17c478bd9Sstevel@tonic-gate /*
27c478bd9Sstevel@tonic-gate * CDDL HEADER START
37c478bd9Sstevel@tonic-gate *
47c478bd9Sstevel@tonic-gate * The contents of this file are subject to the terms of the
545916cd2Sjpk * Common Development and Distribution License (the "License").
645916cd2Sjpk * You may not use this file except in compliance with the License.
77c478bd9Sstevel@tonic-gate *
87c478bd9Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
97c478bd9Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing.
107c478bd9Sstevel@tonic-gate * See the License for the specific language governing permissions
117c478bd9Sstevel@tonic-gate * and limitations under the License.
127c478bd9Sstevel@tonic-gate *
137c478bd9Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each
147c478bd9Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
157c478bd9Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the
167c478bd9Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying
177c478bd9Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner]
187c478bd9Sstevel@tonic-gate *
197c478bd9Sstevel@tonic-gate * CDDL HEADER END
207c478bd9Sstevel@tonic-gate */
217c478bd9Sstevel@tonic-gate /*
22*f8994074SJan Friedel * Copyright (c) 1992, 2010, Oracle and/or its affiliates. All rights reserved.
237c478bd9Sstevel@tonic-gate */
247c478bd9Sstevel@tonic-gate
257c478bd9Sstevel@tonic-gate #include <sys/types.h>
26f48205beScasper #include <sys/param.h>
277c478bd9Sstevel@tonic-gate #include <stdio.h>
287c478bd9Sstevel@tonic-gate #include <unistd.h>
297c478bd9Sstevel@tonic-gate #include <sys/fcntl.h>
307c478bd9Sstevel@tonic-gate #include <bsm/audit.h>
317c478bd9Sstevel@tonic-gate #include <bsm/audit_record.h>
327c478bd9Sstevel@tonic-gate #include <bsm/audit_uevents.h>
337c478bd9Sstevel@tonic-gate #include <bsm/libbsm.h>
347c478bd9Sstevel@tonic-gate #include <bsm/audit_private.h>
357c478bd9Sstevel@tonic-gate #include <stdlib.h>
367c478bd9Sstevel@tonic-gate #include <string.h>
377c478bd9Sstevel@tonic-gate #include <syslog.h>
387c478bd9Sstevel@tonic-gate #include <pwd.h>
397c478bd9Sstevel@tonic-gate #include <netinet/in.h>
4045916cd2Sjpk #include <tsol/label.h>
417c478bd9Sstevel@tonic-gate #include <locale.h>
427c478bd9Sstevel@tonic-gate #include "generic.h"
437c478bd9Sstevel@tonic-gate
447c478bd9Sstevel@tonic-gate #ifdef C2_DEBUG
45dfc7be02SJan Friedel #define dprintf(x) { (void) printf x; }
467c478bd9Sstevel@tonic-gate #else
477c478bd9Sstevel@tonic-gate #define dprintf(x)
487c478bd9Sstevel@tonic-gate #endif
497c478bd9Sstevel@tonic-gate
507c478bd9Sstevel@tonic-gate #define UNKNOWN_CMD "???"
