xref: /freebsd/sys/security/audit/audit_bsm.c (revision 3b2324c3a800d7599f348c408f01908d0cef05a0)
1 /*
2  * SPDX-License-Identifier: BSD-3-Clause
3  *
4  * Copyright (c) 1999-2009 Apple Inc.
5  * Copyright (c) 2016-2017 Robert N. M. Watson
6  * All rights reserved.
7  *
8  * Portions of this software were developed by BAE Systems, the University of
9  * Cambridge Computer Laboratory, and Memorial University under DARPA/AFRL
10  * contract FA8650-15-C-7558 ("CADETS"), as part of the DARPA Transparent
11  * Computing (TC) research program.
12  *
13  * Redistribution and use in source and binary forms, with or without
14  * modification, are permitted provided that the following conditions
15  * are met:
16  * 1.  Redistributions of source code must retain the above copyright
17  *     notice, this list of conditions and the following disclaimer.
18  * 2.  Redistributions in binary form must reproduce the above copyright
19  *     notice, this list of conditions and the following disclaimer in the
20  *     documentation and/or other materials provided with the distribution.
21  * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
22  *     its contributors may be used to endorse or promote products derived
23  *     from this software without specific prior written permission.
24  *
25  * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND
26  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
27  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
28  * ARE DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR
29  * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
30  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
31  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
32  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
33  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
34  * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
35  * POSSIBILITY OF SUCH DAMAGE.
36  */
37 
38 #include <sys/cdefs.h>
39 __FBSDID("$FreeBSD$");
40 
41 #include <sys/param.h>
42 #include <sys/vnode.h>
43 #include <sys/ipc.h>
44 #include <sys/lock.h>
45 #include <sys/malloc.h>
46 #include <sys/mutex.h>
47 #include <sys/socket.h>
48 #include <sys/extattr.h>
49 #include <sys/fcntl.h>
50 #include <sys/user.h>
51 #include <sys/systm.h>
52 
53 #include <bsm/audit.h>
54 #include <bsm/audit_internal.h>
55 #include <bsm/audit_record.h>
56 #include <bsm/audit_kevents.h>
57 
58 #include <security/audit/audit.h>
59 #include <security/audit/audit_private.h>
60 
61 #include <netinet/in_systm.h>
62 #include <netinet/in.h>
63 #include <netinet/ip.h>
64 
65 MALLOC_DEFINE(M_AUDITBSM, "audit_bsm", "Audit BSM data");
66 
67 static void	audit_sys_auditon(struct audit_record *ar,
68 		    struct au_record *rec);
69 
70 /*
71  * Initialize the BSM auditing subsystem.
72  */
73 void
74 kau_init(void)
75 {
76 
77 	au_evclassmap_init();
78 	au_evnamemap_init();
79 }
80 
81 /*
82  * This call reserves memory for the audit record.  Memory must be guaranteed
83  * before any auditable event can be generated.  The au_record structure
84  * maintains a reference to the memory allocated above and also the list of
85  * tokens associated with this record.
86  */
87 static struct au_record *
88 kau_open(void)
89 {
90 	struct au_record *rec;
91 
92 	rec = malloc(sizeof(*rec), M_AUDITBSM, M_WAITOK);
93 	rec->data = NULL;
94 	TAILQ_INIT(&rec->token_q);
95 	rec->len = 0;
96 	rec->used = 1;
97 
98 	return (rec);
99 }
100 
101 /*
102  * Store the token with the record descriptor.
103  */
104 static void
105 kau_write(struct au_record *rec, struct au_token *tok)
106 {
107 
108 	KASSERT(tok != NULL, ("kau_write: tok == NULL"));
109 
110 	TAILQ_INSERT_TAIL(&rec->token_q, tok, tokens);
111 	rec->len += tok->len;
112 }
113 
114 /*
115  * Close out the audit record by adding the header token, identifying any
116  * missing tokens.  Write out the tokens to the record memory.
117  */
118 static void
119 kau_close(struct au_record *rec, struct timespec *ctime, short event)
120 {
121 	u_char *dptr;
122 	size_t tot_rec_size;
123 	token_t *cur, *hdr, *trail;
124 	struct timeval tm;
125 	size_t hdrsize;
126 	struct auditinfo_addr ak;
127 	struct in6_addr *ap;
128 
129 	audit_get_kinfo(&ak);
130 	hdrsize = 0;
131 	switch (ak.ai_termid.at_type) {
132 	case AU_IPv4:
133 		hdrsize = (ak.ai_termid.at_addr[0] == INADDR_ANY) ?
134 		    AUDIT_HEADER_SIZE : AUDIT_HEADER_EX_SIZE(&ak);
135 		break;
136 	case AU_IPv6:
137 		ap = (struct in6_addr *)&ak.ai_termid.at_addr[0];
138 		hdrsize = (IN6_IS_ADDR_UNSPECIFIED(ap)) ? AUDIT_HEADER_SIZE :
139 		    AUDIT_HEADER_EX_SIZE(&ak);
140 		break;
141 	default:
142 		panic("kau_close: invalid address family");
143 	}
144 	tot_rec_size = rec->len + hdrsize + AUDIT_TRAILER_SIZE;
145 	rec->data = malloc(tot_rec_size, M_AUDITBSM, M_WAITOK | M_ZERO);
146 
147 	tm.tv_usec = ctime->tv_nsec / 1000;
148 	tm.tv_sec = ctime->tv_sec;
149 	if (hdrsize != AUDIT_HEADER_SIZE)
150 		hdr = au_to_header32_ex_tm(tot_rec_size, event, 0, tm, &ak);
151 	else
152 		hdr = au_to_header32_tm(tot_rec_size, event, 0, tm);
153 	TAILQ_INSERT_HEAD(&rec->token_q, hdr, tokens);
154 
155 	trail = au_to_trailer(tot_rec_size);
156 	TAILQ_INSERT_TAIL(&rec->token_q, trail, tokens);
157 
158 	rec->len = tot_rec_size;
159 	dptr = rec->data;
160 	TAILQ_FOREACH(cur, &rec->token_q, tokens) {
161 		memcpy(dptr, cur->t_data, cur->len);
162 		dptr += cur->len;
163 	}
164 }
165 
166 /*
167  * Free a BSM audit record by releasing all the tokens and clearing the audit
168  * record information.
169  */
170 void
171 kau_free(struct au_record *rec)
172 {
173 	struct au_token *tok;
174 
175 	/* Free the token list. */
176 	while ((tok = TAILQ_FIRST(&rec->token_q))) {
177 		TAILQ_REMOVE(&rec->token_q, tok, tokens);
178 		free(tok->t_data, M_AUDITBSM);
179 		free(tok, M_AUDITBSM);
180 	}
181 
182 	rec->used = 0;
183 	rec->len = 0;
184 	free(rec->data, M_AUDITBSM);
185 	free(rec, M_AUDITBSM);
186 }
187 
188 /*
189  * XXX: May want turn some (or all) of these macros into functions in order
190  * to reduce the generated code size.
191  *
192  * XXXAUDIT: These macros assume that 'kar', 'ar', 'rec', and 'tok' in the
193  * caller are OK with this.
