xref: /freebsd/sys/security/audit/audit_bsm.c (revision 1e413cf93298b5b97441a21d9a50fdcd0ee9945e)
1 /*
2  * Copyright (c) 1999-2005 Apple Computer, Inc.
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1.  Redistributions of source code must retain the above copyright
9  *     notice, this list of conditions and the following disclaimer.
10  * 2.  Redistributions in binary form must reproduce the above copyright
11  *     notice, this list of conditions and the following disclaimer in the
12  *     documentation and/or other materials provided with the distribution.
13  * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
14  *     its contributors may be used to endorse or promote products derived
15  *     from this software without specific prior written permission.
16  *
17  * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND
18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20  * ARE DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR
21  * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
25  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
26  * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
27  * POSSIBILITY OF SUCH DAMAGE.
28  *
29  * $FreeBSD$
30  */
31 
32 #include <sys/param.h>
33 #include <sys/vnode.h>
34 #include <sys/ipc.h>
35 #include <sys/lock.h>
36 #include <sys/malloc.h>
37 #include <sys/mutex.h>
38 #include <sys/socket.h>
39 #include <sys/extattr.h>
40 #include <sys/fcntl.h>
41 #include <sys/user.h>
42 #include <sys/systm.h>
43 
44 #include <bsm/audit.h>
45 #include <bsm/audit_internal.h>
46 #include <bsm/audit_record.h>
47 #include <bsm/audit_kevents.h>
48 
49 #include <security/audit/audit.h>
50 #include <security/audit/audit_private.h>
51 
52 #include <netinet/in_systm.h>
53 #include <netinet/in.h>
54 #include <netinet/ip.h>
55 
56 MALLOC_DEFINE(M_AUDITBSM, "audit_bsm", "Audit BSM data");
57 
58 static void	audit_sys_auditon(struct audit_record *ar,
59 		    struct au_record *rec);
60 
61 /*
62  * Initialize the BSM auditing subsystem.
63  */
64 void
65 kau_init(void)
66 {
67 
68 	au_evclassmap_init();
69 }
70 
71 /*
72  * This call reserves memory for the audit record.  Memory must be guaranteed
73  * before any auditable event can be generated.  The au_record structure
74  * maintains a reference to the memory allocated above and also the list of
75  * tokens associated with this record
76  */
77 static struct au_record *
78 kau_open(void)
79 {
80 	struct au_record *rec;
81 
82 	rec = malloc(sizeof(*rec), M_AUDITBSM, M_WAITOK);
83 	rec->data = NULL;
84 	TAILQ_INIT(&rec->token_q);
85 	rec->len = 0;
86 	rec->used = 1;
87 
88 	return (rec);
89 }
90 
91 /*
92  * Store the token with the record descriptor.
93  */
94 static void
95 kau_write(struct au_record *rec, struct au_token *tok)
96 {
97 
98 	KASSERT(tok != NULL, ("kau_write: tok == NULL"));
99 
100 	TAILQ_INSERT_TAIL(&rec->token_q, tok, tokens);
101 	rec->len += tok->len;
102 }
103 
104 /*
105  * Close out the audit record by adding the header token, identifying any
106  * missing tokens.  Write out the tokens to the record memory.
107  */
108 static void
109 kau_close(struct au_record *rec, struct timespec *ctime, short event)
110 {
111 	u_char *dptr;
112 	size_t tot_rec_size;
113 	token_t *cur, *hdr, *trail;
114 	struct timeval tm;
115 
116 	tot_rec_size = rec->len + AUDIT_HEADER_SIZE + AUDIT_TRAILER_SIZE;
117 	rec->data = malloc(tot_rec_size, M_AUDITBSM, M_WAITOK | M_ZERO);
118 
119 	tm.tv_usec = ctime->tv_nsec / 1000;
120 	tm.tv_sec = ctime->tv_sec;
121 	hdr = au_to_header32_tm(tot_rec_size, event, 0, tm);
122 	TAILQ_INSERT_HEAD(&rec->token_q, hdr, tokens);
123 
124 	trail = au_to_trailer(tot_rec_size);
125 	TAILQ_INSERT_TAIL(&rec->token_q, trail, tokens);
126 
127 	rec->len = tot_rec_size;
128 	dptr = rec->data;
129 	TAILQ_FOREACH(cur, &rec->token_q, tokens) {
130 		memcpy(dptr, cur->t_data, cur->len);
131 		dptr += cur->len;
132 	}
133 }
134 
135 /*
136  * Free a BSM audit record by releasing all the tokens and clearing the audit
137  * record information.
138  */
139 void
140 kau_free(struct au_record *rec)
141 {
142 	struct au_token *tok;
143 
144 	/* Free the token list. */
145 	while ((tok = TAILQ_FIRST(&rec->token_q))) {
146 		TAILQ_REMOVE(&rec->token_q, tok, tokens);
147 		free(tok->t_data, M_AUDITBSM);
148 		free(tok, M_AUDITBSM);
149 	}
150 
151 	rec->used = 0;
152 	rec->len = 0;
153 	free(rec->data, M_AUDITBSM);
154 	free(rec, M_AUDITBSM);
155 }
156 
157 /*
158  * XXX: May want turn some (or all) of these macros into functions in order
159  * to reduce the generated code sized.
160  *
161  * XXXAUDIT: These macros assume that 'kar', 'ar', 'rec', and 'tok' in the
162  * caller are OK with this.
163  */
164 #define UPATH1_TOKENS do {						\
165 	if (ARG_IS_VALID(kar, ARG_UPATH1)) {				\
166 		tok = au_to_path(ar->ar_arg_upath1);			\
167 		kau_write(rec, tok);					\
168 	}								\
169 } while (0)
170 
171 #define UPATH2_TOKENS do {						\
172 	if (ARG_IS_VALID(kar, ARG_UPATH2)) {				\
173 		tok = au_to_path(ar->ar_arg_upath2);			\
174 		kau_write(rec, tok);					\
175 	}								\
176 } while (0)
177 
178 #define VNODE1_TOKENS do {						\
179 	if (ARG_IS_VALID(kar, ARG_VNODE1)) {  				\
180 		tok = au_to_attr32(&ar->ar_arg_vnode1);			\
181 		kau_write(rec, tok);					\
182 	}								\
183 } while (0)
184 
185 #define UPATH1_VNODE1_TOKENS do {					\
186 	if (ARG_IS_VALID(kar, ARG_UPATH1)) {  				\
187 		UPATH1_TOKENS;						\
188 	}								\
189 	if (ARG_IS_VALID(kar, ARG_VNODE1)) {  				\
190 		tok = au_to_attr32(&ar->ar_arg_vnode1);			\
191 		kau_write(rec, tok);					\
192 	}								\
193 } while (0)
194 
195 #define VNODE2_TOKENS do {						\
196 	if (ARG_IS_VALID(kar, ARG_VNODE2)) {  				\
197 		tok = au_to_attr32(&ar->ar_arg_vnode2);			\
198 		kau_write(rec, tok);					\
199 	}								\
200 } while (0)
201 
202 #define FD_VNODE1_TOKENS	do {					\
203 	if (ARG_IS_VALID(kar, ARG_VNODE1)) {				\
204 		if (ARG_IS_VALID(kar, ARG_FD)) {			\
205 			tok = au_to_arg32(1, "fd", ar->ar_arg_fd);	\
206 			kau_write(rec, tok);				\
207 		}							\
208 		tok = au_to_attr32(&ar->ar_arg_vnode1);			\
209 		kau_write(rec, tok);					\
210 	} else {							\
211 		if (ARG_IS_VALID(kar, ARG_FD)) {			\
212 			tok = au_to_arg32(1, "non-file: fd",		\
213 			    ar->ar_arg_fd);				\
214 			kau_write(rec, tok);				\
215 		}							\
216 	}								\
217 } while (0)
218 
219 #define PROCESS_PID_TOKENS(argn) do {					\
220 	if ((ar->ar_arg_pid > 0) /* Reference a single process */	\
221 	    && (ARG_IS_VALID(kar, ARG_PROCESS))) {			\
222 		tok = au_to_process32_ex(ar->ar_arg_auid,		\
223 		    ar->ar_arg_euid, ar->ar_arg_egid,			\
224 		    ar->ar_arg_ruid, ar->ar_arg_rgid,			\
225 		    ar->ar_arg_pid, ar->ar_arg_asid,			\
226 		    &ar->ar_arg_termid_addr);				\
227 		kau_write(rec, tok);					\
228 	} else if (ARG_IS_VALID(kar, ARG_PID)) {			\
229 		tok = au_to_arg32(argn, "process", ar->ar_arg_pid);	\
230 		kau_write(rec, tok);					\
231 	}								\
232 } while (0)								\
233 
234 #define EXTATTR_TOKENS	do {						\
235 	if (ARG_IS_VALID(kar, ARG_VALUE)) {				\
236 		switch (ar->ar_arg_value) {				\
237 		case EXTATTR_NAMESPACE_USER:				\
238 			tok = au_to_text(EXTATTR_NAMESPACE_USER_STRING);\
239 			break;						\
240 		case EXTATTR_NAMESPACE_SYSTEM:				\
241 			tok = au_to_text(EXTATTR_NAMESPACE_SYSTEM_STRING);\
242 			break;						\
243 		default:						\
244 			tok = au_to_arg32(3, "attrnamespace",		\
245 			    ar->ar_arg_value);				\
246 			break;						\
247 		}							\
248 		kau_write(rec, tok);					\
249 	}								\
250 	/* attrname is in the text field */				\
251 	if (ARG_IS_VALID(kar, ARG_TEXT)) {				\
252 		tok = au_to_text(ar->ar_arg_text);			\
253 		kau_write(rec, tok);					\
254 	}								\
255 } while (0)
256 
257 /*
258  * Implement auditing for the auditon() system call. The audit tokens that
259  * are generated depend on the command that was sent into the auditon()
260  * system call.