517c478bd9Sstevel@tonic-gate
527c478bd9Sstevel@tonic-gate static au_event_t event;
537c478bd9Sstevel@tonic-gate static int audit_rexd_status = 0;
547c478bd9Sstevel@tonic-gate
557c478bd9Sstevel@tonic-gate static char *
build_cmd(char ** cmd)567c478bd9Sstevel@tonic-gate build_cmd(char **cmd)
577c478bd9Sstevel@tonic-gate {
587c478bd9Sstevel@tonic-gate int i, l;
597c478bd9Sstevel@tonic-gate char *r;
607c478bd9Sstevel@tonic-gate
617c478bd9Sstevel@tonic-gate if (cmd == NULL)
627c478bd9Sstevel@tonic-gate return (NULL);
637c478bd9Sstevel@tonic-gate /* count the total length of command line */
647c478bd9Sstevel@tonic-gate for (i = 0, l = 0; cmd[i] != NULL; i++)
657c478bd9Sstevel@tonic-gate l += strlen(cmd[i]) + 1;
667c478bd9Sstevel@tonic-gate
677c478bd9Sstevel@tonic-gate if (l == 0)
687c478bd9Sstevel@tonic-gate return (NULL);
697c478bd9Sstevel@tonic-gate r = malloc(l);
707c478bd9Sstevel@tonic-gate if (r != NULL) {
717c478bd9Sstevel@tonic-gate for (i = 0; cmd[i] != NULL; i++) {
727c478bd9Sstevel@tonic-gate (void) strcat(r, cmd[i]);
737c478bd9Sstevel@tonic-gate if (cmd[i + 1] != NULL)
747c478bd9Sstevel@tonic-gate (void) strcat(r, " ");
757c478bd9Sstevel@tonic-gate }
767c478bd9Sstevel@tonic-gate }
777c478bd9Sstevel@tonic-gate return (r);
787c478bd9Sstevel@tonic-gate }
797c478bd9Sstevel@tonic-gate
807c478bd9Sstevel@tonic-gate static int
selected(uid,user,event,sf)817c478bd9Sstevel@tonic-gate selected(uid, user, event, sf)
827c478bd9Sstevel@tonic-gate uid_t uid;
837c478bd9Sstevel@tonic-gate char *user;
847c478bd9Sstevel@tonic-gate au_event_t event;
857c478bd9Sstevel@tonic-gate int sf;
867c478bd9Sstevel@tonic-gate {
87*f8994074SJan Friedel int sorf;
887c478bd9Sstevel@tonic-gate struct au_mask mask;
897c478bd9Sstevel@tonic-gate
907c478bd9Sstevel@tonic-gate mask.am_success = mask.am_failure = 0;
91f48205beScasper if (uid > MAXEPHUID) {
92*f8994074SJan Friedel /* get non-attrib flags */
93*f8994074SJan Friedel (void) auditon(A_GETKMASK, (caddr_t)&mask, sizeof (mask));
947c478bd9Sstevel@tonic-gate } else {
95*f8994074SJan Friedel (void) au_user_mask(user, &mask);
967c478bd9Sstevel@tonic-gate }
977c478bd9Sstevel@tonic-gate
98*f8994074SJan Friedel if (sf == 0) {
997c478bd9Sstevel@tonic-gate sorf = AU_PRS_SUCCESS;
100*f8994074SJan Friedel } else if (sf == -1) {
1017c478bd9Sstevel@tonic-gate sorf = AU_PRS_FAILURE;
102*f8994074SJan Friedel } else {
1037c478bd9Sstevel@tonic-gate sorf = AU_PRS_BOTH;
104*f8994074SJan Friedel }
105*f8994074SJan Friedel
106*f8994074SJan Friedel return (au_preselect(event, &mask, sorf, AU_PRS_REREAD));
1077c478bd9Sstevel@tonic-gate }
1087c478bd9Sstevel@tonic-gate
1097c478bd9Sstevel@tonic-gate void
audit_rexd_setup()1107c478bd9Sstevel@tonic-gate audit_rexd_setup()
1117c478bd9Sstevel@tonic-gate {
1127c478bd9Sstevel@tonic-gate dprintf(("audit_rexd_setup()\n"));
1137c478bd9Sstevel@tonic-gate
1147c478bd9Sstevel@tonic-gate event = AUE_rexd;
1157c478bd9Sstevel@tonic-gate }
1167c478bd9Sstevel@tonic-gate
1177c478bd9Sstevel@tonic-gate /* ARGSUSED */
1187c478bd9Sstevel@tonic-gate static void
