1 /*
2 * SPDX-License-Identifier: BSD-3-Clause
3 *
4 * Copyright (c) 1999-2009 Apple Inc.
5 * Copyright (c) 2016-2017 Robert N. M. Watson
6 * All rights reserved.
7 *
8 * Portions of this software were developed by BAE Systems, the University of
9 * Cambridge Computer Laboratory, and Memorial University under DARPA/AFRL
10 * contract FA8650-15-C-7558 ("CADETS"), as part of the DARPA Transparent
11 * Computing (TC) research program.
12 *
13 * Redistribution and use in source and binary forms, with or without
14 * modification, are permitted provided that the following conditions
15 * are met:
16 * 1. Redistributions of source code must retain the above copyright
17 * notice, this list of conditions and the following disclaimer.
18 * 2. Redistributions in binary form must reproduce the above copyright
19 * notice, this list of conditions and the following disclaimer in the
20 * documentation and/or other materials provided with the distribution.
21 * 3. Neither the name of Apple Inc. ("Apple") nor the names of
22 * its contributors may be used to endorse or promote products derived
23 * from this software without specific prior written permission.
24 *
25 * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND
26 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
27 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
28 * ARE DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR
29 * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
30 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
31 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
32 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
33 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
34 * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
35 * POSSIBILITY OF SUCH DAMAGE.
36 */
37
38 #include <sys/param.h>
39 #include <sys/vnode.h>
40 #include <sys/ipc.h>
41 #include <sys/lock.h>
42 #include <sys/malloc.h>
43 #include <sys/mutex.h>
44 #include <sys/socket.h>
45 #include <sys/extattr.h>
46 #include <sys/fcntl.h>
47 #include <sys/user.h>
48 #include <sys/systm.h>
49
50 #include <bsm/audit.h>
51 #include <bsm/audit_internal.h>
52 #include <bsm/audit_record.h>
53 #include <bsm/audit_kevents.h>
54
55 #include <security/audit/audit.h>
56 #include <security/audit/audit_private.h>
57
58 #include <netinet/in_systm.h>
59 #include <netinet/in.h>
60 #include <netinet/ip.h>
61
62 MALLOC_DEFINE(M_AUDITBSM, "audit_bsm", "Audit BSM data");
63
64 static void audit_sys_auditon(struct audit_record *ar,
65 struct au_record *rec);
66
67 /*
68 * Initialize the BSM auditing subsystem.
69 */
70 void
kau_init(void)71 kau_init(void)
72 {
73
74 au_evclassmap_init();
75 au_evnamemap_init();
76 }
77
78 /*
79 * This call reserves memory for the audit record. Memory must be guaranteed
80 * before any auditable event can be generated. The au_record structure
81 * maintains a reference to the memory allocated above and also the list of
82 * tokens associated with this record.
83 */
84 static struct au_record *
kau_open(void)85 kau_open(void)
86 {
87 struct au_record *rec;
88
89 rec = malloc(sizeof(*rec), M_AUDITBSM, M_WAITOK);
90 rec->data = NULL;
91 TAILQ_INIT(&rec->token_q);
92 rec->len = 0;
93 rec->used = 1;
94
95 return (rec);
96 }
97
98 /*
99 * Store the token with the record descriptor.
100 */
101 static void
kau_write(struct au_record * rec,struct au_token * tok)102 kau_write(struct au_record *rec, struct au_token *tok)
103 {
104
105 KASSERT(tok != NULL, ("kau_write: tok == NULL"));
106
107 TAILQ_INSERT_TAIL(&rec->token_q, tok, tokens);
108 rec->len += tok->len;
109 }
110
111 /*
112 * Close out the audit record by adding the header token, identifying any
113 * missing tokens. Write out the tokens to the record memory.
114 */
115 static void
kau_close(struct au_record * rec,struct timespec * ctime,short event)116 kau_close(struct au_record *rec, struct timespec *ctime, short event)
117 {
118 u_char *dptr;
119 size_t tot_rec_size;
120 token_t *cur, *hdr, *trail;
121 struct timeval tm;
122 size_t hdrsize;
123 struct auditinfo_addr ak;
124 struct in6_addr *ap;
125
126 audit_get_kinfo(&ak);
127 hdrsize = 0;
128 switch (ak.ai_termid.at_type) {
129 case AU_IPv4:
130 hdrsize = (ak.ai_termid.at_addr[0] == INADDR_ANY) ?
131 AUDIT_HEADER_SIZE : AUDIT_HEADER_EX_SIZE(&ak);
132 break;
133 case AU_IPv6:
134 ap = (struct in6_addr *)&ak.ai_termid.at_addr[0];
135 hdrsize = (IN6_IS_ADDR_UNSPECIFIED(ap)) ? AUDIT_HEADER_SIZE :
136 AUDIT_HEADER_EX_SIZE(&ak);
137 break;
138 default:
139 panic("kau_close: invalid address family");
140 }
141 tot_rec_size = rec->len + hdrsize + AUDIT_TRAILER_SIZE;
142 rec->data = malloc(tot_rec_size, M_AUDITBSM, M_WAITOK | M_ZERO);
143
144 tm.tv_usec = ctime->tv_nsec / 1000;
145 tm.tv_sec = ctime->tv_sec;
146 if (hdrsize != AUDIT_HEADER_SIZE)
147 hdr = au_to_header32_ex_tm(tot_rec_size, event, 0, tm, &ak);
148 else
149 hdr = au_to_header32_tm(tot_rec_size, event, 0, tm);
150 TAILQ_INSERT_HEAD(&rec->token_q, hdr, tokens);
151
152 trail = au_to_trailer(tot_rec_size);
153 TAILQ_INSERT_TAIL(&rec->token_q, trail, tokens);
154
155 rec->len = tot_rec_size;
156 dptr = rec->data;
157 TAILQ_FOREACH(cur, &rec->token_q, tokens) {
158 memcpy(dptr, cur->t_data, cur->len);
159 dptr += cur->len;
160 }
161 }
162
163 /*
164 * Free a BSM audit record by releasing all the tokens and clearing the audit
165 * record information.
166 */
167 void
kau_free(struct au_record * rec)168 kau_free(struct au_record *rec)
169 {
170 struct au_token *tok;
171
172 /* Free the token list. */
173 while ((tok = TAILQ_FIRST(&rec->token_q))) {
174 TAILQ_REMOVE(&rec->token_q, tok, tokens);
175 free(tok->t_data, M_AUDITBSM);
176 free(tok, M_AUDITBSM);
177 }
178
179 rec->used = 0;
180 rec->len = 0;
181 free(rec->data, M_AUDITBSM);
182 free(rec, M_AUDITBSM);
183 }
184
185 /*
186 * XXX: May want turn some (or all) of these macros into functions in order
187 * to reduce the generated code size.
188 *
189 * XXXAUDIT: These macros assume that 'kar', 'ar', 'rec', and 'tok' in the
190 * caller are OK with this.
191 */
192 #define ATFD1_TOKENS(argnum) do { \
193 if (ARG_IS_VALID(kar, ARG_ATFD1)) { \
194 tok = au_to_arg32(argnum, "at fd 1", ar->ar_arg_atfd1); \
195 kau_write(rec, tok); \
196 } \
197 } while (0)
198
199 #define ATFD2_TOKENS(argnum) do { \
200 if (ARG_IS_VALID(kar, ARG_ATFD2)) { \
201 tok = au_to_arg32(argnum, "at fd 2", ar->ar_arg_atfd2); \
202 kau_write(rec, tok); \
203 } \
204 } while (0)
205
206 #define UPATH1_TOKENS do { \
207 if (ARG_IS_VALID(kar, ARG_UPATH1)) { \
208 tok = au_to_path(ar->ar_arg_upath1); \
209 kau_write(rec, tok); \
210 } \
211 } while (0)
212
213 #define UPATH2_TOKENS do { \
214 if (ARG_IS_VALID(kar, ARG_UPATH2)) { \
215 tok = au_to_path(ar->ar_arg_upath2); \
216 kau_write(rec, tok); \
217 } \
218 } while (0)
219
220 #define VNODE1_TOKENS do { \
221 if (ARG_IS_VALID(kar, ARG_ATFD)) { \
222 tok = au_to_arg32(1, "at fd", ar->ar_arg_atfd); \
223 kau_write(rec, tok); \
224 } \
225 if (ARG_IS_VALID(kar, ARG_VNODE1)) { \
226 tok = au_to_attr32(&ar->ar_arg_vnode1); \
227 kau_write(rec, tok); \
228 } \
229 } while (0)
230
231 #define UPATH1_VNODE1_TOKENS do { \
232 UPATH1_TOKENS; \
233 if (ARG_IS_VALID(kar, ARG_VNODE1)) { \
234 tok = au_to_attr32(&ar->ar_arg_vnode1); \
235 kau_write(rec, tok); \
236 } \
237 } while (0)
238
239 #define VNODE2_TOKENS do { \
240 if (ARG_IS_VALID(kar, ARG_VNODE2)) { \
241 tok = au_to_attr32(&ar->ar_arg_vnode2); \
242 kau_write(rec, tok); \
243 } \
244 } while (0)
245
246 #define FD_VNODE1_TOKENS do { \
247 if (ARG_IS_VALID(kar, ARG_VNODE1)) { \
248 if (ARG_IS_VALID(kar, ARG_FD)) { \
249 tok = au_to_arg32(1, "fd", ar->ar_arg_fd); \
250 kau_write(rec, tok); \
251 } \
252 tok = au_to_attr32(&ar->ar_arg_vnode1); \
253 kau_write(rec, tok); \
254 } else { \
255 if (ARG_IS_VALID(kar, ARG_FD)) { \
256 tok = au_to_arg32(1, "non-file: fd", \
257 ar->ar_arg_fd); \
258 kau_write(rec, tok); \
259 } \
260 } \
261 } while (0)
262
263 #define PROCESS_PID_TOKENS(argn) do { \
264 if ((ar->ar_arg_pid > 0) /* Reference a single process */ \
265 && (ARG_IS_VALID(kar, ARG_PROCESS))) { \
266 tok = au_to_process32_ex(ar->ar_arg_auid, \
267 ar->ar_arg_euid, ar->ar_arg_egid, \
268 ar->ar_arg_ruid, ar->ar_arg_rgid, \
269 ar->ar_arg_pid, ar->ar_arg_asid, \
270 &ar->ar_arg_termid_addr); \
271 kau_write(rec, tok); \
272 } else if (ARG_IS_VALID(kar, ARG_PID)) { \
273 tok = au_to_arg32(argn, "process", ar->ar_arg_pid); \
274 kau_write(rec, tok); \
275 } \
276 } while (0)
277
278 #define EXTATTR_TOKENS(namespace_argnum) do { \
279 if (ARG_IS_VALID(kar, ARG_VALUE)) { \
280 switch (ar->ar_arg_value) { \
281 case EXTATTR_NAMESPACE_USER: \
282 tok = au_to_text(EXTATTR_NAMESPACE_USER_STRING);\
283 break; \
284 case EXTATTR_NAMESPACE_SYSTEM: \
285 tok = au_to_text(EXTATTR_NAMESPACE_SYSTEM_STRING);\
286 break; \
287 default: \
288 tok = au_to_arg32((namespace_argnum), \
289 "attrnamespace", ar->ar_arg_value); \
290 break; \
291 } \
292 kau_write(rec, tok); \
293 } \
294 /* attrname is in the text field */ \
295 if (ARG_IS_VALID(kar, ARG_TEXT)) { \
296 tok = au_to_text(ar->ar_arg_text); \
297 kau_write(rec, tok); \
298 } \
299 } while (0)
300
301 /*
302 * Not all pointer arguments to system calls are of interest, but in some
303 * cases they reflect delegation of rights, such as mmap(2) followed by
304 * minherit(2) before execve(2), so do the best we can.
