xref: /freebsd/sys/security/audit/audit.c (revision 195ebc7e9e4b129de810833791a19dfb4349d6a9)
1 /*-
2  * Copyright (c) 1999-2005 Apple Inc.
3  * Copyright (c) 2006-2007 Robert N. M. Watson
4  * All rights reserved.
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions
8  * are met:
9  * 1.  Redistributions of source code must retain the above copyright
10  *     notice, this list of conditions and the following disclaimer.
11  * 2.  Redistributions in binary form must reproduce the above copyright
12  *     notice, this list of conditions and the following disclaimer in the
13  *     documentation and/or other materials provided with the distribution.
14  * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
15  *     its contributors may be used to endorse or promote products derived
16  *     from this software without specific prior written permission.
17  *
18  * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND
19  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21  * ARE DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR
22  * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
23  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
24  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
25  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
26  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
27  * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
28  * POSSIBILITY OF SUCH DAMAGE.
29  */
30 
31 #include <sys/cdefs.h>
32 __FBSDID("$FreeBSD$");
33 
34 #include <sys/param.h>
35 #include <sys/condvar.h>
36 #include <sys/conf.h>
37 #include <sys/file.h>
38 #include <sys/filedesc.h>
39 #include <sys/fcntl.h>
40 #include <sys/ipc.h>
41 #include <sys/kernel.h>
42 #include <sys/kthread.h>
43 #include <sys/malloc.h>
44 #include <sys/mount.h>
45 #include <sys/namei.h>
46 #include <sys/priv.h>
47 #include <sys/proc.h>
48 #include <sys/queue.h>
49 #include <sys/socket.h>
50 #include <sys/socketvar.h>
51 #include <sys/protosw.h>
52 #include <sys/domain.h>
53 #include <sys/sysctl.h>
54 #include <sys/sysproto.h>
55 #include <sys/sysent.h>
56 #include <sys/systm.h>
57 #include <sys/ucred.h>
58 #include <sys/uio.h>
59 #include <sys/un.h>
60 #include <sys/unistd.h>
61 #include <sys/vnode.h>
62 
63 #include <bsm/audit.h>
64 #include <bsm/audit_internal.h>
65 #include <bsm/audit_kevents.h>
66 
67 #include <netinet/in.h>
68 #include <netinet/in_pcb.h>
69 
70 #include <security/audit/audit.h>
71 #include <security/audit/audit_private.h>
72 
73 #include <vm/uma.h>
74 
75 static uma_zone_t	audit_record_zone;
76 static MALLOC_DEFINE(M_AUDITCRED, "audit_cred", "Audit cred storage");
77 MALLOC_DEFINE(M_AUDITDATA, "audit_data", "Audit data storage");
78 MALLOC_DEFINE(M_AUDITPATH, "audit_path", "Audit path storage");
79 MALLOC_DEFINE(M_AUDITTEXT, "audit_text", "Audit text storage");
80 
81 SYSCTL_NODE(_security, OID_AUTO, audit, CTLFLAG_RW, 0,
82     "TrustedBSD audit controls");
83 
84 /*
85  * Audit control settings that are set/read by system calls and are hence
86  * non-static.
87  *
88  * Define the audit control flags.
89  */
90 int			audit_enabled;
91 int			audit_suspended;
92 
93 /*
94  * Flags controlling behavior in low storage situations.  Should we panic if
95  * a write fails?  Should we fail stop if we're out of disk space?
96  */
97 int			audit_panic_on_write_fail;
98 int			audit_fail_stop;
99 int			audit_argv;
100 int			audit_arge;
101 
102 /*
103  * Are we currently "failing stop" due to out of disk space?
104  */
105 int			audit_in_failure;
106 
107 /*
108  * Global audit statistics.
109  */
110 struct audit_fstat	audit_fstat;
111 
112 /*
113  * Preselection mask for non-attributable events.
114  */
115 struct au_mask		audit_nae_mask;
116 
117 /*
118  * Mutex to protect global variables shared between various threads and
119  * processes.
120  */
121 struct mtx		audit_mtx;
122 
123 /*
124  * Queue of audit records ready for delivery to disk.  We insert new records
125  * at the tail, and remove records from the head.  Also, a count of the
126  * number of records used for checking queue depth.  In addition, a counter
127  * of records that we have allocated but are not yet in the queue, which is
128  * needed to estimate the total size of the combined set of records
129  * outstanding in the system.