audit_rexd_session_setup(char * name,char * mach,uid_t uid)1197c478bd9Sstevel@tonic-gate audit_rexd_session_setup(char *name, char *mach, uid_t uid)
1207c478bd9Sstevel@tonic-gate {
1217c478bd9Sstevel@tonic-gate int rc;
1227c478bd9Sstevel@tonic-gate au_mask_t mask;
1237c478bd9Sstevel@tonic-gate struct auditinfo_addr info;
1247c478bd9Sstevel@tonic-gate
1257c478bd9Sstevel@tonic-gate if (getaudit_addr(&info, sizeof (info)) < 0) {
1267c478bd9Sstevel@tonic-gate perror("getaudit_addr");
1277c478bd9Sstevel@tonic-gate exit(1);
1287c478bd9Sstevel@tonic-gate }
1297c478bd9Sstevel@tonic-gate
1307c478bd9Sstevel@tonic-gate info.ai_auid = uid;
1317c478bd9Sstevel@tonic-gate info.ai_asid = getpid();
1327c478bd9Sstevel@tonic-gate
1337c478bd9Sstevel@tonic-gate mask.am_success = 0;
1347c478bd9Sstevel@tonic-gate mask.am_failure = 0;
1357c478bd9Sstevel@tonic-gate
1367c478bd9Sstevel@tonic-gate (void) au_user_mask(name, &mask);
1377c478bd9Sstevel@tonic-gate
1387c478bd9Sstevel@tonic-gate info.ai_mask.am_success = mask.am_success;
1397c478bd9Sstevel@tonic-gate info.ai_mask.am_failure = mask.am_failure;
1407c478bd9Sstevel@tonic-gate
1417c478bd9Sstevel@tonic-gate rc = setaudit_addr(&info, sizeof (info));
1427c478bd9Sstevel@tonic-gate if (rc < 0) {
1437c478bd9Sstevel@tonic-gate perror("setaudit_addr");
1447c478bd9Sstevel@tonic-gate }
1457c478bd9Sstevel@tonic-gate }
1467c478bd9Sstevel@tonic-gate
1477c478bd9Sstevel@tonic-gate void
audit_rexd_fail(msg,hostname,user,uid,gid,shell,cmd)1487c478bd9Sstevel@tonic-gate audit_rexd_fail(msg, hostname, user, uid, gid, shell, cmd)
1497c478bd9Sstevel@tonic-gate char *msg; /* message containing failure information */
1507c478bd9Sstevel@tonic-gate char *hostname; /* hostname of machine requesting service */
1517c478bd9Sstevel@tonic-gate char *user; /* username of user requesting service */
1527c478bd9Sstevel@tonic-gate uid_t uid; /* user id of user requesting service */
1537c478bd9Sstevel@tonic-gate gid_t gid; /* group of user requesting service */
1547c478bd9Sstevel@tonic-gate char *shell; /* login shell of user requesting service */
1557c478bd9Sstevel@tonic-gate char **cmd; /* argv to be executed locally */
1567c478bd9Sstevel@tonic-gate {
1577c478bd9Sstevel@tonic-gate int rd; /* audit record descriptor */
1587c478bd9Sstevel@tonic-gate char buf[256]; /* temporary buffer */
1597c478bd9Sstevel@tonic-gate char *tbuf; /* temporary buffer */
1607c478bd9Sstevel@tonic-gate int tlen;
1617c478bd9Sstevel@tonic-gate const char *gtxt; /* gettext return value */
1627c478bd9Sstevel@tonic-gate pid_t pid;
1637c478bd9Sstevel@tonic-gate char *cmdbuf;
1647c478bd9Sstevel@tonic-gate char *audit_cmd[2] = {NULL, NULL};
1657c478bd9Sstevel@tonic-gate int dont_free = 0;
1667c478bd9Sstevel@tonic-gate struct auditinfo_addr info;
1677c478bd9Sstevel@tonic-gate
1687c478bd9Sstevel@tonic-gate dprintf(("audit_rexd_fail()\n"));
1697c478bd9Sstevel@tonic-gate
1707c478bd9Sstevel@tonic-gate /*
1717c478bd9Sstevel@tonic-gate * check if audit_rexd_fail() or audit_rexd_success()
1727c478bd9Sstevel@tonic-gate * have been called already.