305 */
306 #define ADDR_TOKEN(argnum, argname) do { \
307 if (ARG_IS_VALID(kar, ARG_ADDR)) { \
308 if (sizeof(void *) == sizeof(uint32_t)) \
309 tok = au_to_arg32((argnum), (argname), \
310 (uint32_t)(uintptr_t)ar->ar_arg_addr); \
311 else \
312 tok = au_to_arg64((argnum), (argname), \
313 (uint64_t)(uintptr_t)ar->ar_arg_addr); \
314 kau_write(rec, tok); \
315 } \
316 } while (0)
317
318 /*
319 * Implement auditing for the auditon() system call. The audit tokens that
320 * are generated depend on the command that was sent into the auditon()
321 * system call.
322 */
323 static void
audit_sys_auditon(struct audit_record * ar,struct au_record * rec)324 audit_sys_auditon(struct audit_record *ar, struct au_record *rec)
325 {
326 struct au_token *tok;
327
328 tok = au_to_arg32(3, "length", ar->ar_arg_len);
329 kau_write(rec, tok);
330 switch (ar->ar_arg_cmd) {
331 case A_OLDSETPOLICY:
332 if ((size_t)ar->ar_arg_len == sizeof(int64_t)) {
333 tok = au_to_arg64(2, "policy",
334 ar->ar_arg_auditon.au_policy64);
335 kau_write(rec, tok);
336 break;
337 }
338 /* FALLTHROUGH */
339
340 case A_SETPOLICY:
341 tok = au_to_arg32(2, "policy", ar->ar_arg_auditon.au_policy);
342 kau_write(rec, tok);
343 break;
344
345 case A_SETKMASK:
346 tok = au_to_arg32(2, "setkmask:as_success",
347 ar->ar_arg_auditon.au_mask.am_success);
348 kau_write(rec, tok);
349 tok = au_to_arg32(2, "setkmask:as_failure",
350 ar->ar_arg_auditon.au_mask.am_failure);
351 kau_write(rec, tok);
352 break;
353
354 case A_OLDSETQCTRL:
355 if ((size_t)ar->ar_arg_len == sizeof(au_qctrl64_t)) {
356 tok = au_to_arg64(2, "setqctrl:aq_hiwater",
357 ar->ar_arg_auditon.au_qctrl64.aq64_hiwater);
358 kau_write(rec, tok);
359 tok = au_to_arg64(2, "setqctrl:aq_lowater",
360 ar->ar_arg_auditon.au_qctrl64.aq64_lowater);
361 kau_write(rec, tok);
362 tok = au_to_arg64(2, "setqctrl:aq_bufsz",
363 ar->ar_arg_auditon.au_qctrl64.aq64_bufsz);
364 kau_write(rec, tok);
365 tok = au_to_arg64(2, "setqctrl:aq_delay",
366 ar->ar_arg_auditon.au_qctrl64.aq64_delay);
367 kau_write(rec, tok);
368 tok = au_to_arg64(2, "setqctrl:aq_minfree",
369 ar->ar_arg_auditon.au_qctrl64.aq64_minfree);
370 kau_write(rec, tok);
371 break;
372 }
373 /* FALLTHROUGH */
374
375 case A_SETQCTRL:
376 tok = au_to_arg32(2, "setqctrl:aq_hiwater",
377 ar->ar_arg_auditon.au_qctrl.aq_hiwater);
378 kau_write(rec, tok);
379 tok = au_to_arg32(2, "setqctrl:aq_lowater",
380 ar->ar_arg_auditon.au_qctrl.aq_lowater);
381 kau_write(rec, tok);
382 tok = au_to_arg32(2, "setqctrl:aq_bufsz",
383 ar->ar_arg_auditon.au_qctrl.aq_bufsz);
384 kau_write(rec, tok);
385 tok = au_to_arg32(2, "setqctrl:aq_delay",
386 ar->ar_arg_auditon.au_qctrl.aq_delay);
387 kau_write(rec, tok);
388 tok = au_to_arg32(2, "setqctrl:aq_minfree",
389 ar->ar_arg_auditon.au_qctrl.aq_minfree);
390 kau_write(rec, tok);
391 break;
392
393 case A_SETUMASK:
394 tok = au_to_arg32(2, "setumask:as_success",
395 ar->ar_arg_auditon.au_auinfo.ai_mask.am_success);
396 kau_write(rec, tok);
397 tok = au_to_arg32(2, "setumask:as_failure",
398 ar->ar_arg_auditon.au_auinfo.ai_mask.am_failure);
399 kau_write(rec, tok);
400 break;
401
402 case A_SETSMASK:
403 tok = au_to_arg32(2, "setsmask:as_success",
404 ar->ar_arg_auditon.au_auinfo.ai_mask.am_success);
405 kau_write(rec, tok);
406 tok = au_to_arg32(2, "setsmask:as_failure",
407 ar->ar_arg_auditon.au_auinfo.ai_mask.am_failure);
408 kau_write(rec, tok);
409 break;
410
411 case A_OLDSETCOND:
412 if ((size_t)ar->ar_arg_len == sizeof(int64_t)) {
413 tok = au_to_arg64(2, "setcond",
414 ar->ar_arg_auditon.au_cond64);
415 kau_write(rec, tok);
416 break;
417 }
418 /* FALLTHROUGH */
419
420 case A_SETCOND:
421 tok = au_to_arg32(2, "setcond", ar->ar_arg_auditon.au_cond);
422 kau_write(rec, tok);
423 break;
424
425 case A_SETCLASS:
426 tok = au_to_arg32(2, "setclass:ec_event",
427 ar->ar_arg_auditon.au_evclass.ec_number);
428 kau_write(rec, tok);
429 tok = au_to_arg32(2, "setclass:ec_class",
430 ar->ar_arg_auditon.au_evclass.ec_class);
431 kau_write(rec, tok);
432 break;
433
434 case A_SETPMASK:
435 tok = au_to_arg32(2, "setpmask:as_success",
436 ar->ar_arg_auditon.au_aupinfo.ap_mask.am_success);
437 kau_write(rec, tok);
438 tok = au_to_arg32(2, "setpmask:as_failure",
439 ar->ar_arg_auditon.au_aupinfo.ap_mask.am_failure);
440 kau_write(rec, tok);
441 break;
442
443 case A_SETFSIZE:
444 tok = au_to_arg32(2, "setfsize:filesize",
445 ar->ar_arg_auditon.au_fstat.af_filesz);
446 kau_write(rec, tok);
447 break;
448
449 default:
450 break;
451 }
452 }
453
454 /*
455 * Convert an internal kernel audit record to a BSM record and return a
456 * success/failure indicator. The BSM record is passed as an out parameter to
457 * this function.
458 *
459 * Return conditions:
460 * BSM_SUCCESS: The BSM record is valid
461 * BSM_FAILURE: Failure; the BSM record is NULL.
462 * BSM_NOAUDIT: The event is not auditable for BSM; the BSM record is NULL.
