17c478bd9Sstevel@tonic-gate /*
27c478bd9Sstevel@tonic-gate * CDDL HEADER START
37c478bd9Sstevel@tonic-gate *
47c478bd9Sstevel@tonic-gate * The contents of this file are subject to the terms of the
545916cd2Sjpk * Common Development and Distribution License (the "License").
645916cd2Sjpk * You may not use this file except in compliance with the License.
77c478bd9Sstevel@tonic-gate *
87c478bd9Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
97c478bd9Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing.
107c478bd9Sstevel@tonic-gate * See the License for the specific language governing permissions
117c478bd9Sstevel@tonic-gate * and limitations under the License.
127c478bd9Sstevel@tonic-gate *
137c478bd9Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each
147c478bd9Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
157c478bd9Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the
167c478bd9Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying
177c478bd9Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner]
187c478bd9Sstevel@tonic-gate *
197c478bd9Sstevel@tonic-gate * CDDL HEADER END
207c478bd9Sstevel@tonic-gate */
21794f0adbSRoger A. Faulkner
227c478bd9Sstevel@tonic-gate /*
234a0fa546SMarek Pospisil * Copyright (c) 1992, 2010, Oracle and/or its affiliates. All rights reserved.
24*89b43686SBayard Bell * Copyright (c) 2011 Bayard G. Bell. All rights reserved.
257c478bd9Sstevel@tonic-gate */
267c478bd9Sstevel@tonic-gate
277c478bd9Sstevel@tonic-gate /*
287c478bd9Sstevel@tonic-gate * This file contains the audit event table used to control the production
297c478bd9Sstevel@tonic-gate * of audit records for each system call.
307c478bd9Sstevel@tonic-gate */
317c478bd9Sstevel@tonic-gate
327c478bd9Sstevel@tonic-gate #include <sys/policy.h>
337c478bd9Sstevel@tonic-gate #include <sys/cred.h>
347c478bd9Sstevel@tonic-gate #include <sys/types.h>
357c478bd9Sstevel@tonic-gate #include <sys/systm.h>
367c478bd9Sstevel@tonic-gate #include <sys/systeminfo.h> /* for sysinfo auditing */
377c478bd9Sstevel@tonic-gate #include <sys/utsname.h> /* for sysinfo auditing */
387c478bd9Sstevel@tonic-gate #include <sys/proc.h>
397c478bd9Sstevel@tonic-gate #include <sys/vnode.h>
407c478bd9Sstevel@tonic-gate #include <sys/mman.h> /* for mmap(2) auditing etc. */
417c478bd9Sstevel@tonic-gate #include <sys/fcntl.h>
427c478bd9Sstevel@tonic-gate #include <sys/modctl.h> /* for modctl auditing */
437c478bd9Sstevel@tonic-gate #include <sys/vnode.h>
447c478bd9Sstevel@tonic-gate #include <sys/user.h>
457c478bd9Sstevel@tonic-gate #include <sys/types.h>
467c478bd9Sstevel@tonic-gate #include <sys/processor.h>
477c478bd9Sstevel@tonic-gate #include <sys/procset.h>
487c478bd9Sstevel@tonic-gate #include <sys/acl.h>
497c478bd9Sstevel@tonic-gate #include <sys/ipc.h>
507c478bd9Sstevel@tonic-gate #include <sys/door.h>
517c478bd9Sstevel@tonic-gate #include <sys/sem.h>
527c478bd9Sstevel@tonic-gate #include <sys/msg.h>
537c478bd9Sstevel@tonic-gate #include <sys/shm.h>
547c478bd9Sstevel@tonic-gate #include <sys/kmem.h>
557c478bd9Sstevel@tonic-gate #include <sys/file.h> /* for accept */
567c478bd9Sstevel@tonic-gate #include <sys/utssys.h> /* for fuser */
5745916cd2Sjpk #include <sys/tsol/label.h>
5861b9bf51Srica #include <sys/tsol/tndb.h>
5961b9bf51Srica #include <sys/tsol/tsyscall.h>
607c478bd9Sstevel@tonic-gate #include <c2/audit.h>
617c478bd9Sstevel@tonic-gate #include <c2/audit_kernel.h>
627c478bd9Sstevel@tonic-gate #include <c2/audit_kevents.h>
637c478bd9Sstevel@tonic-gate #include <c2/audit_record.h>
647c478bd9Sstevel@tonic-gate #include <sys/procset.h>
657c478bd9Sstevel@tonic-gate #include <nfs/mount.h>
667c478bd9Sstevel@tonic-gate #include <sys/param.h>
677c478bd9Sstevel@tonic-gate #include <sys/debug.h>
687c478bd9Sstevel@tonic-gate #include <sys/sysmacros.h>
697c478bd9Sstevel@tonic-gate #include <sys/stream.h>
707c478bd9Sstevel@tonic-gate #include <sys/strsubr.h>
717c478bd9Sstevel@tonic-gate #include <sys/stropts.h>
727c478bd9Sstevel@tonic-gate #include <sys/tihdr.h>
737c478bd9Sstevel@tonic-gate #include <sys/socket.h>
747c478bd9Sstevel@tonic-gate #include <sys/socketvar.h>
750f1702c5SYu Xiangning #include <sys/vfs_opreg.h>
760f1702c5SYu Xiangning #include <fs/sockfs/sockcommon.h>
777c478bd9Sstevel@tonic-gate #include <netinet/in.h>
787c478bd9Sstevel@tonic-gate #include <sys/ddi.h>
79df2381bfSpraks #include <sys/port_impl.h>
80df2381bfSpraks
818fd04b83SRoger A. Faulkner static au_event_t aui_fchownat(au_event_t);
82794f0adbSRoger A. Faulkner static au_event_t aui_fchmodat(au_event_t);
837c478bd9Sstevel@tonic-gate static au_event_t aui_open(au_event_t);
848fd04b83SRoger A. Faulkner static au_event_t aui_openat(au_event_t);
858fd04b83SRoger A. Faulkner static au_event_t aui_unlinkat(au_event_t);
868fd04b83SRoger A. Faulkner static au_event_t aui_fstatat(au_event_t);
877c478bd9Sstevel@tonic-gate static au_event_t aui_msgsys(au_event_t);
887c478bd9Sstevel@tonic-gate static au_event_t aui_shmsys(au_event_t);
897c478bd9Sstevel@tonic-gate static au_event_t aui_semsys(au_event_t);
907c478bd9Sstevel@tonic-gate static au_event_t aui_utssys(au_event_t);
917c478bd9Sstevel@tonic-gate static au_event_t aui_fcntl(au_event_t);
927c478bd9Sstevel@tonic-gate static au_event_t aui_execve(au_event_t);
937c478bd9Sstevel@tonic-gate static au_event_t aui_memcntl(au_event_t);
947c478bd9Sstevel@tonic-gate static au_event_t aui_sysinfo(au_event_t);
95df2381bfSpraks static au_event_t aui_portfs(au_event_t);
967c478bd9Sstevel@tonic-gate static au_event_t aui_auditsys(au_event_t);
977c478bd9Sstevel@tonic-gate static au_event_t aui_modctl(au_event_t);
987c478bd9Sstevel@tonic-gate static au_event_t aui_acl(au_event_t);
997c478bd9Sstevel@tonic-gate static au_event_t aui_doorfs(au_event_t);
1007c478bd9Sstevel@tonic-gate static au_event_t aui_privsys(au_event_t);
101657b1f3dSraf static au_event_t aui_forksys(au_event_t);
10261b9bf51Srica static au_event_t aui_labelsys(au_event_t);
1034be8c573SJan Friedel static au_event_t aui_setpgrp(au_event_t);
1047c478bd9Sstevel@tonic-gate
105cb49a9fdSMarek Pospisil static void aus_exit(struct t_audit_data *);
1067c478bd9Sstevel@tonic-gate static void aus_open(struct t_audit_data *);
1078fd04b83SRoger A. Faulkner static void aus_openat(struct t_audit_data *);
1087c478bd9Sstevel@tonic-gate static void aus_acl(struct t_audit_data *);
1097c478bd9Sstevel@tonic-gate static void aus_acct(struct t_audit_data *);
1107c478bd9Sstevel@tonic-gate static void aus_chown(struct t_audit_data *);
1117c478bd9Sstevel@tonic-gate static void aus_fchown(struct t_audit_data *);
1127c478bd9Sstevel@tonic-gate static void aus_lchown(struct t_audit_data *);
1138fd04b83SRoger A. Faulkner static void aus_fchownat(struct t_audit_data *);
1147c478bd9Sstevel@tonic-gate static void aus_chmod(struct t_audit_data *);
1157c478bd9Sstevel@tonic-gate static void aus_facl(struct t_audit_data *);
1167c478bd9Sstevel@tonic-gate static void aus_fchmod(struct t_audit_data *);
117794f0adbSRoger A. Faulkner static void aus_fchmodat(struct t_audit_data *);
1187c478bd9Sstevel@tonic-gate static void aus_fcntl(struct t_audit_data *);
1197c478bd9Sstevel@tonic-gate static void aus_mkdir(struct t_audit_data *);
120794f0adbSRoger A. Faulkner static void aus_mkdirat(struct t_audit_data *);
1217c478bd9Sstevel@tonic-gate static void aus_mknod(struct t_audit_data *);
122794f0adbSRoger A. Faulkner static void aus_mknodat(struct t_audit_data *);
1237c478bd9Sstevel@tonic-gate static void aus_mount(struct t_audit_data *);
1247c478bd9Sstevel@tonic-gate static void aus_umount2(struct t_audit_data *);
1257c478bd9Sstevel@tonic-gate static void aus_msgsys(struct t_audit_data *);
1267c478bd9Sstevel@tonic-gate static void aus_semsys(struct t_audit_data *);
1277c478bd9Sstevel@tonic-gate static void aus_close(struct t_audit_data *);
1287c478bd9Sstevel@tonic-gate static void aus_fstatfs(struct t_audit_data *);
1297c478bd9Sstevel@tonic-gate static void aus_setgid(struct t_audit_data *);
1304be8c573SJan Friedel static void aus_setpgrp(struct t_audit_data *);
1317c478bd9Sstevel@tonic-gate static void aus_setuid(struct t_audit_data *);
1327c478bd9Sstevel@tonic-gate static void aus_shmsys(struct t_audit_data *);
1337c478bd9Sstevel@tonic-gate static void aus_doorfs(struct t_audit_data *);
1347c478bd9Sstevel@tonic-gate static void aus_ioctl(struct t_audit_data *);
1357c478bd9Sstevel@tonic-gate static void aus_memcntl(struct t_audit_data *);
1367c478bd9Sstevel@tonic-gate static void aus_mmap(struct t_audit_data *);
1377c478bd9Sstevel@tonic-gate static void aus_munmap(struct t_audit_data *);
1387c478bd9Sstevel@tonic-gate static void aus_priocntlsys(struct t_audit_data *);
1397c478bd9Sstevel@tonic-gate static void aus_setegid(struct t_audit_data *);
1407c478bd9Sstevel@tonic-gate static void aus_setgroups(struct t_audit_data *);
1417c478bd9Sstevel@tonic-gate static void aus_seteuid(struct t_audit_data *);
1427c478bd9Sstevel@tonic-gate static void aus_putmsg(struct t_audit_data *);
1437c478bd9Sstevel@tonic-gate static void aus_putpmsg(struct t_audit_data *);
1447c478bd9Sstevel@tonic-gate static void aus_getmsg(struct t_audit_data *);
1457c478bd9Sstevel@tonic-gate static void aus_getpmsg(struct t_audit_data *);
1467c478bd9Sstevel@tonic-gate static void aus_auditsys(struct t_audit_data *);
1477c478bd9Sstevel@tonic-gate static void aus_sysinfo(struct t_audit_data *);
1487c478bd9Sstevel@tonic-gate static void aus_modctl(struct t_audit_data *);
1497c478bd9Sstevel@tonic-gate static void aus_kill(struct t_audit_data *);
1507c478bd9Sstevel@tonic-gate static void aus_setregid(struct t_audit_data *);
1517c478bd9Sstevel@tonic-gate static void aus_setreuid(struct t_audit_data *);
15261b9bf51Srica static void aus_labelsys(struct t_audit_data *);
1537c478bd9Sstevel@tonic-gate
1547c478bd9Sstevel@tonic-gate static void auf_mknod(struct t_audit_data *, int, rval_t *);
155794f0adbSRoger A. Faulkner static void auf_mknodat(struct t_audit_data *, int, rval_t *);
1567c478bd9Sstevel@tonic-gate static void auf_msgsys(struct t_audit_data *, int, rval_t *);
1577c478bd9Sstevel@tonic-gate static void auf_semsys(struct t_audit_data *, int, rval_t *);
1587c478bd9Sstevel@tonic-gate static void auf_shmsys(struct t_audit_data *, int, rval_t *);
1597c478bd9Sstevel@tonic-gate static void auf_read(struct t_audit_data *, int, rval_t *);
1607c478bd9Sstevel@tonic-gate static void auf_write(struct t_audit_data *, int, rval_t *);
1617c478bd9Sstevel@tonic-gate
1627c478bd9Sstevel@tonic-gate static void aus_sigqueue(struct t_audit_data *);
1637c478bd9Sstevel@tonic-gate static void aus_p_online(struct t_audit_data *);
1647c478bd9Sstevel@tonic-gate static void aus_processor_bind(struct t_audit_data *);
1657c478bd9Sstevel@tonic-gate static void aus_inst_sync(struct t_audit_data *);
1669acbbeafSnn35248 static void aus_brandsys(struct t_audit_data *);
1677c478bd9Sstevel@tonic-gate
1687c478bd9Sstevel@tonic-gate static void auf_accept(struct t_audit_data *, int, rval_t *);
1697c478bd9Sstevel@tonic-gate
1707c478bd9Sstevel@tonic-gate static void auf_bind(struct t_audit_data *, int, rval_t *);
1717c478bd9Sstevel@tonic-gate static void auf_connect(struct t_audit_data *, int, rval_t *);
1727c478bd9Sstevel@tonic-gate static void aus_shutdown(struct t_audit_data *);
1737c478bd9Sstevel@tonic-gate static void auf_setsockopt(struct t_audit_data *, int, rval_t *);
1747c478bd9Sstevel@tonic-gate static void aus_sockconfig(struct t_audit_data *);
1757c478bd9Sstevel@tonic-gate static void auf_recv(struct t_audit_data *, int, rval_t *);
1767c478bd9Sstevel@tonic-gate static void auf_recvmsg(struct t_audit_data *, int, rval_t *);
1777c478bd9Sstevel@tonic-gate static void auf_send(struct t_audit_data *, int, rval_t *);
1787c478bd9Sstevel@tonic-gate static void auf_sendmsg(struct t_audit_data *, int, rval_t *);
1797c478bd9Sstevel@tonic-gate static void auf_recvfrom(struct t_audit_data *, int, rval_t *);
1807c478bd9Sstevel@tonic-gate static void auf_sendto(struct t_audit_data *, int, rval_t *);
1817c478bd9Sstevel@tonic-gate static void aus_socket(struct t_audit_data *);
1827c478bd9Sstevel@tonic-gate /*
1837c478bd9Sstevel@tonic-gate * This table contains mapping information for converting system call numbers
1847c478bd9Sstevel@tonic-gate * to audit event IDs. In several cases it is necessary to map a single system
1857c478bd9Sstevel@tonic-gate * call to several events.
1867c478bd9Sstevel@tonic-gate */
1877c478bd9Sstevel@tonic-gate
188f9d0e028Sgww #define aui_null NULL /* NULL initialize function */
189f9d0e028Sgww #define aus_null NULL /* NULL start function */
190f9d0e028Sgww #define auf_null NULL /* NULL finish function */
191f9d0e028Sgww
1927c478bd9Sstevel@tonic-gate struct audit_s2e audit_s2e[] =
1937c478bd9Sstevel@tonic-gate {
1947c478bd9Sstevel@tonic-gate /*
1957c478bd9Sstevel@tonic-gate * ---------- ---------- ---------- ----------
1967c478bd9Sstevel@tonic-gate * INITIAL AUDIT START SYSTEM
1977c478bd9Sstevel@tonic-gate * PROCESSING EVENT PROCESSING CALL
1987c478bd9Sstevel@tonic-gate * ---------- ---------- ---------- -----------
1997c478bd9Sstevel@tonic-gate * FINISH EVENT
2007c478bd9Sstevel@tonic-gate * PROCESSING CONTROL
2017c478bd9Sstevel@tonic-gate * ----------------------------------------------------------
2027c478bd9Sstevel@tonic-gate */
2037c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 0 unused (indirect) */
2047c478bd9Sstevel@tonic-gate auf_null, 0,
205cb49a9fdSMarek Pospisil aui_null, AUE_EXIT, aus_exit, /* 1 exit */
2067c478bd9Sstevel@tonic-gate auf_null, S2E_NPT,
2078fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 2 (loadable) was forkall */
2087c478bd9Sstevel@tonic-gate auf_null, 0,
2097c478bd9Sstevel@tonic-gate aui_null, AUE_READ, aus_null, /* 3 read */
2107c478bd9Sstevel@tonic-gate auf_read, S2E_PUB,
2117c478bd9Sstevel@tonic-gate aui_null, AUE_WRITE, aus_null, /* 4 write */
2127c478bd9Sstevel@tonic-gate auf_write, 0,
2137c478bd9Sstevel@tonic-gate aui_open, AUE_OPEN, aus_open, /* 5 open */
2147c478bd9Sstevel@tonic-gate auf_null, S2E_SP,
2157c478bd9Sstevel@tonic-gate aui_null, AUE_CLOSE, aus_close, /* 6 close */
2167c478bd9Sstevel@tonic-gate auf_null, 0,
217794f0adbSRoger A. Faulkner aui_null, AUE_LINK, aus_null, /* 7 linkat */
2187c478bd9Sstevel@tonic-gate auf_null, 0,
2198fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 8 (loadable) was creat */
2208fd04b83SRoger A. Faulkner auf_null, 0,
2217c478bd9Sstevel@tonic-gate aui_null, AUE_LINK, aus_null, /* 9 link */
2227c478bd9Sstevel@tonic-gate auf_null, 0,
2237c478bd9Sstevel@tonic-gate aui_null, AUE_UNLINK, aus_null, /* 10 unlink */
2247c478bd9Sstevel@tonic-gate auf_null, 0,
225794f0adbSRoger A. Faulkner aui_null, AUE_SYMLINK, aus_null, /* 11 symlinkat */
2268fd04b83SRoger A. Faulkner auf_null, 0,
2277c478bd9Sstevel@tonic-gate aui_null, AUE_CHDIR, aus_null, /* 12 chdir */
2287c478bd9Sstevel@tonic-gate auf_null, S2E_SP,
2297c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 13 time */
2307c478bd9Sstevel@tonic-gate auf_null, 0,
2317c478bd9Sstevel@tonic-gate aui_null, AUE_MKNOD, aus_mknod, /* 14 mknod */
232794f0adbSRoger A. Faulkner auf_mknod, S2E_MLD,
2337c478bd9Sstevel@tonic-gate aui_null, AUE_CHMOD, aus_chmod, /* 15 chmod */
2347c478bd9Sstevel@tonic-gate auf_null, 0,
2357c478bd9Sstevel@tonic-gate aui_null, AUE_CHOWN, aus_chown, /* 16 chown */
2367c478bd9Sstevel@tonic-gate auf_null, 0,
2377c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 17 brk */
2387c478bd9Sstevel@tonic-gate auf_null, 0,
2397c478bd9Sstevel@tonic-gate aui_null, AUE_STAT, aus_null, /* 18 stat */
2407c478bd9Sstevel@tonic-gate auf_null, S2E_PUB,
2417c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 19 lseek */
2427c478bd9Sstevel@tonic-gate auf_null, 0,
2437c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 20 getpid */
2447c478bd9Sstevel@tonic-gate auf_null, 0,
2457c478bd9Sstevel@tonic-gate aui_null, AUE_MOUNT, aus_mount, /* 21 mount */
2467c478bd9Sstevel@tonic-gate auf_null, S2E_MLD,
247794f0adbSRoger A. Faulkner aui_null, AUE_READLINK, aus_null, /* 22 readlinkat */
248794f0adbSRoger A. Faulkner auf_null, S2E_PUB,
2497c478bd9Sstevel@tonic-gate aui_null, AUE_SETUID, aus_setuid, /* 23 setuid */
2507c478bd9Sstevel@tonic-gate auf_null, 0,
2517c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 24 getuid */
2527c478bd9Sstevel@tonic-gate auf_null, 0,
2537c478bd9Sstevel@tonic-gate aui_null, AUE_STIME, aus_null, /* 25 stime */
2547c478bd9Sstevel@tonic-gate auf_null, 0,
2558fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 26 pcsample */
2567c478bd9Sstevel@tonic-gate auf_null, 0,
2577c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 27 alarm */
2587c478bd9Sstevel@tonic-gate auf_null, 0,
2597c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 28 fstat */
2607c478bd9Sstevel@tonic-gate auf_null, 0,
2617c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 29 pause */
2627c478bd9Sstevel@tonic-gate auf_null, 0,
2638fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 30 (loadable) was utime */
2647c478bd9Sstevel@tonic-gate auf_null, 0,
2657c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 31 stty (TIOCSETP-audit?) */
2667c478bd9Sstevel@tonic-gate auf_null, 0,
2677c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 32 gtty */
2687c478bd9Sstevel@tonic-gate auf_null, 0,
2697c478bd9Sstevel@tonic-gate aui_null, AUE_ACCESS, aus_null, /* 33 access */
2707c478bd9Sstevel@tonic-gate auf_null, S2E_PUB,
2717c478bd9Sstevel@tonic-gate aui_null, AUE_NICE, aus_null, /* 34 nice */
2727c478bd9Sstevel@tonic-gate auf_null, 0,
2737c478bd9Sstevel@tonic-gate aui_null, AUE_STATFS, aus_null, /* 35 statfs */
2747c478bd9Sstevel@tonic-gate auf_null, S2E_PUB,
2757c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 36 sync */
2767c478bd9Sstevel@tonic-gate auf_null, 0,
2777c478bd9Sstevel@tonic-gate aui_null, AUE_KILL, aus_kill, /* 37 kill */
2787c478bd9Sstevel@tonic-gate auf_null, 0,
2797c478bd9Sstevel@tonic-gate aui_null, AUE_FSTATFS, aus_fstatfs, /* 38 fstatfs */
2807c478bd9Sstevel@tonic-gate auf_null, S2E_PUB,
2814be8c573SJan Friedel aui_setpgrp, AUE_SETPGRP, aus_setpgrp, /* 39 setpgrp */
2827c478bd9Sstevel@tonic-gate auf_null, 0,
2839acbbeafSnn35248 aui_null, AUE_NULL, aus_null, /* 40 uucopystr */
2847c478bd9Sstevel@tonic-gate auf_null, 0,
2858fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 41 (loadable) was dup */
2867c478bd9Sstevel@tonic-gate auf_null, 0,
2878fd04b83SRoger A. Faulkner aui_null, AUE_PIPE, aus_null, /* 42 (loadable) pipe */
2887c478bd9Sstevel@tonic-gate auf_null, 0,
2897c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 43 times */
2907c478bd9Sstevel@tonic-gate auf_null, 0,
2917c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 44 profil */
2927c478bd9Sstevel@tonic-gate auf_null, 0,
2938fd04b83SRoger A. Faulkner aui_null, AUE_ACCESS, aus_null, /* 45 faccessat */
294c4d3e299SBrent Paulson auf_null, S2E_PUB,
2957c478bd9Sstevel@tonic-gate aui_null, AUE_SETGID, aus_setgid, /* 46 setgid */
2967c478bd9Sstevel@tonic-gate auf_null, 0,
2977c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 47 getgid */
2987c478bd9Sstevel@tonic-gate auf_null, 0,
299794f0adbSRoger A. Faulkner aui_null, AUE_MKNOD, aus_mknodat, /* 48 mknodat */
300794f0adbSRoger A. Faulkner auf_mknodat, S2E_MLD,
3018fd04b83SRoger A. Faulkner aui_msgsys, AUE_MSGSYS, aus_msgsys, /* 49 (loadable) msgsys */
3027c478bd9Sstevel@tonic-gate auf_msgsys, 0,
3037c478bd9Sstevel@tonic-gate #if defined(__x86)
3047c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 50 sysi86 */
3057c478bd9Sstevel@tonic-gate auf_null, 0,
3067c478bd9Sstevel@tonic-gate #else
3077c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 50 (loadable) was sys3b */
3087c478bd9Sstevel@tonic-gate auf_null, 0,
3097c478bd9Sstevel@tonic-gate #endif /* __x86 */
3108fd04b83SRoger A. Faulkner aui_null, AUE_ACCT, aus_acct, /* 51 (loadable) sysacct */
3117c478bd9Sstevel@tonic-gate auf_null, 0,
3128fd04b83SRoger A. Faulkner aui_shmsys, AUE_SHMSYS, aus_shmsys, /* 52 (loadable) shmsys */
3137c478bd9Sstevel@tonic-gate auf_shmsys, 0,
3148fd04b83SRoger A. Faulkner aui_semsys, AUE_SEMSYS, aus_semsys, /* 53 (loadable) semsys */
3157c478bd9Sstevel@tonic-gate auf_semsys, 0,
3167c478bd9Sstevel@tonic-gate aui_null, AUE_IOCTL, aus_ioctl, /* 54 ioctl */
3177c478bd9Sstevel@tonic-gate auf_null, 0,
3187c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 55 uadmin */
3197c478bd9Sstevel@tonic-gate auf_null, 0,
3208fd04b83SRoger A. Faulkner aui_fchownat, AUE_NULL, aus_fchownat, /* 56 fchownat */
321c4d3e299SBrent Paulson auf_null, 0,
3227c478bd9Sstevel@tonic-gate aui_utssys, AUE_FUSERS, aus_null, /* 57 utssys */
3237c478bd9Sstevel@tonic-gate auf_null, 0,
3247c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 58 fsync */
3257c478bd9Sstevel@tonic-gate auf_null, 0,
3267c478bd9Sstevel@tonic-gate aui_execve, AUE_EXECVE, aus_null, /* 59 exece */
3277c478bd9Sstevel@tonic-gate auf_null, S2E_MLD,
3287c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 60 umask */
3297c478bd9Sstevel@tonic-gate auf_null, 0,
3307c478bd9Sstevel@tonic-gate aui_null, AUE_CHROOT, aus_null, /* 61 chroot */
3317c478bd9Sstevel@tonic-gate auf_null, S2E_SP,
3327c478bd9Sstevel@tonic-gate aui_fcntl, AUE_FCNTL, aus_fcntl, /* 62 fcntl */
3337c478bd9Sstevel@tonic-gate auf_null, 0,
3347c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 63 ulimit */
3357c478bd9Sstevel@tonic-gate auf_null, 0,
3368fd04b83SRoger A. Faulkner aui_null, AUE_RENAME, aus_null, /* 64 renameat */
337c4d3e299SBrent Paulson auf_null, 0,
3388fd04b83SRoger A. Faulkner aui_unlinkat, AUE_NULL, aus_null, /* 65 unlinkat */
339c4d3e299SBrent Paulson auf_null, 0,
3408fd04b83SRoger A. Faulkner aui_fstatat, AUE_NULL, aus_null, /* 66 fstatat */
341c4d3e299SBrent Paulson auf_null, S2E_PUB,
3428fd04b83SRoger A. Faulkner aui_fstatat, AUE_NULL, aus_null, /* 67 fstatat64 */
343c4d3e299SBrent Paulson auf_null, S2E_PUB,
3448fd04b83SRoger A. Faulkner aui_openat, AUE_OPEN, aus_openat, /* 68 openat */
345c4d3e299SBrent Paulson auf_null, S2E_SP,
3468fd04b83SRoger A. Faulkner aui_openat, AUE_OPEN, aus_openat, /* 69 openat64 */
347c4d3e299SBrent Paulson auf_null, S2E_SP,
3488fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 70 tasksys */
3497c478bd9Sstevel@tonic-gate auf_null, 0,
3508fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 71 (loadable) acctctl */
3517c478bd9Sstevel@tonic-gate auf_null, 0,
3528fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 72 (loadable) exacct */
3537c478bd9Sstevel@tonic-gate auf_null, 0,
3548fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 73 getpagesizes */
3557c478bd9Sstevel@tonic-gate auf_null, 0,
3568fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 74 rctlsys */
3577c478bd9Sstevel@tonic-gate auf_null, 0,
358f48205beScasper aui_null, AUE_NULL, aus_null, /* 75 sidsys */
3597c478bd9Sstevel@tonic-gate auf_null, 0,
3608fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 76 (loadable) was fsat */
3617c478bd9Sstevel@tonic-gate auf_null, 0,
3628fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 77 syslwp_park */
3637c478bd9Sstevel@tonic-gate auf_null, 0,
3648fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 78 sendfilev */
3657c478bd9Sstevel@tonic-gate auf_null, 0,
3667c478bd9Sstevel@tonic-gate aui_null, AUE_RMDIR, aus_null, /* 79 rmdir */
3677c478bd9Sstevel@tonic-gate auf_null, 0,
3687c478bd9Sstevel@tonic-gate aui_null, AUE_MKDIR, aus_mkdir, /* 80 mkdir */
3697c478bd9Sstevel@tonic-gate auf_null, 0,
3707c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 81 getdents */
3717c478bd9Sstevel@tonic-gate auf_null, 0,
3727c478bd9Sstevel@tonic-gate aui_privsys, AUE_NULL, aus_null, /* 82 privsys */
3737c478bd9Sstevel@tonic-gate auf_null, 0,
3748fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 83 ucredsys */
3757c478bd9Sstevel@tonic-gate auf_null, 0,
3767c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 84 sysfs */
3777c478bd9Sstevel@tonic-gate auf_null, 0,
3787c478bd9Sstevel@tonic-gate aui_null, AUE_GETMSG, aus_getmsg, /* 85 getmsg */
3797c478bd9Sstevel@tonic-gate auf_null, 0,
3807c478bd9Sstevel@tonic-gate aui_null, AUE_PUTMSG, aus_putmsg, /* 86 putmsg */
3817c478bd9Sstevel@tonic-gate auf_null, 0,
3828fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 87 (loadable) was poll */
3837c478bd9Sstevel@tonic-gate auf_null, 0,
3847c478bd9Sstevel@tonic-gate aui_null, AUE_LSTAT, aus_null, /* 88 lstat */
3857c478bd9Sstevel@tonic-gate auf_null, S2E_PUB,
3867c478bd9Sstevel@tonic-gate aui_null, AUE_SYMLINK, aus_null, /* 89 symlink */
3877c478bd9Sstevel@tonic-gate auf_null, 0,
3887c478bd9Sstevel@tonic-gate aui_null, AUE_READLINK, aus_null, /* 90 readlink */
3897c478bd9Sstevel@tonic-gate auf_null, S2E_PUB,
3907c478bd9Sstevel@tonic-gate aui_null, AUE_SETGROUPS, aus_setgroups, /* 91 setgroups */
3917c478bd9Sstevel@tonic-gate auf_null, 0,
3927c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 92 getgroups */
3937c478bd9Sstevel@tonic-gate auf_null, 0,
3947c478bd9Sstevel@tonic-gate aui_null, AUE_FCHMOD, aus_fchmod, /* 93 fchmod */
3957c478bd9Sstevel@tonic-gate auf_null, 0,
3967c478bd9Sstevel@tonic-gate aui_null, AUE_FCHOWN, aus_fchown, /* 94 fchown */
3977c478bd9Sstevel@tonic-gate auf_null, 0,
3987c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 95 sigprocmask */
3997c478bd9Sstevel@tonic-gate auf_null, 0,
4007c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 96 sigsuspend */
4017c478bd9Sstevel@tonic-gate auf_null, 0,
4027c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 97 sigaltstack */
4037c478bd9Sstevel@tonic-gate auf_null, 0,
4047c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 98 sigaction */
4057c478bd9Sstevel@tonic-gate auf_null, 0,
4067c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 99 sigpending */
4077c478bd9Sstevel@tonic-gate auf_null, 0,
4087c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 100 setcontext */
4097c478bd9Sstevel@tonic-gate auf_null, 0,
410794f0adbSRoger A. Faulkner aui_fchmodat, AUE_NULL, aus_fchmodat, /* 101 fchmodat */
4117c478bd9Sstevel@tonic-gate auf_null, 0,
412794f0adbSRoger A. Faulkner aui_null, AUE_MKDIR, aus_mkdirat, /* 102 mkdirat */
4137c478bd9Sstevel@tonic-gate auf_null, 0,
4147c478bd9Sstevel@tonic-gate aui_null, AUE_STATVFS, aus_null, /* 103 statvfs */
4157c478bd9Sstevel@tonic-gate auf_null, S2E_PUB,
4167c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 104 fstatvfs */
4177c478bd9Sstevel@tonic-gate auf_null, 0,
4188fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 105 getloadavg */
4197c478bd9Sstevel@tonic-gate auf_null, 0,
4207c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 106 nfssys */
4217c478bd9Sstevel@tonic-gate auf_null, 0,
4228fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 107 waitsys */
4237c478bd9Sstevel@tonic-gate auf_null, 0,
4248fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 108 sigsendsys */
4257c478bd9Sstevel@tonic-gate auf_null, 0,
4267c478bd9Sstevel@tonic-gate #if defined(__x86)
4277c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 109 hrtsys */
4287c478bd9Sstevel@tonic-gate auf_null, 0,
4297c478bd9Sstevel@tonic-gate #else
4307c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 109 (loadable) */
4317c478bd9Sstevel@tonic-gate auf_null, 0,
4327c478bd9Sstevel@tonic-gate #endif /* __x86 */
4338fd04b83SRoger A. Faulkner aui_null, AUE_UTIMES, aus_null, /* 110 utimesys */
434c4d3e299SBrent Paulson auf_null, 0,
4358fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 111 sigresend */
4367c478bd9Sstevel@tonic-gate auf_null, 0,
4378fd04b83SRoger A. Faulkner aui_null, AUE_PRIOCNTLSYS, aus_priocntlsys, /* 112 priocntlsys */
4387c478bd9Sstevel@tonic-gate auf_null, 0,
4397c478bd9Sstevel@tonic-gate aui_null, AUE_PATHCONF, aus_null, /* 113 pathconf */
4407c478bd9Sstevel@tonic-gate auf_null, S2E_PUB,
4417c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 114 mincore */
4427c478bd9Sstevel@tonic-gate auf_null, 0,
4437c478bd9Sstevel@tonic-gate aui_null, AUE_MMAP, aus_mmap, /* 115 mmap */
4447c478bd9Sstevel@tonic-gate auf_null, 0,
4457c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 116 mprotect */
4467c478bd9Sstevel@tonic-gate auf_null, 0,
4477c478bd9Sstevel@tonic-gate aui_null, AUE_MUNMAP, aus_munmap, /* 117 munmap */
4487c478bd9Sstevel@tonic-gate auf_null, 0,
4497c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 118 fpathconf */
4507c478bd9Sstevel@tonic-gate auf_null, 0,
4517c478bd9Sstevel@tonic-gate aui_null, AUE_VFORK, aus_null, /* 119 vfork */
4527c478bd9Sstevel@tonic-gate auf_null, 0,
4537c478bd9Sstevel@tonic-gate aui_null, AUE_FCHDIR, aus_null, /* 120 fchdir */
4547c478bd9Sstevel@tonic-gate auf_null, 0,
4557c478bd9Sstevel@tonic-gate aui_null, AUE_READ, aus_null, /* 121 readv */
4567c478bd9Sstevel@tonic-gate auf_read, S2E_PUB,
4577c478bd9Sstevel@tonic-gate aui_null, AUE_WRITE, aus_null, /* 122 writev */
4587c478bd9Sstevel@tonic-gate auf_write, 0,
4598fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 123 (loadable) was xstat */
4607c478bd9Sstevel@tonic-gate auf_null, 0,
4618fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 124 (loadable) was lxstat */
4628fd04b83SRoger A. Faulkner auf_null, 0,
4638fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 125 (loadable) was fxstat */
4648fd04b83SRoger A. Faulkner auf_null, 0,
4658fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 126 (loadable) was xmknod */
4668fd04b83SRoger A. Faulkner auf_null, 0,
4678fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 127 mmapobj */
4687c478bd9Sstevel@tonic-gate auf_null, 0,
4697c478bd9Sstevel@tonic-gate aui_null, AUE_SETRLIMIT, aus_null, /* 128 setrlimit */
4707c478bd9Sstevel@tonic-gate auf_null, 0,
4717c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 129 getrlimit */
4727c478bd9Sstevel@tonic-gate auf_null, 0,
4737c478bd9Sstevel@tonic-gate aui_null, AUE_LCHOWN, aus_lchown, /* 130 lchown */
4747c478bd9Sstevel@tonic-gate auf_null, 0,
4757c478bd9Sstevel@tonic-gate aui_memcntl, AUE_MEMCNTL, aus_memcntl, /* 131 memcntl */
4767c478bd9Sstevel@tonic-gate auf_null, 0,
4777c478bd9Sstevel@tonic-gate aui_null, AUE_GETPMSG, aus_getpmsg, /* 132 getpmsg */
4787c478bd9Sstevel@tonic-gate auf_null, 0,
4797c478bd9Sstevel@tonic-gate aui_null, AUE_PUTPMSG, aus_putpmsg, /* 133 putpmsg */
4807c478bd9Sstevel@tonic-gate auf_null, 0,
4817c478bd9Sstevel@tonic-gate aui_null, AUE_RENAME, aus_null, /* 134 rename */
4827c478bd9Sstevel@tonic-gate auf_null, 0,
4837c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 135 uname */
4847c478bd9Sstevel@tonic-gate auf_null, 0,
4857c478bd9Sstevel@tonic-gate aui_null, AUE_SETEGID, aus_setegid, /* 136 setegid */
4867c478bd9Sstevel@tonic-gate auf_null, 0,
4877c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 137 sysconfig */
4887c478bd9Sstevel@tonic-gate auf_null, 0,
4897c478bd9Sstevel@tonic-gate aui_null, AUE_ADJTIME, aus_null, /* 138 adjtime */
4907c478bd9Sstevel@tonic-gate auf_null, 0,
4917c478bd9Sstevel@tonic-gate aui_sysinfo, AUE_SYSINFO, aus_sysinfo, /* 139 systeminfo */
4927c478bd9Sstevel@tonic-gate auf_null, 0,
4938fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 140 (loadable) sharefs */
4947c478bd9Sstevel@tonic-gate auf_null, 0,
4957c478bd9Sstevel@tonic-gate aui_null, AUE_SETEUID, aus_seteuid, /* 141 seteuid */
4967c478bd9Sstevel@tonic-gate auf_null, 0,
497657b1f3dSraf aui_forksys, AUE_NULL, aus_null, /* 142 forksys */
4987c478bd9Sstevel@tonic-gate auf_null, 0,
4998fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 143 (loadable) was fork1 */
5007c478bd9Sstevel@tonic-gate auf_null, 0,
5017c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 144 sigwait */
5027c478bd9Sstevel@tonic-gate auf_null, 0,
5037c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 145 lwp_info */
5047c478bd9Sstevel@tonic-gate auf_null, 0,
5057c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 146 yield */
5067c478bd9Sstevel@tonic-gate auf_null, 0,
5078fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 147 (loadable) */
5088fd04b83SRoger A. Faulkner /* was lwp_sema_wait */
5097c478bd9Sstevel@tonic-gate auf_null, 0,
5107c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 148 lwp_sema_post */
5117c478bd9Sstevel@tonic-gate auf_null, 0,
5127c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 149 lwp_sema_trywait */
5137c478bd9Sstevel@tonic-gate auf_null, 0,
5148fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 150 lwp_detach */
5157c478bd9Sstevel@tonic-gate auf_null, 0,
5168fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 151 corectl */
5177c478bd9Sstevel@tonic-gate auf_null, 0,
5187c478bd9Sstevel@tonic-gate aui_modctl, AUE_MODCTL, aus_modctl, /* 152 modctl */
5197c478bd9Sstevel@tonic-gate auf_null, 0,
5207c478bd9Sstevel@tonic-gate aui_null, AUE_FCHROOT, aus_null, /* 153 fchroot */
5217c478bd9Sstevel@tonic-gate auf_null, 0,
5228fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 154 (loadable) was utimes */