194  */
195 #define	ATFD1_TOKENS(argnum) do {					\
196 	if (ARG_IS_VALID(kar, ARG_ATFD1)) {				\
197 		tok = au_to_arg32(argnum, "at fd 1", ar->ar_arg_atfd1);	\
198 		kau_write(rec, tok);					\
199 	}								\
200 } while (0)
201 
202 #define	ATFD2_TOKENS(argnum) do {					\
203 	if (ARG_IS_VALID(kar, ARG_ATFD2)) {				\
204 		tok = au_to_arg32(argnum, "at fd 2", ar->ar_arg_atfd2);	\
205 		kau_write(rec, tok);					\
206 	}								\
207 } while (0)
208 
209 #define	UPATH1_TOKENS do {						\
210 	if (ARG_IS_VALID(kar, ARG_UPATH1)) {				\
211 		tok = au_to_path(ar->ar_arg_upath1);			\
212 		kau_write(rec, tok);					\
213 	}								\
214 } while (0)
215 
216 #define	UPATH2_TOKENS do {						\
217 	if (ARG_IS_VALID(kar, ARG_UPATH2)) {				\
218 		tok = au_to_path(ar->ar_arg_upath2);			\
219 		kau_write(rec, tok);					\
220 	}								\
221 } while (0)
222 
223 #define	VNODE1_TOKENS do {						\
224 	if (ARG_IS_VALID(kar, ARG_ATFD)) {				\
225 		tok = au_to_arg32(1, "at fd", ar->ar_arg_atfd);		\
226 		kau_write(rec, tok);					\
227 	}								\
228 	if (ARG_IS_VALID(kar, ARG_VNODE1)) {				\
229 		tok = au_to_attr32(&ar->ar_arg_vnode1);			\
230 		kau_write(rec, tok);					\
231 	}								\
232 } while (0)
233 
234 #define	UPATH1_VNODE1_TOKENS do {					\
235 	UPATH1_TOKENS;							\
236 	if (ARG_IS_VALID(kar, ARG_VNODE1)) {				\
237 		tok = au_to_attr32(&ar->ar_arg_vnode1);			\
238 		kau_write(rec, tok);					\
239 	}								\
240 } while (0)
241 
242 #define	VNODE2_TOKENS do {						\
243 	if (ARG_IS_VALID(kar, ARG_VNODE2)) {				\
244 		tok = au_to_attr32(&ar->ar_arg_vnode2);			\
245 		kau_write(rec, tok);					\
246 	}								\
247 } while (0)
248 
249 #define	FD_VNODE1_TOKENS do {						\
250 	if (ARG_IS_VALID(kar, ARG_VNODE1)) {				\
251 		if (ARG_IS_VALID(kar, ARG_FD)) {			\
252 			tok = au_to_arg32(1, "fd", ar->ar_arg_fd);	\
253 			kau_write(rec, tok);				\
254 		}							\
255 		tok = au_to_attr32(&ar->ar_arg_vnode1);			\
256 		kau_write(rec, tok);					\
257 	} else {							\
258 		if (ARG_IS_VALID(kar, ARG_FD)) {			\
259 			tok = au_to_arg32(1, "non-file: fd",		\
260 			    ar->ar_arg_fd);				\
261 			kau_write(rec, tok);				\
262 		}							\
263 	}								\
264 } while (0)
265 
266 #define	PROCESS_PID_TOKENS(argn) do {					\
267 	if ((ar->ar_arg_pid > 0) /* Reference a single process */	\
268 	    && (ARG_IS_VALID(kar, ARG_PROCESS))) {			\
269 		tok = au_to_process32_ex(ar->ar_arg_auid,		\
270 		    ar->ar_arg_euid, ar->ar_arg_egid,			\
271 		    ar->ar_arg_ruid, ar->ar_arg_rgid,			\
272 		    ar->ar_arg_pid, ar->ar_arg_asid,			\
273 		    &ar->ar_arg_termid_addr);				\
274 		kau_write(rec, tok);					\
275 	} else if (ARG_IS_VALID(kar, ARG_PID)) {			\
276 		tok = au_to_arg32(argn, "process", ar->ar_arg_pid);	\
277 		kau_write(rec, tok);					\
278 	}								\
279 } while (0)
280 
281 #define	EXTATTR_TOKENS(namespace_argnum) do {				\
282 	if (ARG_IS_VALID(kar, ARG_VALUE)) {				\
283 		switch (ar->ar_arg_value) {				\
284 		case EXTATTR_NAMESPACE_USER:				\
285 			tok = au_to_text(EXTATTR_NAMESPACE_USER_STRING);\
286 			break;						\
287 		case EXTATTR_NAMESPACE_SYSTEM:				\
288 			tok = au_to_text(EXTATTR_NAMESPACE_SYSTEM_STRING);\
289 			break;						\
290 		default:						\
291 			tok = au_to_arg32((namespace_argnum),		\
292 			    "attrnamespace", ar->ar_arg_value);		\
293 			break;						\
294 		}							\
295 		kau_write(rec, tok);					\
296 	}								\
297 	/* attrname is in the text field */				\
298 	if (ARG_IS_VALID(kar, ARG_TEXT)) {				\
299 		tok = au_to_text(ar->ar_arg_text);			\
300 		kau_write(rec, tok);					\
301 	}								\
302 } while (0)
303 
304 /*
305  * Not all pointer arguments to system calls are of interest, but in some
306  * cases they reflect delegation of rights, such as mmap(2) followed by
307  * minherit(2) before execve(2), so do the best we can.
308  */
309 #define	ADDR_TOKEN(argnum, argname) do {				\
310 	if (ARG_IS_VALID(kar, ARG_ADDR)) {				\
311 		if (sizeof(void *) == sizeof(uint32_t))			\
312 			tok = au_to_arg32((argnum), (argname),		\
313 			    (uint32_t)(uintptr_t)ar->ar_arg_addr);	\
314 		else							\
315 			tok = au_to_arg64((argnum), (argname),		\
316 			    (uint64_t)(uintptr_t)ar->ar_arg_addr);	\
317 		kau_write(rec, tok);					\
318 	}								\
319 } while (0)
320 
321 
322 /*
323  * Implement auditing for the auditon() system call. The audit tokens that
324  * are generated depend on the command that was sent into the auditon()
325  * system call.
326  */
327 static void
328 audit_sys_auditon(struct audit_record *ar, struct au_record *rec)
329 {
330 	struct au_token *tok;
331 
332 	tok = au_to_arg32(3, "length", ar->ar_arg_len);
333 	kau_write(rec, tok);
334 	switch (ar->ar_arg_cmd) {
335 	case A_OLDSETPOLICY:
336 		if ((size_t)ar->ar_arg_len == sizeof(int64_t)) {
337 			tok = au_to_arg64(2, "policy",
338 			    ar->ar_arg_auditon.au_policy64);
339 			kau_write(rec, tok);
340 			break;
341 		}
342 		/* FALLTHROUGH */
343 
344 	case A_SETPOLICY:
345 		tok = au_to_arg32(2, "policy", ar->ar_arg_auditon.au_policy);
346 		kau_write(rec, tok);
347 		break;
348 
349 	case A_SETKMASK:
350 		tok = au_to_arg32(2, "setkmask:as_success",
351 		    ar->ar_arg_auditon.au_mask.am_success);
352 		kau_write(rec, tok);
353 		tok = au_to_arg32(2, "setkmask:as_failure",
354 		    ar->ar_arg_auditon.au_mask.am_failure);
355 		kau_write(rec, tok);
356 		break;
357 
358 	case A_OLDSETQCTRL:
359 		if ((size_t)ar->ar_arg_len == sizeof(au_qctrl64_t)) {
360 			tok = au_to_arg64(2, "setqctrl:aq_hiwater",
361 			    ar->ar_arg_auditon.au_qctrl64.aq64_hiwater);
362 			kau_write(rec, tok);
363 			tok = au_to_arg64(2, "setqctrl:aq_lowater",
364 			    ar->ar_arg_auditon.au_qctrl64.aq64_lowater);
365 			kau_write(rec, tok);
366 			tok = au_to_arg64(2, "setqctrl:aq_bufsz",
367 			    ar->ar_arg_auditon.au_qctrl64.aq64_bufsz);
368 			kau_write(rec, tok);
369 			tok = au_to_arg64(2, "setqctrl:aq_delay",
370 			    ar->ar_arg_auditon.au_qctrl64.aq64_delay);
371 			kau_write(rec, tok);
372 			tok = au_to_arg64(2, "setqctrl:aq_minfree",
373 			    ar->ar_arg_auditon.au_qctrl64.aq64_minfree);
374 			kau_write(rec, tok);
375 			break;
376 		}
377 		/* FALLTHROUGH */
378 
379 	case A_SETQCTRL:
380 		tok = au_to_arg32(2, "setqctrl:aq_hiwater",
381 		    ar->ar_arg_auditon.au_qctrl.aq_hiwater);
382 		kau_write(rec, tok);
383 		tok = au_to_arg32(2, "setqctrl:aq_lowater",
384 		    ar->ar_arg_auditon.au_qctrl.aq_lowater);
385 		kau_write(rec, tok);
386 		tok = au_to_arg32(2, "setqctrl:aq_bufsz",
387 		    ar->ar_arg_auditon.au_qctrl.aq_bufsz);
388 		kau_write(rec, tok);
389 		tok = au_to_arg32(2, "setqctrl:aq_delay",
390 		    ar->ar_arg_auditon.au_qctrl.aq_delay);
391 		kau_write(rec, tok);
392 		tok = au_to_arg32(2, "setqctrl:aq_minfree",
393 		    ar->ar_arg_auditon.au_qctrl.aq_minfree);
394 		kau_write(rec, tok);
395 		break;
396 
397 	case A_SETUMASK:
398 		tok = au_to_arg32(2, "setumask:as_success",
399 		    ar->ar_arg_auditon.au_auinfo.ai_mask.am_success);
400 		kau_write(rec, tok);
401 		tok = au_to_arg32(2, "setumask:as_failure",
402 		    ar->ar_arg_auditon.au_auinfo.ai_mask.am_failure);
403 		kau_write(rec, tok);
404 		break;
405 
406 	case A_SETSMASK:
407 		tok = au_to_arg32(2, "setsmask:as_success",
408 		    ar->ar_arg_auditon.au_auinfo.ai_mask.am_success);
409 		kau_write(rec, tok);
410 		tok = au_to_arg32(2, "setsmask:as_failure",
411 		    ar->ar_arg_auditon.au_auinfo.ai_mask.am_failure);
412 		kau_write(rec, tok);
413 		break;
414 
415 	case A_OLDSETCOND:
416 		if ((size_t)ar->ar_arg_len == sizeof(int64_t)) {
417 			tok = au_to_arg64(2, "setcond",
418 			    ar->ar_arg_auditon.au_cond64);
419 			kau_write(rec, tok);
420 			break;
421 		}
422 		/* FALLTHROUGH */
423 
424 	case A_SETCOND:
425 		tok = au_to_arg32(2, "setcond", ar->ar_arg_auditon.au_cond);
426 		kau_write(rec, tok);
427 		break;
428 
429 	case A_SETCLASS:
430 		tok = au_to_arg32(2, "setclass:ec_event",
431 		    ar->ar_arg_auditon.au_evclass.ec_number);
432 		kau_write(rec, tok);
433 		tok = au_to_arg32(2, "setclass:ec_class",
434 		    ar->ar_arg_auditon.au_evclass.ec_class);
435 		kau_write(rec, tok);
436 		break;
437 
438 	case A_SETPMASK:
439 		tok = au_to_arg32(2, "setpmask:as_success",
440 		    ar->ar_arg_auditon.au_aupinfo.ap_mask.am_success);
441 		kau_write(rec, tok);
442 		tok = au_to_arg32(2, "setpmask:as_failure",
443 		    ar->ar_arg_auditon.au_aupinfo.ap_mask.am_failure);
444 		kau_write(rec, tok);
445 		break;
446 
447 	case A_SETFSIZE:
448 		tok = au_to_arg32(2, "setfsize:filesize",
449 		    ar->ar_arg_auditon.au_fstat.af_filesz);
450 		kau_write(rec, tok);
451 		break;
452 
453 	default:
454 		break;
455 	}
456 }
457 
458 /*
459  * Convert an internal kernel audit record to a BSM record and return a
460  * success/failure indicator. The BSM record is passed as an out parameter to
461  * this function.
