD:
1005 		if (ARG_IS_VALID(kar, ARG_FD)) {
1006 			tok = au_to_arg32(2, "fd", ar->ar_arg_fd);
1007 			kau_write(rec, tok);
1008 		}
1009 		EXTATTR_TOKENS(2);
1010 		break;
1011 
1012 	case AUE_FEXECVE:
1013 		if (ARG_IS_VALID(kar, ARG_FD)) {
1014 			tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
1015 			kau_write(rec, tok);
1016 		}
1017 		/* FALLTHROUGH */
1018 
1019 	case AUE_EXECVE:
1020 	case AUE_MAC_EXECVE:
1021 		if (ARG_IS_VALID(kar, ARG_ARGV)) {
1022 			tok = au_to_exec_args(ar->ar_arg_argv,
1023 			    ar->ar_arg_argc);
1024 			kau_write(rec, tok);
1025 		}
1026 		if (ARG_IS_VALID(kar, ARG_ENVV)) {
1027 			tok = au_to_exec_env(ar->ar_arg_envv,
1028 			    ar->ar_arg_envc);
1029 			kau_write(rec, tok);
1030 		}
1031 		UPATH1_VNODE1_TOKENS;
1032 		break;
1033 
1034 	case AUE_FCHMOD:
1035 		if (ARG_IS_VALID(kar, ARG_MODE)) {
1036 			tok = au_to_arg32(2, "new file mode",
1037 			    ar->ar_arg_mode);
1038 			kau_write(rec, tok);
1039 		}
1040 		FD_VNODE1_TOKENS;
1041 		break;
1042 
1043 	/*
1044 	 * XXXRW: Some of these need to handle non-vnode cases as well.
1045 	 */
1046 	case AUE_FCHDIR:
1047 	case AUE_FPATHCONF:
1048 	case AUE_FSTAT:
1049 	case AUE_FSTATFS:
1050 	case AUE_FSYNC:
1051 	case AUE_FTRUNCATE:
1052 	case AUE_FUTIMES:
1053 	case AUE_GETDIRENTRIES:
1054 	case AUE_GETDIRENTRIESATTR:
1055 	case AUE_LSEEK:
1056 	case AUE_POLL:
1057 	case AUE_POSIX_FALLOCATE:
1058 	case AUE_PREAD:
1059 	case AUE_PWRITE:
1060 	case AUE_READ:
1061 	case AUE_READV:
1062 	case AUE_WRITE:
1063 	case AUE_WRITEV:
1064 		FD_VNODE1_TOKENS;
1065 		break;
1066 
1067 	case AUE_FCHOWN:
1068 		if (ARG_IS_VALID(kar, ARG_UID)) {
1069 			tok = au_to_arg32(2, "new file uid", ar->ar_arg_uid);
1070 			kau_write(rec, tok);
1071 		}
1072 		if (ARG_IS_VALID(kar, ARG_GID)) {
1073 			tok = au_to_arg32(3, "new file gid", ar->ar_arg_gid);
1074 			kau_write(rec, tok);
1075 		}
1076 		FD_VNODE1_TOKENS;
1077 		break;
1078 
1079 	case AUE_FCNTL:
1080 		if (ARG_IS_VALID(kar, ARG_CMD)) {
1081 			tok = au_to_arg32(2, "cmd",
1082 			    au_fcntl_cmd_to_bsm(ar->ar_arg_cmd));
1083 			kau_write(rec, tok);
1084 		}
1085 		FD_VNODE1_TOKENS;
1086 		break;
1087 
1088 	case AUE_FCHFLAGS:
1089 		if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1090 			tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
1091 			kau_write(rec, tok);
1092 		}
1093 		FD_VNODE1_TOKENS;
1094 		break;
1095 
1096 	case AUE_FLOCK:
1097 		if (ARG_IS_VALID(kar, ARG_CMD)) {
1098 			tok = au_to_arg32(2, "operation", ar->ar_arg_cmd);
1099 			kau_write(rec, tok);
1100 		}
1101 		FD_VNODE1_TOKENS;
1102 		break;
1103 
1104 	case AUE_FSPACECTL:
1105 		if (ARG_IS_VALID(kar, ARG_CMD)) {
1106 			tok = au_to_arg32(2, "operation", ar->ar_arg_cmd);
1107 			kau_write(rec, tok);
1108 		}
1109 		if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1110 			tok = au_to_arg32(4, "flags", ar->ar_arg_fflags);
1111 			kau_write(rec, tok);
1112 		}
1113 		FD_VNODE1_TOKENS;
1114 		break;
1115 
1116 	case AUE_RFORK:
1117 		if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1118 			tok = au_to_arg32(1, "flags", ar->ar_arg_fflags);
1119 			kau_write(rec, tok);
1120 		}
1121 		/* FALLTHROUGH */
1122 
1123 	case AUE_FORK:
1124 	case AUE_VFORK:
1125 		if (ARG_IS_VALID(kar, ARG_PID)) {
1126 			tok = au_to_arg32(0, "child PID", ar->ar_arg_pid);
1127 			kau_write(rec, tok);
1128 		}
1129 		break;
1130 
1131 	case AUE_PDWAIT:
1132 		if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1133 			tok = au_to_arg32(1, "flags", ar->ar_arg_fflags);
1134 			kau_write(rec, tok);
1135 		}
1136 		if (ARG_IS_VALID(kar, ARG_FD)) {
1137 			tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
1138 			kau_write(rec, tok);
1139 		}
1140 
1141 	case AUE_IOCTL:
1142 		if (ARG_IS_VALID(kar, ARG_CMD)) {
1143 			tok = au_to_arg32(2, "cmd", ar->ar_arg_cmd);
1144 			kau_write(rec, tok);
1145 		}
1146 		if (ARG_IS_VALID(kar, ARG_VNODE1))
1147 			FD_VNODE1_TOKENS;
1148 		else {
1149 			if (ARG_IS_VALID(kar, ARG_SOCKINFO)) {
1150 				tok = kau_to_socket(&ar->ar_arg_sockinfo);
1151 				kau_write(rec, tok);
1152 			} else {
1153 				if (ARG_IS_VALID(kar, ARG_FD)) {
1154 					tok = au_to_arg32(1, "fd",
1155 					    ar->ar_arg_fd);
1156 					kau_write(rec, tok);
1157 				}
1158 			}
1159 		}
1160 		break;
1161 
1162 	case AUE_KILL:
1163 	case AUE_KILLPG:
1164 		if (ARG_IS_VALID(kar, ARG_SIGNUM)) {
1165 			tok = au_to_arg32(2, "signal", ar->ar_arg_signum);
1166 			kau_write(rec, tok);
1167 		}
1168 		PROCESS_PID_TOKENS(1);
1169 		break;
1170 
1171 	case AUE_KTRACE:
1172 		if (ARG_IS_VALID(kar, ARG_CMD)) {
1173 			tok = au_to_arg32(2, "ops", ar->ar_arg_cmd);
1174 			kau_write(rec, tok);
1175 		}
1176 		if (ARG_IS_VALID(kar, ARG_VALUE)) {
1177 			tok = au_to_arg32(3, "trpoints", ar->ar_arg_value);
1178 			kau_write(rec, tok);
1179 		}
1180 		PROCESS_PID_TOKENS(4);
1181 		UPATH1_VNODE1_TOKENS;
1182 		break;
1183 
1184 	case AUE_LINK:
1185 	case AUE_LINKAT:
1186 	case AUE_RENAME:
1187 	case AUE_RENAMEAT:
1188 		ATFD1_TOKENS(1);
1189 		UPATH1_VNODE1_TOKENS;
1190 		ATFD2_TOKENS(3);
1191 		UPATH2_TOKENS;
1192 		break;
1193 
1194 	case AUE_LOADSHFILE:
1195 		ADDR_TOKEN(4, "base addr");
1196 		UPATH1_VNODE1_TOKENS;
1197 		break;
1198 
1199 	case AUE_MKDIR:
1200 	case AUE_MKDIRAT:
1201 	case AUE_MKFIFO:
1202 	case AUE_MKFIFOAT:
1203 		ATFD1_TOKENS(1);
1204 		if (ARG_IS_VALID(kar, ARG_MODE)) {
1205 			tok = au_to_arg32(2, "mode", ar->ar_arg_mode);
1206 			kau_write(rec, tok);
1207 		}
1208 		UPATH1_VNODE1_TOKENS;
1209 		break;
1210 
1211 	case AUE_MKNOD:
1212 	case AUE_MKNODAT:
1213 		ATFD1_TOKENS(1);
1214 		if (ARG_IS_VALID(kar, ARG_MODE)) {
1215 			tok = au_to_arg32(2, "mode", ar->ar_arg_mode);
1216 			kau_write(rec, tok);
1217 		}
1218 		if (ARG_IS_VALID(kar, ARG_DEV)) {
1219 			tok = au_to_arg32(3, "dev", ar->ar_arg_dev);
1220 			kau_write(rec, tok);
1221 		}
1222 		UPATH1_VNODE1_TOKENS;
1223 		break;
1224 
1225 	case AUE_MMAP:
1226 	case AUE_MUNMAP:
1227 	case AUE_MPROTECT:
1228 	case AUE_MLOCK:
1229 	case AUE_MUNLOCK:
1230 	case AUE_MINHERIT:
1231 		ADDR_TOKEN(1, "addr");
1232 		if (ARG_IS_VALID(kar, ARG_LEN)) {
1233 			tok = au_to_arg32(2, "len", ar->ar_arg_len);
1234 			kau_write(rec, tok);
1235 		}
1236 		if (ar->ar_event == AUE_MMAP)
1237 			FD_VNODE1_TOKENS;
1238 		if (ar->ar_event == AUE_MPROTECT) {
1239 			if (ARG_IS_VALID(kar, ARG_VALUE)) {
1240 				tok = au_to_arg32(3, "protection",