463 */
464 int
kaudit_to_bsm(struct kaudit_record * kar,struct au_record ** pau)465 kaudit_to_bsm(struct kaudit_record *kar, struct au_record **pau)
466 {
467 struct au_token *tok, *subj_tok, *jail_tok;
468 struct au_record *rec;
469 au_tid_t tid;
470 struct audit_record *ar;
471 int ctr;
472
473 KASSERT(kar != NULL, ("kaudit_to_bsm: kar == NULL"));
474
475 *pau = NULL;
476 ar = &kar->k_ar;
477 rec = kau_open();
478
479 /*
480 * Create the subject token. If this credential was jailed be sure to
481 * generate a zonename token.
482 */
483 if (ar->ar_jailname[0] != '\0')
484 jail_tok = au_to_zonename(ar->ar_jailname);
485 else
486 jail_tok = NULL;
487 switch (ar->ar_subj_term_addr.at_type) {
488 case AU_IPv4:
489 tid.port = ar->ar_subj_term_addr.at_port;
490 tid.machine = ar->ar_subj_term_addr.at_addr[0];
491 subj_tok = au_to_subject32(ar->ar_subj_auid, /* audit ID */
492 ar->ar_subj_cred.cr_uid, /* eff uid */
493 ar->ar_subj_egid, /* eff group id */
494 ar->ar_subj_ruid, /* real uid */
495 ar->ar_subj_rgid, /* real group id */
496 ar->ar_subj_pid, /* process id */
497 ar->ar_subj_asid, /* session ID */
498 &tid);
499 break;
500 case AU_IPv6:
501 subj_tok = au_to_subject32_ex(ar->ar_subj_auid,
502 ar->ar_subj_cred.cr_uid,
503 ar->ar_subj_egid,
504 ar->ar_subj_ruid,
505 ar->ar_subj_rgid,
506 ar->ar_subj_pid,
507 ar->ar_subj_asid,
508 &ar->ar_subj_term_addr);
509 break;
510 default:
511 bzero(&tid, sizeof(tid));
512 subj_tok = au_to_subject32(ar->ar_subj_auid,
513 ar->ar_subj_cred.cr_uid,
514 ar->ar_subj_egid,
515 ar->ar_subj_ruid,
516 ar->ar_subj_rgid,
517 ar->ar_subj_pid,
518 ar->ar_subj_asid,
519 &tid);
520 }
521
522 /*
523 * The logic inside each case fills in the tokens required for the
524 * event, except for the header, trailer, and return tokens. The
525 * header and trailer tokens are added by the kau_close() function.
526 * The return token is added outside of the switch statement.
527 */
528 switch(ar->ar_event) {
529 case AUE_ACCEPT:
530 if (ARG_IS_VALID(kar, ARG_FD)) {
531 tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
532 kau_write(rec, tok);
533 }
534 if (ARG_IS_VALID(kar, ARG_SADDRINET)) {
535 tok = au_to_sock_inet((struct sockaddr_in *)
536 &ar->ar_arg_sockaddr);
537 kau_write(rec, tok);
538 }
539 if (ARG_IS_VALID(kar, ARG_SADDRUNIX)) {
540 tok = au_to_sock_unix((struct sockaddr_un *)
541 &ar->ar_arg_sockaddr);
542 kau_write(rec, tok);
543 UPATH1_TOKENS;
544 }
545 if (ARG_IS_VALID(kar, ARG_SADDRINET6)) {
546 tok = au_to_sock_inet128((struct sockaddr_in6 *)
547 &ar->ar_arg_sockaddr);
548 kau_write(rec, tok);
549 }
550 break;
551
552 case AUE_BIND:
553 case AUE_LISTEN:
554 case AUE_CONNECT:
555 case AUE_RECV:
556 case AUE_RECVFROM:
557 case AUE_RECVMSG:
558 case AUE_SEND:
559 case AUE_SENDMSG:
560 case AUE_SENDTO:
561 /*
562 * Socket-related events.
563 */
564 if (ARG_IS_VALID(kar, ARG_FD)) {
565 tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
566 kau_write(rec, tok);
567 }
568 if (ARG_IS_VALID(kar, ARG_SADDRINET)) {
569 tok = au_to_sock_inet((struct sockaddr_in *)
570 &ar->ar_arg_sockaddr);
571 kau_write(rec, tok);
572 }
573 if (ARG_IS_VALID(kar, ARG_SADDRUNIX)) {
574 tok = au_to_sock_unix((struct sockaddr_un *)
575 &ar->ar_arg_sockaddr);
576 kau_write(rec, tok);
577 UPATH1_TOKENS;
578 }
579 if (ARG_IS_VALID(kar, ARG_SADDRINET6)) {
580 tok = au_to_sock_inet128((struct sockaddr_in6 *)
581 &ar->ar_arg_sockaddr);
582 kau_write(rec, tok);
583 }
584 break;
585
586 case AUE_BINDAT:
587 case AUE_CONNECTAT:
588 ATFD1_TOKENS(1);
589 if (ARG_IS_VALID(kar, ARG_FD)) {
590 tok = au_to_arg32(2, "fd", ar->ar_arg_fd);
591 kau_write(rec, tok);
592 }
593 if (ARG_IS_VALID(kar, ARG_SADDRUNIX)) {
594 tok = au_to_sock_unix((struct sockaddr_un *)
595 &ar->ar_arg_sockaddr);
596 kau_write(rec, tok);
597 UPATH1_TOKENS;
598 }
599 break;
600
601 case AUE_SENDFILE:
602 FD_VNODE1_TOKENS;
603 if (ARG_IS_VALID(kar, ARG_SADDRINET)) {
604 tok = au_to_sock_inet((struct sockaddr_in *)
605 &ar->ar_arg_sockaddr);
606 kau_write(rec, tok);
607 }
608 if (ARG_IS_VALID(kar, ARG_SADDRUNIX)) {
609 tok = au_to_sock_unix((struct sockaddr_un *)
610 &ar->ar_arg_sockaddr);
611 kau_write(rec, tok);
612 UPATH1_TOKENS;
613 }
614 if (ARG_IS_VALID(kar, ARG_SADDRINET6)) {
615 tok = au_to_sock_inet128((struct sockaddr_in6 *)
616 &ar->ar_arg_sockaddr);
617 kau_write(rec, tok);
618 }
619 break;
620
621 case AUE_SOCKET:
622 case AUE_SOCKETPAIR:
623 if (ARG_IS_VALID(kar, ARG_SOCKINFO)) {
624 tok = au_to_arg32(1, "domain",
625 ar->ar_arg_sockinfo.so_domain);
626 kau_write(rec, tok);
627 tok = au_to_arg32(2, "type",
628 ar->ar_arg_sockinfo.so_type);
629 kau_write(rec, tok);
630 tok = au_to_arg32(3, "protocol",
631 ar->ar_arg_sockinfo.so_protocol);
632 kau_write(rec, tok);
633 }
634 break;
635
636 case AUE_SETSOCKOPT:
637 case AUE_SHUTDOWN:
638 if (ARG_IS_VALID(kar, ARG_FD)) {
639 tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
640 kau_write(rec, tok);
641 }
642 break;
643
644 case AUE_ACCT:
645 if (ARG_IS_VALID(kar, ARG_UPATH1)) {
646 UPATH1_VNODE1_TOKENS;
647 } else {
648 tok = au_to_arg32(1, "accounting off", 0);
649 kau_write(rec, tok);
650 }
651 break;
652
653 case AUE_SETAUID:
654 if (ARG_IS_VALID(kar, ARG_AUID)) {
655 tok = au_to_arg32(2, "setauid", ar->ar_arg_auid);
656 kau_write(rec, tok);
657 }
658 break;
659
660 case AUE_SETAUDIT:
661 if (ARG_IS_VALID(kar, ARG_AUID) &&
662 ARG_IS_VALID(kar, ARG_ASID) &&
663 ARG_IS_VALID(kar, ARG_AMASK) &&
664 ARG_IS_VALID(kar, ARG_TERMID)) {
665 tok = au_to_arg32(1, "setaudit:auid",
666 ar->ar_arg_auid);
667 kau_write(rec, tok);
668 tok = au_to_arg32(1, "setaudit:port",
669 ar->ar_arg_termid.port);
670 kau_write(rec, tok);
671 tok = au_to_arg32(1, "setaudit:machine",
672 ar->ar_arg_termid.machine);
673 kau_write(rec, tok);
674 tok = au_to_arg32(1, "setaudit:as_success",
675 ar->ar_arg_amask.am_success);
676 kau_write(rec, tok);
677 tok = au_to_arg32(1, "setaudit:as_failure",
678 ar->ar_arg_amask.am_failure);
679 kau_write(rec, tok);
680 tok = au_to_arg32(1, "setaudit:asid",
681 ar->ar_arg_asid);
682 kau_write(rec, tok);
683 }
684 break;
685
686 case AUE_SETAUDIT_ADDR:
687 if (ARG_IS_VALID(kar, ARG_AUID) &&
688 ARG_IS_VALID(kar, ARG_ASID) &&
689 ARG_IS_VALID(kar, ARG_AMASK) &&
690 ARG_IS_VALID(kar, ARG_TERMID_ADDR)) {
691 tok = au_to_arg32(1, "setaudit_addr:auid",
692 ar->ar_arg_auid);
693 kau_write(rec, tok);
694 tok = au_to_arg32(1, "setaudit_addr:as_success",
695 ar->ar_arg_amask.am_success);
696 kau_write(rec, tok);
697 tok = au_to_arg32(1, "setaudit_addr:as_failure",
698 ar->ar_arg_amask.am_failure);
699 kau_write(rec, tok);
700 tok = au_to_arg32(1, "setaudit_addr:asid",
701 ar->ar_arg_asid);
702 kau_write(rec, tok);
703 tok = au_to_arg32(1, "setaudit_addr:type",
704 ar->ar_arg_termid_addr.at_type);
705 kau_write(rec, tok);
706 tok = au_to_arg32(1, "setaudit_addr:port",
707 ar->ar_arg_termid_addr.at_port);
708 kau_write(rec, tok);
709 if (ar->ar_arg_termid_addr.at_type == AU_IPv6)
710 tok = au_to_in_addr_ex((struct in6_addr *)
711 &ar->ar_arg_termid_addr.at_addr[0]);
712 if (ar->ar_arg_termid_addr.at_type == AU_IPv4)
713 tok = au_to_in_addr((struct in_addr *)
714 &ar->ar_arg_termid_addr.at_addr[0]);
715 kau_write(rec, tok);
716 }
717 break;
718
719 case AUE_AUDITON:
720 /*
721 * For AUDITON commands without own event, audit the cmd.
