xref: /freebsd/sys/security/audit/audit_bsm.c (revision 4ed925457ab06e83238a5db33e89ccc94b99a713)
1 /*
2  * Copyright (c) 1999-2009 Apple Inc.
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1.  Redistributions of source code must retain the above copyright
9  *     notice, this list of conditions and the following disclaimer.
10  * 2.  Redistributions in binary form must reproduce the above copyright
11  *     notice, this list of conditions and the following disclaimer in the
12  *     documentation and/or other materials provided with the distribution.
13  * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
14  *     its contributors may be used to endorse or promote products derived
15  *     from this software without specific prior written permission.
16  *
17  * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND
18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20  * ARE DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR
21  * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
25  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
26  * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
27  * POSSIBILITY OF SUCH DAMAGE.
28  */
29 
30 #include <sys/cdefs.h>
31 __FBSDID("$FreeBSD$");
32 
33 #include <sys/param.h>
34 #include <sys/vnode.h>
35 #include <sys/ipc.h>
36 #include <sys/lock.h>
37 #include <sys/malloc.h>
38 #include <sys/mutex.h>
39 #include <sys/socket.h>
40 #include <sys/extattr.h>
41 #include <sys/fcntl.h>
42 #include <sys/user.h>
43 #include <sys/systm.h>
44 
45 #include <bsm/audit.h>
46 #include <bsm/audit_internal.h>
47 #include <bsm/audit_record.h>
48 #include <bsm/audit_kevents.h>
49 
50 #include <security/audit/audit.h>
51 #include <security/audit/audit_private.h>
52 
53 #include <netinet/in_systm.h>
54 #include <netinet/in.h>
55 #include <netinet/ip.h>
56 
57 MALLOC_DEFINE(M_AUDITBSM, "audit_bsm", "Audit BSM data");
58 
59 static void	audit_sys_auditon(struct audit_record *ar,
60 		    struct au_record *rec);
61 
62 /*
63  * Initialize the BSM auditing subsystem.
64  */
65 void
66 kau_init(void)
67 {
68 
69 	au_evclassmap_init();
70 }
71 
72 /*
73  * This call reserves memory for the audit record.  Memory must be guaranteed
74  * before any auditable event can be generated.  The au_record structure
75  * maintains a reference to the memory allocated above and also the list of
76  * tokens associated with this record.
77  */
78 static struct au_record *
79 kau_open(void)
80 {
81 	struct au_record *rec;
82 
83 	rec = malloc(sizeof(*rec), M_AUDITBSM, M_WAITOK);
84 	rec->data = NULL;
85 	TAILQ_INIT(&rec->token_q);
86 	rec->len = 0;
87 	rec->used = 1;
88 
89 	return (rec);
90 }
91 
92 /*
93  * Store the token with the record descriptor.
94  */
95 static void
96 kau_write(struct au_record *rec, struct au_token *tok)
97 {
98 
99 	KASSERT(tok != NULL, ("kau_write: tok == NULL"));
100 
101 	TAILQ_INSERT_TAIL(&rec->token_q, tok, tokens);
102 	rec->len += tok->len;
103 }
104 
105 /*
106  * Close out the audit record by adding the header token, identifying any
107  * missing tokens.  Write out the tokens to the record memory.
108  */
109 static void
110 kau_close(struct au_record *rec, struct timespec *ctime, short event)
111 {
112 	u_char *dptr;
113 	size_t tot_rec_size;
114 	token_t *cur, *hdr, *trail;
115 	struct timeval tm;
116 	size_t hdrsize;
117 	struct auditinfo_addr ak;
118 	struct in6_addr *ap;
119 
120 	audit_get_kinfo(&ak);
121 	hdrsize = 0;
122 	switch (ak.ai_termid.at_type) {
123 	case AU_IPv4:
124 		hdrsize = (ak.ai_termid.at_addr[0] == INADDR_ANY) ?
125 		    AUDIT_HEADER_SIZE : AUDIT_HEADER_EX_SIZE(&ak);
126 		break;
127 	case AU_IPv6:
128 		ap = (struct in6_addr *)&ak.ai_termid.at_addr[0];
129 		hdrsize = (IN6_IS_ADDR_UNSPECIFIED(ap)) ? AUDIT_HEADER_SIZE :
130 		    AUDIT_HEADER_EX_SIZE(&ak);
131 		break;
132 	default:
133 		panic("kau_close: invalid address family");
134 	}
135 	tot_rec_size = rec->len + hdrsize + AUDIT_TRAILER_SIZE;
136 	rec->data = malloc(tot_rec_size, M_AUDITBSM, M_WAITOK | M_ZERO);
137 
138 	tm.tv_usec = ctime->tv_nsec / 1000;
139 	tm.tv_sec = ctime->tv_sec;
140 	if (hdrsize != AUDIT_HEADER_SIZE)
141 		hdr = au_to_header32_ex_tm(tot_rec_size, event, 0, tm, &ak);
142 	else
143 		hdr = au_to_header32_tm(tot_rec_size, event, 0, tm);
144 	TAILQ_INSERT_HEAD(&rec->token_q, hdr, tokens);
145 
146 	trail = au_to_trailer(tot_rec_size);
147 	TAILQ_INSERT_TAIL(&rec->token_q, trail, tokens);
148 
149 	rec->len = tot_rec_size;
150 	dptr = rec->data;
151 	TAILQ_FOREACH(cur, &rec->token_q, tokens) {
152 		memcpy(dptr, cur->t_data, cur->len);
153 		dptr += cur->len;
154 	}
155 }
156 
157 /*
158  * Free a BSM audit record by releasing all the tokens and clearing the audit
159  * record information.
160  */
161 void
162 kau_free(struct au_record *rec)
163 {
164 	struct au_token *tok;
165 
166 	/* Free the token list. */
167 	while ((tok = TAILQ_FIRST(&rec->token_q))) {
168 		TAILQ_REMOVE(&rec->token_q, tok, tokens);
169 		free(tok->t_data, M_AUDITBSM);
170 		free(tok, M_AUDITBSM);
171 	}
172 
173 	rec->used = 0;
174 	rec->len = 0;
175 	free(rec->data, M_AUDITBSM);
176 	free(rec, M_AUDITBSM);
177 }
178 
179 /*
180  * XXX: May want turn some (or all) of these macros into functions in order
181  * to reduce the generated code size.
182  *
183  * XXXAUDIT: These macros assume that 'kar', 'ar', 'rec', and 'tok' in the
184  * caller are OK with this.