1241 				    ar->ar_arg_value);
1242 				kau_write(rec, tok);
1243 			}
1244 		}
1245 		if (ar->ar_event == AUE_MINHERIT) {
1246 			if (ARG_IS_VALID(kar, ARG_VALUE)) {
1247 				tok = au_to_arg32(3, "inherit",
1248 				    ar->ar_arg_value);
1249 				kau_write(rec, tok);
1250 			}
1251 		}
1252 		break;
1253 
1254 	case AUE_MOUNT:
1255 	case AUE_NMOUNT:
1256 		/* XXX Need to handle NFS mounts */
1257 		if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1258 			tok = au_to_arg32(3, "flags", ar->ar_arg_fflags);
1259 			kau_write(rec, tok);
1260 		}
1261 		if (ARG_IS_VALID(kar, ARG_TEXT)) {
1262 			tok = au_to_text(ar->ar_arg_text);
1263 			kau_write(rec, tok);
1264 		}
1265 		/* FALLTHROUGH */
1266 
1267 	case AUE_NFS_SVC:
1268 		if (ARG_IS_VALID(kar, ARG_CMD)) {
1269 			tok = au_to_arg32(1, "flags", ar->ar_arg_cmd);
1270 			kau_write(rec, tok);
1271 		}
1272 		break;
1273 
1274 	case AUE_UMOUNT:
1275 		if (ARG_IS_VALID(kar, ARG_VALUE)) {
1276 			tok = au_to_arg32(2, "flags", ar->ar_arg_value);
1277 			kau_write(rec, tok);
1278 		}
1279 		UPATH1_VNODE1_TOKENS;
1280 		if (ARG_IS_VALID(kar, ARG_TEXT)) {
1281 			tok = au_to_text(ar->ar_arg_text);
1282 			kau_write(rec, tok);
1283 		}
1284 		break;
1285 
1286 	case AUE_MSGCTL:
1287 		ar->ar_event = audit_msgctl_to_event(ar->ar_arg_svipc_cmd);
1288 		/* Fall through */
1289 
1290 	case AUE_MSGRCV:
1291 	case AUE_MSGSND:
1292 		tok = au_to_arg32(1, "msg ID", ar->ar_arg_svipc_id);
1293 		kau_write(rec, tok);
1294 		if (ar->ar_errno != EINVAL) {
1295 			tok = au_to_ipc(AT_IPC_MSG, ar->ar_arg_svipc_id);
1296 			kau_write(rec, tok);
1297 		}
1298 		break;
1299 
1300 	case AUE_MSGGET:
1301 		if (ar->ar_errno == 0) {
1302 			if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
1303 				tok = au_to_ipc(AT_IPC_MSG,
1304 				    ar->ar_arg_svipc_id);
1305 				kau_write(rec, tok);
1306 			}
1307 		}
1308 		break;
1309 
1310 	case AUE_RESETSHFILE:
1311 		ADDR_TOKEN(1, "base addr");
1312 		break;
1313 
1314 	case AUE_OPEN_RC:
1315 	case AUE_OPEN_RTC:
1316 	case AUE_OPEN_RWC:
1317 	case AUE_OPEN_RWTC:
1318 	case AUE_OPEN_WC:
1319 	case AUE_OPEN_WTC:
1320 	case AUE_CREAT:
1321 		if (ARG_IS_VALID(kar, ARG_MODE)) {
1322 			tok = au_to_arg32(3, "mode", ar->ar_arg_mode);
1323 			kau_write(rec, tok);
1324 		}
1325 		/* FALLTHROUGH */
1326 
1327 	case AUE_OPEN_R:
1328 	case AUE_OPEN_RT:
1329 	case AUE_OPEN_RW:
1330 	case AUE_OPEN_RWT:
1331 	case AUE_OPEN_W:
1332 	case AUE_OPEN_WT:
1333 		if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1334 			tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
1335 			kau_write(rec, tok);
1336 		}
1337 		UPATH1_VNODE1_TOKENS;
1338 		break;
1339 
1340 	case AUE_OPENAT_RC:
1341 	case AUE_OPENAT_RTC:
1342 	case AUE_OPENAT_RWC:
1343 	case AUE_OPENAT_RWTC:
1344 	case AUE_OPENAT_WC:
1345 	case AUE_OPENAT_WTC:
1346 		if (ARG_IS_VALID(kar, ARG_MODE)) {
1347 			tok = au_to_arg32(3, "mode", ar->ar_arg_mode);
1348 			kau_write(rec, tok);
1349 		}
1350 		/* FALLTHROUGH */
1351 
1352 	case AUE_OPENAT_R:
1353 	case AUE_OPENAT_RT:
1354 	case AUE_OPENAT_RW:
1355 	case AUE_OPENAT_RWT:
1356 	case AUE_OPENAT_W:
1357 	case AUE_OPENAT_WT:
1358 		if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1359 			tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