722 */
723 if (ARG_IS_VALID(kar, ARG_CMD)) {
724 tok = au_to_arg32(1, "cmd", ar->ar_arg_cmd);
725 kau_write(rec, tok);
726 }
727 /* FALLTHROUGH */
728
729 case AUE_AUDITON_GETCAR:
730 case AUE_AUDITON_GETCLASS:
731 case AUE_AUDITON_GETCOND:
732 case AUE_AUDITON_GETCWD:
733 case AUE_AUDITON_GETKMASK:
734 case AUE_AUDITON_GETSTAT:
735 case AUE_AUDITON_GPOLICY:
736 case AUE_AUDITON_GQCTRL:
737 case AUE_AUDITON_SETCLASS:
738 case AUE_AUDITON_SETCOND:
739 case AUE_AUDITON_SETKMASK:
740 case AUE_AUDITON_SETSMASK:
741 case AUE_AUDITON_SETSTAT:
742 case AUE_AUDITON_SETUMASK:
743 case AUE_AUDITON_SPOLICY:
744 case AUE_AUDITON_SQCTRL:
745 if (ARG_IS_VALID(kar, ARG_AUDITON))
746 audit_sys_auditon(ar, rec);
747 break;
748
749 case AUE_AUDITCTL:
750 UPATH1_VNODE1_TOKENS;
751 break;
752
753 case AUE_EXIT:
754 if (ARG_IS_VALID(kar, ARG_EXIT)) {
755 tok = au_to_exit(ar->ar_arg_exitretval,
756 ar->ar_arg_exitstatus);
757 kau_write(rec, tok);
758 }
759 break;
760
761 case AUE_ADJTIME:
762 case AUE_CLOCK_SETTIME:
763 case AUE_AUDIT:
764 case AUE_DUP2:
765 case AUE_GETAUDIT:
766 case AUE_GETAUDIT_ADDR:
767 case AUE_GETAUID:
768 case AUE_GETCWD:
769 case AUE_GETFSSTAT:
770 case AUE_GETRESUID:
771 case AUE_GETRESGID:
772 case AUE_KQUEUE:
773 case AUE_MODLOAD:
774 case AUE_MODUNLOAD:
775 case AUE_MSGSYS:
776 case AUE_NTP_ADJTIME:
777 case AUE_PIPE:
778 case AUE_POSIX_OPENPT:
779 case AUE_PROFILE:
780 case AUE_RTPRIO:
781 case AUE_SEMSYS:
782 case AUE_SETFIB:
783 case AUE_SHMSYS:
784 case AUE_SETPGRP:
785 case AUE_SETRLIMIT:
786 case AUE_SETSID:
787 case AUE_SETTIMEOFDAY:
788 case AUE_SYSARCH:
789
790 /*
791 * Header, subject, and return tokens added at end.
792 */
793 break;
794
795 case AUE_ACL_DELETE_FD:
796 case AUE_ACL_DELETE_FILE:
797 case AUE_ACL_CHECK_FD:
798 case AUE_ACL_CHECK_FILE:
799 case AUE_ACL_CHECK_LINK:
800 case AUE_ACL_DELETE_LINK:
801 case AUE_ACL_GET_FD:
802 case AUE_ACL_GET_FILE:
803 case AUE_ACL_GET_LINK:
804 case AUE_ACL_SET_FD:
805 case AUE_ACL_SET_FILE:
806 case AUE_ACL_SET_LINK:
807 if (ARG_IS_VALID(kar, ARG_VALUE)) {
808 tok = au_to_arg32(1, "type", ar->ar_arg_value);
809 kau_write(rec, tok);
810 }
811 ATFD1_TOKENS(1);
812 UPATH1_VNODE1_TOKENS;
813 break;
814
815 /*
816 * NB: We may want to verify that the appropriate
817 * audit args are being processed here, but I think
818 * a bit analysis is required.
819 *
820 * Process AUE_JAIL_SET in the next block so we can pickup any path
821 * related tokens that might exist.
822 */
823 case AUE_JAIL_GET:
824 case AUE_JAIL_ATTACH:
825 case AUE_JAIL_REMOVE:
826 break;
827
828 case AUE_JAIL_SET:
829 case AUE_CHDIR:
830 case AUE_CHROOT:
831 case AUE_FSTATAT:
832 case AUE_FUTIMESAT:
833 case AUE_GETATTRLIST:
834 case AUE_JAIL:
835 case AUE_LUTIMES:
836 case AUE_NFS_GETFH:
837 case AUE_LGETFH:
838 case AUE_LSTAT:
839 case AUE_LPATHCONF:
840 case AUE_PATHCONF:
841 case AUE_READLINK:
842 case AUE_READLINKAT:
843 case AUE_REVOKE:
844 case AUE_RMDIR:
845 case AUE_SEARCHFS:
846 case AUE_SETATTRLIST:
847 case AUE_STAT:
848 case AUE_STATFS:
849 case AUE_SWAPON:
850 case AUE_SWAPOFF:
851 case AUE_TRUNCATE:
852 case AUE_UNDELETE:
853 case AUE_UNLINK:
854 case AUE_UNLINKAT:
855 case AUE_UTIMES:
856 case AUE_REALPATHAT:
857 ATFD1_TOKENS(1);
858 UPATH1_VNODE1_TOKENS;
859 break;
860
861 case AUE_ACCESS:
862 case AUE_EACCESS:
863 case AUE_FACCESSAT:
864 ATFD1_TOKENS(1);
865 UPATH1_VNODE1_TOKENS;
866 if (ARG_IS_VALID(kar, ARG_VALUE)) {
867 tok = au_to_arg32(2, "mode", ar->ar_arg_value);
868 kau_write(rec, tok);
869 }
870 break;
871
872 case AUE_FHSTATFS:
873 case AUE_FHOPEN:
874 case AUE_FHSTAT:
875 /* XXXRW: Need to audit vnode argument. */
876 break;
877
878 case AUE_CHFLAGS:
879 case AUE_LCHFLAGS:
880 case AUE_CHFLAGSAT:
881 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
882 tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
883 kau_write(rec, tok);
884 }
885 UPATH1_VNODE1_TOKENS;
886 break;
887
888 case AUE_CHMOD:
889 case AUE_LCHMOD:
890 if (ARG_IS_VALID(kar, ARG_MODE)) {
891 tok = au_to_arg32(2, "new file mode",
892 ar->ar_arg_mode);
893 kau_write(rec, tok);
894 }
895 UPATH1_VNODE1_TOKENS;
896 break;
897
898 case AUE_FCHMODAT:
899 ATFD1_TOKENS(1);
900 if (ARG_IS_VALID(kar, ARG_MODE)) {
901 tok = au_to_arg32(3, "new file mode",
902 ar->ar_arg_mode);
903 kau_write(rec, tok);
904 }
905 UPATH1_VNODE1_TOKENS;
906 break;
907
908 case AUE_CHOWN:
909 case AUE_LCHOWN:
910 if (ARG_IS_VALID(kar, ARG_UID)) {
911 tok = au_to_arg32(2, "new file uid", ar->ar_arg_uid);
912 kau_write(rec, tok);
913 }
914 if (ARG_IS_VALID(kar, ARG_GID)) {
915 tok = au_to_arg32(3, "new file gid", ar->ar_arg_gid);
916 kau_write(rec, tok);
917 }
918 UPATH1_VNODE1_TOKENS;
919 break;
920
921 case AUE_FCHOWNAT:
922 ATFD1_TOKENS(1);
923 if (ARG_IS_VALID(kar, ARG_UID)) {
924 tok = au_to_arg32(3, "new file uid", ar->ar_arg_uid);
925 kau_write(rec, tok);
926 }
927 if (ARG_IS_VALID(kar, ARG_GID)) {
928 tok = au_to_arg32(4, "new file gid", ar->ar_arg_gid);
929 kau_write(rec, tok);
930 }
931 UPATH1_VNODE1_TOKENS;
932 break;
933
934 case AUE_EXCHANGEDATA:
935 UPATH1_VNODE1_TOKENS;
936 UPATH2_TOKENS;
937 break;
938
939 case AUE_CLOSE:
940 if (ARG_IS_VALID(kar, ARG_FD)) {
941 tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
942 kau_write(rec, tok);
943 }
944 UPATH1_VNODE1_TOKENS;
945 break;
946
947 case AUE_CLOSEFROM:
948 if (ARG_IS_VALID(kar, ARG_FD)) {
949 tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
950 kau_write(rec, tok);
951 }
952 break;
953
954 case AUE_CLOSERANGE:
955 if (ARG_IS_VALID(kar, ARG_FD)) {
956 tok = au_to_arg32(1, "lowfd", ar->ar_arg_fd);
957 kau_write(rec, tok);
958 }
959 if (ARG_IS_VALID(kar, ARG_CMD)) {
960 tok = au_to_arg32(2, "highfd", ar->ar_arg_cmd);
961 kau_write(rec, tok);
962 }
963 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
964 tok = au_to_arg32(3, "flags", ar->ar_arg_fflags);
965 kau_write(rec, tok);
966 }
967 break;
968
969 case AUE_CORE:
970 if (ARG_IS_VALID(kar, ARG_SIGNUM)) {
971 tok = au_to_arg32(1, "signal", ar->ar_arg_signum);
972 kau_write(rec, tok);
973 }
974 UPATH1_VNODE1_TOKENS;
975 break;
976
977 case AUE_EXTATTRCTL:
978 UPATH1_VNODE1_TOKENS;
979 if (ARG_IS_VALID(kar, ARG_CMD)) {
980 tok = au_to_arg32(2, "cmd", ar->ar_arg_cmd);
981 kau_write(rec, tok);
982 }
983 /* extattrctl(2) filename parameter is in upath2/vnode2 */
984 UPATH2_TOKENS;
985 VNODE2_TOKENS;
986 EXTATTR_TOKENS(4);
987 break;
988
989 case AUE_EXTATTR_GET_FILE:
990 case AUE_EXTATTR_SET_FILE:
991 case AUE_EXTATTR_LIST_FILE:
992 case AUE_EXTATTR_DELETE_FILE:
993 case AUE_EXTATTR_GET_LINK:
994 case AUE_EXTATTR_SET_LINK:
995 case AUE_EXTATTR_LIST_LINK:
996 case AUE_EXTATTR_DELETE_LINK:
997 UPATH1_VNODE1_TOKENS;
998 EXTATTR_TOKENS(2);
999 break;
1000
1001 case AUE_EXTATTR_GET_FD:
1002 case AUE_EXTATTR_SET_FD:
1003 case AUE_EXTATTR_LIST_FD:
1004 case AUE_EXTATTR_DELETE_FD:
1005 if (ARG_IS_VALID(kar, ARG_FD)) {
1006 tok = au_to_arg32(2, "fd", ar->ar_arg_fd);
1007 kau_write(rec, tok);
1008 }
1009 EXTATTR_TOKENS(2);
1010 break;
1011
1012 case AUE_FEXECVE:
1013 if (ARG_IS_VALID(kar, ARG_FD)) {
1014 tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
1015 kau_write(rec, tok);
1016 }
1017 /* FALLTHROUGH */
1018
1019 case AUE_EXECVE:
1020 case AUE_MAC_EXECVE:
1021 if (ARG_IS_VALID(kar, ARG_ARGV)) {
1022 tok = au_to_exec_args(ar->ar_arg_argv,
1023 ar->ar_arg_argc);
1024 kau_write(rec, tok);
1025 }
1026 if (ARG_IS_VALID(kar, ARG_ENVV)) {
1027 tok = au_to_exec_env(ar->ar_arg_envv,
1028 ar->ar_arg_envc);
1029 kau_write(rec, tok);
1030 }
1031 UPATH1_VNODE1_TOKENS;
1032 break;
1033
1034 case AUE_FCHMOD:
1035 if (ARG_IS_VALID(kar, ARG_MODE)) {
1036 tok = au_to_arg32(2, "new file mode",
1037 ar->ar_arg_mode);
1038 kau_write(rec, tok);
1039 }
1040 FD_VNODE1_TOKENS;
1041 break;
1042
1043 /*
1044 * XXXRW: Some of these need to handle non-vnode cases as well.
1045 */
1046 case AUE_FCHDIR:
1047 case AUE_FPATHCONF:
1048 case AUE_FSTAT:
1049 case AUE_FSTATFS:
1050 case AUE_FSYNC:
1051 case AUE_FTRUNCATE:
1052 case AUE_FUTIMES:
1053 case AUE_GETDIRENTRIES:
1054 case AUE_GETDIRENTRIESATTR:
1055 case AUE_LSEEK:
1056 case AUE_POLL:
1057 case AUE_POSIX_FALLOCATE:
1058 case AUE_PREAD:
1059 case AUE_PWRITE:
1060 case AUE_READ:
1061 case AUE_READV:
1062 case AUE_WRITE:
1063 case AUE_WRITEV:
1064 FD_VNODE1_TOKENS;
1065 break;
1066
1067 case AUE_FCHOWN:
1068 if (ARG_IS_VALID(kar, ARG_UID)) {
1069 tok = au_to_arg32(2, "new file uid", ar->ar_arg_uid);
1070 kau_write(rec, tok);
1071 }
1072 if (ARG_IS_VALID(kar, ARG_GID)) {
1073 tok = au_to_arg32(3, "new file gid", ar->ar_arg_gid);
1074 kau_write(rec, tok);
1075 }
1076 FD_VNODE1_TOKENS;
1077 break;
1078
1079 case AUE_FCNTL:
1080 if (ARG_IS_VALID(kar, ARG_CMD)) {
1081 tok = au_to_arg32(2, "cmd",
1082 au_fcntl_cmd_to_bsm(ar->ar_arg_cmd));
1083 kau_write(rec, tok);
1084 }
1085 FD_VNODE1_TOKENS;
1086 break;
1087
1088 case AUE_FCHFLAGS:
1089 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1090 tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
1091 kau_write(rec, tok);
1092 }
1093 FD_VNODE1_TOKENS;
1094 break;
1095
1096 case AUE_FLOCK:
1097 if (ARG_IS_VALID(kar, ARG_CMD)) {
1098 tok = au_to_arg32(2, "operation", ar->ar_arg_cmd);
1099 kau_write(rec, tok);
1100 }
1101 FD_VNODE1_TOKENS;
1102 break;
1103
1104 case AUE_FSPACECTL:
1105 if (ARG_IS_VALID(kar, ARG_CMD)) {
1106 tok = au_to_arg32(2, "operation", ar->ar_arg_cmd);
1107 kau_write(rec, tok);
1108 }
1109 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1110 tok = au_to_arg32(4, "flags", ar->ar_arg_fflags);
1111 kau_write(rec, tok);
1112 }
1113 FD_VNODE1_TOKENS;
1114 break;
1115
1116 case AUE_RFORK:
1117 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1118 tok = au_to_arg32(1, "flags", ar->ar_arg_fflags);
1119 kau_write(rec, tok);
1120 }
1121 /* FALLTHROUGH */
1122
1123 case AUE_FORK:
1124 case AUE_VFORK:
1125 if (ARG_IS_VALID(kar, ARG_PID)) {
1126 tok = au_to_arg32(0, "child PID", ar->ar_arg_pid);
1127 kau_write(rec, tok);
1128 }
1129 break;
1130
1131 case AUE_PDWAIT:
1132 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1133 tok = au_to_arg32(1, "flags", ar->ar_arg_fflags);
1134 kau_write(rec, tok);
1135 }
1136 if (ARG_IS_VALID(kar, ARG_FD)) {
1137 tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
1138 kau_write(rec, tok);
1139 }
1140
1141 case AUE_IOCTL:
1142 if (ARG_IS_VALID(kar, ARG_CMD)) {
1143 tok = au_to_arg32(2, "cmd", ar->ar_arg_cmd);
1144 kau_write(rec, tok);
1145 }
1146 if (ARG_IS_VALID(kar, ARG_VNODE1))
1147 FD_VNODE1_TOKENS;
1148 else {
1149 if (ARG_IS_VALID(kar, ARG_SOCKINFO)) {
1150 tok = kau_to_socket(&ar->ar_arg_sockinfo);
1151 kau_write(rec, tok);
1152 } else {
1153 if (ARG_IS_VALID(kar, ARG_FD)) {
1154 tok = au_to_arg32(1, "fd",
1155 ar->ar_arg_fd);
1156 kau_write(rec, tok);
1157 }
1158 }
1159 }
1160 break;
1161
1162 case AUE_KILL:
1163 case AUE_KILLPG:
1164 if (ARG_IS_VALID(kar, ARG_SIGNUM)) {
1165 tok = au_to_arg32(2, "signal", ar->ar_arg_signum);
1166 kau_write(rec, tok);
1167 }
1168 PROCESS_PID_TOKENS(1);
1169 break;
1170
1171 case AUE_KTRACE:
1172 if (ARG_IS_VALID(kar, ARG_CMD)) {
1173 tok = au_to_arg32(2, "ops", ar->ar_arg_cmd);
1174 kau_write(rec, tok);
1175 }
1176 if (ARG_IS_VALID(kar, ARG_VALUE)) {
1177 tok = au_to_arg32(3, "trpoints", ar->ar_arg_value);
1178 kau_write(rec, tok);
1179 }
1180 PROCESS_PID_TOKENS(4);
1181 UPATH1_VNODE1_TOKENS;
1182 break;
1183
1184 case AUE_LINK:
1185 case AUE_LINKAT:
1186 case AUE_RENAME:
1187 case AUE_RENAMEAT:
1188 ATFD1_TOKENS(1);
1189 UPATH1_VNODE1_TOKENS;
1190 ATFD2_TOKENS(3);
1191 UPATH2_TOKENS;
1192 break;
1193
1194 case AUE_LOADSHFILE:
1195 ADDR_TOKEN(4, "base addr");
1196 UPATH1_VNODE1_TOKENS;
1197 break;
1198
1199 case AUE_MKDIR:
1200 case AUE_MKDIRAT:
1201 case AUE_MKFIFO:
1202 case AUE_MKFIFOAT:
1203 ATFD1_TOKENS(1);
1204 if (ARG_IS_VALID(kar, ARG_MODE)) {
1205 tok = au_to_arg32(2, "mode", ar->ar_arg_mode);
1206 kau_write(rec, tok);
1207 }
1208 UPATH1_VNODE1_TOKENS;
1209 break;
1210
1211 case AUE_MKNOD:
1212 case AUE_MKNODAT:
1213 ATFD1_TOKENS(1);
1214 if (ARG_IS_VALID(kar, ARG_MODE)) {
1215 tok = au_to_arg32(2, "mode", ar->ar_arg_mode);
1216 kau_write(rec, tok);
1217 }
1218 if (ARG_IS_VALID(kar, ARG_DEV)) {
1219 tok = au_to_arg32(3, "dev", ar->ar_arg_dev);
1220 kau_write(rec, tok);