5237c478bd9Sstevel@tonic-gate auf_null, 0,
5247c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 155 vhangup */
5257c478bd9Sstevel@tonic-gate auf_null, 0,
5267c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 156 gettimeofday */
5277c478bd9Sstevel@tonic-gate auf_null, 0,
5287c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 157 getitimer */
5297c478bd9Sstevel@tonic-gate auf_null, 0,
5307c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 158 setitimer */
5317c478bd9Sstevel@tonic-gate auf_null, 0,
5327c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 159 lwp_create */
5337c478bd9Sstevel@tonic-gate auf_null, 0,
5347c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 160 lwp_exit */
5357c478bd9Sstevel@tonic-gate auf_null, 0,
5367c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 161 lwp_suspend */
5377c478bd9Sstevel@tonic-gate auf_null, 0,
5387c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 162 lwp_continue */
5397c478bd9Sstevel@tonic-gate auf_null, 0,
5407c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 163 lwp_kill */
5417c478bd9Sstevel@tonic-gate auf_null, 0,
5427c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 164 lwp_self */
5437c478bd9Sstevel@tonic-gate auf_null, 0,
5448fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 165 lwp_sigmask */
5457c478bd9Sstevel@tonic-gate auf_null, 0,
5468fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 166 lwp_private */
5477c478bd9Sstevel@tonic-gate auf_null, 0,
5487c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 167 lwp_wait */
5497c478bd9Sstevel@tonic-gate auf_null, 0,
550883492d5Sraf aui_null, AUE_NULL, aus_null, /* 168 lwp_mutex_wakeup */
5517c478bd9Sstevel@tonic-gate auf_null, 0,
5528fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 169 (loadable) */
5538fd04b83SRoger A. Faulkner /* was lwp_mutex_lock */
5547c478bd9Sstevel@tonic-gate auf_null, 0,
5557c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 170 lwp_cond_wait */
5567c478bd9Sstevel@tonic-gate auf_null, 0,
5577c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 171 lwp_cond_signal */
5587c478bd9Sstevel@tonic-gate auf_null, 0,
5597c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 172 lwp_cond_broadcast */
5607c478bd9Sstevel@tonic-gate auf_null, 0,
5617c478bd9Sstevel@tonic-gate aui_null, AUE_READ, aus_null, /* 173 pread */
5627c478bd9Sstevel@tonic-gate auf_read, S2E_PUB,
5637c478bd9Sstevel@tonic-gate aui_null, AUE_WRITE, aus_null, /* 174 pwrite */
5647c478bd9Sstevel@tonic-gate auf_write, 0,
5657c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 175 llseek */
5667c478bd9Sstevel@tonic-gate auf_null, 0,
5678fd04b83SRoger A. Faulkner aui_null, AUE_INST_SYNC, aus_inst_sync, /* 176 (loadable) inst_sync */
5687c478bd9Sstevel@tonic-gate auf_null, 0,
5699acbbeafSnn35248 aui_null, AUE_BRANDSYS, aus_brandsys, /* 177 brandsys */
5707c478bd9Sstevel@tonic-gate auf_null, 0,
5718fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 178 (loadable) kaio */
5727c478bd9Sstevel@tonic-gate auf_null, 0,
5738fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 179 (loadable) cpc */
5747c478bd9Sstevel@tonic-gate auf_null, 0,
5758fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 180 lgrpsys */
5767c478bd9Sstevel@tonic-gate auf_null, 0,
5778fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 181 rusagesys */
5787c478bd9Sstevel@tonic-gate auf_null, 0,
579df2381bfSpraks aui_portfs, AUE_PORTFS, aus_null, /* 182 (loadable) portfs */
5807e309bc2SJan Friedel auf_null, S2E_MLD,
5818fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 183 pollsys */
5827c478bd9Sstevel@tonic-gate auf_null, 0,
58361b9bf51Srica aui_labelsys, AUE_NULL, aus_labelsys, /* 184 labelsys */
5847c478bd9Sstevel@tonic-gate auf_null, 0,
5857c478bd9Sstevel@tonic-gate aui_acl, AUE_ACLSET, aus_acl, /* 185 acl */
5867c478bd9Sstevel@tonic-gate auf_null, 0,
5877c478bd9Sstevel@tonic-gate aui_auditsys, AUE_AUDITSYS, aus_auditsys, /* 186 auditsys */
5887c478bd9Sstevel@tonic-gate auf_null, 0,
5898fd04b83SRoger A. Faulkner aui_null, AUE_PROCESSOR_BIND, aus_processor_bind, /* 187 processor_bind */
5908fd04b83SRoger A. Faulkner auf_null, 0,
5917c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 188 processor_info */
5927c478bd9Sstevel@tonic-gate auf_null, 0,
5937c478bd9Sstevel@tonic-gate aui_null, AUE_P_ONLINE, aus_p_online, /* 189 p_online */
5947c478bd9Sstevel@tonic-gate auf_null, 0,
5957c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_sigqueue, /* 190 sigqueue */
5967c478bd9Sstevel@tonic-gate auf_null, 0,
5977c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 191 clock_gettime */
5987c478bd9Sstevel@tonic-gate auf_null, 0,
5997c478bd9Sstevel@tonic-gate aui_null, AUE_CLOCK_SETTIME, aus_null, /* 192 clock_settime */
6007c478bd9Sstevel@tonic-gate auf_null, 0,
6017c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 193 clock_getres */
6027c478bd9Sstevel@tonic-gate auf_null, 0,
6037c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 194 timer_create */
6047c478bd9Sstevel@tonic-gate auf_null, 0,
6057c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 195 timer_delete */
6067c478bd9Sstevel@tonic-gate auf_null, 0,
6077c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 196 timer_settime */
6087c478bd9Sstevel@tonic-gate auf_null, 0,
6097c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 197 timer_gettime */
6107c478bd9Sstevel@tonic-gate auf_null, 0,
6117c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 198 timer_getoverrun */
6127c478bd9Sstevel@tonic-gate auf_null, 0,
6137c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 199 nanosleep */
6147c478bd9Sstevel@tonic-gate auf_null, 0,
6157c478bd9Sstevel@tonic-gate aui_acl, AUE_FACLSET, aus_facl, /* 200 facl */
6167c478bd9Sstevel@tonic-gate auf_null, 0,
6177c478bd9Sstevel@tonic-gate aui_doorfs, AUE_DOORFS, aus_doorfs, /* 201 (loadable) doorfs */
6187c478bd9Sstevel@tonic-gate auf_null, 0,
6197c478bd9Sstevel@tonic-gate aui_null, AUE_SETREUID, aus_setreuid, /* 202 setreuid */
6207c478bd9Sstevel@tonic-gate auf_null, 0,
6217c478bd9Sstevel@tonic-gate aui_null, AUE_SETREGID, aus_setregid, /* 203 setregid */
6227c478bd9Sstevel@tonic-gate auf_null, 0,
6237c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 204 install_utrap */
6247c478bd9Sstevel@tonic-gate auf_null, 0,
6257c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 205 signotify */
6267c478bd9Sstevel@tonic-gate auf_null, 0,
6277c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 206 schedctl */
6287c478bd9Sstevel@tonic-gate auf_null, 0,
6297c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 207 (loadable) pset */
6307c478bd9Sstevel@tonic-gate auf_null, 0,
6318fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 208 sparc_utrap_install */
6327c478bd9Sstevel@tonic-gate auf_null, 0,
6337c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 209 resolvepath */
6347c478bd9Sstevel@tonic-gate auf_null, 0,
6357c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 210 lwp_mutex_timedlock */
6367c478bd9Sstevel@tonic-gate auf_null, 0,
6377c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 211 lwp_sema_timedwait */
6387c478bd9Sstevel@tonic-gate auf_null, 0,
6397c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 212 lwp_rwlock_sys */
6407c478bd9Sstevel@tonic-gate auf_null, 0,
6418fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 213 getdents64 */
6427c478bd9Sstevel@tonic-gate auf_null, 0,
6437c478bd9Sstevel@tonic-gate aui_null, AUE_MMAP, aus_mmap, /* 214 mmap64 */
6447c478bd9Sstevel@tonic-gate auf_null, 0,
6457c478bd9Sstevel@tonic-gate aui_null, AUE_STAT, aus_null, /* 215 stat64 */
6467c478bd9Sstevel@tonic-gate auf_null, S2E_PUB,
6477c478bd9Sstevel@tonic-gate aui_null, AUE_LSTAT, aus_null, /* 216 lstat64 */
6487c478bd9Sstevel@tonic-gate auf_null, S2E_PUB,
6497c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 217 fstat64 */
6507c478bd9Sstevel@tonic-gate auf_null, 0,
6517c478bd9Sstevel@tonic-gate aui_null, AUE_STATVFS, aus_null, /* 218 statvfs64 */
6527c478bd9Sstevel@tonic-gate auf_null, S2E_PUB,
6537c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 219 fstatvfs64 */
6547c478bd9Sstevel@tonic-gate auf_null, 0,
6557c478bd9Sstevel@tonic-gate aui_null, AUE_SETRLIMIT, aus_null, /* 220 setrlimit64 */
6567c478bd9Sstevel@tonic-gate auf_null, 0,
6577c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 221 getrlimit64 */
6587c478bd9Sstevel@tonic-gate auf_null, 0,
6597c478bd9Sstevel@tonic-gate aui_null, AUE_READ, aus_null, /* 222 pread64 */
6607c478bd9Sstevel@tonic-gate auf_read, S2E_PUB,
6617c478bd9Sstevel@tonic-gate aui_null, AUE_WRITE, aus_null, /* 223 pwrite64 */
6627c478bd9Sstevel@tonic-gate auf_write, 0,
6638fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 224 (loadable) was creat64 */
6648fd04b83SRoger A. Faulkner auf_null, 0,
6657c478bd9Sstevel@tonic-gate aui_open, AUE_OPEN, aus_open, /* 225 open64 */
6667c478bd9Sstevel@tonic-gate auf_null, S2E_SP,
6677c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 226 (loadable) rpcsys */
6687c478bd9Sstevel@tonic-gate auf_null, 0,
6698fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 227 zone */
6707c478bd9Sstevel@tonic-gate auf_null, 0,
6718fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 228 (loadable) autofssys */
6727c478bd9Sstevel@tonic-gate auf_null, 0,
6738fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 229 getcwd */
6747c478bd9Sstevel@tonic-gate auf_null, 0,
6757c478bd9Sstevel@tonic-gate aui_null, AUE_SOCKET, aus_socket, /* 230 so_socket */
6767c478bd9Sstevel@tonic-gate auf_null, 0,
6777c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 231 so_socketpair */
6787c478bd9Sstevel@tonic-gate auf_null, 0,
6797c478bd9Sstevel@tonic-gate aui_null, AUE_BIND, aus_null, /* 232 bind */
6807c478bd9Sstevel@tonic-gate auf_bind, 0,
6817c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 233 listen */
6827c478bd9Sstevel@tonic-gate auf_null, 0,
6837c478bd9Sstevel@tonic-gate aui_null, AUE_ACCEPT, aus_null, /* 234 accept */
6847c478bd9Sstevel@tonic-gate auf_accept, 0,
6857c478bd9Sstevel@tonic-gate aui_null, AUE_CONNECT, aus_null, /* 235 connect */
6867c478bd9Sstevel@tonic-gate auf_connect, 0,
6877c478bd9Sstevel@tonic-gate aui_null, AUE_SHUTDOWN, aus_shutdown, /* 236 shutdown */
6887c478bd9Sstevel@tonic-gate auf_null, 0,
6897c478bd9Sstevel@tonic-gate aui_null, AUE_READ, aus_null, /* 237 recv */
6907c478bd9Sstevel@tonic-gate auf_recv, 0,
6917c478bd9Sstevel@tonic-gate aui_null, AUE_RECVFROM, aus_null, /* 238 recvfrom */
6927c478bd9Sstevel@tonic-gate auf_recvfrom, 0,
6937c478bd9Sstevel@tonic-gate aui_null, AUE_RECVMSG, aus_null, /* 239 recvmsg */
6947c478bd9Sstevel@tonic-gate auf_recvmsg, 0,
6957c478bd9Sstevel@tonic-gate aui_null, AUE_WRITE, aus_null, /* 240 send */
6967c478bd9Sstevel@tonic-gate auf_send, 0,
6977c478bd9Sstevel@tonic-gate aui_null, AUE_SENDMSG, aus_null, /* 241 sendmsg */
6987c478bd9Sstevel@tonic-gate auf_sendmsg, 0,
6997c478bd9Sstevel@tonic-gate aui_null, AUE_SENDTO, aus_null, /* 242 sendto */
7007c478bd9Sstevel@tonic-gate auf_sendto, 0,
7017c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 243 getpeername */
7027c478bd9Sstevel@tonic-gate auf_null, 0,
7037c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 244 getsockname */
7047c478bd9Sstevel@tonic-gate auf_null, 0,
7057c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 245 getsockopt */
7067c478bd9Sstevel@tonic-gate auf_null, 0,
7077c478bd9Sstevel@tonic-gate aui_null, AUE_SETSOCKOPT, aus_null, /* 246 setsockopt */
7087c478bd9Sstevel@tonic-gate auf_setsockopt, 0,
7097c478bd9Sstevel@tonic-gate aui_null, AUE_SOCKCONFIG, aus_sockconfig, /* 247 sockconfig */
7107c478bd9Sstevel@tonic-gate auf_null, 0,
7117c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 248 ntp_gettime */
7127c478bd9Sstevel@tonic-gate auf_null, 0,
7137c478bd9Sstevel@tonic-gate aui_null, AUE_NTP_ADJTIME, aus_null, /* 249 ntp_adjtime */
7147c478bd9Sstevel@tonic-gate auf_null, 0,
7157c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 250 lwp_mutex_unlock */
7167c478bd9Sstevel@tonic-gate auf_null, 0,
7177c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 251 lwp_mutex_trylock */
7187c478bd9Sstevel@tonic-gate auf_null, 0,
719883492d5Sraf aui_null, AUE_NULL, aus_null, /* 252 lwp_mutex_register */
7207c478bd9Sstevel@tonic-gate auf_null, 0,
7217c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 253 cladm */
7227c478bd9Sstevel@tonic-gate auf_null, 0,
7239acbbeafSnn35248 aui_null, AUE_NULL, aus_null, /* 254 uucopy */
7247c478bd9Sstevel@tonic-gate auf_null, 0,
7257c478bd9Sstevel@tonic-gate aui_null, AUE_UMOUNT2, aus_umount2, /* 255 umount2 */
7267c478bd9Sstevel@tonic-gate auf_null, 0
7277c478bd9Sstevel@tonic-gate };
7287c478bd9Sstevel@tonic-gate
7297c478bd9Sstevel@tonic-gate uint_t num_syscall = sizeof (audit_s2e) / sizeof (struct audit_s2e);
7307c478bd9Sstevel@tonic-gate
7317c478bd9Sstevel@tonic-gate
732cb49a9fdSMarek Pospisil /* exit start function */
733cb49a9fdSMarek Pospisil /*ARGSUSED*/
734cb49a9fdSMarek Pospisil static void
aus_exit(struct t_audit_data * tad)735cb49a9fdSMarek Pospisil aus_exit(struct t_audit_data *tad)
736cb49a9fdSMarek Pospisil {
737cb49a9fdSMarek Pospisil uint32_t rval;
738cb49a9fdSMarek Pospisil struct a {
739cb49a9fdSMarek Pospisil long rval;
740cb49a9fdSMarek Pospisil } *uap = (struct a *)ttolwp(curthread)->lwp_ap;
741cb49a9fdSMarek Pospisil
742cb49a9fdSMarek Pospisil rval = (uint32_t)uap->rval;
743cb49a9fdSMarek Pospisil au_uwrite(au_to_arg32(1, "exit status", rval));
744cb49a9fdSMarek Pospisil }
745cb49a9fdSMarek Pospisil
7467c478bd9Sstevel@tonic-gate /* acct start function */
7477c478bd9Sstevel@tonic-gate /*ARGSUSED*/
7487c478bd9Sstevel@tonic-gate static void
aus_acct(struct t_audit_data * tad)7497c478bd9Sstevel@tonic-gate aus_acct(struct t_audit_data *tad)
7507c478bd9Sstevel@tonic-gate {
7517c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
7527c478bd9Sstevel@tonic-gate uintptr_t fname;
7537c478bd9Sstevel@tonic-gate
7547c478bd9Sstevel@tonic-gate struct a {
7557c478bd9Sstevel@tonic-gate long fname; /* char * */
7567c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
7577c478bd9Sstevel@tonic-gate
7587c478bd9Sstevel@tonic-gate fname = (uintptr_t)uap->fname;
7597c478bd9Sstevel@tonic-gate
7607c478bd9Sstevel@tonic-gate if (fname == 0)
7617c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "accounting off", (uint32_t)0));
7627c478bd9Sstevel@tonic-gate }
7637c478bd9Sstevel@tonic-gate
7647c478bd9Sstevel@tonic-gate /* chown start function */
7657c478bd9Sstevel@tonic-gate /*ARGSUSED*/
7667c478bd9Sstevel@tonic-gate static void
aus_chown(struct t_audit_data * tad)7677c478bd9Sstevel@tonic-gate aus_chown(struct t_audit_data *tad)
7687c478bd9Sstevel@tonic-gate {
7697c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
7707c478bd9Sstevel@tonic-gate uint32_t uid, gid;
7717c478bd9Sstevel@tonic-gate
7727c478bd9Sstevel@tonic-gate struct a {
7737c478bd9Sstevel@tonic-gate long fname; /* char * */
7747c478bd9Sstevel@tonic-gate long uid;
7757c478bd9Sstevel@tonic-gate long gid;
7767c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
7777c478bd9Sstevel@tonic-gate
7787c478bd9Sstevel@tonic-gate uid = (uint32_t)uap->uid;
7797c478bd9Sstevel@tonic-gate gid = (uint32_t)uap->gid;
7807c478bd9Sstevel@tonic-gate
7817c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(2, "new file uid", uid));
7827c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(3, "new file gid", gid));
7837c478bd9Sstevel@tonic-gate }
7847c478bd9Sstevel@tonic-gate
7857c478bd9Sstevel@tonic-gate /* fchown start function */
7867c478bd9Sstevel@tonic-gate /*ARGSUSED*/
7877c478bd9Sstevel@tonic-gate static void
aus_fchown(struct t_audit_data * tad)7887c478bd9Sstevel@tonic-gate aus_fchown(struct t_audit_data *tad)
7897c478bd9Sstevel@tonic-gate {
7907c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
7917c478bd9Sstevel@tonic-gate uint32_t uid, gid, fd;
7927c478bd9Sstevel@tonic-gate struct file *fp;
7937c478bd9Sstevel@tonic-gate struct vnode *vp;
7947c478bd9Sstevel@tonic-gate struct f_audit_data *fad;
7957c478bd9Sstevel@tonic-gate
7967c478bd9Sstevel@tonic-gate struct a {
7977c478bd9Sstevel@tonic-gate long fd;
7987c478bd9Sstevel@tonic-gate long uid;
7997c478bd9Sstevel@tonic-gate long gid;
8007c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
8017c478bd9Sstevel@tonic-gate
8027c478bd9Sstevel@tonic-gate fd = (uint32_t)uap->fd;
8037c478bd9Sstevel@tonic-gate uid = (uint32_t)uap->uid;
8047c478bd9Sstevel@tonic-gate gid = (uint32_t)uap->gid;
8057c478bd9Sstevel@tonic-gate
8067c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(2, "new file uid", uid));
8077c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(3, "new file gid", gid));
8087c478bd9Sstevel@tonic-gate
8097c478bd9Sstevel@tonic-gate /*
8107c478bd9Sstevel@tonic-gate * convert file pointer to file descriptor
8117c478bd9Sstevel@tonic-gate * Note: fd ref count incremented here.
8127c478bd9Sstevel@tonic-gate */
8137c478bd9Sstevel@tonic-gate if ((fp = getf(fd)) == NULL)
8147c478bd9Sstevel@tonic-gate return;
8157c478bd9Sstevel@tonic-gate
8167c478bd9Sstevel@tonic-gate /* get path from file struct here */
8177c478bd9Sstevel@tonic-gate fad = F2A(fp);
8187c478bd9Sstevel@tonic-gate if (fad->fad_aupath != NULL) {
8197c478bd9Sstevel@tonic-gate au_uwrite(au_to_path(fad->fad_aupath));
8207c478bd9Sstevel@tonic-gate } else {
8217c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "no path: fd", fd));
8227c478bd9Sstevel@tonic-gate }
8237c478bd9Sstevel@tonic-gate
8247c478bd9Sstevel@tonic-gate vp = fp->f_vnode;
8257c478bd9Sstevel@tonic-gate audit_attributes(vp);
8267c478bd9Sstevel@tonic-gate
8277c478bd9Sstevel@tonic-gate /* decrement file descriptor reference count */
8287c478bd9Sstevel@tonic-gate releasef(fd);
8297c478bd9Sstevel@tonic-gate }
8307c478bd9Sstevel@tonic-gate
8317c478bd9Sstevel@tonic-gate /*ARGSUSED*/
8327c478bd9Sstevel@tonic-gate static void
aus_lchown(struct t_audit_data * tad)8337c478bd9Sstevel@tonic-gate aus_lchown(struct t_audit_data *tad)
8347c478bd9Sstevel@tonic-gate {
8357c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
8367c478bd9Sstevel@tonic-gate uint32_t uid, gid;
8377c478bd9Sstevel@tonic-gate
8387c478bd9Sstevel@tonic-gate
8397c478bd9Sstevel@tonic-gate struct a {
8407c478bd9Sstevel@tonic-gate long fname; /* char * */
8417c478bd9Sstevel@tonic-gate long uid;
8427c478bd9Sstevel@tonic-gate long gid;
8437c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
8447c478bd9Sstevel@tonic-gate
8457c478bd9Sstevel@tonic-gate uid = (uint32_t)uap->uid;
8467c478bd9Sstevel@tonic-gate gid = (uint32_t)uap->gid;
8477c478bd9Sstevel@tonic-gate
8487c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(2, "new file uid", uid));
8497c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(3, "new file gid", gid));
8507c478bd9Sstevel@tonic-gate }
8517c478bd9Sstevel@tonic-gate
8528fd04b83SRoger A. Faulkner static au_event_t
aui_fchownat(au_event_t e)8538fd04b83SRoger A. Faulkner aui_fchownat(au_event_t e)
8548fd04b83SRoger A. Faulkner {
8558fd04b83SRoger A. Faulkner klwp_t *clwp = ttolwp(curthread);
8568fd04b83SRoger A. Faulkner
8578fd04b83SRoger A. Faulkner struct a {
8588fd04b83SRoger A. Faulkner long fd;
8598fd04b83SRoger A. Faulkner long fname; /* char * */
8608fd04b83SRoger A. Faulkner long uid;
8618fd04b83SRoger A. Faulkner long gid;
8628fd04b83SRoger A. Faulkner long flags;
8638fd04b83SRoger A. Faulkner } *uap = (struct a *)clwp->lwp_ap;
8648fd04b83SRoger A. Faulkner
8658fd04b83SRoger A. Faulkner if (uap->fname == NULL)
8668fd04b83SRoger A. Faulkner e = AUE_FCHOWN;
8678fd04b83SRoger A. Faulkner else if (uap->flags & AT_SYMLINK_NOFOLLOW)
8688fd04b83SRoger A. Faulkner e = AUE_LCHOWN;
8698fd04b83SRoger A. Faulkner else
8708fd04b83SRoger A. Faulkner e = AUE_CHOWN;
8718fd04b83SRoger A. Faulkner
8728fd04b83SRoger A. Faulkner return (e);
8738fd04b83SRoger A. Faulkner }
8748fd04b83SRoger A. Faulkner
8758fd04b83SRoger A. Faulkner /*ARGSUSED*/
8768fd04b83SRoger A. Faulkner static void
aus_fchownat(struct t_audit_data * tad)8778fd04b83SRoger A. Faulkner aus_fchownat(struct t_audit_data *tad)
8788fd04b83SRoger A. Faulkner {
8798fd04b83SRoger A. Faulkner klwp_t *clwp = ttolwp(curthread);
8808fd04b83SRoger A. Faulkner uint32_t uid, gid;
8818fd04b83SRoger A. Faulkner
8828fd04b83SRoger A. Faulkner struct a {
8838fd04b83SRoger A. Faulkner long fd;
8848fd04b83SRoger A. Faulkner long fname; /* char * */
8858fd04b83SRoger A. Faulkner long uid;
8868fd04b83SRoger A. Faulkner long gid;
8878fd04b83SRoger A. Faulkner long flags;
8888fd04b83SRoger A. Faulkner } *uap = (struct a *)clwp->lwp_ap;
8898fd04b83SRoger A. Faulkner
8908fd04b83SRoger A. Faulkner uid = (uint32_t)uap->uid;
8918fd04b83SRoger A. Faulkner gid = (uint32_t)uap->gid;
8928fd04b83SRoger A. Faulkner
8938fd04b83SRoger A. Faulkner au_uwrite(au_to_arg32(3, "new file uid", uid));
8948fd04b83SRoger A. Faulkner au_uwrite(au_to_arg32(4, "new file gid", gid));
8958fd04b83SRoger A. Faulkner }
8968fd04b83SRoger A. Faulkner
8977c478bd9Sstevel@tonic-gate /*ARGSUSED*/
8987c478bd9Sstevel@tonic-gate static void
aus_chmod(struct t_audit_data * tad)8997c478bd9Sstevel@tonic-gate aus_chmod(struct t_audit_data *tad)
9007c478bd9Sstevel@tonic-gate {
9017c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
9027c478bd9Sstevel@tonic-gate uint32_t fmode;
9037c478bd9Sstevel@tonic-gate
9047c478bd9Sstevel@tonic-gate struct a {
9057c478bd9Sstevel@tonic-gate long fname; /* char * */
9067c478bd9Sstevel@tonic-gate long fmode;
9077c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
9087c478bd9Sstevel@tonic-gate
9097c478bd9Sstevel@tonic-gate fmode = (uint32_t)uap->fmode;
9107c478bd9Sstevel@tonic-gate
9117c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(2, "new file mode", fmode&07777));
9127c478bd9Sstevel@tonic-gate }
9137c478bd9Sstevel@tonic-gate
9147c478bd9Sstevel@tonic-gate /*ARGSUSED*/
9157c478bd9Sstevel@tonic-gate static void
aus_fchmod(struct t_audit_data * tad)9167c478bd9Sstevel@tonic-gate aus_fchmod(struct t_audit_data *tad)
9177c478bd9Sstevel@tonic-gate {
9187c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
9197c478bd9Sstevel@tonic-gate uint32_t fmode, fd;
9207c478bd9Sstevel@tonic-gate struct file *fp;
9217c478bd9Sstevel@tonic-gate struct vnode *vp;
9227c478bd9Sstevel@tonic-gate struct f_audit_data *fad;
9237c478bd9Sstevel@tonic-gate
9247c478bd9Sstevel@tonic-gate struct a {
9257c478bd9Sstevel@tonic-gate long fd;
9267c478bd9Sstevel@tonic-gate long fmode;
9277c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
9287c478bd9Sstevel@tonic-gate
9297c478bd9Sstevel@tonic-gate fd = (uint32_t)uap->fd;
9307c478bd9Sstevel@tonic-gate fmode = (uint32_t)uap->fmode;
9317c478bd9Sstevel@tonic-gate
9327c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(2, "new file mode", fmode&07777));
9337c478bd9Sstevel@tonic-gate
9347c478bd9Sstevel@tonic-gate /*
9357c478bd9Sstevel@tonic-gate * convert file pointer to file descriptor
9367c478bd9Sstevel@tonic-gate * Note: fd ref count incremented here.
9377c478bd9Sstevel@tonic-gate */
9387c478bd9Sstevel@tonic-gate if ((fp = getf(fd)) == NULL)
9397c478bd9Sstevel@tonic-gate return;
9407c478bd9Sstevel@tonic-gate
9417c478bd9Sstevel@tonic-gate /* get path from file struct here */
9427c478bd9Sstevel@tonic-gate fad = F2A(fp);
9437c478bd9Sstevel@tonic-gate if (fad->fad_aupath != NULL) {
9447c478bd9Sstevel@tonic-gate au_uwrite(au_to_path(fad->fad_aupath));
9457c478bd9Sstevel@tonic-gate } else {
9467c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "no path: fd", fd));
9477c478bd9Sstevel@tonic-gate }
9487c478bd9Sstevel@tonic-gate
9497c478bd9Sstevel@tonic-gate vp = fp->f_vnode;
9507c478bd9Sstevel@tonic-gate audit_attributes(vp);
9517c478bd9Sstevel@tonic-gate
9527c478bd9Sstevel@tonic-gate /* decrement file descriptor reference count */
9537c478bd9Sstevel@tonic-gate releasef(fd);
9547c478bd9Sstevel@tonic-gate }
9557c478bd9Sstevel@tonic-gate
956794f0adbSRoger A. Faulkner static au_event_t
aui_fchmodat(au_event_t e)957794f0adbSRoger A. Faulkner aui_fchmodat(au_event_t e)
958794f0adbSRoger A. Faulkner {
959794f0adbSRoger A. Faulkner klwp_t *clwp = ttolwp(curthread);
960794f0adbSRoger A. Faulkner
961794f0adbSRoger A. Faulkner struct a {
962794f0adbSRoger A. Faulkner long fd;
963794f0adbSRoger A. Faulkner long fname; /* char * */
964794f0adbSRoger A. Faulkner long fmode;
965794f0adbSRoger A. Faulkner long flag;
966794f0adbSRoger A. Faulkner } *uap = (struct a *)clwp->lwp_ap;
967794f0adbSRoger A. Faulkner
968794f0adbSRoger A. Faulkner if (uap->fname == NULL)
969794f0adbSRoger A. Faulkner e = AUE_FCHMOD;
970794f0adbSRoger A. Faulkner else
971794f0adbSRoger A. Faulkner e = AUE_CHMOD;
972794f0adbSRoger A. Faulkner
973794f0adbSRoger A. Faulkner return (e);
974794f0adbSRoger A. Faulkner }
975794f0adbSRoger A. Faulkner
976794f0adbSRoger A. Faulkner /*ARGSUSED*/
977794f0adbSRoger A. Faulkner static void
aus_fchmodat(struct t_audit_data * tad)978794f0adbSRoger A. Faulkner aus_fchmodat(struct t_audit_data *tad)
979794f0adbSRoger A. Faulkner {
980794f0adbSRoger A. Faulkner klwp_t *clwp = ttolwp(curthread);
981794f0adbSRoger A. Faulkner uint32_t fmode;
982794f0adbSRoger A. Faulkner uint32_t fd;
983794f0adbSRoger A. Faulkner struct file *fp;
984794f0adbSRoger A. Faulkner struct vnode *vp;
985794f0adbSRoger A. Faulkner struct f_audit_data *fad;
986794f0adbSRoger A. Faulkner
987794f0adbSRoger A. Faulkner struct a {
988794f0adbSRoger A. Faulkner long fd;
989794f0adbSRoger A. Faulkner long fname; /* char * */
990794f0adbSRoger A. Faulkner long fmode;
991794f0adbSRoger A. Faulkner long flag;
992794f0adbSRoger A. Faulkner } *uap = (struct a *)clwp->lwp_ap;
993794f0adbSRoger A. Faulkner
994794f0adbSRoger A. Faulkner fd = (uint32_t)uap->fd;
995794f0adbSRoger A. Faulkner fmode = (uint32_t)uap->fmode;
996794f0adbSRoger A. Faulkner
997794f0adbSRoger A. Faulkner au_uwrite(au_to_arg32(2, "new file mode", fmode&07777));
998794f0adbSRoger A. Faulkner
999794f0adbSRoger A. Faulkner if (fd == AT_FDCWD || uap->fname != NULL) /* same as chmod() */
1000794f0adbSRoger A. Faulkner return;
1001794f0adbSRoger A. Faulkner
1002794f0adbSRoger A. Faulkner /*
1003794f0adbSRoger A. Faulkner * convert file pointer to file descriptor
1004794f0adbSRoger A. Faulkner * Note: fd ref count incremented here.
1005794f0adbSRoger A. Faulkner */
1006794f0adbSRoger A. Faulkner if ((fp = getf(fd)) == NULL)
1007794f0adbSRoger A. Faulkner return;
1008794f0adbSRoger A. Faulkner
1009794f0adbSRoger A. Faulkner /* get path from file struct here */
1010794f0adbSRoger A. Faulkner fad = F2A(fp);
1011794f0adbSRoger A. Faulkner if (fad->fad_aupath != NULL) {
1012794f0adbSRoger A. Faulkner au_uwrite(au_to_path(fad->fad_aupath));
1013794f0adbSRoger A. Faulkner } else {
1014794f0adbSRoger A. Faulkner au_uwrite(au_to_arg32(1, "no path: fd", fd));
1015794f0adbSRoger A. Faulkner }
1016794f0adbSRoger A. Faulkner
1017794f0adbSRoger A. Faulkner vp = fp->f_vnode;
1018794f0adbSRoger A. Faulkner audit_attributes(vp);
1019794f0adbSRoger A. Faulkner
1020794f0adbSRoger A. Faulkner /* decrement file descriptor reference count */
1021794f0adbSRoger A. Faulkner releasef(fd);
1022794f0adbSRoger A. Faulkner }
1023794f0adbSRoger A. Faulkner
10248fd04b83SRoger A. Faulkner /*
10258fd04b83SRoger A. Faulkner * convert open mode to appropriate open event
10268fd04b83SRoger A. Faulkner */
10278fd04b83SRoger A. Faulkner au_event_t
open_event(uint_t fm)10288fd04b83SRoger A. Faulkner open_event(uint_t fm)
10298fd04b83SRoger A. Faulkner {
10308fd04b83SRoger A. Faulkner au_event_t e;
10317c478bd9Sstevel@tonic-gate
1032794f0adbSRoger A. Faulkner switch (fm & (O_ACCMODE | O_CREAT | O_TRUNC)) {
10338fd04b83SRoger A. Faulkner case O_RDONLY:
10348fd04b83SRoger A. Faulkner e = AUE_OPEN_R;
10358fd04b83SRoger A. Faulkner break;
10368fd04b83SRoger A. Faulkner case O_RDONLY | O_CREAT:
10378fd04b83SRoger A. Faulkner e = AUE_OPEN_RC;
10388fd04b83SRoger A. Faulkner break;
10398fd04b83SRoger A. Faulkner case O_RDONLY | O_TRUNC:
10408fd04b83SRoger A. Faulkner e = AUE_OPEN_RT;
10418fd04b83SRoger A. Faulkner break;
10428fd04b83SRoger A. Faulkner case O_RDONLY | O_TRUNC | O_CREAT:
10438fd04b83SRoger A. Faulkner e = AUE_OPEN_RTC;
10448fd04b83SRoger A. Faulkner break;
10458fd04b83SRoger A. Faulkner case O_WRONLY:
10468fd04b83SRoger A. Faulkner e = AUE_OPEN_W;
10478fd04b83SRoger A. Faulkner break;
10488fd04b83SRoger A. Faulkner case O_WRONLY | O_CREAT:
10498fd04b83SRoger A. Faulkner e = AUE_OPEN_WC;
10508fd04b83SRoger A. Faulkner break;
10518fd04b83SRoger A. Faulkner case O_WRONLY | O_TRUNC:
10528fd04b83SRoger A. Faulkner e = AUE_OPEN_WT;
10538fd04b83SRoger A. Faulkner break;
10548fd04b83SRoger A. Faulkner case O_WRONLY | O_TRUNC | O_CREAT:
10558fd04b83SRoger A. Faulkner e = AUE_OPEN_WTC;
10568fd04b83SRoger A. Faulkner break;
10578fd04b83SRoger A. Faulkner case O_RDWR:
10588fd04b83SRoger A. Faulkner e = AUE_OPEN_RW;
10598fd04b83SRoger A. Faulkner break;
10608fd04b83SRoger A. Faulkner case O_RDWR | O_CREAT:
10618fd04b83SRoger A. Faulkner e = AUE_OPEN_RWC;
10628fd04b83SRoger A. Faulkner break;
10638fd04b83SRoger A. Faulkner case O_RDWR | O_TRUNC:
10648fd04b83SRoger A. Faulkner e = AUE_OPEN_RWT;
10658fd04b83SRoger A. Faulkner break;
10668fd04b83SRoger A. Faulkner case O_RDWR | O_TRUNC | O_CREAT:
10678fd04b83SRoger A. Faulkner e = AUE_OPEN_RWTC;
10688fd04b83SRoger A. Faulkner break;
1069794f0adbSRoger A. Faulkner case O_SEARCH:
1070794f0adbSRoger A. Faulkner e = AUE_OPEN_S;
1071794f0adbSRoger A. Faulkner break;
1072794f0adbSRoger A. Faulkner case O_EXEC:
1073794f0adbSRoger A. Faulkner e = AUE_OPEN_E;
1074794f0adbSRoger A. Faulkner break;
10758fd04b83SRoger A. Faulkner default:
10768fd04b83SRoger A. Faulkner e = AUE_NULL;
10778fd04b83SRoger A. Faulkner break;
10788fd04b83SRoger A. Faulkner }
10798fd04b83SRoger A. Faulkner
10808fd04b83SRoger A. Faulkner return (e);
10818fd04b83SRoger A. Faulkner }
10828fd04b83SRoger A. Faulkner
10838fd04b83SRoger A. Faulkner /* ARGSUSED */
10847c478bd9Sstevel@tonic-gate static au_event_t
aui_open(au_event_t e)10857c478bd9Sstevel@tonic-gate aui_open(au_event_t e)
10867c478bd9Sstevel@tonic-gate {
10877c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
10887c478bd9Sstevel@tonic-gate uint_t fm;
10897c478bd9Sstevel@tonic-gate
10907c478bd9Sstevel@tonic-gate struct a {
10917c478bd9Sstevel@tonic-gate long fnamep; /* char * */
10927c478bd9Sstevel@tonic-gate long fmode;
10937c478bd9Sstevel@tonic-gate long cmode;
10947c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
10957c478bd9Sstevel@tonic-gate
10967c478bd9Sstevel@tonic-gate fm = (uint_t)uap->fmode;
10977c478bd9Sstevel@tonic-gate
10988fd04b83SRoger A. Faulkner return (open_event(fm));
10997c478bd9Sstevel@tonic-gate }
11007c478bd9Sstevel@tonic-gate
11017c478bd9Sstevel@tonic-gate static void
aus_open(struct t_audit_data * tad)11027c478bd9Sstevel@tonic-gate aus_open(struct t_audit_data *tad)
11037c478bd9Sstevel@tonic-gate {
11047c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
11057c478bd9Sstevel@tonic-gate uint_t fm;
11067c478bd9Sstevel@tonic-gate
11077c478bd9Sstevel@tonic-gate struct a {
11087c478bd9Sstevel@tonic-gate long fnamep; /* char * */
11097c478bd9Sstevel@tonic-gate long fmode;
11107c478bd9Sstevel@tonic-gate long cmode;
11117c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
11127c478bd9Sstevel@tonic-gate
11137c478bd9Sstevel@tonic-gate fm = (uint_t)uap->fmode;
11147c478bd9Sstevel@tonic-gate
11157c478bd9Sstevel@tonic-gate /* If no write, create, or trunc modes, mark as a public op */
11168fd04b83SRoger A. Faulkner if ((fm & (O_RDONLY|O_WRONLY|O_RDWR|O_CREAT|O_TRUNC)) == O_RDONLY)
11174a0fa546SMarek Pospisil tad->tad_ctrl |= TAD_PUBLIC_EV;
11187c478bd9Sstevel@tonic-gate }
11197c478bd9Sstevel@tonic-gate
11208fd04b83SRoger A. Faulkner /* ARGSUSED */
11217c478bd9Sstevel@tonic-gate static au_event_t
aui_openat(au_event_t e)11228fd04b83SRoger A. Faulkner aui_openat(au_event_t e)
11237c478bd9Sstevel@tonic-gate {
11248fd04b83SRoger A. Faulkner t_audit_data_t *tad = T2A(curthread);
11257c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
11268fd04b83SRoger A. Faulkner uint_t fm;
11278fd04b83SRoger A. Faulkner
11287c478bd9Sstevel@tonic-gate struct a {
11298fd04b83SRoger A. Faulkner long filedes;
11308fd04b83SRoger A. Faulkner long fnamep; /* char * */
11318fd04b83SRoger A. Faulkner long fmode;
11328fd04b83SRoger A. Faulkner long cmode;
11337c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
11347c478bd9Sstevel@tonic-gate
11358fd04b83SRoger A. Faulkner fm = (uint_t)uap->fmode;
11367c478bd9Sstevel@tonic-gate
1137c4d3e299SBrent Paulson /*
1138c4d3e299SBrent Paulson * __openattrdirat() does an extra pathname lookup in order to
1139c4d3e299SBrent Paulson * enter the extended system attribute namespace of the referenced
1140c4d3e299SBrent Paulson * extended attribute filename.