1360 			kau_write(rec, tok);
1361 		}
1362 		ATFD1_TOKENS(1);
1363 		UPATH1_VNODE1_TOKENS;
1364 		break;
1365 
1366 	case AUE_PDKILL:
1367 		if (ARG_IS_VALID(kar, ARG_FD)) {
1368 			tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
1369 			kau_write(rec, tok);
1370 		}
1371 		if (ARG_IS_VALID(kar, ARG_SIGNUM)) {
1372 			tok = au_to_arg32(2, "signal", ar->ar_arg_signum);
1373 			kau_write(rec, tok);
1374 		}
1375 		PROCESS_PID_TOKENS(1);
1376 		break;
1377 	case AUE_PDFORK:
1378 		if (ARG_IS_VALID(kar, ARG_PID)) {
1379 			tok = au_to_arg32(0, "child PID", ar->ar_arg_pid);
1380 			kau_write(rec, tok);
1381 		}
1382 		if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1383 			tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
1384 			kau_write(rec, tok);
1385 		}
1386 		if (ARG_IS_VALID(kar, ARG_FD)) {
1387 			tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
1388 			kau_write(rec, tok);
1389 		}
1390 		break;
1391 	case AUE_PDRFORK:
1392 		if (ARG_IS_VALID(kar, ARG_PID)) {
1393 			tok = au_to_arg32(0, "child PID", ar->ar_arg_pid);
1394 			kau_write(rec, tok);
1395 		}
1396 		if (ARG_IS_VALID(kar, ARG_CMD)) {
1397 			tok = au_to_arg32(2, "fflags", ar->ar_arg_cmd);
1398 			kau_write(rec, tok);
1399 		}
1400 		if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1401 			tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
1402 			kau_write(rec, tok);
1403 		}
1404 		if (ARG_IS_VALID(kar, ARG_FD)) {
1405 			tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
1406 			kau_write(rec, tok);
1407 		}
1408 		break;
1409 	case AUE_PDGETPID:
1410 		if (ARG_IS_VALID(kar, ARG_FD)) {
1411 			tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
1412 			kau_write(rec, tok);
1413 		}
1414 		break;
1415 
1416 	case AUE_PROCCTL:
1417 		if (ARG_IS_VALID(kar, ARG_VALUE)) {
1418 			tok = au_to_arg32(1, "idtype", ar->ar_arg_value);
1419 			kau_write(rec, tok);
1420 		}
1421 		if (ARG_IS_VALID(kar, ARG_CMD)) {
1422 			tok = au_to_arg32(2, "com", ar->ar_arg_cmd);
1423 			kau_write(rec, tok);
1424 		}
1425 		PROCESS_PID_TOKENS(3);
1426 		break;
1427 
1428 	case AUE_PTRACE:
1429 		if (ARG_IS_VALID(kar, ARG_CMD)) {
1430 			tok = au_to_arg32(1, "request", ar->ar_arg_cmd);
1431 			kau_write(rec, tok);
1432 		}
1433 		if (ARG_IS_VALID(kar, ARG_VALUE)) {
1434 			tok = au_to_arg32(4, "data", ar->ar_arg_value);
1435 			kau_write(rec, tok);
1436 		}
1437 		PROCESS_PID_TOKENS(2);
1438 		break;
1439 
1440 	case AUE_QUOTACTL:
1441 		if (ARG_IS_VALID(kar, ARG_CMD)) {
1442 			tok = au_to_arg32(2, "command", ar->ar_arg_cmd);
1443 			kau_write(rec, tok);
1444 		}
1445 		if (ARG_IS_VALID(kar, ARG_UID)) {
1446 			tok = au_to_arg32(3, "uid", ar->ar_arg_uid);
1447 			kau_write(rec, tok);
1448 		}
1449 		if (ARG_IS_VALID(kar, ARG_GID)) {
1450 			tok = au_to_arg32(3, "gid", ar->ar_arg_gid);
1451 			kau_write(rec, tok);
1452 		}
1453 		UPATH1_VNODE1_TOKENS;
1454 		break;
1455 
1456 	case AUE_REBOOT:
1457 		if (ARG_IS_VALID(kar, ARG_CMD)) {
1458 			tok = au_to_arg32(1, "howto", ar->ar_arg_cmd);
1459 			kau_write(rec, tok);
1460 		}
1461 		break;
1462 
1463 	case AUE_SEMCTL:
1464 		ar->ar_event = audit_semctl_to_event(ar->ar_arg_svipc_cmd);