261  */
262 static void
263 audit_sys_auditon(struct audit_record *ar, struct au_record *rec)
264 {
265 	struct au_token *tok;
266 
267 	switch (ar->ar_arg_cmd) {
268 	case A_SETPOLICY:
269 		if (sizeof(ar->ar_arg_auditon.au_flags) > 4)
270 			tok = au_to_arg64(1, "policy",
271 			    ar->ar_arg_auditon.au_flags);
272 		else
273 			tok = au_to_arg32(1, "policy",
274 			    ar->ar_arg_auditon.au_flags);
275 		kau_write(rec, tok);
276 		break;
277 
278 	case A_SETKMASK:
279 		tok = au_to_arg32(2, "setkmask:as_success",
280 		    ar->ar_arg_auditon.au_mask.am_success);
281 		kau_write(rec, tok);
282 		tok = au_to_arg32(2, "setkmask:as_failure",
283 		    ar->ar_arg_auditon.au_mask.am_failure);
284 		kau_write(rec, tok);
285 		break;
286 
287 	case A_SETQCTRL:
288 		tok = au_to_arg32(3, "setqctrl:aq_hiwater",
289 		    ar->ar_arg_auditon.au_qctrl.aq_hiwater);
290 		kau_write(rec, tok);
291 		tok = au_to_arg32(3, "setqctrl:aq_lowater",
292 		    ar->ar_arg_auditon.au_qctrl.aq_lowater);
293 		kau_write(rec, tok);
294 		tok = au_to_arg32(3, "setqctrl:aq_bufsz",
295 		    ar->ar_arg_auditon.au_qctrl.aq_bufsz);
296 		kau_write(rec, tok);
297 		tok = au_to_arg32(3, "setqctrl:aq_delay",
298 		    ar->ar_arg_auditon.au_qctrl.aq_delay);
299 		kau_write(rec, tok);
300 		tok = au_to_arg32(3, "setqctrl:aq_minfree",
301 		    ar->ar_arg_auditon.au_qctrl.aq_minfree);
302 		kau_write(rec, tok);
303 		break;
304 
305 	case A_SETUMASK:
306 		tok = au_to_arg32(3, "setumask:as_success",
307 		    ar->ar_arg_auditon.au_auinfo.ai_mask.am_success);
308 		kau_write(rec, tok);
309 		tok = au_to_arg32(3, "setumask:as_failure",
310 		    ar->ar_arg_auditon.au_auinfo.ai_mask.am_failure);
311 		kau_write(rec, tok);
312 		break;
313 
314 	case A_SETSMASK:
315 		tok = au_to_arg32(3, "setsmask:as_success",
316 		    ar->ar_arg_auditon.au_auinfo.ai_mask.am_success);
317 		kau_write(rec, tok);
318 		tok = au_to_arg32(3, "setsmask:as_failure",
319 		    ar->ar_arg_auditon.au_auinfo.ai_mask.am_failure);
320 		kau_write(rec, tok);
321 		break;
322 
323 	case A_SETCOND:
324 		if (sizeof(ar->ar_arg_auditon.au_cond) > 4)
325 			tok = au_to_arg64(3, "setcond",
326 			    ar->ar_arg_auditon.au_cond);
327 		else
328 			tok = au_to_arg32(3, "setcond",
329 			    ar->ar_arg_auditon.au_cond);
330 		kau_write(rec, tok);
331 		break;
332 
333 	case A_SETCLASS:
334 		tok = au_to_arg32(2, "setclass:ec_event",
335 		    ar->ar_arg_auditon.au_evclass.ec_number);
336 		kau_write(rec, tok);
337 		tok = au_to_arg32(3, "setclass:ec_class",
338 		    ar->ar_arg_auditon.au_evclass.ec_class);
339 		kau_write(rec, tok);
340 		break;
341 
342 	case A_SETPMASK:
343 		tok = au_to_arg32(2, "setpmask:as_success",
344 		    ar->ar_arg_auditon.au_aupinfo.ap_mask.am_success);
345 		kau_write(rec, tok);
346 		tok = au_to_arg32(2, "setpmask:as_failure",
347 		    ar->ar_arg_auditon.au_aupinfo.ap_mask.am_failure);
348 		kau_write(rec, tok);
349 		break;
350 
351 	case A_SETFSIZE:
352 		tok = au_to_arg32(2, "setfsize:filesize",
353 		    ar->ar_arg_auditon.au_fstat.af_filesz);
354 		kau_write(rec, tok);
355 		break;
356 
357 	default:
358 		break;
359 	}
360 }
361 
362 /*
363  * Convert an internal kernel audit record to a BSM record and return a
364  * success/failure indicator. The BSM record is passed as an out parameter to
365  * this function.
366  *
367  * Return conditions:
368  *   BSM_SUCCESS: The BSM record is valid
369  *   BSM_FAILURE: Failure; the BSM record is NULL.
370  *   BSM_NOAUDIT: The event is not auditable for BSM; the BSM record is NULL.