185  */
186 #define	ATFD1_TOKENS(argnum) do {					\
187 	if (ARG_IS_VALID(kar, ARG_ATFD1)) {				\
188 		tok = au_to_arg32(argnum, "at fd 1", ar->ar_arg_atfd1);	\
189 		kau_write(rec, tok);					\
190 	}								\
191 } while (0)
192 
193 #define	ATFD2_TOKENS(argnum) do {					\
194 	if (ARG_IS_VALID(kar, ARG_ATFD2)) {				\
195 		tok = au_to_arg32(argnum, "at fd 2", ar->ar_arg_atfd2);	\
196 		kau_write(rec, tok);					\
197 	}								\
198 } while (0)
199 
200 #define	UPATH1_TOKENS do {						\
201 	if (ARG_IS_VALID(kar, ARG_UPATH1)) {				\
202 		tok = au_to_path(ar->ar_arg_upath1);			\
203 		kau_write(rec, tok);					\
204 	}								\
205 } while (0)
206 
207 #define	UPATH2_TOKENS do {						\
208 	if (ARG_IS_VALID(kar, ARG_UPATH2)) {				\
209 		tok = au_to_path(ar->ar_arg_upath2);			\
210 		kau_write(rec, tok);					\
211 	}								\
212 } while (0)
213 
214 #define	VNODE1_TOKENS do {						\
215 	if (ARG_IS_VALID(kar, ARG_ATFD)) {				\
216 		tok = au_to_arg32(1, "at fd", ar->ar_arg_atfd);		\
217 		kau_write(rec, tok);					\
218 	}								\
219 	if (ARG_IS_VALID(kar, ARG_VNODE1)) {				\
220 		tok = au_to_attr32(&ar->ar_arg_vnode1);			\
221 		kau_write(rec, tok);					\
222 	}								\
223 } while (0)
224 
225 #define	UPATH1_VNODE1_TOKENS do {					\
226 	if (ARG_IS_VALID(kar, ARG_UPATH1)) {				\
227 		UPATH1_TOKENS;						\
228 	}								\
229 	if (ARG_IS_VALID(kar, ARG_VNODE1)) {				\
230 		tok = au_to_attr32(&ar->ar_arg_vnode1);			\
231 		kau_write(rec, tok);					\
232 	}								\
233 } while (0)
234 
235 #define	VNODE2_TOKENS do {						\
236 	if (ARG_IS_VALID(kar, ARG_VNODE2)) {				\
237 		tok = au_to_attr32(&ar->ar_arg_vnode2);			\
238 		kau_write(rec, tok);					\
239 	}								\
240 } while (0)
241 
242 #define	FD_VNODE1_TOKENS do {						\
243 	if (ARG_IS_VALID(kar, ARG_VNODE1)) {				\
244 		if (ARG_IS_VALID(kar, ARG_FD)) {			\
245 			tok = au_to_arg32(1, "fd", ar->ar_arg_fd);	\
246 			kau_write(rec, tok);				\
247 		}							\
248 		tok = au_to_attr32(&ar->ar_arg_vnode1);			\
249 		kau_write(rec, tok);					\
250 	} else {							\
251 		if (ARG_IS_VALID(kar, ARG_FD)) {			\
252 			tok = au_to_arg32(1, "non-file: fd",		\
253 			    ar->ar_arg_fd);				\
254 			kau_write(rec, tok);				\
255 		}							\
256 	}								\
257 } while (0)
258 
259 #define	PROCESS_PID_TOKENS(argn) do {					\
260 	if ((ar->ar_arg_pid > 0) /* Reference a single process */	\
261 	    && (ARG_IS_VALID(kar, ARG_PROCESS))) {			\
262 		tok = au_to_process32_ex(ar->ar_arg_auid,		\
263 		    ar->ar_arg_euid, ar->ar_arg_egid,			\
264 		    ar->ar_arg_ruid, ar->ar_arg_rgid,			\
265 		    ar->ar_arg_pid, ar->ar_arg_asid,			\
266 		    &ar->ar_arg_termid_addr);				\
267 		kau_write(rec, tok);					\
268 	} else if (ARG_IS_VALID(kar, ARG_PID)) {			\
269 		tok = au_to_arg32(argn, "process", ar->ar_arg_pid);	\
270 		kau_write(rec, tok);					\
271 	}								\
272 } while (0)
273 
274 #define	EXTATTR_TOKENS(namespace_argnum) do {				\
275 	if (ARG_IS_VALID(kar, ARG_VALUE)) {				\
276 		switch (ar->ar_arg_value) {				\
277 		case EXTATTR_NAMESPACE_USER:				\
278 			tok = au_to_text(EXTATTR_NAMESPACE_USER_STRING);\
279 			break;						\
280 		case EXTATTR_NAMESPACE_SYSTEM:				\
281 			tok = au_to_text(EXTATTR_NAMESPACE_SYSTEM_STRING);\
282 			break;						\
283 		default:						\
284 			tok = au_to_arg32((namespace_argnum),		\
285 			    "attrnamespace", ar->ar_arg_value);		\
286 			break;						\
287 		}							\
288 		kau_write(rec, tok);					\
289 	}								\
290 	/* attrname is in the text field */				\
291 	if (ARG_IS_VALID(kar, ARG_TEXT)) {				\
292 		tok = au_to_text(ar->ar_arg_text);			\
293 		kau_write(rec, tok);					\
294 	}								\
295 } while (0)
296 
297 /*
298  * Not all pointer arguments to system calls are of interest, but in some
299  * cases they reflect delegation of rights, such as mmap(2) followed by
300  * minherit(2) before execve(2), so do the best we can.
301  */
302 #define	ADDR_TOKEN(argnum, argname) do {				\
303 	if (ARG_IS_VALID(kar, ARG_ADDR)) {				\
304 		if (sizeof(void *) == sizeof(uint32_t))			\
305 			tok = au_to_arg32((argnum), (argname),		\
306 			    (uint32_t)(uintptr_t)ar->ar_arg_addr);	\
307 		else							\
308 			tok = au_to_arg64((argnum), (argname),		\
309 			    (uint64_t)(uintptr_t)ar->ar_arg_addr);	\
310 		kau_write(rec, tok);					\
311 	}								\
312 } while (0)
313 
314 
315 /*
316  * Implement auditing for the auditon() system call. The audit tokens that
317  * are generated depend on the command that was sent into the auditon()
318  * system call.
319  */
320 static void
321 audit_sys_auditon(struct audit_record *ar, struct au_record *rec)
322 {
323 	struct au_token *tok;
324 
325 	tok = au_to_arg32(3, "length", ar->ar_arg_len);
326 	kau_write(rec, tok);
327 	switch (ar->ar_arg_cmd) {
328 	case A_OLDSETPOLICY:
329 		if ((size_t)ar->ar_arg_len == sizeof(int64_t)) {
330 			tok = au_to_arg64(2, "policy",
331 			    ar->ar_arg_auditon.au_policy64);
332 			kau_write(rec, tok);
333 			break;
334 		}
335 		/* FALLTHROUGH */
336 
337 	case A_SETPOLICY:
338 		tok = au_to_arg32(2, "policy", ar->ar_arg_auditon.au_policy);
339 		kau_write(rec, tok);
340 		break;
341 
342 	case A_SETKMASK:
343 		tok = au_to_arg32(2, "setkmask:as_success",
344 		    ar->ar_arg_auditon.au_mask.am_success);
345 		kau_write(rec, tok);
346 		tok = au_to_arg32(2, "setkmask:as_failure",
347 		    ar->ar_arg_auditon.au_mask.am_failure);
348 		kau_write(rec, tok);
349 		break;
350 
351 	case A_OLDSETQCTRL:
352 		if ((size_t)ar->ar_arg_len == sizeof(au_qctrl64_t)) {
353 			tok = au_to_arg64(2, "setqctrl:aq_hiwater",
354 			    ar->ar_arg_auditon.au_qctrl64.aq64_hiwater);
355 			kau_write(rec, tok);
356 			tok = au_to_arg64(2, "setqctrl:aq_lowater",
357 			    ar->ar_arg_auditon.au_qctrl64.aq64_lowater);
358 			kau_write(rec, tok);
359 			tok = au_to_arg64(2, "setqctrl:aq_bufsz",
360 			    ar->ar_arg_auditon.au_qctrl64.aq64_bufsz);
361 			kau_write(rec, tok);
362 			tok = au_to_arg64(2, "setqctrl:aq_delay",
363 			    ar->ar_arg_auditon.au_qctrl64.aq64_delay);
364 			kau_write(rec, tok);
365 			tok = au_to_arg64(2, "setqctrl:aq_minfree",
366 			    ar->ar_arg_auditon.au_qctrl64.aq64_minfree);
367 			kau_write(rec, tok);
368 			break;
369 		}
370 		/* FALLTHROUGH */
371 
372 	case A_SETQCTRL:
373 		tok = au_to_arg32(2, "setqctrl:aq_hiwater",
374 		    ar->ar_arg_auditon.au_qctrl.aq_hiwater);
375 		kau_write(rec, tok);
376 		tok = au_to_arg32(2, "setqctrl:aq_lowater",
377 		    ar->ar_arg_auditon.au_qctrl.aq_lowater);
378 		kau_write(rec, tok);
379 		tok = au_to_arg32(2, "setqctrl:aq_bufsz",
380 		    ar->ar_arg_auditon.au_qctrl.aq_bufsz);
381 		kau_write(rec, tok);
382 		tok = au_to_arg32(2, "setqctrl:aq_delay",
383 		    ar->ar_arg_auditon.au_qctrl.aq_delay);
384 		kau_write(rec, tok);
385 		tok = au_to_arg32(2, "setqctrl:aq_minfree",
386 		    ar->ar_arg_auditon.au_qctrl.aq_minfree);
387 		kau_write(rec, tok);
388 		break;
389 
390 	case A_SETUMASK:
391 		tok = au_to_arg32(2, "setumask:as_success",
392 		    ar->ar_arg_auditon.au_auinfo.ai_mask.am_success);
393 		kau_write(rec, tok);
394 		tok = au_to_arg32(2, "setumask:as_failure",
395 		    ar->ar_arg_auditon.au_auinfo.ai_mask.am_failure);
396 		kau_write(rec, tok);
397 		break;
398 
399 	case A_SETSMASK:
400 		tok = au_to_arg32(2, "setsmask:as_success",
401 		    ar->ar_arg_auditon.au_auinfo.ai_mask.am_success);
402 		kau_write(rec, tok);
403 		tok = au_to_arg32(2, "setsmask:as_failure",
404 		    ar->ar_arg_auditon.au_auinfo.ai_mask.am_failure);
405 		kau_write(rec, tok);
406 		break;
407 
408 	case A_OLDSETCOND:
409 		if ((size_t)ar->ar_arg_len == sizeof(int64_t)) {
410 			tok = au_to_arg64(2, "setcond",
411 			    ar->ar_arg_auditon.au_cond64);
412 			kau_write(rec, tok);
413 			break;
414 		}
415 		/* FALLTHROUGH */
416 
417 	case A_SETCOND:
418 		tok = au_to_arg32(2, "setcond", ar->ar_arg_auditon.au_cond);
419 		kau_write(rec, tok);
420 		break;
421 
422 	case A_SETCLASS:
423 		kau_write(rec, tok);
424 		tok = au_to_arg32(2, "setclass:ec_event",
425 		    ar->ar_arg_auditon.au_evclass.ec_number);
426 		kau_write(rec, tok);
427 		tok = au_to_arg32(2, "setclass:ec_class",
428 		    ar->ar_arg_auditon.au_evclass.ec_class);
429 		kau_write(rec, tok);
430 		break;
431 
432 	case A_SETPMASK:
433 		tok = au_to_arg32(2, "setpmask:as_success",
434 		    ar->ar_arg_auditon.au_aupinfo.ap_mask.am_success);
435 		kau_write(rec, tok);
436 		tok = au_to_arg32(2, "setpmask:as_failure",
437 		    ar->ar_arg_auditon.au_aupinfo.ap_mask.am_failure);
438 		kau_write(rec, tok);
439 		break;
440 
441 	case A_SETFSIZE:
442 		tok = au_to_arg32(2, "setfsize:filesize",
443 		    ar->ar_arg_auditon.au_fstat.af_filesz);
444 		kau_write(rec, tok);
445 		break;
446 
447 	default:
448 		break;
449 	}
450 }
451 
452 /*
453  * Convert an internal kernel audit record to a BSM record and return a
454  * success/failure indicator. The BSM record is passed as an out parameter to
455  * this function.