130  */
131 struct kaudit_queue	audit_q;
132 int			audit_q_len;
133 int			audit_pre_q_len;
134 
135 /*
136  * Audit queue control settings (minimum free, low/high water marks, etc.)
137  */
138 struct au_qctrl		audit_qctrl;
139 
140 /*
141  * Condition variable to signal to the worker that it has work to do: either
142  * new records are in the queue, or a log replacement is taking place.
143  */
144 struct cv		audit_worker_cv;
145 
146 /*
147  * Condition variable to flag when crossing the low watermark, meaning that
148  * threads blocked due to hitting the high watermark can wake up and continue
149  * to commit records.
150  */
151 struct cv		audit_watermark_cv;
152 
153 /*
154  * Condition variable for  auditing threads wait on when in fail-stop mode.
155  * Threads wait on this CV forever (and ever), never seeing the light of day
156  * again.
157  */
158 static struct cv	audit_fail_cv;
159 
160 /*
161  * Kernel audit information.  This will store the current audit address
162  * or host information that the kernel will use when it's generating
163  * audit records.  This data is modified by the A_GET{SET}KAUDIT auditon(2)
164  * command.
165  */
166 static struct auditinfo_addr	audit_kinfo;
167 static struct rwlock		audit_kinfo_lock;
168 
169 #define	KINFO_LOCK_INIT()	rw_init(&audit_kinfo_lock, \
170 				    "audit_kinfo_lock")
171 #define	KINFO_RLOCK()		rw_rlock(&audit_kinfo_lock)
172 #define	KINFO_WLOCK()		rw_wlock(&audit_kinfo_lock)
173 #define	KINFO_RUNLOCK()		rw_runlock(&audit_kinfo_lock)
174 #define	KINFO_WUNLOCK()		rw_wunlock(&audit_kinfo_lock)
175 
176 void
177 audit_set_kinfo(struct auditinfo_addr *ak)
178 {
179 
180 	KASSERT(ak->ai_termid.at_type == AU_IPv4 ||
181 	    ak->ai_termid.at_type == AU_IPv6,
182 	    ("audit_set_kinfo: invalid address type"));
183 
184 	KINFO_WLOCK();
185 	audit_kinfo = *ak;
186 	KINFO_WUNLOCK();
187 }
188 
189 void
190 audit_get_kinfo(struct auditinfo_addr *ak)
191 {
192 
193 	KASSERT(audit_kinfo.ai_termid.at_type == AU_IPv4 ||
194 	    audit_kinfo.ai_termid.at_type == AU_IPv6,
195 	    ("audit_set_kinfo: invalid address type"));
196 
197 	KINFO_RLOCK();
198 	*ak = audit_kinfo;
199 	KINFO_RUNLOCK();
200 }
201 
202 /*
203  * Construct an audit record for the passed thread.
204  */
205 static int
206 audit_record_ctor(void *mem, int size, void *arg, int flags)
207 {
208 	struct kaudit_record *ar;
209 	struct thread *td;
210 	struct ucred *cred;
211 
212 	KASSERT(sizeof(*ar) == size, ("audit_record_ctor: wrong size"));
213 
214 	td = arg;
215 	ar = mem;
216 	bzero(ar, sizeof(*ar));
217 	ar->k_ar.ar_magic = AUDIT_RECORD_MAGIC;
218 	nanotime(&ar->k_ar.ar_starttime);
219 
220 	/*
221 	 * Export the subject credential.