371  */
372 int
373 kaudit_to_bsm(struct kaudit_record *kar, struct au_record **pau)
374 {
375 	struct au_token *tok, *subj_tok;
376 	struct au_record *rec;
377 	au_tid_t tid;
378 	struct audit_record *ar;
379 	int ctr;
380 
381 	KASSERT(kar != NULL, ("kaudit_to_bsm: kar == NULL"));
382 
383 	*pau = NULL;
384 	ar = &kar->k_ar;
385 	rec = kau_open();
386 
387 	/* Create the subject token */
388 	switch (ar->ar_subj_term_addr.at_type) {
389 	case AU_IPv4:
390 		tid.port = ar->ar_subj_term_addr.at_port;
391 		tid.machine = ar->ar_subj_term_addr.at_addr[0];
392 		subj_tok = au_to_subject32(ar->ar_subj_auid,  /* audit ID */
393 		    ar->ar_subj_cred.cr_uid, /* eff uid */
394 		    ar->ar_subj_egid,	/* eff group id */
395 		    ar->ar_subj_ruid, 	/* real uid */
396 		    ar->ar_subj_rgid, 	/* real group id */
397 		    ar->ar_subj_pid,	/* process id */
398 		    ar->ar_subj_asid,	/* session ID */
399 		    &tid);
400 		break;
401 	case AU_IPv6:
402 		subj_tok = au_to_subject32_ex(ar->ar_subj_auid,
403 		    ar->ar_subj_cred.cr_uid,
404 		    ar->ar_subj_egid,
405 		    ar->ar_subj_ruid,
406 		    ar->ar_subj_rgid,
407 		    ar->ar_subj_pid,
408 		    ar->ar_subj_asid,
409 		    &ar->ar_subj_term_addr);
410 		break;
411 	default:
412 		bzero(&tid, sizeof(tid));
413 		subj_tok = au_to_subject32(ar->ar_subj_auid,
414 		    ar->ar_subj_cred.cr_uid,
415 		    ar->ar_subj_egid,
416 		    ar->ar_subj_ruid,
417 		    ar->ar_subj_rgid,
418 		    ar->ar_subj_pid,
419 		    ar->ar_subj_asid,
420 		    &tid);
421 	}
422 
423 	/*
424 	 * The logic inside each case fills in the tokens required for the
425 	 * event, except for the header, trailer, and return tokens.  The
426 	 * header and trailer tokens are added by the kau_close() function.
427 	 * The return token is added outside of the switch statement.
428 	 */
429 	switch(ar->ar_event) {
430 	case AUE_ACCEPT:
431 	case AUE_BIND:
432 	case AUE_CONNECT:
433 	case AUE_RECV:
434 	case AUE_RECVFROM:
435 	case AUE_RECVMSG:
436 	case AUE_SEND:
437 	case AUE_SENDFILE:
438 	case AUE_SENDMSG:
439 	case AUE_SENDTO:
440 		/*
441 		 * Socket-related events.
442 		 */
443 		if (ARG_IS_VALID(kar, ARG_FD)) {
444 			tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
445 			kau_write(rec, tok);
446 		}
447 		if (ARG_IS_VALID(kar, ARG_SADDRINET)) {
448 			tok = au_to_sock_inet((struct sockaddr_in *)
449 			    &ar->ar_arg_sockaddr);
450 			kau_write(rec, tok);
451 		}
452 		if (ARG_IS_VALID(kar, ARG_SADDRUNIX)) {
453 			tok = au_to_sock_unix((struct sockaddr_un *)
454 			    &ar->ar_arg_sockaddr);
455 			kau_write(rec, tok);
456 			UPATH1_TOKENS;
457 		}
458 		/* XXX Need to handle ARG_SADDRINET6 */
459 		break;
460 
461 	case AUE_SOCKET:
462 	case AUE_SOCKETPAIR:
463 		if (ARG_IS_VALID(kar, ARG_SOCKINFO)) {
464 			tok = au_to_arg32(1,"domain",
465 			    ar->ar_arg_sockinfo.so_domain);
466 			kau_write(rec, tok);
467 			tok = au_to_arg32(2,"type",
468 			    ar->ar_arg_sockinfo.so_type);
469 			kau_write(rec, tok);
470 			tok = au_to_arg32(3,"protocol",
471 			    ar->ar_arg_sockinfo.so_protocol);
472 			kau_write(rec, tok);
473 		}
474 		break;
475 
476 	case AUE_SETSOCKOPT:
477 	case AUE_SHUTDOWN:
478 		if (ARG_IS_VALID(kar, ARG_FD)) {
479 			tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
480 			kau_write(rec, tok);
481 		}
482 		break;
483 
484 	case AUE_ACCT:
485 		if (ARG_IS_VALID(kar, ARG_UPATH1)) {
486 			UPATH1_VNODE1_TOKENS;
487 		} else {
488 			tok = au_to_arg32(1, "accounting off", 0);
489 			kau_write(rec, tok);
490 		}
491 		break;
492 
493 	case AUE_SETAUID:
494 		if (ARG_IS_VALID(kar, ARG_AUID)) {
495 			tok = au_to_arg32(2, "setauid", ar->ar_arg_auid);
496 			kau_write(rec, tok);
497 		}
498 		break;
499 
500 	case AUE_SETAUDIT:
501 		if (ARG_IS_VALID(kar, ARG_AUID) &&
502 		    ARG_IS_VALID(kar, ARG_ASID) &&
503 		    ARG_IS_VALID(kar, ARG_AMASK) &&
504 		    ARG_IS_VALID(kar, ARG_TERMID)) {
505 			tok = au_to_arg32(1, "setaudit:auid",
506 			    ar->ar_arg_auid);
507 			kau_write(rec, tok);
508 			tok = au_to_arg32(1, "setaudit:port",
509 			    ar->ar_arg_termid.port);
510 			kau_write(rec, tok);
511 			tok = au_to_arg32(1, "setaudit:machine",
512 			    ar->ar_arg_termid.machine);
513 			kau_write(rec, tok);
514 			tok = au_to_arg32(1, "setaudit:as_success",
515 			    ar->ar_arg_amask.am_success);
516 			kau_write(rec, tok);
517 			tok = au_to_arg32(1, "setaudit:as_failure",
518 			    ar->ar_arg_amask.am_failure);
519 			kau_write(rec, tok);
520 			tok = au_to_arg32(1, "setaudit:asid",
521 			    ar->ar_arg_asid);
522 			kau_write(rec, tok);
523 		}
524 		break;
525 
526 	case AUE_SETAUDIT_ADDR:
527 		if (ARG_IS_VALID(kar, ARG_AUID) &&
528 		    ARG_IS_VALID(kar, ARG_ASID) &&
529 		    ARG_IS_VALID(kar, ARG_AMASK) &&
530 		    ARG_IS_VALID(kar, ARG_TERMID_ADDR)) {
531 			tok = au_to_arg32(1, "setaudit_addr:auid",
532 			    ar->ar_arg_auid);
533 			kau_write(rec, tok);
534 			tok = au_to_arg32(1, "setaudit_addr:as_success",
535 			    ar->ar_arg_amask.am_success);
536 			kau_write(rec, tok);
537 			tok = au_to_arg32(1, "setaudit_addr:as_failure",
538 			    ar->ar_arg_amask.am_failure);
539 			kau_write(rec, tok);
540 			tok = au_to_arg32(1, "setaudit_addr:asid",
541 			    ar->ar_arg_asid);
542 			kau_write(rec, tok);
543 			tok = au_to_arg32(1, "setaudit_addr:type",
544 			    ar->ar_arg_termid_addr.at_type);
545 			kau_write(rec, tok);
546 			tok = au_to_arg32(1, "setaudit_addr:port",
547 			    ar->ar_arg_termid_addr.at_port);
548 			kau_write(rec, tok);
549 			if (ar->ar_arg_termid_addr.at_type == AU_IPv6)
550 				tok = au_to_in_addr_ex((struct in6_addr *)
551 				    &ar->ar_arg_termid_addr.at_addr[0]);
552 			if (ar->ar_arg_termid_addr.at_type == AU_IPv4)
553 				tok = au_to_in_addr((struct in_addr *)
554 				    &ar->ar_arg_termid_addr.at_addr[0]);
555 			kau_write(rec, tok);
556 		}
557 		break;
558 
559 	case AUE_AUDITON:
560 		/*
561 		 * For AUDITON commands without own event, audit the cmd.