1141c4d3e299SBrent Paulson */
1142c4d3e299SBrent Paulson if (fm & FXATTRDIROPEN)
1143c4d3e299SBrent Paulson tad->tad_ctrl |= TAD_MLD;
11447c478bd9Sstevel@tonic-gate
11458fd04b83SRoger A. Faulkner return (open_event(fm));
11467c478bd9Sstevel@tonic-gate }
11477c478bd9Sstevel@tonic-gate
11488fd04b83SRoger A. Faulkner static void
aus_openat(struct t_audit_data * tad)11498fd04b83SRoger A. Faulkner aus_openat(struct t_audit_data *tad)
11508fd04b83SRoger A. Faulkner {
11518fd04b83SRoger A. Faulkner klwp_t *clwp = ttolwp(curthread);
11528fd04b83SRoger A. Faulkner uint_t fm;
11538fd04b83SRoger A. Faulkner
11548fd04b83SRoger A. Faulkner struct a {
11558fd04b83SRoger A. Faulkner long filedes;
11568fd04b83SRoger A. Faulkner long fnamep; /* char * */
11578fd04b83SRoger A. Faulkner long fmode;
11588fd04b83SRoger A. Faulkner long cmode;
11598fd04b83SRoger A. Faulkner } *uap = (struct a *)clwp->lwp_ap;
11608fd04b83SRoger A. Faulkner
11618fd04b83SRoger A. Faulkner fm = (uint_t)uap->fmode;
11628fd04b83SRoger A. Faulkner
11638fd04b83SRoger A. Faulkner /* If no write, create, or trunc modes, mark as a public op */
11648fd04b83SRoger A. Faulkner if ((fm & (O_RDONLY|O_WRONLY|O_RDWR|O_CREAT|O_TRUNC)) == O_RDONLY)
11654a0fa546SMarek Pospisil tad->tad_ctrl |= TAD_PUBLIC_EV;
11668fd04b83SRoger A. Faulkner }
11678fd04b83SRoger A. Faulkner
11688fd04b83SRoger A. Faulkner static au_event_t
aui_unlinkat(au_event_t e)11698fd04b83SRoger A. Faulkner aui_unlinkat(au_event_t e)
11708fd04b83SRoger A. Faulkner {
11718fd04b83SRoger A. Faulkner klwp_t *clwp = ttolwp(curthread);
11728fd04b83SRoger A. Faulkner
11738fd04b83SRoger A. Faulkner struct a {
11748fd04b83SRoger A. Faulkner long filedes;
11758fd04b83SRoger A. Faulkner long fnamep; /* char * */
11768fd04b83SRoger A. Faulkner long flags;
11778fd04b83SRoger A. Faulkner } *uap = (struct a *)clwp->lwp_ap;
11788fd04b83SRoger A. Faulkner
11798fd04b83SRoger A. Faulkner if (uap->flags & AT_REMOVEDIR)
11808fd04b83SRoger A. Faulkner e = AUE_RMDIR;
11818fd04b83SRoger A. Faulkner else
11828fd04b83SRoger A. Faulkner e = AUE_UNLINK;
11838fd04b83SRoger A. Faulkner
11847c478bd9Sstevel@tonic-gate return (e);
11857c478bd9Sstevel@tonic-gate }
11867c478bd9Sstevel@tonic-gate
11878fd04b83SRoger A. Faulkner static au_event_t
aui_fstatat(au_event_t e)11888fd04b83SRoger A. Faulkner aui_fstatat(au_event_t e)
11897c478bd9Sstevel@tonic-gate {
11907c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
11918fd04b83SRoger A. Faulkner
11927c478bd9Sstevel@tonic-gate struct a {
11938fd04b83SRoger A. Faulkner long filedes;
11948fd04b83SRoger A. Faulkner long fnamep; /* char * */
11958fd04b83SRoger A. Faulkner long statb;
11968fd04b83SRoger A. Faulkner long flags;
11977c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
11987c478bd9Sstevel@tonic-gate
11998fd04b83SRoger A. Faulkner if (uap->fnamep == NULL)
12008fd04b83SRoger A. Faulkner e = AUE_FSTAT;
12018fd04b83SRoger A. Faulkner else if (uap->flags & AT_SYMLINK_NOFOLLOW)
12028fd04b83SRoger A. Faulkner e = AUE_LSTAT;
12038fd04b83SRoger A. Faulkner else
12048fd04b83SRoger A. Faulkner e = AUE_STAT;
12057c478bd9Sstevel@tonic-gate
12068fd04b83SRoger A. Faulkner return (e);
12077c478bd9Sstevel@tonic-gate }
12087c478bd9Sstevel@tonic-gate
12097c478bd9Sstevel@tonic-gate /* msgsys */
12107c478bd9Sstevel@tonic-gate static au_event_t
aui_msgsys(au_event_t e)12117c478bd9Sstevel@tonic-gate aui_msgsys(au_event_t e)
12127c478bd9Sstevel@tonic-gate {
12137c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
12147c478bd9Sstevel@tonic-gate uint_t fm;
12157c478bd9Sstevel@tonic-gate
12167c478bd9Sstevel@tonic-gate struct a {
12177c478bd9Sstevel@tonic-gate long id; /* function code id */
12187c478bd9Sstevel@tonic-gate long ap; /* arg pointer for recvmsg */
12197c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
12207c478bd9Sstevel@tonic-gate
12217c478bd9Sstevel@tonic-gate struct b {
12227c478bd9Sstevel@tonic-gate long msgid;
12237c478bd9Sstevel@tonic-gate long cmd;
12247c478bd9Sstevel@tonic-gate long buf; /* struct msqid_ds * */
12257c478bd9Sstevel@tonic-gate } *uap1 = (struct b *)&clwp->lwp_ap[1];
12267c478bd9Sstevel@tonic-gate
12277c478bd9Sstevel@tonic-gate fm = (uint_t)uap->id;
12287c478bd9Sstevel@tonic-gate
12297c478bd9Sstevel@tonic-gate switch (fm) {
12307c478bd9Sstevel@tonic-gate case 0: /* msgget */
12317c478bd9Sstevel@tonic-gate e = AUE_MSGGET;
12327c478bd9Sstevel@tonic-gate break;
12337c478bd9Sstevel@tonic-gate case 1: /* msgctl */
12347c478bd9Sstevel@tonic-gate switch ((uint_t)uap1->cmd) {
12357c478bd9Sstevel@tonic-gate case IPC_RMID:
12367c478bd9Sstevel@tonic-gate e = AUE_MSGCTL_RMID;
12377c478bd9Sstevel@tonic-gate break;
12387c478bd9Sstevel@tonic-gate case IPC_SET:
12397c478bd9Sstevel@tonic-gate e = AUE_MSGCTL_SET;
12407c478bd9Sstevel@tonic-gate break;
12417c478bd9Sstevel@tonic-gate case IPC_STAT:
12427c478bd9Sstevel@tonic-gate e = AUE_MSGCTL_STAT;
12437c478bd9Sstevel@tonic-gate break;
12447c478bd9Sstevel@tonic-gate default:
12457c478bd9Sstevel@tonic-gate e = AUE_MSGCTL;
12467c478bd9Sstevel@tonic-gate break;
12477c478bd9Sstevel@tonic-gate }
12487c478bd9Sstevel@tonic-gate break;
12497c478bd9Sstevel@tonic-gate case 2: /* msgrcv */
12507c478bd9Sstevel@tonic-gate e = AUE_MSGRCV;
12517c478bd9Sstevel@tonic-gate break;
12527c478bd9Sstevel@tonic-gate case 3: /* msgsnd */
12537c478bd9Sstevel@tonic-gate e = AUE_MSGSND;
12547c478bd9Sstevel@tonic-gate break;
12557c478bd9Sstevel@tonic-gate default: /* illegal system call */
12567c478bd9Sstevel@tonic-gate e = AUE_NULL;
12577c478bd9Sstevel@tonic-gate break;
12587c478bd9Sstevel@tonic-gate }
12597c478bd9Sstevel@tonic-gate
12607c478bd9Sstevel@tonic-gate return (e);
12617c478bd9Sstevel@tonic-gate }
12627c478bd9Sstevel@tonic-gate
12637c478bd9Sstevel@tonic-gate
12647c478bd9Sstevel@tonic-gate /* shmsys */
12657c478bd9Sstevel@tonic-gate static au_event_t
aui_shmsys(au_event_t e)12667c478bd9Sstevel@tonic-gate aui_shmsys(au_event_t e)
12677c478bd9Sstevel@tonic-gate {
12687c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
12697c478bd9Sstevel@tonic-gate int fm;
12707c478bd9Sstevel@tonic-gate
12717c478bd9Sstevel@tonic-gate struct a { /* shmsys */
12727c478bd9Sstevel@tonic-gate long id; /* function code id */
12737c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
12747c478bd9Sstevel@tonic-gate
12757c478bd9Sstevel@tonic-gate struct b { /* ctrl */
12767c478bd9Sstevel@tonic-gate long shmid;
12777c478bd9Sstevel@tonic-gate long cmd;
12787c478bd9Sstevel@tonic-gate long arg; /* struct shmid_ds * */
12797c478bd9Sstevel@tonic-gate } *uap1 = (struct b *)&clwp->lwp_ap[1];
12807c478bd9Sstevel@tonic-gate fm = (uint_t)uap->id;
12817c478bd9Sstevel@tonic-gate
12827c478bd9Sstevel@tonic-gate switch (fm) {
12837c478bd9Sstevel@tonic-gate case 0: /* shmat */
12847c478bd9Sstevel@tonic-gate e = AUE_SHMAT;
12857c478bd9Sstevel@tonic-gate break;
12867c478bd9Sstevel@tonic-gate case 1: /* shmctl */
12877c478bd9Sstevel@tonic-gate switch ((uint_t)uap1->cmd) {
12887c478bd9Sstevel@tonic-gate case IPC_RMID:
12897c478bd9Sstevel@tonic-gate e = AUE_SHMCTL_RMID;
12907c478bd9Sstevel@tonic-gate break;
12917c478bd9Sstevel@tonic-gate case IPC_SET:
12927c478bd9Sstevel@tonic-gate e = AUE_SHMCTL_SET;
12937c478bd9Sstevel@tonic-gate break;
12947c478bd9Sstevel@tonic-gate case IPC_STAT:
12957c478bd9Sstevel@tonic-gate e = AUE_SHMCTL_STAT;
12967c478bd9Sstevel@tonic-gate break;
12977c478bd9Sstevel@tonic-gate default:
12987c478bd9Sstevel@tonic-gate e = AUE_SHMCTL;
12997c478bd9Sstevel@tonic-gate break;
13007c478bd9Sstevel@tonic-gate }
13017c478bd9Sstevel@tonic-gate break;
13027c478bd9Sstevel@tonic-gate case 2: /* shmdt */
13037c478bd9Sstevel@tonic-gate e = AUE_SHMDT;
13047c478bd9Sstevel@tonic-gate break;
13057c478bd9Sstevel@tonic-gate case 3: /* shmget */
13067c478bd9Sstevel@tonic-gate e = AUE_SHMGET;
13077c478bd9Sstevel@tonic-gate break;
13087c478bd9Sstevel@tonic-gate default: /* illegal system call */
13097c478bd9Sstevel@tonic-gate e = AUE_NULL;
13107c478bd9Sstevel@tonic-gate break;
13117c478bd9Sstevel@tonic-gate }
13127c478bd9Sstevel@tonic-gate
13137c478bd9Sstevel@tonic-gate return (e);
13147c478bd9Sstevel@tonic-gate }
13157c478bd9Sstevel@tonic-gate
13167c478bd9Sstevel@tonic-gate
13177c478bd9Sstevel@tonic-gate /* semsys */
13187c478bd9Sstevel@tonic-gate static au_event_t
aui_semsys(au_event_t e)13197c478bd9Sstevel@tonic-gate aui_semsys(au_event_t e)
13207c478bd9Sstevel@tonic-gate {
13217c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
13227c478bd9Sstevel@tonic-gate uint_t fm;
13237c478bd9Sstevel@tonic-gate
13247c478bd9Sstevel@tonic-gate struct a { /* semsys */
13257c478bd9Sstevel@tonic-gate long id;
13267c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
13277c478bd9Sstevel@tonic-gate
13287c478bd9Sstevel@tonic-gate struct b { /* ctrl */
13297c478bd9Sstevel@tonic-gate long semid;
13307c478bd9Sstevel@tonic-gate long semnum;
13317c478bd9Sstevel@tonic-gate long cmd;
13327c478bd9Sstevel@tonic-gate long arg;
13337c478bd9Sstevel@tonic-gate } *uap1 = (struct b *)&clwp->lwp_ap[1];
13347c478bd9Sstevel@tonic-gate
13357c478bd9Sstevel@tonic-gate fm = (uint_t)uap->id;
13367c478bd9Sstevel@tonic-gate
13377c478bd9Sstevel@tonic-gate switch (fm) {
13387c478bd9Sstevel@tonic-gate case 0: /* semctl */
13397c478bd9Sstevel@tonic-gate switch ((uint_t)uap1->cmd) {
13407c478bd9Sstevel@tonic-gate case IPC_RMID:
13417c478bd9Sstevel@tonic-gate e = AUE_SEMCTL_RMID;
13427c478bd9Sstevel@tonic-gate break;
13437c478bd9Sstevel@tonic-gate case IPC_SET:
13447c478bd9Sstevel@tonic-gate e = AUE_SEMCTL_SET;
13457c478bd9Sstevel@tonic-gate break;
13467c478bd9Sstevel@tonic-gate case IPC_STAT:
13477c478bd9Sstevel@tonic-gate e = AUE_SEMCTL_STAT;
13487c478bd9Sstevel@tonic-gate break;
13497c478bd9Sstevel@tonic-gate case GETNCNT:
13507c478bd9Sstevel@tonic-gate e = AUE_SEMCTL_GETNCNT;
13517c478bd9Sstevel@tonic-gate break;
13527c478bd9Sstevel@tonic-gate case GETPID:
13537c478bd9Sstevel@tonic-gate e = AUE_SEMCTL_GETPID;
13547c478bd9Sstevel@tonic-gate break;
13557c478bd9Sstevel@tonic-gate case GETVAL:
13567c478bd9Sstevel@tonic-gate e = AUE_SEMCTL_GETVAL;
13577c478bd9Sstevel@tonic-gate break;
13587c478bd9Sstevel@tonic-gate case GETALL:
13597c478bd9Sstevel@tonic-gate e = AUE_SEMCTL_GETALL;
13607c478bd9Sstevel@tonic-gate break;
13617c478bd9Sstevel@tonic-gate case GETZCNT:
13627c478bd9Sstevel@tonic-gate e = AUE_SEMCTL_GETZCNT;
13637c478bd9Sstevel@tonic-gate break;
13647c478bd9Sstevel@tonic-gate case SETVAL:
13657c478bd9Sstevel@tonic-gate e = AUE_SEMCTL_SETVAL;
13667c478bd9Sstevel@tonic-gate break;
13677c478bd9Sstevel@tonic-gate case SETALL:
13687c478bd9Sstevel@tonic-gate e = AUE_SEMCTL_SETALL;
13697c478bd9Sstevel@tonic-gate break;
13707c478bd9Sstevel@tonic-gate default:
13717c478bd9Sstevel@tonic-gate e = AUE_SEMCTL;
13727c478bd9Sstevel@tonic-gate break;
13737c478bd9Sstevel@tonic-gate }
13747c478bd9Sstevel@tonic-gate break;
13757c478bd9Sstevel@tonic-gate case 1: /* semget */
13767c478bd9Sstevel@tonic-gate e = AUE_SEMGET;
13777c478bd9Sstevel@tonic-gate break;
13787c478bd9Sstevel@tonic-gate case 2: /* semop */
13797c478bd9Sstevel@tonic-gate e = AUE_SEMOP;
13807c478bd9Sstevel@tonic-gate break;
13817c478bd9Sstevel@tonic-gate default: /* illegal system call */
13827c478bd9Sstevel@tonic-gate e = AUE_NULL;
13837c478bd9Sstevel@tonic-gate break;
13847c478bd9Sstevel@tonic-gate }
13857c478bd9Sstevel@tonic-gate
13867c478bd9Sstevel@tonic-gate return (e);
13877c478bd9Sstevel@tonic-gate }
13887c478bd9Sstevel@tonic-gate
13897c478bd9Sstevel@tonic-gate /* utssys - uname(2), ustat(2), fusers(2) */
13907c478bd9Sstevel@tonic-gate static au_event_t
aui_utssys(au_event_t e)13917c478bd9Sstevel@tonic-gate aui_utssys(au_event_t e)
13927c478bd9Sstevel@tonic-gate {
13937c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
13947c478bd9Sstevel@tonic-gate uint_t type;
13957c478bd9Sstevel@tonic-gate
13967c478bd9Sstevel@tonic-gate struct a {
13977c478bd9Sstevel@tonic-gate union {
13987c478bd9Sstevel@tonic-gate long cbuf; /* char * */
13997c478bd9Sstevel@tonic-gate long ubuf; /* struct stat * */
14007c478bd9Sstevel@tonic-gate } ub;
14017c478bd9Sstevel@tonic-gate union {
14027c478bd9Sstevel@tonic-gate long mv; /* for USTAT */
14037c478bd9Sstevel@tonic-gate long flags; /* for FUSERS */
14047c478bd9Sstevel@tonic-gate } un;
14057c478bd9Sstevel@tonic-gate long type;
14067c478bd9Sstevel@tonic-gate long outbp; /* char * for FUSERS */
14077c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
14087c478bd9Sstevel@tonic-gate
14097c478bd9Sstevel@tonic-gate type = (uint_t)uap->type;
14107c478bd9Sstevel@tonic-gate
14117c478bd9Sstevel@tonic-gate if (type == UTS_FUSERS)
14127c478bd9Sstevel@tonic-gate return (e);
14137c478bd9Sstevel@tonic-gate else
14147c478bd9Sstevel@tonic-gate return ((au_event_t)AUE_NULL);
14157c478bd9Sstevel@tonic-gate }
14167c478bd9Sstevel@tonic-gate
14177c478bd9Sstevel@tonic-gate static au_event_t
aui_fcntl(au_event_t e)14187c478bd9Sstevel@tonic-gate aui_fcntl(au_event_t e)
14197c478bd9Sstevel@tonic-gate {
14207c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
14217c478bd9Sstevel@tonic-gate uint_t cmd;
14227c478bd9Sstevel@tonic-gate
14237c478bd9Sstevel@tonic-gate struct a {
14247c478bd9Sstevel@tonic-gate long fdes;
14257c478bd9Sstevel@tonic-gate long cmd;
14267c478bd9Sstevel@tonic-gate long arg;
14277c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
14287c478bd9Sstevel@tonic-gate
14297c478bd9Sstevel@tonic-gate cmd = (uint_t)uap->cmd;
14307c478bd9Sstevel@tonic-gate
14317c478bd9Sstevel@tonic-gate switch (cmd) {
14327c478bd9Sstevel@tonic-gate case F_GETLK:
14337c478bd9Sstevel@tonic-gate case F_SETLK:
14347c478bd9Sstevel@tonic-gate case F_SETLKW:
14357c478bd9Sstevel@tonic-gate break;
14367c478bd9Sstevel@tonic-gate case F_SETFL:
14377c478bd9Sstevel@tonic-gate case F_GETFL:
14387c478bd9Sstevel@tonic-gate case F_GETFD:
14397c478bd9Sstevel@tonic-gate break;
14407c478bd9Sstevel@tonic-gate default:
14417c478bd9Sstevel@tonic-gate e = (au_event_t)AUE_NULL;
14427c478bd9Sstevel@tonic-gate break;
14437c478bd9Sstevel@tonic-gate }
14447c478bd9Sstevel@tonic-gate return ((au_event_t)e);
14457c478bd9Sstevel@tonic-gate }
14467c478bd9Sstevel@tonic-gate
14477c478bd9Sstevel@tonic-gate /* null function for now */
14487c478bd9Sstevel@tonic-gate static au_event_t
aui_execve(au_event_t e)14497c478bd9Sstevel@tonic-gate aui_execve(au_event_t e)
14507c478bd9Sstevel@tonic-gate {
14517c478bd9Sstevel@tonic-gate return (e);
14527c478bd9Sstevel@tonic-gate }
14537c478bd9Sstevel@tonic-gate
14547c478bd9Sstevel@tonic-gate /*ARGSUSED*/
14557c478bd9Sstevel@tonic-gate static void
aus_fcntl(struct t_audit_data * tad)14567c478bd9Sstevel@tonic-gate aus_fcntl(struct t_audit_data *tad)
14577c478bd9Sstevel@tonic-gate {
14587c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
145951b433b7SMarek Pospisil uint32_t cmd, fd, flags;
14607c478bd9Sstevel@tonic-gate struct file *fp;
14617c478bd9Sstevel@tonic-gate struct vnode *vp;
14627c478bd9Sstevel@tonic-gate struct f_audit_data *fad;
14637c478bd9Sstevel@tonic-gate
14647c478bd9Sstevel@tonic-gate struct a {
14657c478bd9Sstevel@tonic-gate long fd;
14667c478bd9Sstevel@tonic-gate long cmd;
14677c478bd9Sstevel@tonic-gate long arg;
14687c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
14697c478bd9Sstevel@tonic-gate
14707c478bd9Sstevel@tonic-gate cmd = (uint32_t)uap->cmd;
14717c478bd9Sstevel@tonic-gate fd = (uint32_t)uap->fd;
147251b433b7SMarek Pospisil flags = (uint32_t)uap->arg;
14737c478bd9Sstevel@tonic-gate
14747c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(2, "cmd", cmd));
14757c478bd9Sstevel@tonic-gate
147651b433b7SMarek Pospisil if (cmd == F_SETFL)
147751b433b7SMarek Pospisil au_uwrite(au_to_arg32(3, "flags", flags));
147851b433b7SMarek Pospisil
14797c478bd9Sstevel@tonic-gate /*
14807c478bd9Sstevel@tonic-gate * convert file pointer to file descriptor
14817c478bd9Sstevel@tonic-gate * Note: fd ref count incremented here.
14827c478bd9Sstevel@tonic-gate */
14837c478bd9Sstevel@tonic-gate if ((fp = getf(fd)) == NULL)
14847c478bd9Sstevel@tonic-gate return;
14857c478bd9Sstevel@tonic-gate
14867c478bd9Sstevel@tonic-gate /* get path from file struct here */
14877c478bd9Sstevel@tonic-gate fad = F2A(fp);
14887c478bd9Sstevel@tonic-gate if (fad->fad_aupath != NULL) {
14897c478bd9Sstevel@tonic-gate au_uwrite(au_to_path(fad->fad_aupath));
14907c478bd9Sstevel@tonic-gate } else {
14917c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "no path: fd", fd));
14927c478bd9Sstevel@tonic-gate }
14937c478bd9Sstevel@tonic-gate
14947c478bd9Sstevel@tonic-gate vp = fp->f_vnode;
14957c478bd9Sstevel@tonic-gate audit_attributes(vp);
14967c478bd9Sstevel@tonic-gate
14977c478bd9Sstevel@tonic-gate /* decrement file descriptor reference count */
14987c478bd9Sstevel@tonic-gate releasef(fd);
14997c478bd9Sstevel@tonic-gate }
15007c478bd9Sstevel@tonic-gate
15017c478bd9Sstevel@tonic-gate /*ARGSUSED*/
15027c478bd9Sstevel@tonic-gate static void
aus_kill(struct t_audit_data * tad)15037c478bd9Sstevel@tonic-gate aus_kill(struct t_audit_data *tad)
15047c478bd9Sstevel@tonic-gate {
15057c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
15067c478bd9Sstevel@tonic-gate struct proc *p;
15077c478bd9Sstevel@tonic-gate uint32_t signo;
15087c478bd9Sstevel@tonic-gate uid_t uid, ruid;
15097c478bd9Sstevel@tonic-gate gid_t gid, rgid;
15107c478bd9Sstevel@tonic-gate pid_t pid;
15117c478bd9Sstevel@tonic-gate const auditinfo_addr_t *ainfo;
15127c478bd9Sstevel@tonic-gate cred_t *cr;
15137c478bd9Sstevel@tonic-gate
15147c478bd9Sstevel@tonic-gate struct a {
15157c478bd9Sstevel@tonic-gate long pid;
15167c478bd9Sstevel@tonic-gate long signo;
15177c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
15187c478bd9Sstevel@tonic-gate
15197c478bd9Sstevel@tonic-gate pid = (pid_t)uap->pid;
15207c478bd9Sstevel@tonic-gate signo = (uint32_t)uap->signo;
15217c478bd9Sstevel@tonic-gate
15227c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(2, "signal", signo));
15237c478bd9Sstevel@tonic-gate if (pid > 0) {
15247c478bd9Sstevel@tonic-gate mutex_enter(&pidlock);
15257c478bd9Sstevel@tonic-gate if (((p = prfind(pid)) == (struct proc *)0) ||
15267c478bd9Sstevel@tonic-gate (p->p_stat == SIDL)) {
15277c478bd9Sstevel@tonic-gate mutex_exit(&pidlock);
15287c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "process", (uint32_t)pid));
15297c478bd9Sstevel@tonic-gate return;
15307c478bd9Sstevel@tonic-gate }
15317c478bd9Sstevel@tonic-gate mutex_enter(&p->p_lock); /* so process doesn't go away */
15327c478bd9Sstevel@tonic-gate mutex_exit(&pidlock);
15337c478bd9Sstevel@tonic-gate
15347c478bd9Sstevel@tonic-gate mutex_enter(&p->p_crlock);
15357c478bd9Sstevel@tonic-gate crhold(cr = p->p_cred);
15367c478bd9Sstevel@tonic-gate mutex_exit(&p->p_crlock);
15377c478bd9Sstevel@tonic-gate mutex_exit(&p->p_lock);
15387c478bd9Sstevel@tonic-gate
15397c478bd9Sstevel@tonic-gate ainfo = crgetauinfo(cr);
15407c478bd9Sstevel@tonic-gate if (ainfo == NULL) {
15417c478bd9Sstevel@tonic-gate crfree(cr);
15427c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "process", (uint32_t)pid));
15437c478bd9Sstevel@tonic-gate return;
15447c478bd9Sstevel@tonic-gate }
15457c478bd9Sstevel@tonic-gate
15467c478bd9Sstevel@tonic-gate uid = crgetuid(cr);
15477c478bd9Sstevel@tonic-gate gid = crgetgid(cr);
15487c478bd9Sstevel@tonic-gate ruid = crgetruid(cr);
15497c478bd9Sstevel@tonic-gate rgid = crgetrgid(cr);
15507c478bd9Sstevel@tonic-gate au_uwrite(au_to_process(uid, gid, ruid, rgid, pid,
15517c478bd9Sstevel@tonic-gate ainfo->ai_auid, ainfo->ai_asid, &ainfo->ai_termid));
155245916cd2Sjpk
155345916cd2Sjpk if (is_system_labeled())
155445916cd2Sjpk au_uwrite(au_to_label(CR_SL(cr)));
155545916cd2Sjpk
15567c478bd9Sstevel@tonic-gate crfree(cr);
15577c478bd9Sstevel@tonic-gate }
15587c478bd9Sstevel@tonic-gate else
15597c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "process", (uint32_t)pid));
15607c478bd9Sstevel@tonic-gate }
15617c478bd9Sstevel@tonic-gate
15627c478bd9Sstevel@tonic-gate /*ARGSUSED*/
15637c478bd9Sstevel@tonic-gate static void
aus_mkdir(struct t_audit_data * tad)15647c478bd9Sstevel@tonic-gate aus_mkdir(struct t_audit_data *tad)
15657c478bd9Sstevel@tonic-gate {
15667c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
15677c478bd9Sstevel@tonic-gate uint32_t dmode;
15687c478bd9Sstevel@tonic-gate
15697c478bd9Sstevel@tonic-gate struct a {
15707c478bd9Sstevel@tonic-gate long dirnamep; /* char * */
15717c478bd9Sstevel@tonic-gate long dmode;
15727c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
15737c478bd9Sstevel@tonic-gate
15747c478bd9Sstevel@tonic-gate dmode = (uint32_t)uap->dmode;
15757c478bd9Sstevel@tonic-gate
15767c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(2, "mode", dmode));
15777c478bd9Sstevel@tonic-gate }
15787c478bd9Sstevel@tonic-gate
15797c478bd9Sstevel@tonic-gate /*ARGSUSED*/
15807c478bd9Sstevel@tonic-gate static void
aus_mkdirat(struct t_audit_data * tad)1581794f0adbSRoger A. Faulkner aus_mkdirat(struct t_audit_data *tad)
1582794f0adbSRoger A. Faulkner {
1583794f0adbSRoger A. Faulkner klwp_t *clwp = ttolwp(curthread);
1584794f0adbSRoger A. Faulkner uint32_t dmode;
1585794f0adbSRoger A. Faulkner
1586794f0adbSRoger A. Faulkner struct a {
1587794f0adbSRoger A. Faulkner long fd;
1588794f0adbSRoger A. Faulkner long dirnamep; /* char * */
1589794f0adbSRoger A. Faulkner long dmode;
1590794f0adbSRoger A. Faulkner } *uap = (struct a *)clwp->lwp_ap;
1591794f0adbSRoger A. Faulkner
1592794f0adbSRoger A. Faulkner dmode = (uint32_t)uap->dmode;
1593794f0adbSRoger A. Faulkner
1594794f0adbSRoger A. Faulkner au_uwrite(au_to_arg32(2, "mode", dmode));
1595794f0adbSRoger A. Faulkner }
1596794f0adbSRoger A. Faulkner
1597794f0adbSRoger A. Faulkner /*ARGSUSED*/
1598794f0adbSRoger A. Faulkner static void
aus_mknod(struct t_audit_data * tad)15997c478bd9Sstevel@tonic-gate aus_mknod(struct t_audit_data *tad)
16007c478bd9Sstevel@tonic-gate {
16017c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
16027c478bd9Sstevel@tonic-gate uint32_t fmode;
16037c478bd9Sstevel@tonic-gate dev_t dev;
16047c478bd9Sstevel@tonic-gate
16057c478bd9Sstevel@tonic-gate struct a {
16067c478bd9Sstevel@tonic-gate long pnamep; /* char * */
16077c478bd9Sstevel@tonic-gate long fmode;
16087c478bd9Sstevel@tonic-gate long dev;
16097c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
16107c478bd9Sstevel@tonic-gate
16117c478bd9Sstevel@tonic-gate fmode = (uint32_t)uap->fmode;
16127c478bd9Sstevel@tonic-gate dev = (dev_t)uap->dev;
16137c478bd9Sstevel@tonic-gate
16147c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(2, "mode", fmode));
16157c478bd9Sstevel@tonic-gate #ifdef _LP64
16167c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg64(3, "dev", dev));
16177c478bd9Sstevel@tonic-gate #else
16187c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(3, "dev", dev));
16197c478bd9Sstevel@tonic-gate #endif
16207c478bd9Sstevel@tonic-gate }
16217c478bd9Sstevel@tonic-gate
16227c478bd9Sstevel@tonic-gate /*ARGSUSED*/
16237c478bd9Sstevel@tonic-gate static void
auf_mknod(struct t_audit_data * tad,int error,rval_t * rval)16247c478bd9Sstevel@tonic-gate auf_mknod(struct t_audit_data *tad, int error, rval_t *rval)
16257c478bd9Sstevel@tonic-gate {
16267c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
16277c478bd9Sstevel@tonic-gate vnode_t *dvp;
16287c478bd9Sstevel@tonic-gate caddr_t pnamep;
16297c478bd9Sstevel@tonic-gate
16307c478bd9Sstevel@tonic-gate struct a {
16317c478bd9Sstevel@tonic-gate long pnamep; /* char * */
16327c478bd9Sstevel@tonic-gate long fmode;
16337c478bd9Sstevel@tonic-gate long dev;
16347c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
16357c478bd9Sstevel@tonic-gate
16367c478bd9Sstevel@tonic-gate /* no error, then already path token in audit record */
1637794f0adbSRoger A. Faulkner if (error != EPERM && error != EINVAL)
16387c478bd9Sstevel@tonic-gate return;
16397c478bd9Sstevel@tonic-gate
16407c478bd9Sstevel@tonic-gate /* do the lookup to force generation of path token */
16417c478bd9Sstevel@tonic-gate pnamep = (caddr_t)uap->pnamep;
16424a0fa546SMarek Pospisil tad->tad_ctrl |= TAD_NOATTRB;
16437c478bd9Sstevel@tonic-gate error = lookupname(pnamep, UIO_USERSPACE, NO_FOLLOW, &dvp, NULLVPP);
16447c478bd9Sstevel@tonic-gate if (error == 0)
16457c478bd9Sstevel@tonic-gate VN_RELE(dvp);
16467c478bd9Sstevel@tonic-gate }
16477c478bd9Sstevel@tonic-gate
16487c478bd9Sstevel@tonic-gate /*ARGSUSED*/
16497c478bd9Sstevel@tonic-gate static void
aus_mknodat(struct t_audit_data * tad)1650794f0adbSRoger A. Faulkner aus_mknodat(struct t_audit_data *tad)
1651794f0adbSRoger A. Faulkner {
1652794f0adbSRoger A. Faulkner klwp_t *clwp = ttolwp(curthread);
1653794f0adbSRoger A. Faulkner uint32_t fmode;
1654794f0adbSRoger A. Faulkner dev_t dev;
1655794f0adbSRoger A. Faulkner
1656794f0adbSRoger A. Faulkner struct a {
1657794f0adbSRoger A. Faulkner long fd;
1658794f0adbSRoger A. Faulkner long pnamep; /* char * */
1659794f0adbSRoger A. Faulkner long fmode;
1660794f0adbSRoger A. Faulkner long dev;
1661794f0adbSRoger A. Faulkner } *uap = (struct a *)clwp->lwp_ap;
1662794f0adbSRoger A. Faulkner
1663794f0adbSRoger A. Faulkner fmode = (uint32_t)uap->fmode;
1664794f0adbSRoger A. Faulkner dev = (dev_t)uap->dev;
1665794f0adbSRoger A. Faulkner
1666794f0adbSRoger A. Faulkner au_uwrite(au_to_arg32(2, "mode", fmode));
1667794f0adbSRoger A. Faulkner #ifdef _LP64
1668794f0adbSRoger A. Faulkner au_uwrite(au_to_arg64(3, "dev", dev));
1669794f0adbSRoger A. Faulkner #else
1670794f0adbSRoger A. Faulkner au_uwrite(au_to_arg32(3, "dev", dev));
1671794f0adbSRoger A. Faulkner #endif
1672794f0adbSRoger A. Faulkner }
1673794f0adbSRoger A. Faulkner
1674794f0adbSRoger A. Faulkner /*ARGSUSED*/
1675794f0adbSRoger A. Faulkner static void
auf_mknodat(struct t_audit_data * tad,int error,rval_t * rval)1676794f0adbSRoger A. Faulkner auf_mknodat(struct t_audit_data *tad, int error, rval_t *rval)
1677794f0adbSRoger A. Faulkner {
1678794f0adbSRoger A. Faulkner klwp_t *clwp = ttolwp(curthread);
1679794f0adbSRoger A. Faulkner vnode_t *startvp;
1680794f0adbSRoger A. Faulkner vnode_t *dvp;
1681794f0adbSRoger A. Faulkner caddr_t pnamep;
1682794f0adbSRoger A. Faulkner int fd;
1683794f0adbSRoger A. Faulkner
1684794f0adbSRoger A. Faulkner struct a {
1685794f0adbSRoger A. Faulkner long fd;
1686794f0adbSRoger A. Faulkner long pnamep; /* char * */
1687794f0adbSRoger A. Faulkner long fmode;
1688794f0adbSRoger A. Faulkner long dev;
1689794f0adbSRoger A. Faulkner } *uap = (struct a *)clwp->lwp_ap;
1690794f0adbSRoger A. Faulkner
1691794f0adbSRoger A. Faulkner /* no error, then already path token in audit record */
1692794f0adbSRoger A. Faulkner if (error != EPERM && error != EINVAL)
1693794f0adbSRoger A. Faulkner return;
1694794f0adbSRoger A. Faulkner
1695794f0adbSRoger A. Faulkner /* do the lookup to force generation of path token */
1696794f0adbSRoger A. Faulkner fd = (int)uap->fd;
1697794f0adbSRoger A. Faulkner pnamep = (caddr_t)uap->pnamep;
1698794f0adbSRoger A. Faulkner if (pnamep == NULL ||
1699794f0adbSRoger A. Faulkner fgetstartvp(fd, pnamep, &startvp) != 0)
1700794f0adbSRoger A. Faulkner return;
1701794f0adbSRoger A. Faulkner tad->tad_ctrl |= TAD_NOATTRB;
1702794f0adbSRoger A. Faulkner error = lookupnameat(pnamep, UIO_USERSPACE, NO_FOLLOW, &dvp, NULLVPP,
1703794f0adbSRoger A. Faulkner startvp);
1704794f0adbSRoger A. Faulkner if (error == 0)
1705794f0adbSRoger A. Faulkner VN_RELE(dvp);
1706794f0adbSRoger A. Faulkner if (startvp != NULL)
1707794f0adbSRoger A. Faulkner VN_RELE(startvp);
1708794f0adbSRoger A. Faulkner }
1709794f0adbSRoger A. Faulkner
1710794f0adbSRoger A. Faulkner /*ARGSUSED*/
1711794f0adbSRoger A. Faulkner static void
aus_mount(struct t_audit_data * tad)17127c478bd9Sstevel@tonic-gate aus_mount(struct t_audit_data *tad)
17137c478bd9Sstevel@tonic-gate { /* AUS_START */
17147c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
17157c478bd9Sstevel@tonic-gate uint32_t flags;
17167c478bd9Sstevel@tonic-gate uintptr_t u_fstype, dataptr;
17177c478bd9Sstevel@tonic-gate STRUCT_DECL(nfs_args, nfsargs);
17187c478bd9Sstevel@tonic-gate size_t len;
17197c478bd9Sstevel@tonic-gate char *fstype, *hostname;
17207c478bd9Sstevel@tonic-gate
17217c478bd9Sstevel@tonic-gate struct a {
17227c478bd9Sstevel@tonic-gate long spec; /* char * */
17237c478bd9Sstevel@tonic-gate long dir; /* char * */
17247c478bd9Sstevel@tonic-gate long flags;
17257c478bd9Sstevel@tonic-gate long fstype; /* char * */
17267c478bd9Sstevel@tonic-gate long dataptr; /* char * */
17277c478bd9Sstevel@tonic-gate long datalen;
17287c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
17297c478bd9Sstevel@tonic-gate
17307c478bd9Sstevel@tonic-gate u_fstype = (uintptr_t)uap->fstype;
17317c478bd9Sstevel@tonic-gate flags = (uint32_t)uap->flags;
17327c478bd9Sstevel@tonic-gate dataptr = (uintptr_t)uap->dataptr;
17337c478bd9Sstevel@tonic-gate
17347c478bd9Sstevel@tonic-gate fstype = kmem_alloc(MAXNAMELEN, KM_SLEEP);
17357c478bd9Sstevel@tonic-gate if (copyinstr((caddr_t)u_fstype, (caddr_t)fstype, MAXNAMELEN, &len))
17367c478bd9Sstevel@tonic-gate goto mount_free_fstype;
17377c478bd9Sstevel@tonic-gate
17387c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(3, "flags", flags));
17397c478bd9Sstevel@tonic-gate au_uwrite(au_to_text(fstype));
17407c478bd9Sstevel@tonic-gate
17417c478bd9Sstevel@tonic-gate if (strncmp(fstype, "nfs", 3) == 0) {
17427c478bd9Sstevel@tonic-gate
17437c478bd9Sstevel@tonic-gate STRUCT_INIT(nfsargs, get_udatamodel());
17447c478bd9Sstevel@tonic-gate bzero(STRUCT_BUF(nfsargs), STRUCT_SIZE(nfsargs));
17457c478bd9Sstevel@tonic-gate
17467c478bd9Sstevel@tonic-gate if (copyin((caddr_t)dataptr,
17477c478bd9Sstevel@tonic-gate STRUCT_BUF(nfsargs),
17487c478bd9Sstevel@tonic-gate MIN(uap->datalen, STRUCT_SIZE(nfsargs)))) {
17497c478bd9Sstevel@tonic-gate /* DEBUG debug_enter((char *)NULL); */
17507c478bd9Sstevel@tonic-gate goto mount_free_fstype;
17517c478bd9Sstevel@tonic-gate }
17527c478bd9Sstevel@tonic-gate hostname = kmem_alloc(MAXNAMELEN, KM_SLEEP);
17537c478bd9Sstevel@tonic-gate if (copyinstr(STRUCT_FGETP(nfsargs, hostname),
17547c478bd9Sstevel@tonic-gate (caddr_t)hostname,
17557c478bd9Sstevel@tonic-gate MAXNAMELEN, &len)) {
17567c478bd9Sstevel@tonic-gate goto mount_free_hostname;
17577c478bd9Sstevel@tonic-gate }
17587c478bd9Sstevel@tonic-gate au_uwrite(au_to_text(hostname));
17597c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(3, "internal flags",
17607c478bd9Sstevel@tonic-gate (uint_t)STRUCT_FGET(nfsargs, flags)));
17617c478bd9Sstevel@tonic-gate
17627c478bd9Sstevel@tonic-gate mount_free_hostname:
17637c478bd9Sstevel@tonic-gate kmem_free(hostname, MAXNAMELEN);
17647c478bd9Sstevel@tonic-gate }
17657c478bd9Sstevel@tonic-gate
17667c478bd9Sstevel@tonic-gate mount_free_fstype:
17677c478bd9Sstevel@tonic-gate kmem_free(fstype, MAXNAMELEN);
17687c478bd9Sstevel@tonic-gate } /* AUS_MOUNT */
17697c478bd9Sstevel@tonic-gate
17707c478bd9Sstevel@tonic-gate static void
aus_umount_path(caddr_t umount_dir)17717c478bd9Sstevel@tonic-gate aus_umount_path(caddr_t umount_dir)
17727c478bd9Sstevel@tonic-gate {
17737c478bd9Sstevel@tonic-gate char *dir_path;
17747c478bd9Sstevel@tonic-gate struct audit_path *path;
17757c478bd9Sstevel@tonic-gate size_t path_len, dir_len;
17767c478bd9Sstevel@tonic-gate
17777c478bd9Sstevel@tonic-gate /* length alloc'd for two string pointers */
17787c478bd9Sstevel@tonic-gate path_len = sizeof (struct audit_path) + sizeof (char *);
17797c478bd9Sstevel@tonic-gate path = kmem_alloc(path_len, KM_SLEEP);
17807c478bd9Sstevel@tonic-gate dir_path = kmem_alloc(MAXPATHLEN, KM_SLEEP);
17817c478bd9Sstevel@tonic-gate
17827c478bd9Sstevel@tonic-gate if (copyinstr(umount_dir, (caddr_t)dir_path,
17837c478bd9Sstevel@tonic-gate MAXPATHLEN, &dir_len))
17847c478bd9Sstevel@tonic-gate goto umount2_free_dir;
17857c478bd9Sstevel@tonic-gate
17867c478bd9Sstevel@tonic-gate /*
17877c478bd9Sstevel@tonic-gate * the audit_path struct assumes that the buffer pointed to
17887c478bd9Sstevel@tonic-gate * by audp_sect[n] contains string 0 immediatedly followed
17897c478bd9Sstevel@tonic-gate * by string 1.