222 	 */
223 	cred = td->td_ucred;
224 	cru2x(cred, &ar->k_ar.ar_subj_cred);
225 	ar->k_ar.ar_subj_ruid = cred->cr_ruid;
226 	ar->k_ar.ar_subj_rgid = cred->cr_rgid;
227 	ar->k_ar.ar_subj_egid = cred->cr_groups[0];
228 	ar->k_ar.ar_subj_auid = cred->cr_audit.ai_auid;
229 	ar->k_ar.ar_subj_asid = cred->cr_audit.ai_asid;
230 	ar->k_ar.ar_subj_pid = td->td_proc->p_pid;
231 	ar->k_ar.ar_subj_amask = cred->cr_audit.ai_mask;
232 	ar->k_ar.ar_subj_term_addr = cred->cr_audit.ai_termid;
233 	return (0);
234 }
235 
236 static void
237 audit_record_dtor(void *mem, int size, void *arg)
238 {
239 	struct kaudit_record *ar;
240 
241 	KASSERT(sizeof(*ar) == size, ("audit_record_dtor: wrong size"));
242 
243 	ar = mem;
244 	if (ar->k_ar.ar_arg_upath1 != NULL)
245 		free(ar->k_ar.ar_arg_upath1, M_AUDITPATH);
246 	if (ar->k_ar.ar_arg_upath2 != NULL)
247 		free(ar->k_ar.ar_arg_upath2, M_AUDITPATH);
248 	if (ar->k_ar.ar_arg_text != NULL)
249 		free(ar->k_ar.ar_arg_text, M_AUDITTEXT);
250 	if (ar->k_udata != NULL)
251 		free(ar->k_udata, M_AUDITDATA);
252 	if (ar->k_ar.ar_arg_argv != NULL)
253 		free(ar->k_ar.ar_arg_argv, M_AUDITTEXT);
254 	if (ar->k_ar.ar_arg_envv != NULL)
255 		free(ar->k_ar.ar_arg_envv, M_AUDITTEXT);
256 }
257 
258 /*
259  * Initialize the Audit subsystem: configuration state, work queue,
260  * synchronization primitives, worker thread, and trigger device node.  Also
261  * call into the BSM assembly code to initialize it.
262  */
263 static void
264 audit_init(void)
265 {
266 
267 	audit_enabled = 0;
268 	audit_suspended = 0;
269 	audit_panic_on_write_fail = 0;
270 	audit_fail_stop = 0;
271 	audit_in_failure = 0;
272 	audit_argv = 0;
273 	audit_arge = 0;
274 
275 	audit_fstat.af_filesz = 0;	/* '0' means unset, unbounded. */
276 	audit_fstat.af_currsz = 0;
277 	audit_nae_mask.am_success = 0;
278 	audit_nae_mask.am_failure = 0;
279 
280 	TAILQ_INIT(&audit_q);
281 	audit_q_len = 0;
282 	audit_pre_q_len = 0;
283 	audit_qctrl.aq_hiwater = AQ_HIWATER;
284 	audit_qctrl.aq_lowater = AQ_LOWATER;
285 	audit_qctrl.aq_bufsz = AQ_BUFSZ;
286 	audit_qctrl.aq_minfree = AU_FS_MINFREE;
287 
288 	audit_kinfo.ai_termid.at_type = AU_IPv4;
289 	audit_kinfo.ai_termid.at_addr[0] = INADDR_ANY;
290 
291 	mtx_init(&audit_mtx, "audit_mtx", NULL, MTX_DEF);
292 	KINFO_LOCK_INIT();
293 	cv_init(&audit_worker_cv, "audit_worker_cv");
294 	cv_init(&audit_watermark_cv, "audit_watermark_cv");
295 	cv_init(&audit_fail_cv, "audit_fail_cv");
296 
297 	audit_record_zone = uma_zcreate("audit_record",
298 	    sizeof(struct kaudit_record), audit_record_ctor,
299 	    audit_record_dtor, NULL, NULL, UMA_ALIGN_PTR, 0);
300 
301 	/* Initialize the BSM audit subsystem. */
302 	kau_init();
303 
304 	audit_trigger_init();
305 
306 	/* Register shutdown handler. */
307 	EVENTHANDLER_REGISTER(shutdown_pre_sync, audit_shutdown, NULL,
308 	    SHUTDOWN_PRI_FIRST);
309 
310 	/* Start audit worker thread. */
311 	audit_worker_init();
312 }
313 
314 SYSINIT(audit_init, SI_SUB_AUDIT, SI_ORDER_FIRST, audit_init, NULL);
315 
316 /*
317  * Drain the audit queue and close the log at shutdown.  Note that this can
318  * be called both from the system shutdown path and also from audit
319  * configuration syscalls, so 'arg' and 'howto' are ignored.
320  *
321  * XXXRW: In FreeBSD 7.x and 8.x, this fails to wait for the record queue to
322  * drain before returning, which could lead to lost records on shutdown.
323  */
324 void
325 audit_shutdown(void *arg, int howto)
326 {
327 
328 	audit_rotate_vnode(NULL, NULL);
329 }
330 
331 /*
332  * Return the current thread's audit record, if any.
333  */
334 struct kaudit_record *
335 currecord(void)
336 {
337 
338 	return (curthread->td_ar);
339 }
340 
341 /*
342  * XXXAUDIT: There are a number of races present in the code below due to
343  * release and re-grab of the mutex.  The code should be revised to become
344  * slightly less racy.
