xref: /freebsd/sys/security/audit/audit_arg.c (revision ae1078d657c7d7618e23659c11221d5be94f05bd)
1718c8510SRobert Watson /*
2718c8510SRobert Watson  * Copyright (c) 1999-2005 Apple Computer, Inc.
3718c8510SRobert Watson  * All rights reserved.
4718c8510SRobert Watson  *
5718c8510SRobert Watson  * Redistribution and use in source and binary forms, with or without
6718c8510SRobert Watson  * modification, are permitted provided that the following conditions
7718c8510SRobert Watson  * are met:
8718c8510SRobert Watson  * 1.  Redistributions of source code must retain the above copyright
9718c8510SRobert Watson  *     notice, this list of conditions and the following disclaimer.
10718c8510SRobert Watson  * 2.  Redistributions in binary form must reproduce the above copyright
11718c8510SRobert Watson  *     notice, this list of conditions and the following disclaimer in the
12718c8510SRobert Watson  *     documentation and/or other materials provided with the distribution.
13718c8510SRobert Watson  * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
14718c8510SRobert Watson  *     its contributors may be used to endorse or promote products derived
15718c8510SRobert Watson  *     from this software without specific prior written permission.
16718c8510SRobert Watson  *
17718c8510SRobert Watson  * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND
18718c8510SRobert Watson  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19718c8510SRobert Watson  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20718c8510SRobert Watson  * ARE DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR
21718c8510SRobert Watson  * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22718c8510SRobert Watson  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23718c8510SRobert Watson  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24718c8510SRobert Watson  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
25718c8510SRobert Watson  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
26718c8510SRobert Watson  * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
27718c8510SRobert Watson  * POSSIBILITY OF SUCH DAMAGE.
28718c8510SRobert Watson  *
29718c8510SRobert Watson  * $FreeBSD$
30718c8510SRobert Watson  */
31718c8510SRobert Watson 
32718c8510SRobert Watson #include <sys/param.h>
33718c8510SRobert Watson #include <sys/filedesc.h>
34718c8510SRobert Watson #include <sys/ipc.h>
35718c8510SRobert Watson #include <sys/mount.h>
36718c8510SRobert Watson #include <sys/proc.h>
37718c8510SRobert Watson #include <sys/socket.h>
38718c8510SRobert Watson #include <sys/socketvar.h>
39718c8510SRobert Watson #include <sys/protosw.h>
40718c8510SRobert Watson #include <sys/domain.h>
415619113cSRobert Watson #include <sys/sbuf.h>
42718c8510SRobert Watson #include <sys/systm.h>
43718c8510SRobert Watson #include <sys/un.h>
44718c8510SRobert Watson #include <sys/vnode.h>
45718c8510SRobert Watson 
46718c8510SRobert Watson #include <netinet/in.h>
47718c8510SRobert Watson #include <netinet/in_pcb.h>
48718c8510SRobert Watson 
49718c8510SRobert Watson #include <security/audit/audit.h>
50718c8510SRobert Watson #include <security/audit/audit_private.h>
51718c8510SRobert Watson 
52718c8510SRobert Watson /*
53718c8510SRobert Watson  * Calls to manipulate elements of the audit record structure from system
54718c8510SRobert Watson  * call code.  Macro wrappers will prevent this functions from being
55718c8510SRobert Watson  * entered if auditing is disabled, avoiding the function call cost.  We
56718c8510SRobert Watson  * check the thread audit record pointer anyway, as the audit condition
57718c8510SRobert Watson  * could change, and pre-selection may not have allocated an audit
58718c8510SRobert Watson  * record for this event.
59718c8510SRobert Watson  *
60718c8510SRobert Watson  * XXXAUDIT: Should we assert, in each case, that this field of the record
61718c8510SRobert Watson  * hasn't already been filled in?
62718c8510SRobert Watson  */
63718c8510SRobert Watson void
64718c8510SRobert Watson audit_arg_addr(void * addr)
65718c8510SRobert Watson {
66718c8510SRobert Watson 	struct kaudit_record *ar;
67718c8510SRobert Watson 
68718c8510SRobert Watson 	ar = currecord();
69718c8510SRobert Watson 	if (ar == NULL)
70718c8510SRobert Watson 		return;
71718c8510SRobert Watson 
72718c8510SRobert Watson 	ar->k_ar.ar_arg_addr = addr;
73718c8510SRobert Watson 	ARG_SET_VALID(ar, ARG_ADDR);
74718c8510SRobert Watson }
75718c8510SRobert Watson 
76718c8510SRobert Watson void
77718c8510SRobert Watson audit_arg_exit(int status, int retval)
78718c8510SRobert Watson {
79718c8510SRobert Watson 	struct kaudit_record *ar;
80718c8510SRobert Watson 
81718c8510SRobert Watson 	ar = currecord();
82718c8510SRobert Watson 	if (ar == NULL)
83718c8510SRobert Watson 		return;
84718c8510SRobert Watson 
85718c8510SRobert Watson 	ar->k_ar.ar_arg_exitstatus = status;
86718c8510SRobert Watson 	ar->k_ar.ar_arg_exitretval = retval;