1465 		/* Fall through */
1466 
1467 	case AUE_SEMOP:
1468 		if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
1469 			tok = au_to_arg32(1, "sem ID", ar->ar_arg_svipc_id);
1470 			kau_write(rec, tok);
1471 			if (ar->ar_errno != EINVAL) {
1472 				tok = au_to_ipc(AT_IPC_SEM,
1473 				    ar->ar_arg_svipc_id);
1474 				kau_write(rec, tok);
1475 			}
1476 		}
1477 		break;
1478 
1479 	case AUE_SEMGET:
1480 		if (ar->ar_errno == 0) {
1481 			if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
1482 				tok = au_to_ipc(AT_IPC_SEM,
1483 				    ar->ar_arg_svipc_id);
1484 				kau_write(rec, tok);
1485 			}
1486 		}
1487 		break;
1488 
1489 	case AUE_SETEGID:
1490 		if (ARG_IS_VALID(kar, ARG_EGID)) {
1491 			tok = au_to_arg32(1, "egid", ar->ar_arg_egid);
1492 			kau_write(rec, tok);
1493 		}
1494 		break;
1495 
1496 	case AUE_SETEUID:
1497 		if (ARG_IS_VALID(kar, ARG_EUID)) {
1498 			tok = au_to_arg32(1, "euid", ar->ar_arg_euid);
1499 			kau_write(rec, tok);
1500 		}
1501 		break;
1502 
1503 	case AUE_SETREGID:
1504 		if (ARG_IS_VALID(kar, ARG_RGID)) {
1505 			tok = au_to_arg32(1, "rgid", ar->ar_arg_rgid);
1506 			kau_write(rec, tok);
1507 		}
1508 		if (ARG_IS_VALID(kar, ARG_EGID)) {
1509 			tok = au_to_arg32(2, "egid", ar->ar_arg_egid);
1510 			kau_write(rec, tok);
1511 		}
1512 		break;
1513 
1514 	case AUE_SETREUID:
1515 		if (ARG_IS_VALID(kar, ARG_RUID)) {
1516 			tok = au_to_arg32(1, "ruid", ar->ar_arg_ruid);
1517 			kau_write(rec, tok);
1518 		}
1519 		if (ARG_IS_VALID(kar, ARG_EUID)) {
1520 			tok = au_to_arg32(2, "euid", ar->ar_arg_euid);
1521 			kau_write(rec, tok);
1522 		}
1523 		break;
1524 
1525 	case AUE_SETRESGID:
1526 		if (ARG_IS_VALID(kar, ARG_RGID)) {
1527 			tok = au_to_arg32(1, "rgid", ar->ar_arg_rgid);
1528 			kau_write(rec, tok);
1529 		}
1530 		if (ARG_IS_VALID(kar, ARG_EGID)) {
1531 			tok = au_to_arg32(2, "egid", ar->ar_arg_egid);
1532 			kau_write(rec, tok);
1533 		}
1534 		if (ARG_IS_VALID(kar, ARG_SGID)) {
1535 			tok = au_to_arg32(3, "sgid", ar->ar_arg_sgid);
1536 			kau_write(rec, tok);
1537 		}
1538 		break;
1539 
1540 	case AUE_SETRESUID:
1541 		if (ARG_IS_VALID(kar, ARG_RUID)) {
1542 			tok = au_to_arg32(1, "ruid", ar->ar_arg_ruid);
1543 			kau_write(rec, tok);
1544 		}
1545 		if (ARG_IS_VALID(kar, ARG_EUID)) {
1546 			tok = au_to_arg32(2, "euid", ar->ar_arg_euid);
1547 			kau_write(rec, tok);
1548 		}
1549 		if (ARG_IS_VALID(kar, ARG_SUID)) {
1550 			tok = au_to_arg32(3, "suid", ar->ar_arg_suid);
1551 			kau_write(rec, tok);
1552 		}
1553 		break;
1554 
1555 	case AUE_SETGID:
1556 		if (ARG_IS_VALID(kar, ARG_GID)) {
1557 			tok = au_to_arg32(1, "gid", ar->ar_arg_gid);
1558 			kau_write(rec, tok);
1559 		}
1560 		break;
1561 
1562 	case AUE_SETUID:
1563 		if (ARG_IS_VALID(kar, ARG_UID)) {
1564 			tok = au_to_arg32(1, "uid", ar->ar_arg_uid);
1565 			kau_write(rec, tok);
1566 		}
1567 		break;
1568 
1569 	case AUE_SETGROUPS:
1570 		if (ARG_IS_VALID(kar, ARG_GROUPSET)) {
1571 			for(ctr = 0; ctr < ar->ar_arg_groups.gidset_size; ctr++)
1572 			{
1573 				tok = au_to_arg32(1, "setgroups",
1574 				    ar->ar_arg_groups.gidset[ctr]);
1575 				kau_write(rec, tok);
1576 			}
1577 		}
1578 		break;