17907c478bd9Sstevel@tonic-gate */
17917c478bd9Sstevel@tonic-gate path->audp_sect[0] = dir_path;
17927c478bd9Sstevel@tonic-gate path->audp_sect[1] = dir_path + strlen(dir_path) + 1;
17937c478bd9Sstevel@tonic-gate path->audp_size = path_len;
17947c478bd9Sstevel@tonic-gate path->audp_ref = 1; /* not used */
17957c478bd9Sstevel@tonic-gate path->audp_cnt = 1; /* one path string */
17967c478bd9Sstevel@tonic-gate
17977c478bd9Sstevel@tonic-gate au_uwrite(au_to_path(path));
17987c478bd9Sstevel@tonic-gate
17997c478bd9Sstevel@tonic-gate umount2_free_dir:
18007c478bd9Sstevel@tonic-gate kmem_free(dir_path, MAXPATHLEN);
18017c478bd9Sstevel@tonic-gate kmem_free(path, path_len);
18027c478bd9Sstevel@tonic-gate }
18037c478bd9Sstevel@tonic-gate
18047c478bd9Sstevel@tonic-gate /*ARGSUSED*/
18057c478bd9Sstevel@tonic-gate static void
aus_umount2(struct t_audit_data * tad)18067c478bd9Sstevel@tonic-gate aus_umount2(struct t_audit_data *tad)
18077c478bd9Sstevel@tonic-gate {
18087c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
18097c478bd9Sstevel@tonic-gate struct a {
18107c478bd9Sstevel@tonic-gate long dir; /* char * */
18117c478bd9Sstevel@tonic-gate long flags;
18127c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
18137c478bd9Sstevel@tonic-gate
18147c478bd9Sstevel@tonic-gate aus_umount_path((caddr_t)uap->dir);
18157c478bd9Sstevel@tonic-gate
18167c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(2, "flags", (uint32_t)uap->flags));
18177c478bd9Sstevel@tonic-gate }
18187c478bd9Sstevel@tonic-gate
18197c478bd9Sstevel@tonic-gate static void
aus_msgsys(struct t_audit_data * tad)18207c478bd9Sstevel@tonic-gate aus_msgsys(struct t_audit_data *tad)
18217c478bd9Sstevel@tonic-gate {
18227c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
18237c478bd9Sstevel@tonic-gate uint32_t msgid;
18247c478bd9Sstevel@tonic-gate
18257c478bd9Sstevel@tonic-gate struct b {
18267c478bd9Sstevel@tonic-gate long msgid;
18277c478bd9Sstevel@tonic-gate long cmd;
18287c478bd9Sstevel@tonic-gate long buf; /* struct msqid_ds * */
18297c478bd9Sstevel@tonic-gate } *uap1 = (struct b *)&clwp->lwp_ap[1];
18307c478bd9Sstevel@tonic-gate
18317c478bd9Sstevel@tonic-gate msgid = (uint32_t)uap1->msgid;
18327c478bd9Sstevel@tonic-gate
18337c478bd9Sstevel@tonic-gate
18347c478bd9Sstevel@tonic-gate switch (tad->tad_event) {
18357c478bd9Sstevel@tonic-gate case AUE_MSGGET: /* msgget */
18367c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "msg key", msgid));
18377c478bd9Sstevel@tonic-gate break;
18387c478bd9Sstevel@tonic-gate case AUE_MSGCTL: /* msgctl */
18397c478bd9Sstevel@tonic-gate case AUE_MSGCTL_RMID: /* msgctl */
1840f158b2dfSJan Friedel case AUE_MSGCTL_SET: /* msgctl */
18417c478bd9Sstevel@tonic-gate case AUE_MSGCTL_STAT: /* msgctl */
18427c478bd9Sstevel@tonic-gate case AUE_MSGRCV: /* msgrcv */
18437c478bd9Sstevel@tonic-gate case AUE_MSGSND: /* msgsnd */
18447c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "msg ID", msgid));
18457c478bd9Sstevel@tonic-gate break;
18467c478bd9Sstevel@tonic-gate }
18477c478bd9Sstevel@tonic-gate }
18487c478bd9Sstevel@tonic-gate
18497c478bd9Sstevel@tonic-gate /*ARGSUSED*/
18507c478bd9Sstevel@tonic-gate static void
auf_msgsys(struct t_audit_data * tad,int error,rval_t * rval)18517c478bd9Sstevel@tonic-gate auf_msgsys(struct t_audit_data *tad, int error, rval_t *rval)
18527c478bd9Sstevel@tonic-gate {
18537c478bd9Sstevel@tonic-gate int id;
18547c478bd9Sstevel@tonic-gate
18557c478bd9Sstevel@tonic-gate if (error != 0)
18567c478bd9Sstevel@tonic-gate return;
18577c478bd9Sstevel@tonic-gate if (tad->tad_event == AUE_MSGGET) {
18587c478bd9Sstevel@tonic-gate uint32_t scid;
18597c478bd9Sstevel@tonic-gate uint32_t sy_flags;
18607c478bd9Sstevel@tonic-gate
18617c478bd9Sstevel@tonic-gate /* need to determine type of executing binary */
18627c478bd9Sstevel@tonic-gate scid = tad->tad_scid;
18637c478bd9Sstevel@tonic-gate #ifdef _SYSCALL32_IMPL
18647c478bd9Sstevel@tonic-gate if (lwp_getdatamodel(ttolwp(curthread)) == DATAMODEL_NATIVE)
18657c478bd9Sstevel@tonic-gate sy_flags = sysent[scid].sy_flags & SE_RVAL_MASK;
18667c478bd9Sstevel@tonic-gate else
18677c478bd9Sstevel@tonic-gate sy_flags = sysent32[scid].sy_flags & SE_RVAL_MASK;
18687c478bd9Sstevel@tonic-gate #else
18697c478bd9Sstevel@tonic-gate sy_flags = sysent[scid].sy_flags & SE_RVAL_MASK;
18707c478bd9Sstevel@tonic-gate #endif
18717c478bd9Sstevel@tonic-gate if (sy_flags == SE_32RVAL1)
18727c478bd9Sstevel@tonic-gate id = rval->r_val1;
18737c478bd9Sstevel@tonic-gate if (sy_flags == (SE_32RVAL2|SE_32RVAL1))
18747c478bd9Sstevel@tonic-gate id = rval->r_val1;
18757c478bd9Sstevel@tonic-gate if (sy_flags == SE_64RVAL)
18767c478bd9Sstevel@tonic-gate id = (int)rval->r_vals;
18777c478bd9Sstevel@tonic-gate
18787c478bd9Sstevel@tonic-gate au_uwrite(au_to_ipc(AT_IPC_MSG, id));
18797c478bd9Sstevel@tonic-gate }
18807c478bd9Sstevel@tonic-gate }
18817c478bd9Sstevel@tonic-gate
18827c478bd9Sstevel@tonic-gate static void
aus_semsys(struct t_audit_data * tad)18837c478bd9Sstevel@tonic-gate aus_semsys(struct t_audit_data *tad)
18847c478bd9Sstevel@tonic-gate {
18857c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
18867c478bd9Sstevel@tonic-gate uint32_t semid;
18877c478bd9Sstevel@tonic-gate
18887c478bd9Sstevel@tonic-gate struct b { /* ctrl */
18897c478bd9Sstevel@tonic-gate long semid;
18907c478bd9Sstevel@tonic-gate long semnum;
18917c478bd9Sstevel@tonic-gate long cmd;
18927c478bd9Sstevel@tonic-gate long arg;
18937c478bd9Sstevel@tonic-gate } *uap1 = (struct b *)&clwp->lwp_ap[1];
18947c478bd9Sstevel@tonic-gate
18957c478bd9Sstevel@tonic-gate semid = (uint32_t)uap1->semid;
18967c478bd9Sstevel@tonic-gate
18977c478bd9Sstevel@tonic-gate switch (tad->tad_event) {
18987c478bd9Sstevel@tonic-gate case AUE_SEMCTL_RMID:
18997c478bd9Sstevel@tonic-gate case AUE_SEMCTL_STAT:
19007c478bd9Sstevel@tonic-gate case AUE_SEMCTL_GETNCNT:
19017c478bd9Sstevel@tonic-gate case AUE_SEMCTL_GETPID:
19027c478bd9Sstevel@tonic-gate case AUE_SEMCTL_GETVAL:
19037c478bd9Sstevel@tonic-gate case AUE_SEMCTL_GETALL:
19047c478bd9Sstevel@tonic-gate case AUE_SEMCTL_GETZCNT:
1905f158b2dfSJan Friedel case AUE_SEMCTL_SET:
19067c478bd9Sstevel@tonic-gate case AUE_SEMCTL_SETVAL:
19077c478bd9Sstevel@tonic-gate case AUE_SEMCTL_SETALL:
19087c478bd9Sstevel@tonic-gate case AUE_SEMCTL:
19097c478bd9Sstevel@tonic-gate case AUE_SEMOP:
19107c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "sem ID", semid));
19117c478bd9Sstevel@tonic-gate break;
19127c478bd9Sstevel@tonic-gate case AUE_SEMGET:
19137c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "sem key", semid));
19147c478bd9Sstevel@tonic-gate break;
19157c478bd9Sstevel@tonic-gate }
19167c478bd9Sstevel@tonic-gate }
19177c478bd9Sstevel@tonic-gate
19187c478bd9Sstevel@tonic-gate /*ARGSUSED*/
19197c478bd9Sstevel@tonic-gate static void
auf_semsys(struct t_audit_data * tad,int error,rval_t * rval)19207c478bd9Sstevel@tonic-gate auf_semsys(struct t_audit_data *tad, int error, rval_t *rval)
19217c478bd9Sstevel@tonic-gate {
19227c478bd9Sstevel@tonic-gate int id;
19237c478bd9Sstevel@tonic-gate
19247c478bd9Sstevel@tonic-gate if (error != 0)
19257c478bd9Sstevel@tonic-gate return;
19267c478bd9Sstevel@tonic-gate if (tad->tad_event == AUE_SEMGET) {
19277c478bd9Sstevel@tonic-gate uint32_t scid;
19287c478bd9Sstevel@tonic-gate uint32_t sy_flags;
19297c478bd9Sstevel@tonic-gate
19307c478bd9Sstevel@tonic-gate /* need to determine type of executing binary */
19317c478bd9Sstevel@tonic-gate scid = tad->tad_scid;
19327c478bd9Sstevel@tonic-gate #ifdef _SYSCALL32_IMPL
19337c478bd9Sstevel@tonic-gate if (lwp_getdatamodel(ttolwp(curthread)) == DATAMODEL_NATIVE)
19347c478bd9Sstevel@tonic-gate sy_flags = sysent[scid].sy_flags & SE_RVAL_MASK;
19357c478bd9Sstevel@tonic-gate else
19367c478bd9Sstevel@tonic-gate sy_flags = sysent32[scid].sy_flags & SE_RVAL_MASK;
19377c478bd9Sstevel@tonic-gate #else
19387c478bd9Sstevel@tonic-gate sy_flags = sysent[scid].sy_flags & SE_RVAL_MASK;
19397c478bd9Sstevel@tonic-gate #endif
19407c478bd9Sstevel@tonic-gate if (sy_flags == SE_32RVAL1)
19417c478bd9Sstevel@tonic-gate id = rval->r_val1;
19427c478bd9Sstevel@tonic-gate if (sy_flags == (SE_32RVAL2|SE_32RVAL1))
19437c478bd9Sstevel@tonic-gate id = rval->r_val1;
19447c478bd9Sstevel@tonic-gate if (sy_flags == SE_64RVAL)
19457c478bd9Sstevel@tonic-gate id = (int)rval->r_vals;
19467c478bd9Sstevel@tonic-gate
19477c478bd9Sstevel@tonic-gate au_uwrite(au_to_ipc(AT_IPC_SEM, id));
19487c478bd9Sstevel@tonic-gate }
19497c478bd9Sstevel@tonic-gate }
19507c478bd9Sstevel@tonic-gate
19517c478bd9Sstevel@tonic-gate /*ARGSUSED*/
19527c478bd9Sstevel@tonic-gate static void
aus_close(struct t_audit_data * tad)19537c478bd9Sstevel@tonic-gate aus_close(struct t_audit_data *tad)
19547c478bd9Sstevel@tonic-gate {
19557c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
19567c478bd9Sstevel@tonic-gate uint32_t fd;
19577c478bd9Sstevel@tonic-gate struct file *fp;
19587c478bd9Sstevel@tonic-gate struct f_audit_data *fad;
19597c478bd9Sstevel@tonic-gate struct vnode *vp;
19607c478bd9Sstevel@tonic-gate struct vattr attr;
19619e9e6ab8Spaulson au_kcontext_t *kctx = GET_KCTX_PZ;
19627c478bd9Sstevel@tonic-gate
19637c478bd9Sstevel@tonic-gate struct a {
19647c478bd9Sstevel@tonic-gate long i;
19657c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
19667c478bd9Sstevel@tonic-gate
19677c478bd9Sstevel@tonic-gate fd = (uint32_t)uap->i;
19687c478bd9Sstevel@tonic-gate
19697c478bd9Sstevel@tonic-gate attr.va_mask = 0;
19707c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "fd", fd));
19717c478bd9Sstevel@tonic-gate
19727c478bd9Sstevel@tonic-gate /*
19737c478bd9Sstevel@tonic-gate * convert file pointer to file descriptor
19747c478bd9Sstevel@tonic-gate * Note: fd ref count incremented here.
19757c478bd9Sstevel@tonic-gate */
19767c478bd9Sstevel@tonic-gate if ((fp = getf(fd)) == NULL)
19777c478bd9Sstevel@tonic-gate return;
19787c478bd9Sstevel@tonic-gate
19797c478bd9Sstevel@tonic-gate fad = F2A(fp);
1980d0fa49b7STony Nguyen tad->tad_evmod = (au_emod_t)fad->fad_flags;
19817c478bd9Sstevel@tonic-gate if (fad->fad_aupath != NULL) {
19827c478bd9Sstevel@tonic-gate au_uwrite(au_to_path(fad->fad_aupath));
19837c478bd9Sstevel@tonic-gate if ((vp = fp->f_vnode) != NULL) {
19847c478bd9Sstevel@tonic-gate attr.va_mask = AT_ALL;
1985da6c28aaSamw if (VOP_GETATTR(vp, &attr, 0, CRED(), NULL) == 0) {
19867c478bd9Sstevel@tonic-gate /*
19877c478bd9Sstevel@tonic-gate * When write was not used and the file can be
19887c478bd9Sstevel@tonic-gate * considered public, skip the audit.
19897c478bd9Sstevel@tonic-gate */
19907c478bd9Sstevel@tonic-gate if (((fp->f_flag & FWRITE) == 0) &&
19914a0fa546SMarek Pospisil object_is_public(&attr)) {
19927c478bd9Sstevel@tonic-gate tad->tad_flag = 0;
19937c478bd9Sstevel@tonic-gate tad->tad_evmod = 0;
19947c478bd9Sstevel@tonic-gate /* free any residual audit data */
1995005d3febSMarek Pospisil au_close(kctx, &(u_ad), 0, 0, 0, NULL);
19967c478bd9Sstevel@tonic-gate releasef(fd);
19977c478bd9Sstevel@tonic-gate return;
19987c478bd9Sstevel@tonic-gate }
199945916cd2Sjpk au_uwrite(au_to_attr(&attr));
200045916cd2Sjpk audit_sec_attributes(&(u_ad), vp);
20017c478bd9Sstevel@tonic-gate }
20027c478bd9Sstevel@tonic-gate }
20037c478bd9Sstevel@tonic-gate }
20047c478bd9Sstevel@tonic-gate
20057c478bd9Sstevel@tonic-gate /* decrement file descriptor reference count */
20067c478bd9Sstevel@tonic-gate releasef(fd);
20077c478bd9Sstevel@tonic-gate }
20087c478bd9Sstevel@tonic-gate
20097c478bd9Sstevel@tonic-gate /*ARGSUSED*/
20107c478bd9Sstevel@tonic-gate static void
aus_fstatfs(struct t_audit_data * tad)20117c478bd9Sstevel@tonic-gate aus_fstatfs(struct t_audit_data *tad)
20127c478bd9Sstevel@tonic-gate {
20137c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
20147c478bd9Sstevel@tonic-gate uint32_t fd;
20157c478bd9Sstevel@tonic-gate struct file *fp;
20167c478bd9Sstevel@tonic-gate struct vnode *vp;
20177c478bd9Sstevel@tonic-gate struct f_audit_data *fad;
20187c478bd9Sstevel@tonic-gate
20197c478bd9Sstevel@tonic-gate struct a {
20207c478bd9Sstevel@tonic-gate long fd;
20217c478bd9Sstevel@tonic-gate long buf; /* struct statfs * */
20227c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
20237c478bd9Sstevel@tonic-gate
20247c478bd9Sstevel@tonic-gate fd = (uint_t)uap->fd;
20257c478bd9Sstevel@tonic-gate
20267c478bd9Sstevel@tonic-gate /*
20277c478bd9Sstevel@tonic-gate * convert file pointer to file descriptor
20287c478bd9Sstevel@tonic-gate * Note: fd ref count incremented here.
20297c478bd9Sstevel@tonic-gate */
20307c478bd9Sstevel@tonic-gate if ((fp = getf(fd)) == NULL)
20317c478bd9Sstevel@tonic-gate return;
20327c478bd9Sstevel@tonic-gate
20337c478bd9Sstevel@tonic-gate /* get path from file struct here */
20347c478bd9Sstevel@tonic-gate fad = F2A(fp);
20357c478bd9Sstevel@tonic-gate if (fad->fad_aupath != NULL) {
20367c478bd9Sstevel@tonic-gate au_uwrite(au_to_path(fad->fad_aupath));
20377c478bd9Sstevel@tonic-gate } else {
20387c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "no path: fd", fd));
20397c478bd9Sstevel@tonic-gate }
20407c478bd9Sstevel@tonic-gate
20417c478bd9Sstevel@tonic-gate vp = fp->f_vnode;
20427c478bd9Sstevel@tonic-gate audit_attributes(vp);
20437c478bd9Sstevel@tonic-gate
20447c478bd9Sstevel@tonic-gate /* decrement file descriptor reference count */
20457c478bd9Sstevel@tonic-gate releasef(fd);
20467c478bd9Sstevel@tonic-gate }
20477c478bd9Sstevel@tonic-gate
20484be8c573SJan Friedel static au_event_t
aui_setpgrp(au_event_t e)20494be8c573SJan Friedel aui_setpgrp(au_event_t e)
20504be8c573SJan Friedel {
20514be8c573SJan Friedel klwp_t *clwp = ttolwp(curthread);
20524be8c573SJan Friedel int flag;
20534be8c573SJan Friedel
20544be8c573SJan Friedel struct a {
20554be8c573SJan Friedel long flag;
20564be8c573SJan Friedel long pid;
20574be8c573SJan Friedel long pgid;
20584be8c573SJan Friedel } *uap = (struct a *)clwp->lwp_ap;
20594be8c573SJan Friedel
20604be8c573SJan Friedel flag = (int)uap->flag;
20614be8c573SJan Friedel
20624be8c573SJan Friedel
20634be8c573SJan Friedel switch (flag) {
20644be8c573SJan Friedel
20654be8c573SJan Friedel case 1: /* setpgrp() */
20664be8c573SJan Friedel e = AUE_SETPGRP;
20674be8c573SJan Friedel break;
20684be8c573SJan Friedel
20694be8c573SJan Friedel case 3: /* setsid() */
20704be8c573SJan Friedel e = AUE_SETSID;
20714be8c573SJan Friedel break;
20724be8c573SJan Friedel
20734be8c573SJan Friedel case 5: /* setpgid() */
20744be8c573SJan Friedel e = AUE_SETPGID;
20754be8c573SJan Friedel break;
20764be8c573SJan Friedel
20774be8c573SJan Friedel case 0: /* getpgrp() - not security relevant */
20784be8c573SJan Friedel case 2: /* getsid() - not security relevant */
20794be8c573SJan Friedel case 4: /* getpgid() - not security relevant */
20804be8c573SJan Friedel e = AUE_NULL;
20814be8c573SJan Friedel break;
20824be8c573SJan Friedel
20834be8c573SJan Friedel default:
20844be8c573SJan Friedel e = AUE_NULL;
20854be8c573SJan Friedel break;
20864be8c573SJan Friedel }
20874be8c573SJan Friedel
20884be8c573SJan Friedel return (e);
20894be8c573SJan Friedel }
20904be8c573SJan Friedel
209145a9a7b1SJan Friedel /*ARGSUSED*/
20927c478bd9Sstevel@tonic-gate static void
aus_setpgrp(struct t_audit_data * tad)20937c478bd9Sstevel@tonic-gate aus_setpgrp(struct t_audit_data *tad)
20947c478bd9Sstevel@tonic-gate {
20957c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
20964be8c573SJan Friedel pid_t pgid;
20977c478bd9Sstevel@tonic-gate struct proc *p;
20987c478bd9Sstevel@tonic-gate uid_t uid, ruid;
20997c478bd9Sstevel@tonic-gate gid_t gid, rgid;
21007c478bd9Sstevel@tonic-gate pid_t pid;
21017c478bd9Sstevel@tonic-gate cred_t *cr;
21024be8c573SJan Friedel int flag;
21034be8c573SJan Friedel const auditinfo_addr_t *ainfo;
21047c478bd9Sstevel@tonic-gate
21057c478bd9Sstevel@tonic-gate struct a {
21064be8c573SJan Friedel long flag;
21077c478bd9Sstevel@tonic-gate long pid;
21084be8c573SJan Friedel long pgid;
21097c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
21107c478bd9Sstevel@tonic-gate
21114be8c573SJan Friedel flag = (int)uap->flag;
21127c478bd9Sstevel@tonic-gate pid = (pid_t)uap->pid;
21134be8c573SJan Friedel pgid = (pid_t)uap->pgid;
21144be8c573SJan Friedel
21154be8c573SJan Friedel
21164be8c573SJan Friedel switch (flag) {
21174be8c573SJan Friedel
21184be8c573SJan Friedel case 0: /* getpgrp() */
21194be8c573SJan Friedel case 1: /* setpgrp() */
21204be8c573SJan Friedel case 2: /* getsid() */
21214be8c573SJan Friedel case 3: /* setsid() */
21224be8c573SJan Friedel case 4: /* getpgid() */
21234be8c573SJan Friedel break;
21244be8c573SJan Friedel
21254be8c573SJan Friedel case 5: /* setpgid() */
21267c478bd9Sstevel@tonic-gate
21277c478bd9Sstevel@tonic-gate /* current process? */
21284be8c573SJan Friedel if (pid == 0) {
21294be8c573SJan Friedel return;
21304be8c573SJan Friedel }
21317c478bd9Sstevel@tonic-gate
21327c478bd9Sstevel@tonic-gate mutex_enter(&pidlock);
21337c478bd9Sstevel@tonic-gate p = prfind(pid);
21344be8c573SJan Friedel if (p == NULL || p->p_as == &kas ||
21354be8c573SJan Friedel p->p_stat == SIDL || p->p_stat == SZOMB) {
21367c478bd9Sstevel@tonic-gate mutex_exit(&pidlock);
21377c478bd9Sstevel@tonic-gate return;
21387c478bd9Sstevel@tonic-gate }
21397c478bd9Sstevel@tonic-gate mutex_enter(&p->p_lock); /* so process doesn't go away */
21407c478bd9Sstevel@tonic-gate mutex_exit(&pidlock);
21417c478bd9Sstevel@tonic-gate
21427c478bd9Sstevel@tonic-gate mutex_enter(&p->p_crlock);
21437c478bd9Sstevel@tonic-gate crhold(cr = p->p_cred);
21447c478bd9Sstevel@tonic-gate mutex_exit(&p->p_crlock);
21457c478bd9Sstevel@tonic-gate mutex_exit(&p->p_lock);
21467c478bd9Sstevel@tonic-gate
21477c478bd9Sstevel@tonic-gate ainfo = crgetauinfo(cr);
21487c478bd9Sstevel@tonic-gate if (ainfo == NULL) {
21497c478bd9Sstevel@tonic-gate crfree(cr);
21507c478bd9Sstevel@tonic-gate return;
21517c478bd9Sstevel@tonic-gate }
21527c478bd9Sstevel@tonic-gate
21537c478bd9Sstevel@tonic-gate uid = crgetuid(cr);
21547c478bd9Sstevel@tonic-gate gid = crgetgid(cr);
21557c478bd9Sstevel@tonic-gate ruid = crgetruid(cr);
21567c478bd9Sstevel@tonic-gate rgid = crgetrgid(cr);
21577c478bd9Sstevel@tonic-gate au_uwrite(au_to_process(uid, gid, ruid, rgid, pid,
21587c478bd9Sstevel@tonic-gate ainfo->ai_auid, ainfo->ai_asid, &ainfo->ai_termid));
21597c478bd9Sstevel@tonic-gate crfree(cr);
21604be8c573SJan Friedel au_uwrite(au_to_arg32(2, "pgid", pgid));
21614be8c573SJan Friedel break;
21624be8c573SJan Friedel
21634be8c573SJan Friedel default:
21644be8c573SJan Friedel break;
21657c478bd9Sstevel@tonic-gate }
21664be8c573SJan Friedel }
21674be8c573SJan Friedel
21687c478bd9Sstevel@tonic-gate
21697c478bd9Sstevel@tonic-gate /*ARGSUSED*/
21707c478bd9Sstevel@tonic-gate static void
aus_setregid(struct t_audit_data * tad)21717c478bd9Sstevel@tonic-gate aus_setregid(struct t_audit_data *tad)
21727c478bd9Sstevel@tonic-gate {
21737c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
21747c478bd9Sstevel@tonic-gate uint32_t rgid, egid;
21757c478bd9Sstevel@tonic-gate
21767c478bd9Sstevel@tonic-gate struct a {
21777c478bd9Sstevel@tonic-gate long rgid;
21787c478bd9Sstevel@tonic-gate long egid;
21797c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
21807c478bd9Sstevel@tonic-gate
21817c478bd9Sstevel@tonic-gate rgid = (uint32_t)uap->rgid;
21827c478bd9Sstevel@tonic-gate egid = (uint32_t)uap->egid;
21837c478bd9Sstevel@tonic-gate
21847c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "rgid", rgid));
21857c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(2, "egid", egid));
21867c478bd9Sstevel@tonic-gate }
21877c478bd9Sstevel@tonic-gate
21887c478bd9Sstevel@tonic-gate /*ARGSUSED*/
21897c478bd9Sstevel@tonic-gate static void
aus_setgid(struct t_audit_data * tad)21907c478bd9Sstevel@tonic-gate aus_setgid(struct t_audit_data *tad)
21917c478bd9Sstevel@tonic-gate {
21927c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
21937c478bd9Sstevel@tonic-gate uint32_t gid;
21947c478bd9Sstevel@tonic-gate
21957c478bd9Sstevel@tonic-gate struct a {
21967c478bd9Sstevel@tonic-gate long gid;
21977c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
21987c478bd9Sstevel@tonic-gate
21997c478bd9Sstevel@tonic-gate gid = (uint32_t)uap->gid;
22007c478bd9Sstevel@tonic-gate
22017c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "gid", gid));
22027c478bd9Sstevel@tonic-gate }
22037c478bd9Sstevel@tonic-gate
22047c478bd9Sstevel@tonic-gate
22057c478bd9Sstevel@tonic-gate /*ARGSUSED*/
22067c478bd9Sstevel@tonic-gate static void
aus_setreuid(struct t_audit_data * tad)22077c478bd9Sstevel@tonic-gate aus_setreuid(struct t_audit_data *tad)
22087c478bd9Sstevel@tonic-gate {
22097c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
22107c478bd9Sstevel@tonic-gate uint32_t ruid, euid;
22117c478bd9Sstevel@tonic-gate
22127c478bd9Sstevel@tonic-gate struct a {
22137c478bd9Sstevel@tonic-gate long ruid;
22147c478bd9Sstevel@tonic-gate long euid;
22157c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
22167c478bd9Sstevel@tonic-gate
22177c478bd9Sstevel@tonic-gate ruid = (uint32_t)uap->ruid;
22187c478bd9Sstevel@tonic-gate euid = (uint32_t)uap->euid;
22197c478bd9Sstevel@tonic-gate
22207c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "ruid", ruid));
22217c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(2, "euid", euid));
22227c478bd9Sstevel@tonic-gate }
22237c478bd9Sstevel@tonic-gate
22247c478bd9Sstevel@tonic-gate
22257c478bd9Sstevel@tonic-gate /*ARGSUSED*/
22267c478bd9Sstevel@tonic-gate static void
aus_setuid(struct t_audit_data * tad)22277c478bd9Sstevel@tonic-gate aus_setuid(struct t_audit_data *tad)
22287c478bd9Sstevel@tonic-gate {
22297c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
22307c478bd9Sstevel@tonic-gate uint32_t uid;
22317c478bd9Sstevel@tonic-gate
22327c478bd9Sstevel@tonic-gate struct a {
22337c478bd9Sstevel@tonic-gate long uid;
22347c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
22357c478bd9Sstevel@tonic-gate
22367c478bd9Sstevel@tonic-gate uid = (uint32_t)uap->uid;
22377c478bd9Sstevel@tonic-gate
22387c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "uid", uid));
22397c478bd9Sstevel@tonic-gate }
22407c478bd9Sstevel@tonic-gate
22417c478bd9Sstevel@tonic-gate /*ARGSUSED*/
22427c478bd9Sstevel@tonic-gate static void
aus_shmsys(struct t_audit_data * tad)22437c478bd9Sstevel@tonic-gate aus_shmsys(struct t_audit_data *tad)
22447c478bd9Sstevel@tonic-gate {
22457c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
22467c478bd9Sstevel@tonic-gate uint32_t id, cmd;
22477c478bd9Sstevel@tonic-gate
22487c478bd9Sstevel@tonic-gate struct b {
22497c478bd9Sstevel@tonic-gate long id;
22507c478bd9Sstevel@tonic-gate long cmd;
22517c478bd9Sstevel@tonic-gate long buf; /* struct shmid_ds * */
22527c478bd9Sstevel@tonic-gate } *uap1 = (struct b *)&clwp->lwp_ap[1];
22537c478bd9Sstevel@tonic-gate
22547c478bd9Sstevel@tonic-gate id = (uint32_t)uap1->id;
22557c478bd9Sstevel@tonic-gate cmd = (uint32_t)uap1->cmd;
22567c478bd9Sstevel@tonic-gate
22577c478bd9Sstevel@tonic-gate switch (tad->tad_event) {
22587c478bd9Sstevel@tonic-gate case AUE_SHMGET: /* shmget */
22597c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "shm key", id));
22607c478bd9Sstevel@tonic-gate break;
22617c478bd9Sstevel@tonic-gate case AUE_SHMCTL: /* shmctl */
22627c478bd9Sstevel@tonic-gate case AUE_SHMCTL_RMID: /* shmctl */
22637c478bd9Sstevel@tonic-gate case AUE_SHMCTL_STAT: /* shmctl */
22647c478bd9Sstevel@tonic-gate case AUE_SHMCTL_SET: /* shmctl */
22657c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "shm ID", id));
22667c478bd9Sstevel@tonic-gate break;
22677c478bd9Sstevel@tonic-gate case AUE_SHMDT: /* shmdt */
22687c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "shm adr", id));
22697c478bd9Sstevel@tonic-gate break;
22707c478bd9Sstevel@tonic-gate case AUE_SHMAT: /* shmat */
22717c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "shm ID", id));
22727c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(2, "shm adr", cmd));
22737c478bd9Sstevel@tonic-gate break;
22747c478bd9Sstevel@tonic-gate }
22757c478bd9Sstevel@tonic-gate }
22767c478bd9Sstevel@tonic-gate
22777c478bd9Sstevel@tonic-gate /*ARGSUSED*/
22787c478bd9Sstevel@tonic-gate static void
auf_shmsys(struct t_audit_data * tad,int error,rval_t * rval)22797c478bd9Sstevel@tonic-gate auf_shmsys(struct t_audit_data *tad, int error, rval_t *rval)
22807c478bd9Sstevel@tonic-gate {
22817c478bd9Sstevel@tonic-gate int id;
22827c478bd9Sstevel@tonic-gate
22837c478bd9Sstevel@tonic-gate if (error != 0)
22847c478bd9Sstevel@tonic-gate return;
22857c478bd9Sstevel@tonic-gate if (tad->tad_event == AUE_SHMGET) {
22867c478bd9Sstevel@tonic-gate uint32_t scid;
22877c478bd9Sstevel@tonic-gate uint32_t sy_flags;
22887c478bd9Sstevel@tonic-gate
22897c478bd9Sstevel@tonic-gate /* need to determine type of executing binary */
22907c478bd9Sstevel@tonic-gate scid = tad->tad_scid;
22917c478bd9Sstevel@tonic-gate #ifdef _SYSCALL32_IMPL
22927c478bd9Sstevel@tonic-gate if (lwp_getdatamodel(ttolwp(curthread)) == DATAMODEL_NATIVE)
22937c478bd9Sstevel@tonic-gate sy_flags = sysent[scid].sy_flags & SE_RVAL_MASK;
22947c478bd9Sstevel@tonic-gate else
22957c478bd9Sstevel@tonic-gate sy_flags = sysent32[scid].sy_flags & SE_RVAL_MASK;
22967c478bd9Sstevel@tonic-gate #else
22977c478bd9Sstevel@tonic-gate sy_flags = sysent[scid].sy_flags & SE_RVAL_MASK;
22987c478bd9Sstevel@tonic-gate #endif
22997c478bd9Sstevel@tonic-gate if (sy_flags == SE_32RVAL1)
23007c478bd9Sstevel@tonic-gate id = rval->r_val1;
23017c478bd9Sstevel@tonic-gate if (sy_flags == (SE_32RVAL2|SE_32RVAL1))
23027c478bd9Sstevel@tonic-gate id = rval->r_val1;
23037c478bd9Sstevel@tonic-gate if (sy_flags == SE_64RVAL)
23047c478bd9Sstevel@tonic-gate id = (int)rval->r_vals;
23057c478bd9Sstevel@tonic-gate au_uwrite(au_to_ipc(AT_IPC_SHM, id));
23067c478bd9Sstevel@tonic-gate }
23077c478bd9Sstevel@tonic-gate }
23087c478bd9Sstevel@tonic-gate
23097c478bd9Sstevel@tonic-gate
23107c478bd9Sstevel@tonic-gate /*ARGSUSED*/
23117c478bd9Sstevel@tonic-gate static void
aus_ioctl(struct t_audit_data * tad)23127c478bd9Sstevel@tonic-gate aus_ioctl(struct t_audit_data *tad)
23137c478bd9Sstevel@tonic-gate {
23147c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
23157c478bd9Sstevel@tonic-gate struct file *fp;
23167c478bd9Sstevel@tonic-gate struct vnode *vp;
23177c478bd9Sstevel@tonic-gate struct f_audit_data *fad;
23187c478bd9Sstevel@tonic-gate uint32_t fd, cmd;
23197c478bd9Sstevel@tonic-gate uintptr_t cmarg;
23207c478bd9Sstevel@tonic-gate
23217c478bd9Sstevel@tonic-gate /* XX64 */
23227c478bd9Sstevel@tonic-gate struct a {
23237c478bd9Sstevel@tonic-gate long fd;
23247c478bd9Sstevel@tonic-gate long cmd;
23257c478bd9Sstevel@tonic-gate long cmarg; /* caddr_t */
23267c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
23277c478bd9Sstevel@tonic-gate
23287c478bd9Sstevel@tonic-gate fd = (uint32_t)uap->fd;
23297c478bd9Sstevel@tonic-gate cmd = (uint32_t)uap->cmd;
23307c478bd9Sstevel@tonic-gate cmarg = (uintptr_t)uap->cmarg;
23317c478bd9Sstevel@tonic-gate
23327c478bd9Sstevel@tonic-gate /*
23337c478bd9Sstevel@tonic-gate * convert file pointer to file descriptor
23347c478bd9Sstevel@tonic-gate * Note: fd ref count incremented here.
23357c478bd9Sstevel@tonic-gate */
23367c478bd9Sstevel@tonic-gate if ((fp = getf(fd)) == NULL) {
23377c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "fd", fd));
23387c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(2, "cmd", cmd));
23397c478bd9Sstevel@tonic-gate #ifndef _LP64
23407c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(3, "arg", (uint32_t)cmarg));
23417c478bd9Sstevel@tonic-gate #else
23427c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg64(3, "arg", (uint64_t)cmarg));
23437c478bd9Sstevel@tonic-gate #endif
23447c478bd9Sstevel@tonic-gate return;
23457c478bd9Sstevel@tonic-gate }
23467c478bd9Sstevel@tonic-gate
23477c478bd9Sstevel@tonic-gate /* get path from file struct here */
23487c478bd9Sstevel@tonic-gate fad = F2A(fp);
23497c478bd9Sstevel@tonic-gate if (fad->fad_aupath != NULL) {
23507c478bd9Sstevel@tonic-gate au_uwrite(au_to_path(fad->fad_aupath));
23517c478bd9Sstevel@tonic-gate } else {
23527c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "no path: fd", fd));
23537c478bd9Sstevel@tonic-gate }
23547c478bd9Sstevel@tonic-gate
23557c478bd9Sstevel@tonic-gate vp = fp->f_vnode;
23567c478bd9Sstevel@tonic-gate audit_attributes(vp);
23577c478bd9Sstevel@tonic-gate
23587c478bd9Sstevel@tonic-gate /* decrement file descriptor reference count */
23597c478bd9Sstevel@tonic-gate releasef(fd);
23607c478bd9Sstevel@tonic-gate
23617c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(2, "cmd", cmd));
23627c478bd9Sstevel@tonic-gate #ifndef _LP64
23637c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(3, "arg", (uint32_t)cmarg));
23647c478bd9Sstevel@tonic-gate #else
23657c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg64(3, "arg", (uint64_t)cmarg));
23667c478bd9Sstevel@tonic-gate #endif
23677c478bd9Sstevel@tonic-gate }
23687c478bd9Sstevel@tonic-gate
23697c478bd9Sstevel@tonic-gate /*
23707c478bd9Sstevel@tonic-gate * null function for memcntl for now. We might want to limit memcntl()
23717c478bd9Sstevel@tonic-gate * auditing to commands: MC_LOCKAS, MC_LOCK, MC_UNLOCKAS, MC_UNLOCK which
23727c478bd9Sstevel@tonic-gate * require privileges.
23737c478bd9Sstevel@tonic-gate */
23747c478bd9Sstevel@tonic-gate static au_event_t
aui_memcntl(au_event_t e)23757c478bd9Sstevel@tonic-gate aui_memcntl(au_event_t e)
23767c478bd9Sstevel@tonic-gate {
23777c478bd9Sstevel@tonic-gate return (e);
23787c478bd9Sstevel@tonic-gate }
23797c478bd9Sstevel@tonic-gate
23807c478bd9Sstevel@tonic-gate /*ARGSUSED*/
23817c478bd9Sstevel@tonic-gate static au_event_t
aui_privsys(au_event_t e)23827c478bd9Sstevel@tonic-gate aui_privsys(au_event_t e)
23837c478bd9Sstevel@tonic-gate {
23847c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
23857c478bd9Sstevel@tonic-gate
23867c478bd9Sstevel@tonic-gate struct a {
23877c478bd9Sstevel@tonic-gate long opcode;
23887c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
23897c478bd9Sstevel@tonic-gate
23907c478bd9Sstevel@tonic-gate switch (uap->opcode) {
23917c478bd9Sstevel@tonic-gate case PRIVSYS_SETPPRIV:
23927c478bd9Sstevel@tonic-gate return (AUE_SETPPRIV);
23937c478bd9Sstevel@tonic-gate default:
23947c478bd9Sstevel@tonic-gate return (AUE_NULL);
23957c478bd9Sstevel@tonic-gate }
23967c478bd9Sstevel@tonic-gate }
23977c478bd9Sstevel@tonic-gate
23987c478bd9Sstevel@tonic-gate /*ARGSUSED*/
23997c478bd9Sstevel@tonic-gate static void
aus_memcntl(struct t_audit_data * tad)24007c478bd9Sstevel@tonic-gate aus_memcntl(struct t_audit_data *tad)
24017c478bd9Sstevel@tonic-gate {
24027c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
24037c478bd9Sstevel@tonic-gate
24047c478bd9Sstevel@tonic-gate struct a {
24057c478bd9Sstevel@tonic-gate long addr;
24067c478bd9Sstevel@tonic-gate long len;
24077c478bd9Sstevel@tonic-gate long cmd;
24087c478bd9Sstevel@tonic-gate long arg;
24097c478bd9Sstevel@tonic-gate long attr;
24107c478bd9Sstevel@tonic-gate long mask;
24117c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
24127c478bd9Sstevel@tonic-gate
24137c478bd9Sstevel@tonic-gate #ifdef _LP64
24147c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg64(1, "base", (uint64_t)uap->addr));
24157c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg64(2, "len", (uint64_t)uap->len));
24167c478bd9Sstevel@tonic-gate #else
24177c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "base", (uint32_t)uap->addr));
24187c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(2, "len", (uint32_t)uap->len));
24197c478bd9Sstevel@tonic-gate #endif
24207c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(3, "cmd", (uint_t)uap->cmd));
24217c478bd9Sstevel@tonic-gate #ifdef _LP64
24227c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg64(4, "arg", (uint64_t)uap->arg));
24237c478bd9Sstevel@tonic-gate #else
24247c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(4, "arg", (uint32_t)uap->arg));
24257c478bd9Sstevel@tonic-gate #endif
24267c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(5, "attr", (uint_t)uap->attr));
24277c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(6, "mask", (uint_t)uap->mask));
24287c478bd9Sstevel@tonic-gate }
24297c478bd9Sstevel@tonic-gate
24307c478bd9Sstevel@tonic-gate /*ARGSUSED*/
24317c478bd9Sstevel@tonic-gate static void
aus_mmap(struct t_audit_data * tad)24327c478bd9Sstevel@tonic-gate aus_mmap(struct t_audit_data *tad)
24337c478bd9Sstevel@tonic-gate {
24347c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
24357c478bd9Sstevel@tonic-gate struct file *fp;
24367c478bd9Sstevel@tonic-gate struct f_audit_data *fad;
24377c478bd9Sstevel@tonic-gate struct vnode *vp;
24387c478bd9Sstevel@tonic-gate uint32_t fd;
24397c478bd9Sstevel@tonic-gate
24407c478bd9Sstevel@tonic-gate struct a {
24417c478bd9Sstevel@tonic-gate long addr;
24427c478bd9Sstevel@tonic-gate long len;
24437c478bd9Sstevel@tonic-gate long prot;
24447c478bd9Sstevel@tonic-gate long flags;
24457c478bd9Sstevel@tonic-gate long fd;
24467c478bd9Sstevel@tonic-gate long pos;
24477c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
24487c478bd9Sstevel@tonic-gate
24497c478bd9Sstevel@tonic-gate fd = (uint32_t)uap->fd;
24507c478bd9Sstevel@tonic-gate
24517c478bd9Sstevel@tonic-gate #ifdef _LP64
24527c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg64(1, "addr", (uint64_t)uap->addr));
24537c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg64(2, "len", (uint64_t)uap->len));
24547c478bd9Sstevel@tonic-gate #else
24557c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "addr", (uint32_t)uap->addr));
24567c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(2, "len", (uint32_t)uap->len));
24577c478bd9Sstevel@tonic-gate #endif
24587c478bd9Sstevel@tonic-gate
24597c478bd9Sstevel@tonic-gate if ((fp = getf(fd)) == NULL) {
24607c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(5, "fd", (uint32_t)uap->fd));
24617c478bd9Sstevel@tonic-gate return;
24627c478bd9Sstevel@tonic-gate }
24637c478bd9Sstevel@tonic-gate
24647c478bd9Sstevel@tonic-gate /*
24657c478bd9Sstevel@tonic-gate * Mark in the tad if write access is NOT requested... if
24667c478bd9Sstevel@tonic-gate * this is later detected (in audit_attributes) to be a
24677c478bd9Sstevel@tonic-gate * public object, the mmap event may be discarded.