456  *
457  * Return conditions:
458  *   BSM_SUCCESS: The BSM record is valid
459  *   BSM_FAILURE: Failure; the BSM record is NULL.
460  *   BSM_NOAUDIT: The event is not auditable for BSM; the BSM record is NULL.
461  */
462 int
463 kaudit_to_bsm(struct kaudit_record *kar, struct au_record **pau)
464 {
465 	struct au_token *tok, *subj_tok;
466 	struct au_record *rec;
467 	au_tid_t tid;
468 	struct audit_record *ar;
469 	int ctr;
470 
471 	KASSERT(kar != NULL, ("kaudit_to_bsm: kar == NULL"));
472 
473 	*pau = NULL;
474 	ar = &kar->k_ar;
475 	rec = kau_open();
476 
477 	/*
478 	 * Create the subject token.
479 	 */
480 	switch (ar->ar_subj_term_addr.at_type) {
481 	case AU_IPv4:
482 		tid.port = ar->ar_subj_term_addr.at_port;
483 		tid.machine = ar->ar_subj_term_addr.at_addr[0];
484 		subj_tok = au_to_subject32(ar->ar_subj_auid,  /* audit ID */
485 		    ar->ar_subj_cred.cr_uid, /* eff uid */
486 		    ar->ar_subj_egid,	/* eff group id */
487 		    ar->ar_subj_ruid,	/* real uid */
488 		    ar->ar_subj_rgid,	/* real group id */
489 		    ar->ar_subj_pid,	/* process id */
490 		    ar->ar_subj_asid,	/* session ID */
491 		    &tid);
492 		break;
493 	case AU_IPv6:
494 		subj_tok = au_to_subject32_ex(ar->ar_subj_auid,
495 		    ar->ar_subj_cred.cr_uid,
496 		    ar->ar_subj_egid,
497 		    ar->ar_subj_ruid,
498 		    ar->ar_subj_rgid,
499 		    ar->ar_subj_pid,
500 		    ar->ar_subj_asid,
501 		    &ar->ar_subj_term_addr);
502 		break;
503 	default:
504 		bzero(&tid, sizeof(tid));
505 		subj_tok = au_to_subject32(ar->ar_subj_auid,
506 		    ar->ar_subj_cred.cr_uid,
507 		    ar->ar_subj_egid,
508 		    ar->ar_subj_ruid,
509 		    ar->ar_subj_rgid,
510 		    ar->ar_subj_pid,
511 		    ar->ar_subj_asid,
512 		    &tid);
513 	}
514 
515 	/*
516 	 * The logic inside each case fills in the tokens required for the
517 	 * event, except for the header, trailer, and return tokens.  The
518 	 * header and trailer tokens are added by the kau_close() function.
519 	 * The return token is added outside of the switch statement.
520 	 */
521 	switch(ar->ar_event) {
522 	case AUE_ACCEPT:
523 	case AUE_BIND:
524 	case AUE_LISTEN:
525 	case AUE_CONNECT:
526 	case AUE_RECV:
527 	case AUE_RECVFROM:
528 	case AUE_RECVMSG:
529 	case AUE_SEND:
530 	case AUE_SENDFILE:
531 	case AUE_SENDMSG:
532 	case AUE_SENDTO:
533 		/*
534 		 * Socket-related events.
535 		 */
536 		if (ARG_IS_VALID(kar, ARG_FD)) {
537 			tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
538 			kau_write(rec, tok);
539 		}
540 		if (ARG_IS_VALID(kar, ARG_SADDRINET)) {
541 			tok = au_to_sock_inet((struct sockaddr_in *)
542 			    &ar->ar_arg_sockaddr);
543 			kau_write(rec, tok);
544 		}
545 		if (ARG_IS_VALID(kar, ARG_SADDRUNIX)) {
546 			tok = au_to_sock_unix((struct sockaddr_un *)
547 			    &ar->ar_arg_sockaddr);
548 			kau_write(rec, tok);
549 			UPATH1_TOKENS;
550 		}
551 		/* XXX Need to handle ARG_SADDRINET6 */
552 		break;
553 
554 	case AUE_SOCKET:
555 	case AUE_SOCKETPAIR:
556 		if (ARG_IS_VALID(kar, ARG_SOCKINFO)) {
557 			tok = au_to_arg32(1, "domain",
558 			    ar->ar_arg_sockinfo.so_domain);
559 			kau_write(rec, tok);
560 			tok = au_to_arg32(2, "type",
561 			    ar->ar_arg_sockinfo.so_type);
562 			kau_write(rec, tok);
563 			tok = au_to_arg32(3, "protocol",
564 			    ar->ar_arg_sockinfo.so_protocol);
565 			kau_write(rec, tok);
566 		}
567 		break;
568 
569 	case AUE_SETSOCKOPT:
570 	case AUE_SHUTDOWN:
571 		if (ARG_IS_VALID(kar, ARG_FD)) {
572 			tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
573 			kau_write(rec, tok);
574 		}
575 		break;
576 
577 	case AUE_ACCT:
578 		if (ARG_IS_VALID(kar, ARG_UPATH1)) {
579 			UPATH1_VNODE1_TOKENS;
580 		} else {
581 			tok = au_to_arg32(1, "accounting off", 0);
582 			kau_write(rec, tok);
583 		}
584 		break;
585 
586 	case AUE_SETAUID:
587 		if (ARG_IS_VALID(kar, ARG_AUID)) {
588 			tok = au_to_arg32(2, "setauid", ar->ar_arg_auid);
589 			kau_write(rec, tok);
590 		}
591 		break;
592 
593 	case AUE_SETAUDIT:
594 		if (ARG_IS_VALID(kar, ARG_AUID) &&
595 		    ARG_IS_VALID(kar, ARG_ASID) &&
596 		    ARG_IS_VALID(kar, ARG_AMASK) &&
597 		    ARG_IS_VALID(kar, ARG_TERMID)) {
598 			tok = au_to_arg32(1, "setaudit:auid",
599 			    ar->ar_arg_auid);
600 			kau_write(rec, tok);
601 			tok = au_to_arg32(1, "setaudit:port",
602 			    ar->ar_arg_termid.port);
603 			kau_write(rec, tok);
604 			tok = au_to_arg32(1, "setaudit:machine",
605 			    ar->ar_arg_termid.machine);
606 			kau_write(rec, tok);
607 			tok = au_to_arg32(1, "setaudit:as_success",
608 			    ar->ar_arg_amask.am_success);
609 			kau_write(rec, tok);
610 			tok = au_to_arg32(1, "setaudit:as_failure",
611 			    ar->ar_arg_amask.am_failure);
612 			kau_write(rec, tok);
613 			tok = au_to_arg32(1, "setaudit:asid",
614 			    ar->ar_arg_asid);
615 			kau_write(rec, tok);
616 		}
617 		break;
618 
619 	case AUE_SETAUDIT_ADDR:
620 		if (ARG_IS_VALID(kar, ARG_AUID) &&
621 		    ARG_IS_VALID(kar, ARG_ASID) &&
622 		    ARG_IS_VALID(kar, ARG_AMASK) &&
623 		    ARG_IS_VALID(kar, ARG_TERMID_ADDR)) {
624 			tok = au_to_arg32(1, "setaudit_addr:auid",
625 			    ar->ar_arg_auid);
626 			kau_write(rec, tok);
627 			tok = au_to_arg32(1, "setaudit_addr:as_success",
628 			    ar->ar_arg_amask.am_success);
629 			kau_write(rec, tok);
630 			tok = au_to_arg32(1, "setaudit_addr:as_failure",
631 			    ar->ar_arg_amask.am_failure);
632 			kau_write(rec, tok);
633 			tok = au_to_arg32(1, "setaudit_addr:asid",
634 			    ar->ar_arg_asid);
635 			kau_write(rec, tok);
636 			tok = au_to_arg32(1, "setaudit_addr:type",
637 			    ar->ar_arg_termid_addr.at_type);
638 			kau_write(rec, tok);
639 			tok = au_to_arg32(1, "setaudit_addr:port",
640 			    ar->ar_arg_termid_addr.at_port);
641 			kau_write(rec, tok);
642 			if (ar->ar_arg_termid_addr.at_type == AU_IPv6)
643 				tok = au_to_in_addr_ex((struct in6_addr *)
644 				    &ar->ar_arg_termid_addr.at_addr[0]);
645 			if (ar->ar_arg_termid_addr.at_type == AU_IPv4)
646 				tok = au_to_in_addr((struct in_addr *)
647 				    &ar->ar_arg_termid_addr.at_addr[0]);
648 			kau_write(rec, tok);
649 		}
650 		break;
651 
652 	case AUE_AUDITON:
653 		/*
654 		 * For AUDITON commands without own event, audit the cmd.