1579 
1580 	case AUE_SETLOGIN:
1581 		if (ARG_IS_VALID(kar, ARG_LOGIN)) {
1582 			tok = au_to_text(ar->ar_arg_login);
1583 			kau_write(rec, tok);
1584 		}
1585 		break;
1586 
1587 	case AUE_SETLOGINCLASS:
1588 		break;
1589 
1590 	case AUE_SETPRIORITY:
1591 		if (ARG_IS_VALID(kar, ARG_CMD)) {
1592 			tok = au_to_arg32(1, "which", ar->ar_arg_cmd);
1593 			kau_write(rec, tok);
1594 		}
1595 		if (ARG_IS_VALID(kar, ARG_UID)) {
1596 			tok = au_to_arg32(2, "who", ar->ar_arg_uid);
1597 			kau_write(rec, tok);
1598 		}
1599 		PROCESS_PID_TOKENS(2);
1600 		if (ARG_IS_VALID(kar, ARG_VALUE)) {
1601 			tok = au_to_arg32(3, "priority", ar->ar_arg_value);
1602 			kau_write(rec, tok);
1603 		}
1604 		break;
1605 
1606 	case AUE_SETPRIVEXEC:
1607 		if (ARG_IS_VALID(kar, ARG_VALUE)) {
1608 			tok = au_to_arg32(1, "flag", ar->ar_arg_value);
1609 			kau_write(rec, tok);
1610 		}
1611 		break;
1612 
1613 	/* AUE_SHMAT, AUE_SHMCTL, AUE_SHMDT and AUE_SHMGET are SysV IPC */
1614 	case AUE_SHMAT:
1615 		if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
1616 			tok = au_to_arg32(1, "shmid", ar->ar_arg_svipc_id);
1617 			kau_write(rec, tok);
1618 			/* XXXAUDIT: Does having the ipc token make sense? */
1619 			tok = au_to_ipc(AT_IPC_SHM, ar->ar_arg_svipc_id);
1620 			kau_write(rec, tok);
1621 		}
1622 		if (ARG_IS_VALID(kar, ARG_SVIPC_ADDR)) {
1623 			tok = au_to_arg32(2, "shmaddr",
1624 			    (int)(uintptr_t)ar->ar_arg_svipc_addr);
1625 			kau_write(rec, tok);
1626 		}
1627 		if (ARG_IS_VALID(kar, ARG_SVIPC_PERM)) {
1628 			tok = au_to_ipc_perm(&ar->ar_arg_svipc_perm);
1629 			kau_write(rec, tok);
1630 		}
1631 		break;
1632 
1633 	case AUE_SHMCTL:
1634 		if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
1635 			tok = au_to_arg32(1, "shmid", ar->ar_arg_svipc_id);
1636 			kau_write(rec, tok);
1637 			/* XXXAUDIT: Does having the ipc token make sense? */
1638 			tok = au_to_ipc(AT_IPC_SHM, ar->ar_arg_svipc_id);
1639 			kau_write(rec, tok);
1640 		}
1641 		switch (ar->ar_arg_svipc_cmd) {
1642 		case IPC_STAT:
1643 			ar->ar_event = AUE_SHMCTL_STAT;
1644 			break;
1645 		case IPC_RMID:
1646 			ar->ar_event = AUE_SHMCTL_RMID;
1647 			break;
1648 		case IPC_SET:
1649 			ar->ar_event = AUE_SHMCTL_SET;
1650 			if (ARG_IS_VALID(kar, ARG_SVIPC_PERM)) {
1651 				tok = au_to_ipc_perm(&ar->ar_arg_svipc_perm);
1652 				kau_write(rec, tok);
1653 			}
1654 			break;
1655 		default:
1656 			break;	/* We will audit a bad command */
1657 		}
1658 		break;
1659 
1660 	case AUE_SHMDT:
1661 		if (ARG_IS_VALID(kar, ARG_SVIPC_ADDR)) {
1662 			tok = au_to_arg32(1, "shmaddr",
1663 			    (int)(uintptr_t)ar->ar_arg_svipc_addr);
1664 			kau_write(rec, tok);
1665 		}
1666 		break;
1667 
1668 	case AUE_SHMGET:
1669 		/* This is unusual; the return value is in an argument token */
1670 		if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
1671 			tok = au_to_arg32(0, "shmid", ar->ar_arg_svipc_id);
1672 			kau_write(rec, tok);
1673 			tok = au_to_ipc(AT_IPC_SHM, ar->ar_arg_svipc_id);
1674 			kau_write(rec, tok);
1675 		}
1676 		if (ARG_IS_VALID(kar, ARG_SVIPC_PERM)) {
1677 			tok = au_to_ipc_perm(&ar->ar_arg_svipc_perm);
1678 			kau_write(rec, tok);
1679 		}
1680 		break;
1681 