87718c8510SRobert Watson 	ARG_SET_VALID(ar, ARG_EXIT);
88718c8510SRobert Watson }
89718c8510SRobert Watson 
90718c8510SRobert Watson void
91718c8510SRobert Watson audit_arg_len(int len)
92718c8510SRobert Watson {
93718c8510SRobert Watson 	struct kaudit_record *ar;
94718c8510SRobert Watson 
95718c8510SRobert Watson 	ar = currecord();
96718c8510SRobert Watson 	if (ar == NULL)
97718c8510SRobert Watson 		return;
98718c8510SRobert Watson 
99718c8510SRobert Watson 	ar->k_ar.ar_arg_len = len;
100718c8510SRobert Watson 	ARG_SET_VALID(ar, ARG_LEN);
101718c8510SRobert Watson }
102718c8510SRobert Watson 
103718c8510SRobert Watson void
104718c8510SRobert Watson audit_arg_fd(int fd)
105718c8510SRobert Watson {
106718c8510SRobert Watson 	struct kaudit_record *ar;
107718c8510SRobert Watson 
108718c8510SRobert Watson 	ar = currecord();
109718c8510SRobert Watson 	if (ar == NULL)
110718c8510SRobert Watson 		return;
111718c8510SRobert Watson 
112718c8510SRobert Watson 	ar->k_ar.ar_arg_fd = fd;
113718c8510SRobert Watson 	ARG_SET_VALID(ar, ARG_FD);
114718c8510SRobert Watson }
115718c8510SRobert Watson 
116718c8510SRobert Watson void
117718c8510SRobert Watson audit_arg_fflags(int fflags)
118718c8510SRobert Watson {
119718c8510SRobert Watson 	struct kaudit_record *ar;
120718c8510SRobert Watson 
121718c8510SRobert Watson 	ar = currecord();
122718c8510SRobert Watson 	if (ar == NULL)
123718c8510SRobert Watson 		return;
124718c8510SRobert Watson 
125718c8510SRobert Watson 	ar->k_ar.ar_arg_fflags = fflags;
126718c8510SRobert Watson 	ARG_SET_VALID(ar, ARG_FFLAGS);
127718c8510SRobert Watson }
128718c8510SRobert Watson 
129718c8510SRobert Watson void
130718c8510SRobert Watson audit_arg_gid(gid_t gid)
131718c8510SRobert Watson {
132718c8510SRobert Watson 	struct kaudit_record *ar;
133718c8510SRobert Watson 
134718c8510SRobert Watson 	ar = currecord();
135718c8510SRobert Watson 	if (ar == NULL)
136718c8510SRobert Watson 		return;
137718c8510SRobert Watson 
138718c8510SRobert Watson 	ar->k_ar.ar_arg_gid = gid;
139718c8510SRobert Watson 	ARG_SET_VALID(ar, ARG_GID);
140718c8510SRobert Watson }
141718c8510SRobert Watson 
142718c8510SRobert Watson void
143718c8510SRobert Watson audit_arg_uid(uid_t uid)
144718c8510SRobert Watson {
145718c8510SRobert Watson 	struct kaudit_record *ar;
146718c8510SRobert Watson 
147718c8510SRobert Watson 	ar = currecord();
148718c8510SRobert Watson 	if (ar == NULL)
149718c8510SRobert Watson 		return;
150718c8510SRobert Watson 
151718c8510SRobert Watson 	ar->k_ar.ar_arg_uid = uid;
152718c8510SRobert Watson 	ARG_SET_VALID(ar, ARG_UID);
153718c8510SRobert Watson }
154718c8510SRobert Watson 
155718c8510SRobert Watson void
156718c8510SRobert Watson audit_arg_egid(gid_t egid)
157718c8510SRobert Watson {
158718c8510SRobert Watson 	struct kaudit_record *ar;
159718c8510SRobert Watson 
160718c8510SRobert Watson 	ar = currecord();
161718c8510SRobert Watson 	if (ar == NULL)
162718c8510SRobert Watson 		return;
163718c8510SRobert Watson 
164718c8510SRobert Watson 	ar->k_ar.ar_arg_egid = egid;
165718c8510SRobert Watson 	ARG_SET_VALID(ar, ARG_EGID);
166718c8510SRobert Watson }
167718c8510SRobert Watson 
168718c8510SRobert Watson void
169718c8510SRobert Watson audit_arg_euid(uid_t euid)
170718c8510SRobert Watson {
171718c8510SRobert Watson 	struct kaudit_record *ar;
172718c8510SRobert Watson 
173718c8510SRobert Watson 	ar = currecord();
174718c8510SRobert Watson 	if (ar == NULL)
175718c8510SRobert Watson 		return;
176718c8510SRobert Watson 
177718c8510SRobert Watson 	ar->k_ar.ar_arg_euid = euid;
178718c8510SRobert Watson 	ARG_SET_VALID(ar, ARG_EUID);
179718c8510SRobert Watson }
180718c8510SRobert Watson 
181718c8510SRobert Watson void
182718c8510SRobert Watson audit_arg_rgid(gid_t rgid)
183718c8510SRobert Watson {
184718c8510SRobert Watson 	struct kaudit_record *ar;
185718c8510SRobert Watson 
186718c8510SRobert Watson 	ar = currecord();
187718c8510SRobert Watson 	if (ar == NULL)
188718c8510SRobert Watson 		return;
189718c8510SRobert Watson 
190718c8510SRobert Watson 	ar->k_ar.ar_arg_rgid = rgid;
191718c8510SRobert Watson 	ARG_SET_VALID(ar, ARG_RGID);
192718c8510SRobert Watson }
193718c8510SRobert Watson 
194718c8510SRobert Watson void
195718c8510SRobert Watson audit_arg_ruid(uid_t ruid)
196718c8510SRobert Watson {
197718c8510SRobert Watson 	struct kaudit_record *ar;
198718c8510SRobert Watson 
199718c8510SRobert Watson 	ar = currecord();
200718c8510SRobert Watson 	if (ar == NULL)
201718c8510SRobert Watson 		return;
202718c8510SRobert Watson 
203718c8510SRobert Watson 	ar->k_ar.ar_arg_ruid = ruid;
204718c8510SRobert Watson 	ARG_SET_VALID(ar, ARG_RUID);
205718c8510SRobert Watson }
206718c8510SRobert Watson 
207718c8510SRobert Watson void
208718c8510SRobert Watson audit_arg_sgid(gid_t sgid)
209718c8510SRobert Watson {
210718c8510SRobert Watson 	struct kaudit_record *ar;
211718c8510SRobert Watson 
212718c8510SRobert Watson 	ar = currecord();
213718c8510SRobert Watson 	if (ar == NULL)