1737c478bd9Sstevel@tonic-gate */
1747c478bd9Sstevel@tonic-gate if (audit_rexd_status == 1) {
1757c478bd9Sstevel@tonic-gate return;
1767c478bd9Sstevel@tonic-gate }
1777c478bd9Sstevel@tonic-gate
1787c478bd9Sstevel@tonic-gate if (cannot_audit(0)) {
1797c478bd9Sstevel@tonic-gate return;
1807c478bd9Sstevel@tonic-gate }
1817c478bd9Sstevel@tonic-gate
1827c478bd9Sstevel@tonic-gate /*
1837c478bd9Sstevel@tonic-gate * set status to prevent multiple calls
1847c478bd9Sstevel@tonic-gate * to audit_rexd_fail() and audit_rexd_success()
1857c478bd9Sstevel@tonic-gate */
1867c478bd9Sstevel@tonic-gate audit_rexd_status = 1;
1877c478bd9Sstevel@tonic-gate
1887c478bd9Sstevel@tonic-gate /* determine if we're preselected */
1897c478bd9Sstevel@tonic-gate if (!selected(uid, user, event, -1))
1907c478bd9Sstevel@tonic-gate return;
1917c478bd9Sstevel@tonic-gate
1927c478bd9Sstevel@tonic-gate pid = getpid();
1937c478bd9Sstevel@tonic-gate
1947c478bd9Sstevel@tonic-gate if (getaudit_addr(&info, sizeof (info)) < 0) {
1957c478bd9Sstevel@tonic-gate perror("getaudit_addr");
1967c478bd9Sstevel@tonic-gate exit(1);
1977c478bd9Sstevel@tonic-gate }
1987c478bd9Sstevel@tonic-gate
1997c478bd9Sstevel@tonic-gate rd = au_open();
2007c478bd9Sstevel@tonic-gate
2017c478bd9Sstevel@tonic-gate /* add subject token */
2027c478bd9Sstevel@tonic-gate (void) au_write(rd,
2037c478bd9Sstevel@tonic-gate au_to_subject_ex(uid, uid, gid, uid, gid, pid, pid,
2047c478bd9Sstevel@tonic-gate &info.ai_termid));
20545916cd2Sjpk if (is_system_labeled())
20645916cd2Sjpk (void) au_write(rd, au_to_mylabel());
2077c478bd9Sstevel@tonic-gate
2087c478bd9Sstevel@tonic-gate /* add reason for failure */
2097c478bd9Sstevel@tonic-gate (void) au_write(rd, au_to_text(msg));
2107c478bd9Sstevel@tonic-gate
2117c478bd9Sstevel@tonic-gate /* add hostname of machine requesting service */
2127c478bd9Sstevel@tonic-gate (void) snprintf(buf, sizeof (buf), dgettext(bsm_dom,
2137c478bd9Sstevel@tonic-gate "Remote execution requested by: %s"), hostname);
2147c478bd9Sstevel@tonic-gate (void) au_write(rd, au_to_text(buf));
2157c478bd9Sstevel@tonic-gate
2167c478bd9Sstevel@tonic-gate /* add username of user requesting service */
2177c478bd9Sstevel@tonic-gate if (user == NULL)
2187c478bd9Sstevel@tonic-gate user = "???";
2197c478bd9Sstevel@tonic-gate (void) snprintf(buf, sizeof (buf), dgettext(bsm_dom,
2207c478bd9Sstevel@tonic-gate "Username: %s"), user);
2217c478bd9Sstevel@tonic-gate (void) au_write(rd, au_to_text(buf));
2227c478bd9Sstevel@tonic-gate
2237c478bd9Sstevel@tonic-gate (void) snprintf(buf, sizeof (buf), dgettext(bsm_dom,
2247c478bd9Sstevel@tonic-gate "User id: %d"), uid);
2257c478bd9Sstevel@tonic-gate (void) au_write(rd, au_to_text(buf));
2267c478bd9Sstevel@tonic-gate
2277c478bd9Sstevel@tonic-gate if (cmd == NULL) {
2287c478bd9Sstevel@tonic-gate audit_cmd[0] = shell;
2297c478bd9Sstevel@tonic-gate cmd = audit_cmd;
2307c478bd9Sstevel@tonic-gate }
2317c478bd9Sstevel@tonic-gate
2327c478bd9Sstevel@tonic-gate cmdbuf = build_cmd(cmd);
2337c478bd9Sstevel@tonic-gate if (cmdbuf == NULL) {
2347c478bd9Sstevel@tonic-gate cmdbuf = UNKNOWN_CMD;
2357c478bd9Sstevel@tonic-gate dont_free = 1;