462  *
463  * Return conditions:
464  *   BSM_SUCCESS: The BSM record is valid
465  *   BSM_FAILURE: Failure; the BSM record is NULL.
466  *   BSM_NOAUDIT: The event is not auditable for BSM; the BSM record is NULL.
467  */
468 int
469 kaudit_to_bsm(struct kaudit_record *kar, struct au_record **pau)
470 {
471 	struct au_token *tok, *subj_tok, *jail_tok;
472 	struct au_record *rec;
473 	au_tid_t tid;
474 	struct audit_record *ar;
475 	int ctr;
476 
477 	KASSERT(kar != NULL, ("kaudit_to_bsm: kar == NULL"));
478 
479 	*pau = NULL;
480 	ar = &kar->k_ar;
481 	rec = kau_open();
482 
483 	/*
484 	 * Create the subject token.  If this credential was jailed be sure to
485 	 * generate a zonename token.
486 	 */
487 	if (ar->ar_jailname[0] != '\0')
488 		jail_tok = au_to_zonename(ar->ar_jailname);
489 	else
490 		jail_tok = NULL;
491 	switch (ar->ar_subj_term_addr.at_type) {
492 	case AU_IPv4:
493 		tid.port = ar->ar_subj_term_addr.at_port;
494 		tid.machine = ar->ar_subj_term_addr.at_addr[0];
495 		subj_tok = au_to_subject32(ar->ar_subj_auid,  /* audit ID */
496 		    ar->ar_subj_cred.cr_uid, /* eff uid */
497 		    ar->ar_subj_egid,	/* eff group id */
498 		    ar->ar_subj_ruid,	/* real uid */
499 		    ar->ar_subj_rgid,	/* real group id */
500 		    ar->ar_subj_pid,	/* process id */
501 		    ar->ar_subj_asid,	/* session ID */
502 		    &tid);
503 		break;
504 	case AU_IPv6:
505 		subj_tok = au_to_subject32_ex(ar->ar_subj_auid,
506 		    ar->ar_subj_cred.cr_uid,
507 		    ar->ar_subj_egid,
508 		    ar->ar_subj_ruid,
509 		    ar->ar_subj_rgid,
510 		    ar->ar_subj_pid,
511 		    ar->ar_subj_asid,
512 		    &ar->ar_subj_term_addr);
513 		break;
514 	default:
515 		bzero(&tid, sizeof(tid));
516 		subj_tok = au_to_subject32(ar->ar_subj_auid,
517 		    ar->ar_subj_cred.cr_uid,
518 		    ar->ar_subj_egid,
519 		    ar->ar_subj_ruid,
520 		    ar->ar_subj_rgid,
521 		    ar->ar_subj_pid,
522 		    ar->ar_subj_asid,
523 		    &tid);
524 	}
525 
526 	/*
527 	 * The logic inside each case fills in the tokens required for the
528 	 * event, except for the header, trailer, and return tokens.  The
529 	 * header and trailer tokens are added by the kau_close() function.
530 	 * The return token is added outside of the switch statement.
531 	 */
532 	switch(ar->ar_event) {
533 	case AUE_ACCEPT:
534 		if (ARG_IS_VALID(kar, ARG_FD)) {
535 			tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
536 			kau_write(rec, tok);
537 		}
538 		if (ARG_IS_VALID(kar, ARG_SADDRINET)) {
539 			tok = au_to_sock_inet((struct sockaddr_in *)
540 			    &ar->ar_arg_sockaddr);
541 			kau_write(rec, tok);
542 		}
543 		if (ARG_IS_VALID(kar, ARG_SADDRUNIX)) {
544 			tok = au_to_sock_unix((struct sockaddr_un *)
545 			    &ar->ar_arg_sockaddr);
546 			kau_write(rec, tok);
547 			UPATH1_TOKENS;
548 		}
549 		break;
550 
551 	case AUE_BIND:
552 	case AUE_LISTEN:
553 	case AUE_CONNECT:
554 	case AUE_RECV:
555 	case AUE_RECVFROM:
556 	case AUE_RECVMSG:
557 	case AUE_SEND:
558 	case AUE_SENDMSG:
559 	case AUE_SENDTO:
560 		/*
561 		 * Socket-related events.
562 		 */
563 		if (ARG_IS_VALID(kar, ARG_FD)) {
564 			tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
565 			kau_write(rec, tok);
566 		}
567 		if (ARG_IS_VALID(kar, ARG_SADDRINET)) {
568 			tok = au_to_sock_inet((struct sockaddr_in *)
569 			    &ar->ar_arg_sockaddr);
570 			kau_write(rec, tok);
571 		}
572 		if (ARG_IS_VALID(kar, ARG_SADDRUNIX)) {
573 			tok = au_to_sock_unix((struct sockaddr_un *)
574 			    &ar->ar_arg_sockaddr);
575 			kau_write(rec, tok);
576 			UPATH1_TOKENS;
577 		}
578 		/* XXX Need to handle ARG_SADDRINET6 */
579 		break;
580 
581 	case AUE_BINDAT:
582 	case AUE_CONNECTAT:
583 		ATFD1_TOKENS(1);
584 		if (ARG_IS_VALID(kar, ARG_FD)) {
585 			tok = au_to_arg32(2, "fd", ar->ar_arg_fd);
586 			kau_write(rec, tok);
587 		}
588 		if (ARG_IS_VALID(kar, ARG_SADDRUNIX)) {
589 			tok = au_to_sock_unix((struct sockaddr_un *)
590 			    &ar->ar_arg_sockaddr);
591 			kau_write(rec, tok);
592 			UPATH1_TOKENS;
593 		}
594 		break;
595 
596 	case AUE_SENDFILE:
597 		FD_VNODE1_TOKENS;
598 		if (ARG_IS_VALID(kar, ARG_SADDRINET)) {
599 			tok = au_to_sock_inet((struct sockaddr_in *)
600 			    &ar->ar_arg_sockaddr);
601 			kau_write(rec, tok);
602 		}
603 		if (ARG_IS_VALID(kar, ARG_SADDRUNIX)) {
604 			tok = au_to_sock_unix((struct sockaddr_un *)
605 			    &ar->ar_arg_sockaddr);
606 			kau_write(rec, tok);
607 			UPATH1_TOKENS;
608 		}
609 		/* XXX Need to handle ARG_SADDRINET6 */
610 		break;
611 
612 	case AUE_SOCKET:
613 	case AUE_SOCKETPAIR:
614 		if (ARG_IS_VALID(kar, ARG_SOCKINFO)) {
615 			tok = au_to_arg32(1, "domain",
616 			    ar->ar_arg_sockinfo.so_domain);
617 			kau_write(rec, tok);
618 			tok = au_to_arg32(2, "type",
619 			    ar->ar_arg_sockinfo.so_type);
620 			kau_write(rec, tok);
621 			tok = au_to_arg32(3, "protocol",
622 			    ar->ar_arg_sockinfo.so_protocol);
623 			kau_write(rec, tok);
624 		}
625 		break;
626 
627 	case AUE_SETSOCKOPT:
628 	case AUE_SHUTDOWN:
629 		if (ARG_IS_VALID(kar, ARG_FD)) {
630 			tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
631 			kau_write(rec, tok);
632 		}
633 		break;
634 
635 	case AUE_ACCT:
636 		if (ARG_IS_VALID(kar, ARG_UPATH1)) {
637 			UPATH1_VNODE1_TOKENS;
638 		} else {
639 			tok = au_to_arg32(1, "accounting off", 0);
640 			kau_write(rec, tok);
641 		}
642 		break;
643 
644 	case AUE_SETAUID:
645 		if (ARG_IS_VALID(kar, ARG_AUID)) {
646 			tok = au_to_arg32(2, "setauid", ar->ar_arg_auid);
647 			kau_write(rec, tok);
648 		}
649 		break;
650 
651 	case AUE_SETAUDIT:
652 		if (ARG_IS_VALID(kar, ARG_AUID) &&
653 		    ARG_IS_VALID(kar, ARG_ASID) &&
654 		    ARG_IS_VALID(kar, ARG_AMASK) &&
655 		    ARG_IS_VALID(kar, ARG_TERMID)) {
656 			tok = au_to_arg32(1, "setaudit:auid",
657 			    ar->ar_arg_auid);
658 			kau_write(rec, tok);
659 			tok = au_to_arg32(1, "setaudit:port",
660 			    ar->ar_arg_termid.port);
661 			kau_write(rec, tok);
662 			tok = au_to_arg32(1, "setaudit:machine",
663 			    ar->ar_arg_termid.machine);
664 			kau_write(rec, tok);
665 			tok = au_to_arg32(1, "setaudit:as_success",
666 			    ar->ar_arg_amask.am_success);
667 			kau_write(rec, tok);
668 			tok = au_to_arg32(1, "setaudit:as_failure",
669 			    ar->ar_arg_amask.am_failure);
670 			kau_write(rec, tok);
671 			tok = au_to_arg32(1, "setaudit:asid",
672 			    ar->ar_arg_asid);
673 			kau_write(rec, tok);
674 		}
675 		break;
676 
677 	case AUE_SETAUDIT_ADDR:
678 		if (ARG_IS_VALID(kar, ARG_AUID) &&
679 		    ARG_IS_VALID(kar, ARG_ASID) &&
680 		    ARG_IS_VALID(kar, ARG_AMASK) &&
681 		    ARG_IS_VALID(kar, ARG_TERMID_ADDR)) {
682 			tok = au_to_arg32(1, "setaudit_addr:auid",
683 			    ar->ar_arg_auid);
684 			kau_write(rec, tok);
685 			tok = au_to_arg32(1, "setaudit_addr:as_success",
686 			    ar->ar_arg_amask.am_success);
687 			kau_write(rec, tok);
688 			tok = au_to_arg32(1, "setaudit_addr:as_failure",
689 			    ar->ar_arg_amask.am_failure);
690 			kau_write(rec, tok);
691 			tok = au_to_arg32(1, "setaudit_addr:asid",
692 			    ar->ar_arg_asid);
693 			kau_write(rec, tok);
694 			tok = au_to_arg32(1, "setaudit_addr:type",
695 			    ar->ar_arg_termid_addr.at_type);
696 			kau_write(rec, tok);
697 			tok = au_to_arg32(1, "setaudit_addr:port",
698 			    ar->ar_arg_termid_addr.at_port);
699 			kau_write(rec, tok);
700 			if (ar->ar_arg_termid_addr.at_type == AU_IPv6)
701 				tok = au_to_in_addr_ex((struct in6_addr *)
702 				    &ar->ar_arg_termid_addr.at_addr[0]);
703 			if (ar->ar_arg_termid_addr.at_type == AU_IPv4)
704 				tok = au_to_in_addr((struct in_addr *)
705 				    &ar->ar_arg_termid_addr.at_addr[0]);
706 			kau_write(rec, tok);
707 		}
708 		break;
709 
710 	case AUE_AUDITON:
711 		/*
712 		 * For AUDITON commands without own event, audit the cmd.