655 		 */
656 		if (ARG_IS_VALID(kar, ARG_CMD)) {
657 			tok = au_to_arg32(1, "cmd", ar->ar_arg_cmd);
658 			kau_write(rec, tok);
659 		}
660 		/* FALLTHROUGH */
661 
662 	case AUE_AUDITON_GETCAR:
663 	case AUE_AUDITON_GETCLASS:
664 	case AUE_AUDITON_GETCOND:
665 	case AUE_AUDITON_GETCWD:
666 	case AUE_AUDITON_GETKMASK:
667 	case AUE_AUDITON_GETSTAT:
668 	case AUE_AUDITON_GPOLICY:
669 	case AUE_AUDITON_GQCTRL:
670 	case AUE_AUDITON_SETCLASS:
671 	case AUE_AUDITON_SETCOND:
672 	case AUE_AUDITON_SETKMASK:
673 	case AUE_AUDITON_SETSMASK:
674 	case AUE_AUDITON_SETSTAT:
675 	case AUE_AUDITON_SETUMASK:
676 	case AUE_AUDITON_SPOLICY:
677 	case AUE_AUDITON_SQCTRL:
678 		if (ARG_IS_VALID(kar, ARG_AUDITON))
679 			audit_sys_auditon(ar, rec);
680 		break;
681 
682 	case AUE_AUDITCTL:
683 		UPATH1_VNODE1_TOKENS;
684 		break;
685 
686 	case AUE_EXIT:
687 		if (ARG_IS_VALID(kar, ARG_EXIT)) {
688 			tok = au_to_exit(ar->ar_arg_exitretval,
689 			    ar->ar_arg_exitstatus);
690 			kau_write(rec, tok);
691 		}
692 		break;
693 
694 	case AUE_ADJTIME:
695 	case AUE_CLOCK_SETTIME:
696 	case AUE_AUDIT:
697 	case AUE_DUP2:
698 	case AUE_GETAUDIT:
699 	case AUE_GETAUDIT_ADDR:
700 	case AUE_GETAUID:
701 	case AUE_GETCWD:
702 	case AUE_GETFSSTAT:
703 	case AUE_GETRESUID:
704 	case AUE_GETRESGID:
705 	case AUE_KQUEUE:
706 	case AUE_MODLOAD:
707 	case AUE_MODUNLOAD:
708 	case AUE_MSGSYS:
709 	case AUE_NTP_ADJTIME:
710 	case AUE_PIPE:
711 	case AUE_POSIX_OPENPT:
712 	case AUE_PROFILE:
713 	case AUE_RTPRIO:
714 	case AUE_SEMSYS:
715 	case AUE_SHMSYS:
716 	case AUE_SETPGRP:
717 	case AUE_SETRLIMIT:
718 	case AUE_SETSID:
719 	case AUE_SETTIMEOFDAY:
720 	case AUE_SYSARCH:
721 
722 		/*
723 		 * Header, subject, and return tokens added at end.
724 		 */
725 		break;
726 
727 	case AUE_MKFIFO:
728 		if (ARG_IS_VALID(kar, ARG_MODE)) {
729 			tok = au_to_arg32(2, "mode", ar->ar_arg_mode);
730 			kau_write(rec, tok);
731 		}
732 		/* FALLTHROUGH */
733 
734 	case AUE_CHDIR:
735 	case AUE_CHROOT:
736 	case AUE_FSTATAT:
737 	case AUE_FUTIMESAT:
738 	case AUE_GETATTRLIST:
739 	case AUE_JAIL:
740 	case AUE_LUTIMES:
741 	case AUE_NFS_GETFH:
742 	case AUE_LSTAT:
743 	case AUE_PATHCONF:
744 	case AUE_READLINK:
745 	case AUE_REVOKE:
746 	case AUE_RMDIR:
747 	case AUE_SEARCHFS:
748 	case AUE_SETATTRLIST:
749 	case AUE_STAT:
750 	case AUE_STATFS:
751 	case AUE_SWAPON:
752 	case AUE_SWAPOFF:
753 	case AUE_TRUNCATE:
754 	case AUE_UNDELETE:
755 	case AUE_UNLINK:
756 	case AUE_UNLINKAT:
757 	case AUE_UTIMES:
758 		ATFD1_TOKENS(1);
759 		UPATH1_VNODE1_TOKENS;
760 		break;
761 
762 	case AUE_ACCESS:
763 	case AUE_EACCESS:
764 		UPATH1_VNODE1_TOKENS;
765 		if (ARG_IS_VALID(kar, ARG_VALUE)) {
766 			tok = au_to_arg32(2, "mode", ar->ar_arg_value);
767 			kau_write(rec, tok);
768 		}
769 		break;
770 
771 	case AUE_FHSTATFS:
772 	case AUE_FHOPEN:
773 	case AUE_FHSTAT:
774 		/* XXXRW: Need to audit vnode argument. */
775 		break;
776 
777 	case AUE_CHFLAGS:
778 	case AUE_LCHFLAGS:
779 		if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
780 			tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
781 			kau_write(rec, tok);
782 		}
783 		UPATH1_VNODE1_TOKENS;
784 		break;
785 
786 	case AUE_CHMOD:
787 	case AUE_LCHMOD:
788 		if (ARG_IS_VALID(kar, ARG_MODE)) {
789 			tok = au_to_arg32(2, "new file mode",
790 			    ar->ar_arg_mode);
791 			kau_write(rec, tok);
792 		}
793 		UPATH1_VNODE1_TOKENS;
794 		break;
795 
796 	case AUE_FCHMODAT:
797 		ATFD1_TOKENS(1);
798 		if (ARG_IS_VALID(kar, ARG_MODE)) {
799 			tok = au_to_arg32(3, "new file mode",
800 			    ar->ar_arg_mode);
801 			kau_write(rec, tok);
802 		}
803 		UPATH1_VNODE1_TOKENS;
804 		break;
805 
806 	case AUE_CHOWN:
807 	case AUE_LCHOWN:
808 		if (ARG_IS_VALID(kar, ARG_UID)) {
809 			tok = au_to_arg32(2, "new file uid", ar->ar_arg_uid);
810 			kau_write(rec, tok);
811 		}
812 		if (ARG_IS_VALID(kar, ARG_GID)) {
813 			tok = au_to_arg32(3, "new file gid", ar->ar_arg_gid);
814 			kau_write(rec, tok);
815 		}
816 		UPATH1_VNODE1_TOKENS;
817 		break;
818 
819 	case AUE_FCHOWNAT:
820 		ATFD1_TOKENS(1);
821 		if (ARG_IS_VALID(kar, ARG_UID)) {
822 			tok = au_to_arg32(3, "new file uid", ar->ar_arg_uid);
823 			kau_write(rec, tok);
824 		}
825 		if (ARG_IS_VALID(kar, ARG_GID)) {
826 			tok = au_to_arg32(4, "new file gid", ar->ar_arg_gid);
827 			kau_write(rec, tok);
828 		}
829 		UPATH1_VNODE1_TOKENS;
830 		break;
831 
832 	case AUE_EXCHANGEDATA:
833 		UPATH1_VNODE1_TOKENS;
834 		UPATH2_TOKENS;
835 		break;
836 
837 	case AUE_CLOSE:
838 		if (ARG_IS_VALID(kar, ARG_FD)) {
839 			tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
840 			kau_write(rec, tok);
841 		}
842 		UPATH1_VNODE1_TOKENS;
843 		break;
844 
845 	case AUE_CLOSEFROM:
846 		if (ARG_IS_VALID(kar, ARG_FD)) {
847 			tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
848 			kau_write(rec, tok);
849 		}
850 		break;
851 
852 	case AUE_CORE:
853 		if (ARG_IS_VALID(kar, ARG_SIGNUM)) {
854 			tok = au_to_arg32(1, "signal", ar->ar_arg_signum);
855 			kau_write(rec, tok);
856 		}
857 		UPATH1_VNODE1_TOKENS;
858 		break;
859 
860 	case AUE_EXTATTRCTL:
861 		UPATH1_VNODE1_TOKENS;
862 		if (ARG_IS_VALID(kar, ARG_CMD)) {
863 			tok = au_to_arg32(2, "cmd", ar->ar_arg_cmd);
864 			kau_write(rec, tok);
865 		}
866 		/* extattrctl(2) filename parameter is in upath2/vnode2 */
867 		UPATH2_TOKENS;
868 		VNODE2_TOKENS;
869 		EXTATTR_TOKENS(4);
870 		break;
871 