2367c478bd9Sstevel@tonic-gate }
2377c478bd9Sstevel@tonic-gate
2387c478bd9Sstevel@tonic-gate gtxt = dgettext(bsm_dom, "Command line: %s");
2397c478bd9Sstevel@tonic-gate /* over estimate of size of buffer needed (%s is replaced) */
2407c478bd9Sstevel@tonic-gate tlen = strlen(cmdbuf) + strlen(gtxt) + 1;
2417c478bd9Sstevel@tonic-gate
2427c478bd9Sstevel@tonic-gate if ((tbuf = malloc(tlen)) == NULL) {
2437c478bd9Sstevel@tonic-gate (void) au_close(rd, 0, 0);
2447c478bd9Sstevel@tonic-gate return;
2457c478bd9Sstevel@tonic-gate }
2467c478bd9Sstevel@tonic-gate (void) snprintf(tbuf, tlen, gtxt, cmdbuf);
2477c478bd9Sstevel@tonic-gate (void) au_write(rd, au_to_text(tbuf));
2487c478bd9Sstevel@tonic-gate (void) free(tbuf);
2497c478bd9Sstevel@tonic-gate if (!dont_free)
2507c478bd9Sstevel@tonic-gate (void) free(cmdbuf);
2517c478bd9Sstevel@tonic-gate
2527c478bd9Sstevel@tonic-gate /* add return token */
2537c478bd9Sstevel@tonic-gate #ifdef _LP64
2547c478bd9Sstevel@tonic-gate (void) au_write(rd, au_to_return64(-1, (int64_t)0));
2557c478bd9Sstevel@tonic-gate #else
2567c478bd9Sstevel@tonic-gate (void) au_write(rd, au_to_return32(-1, (int32_t)0));
2577c478bd9Sstevel@tonic-gate #endif
2587c478bd9Sstevel@tonic-gate
2597c478bd9Sstevel@tonic-gate /* write audit record */
2607c478bd9Sstevel@tonic-gate if (au_close(rd, 1, event) < 0) {
2617c478bd9Sstevel@tonic-gate (void) au_close(rd, 0, 0);
2627c478bd9Sstevel@tonic-gate return;
2637c478bd9Sstevel@tonic-gate }
2647c478bd9Sstevel@tonic-gate }
2657c478bd9Sstevel@tonic-gate
2667c478bd9Sstevel@tonic-gate void
audit_rexd_success(hostname,user,uid,gid,shell,cmd)2677c478bd9Sstevel@tonic-gate audit_rexd_success(hostname, user, uid, gid, shell, cmd)
2687c478bd9Sstevel@tonic-gate char *hostname; /* hostname of machine requesting service */
2697c478bd9Sstevel@tonic-gate char *user; /* username of user requesting service, may be NULL */
2707c478bd9Sstevel@tonic-gate uid_t uid; /* user id of user requesting service */
2717c478bd9Sstevel@tonic-gate gid_t gid; /* group of user requesting service */
2727c478bd9Sstevel@tonic-gate char *shell; /* login shell of user requesting service */
2737c478bd9Sstevel@tonic-gate char **cmd; /* argv to be executed locally, may be NULL */
2747c478bd9Sstevel@tonic-gate {
2757c478bd9Sstevel@tonic-gate int rd; /* audit record descriptor */
2767c478bd9Sstevel@tonic-gate char buf[256]; /* temporary buffer */
2777c478bd9Sstevel@tonic-gate char *tbuf; /* temporary buffer */
2787c478bd9Sstevel@tonic-gate int tlen;
2797c478bd9Sstevel@tonic-gate const char *gtxt;
2807c478bd9Sstevel@tonic-gate pid_t pid;
2817c478bd9Sstevel@tonic-gate char *cmdbuf;
2827c478bd9Sstevel@tonic-gate char *audit_cmd[2] = {NULL, NULL};
2837c478bd9Sstevel@tonic-gate int dont_free = 0;
2847c478bd9Sstevel@tonic-gate struct auditinfo_addr info;
2857c478bd9Sstevel@tonic-gate char *empty = "";
2867c478bd9Sstevel@tonic-gate
2877c478bd9Sstevel@tonic-gate dprintf(("audit_rexd_success()\n"));
2887c478bd9Sstevel@tonic-gate
2897c478bd9Sstevel@tonic-gate /*
2907c478bd9Sstevel@tonic-gate * check if audit_rexd_fail() or audit_rexd_success()
2917c478bd9Sstevel@tonic-gate * have been called already.