1221 }
1222 UPATH1_VNODE1_TOKENS;
1223 break;
1224
1225 case AUE_MMAP:
1226 case AUE_MUNMAP:
1227 case AUE_MPROTECT:
1228 case AUE_MLOCK:
1229 case AUE_MUNLOCK:
1230 case AUE_MINHERIT:
1231 ADDR_TOKEN(1, "addr");
1232 if (ARG_IS_VALID(kar, ARG_LEN)) {
1233 tok = au_to_arg32(2, "len", ar->ar_arg_len);
1234 kau_write(rec, tok);
1235 }
1236 if (ar->ar_event == AUE_MMAP)
1237 FD_VNODE1_TOKENS;
1238 if (ar->ar_event == AUE_MPROTECT) {
1239 if (ARG_IS_VALID(kar, ARG_VALUE)) {
1240 tok = au_to_arg32(3, "protection",
1241 ar->ar_arg_value);
1242 kau_write(rec, tok);
1243 }
1244 }
1245 if (ar->ar_event == AUE_MINHERIT) {
1246 if (ARG_IS_VALID(kar, ARG_VALUE)) {
1247 tok = au_to_arg32(3, "inherit",
1248 ar->ar_arg_value);
1249 kau_write(rec, tok);
1250 }
1251 }
1252 break;
1253
1254 case AUE_MOUNT:
1255 case AUE_NMOUNT:
1256 /* XXX Need to handle NFS mounts */
1257 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1258 tok = au_to_arg32(3, "flags", ar->ar_arg_fflags);
1259 kau_write(rec, tok);
1260 }
1261 if (ARG_IS_VALID(kar, ARG_TEXT)) {
1262 tok = au_to_text(ar->ar_arg_text);
1263 kau_write(rec, tok);
1264 }
1265 /* FALLTHROUGH */
1266
1267 case AUE_NFS_SVC:
1268 if (ARG_IS_VALID(kar, ARG_CMD)) {
1269 tok = au_to_arg32(1, "flags", ar->ar_arg_cmd);
1270 kau_write(rec, tok);
1271 }
1272 break;
1273
1274 case AUE_UMOUNT:
1275 if (ARG_IS_VALID(kar, ARG_VALUE)) {
1276 tok = au_to_arg32(2, "flags", ar->ar_arg_value);
1277 kau_write(rec, tok);
1278 }
1279 UPATH1_VNODE1_TOKENS;
1280 if (ARG_IS_VALID(kar, ARG_TEXT)) {
1281 tok = au_to_text(ar->ar_arg_text);
1282 kau_write(rec, tok);
1283 }
1284 break;
1285
1286 case AUE_MSGCTL:
1287 ar->ar_event = audit_msgctl_to_event(ar->ar_arg_svipc_cmd);
1288 /* Fall through */
1289
1290 case AUE_MSGRCV:
1291 case AUE_MSGSND:
1292 tok = au_to_arg32(1, "msg ID", ar->ar_arg_svipc_id);
1293 kau_write(rec, tok);
1294 if (ar->ar_errno != EINVAL) {
1295 tok = au_to_ipc(AT_IPC_MSG, ar->ar_arg_svipc_id);
1296 kau_write(rec, tok);
1297 }
1298 break;
1299
1300 case AUE_MSGGET:
1301 if (ar->ar_errno == 0) {
1302 if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
1303 tok = au_to_ipc(AT_IPC_MSG,
1304 ar->ar_arg_svipc_id);
1305 kau_write(rec, tok);
1306 }
1307 }
1308 break;
1309
1310 case AUE_RESETSHFILE:
1311 ADDR_TOKEN(1, "base addr");
1312 break;
1313
1314 case AUE_OPEN_RC:
1315 case AUE_OPEN_RTC:
1316 case AUE_OPEN_RWC:
1317 case AUE_OPEN_RWTC:
1318 case AUE_OPEN_WC:
1319 case AUE_OPEN_WTC:
1320 case AUE_CREAT:
1321 if (ARG_IS_VALID(kar, ARG_MODE)) {
1322 tok = au_to_arg32(3, "mode", ar->ar_arg_mode);
1323 kau_write(rec, tok);
1324 }
1325 /* FALLTHROUGH */
1326
1327 case AUE_OPEN_R:
1328 case AUE_OPEN_RT:
1329 case AUE_OPEN_RW:
1330 case AUE_OPEN_RWT:
1331 case AUE_OPEN_W:
1332 case AUE_OPEN_WT:
1333 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1334 tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
1335 kau_write(rec, tok);
1336 }
1337 UPATH1_VNODE1_TOKENS;
1338 break;
1339
1340 case AUE_OPENAT_RC:
1341 case AUE_OPENAT_RTC:
1342 case AUE_OPENAT_RWC:
1343 case AUE_OPENAT_RWTC:
1344 case AUE_OPENAT_WC:
1345 case AUE_OPENAT_WTC:
1346 if (ARG_IS_VALID(kar, ARG_MODE)) {
1347 tok = au_to_arg32(3, "mode", ar->ar_arg_mode);
1348 kau_write(rec, tok);
1349 }
1350 /* FALLTHROUGH */
1351
1352 case AUE_OPENAT_R:
1353 case AUE_OPENAT_RT:
1354 case AUE_OPENAT_RW:
1355 case AUE_OPENAT_RWT:
1356 case AUE_OPENAT_W:
1357 case AUE_OPENAT_WT:
1358 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1359 tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
1360 kau_write(rec, tok);
1361 }
1362 ATFD1_TOKENS(1);
1363 UPATH1_VNODE1_TOKENS;
1364 break;
1365
1366 case AUE_PDKILL:
1367 if (ARG_IS_VALID(kar, ARG_FD)) {
1368 tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
1369 kau_write(rec, tok);
1370 }
1371 if (ARG_IS_VALID(kar, ARG_SIGNUM)) {
1372 tok = au_to_arg32(2, "signal", ar->ar_arg_signum);
1373 kau_write(rec, tok);
1374 }
1375 PROCESS_PID_TOKENS(1);
1376 break;
1377 case AUE_PDFORK:
1378 if (ARG_IS_VALID(kar, ARG_PID)) {
1379 tok = au_to_arg32(0, "child PID", ar->ar_arg_pid);
1380 kau_write(rec, tok);
1381 }
1382 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1383 tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
1384 kau_write(rec, tok);
1385 }
1386 if (ARG_IS_VALID(kar, ARG_FD)) {
1387 tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
1388 kau_write(rec, tok);
1389 }
1390 break;
1391 case AUE_PDRFORK:
1392 if (ARG_IS_VALID(kar, ARG_PID)) {
1393 tok = au_to_arg32(0, "child PID", ar->ar_arg_pid);
1394 kau_write(rec, tok);
1395 }
1396 if (ARG_IS_VALID(kar, ARG_CMD)) {
1397 tok = au_to_arg32(2, "fflags", ar->ar_arg_cmd);
1398 kau_write(rec, tok);
1399 }
1400 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1401 tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
1402 kau_write(rec, tok);
1403 }
1404 if (ARG_IS_VALID(kar, ARG_FD)) {
1405 tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
1406 kau_write(rec, tok);
1407 }
1408 break;
1409 case AUE_PDGETPID:
1410 if (ARG_IS_VALID(kar, ARG_FD)) {
1411 tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
1412 kau_write(rec, tok);
1413 }
1414 break;
1415
1416 case AUE_PROCCTL:
1417 if (ARG_IS_VALID(kar, ARG_VALUE)) {
1418 tok = au_to_arg32(1, "idtype", ar->ar_arg_value);
1419 kau_write(rec, tok);
1420 }
1421 if (ARG_IS_VALID(kar, ARG_CMD)) {
1422 tok = au_to_arg32(2, "com", ar->ar_arg_cmd);
1423 kau_write(rec, tok);
1424 }
1425 PROCESS_PID_TOKENS(3);
1426 break;
1427
1428 case AUE_PTRACE:
1429 if (ARG_IS_VALID(kar, ARG_CMD)) {
1430 tok = au_to_arg32(1, "request", ar->ar_arg_cmd);
1431 kau_write(rec, tok);
1432 }
1433 if (ARG_IS_VALID(kar, ARG_VALUE)) {
1434 tok = au_to_arg32(4, "data", ar->ar_arg_value);
1435 kau_write(rec, tok);
1436 }
1437 PROCESS_PID_TOKENS(2);
1438 break;
1439
1440 case AUE_QUOTACTL:
1441 if (ARG_IS_VALID(kar, ARG_CMD)) {
1442 tok = au_to_arg32(2, "command", ar->ar_arg_cmd);
1443 kau_write(rec, tok);
1444 }
1445 if (ARG_IS_VALID(kar, ARG_UID)) {
1446 tok = au_to_arg32(3, "uid", ar->ar_arg_uid);
1447 kau_write(rec, tok);
1448 }
1449 if (ARG_IS_VALID(kar, ARG_GID)) {