562 		 */
563 		if (ARG_IS_VALID(kar, ARG_CMD)) {
564 			tok = au_to_arg32(1, "cmd", ar->ar_arg_cmd);
565 			kau_write(rec, tok);
566 		}
567 		/* fall thru */
568 
569 	case AUE_AUDITON_GETCAR:
570 	case AUE_AUDITON_GETCLASS:
571 	case AUE_AUDITON_GETCOND:
572 	case AUE_AUDITON_GETCWD:
573 	case AUE_AUDITON_GETKMASK:
574 	case AUE_AUDITON_GETSTAT:
575 	case AUE_AUDITON_GPOLICY:
576 	case AUE_AUDITON_GQCTRL:
577 	case AUE_AUDITON_SETCLASS:
578 	case AUE_AUDITON_SETCOND:
579 	case AUE_AUDITON_SETKMASK:
580 	case AUE_AUDITON_SETSMASK:
581 	case AUE_AUDITON_SETSTAT:
582 	case AUE_AUDITON_SETUMASK:
583 	case AUE_AUDITON_SPOLICY:
584 	case AUE_AUDITON_SQCTRL:
585 		if (ARG_IS_VALID(kar, ARG_AUDITON))
586 			audit_sys_auditon(ar, rec);
587 		break;
588 
589 	case AUE_AUDITCTL:
590 		UPATH1_VNODE1_TOKENS;
591 		break;
592 
593 	case AUE_EXIT:
594 		if (ARG_IS_VALID(kar, ARG_EXIT)) {
595 			tok = au_to_exit(ar->ar_arg_exitretval,
596 			    ar->ar_arg_exitstatus);
597 			kau_write(rec, tok);
598 		}
599 		break;
600 
601 	case AUE_ADJTIME:
602 	case AUE_CLOCK_SETTIME:
603 	case AUE_AUDIT:
604 	case AUE_DUP2:
605 	case AUE_GETAUDIT:
606 	case AUE_GETAUDIT_ADDR:
607 	case AUE_GETAUID:
608 	case AUE_GETCWD:
609 	case AUE_GETFSSTAT:
610 	case AUE_GETRESUID:
611 	case AUE_GETRESGID:
612 	case AUE_KQUEUE:
613 	case AUE_LSEEK:
614 	case AUE_MODLOAD:
615 	case AUE_MODUNLOAD:
616 	case AUE_MSGSYS:
617 	case AUE_NFS_SVC:
618 	case AUE_NTP_ADJTIME:
619 	case AUE_PIPE:
620 	case AUE_PROFILE:
621 	case AUE_RTPRIO:
622 	case AUE_SEMSYS:
623 	case AUE_SHMSYS:
624 	case AUE_SETPGRP:
625 	case AUE_SETRLIMIT:
626 	case AUE_SETSID:
627 	case AUE_SETTIMEOFDAY:
628 	case AUE_SYSARCH:
629 
630 		/*
631 		 * Header, subject, and return tokens added at end.
632 		 */
633 		break;
634 
635 	case AUE_MKFIFO:
636 		if (ARG_IS_VALID(kar, ARG_MODE)) {
637 			tok = au_to_arg32(2, "mode", ar->ar_arg_mode);
638 			kau_write(rec, tok);
639 		}
640 		/* fall through */
641 	case AUE_ACCESS:
642 	case AUE_CHDIR:
643 	case AUE_CHROOT:
644 	case AUE_EACCESS:
645 	case AUE_GETATTRLIST:
646 	case AUE_JAIL:
647 	case AUE_LUTIMES:
648 	case AUE_NFS_GETFH:
649 	case AUE_LSTAT:
650 	case AUE_PATHCONF:
651 	case AUE_READLINK:
652 	case AUE_REVOKE:
653 	case AUE_RMDIR:
654 	case AUE_SEARCHFS:
655 	case AUE_SETATTRLIST:
656 	case AUE_STAT:
657 	case AUE_STATFS:
658 	case AUE_SWAPON:
659 	case AUE_SWAPOFF:
660 	case AUE_TRUNCATE:
661 	case AUE_UNDELETE:
662 	case AUE_UNLINK:
663 	case AUE_UTIMES:
664 		UPATH1_VNODE1_TOKENS;
665 		break;
666 
667 	case AUE_FHSTATFS:
668 	case AUE_FHOPEN:
669 	case AUE_FHSTAT:
670 		/* XXXRW: Need to audit vnode argument. */
671 		break;
672 
673 	case AUE_CHFLAGS:
674 	case AUE_LCHFLAGS:
675 		if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
676 			tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
677 			kau_write(rec, tok);
678 		}
679 		UPATH1_VNODE1_TOKENS;
680 		break;
681 
682 	case AUE_CHMOD:
683 	case AUE_LCHMOD:
684 		if (ARG_IS_VALID(kar, ARG_MODE)) {
685 			tok = au_to_arg32(2, "new file mode",
686 			    ar->ar_arg_mode);
687 			kau_write(rec, tok);
688 		}
689 		UPATH1_VNODE1_TOKENS;
690 		break;
691 
692 	case AUE_CHOWN:
693 	case AUE_LCHOWN:
694 		if (ARG_IS_VALID(kar, ARG_UID)) {
695 			tok = au_to_arg32(2, "new file uid", ar->ar_arg_uid);
696 			kau_write(rec, tok);
697 		}
698 		if (ARG_IS_VALID(kar, ARG_GID)) {
699 			tok = au_to_arg32(3, "new file gid", ar->ar_arg_gid);
700 			kau_write(rec, tok);
701 		}
702 		UPATH1_VNODE1_TOKENS;
703 		break;
704 
705 	case AUE_EXCHANGEDATA:
706 		UPATH1_VNODE1_TOKENS;
707 		UPATH2_TOKENS;
708 		break;
709 
710 	case AUE_CLOSE:
711 		if (ARG_IS_VALID(kar, ARG_FD)) {
712 			tok = au_to_arg32(2, "fd", ar->ar_arg_fd);
713 			kau_write(rec, tok);
714 		}
715 		UPATH1_VNODE1_TOKENS;
716 		break;
717 
718 	case AUE_CORE:
719 		if (ARG_IS_VALID(kar, ARG_SIGNUM)) {
720 			tok = au_to_arg32(0, "signal", ar->ar_arg_signum);
721 			kau_write(rec, tok);
722 		}
723 		UPATH1_VNODE1_TOKENS;
724 		break;
725 
726 	case AUE_EXTATTRCTL:
727 		UPATH1_VNODE1_TOKENS;
728 		if (ARG_IS_VALID(kar, ARG_CMD)) {
729 			tok = au_to_arg32(2, "cmd", ar->ar_arg_cmd);
730 			kau_write(rec, tok);
731 		}
732 		/* extattrctl(2) filename parameter is in upath2/vnode2 */
733 		UPATH2_TOKENS;
734 		VNODE2_TOKENS;
735 		EXTATTR_TOKENS;
736 		break;
737 
738 	case AUE_EXTATTR_GET_FILE:
739 	case AUE_EXTATTR_SET_FILE:
740 	case AUE_EXTATTR_LIST_FILE:
741 	case AUE_EXTATTR_DELETE_FILE:
742 	case AUE_EXTATTR_GET_LINK:
743 	case AUE_EXTATTR_SET_LINK:
744 	case AUE_EXTATTR_LIST_LINK:
745 	case AUE_EXTATTR_DELETE_LINK:
746 		UPATH1_VNODE1_TOKENS;
747 		EXTATTR_TOKENS;
748 		break;
749 
750 	case AUE_EXTATTR_GET_FD:
751 	case AUE_EXTATTR_SET_FD:
752 	case AUE_EXTATTR_LIST_FD:
753 	case AUE_EXTATTR_DELETE_FD:
754 		if (ARG_IS_VALID(kar, ARG_FD)) {
755 			tok = au_to_arg32(2, "fd", ar->ar_arg_fd);
756 			kau_write(rec, tok);
757 		}
758 		EXTATTR_TOKENS;
759 		break;
760 
761 	case AUE_EXECVE:
762 		if (ARG_IS_VALID(kar, ARG_ARGV)) {
763 			tok = au_to_exec_args(ar->ar_arg_argv,
764 			    ar->ar_arg_argc);
765 			kau_write(rec, tok);
766 		}
767 		if (ARG_IS_VALID(kar, ARG_ENVV)) {
768 			tok = au_to_exec_env(ar->ar_arg_envv,
769 			    ar->ar_arg_envc);
770 			kau_write(rec, tok);
771 		}
772 		UPATH1_VNODE1_TOKENS;
773 		break;
774 
775 	case AUE_FCHMOD:
776 		if (ARG_IS_VALID(kar, ARG_MODE)) {
777 			tok = au_to_arg32(2, "new file mode",
778 			    ar->ar_arg_mode);
779 			kau_write(rec, tok);
780 		}
781 		FD_VNODE1_TOKENS;
782 		break;
783 
784 	/*
785 	 * XXXRW: Some of these need to handle non-vnode cases as well.