24687c478bd9Sstevel@tonic-gate */
24697c478bd9Sstevel@tonic-gate if (((uap->prot) & PROT_WRITE) == 0) {
24704a0fa546SMarek Pospisil tad->tad_ctrl |= TAD_PUBLIC_EV;
24717c478bd9Sstevel@tonic-gate }
24727c478bd9Sstevel@tonic-gate
24737c478bd9Sstevel@tonic-gate fad = F2A(fp);
24747c478bd9Sstevel@tonic-gate if (fad->fad_aupath != NULL) {
24757c478bd9Sstevel@tonic-gate au_uwrite(au_to_path(fad->fad_aupath));
24767c478bd9Sstevel@tonic-gate } else {
24777c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "no path: fd", fd));
24787c478bd9Sstevel@tonic-gate }
24797c478bd9Sstevel@tonic-gate
24807c478bd9Sstevel@tonic-gate vp = (struct vnode *)fp->f_vnode;
24817c478bd9Sstevel@tonic-gate audit_attributes(vp);
24827c478bd9Sstevel@tonic-gate
24837c478bd9Sstevel@tonic-gate /* mark READ/WRITE since we can't predict access */
24847c478bd9Sstevel@tonic-gate if (uap->prot & PROT_READ)
24857c478bd9Sstevel@tonic-gate fad->fad_flags |= FAD_READ;
24867c478bd9Sstevel@tonic-gate if (uap->prot & PROT_WRITE)
24877c478bd9Sstevel@tonic-gate fad->fad_flags |= FAD_WRITE;
24887c478bd9Sstevel@tonic-gate
24897c478bd9Sstevel@tonic-gate /* decrement file descriptor reference count */
24907c478bd9Sstevel@tonic-gate releasef(fd);
24917c478bd9Sstevel@tonic-gate
24927c478bd9Sstevel@tonic-gate } /* AUS_MMAP */
24937c478bd9Sstevel@tonic-gate
24947c478bd9Sstevel@tonic-gate
24957c478bd9Sstevel@tonic-gate
24967c478bd9Sstevel@tonic-gate
24977c478bd9Sstevel@tonic-gate /*ARGSUSED*/
24987c478bd9Sstevel@tonic-gate static void
aus_munmap(struct t_audit_data * tad)24997c478bd9Sstevel@tonic-gate aus_munmap(struct t_audit_data *tad)
25007c478bd9Sstevel@tonic-gate {
25017c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
25027c478bd9Sstevel@tonic-gate
25037c478bd9Sstevel@tonic-gate struct a {
25047c478bd9Sstevel@tonic-gate long addr;
25057c478bd9Sstevel@tonic-gate long len;
25067c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
25077c478bd9Sstevel@tonic-gate
25087c478bd9Sstevel@tonic-gate #ifdef _LP64
25097c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg64(1, "addr", (uint64_t)uap->addr));
25107c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg64(2, "len", (uint64_t)uap->len));
25117c478bd9Sstevel@tonic-gate #else
25127c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "addr", (uint32_t)uap->addr));
25137c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(2, "len", (uint32_t)uap->len));
25147c478bd9Sstevel@tonic-gate #endif
25157c478bd9Sstevel@tonic-gate
25167c478bd9Sstevel@tonic-gate } /* AUS_MUNMAP */
25177c478bd9Sstevel@tonic-gate
25187c478bd9Sstevel@tonic-gate
25197c478bd9Sstevel@tonic-gate
25207c478bd9Sstevel@tonic-gate
25217c478bd9Sstevel@tonic-gate
25227c478bd9Sstevel@tonic-gate
25237c478bd9Sstevel@tonic-gate
25247c478bd9Sstevel@tonic-gate /*ARGSUSED*/
25257c478bd9Sstevel@tonic-gate static void
aus_priocntlsys(struct t_audit_data * tad)25267c478bd9Sstevel@tonic-gate aus_priocntlsys(struct t_audit_data *tad)
25277c478bd9Sstevel@tonic-gate {
25287c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
25297c478bd9Sstevel@tonic-gate
25307c478bd9Sstevel@tonic-gate struct a {
25317c478bd9Sstevel@tonic-gate long pc_version;
25327c478bd9Sstevel@tonic-gate long psp; /* procset_t */
25337c478bd9Sstevel@tonic-gate long cmd;
25347c478bd9Sstevel@tonic-gate long arg;
25357c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
25367c478bd9Sstevel@tonic-gate
25377c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "pc_version", (uint32_t)uap->pc_version));
25387c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(3, "cmd", (uint32_t)uap->cmd));
25397c478bd9Sstevel@tonic-gate
25407c478bd9Sstevel@tonic-gate } /* AUS_PRIOCNTLSYS */
25417c478bd9Sstevel@tonic-gate
25427c478bd9Sstevel@tonic-gate
25437c478bd9Sstevel@tonic-gate /*ARGSUSED*/
25447c478bd9Sstevel@tonic-gate static void
aus_setegid(struct t_audit_data * tad)25457c478bd9Sstevel@tonic-gate aus_setegid(struct t_audit_data *tad)
25467c478bd9Sstevel@tonic-gate {
25477c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
25487c478bd9Sstevel@tonic-gate uint32_t gid;
25497c478bd9Sstevel@tonic-gate
25507c478bd9Sstevel@tonic-gate struct a {
25517c478bd9Sstevel@tonic-gate long gid;
25527c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
25537c478bd9Sstevel@tonic-gate
25547c478bd9Sstevel@tonic-gate gid = (uint32_t)uap->gid;
25557c478bd9Sstevel@tonic-gate
25567c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "gid", gid));
25577c478bd9Sstevel@tonic-gate } /* AUS_SETEGID */
25587c478bd9Sstevel@tonic-gate
25597c478bd9Sstevel@tonic-gate
25607c478bd9Sstevel@tonic-gate
25617c478bd9Sstevel@tonic-gate
25627c478bd9Sstevel@tonic-gate /*ARGSUSED*/
25637c478bd9Sstevel@tonic-gate static void
aus_setgroups(struct t_audit_data * tad)25647c478bd9Sstevel@tonic-gate aus_setgroups(struct t_audit_data *tad)
25657c478bd9Sstevel@tonic-gate {
25667c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
25677c478bd9Sstevel@tonic-gate int i;
25687c478bd9Sstevel@tonic-gate int gidsetsize;
25697c478bd9Sstevel@tonic-gate uintptr_t gidset;
25707c478bd9Sstevel@tonic-gate gid_t *gidlist;
25717c478bd9Sstevel@tonic-gate
25727c478bd9Sstevel@tonic-gate struct a {
25737c478bd9Sstevel@tonic-gate long gidsetsize;
25747c478bd9Sstevel@tonic-gate long gidset;
25757c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
25767c478bd9Sstevel@tonic-gate
25777c478bd9Sstevel@tonic-gate gidsetsize = (uint_t)uap->gidsetsize;
25787c478bd9Sstevel@tonic-gate gidset = (uintptr_t)uap->gidset;
25797c478bd9Sstevel@tonic-gate
25807c478bd9Sstevel@tonic-gate if ((gidsetsize > NGROUPS_MAX_DEFAULT) || (gidsetsize < 0))
25817c478bd9Sstevel@tonic-gate return;
25827c478bd9Sstevel@tonic-gate if (gidsetsize != 0) {
25837c478bd9Sstevel@tonic-gate gidlist = kmem_alloc(gidsetsize * sizeof (gid_t),
25847c478bd9Sstevel@tonic-gate KM_SLEEP);
25857c478bd9Sstevel@tonic-gate if (copyin((caddr_t)gidset, gidlist,
25867c478bd9Sstevel@tonic-gate gidsetsize * sizeof (gid_t)) == 0)
25877c478bd9Sstevel@tonic-gate for (i = 0; i < gidsetsize; i++)
25887c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "setgroups",
25897c478bd9Sstevel@tonic-gate (uint32_t)gidlist[i]));
25907c478bd9Sstevel@tonic-gate kmem_free(gidlist, gidsetsize * sizeof (gid_t));
25917c478bd9Sstevel@tonic-gate } else
25927c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "setgroups", (uint32_t)0));
25937c478bd9Sstevel@tonic-gate
25947c478bd9Sstevel@tonic-gate } /* AUS_SETGROUPS */
25957c478bd9Sstevel@tonic-gate
25967c478bd9Sstevel@tonic-gate
25977c478bd9Sstevel@tonic-gate
25987c478bd9Sstevel@tonic-gate
25997c478bd9Sstevel@tonic-gate
26007c478bd9Sstevel@tonic-gate /*ARGSUSED*/
26017c478bd9Sstevel@tonic-gate static void
aus_seteuid(struct t_audit_data * tad)26027c478bd9Sstevel@tonic-gate aus_seteuid(struct t_audit_data *tad)
26037c478bd9Sstevel@tonic-gate {
26047c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
26057c478bd9Sstevel@tonic-gate uint32_t uid;
26067c478bd9Sstevel@tonic-gate
26077c478bd9Sstevel@tonic-gate struct a {
26087c478bd9Sstevel@tonic-gate long uid;
26097c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
26107c478bd9Sstevel@tonic-gate
26117c478bd9Sstevel@tonic-gate uid = (uint32_t)uap->uid;
26127c478bd9Sstevel@tonic-gate
26137c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "euid", uid));
26147c478bd9Sstevel@tonic-gate
26157c478bd9Sstevel@tonic-gate } /* AUS_SETEUID */
26167c478bd9Sstevel@tonic-gate
26177c478bd9Sstevel@tonic-gate /*ARGSUSED*/
26187c478bd9Sstevel@tonic-gate static void
aus_putmsg(struct t_audit_data * tad)26197c478bd9Sstevel@tonic-gate aus_putmsg(struct t_audit_data *tad)
26207c478bd9Sstevel@tonic-gate {
26217c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
26227c478bd9Sstevel@tonic-gate uint32_t fd, pri;
26237c478bd9Sstevel@tonic-gate struct file *fp;
26247c478bd9Sstevel@tonic-gate struct f_audit_data *fad;
26257c478bd9Sstevel@tonic-gate
26267c478bd9Sstevel@tonic-gate struct a {
26277c478bd9Sstevel@tonic-gate long fdes;
26287c478bd9Sstevel@tonic-gate long ctl; /* struct strbuf * */
26297c478bd9Sstevel@tonic-gate long data; /* struct strbuf * */
26307c478bd9Sstevel@tonic-gate long pri;
26317c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
26327c478bd9Sstevel@tonic-gate
26337c478bd9Sstevel@tonic-gate fd = (uint32_t)uap->fdes;
26347c478bd9Sstevel@tonic-gate pri = (uint32_t)uap->pri;
26357c478bd9Sstevel@tonic-gate
26367c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "fd", fd));
26377c478bd9Sstevel@tonic-gate
26387c478bd9Sstevel@tonic-gate if ((fp = getf(fd)) != NULL) {
26397c478bd9Sstevel@tonic-gate fad = F2A(fp);
26407c478bd9Sstevel@tonic-gate
26417c478bd9Sstevel@tonic-gate fad->fad_flags |= FAD_WRITE;
26427c478bd9Sstevel@tonic-gate
26437c478bd9Sstevel@tonic-gate /* add path name to audit record */
26447c478bd9Sstevel@tonic-gate if (fad->fad_aupath != NULL) {
26457c478bd9Sstevel@tonic-gate au_uwrite(au_to_path(fad->fad_aupath));
26467c478bd9Sstevel@tonic-gate }
26477c478bd9Sstevel@tonic-gate audit_attributes(fp->f_vnode);
26487c478bd9Sstevel@tonic-gate
26497c478bd9Sstevel@tonic-gate releasef(fd);
26507c478bd9Sstevel@tonic-gate }
26517c478bd9Sstevel@tonic-gate
26527c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(4, "pri", pri));
26537c478bd9Sstevel@tonic-gate }
26547c478bd9Sstevel@tonic-gate
26557c478bd9Sstevel@tonic-gate /*ARGSUSED*/
26567c478bd9Sstevel@tonic-gate static void
aus_putpmsg(struct t_audit_data * tad)26577c478bd9Sstevel@tonic-gate aus_putpmsg(struct t_audit_data *tad)
26587c478bd9Sstevel@tonic-gate {
26597c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
26607c478bd9Sstevel@tonic-gate uint32_t fd, pri, flags;
26617c478bd9Sstevel@tonic-gate struct file *fp;
26627c478bd9Sstevel@tonic-gate struct f_audit_data *fad;
26637c478bd9Sstevel@tonic-gate
26647c478bd9Sstevel@tonic-gate struct a {
26657c478bd9Sstevel@tonic-gate long fdes;
26667c478bd9Sstevel@tonic-gate long ctl; /* struct strbuf * */
26677c478bd9Sstevel@tonic-gate long data; /* struct strbuf * */
26687c478bd9Sstevel@tonic-gate long pri;
26697c478bd9Sstevel@tonic-gate long flags;
26707c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
26717c478bd9Sstevel@tonic-gate
26727c478bd9Sstevel@tonic-gate fd = (uint32_t)uap->fdes;
26737c478bd9Sstevel@tonic-gate pri = (uint32_t)uap->pri;
26747c478bd9Sstevel@tonic-gate flags = (uint32_t)uap->flags;
26757c478bd9Sstevel@tonic-gate
26767c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "fd", fd));
26777c478bd9Sstevel@tonic-gate
26787c478bd9Sstevel@tonic-gate if ((fp = getf(fd)) != NULL) {
26797c478bd9Sstevel@tonic-gate fad = F2A(fp);
26807c478bd9Sstevel@tonic-gate
26817c478bd9Sstevel@tonic-gate fad->fad_flags |= FAD_WRITE;
26827c478bd9Sstevel@tonic-gate
26837c478bd9Sstevel@tonic-gate /* add path name to audit record */
26847c478bd9Sstevel@tonic-gate if (fad->fad_aupath != NULL) {
26857c478bd9Sstevel@tonic-gate au_uwrite(au_to_path(fad->fad_aupath));
26867c478bd9Sstevel@tonic-gate }
26877c478bd9Sstevel@tonic-gate audit_attributes(fp->f_vnode);
26887c478bd9Sstevel@tonic-gate
26897c478bd9Sstevel@tonic-gate releasef(fd);
26907c478bd9Sstevel@tonic-gate }
26917c478bd9Sstevel@tonic-gate
26927c478bd9Sstevel@tonic-gate
26937c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(4, "pri", pri));
26947c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(5, "flags", flags));
26957c478bd9Sstevel@tonic-gate }
26967c478bd9Sstevel@tonic-gate
26977c478bd9Sstevel@tonic-gate /*ARGSUSED*/
26987c478bd9Sstevel@tonic-gate static void
aus_getmsg(struct t_audit_data * tad)26997c478bd9Sstevel@tonic-gate aus_getmsg(struct t_audit_data *tad)
27007c478bd9Sstevel@tonic-gate {
27017c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
27027c478bd9Sstevel@tonic-gate uint32_t fd, pri;
27037c478bd9Sstevel@tonic-gate struct file *fp;
27047c478bd9Sstevel@tonic-gate struct f_audit_data *fad;
27057c478bd9Sstevel@tonic-gate
27067c478bd9Sstevel@tonic-gate struct a {
27077c478bd9Sstevel@tonic-gate long fdes;
27087c478bd9Sstevel@tonic-gate long ctl; /* struct strbuf * */
27097c478bd9Sstevel@tonic-gate long data; /* struct strbuf * */
27107c478bd9Sstevel@tonic-gate long pri;
27117c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
27127c478bd9Sstevel@tonic-gate
27137c478bd9Sstevel@tonic-gate fd = (uint32_t)uap->fdes;
27147c478bd9Sstevel@tonic-gate pri = (uint32_t)uap->pri;
27157c478bd9Sstevel@tonic-gate
27167c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "fd", fd));
27177c478bd9Sstevel@tonic-gate
27187c478bd9Sstevel@tonic-gate if ((fp = getf(fd)) != NULL) {
27197c478bd9Sstevel@tonic-gate fad = F2A(fp);
27207c478bd9Sstevel@tonic-gate
27217c478bd9Sstevel@tonic-gate /*
27227c478bd9Sstevel@tonic-gate * read operation on this object
27237c478bd9Sstevel@tonic-gate */
27247c478bd9Sstevel@tonic-gate fad->fad_flags |= FAD_READ;
27257c478bd9Sstevel@tonic-gate
27267c478bd9Sstevel@tonic-gate /* add path name to audit record */
27277c478bd9Sstevel@tonic-gate if (fad->fad_aupath != NULL) {
27287c478bd9Sstevel@tonic-gate au_uwrite(au_to_path(fad->fad_aupath));
27297c478bd9Sstevel@tonic-gate }
27307c478bd9Sstevel@tonic-gate audit_attributes(fp->f_vnode);
27317c478bd9Sstevel@tonic-gate
27327c478bd9Sstevel@tonic-gate releasef(fd);
27337c478bd9Sstevel@tonic-gate }
27347c478bd9Sstevel@tonic-gate
27357c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(4, "pri", pri));
27367c478bd9Sstevel@tonic-gate }
27377c478bd9Sstevel@tonic-gate
27387c478bd9Sstevel@tonic-gate /*ARGSUSED*/
27397c478bd9Sstevel@tonic-gate static void
aus_getpmsg(struct t_audit_data * tad)27407c478bd9Sstevel@tonic-gate aus_getpmsg(struct t_audit_data *tad)
27417c478bd9Sstevel@tonic-gate {
27427c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
27437c478bd9Sstevel@tonic-gate uint32_t fd;
27447c478bd9Sstevel@tonic-gate struct file *fp;
27457c478bd9Sstevel@tonic-gate struct f_audit_data *fad;
27467c478bd9Sstevel@tonic-gate
27477c478bd9Sstevel@tonic-gate struct a {
27487c478bd9Sstevel@tonic-gate long fdes;
27497c478bd9Sstevel@tonic-gate long ctl; /* struct strbuf * */
27507c478bd9Sstevel@tonic-gate long data; /* struct strbuf * */
27517c478bd9Sstevel@tonic-gate long pri;
27527c478bd9Sstevel@tonic-gate long flags;
27537c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
27547c478bd9Sstevel@tonic-gate
27557c478bd9Sstevel@tonic-gate fd = (uint32_t)uap->fdes;
27567c478bd9Sstevel@tonic-gate
27577c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "fd", fd));
27587c478bd9Sstevel@tonic-gate
27597c478bd9Sstevel@tonic-gate if ((fp = getf(fd)) != NULL) {
27607c478bd9Sstevel@tonic-gate fad = F2A(fp);
27617c478bd9Sstevel@tonic-gate
27627c478bd9Sstevel@tonic-gate /*
27637c478bd9Sstevel@tonic-gate * read operation on this object
27647c478bd9Sstevel@tonic-gate */
27657c478bd9Sstevel@tonic-gate fad->fad_flags |= FAD_READ;
27667c478bd9Sstevel@tonic-gate
27677c478bd9Sstevel@tonic-gate /* add path name to audit record */
27687c478bd9Sstevel@tonic-gate if (fad->fad_aupath != NULL) {
27697c478bd9Sstevel@tonic-gate au_uwrite(au_to_path(fad->fad_aupath));
27707c478bd9Sstevel@tonic-gate }
27717c478bd9Sstevel@tonic-gate audit_attributes(fp->f_vnode);
27727c478bd9Sstevel@tonic-gate
27737c478bd9Sstevel@tonic-gate releasef(fd);
27747c478bd9Sstevel@tonic-gate }
27757c478bd9Sstevel@tonic-gate }
27767c478bd9Sstevel@tonic-gate
27777c478bd9Sstevel@tonic-gate static au_event_t
aui_labelsys(au_event_t e)277861b9bf51Srica aui_labelsys(au_event_t e)
277961b9bf51Srica {
278061b9bf51Srica klwp_t *clwp = ttolwp(curthread);
278161b9bf51Srica uint32_t code;
278261b9bf51Srica uint32_t cmd;
278361b9bf51Srica
278461b9bf51Srica struct a {
278561b9bf51Srica long code;
278661b9bf51Srica long cmd;
278761b9bf51Srica } *uap = (struct a *)clwp->lwp_ap;
278861b9bf51Srica
278961b9bf51Srica code = (uint32_t)uap->code;
279061b9bf51Srica cmd = (uint32_t)uap->cmd;
279161b9bf51Srica
279261b9bf51Srica /* not security relevant if not changing kernel cache */
279361b9bf51Srica if (cmd == TNDB_GET)
2794d3e710c8SRic Aleshire return (AUE_NULL);
279561b9bf51Srica
279661b9bf51Srica switch (code) {
279761b9bf51Srica case TSOL_TNRH:
279861b9bf51Srica e = AUE_LABELSYS_TNRH;
279961b9bf51Srica break;
280061b9bf51Srica case TSOL_TNRHTP:
280161b9bf51Srica e = AUE_LABELSYS_TNRHTP;
280261b9bf51Srica break;
280361b9bf51Srica case TSOL_TNMLP:
280461b9bf51Srica e = AUE_LABELSYS_TNMLP;
280561b9bf51Srica break;
280661b9bf51Srica default:
280761b9bf51Srica e = AUE_NULL;
280861b9bf51Srica break;
280961b9bf51Srica }
281061b9bf51Srica
281161b9bf51Srica return (e);
281261b9bf51Srica
281361b9bf51Srica }
281461b9bf51Srica
281561b9bf51Srica static void
aus_labelsys(struct t_audit_data * tad)281661b9bf51Srica aus_labelsys(struct t_audit_data *tad)
281761b9bf51Srica {
281861b9bf51Srica klwp_t *clwp = ttolwp(curthread);
281961b9bf51Srica uint32_t cmd;
282061b9bf51Srica uintptr_t a2;
282161b9bf51Srica
282261b9bf51Srica struct a {
282361b9bf51Srica long code;
282461b9bf51Srica long cmd;
282561b9bf51Srica long a2;
282661b9bf51Srica } *uap = (struct a *)clwp->lwp_ap;
282761b9bf51Srica
282861b9bf51Srica cmd = (uint32_t)uap->cmd;
282961b9bf51Srica a2 = (uintptr_t)uap->a2;
283061b9bf51Srica
283161b9bf51Srica switch (tad->tad_event) {
283261b9bf51Srica case AUE_LABELSYS_TNRH:
283361b9bf51Srica {
283461b9bf51Srica tsol_rhent_t *rhent;
283561b9bf51Srica tnaddr_t *rh_addr;
283661b9bf51Srica
283761b9bf51Srica au_uwrite(au_to_arg32(1, "cmd", cmd));
283861b9bf51Srica
283961b9bf51Srica /* Remaining args don't apply for FLUSH, so skip */
284061b9bf51Srica if (cmd == TNDB_FLUSH)
284161b9bf51Srica break;
284261b9bf51Srica
284361b9bf51Srica rhent = kmem_alloc(sizeof (tsol_rhent_t), KM_SLEEP);
284461b9bf51Srica if (copyin((caddr_t)a2, rhent, sizeof (tsol_rhent_t))) {
284561b9bf51Srica kmem_free(rhent, sizeof (tsol_rhent_t));
284661b9bf51Srica return;
284761b9bf51Srica }
284861b9bf51Srica
284961b9bf51Srica rh_addr = &rhent->rh_address;
285061b9bf51Srica if (rh_addr->ta_family == AF_INET) {
285161b9bf51Srica struct in_addr *ipaddr;
285261b9bf51Srica
285361b9bf51Srica ipaddr = &(rh_addr->ta_addr_v4);
285461b9bf51Srica au_uwrite(au_to_in_addr(ipaddr));
285561b9bf51Srica } else if (rh_addr->ta_family == AF_INET6) {
285661b9bf51Srica int32_t *ipaddr;
285761b9bf51Srica
285861b9bf51Srica ipaddr = (int32_t *)&(rh_addr->ta_addr_v6);
285961b9bf51Srica au_uwrite(au_to_in_addr_ex(ipaddr));
286061b9bf51Srica }
286161b9bf51Srica au_uwrite(au_to_arg32(2, "prefix len", rhent->rh_prefix));
286261b9bf51Srica
286361b9bf51Srica kmem_free(rhent, sizeof (tsol_rhent_t));
286461b9bf51Srica
286561b9bf51Srica break;
286661b9bf51Srica }
286761b9bf51Srica case AUE_LABELSYS_TNRHTP:
286861b9bf51Srica {
286961b9bf51Srica tsol_tpent_t *tpent;
287061b9bf51Srica
287161b9bf51Srica au_uwrite(au_to_arg32(1, "cmd", cmd));
287261b9bf51Srica
287361b9bf51Srica /* Remaining args don't apply for FLUSH, so skip */
287461b9bf51Srica if (cmd == TNDB_FLUSH)
287561b9bf51Srica break;
287661b9bf51Srica
287761b9bf51Srica tpent = kmem_alloc(sizeof (tsol_tpent_t), KM_SLEEP);
287861b9bf51Srica if (copyin((caddr_t)a2, tpent, sizeof (tsol_tpent_t))) {
287961b9bf51Srica kmem_free(tpent, sizeof (tsol_tpent_t));
288061b9bf51Srica return;
288161b9bf51Srica }
288261b9bf51Srica
2883d3e710c8SRic Aleshire /* Make sure that the template name is null-terminated. */
2884d3e710c8SRic Aleshire *(tpent->name + TNTNAMSIZ - 1) = '\0';
2885d3e710c8SRic Aleshire
288661b9bf51Srica au_uwrite(au_to_text(tpent->name));
288761b9bf51Srica kmem_free(tpent, sizeof (tsol_tpent_t));
288861b9bf51Srica
288961b9bf51Srica break;
289061b9bf51Srica }
289161b9bf51Srica case AUE_LABELSYS_TNMLP:
289261b9bf51Srica {
289361b9bf51Srica tsol_mlpent_t *mlpent;
289461b9bf51Srica
289561b9bf51Srica au_uwrite(au_to_arg32(1, "cmd", cmd));
289661b9bf51Srica
289761b9bf51Srica mlpent = kmem_alloc(sizeof (tsol_mlpent_t), KM_SLEEP);
289861b9bf51Srica if (copyin((caddr_t)a2, mlpent, sizeof (tsol_mlpent_t))) {
289961b9bf51Srica kmem_free(mlpent, sizeof (tsol_mlpent_t));
290061b9bf51Srica return;
290161b9bf51Srica }
290261b9bf51Srica
290361b9bf51Srica if (mlpent->tsme_flags & TSOL_MEF_SHARED) {
290461b9bf51Srica au_uwrite(au_to_text("shared"));
290561b9bf51Srica } else {
290661b9bf51Srica zone_t *zone;
290761b9bf51Srica
290861b9bf51Srica zone = zone_find_by_id(mlpent->tsme_zoneid);
290961b9bf51Srica if (zone != NULL) {
291061b9bf51Srica au_uwrite(au_to_text(zone->zone_name));
291161b9bf51Srica zone_rele(zone);
291261b9bf51Srica }
291361b9bf51Srica }
291461b9bf51Srica
291561b9bf51Srica /* Remaining args don't apply for FLUSH, so skip */
291661b9bf51Srica if (cmd == TNDB_FLUSH) {
291761b9bf51Srica kmem_free(mlpent, sizeof (tsol_mlpent_t));
291861b9bf51Srica break;
291961b9bf51Srica }
292061b9bf51Srica
292161b9bf51Srica au_uwrite(au_to_arg32(2, "proto num",
292261b9bf51Srica (uint32_t)mlpent->tsme_mlp.mlp_ipp));
292361b9bf51Srica au_uwrite(au_to_arg32(2, "mlp_port",
292461b9bf51Srica (uint32_t)mlpent->tsme_mlp.mlp_port));
292561b9bf51Srica
292661b9bf51Srica if (mlpent->tsme_mlp.mlp_port_upper != 0)
292761b9bf51Srica au_uwrite(au_to_arg32(2, "mlp_port_upper",
292861b9bf51Srica (uint32_t)mlpent->tsme_mlp.mlp_port_upper));
292961b9bf51Srica
293061b9bf51Srica kmem_free(mlpent, sizeof (tsol_mlpent_t));
293161b9bf51Srica
293261b9bf51Srica break;
293361b9bf51Srica }
293461b9bf51Srica default:
293561b9bf51Srica break;
293661b9bf51Srica }
293761b9bf51Srica }
293861b9bf51Srica
293961b9bf51Srica
294061b9bf51Srica static au_event_t
aui_auditsys(au_event_t e)29417c478bd9Sstevel@tonic-gate aui_auditsys(au_event_t e)
29427c478bd9Sstevel@tonic-gate {
29437c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
29447c478bd9Sstevel@tonic-gate uint32_t code;
29457c478bd9Sstevel@tonic-gate
29467c478bd9Sstevel@tonic-gate struct a {
29477c478bd9Sstevel@tonic-gate long code;
29487c478bd9Sstevel@tonic-gate long a1;
29497c478bd9Sstevel@tonic-gate long a2;
29507c478bd9Sstevel@tonic-gate long a3;
29517c478bd9Sstevel@tonic-gate long a4;
29527c478bd9Sstevel@tonic-gate long a5;
29537c478bd9Sstevel@tonic-gate long a6;
29547c478bd9Sstevel@tonic-gate long a7;
29557c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
29567c478bd9Sstevel@tonic-gate
29577c478bd9Sstevel@tonic-gate code = (uint32_t)uap->code;
29587c478bd9Sstevel@tonic-gate
29597c478bd9Sstevel@tonic-gate switch (code) {
29607c478bd9Sstevel@tonic-gate
29617c478bd9Sstevel@tonic-gate case BSM_GETAUID:
29627c478bd9Sstevel@tonic-gate e = AUE_GETAUID;
29637c478bd9Sstevel@tonic-gate break;
29647c478bd9Sstevel@tonic-gate case BSM_SETAUID:
29657c478bd9Sstevel@tonic-gate e = AUE_SETAUID;
29667c478bd9Sstevel@tonic-gate break;
29677c478bd9Sstevel@tonic-gate case BSM_GETAUDIT:
29687c478bd9Sstevel@tonic-gate e = AUE_GETAUDIT;
29697c478bd9Sstevel@tonic-gate break;
29707c478bd9Sstevel@tonic-gate case BSM_GETAUDIT_ADDR:
29717c478bd9Sstevel@tonic-gate e = AUE_GETAUDIT_ADDR;
29727c478bd9Sstevel@tonic-gate break;
29737c478bd9Sstevel@tonic-gate case BSM_SETAUDIT:
29747c478bd9Sstevel@tonic-gate e = AUE_SETAUDIT;
29757c478bd9Sstevel@tonic-gate break;
29767c478bd9Sstevel@tonic-gate case BSM_SETAUDIT_ADDR:
29777c478bd9Sstevel@tonic-gate e = AUE_SETAUDIT_ADDR;
29787c478bd9Sstevel@tonic-gate break;
29797c478bd9Sstevel@tonic-gate case BSM_AUDIT:
29807c478bd9Sstevel@tonic-gate e = AUE_AUDIT;
29817c478bd9Sstevel@tonic-gate break;
29827c478bd9Sstevel@tonic-gate case BSM_AUDITCTL:
29837c478bd9Sstevel@tonic-gate switch ((uint_t)uap->a1) {
29847c478bd9Sstevel@tonic-gate
29857c478bd9Sstevel@tonic-gate case A_GETPOLICY:
29867c478bd9Sstevel@tonic-gate e = AUE_AUDITON_GPOLICY;
29877c478bd9Sstevel@tonic-gate break;
29887c478bd9Sstevel@tonic-gate case A_SETPOLICY:
29897c478bd9Sstevel@tonic-gate e = AUE_AUDITON_SPOLICY;
29907c478bd9Sstevel@tonic-gate break;
2991f8994074SJan Friedel case A_GETAMASK:
2992f8994074SJan Friedel e = AUE_AUDITON_GETAMASK;
2993f8994074SJan Friedel break;
2994f8994074SJan Friedel case A_SETAMASK:
2995f8994074SJan Friedel e = AUE_AUDITON_SETAMASK;
2996f8994074SJan Friedel break;
29977c478bd9Sstevel@tonic-gate case A_GETKMASK:
29987c478bd9Sstevel@tonic-gate e = AUE_AUDITON_GETKMASK;
29997c478bd9Sstevel@tonic-gate break;
30007c478bd9Sstevel@tonic-gate case A_SETKMASK:
30017c478bd9Sstevel@tonic-gate e = AUE_AUDITON_SETKMASK;
30027c478bd9Sstevel@tonic-gate break;
30037c478bd9Sstevel@tonic-gate case A_GETQCTRL:
30047c478bd9Sstevel@tonic-gate e = AUE_AUDITON_GQCTRL;
30057c478bd9Sstevel@tonic-gate break;
30067c478bd9Sstevel@tonic-gate case A_SETQCTRL:
30077c478bd9Sstevel@tonic-gate e = AUE_AUDITON_SQCTRL;
30087c478bd9Sstevel@tonic-gate break;
30097c478bd9Sstevel@tonic-gate case A_GETCWD:
30107c478bd9Sstevel@tonic-gate e = AUE_AUDITON_GETCWD;
30117c478bd9Sstevel@tonic-gate break;
30127c478bd9Sstevel@tonic-gate case A_GETCAR:
30137c478bd9Sstevel@tonic-gate e = AUE_AUDITON_GETCAR;
30147c478bd9Sstevel@tonic-gate break;
30157c478bd9Sstevel@tonic-gate case A_GETSTAT:
30167c478bd9Sstevel@tonic-gate e = AUE_AUDITON_GETSTAT;
30177c478bd9Sstevel@tonic-gate break;
30187c478bd9Sstevel@tonic-gate case A_SETSTAT:
30197c478bd9Sstevel@tonic-gate e = AUE_AUDITON_SETSTAT;
30207c478bd9Sstevel@tonic-gate break;
30217c478bd9Sstevel@tonic-gate case A_SETUMASK:
30227c478bd9Sstevel@tonic-gate e = AUE_AUDITON_SETUMASK;
30237c478bd9Sstevel@tonic-gate break;
30247c478bd9Sstevel@tonic-gate case A_SETSMASK:
30257c478bd9Sstevel@tonic-gate e = AUE_AUDITON_SETSMASK;
30267c478bd9Sstevel@tonic-gate break;
30277c478bd9Sstevel@tonic-gate case A_GETCOND:
30287c478bd9Sstevel@tonic-gate e = AUE_AUDITON_GETCOND;
30297c478bd9Sstevel@tonic-gate break;
30307c478bd9Sstevel@tonic-gate case A_SETCOND:
30317c478bd9Sstevel@tonic-gate e = AUE_AUDITON_SETCOND;
30327c478bd9Sstevel@tonic-gate break;
30337c478bd9Sstevel@tonic-gate case A_GETCLASS:
30347c478bd9Sstevel@tonic-gate e = AUE_AUDITON_GETCLASS;
30357c478bd9Sstevel@tonic-gate break;
30367c478bd9Sstevel@tonic-gate case A_SETCLASS:
30377c478bd9Sstevel@tonic-gate e = AUE_AUDITON_SETCLASS;
30387c478bd9Sstevel@tonic-gate break;
30397c478bd9Sstevel@tonic-gate default:
30407c478bd9Sstevel@tonic-gate e = AUE_NULL;
30417c478bd9Sstevel@tonic-gate break;
30427c478bd9Sstevel@tonic-gate }
30437c478bd9Sstevel@tonic-gate break;
30447c478bd9Sstevel@tonic-gate default:
30457c478bd9Sstevel@tonic-gate e = AUE_NULL;
30467c478bd9Sstevel@tonic-gate break;
30477c478bd9Sstevel@tonic-gate }
30487c478bd9Sstevel@tonic-gate
30497c478bd9Sstevel@tonic-gate return (e);
30507c478bd9Sstevel@tonic-gate
30517c478bd9Sstevel@tonic-gate } /* AUI_AUDITSYS */
30527c478bd9Sstevel@tonic-gate
30537c478bd9Sstevel@tonic-gate
30547c478bd9Sstevel@tonic-gate static void
aus_auditsys(struct t_audit_data * tad)30557c478bd9Sstevel@tonic-gate aus_auditsys(struct t_audit_data *tad)
30567c478bd9Sstevel@tonic-gate {
30577c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
30587c478bd9Sstevel@tonic-gate uintptr_t a1, a2;
30597c478bd9Sstevel@tonic-gate STRUCT_DECL(auditinfo, ainfo);
30607c478bd9Sstevel@tonic-gate STRUCT_DECL(auditinfo_addr, ainfo_addr);
30617c478bd9Sstevel@tonic-gate au_evclass_map_t event;
30627c478bd9Sstevel@tonic-gate au_mask_t mask;
30637c478bd9Sstevel@tonic-gate int auditstate, policy;
3064f2fcf18cStz204579 au_id_t auid;
30657c478bd9Sstevel@tonic-gate
30667c478bd9Sstevel@tonic-gate
30677c478bd9Sstevel@tonic-gate struct a {
30687c478bd9Sstevel@tonic-gate long code;
30697c478bd9Sstevel@tonic-gate long a1;
30707c478bd9Sstevel@tonic-gate long a2;
30717c478bd9Sstevel@tonic-gate long a3;
30727c478bd9Sstevel@tonic-gate long a4;
30737c478bd9Sstevel@tonic-gate long a5;
30747c478bd9Sstevel@tonic-gate long a6;
30757c478bd9Sstevel@tonic-gate long a7;
30767c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
30777c478bd9Sstevel@tonic-gate
30787c478bd9Sstevel@tonic-gate a1 = (uintptr_t)uap->a1;
30797c478bd9Sstevel@tonic-gate a2 = (uintptr_t)uap->a2;
30807c478bd9Sstevel@tonic-gate
30817c478bd9Sstevel@tonic-gate switch (tad->tad_event) {
30827c478bd9Sstevel@tonic-gate case AUE_SETAUID:
3083f2fcf18cStz204579 if (copyin((caddr_t)a1, &auid, sizeof (au_id_t)))
3084f2fcf18cStz204579 return;
3085f2fcf18cStz204579 au_uwrite(au_to_arg32(2, "setauid", auid));
30867c478bd9Sstevel@tonic-gate break;
30877c478bd9Sstevel@tonic-gate case AUE_SETAUDIT:
30887c478bd9Sstevel@tonic-gate STRUCT_INIT(ainfo, get_udatamodel());
30897c478bd9Sstevel@tonic-gate if (copyin((caddr_t)a1, STRUCT_BUF(ainfo),
30907c478bd9Sstevel@tonic-gate STRUCT_SIZE(ainfo))) {
30917c478bd9Sstevel@tonic-gate return;
30927c478bd9Sstevel@tonic-gate }
30937c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32((char)1, "setaudit:auid",
30947c478bd9Sstevel@tonic-gate (uint32_t)STRUCT_FGET(ainfo, ai_auid)));
30957c478bd9Sstevel@tonic-gate #ifdef _LP64
30967c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg64((char)1, "setaudit:port",
30977c478bd9Sstevel@tonic-gate (uint64_t)STRUCT_FGET(ainfo, ai_termid.port)));
30987c478bd9Sstevel@tonic-gate #else
30997c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32((char)1, "setaudit:port",
31007c478bd9Sstevel@tonic-gate (uint32_t)STRUCT_FGET(ainfo, ai_termid.port)));
31017c478bd9Sstevel@tonic-gate #endif
31027c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32((char)1, "setaudit:machine",
31037c478bd9Sstevel@tonic-gate (uint32_t)STRUCT_FGET(ainfo, ai_termid.machine)));
31047c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32((char)1, "setaudit:as_success",
31057c478bd9Sstevel@tonic-gate (uint32_t)STRUCT_FGET(ainfo, ai_mask.as_success)));
31067c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32((char)1, "setaudit:as_failure",
31077c478bd9Sstevel@tonic-gate (uint32_t)STRUCT_FGET(ainfo, ai_mask.as_failure)));
31087c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32((char)1, "setaudit:asid",
31097c478bd9Sstevel@tonic-gate (uint32_t)STRUCT_FGET(ainfo, ai_asid)));
31107c478bd9Sstevel@tonic-gate break;
31117c478bd9Sstevel@tonic-gate case AUE_SETAUDIT_ADDR:
31127c478bd9Sstevel@tonic-gate STRUCT_INIT(ainfo_addr, get_udatamodel());
31137c478bd9Sstevel@tonic-gate if (copyin((caddr_t)a1, STRUCT_BUF(ainfo_addr),
31147c478bd9Sstevel@tonic-gate STRUCT_SIZE(ainfo_addr))) {
31157c478bd9Sstevel@tonic-gate return;
31167c478bd9Sstevel@tonic-gate }
31177c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32((char)1, "auid",
31187c478bd9Sstevel@tonic-gate (uint32_t)STRUCT_FGET(ainfo_addr, ai_auid)));
31197c478bd9Sstevel@tonic-gate #ifdef _LP64
31207c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg64((char)1, "port",
31217c478bd9Sstevel@tonic-gate (uint64_t)STRUCT_FGET(ainfo_addr, ai_termid.at_port)));
31227c478bd9Sstevel@tonic-gate #else
31237c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32((char)1, "port",
31247c478bd9Sstevel@tonic-gate (uint32_t)STRUCT_FGET(ainfo_addr, ai_termid.at_port)));
31257c478bd9Sstevel@tonic-gate #endif
31267c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32((char)1, "type",
31277c478bd9Sstevel@tonic-gate (uint32_t)STRUCT_FGET(ainfo_addr, ai_termid.at_type)));
31287c478bd9Sstevel@tonic-gate if ((uint32_t)STRUCT_FGET(ainfo_addr, ai_termid.at_type) ==
31297c478bd9Sstevel@tonic-gate AU_IPv4) {
31307c478bd9Sstevel@tonic-gate au_uwrite(au_to_in_addr(
31317c478bd9Sstevel@tonic-gate (struct in_addr *)STRUCT_FGETP(ainfo_addr,
31327c478bd9Sstevel@tonic-gate ai_termid.at_addr)));
31337c478bd9Sstevel@tonic-gate } else {