872 	case AUE_EXTATTR_GET_FILE:
873 	case AUE_EXTATTR_SET_FILE:
874 	case AUE_EXTATTR_LIST_FILE:
875 	case AUE_EXTATTR_DELETE_FILE:
876 	case AUE_EXTATTR_GET_LINK:
877 	case AUE_EXTATTR_SET_LINK:
878 	case AUE_EXTATTR_LIST_LINK:
879 	case AUE_EXTATTR_DELETE_LINK:
880 		UPATH1_VNODE1_TOKENS;
881 		EXTATTR_TOKENS(2);
882 		break;
883 
884 	case AUE_EXTATTR_GET_FD:
885 	case AUE_EXTATTR_SET_FD:
886 	case AUE_EXTATTR_LIST_FD:
887 	case AUE_EXTATTR_DELETE_FD:
888 		if (ARG_IS_VALID(kar, ARG_FD)) {
889 			tok = au_to_arg32(2, "fd", ar->ar_arg_fd);
890 			kau_write(rec, tok);
891 		}
892 		EXTATTR_TOKENS(2);
893 		break;
894 
895 	case AUE_FEXECVE:
896 		if (ARG_IS_VALID(kar, ARG_FD)) {
897 			tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
898 			kau_write(rec, tok);
899 		}
900 		/* FALLTHROUGH */
901 
902 	case AUE_EXECVE:
903 	case AUE_MAC_EXECVE:
904 		if (ARG_IS_VALID(kar, ARG_ARGV)) {
905 			tok = au_to_exec_args(ar->ar_arg_argv,
906 			    ar->ar_arg_argc);
907 			kau_write(rec, tok);
908 		}
909 		if (ARG_IS_VALID(kar, ARG_ENVV)) {
910 			tok = au_to_exec_env(ar->ar_arg_envv,
911 			    ar->ar_arg_envc);
912 			kau_write(rec, tok);
913 		}
914 		UPATH1_VNODE1_TOKENS;
915 		break;
916 
917 	case AUE_FCHMOD:
918 		if (ARG_IS_VALID(kar, ARG_MODE)) {
919 			tok = au_to_arg32(2, "new file mode",
920 			    ar->ar_arg_mode);
921 			kau_write(rec, tok);
922 		}
923 		FD_VNODE1_TOKENS;
924 		break;
925 
926 	/*
927 	 * XXXRW: Some of these need to handle non-vnode cases as well.
928 	 */
929 	case AUE_FCHDIR:
930 	case AUE_FPATHCONF:
931 	case AUE_FSTAT:
932 	case AUE_FSTATFS:
933 	case AUE_FSYNC:
934 	case AUE_FTRUNCATE:
935 	case AUE_FUTIMES:
936 	case AUE_GETDIRENTRIES:
937 	case AUE_GETDIRENTRIESATTR:
938 	case AUE_LSEEK:
939 	case AUE_POLL:
940 	case AUE_READ:
941 	case AUE_READV:
942 	case AUE_WRITE:
943 	case AUE_WRITEV:
944 		FD_VNODE1_TOKENS;
945 		break;
946 
947 	case AUE_FCHOWN:
948 		if (ARG_IS_VALID(kar, ARG_UID)) {
949 			tok = au_to_arg32(2, "new file uid", ar->ar_arg_uid);
950 			kau_write(rec, tok);
951 		}
952 		if (ARG_IS_VALID(kar, ARG_GID)) {
953 			tok = au_to_arg32(3, "new file gid", ar->ar_arg_gid);
954 			kau_write(rec, tok);
955 		}
956 		FD_VNODE1_TOKENS;
957 		break;
958 
959 	case AUE_FCNTL:
960 		if (ARG_IS_VALID(kar, ARG_CMD)) {
961 			tok = au_to_arg32(2, "cmd",
962 			    au_fcntl_cmd_to_bsm(ar->ar_arg_cmd));
963 			kau_write(rec, tok);
964 		}
965 		if (ar->ar_arg_cmd == F_GETLK || ar->ar_arg_cmd == F_SETLK ||
966 		    ar->ar_arg_cmd == F_SETLKW) {
967 			FD_VNODE1_TOKENS;
968 		}
969 		break;
970 
971 	case AUE_FCHFLAGS:
972 		if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
973 			tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
974 			kau_write(rec, tok);
975 		}
976 		FD_VNODE1_TOKENS;
977 		break;
978 
979 	case AUE_FLOCK:
980 		if (ARG_IS_VALID(kar, ARG_CMD)) {
981 			tok = au_to_arg32(2, "operation", ar->ar_arg_cmd);
982 			kau_write(rec, tok);
983 		}
984 		FD_VNODE1_TOKENS;
985 		break;
986 
987 	case AUE_RFORK:
988 		if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
989 			tok = au_to_arg32(1, "flags", ar->ar_arg_fflags);
990 			kau_write(rec, tok);
991 		}
992 		/* FALLTHROUGH */
993 
994 	case AUE_FORK:
995 	case AUE_VFORK:
996 		if (ARG_IS_VALID(kar, ARG_PID)) {
997 			tok = au_to_arg32(0, "child PID", ar->ar_arg_pid);
998 			kau_write(rec, tok);
999 		}
1000 		break;
1001 
1002 	case AUE_IOCTL:
1003 		if (ARG_IS_VALID(kar, ARG_CMD)) {
1004 			tok = au_to_arg32(2, "cmd", ar->ar_arg_cmd);
1005 			kau_write(rec, tok);
1006 		}
1007 		if (ARG_IS_VALID(kar, ARG_VNODE1))
1008 			FD_VNODE1_TOKENS;
1009 		else {
1010 			if (ARG_IS_VALID(kar, ARG_SOCKINFO)) {
1011 				tok = kau_to_socket(&ar->ar_arg_sockinfo);
1012 				kau_write(rec, tok);
1013 			} else {
1014 				if (ARG_IS_VALID(kar, ARG_FD)) {
1015 					tok = au_to_arg32(1, "fd",
1016 					    ar->ar_arg_fd);
1017 					kau_write(rec, tok);
1018 				}
1019 			}
1020 		}
1021 		break;
1022 
1023 	case AUE_KILL:
1024 	case AUE_KILLPG:
1025 		if (ARG_IS_VALID(kar, ARG_SIGNUM)) {
1026 			tok = au_to_arg32(2, "signal", ar->ar_arg_signum);
1027 			kau_write(rec, tok);
1028 		}
1029 		PROCESS_PID_TOKENS(1);
1030 		break;
1031 
1032 	case AUE_KTRACE:
1033 		if (ARG_IS_VALID(kar, ARG_CMD)) {
1034 			tok = au_to_arg32(2, "ops", ar->ar_arg_cmd);
1035 			kau_write(rec, tok);
1036 		}
1037 		if (ARG_IS_VALID(kar, ARG_VALUE)) {
1038 			tok = au_to_arg32(3, "trpoints", ar->ar_arg_value);
1039 			kau_write(rec, tok);
1040 		}
1041 		PROCESS_PID_TOKENS(4);
1042 		UPATH1_VNODE1_TOKENS;
1043 		break;
1044 
1045 	case AUE_LINK:
1046 	case AUE_LINKAT:
1047 	case AUE_RENAME:
1048 	case AUE_RENAMEAT:
1049 		ATFD1_TOKENS(1);
1050 		UPATH1_VNODE1_TOKENS;
1051 		ATFD2_TOKENS(3);
1052 		UPATH2_TOKENS;
1053 		break;
1054 
1055 	case AUE_LOADSHFILE:
1056 		ADDR_TOKEN(4, "base addr");
1057 		UPATH1_VNODE1_TOKENS;
1058 		break;
1059 
1060 	case AUE_MKDIR:
1061 		if (ARG_IS_VALID(kar, ARG_MODE)) {
1062 			tok = au_to_arg32(2, "mode", ar->ar_arg_mode);
1063 			kau_write(rec, tok);
1064 		}
1065 		UPATH1_VNODE1_TOKENS;
1066 		break;
1067 
1068 	case AUE_MKNOD:
1069 		if (ARG_IS_VALID(kar, ARG_MODE)) {
1070 			tok = au_to_arg32(2, "mode", ar->ar_arg_mode);
1071 			kau_write(rec, tok);
1072 		}
1073 		if (ARG_IS_VALID(kar, ARG_DEV)) {
1074 			tok = au_to_arg32(3, "dev", ar->ar_arg_dev);
1075 			kau_write(rec, tok);
1076 		}
1077 		UPATH1_VNODE1_TOKENS;