345  *
346  * XXXAUDIT: Shouldn't there be logic here to sleep waiting on available
347  * pre_q space, suspending the system call until there is room?
348  */
349 struct kaudit_record *
350 audit_new(int event, struct thread *td)
351 {
352 	struct kaudit_record *ar;
353 	int no_record;
354 
355 	mtx_lock(&audit_mtx);
356 	no_record = (audit_suspended || !audit_enabled);
357 	mtx_unlock(&audit_mtx);
358 	if (no_record)
359 		return (NULL);
360 
361 	/*
362 	 * Note: the number of outstanding uncommitted audit records is
363 	 * limited to the number of concurrent threads servicing system calls
364 	 * in the kernel.
365 	 */
366 	ar = uma_zalloc_arg(audit_record_zone, td, M_WAITOK);
367 	ar->k_ar.ar_event = event;
368 
369 	mtx_lock(&audit_mtx);
370 	audit_pre_q_len++;
371 	mtx_unlock(&audit_mtx);
372 
373 	return (ar);
374 }
375 
376 void
377 audit_free(struct kaudit_record *ar)
378 {
379 
380 	uma_zfree(audit_record_zone, ar);
381 }
382 
383 void
384 audit_commit(struct kaudit_record *ar, int error, int retval)
385 {
386 	au_event_t event;
387 	au_class_t class;
388 	au_id_t auid;
389 	int sorf;
390 	struct au_mask *aumask;
391 
392 	if (ar == NULL)
393 		return;
394 
395 	/*
396 	 * Decide whether to commit the audit record by checking the error
397 	 * value from the system call and using the appropriate audit mask.
398 	 */
399 	if (ar->k_ar.ar_subj_auid == AU_DEFAUDITID)
400 		aumask = &audit_nae_mask;
401 	else
402 		aumask = &ar->k_ar.ar_subj_amask;
403 
404 	if (error)
405 		sorf = AU_PRS_FAILURE;
406 	else
407 		sorf = AU_PRS_SUCCESS;
408 
409 	switch(ar->k_ar.ar_event) {
410 	case AUE_OPEN_RWTC:
411 		/*
412 		 * The open syscall always writes a AUE_OPEN_RWTC event;
413 		 * change it to the proper type of event based on the flags
414 		 * and the error value.
415 		 */
416 		ar->k_ar.ar_event = audit_flags_and_error_to_openevent(
417 		    ar->k_ar.ar_arg_fflags, error);
418 		break;
419 
420 	case AUE_SYSCTL:
421 		ar->k_ar.ar_event = audit_ctlname_to_sysctlevent(
422 		    ar->k_ar.ar_arg_ctlname, ar->k_ar.ar_valid_arg);
423 		break;
424 
425 	case AUE_AUDITON:
426 		/* Convert the auditon() command to an event. */
427 		ar->k_ar.ar_event = auditon_command_event(ar->k_ar.ar_arg_cmd);
428 		break;
429 	}
430 
431 	auid = ar->k_ar.ar_subj_auid;
432 	event = ar->k_ar.ar_event;
433 	class = au_event_class(event);
434 
435 	ar->k_ar_commit |= AR_COMMIT_KERNEL;
436 	if (au_preselect(event, class, aumask, sorf) != 0)
437 		ar->k_ar_commit |= AR_PRESELECT_TRAIL;
438 	if (audit_pipe_preselect(auid, event, class, sorf,
439 	    ar->k_ar_commit & AR_PRESELECT_TRAIL) != 0)
440 		ar->k_ar_commit |= AR_PRESELECT_PIPE;
441 	if ((ar->k_ar_commit & (AR_PRESELECT_TRAIL | AR_PRESELECT_PIPE |
442 	    AR_PRESELECT_USER_TRAIL | AR_PRESELECT_USER_PIPE)) == 0) {
443 		mtx_lock(&audit_mtx);
444 		audit_pre_q_len--;
445 		mtx_unlock(&audit_mtx);
446 		audit_free(ar);
447 		return;
448 	}
449 
450 	ar->k_ar.ar_errno = error;
451 	ar->k_ar.ar_retval = retval;
452 	nanotime(&ar->k_ar.ar_endtime);
453 
454 	/*
455 	 * Note: it could be that some records initiated while audit was
456 	 * enabled should still be committed?