713 		 */
714 		if (ARG_IS_VALID(kar, ARG_CMD)) {
715 			tok = au_to_arg32(1, "cmd", ar->ar_arg_cmd);
716 			kau_write(rec, tok);
717 		}
718 		/* FALLTHROUGH */
719 
720 	case AUE_AUDITON_GETCAR:
721 	case AUE_AUDITON_GETCLASS:
722 	case AUE_AUDITON_GETCOND:
723 	case AUE_AUDITON_GETCWD:
724 	case AUE_AUDITON_GETKMASK:
725 	case AUE_AUDITON_GETSTAT:
726 	case AUE_AUDITON_GPOLICY:
727 	case AUE_AUDITON_GQCTRL:
728 	case AUE_AUDITON_SETCLASS:
729 	case AUE_AUDITON_SETCOND:
730 	case AUE_AUDITON_SETKMASK:
731 	case AUE_AUDITON_SETSMASK:
732 	case AUE_AUDITON_SETSTAT:
733 	case AUE_AUDITON_SETUMASK:
734 	case AUE_AUDITON_SPOLICY:
735 	case AUE_AUDITON_SQCTRL:
736 		if (ARG_IS_VALID(kar, ARG_AUDITON))
737 			audit_sys_auditon(ar, rec);
738 		break;
739 
740 	case AUE_AUDITCTL:
741 		UPATH1_VNODE1_TOKENS;
742 		break;
743 
744 	case AUE_EXIT:
745 		if (ARG_IS_VALID(kar, ARG_EXIT)) {
746 			tok = au_to_exit(ar->ar_arg_exitretval,
747 			    ar->ar_arg_exitstatus);
748 			kau_write(rec, tok);
749 		}
750 		break;
751 
752 	case AUE_ADJTIME:
753 	case AUE_CLOCK_SETTIME:
754 	case AUE_AUDIT:
755 	case AUE_DUP2:
756 	case AUE_GETAUDIT:
757 	case AUE_GETAUDIT_ADDR:
758 	case AUE_GETAUID:
759 	case AUE_GETCWD:
760 	case AUE_GETFSSTAT:
761 	case AUE_GETRESUID:
762 	case AUE_GETRESGID:
763 	case AUE_KQUEUE:
764 	case AUE_MODLOAD:
765 	case AUE_MODUNLOAD:
766 	case AUE_MSGSYS:
767 	case AUE_NTP_ADJTIME:
768 	case AUE_PIPE:
769 	case AUE_POSIX_OPENPT:
770 	case AUE_PROFILE:
771 	case AUE_RTPRIO:
772 	case AUE_SEMSYS:
773 	case AUE_SETFIB:
774 	case AUE_SHMSYS:
775 	case AUE_SETPGRP:
776 	case AUE_SETRLIMIT:
777 	case AUE_SETSID:
778 	case AUE_SETTIMEOFDAY:
779 	case AUE_SYSARCH:
780 
781 		/*
782 		 * Header, subject, and return tokens added at end.
783 		 */
784 		break;
785 
786 	case AUE_ACL_DELETE_FD:
787 	case AUE_ACL_DELETE_FILE:
788 	case AUE_ACL_CHECK_FD:
789 	case AUE_ACL_CHECK_FILE:
790 	case AUE_ACL_CHECK_LINK:
791 	case AUE_ACL_DELETE_LINK:
792 	case AUE_ACL_GET_FD:
793 	case AUE_ACL_GET_FILE:
794 	case AUE_ACL_GET_LINK:
795 	case AUE_ACL_SET_FD:
796 	case AUE_ACL_SET_FILE:
797 	case AUE_ACL_SET_LINK:
798 		if (ARG_IS_VALID(kar, ARG_VALUE)) {
799 			tok = au_to_arg32(1, "type", ar->ar_arg_value);
800 			kau_write(rec, tok);
801 		}
802 		ATFD1_TOKENS(1);
803 		UPATH1_VNODE1_TOKENS;
804 		break;
805 
806 	case AUE_CHDIR:
807 	case AUE_CHROOT:
808 	case AUE_FSTATAT:
809 	case AUE_FUTIMESAT:
810 	case AUE_GETATTRLIST:
811 	case AUE_JAIL:
812 	case AUE_LUTIMES:
813 	case AUE_NFS_GETFH:
814 	case AUE_LGETFH:
815 	case AUE_LSTAT:
816 	case AUE_LPATHCONF:
817 	case AUE_PATHCONF:
818 	case AUE_READLINK:
819 	case AUE_READLINKAT:
820 	case AUE_REVOKE:
821 	case AUE_RMDIR:
822 	case AUE_SEARCHFS:
823 	case AUE_SETATTRLIST:
824 	case AUE_STAT:
825 	case AUE_STATFS:
826 	case AUE_SWAPON:
827 	case AUE_SWAPOFF:
828 	case AUE_TRUNCATE:
829 	case AUE_UNDELETE:
830 	case AUE_UNLINK:
831 	case AUE_UNLINKAT:
832 	case AUE_UTIMES:
833 		ATFD1_TOKENS(1);
834 		UPATH1_VNODE1_TOKENS;
835 		break;
836 
837 	case AUE_ACCESS:
838 	case AUE_EACCESS:
839 	case AUE_FACCESSAT:
840 		ATFD1_TOKENS(1);
841 		UPATH1_VNODE1_TOKENS;
842 		if (ARG_IS_VALID(kar, ARG_VALUE)) {
843 			tok = au_to_arg32(2, "mode", ar->ar_arg_value);
844 			kau_write(rec, tok);
845 		}
846 		break;
847 
848 	case AUE_FHSTATFS:
849 	case AUE_FHOPEN:
850 	case AUE_FHSTAT:
851 		/* XXXRW: Need to audit vnode argument. */
852 		break;
853 
854 	case AUE_CHFLAGS:
855 	case AUE_LCHFLAGS:
856 	case AUE_CHFLAGSAT:
857 		if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
858 			tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
859 			kau_write(rec, tok);
860 		}
861 		UPATH1_VNODE1_TOKENS;
862 		break;
863 
864 	case AUE_CHMOD:
865 	case AUE_LCHMOD:
866 		if (ARG_IS_VALID(kar, ARG_MODE)) {
867 			tok = au_to_arg32(2, "new file mode",
868 			    ar->ar_arg_mode);
869 			kau_write(rec, tok);
870 		}
871 		UPATH1_VNODE1_TOKENS;
872 		break;
873 
874 	case AUE_FCHMODAT:
875 		ATFD1_TOKENS(1);
876 		if (ARG_IS_VALID(kar, ARG_MODE)) {
877 			tok = au_to_arg32(3, "new file mode",
878 			    ar->ar_arg_mode);
879 			kau_write(rec, tok);
880 		}
881 		UPATH1_VNODE1_TOKENS;
882 		break;
883 
884 	case AUE_CHOWN:
885 	case AUE_LCHOWN:
886 		if (ARG_IS_VALID(kar, ARG_UID)) {
887 			tok = au_to_arg32(2, "new file uid", ar->ar_arg_uid);
888 			kau_write(rec, tok);
889 		}
890 		if (ARG_IS_VALID(kar, ARG_GID)) {
891 			tok = au_to_arg32(3, "new file gid", ar->ar_arg_gid);
892 			kau_write(rec, tok);
893 		}
894 		UPATH1_VNODE1_TOKENS;
895 		break;
896 
897 	case AUE_FCHOWNAT:
898 		ATFD1_TOKENS(1);
899 		if (ARG_IS_VALID(kar, ARG_UID)) {
900 			tok = au_to_arg32(3, "new file uid", ar->ar_arg_uid);
901 			kau_write(rec, tok);
902 		}
903 		if (ARG_IS_VALID(kar, ARG_GID)) {
904 			tok = au_to_arg32(4, "new file gid", ar->ar_arg_gid);
905 			kau_write(rec, tok);
906 		}
907 		UPATH1_VNODE1_TOKENS;
908 		break;
909 
910 	case AUE_EXCHANGEDATA:
911 		UPATH1_VNODE1_TOKENS;
912 		UPATH2_TOKENS;
913 		break;
914 
915 	case AUE_CLOSE:
916 		if (ARG_IS_VALID(kar, ARG_FD)) {
917 			tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
918 			kau_write(rec, tok);
919 		}
920 		UPATH1_VNODE1_TOKENS;
921 		break;
922 
923 	case AUE_CLOSEFROM:
924 		if (ARG_IS_VALID(kar, ARG_FD)) {
925 			tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
926 			kau_write(rec, tok);
927 		}
928 		break;
929 
930 	case AUE_CORE:
931 		if (ARG_IS_VALID(kar, ARG_SIGNUM)) {
932 			tok = au_to_arg32(1, "signal", ar->ar_arg_signum);
933 			kau_write(rec, tok);
934 		}
935 		UPATH1_VNODE1_TOKENS;
936 		break;
937 
938 	case AUE_EXTATTRCTL:
939 		UPATH1_VNODE1_TOKENS;
940 		if (ARG_IS_VALID(kar, ARG_CMD)) {
941 			tok = au_to_arg32(2, "cmd", ar->ar_arg_cmd);
942 			kau_write(rec, tok);
943 		}
944 		/* extattrctl(2) filename parameter is in upath2/vnode2 */