2927c478bd9Sstevel@tonic-gate */
2937c478bd9Sstevel@tonic-gate if (audit_rexd_status == 1) {
2947c478bd9Sstevel@tonic-gate return;
2957c478bd9Sstevel@tonic-gate }
2967c478bd9Sstevel@tonic-gate
2977c478bd9Sstevel@tonic-gate if (cannot_audit(0)) {
2987c478bd9Sstevel@tonic-gate return;
2997c478bd9Sstevel@tonic-gate }
3007c478bd9Sstevel@tonic-gate
3017c478bd9Sstevel@tonic-gate /* a little bullet proofing... */
3027c478bd9Sstevel@tonic-gate
3037c478bd9Sstevel@tonic-gate if (hostname == NULL)
3047c478bd9Sstevel@tonic-gate hostname = empty;
3057c478bd9Sstevel@tonic-gate if (shell == NULL)
3067c478bd9Sstevel@tonic-gate shell = empty;
3077c478bd9Sstevel@tonic-gate
3087c478bd9Sstevel@tonic-gate /*
3097c478bd9Sstevel@tonic-gate * set status to prevent multiple calls
3107c478bd9Sstevel@tonic-gate * to audit_rexd_fail() and audit_rexd_success()
3117c478bd9Sstevel@tonic-gate */
3127c478bd9Sstevel@tonic-gate audit_rexd_status = 1;
3137c478bd9Sstevel@tonic-gate
3147c478bd9Sstevel@tonic-gate /* determine if we're preselected */
3157c478bd9Sstevel@tonic-gate if (!selected(uid, user, event, 0))
3167c478bd9Sstevel@tonic-gate goto rexd_audit_session;
3177c478bd9Sstevel@tonic-gate
3187c478bd9Sstevel@tonic-gate pid = getpid();
3197c478bd9Sstevel@tonic-gate
3207c478bd9Sstevel@tonic-gate if (getaudit_addr(&info, sizeof (info)) < 0) {
3217c478bd9Sstevel@tonic-gate perror("getaudit_addr");
3227c478bd9Sstevel@tonic-gate exit(1);
3237c478bd9Sstevel@tonic-gate }
3247c478bd9Sstevel@tonic-gate
3257c478bd9Sstevel@tonic-gate rd = au_open();
3267c478bd9Sstevel@tonic-gate
3277c478bd9Sstevel@tonic-gate /* add subject token */
3287c478bd9Sstevel@tonic-gate (void) au_write(rd,
3297c478bd9Sstevel@tonic-gate au_to_subject_ex(uid, uid, gid, uid, gid, pid, pid,
3307c478bd9Sstevel@tonic-gate &info.ai_termid));
33145916cd2Sjpk if (is_system_labeled())
33245916cd2Sjpk (void) au_write(rd, au_to_mylabel());
3337c478bd9Sstevel@tonic-gate
3347c478bd9Sstevel@tonic-gate /* add hostname of machine requesting service */
3357c478bd9Sstevel@tonic-gate
3367c478bd9Sstevel@tonic-gate (void) snprintf(buf, sizeof (buf), dgettext(bsm_dom,
3377c478bd9Sstevel@tonic-gate "Remote execution requested by: %s"), hostname);
3387c478bd9Sstevel@tonic-gate (void) au_write(rd, au_to_text(buf));
3397c478bd9Sstevel@tonic-gate