457 	 */
458 	mtx_lock(&audit_mtx);
459 	if (audit_suspended || !audit_enabled) {
460 		audit_pre_q_len--;
461 		mtx_unlock(&audit_mtx);
462 		audit_free(ar);
463 		return;
464 	}
465 
466 	/*
467 	 * Constrain the number of committed audit records based on the
468 	 * configurable parameter.
469 	 */
470 	while (audit_q_len >= audit_qctrl.aq_hiwater)
471 		cv_wait(&audit_watermark_cv, &audit_mtx);
472 
473 	TAILQ_INSERT_TAIL(&audit_q, ar, k_q);
474 	audit_q_len++;
475 	audit_pre_q_len--;
476 	cv_signal(&audit_worker_cv);
477 	mtx_unlock(&audit_mtx);
478 }
479 
480 /*
481  * audit_syscall_enter() is called on entry to each system call.  It is
482  * responsible for deciding whether or not to audit the call (preselection),
483  * and if so, allocating a per-thread audit record.  audit_new() will fill in
484  * basic thread/credential properties.
485  */
486 void
487 audit_syscall_enter(unsigned short code, struct thread *td)
488 {
489 	struct au_mask *aumask;
490 	au_class_t class;
491 	au_event_t event;
492 	au_id_t auid;
493 
494 	KASSERT(td->td_ar == NULL, ("audit_syscall_enter: td->td_ar != NULL"));
495 	KASSERT((td->td_pflags & TDP_AUDITREC) == 0,
496 	    ("audit_syscall_enter: TDP_AUDITREC set"));
497 
498 	/*
499 	 * In FreeBSD, each ABI has its own system call table, and hence
500 	 * mapping of system call codes to audit events.  Convert the code to
501 	 * an audit event identifier using the process system call table
502 	 * reference.  In Darwin, there's only one, so we use the global
503 	 * symbol for the system call table.  No audit record is generated
504 	 * for bad system calls, as no operation has been performed.
505 	 */
506 	if (code >= td->td_proc->p_sysent->sv_size)
507 		return;
508 
509 	event = td->td_proc->p_sysent->sv_table[code].sy_auevent;
510 	if (event == AUE_NULL)
511 		return;
512 
513 	/*
514 	 * Check which audit mask to use; either the kernel non-attributable
515 	 * event mask or the process audit mask.
516 	 */
517 	auid = td->td_ucred->cr_audit.ai_auid;
518 	if (auid == AU_DEFAUDITID)
519 		aumask = &audit_nae_mask;
520 	else
521 		aumask = &td->td_ucred->cr_audit.ai_mask;
522 
523 	/*
524 	 * Allocate an audit record, if preselection allows it, and store in
525 	 * the thread for later use.
526 	 */
527 	class = au_event_class(event);
528 	if (au_preselect(event, class, aumask, AU_PRS_BOTH)) {
529 		/*
530 		 * If we're out of space and need to suspend unprivileged
531 		 * processes, do that here rather than trying to allocate
532 		 * another audit record.
533 		 *
534 		 * Note: we might wish to be able to continue here in the
535 		 * future, if the system recovers.  That should be possible
536 		 * by means of checking the condition in a loop around
537 		 * cv_wait().  It might be desirable to reevaluate whether an
538 		 * audit record is still required for this event by
539 		 * re-calling au_preselect().
540 		 */
541 		if (audit_in_failure &&
542 		    priv_check(td, PRIV_AUDIT_FAILSTOP) != 0) {
543 			cv_wait(&audit_fail_cv, &audit_mtx);
544 			panic("audit_failing_stop: thread continued");
545 		}
546 		td->td_ar = audit_new(event, td);
547 		if (td->td_ar != NULL)
548 			td->td_pflags |= TDP_AUDITREC;
549 	} else if (audit_pipe_preselect(auid, event, class, AU_PRS_BOTH, 0)) {
550 		td->td_ar = audit_new(event, td);
551 		if (td->td_ar != NULL)
552 			td->td_pflags |= TDP_AUDITREC;
553 	} else
554 		td->td_ar = NULL;
555 }
556 
557 /*
558  * audit_syscall_exit() is called from the return of every system call, or in
559  * the event of exit1(), during the execution of exit1().  It is responsible
560  * for committing the audit record, if any, along with return condition.