1450 tok = au_to_arg32(3, "gid", ar->ar_arg_gid);
1451 kau_write(rec, tok);
1452 }
1453 UPATH1_VNODE1_TOKENS;
1454 break;
1455
1456 case AUE_REBOOT:
1457 if (ARG_IS_VALID(kar, ARG_CMD)) {
1458 tok = au_to_arg32(1, "howto", ar->ar_arg_cmd);
1459 kau_write(rec, tok);
1460 }
1461 break;
1462
1463 case AUE_SEMCTL:
1464 ar->ar_event = audit_semctl_to_event(ar->ar_arg_svipc_cmd);
1465 /* Fall through */
1466
1467 case AUE_SEMOP:
1468 if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
1469 tok = au_to_arg32(1, "sem ID", ar->ar_arg_svipc_id);
1470 kau_write(rec, tok);
1471 if (ar->ar_errno != EINVAL) {
1472 tok = au_to_ipc(AT_IPC_SEM,
1473 ar->ar_arg_svipc_id);
1474 kau_write(rec, tok);
1475 }
1476 }
1477 break;
1478
1479 case AUE_SEMGET:
1480 if (ar->ar_errno == 0) {
1481 if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
1482 tok = au_to_ipc(AT_IPC_SEM,
1483 ar->ar_arg_svipc_id);
1484 kau_write(rec, tok);
1485 }
1486 }
1487 break;
1488
1489 case AUE_SETEGID:
1490 if (ARG_IS_VALID(kar, ARG_EGID)) {
1491 tok = au_to_arg32(1, "egid", ar->ar_arg_egid);
1492 kau_write(rec, tok);
1493 }
1494 break;
1495
1496 case AUE_SETEUID:
1497 if (ARG_IS_VALID(kar, ARG_EUID)) {
1498 tok = au_to_arg32(1, "euid", ar->ar_arg_euid);
1499 kau_write(rec, tok);
1500 }
1501 break;
1502
1503 case AUE_SETREGID:
1504 if (ARG_IS_VALID(kar, ARG_RGID)) {
1505 tok = au_to_arg32(1, "rgid", ar->ar_arg_rgid);
1506 kau_write(rec, tok);
1507 }
1508 if (ARG_IS_VALID(kar, ARG_EGID)) {
1509 tok = au_to_arg32(2, "egid", ar->ar_arg_egid);
1510 kau_write(rec, tok);
1511 }
1512 break;
1513
1514 case AUE_SETREUID:
1515 if (ARG_IS_VALID(kar, ARG_RUID)) {
1516 tok = au_to_arg32(1, "ruid", ar->ar_arg_ruid);
1517 kau_write(rec, tok);
1518 }
1519 if (ARG_IS_VALID(kar, ARG_EUID)) {
1520 tok = au_to_arg32(2, "euid", ar->ar_arg_euid);
1521 kau_write(rec, tok);
1522 }
1523 break;
1524
1525 case AUE_SETRESGID:
1526 if (ARG_IS_VALID(kar, ARG_RGID)) {
1527 tok = au_to_arg32(1, "rgid", ar->ar_arg_rgid);
1528 kau_write(rec, tok);
1529 }
1530 if (ARG_IS_VALID(kar, ARG_EGID)) {
1531 tok = au_to_arg32(2, "egid", ar->ar_arg_egid);
1532 kau_write(rec, tok);
1533 }
1534 if (ARG_IS_VALID(kar, ARG_SGID)) {
1535 tok = au_to_arg32(3, "sgid", ar->ar_arg_sgid);
1536 kau_write(rec, tok);
1537 }
1538 break;
1539
1540 case AUE_SETRESUID:
1541 if (ARG_IS_VALID(kar, ARG_RUID)) {
1542 tok = au_to_arg32(1, "ruid", ar->ar_arg_ruid);
1543 kau_write(rec, tok);
1544 }
1545 if (ARG_IS_VALID(kar, ARG_EUID)) {
1546 tok = au_to_arg32(2, "euid", ar->ar_arg_euid);
1547 kau_write(rec, tok);
1548 }
1549 if (ARG_IS_VALID(kar, ARG_SUID)) {
1550 tok = au_to_arg32(3, "suid", ar->ar_arg_suid);
1551 kau_write(rec, tok);
1552 }
1553 break;
1554
1555 case AUE_SETGID:
1556 if (ARG_IS_VALID(kar, ARG_GID)) {
1557 tok = au_to_arg32(1, "gid", ar->ar_arg_gid);
1558 kau_write(rec, tok);
1559 }
1560 break;
1561
1562 case AUE_SETUID:
1563 if (ARG_IS_VALID(kar, ARG_UID)) {
1564 tok = au_to_arg32(1, "uid", ar->ar_arg_uid);
1565 kau_write(rec, tok);
1566 }
1567 break;
1568
1569 case AUE_SETGROUPS:
1570 if (ARG_IS_VALID(kar, ARG_GROUPSET)) {
1571 for(ctr = 0; ctr < ar->ar_arg_groups.gidset_size; ctr++)
1572 {
1573 tok = au_to_arg32(1, "setgroups",
1574 ar->ar_arg_groups.gidset[ctr]);
1575 kau_write(rec, tok);
1576 }
1577 }
1578 break;
1579
1580 case AUE_SETLOGIN:
1581 if (ARG_IS_VALID(kar, ARG_LOGIN)) {
1582 tok = au_to_text(ar->ar_arg_login);
1583 kau_write(rec, tok);
1584 }
1585 break;
1586
1587 case AUE_SETLOGINCLASS:
1588 break;
1589
1590 case AUE_SETPRIORITY:
1591 if (ARG_IS_VALID(kar, ARG_CMD)) {
1592 tok = au_to_arg32(1, "which", ar->ar_arg_cmd);
1593 kau_write(rec, tok);
1594 }
1595 if (ARG_IS_VALID(kar, ARG_UID)) {
1596 tok = au_to_arg32(2, "who", ar->ar_arg_uid);
1597 kau_write(rec, tok);
1598 }
1599 PROCESS_PID_TOKENS(2);
1600 if (ARG_IS_VALID(kar, ARG_VALUE)) {
1601 tok = au_to_arg32(3, "priority", ar->ar_arg_value);
1602 kau_write(rec, tok);
1603 }
1604 break;
1605
1606 case AUE_SETPRIVEXEC:
1607 if (ARG_IS_VALID(kar, ARG_VALUE)) {
1608 tok = au_to_arg32(1, "flag", ar->ar_arg_value);
1609 kau_write(rec, tok);
1610 }
1611 break;
1612
1613 /* AUE_SHMAT, AUE_SHMCTL, AUE_SHMDT and AUE_SHMGET are SysV IPC */
1614 case AUE_SHMAT:
1615 if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
1616 tok = au_to_arg32(1, "shmid", ar->ar_arg_svipc_id);
1617 kau_write(rec, tok);
1618 /* XXXAUDIT: Does having the ipc token make sense? */
1619 tok = au_to_ipc(AT_IPC_SHM, ar->ar_arg_svipc_id);
1620 kau_write(rec, tok);
1621 }
1622 if (ARG_IS_VALID(kar, ARG_SVIPC_ADDR)) {
1623 tok = au_to_arg32(2, "shmaddr",
1624 (int)(uintptr_t)ar->ar_arg_svipc_addr);
1625 kau_write(rec, tok);
1626 }
1627 if (ARG_IS_VALID(kar, ARG_SVIPC_PERM)) {
1628 tok = au_to_ipc_perm(&ar->ar_arg_svipc_perm);
1629 kau_write(rec, tok);
1630 }
1631 break;
1632
1633 case AUE_SHMCTL:
1634 if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
1635 tok = au_to_arg32(1, "shmid", ar->ar_arg_svipc_id);
1636 kau_write(rec, tok);
1637 /* XXXAUDIT: Does having the ipc token make sense? */
1638 tok = au_to_ipc(AT_IPC_SHM, ar->ar_arg_svipc_id);
1639 kau_write(rec, tok);
1640 }
1641 switch (ar->ar_arg_svipc_cmd) {
1642 case IPC_STAT:
1643 ar->ar_event = AUE_SHMCTL_STAT;
1644 break;
1645 case IPC_RMID:
1646 ar->ar_event = AUE_SHMCTL_RMID;
1647 break;
1648 case IPC_SET:
1649 ar->ar_event = AUE_SHMCTL_SET;
1650 if (ARG_IS_VALID(kar, ARG_SVIPC_PERM)) {
1651 tok = au_to_ipc_perm(&ar->ar_arg_svipc_perm);
1652 kau_write(rec, tok);
1653 }
1654 break;
1655 default:
1656 break; /* We will audit a bad command */
1657 }
1658 break;
1659
1660 case AUE_SHMDT:
1661 if (ARG_IS_VALID(kar, ARG_SVIPC_ADDR)) {
1662 tok = au_to_arg32(1, "shmaddr",
1663 (int)(uintptr_t)ar->ar_arg_svipc_addr);
1664 kau_write(rec, tok);
1665 }
1666 break;
1667
1668 case AUE_SHMGET:
1669 /* This is unusual; the return value is in an argument token */
1670 if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
1671 tok = au_to_arg32(0, "shmid", ar->ar_arg_svipc_id);
1672 kau_write(rec, tok);
1673 tok = au_to_ipc(AT_IPC_SHM, ar->ar_arg_svipc_id);
1674 kau_write(rec, tok);
1675 }