945 		UPATH2_TOKENS;
946 		VNODE2_TOKENS;
947 		EXTATTR_TOKENS(4);
948 		break;
949 
950 	case AUE_EXTATTR_GET_FILE:
951 	case AUE_EXTATTR_SET_FILE:
952 	case AUE_EXTATTR_LIST_FILE:
953 	case AUE_EXTATTR_DELETE_FILE:
954 	case AUE_EXTATTR_GET_LINK:
955 	case AUE_EXTATTR_SET_LINK:
956 	case AUE_EXTATTR_LIST_LINK:
957 	case AUE_EXTATTR_DELETE_LINK:
958 		UPATH1_VNODE1_TOKENS;
959 		EXTATTR_TOKENS(2);
960 		break;
961 
962 	case AUE_EXTATTR_GET_FD:
963 	case AUE_EXTATTR_SET_FD:
964 	case AUE_EXTATTR_LIST_FD:
965 	case AUE_EXTATTR_DELETE_FD:
966 		if (ARG_IS_VALID(kar, ARG_FD)) {
967 			tok = au_to_arg32(2, "fd", ar->ar_arg_fd);
968 			kau_write(rec, tok);
969 		}
970 		EXTATTR_TOKENS(2);
971 		break;
972 
973 	case AUE_FEXECVE:
974 		if (ARG_IS_VALID(kar, ARG_FD)) {
975 			tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
976 			kau_write(rec, tok);
977 		}
978 		/* FALLTHROUGH */
979 
980 	case AUE_EXECVE:
981 	case AUE_MAC_EXECVE:
982 		if (ARG_IS_VALID(kar, ARG_ARGV)) {
983 			tok = au_to_exec_args(ar->ar_arg_argv,
984 			    ar->ar_arg_argc);
985 			kau_write(rec, tok);
986 		}
987 		if (ARG_IS_VALID(kar, ARG_ENVV)) {
988 			tok = au_to_exec_env(ar->ar_arg_envv,
989 			    ar->ar_arg_envc);
990 			kau_write(rec, tok);
991 		}
992 		UPATH1_VNODE1_TOKENS;
993 		break;
994 
995 	case AUE_FCHMOD:
996 		if (ARG_IS_VALID(kar, ARG_MODE)) {
997 			tok = au_to_arg32(2, "new file mode",
998 			    ar->ar_arg_mode);
999 			kau_write(rec, tok);
1000 		}
1001 		FD_VNODE1_TOKENS;
1002 		break;
1003 
1004 	/*
1005 	 * XXXRW: Some of these need to handle non-vnode cases as well.
1006 	 */
1007 	case AUE_FCHDIR:
1008 	case AUE_FPATHCONF:
1009 	case AUE_FSTAT:
1010 	case AUE_FSTATFS:
1011 	case AUE_FSYNC:
1012 	case AUE_FTRUNCATE:
1013 	case AUE_FUTIMES:
1014 	case AUE_GETDIRENTRIES:
1015 	case AUE_GETDIRENTRIESATTR:
1016 	case AUE_LSEEK:
1017 	case AUE_POLL:
1018 	case AUE_POSIX_FALLOCATE:
1019 	case AUE_PREAD:
1020 	case AUE_PWRITE:
1021 	case AUE_READ:
1022 	case AUE_READV:
1023 	case AUE_WRITE:
1024 	case AUE_WRITEV:
1025 		FD_VNODE1_TOKENS;
1026 		break;
1027 
1028 	case AUE_FCHOWN:
1029 		if (ARG_IS_VALID(kar, ARG_UID)) {
1030 			tok = au_to_arg32(2, "new file uid", ar->ar_arg_uid);
1031 			kau_write(rec, tok);
1032 		}
1033 		if (ARG_IS_VALID(kar, ARG_GID)) {
1034 			tok = au_to_arg32(3, "new file gid", ar->ar_arg_gid);
1035 			kau_write(rec, tok);
1036 		}
1037 		FD_VNODE1_TOKENS;
1038 		break;
1039 
1040 	case AUE_FCNTL:
1041 		if (ARG_IS_VALID(kar, ARG_CMD)) {
1042 			tok = au_to_arg32(2, "cmd",
1043 			    au_fcntl_cmd_to_bsm(ar->ar_arg_cmd));
1044 			kau_write(rec, tok);
1045 		}
1046 		FD_VNODE1_TOKENS;
1047 		break;
1048 
1049 	case AUE_FCHFLAGS:
1050 		if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1051 			tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
1052 			kau_write(rec, tok);
1053 		}
1054 		FD_VNODE1_TOKENS;
1055 		break;
1056 
1057 	case AUE_FLOCK:
1058 		if (ARG_IS_VALID(kar, ARG_CMD)) {
1059 			tok = au_to_arg32(2, "operation", ar->ar_arg_cmd);
1060 			kau_write(rec, tok);
1061 		}
1062 		FD_VNODE1_TOKENS;
1063 		break;
1064 
1065 	case AUE_RFORK:
1066 		if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1067 			tok = au_to_arg32(1, "flags", ar->ar_arg_fflags);
1068 			kau_write(rec, tok);
1069 		}
1070 		/* FALLTHROUGH */
1071 
1072 	case AUE_FORK:
1073 	case AUE_VFORK:
1074 		if (ARG_IS_VALID(kar, ARG_PID)) {
1075 			tok = au_to_arg32(0, "child PID", ar->ar_arg_pid);
1076 			kau_write(rec, tok);
1077 		}
1078 		break;
1079 
1080 	case AUE_IOCTL:
1081 		if (ARG_IS_VALID(kar, ARG_CMD)) {
1082 			tok = au_to_arg32(2, "cmd", ar->ar_arg_cmd);
1083 			kau_write(rec, tok);
1084 		}
1085 		if (ARG_IS_VALID(kar, ARG_VNODE1))
1086 			FD_VNODE1_TOKENS;
1087 		else {
1088 			if (ARG_IS_VALID(kar, ARG_SOCKINFO)) {
1089 				tok = kau_to_socket(&ar->ar_arg_sockinfo);
1090 				kau_write(rec, tok);
1091 			} else {
1092 				if (ARG_IS_VALID(kar, ARG_FD)) {
1093 					tok = au_to_arg32(1, "fd",
1094 					    ar->ar_arg_fd);
1095 					kau_write(rec, tok);
1096 				}
1097 			}
1098 		}
1099 		break;
1100 
1101 	case AUE_KILL:
1102 	case AUE_KILLPG:
1103 		if (ARG_IS_VALID(kar, ARG_SIGNUM)) {
1104 			tok = au_to_arg32(2, "signal", ar->ar_arg_signum);
1105 			kau_write(rec, tok);
1106 		}
1107 		PROCESS_PID_TOKENS(1);
1108 		break;
1109 
1110 	case AUE_KTRACE:
1111 		if (ARG_IS_VALID(kar, ARG_CMD)) {
1112 			tok = au_to_arg32(2, "ops", ar->ar_arg_cmd);
1113 			kau_write(rec, tok);
1114 		}
1115 		if (ARG_IS_VALID(kar, ARG_VALUE)) {
1116 			tok = au_to_arg32(3, "trpoints", ar->ar_arg_value);
1117 			kau_write(rec, tok);
1118 		}
1119 		PROCESS_PID_TOKENS(4);
1120 		UPATH1_VNODE1_TOKENS;
1121 		break;
1122 
1123 	case AUE_LINK:
1124 	case AUE_LINKAT:
1125 	case AUE_RENAME:
1126 	case AUE_RENAMEAT:
1127 		ATFD1_TOKENS(1);
1128 		UPATH1_VNODE1_TOKENS;
1129 		ATFD2_TOKENS(3);
1130 		UPATH2_TOKENS;
1131 		break;
1132 
1133 	case AUE_LOADSHFILE:
1134 		ADDR_TOKEN(4, "base addr");
1135 		UPATH1_VNODE1_TOKENS;
1136 		break;
1137 
1138 	case AUE_MKDIR:
1139 	case AUE_MKDIRAT:
1140 	case AUE_MKFIFO:
1141 	case AUE_MKFIFOAT:
1142 		ATFD1_TOKENS(1);
1143 		if (ARG_IS_VALID(kar, ARG_MODE)) {
1144 			tok = au_to_arg32(2, "mode", ar->ar_arg_mode);
1145 			kau_write(rec, tok);
1146 		}
1147 		UPATH1_VNODE1_TOKENS;
1148 		break;
1149 
1150 	case AUE_MKNOD:
1151 	case AUE_MKNODAT:
1152 		ATFD1_TOKENS(1);
1153 		if (ARG_IS_VALID(kar, ARG_MODE)) {
1154 			tok = au_to_arg32(2, "mode", ar->ar_arg_mode);
1155 			kau_write(rec, tok);
1156 		}
1157 		if (ARG_IS_VALID(kar, ARG_DEV)) {
1158 			tok = au_to_arg32(3, "dev", ar->ar_arg_dev);
1159 			kau_write(rec, tok);
1160 		}
1161 		UPATH1_VNODE1_TOKENS;
1162 		break;
1163 
1164 	case AUE_MMAP:
1165 	case AUE_MUNMAP:
1166 	case AUE_MPROTECT:
1167 	case AUE_MLOCK:
1168 	case AUE_MUNLOCK:
1169 	case AUE_MINHERIT:
1170 		ADDR_TOKEN(1, "addr");
1171 		if (ARG_IS_VALID(kar, ARG_LEN)) {
1172 			tok = au_to_arg32(2, "len", ar->ar_arg_len);
1173 			kau_write(rec, tok);
1174 		}
1175 		if (ar->ar_event == AUE_MMAP)
1176 			FD_VNODE1_TOKENS;
1177 		if (ar->ar_event == AUE_MPROTECT) {
1178 			if (ARG_IS_VALID(kar, ARG_VALUE)) {
1179 				tok = au_to_arg32(3, "protection",
1180 				    ar->ar_arg_value);
1181 				kau_write(rec, tok);
1182 			}
1183 		}
1184 		if (ar->ar_event == AUE_MINHERIT) {
1185 			if (ARG_IS_VALID(kar, ARG_VALUE)) {
1186 				tok = au_to_arg32(3, "inherit",
1187 				    ar->ar_arg_value);
1188 				kau_write(rec, tok);
1189 			}
1190 		}
1191 		break;
1192 
1193 	case AUE_MOUNT:
1194 	case AUE_NMOUNT:
1195 		/* XXX Need to handle NFS mounts */
1196 		if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1197 			tok = au_to_arg32(3, "flags", ar->ar_arg_fflags);
1198 			kau_write(rec, tok);
1199 		}
1200 		if (ARG_IS_VALID(kar, ARG_TEXT)) {
1201 			tok = au_to_text(ar->ar_arg_text);
1202 			kau_write(rec, tok);
1203 		}
1204 		/* FALLTHROUGH */
1205 
1206 	case AUE_NFS_SVC:
1207 		if (ARG_IS_VALID(kar, ARG_CMD)) {
1208 			tok = au_to_arg32(1, "flags", ar->ar_arg_cmd);
1209 			kau_write(rec, tok);
1210 		}
1211 		break;
1212 
1213 	case AUE_UMOUNT:
1214 		if (ARG_IS_VALID(kar, ARG_VALUE)) {
1215 			tok = au_to_arg32(2, "flags", ar->ar_arg_value);
1216 			kau_write(rec, tok);
1217 		}
1218 		UPATH1_VNODE1_TOKENS;
1219 		if (ARG_IS_VALID(kar, ARG_TEXT)) {
1220 			tok = au_to_text(ar->ar_arg_text);
1221 			kau_write(rec, tok);
1222 		}
1223 		break;
1224 
1225 	case AUE_MSGCTL:
1226 		ar->ar_event = audit_msgctl_to_event(ar->ar_arg_svipc_cmd);
1227 		/* Fall through */
1228 
1229 	case AUE_MSGRCV:
1230 	case AUE_MSGSND:
1231 		tok = au_to_arg32(1, "msg ID", ar->ar_arg_svipc_id);
1232 		kau_write(rec, tok);
1233 		if (ar->ar_errno != EINVAL) {
1234 			tok = au_to_ipc(AT_IPC_MSG, ar->ar_arg_svipc_id);
1235 			kau_write(rec, tok);
1236 		}
1237 		break;
1238 
1239 	case AUE_MSGGET:
1240 		if (ar->ar_errno == 0) {
1241 			if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
1242 				tok = au_to_ipc(AT_IPC_MSG,
1243 				    ar->ar_arg_svipc_id);
1244 				kau_write(rec, tok);
1245 			}
1246 		}
1247 		break;
1248 
1249 	case AUE_RESETSHFILE:
1250 		ADDR_TOKEN(1, "base addr");
1251 		break;
1252 
1253 	case AUE_OPEN_RC:
1254 	case AUE_OPEN_RTC:
1255 	case AUE_OPEN_RWC:
1256 	case AUE_OPEN_RWTC:
1257 	case AUE_OPEN_WC:
1258 	case AUE_OPEN_WTC:
1259 	case AUE_CREAT:
1260 		if (ARG_IS_VALID(kar, ARG_MODE)) {
1261 			tok = au_to_arg32(3, "mode", ar->ar_arg_mode);
1262 			kau_write(rec, tok);
1263 		}
1264 		/* FALLTHROUGH */
1265 
1266 	case AUE_OPEN_R:
1267 	case AUE_OPEN_RT:
1268 	case AUE_OPEN_RW:
1269 	case AUE_OPEN_RWT:
1270 	case AUE_OPEN_W:
1271 	case AUE_OPEN_WT:
1272 		if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1273 			tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
1274 			kau_write(rec, tok);
1275 		}
1276 		UPATH1_VNODE1_TOKENS;
1277 		break;
1278 
1279 	case AUE_OPENAT_RC:
1280 	case AUE_OPENAT_RTC:
1281 	case AUE_OPENAT_RWC:
1282 	case AUE_OPENAT_RWTC:
1283 	case AUE_OPENAT_WC:
1284 	case AUE_OPENAT_WTC:
1285 		if (ARG_IS_VALID(kar, ARG_MODE)) {
1286 			tok = au_to_arg32(3, "mode", ar->ar_arg_mode);
1287 			kau_write(rec, tok);
1288 		}
1289 		/* FALLTHROUGH */
1290 
1291 	case AUE_OPENAT_R:
1292 	case AUE_OPENAT_RT:
1293 	case AUE_OPENAT_RW:
1294 	case AUE_OPENAT_RWT:
1295 	case AUE_OPENAT_W:
1296 	case AUE_OPENAT_WT:
1297 		if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1298 			tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
1299 			kau_write(rec, tok);
1300 		}
1301 		ATFD1_TOKENS(1);
1302 		UPATH1_VNODE1_TOKENS;
1303 		break;
1304 
1305 	case AUE_PROCCTL:
1306 		if (ARG_IS_VALID(kar, ARG_VALUE)) {
1307 			tok = au_to_arg32(1, "idtype", ar->ar_arg_value);
1308 			kau_write(rec, tok);
1309 		}
1310 		if (ARG_IS_VALID(kar, ARG_CMD)) {
1311 			tok = au_to_arg32(2, "com", ar->ar_arg_cmd);
1312 			kau_write(rec, tok);
1313 		}
1314 		PROCESS_PID_TOKENS(3);
1315 		break;
1316 
1317 	case AUE_PTRACE:
1318 		if (ARG_IS_VALID(kar, ARG_CMD)) {
1319 			tok = au_to_arg32(1, "request", ar->ar_arg_cmd);
1320 			kau_write(rec, tok);
1321 		}
1322 		if (ARG_IS_VALID(kar, ARG_VALUE)) {
1323 			tok = au_to_arg32(4, "data", ar->ar_arg_value);
1324 			kau_write(rec, tok);
1325 		}
1326 		PROCESS_PID_TOKENS(2);
1327 		break;
1328 
1329 	case AUE_QUOTACTL:
1330 		if (ARG_IS_VALID(kar, ARG_CMD)) {
1331 			tok = au_to_arg32(2, "command", ar->ar_arg_cmd);
1332 			kau_write(rec, tok);
1333 		}
1334 		if (ARG_IS_VALID(kar, ARG_UID)) {
1335 			tok = au_to_arg32(3, "uid", ar->ar_arg_uid);
1336 			kau_write(rec, tok);
1337 		}
1338 		if (ARG_IS_VALID(kar, ARG_GID)) {
1339 			tok = au_to_arg32(3, "gid", ar->ar_arg_gid);
1340 			kau_write(rec, tok);
1341 		}
1342 		UPATH1_VNODE1_TOKENS;
1343 		break;
1344 
1345 	case AUE_REBOOT:
1346 		if (ARG_IS_VALID(kar, ARG_CMD)) {
1347 			tok = au_to_arg32(1, "howto", ar->ar_arg_cmd);
1348 			kau_write(rec, tok);
1349 		}
1350 		break;
1351 
1352 	case AUE_SEMCTL:
1353 		ar->ar_event = audit_semctl_to_event(ar->ar_arg_svipc_cmd);
1354 		/* Fall through */
1355 
1356 	case AUE_SEMOP:
1357 		if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
1358 			tok = au_to_arg32(1, "sem ID", ar->ar_arg_svipc_id);
1359 			kau_write(rec, tok);
1360 			if (ar->ar_errno != EINVAL) {
1361 				tok = au_to_ipc(AT_IPC_SEM,
1362 				    ar->ar_arg_svipc_id);
1363 				kau_write(rec, tok);
1364 			}
1365 		}
1366 		break;
1367 
1368 	case AUE_SEMGET:
1369 		if (ar->ar_errno == 0) {
1370 			if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
1371 				tok = au_to_ipc(AT_IPC_SEM,
1372 				    ar->ar_arg_svipc_id);
1373 				kau_write(rec, tok);
1374 			}