31347c478bd9Sstevel@tonic-gate au_uwrite(au_to_in_addr_ex(
31357c478bd9Sstevel@tonic-gate (int32_t *)STRUCT_FGETP(ainfo_addr,
31367c478bd9Sstevel@tonic-gate ai_termid.at_addr)));
31377c478bd9Sstevel@tonic-gate }
31387c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32((char)1, "as_success",
31397c478bd9Sstevel@tonic-gate (uint32_t)STRUCT_FGET(ainfo_addr, ai_mask.as_success)));
31407c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32((char)1, "as_failure",
31417c478bd9Sstevel@tonic-gate (uint32_t)STRUCT_FGET(ainfo_addr, ai_mask.as_failure)));
31427c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32((char)1, "asid",
31437c478bd9Sstevel@tonic-gate (uint32_t)STRUCT_FGET(ainfo_addr, ai_asid)));
31447c478bd9Sstevel@tonic-gate break;
3145f8994074SJan Friedel case AUE_AUDITON_SETAMASK:
3146f8994074SJan Friedel if (copyin((caddr_t)a2, &mask, sizeof (au_mask_t)))
3147f8994074SJan Friedel return;
3148f8994074SJan Friedel au_uwrite(au_to_arg32(
3149f8994074SJan Friedel 2, "setamask:as_success", (uint32_t)mask.as_success));
3150f8994074SJan Friedel au_uwrite(au_to_arg32(
3151f8994074SJan Friedel 2, "setamask:as_failure", (uint32_t)mask.as_failure));
3152f8994074SJan Friedel break;
31537c478bd9Sstevel@tonic-gate case AUE_AUDITON_SETKMASK:
31547c478bd9Sstevel@tonic-gate if (copyin((caddr_t)a2, &mask, sizeof (au_mask_t)))
31557c478bd9Sstevel@tonic-gate return;
31567c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(
31577c478bd9Sstevel@tonic-gate 2, "setkmask:as_success", (uint32_t)mask.as_success));
31587c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(
31597c478bd9Sstevel@tonic-gate 2, "setkmask:as_failure", (uint32_t)mask.as_failure));
31607c478bd9Sstevel@tonic-gate break;
31617c478bd9Sstevel@tonic-gate case AUE_AUDITON_SPOLICY:
31627c478bd9Sstevel@tonic-gate if (copyin((caddr_t)a2, &policy, sizeof (int)))
31637c478bd9Sstevel@tonic-gate return;
31647c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(3, "setpolicy", (uint32_t)policy));
31657c478bd9Sstevel@tonic-gate break;
31667c478bd9Sstevel@tonic-gate case AUE_AUDITON_SQCTRL: {
31677c478bd9Sstevel@tonic-gate STRUCT_DECL(au_qctrl, qctrl);
31687c478bd9Sstevel@tonic-gate model_t model;
31697c478bd9Sstevel@tonic-gate
31707c478bd9Sstevel@tonic-gate model = get_udatamodel();
31717c478bd9Sstevel@tonic-gate STRUCT_INIT(qctrl, model);
31727c478bd9Sstevel@tonic-gate if (copyin((caddr_t)a2, STRUCT_BUF(qctrl), STRUCT_SIZE(qctrl)))
31737c478bd9Sstevel@tonic-gate return;
31747c478bd9Sstevel@tonic-gate if (model == DATAMODEL_ILP32) {
31757c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(
31767c478bd9Sstevel@tonic-gate 3, "setqctrl:aq_hiwater",
31777c478bd9Sstevel@tonic-gate (uint32_t)STRUCT_FGET(qctrl, aq_hiwater)));
31787c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(
31797c478bd9Sstevel@tonic-gate 3, "setqctrl:aq_lowater",
31807c478bd9Sstevel@tonic-gate (uint32_t)STRUCT_FGET(qctrl, aq_lowater)));
31817c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(
31827c478bd9Sstevel@tonic-gate 3, "setqctrl:aq_bufsz",
31837c478bd9Sstevel@tonic-gate (uint32_t)STRUCT_FGET(qctrl, aq_bufsz)));
31847c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(
31857c478bd9Sstevel@tonic-gate 3, "setqctrl:aq_delay",
31867c478bd9Sstevel@tonic-gate (uint32_t)STRUCT_FGET(qctrl, aq_delay)));
31877c478bd9Sstevel@tonic-gate } else {
31887c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg64(
31897c478bd9Sstevel@tonic-gate 3, "setqctrl:aq_hiwater",
31907c478bd9Sstevel@tonic-gate (uint64_t)STRUCT_FGET(qctrl, aq_hiwater)));
31917c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg64(
31927c478bd9Sstevel@tonic-gate 3, "setqctrl:aq_lowater",
31937c478bd9Sstevel@tonic-gate (uint64_t)STRUCT_FGET(qctrl, aq_lowater)));
31947c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg64(
31957c478bd9Sstevel@tonic-gate 3, "setqctrl:aq_bufsz",
31967c478bd9Sstevel@tonic-gate (uint64_t)STRUCT_FGET(qctrl, aq_bufsz)));
31977c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg64(
31987c478bd9Sstevel@tonic-gate 3, "setqctrl:aq_delay",
31997c478bd9Sstevel@tonic-gate (uint64_t)STRUCT_FGET(qctrl, aq_delay)));
32007c478bd9Sstevel@tonic-gate }
32017c478bd9Sstevel@tonic-gate break;
32027c478bd9Sstevel@tonic-gate }
32037c478bd9Sstevel@tonic-gate case AUE_AUDITON_SETUMASK:
32047c478bd9Sstevel@tonic-gate STRUCT_INIT(ainfo, get_udatamodel());
32057c478bd9Sstevel@tonic-gate if (copyin((caddr_t)uap->a2, STRUCT_BUF(ainfo),
32067c478bd9Sstevel@tonic-gate STRUCT_SIZE(ainfo))) {
32077c478bd9Sstevel@tonic-gate return;
32087c478bd9Sstevel@tonic-gate }
32097c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(3, "setumask:as_success",
32107c478bd9Sstevel@tonic-gate (uint32_t)STRUCT_FGET(ainfo, ai_mask.as_success)));
32117c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(3, "setumask:as_failure",
32127c478bd9Sstevel@tonic-gate (uint32_t)STRUCT_FGET(ainfo, ai_mask.as_failure)));
32137c478bd9Sstevel@tonic-gate break;
32147c478bd9Sstevel@tonic-gate case AUE_AUDITON_SETSMASK:
32157c478bd9Sstevel@tonic-gate STRUCT_INIT(ainfo, get_udatamodel());
32167c478bd9Sstevel@tonic-gate if (copyin((caddr_t)uap->a2, STRUCT_BUF(ainfo),
32177c478bd9Sstevel@tonic-gate STRUCT_SIZE(ainfo))) {
32187c478bd9Sstevel@tonic-gate return;
32197c478bd9Sstevel@tonic-gate }
32207c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(3, "setsmask:as_success",
32217c478bd9Sstevel@tonic-gate (uint32_t)STRUCT_FGET(ainfo, ai_mask.as_success)));
32227c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(3, "setsmask:as_failure",
32237c478bd9Sstevel@tonic-gate (uint32_t)STRUCT_FGET(ainfo, ai_mask.as_failure)));
32247c478bd9Sstevel@tonic-gate break;
32257c478bd9Sstevel@tonic-gate case AUE_AUDITON_SETCOND:
32267c478bd9Sstevel@tonic-gate if (copyin((caddr_t)a2, &auditstate, sizeof (int)))
32277c478bd9Sstevel@tonic-gate return;
32287c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(3, "setcond", (uint32_t)auditstate));
32297c478bd9Sstevel@tonic-gate break;
32307c478bd9Sstevel@tonic-gate case AUE_AUDITON_SETCLASS:
32317c478bd9Sstevel@tonic-gate if (copyin((caddr_t)a2, &event, sizeof (au_evclass_map_t)))
32327c478bd9Sstevel@tonic-gate return;
32337c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(
32347c478bd9Sstevel@tonic-gate 2, "setclass:ec_event", (uint32_t)event.ec_number));
32357c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(
32367c478bd9Sstevel@tonic-gate 3, "setclass:ec_class", (uint32_t)event.ec_class));
32377c478bd9Sstevel@tonic-gate break;
32387c478bd9Sstevel@tonic-gate case AUE_GETAUID:
32397c478bd9Sstevel@tonic-gate case AUE_GETAUDIT:
32407c478bd9Sstevel@tonic-gate case AUE_GETAUDIT_ADDR:
32417c478bd9Sstevel@tonic-gate case AUE_AUDIT:
32427c478bd9Sstevel@tonic-gate case AUE_AUDITON_GPOLICY:
32437c478bd9Sstevel@tonic-gate case AUE_AUDITON_GQCTRL:
3244f8994074SJan Friedel case AUE_AUDITON_GETAMASK:
32457c478bd9Sstevel@tonic-gate case AUE_AUDITON_GETKMASK:
32467c478bd9Sstevel@tonic-gate case AUE_AUDITON_GETCWD:
32477c478bd9Sstevel@tonic-gate case AUE_AUDITON_GETCAR:
32487c478bd9Sstevel@tonic-gate case AUE_AUDITON_GETSTAT:
32497c478bd9Sstevel@tonic-gate case AUE_AUDITON_SETSTAT:
32507c478bd9Sstevel@tonic-gate case AUE_AUDITON_GETCOND:
32517c478bd9Sstevel@tonic-gate case AUE_AUDITON_GETCLASS:
32527c478bd9Sstevel@tonic-gate break;
32537c478bd9Sstevel@tonic-gate default:
32547c478bd9Sstevel@tonic-gate break;
32557c478bd9Sstevel@tonic-gate }
32567c478bd9Sstevel@tonic-gate
32577c478bd9Sstevel@tonic-gate } /* AUS_AUDITSYS */
32587c478bd9Sstevel@tonic-gate
32597c478bd9Sstevel@tonic-gate
32607c478bd9Sstevel@tonic-gate /* only audit privileged operations for systeminfo(2) system call */
32617c478bd9Sstevel@tonic-gate static au_event_t
aui_sysinfo(au_event_t e)32627c478bd9Sstevel@tonic-gate aui_sysinfo(au_event_t e)
32637c478bd9Sstevel@tonic-gate {
32647c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
32657c478bd9Sstevel@tonic-gate uint32_t command;
32667c478bd9Sstevel@tonic-gate
32677c478bd9Sstevel@tonic-gate struct a {
32687c478bd9Sstevel@tonic-gate long command;
32697c478bd9Sstevel@tonic-gate long buf; /* char * */
32707c478bd9Sstevel@tonic-gate long count;
32717c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
32727c478bd9Sstevel@tonic-gate
32737c478bd9Sstevel@tonic-gate command = (uint32_t)uap->command;
32747c478bd9Sstevel@tonic-gate
32757c478bd9Sstevel@tonic-gate switch (command) {
32767c478bd9Sstevel@tonic-gate case SI_SET_HOSTNAME:
32777c478bd9Sstevel@tonic-gate case SI_SET_SRPC_DOMAIN:
32787c478bd9Sstevel@tonic-gate e = (au_event_t)AUE_SYSINFO;
32797c478bd9Sstevel@tonic-gate break;
32807c478bd9Sstevel@tonic-gate default:
32817c478bd9Sstevel@tonic-gate e = (au_event_t)AUE_NULL;
32827c478bd9Sstevel@tonic-gate break;
32837c478bd9Sstevel@tonic-gate }
32847c478bd9Sstevel@tonic-gate return (e);
32857c478bd9Sstevel@tonic-gate }
32867c478bd9Sstevel@tonic-gate
32877c478bd9Sstevel@tonic-gate /*ARGSUSED*/
32887c478bd9Sstevel@tonic-gate static void
aus_sysinfo(struct t_audit_data * tad)32897c478bd9Sstevel@tonic-gate aus_sysinfo(struct t_audit_data *tad)
32907c478bd9Sstevel@tonic-gate {
32917c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
32927c478bd9Sstevel@tonic-gate uint32_t command;
32937c478bd9Sstevel@tonic-gate size_t len, maxlen;
32947c478bd9Sstevel@tonic-gate char *name;
32957c478bd9Sstevel@tonic-gate uintptr_t buf;
32967c478bd9Sstevel@tonic-gate
32977c478bd9Sstevel@tonic-gate struct a {
32987c478bd9Sstevel@tonic-gate long command;
32997c478bd9Sstevel@tonic-gate long buf; /* char * */
33007c478bd9Sstevel@tonic-gate long count;
33017c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
33027c478bd9Sstevel@tonic-gate
33037c478bd9Sstevel@tonic-gate command = (uint32_t)uap->command;
33047c478bd9Sstevel@tonic-gate buf = (uintptr_t)uap->buf;
33057c478bd9Sstevel@tonic-gate
33067c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "cmd", command));
33077c478bd9Sstevel@tonic-gate
33087c478bd9Sstevel@tonic-gate switch (command) {
33097c478bd9Sstevel@tonic-gate case SI_SET_HOSTNAME:
33107c478bd9Sstevel@tonic-gate {
33117c478bd9Sstevel@tonic-gate if (secpolicy_sys_config(CRED(), B_TRUE) != 0)
33127c478bd9Sstevel@tonic-gate return;
33137c478bd9Sstevel@tonic-gate
33147c478bd9Sstevel@tonic-gate maxlen = SYS_NMLN;
33157c478bd9Sstevel@tonic-gate name = kmem_alloc(maxlen, KM_SLEEP);
33167c478bd9Sstevel@tonic-gate if (copyinstr((caddr_t)buf, name, SYS_NMLN, &len))
33177c478bd9Sstevel@tonic-gate break;
33187c478bd9Sstevel@tonic-gate
33197c478bd9Sstevel@tonic-gate /*
33207c478bd9Sstevel@tonic-gate * Must be non-NULL string and string
33217c478bd9Sstevel@tonic-gate * must be less than SYS_NMLN chars.
33227c478bd9Sstevel@tonic-gate */
33237c478bd9Sstevel@tonic-gate if (len < 2 || (len == SYS_NMLN && name[SYS_NMLN - 1] != '\0'))
33247c478bd9Sstevel@tonic-gate break;
33257c478bd9Sstevel@tonic-gate
33267c478bd9Sstevel@tonic-gate au_uwrite(au_to_text(name));
33277c478bd9Sstevel@tonic-gate break;
33287c478bd9Sstevel@tonic-gate }
33297c478bd9Sstevel@tonic-gate
33307c478bd9Sstevel@tonic-gate case SI_SET_SRPC_DOMAIN:
33317c478bd9Sstevel@tonic-gate {
33327c478bd9Sstevel@tonic-gate if (secpolicy_sys_config(CRED(), B_TRUE) != 0)
33337c478bd9Sstevel@tonic-gate return;
33347c478bd9Sstevel@tonic-gate
33357c478bd9Sstevel@tonic-gate maxlen = SYS_NMLN;
33367c478bd9Sstevel@tonic-gate name = kmem_alloc(maxlen, KM_SLEEP);
33377c478bd9Sstevel@tonic-gate if (copyinstr((caddr_t)buf, name, SYS_NMLN, &len))
33387c478bd9Sstevel@tonic-gate break;
33397c478bd9Sstevel@tonic-gate
33407c478bd9Sstevel@tonic-gate /*
33417c478bd9Sstevel@tonic-gate * If string passed in is longer than length
33427c478bd9Sstevel@tonic-gate * allowed for domain name, fail.
33437c478bd9Sstevel@tonic-gate */
33447c478bd9Sstevel@tonic-gate if (len == SYS_NMLN && name[SYS_NMLN - 1] != '\0')
33457c478bd9Sstevel@tonic-gate break;
33467c478bd9Sstevel@tonic-gate
33477c478bd9Sstevel@tonic-gate au_uwrite(au_to_text(name));
33487c478bd9Sstevel@tonic-gate break;
33497c478bd9Sstevel@tonic-gate }
33507c478bd9Sstevel@tonic-gate
33517c478bd9Sstevel@tonic-gate default:
33527c478bd9Sstevel@tonic-gate return;
33537c478bd9Sstevel@tonic-gate }
33547c478bd9Sstevel@tonic-gate
33557c478bd9Sstevel@tonic-gate kmem_free(name, maxlen);
33567c478bd9Sstevel@tonic-gate }
33577c478bd9Sstevel@tonic-gate
33587c478bd9Sstevel@tonic-gate static au_event_t
aui_modctl(au_event_t e)33597c478bd9Sstevel@tonic-gate aui_modctl(au_event_t e)
33607c478bd9Sstevel@tonic-gate {
33617c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
33627c478bd9Sstevel@tonic-gate uint_t cmd;
33637c478bd9Sstevel@tonic-gate
33647c478bd9Sstevel@tonic-gate struct a {
33657c478bd9Sstevel@tonic-gate long cmd;
33667c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
33677c478bd9Sstevel@tonic-gate
33687c478bd9Sstevel@tonic-gate cmd = (uint_t)uap->cmd;
33697c478bd9Sstevel@tonic-gate
33707c478bd9Sstevel@tonic-gate switch (cmd) {
33717c478bd9Sstevel@tonic-gate case MODLOAD:
33727c478bd9Sstevel@tonic-gate e = AUE_MODLOAD;
33737c478bd9Sstevel@tonic-gate break;
33747c478bd9Sstevel@tonic-gate case MODUNLOAD:
33757c478bd9Sstevel@tonic-gate e = AUE_MODUNLOAD;
33767c478bd9Sstevel@tonic-gate break;
33777c478bd9Sstevel@tonic-gate case MODADDMAJBIND:
33787c478bd9Sstevel@tonic-gate e = AUE_MODADDMAJ;
33797c478bd9Sstevel@tonic-gate break;
33807c478bd9Sstevel@tonic-gate case MODSETDEVPOLICY:
33817c478bd9Sstevel@tonic-gate e = AUE_MODDEVPLCY;
33827c478bd9Sstevel@tonic-gate break;
33837c478bd9Sstevel@tonic-gate case MODALLOCPRIV:
33847c478bd9Sstevel@tonic-gate e = AUE_MODADDPRIV;
33857c478bd9Sstevel@tonic-gate break;
33867c478bd9Sstevel@tonic-gate default:
33877c478bd9Sstevel@tonic-gate e = AUE_NULL;
33887c478bd9Sstevel@tonic-gate break;
33897c478bd9Sstevel@tonic-gate }
33907c478bd9Sstevel@tonic-gate return (e);
33917c478bd9Sstevel@tonic-gate }
33927c478bd9Sstevel@tonic-gate
33937c478bd9Sstevel@tonic-gate
33947c478bd9Sstevel@tonic-gate /*ARGSUSED*/
33957c478bd9Sstevel@tonic-gate static void
aus_modctl(struct t_audit_data * tad)33967c478bd9Sstevel@tonic-gate aus_modctl(struct t_audit_data *tad)
33977c478bd9Sstevel@tonic-gate {
33987c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
33997c478bd9Sstevel@tonic-gate void *a = clwp->lwp_ap;
34007c478bd9Sstevel@tonic-gate uint_t use_path;
34017c478bd9Sstevel@tonic-gate
34027c478bd9Sstevel@tonic-gate switch (tad->tad_event) {
34037c478bd9Sstevel@tonic-gate case AUE_MODLOAD: {
34047c478bd9Sstevel@tonic-gate typedef struct {
34057c478bd9Sstevel@tonic-gate long cmd;
34067c478bd9Sstevel@tonic-gate long use_path;
34077c478bd9Sstevel@tonic-gate long filename; /* char * */
34087c478bd9Sstevel@tonic-gate } modloada_t;
34097c478bd9Sstevel@tonic-gate
34107c478bd9Sstevel@tonic-gate char *filenamep;
34117c478bd9Sstevel@tonic-gate uintptr_t fname;
34127c478bd9Sstevel@tonic-gate extern char *default_path;
34137c478bd9Sstevel@tonic-gate
34147c478bd9Sstevel@tonic-gate fname = (uintptr_t)((modloada_t *)a)->filename;
34157c478bd9Sstevel@tonic-gate use_path = (uint_t)((modloada_t *)a)->use_path;
34167c478bd9Sstevel@tonic-gate
34177c478bd9Sstevel@tonic-gate /* space to hold path */
34187c478bd9Sstevel@tonic-gate filenamep = kmem_alloc(MOD_MAXPATH, KM_SLEEP);
34197c478bd9Sstevel@tonic-gate /* get string */
34207c478bd9Sstevel@tonic-gate if (copyinstr((caddr_t)fname, filenamep, MOD_MAXPATH, 0)) {
34217c478bd9Sstevel@tonic-gate /* free allocated path */
34227c478bd9Sstevel@tonic-gate kmem_free(filenamep, MOD_MAXPATH);
34237c478bd9Sstevel@tonic-gate return;
34247c478bd9Sstevel@tonic-gate }
34257c478bd9Sstevel@tonic-gate /* ensure it's null terminated */
34267c478bd9Sstevel@tonic-gate filenamep[MOD_MAXPATH - 1] = 0;
34277c478bd9Sstevel@tonic-gate
34287c478bd9Sstevel@tonic-gate if (use_path)
34297c478bd9Sstevel@tonic-gate au_uwrite(au_to_text(default_path));
34307c478bd9Sstevel@tonic-gate au_uwrite(au_to_text(filenamep));
34317c478bd9Sstevel@tonic-gate
34327c478bd9Sstevel@tonic-gate /* release temporary memory */
34337c478bd9Sstevel@tonic-gate kmem_free(filenamep, MOD_MAXPATH);
34347c478bd9Sstevel@tonic-gate break;
34357c478bd9Sstevel@tonic-gate }
34367c478bd9Sstevel@tonic-gate case AUE_MODUNLOAD: {
34377c478bd9Sstevel@tonic-gate typedef struct {
34387c478bd9Sstevel@tonic-gate long cmd;
34397c478bd9Sstevel@tonic-gate long id;
34407c478bd9Sstevel@tonic-gate } modunloada_t;
34417c478bd9Sstevel@tonic-gate
34427c478bd9Sstevel@tonic-gate uint32_t id = (uint32_t)((modunloada_t *)a)->id;
34437c478bd9Sstevel@tonic-gate
34447c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "id", id));
34457c478bd9Sstevel@tonic-gate break;
34467c478bd9Sstevel@tonic-gate }
34477c478bd9Sstevel@tonic-gate case AUE_MODADDMAJ: {
34487c478bd9Sstevel@tonic-gate STRUCT_DECL(modconfig, mc);
34497c478bd9Sstevel@tonic-gate typedef struct {
34507c478bd9Sstevel@tonic-gate long cmd;
34517c478bd9Sstevel@tonic-gate long subcmd;
34527c478bd9Sstevel@tonic-gate long data; /* int * */
34537c478bd9Sstevel@tonic-gate } modconfiga_t;
34547c478bd9Sstevel@tonic-gate
34557c478bd9Sstevel@tonic-gate STRUCT_DECL(aliases, alias);
34567c478bd9Sstevel@tonic-gate caddr_t ap;
34577c478bd9Sstevel@tonic-gate int i, num_aliases;
34587c478bd9Sstevel@tonic-gate char *drvname, *mc_drvname;
34597c478bd9Sstevel@tonic-gate char *name;
34607c478bd9Sstevel@tonic-gate extern char *ddi_major_to_name(major_t);
34617c478bd9Sstevel@tonic-gate model_t model;
34627c478bd9Sstevel@tonic-gate
34637c478bd9Sstevel@tonic-gate uintptr_t data = (uintptr_t)((modconfiga_t *)a)->data;
34647c478bd9Sstevel@tonic-gate
34657c478bd9Sstevel@tonic-gate model = get_udatamodel();
34667c478bd9Sstevel@tonic-gate STRUCT_INIT(mc, model);
34677c478bd9Sstevel@tonic-gate /* sanitize buffer */
34687c478bd9Sstevel@tonic-gate bzero((caddr_t)STRUCT_BUF(mc), STRUCT_SIZE(mc));
34697c478bd9Sstevel@tonic-gate /* get user arguments */
34707c478bd9Sstevel@tonic-gate if (copyin((caddr_t)data, (caddr_t)STRUCT_BUF(mc),
34717c478bd9Sstevel@tonic-gate STRUCT_SIZE(mc)) != 0)
34727c478bd9Sstevel@tonic-gate return;
34737c478bd9Sstevel@tonic-gate
34747c478bd9Sstevel@tonic-gate mc_drvname = STRUCT_FGET(mc, drvname);
34757c478bd9Sstevel@tonic-gate if ((drvname = ddi_major_to_name(
34767c478bd9Sstevel@tonic-gate (major_t)STRUCT_FGET(mc, major))) != NULL &&
34777c478bd9Sstevel@tonic-gate strncmp(drvname, mc_drvname, MAXMODCONFNAME) != 0) {
34787c478bd9Sstevel@tonic-gate /* safety */
34797c478bd9Sstevel@tonic-gate if (mc_drvname[0] != '\0') {
34807c478bd9Sstevel@tonic-gate mc_drvname[MAXMODCONFNAME-1] = '\0';
34817c478bd9Sstevel@tonic-gate au_uwrite(au_to_text(mc_drvname));
34827c478bd9Sstevel@tonic-gate }
34837c478bd9Sstevel@tonic-gate /* drvname != NULL from test above */
34847c478bd9Sstevel@tonic-gate au_uwrite(au_to_text(drvname));
34857c478bd9Sstevel@tonic-gate return;
34867c478bd9Sstevel@tonic-gate }
34877c478bd9Sstevel@tonic-gate
34887c478bd9Sstevel@tonic-gate if (mc_drvname[0] != '\0') {
34897c478bd9Sstevel@tonic-gate /* safety */
34907c478bd9Sstevel@tonic-gate mc_drvname[MAXMODCONFNAME-1] = '\0';
34917c478bd9Sstevel@tonic-gate au_uwrite(au_to_text(mc_drvname));
34927c478bd9Sstevel@tonic-gate } else
34937c478bd9Sstevel@tonic-gate au_uwrite(au_to_text("no drvname"));
34947c478bd9Sstevel@tonic-gate
34957c478bd9Sstevel@tonic-gate num_aliases = STRUCT_FGET(mc, num_aliases);
34967c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(5, "", (uint32_t)num_aliases));
34977c478bd9Sstevel@tonic-gate ap = (caddr_t)STRUCT_FGETP(mc, ap);
34987c478bd9Sstevel@tonic-gate name = kmem_alloc(MAXMODCONFNAME, KM_SLEEP);
34997c478bd9Sstevel@tonic-gate STRUCT_INIT(alias, model);
35007c478bd9Sstevel@tonic-gate for (i = 0; i < num_aliases; i++) {
35017c478bd9Sstevel@tonic-gate bzero((caddr_t)STRUCT_BUF(alias),
35027c478bd9Sstevel@tonic-gate STRUCT_SIZE(alias));
35037c478bd9Sstevel@tonic-gate if (copyin((caddr_t)ap, (caddr_t)STRUCT_BUF(alias),
35047c478bd9Sstevel@tonic-gate STRUCT_SIZE(alias)) != 0)
35057c478bd9Sstevel@tonic-gate break;
35067c478bd9Sstevel@tonic-gate if (copyinstr(STRUCT_FGETP(alias, a_name), name,
35077c478bd9Sstevel@tonic-gate MAXMODCONFNAME, NULL) != 0) {
35087c478bd9Sstevel@tonic-gate break;
35097c478bd9Sstevel@tonic-gate }
35107c478bd9Sstevel@tonic-gate
35117c478bd9Sstevel@tonic-gate au_uwrite(au_to_text(name));
35127c478bd9Sstevel@tonic-gate ap = (caddr_t)STRUCT_FGETP(alias, a_next);
35137c478bd9Sstevel@tonic-gate }
35147c478bd9Sstevel@tonic-gate kmem_free(name, MAXMODCONFNAME);
35157c478bd9Sstevel@tonic-gate break;
35167c478bd9Sstevel@tonic-gate }
35177c478bd9Sstevel@tonic-gate default:
35187c478bd9Sstevel@tonic-gate break;
35197c478bd9Sstevel@tonic-gate }
35207c478bd9Sstevel@tonic-gate }
35217c478bd9Sstevel@tonic-gate
35227c478bd9Sstevel@tonic-gate
35237c478bd9Sstevel@tonic-gate /*ARGSUSED*/
35247c478bd9Sstevel@tonic-gate static void
auf_accept(struct t_audit_data * tad,int error,rval_t * rval)35257c478bd9Sstevel@tonic-gate auf_accept(
35267c478bd9Sstevel@tonic-gate struct t_audit_data *tad,
35277c478bd9Sstevel@tonic-gate int error,
35287c478bd9Sstevel@tonic-gate rval_t *rval)
35297c478bd9Sstevel@tonic-gate {
35307c478bd9Sstevel@tonic-gate uint32_t scid;
35317c478bd9Sstevel@tonic-gate uint32_t sy_flags;
35327c478bd9Sstevel@tonic-gate int fd;
35337c478bd9Sstevel@tonic-gate struct sonode *so;
35347c478bd9Sstevel@tonic-gate char so_laddr[sizeof (struct sockaddr_in6)];
35357c478bd9Sstevel@tonic-gate char so_faddr[sizeof (struct sockaddr_in6)];
35367c478bd9Sstevel@tonic-gate int err;
35377c478bd9Sstevel@tonic-gate short so_family, so_type;
35387c478bd9Sstevel@tonic-gate int add_sock_token = 0;
35397c478bd9Sstevel@tonic-gate
35407c478bd9Sstevel@tonic-gate /* need to determine type of executing binary */
35417c478bd9Sstevel@tonic-gate scid = tad->tad_scid;
35427c478bd9Sstevel@tonic-gate #ifdef _SYSCALL32_IMPL
35437c478bd9Sstevel@tonic-gate if (lwp_getdatamodel(ttolwp(curthread)) == DATAMODEL_NATIVE)
35447c478bd9Sstevel@tonic-gate sy_flags = sysent[scid].sy_flags & SE_RVAL_MASK;
35457c478bd9Sstevel@tonic-gate else
35467c478bd9Sstevel@tonic-gate sy_flags = sysent32[scid].sy_flags & SE_RVAL_MASK;
35477c478bd9Sstevel@tonic-gate #else
35487c478bd9Sstevel@tonic-gate sy_flags = sysent[scid].sy_flags & SE_RVAL_MASK;
35497c478bd9Sstevel@tonic-gate #endif
3550aeba2189SMarek Pospisil switch (sy_flags) {
3551aeba2189SMarek Pospisil case SE_32RVAL1:
3552aeba2189SMarek Pospisil /* FALLTHRU */
3553aeba2189SMarek Pospisil case SE_32RVAL2|SE_32RVAL1:
35547c478bd9Sstevel@tonic-gate fd = rval->r_val1;
3555aeba2189SMarek Pospisil break;
3556aeba2189SMarek Pospisil case SE_64RVAL:
35577c478bd9Sstevel@tonic-gate fd = (int)rval->r_vals;
3558aeba2189SMarek Pospisil break;
3559aeba2189SMarek Pospisil default:
3560aeba2189SMarek Pospisil /*
3561aeba2189SMarek Pospisil * should never happen, seems to be an internal error
3562aeba2189SMarek Pospisil * in sysent => no fd, nothing to audit here, returning
3563aeba2189SMarek Pospisil */
3564aeba2189SMarek Pospisil return;
3565aeba2189SMarek Pospisil }
35667c478bd9Sstevel@tonic-gate
35677c478bd9Sstevel@tonic-gate if (error) {
35687c478bd9Sstevel@tonic-gate /* can't trust socket contents. Just return */
35697c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
35707c478bd9Sstevel@tonic-gate return;
35717c478bd9Sstevel@tonic-gate }
35727c478bd9Sstevel@tonic-gate
3573745b2690Stz204579 if ((so = getsonode(fd, &err, NULL)) == NULL) {
35747c478bd9Sstevel@tonic-gate /*
35757c478bd9Sstevel@tonic-gate * not security relevant if doing a accept from non socket
35767c478bd9Sstevel@tonic-gate * so no extra tokens. Should probably turn off audit record
35777c478bd9Sstevel@tonic-gate * generation here.
35787c478bd9Sstevel@tonic-gate */
35797c478bd9Sstevel@tonic-gate return;
35807c478bd9Sstevel@tonic-gate }
35817c478bd9Sstevel@tonic-gate
35827c478bd9Sstevel@tonic-gate so_family = so->so_family;
35837c478bd9Sstevel@tonic-gate so_type = so->so_type;
35847c478bd9Sstevel@tonic-gate
35857c478bd9Sstevel@tonic-gate switch (so_family) {
35867c478bd9Sstevel@tonic-gate case AF_INET:
35877c478bd9Sstevel@tonic-gate case AF_INET6:
35887c478bd9Sstevel@tonic-gate /*
35897c478bd9Sstevel@tonic-gate * XXX - what about other socket types for AF_INET (e.g. DGRAM)
35907c478bd9Sstevel@tonic-gate */
35917c478bd9Sstevel@tonic-gate if (so->so_type == SOCK_STREAM) {
35920f1702c5SYu Xiangning socklen_t len;
35937c478bd9Sstevel@tonic-gate
35947c478bd9Sstevel@tonic-gate bzero((void *)so_laddr, sizeof (so_laddr));
35957c478bd9Sstevel@tonic-gate bzero((void *)so_faddr, sizeof (so_faddr));
35967c478bd9Sstevel@tonic-gate
35970f1702c5SYu Xiangning len = sizeof (so_laddr);
35980f1702c5SYu Xiangning (void) socket_getsockname(so,
35990f1702c5SYu Xiangning (struct sockaddr *)so_laddr, &len, CRED());
36000f1702c5SYu Xiangning len = sizeof (so_faddr);
36010f1702c5SYu Xiangning (void) socket_getpeername(so,
36020f1702c5SYu Xiangning (struct sockaddr *)so_faddr, &len, B_FALSE, CRED());
36037c478bd9Sstevel@tonic-gate
36047c478bd9Sstevel@tonic-gate add_sock_token = 1;
36057c478bd9Sstevel@tonic-gate }
36067c478bd9Sstevel@tonic-gate break;
36077c478bd9Sstevel@tonic-gate
36087c478bd9Sstevel@tonic-gate default:
36097c478bd9Sstevel@tonic-gate /* AF_UNIX, AF_ROUTE, AF_KEY do not support accept */
36107c478bd9Sstevel@tonic-gate break;
36117c478bd9Sstevel@tonic-gate }
36127c478bd9Sstevel@tonic-gate
36137c478bd9Sstevel@tonic-gate releasef(fd);
36147c478bd9Sstevel@tonic-gate
36157c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
36167c478bd9Sstevel@tonic-gate
36177c478bd9Sstevel@tonic-gate if (add_sock_token == 0) {
36187c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(0, "family", (uint32_t)(so_family)));
36197c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(0, "type", (uint32_t)(so_type)));
36207c478bd9Sstevel@tonic-gate return;
36217c478bd9Sstevel@tonic-gate }
36227c478bd9Sstevel@tonic-gate
36237c478bd9Sstevel@tonic-gate au_uwrite(au_to_socket_ex(so_family, so_type, so_laddr, so_faddr));
36247c478bd9Sstevel@tonic-gate
36257c478bd9Sstevel@tonic-gate }
36267c478bd9Sstevel@tonic-gate
36277c478bd9Sstevel@tonic-gate /*ARGSUSED*/
36287c478bd9Sstevel@tonic-gate static void
auf_bind(struct t_audit_data * tad,int error,rval_t * rvp)36297c478bd9Sstevel@tonic-gate auf_bind(struct t_audit_data *tad, int error, rval_t *rvp)
36307c478bd9Sstevel@tonic-gate {
36317c478bd9Sstevel@tonic-gate struct a {
36327c478bd9Sstevel@tonic-gate long fd;
36337c478bd9Sstevel@tonic-gate long addr;
36347c478bd9Sstevel@tonic-gate long len;
36357c478bd9Sstevel@tonic-gate } *uap = (struct a *)ttolwp(curthread)->lwp_ap;
36367c478bd9Sstevel@tonic-gate
36377c478bd9Sstevel@tonic-gate struct sonode *so;
36387c478bd9Sstevel@tonic-gate char so_laddr[sizeof (struct sockaddr_in6)];
36397c478bd9Sstevel@tonic-gate char so_faddr[sizeof (struct sockaddr_in6)];
36407c478bd9Sstevel@tonic-gate int err, fd;
36410f1702c5SYu Xiangning socklen_t len;
36427c478bd9Sstevel@tonic-gate short so_family, so_type;
36437c478bd9Sstevel@tonic-gate int add_sock_token = 0;
36447c478bd9Sstevel@tonic-gate
36457c478bd9Sstevel@tonic-gate fd = (int)uap->fd;
36467c478bd9Sstevel@tonic-gate
36477c478bd9Sstevel@tonic-gate /*
36487c478bd9Sstevel@tonic-gate * bind failed, then nothing extra to add to audit record.
36497c478bd9Sstevel@tonic-gate */
36507c478bd9Sstevel@tonic-gate if (error) {
36517c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
36527c478bd9Sstevel@tonic-gate /* XXX may want to add failed address some day */
36537c478bd9Sstevel@tonic-gate return;
36547c478bd9Sstevel@tonic-gate }
36557c478bd9Sstevel@tonic-gate
3656745b2690Stz204579 if ((so = getsonode(fd, &err, NULL)) == NULL) {
36577c478bd9Sstevel@tonic-gate /*
36587c478bd9Sstevel@tonic-gate * not security relevant if doing a bind from non socket
36597c478bd9Sstevel@tonic-gate * so no extra tokens. Should probably turn off audit record
36607c478bd9Sstevel@tonic-gate * generation here.
36617c478bd9Sstevel@tonic-gate */
36627c478bd9Sstevel@tonic-gate return;
36637c478bd9Sstevel@tonic-gate }
36647c478bd9Sstevel@tonic-gate
36657c478bd9Sstevel@tonic-gate so_family = so->so_family;
36667c478bd9Sstevel@tonic-gate so_type = so->so_type;
36677c478bd9Sstevel@tonic-gate
36687c478bd9Sstevel@tonic-gate switch (so_family) {
36697c478bd9Sstevel@tonic-gate case AF_INET:
36707c478bd9Sstevel@tonic-gate case AF_INET6:
36717c478bd9Sstevel@tonic-gate
36727c478bd9Sstevel@tonic-gate bzero(so_faddr, sizeof (so_faddr));
36730f1702c5SYu Xiangning len = sizeof (so_faddr);
36747c478bd9Sstevel@tonic-gate
36750f1702c5SYu Xiangning (void) socket_getpeername(so,
36760f1702c5SYu Xiangning (struct sockaddr *)so_faddr, &len, B_FALSE, CRED());
36777c478bd9Sstevel@tonic-gate add_sock_token = 1;
36787c478bd9Sstevel@tonic-gate
36797c478bd9Sstevel@tonic-gate break;
36807c478bd9Sstevel@tonic-gate
36817c478bd9Sstevel@tonic-gate case AF_UNIX:
36827c478bd9Sstevel@tonic-gate /* token added by lookup */
36837c478bd9Sstevel@tonic-gate break;
36847c478bd9Sstevel@tonic-gate default:
36857c478bd9Sstevel@tonic-gate /* AF_ROUTE, AF_KEY do not support accept */
36867c478bd9Sstevel@tonic-gate break;
36877c478bd9Sstevel@tonic-gate }
36887c478bd9Sstevel@tonic-gate
36897c478bd9Sstevel@tonic-gate releasef(fd);
36907c478bd9Sstevel@tonic-gate
36917c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
36927c478bd9Sstevel@tonic-gate
36937c478bd9Sstevel@tonic-gate if (add_sock_token == 0) {
36947c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "family", (uint32_t)(so_family)));
36957c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "type", (uint32_t)(so_type)));
36967c478bd9Sstevel@tonic-gate return;
36977c478bd9Sstevel@tonic-gate }
36987c478bd9Sstevel@tonic-gate
36997c478bd9Sstevel@tonic-gate au_uwrite(au_to_socket_ex(so_family, so_type, so_laddr, so_faddr));
37007c478bd9Sstevel@tonic-gate
37017c478bd9Sstevel@tonic-gate }
37027c478bd9Sstevel@tonic-gate
37037c478bd9Sstevel@tonic-gate /*ARGSUSED*/
37047c478bd9Sstevel@tonic-gate static void
auf_connect(struct t_audit_data * tad,int error,rval_t * rval)37057c478bd9Sstevel@tonic-gate auf_connect(struct t_audit_data *tad, int error, rval_t *rval)
37067c478bd9Sstevel@tonic-gate {
37077c478bd9Sstevel@tonic-gate struct a {
37087c478bd9Sstevel@tonic-gate long fd;
37097c478bd9Sstevel@tonic-gate long addr;
37107c478bd9Sstevel@tonic-gate long len;
37117c478bd9Sstevel@tonic-gate } *uap = (struct a *)ttolwp(curthread)->lwp_ap;
37127c478bd9Sstevel@tonic-gate
37137c478bd9Sstevel@tonic-gate struct sonode *so;
37147c478bd9Sstevel@tonic-gate char so_laddr[sizeof (struct sockaddr_in6)];
37157c478bd9Sstevel@tonic-gate char so_faddr[sizeof (struct sockaddr_in6)];
37167c478bd9Sstevel@tonic-gate int err, fd;
37170f1702c5SYu Xiangning socklen_t len;
37187c478bd9Sstevel@tonic-gate short so_family, so_type;
37197c478bd9Sstevel@tonic-gate int add_sock_token = 0;
37207c478bd9Sstevel@tonic-gate
37217c478bd9Sstevel@tonic-gate fd = (int)uap->fd;
37227c478bd9Sstevel@tonic-gate
37237c478bd9Sstevel@tonic-gate
3724745b2690Stz204579 if ((so = getsonode(fd, &err, NULL)) == NULL) {
37257c478bd9Sstevel@tonic-gate /*
37267c478bd9Sstevel@tonic-gate * not security relevant if doing a connect from non socket
37277c478bd9Sstevel@tonic-gate * so no extra tokens. Should probably turn off audit record
37287c478bd9Sstevel@tonic-gate * generation here.