1676 if (ARG_IS_VALID(kar, ARG_SVIPC_PERM)) {
1677 tok = au_to_ipc_perm(&ar->ar_arg_svipc_perm);
1678 kau_write(rec, tok);
1679 }
1680 break;
1681
1682 /* shm_rename is a non-Posix extension to the Posix shm implementation */
1683 case AUE_SHMRENAME:
1684 UPATH1_TOKENS;
1685 UPATH2_TOKENS;
1686 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1687 tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
1688 kau_write(rec, tok);
1689 }
1690 break;
1691
1692 /* AUE_SHMOPEN, AUE_SHMUNLINK, AUE_SEMOPEN, AUE_SEMCLOSE
1693 * and AUE_SEMUNLINK are Posix IPC */
1694 case AUE_SHMOPEN:
1695 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1696 tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
1697 kau_write(rec, tok);
1698 }
1699 if (ARG_IS_VALID(kar, ARG_MODE)) {
1700 tok = au_to_arg32(3, "mode", ar->ar_arg_mode);
1701 kau_write(rec, tok);
1702 }
1703 /* FALLTHROUGH */
1704
1705 case AUE_SHMUNLINK:
1706 UPATH1_TOKENS;
1707 if (ARG_IS_VALID(kar, ARG_POSIX_IPC_PERM)) {
1708 struct ipc_perm perm;
1709
1710 perm.uid = ar->ar_arg_pipc_perm.pipc_uid;
1711 perm.gid = ar->ar_arg_pipc_perm.pipc_gid;
1712 perm.cuid = ar->ar_arg_pipc_perm.pipc_uid;
1713 perm.cgid = ar->ar_arg_pipc_perm.pipc_gid;
1714 perm.mode = ar->ar_arg_pipc_perm.pipc_mode;
1715 perm.seq = 0;
1716 perm.key = 0;
1717 tok = au_to_ipc_perm(&perm);
1718 kau_write(rec, tok);
1719 }
1720 break;
1721
1722 case AUE_SEMOPEN:
1723 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1724 tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
1725 kau_write(rec, tok);
1726 }
1727 if (ARG_IS_VALID(kar, ARG_MODE)) {
1728 tok = au_to_arg32(3, "mode", ar->ar_arg_mode);
1729 kau_write(rec, tok);
1730 }
1731 if (ARG_IS_VALID(kar, ARG_VALUE)) {
1732 tok = au_to_arg32(4, "value", ar->ar_arg_value);
1733 kau_write(rec, tok);
1734 }
1735 /* FALLTHROUGH */
1736
1737 case AUE_SEMUNLINK:
1738 if (ARG_IS_VALID(kar, ARG_TEXT)) {
1739 tok = au_to_text(ar->ar_arg_text);
1740 kau_write(rec, tok);
1741 }
1742 if (ARG_IS_VALID(kar, ARG_POSIX_IPC_PERM)) {
1743 struct ipc_perm perm;
1744
1745 perm.uid = ar->ar_arg_pipc_perm.pipc_uid;
1746 perm.gid = ar->ar_arg_pipc_perm.pipc_gid;
1747 perm.cuid = ar->ar_arg_pipc_perm.pipc_uid;
1748 perm.cgid = ar->ar_arg_pipc_perm.pipc_gid;
1749 perm.mode = ar->ar_arg_pipc_perm.pipc_mode;
1750 perm.seq = 0;
1751 perm.key = 0;
1752 tok = au_to_ipc_perm(&perm);
1753 kau_write(rec, tok);
1754 }
1755 break;
1756
1757 case AUE_SEMCLOSE:
1758 if (ARG_IS_VALID(kar, ARG_FD)) {
1759 tok = au_to_arg32(1, "sem", ar->ar_arg_fd);
1760 kau_write(rec, tok);
1761 }
1762 break;
1763
1764 case AUE_SYMLINK:
1765 case AUE_SYMLINKAT:
1766 if (ARG_IS_VALID(kar, ARG_TEXT)) {
1767 tok = au_to_text(ar->ar_arg_text);
1768 kau_write(rec, tok);
1769 }
1770 ATFD1_TOKENS(1);
1771 UPATH1_VNODE1_TOKENS;
1772 break;
1773
1774 case AUE_SYSCTL:
1775 case AUE_SYSCTL_NONADMIN:
1776 if (ARG_IS_VALID(kar, ARG_CTLNAME | ARG_LEN)) {
1777 for (ctr = 0; ctr < ar->ar_arg_len; ctr++) {
1778 tok = au_to_arg32(1, "name",
1779 ar->ar_arg_ctlname[ctr]);
1780 kau_write(rec, tok);
1781 }
1782 }
1783 if (ARG_IS_VALID(kar, ARG_VALUE)) {
1784 tok = au_to_arg32(5, "newval", ar->ar_arg_value);
1785 kau_write(rec, tok);
1786 }
1787 if (ARG_IS_VALID(kar, ARG_TEXT)) {
1788 tok = au_to_text(ar->ar_arg_text);
1789 kau_write(rec, tok);
1790 }
1791 break;
1792
1793 case AUE_UMASK:
1794 if (ARG_IS_VALID(kar, ARG_MASK)) {
1795 tok = au_to_arg32(1, "new mask", ar->ar_arg_mask);
1796 kau_write(rec, tok);
1797 }
1798 tok = au_to_arg32(0, "prev mask", ar->ar_retval);
1799 kau_write(rec, tok);
1800 break;
1801
1802 case AUE_WAIT4:
1803 case AUE_WAIT6:
1804 PROCESS_PID_TOKENS(1);
1805 if (ARG_IS_VALID(kar, ARG_VALUE)) {
1806 tok = au_to_arg32(3, "options", ar->ar_arg_value);
1807 kau_write(rec, tok);
1808 }
1809 break;
1810
1811 case AUE_CAP_RIGHTS_LIMIT:
1812 /*
1813 * XXXRW/XXXJA: Would be nice to audit socket/etc information.
1814 */
1815 FD_VNODE1_TOKENS;
1816 if (ARG_IS_VALID(kar, ARG_RIGHTS)) {
1817 tok = au_to_rights(&ar->ar_arg_rights);
1818 kau_write(rec, tok);
1819 }
1820 break;
1821
1822 case AUE_CAP_FCNTLS_GET:
1823 case AUE_CAP_IOCTLS_GET:
1824 case AUE_CAP_IOCTLS_LIMIT:
1825 case AUE_CAP_RIGHTS_GET:
1826 if (ARG_IS_VALID(kar, ARG_FD)) {
1827 tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
1828 kau_write(rec, tok);
1829 }
1830 break;
1831
1832 case AUE_CAP_FCNTLS_LIMIT:
1833 FD_VNODE1_TOKENS;
1834 if (ARG_IS_VALID(kar, ARG_FCNTL_RIGHTS)) {
1835 tok = au_to_arg32(2, "fcntlrights",
1836 ar->ar_arg_fcntl_rights);
1837 kau_write(rec, tok);
1838 }
1839 break;
1840
1841 case AUE_CAP_ENTER:
1842 case AUE_CAP_GETMODE:
1843 break;
1844
1845 case AUE_THR_NEW:
1846 case AUE_THR_KILL:
1847 case AUE_THR_EXIT:
1848 break;
1849
1850 case AUE_NULL:
1851 default:
1852 printf("BSM conversion requested for unknown event %d\n",
1853 ar->ar_event);
1854
1855 /*
1856 * Write the subject token so it is properly freed here.
1857 */
1858 if (jail_tok != NULL)
1859 kau_write(rec, jail_tok);
1860 kau_write(rec, subj_tok);
1861 kau_free(rec);
1862 return (BSM_NOAUDIT);
1863 }
1864
1865 if (jail_tok != NULL)
1866 kau_write(rec, jail_tok);
1867 kau_write(rec, subj_tok);
1868 tok = au_to_return32(au_errno_to_bsm(ar->ar_errno), ar->ar_retval);
1869 kau_write(rec, tok); /* Every record gets a return token */
1870
1871 kau_close(rec, &ar->ar_endtime, ar->ar_event);
1872
1873 *pau = rec;
1874 return (BSM_SUCCESS);
1875 }
1876
1877 /*
1878 * Verify that a record is a valid BSM record. This verification is simple
1879 * now, but may be expanded on sometime in the future. Return 1 if the
1880 * record is good, 0 otherwise.
1881 */
1882 int
bsm_rec_verify(void * rec)1883 bsm_rec_verify(void *rec)
1884 {
1885 char c = *(char *)rec;
1886
1887 /*
1888 * Check the token ID of the first token; it has to be a header
1889 * token.
1890 *
1891 * XXXAUDIT There needs to be a token structure to map a token.
1892 * XXXAUDIT 'Shouldn't be simply looking at the first char.
1893 */
1894 if ((c != AUT_HEADER32) && (c != AUT_HEADER32_EX) &&
1895 (c != AUT_HEADER64) && (c != AUT_HEADER64_EX))
1896 return (0);
1897 return (1);
1898 }
1899