1078 		break;
1079 
1080 	case AUE_MMAP:
1081 	case AUE_MUNMAP:
1082 	case AUE_MPROTECT:
1083 	case AUE_MLOCK:
1084 	case AUE_MUNLOCK:
1085 	case AUE_MINHERIT:
1086 		ADDR_TOKEN(1, "addr");
1087 		if (ARG_IS_VALID(kar, ARG_LEN)) {
1088 			tok = au_to_arg32(2, "len", ar->ar_arg_len);
1089 			kau_write(rec, tok);
1090 		}
1091 		if (ar->ar_event == AUE_MMAP)
1092 			FD_VNODE1_TOKENS;
1093 		if (ar->ar_event == AUE_MPROTECT) {
1094 			if (ARG_IS_VALID(kar, ARG_VALUE)) {
1095 				tok = au_to_arg32(3, "protection",
1096 				    ar->ar_arg_value);
1097 				kau_write(rec, tok);
1098 			}
1099 		}
1100 		if (ar->ar_event == AUE_MINHERIT) {
1101 			if (ARG_IS_VALID(kar, ARG_VALUE)) {
1102 				tok = au_to_arg32(3, "inherit",
1103 				    ar->ar_arg_value);
1104 				kau_write(rec, tok);
1105 			}
1106 		}
1107 		break;
1108 
1109 	case AUE_MOUNT:
1110 	case AUE_NMOUNT:
1111 		/* XXX Need to handle NFS mounts */
1112 		if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1113 			tok = au_to_arg32(3, "flags", ar->ar_arg_fflags);
1114 			kau_write(rec, tok);
1115 		}
1116 		if (ARG_IS_VALID(kar, ARG_TEXT)) {
1117 			tok = au_to_text(ar->ar_arg_text);
1118 			kau_write(rec, tok);
1119 		}
1120 		/* FALLTHROUGH */
1121 
1122 	case AUE_NFS_SVC:
1123 		if (ARG_IS_VALID(kar, ARG_CMD)) {
1124 			tok = au_to_arg32(1, "flags", ar->ar_arg_cmd);
1125 			kau_write(rec, tok);
1126 		}
1127 		break;
1128 
1129 	case AUE_UMOUNT:
1130 		if (ARG_IS_VALID(kar, ARG_VALUE)) {
1131 			tok = au_to_arg32(2, "flags", ar->ar_arg_value);
1132 			kau_write(rec, tok);
1133 		}
1134 		UPATH1_VNODE1_TOKENS;
1135 		if (ARG_IS_VALID(kar, ARG_TEXT)) {
1136 			tok = au_to_text(ar->ar_arg_text);
1137 			kau_write(rec, tok);
1138 		}
1139 		break;
1140 
1141 	case AUE_MSGCTL:
1142 		ar->ar_event = audit_msgctl_to_event(ar->ar_arg_svipc_cmd);
1143 		/* Fall through */
1144 
1145 	case AUE_MSGRCV:
1146 	case AUE_MSGSND:
1147 		tok = au_to_arg32(1, "msg ID", ar->ar_arg_svipc_id);
1148 		kau_write(rec, tok);
1149 		if (ar->ar_errno != EINVAL) {
1150 			tok = au_to_ipc(AT_IPC_MSG, ar->ar_arg_svipc_id);
1151 			kau_write(rec, tok);
1152 		}
1153 		break;
1154 
1155 	case AUE_MSGGET:
1156 		if (ar->ar_errno == 0) {
1157 			if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
1158 				tok = au_to_ipc(AT_IPC_MSG,
1159 				    ar->ar_arg_svipc_id);
1160 				kau_write(rec, tok);
1161 			}
1162 		}
1163 		break;
1164 
1165 	case AUE_RESETSHFILE:
1166 		ADDR_TOKEN(1, "base addr");
1167 		break;
1168 
1169 	case AUE_OPEN_RC:
1170 	case AUE_OPEN_RTC:
1171 	case AUE_OPEN_RWC:
1172 	case AUE_OPEN_RWTC:
1173 	case AUE_OPEN_WC:
1174 	case AUE_OPEN_WTC:
1175 	case AUE_CREAT:
1176 		if (ARG_IS_VALID(kar, ARG_MODE)) {
1177 			tok = au_to_arg32(3, "mode", ar->ar_arg_mode);
1178 			kau_write(rec, tok);
1179 		}
1180 		/* FALLTHROUGH */
1181 
1182 	case AUE_OPEN_R:
1183 	case AUE_OPEN_RT:
1184 	case AUE_OPEN_RW:
1185 	case AUE_OPEN_RWT:
1186 	case AUE_OPEN_W:
1187 	case AUE_OPEN_WT:
1188 		if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1189 			tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
1190 			kau_write(rec, tok);
1191 		}
1192 		UPATH1_VNODE1_TOKENS;
1193 		break;
1194 
1195 	case AUE_OPENAT_RC:
1196 	case AUE_OPENAT_RTC:
1197 	case AUE_OPENAT_RWC:
1198 	case AUE_OPENAT_RWTC:
1199 	case AUE_OPENAT_WC:
1200 	case AUE_OPENAT_WTC:
1201 		if (ARG_IS_VALID(kar, ARG_MODE)) {
1202 			tok = au_to_arg32(3, "mode", ar->ar_arg_mode);
1203 			kau_write(rec, tok);
1204 		}
1205 		/* FALLTHROUGH */
1206 
1207 	case AUE_OPENAT_R:
1208 	case AUE_OPENAT_RT:
1209 	case AUE_OPENAT_RW:
1210 	case AUE_OPENAT_RWT:
1211 	case AUE_OPENAT_W:
1212 	case AUE_OPENAT_WT:
1213 		if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1214 			tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
1215 			kau_write(rec, tok);
1216 		}
1217 		ATFD1_TOKENS(1);
1218 		UPATH1_VNODE1_TOKENS;
1219 		break;
1220 
1221 	case AUE_PTRACE:
1222 		if (ARG_IS_VALID(kar, ARG_CMD)) {
1223 			tok = au_to_arg32(1, "request", ar->ar_arg_cmd);
1224 			kau_write(rec, tok);
1225 		}
1226 		if (ARG_IS_VALID(kar, ARG_VALUE)) {
1227 			tok = au_to_arg32(4, "data", ar->ar_arg_value);
1228 			kau_write(rec, tok);
1229 		}
1230 		PROCESS_PID_TOKENS(2);
1231 		break;
1232 
1233 	case AUE_QUOTACTL:
1234 		if (ARG_IS_VALID(kar, ARG_CMD)) {
1235 			tok = au_to_arg32(2, "command", ar->ar_arg_cmd);
1236 			kau_write(rec, tok);
1237 		}
1238 		if (ARG_IS_VALID(kar, ARG_UID)) {
1239 			tok = au_to_arg32(3, "uid", ar->ar_arg_uid);
1240 			kau_write(rec, tok);
1241 		}
1242 		if (ARG_IS_VALID(kar, ARG_GID)) {
1243 			tok = au_to_arg32(3, "gid", ar->ar_arg_gid);
1244 			kau_write(rec, tok);
1245 		}
1246 		UPATH1_VNODE1_TOKENS;
1247 		break;
1248 
1249 	case AUE_REBOOT:
1250 		if (ARG_IS_VALID(kar, ARG_CMD)) {
1251 			tok = au_to_arg32(1, "howto", ar->ar_arg_cmd);
1252 			kau_write(rec, tok);
1253 		}
1254 		break;
1255 
1256 	case AUE_SEMCTL:
1257 		ar->ar_event = audit_semctl_to_event(ar->ar_arg_svipc_cmd);
1258 		/* Fall through */
1259 
1260 	case AUE_SEMOP:
1261 		if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
1262 			tok = au_to_arg32(1, "sem ID", ar->ar_arg_svipc_id);
1263 			kau_write(rec, tok);
1264 			if (ar->ar_errno != EINVAL) {
1265 				tok = au_to_ipc(AT_IPC_SEM,
1266 				    ar->ar_arg_svipc_id);
1267 				kau_write(rec, tok);
1268 			}
1269 		}
1270 		break;
1271 
1272 	case AUE_SEMGET:
1273 		if (ar->ar_errno == 0) {