3407c478bd9Sstevel@tonic-gate /* add username at machine requesting service */
3417c478bd9Sstevel@tonic-gate (void) snprintf(buf, sizeof (buf), dgettext(bsm_dom,
3427c478bd9Sstevel@tonic-gate "Username: %s"), user);
3437c478bd9Sstevel@tonic-gate (void) au_write(rd, au_to_text(buf));
3447c478bd9Sstevel@tonic-gate
3457c478bd9Sstevel@tonic-gate if (cmd == NULL) {
3467c478bd9Sstevel@tonic-gate audit_cmd[0] = shell;
3477c478bd9Sstevel@tonic-gate cmd = audit_cmd;
3487c478bd9Sstevel@tonic-gate }
3497c478bd9Sstevel@tonic-gate
3507c478bd9Sstevel@tonic-gate cmdbuf = build_cmd(cmd);
3517c478bd9Sstevel@tonic-gate if (cmdbuf == NULL) {
3527c478bd9Sstevel@tonic-gate cmdbuf = UNKNOWN_CMD;
3537c478bd9Sstevel@tonic-gate dont_free = 1;
3547c478bd9Sstevel@tonic-gate }
3557c478bd9Sstevel@tonic-gate
3567c478bd9Sstevel@tonic-gate gtxt = dgettext(bsm_dom, "Command line: %s");
3577c478bd9Sstevel@tonic-gate tlen = strlen(cmdbuf) + strlen(gtxt) + 1;
3587c478bd9Sstevel@tonic-gate
3597c478bd9Sstevel@tonic-gate if ((tbuf = malloc(tlen)) == NULL) {
3607c478bd9Sstevel@tonic-gate (void) au_close(rd, 0, 0);
3617c478bd9Sstevel@tonic-gate goto rexd_audit_session;
3627c478bd9Sstevel@tonic-gate }
3637c478bd9Sstevel@tonic-gate
3647c478bd9Sstevel@tonic-gate (void) snprintf(tbuf, tlen, gtxt, cmdbuf);
3657c478bd9Sstevel@tonic-gate (void) au_write(rd, au_to_text(tbuf));
3667c478bd9Sstevel@tonic-gate (void) free(tbuf);
3677c478bd9Sstevel@tonic-gate if (!dont_free)
3687c478bd9Sstevel@tonic-gate (void) free(cmdbuf);
3697c478bd9Sstevel@tonic-gate
3707c478bd9Sstevel@tonic-gate /* add return token */
3717c478bd9Sstevel@tonic-gate #ifdef _LP64
3727c478bd9Sstevel@tonic-gate (void) au_write(rd, au_to_return64(0, (int64_t)0));
3737c478bd9Sstevel@tonic-gate #else
3747c478bd9Sstevel@tonic-gate (void) au_write(rd, au_to_return32(0, (int32_t)0));
3757c478bd9Sstevel@tonic-gate #endif
3767c478bd9Sstevel@tonic-gate
3777c478bd9Sstevel@tonic-gate /* write audit record */
3787c478bd9Sstevel@tonic-gate if (au_close(rd, 1, event) < 0) {
3797c478bd9Sstevel@tonic-gate (void) au_close(rd, 0, 0);
3807c478bd9Sstevel@tonic-gate }
3817c478bd9Sstevel@tonic-gate
3827c478bd9Sstevel@tonic-gate rexd_audit_session:
3837c478bd9Sstevel@tonic-gate audit_rexd_session_setup(user, hostname, uid);
3847c478bd9Sstevel@tonic-gate }
385