214718c8510SRobert Watson 		return;
215718c8510SRobert Watson 
216718c8510SRobert Watson 	ar->k_ar.ar_arg_sgid = sgid;
217718c8510SRobert Watson 	ARG_SET_VALID(ar, ARG_SGID);
218718c8510SRobert Watson }
219718c8510SRobert Watson 
220718c8510SRobert Watson void
221718c8510SRobert Watson audit_arg_suid(uid_t suid)
222718c8510SRobert Watson {
223718c8510SRobert Watson 	struct kaudit_record *ar;
224718c8510SRobert Watson 
225718c8510SRobert Watson 	ar = currecord();
226718c8510SRobert Watson 	if (ar == NULL)
227718c8510SRobert Watson 		return;
228718c8510SRobert Watson 
229718c8510SRobert Watson 	ar->k_ar.ar_arg_suid = suid;
230718c8510SRobert Watson 	ARG_SET_VALID(ar, ARG_SUID);
231718c8510SRobert Watson }
232718c8510SRobert Watson 
233718c8510SRobert Watson void
234718c8510SRobert Watson audit_arg_groupset(gid_t *gidset, u_int gidset_size)
235718c8510SRobert Watson {
236718c8510SRobert Watson 	int i;
237718c8510SRobert Watson 	struct kaudit_record *ar;
238718c8510SRobert Watson 
239718c8510SRobert Watson 	ar = currecord();
240718c8510SRobert Watson 	if (ar == NULL)
241718c8510SRobert Watson 		return;
242718c8510SRobert Watson 
243718c8510SRobert Watson 	for (i = 0; i < gidset_size; i++)
244718c8510SRobert Watson 		ar->k_ar.ar_arg_groups.gidset[i] = gidset[i];
245718c8510SRobert Watson 	ar->k_ar.ar_arg_groups.gidset_size = gidset_size;
246718c8510SRobert Watson 	ARG_SET_VALID(ar, ARG_GROUPSET);
247718c8510SRobert Watson }
248718c8510SRobert Watson 
249718c8510SRobert Watson void
250718c8510SRobert Watson audit_arg_login(char *login)
251718c8510SRobert Watson {
252718c8510SRobert Watson 	struct kaudit_record *ar;
253718c8510SRobert Watson 
254718c8510SRobert Watson 	ar = currecord();
255718c8510SRobert Watson 	if (ar == NULL)
256718c8510SRobert Watson 		return;
257718c8510SRobert Watson 
258718c8510SRobert Watson 	strlcpy(ar->k_ar.ar_arg_login, login, MAXLOGNAME);
259718c8510SRobert Watson 	ARG_SET_VALID(ar, ARG_LOGIN);
260718c8510SRobert Watson }
261718c8510SRobert Watson 
262718c8510SRobert Watson void
263718c8510SRobert Watson audit_arg_ctlname(int *name, int namelen)
264718c8510SRobert Watson {
265718c8510SRobert Watson 	struct kaudit_record *ar;
266718c8510SRobert Watson 
267718c8510SRobert Watson 	ar = currecord();
268718c8510SRobert Watson 	if (ar == NULL)
269718c8510SRobert Watson 		return;
270718c8510SRobert Watson 
271718c8510SRobert Watson 	bcopy(name, &ar->k_ar.ar_arg_ctlname, namelen * sizeof(int));
272718c8510SRobert Watson 	ar->k_ar.ar_arg_len = namelen;
273718c8510SRobert Watson 	ARG_SET_VALID(ar, ARG_CTLNAME | ARG_LEN);
274718c8510SRobert Watson }
275718c8510SRobert Watson 
276718c8510SRobert Watson void
277718c8510SRobert Watson audit_arg_mask(int mask)
278718c8510SRobert Watson {
279718c8510SRobert Watson 	struct kaudit_record *ar;
280718c8510SRobert Watson 
281718c8510SRobert Watson 	ar = currecord();
282718c8510SRobert Watson 	if (ar == NULL)
283718c8510SRobert Watson 		return;
284718c8510SRobert Watson 
285718c8510SRobert Watson 	ar->k_ar.ar_arg_mask = mask;
286718c8510SRobert Watson 	ARG_SET_VALID(ar, ARG_MASK);
287718c8510SRobert Watson }
288718c8510SRobert Watson 
289718c8510SRobert Watson void
290718c8510SRobert Watson audit_arg_mode(mode_t mode)
291718c8510SRobert Watson {
292718c8510SRobert Watson 	struct kaudit_record *ar;
293718c8510SRobert Watson 
294718c8510SRobert Watson 	ar = currecord();
295718c8510SRobert Watson 	if (ar == NULL)
296718c8510SRobert Watson 		return;
297718c8510SRobert Watson 
298718c8510SRobert Watson 	ar->k_ar.ar_arg_mode = mode;
299718c8510SRobert Watson 	ARG_SET_VALID(ar, ARG_MODE);
300718c8510SRobert Watson }
301718c8510SRobert Watson 
302718c8510SRobert Watson void
303718c8510SRobert Watson audit_arg_dev(int dev)
304718c8510SRobert Watson {
305718c8510SRobert Watson 	struct kaudit_record *ar;
306718c8510SRobert Watson 
307718c8510SRobert Watson 	ar = currecord();
308718c8510SRobert Watson 	if (ar == NULL)
309718c8510SRobert Watson 		return;
310718c8510SRobert Watson 
311718c8510SRobert Watson 	ar->k_ar.ar_arg_dev = dev;
312718c8510SRobert Watson 	ARG_SET_VALID(ar, ARG_DEV);
313718c8510SRobert Watson }
314718c8510SRobert Watson 
315718c8510SRobert Watson void
316718c8510SRobert Watson audit_arg_value(long value)
317718c8510SRobert Watson {
318718c8510SRobert Watson 	struct kaudit_record *ar;
319718c8510SRobert Watson 
320718c8510SRobert Watson 	ar = currecord();
321718c8510SRobert Watson 	if (ar == NULL)
322718c8510SRobert Watson 		return;
323718c8510SRobert Watson 
324718c8510SRobert Watson 	ar->k_ar.ar_arg_value = value;
325718c8510SRobert Watson 	ARG_SET_VALID(ar, ARG_VALUE);
326718c8510SRobert Watson }
327718c8510SRobert Watson 
328718c8510SRobert Watson void
329718c8510SRobert Watson audit_arg_owner(uid_t uid, gid_t gid)
330718c8510SRobert Watson {
331718c8510SRobert Watson 	struct kaudit_record *ar;
332718c8510SRobert Watson 
333718c8510SRobert Watson 	ar = currecord();
334718c8510SRobert Watson 	if (ar == NULL)