786 	 */
787 	case AUE_FCHDIR:
788 	case AUE_FPATHCONF:
789 	case AUE_FSTAT:
790 	case AUE_FSTATFS:
791 	case AUE_FSYNC:
792 	case AUE_FTRUNCATE:
793 	case AUE_FUTIMES:
794 	case AUE_GETDIRENTRIES:
795 	case AUE_GETDIRENTRIESATTR:
796 	case AUE_POLL:
797 	case AUE_READ:
798 	case AUE_READV:
799 	case AUE_WRITE:
800 	case AUE_WRITEV:
801 		FD_VNODE1_TOKENS;
802 		break;
803 
804 	case AUE_FCHOWN:
805 		if (ARG_IS_VALID(kar, ARG_UID)) {
806 			tok = au_to_arg32(2, "new file uid", ar->ar_arg_uid);
807 			kau_write(rec, tok);
808 		}
809 		if (ARG_IS_VALID(kar, ARG_GID)) {
810 			tok = au_to_arg32(3, "new file gid", ar->ar_arg_gid);
811 			kau_write(rec, tok);
812 		}
813 		FD_VNODE1_TOKENS;
814 		break;
815 
816 	case AUE_FCNTL:
817 		if (ar->ar_arg_cmd == F_GETLK || ar->ar_arg_cmd == F_SETLK ||
818 			ar->ar_arg_cmd == F_SETLKW) {
819 			if (ARG_IS_VALID(kar, ARG_CMD)) {
820 				tok = au_to_arg32(2, "cmd", ar->ar_arg_cmd);
821 				kau_write(rec, tok);
822 			}
823 			FD_VNODE1_TOKENS;
824 		}
825 		break;
826 
827 	case AUE_FCHFLAGS:
828 		if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
829 			tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
830 			kau_write(rec, tok);
831 		}
832 		FD_VNODE1_TOKENS;
833 		break;
834 
835 	case AUE_FLOCK:
836 		if (ARG_IS_VALID(kar, ARG_CMD)) {
837 			tok = au_to_arg32(2, "operation", ar->ar_arg_cmd);
838 			kau_write(rec, tok);
839 		}
840 		FD_VNODE1_TOKENS;
841 		break;
842 
843 	case AUE_RFORK:
844 		if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
845 			tok = au_to_arg32(1, "flags", ar->ar_arg_fflags);
846 			kau_write(rec, tok);
847 		}
848 		/* fall through */
849 	case AUE_FORK:
850 	case AUE_VFORK:
851 		if (ARG_IS_VALID(kar, ARG_PID)) {
852 			tok = au_to_arg32(0, "child PID", ar->ar_arg_pid);
853 			kau_write(rec, tok);
854 		}
855 		break;
856 
857 	case AUE_IOCTL:
858 		if (ARG_IS_VALID(kar, ARG_CMD)) {
859 			tok = au_to_arg32(2, "cmd", ar->ar_arg_cmd);
860 			kau_write(rec, tok);
861 		}
862 		if (ARG_IS_VALID(kar, ARG_ADDR)) {
863 			tok = au_to_arg32(1, "arg",
864 			    (u_int32_t)(uintptr_t)ar->ar_arg_addr);
865 			kau_write(rec, tok);
866 		}
867 		if (ARG_IS_VALID(kar, ARG_VNODE1))
868 			FD_VNODE1_TOKENS;
869 		else {
870 			if (ARG_IS_VALID(kar, ARG_SOCKINFO)) {
871 				tok = kau_to_socket(&ar->ar_arg_sockinfo);
872 				kau_write(rec, tok);
873 			} else {
874 				if (ARG_IS_VALID(kar, ARG_FD)) {
875 					tok = au_to_arg32(1, "fd",
876 					    ar->ar_arg_fd);
877 			    		kau_write(rec, tok);
878 				}
879 			}
880 		}
881 		break;
882 
883 	case AUE_KILL:
884 	case AUE_KILLPG:
885 		if (ARG_IS_VALID(kar, ARG_SIGNUM)) {
886 			tok = au_to_arg32(2, "signal", ar->ar_arg_signum);
887 			kau_write(rec, tok);
888 		}
889 		PROCESS_PID_TOKENS(1);
890 		break;
891 
892 	case AUE_KTRACE:
893 		if (ARG_IS_VALID(kar, ARG_CMD)) {
894 			tok = au_to_arg32(2, "ops", ar->ar_arg_cmd);
895 			kau_write(rec, tok);
896 		}
897 		if (ARG_IS_VALID(kar, ARG_VALUE)) {
898 			tok = au_to_arg32(3, "trpoints", ar->ar_arg_value);
899 			kau_write(rec, tok);
900 		}
901 		PROCESS_PID_TOKENS(4);
902 		UPATH1_VNODE1_TOKENS;
903 		break;
904 
905 	case AUE_LINK:
906 	case AUE_RENAME:
907 		UPATH1_VNODE1_TOKENS;
908 		UPATH2_TOKENS;
909 		break;
910 
911 	case AUE_LOADSHFILE:
912 		if (ARG_IS_VALID(kar, ARG_ADDR)) {
913 			tok = au_to_arg32(4, "base addr",
914 			    (u_int32_t)(uintptr_t)ar->ar_arg_addr);
915 			kau_write(rec, tok);
916 		}
917 		UPATH1_VNODE1_TOKENS;
918 		break;
919 
920 	case AUE_MKDIR:
921 		if (ARG_IS_VALID(kar, ARG_MODE)) {
922 			tok = au_to_arg32(2, "mode", ar->ar_arg_mode);
923 			kau_write(rec, tok);
924 		}
925 		UPATH1_VNODE1_TOKENS;
926 		break;
927 
928 	case AUE_MKNOD:
929 		if (ARG_IS_VALID(kar, ARG_MODE)) {
930 			tok = au_to_arg32(2, "mode", ar->ar_arg_mode);
931 			kau_write(rec, tok);
932 		}
933 		if (ARG_IS_VALID(kar, ARG_DEV)) {
934 			tok = au_to_arg32(3, "dev", ar->ar_arg_dev);
935 			kau_write(rec, tok);
936 		}
937 		UPATH1_VNODE1_TOKENS;
938 		break;
939 
940 	case AUE_MMAP:
941 	case AUE_MUNMAP:
942 	case AUE_MPROTECT:
943 	case AUE_MLOCK:
944 	case AUE_MUNLOCK:
945 	case AUE_MINHERIT:
946 		if (ARG_IS_VALID(kar, ARG_ADDR)) {
947 			tok = au_to_arg32(1, "addr",
948 			    (u_int32_t)(uintptr_t)ar->ar_arg_addr);
949 			kau_write(rec, tok);
950 		}
951 		if (ARG_IS_VALID(kar, ARG_LEN)) {
952 			tok = au_to_arg32(2, "len", ar->ar_arg_len);
953 			kau_write(rec, tok);
954 		}
955 		if (ar->ar_event == AUE_MMAP)
956 			FD_VNODE1_TOKENS;
957 		if (ar->ar_event == AUE_MPROTECT) {
958 			if (ARG_IS_VALID(kar, ARG_VALUE)) {
959 				tok = au_to_arg32(3, "protection",
960 				    ar->ar_arg_value);
961 				kau_write(rec, tok);
962 			}
963 		}
964 		if (ar->ar_event == AUE_MINHERIT) {
965 			if (ARG_IS_VALID(kar, ARG_VALUE)) {