37297c478bd9Sstevel@tonic-gate */
37307c478bd9Sstevel@tonic-gate return;
37317c478bd9Sstevel@tonic-gate }
37327c478bd9Sstevel@tonic-gate
37337c478bd9Sstevel@tonic-gate so_family = so->so_family;
37347c478bd9Sstevel@tonic-gate so_type = so->so_type;
37357c478bd9Sstevel@tonic-gate
37367c478bd9Sstevel@tonic-gate switch (so_family) {
37377c478bd9Sstevel@tonic-gate case AF_INET:
37387c478bd9Sstevel@tonic-gate case AF_INET6:
37397c478bd9Sstevel@tonic-gate
37407c478bd9Sstevel@tonic-gate bzero(so_laddr, sizeof (so_laddr));
37417c478bd9Sstevel@tonic-gate bzero(so_faddr, sizeof (so_faddr));
37427c478bd9Sstevel@tonic-gate
37430f1702c5SYu Xiangning len = sizeof (so_laddr);
37440f1702c5SYu Xiangning (void) socket_getsockname(so, (struct sockaddr *)so_laddr,
37450f1702c5SYu Xiangning &len, CRED());
37467c478bd9Sstevel@tonic-gate if (error) {
37477c478bd9Sstevel@tonic-gate if (uap->addr == NULL)
37487c478bd9Sstevel@tonic-gate break;
37497c478bd9Sstevel@tonic-gate if (uap->len <= 0)
37507c478bd9Sstevel@tonic-gate break;
37517c478bd9Sstevel@tonic-gate len = min(uap->len, sizeof (so_faddr));
37527c478bd9Sstevel@tonic-gate if (copyin((caddr_t)(uap->addr), so_faddr, len) != 0)
37537c478bd9Sstevel@tonic-gate break;
37547c478bd9Sstevel@tonic-gate #ifdef NOTYET
37557c478bd9Sstevel@tonic-gate au_uwrite(au_to_data(AUP_HEX, AUR_CHAR, len, so_faddr));
37567c478bd9Sstevel@tonic-gate #endif
37577c478bd9Sstevel@tonic-gate } else {
37587c478bd9Sstevel@tonic-gate /* sanity check on length */
37590f1702c5SYu Xiangning len = sizeof (so_faddr);
37600f1702c5SYu Xiangning (void) socket_getpeername(so,
37610f1702c5SYu Xiangning (struct sockaddr *)so_faddr, &len, B_FALSE, CRED());
37627c478bd9Sstevel@tonic-gate }
37637c478bd9Sstevel@tonic-gate
37647c478bd9Sstevel@tonic-gate add_sock_token = 1;
37657c478bd9Sstevel@tonic-gate
37667c478bd9Sstevel@tonic-gate break;
37677c478bd9Sstevel@tonic-gate
37687c478bd9Sstevel@tonic-gate case AF_UNIX:
37697c478bd9Sstevel@tonic-gate /* does a lookup on name */
37707c478bd9Sstevel@tonic-gate break;
37717c478bd9Sstevel@tonic-gate
37727c478bd9Sstevel@tonic-gate default:
37737c478bd9Sstevel@tonic-gate /* AF_ROUTE, AF_KEY do not support accept */
37747c478bd9Sstevel@tonic-gate break;
37757c478bd9Sstevel@tonic-gate }
37767c478bd9Sstevel@tonic-gate
37777c478bd9Sstevel@tonic-gate releasef(fd);
37787c478bd9Sstevel@tonic-gate
37797c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
37807c478bd9Sstevel@tonic-gate
37817c478bd9Sstevel@tonic-gate if (add_sock_token == 0) {
37827c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "family", (uint32_t)(so_family)));
37837c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "type", (uint32_t)(so_type)));
37847c478bd9Sstevel@tonic-gate return;
37857c478bd9Sstevel@tonic-gate }
37867c478bd9Sstevel@tonic-gate
37877c478bd9Sstevel@tonic-gate au_uwrite(au_to_socket_ex(so_family, so_type, so_laddr, so_faddr));
37887c478bd9Sstevel@tonic-gate
37897c478bd9Sstevel@tonic-gate }
37907c478bd9Sstevel@tonic-gate
37917c478bd9Sstevel@tonic-gate /*ARGSUSED*/
37927c478bd9Sstevel@tonic-gate static void
aus_shutdown(struct t_audit_data * tad)37937c478bd9Sstevel@tonic-gate aus_shutdown(struct t_audit_data *tad)
37947c478bd9Sstevel@tonic-gate {
37957c478bd9Sstevel@tonic-gate struct a {
37967c478bd9Sstevel@tonic-gate long fd;
37977c478bd9Sstevel@tonic-gate long how;
37987c478bd9Sstevel@tonic-gate } *uap = (struct a *)ttolwp(curthread)->lwp_ap;
37997c478bd9Sstevel@tonic-gate
38007c478bd9Sstevel@tonic-gate struct sonode *so;
38017c478bd9Sstevel@tonic-gate char so_laddr[sizeof (struct sockaddr_in6)];
38027c478bd9Sstevel@tonic-gate char so_faddr[sizeof (struct sockaddr_in6)];
38037c478bd9Sstevel@tonic-gate int err, fd;
38040f1702c5SYu Xiangning socklen_t len;
38057c478bd9Sstevel@tonic-gate short so_family, so_type;
38067c478bd9Sstevel@tonic-gate int add_sock_token = 0;
38077c478bd9Sstevel@tonic-gate file_t *fp; /* unix domain sockets */
38087c478bd9Sstevel@tonic-gate struct f_audit_data *fad; /* unix domain sockets */
38097c478bd9Sstevel@tonic-gate
38107c478bd9Sstevel@tonic-gate fd = (int)uap->fd;
38117c478bd9Sstevel@tonic-gate
3812745b2690Stz204579 if ((so = getsonode(fd, &err, &fp)) == NULL) {
38137c478bd9Sstevel@tonic-gate /*
38147c478bd9Sstevel@tonic-gate * not security relevant if doing a shutdown using non socket
38157c478bd9Sstevel@tonic-gate * so no extra tokens. Should probably turn off audit record
38167c478bd9Sstevel@tonic-gate * generation here.
38177c478bd9Sstevel@tonic-gate */
38187c478bd9Sstevel@tonic-gate return;
38197c478bd9Sstevel@tonic-gate }
38207c478bd9Sstevel@tonic-gate
38217c478bd9Sstevel@tonic-gate so_family = so->so_family;
38227c478bd9Sstevel@tonic-gate so_type = so->so_type;
38237c478bd9Sstevel@tonic-gate
38247c478bd9Sstevel@tonic-gate switch (so_family) {
38257c478bd9Sstevel@tonic-gate case AF_INET:
38267c478bd9Sstevel@tonic-gate case AF_INET6:
38277c478bd9Sstevel@tonic-gate
38287c478bd9Sstevel@tonic-gate bzero(so_laddr, sizeof (so_laddr));
38297c478bd9Sstevel@tonic-gate bzero(so_faddr, sizeof (so_faddr));
38307c478bd9Sstevel@tonic-gate
38310f1702c5SYu Xiangning len = sizeof (so_laddr);
38320f1702c5SYu Xiangning (void) socket_getsockname(so,
38330f1702c5SYu Xiangning (struct sockaddr *)so_laddr, &len, CRED());
38340f1702c5SYu Xiangning len = sizeof (so_faddr);
38350f1702c5SYu Xiangning (void) socket_getpeername(so,
38360f1702c5SYu Xiangning (struct sockaddr *)so_faddr, &len, B_FALSE, CRED());
38377c478bd9Sstevel@tonic-gate
38387c478bd9Sstevel@tonic-gate add_sock_token = 1;
38397c478bd9Sstevel@tonic-gate
38407c478bd9Sstevel@tonic-gate break;
38417c478bd9Sstevel@tonic-gate
38427c478bd9Sstevel@tonic-gate case AF_UNIX:
38437c478bd9Sstevel@tonic-gate
38447c478bd9Sstevel@tonic-gate /* get path from file struct here */
38457c478bd9Sstevel@tonic-gate fad = F2A(fp);
38467c478bd9Sstevel@tonic-gate ASSERT(fad);
38477c478bd9Sstevel@tonic-gate
38487c478bd9Sstevel@tonic-gate if (fad->fad_aupath != NULL) {
38497c478bd9Sstevel@tonic-gate au_uwrite(au_to_path(fad->fad_aupath));
38507c478bd9Sstevel@tonic-gate } else {
38517c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "no path: fd", fd));
38527c478bd9Sstevel@tonic-gate }
38537c478bd9Sstevel@tonic-gate
38547c478bd9Sstevel@tonic-gate audit_attributes(fp->f_vnode);
38557c478bd9Sstevel@tonic-gate
38567c478bd9Sstevel@tonic-gate break;
38577c478bd9Sstevel@tonic-gate
38587c478bd9Sstevel@tonic-gate default:
38597c478bd9Sstevel@tonic-gate /*
38607c478bd9Sstevel@tonic-gate * AF_KEY and AF_ROUTE support shutdown. No socket token
38617c478bd9Sstevel@tonic-gate * added.
38627c478bd9Sstevel@tonic-gate */
38637c478bd9Sstevel@tonic-gate break;
38647c478bd9Sstevel@tonic-gate }
38657c478bd9Sstevel@tonic-gate
38667c478bd9Sstevel@tonic-gate releasef(fd);
38677c478bd9Sstevel@tonic-gate
38687c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
38697c478bd9Sstevel@tonic-gate
38707c478bd9Sstevel@tonic-gate if (add_sock_token == 0) {
38717c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "family", (uint32_t)(so_family)));
38727c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "type", (uint32_t)(so_type)));
38737c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(2, "how", (uint32_t)(uap->how)));
38747c478bd9Sstevel@tonic-gate return;
38757c478bd9Sstevel@tonic-gate }
38767c478bd9Sstevel@tonic-gate
38777c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(2, "how", (uint32_t)(uap->how)));
38787c478bd9Sstevel@tonic-gate
38797c478bd9Sstevel@tonic-gate au_uwrite(au_to_socket_ex(so_family, so_type, so_laddr, so_faddr));
38807c478bd9Sstevel@tonic-gate
38817c478bd9Sstevel@tonic-gate }
38827c478bd9Sstevel@tonic-gate
38837c478bd9Sstevel@tonic-gate /*ARGSUSED*/
38847c478bd9Sstevel@tonic-gate static void
auf_setsockopt(struct t_audit_data * tad,int error,rval_t * rval)38857c478bd9Sstevel@tonic-gate auf_setsockopt(struct t_audit_data *tad, int error, rval_t *rval)
38867c478bd9Sstevel@tonic-gate {
38877c478bd9Sstevel@tonic-gate struct a {
38887c478bd9Sstevel@tonic-gate long fd;
38897c478bd9Sstevel@tonic-gate long level;
38907c478bd9Sstevel@tonic-gate long optname;
38917c478bd9Sstevel@tonic-gate long *optval;
38927c478bd9Sstevel@tonic-gate long optlen;
38937c478bd9Sstevel@tonic-gate } *uap = (struct a *)ttolwp(curthread)->lwp_ap;
38947c478bd9Sstevel@tonic-gate
38957c478bd9Sstevel@tonic-gate struct sonode *so;
38967c478bd9Sstevel@tonic-gate char so_laddr[sizeof (struct sockaddr_in6)];
38977c478bd9Sstevel@tonic-gate char so_faddr[sizeof (struct sockaddr_in6)];
38987c478bd9Sstevel@tonic-gate char val[AU_BUFSIZE];
38997c478bd9Sstevel@tonic-gate int err, fd;
39000f1702c5SYu Xiangning socklen_t len;
39017c478bd9Sstevel@tonic-gate short so_family, so_type;
39027c478bd9Sstevel@tonic-gate int add_sock_token = 0;
39037c478bd9Sstevel@tonic-gate file_t *fp; /* unix domain sockets */
39047c478bd9Sstevel@tonic-gate struct f_audit_data *fad; /* unix domain sockets */
39057c478bd9Sstevel@tonic-gate
39067c478bd9Sstevel@tonic-gate fd = (int)uap->fd;
39077c478bd9Sstevel@tonic-gate
39087c478bd9Sstevel@tonic-gate if (error) {
39097c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
39107c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(2, "level", (uint32_t)uap->level));
39117c478bd9Sstevel@tonic-gate /* XXX may want to include other arguments */
39127c478bd9Sstevel@tonic-gate return;
39137c478bd9Sstevel@tonic-gate }
39147c478bd9Sstevel@tonic-gate
3915745b2690Stz204579 if ((so = getsonode(fd, &err, &fp)) == NULL) {
39167c478bd9Sstevel@tonic-gate /*
39177c478bd9Sstevel@tonic-gate * not security relevant if doing a setsockopt from non socket
39187c478bd9Sstevel@tonic-gate * so no extra tokens. Should probably turn off audit record
39197c478bd9Sstevel@tonic-gate * generation here.
39207c478bd9Sstevel@tonic-gate */
39217c478bd9Sstevel@tonic-gate return;
39227c478bd9Sstevel@tonic-gate }
39237c478bd9Sstevel@tonic-gate
39247c478bd9Sstevel@tonic-gate so_family = so->so_family;
39257c478bd9Sstevel@tonic-gate so_type = so->so_type;
39267c478bd9Sstevel@tonic-gate
39277c478bd9Sstevel@tonic-gate switch (so_family) {
39287c478bd9Sstevel@tonic-gate case AF_INET:
39297c478bd9Sstevel@tonic-gate case AF_INET6:
39307c478bd9Sstevel@tonic-gate bzero((void *)so_laddr, sizeof (so_laddr));
39317c478bd9Sstevel@tonic-gate bzero((void *)so_faddr, sizeof (so_faddr));
39327c478bd9Sstevel@tonic-gate
39337c478bd9Sstevel@tonic-gate /* get local and foreign addresses */
39340f1702c5SYu Xiangning len = sizeof (so_laddr);
39350f1702c5SYu Xiangning (void) socket_getsockname(so, (struct sockaddr *)so_laddr,
39360f1702c5SYu Xiangning &len, CRED());
39370f1702c5SYu Xiangning len = sizeof (so_faddr);
39380f1702c5SYu Xiangning (void) socket_getpeername(so, (struct sockaddr *)so_faddr,
39390f1702c5SYu Xiangning &len, B_FALSE, CRED());
39407c478bd9Sstevel@tonic-gate
39417c478bd9Sstevel@tonic-gate add_sock_token = 1;
39427c478bd9Sstevel@tonic-gate
39437c478bd9Sstevel@tonic-gate break;
39447c478bd9Sstevel@tonic-gate
39457c478bd9Sstevel@tonic-gate case AF_UNIX:
39467c478bd9Sstevel@tonic-gate
39477c478bd9Sstevel@tonic-gate /* get path from file struct here */
39487c478bd9Sstevel@tonic-gate fad = F2A(fp);
39497c478bd9Sstevel@tonic-gate ASSERT(fad);
39507c478bd9Sstevel@tonic-gate
39517c478bd9Sstevel@tonic-gate if (fad->fad_aupath != NULL) {
39527c478bd9Sstevel@tonic-gate au_uwrite(au_to_path(fad->fad_aupath));
39537c478bd9Sstevel@tonic-gate } else {
39547c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "no path: fd", fd));
39557c478bd9Sstevel@tonic-gate }
39567c478bd9Sstevel@tonic-gate
39577c478bd9Sstevel@tonic-gate audit_attributes(fp->f_vnode);
39587c478bd9Sstevel@tonic-gate
39597c478bd9Sstevel@tonic-gate break;
39607c478bd9Sstevel@tonic-gate
39617c478bd9Sstevel@tonic-gate default:
39627c478bd9Sstevel@tonic-gate /*
39637c478bd9Sstevel@tonic-gate * AF_KEY and AF_ROUTE support setsockopt. No socket token
39647c478bd9Sstevel@tonic-gate * added.
39657c478bd9Sstevel@tonic-gate */
39667c478bd9Sstevel@tonic-gate break;
39677c478bd9Sstevel@tonic-gate }
39687c478bd9Sstevel@tonic-gate
39697c478bd9Sstevel@tonic-gate releasef(fd);
39707c478bd9Sstevel@tonic-gate
39717c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
39727c478bd9Sstevel@tonic-gate
39737c478bd9Sstevel@tonic-gate if (add_sock_token == 0) {
39747c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "family", (uint32_t)(so_family)));
39757c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "type", (uint32_t)(so_type)));
39767c478bd9Sstevel@tonic-gate }
39777c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(2, "level", (uint32_t)(uap->level)));
39787c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(3, "optname", (uint32_t)(uap->optname)));
39797c478bd9Sstevel@tonic-gate
39807c478bd9Sstevel@tonic-gate bzero(val, sizeof (val));
39817c478bd9Sstevel@tonic-gate len = min(uap->optlen, sizeof (val));
39827c478bd9Sstevel@tonic-gate if ((len > 0) &&
39837c478bd9Sstevel@tonic-gate (copyin((caddr_t)(uap->optval), (caddr_t)val, len) == 0)) {
39847c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(5, "optlen", (uint32_t)(uap->optlen)));
39857c478bd9Sstevel@tonic-gate au_uwrite(au_to_data(AUP_HEX, AUR_BYTE, len, val));
39867c478bd9Sstevel@tonic-gate }
39877c478bd9Sstevel@tonic-gate
39887c478bd9Sstevel@tonic-gate if (add_sock_token == 0)
39897c478bd9Sstevel@tonic-gate return;
39907c478bd9Sstevel@tonic-gate
39917c478bd9Sstevel@tonic-gate au_uwrite(au_to_socket_ex(so_family, so_type, so_laddr, so_faddr));
39927c478bd9Sstevel@tonic-gate
39937c478bd9Sstevel@tonic-gate }
39947c478bd9Sstevel@tonic-gate
39957c478bd9Sstevel@tonic-gate /*ARGSUSED*/
39967c478bd9Sstevel@tonic-gate static void
aus_sockconfig(tad)39977c478bd9Sstevel@tonic-gate aus_sockconfig(tad)
39987c478bd9Sstevel@tonic-gate struct t_audit_data *tad;
39997c478bd9Sstevel@tonic-gate {
40007c478bd9Sstevel@tonic-gate struct a {
40013e95bd4aSAnders Persson long cmd;
40023e95bd4aSAnders Persson long arg1;
40033e95bd4aSAnders Persson long arg2;
40043e95bd4aSAnders Persson long arg3;
40053e95bd4aSAnders Persson long arg4;
40067c478bd9Sstevel@tonic-gate } *uap = (struct a *)ttolwp(curthread)->lwp_ap;
40077c478bd9Sstevel@tonic-gate
40083e95bd4aSAnders Persson char *buf;
40093e95bd4aSAnders Persson int buflen;
40107c478bd9Sstevel@tonic-gate size_t size;
40117c478bd9Sstevel@tonic-gate
40123e95bd4aSAnders Persson au_uwrite(au_to_arg32(1, "cmd", (uint_t)uap->cmd));
40133e95bd4aSAnders Persson switch (uap->cmd) {
40143e95bd4aSAnders Persson case SOCKCONFIG_ADD_SOCK:
40153e95bd4aSAnders Persson case SOCKCONFIG_REMOVE_SOCK:
40163e95bd4aSAnders Persson au_uwrite(au_to_arg32(2, "domain", (uint32_t)uap->arg1));
40173e95bd4aSAnders Persson au_uwrite(au_to_arg32(3, "type", (uint32_t)uap->arg2));
40183e95bd4aSAnders Persson au_uwrite(au_to_arg32(4, "protocol", (uint32_t)uap->arg3));
40197c478bd9Sstevel@tonic-gate
40203e95bd4aSAnders Persson if (uap->arg4 == 0) {
40213e95bd4aSAnders Persson au_uwrite(au_to_arg32(5, "devpath", (uint32_t)0));
40227c478bd9Sstevel@tonic-gate } else {
40233e95bd4aSAnders Persson buflen = MAXPATHLEN + 1;
40243e95bd4aSAnders Persson buf = kmem_alloc(buflen, KM_SLEEP);
40253e95bd4aSAnders Persson if (copyinstr((caddr_t)uap->arg4, buf, buflen,
40267c478bd9Sstevel@tonic-gate &size)) {
40273e95bd4aSAnders Persson kmem_free(buf, buflen);
40287c478bd9Sstevel@tonic-gate return;
40297c478bd9Sstevel@tonic-gate }
40307c478bd9Sstevel@tonic-gate
40317c478bd9Sstevel@tonic-gate if (size > MAXPATHLEN) {
40323e95bd4aSAnders Persson kmem_free(buf, buflen);
40337c478bd9Sstevel@tonic-gate return;
40347c478bd9Sstevel@tonic-gate }
40357c478bd9Sstevel@tonic-gate
40363e95bd4aSAnders Persson au_uwrite(au_to_text(buf));
40373e95bd4aSAnders Persson kmem_free(buf, buflen);
40383e95bd4aSAnders Persson }
40393e95bd4aSAnders Persson break;
40403e95bd4aSAnders Persson case SOCKCONFIG_ADD_FILTER:
40413e95bd4aSAnders Persson case SOCKCONFIG_REMOVE_FILTER:
40423e95bd4aSAnders Persson buflen = FILNAME_MAX;
40433e95bd4aSAnders Persson buf = kmem_alloc(buflen, KM_SLEEP);
40443e95bd4aSAnders Persson
40453e95bd4aSAnders Persson if (copyinstr((caddr_t)uap->arg1, buf, buflen, &size)) {
40463e95bd4aSAnders Persson kmem_free(buf, buflen);
40473e95bd4aSAnders Persson return;
40483e95bd4aSAnders Persson }
40493e95bd4aSAnders Persson
40503e95bd4aSAnders Persson au_uwrite(au_to_text(buf));
40513e95bd4aSAnders Persson kmem_free(buf, buflen);
40523e95bd4aSAnders Persson break;
40533e95bd4aSAnders Persson default:
40543e95bd4aSAnders Persson break;
40557c478bd9Sstevel@tonic-gate }
40567c478bd9Sstevel@tonic-gate }
40577c478bd9Sstevel@tonic-gate
40587c478bd9Sstevel@tonic-gate /*
40597c478bd9Sstevel@tonic-gate * only audit recvmsg when the system call represents the creation of a new
40607c478bd9Sstevel@tonic-gate * circuit. This effectively occurs for all UDP packets and may occur for
40617c478bd9Sstevel@tonic-gate * special TCP situations where the local host has not set a local address
40627c478bd9Sstevel@tonic-gate * in the socket structure.
40637c478bd9Sstevel@tonic-gate */
40647c478bd9Sstevel@tonic-gate /*ARGSUSED*/
40657c478bd9Sstevel@tonic-gate static void
auf_recvmsg(struct t_audit_data * tad,int error,rval_t * rvp)40667c478bd9Sstevel@tonic-gate auf_recvmsg(
40677c478bd9Sstevel@tonic-gate struct t_audit_data *tad,
40687c478bd9Sstevel@tonic-gate int error,
40697c478bd9Sstevel@tonic-gate rval_t *rvp)
40707c478bd9Sstevel@tonic-gate {
40717c478bd9Sstevel@tonic-gate struct a {
40727c478bd9Sstevel@tonic-gate long fd;
40737c478bd9Sstevel@tonic-gate long msg; /* struct msghdr */
40747c478bd9Sstevel@tonic-gate long flags;
40757c478bd9Sstevel@tonic-gate } *uap = (struct a *)ttolwp(curthread)->lwp_ap;
40767c478bd9Sstevel@tonic-gate
40777c478bd9Sstevel@tonic-gate struct sonode *so;
40787c478bd9Sstevel@tonic-gate STRUCT_DECL(msghdr, msg);
40797c478bd9Sstevel@tonic-gate caddr_t msg_name;
40807c478bd9Sstevel@tonic-gate socklen_t msg_namelen;
40817c478bd9Sstevel@tonic-gate int fd;
40827c478bd9Sstevel@tonic-gate int err;
40837c478bd9Sstevel@tonic-gate char so_laddr[sizeof (struct sockaddr_in6)];
40847c478bd9Sstevel@tonic-gate char so_faddr[sizeof (struct sockaddr_in6)];
40850f1702c5SYu Xiangning socklen_t len;
40867c478bd9Sstevel@tonic-gate file_t *fp; /* unix domain sockets */
40877c478bd9Sstevel@tonic-gate struct f_audit_data *fad; /* unix domain sockets */
40887c478bd9Sstevel@tonic-gate short so_family, so_type;
40897c478bd9Sstevel@tonic-gate int add_sock_token = 0;
40909e9e6ab8Spaulson au_kcontext_t *kctx = GET_KCTX_PZ;
40917c478bd9Sstevel@tonic-gate
40927c478bd9Sstevel@tonic-gate fd = (int)uap->fd;
40937c478bd9Sstevel@tonic-gate
40947c478bd9Sstevel@tonic-gate /* bail if an error */
40957c478bd9Sstevel@tonic-gate if (error) {
40967c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
40977c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(3, "flags", (uint32_t)(uap->flags)));
40987c478bd9Sstevel@tonic-gate return;
40997c478bd9Sstevel@tonic-gate }
41007c478bd9Sstevel@tonic-gate
4101745b2690Stz204579 if ((so = getsonode(fd, &err, &fp)) == NULL) {
41027c478bd9Sstevel@tonic-gate /*
41037c478bd9Sstevel@tonic-gate * not security relevant if doing a recvmsg from non socket
41047c478bd9Sstevel@tonic-gate * so no extra tokens. Should probably turn off audit record
41057c478bd9Sstevel@tonic-gate * generation here.
41067c478bd9Sstevel@tonic-gate */
41077c478bd9Sstevel@tonic-gate return;
41087c478bd9Sstevel@tonic-gate }
41097c478bd9Sstevel@tonic-gate
41107c478bd9Sstevel@tonic-gate so_family = so->so_family;
41117c478bd9Sstevel@tonic-gate so_type = so->so_type;
41127c478bd9Sstevel@tonic-gate
41137c478bd9Sstevel@tonic-gate /*
41147c478bd9Sstevel@tonic-gate * only putout SOCKET_EX token if INET/INET6 family.
41157c478bd9Sstevel@tonic-gate * XXX - what do we do about other families?
41167c478bd9Sstevel@tonic-gate */
41177c478bd9Sstevel@tonic-gate
41187c478bd9Sstevel@tonic-gate switch (so_family) {
41197c478bd9Sstevel@tonic-gate case AF_INET:
41207c478bd9Sstevel@tonic-gate case AF_INET6:
41217c478bd9Sstevel@tonic-gate
41227c478bd9Sstevel@tonic-gate /*
41237c478bd9Sstevel@tonic-gate * if datagram type socket, then just use what is in
41247c478bd9Sstevel@tonic-gate * socket structure for local address.
41257c478bd9Sstevel@tonic-gate * XXX - what do we do for other types?
41267c478bd9Sstevel@tonic-gate */
41277c478bd9Sstevel@tonic-gate if ((so->so_type == SOCK_DGRAM) ||
41287c478bd9Sstevel@tonic-gate (so->so_type == SOCK_RAW)) {
41297c478bd9Sstevel@tonic-gate add_sock_token = 1;
41307c478bd9Sstevel@tonic-gate
41317c478bd9Sstevel@tonic-gate bzero((void *)so_laddr, sizeof (so_laddr));
41327c478bd9Sstevel@tonic-gate bzero((void *)so_faddr, sizeof (so_faddr));
41337c478bd9Sstevel@tonic-gate
41347c478bd9Sstevel@tonic-gate /* get local address */
41350f1702c5SYu Xiangning len = sizeof (so_laddr);
41360f1702c5SYu Xiangning (void) socket_getsockname(so,
41370f1702c5SYu Xiangning (struct sockaddr *)so_laddr, &len, CRED());
41387c478bd9Sstevel@tonic-gate
41397c478bd9Sstevel@tonic-gate /* get peer address */
41407c478bd9Sstevel@tonic-gate STRUCT_INIT(msg, get_udatamodel());
41417c478bd9Sstevel@tonic-gate
41427c478bd9Sstevel@tonic-gate if (copyin((caddr_t)(uap->msg),
41437c478bd9Sstevel@tonic-gate (caddr_t)STRUCT_BUF(msg), STRUCT_SIZE(msg)) != 0) {
41447c478bd9Sstevel@tonic-gate break;
41457c478bd9Sstevel@tonic-gate }
41467c478bd9Sstevel@tonic-gate msg_name = (caddr_t)STRUCT_FGETP(msg, msg_name);
41477c478bd9Sstevel@tonic-gate if (msg_name == NULL) {
41487c478bd9Sstevel@tonic-gate break;
41497c478bd9Sstevel@tonic-gate }
41507c478bd9Sstevel@tonic-gate
41517c478bd9Sstevel@tonic-gate /* length is value from recvmsg - sanity check */
41527c478bd9Sstevel@tonic-gate msg_namelen = (socklen_t)STRUCT_FGET(msg, msg_namelen);
41537c478bd9Sstevel@tonic-gate if (msg_namelen == 0) {
41547c478bd9Sstevel@tonic-gate break;
41557c478bd9Sstevel@tonic-gate }
41567c478bd9Sstevel@tonic-gate if (copyin(msg_name, so_faddr,
41577c478bd9Sstevel@tonic-gate sizeof (so_faddr)) != 0) {
41587c478bd9Sstevel@tonic-gate break;
41597c478bd9Sstevel@tonic-gate }
41607c478bd9Sstevel@tonic-gate
41617c478bd9Sstevel@tonic-gate } else if (so->so_type == SOCK_STREAM) {
41627c478bd9Sstevel@tonic-gate
41637c478bd9Sstevel@tonic-gate /* get path from file struct here */
41647c478bd9Sstevel@tonic-gate fad = F2A(fp);
41657c478bd9Sstevel@tonic-gate ASSERT(fad);
41667c478bd9Sstevel@tonic-gate
41677c478bd9Sstevel@tonic-gate /*
41687c478bd9Sstevel@tonic-gate * already processed this file for read attempt
41697c478bd9Sstevel@tonic-gate */
41707c478bd9Sstevel@tonic-gate if (fad->fad_flags & FAD_READ) {
41717c478bd9Sstevel@tonic-gate /* don't want to audit every recvmsg attempt */
41727c478bd9Sstevel@tonic-gate tad->tad_flag = 0;
41737c478bd9Sstevel@tonic-gate /* free any residual audit data */
4174005d3febSMarek Pospisil au_close(kctx, &(u_ad), 0, 0, 0, NULL);
41757c478bd9Sstevel@tonic-gate releasef(fd);
41767c478bd9Sstevel@tonic-gate return;
41777c478bd9Sstevel@tonic-gate }
41787c478bd9Sstevel@tonic-gate /*
41797c478bd9Sstevel@tonic-gate * mark things so we know what happened and don't
41807c478bd9Sstevel@tonic-gate * repeat things
41817c478bd9Sstevel@tonic-gate */
41827c478bd9Sstevel@tonic-gate fad->fad_flags |= FAD_READ;
41837c478bd9Sstevel@tonic-gate
41847c478bd9Sstevel@tonic-gate bzero((void *)so_laddr, sizeof (so_laddr));
41857c478bd9Sstevel@tonic-gate bzero((void *)so_faddr, sizeof (so_faddr));
41867c478bd9Sstevel@tonic-gate
41877c478bd9Sstevel@tonic-gate /* get local and foreign addresses */
41880f1702c5SYu Xiangning len = sizeof (so_laddr);
41890f1702c5SYu Xiangning (void) socket_getsockname(so,
41900f1702c5SYu Xiangning (struct sockaddr *)so_laddr, &len, CRED());
41910f1702c5SYu Xiangning len = sizeof (so_faddr);
41920f1702c5SYu Xiangning (void) socket_getpeername(so,
41930f1702c5SYu Xiangning (struct sockaddr *)so_faddr, &len, B_FALSE, CRED());
41947c478bd9Sstevel@tonic-gate
41957c478bd9Sstevel@tonic-gate add_sock_token = 1;
41967c478bd9Sstevel@tonic-gate }
41977c478bd9Sstevel@tonic-gate
41987c478bd9Sstevel@tonic-gate /* XXX - what about SOCK_RDM/SOCK_SEQPACKET ??? */
41997c478bd9Sstevel@tonic-gate
42007c478bd9Sstevel@tonic-gate break;
42017c478bd9Sstevel@tonic-gate
42027c478bd9Sstevel@tonic-gate case AF_UNIX:
42037c478bd9Sstevel@tonic-gate /*
42047c478bd9Sstevel@tonic-gate * first check if this is first time through. Too much
42057c478bd9Sstevel@tonic-gate * duplicate code to put this in an aui_ routine.
42067c478bd9Sstevel@tonic-gate */
42077c478bd9Sstevel@tonic-gate
42087c478bd9Sstevel@tonic-gate /* get path from file struct here */
42097c478bd9Sstevel@tonic-gate fad = F2A(fp);
42107c478bd9Sstevel@tonic-gate ASSERT(fad);
42117c478bd9Sstevel@tonic-gate
42127c478bd9Sstevel@tonic-gate /*
42137c478bd9Sstevel@tonic-gate * already processed this file for read attempt
42147c478bd9Sstevel@tonic-gate */
42157c478bd9Sstevel@tonic-gate if (fad->fad_flags & FAD_READ) {
42167c478bd9Sstevel@tonic-gate releasef(fd);
42177c478bd9Sstevel@tonic-gate /* don't want to audit every recvmsg attempt */
42187c478bd9Sstevel@tonic-gate tad->tad_flag = 0;
42197c478bd9Sstevel@tonic-gate /* free any residual audit data */
4220005d3febSMarek Pospisil au_close(kctx, &(u_ad), 0, 0, 0, NULL);
42217c478bd9Sstevel@tonic-gate return;
42227c478bd9Sstevel@tonic-gate }
42237c478bd9Sstevel@tonic-gate /*
42247c478bd9Sstevel@tonic-gate * mark things so we know what happened and don't
42257c478bd9Sstevel@tonic-gate * repeat things
42267c478bd9Sstevel@tonic-gate */
42277c478bd9Sstevel@tonic-gate fad->fad_flags |= FAD_READ;
42287c478bd9Sstevel@tonic-gate
42297c478bd9Sstevel@tonic-gate if (fad->fad_aupath != NULL) {
42307c478bd9Sstevel@tonic-gate au_uwrite(au_to_path(fad->fad_aupath));
42317c478bd9Sstevel@tonic-gate } else {
42327c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "no path: fd", fd));
42337c478bd9Sstevel@tonic-gate }
42347c478bd9Sstevel@tonic-gate
42357c478bd9Sstevel@tonic-gate audit_attributes(fp->f_vnode);
42367c478bd9Sstevel@tonic-gate
42377c478bd9Sstevel@tonic-gate releasef(fd);
42387c478bd9Sstevel@tonic-gate
42397c478bd9Sstevel@tonic-gate return;
42407c478bd9Sstevel@tonic-gate
42417c478bd9Sstevel@tonic-gate default:
42427c478bd9Sstevel@tonic-gate break;
42437c478bd9Sstevel@tonic-gate
42447c478bd9Sstevel@tonic-gate }
42457c478bd9Sstevel@tonic-gate
42467c478bd9Sstevel@tonic-gate releasef(fd);
42477c478bd9Sstevel@tonic-gate
42487c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
42497c478bd9Sstevel@tonic-gate
42507c478bd9Sstevel@tonic-gate if (add_sock_token == 0) {
42517c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "family", (uint32_t)so_family));
42527c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "type", (uint32_t)so_type));
42537c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(3, "flags", (uint32_t)(uap->flags)));
42547c478bd9Sstevel@tonic-gate return;
42557c478bd9Sstevel@tonic-gate }
42567c478bd9Sstevel@tonic-gate
42577c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(3, "flags", (uint32_t)(uap->flags)));
42587c478bd9Sstevel@tonic-gate
42597c478bd9Sstevel@tonic-gate au_uwrite(au_to_socket_ex(so_family, so_type, so_laddr, so_faddr));
42607c478bd9Sstevel@tonic-gate
42617c478bd9Sstevel@tonic-gate }
42627c478bd9Sstevel@tonic-gate
42637c478bd9Sstevel@tonic-gate /*ARGSUSED*/
42647c478bd9Sstevel@tonic-gate static void
auf_recvfrom(struct t_audit_data * tad,int error,rval_t * rvp)42657c478bd9Sstevel@tonic-gate auf_recvfrom(
42667c478bd9Sstevel@tonic-gate struct t_audit_data *tad,
42677c478bd9Sstevel@tonic-gate int error,
42687c478bd9Sstevel@tonic-gate rval_t *rvp)
42697c478bd9Sstevel@tonic-gate {
42707c478bd9Sstevel@tonic-gate
42717c478bd9Sstevel@tonic-gate struct a {
42727c478bd9Sstevel@tonic-gate long fd;
42737c478bd9Sstevel@tonic-gate long msg; /* char */
42747c478bd9Sstevel@tonic-gate long len;
42757c478bd9Sstevel@tonic-gate long flags;
42767c478bd9Sstevel@tonic-gate long from; /* struct sockaddr */
42777c478bd9Sstevel@tonic-gate long fromlen;
42787c478bd9Sstevel@tonic-gate } *uap = (struct a *)ttolwp(curthread)->lwp_ap;
42797c478bd9Sstevel@tonic-gate
42807c478bd9Sstevel@tonic-gate socklen_t fromlen;
42817c478bd9Sstevel@tonic-gate struct sonode *so;
42827c478bd9Sstevel@tonic-gate char so_laddr[sizeof (struct sockaddr_in6)];
42837c478bd9Sstevel@tonic-gate char so_faddr[sizeof (struct sockaddr_in6)];
42847c478bd9Sstevel@tonic-gate int fd;
42857c478bd9Sstevel@tonic-gate short so_family, so_type;
42867c478bd9Sstevel@tonic-gate int add_sock_token = 0;
42870f1702c5SYu Xiangning socklen_t len;
42887c478bd9Sstevel@tonic-gate int err;
42897c478bd9Sstevel@tonic-gate struct file *fp;
42907c478bd9Sstevel@tonic-gate struct f_audit_data *fad; /* unix domain sockets */
42919e9e6ab8Spaulson au_kcontext_t *kctx = GET_KCTX_PZ;
42927c478bd9Sstevel@tonic-gate
42937c478bd9Sstevel@tonic-gate fd = (int)uap->fd;
42947c478bd9Sstevel@tonic-gate
42957c478bd9Sstevel@tonic-gate /* bail if an error */
42967c478bd9Sstevel@tonic-gate if (error) {
42977c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
42987c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(3, "flags", (uint32_t)(uap->flags)));
42997c478bd9Sstevel@tonic-gate return;
43007c478bd9Sstevel@tonic-gate }
43017c478bd9Sstevel@tonic-gate
4302745b2690Stz204579 if ((so = getsonode(fd, &err, &fp)) == NULL) {
43037c478bd9Sstevel@tonic-gate /*
43047c478bd9Sstevel@tonic-gate * not security relevant if doing a recvmsg from non socket
43057c478bd9Sstevel@tonic-gate * so no extra tokens. Should probably turn off audit record
43067c478bd9Sstevel@tonic-gate * generation here.
43077c478bd9Sstevel@tonic-gate */
43087c478bd9Sstevel@tonic-gate return;
43097c478bd9Sstevel@tonic-gate }
43107c478bd9Sstevel@tonic-gate
43117c478bd9Sstevel@tonic-gate so_family = so->so_family;
43127c478bd9Sstevel@tonic-gate so_type = so->so_type;
43137c478bd9Sstevel@tonic-gate
43147c478bd9Sstevel@tonic-gate /*
43157c478bd9Sstevel@tonic-gate * only putout SOCKET_EX token if INET/INET6 family.
43167c478bd9Sstevel@tonic-gate * XXX - what do we do about other families?
43177c478bd9Sstevel@tonic-gate */
43187c478bd9Sstevel@tonic-gate
43197c478bd9Sstevel@tonic-gate switch (so_family) {
43207c478bd9Sstevel@tonic-gate case AF_INET:
43217c478bd9Sstevel@tonic-gate case AF_INET6:
43227c478bd9Sstevel@tonic-gate
43237c478bd9Sstevel@tonic-gate /*
43247c478bd9Sstevel@tonic-gate * if datagram type socket, then just use what is in
43257c478bd9Sstevel@tonic-gate * socket structure for local address.