335718c8510SRobert Watson 		return;
336718c8510SRobert Watson 
337718c8510SRobert Watson 	ar->k_ar.ar_arg_uid = uid;
338718c8510SRobert Watson 	ar->k_ar.ar_arg_gid = gid;
339718c8510SRobert Watson 	ARG_SET_VALID(ar, ARG_UID | ARG_GID);
340718c8510SRobert Watson }
341718c8510SRobert Watson 
342718c8510SRobert Watson void
343718c8510SRobert Watson audit_arg_pid(pid_t pid)
344718c8510SRobert Watson {
345718c8510SRobert Watson 	struct kaudit_record *ar;
346718c8510SRobert Watson 
347718c8510SRobert Watson 	ar = currecord();
348718c8510SRobert Watson 	if (ar == NULL)
349718c8510SRobert Watson 		return;
350718c8510SRobert Watson 
351718c8510SRobert Watson 	ar->k_ar.ar_arg_pid = pid;
352718c8510SRobert Watson 	ARG_SET_VALID(ar, ARG_PID);
353718c8510SRobert Watson }
354718c8510SRobert Watson 
355718c8510SRobert Watson void
356718c8510SRobert Watson audit_arg_process(struct proc *p)
357718c8510SRobert Watson {
358718c8510SRobert Watson 	struct kaudit_record *ar;
359718c8510SRobert Watson 
360814fe9e9SRobert Watson 	KASSERT(p != NULL, ("audit_arg_process: p == NULL"));
361814fe9e9SRobert Watson 
362814fe9e9SRobert Watson 	PROC_LOCK_ASSERT(p, MA_OWNED);
363814fe9e9SRobert Watson 
364718c8510SRobert Watson 	ar = currecord();
365814fe9e9SRobert Watson 	if (ar == NULL)
366718c8510SRobert Watson 		return;
367718c8510SRobert Watson 
368718c8510SRobert Watson 	ar->k_ar.ar_arg_auid = p->p_au->ai_auid;
369718c8510SRobert Watson 	ar->k_ar.ar_arg_euid = p->p_ucred->cr_uid;
370718c8510SRobert Watson 	ar->k_ar.ar_arg_egid = p->p_ucred->cr_groups[0];
371718c8510SRobert Watson 	ar->k_ar.ar_arg_ruid = p->p_ucred->cr_ruid;
372718c8510SRobert Watson 	ar->k_ar.ar_arg_rgid = p->p_ucred->cr_rgid;
373718c8510SRobert Watson 	ar->k_ar.ar_arg_asid = p->p_au->ai_asid;
374718c8510SRobert Watson 	ar->k_ar.ar_arg_termid = p->p_au->ai_termid;
3755619113cSRobert Watson 	ar->k_ar.ar_arg_pid = p->p_pid;
376718c8510SRobert Watson 	ARG_SET_VALID(ar, ARG_AUID | ARG_EUID | ARG_EGID | ARG_RUID |
3775619113cSRobert Watson 	    ARG_RGID | ARG_ASID | ARG_TERMID | ARG_PID | ARG_PROCESS);
378718c8510SRobert Watson }
379718c8510SRobert Watson 
380718c8510SRobert Watson void
381718c8510SRobert Watson audit_arg_signum(u_int signum)
382718c8510SRobert Watson {
383718c8510SRobert Watson 	struct kaudit_record *ar;
384718c8510SRobert Watson 
385718c8510SRobert Watson 	ar = currecord();
386718c8510SRobert Watson 	if (ar == NULL)
387718c8510SRobert Watson 		return;
388718c8510SRobert Watson 
389718c8510SRobert Watson 	ar->k_ar.ar_arg_signum = signum;
390718c8510SRobert Watson 	ARG_SET_VALID(ar, ARG_SIGNUM);
391718c8510SRobert Watson }
392718c8510SRobert Watson 
393718c8510SRobert Watson void
394718c8510SRobert Watson audit_arg_socket(int sodomain, int sotype, int soprotocol)
395718c8510SRobert Watson {
396718c8510SRobert Watson 	struct kaudit_record *ar;
397718c8510SRobert Watson 
398718c8510SRobert Watson 	ar = currecord();
399718c8510SRobert Watson 	if (ar == NULL)
400718c8510SRobert Watson 		return;
401718c8510SRobert Watson 
402718c8510SRobert Watson 	ar->k_ar.ar_arg_sockinfo.so_domain = sodomain;
403718c8510SRobert Watson 	ar->k_ar.ar_arg_sockinfo.so_type = sotype;
404718c8510SRobert Watson 	ar->k_ar.ar_arg_sockinfo.so_protocol = soprotocol;
405718c8510SRobert Watson 	ARG_SET_VALID(ar, ARG_SOCKINFO);
406718c8510SRobert Watson }
407718c8510SRobert Watson 
408718c8510SRobert Watson void
409814fe9e9SRobert Watson audit_arg_sockaddr(struct thread *td, struct sockaddr *sa)
410718c8510SRobert Watson {
411718c8510SRobert Watson 	struct kaudit_record *ar;
412718c8510SRobert Watson 
413814fe9e9SRobert Watson 	KASSERT(td != NULL, ("audit_arg_sockaddr: td == NULL"));
414814fe9e9SRobert Watson 	KASSERT(sa != NULL, ("audit_arg_sockaddr: sa == NULL"));
415814fe9e9SRobert Watson 
416718c8510SRobert Watson 	ar = currecord();
417814fe9e9SRobert Watson 	if (ar == NULL)
418718c8510SRobert Watson 		return;
419718c8510SRobert Watson 
420814fe9e9SRobert Watson 	bcopy(sa, &ar->k_ar.ar_arg_sockaddr,
421814fe9e9SRobert Watson 	    sizeof(ar->k_ar.ar_arg_sockaddr));
422814fe9e9SRobert Watson 	switch (sa->sa_family) {
423718c8510SRobert Watson 	case AF_INET:
424718c8510SRobert Watson 		ARG_SET_VALID(ar, ARG_SADDRINET);
425718c8510SRobert Watson 		break;
426718c8510SRobert Watson 
427718c8510SRobert Watson 	case AF_INET6:
428718c8510SRobert Watson 		ARG_SET_VALID(ar, ARG_SADDRINET6);
429718c8510SRobert Watson 		break;
430718c8510SRobert Watson 
431718c8510SRobert Watson 	case AF_UNIX:
432814fe9e9SRobert Watson 		audit_arg_upath(td, ((struct sockaddr_un *)sa)->sun_path,
433718c8510SRobert Watson 				ARG_UPATH1);
434718c8510SRobert Watson 		ARG_SET_VALID(ar, ARG_SADDRUNIX);
435718c8510SRobert Watson 		break;
436718c8510SRobert Watson 	/* XXXAUDIT: default:? */
437718c8510SRobert Watson 	}
438718c8510SRobert Watson }
439718c8510SRobert Watson 
440718c8510SRobert Watson void
441718c8510SRobert Watson audit_arg_auid(uid_t auid)
442718c8510SRobert Watson {