1375 		}
1376 		break;
1377 
1378 	case AUE_SETEGID:
1379 		if (ARG_IS_VALID(kar, ARG_EGID)) {
1380 			tok = au_to_arg32(1, "egid", ar->ar_arg_egid);
1381 			kau_write(rec, tok);
1382 		}
1383 		break;
1384 
1385 	case AUE_SETEUID:
1386 		if (ARG_IS_VALID(kar, ARG_EUID)) {
1387 			tok = au_to_arg32(1, "euid", ar->ar_arg_euid);
1388 			kau_write(rec, tok);
1389 		}
1390 		break;
1391 
1392 	case AUE_SETREGID:
1393 		if (ARG_IS_VALID(kar, ARG_RGID)) {
1394 			tok = au_to_arg32(1, "rgid", ar->ar_arg_rgid);
1395 			kau_write(rec, tok);
1396 		}
1397 		if (ARG_IS_VALID(kar, ARG_EGID)) {
1398 			tok = au_to_arg32(2, "egid", ar->ar_arg_egid);
1399 			kau_write(rec, tok);
1400 		}
1401 		break;
1402 
1403 	case AUE_SETREUID:
1404 		if (ARG_IS_VALID(kar, ARG_RUID)) {
1405 			tok = au_to_arg32(1, "ruid", ar->ar_arg_ruid);
1406 			kau_write(rec, tok);
1407 		}
1408 		if (ARG_IS_VALID(kar, ARG_EUID)) {
1409 			tok = au_to_arg32(2, "euid", ar->ar_arg_euid);
1410 			kau_write(rec, tok);
1411 		}
1412 		break;
1413 
1414 	case AUE_SETRESGID:
1415 		if (ARG_IS_VALID(kar, ARG_RGID)) {
1416 			tok = au_to_arg32(1, "rgid", ar->ar_arg_rgid);
1417 			kau_write(rec, tok);
1418 		}
1419 		if (ARG_IS_VALID(kar, ARG_EGID)) {
1420 			tok = au_to_arg32(2, "egid", ar->ar_arg_egid);
1421 			kau_write(rec, tok);
1422 		}
1423 		if (ARG_IS_VALID(kar, ARG_SGID)) {
1424 			tok = au_to_arg32(3, "sgid", ar->ar_arg_sgid);
1425 			kau_write(rec, tok);
1426 		}
1427 		break;
1428 
1429 	case AUE_SETRESUID:
1430 		if (ARG_IS_VALID(kar, ARG_RUID)) {
1431 			tok = au_to_arg32(1, "ruid", ar->ar_arg_ruid);
1432 			kau_write(rec, tok);
1433 		}
1434 		if (ARG_IS_VALID(kar, ARG_EUID)) {
1435 			tok = au_to_arg32(2, "euid", ar->ar_arg_euid);
1436 			kau_write(rec, tok);
1437 		}
1438 		if (ARG_IS_VALID(kar, ARG_SUID)) {
1439 			tok = au_to_arg32(3, "suid", ar->ar_arg_suid);
1440 			kau_write(rec, tok);
1441 		}
1442 		break;
1443 
1444 	case AUE_SETGID:
1445 		if (ARG_IS_VALID(kar, ARG_GID)) {
1446 			tok = au_to_arg32(1, "gid", ar->ar_arg_gid);
1447 			kau_write(rec, tok);
1448 		}
1449 		break;
1450 
1451 	case AUE_SETUID:
1452 		if (ARG_IS_VALID(kar, ARG_UID)) {
1453 			tok = au_to_arg32(1, "uid", ar->ar_arg_uid);
1454 			kau_write(rec, tok);
1455 		}
1456 		break;
1457 
1458 	case AUE_SETGROUPS:
1459 		if (ARG_IS_VALID(kar, ARG_GROUPSET)) {
1460 			for(ctr = 0; ctr < ar->ar_arg_groups.gidset_size; ctr++)
1461 			{
1462 				tok = au_to_arg32(1, "setgroups",
1463 				    ar->ar_arg_groups.gidset[ctr]);
1464 				kau_write(rec, tok);
1465 			}
1466 		}
1467 		break;
1468 
1469 	case AUE_SETLOGIN:
1470 		if (ARG_IS_VALID(kar, ARG_LOGIN)) {
1471 			tok = au_to_text(ar->ar_arg_login);
1472 			kau_write(rec, tok);
1473 		}
1474 		break;
1475 
1476 	case AUE_SETPRIORITY:
1477 		if (ARG_IS_VALID(kar, ARG_CMD)) {
1478 			tok = au_to_arg32(1, "which", ar->ar_arg_cmd);
1479 			kau_write(rec, tok);
1480 		}
1481 		if (ARG_IS_VALID(kar, ARG_UID)) {
1482 			tok = au_to_arg32(2, "who", ar->ar_arg_uid);
1483 			kau_write(rec, tok);
1484 		}
1485 		PROCESS_PID_TOKENS(2);
1486 		if (ARG_IS_VALID(kar, ARG_VALUE)) {
1487 			tok = au_to_arg32(3, "priority", ar->ar_arg_value);
1488 			kau_write(rec, tok);
1489 		}
1490 		break;
1491 
1492 	case AUE_SETPRIVEXEC:
1493 		if (ARG_IS_VALID(kar, ARG_VALUE)) {
1494 			tok = au_to_arg32(1, "flag", ar->ar_arg_value);
1495 			kau_write(rec, tok);
1496 		}
1497 		break;
1498 
1499 	/* AUE_SHMAT, AUE_SHMCTL, AUE_SHMDT and AUE_SHMGET are SysV IPC */
1500 	case AUE_SHMAT:
1501 		if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
1502 			tok = au_to_arg32(1, "shmid", ar->ar_arg_svipc_id);
1503 			kau_write(rec, tok);
1504 			/* XXXAUDIT: Does having the ipc token make sense? */
1505 			tok = au_to_ipc(AT_IPC_SHM, ar->ar_arg_svipc_id);
1506 			kau_write(rec, tok);
1507 		}
1508 		if (ARG_IS_VALID(kar, ARG_SVIPC_ADDR)) {
1509 			tok = au_to_arg32(2, "shmaddr",
1510 			    (int)(uintptr_t)ar->ar_arg_svipc_addr);
1511 			kau_write(rec, tok);
1512 		}
1513 		if (ARG_IS_VALID(kar, ARG_SVIPC_PERM)) {
1514 			tok = au_to_ipc_perm(&ar->ar_arg_svipc_perm);
1515 			kau_write(rec, tok);
1516 		}
1517 		break;
1518 
1519 	case AUE_SHMCTL:
1520 		if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
1521 			tok = au_to_arg32(1, "shmid", ar->ar_arg_svipc_id);
1522 			kau_write(rec, tok);
1523 			/* XXXAUDIT: Does having the ipc token make sense? */
1524 			tok = au_to_ipc(AT_IPC_SHM, ar->ar_arg_svipc_id);
1525 			kau_write(rec, tok);
1526 		}
1527 		switch (ar->ar_arg_svipc_cmd) {
1528 		case IPC_STAT:
1529 			ar->ar_event = AUE_SHMCTL_STAT;
1530 			break;
1531 		case IPC_RMID:
1532 			ar->ar_event = AUE_SHMCTL_RMID;
1533 			break;
1534 		case IPC_SET:
1535 			ar->ar_event = AUE_SHMCTL_SET;
1536 			if (ARG_IS_VALID(kar, ARG_SVIPC_PERM)) {
1537 				tok = au_to_ipc_perm(&ar->ar_arg_svipc_perm);
1538 				kau_write(rec, tok);
1539 			}
1540 			break;
1541 		default:
1542 			break;	/* We will audit a bad command */
1543 		}
1544 		break;
1545 
1546 	case AUE_SHMDT:
1547 		if (ARG_IS_VALID(kar, ARG_SVIPC_ADDR)) {
1548 			tok = au_to_arg32(1, "shmaddr",
1549 			    (int)(uintptr_t)ar->ar_arg_svipc_addr);
1550 			kau_write(rec, tok);
1551 		}
1552 		break;
1553 
1554 	case AUE_SHMGET:
1555 		/* This is unusual; the return value is in an argument token */
1556 		if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
1557 			tok = au_to_arg32(0, "shmid", ar->ar_arg_svipc_id);
1558 			kau_write(rec, tok);
1559 			tok = au_to_ipc(AT_IPC_SHM, ar->ar_arg_svipc_id);
1560 			kau_write(rec, tok);
1561 		}
1562 		if (ARG_IS_VALID(kar, ARG_SVIPC_PERM)) {
1563 			tok = au_to_ipc_perm(&ar->ar_arg_svipc_perm);
1564 			kau_write(rec, tok);
1565 		}
1566 		break;
1567 
1568 	/* AUE_SHMOPEN, AUE_SHMUNLINK, AUE_SEMOPEN, AUE_SEMCLOSE
1569 	 * and AUE_SEMUNLINK are Posix IPC */
1570 	case AUE_SHMOPEN:
1571 		if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1572 			tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
1573 			kau_write(rec, tok);
1574 		}
1575 		if (ARG_IS_VALID(kar, ARG_MODE)) {
1576 			tok = au_to_arg32(3, "mode", ar->ar_arg_mode);
1577 			kau_write(rec, tok);
1578 		}
1579 		/* FALLTHROUGH */
1580 
1581 	case AUE_SHMUNLINK:
1582 		UPATH1_TOKENS;
1583 		if (ARG_IS_VALID(kar, ARG_POSIX_IPC_PERM)) {
1584 			struct ipc_perm perm;
1585 
1586 			perm.uid = ar->ar_arg_pipc_perm.pipc_uid;
1587 			perm.gid = ar->ar_arg_pipc_perm.pipc_gid;
1588 			perm.cuid = ar->ar_arg_pipc_perm.pipc_uid;
1589 			perm.cgid = ar->ar_arg_pipc_perm.pipc_gid;
1590 			perm.mode = ar->ar_arg_pipc_perm.pipc_mode;
1591 			perm.seq = 0;
1592 			perm.key = 0;
1593 			tok = au_to_ipc_perm(&perm);
1594 			kau_write(rec, tok);
1595 		}
1596 		break;
1597 
1598 	case AUE_SEMOPEN:
1599 		if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1600 			tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
1601 			kau_write(rec, tok);
1602 		}
1603 		if (ARG_IS_VALID(kar, ARG_MODE)) {
1604 			tok = au_to_arg32(3, "mode", ar->ar_arg_mode);
1605 			kau_write(rec, tok);
1606 		}
1607 		if (ARG_IS_VALID(kar, ARG_VALUE)) {
1608 			tok = au_to_arg32(4, "value", ar->ar_arg_value);
1609 			kau_write(rec, tok);
1610 		}
1611 		/* FALLTHROUGH */
1612 
1613 	case AUE_SEMUNLINK:
1614 		if (ARG_IS_VALID(kar, ARG_TEXT)) {
1615 			tok = au_to_text(ar->ar_arg_text);
1616 			kau_write(rec, tok);
1617 		}
1618 		if (ARG_IS_VALID(kar, ARG_POSIX_IPC_PERM)) {
1619 			struct ipc_perm perm;
1620 
1621 			perm.uid = ar->ar_arg_pipc_perm.pipc_uid;
1622 			perm.gid = ar->ar_arg_pipc_perm.pipc_gid;
1623 			perm.cuid = ar->ar_arg_pipc_perm.pipc_uid;
1624 			perm.cgid = ar->ar_arg_pipc_perm.pipc_gid;
1625 			perm.mode = ar->ar_arg_pipc_perm.pipc_mode;
1626 			perm.seq = 0;
1627 			perm.key = 0;
1628 			tok = au_to_ipc_perm(&perm);
1629 			kau_write(rec, tok);
1630 		}
1631 		break;
1632 
1633 	case AUE_SEMCLOSE:
1634 		if (ARG_IS_VALID(kar, ARG_FD)) {
1635 			tok = au_to_arg32(1, "sem", ar->ar_arg_fd);
1636 			kau_write(rec, tok);
1637 		}
1638 		break;
1639 
1640 	case AUE_SYMLINK:
1641 	case AUE_SYMLINKAT:
1642 		if (ARG_IS_VALID(kar, ARG_TEXT)) {
1643 			tok = au_to_text(ar->ar_arg_text);
1644 			kau_write(rec, tok);
1645 		}
1646 		ATFD1_TOKENS(1);
1647 		UPATH1_VNODE1_TOKENS;
1648 		break;
1649 
1650 	case AUE_SYSCTL:
1651 	case AUE_SYSCTL_NONADMIN:
1652 		if (ARG_IS_VALID(kar, ARG_CTLNAME | ARG_LEN)) {
1653 			for (ctr = 0; ctr < ar->ar_arg_len; ctr++) {
1654 				tok = au_to_arg32(1, "name",
1655 				    ar->ar_arg_ctlname[ctr]);
1656 				kau_write(rec, tok);
1657 			}
1658 		}
1659 		if (ARG_IS_VALID(kar, ARG_VALUE)) {
1660 			tok = au_to_arg32(5, "newval", ar->ar_arg_value);
1661 			kau_write(rec, tok);
1662 		}
1663 		if (ARG_IS_VALID(kar, ARG_TEXT)) {
1664 			tok = au_to_text(ar->ar_arg_text);
1665 			kau_write(rec, tok);
1666 		}
1667 		break;
1668 
1669 	case AUE_UMASK:
1670 		if (ARG_IS_VALID(kar, ARG_MASK)) {
1671 			tok = au_to_arg32(1, "new mask", ar->ar_arg_mask);
1672 			kau_write(rec, tok);
1673 		}
1674 		tok = au_to_arg32(0, "prev mask", ar->ar_retval);
1675 		kau_write(rec, tok);
1676 		break;
1677 
1678 	case AUE_WAIT4:
1679 	case AUE_WAIT6:
1680 		PROCESS_PID_TOKENS(1);
1681 		if (ARG_IS_VALID(kar, ARG_VALUE)) {
1682 			tok = au_to_arg32(3, "options", ar->ar_arg_value);
1683 			kau_write(rec, tok);
1684 		}
1685 		break;
1686 
1687 	case AUE_CAP_RIGHTS_LIMIT:
1688 		/*
1689 		 * XXXRW/XXXJA: Would be nice to audit socket/etc information.
1690 		 */
1691 		FD_VNODE1_TOKENS;
1692 		if (ARG_IS_VALID(kar, ARG_RIGHTS)) {
1693 			tok = au_to_rights(&ar->ar_arg_rights);
1694 			kau_write(rec, tok);
1695 		}
1696 		break;
1697 
1698 	case AUE_CAP_FCNTLS_GET:
1699 	case AUE_CAP_IOCTLS_GET:
1700 	case AUE_CAP_IOCTLS_LIMIT:
1701 	case AUE_CAP_RIGHTS_GET:
1702 		if (ARG_IS_VALID(kar, ARG_FD)) {
1703 			tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
1704 			kau_write(rec, tok);
1705 		}
1706 		break;
1707 
1708 	case AUE_CAP_FCNTLS_LIMIT:
1709 		FD_VNODE1_TOKENS;
1710 		if (ARG_IS_VALID(kar, ARG_FCNTL_RIGHTS)) {
1711 			tok = au_to_arg32(2, "fcntlrights",
1712 			    ar->ar_arg_fcntl_rights);
1713 			kau_write(rec, tok);
1714 		}
1715 		break;
1716 
1717 	case AUE_CAP_ENTER:
1718 	case AUE_CAP_GETMODE:
1719 		break;
1720 
1721 	case AUE_NULL:
1722 	default:
1723 		printf("BSM conversion requested for unknown event %d\n",
1724 		    ar->ar_event);
1725 
1726 		/*
1727 		 * Write the subject token so it is properly freed here.
1728 		 */
1729 		if (jail_tok != NULL)
1730 			kau_write(rec, jail_tok);
1731 		kau_write(rec, subj_tok);
1732 		kau_free(rec);
1733 		return (BSM_NOAUDIT);
1734 	}
1735 
1736 	if (jail_tok != NULL)
1737 		kau_write(rec, jail_tok);
1738 	kau_write(rec, subj_tok);
1739 	tok = au_to_return32(au_errno_to_bsm(ar->ar_errno), ar->ar_retval);
1740 	kau_write(rec, tok);  /* Every record gets a return token */
1741 
1742 	kau_close(rec, &ar->ar_endtime, ar->ar_event);
1743 
1744 	*pau = rec;
1745 	return (BSM_SUCCESS);
1746 }
1747 
1748 /*
1749  * Verify that a record is a valid BSM record. This verification is simple
1750  * now, but may be expanded on sometime in the future.  Return 1 if the
1751  * record is good, 0 otherwise.
1752  */
1753 int
1754 bsm_rec_verify(void *rec)
1755 {
1756 	char c = *(char *)rec;
1757 
1758 	/*
1759 	 * Check the token ID of the first token; it has to be a header
1760 	 * token.
1761 	 *
1762 	 * XXXAUDIT There needs to be a token structure to map a token.
1763 	 * XXXAUDIT 'Shouldn't be simply looking at the first char.
1764 	 */
1765 	if ((c != AUT_HEADER32) && (c != AUT_HEADER32_EX) &&
1766 	    (c != AUT_HEADER64) && (c != AUT_HEADER64_EX))
1767 		return (0);
1768 	return (1);
1769 }
1770