561  */
562 void
563 audit_syscall_exit(int error, struct thread *td)
564 {
565 	int retval;
566 
567 	/*
568 	 * Commit the audit record as desired; once we pass the record into
569 	 * audit_commit(), the memory is owned by the audit subsystem.  The
570 	 * return value from the system call is stored on the user thread.
571 	 * If there was an error, the return value is set to -1, imitating
572 	 * the behavior of the cerror routine.
573 	 */
574 	if (error)
575 		retval = -1;
576 	else
577 		retval = td->td_retval[0];
578 
579 	audit_commit(td->td_ar, error, retval);
580 	td->td_ar = NULL;
581 	td->td_pflags &= ~TDP_AUDITREC;
582 }
583 
584 void
585 audit_cred_copy(struct ucred *src, struct ucred *dest)
586 {
587 
588 	bcopy(&src->cr_audit, &dest->cr_audit, sizeof(dest->cr_audit));
589 }
590 
591 void
592 audit_cred_destroy(struct ucred *cred)
593 {
594 
595 }
596 
597 void
598 audit_cred_init(struct ucred *cred)
599 {
600 
601 	bzero(&cred->cr_audit, sizeof(cred->cr_audit));
602 }
603 
604 /*
605  * Initialize audit information for the first kernel process (proc 0) and for
606  * the first user process (init).
607  */
608 void
609 audit_cred_kproc0(struct ucred *cred)
610 {
611 
612 	cred->cr_audit.ai_auid = AU_DEFAUDITID;
613 	cred->cr_audit.ai_termid.at_type = AU_IPv4;
614 }
615 
616 void
617 audit_cred_proc1(struct ucred *cred)
618 {
619 
620 	cred->cr_audit.ai_auid = AU_DEFAUDITID;
621 	cred->cr_audit.ai_termid.at_type = AU_IPv4;
622 }
623 
624 void
625 audit_thread_alloc(struct thread *td)
626 {
627 
628 	td->td_ar = NULL;
629 }
630 
631 void
632 audit_thread_free(struct thread *td)
633 {
634 
635 	KASSERT(td->td_ar == NULL, ("audit_thread_free: td_ar != NULL"));
636 	KASSERT((td->td_pflags & TDP_AUDITREC) == 0,
637 	    ("audit_thread_free: TDP_AUDITREC set"));
638 }
639 
640 void
641 audit_proc_coredump(struct thread *td, char *path, int errcode)
642 {
643 	struct kaudit_record *ar;
644 	struct au_mask *aumask;
645 	struct ucred *cred;
646 	au_class_t class;
647 	int ret, sorf;
648 	char **pathp;
649 	au_id_t auid;
650 
651 	ret = 0;
652 
653 	/*
654 	 * Make sure we are using the correct preselection mask.
655 	 */
656 	cred = td->td_ucred;
657 	auid = cred->cr_audit.ai_auid;
658 	if (auid == AU_DEFAUDITID)
659 		aumask = &audit_nae_mask;
660 	else
661 		aumask = &cred->cr_audit.ai_mask;
662 	/*
663 	 * It's possible for coredump(9) generation to fail.  Make sure that
664 	 * we handle this case correctly for preselection.
665 	 */
666 	if (errcode != 0)
667 		sorf = AU_PRS_FAILURE;
668 	else
669 		sorf = AU_PRS_SUCCESS;
670 	class = au_event_class(AUE_CORE);
671 	if (au_preselect(AUE_CORE, class, aumask, sorf) == 0 &&
672 	    audit_pipe_preselect(auid, AUE_CORE, class, sorf, 0) == 0)
673 		return;
674 
675 	/*
676 	 * If we are interested in seeing this audit record, allocate it.
677 	 * Where possible coredump records should contain a pathname and arg32
678 	 * (signal) tokens.
679 	 */
680 	ar = audit_new(AUE_CORE, td);
681 	if (path != NULL) {
682 		pathp = &ar->k_ar.ar_arg_upath1;
683 		*pathp = malloc(MAXPATHLEN, M_AUDITPATH, M_WAITOK);
684 		audit_canon_path(td, path, *pathp);
685 		ARG_SET_VALID(ar, ARG_UPATH1);
686 	}
687 	ar->k_ar.ar_arg_signum = td->td_proc->p_sig;
688 	ARG_SET_VALID(ar, ARG_SIGNUM);
689 	if (errcode != 0)
690 		ret = 1;
691 	audit_commit(ar, errcode, ret);
692 }
693