966 				tok = au_to_arg32(3, "inherit",
967 				    ar->ar_arg_value);
968 				kau_write(rec, tok);
969 			}
970 		}
971 		break;
972 
973 	case AUE_MOUNT:
974 	case AUE_NMOUNT:
975 		/* XXX Need to handle NFS mounts */
976 		if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
977 			tok = au_to_arg32(3, "flags", ar->ar_arg_fflags);
978 			kau_write(rec, tok);
979 		}
980 		if (ARG_IS_VALID(kar, ARG_TEXT)) {
981 			tok = au_to_text(ar->ar_arg_text);
982 			kau_write(rec, tok);
983 		}
984 		/* fall through */
985 
986 	case AUE_UMOUNT:
987 		UPATH1_VNODE1_TOKENS;
988 		break;
989 
990 	case AUE_MSGCTL:
991 		ar->ar_event = msgctl_to_event(ar->ar_arg_svipc_cmd);
992 		/* Fall through */
993 
994 	case AUE_MSGRCV:
995 	case AUE_MSGSND:
996 		tok = au_to_arg32(1, "msg ID", ar->ar_arg_svipc_id);
997 		kau_write(rec, tok);
998 		if (ar->ar_errno != EINVAL) {
999 			tok = au_to_ipc(AT_IPC_MSG, ar->ar_arg_svipc_id);
1000 			kau_write(rec, tok);
1001 		}
1002 		break;
1003 
1004 	case AUE_MSGGET:
1005 		if (ar->ar_errno == 0) {
1006 			if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
1007 				tok = au_to_ipc(AT_IPC_MSG,
1008 				    ar->ar_arg_svipc_id);
1009 				kau_write(rec, tok);
1010 			}
1011 		}
1012 		break;
1013 
1014 	case AUE_RESETSHFILE:
1015 		if (ARG_IS_VALID(kar, ARG_ADDR)) {
1016 			tok = au_to_arg32(1, "base addr",
1017 			    (u_int32_t)(uintptr_t)ar->ar_arg_addr);
1018 			kau_write(rec, tok);
1019 		}
1020 		break;
1021 
1022 	case AUE_OPEN_RC:
1023 	case AUE_OPEN_RTC:
1024 	case AUE_OPEN_RWC:
1025 	case AUE_OPEN_RWTC:
1026 	case AUE_OPEN_WC:
1027 	case AUE_OPEN_WTC:
1028 	case AUE_CREAT:
1029 		if (ARG_IS_VALID(kar, ARG_MODE)) {
1030 			tok = au_to_arg32(3, "mode", ar->ar_arg_mode);
1031 			kau_write(rec, tok);
1032 		}
1033 		/* fall through */
1034 
1035 	case AUE_OPEN_R:
1036 	case AUE_OPEN_RT:
1037 	case AUE_OPEN_RW:
1038 	case AUE_OPEN_RWT:
1039 	case AUE_OPEN_W:
1040 	case AUE_OPEN_WT:
1041 		if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1042 			tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
1043 			kau_write(rec, tok);
1044 		}
1045 		UPATH1_VNODE1_TOKENS;
1046 		break;
1047 
1048 	case AUE_PTRACE:
1049 		if (ARG_IS_VALID(kar, ARG_CMD)) {
1050 			tok = au_to_arg32(1, "request", ar->ar_arg_cmd);
1051 			kau_write(rec, tok);
1052 		}
1053 		if (ARG_IS_VALID(kar, ARG_ADDR)) {
1054 			tok = au_to_arg32(3, "addr",
1055 			    (u_int32_t)(uintptr_t)ar->ar_arg_addr);
1056 			kau_write(rec, tok);
1057 		}
1058 		if (ARG_IS_VALID(kar, ARG_VALUE)) {
1059 			tok = au_to_arg32(4, "data", ar->ar_arg_value);
1060 			kau_write(rec, tok);
1061 		}
1062 		PROCESS_PID_TOKENS(2);
1063 		break;
1064 
1065 	case AUE_QUOTACTL:
1066 		if (ARG_IS_VALID(kar, ARG_CMD)) {
1067 			tok = au_to_arg32(2, "command", ar->ar_arg_cmd);
1068 			kau_write(rec, tok);
1069 		}
1070 		if (ARG_IS_VALID(kar, ARG_UID)) {
1071 			tok = au_to_arg32(3, "uid", ar->ar_arg_uid);
1072 			kau_write(rec, tok);
1073 		}
1074 		UPATH1_VNODE1_TOKENS;
1075 		break;
1076 
1077 	case AUE_REBOOT:
1078 		if (ARG_IS_VALID(kar, ARG_CMD)) {
1079 			tok = au_to_arg32(1, "howto", ar->ar_arg_cmd);
1080 			kau_write(rec, tok);
1081 		}
1082 		break;
1083 
1084 	case AUE_SEMCTL:
1085 		ar->ar_event = semctl_to_event(ar->ar_arg_svipc_cmd);
1086 		/* Fall through */
1087 
1088 	case AUE_SEMOP:
1089 		if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
1090 			tok = au_to_arg32(1, "sem ID", ar->ar_arg_svipc_id);
1091 			kau_write(rec, tok);
1092 			if (ar->ar_errno != EINVAL) {
1093 				tok = au_to_ipc(AT_IPC_SEM,
1094 				    ar->ar_arg_svipc_id);
1095 				kau_write(rec, tok);
1096 			}
1097 		}
1098 		break;
1099 
1100 	case AUE_SEMGET:
1101 		if (ar->ar_errno == 0) {
1102 			if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
1103 				tok = au_to_ipc(AT_IPC_SEM,
1104 				    ar->ar_arg_svipc_id);
1105 				kau_write(rec, tok);
1106 			}
1107 		}
1108 		break;
1109 
1110 	case AUE_SETEGID:
1111 		if (ARG_IS_VALID(kar, ARG_EGID)) {
1112 			tok = au_to_arg32(1, "gid", ar->ar_arg_egid);
1113 			kau_write(rec, tok);
1114 		}
1115 		break;
1116 
1117 	case AUE_SETEUID:
1118 		if (ARG_IS_VALID(kar, ARG_EUID)) {
1119 			tok = au_to_arg32(1, "uid", ar->ar_arg_euid);
1120 			kau_write(rec, tok);
1121 		}
1122 		break;
1123 
1124 	case AUE_SETREGID:
1125 		if (ARG_IS_VALID(kar, ARG_RGID)) {
1126 			tok = au_to_arg32(1, "rgid", ar->ar_arg_rgid);
1127 			kau_write(rec, tok);
1128 		}
1129 		if (ARG_IS_VALID(kar, ARG_EGID)) {
1130 			tok = au_to_arg32(2, "egid", ar->ar_arg_egid);
1131 			kau_write(rec, tok);
1132 		}
1133 		break;
1134 
1135 	case AUE_SETREUID:
1136 		if (ARG_IS_VALID(kar, ARG_RUID)) {
1137 			tok = au_to_arg32(1, "ruid", ar->ar_arg_ruid);
1138 			kau_write(rec, tok);
1139 		}
1140 		if (ARG_IS_VALID(kar, ARG_EUID)) {