1682 	/* shm_rename is a non-Posix extension to the Posix shm implementation */
1683 	case AUE_SHMRENAME:
1684 		UPATH1_TOKENS;
1685 		UPATH2_TOKENS;
1686 		if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1687 			tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
1688 			kau_write(rec, tok);
1689 		}
1690 		break;
1691 
1692 	/* AUE_SHMOPEN, AUE_SHMUNLINK, AUE_SEMOPEN, AUE_SEMCLOSE
1693 	 * and AUE_SEMUNLINK are Posix IPC */
1694 	case AUE_SHMOPEN:
1695 		if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1696 			tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
1697 			kau_write(rec, tok);
1698 		}
1699 		if (ARG_IS_VALID(kar, ARG_MODE)) {
1700 			tok = au_to_arg32(3, "mode", ar->ar_arg_mode);
1701 			kau_write(rec, tok);
1702 		}
1703 		/* FALLTHROUGH */
1704 
1705 	case AUE_SHMUNLINK:
1706 		UPATH1_TOKENS;
1707 		if (ARG_IS_VALID(kar, ARG_POSIX_IPC_PERM)) {
1708 			struct ipc_perm perm;
1709 
1710 			perm.uid = ar->ar_arg_pipc_perm.pipc_uid;
1711 			perm.gid = ar->ar_arg_pipc_perm.pipc_gid;
1712 			perm.cuid = ar->ar_arg_pipc_perm.pipc_uid;
1713 			perm.cgid = ar->ar_arg_pipc_perm.pipc_gid;
1714 			perm.mode = ar->ar_arg_pipc_perm.pipc_mode;
1715 			perm.seq = 0;
1716 			perm.key = 0;
1717 			tok = au_to_ipc_perm(&perm);
1718 			kau_write(rec, tok);
1719 		}
1720 		break;
1721 
1722 	case AUE_SEMOPEN:
1723 		if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1724 			tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
1725 			kau_write(rec, tok);
1726 		}
1727 		if (ARG_IS_VALID(kar, ARG_MODE)) {
1728 			tok = au_to_arg32(3, "mode", ar->ar_arg_mode);
1729 			kau_write(rec, tok);
1730 		}
1731 		if (ARG_IS_VALID(kar, ARG_VALUE)) {
1732 			tok = au_to_arg32(4, "value", ar->ar_arg_value);
1733 			kau_write(rec, tok);
1734 		}
1735 		/* FALLTHROUGH */
1736 
1737 	case AUE_SEMUNLINK:
1738 		if (ARG_IS_VALID(kar, ARG_TEXT)) {
1739 			tok = au_to_text(ar->ar_arg_text);
1740 			kau_write(rec, tok);
1741 		}
1742 		if (ARG_IS_VALID(kar, ARG_POSIX_IPC_PERM)) {
1743 			struct ipc_perm perm;
1744 
1745 			perm.uid = ar->ar_arg_pipc_perm.pipc_uid;
1746 			perm.gid = ar->ar_arg_pipc_perm.pipc_gid;
1747 			perm.cuid = ar->ar_arg_pipc_perm.pipc_uid;
1748 			perm.cgid = ar->ar_arg_pipc_perm.pipc_gid;
1749 			perm.mode = ar->ar_arg_pipc_perm.pipc_mode;
1750 			perm.seq = 0;
1751 			perm.key = 0;
1752 			tok = au_to_ipc_perm(&perm);
1753 			kau_write(rec, tok);
1754 		}
1755 		break;
1756 
1757 	case AUE_SEMCLOSE:
1758 		if (ARG_IS_VALID(kar, ARG_FD)) {
1759 			tok = au_to_arg32(1, "sem", ar->ar_arg_fd);
1760 			kau_write(rec, tok);
1761 		}
1762 		break;
1763 
1764 	case AUE_SYMLINK:
1765 	case AUE_SYMLINKAT:
1766 		if (ARG_IS_VALID(kar, ARG_TEXT)) {
1767 			tok = au_to_text(ar->ar_arg_text);
1768 			kau_write(rec, tok);
1769 		}
1770 		ATFD1_TOKENS(1);
1771 		UPATH1_VNODE1_TOKENS;
1772 		break;
1773 
1774 	case AUE_SYSCTL:
1775 	case AUE_SYSCTL_NONADMIN:
1776 		if (ARG_IS_VALID(kar, ARG_CTLNAME | ARG_LEN)) {
1777 			for (ctr = 0; ctr < ar->ar_arg_len; ctr++) {
1778 				tok = au_to_arg32(1, "name",
1779 				    ar->ar_arg_ctlname[ctr]);
1780 				kau_write(rec, tok);
1781 			}
1782 		}
1783 		if (ARG_IS_VALID(kar, ARG_VALUE)) {