443718c8510SRobert Watson 	struct kaudit_record *ar;
444718c8510SRobert Watson 
445718c8510SRobert Watson 	ar = currecord();
446718c8510SRobert Watson 	if (ar == NULL)
447718c8510SRobert Watson 		return;
448718c8510SRobert Watson 
449718c8510SRobert Watson 	ar->k_ar.ar_arg_auid = auid;
450718c8510SRobert Watson 	ARG_SET_VALID(ar, ARG_AUID);
451718c8510SRobert Watson }
452718c8510SRobert Watson 
453718c8510SRobert Watson void
454718c8510SRobert Watson audit_arg_auditinfo(struct auditinfo *au_info)
455718c8510SRobert Watson {
456718c8510SRobert Watson 	struct kaudit_record *ar;
457718c8510SRobert Watson 
458718c8510SRobert Watson 	ar = currecord();
459718c8510SRobert Watson 	if (ar == NULL)
460718c8510SRobert Watson 		return;
461718c8510SRobert Watson 
462718c8510SRobert Watson 	ar->k_ar.ar_arg_auid = au_info->ai_auid;
463718c8510SRobert Watson 	ar->k_ar.ar_arg_asid = au_info->ai_asid;
464718c8510SRobert Watson 	ar->k_ar.ar_arg_amask.am_success = au_info->ai_mask.am_success;
465718c8510SRobert Watson 	ar->k_ar.ar_arg_amask.am_failure = au_info->ai_mask.am_failure;
466718c8510SRobert Watson 	ar->k_ar.ar_arg_termid.port = au_info->ai_termid.port;
467718c8510SRobert Watson 	ar->k_ar.ar_arg_termid.machine = au_info->ai_termid.machine;
468718c8510SRobert Watson 	ARG_SET_VALID(ar, ARG_AUID | ARG_ASID | ARG_AMASK | ARG_TERMID);
469718c8510SRobert Watson }
470718c8510SRobert Watson 
471718c8510SRobert Watson void
472718c8510SRobert Watson audit_arg_text(char *text)
473718c8510SRobert Watson {
474718c8510SRobert Watson 	struct kaudit_record *ar;
475718c8510SRobert Watson 
476814fe9e9SRobert Watson 	KASSERT(text != NULL, ("audit_arg_text: text == NULL"));
477814fe9e9SRobert Watson 
478718c8510SRobert Watson 	ar = currecord();
479718c8510SRobert Watson 	if (ar == NULL)
480718c8510SRobert Watson 		return;
481718c8510SRobert Watson 
482718c8510SRobert Watson 	/* Invalidate the text string */
483718c8510SRobert Watson 	ar->k_ar.ar_valid_arg &= (ARG_ALL ^ ARG_TEXT);
484718c8510SRobert Watson 
485718c8510SRobert Watson 	if (ar->k_ar.ar_arg_text == NULL)
486718c8510SRobert Watson 		ar->k_ar.ar_arg_text = malloc(MAXPATHLEN, M_AUDITTEXT,
487718c8510SRobert Watson 		    M_WAITOK);
488718c8510SRobert Watson 
489718c8510SRobert Watson 	strncpy(ar->k_ar.ar_arg_text, text, MAXPATHLEN);
490718c8510SRobert Watson 	ARG_SET_VALID(ar, ARG_TEXT);
491718c8510SRobert Watson }
492718c8510SRobert Watson 
493718c8510SRobert Watson void
494718c8510SRobert Watson audit_arg_cmd(int cmd)
495718c8510SRobert Watson {
496718c8510SRobert Watson 	struct kaudit_record *ar;
497718c8510SRobert Watson 
498718c8510SRobert Watson 	ar = currecord();
499718c8510SRobert Watson 	if (ar == NULL)
500718c8510SRobert Watson 		return;
501718c8510SRobert Watson 
502718c8510SRobert Watson 	ar->k_ar.ar_arg_cmd = cmd;
503718c8510SRobert Watson 	ARG_SET_VALID(ar, ARG_CMD);
504718c8510SRobert Watson }
505718c8510SRobert Watson 
506718c8510SRobert Watson void
507718c8510SRobert Watson audit_arg_svipc_cmd(int cmd)
508718c8510SRobert Watson {
509718c8510SRobert Watson 	struct kaudit_record *ar;
510718c8510SRobert Watson 
511718c8510SRobert Watson 	ar = currecord();
512718c8510SRobert Watson 	if (ar == NULL)
513718c8510SRobert Watson 		return;
514718c8510SRobert Watson 
515718c8510SRobert Watson 	ar->k_ar.ar_arg_svipc_cmd = cmd;
516718c8510SRobert Watson 	ARG_SET_VALID(ar, ARG_SVIPC_CMD);
517718c8510SRobert Watson }
518718c8510SRobert Watson 
519718c8510SRobert Watson void
520718c8510SRobert Watson audit_arg_svipc_perm(struct ipc_perm *perm)
521718c8510SRobert Watson {
522718c8510SRobert Watson 	struct kaudit_record *ar;
523718c8510SRobert Watson 
524718c8510SRobert Watson 	ar = currecord();
525718c8510SRobert Watson 	if (ar == NULL)
526718c8510SRobert Watson 		return;
527718c8510SRobert Watson 
528718c8510SRobert Watson 	bcopy(perm, &ar->k_ar.ar_arg_svipc_perm,
529718c8510SRobert Watson 	    sizeof(ar->k_ar.ar_arg_svipc_perm));
530718c8510SRobert Watson 	ARG_SET_VALID(ar, ARG_SVIPC_PERM);
531718c8510SRobert Watson }
532718c8510SRobert Watson 
533718c8510SRobert Watson void
534718c8510SRobert Watson audit_arg_svipc_id(int id)
535718c8510SRobert Watson {
536718c8510SRobert Watson 	struct kaudit_record *ar;
537718c8510SRobert Watson 
538718c8510SRobert Watson 	ar = currecord();
539718c8510SRobert Watson 	if (ar == NULL)
540718c8510SRobert Watson 		return;
541718c8510SRobert Watson 
542718c8510SRobert Watson 	ar->k_ar.ar_arg_svipc_id = id;
543718c8510SRobert Watson 	ARG_SET_VALID(ar, ARG_SVIPC_ID);
544718c8510SRobert Watson }
545718c8510SRobert Watson 
546718c8510SRobert Watson void
547718c8510SRobert Watson audit_arg_svipc_addr(void * addr)
548718c8510SRobert Watson {
549718c8510SRobert Watson 	struct kaudit_record *ar;
550718c8510SRobert Watson 
551718c8510SRobert Watson 	ar = currecord();
552718c8510SRobert Watson 	if (ar == NULL)
553718c8510SRobert Watson 		return;
554718c8510SRobert Watson 
555718c8510SRobert Watson 	ar->k_ar.ar_arg_svipc_addr = addr;