1141 			tok = au_to_arg32(2, "euid", ar->ar_arg_euid);
1142 			kau_write(rec, tok);
1143 		}
1144 		break;
1145 
1146 	case AUE_SETRESGID:
1147 		if (ARG_IS_VALID(kar, ARG_RGID)) {
1148 			tok = au_to_arg32(1, "rgid", ar->ar_arg_rgid);
1149 			kau_write(rec, tok);
1150 		}
1151 		if (ARG_IS_VALID(kar, ARG_EGID)) {
1152 			tok = au_to_arg32(2, "egid", ar->ar_arg_egid);
1153 			kau_write(rec, tok);
1154 		}
1155 		if (ARG_IS_VALID(kar, ARG_SGID)) {
1156 			tok = au_to_arg32(3, "sgid", ar->ar_arg_sgid);
1157 			kau_write(rec, tok);
1158 		}
1159 		break;
1160 
1161 	case AUE_SETRESUID:
1162 		if (ARG_IS_VALID(kar, ARG_RUID)) {
1163 			tok = au_to_arg32(1, "ruid", ar->ar_arg_ruid);
1164 			kau_write(rec, tok);
1165 		}
1166 		if (ARG_IS_VALID(kar, ARG_EUID)) {
1167 			tok = au_to_arg32(2, "euid", ar->ar_arg_euid);
1168 			kau_write(rec, tok);
1169 		}
1170 		if (ARG_IS_VALID(kar, ARG_SUID)) {
1171 			tok = au_to_arg32(3, "suid", ar->ar_arg_suid);
1172 			kau_write(rec, tok);
1173 		}
1174 		break;
1175 
1176 	case AUE_SETGID:
1177 		if (ARG_IS_VALID(kar, ARG_GID)) {
1178 			tok = au_to_arg32(1, "gid", ar->ar_arg_gid);
1179 			kau_write(rec, tok);
1180 		}
1181 		break;
1182 
1183 	case AUE_SETUID:
1184 		if (ARG_IS_VALID(kar, ARG_UID)) {
1185 			tok = au_to_arg32(1, "uid", ar->ar_arg_uid);
1186 			kau_write(rec, tok);
1187 		}
1188 		break;
1189 
1190 	case AUE_SETGROUPS:
1191 		if (ARG_IS_VALID(kar, ARG_GROUPSET)) {
1192 			for(ctr = 0; ctr < ar->ar_arg_groups.gidset_size; ctr++)
1193 			{
1194 				tok = au_to_arg32(1, "setgroups", 							ar->ar_arg_groups.gidset[ctr]);
1195 				kau_write(rec, tok);
1196 			}
1197 		}
1198 		break;
1199 
1200 	case AUE_SETLOGIN:
1201 		if (ARG_IS_VALID(kar, ARG_TEXT)) {
1202 			tok = au_to_text(ar->ar_arg_text);
1203 			kau_write(rec, tok);
1204 		}
1205 		break;
1206 
1207 	case AUE_SETPRIORITY:
1208 		if (ARG_IS_VALID(kar, ARG_CMD)) {
1209 			tok = au_to_arg32(1, "which", ar->ar_arg_cmd);
1210 			kau_write(rec, tok);
1211 		}
1212 		if (ARG_IS_VALID(kar, ARG_UID)) {
1213 			tok = au_to_arg32(2, "who", ar->ar_arg_uid);
1214 			kau_write(rec, tok);
1215 		}
1216 		if (ARG_IS_VALID(kar, ARG_VALUE)) {
1217 			tok = au_to_arg32(2, "priority", ar->ar_arg_value);
1218 			kau_write(rec, tok);
1219 		}
1220 		break;
1221 
1222 	case AUE_SETPRIVEXEC:
1223 		if (ARG_IS_VALID(kar, ARG_VALUE)) {
1224 			tok = au_to_arg32(1, "flag", ar->ar_arg_value);
1225 			kau_write(rec, tok);
1226 		}
1227 		break;
1228 
1229 	/* AUE_SHMAT, AUE_SHMCTL, AUE_SHMDT and AUE_SHMGET are SysV IPC */
1230 	case AUE_SHMAT:
1231 		if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
1232 			tok = au_to_arg32(1, "shmid", ar->ar_arg_svipc_id);
1233 			kau_write(rec, tok);
1234 			/* XXXAUDIT: Does having the ipc token make sense? */
1235 			tok = au_to_ipc(AT_IPC_SHM, ar->ar_arg_svipc_id);
1236 			kau_write(rec, tok);
1237 		}
1238 		if (ARG_IS_VALID(kar, ARG_SVIPC_ADDR)) {
1239 			tok = au_to_arg32(2, "shmaddr",
1240 			    (int)(uintptr_t)ar->ar_arg_svipc_addr);
1241 			kau_write(rec, tok);
1242 		}
1243 		if (ARG_IS_VALID(kar, ARG_SVIPC_PERM)) {
1244 			tok = au_to_ipc_perm(&ar->ar_arg_svipc_perm);
1245 			kau_write(rec, tok);
1246 		}
1247 		break;
1248 
1249 	case AUE_SHMCTL:
1250 		if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
1251 			tok = au_to_arg32(1, "shmid", ar->ar_arg_svipc_id);
1252 			kau_write(rec, tok);
1253 			/* XXXAUDIT: Does having the ipc token make sense? */
1254 			tok = au_to_ipc(AT_IPC_SHM, ar->ar_arg_svipc_id);
1255 			kau_write(rec, tok);
1256 		}
1257 		switch (ar->ar_arg_svipc_cmd) {
1258 		case IPC_STAT:
1259 			ar->ar_event = AUE_SHMCTL_STAT;
1260 			break;
1261 		case IPC_RMID:
1262 			ar->ar_event = AUE_SHMCTL_RMID;
1263 			break;
1264 		case IPC_SET:
1265 			ar->ar_event = AUE_SHMCTL_SET;
1266 			if (ARG_IS_VALID(kar, ARG_SVIPC_PERM)) {
1267 				tok = au_to_ipc_perm(&ar->ar_arg_svipc_perm);
1268 				kau_write(rec, tok);
1269 			}
1270 			break;
1271 		default:
1272 			break;	/* We will audit a bad command */
1273 		}
1274 		break;
1275 
1276 	case AUE_SHMDT:
1277 		if (ARG_IS_VALID(kar, ARG_SVIPC_ADDR)) {
1278 			tok = au_to_arg32(1, "shmaddr",
1279 			    (int)(uintptr_t)ar->ar_arg_svipc_addr);
1280 			kau_write(rec, tok);
1281 		}
1282 		break;
1283 
1284 	case AUE_SHMGET:
1285 		/* This is unusual; the return value is in an argument token */
1286 		if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
1287 			tok = au_to_arg32(0, "shmid", ar->ar_arg_svipc_id);
1288 			kau_write(rec, tok);
1289 			tok = au_to_ipc(AT_IPC_SHM, ar->ar_arg_svipc_id);
1290 			kau_write(rec, tok);
1291 		}
1292 		if (ARG_IS_VALID(kar, ARG_SVIPC_PERM)) {
1293 			tok = au_to_ipc_perm(&ar->ar_arg_svipc_perm);
1294 			kau_write(rec, tok);
1295 		}
1296 		break;
1297 
1298 	/* AUE_SHMOPEN, AUE_SHMUNLINK, AUE_SEMOPEN, AUE_SEMCLOSE