1784 			tok = au_to_arg32(5, "newval", ar->ar_arg_value);
1785 			kau_write(rec, tok);
1786 		}
1787 		if (ARG_IS_VALID(kar, ARG_TEXT)) {
1788 			tok = au_to_text(ar->ar_arg_text);
1789 			kau_write(rec, tok);
1790 		}
1791 		break;
1792 
1793 	case AUE_UMASK:
1794 		if (ARG_IS_VALID(kar, ARG_MASK)) {
1795 			tok = au_to_arg32(1, "new mask", ar->ar_arg_mask);
1796 			kau_write(rec, tok);
1797 		}
1798 		tok = au_to_arg32(0, "prev mask", ar->ar_retval);
1799 		kau_write(rec, tok);
1800 		break;
1801 
1802 	case AUE_WAIT4:
1803 	case AUE_WAIT6:
1804 		PROCESS_PID_TOKENS(1);
1805 		if (ARG_IS_VALID(kar, ARG_VALUE)) {
1806 			tok = au_to_arg32(3, "options", ar->ar_arg_value);
1807 			kau_write(rec, tok);
1808 		}
1809 		break;
1810 
1811 	case AUE_CAP_RIGHTS_LIMIT:
1812 		/*
1813 		 * XXXRW/XXXJA: Would be nice to audit socket/etc information.
1814 		 */
1815 		FD_VNODE1_TOKENS;
1816 		if (ARG_IS_VALID(kar, ARG_RIGHTS)) {
1817 			tok = au_to_rights(&ar->ar_arg_rights);
1818 			kau_write(rec, tok);
1819 		}
1820 		break;
1821 
1822 	case AUE_CAP_FCNTLS_GET:
1823 	case AUE_CAP_IOCTLS_GET:
1824 	case AUE_CAP_IOCTLS_LIMIT:
1825 	case AUE_CAP_RIGHTS_GET:
1826 		if (ARG_IS_VALID(kar, ARG_FD)) {
1827 			tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
1828 			kau_write(rec, tok);
1829 		}
1830 		break;
1831 
1832 	case AUE_CAP_FCNTLS_LIMIT:
1833 		FD_VNODE1_TOKENS;
1834 		if (ARG_IS_VALID(kar, ARG_FCNTL_RIGHTS)) {
1835 			tok = au_to_arg32(2, "fcntlrights",
1836 			    ar->ar_arg_fcntl_rights);
1837 			kau_write(rec, tok);
1838 		}
1839 		break;
1840 
1841 	case AUE_CAP_ENTER:
1842 	case AUE_CAP_GETMODE:
1843 		break;
1844 
1845 	case AUE_THR_NEW:
1846 	case AUE_THR_KILL:
1847 	case AUE_THR_EXIT:
1848 		break;
1849 
1850 	case AUE_NULL:
1851 	default:
1852 		printf("BSM conversion requested for unknown event %d\n",
1853 		    ar->ar_event);
1854 
1855 		/*
1856 		 * Write the subject token so it is properly freed here.
1857 		 */
1858 		if (jail_tok != NULL)
1859 			kau_write(rec, jail_tok);
1860 		kau_write(rec, subj_tok);
1861 		kau_free(rec);
1862 		return (BSM_NOAUDIT);
1863 	}
1864 
1865 	if (jail_tok != NULL)
1866 		kau_write(rec, jail_tok);
1867 	kau_write(rec, subj_tok);
1868 	tok = au_to_return32(au_errno_to_bsm(ar->ar_errno), ar->ar_retval);
1869 	kau_write(rec, tok);  /* Every record gets a return token */
1870 
1871 	kau_close(rec, &ar->ar_endtime, ar->ar_event);
1872 
1873 	*pau = rec;
1874 	return (BSM_SUCCESS);
1875 }
1876 
1877 /*
1878  * Verify that a record is a valid BSM record. This verification is simple
1879  * now, but may be expanded on sometime in the future.  Return 1 if the
1880  * record is good, 0 otherwise.
1881  */
1882 int
bsm_rec_verify(void * rec)1883 bsm_rec_verify(void *rec)
1884 {
1885 	char c = *(char *)rec;
1886 
1887 	/*
1888 	 * Check the token ID of the first token; it has to be a header
1889 	 * token.
1890 	 *
1891 	 * XXXAUDIT There needs to be a token structure to map a token.
1892 	 * XXXAUDIT 'Shouldn't be simply looking at the first char.
1893 	 */
1894 	if ((c != AUT_HEADER32) && (c != AUT_HEADER32_EX) &&
1895 	    (c != AUT_HEADER64) && (c != AUT_HEADER64_EX))
1896 		return (0);
1897 	return (1);
1898 }
1899