556718c8510SRobert Watson 	ARG_SET_VALID(ar, ARG_SVIPC_ADDR);
557718c8510SRobert Watson }
558718c8510SRobert Watson 
559718c8510SRobert Watson void
560718c8510SRobert Watson audit_arg_posix_ipc_perm(uid_t uid, gid_t gid, mode_t mode)
561718c8510SRobert Watson {
562718c8510SRobert Watson 	struct kaudit_record *ar;
563718c8510SRobert Watson 
564718c8510SRobert Watson 	ar = currecord();
565718c8510SRobert Watson 	if (ar == NULL)
566718c8510SRobert Watson 		return;
567718c8510SRobert Watson 
568718c8510SRobert Watson 	ar->k_ar.ar_arg_pipc_perm.pipc_uid = uid;
569718c8510SRobert Watson 	ar->k_ar.ar_arg_pipc_perm.pipc_gid = gid;
570718c8510SRobert Watson 	ar->k_ar.ar_arg_pipc_perm.pipc_mode = mode;
571718c8510SRobert Watson 	ARG_SET_VALID(ar, ARG_POSIX_IPC_PERM);
572718c8510SRobert Watson }
573718c8510SRobert Watson 
574718c8510SRobert Watson void
575718c8510SRobert Watson audit_arg_auditon(union auditon_udata *udata)
576718c8510SRobert Watson {
577718c8510SRobert Watson 	struct kaudit_record *ar;
578718c8510SRobert Watson 
579718c8510SRobert Watson 	ar = currecord();
580718c8510SRobert Watson 	if (ar == NULL)
581718c8510SRobert Watson 		return;
582718c8510SRobert Watson 
583718c8510SRobert Watson 	bcopy((void *)udata, &ar->k_ar.ar_arg_auditon,
584718c8510SRobert Watson 	    sizeof(ar->k_ar.ar_arg_auditon));
585718c8510SRobert Watson 	ARG_SET_VALID(ar, ARG_AUDITON);
586718c8510SRobert Watson }
587718c8510SRobert Watson 
588718c8510SRobert Watson /*
589718c8510SRobert Watson  * Audit information about a file, either the file's vnode info, or its
590718c8510SRobert Watson  * socket address info.
591718c8510SRobert Watson  */
592718c8510SRobert Watson void
593718c8510SRobert Watson audit_arg_file(struct proc *p, struct file *fp)
594718c8510SRobert Watson {
595718c8510SRobert Watson 	struct kaudit_record *ar;
596718c8510SRobert Watson 	struct socket *so;
597718c8510SRobert Watson 	struct inpcb *pcb;
598718c8510SRobert Watson 	struct vnode *vp;
599718c8510SRobert Watson 	int vfslocked;
600718c8510SRobert Watson 
601814fe9e9SRobert Watson 	ar = currecord();
602814fe9e9SRobert Watson 	if (ar == NULL)
603814fe9e9SRobert Watson 		return;
604814fe9e9SRobert Watson 
605718c8510SRobert Watson 	switch (fp->f_type) {
606718c8510SRobert Watson 	case DTYPE_VNODE:
607718c8510SRobert Watson 	case DTYPE_FIFO:
608718c8510SRobert Watson 		/*
609718c8510SRobert Watson 		 * XXXAUDIT: Only possibly to record as first vnode?
610718c8510SRobert Watson 		 */
611718c8510SRobert Watson 		vp = fp->f_vnode;
612718c8510SRobert Watson 		vfslocked = VFS_LOCK_GIANT(vp->v_mount);
613718c8510SRobert Watson 		vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, curthread);
614718c8510SRobert Watson 		audit_arg_vnode(vp, ARG_VNODE1);
615718c8510SRobert Watson 		VOP_UNLOCK(vp, 0, curthread);
616718c8510SRobert Watson 		VFS_UNLOCK_GIANT(vfslocked);
617718c8510SRobert Watson 		break;
618718c8510SRobert Watson 
619718c8510SRobert Watson 	case DTYPE_SOCKET:
620718c8510SRobert Watson 		so = (struct socket *)fp->f_data;
621814fe9e9SRobert Watson 		SOCK_LOCK(so);
622718c8510SRobert Watson 		if (INP_CHECK_SOCKAF(so, PF_INET)) {
623718c8510SRobert Watson 			if (so->so_pcb == NULL)
624718c8510SRobert Watson 				return;
625718c8510SRobert Watson 			ar->k_ar.ar_arg_sockinfo.so_type =
626718c8510SRobert Watson 			    so->so_type;
627718c8510SRobert Watson 			ar->k_ar.ar_arg_sockinfo.so_domain =
628718c8510SRobert Watson 			    INP_SOCKAF(so);
629718c8510SRobert Watson 			ar->k_ar.ar_arg_sockinfo.so_protocol =
630718c8510SRobert Watson 			    so->so_proto->pr_protocol;
631718c8510SRobert Watson 			pcb = (struct inpcb *)so->so_pcb;
632718c8510SRobert Watson 			ar->k_ar.ar_arg_sockinfo.so_raddr =
633718c8510SRobert Watson 			    pcb->inp_faddr.s_addr;
634718c8510SRobert Watson 			ar->k_ar.ar_arg_sockinfo.so_laddr =
635718c8510SRobert Watson 			    pcb->inp_laddr.s_addr;
636718c8510SRobert Watson 			ar->k_ar.ar_arg_sockinfo.so_rport =
637718c8510SRobert Watson 			    pcb->inp_fport;
638718c8510SRobert Watson 			ar->k_ar.ar_arg_sockinfo.so_lport =
639718c8510SRobert Watson 			    pcb->inp_lport;
640718c8510SRobert Watson 			ARG_SET_VALID(ar, ARG_SOCKINFO);
641718c8510SRobert Watson 		}
642814fe9e9SRobert Watson 		SOCK_UNLOCK(so);
643718c8510SRobert Watson 		break;
644718c8510SRobert Watson 
645718c8510SRobert Watson 	default:
646718c8510SRobert Watson 		/* XXXAUDIT: else? */
647718c8510SRobert Watson 		break;
648718c8510SRobert Watson 	}
649718c8510SRobert Watson 
650718c8510SRobert Watson }
651718c8510SRobert Watson 
652718c8510SRobert Watson /*
653718c8510SRobert Watson  * Store a path as given by the user process for auditing into the audit
654871499feSRobert Watson  * record stored on the user thread. This function will allocate the memory
655871499feSRobert Watson  * to store the path info if not already available. This memory will be freed
656871499feSRobert Watson  * when the audit record is freed.