1274 			if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
1275 				tok = au_to_ipc(AT_IPC_SEM,
1276 				    ar->ar_arg_svipc_id);
1277 				kau_write(rec, tok);
1278 			}
1279 		}
1280 		break;
1281 
1282 	case AUE_SETEGID:
1283 		if (ARG_IS_VALID(kar, ARG_EGID)) {
1284 			tok = au_to_arg32(1, "egid", ar->ar_arg_egid);
1285 			kau_write(rec, tok);
1286 		}
1287 		break;
1288 
1289 	case AUE_SETEUID:
1290 		if (ARG_IS_VALID(kar, ARG_EUID)) {
1291 			tok = au_to_arg32(1, "euid", ar->ar_arg_euid);
1292 			kau_write(rec, tok);
1293 		}
1294 		break;
1295 
1296 	case AUE_SETREGID:
1297 		if (ARG_IS_VALID(kar, ARG_RGID)) {
1298 			tok = au_to_arg32(1, "rgid", ar->ar_arg_rgid);
1299 			kau_write(rec, tok);
1300 		}
1301 		if (ARG_IS_VALID(kar, ARG_EGID)) {
1302 			tok = au_to_arg32(2, "egid", ar->ar_arg_egid);
1303 			kau_write(rec, tok);
1304 		}
1305 		break;
1306 
1307 	case AUE_SETREUID:
1308 		if (ARG_IS_VALID(kar, ARG_RUID)) {
1309 			tok = au_to_arg32(1, "ruid", ar->ar_arg_ruid);
1310 			kau_write(rec, tok);
1311 		}
1312 		if (ARG_IS_VALID(kar, ARG_EUID)) {
1313 			tok = au_to_arg32(2, "euid", ar->ar_arg_euid);
1314 			kau_write(rec, tok);
1315 		}
1316 		break;
1317 
1318 	case AUE_SETRESGID:
1319 		if (ARG_IS_VALID(kar, ARG_RGID)) {
1320 			tok = au_to_arg32(1, "rgid", ar->ar_arg_rgid);
1321 			kau_write(rec, tok);
1322 		}
1323 		if (ARG_IS_VALID(kar, ARG_EGID)) {
1324 			tok = au_to_arg32(2, "egid", ar->ar_arg_egid);
1325 			kau_write(rec, tok);
1326 		}
1327 		if (ARG_IS_VALID(kar, ARG_SGID)) {
1328 			tok = au_to_arg32(3, "sgid", ar->ar_arg_sgid);
1329 			kau_write(rec, tok);
1330 		}
1331 		break;
1332 
1333 	case AUE_SETRESUID:
1334 		if (ARG_IS_VALID(kar, ARG_RUID)) {
1335 			tok = au_to_arg32(1, "ruid", ar->ar_arg_ruid);
1336 			kau_write(rec, tok);
1337 		}
1338 		if (ARG_IS_VALID(kar, ARG_EUID)) {
1339 			tok = au_to_arg32(2, "euid", ar->ar_arg_euid);
1340 			kau_write(rec, tok);
1341 		}
1342 		if (ARG_IS_VALID(kar, ARG_SUID)) {
1343 			tok = au_to_arg32(3, "suid", ar->ar_arg_suid);
1344 			kau_write(rec, tok);
1345 		}
1346 		break;
1347 
1348 	case AUE_SETGID:
1349 		if (ARG_IS_VALID(kar, ARG_GID)) {
1350 			tok = au_to_arg32(1, "gid", ar->ar_arg_gid);
1351 			kau_write(rec, tok);
1352 		}
1353 		break;
1354 
1355 	case AUE_SETUID:
1356 		if (ARG_IS_VALID(kar, ARG_UID)) {
1357 			tok = au_to_arg32(1, "uid", ar->ar_arg_uid);
1358 			kau_write(rec, tok);
1359 		}
1360 		break;
1361 
1362 	case AUE_SETGROUPS:
1363 		if (ARG_IS_VALID(kar, ARG_GROUPSET)) {
1364 			for(ctr = 0; ctr < ar->ar_arg_groups.gidset_size; ctr++)
1365 			{
1366 				tok = au_to_arg32(1, "setgroups",
1367 				    ar->ar_arg_groups.gidset[ctr]);
1368 				kau_write(rec, tok);
1369 			}
1370 		}
1371 		break;
1372 
1373 	case AUE_SETLOGIN:
1374 		if (ARG_IS_VALID(kar, ARG_TEXT)) {
1375 			tok = au_to_text(ar->ar_arg_text);
1376 			kau_write(rec, tok);
1377 		}
1378 		break;
1379 
1380 	case AUE_SETPRIORITY:
1381 		if (ARG_IS_VALID(kar, ARG_CMD)) {
1382 			tok = au_to_arg32(1, "which", ar->ar_arg_cmd);
1383 			kau_write(rec, tok);
1384 		}
1385 		if (ARG_IS_VALID(kar, ARG_UID)) {
1386 			tok = au_to_arg32(2, "who", ar->ar_arg_uid);
1387 			kau_write(rec, tok);
1388 		}
1389 		PROCESS_PID_TOKENS(2);
1390 		if (ARG_IS_VALID(kar, ARG_VALUE)) {
1391 			tok = au_to_arg32(3, "priority", ar->ar_arg_value);
1392 			kau_write(rec, tok);
1393 		}
1394 		break;
1395 
1396 	case AUE_SETPRIVEXEC:
1397 		if (ARG_IS_VALID(kar, ARG_VALUE)) {
1398 			tok = au_to_arg32(1, "flag", ar->ar_arg_value);
1399 			kau_write(rec, tok);
1400 		}
1401 		break;
1402 
1403 	/* AUE_SHMAT, AUE_SHMCTL, AUE_SHMDT and AUE_SHMGET are SysV IPC */
1404 	case AUE_SHMAT:
1405 		if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
1406 			tok = au_to_arg32(1, "shmid", ar->ar_arg_svipc_id);
1407 			kau_write(rec, tok);
1408 			/* XXXAUDIT: Does having the ipc token make sense? */
1409 			tok = au_to_ipc(AT_IPC_SHM, ar->ar_arg_svipc_id);
1410 			kau_write(rec, tok);
1411 		}
1412 		if (ARG_IS_VALID(kar, ARG_SVIPC_ADDR)) {
1413 			tok = au_to_arg32(2, "shmaddr",
1414 			    (int)(uintptr_t)ar->ar_arg_svipc_addr);
1415 			kau_write(rec, tok);
1416 		}
1417 		if (ARG_IS_VALID(kar, ARG_SVIPC_PERM)) {
1418 			tok = au_to_ipc_perm(&ar->ar_arg_svipc_perm);
1419 			kau_write(rec, tok);
1420 		}
1421 		break;
1422 
1423 	case AUE_SHMCTL:
1424 		if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
1425 			tok = au_to_arg32(1, "shmid", ar->ar_arg_svipc_id);
1426 			kau_write(rec, tok);
1427 			/* XXXAUDIT: Does having the ipc token make sense? */
1428 			tok = au_to_ipc(AT_IPC_SHM, ar->ar_arg_svipc_id);
1429 			kau_write(rec, tok);
1430 		}
1431 		switch (ar->ar_arg_svipc_cmd) {
1432 		case IPC_STAT:
1433 			ar->ar_event = AUE_SHMCTL_STAT;
1434 			break;
1435 		case IPC_RMID:
1436 			ar->ar_event = AUE_SHMCTL_RMID;
1437 			break;
1438 		case IPC_SET:
1439 			ar->ar_event = AUE_SHMCTL_SET;
1440 			if (ARG_IS_VALID(kar, ARG_SVIPC_PERM)) {
1441 				tok = au_to_ipc_perm(&ar->ar_arg_svipc_perm);
1442 				kau_write(rec, tok);
1443 			}
1444 			break;
1445 		default:
1446 			break;	/* We will audit a bad command */
1447 		}
1448 		break;
1449 
1450 	case AUE_SHMDT:
1451 		if (ARG_IS_VALID(kar, ARG_SVIPC_ADDR)) {
1452 			tok = au_to_arg32(1, "shmaddr",
1453 			    (int)(uintptr_t)ar->ar_arg_svipc_addr);
1454 			kau_write(rec, tok);
1455 		}
1456 		break;
1457 
1458 	case AUE_SHMGET:
1459 		/* This is unusual; the return value is in an argument token */
1460 		if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
1461 			tok = au_to_arg32(0, "shmid", ar->ar_arg_svipc_id);
1462 			kau_write(rec, tok);
1463 			tok = au_to_ipc(AT_IPC_SHM, ar->ar_arg_svipc_id);
1464 			kau_write(rec, tok);
1465 		}
1466 		if (ARG_IS_VALID(kar, ARG_SVIPC_PERM)) {
1467 			tok = au_to_ipc_perm(&ar->ar_arg_svipc_perm);
1468 			kau_write(rec, tok);
1469 		}
1470 		break;
1471 
1472 	/* AUE_SHMOPEN, AUE_SHMUNLINK, AUE_SEMOPEN, AUE_SEMCLOSE
1473 	 * and AUE_SEMUNLINK are Posix IPC */
1474 	case AUE_SHMOPEN:
1475 		if (ARG_IS_VALID(kar, ARG_SVIPC_ADDR)) {
1476 			tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
1477 			kau_write(rec, tok);
1478 		}
1479 		if (ARG_IS_VALID(kar, ARG_MODE)) {
1480 			tok = au_to_arg32(3, "mode", ar->ar_arg_mode);
1481 			kau_write(rec, tok);
1482 		}
1483 		/* FALLTHROUGH */
1484 
1485 	case AUE_SHMUNLINK:
1486 		if (ARG_IS_VALID(kar, ARG_TEXT)) {
1487 			tok = au_to_text(ar->ar_arg_text);
1488 			kau_write(rec, tok);
1489 		}
1490 		if (ARG_IS_VALID(kar, ARG_POSIX_IPC_PERM)) {
1491 			struct ipc_perm perm;
1492 
1493 			perm.uid = ar->ar_arg_pipc_perm.pipc_uid;
1494 			perm.gid = ar->ar_arg_pipc_perm.pipc_gid;
1495 			perm.cuid = ar->ar_arg_pipc_perm.pipc_uid;
1496 			perm.cgid = ar->ar_arg_pipc_perm.pipc_gid;
1497 			perm.mode = ar->ar_arg_pipc_perm.pipc_mode;
1498 			perm.seq = 0;
1499 			perm.key = 0;
1500 			tok = au_to_ipc_perm(&perm);
1501 			kau_write(rec, tok);
1502 		}
1503 		break;
1504 
1505 	case AUE_SEMOPEN:
1506 		if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
1507 			tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
1508 			kau_write(rec, tok);
1509 		}
1510 		if (ARG_IS_VALID(kar, ARG_MODE)) {
1511 			tok = au_to_arg32(3, "mode", ar->ar_arg_mode);
1512 			kau_write(rec, tok);
1513 		}
1514 		if (ARG_IS_VALID(kar, ARG_VALUE)) {
1515 			tok = au_to_arg32(4, "value", ar->ar_arg_value);
1516 			kau_write(rec, tok);
1517 		}
1518 		/* FALLTHROUGH */
1519 
1520 	case AUE_SEMUNLINK:
1521 		if (ARG_IS_VALID(kar, ARG_TEXT)) {
1522 			tok = au_to_text(ar->ar_arg_text);
1523 			kau_write(rec, tok);
1524 		}
1525 		if (ARG_IS_VALID(kar, ARG_POSIX_IPC_PERM)) {
1526 			struct ipc_perm perm;
1527 
1528 			perm.uid = ar->ar_arg_pipc_perm.pipc_uid;
1529 			perm.gid = ar->ar_arg_pipc_perm.pipc_gid;
1530 			perm.cuid = ar->ar_arg_pipc_perm.pipc_uid;
1531 			perm.cgid = ar->ar_arg_pipc_perm.pipc_gid;
1532 			perm.mode = ar->ar_arg_pipc_perm.pipc_mode;
1533 			perm.seq = 0;
1534 			perm.key = 0;
1535 			tok = au_to_ipc_perm(&perm);
1536 			kau_write(rec, tok);
1537 		}
1538 		break;
1539 
1540 	case AUE_SEMCLOSE:
1541 		if (ARG_IS_VALID(kar, ARG_FD)) {
1542 			tok = au_to_arg32(1, "sem", ar->ar_arg_fd);
1543 			kau_write(rec, tok);
1544 		}
1545 		break;
1546 
1547 	case AUE_SYMLINK:
1548 		if (ARG_IS_VALID(kar, ARG_TEXT)) {
1549 			tok = au_to_text(ar->ar_arg_text);
1550 			kau_write(rec, tok);
1551 		}
1552 		UPATH1_VNODE1_TOKENS;
1553 		break;
1554 
1555 	case AUE_SYSCTL:
1556 	case AUE_SYSCTL_NONADMIN:
1557 		if (ARG_IS_VALID(kar, ARG_CTLNAME | ARG_LEN)) {
1558 			for (ctr = 0; ctr < ar->ar_arg_len; ctr++) {
1559 				tok = au_to_arg32(1, "name",
1560 				    ar->ar_arg_ctlname[ctr]);
1561 				kau_write(rec, tok);
1562 			}
1563 		}
1564 		if (ARG_IS_VALID(kar, ARG_VALUE)) {
1565 			tok = au_to_arg32(5, "newval", ar->ar_arg_value);
1566 			kau_write(rec, tok);
1567 		}
1568 		if (ARG_IS_VALID(kar, ARG_TEXT)) {
1569 			tok = au_to_text(ar->ar_arg_text);
1570 			kau_write(rec, tok);
1571 		}
1572 		break;
1573 
1574 	case AUE_UMASK:
1575 		if (ARG_IS_VALID(kar, ARG_MASK)) {
1576 			tok = au_to_arg32(1, "new mask", ar->ar_arg_mask);
1577 			kau_write(rec, tok);
1578 		}
1579 		tok = au_to_arg32(0, "prev mask", ar->ar_retval);
1580 		kau_write(rec, tok);
1581 		break;
1582 
1583 	case AUE_WAIT4:
1584 		PROCESS_PID_TOKENS(1);
1585 		if (ARG_IS_VALID(kar, ARG_VALUE)) {
1586 			tok = au_to_arg32(3, "options", ar->ar_arg_value);
1587 			kau_write(rec, tok);
1588 		}
1589 		break;
1590 
1591 	case AUE_NULL:
1592 	default:
1593 		printf("BSM conversion requested for unknown event %d\n",
1594 		    ar->ar_event);
1595 
1596 		/*
1597 		 * Write the subject token so it is properly freed here.
1598 		 */
1599 		kau_write(rec, subj_tok);
1600 		kau_free(rec);
1601 		return (BSM_NOAUDIT);
1602 	}
1603 
1604 	kau_write(rec, subj_tok);
1605 	tok = au_to_return32(au_errno_to_bsm(ar->ar_errno), ar->ar_retval);
1606 	kau_write(rec, tok);  /* Every record gets a return token */
1607 
1608 	kau_close(rec, &ar->ar_endtime, ar->ar_event);
1609 
1610 	*pau = rec;
1611 	return (BSM_SUCCESS);
1612 }
1613 
1614 /*
1615  * Verify that a record is a valid BSM record. This verification is simple
1616  * now, but may be expanded on sometime in the future.  Return 1 if the
1617  * record is good, 0 otherwise.
1618  */
1619 int
1620 bsm_rec_verify(void *rec)
1621 {
1622 	char c = *(char *)rec;
1623 
1624 	/*
1625 	 * Check the token ID of the first token; it has to be a header
1626 	 * token.
1627 	 *
1628 	 * XXXAUDIT There needs to be a token structure to map a token.
1629 	 * XXXAUDIT 'Shouldn't be simply looking at the first char.
1630 	 */
1631 	if ((c != AUT_HEADER32) && (c != AUT_HEADER32_EX) &&
1632 	    (c != AUT_HEADER64) && (c != AUT_HEADER64_EX))
1633 		return (0);
1634 	return (1);
1635 }
1636