1299 	 * and AUE_SEMUNLINK are Posix IPC */
1300 	case AUE_SHMOPEN:
1301 		if (ARG_IS_VALID(kar, ARG_SVIPC_ADDR)) {
1302 			tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
1303 			kau_write(rec, tok);
1304 		}
1305 		if (ARG_IS_VALID(kar, ARG_MODE)) {
1306 			tok = au_to_arg32(3, "mode", ar->ar_arg_mode);
1307 			kau_write(rec, tok);
1308 		}
1309 	case AUE_SHMUNLINK:
1310 		if (ARG_IS_VALID(kar, ARG_TEXT)) {
1311 			tok = au_to_text(ar->ar_arg_text);
1312 			kau_write(rec, tok);
1313 		}
1314 		if (ARG_IS_VALID(kar, ARG_POSIX_IPC_PERM)) {
1315 		/* Create an ipc_perm token */
1316 			struct ipc_perm perm;
1317 			perm.uid = ar->ar_arg_pipc_perm.pipc_uid;
1318 			perm.gid = ar->ar_arg_pipc_perm.pipc_gid;
1319 			perm.cuid = ar->ar_arg_pipc_perm.pipc_uid;
1320 			perm.cgid = ar->ar_arg_pipc_perm.pipc_gid;
1321 			perm.mode = ar->ar_arg_pipc_perm.pipc_mode;
1322 			perm.seq = 0;
1323 			perm.key = 0;
1324 			tok = au_to_ipc_perm(&perm);
1325 			kau_write(rec, tok);
1326 		}
1327 		break;
1328 
1329 	case AUE_SEMOPEN:
1330 		if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1331 			tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
1332 			kau_write(rec, tok);
1333 		}
1334 		if (ARG_IS_VALID(kar, ARG_MODE)) {
1335 			tok = au_to_arg32(3, "mode", ar->ar_arg_mode);
1336 			kau_write(rec, tok);
1337 		}
1338 		if (ARG_IS_VALID(kar, ARG_VALUE)) {
1339 			tok = au_to_arg32(4, "value", ar->ar_arg_value);
1340 			kau_write(rec, tok);
1341 		}
1342 		/* fall through */
1343 
1344 	case AUE_SEMUNLINK:
1345 		if (ARG_IS_VALID(kar, ARG_TEXT)) {
1346 			tok = au_to_text(ar->ar_arg_text);
1347 			kau_write(rec, tok);
1348 		}
1349 		if (ARG_IS_VALID(kar, ARG_POSIX_IPC_PERM)) {
1350 		/* Create an ipc_perm token */
1351 			struct ipc_perm perm;
1352 			perm.uid = ar->ar_arg_pipc_perm.pipc_uid;
1353 			perm.gid = ar->ar_arg_pipc_perm.pipc_gid;
1354 			perm.cuid = ar->ar_arg_pipc_perm.pipc_uid;
1355 			perm.cgid = ar->ar_arg_pipc_perm.pipc_gid;
1356 			perm.mode = ar->ar_arg_pipc_perm.pipc_mode;
1357 			perm.seq = 0;
1358 			perm.key = 0;
1359 			tok = au_to_ipc_perm(&perm);
1360 			kau_write(rec, tok);
1361 		}
1362 		break;
1363 
1364 	case AUE_SEMCLOSE:
1365 		if (ARG_IS_VALID(kar, ARG_FD)) {
1366 			tok = au_to_arg32(1, "sem", ar->ar_arg_fd);
1367 			kau_write(rec, tok);
1368 		}
1369 		break;
1370 
1371 	case AUE_SYMLINK:
1372 		if (ARG_IS_VALID(kar, ARG_TEXT)) {
1373 			tok = au_to_text(ar->ar_arg_text);
1374 			kau_write(rec, tok);
1375 		}
1376 		UPATH1_VNODE1_TOKENS;
1377 		break;
1378 
1379 	case AUE_SYSCTL:
1380 		if (ARG_IS_VALID(kar, ARG_CTLNAME | ARG_LEN)) {
1381 			for (ctr = 0; ctr < ar->ar_arg_len; ctr++) {
1382 				tok = au_to_arg32(1, "name",
1383 				    ar->ar_arg_ctlname[ctr]);
1384 				kau_write(rec, tok);
1385 			}
1386 		}
1387 		if (ARG_IS_VALID(kar, ARG_VALUE)) {
1388 			tok = au_to_arg32(5, "newval", ar->ar_arg_value);
1389 			kau_write(rec, tok);
1390 		}
1391 		if (ARG_IS_VALID(kar, ARG_TEXT)) {
1392 			tok = au_to_text(ar->ar_arg_text);
1393 			kau_write(rec, tok);
1394 		}
1395 		break;
1396 
1397 	case AUE_UMASK:
1398 		if (ARG_IS_VALID(kar, ARG_MASK)) {
1399 			tok = au_to_arg32(1, "new mask", ar->ar_arg_mask);
1400 			kau_write(rec, tok);
1401 		}
1402 		tok = au_to_arg32(0, "prev mask", ar->ar_retval);
1403 		kau_write(rec, tok);
1404 		break;
1405 
1406 	case AUE_WAIT4:
1407 		if (ARG_IS_VALID(kar, ARG_PID)) {
1408 			tok = au_to_arg32(0, "pid", ar->ar_arg_pid);
1409 			kau_write(rec, tok);
1410 		}
1411 		break;
1412 
1413 	case AUE_NULL:
1414 	default:
1415 		printf("BSM conversion requested for unknown event %d\n",
1416 		    ar->ar_event);
1417 		/* Write the subject token so it is properly freed here. */
1418 		kau_write(rec, subj_tok);
1419 		kau_free(rec);
1420 		return (BSM_NOAUDIT);
1421 	}
1422 
1423 	kau_write(rec, subj_tok);
1424 	tok = au_to_return32((char)ar->ar_errno, ar->ar_retval);
1425 	kau_write(rec, tok);  /* Every record gets a return token */
1426 
1427 	kau_close(rec, &ar->ar_endtime, ar->ar_event);
1428 
1429 	*pau = rec;
1430 	return (BSM_SUCCESS);
1431 }
1432 
1433 /*
1434  * Verify that a record is a valid BSM record. This verification is simple
1435  * now, but may be expanded on sometime in the future.  Return 1 if the
1436  * record is good, 0 otherwise.
1437  */
1438 int
1439 bsm_rec_verify(void *rec)
1440 {
1441 	char c = *(char *)rec;
1442 
1443 	/*
1444 	 * Check the token ID of the first token; it has to be a header
1445 	 * token.
1446 	 *
1447 	 * XXXAUDIT There needs to be a token structure to map a token.
1448 	 * XXXAUDIT 'Shouldn't be simply looking at the first char.
1449 	 */
1450 	if ((c != AUT_HEADER32) && (c != AUT_HEADER32_EX) &&
1451 	    (c != AUT_HEADER64) && (c != AUT_HEADER64_EX))
1452 		return (0);
1453 	return (1);
1454 }
1455