657718c8510SRobert Watson  *
658718c8510SRobert Watson  * XXXAUDIT: Possibly assert that the memory isn't already allocated?
659718c8510SRobert Watson  */
660718c8510SRobert Watson void
661718c8510SRobert Watson audit_arg_upath(struct thread *td, char *upath, u_int64_t flag)
662718c8510SRobert Watson {
663718c8510SRobert Watson 	struct kaudit_record *ar;
664718c8510SRobert Watson 	char **pathp;
665718c8510SRobert Watson 
666814fe9e9SRobert Watson 	KASSERT(td != NULL, ("audit_arg_upath: td == NULL"));
667814fe9e9SRobert Watson 	KASSERT(upath != NULL, ("audit_arg_upath: upath == NULL"));
668814fe9e9SRobert Watson 
669814fe9e9SRobert Watson 	ar = currecord();
670814fe9e9SRobert Watson 	if (ar == NULL)
671814fe9e9SRobert Watson 		return;
672718c8510SRobert Watson 
673718c8510SRobert Watson 	/*
674718c8510SRobert Watson 	 * XXXAUDIT: Witness warning for possible sleep here?
675718c8510SRobert Watson 	 */
676718c8510SRobert Watson 	KASSERT((flag == ARG_UPATH1) || (flag == ARG_UPATH2),
677fac3e318SRobert Watson 	    ("audit_arg_upath: flag %llu", (unsigned long long)flag));
678718c8510SRobert Watson 	KASSERT((flag != ARG_UPATH1) || (flag != ARG_UPATH2),
679fac3e318SRobert Watson 	    ("audit_arg_upath: flag %llu", (unsigned long long)flag));
680718c8510SRobert Watson 
681718c8510SRobert Watson 	if (flag == ARG_UPATH1)
682718c8510SRobert Watson 		pathp = &ar->k_ar.ar_arg_upath1;
683718c8510SRobert Watson 	else
684718c8510SRobert Watson 		pathp = &ar->k_ar.ar_arg_upath2;
685718c8510SRobert Watson 
686718c8510SRobert Watson 	if (*pathp == NULL)
687718c8510SRobert Watson 		*pathp = malloc(MAXPATHLEN, M_AUDITPATH, M_WAITOK);
688718c8510SRobert Watson 
689718c8510SRobert Watson 	canon_path(td, upath, *pathp);
690718c8510SRobert Watson 
691718c8510SRobert Watson 	ARG_SET_VALID(ar, flag);
692718c8510SRobert Watson }
693718c8510SRobert Watson 
694718c8510SRobert Watson /*
695718c8510SRobert Watson  * Function to save the path and vnode attr information into the audit
696718c8510SRobert Watson  * record.
697718c8510SRobert Watson  *
698718c8510SRobert Watson  * It is assumed that the caller will hold any vnode locks necessary to
699718c8510SRobert Watson  * perform a VOP_GETATTR() on the passed vnode.
700718c8510SRobert Watson  *
701718c8510SRobert Watson  * XXX: The attr code is very similar to vfs_vnops.c:vn_stat(), but
702718c8510SRobert Watson  * always provides access to the generation number as we need that
703718c8510SRobert Watson  * to construct the BSM file ID.
704718c8510SRobert Watson  * XXX: We should accept the process argument from the caller, since
705718c8510SRobert Watson  * it's very likely they already have a reference.
706718c8510SRobert Watson  * XXX: Error handling in this function is poor.
707718c8510SRobert Watson  *
708718c8510SRobert Watson  * XXXAUDIT: Possibly KASSERT the path pointer is NULL?
709718c8510SRobert Watson  */
710718c8510SRobert Watson void
711718c8510SRobert Watson audit_arg_vnode(struct vnode *vp, u_int64_t flags)
712718c8510SRobert Watson {
713718c8510SRobert Watson 	struct kaudit_record *ar;
714718c8510SRobert Watson 	struct vattr vattr;
715718c8510SRobert Watson 	int error;
716718c8510SRobert Watson 	struct vnode_au_info *vnp;
717718c8510SRobert Watson 
718814fe9e9SRobert Watson 	KASSERT(vp != NULL, ("audit_arg_vnode: vp == NULL"));
719814fe9e9SRobert Watson 	KASSERT((flags == ARG_VNODE1) || (flags == ARG_VNODE2),
720814fe9e9SRobert Watson 	    ("audit_arg_vnode: flags %jd", (intmax_t)flags));
721718c8510SRobert Watson 
722718c8510SRobert Watson 	/*
723718c8510SRobert Watson 	 * Assume that if the caller is calling audit_arg_vnode() on a
724718c8510SRobert Watson 	 * non-MPSAFE vnode, then it will have acquired Giant.
725718c8510SRobert Watson 	 */
726718c8510SRobert Watson 	VFS_ASSERT_GIANT(vp->v_mount);
727718c8510SRobert Watson 	ASSERT_VOP_LOCKED(vp, "audit_arg_vnode");
728718c8510SRobert Watson 
729718c8510SRobert Watson 	ar = currecord();
730871499feSRobert Watson 	if (ar == NULL)
731718c8510SRobert Watson 		return;
732718c8510SRobert Watson 
733718c8510SRobert Watson 	/*
734718c8510SRobert Watson 	 * XXXAUDIT: The below clears, and then resets the flags for valid
735718c8510SRobert Watson 	 * arguments.  Ideally, either the new vnode is used, or the old one
736718c8510SRobert Watson 	 * would be.
737718c8510SRobert Watson 	 */
738718c8510SRobert Watson 	if (flags & ARG_VNODE1) {
739718c8510SRobert Watson 		ar->k_ar.ar_valid_arg &= (ARG_ALL ^ ARG_VNODE1);
740718c8510SRobert Watson 		vnp = &ar->k_ar.ar_arg_vnode1;
741718c8510SRobert Watson 	} else {
742718c8510SRobert Watson 		ar->k_ar.ar_valid_arg &= (ARG_ALL ^ ARG_VNODE2);
743718c8510SRobert Watson 		vnp = &ar->k_ar.ar_arg_vnode2;
744718c8510SRobert Watson 	}
745718c8510SRobert Watson 
746814fe9e9SRobert Watson 	error = VOP_GETATTR(vp, &vattr, curthread->td_ucred, curthread);
747718c8510SRobert Watson 	if (error) {
748718c8510SRobert Watson 		/* XXX: How to handle this case? */
749718c8510SRobert Watson 		return;
750718c8510SRobert Watson 	}
751718c8510SRobert Watson 
752718c8510SRobert Watson 	vnp->vn_mode = vattr.va_mode;
753718c8510SRobert Watson 	vnp->vn_uid = vattr.va_uid;
754718c8510SRobert Watson 	vnp->vn_gid = vattr.va_gid;
755718c8510SRobert Watson 	vnp->vn_dev = vattr.va_rdev;
756718c8510SRobert Watson 	vnp->vn_fsid = vattr.va_fsid;
757718c8510SRobert Watson 	vnp->vn_fileid = vattr.va_fileid;
758718c8510SRobert Watson 	vnp->vn_gen = vattr.va_gen;
759718c8510SRobert Watson 	if (flags & ARG_VNODE1)
760718c8510SRobert Watson 		ARG_SET_VALID(ar, ARG_VNODE1);
761718c8510SRobert Watson 	else
762718c8510SRobert Watson 		ARG_SET_VALID(ar, ARG_VNODE2);
763718c8510SRobert Watson }
764718c8510SRobert Watson 
765718c8510SRobert Watson /*
766ae1078d6SWayne Salamon  * Audit the argument strings passed to exec.
767ae1078d6SWayne Salamon  */
768ae1078d6SWayne Salamon void
769ae1078d6SWayne Salamon audit_arg_argv(char *argv, int argc, int length)
770ae1078d6SWayne Salamon {
771ae1078d6SWayne Salamon 	struct kaudit_record *ar;
772ae1078d6SWayne Salamon 
773ae1078d6SWayne Salamon 	if (audit_argv == 0)
774ae1078d6SWayne Salamon 		return;
775ae1078d6SWayne Salamon 
776ae1078d6SWayne Salamon 	ar = currecord();
777ae1078d6SWayne Salamon 	if (ar == NULL)
778ae1078d6SWayne Salamon 		return;
779ae1078d6SWayne Salamon 
780ae1078d6SWayne Salamon 	ar->k_ar.ar_arg_argv = malloc(length, M_AUDITTEXT, M_WAITOK);
781ae1078d6SWayne Salamon 	bcopy(argv, ar->k_ar.ar_arg_argv, length);
782ae1078d6SWayne Salamon 	ar->k_ar.ar_arg_argc = argc;
783ae1078d6SWayne Salamon 	ARG_SET_VALID(ar, ARG_ARGV);
784ae1078d6SWayne Salamon }
785ae1078d6SWayne Salamon 
786ae1078d6SWayne Salamon /*
787ae1078d6SWayne Salamon  * Audit the environment strings passed to exec.
788ae1078d6SWayne Salamon  */
789ae1078d6SWayne Salamon void
790ae1078d6SWayne Salamon audit_arg_envv(char *envv, int envc, int length)
791ae1078d6SWayne Salamon {
792ae1078d6SWayne Salamon 	struct kaudit_record *ar;
793ae1078d6SWayne Salamon 
794ae1078d6SWayne Salamon 	if (audit_arge == 0)
795ae1078d6SWayne Salamon 		return;
796ae1078d6SWayne Salamon 
797ae1078d6SWayne Salamon 	ar = currecord();
798ae1078d6SWayne Salamon 	if (ar == NULL)
799ae1078d6SWayne Salamon 		return;
800ae1078d6SWayne Salamon 
801ae1078d6SWayne Salamon 	ar->k_ar.ar_arg_envv = malloc(length, M_AUDITTEXT, M_WAITOK);
802ae1078d6SWayne Salamon 	bcopy(envv, ar->k_ar.ar_arg_envv, length);
803ae1078d6SWayne Salamon 	ar->k_ar.ar_arg_envc = envc;
804ae1078d6SWayne Salamon 	ARG_SET_VALID(ar, ARG_ENVV);
805ae1078d6SWayne Salamon }
806ae1078d6SWayne Salamon 
807ae1078d6SWayne Salamon /*
808871499feSRobert Watson  * The close() system call uses it's own audit call to capture the path/vnode
809871499feSRobert Watson  * information because those pieces are not easily obtained within the system
810871499feSRobert Watson  * call itself.
811718c8510SRobert Watson  */
812718c8510SRobert Watson void
813718c8510SRobert Watson audit_sysclose(struct thread *td, int fd)
814718c8510SRobert Watson {
815814fe9e9SRobert Watson 	struct kaudit_record *ar;
816718c8510SRobert Watson 	struct vnode *vp;
817718c8510SRobert Watson 	struct file *fp;
818718c8510SRobert Watson 	int vfslocked;
819718c8510SRobert Watson 
820814fe9e9SRobert Watson 	KASSERT(td != NULL, ("audit_sysclose: td == NULL"));
821814fe9e9SRobert Watson 
822814fe9e9SRobert Watson 	ar = currecord();
823814fe9e9SRobert Watson 	if (ar == NULL)
824814fe9e9SRobert Watson 		return;
825814fe9e9SRobert Watson 
826718c8510SRobert Watson 	audit_arg_fd(fd);
827718c8510SRobert Watson 
828718c8510SRobert Watson 	if (getvnode(td->td_proc->p_fd, fd, &fp) != 0)
829718c8510SRobert Watson 		return;
830718c8510SRobert Watson 
831718c8510SRobert Watson 	vp = fp->f_vnode;
832718c8510SRobert Watson 	vfslocked = VFS_LOCK_GIANT(vp->v_mount);
833718c8510SRobert Watson 	vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td);
834718c8510SRobert Watson 	audit_arg_vnode(vp, ARG_VNODE1);
835718c8510SRobert Watson 	VOP_UNLOCK(vp, 0, td);
836718c8510SRobert Watson 	VFS_UNLOCK_GIANT(vfslocked);
837718c8510SRobert Watson 	fdrop(fp, td);
838718c8510SRobert Watson }
839