43267c478bd9Sstevel@tonic-gate * XXX - what do we do for other types?
43277c478bd9Sstevel@tonic-gate */
43287c478bd9Sstevel@tonic-gate if ((so->so_type == SOCK_DGRAM) ||
43297c478bd9Sstevel@tonic-gate (so->so_type == SOCK_RAW)) {
43307c478bd9Sstevel@tonic-gate add_sock_token = 1;
43317c478bd9Sstevel@tonic-gate
43327c478bd9Sstevel@tonic-gate /* get local address */
43330f1702c5SYu Xiangning len = sizeof (so_laddr);
43340f1702c5SYu Xiangning (void) socket_getsockname(so,
43350f1702c5SYu Xiangning (struct sockaddr *)so_laddr, &len, CRED());
43367c478bd9Sstevel@tonic-gate
43377c478bd9Sstevel@tonic-gate /* get peer address */
43387c478bd9Sstevel@tonic-gate bzero((void *)so_faddr, sizeof (so_faddr));
43397c478bd9Sstevel@tonic-gate
43407c478bd9Sstevel@tonic-gate /* sanity check */
43417c478bd9Sstevel@tonic-gate if (uap->from == NULL)
43427c478bd9Sstevel@tonic-gate break;
43437c478bd9Sstevel@tonic-gate
43447c478bd9Sstevel@tonic-gate /* sanity checks */
43457c478bd9Sstevel@tonic-gate if (uap->fromlen == 0)
43467c478bd9Sstevel@tonic-gate break;
43477c478bd9Sstevel@tonic-gate
43487c478bd9Sstevel@tonic-gate if (copyin((caddr_t)(uap->fromlen), (caddr_t)&fromlen,
43497c478bd9Sstevel@tonic-gate sizeof (fromlen)) != 0)
43507c478bd9Sstevel@tonic-gate break;
43517c478bd9Sstevel@tonic-gate
43527c478bd9Sstevel@tonic-gate if (fromlen == 0)
43537c478bd9Sstevel@tonic-gate break;
43547c478bd9Sstevel@tonic-gate
43557c478bd9Sstevel@tonic-gate /* enforce maximum size */
43567c478bd9Sstevel@tonic-gate if (fromlen > sizeof (so_faddr))
43577c478bd9Sstevel@tonic-gate fromlen = sizeof (so_faddr);
43587c478bd9Sstevel@tonic-gate
43597c478bd9Sstevel@tonic-gate if (copyin((caddr_t)(uap->from), so_faddr,
43607c478bd9Sstevel@tonic-gate fromlen) != 0)
43617c478bd9Sstevel@tonic-gate break;
43627c478bd9Sstevel@tonic-gate
43637c478bd9Sstevel@tonic-gate } else if (so->so_type == SOCK_STREAM) {
43647c478bd9Sstevel@tonic-gate
43657c478bd9Sstevel@tonic-gate /* get path from file struct here */
43667c478bd9Sstevel@tonic-gate fad = F2A(fp);
43677c478bd9Sstevel@tonic-gate ASSERT(fad);
43687c478bd9Sstevel@tonic-gate
43697c478bd9Sstevel@tonic-gate /*
43707c478bd9Sstevel@tonic-gate * already processed this file for read attempt
43717c478bd9Sstevel@tonic-gate */
43727c478bd9Sstevel@tonic-gate if (fad->fad_flags & FAD_READ) {
43737c478bd9Sstevel@tonic-gate /* don't want to audit every recvfrom attempt */
43747c478bd9Sstevel@tonic-gate tad->tad_flag = 0;
43757c478bd9Sstevel@tonic-gate /* free any residual audit data */
4376005d3febSMarek Pospisil au_close(kctx, &(u_ad), 0, 0, 0, NULL);
43777c478bd9Sstevel@tonic-gate releasef(fd);
43787c478bd9Sstevel@tonic-gate return;
43797c478bd9Sstevel@tonic-gate }
43807c478bd9Sstevel@tonic-gate /*
43817c478bd9Sstevel@tonic-gate * mark things so we know what happened and don't
43827c478bd9Sstevel@tonic-gate * repeat things
43837c478bd9Sstevel@tonic-gate */
43847c478bd9Sstevel@tonic-gate fad->fad_flags |= FAD_READ;
43857c478bd9Sstevel@tonic-gate
43867c478bd9Sstevel@tonic-gate bzero((void *)so_laddr, sizeof (so_laddr));
43877c478bd9Sstevel@tonic-gate bzero((void *)so_faddr, sizeof (so_faddr));
43887c478bd9Sstevel@tonic-gate
43897c478bd9Sstevel@tonic-gate /* get local and foreign addresses */
43900f1702c5SYu Xiangning len = sizeof (so_laddr);
43910f1702c5SYu Xiangning (void) socket_getsockname(so,
43920f1702c5SYu Xiangning (struct sockaddr *)so_laddr, &len, CRED());
43930f1702c5SYu Xiangning len = sizeof (so_faddr);
43940f1702c5SYu Xiangning (void) socket_getpeername(so,
43950f1702c5SYu Xiangning (struct sockaddr *)so_faddr, &len, B_FALSE, CRED());
43967c478bd9Sstevel@tonic-gate
43977c478bd9Sstevel@tonic-gate add_sock_token = 1;
43987c478bd9Sstevel@tonic-gate }
43997c478bd9Sstevel@tonic-gate
44007c478bd9Sstevel@tonic-gate /* XXX - what about SOCK_RDM/SOCK_SEQPACKET ??? */
44017c478bd9Sstevel@tonic-gate
44027c478bd9Sstevel@tonic-gate break;
44037c478bd9Sstevel@tonic-gate
44047c478bd9Sstevel@tonic-gate case AF_UNIX:
44057c478bd9Sstevel@tonic-gate /*
44067c478bd9Sstevel@tonic-gate * first check if this is first time through. Too much
44077c478bd9Sstevel@tonic-gate * duplicate code to put this in an aui_ routine.
44087c478bd9Sstevel@tonic-gate */
44097c478bd9Sstevel@tonic-gate
44107c478bd9Sstevel@tonic-gate /* get path from file struct here */
44117c478bd9Sstevel@tonic-gate fad = F2A(fp);
44127c478bd9Sstevel@tonic-gate ASSERT(fad);
44137c478bd9Sstevel@tonic-gate
44147c478bd9Sstevel@tonic-gate /*
44157c478bd9Sstevel@tonic-gate * already processed this file for read attempt
44167c478bd9Sstevel@tonic-gate */
44177c478bd9Sstevel@tonic-gate if (fad->fad_flags & FAD_READ) {
44187c478bd9Sstevel@tonic-gate /* don't want to audit every recvfrom attempt */
44197c478bd9Sstevel@tonic-gate tad->tad_flag = 0;
44207c478bd9Sstevel@tonic-gate /* free any residual audit data */
4421005d3febSMarek Pospisil au_close(kctx, &(u_ad), 0, 0, 0, NULL);
44227c478bd9Sstevel@tonic-gate releasef(fd);
44237c478bd9Sstevel@tonic-gate return;
44247c478bd9Sstevel@tonic-gate }
44257c478bd9Sstevel@tonic-gate /*
44267c478bd9Sstevel@tonic-gate * mark things so we know what happened and don't
44277c478bd9Sstevel@tonic-gate * repeat things
44287c478bd9Sstevel@tonic-gate */
44297c478bd9Sstevel@tonic-gate fad->fad_flags |= FAD_READ;
44307c478bd9Sstevel@tonic-gate
44317c478bd9Sstevel@tonic-gate if (fad->fad_aupath != NULL) {
44327c478bd9Sstevel@tonic-gate au_uwrite(au_to_path(fad->fad_aupath));
44337c478bd9Sstevel@tonic-gate } else {
44347c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "no path: fd", fd));
44357c478bd9Sstevel@tonic-gate }
44367c478bd9Sstevel@tonic-gate
44377c478bd9Sstevel@tonic-gate audit_attributes(fp->f_vnode);
44387c478bd9Sstevel@tonic-gate
44397c478bd9Sstevel@tonic-gate releasef(fd);
44407c478bd9Sstevel@tonic-gate
44417c478bd9Sstevel@tonic-gate return;
44427c478bd9Sstevel@tonic-gate
44437c478bd9Sstevel@tonic-gate default:
44447c478bd9Sstevel@tonic-gate break;
44457c478bd9Sstevel@tonic-gate
44467c478bd9Sstevel@tonic-gate }
44477c478bd9Sstevel@tonic-gate
44487c478bd9Sstevel@tonic-gate releasef(fd);
44497c478bd9Sstevel@tonic-gate
44507c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
44517c478bd9Sstevel@tonic-gate
44527c478bd9Sstevel@tonic-gate if (add_sock_token == 0) {
44537c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "family", (uint32_t)so_family));
44547c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "type", (uint32_t)so_type));
44557c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(3, "flags", (uint32_t)(uap->flags)));
44567c478bd9Sstevel@tonic-gate return;
44577c478bd9Sstevel@tonic-gate }
44587c478bd9Sstevel@tonic-gate
44597c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(3, "flags", (uint32_t)(uap->flags)));
44607c478bd9Sstevel@tonic-gate
44617c478bd9Sstevel@tonic-gate au_uwrite(au_to_socket_ex(so_family, so_type, so_laddr, so_faddr));
44627c478bd9Sstevel@tonic-gate }
44637c478bd9Sstevel@tonic-gate
44647c478bd9Sstevel@tonic-gate /*ARGSUSED*/
44657c478bd9Sstevel@tonic-gate static void
auf_sendmsg(struct t_audit_data * tad,int error,rval_t * rval)44667c478bd9Sstevel@tonic-gate auf_sendmsg(struct t_audit_data *tad, int error, rval_t *rval)
44677c478bd9Sstevel@tonic-gate {
44687c478bd9Sstevel@tonic-gate struct a {
44697c478bd9Sstevel@tonic-gate long fd;
44707c478bd9Sstevel@tonic-gate long msg; /* struct msghdr */
44717c478bd9Sstevel@tonic-gate long flags;
44727c478bd9Sstevel@tonic-gate } *uap = (struct a *)ttolwp(curthread)->lwp_ap;
44737c478bd9Sstevel@tonic-gate
44747c478bd9Sstevel@tonic-gate struct sonode *so;
44757c478bd9Sstevel@tonic-gate char so_laddr[sizeof (struct sockaddr_in6)];
44767c478bd9Sstevel@tonic-gate char so_faddr[sizeof (struct sockaddr_in6)];
44777c478bd9Sstevel@tonic-gate int err;
44787c478bd9Sstevel@tonic-gate int fd;
44797c478bd9Sstevel@tonic-gate short so_family, so_type;
44807c478bd9Sstevel@tonic-gate int add_sock_token = 0;
44810f1702c5SYu Xiangning socklen_t len;
44827c478bd9Sstevel@tonic-gate struct file *fp;
44837c478bd9Sstevel@tonic-gate struct f_audit_data *fad;
44847c478bd9Sstevel@tonic-gate caddr_t msg_name;
44857c478bd9Sstevel@tonic-gate socklen_t msg_namelen;
44867c478bd9Sstevel@tonic-gate STRUCT_DECL(msghdr, msg);
44879e9e6ab8Spaulson au_kcontext_t *kctx = GET_KCTX_PZ;
44887c478bd9Sstevel@tonic-gate
44897c478bd9Sstevel@tonic-gate fd = (int)uap->fd;
44907c478bd9Sstevel@tonic-gate
44917c478bd9Sstevel@tonic-gate /* bail if an error */
44927c478bd9Sstevel@tonic-gate if (error) {
44937c478bd9Sstevel@tonic-gate /* XXX include destination address from system call arguments */
44947c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
44957c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(3, "flags", (uint32_t)(uap->flags)));
44967c478bd9Sstevel@tonic-gate return;
44977c478bd9Sstevel@tonic-gate }
44987c478bd9Sstevel@tonic-gate
4499745b2690Stz204579 if ((so = getsonode(fd, &err, &fp)) == NULL) {
45007c478bd9Sstevel@tonic-gate /*
45017c478bd9Sstevel@tonic-gate * not security relevant if doing a sendmsg from non socket
45027c478bd9Sstevel@tonic-gate * so no extra tokens. Should probably turn off audit record
45037c478bd9Sstevel@tonic-gate * generation here.
45047c478bd9Sstevel@tonic-gate */
45057c478bd9Sstevel@tonic-gate return;
45067c478bd9Sstevel@tonic-gate }
45077c478bd9Sstevel@tonic-gate
45087c478bd9Sstevel@tonic-gate so_family = so->so_family;
45097c478bd9Sstevel@tonic-gate so_type = so->so_type;
45107c478bd9Sstevel@tonic-gate
45117c478bd9Sstevel@tonic-gate switch (so_family) {
45127c478bd9Sstevel@tonic-gate case AF_INET:
45137c478bd9Sstevel@tonic-gate case AF_INET6:
45147c478bd9Sstevel@tonic-gate /*
45157c478bd9Sstevel@tonic-gate * if datagram type socket, then just use what is in
45167c478bd9Sstevel@tonic-gate * socket structure for local address.
45177c478bd9Sstevel@tonic-gate * XXX - what do we do for other types?
45187c478bd9Sstevel@tonic-gate */
45197c478bd9Sstevel@tonic-gate if ((so->so_type == SOCK_DGRAM) ||
45207c478bd9Sstevel@tonic-gate (so->so_type == SOCK_RAW)) {
45217c478bd9Sstevel@tonic-gate
45227c478bd9Sstevel@tonic-gate bzero((void *)so_laddr, sizeof (so_laddr));
45237c478bd9Sstevel@tonic-gate bzero((void *)so_faddr, sizeof (so_faddr));
45247c478bd9Sstevel@tonic-gate
45257c478bd9Sstevel@tonic-gate /* get local address */
45260f1702c5SYu Xiangning len = sizeof (so_laddr);
45270f1702c5SYu Xiangning (void) socket_getsockname(so,
45280f1702c5SYu Xiangning (struct sockaddr *)so_laddr, &len, CRED());
45297c478bd9Sstevel@tonic-gate
45307c478bd9Sstevel@tonic-gate /* get peer address */
45317c478bd9Sstevel@tonic-gate STRUCT_INIT(msg, get_udatamodel());
45327c478bd9Sstevel@tonic-gate
45337c478bd9Sstevel@tonic-gate if (copyin((caddr_t)(uap->msg),
45347c478bd9Sstevel@tonic-gate (caddr_t)STRUCT_BUF(msg), STRUCT_SIZE(msg)) != 0) {
45357c478bd9Sstevel@tonic-gate break;
45367c478bd9Sstevel@tonic-gate }
45377c478bd9Sstevel@tonic-gate msg_name = (caddr_t)STRUCT_FGETP(msg, msg_name);
45387c478bd9Sstevel@tonic-gate if (msg_name == NULL)
45397c478bd9Sstevel@tonic-gate break;
45407c478bd9Sstevel@tonic-gate
45417c478bd9Sstevel@tonic-gate msg_namelen = (socklen_t)STRUCT_FGET(msg, msg_namelen);
45427c478bd9Sstevel@tonic-gate /* length is value from recvmsg - sanity check */
45437c478bd9Sstevel@tonic-gate if (msg_namelen == 0)
45447c478bd9Sstevel@tonic-gate break;
45457c478bd9Sstevel@tonic-gate
45467c478bd9Sstevel@tonic-gate if (copyin(msg_name, so_faddr,
45477c478bd9Sstevel@tonic-gate sizeof (so_faddr)) != 0)
45487c478bd9Sstevel@tonic-gate break;
45497c478bd9Sstevel@tonic-gate
45507c478bd9Sstevel@tonic-gate add_sock_token = 1;
45517c478bd9Sstevel@tonic-gate
45527c478bd9Sstevel@tonic-gate } else if (so->so_type == SOCK_STREAM) {
45537c478bd9Sstevel@tonic-gate
45547c478bd9Sstevel@tonic-gate /* get path from file struct here */
45557c478bd9Sstevel@tonic-gate fad = F2A(fp);
45567c478bd9Sstevel@tonic-gate ASSERT(fad);
45577c478bd9Sstevel@tonic-gate
45587c478bd9Sstevel@tonic-gate /*
45597c478bd9Sstevel@tonic-gate * already processed this file for write attempt
45607c478bd9Sstevel@tonic-gate */
45617c478bd9Sstevel@tonic-gate if (fad->fad_flags & FAD_WRITE) {
45627c478bd9Sstevel@tonic-gate releasef(fd);
45637c478bd9Sstevel@tonic-gate /* don't want to audit every sendmsg attempt */
45647c478bd9Sstevel@tonic-gate tad->tad_flag = 0;
45657c478bd9Sstevel@tonic-gate /* free any residual audit data */
4566005d3febSMarek Pospisil au_close(kctx, &(u_ad), 0, 0, 0, NULL);
45677c478bd9Sstevel@tonic-gate return;
45687c478bd9Sstevel@tonic-gate }
45697c478bd9Sstevel@tonic-gate
45707c478bd9Sstevel@tonic-gate /*
45717c478bd9Sstevel@tonic-gate * mark things so we know what happened and don't
45727c478bd9Sstevel@tonic-gate * repeat things
45737c478bd9Sstevel@tonic-gate */
45747c478bd9Sstevel@tonic-gate fad->fad_flags |= FAD_WRITE;
45757c478bd9Sstevel@tonic-gate
45767c478bd9Sstevel@tonic-gate bzero((void *)so_laddr, sizeof (so_laddr));
45777c478bd9Sstevel@tonic-gate bzero((void *)so_faddr, sizeof (so_faddr));
45787c478bd9Sstevel@tonic-gate
45797c478bd9Sstevel@tonic-gate /* get local and foreign addresses */
45800f1702c5SYu Xiangning len = sizeof (so_laddr);
45810f1702c5SYu Xiangning (void) socket_getsockname(so,
45820f1702c5SYu Xiangning (struct sockaddr *)so_laddr, &len, CRED());
45830f1702c5SYu Xiangning len = sizeof (so_faddr);
45840f1702c5SYu Xiangning (void) socket_getpeername(so,
45850f1702c5SYu Xiangning (struct sockaddr *)so_faddr, &len, B_FALSE, CRED());
45867c478bd9Sstevel@tonic-gate
45877c478bd9Sstevel@tonic-gate add_sock_token = 1;
45887c478bd9Sstevel@tonic-gate }
45897c478bd9Sstevel@tonic-gate
45907c478bd9Sstevel@tonic-gate /* XXX - what about SOCK_RAW/SOCK_RDM/SOCK_SEQPACKET ??? */
45917c478bd9Sstevel@tonic-gate
45927c478bd9Sstevel@tonic-gate break;
45937c478bd9Sstevel@tonic-gate
45947c478bd9Sstevel@tonic-gate case AF_UNIX:
45957c478bd9Sstevel@tonic-gate /*
45967c478bd9Sstevel@tonic-gate * first check if this is first time through. Too much
45977c478bd9Sstevel@tonic-gate * duplicate code to put this in an aui_ routine.
45987c478bd9Sstevel@tonic-gate */
45997c478bd9Sstevel@tonic-gate
46007c478bd9Sstevel@tonic-gate /* get path from file struct here */
46017c478bd9Sstevel@tonic-gate fad = F2A(fp);
46027c478bd9Sstevel@tonic-gate ASSERT(fad);
46037c478bd9Sstevel@tonic-gate
46047c478bd9Sstevel@tonic-gate /*
46057c478bd9Sstevel@tonic-gate * already processed this file for write attempt
46067c478bd9Sstevel@tonic-gate */
46077c478bd9Sstevel@tonic-gate if (fad->fad_flags & FAD_WRITE) {
46087c478bd9Sstevel@tonic-gate releasef(fd);
46097c478bd9Sstevel@tonic-gate /* don't want to audit every sendmsg attempt */
46107c478bd9Sstevel@tonic-gate tad->tad_flag = 0;
46117c478bd9Sstevel@tonic-gate /* free any residual audit data */
4612005d3febSMarek Pospisil au_close(kctx, &(u_ad), 0, 0, 0, NULL);
46137c478bd9Sstevel@tonic-gate return;
46147c478bd9Sstevel@tonic-gate }
46157c478bd9Sstevel@tonic-gate /*
46167c478bd9Sstevel@tonic-gate * mark things so we know what happened and don't
46177c478bd9Sstevel@tonic-gate * repeat things
46187c478bd9Sstevel@tonic-gate */
46197c478bd9Sstevel@tonic-gate fad->fad_flags |= FAD_WRITE;
46207c478bd9Sstevel@tonic-gate
46217c478bd9Sstevel@tonic-gate if (fad->fad_aupath != NULL) {
46227c478bd9Sstevel@tonic-gate au_uwrite(au_to_path(fad->fad_aupath));
46237c478bd9Sstevel@tonic-gate } else {
46247c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "no path: fd", fd));
46257c478bd9Sstevel@tonic-gate }
46267c478bd9Sstevel@tonic-gate
46277c478bd9Sstevel@tonic-gate audit_attributes(fp->f_vnode);
46287c478bd9Sstevel@tonic-gate
46297c478bd9Sstevel@tonic-gate releasef(fd);
46307c478bd9Sstevel@tonic-gate
46317c478bd9Sstevel@tonic-gate return;
46327c478bd9Sstevel@tonic-gate
46337c478bd9Sstevel@tonic-gate default:
46347c478bd9Sstevel@tonic-gate break;
46357c478bd9Sstevel@tonic-gate }
46367c478bd9Sstevel@tonic-gate
46377c478bd9Sstevel@tonic-gate releasef(fd);
46387c478bd9Sstevel@tonic-gate
46397c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
46407c478bd9Sstevel@tonic-gate
46417c478bd9Sstevel@tonic-gate if (add_sock_token == 0) {
46427c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "family", (uint32_t)so_family));
46437c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "type", (uint32_t)so_type));
46447c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(3, "flags", (uint32_t)(uap->flags)));
46457c478bd9Sstevel@tonic-gate return;
46467c478bd9Sstevel@tonic-gate }
46477c478bd9Sstevel@tonic-gate
46487c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(3, "flags", (uint32_t)(uap->flags)));
46497c478bd9Sstevel@tonic-gate
46507c478bd9Sstevel@tonic-gate au_uwrite(au_to_socket_ex(so_family, so_type, so_laddr, so_faddr));
46517c478bd9Sstevel@tonic-gate }
46527c478bd9Sstevel@tonic-gate
46537c478bd9Sstevel@tonic-gate /*ARGSUSED*/
46547c478bd9Sstevel@tonic-gate static void
auf_sendto(struct t_audit_data * tad,int error,rval_t * rval)46557c478bd9Sstevel@tonic-gate auf_sendto(struct t_audit_data *tad, int error, rval_t *rval)
46567c478bd9Sstevel@tonic-gate {
46577c478bd9Sstevel@tonic-gate struct a {
46587c478bd9Sstevel@tonic-gate long fd;
46597c478bd9Sstevel@tonic-gate long msg; /* char */
46607c478bd9Sstevel@tonic-gate long len;
46617c478bd9Sstevel@tonic-gate long flags;
46627c478bd9Sstevel@tonic-gate long to; /* struct sockaddr */
46637c478bd9Sstevel@tonic-gate long tolen;
46647c478bd9Sstevel@tonic-gate } *uap = (struct a *)ttolwp(curthread)->lwp_ap;
46657c478bd9Sstevel@tonic-gate
46667c478bd9Sstevel@tonic-gate struct sonode *so;
46677c478bd9Sstevel@tonic-gate char so_laddr[sizeof (struct sockaddr_in6)];
46687c478bd9Sstevel@tonic-gate char so_faddr[sizeof (struct sockaddr_in6)];
46697c478bd9Sstevel@tonic-gate socklen_t tolen;
46707c478bd9Sstevel@tonic-gate int err;
46717c478bd9Sstevel@tonic-gate int fd;
46720f1702c5SYu Xiangning socklen_t len;
46737c478bd9Sstevel@tonic-gate short so_family, so_type;
46747c478bd9Sstevel@tonic-gate int add_sock_token = 0;
46757c478bd9Sstevel@tonic-gate struct file *fp;
46767c478bd9Sstevel@tonic-gate struct f_audit_data *fad;
46779e9e6ab8Spaulson au_kcontext_t *kctx = GET_KCTX_PZ;
46787c478bd9Sstevel@tonic-gate
46797c478bd9Sstevel@tonic-gate fd = (int)uap->fd;
46807c478bd9Sstevel@tonic-gate
46817c478bd9Sstevel@tonic-gate /* bail if an error */
46827c478bd9Sstevel@tonic-gate if (error) {
46837c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
46847c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(3, "flags", (uint32_t)(uap->flags)));
46857c478bd9Sstevel@tonic-gate /* XXX include destination address from system call arguments */
46867c478bd9Sstevel@tonic-gate return;
46877c478bd9Sstevel@tonic-gate }
46887c478bd9Sstevel@tonic-gate
4689745b2690Stz204579 if ((so = getsonode(fd, &err, &fp)) == NULL) {
46907c478bd9Sstevel@tonic-gate /*
46917c478bd9Sstevel@tonic-gate * not security relevant if doing a sendto using non socket
46927c478bd9Sstevel@tonic-gate * so no extra tokens. Should probably turn off audit record
46937c478bd9Sstevel@tonic-gate * generation here.
46947c478bd9Sstevel@tonic-gate */
46957c478bd9Sstevel@tonic-gate return;
46967c478bd9Sstevel@tonic-gate }
46977c478bd9Sstevel@tonic-gate
46987c478bd9Sstevel@tonic-gate so_family = so->so_family;
46997c478bd9Sstevel@tonic-gate so_type = so->so_type;
47007c478bd9Sstevel@tonic-gate
47017c478bd9Sstevel@tonic-gate /*
47027c478bd9Sstevel@tonic-gate * only putout SOCKET_EX token if INET/INET6 family.
47037c478bd9Sstevel@tonic-gate * XXX - what do we do about other families?
47047c478bd9Sstevel@tonic-gate */
47057c478bd9Sstevel@tonic-gate
47067c478bd9Sstevel@tonic-gate switch (so_family) {
47077c478bd9Sstevel@tonic-gate case AF_INET:
47087c478bd9Sstevel@tonic-gate case AF_INET6:
47097c478bd9Sstevel@tonic-gate
47107c478bd9Sstevel@tonic-gate /*
47117c478bd9Sstevel@tonic-gate * if datagram type socket, then just use what is in
47127c478bd9Sstevel@tonic-gate * socket structure for local address.
47137c478bd9Sstevel@tonic-gate * XXX - what do we do for other types?
47147c478bd9Sstevel@tonic-gate */
47157c478bd9Sstevel@tonic-gate if ((so->so_type == SOCK_DGRAM) ||
47167c478bd9Sstevel@tonic-gate (so->so_type == SOCK_RAW)) {
47177c478bd9Sstevel@tonic-gate
47187c478bd9Sstevel@tonic-gate bzero((void *)so_laddr, sizeof (so_laddr));
47197c478bd9Sstevel@tonic-gate bzero((void *)so_faddr, sizeof (so_faddr));
47207c478bd9Sstevel@tonic-gate
47217c478bd9Sstevel@tonic-gate /* get local address */
47220f1702c5SYu Xiangning len = sizeof (so_laddr);
47230f1702c5SYu Xiangning (void) socket_getsockname(so,
47240f1702c5SYu Xiangning (struct sockaddr *)so_laddr, &len, CRED());
47257c478bd9Sstevel@tonic-gate
47267c478bd9Sstevel@tonic-gate /* get peer address */
47277c478bd9Sstevel@tonic-gate
47287c478bd9Sstevel@tonic-gate /* sanity check */
47297c478bd9Sstevel@tonic-gate if (uap->to == NULL)
47307c478bd9Sstevel@tonic-gate break;
47317c478bd9Sstevel@tonic-gate
47327c478bd9Sstevel@tonic-gate /* sanity checks */
47337c478bd9Sstevel@tonic-gate if (uap->tolen == 0)
47347c478bd9Sstevel@tonic-gate break;
47357c478bd9Sstevel@tonic-gate
47367c478bd9Sstevel@tonic-gate tolen = (socklen_t)uap->tolen;
47377c478bd9Sstevel@tonic-gate
47387c478bd9Sstevel@tonic-gate /* enforce maximum size */
47397c478bd9Sstevel@tonic-gate if (tolen > sizeof (so_faddr))
47407c478bd9Sstevel@tonic-gate tolen = sizeof (so_faddr);
47417c478bd9Sstevel@tonic-gate
47427c478bd9Sstevel@tonic-gate if (copyin((caddr_t)(uap->to), so_faddr, tolen) != 0)
47437c478bd9Sstevel@tonic-gate break;
47447c478bd9Sstevel@tonic-gate
47457c478bd9Sstevel@tonic-gate add_sock_token = 1;
47467c478bd9Sstevel@tonic-gate } else {
47477c478bd9Sstevel@tonic-gate /*
47487c478bd9Sstevel@tonic-gate * check if this is first time through.
47497c478bd9Sstevel@tonic-gate */
47507c478bd9Sstevel@tonic-gate
47517c478bd9Sstevel@tonic-gate /* get path from file struct here */
47527c478bd9Sstevel@tonic-gate fad = F2A(fp);
47537c478bd9Sstevel@tonic-gate ASSERT(fad);
47547c478bd9Sstevel@tonic-gate
47557c478bd9Sstevel@tonic-gate /*
47567c478bd9Sstevel@tonic-gate * already processed this file for write attempt
47577c478bd9Sstevel@tonic-gate */
47587c478bd9Sstevel@tonic-gate if (fad->fad_flags & FAD_WRITE) {
47597c478bd9Sstevel@tonic-gate /* don't want to audit every sendto attempt */
47607c478bd9Sstevel@tonic-gate tad->tad_flag = 0;
47617c478bd9Sstevel@tonic-gate /* free any residual audit data */
4762005d3febSMarek Pospisil au_close(kctx, &(u_ad), 0, 0, 0, NULL);
47637c478bd9Sstevel@tonic-gate releasef(fd);
47647c478bd9Sstevel@tonic-gate return;
47657c478bd9Sstevel@tonic-gate }
47667c478bd9Sstevel@tonic-gate /*
47677c478bd9Sstevel@tonic-gate * mark things so we know what happened and don't
47687c478bd9Sstevel@tonic-gate * repeat things
47697c478bd9Sstevel@tonic-gate */
47707c478bd9Sstevel@tonic-gate fad->fad_flags |= FAD_WRITE;
47717c478bd9Sstevel@tonic-gate
47727c478bd9Sstevel@tonic-gate bzero((void *)so_laddr, sizeof (so_laddr));
47737c478bd9Sstevel@tonic-gate bzero((void *)so_faddr, sizeof (so_faddr));
47747c478bd9Sstevel@tonic-gate
47757c478bd9Sstevel@tonic-gate /* get local and foreign addresses */
47760f1702c5SYu Xiangning len = sizeof (so_laddr);
47770f1702c5SYu Xiangning (void) socket_getsockname(so,
47780f1702c5SYu Xiangning (struct sockaddr *)so_laddr, &len, CRED());
47790f1702c5SYu Xiangning len = sizeof (so_faddr);
47800f1702c5SYu Xiangning (void) socket_getpeername(so,
47810f1702c5SYu Xiangning (struct sockaddr *)so_faddr, &len, B_FALSE, CRED());
47827c478bd9Sstevel@tonic-gate
47837c478bd9Sstevel@tonic-gate add_sock_token = 1;
47847c478bd9Sstevel@tonic-gate }
47857c478bd9Sstevel@tonic-gate
47867c478bd9Sstevel@tonic-gate /* XXX - what about SOCK_RDM/SOCK_SEQPACKET ??? */
47877c478bd9Sstevel@tonic-gate
47887c478bd9Sstevel@tonic-gate break;
47897c478bd9Sstevel@tonic-gate
47907c478bd9Sstevel@tonic-gate case AF_UNIX:
47917c478bd9Sstevel@tonic-gate /*
47927c478bd9Sstevel@tonic-gate * first check if this is first time through. Too much
47937c478bd9Sstevel@tonic-gate * duplicate code to put this in an aui_ routine.
47947c478bd9Sstevel@tonic-gate */
47957c478bd9Sstevel@tonic-gate
47967c478bd9Sstevel@tonic-gate /* get path from file struct here */
47977c478bd9Sstevel@tonic-gate fad = F2A(fp);
47987c478bd9Sstevel@tonic-gate ASSERT(fad);
47997c478bd9Sstevel@tonic-gate
48007c478bd9Sstevel@tonic-gate /*
48017c478bd9Sstevel@tonic-gate * already processed this file for write attempt
48027c478bd9Sstevel@tonic-gate */
48037c478bd9Sstevel@tonic-gate if (fad->fad_flags & FAD_WRITE) {
48047c478bd9Sstevel@tonic-gate /* don't want to audit every sendto attempt */
48057c478bd9Sstevel@tonic-gate tad->tad_flag = 0;
48067c478bd9Sstevel@tonic-gate /* free any residual audit data */
4807005d3febSMarek Pospisil au_close(kctx, &(u_ad), 0, 0, 0, NULL);
48087c478bd9Sstevel@tonic-gate releasef(fd);
48097c478bd9Sstevel@tonic-gate return;
48107c478bd9Sstevel@tonic-gate }
48117c478bd9Sstevel@tonic-gate /*
48127c478bd9Sstevel@tonic-gate * mark things so we know what happened and don't
48137c478bd9Sstevel@tonic-gate * repeat things
48147c478bd9Sstevel@tonic-gate */
48157c478bd9Sstevel@tonic-gate fad->fad_flags |= FAD_WRITE;
48167c478bd9Sstevel@tonic-gate
48177c478bd9Sstevel@tonic-gate if (fad->fad_aupath != NULL) {
48187c478bd9Sstevel@tonic-gate au_uwrite(au_to_path(fad->fad_aupath));
48197c478bd9Sstevel@tonic-gate } else {
48207c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "no path: fd", fd));
48217c478bd9Sstevel@tonic-gate }
48227c478bd9Sstevel@tonic-gate
48237c478bd9Sstevel@tonic-gate audit_attributes(fp->f_vnode);
48247c478bd9Sstevel@tonic-gate
48257c478bd9Sstevel@tonic-gate releasef(fd);
48267c478bd9Sstevel@tonic-gate
48277c478bd9Sstevel@tonic-gate return;
48287c478bd9Sstevel@tonic-gate
48297c478bd9Sstevel@tonic-gate default:
48307c478bd9Sstevel@tonic-gate break;
48317c478bd9Sstevel@tonic-gate
48327c478bd9Sstevel@tonic-gate }
48337c478bd9Sstevel@tonic-gate
48347c478bd9Sstevel@tonic-gate releasef(fd);
48357c478bd9Sstevel@tonic-gate
48367c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
48377c478bd9Sstevel@tonic-gate
48387c478bd9Sstevel@tonic-gate if (add_sock_token == 0) {
48397c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "family", (uint32_t)so_family));
48407c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "type", (uint32_t)so_type));
48417c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(3, "flags", (uint32_t)(uap->flags)));
48427c478bd9Sstevel@tonic-gate return;
48437c478bd9Sstevel@tonic-gate }
48447c478bd9Sstevel@tonic-gate
48457c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(3, "flags", (uint32_t)(uap->flags)));
48467c478bd9Sstevel@tonic-gate
48477c478bd9Sstevel@tonic-gate au_uwrite(au_to_socket_ex(so_family, so_type, so_laddr, so_faddr));
48487c478bd9Sstevel@tonic-gate
48497c478bd9Sstevel@tonic-gate }
48507c478bd9Sstevel@tonic-gate
48517c478bd9Sstevel@tonic-gate /*
4852da6c28aaSamw * XXX socket(2) may be equivalent to open(2) on a unix domain
48537c478bd9Sstevel@tonic-gate * socket. This needs investigation.
48547c478bd9Sstevel@tonic-gate */
48557c478bd9Sstevel@tonic-gate
48567c478bd9Sstevel@tonic-gate /*ARGSUSED*/
48577c478bd9Sstevel@tonic-gate static void
aus_socket(struct t_audit_data * tad)48587c478bd9Sstevel@tonic-gate aus_socket(struct t_audit_data *tad)
48597c478bd9Sstevel@tonic-gate {
48607c478bd9Sstevel@tonic-gate struct a {
48617c478bd9Sstevel@tonic-gate long domain;
48627c478bd9Sstevel@tonic-gate long type;
48637c478bd9Sstevel@tonic-gate long protocol;
48647c478bd9Sstevel@tonic-gate } *uap = (struct a *)ttolwp(curthread)->lwp_ap;
48657c478bd9Sstevel@tonic-gate
48667c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "domain", (uint32_t)uap->domain));
48677c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(2, "type", (uint32_t)uap->type));
48687c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(3, "protocol", (uint32_t)uap->protocol));
48697c478bd9Sstevel@tonic-gate }
48707c478bd9Sstevel@tonic-gate
48717c478bd9Sstevel@tonic-gate /*ARGSUSED*/
48727c478bd9Sstevel@tonic-gate static void
aus_sigqueue(struct t_audit_data * tad)48737c478bd9Sstevel@tonic-gate aus_sigqueue(struct t_audit_data *tad)
48747c478bd9Sstevel@tonic-gate {
48757c478bd9Sstevel@tonic-gate struct a {
48767c478bd9Sstevel@tonic-gate long pid;
48777c478bd9Sstevel@tonic-gate long signo;
48787c478bd9Sstevel@tonic-gate long *val;
48797c478bd9Sstevel@tonic-gate } *uap = (struct a *)ttolwp(curthread)->lwp_ap;
48807c478bd9Sstevel@tonic-gate struct proc *p;
48817c478bd9Sstevel@tonic-gate uid_t uid, ruid;
48827c478bd9Sstevel@tonic-gate gid_t gid, rgid;
48837c478bd9Sstevel@tonic-gate pid_t pid;
48847c478bd9Sstevel@tonic-gate const auditinfo_addr_t *ainfo;
48857c478bd9Sstevel@tonic-gate cred_t *cr;
48867c478bd9Sstevel@tonic-gate
48877c478bd9Sstevel@tonic-gate pid = (pid_t)uap->pid;
48887c478bd9Sstevel@tonic-gate
48897c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(2, "signal", (uint32_t)uap->signo));
48907c478bd9Sstevel@tonic-gate if (pid > 0) {
48917c478bd9Sstevel@tonic-gate mutex_enter(&pidlock);
48927c478bd9Sstevel@tonic-gate if ((p = prfind(pid)) == (struct proc *)0) {
48937c478bd9Sstevel@tonic-gate mutex_exit(&pidlock);
48947c478bd9Sstevel@tonic-gate return;
48957c478bd9Sstevel@tonic-gate }
48967c478bd9Sstevel@tonic-gate mutex_enter(&p->p_lock); /* so process doesn't go away */
48977c478bd9Sstevel@tonic-gate mutex_exit(&pidlock);
48987c478bd9Sstevel@tonic-gate
48997c478bd9Sstevel@tonic-gate mutex_enter(&p->p_crlock);
49007c478bd9Sstevel@tonic-gate crhold(cr = p->p_cred);
49017c478bd9Sstevel@tonic-gate mutex_exit(&p->p_crlock);
49027c478bd9Sstevel@tonic-gate mutex_exit(&p->p_lock);
49037c478bd9Sstevel@tonic-gate
49047c478bd9Sstevel@tonic-gate ainfo = crgetauinfo(cr);
49057c478bd9Sstevel@tonic-gate if (ainfo == NULL) {
49067c478bd9Sstevel@tonic-gate crfree(cr);
49077c478bd9Sstevel@tonic-gate return;
49087c478bd9Sstevel@tonic-gate }
49097c478bd9Sstevel@tonic-gate
49107c478bd9Sstevel@tonic-gate uid = crgetuid(cr);
49117c478bd9Sstevel@tonic-gate gid = crgetgid(cr);
49127c478bd9Sstevel@tonic-gate ruid = crgetruid(cr);
49137c478bd9Sstevel@tonic-gate rgid = crgetrgid(cr);
49147c478bd9Sstevel@tonic-gate au_uwrite(au_to_process(uid, gid, ruid, rgid, pid,
49157c478bd9Sstevel@tonic-gate ainfo->ai_auid, ainfo->ai_asid, &ainfo->ai_termid));
49167c478bd9Sstevel@tonic-gate crfree(cr);
49177c478bd9Sstevel@tonic-gate }
49187c478bd9Sstevel@tonic-gate else
49197c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "process ID", (uint32_t)pid));
49207c478bd9Sstevel@tonic-gate }
49217c478bd9Sstevel@tonic-gate
49227c478bd9Sstevel@tonic-gate /*ARGSUSED*/
49237c478bd9Sstevel@tonic-gate static void
aus_inst_sync(struct t_audit_data * tad)49247c478bd9Sstevel@tonic-gate aus_inst_sync(struct t_audit_data *tad)
49257c478bd9Sstevel@tonic-gate {
49267c478bd9Sstevel@tonic-gate struct a {
49277c478bd9Sstevel@tonic-gate long name; /* char */
49287c478bd9Sstevel@tonic-gate long flags;
49297c478bd9Sstevel@tonic-gate } *uap = (struct a *)ttolwp(curthread)->lwp_ap;
49307c478bd9Sstevel@tonic-gate
49317c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(2, "flags", (uint32_t)uap->flags));
49327c478bd9Sstevel@tonic-gate }
49337c478bd9Sstevel@tonic-gate
49347c478bd9Sstevel@tonic-gate /*ARGSUSED*/
49357c478bd9Sstevel@tonic-gate static void
aus_brandsys(struct t_audit_data * tad)49369acbbeafSnn35248 aus_brandsys(struct t_audit_data *tad)
49379acbbeafSnn35248 {
49389acbbeafSnn35248 klwp_t *clwp = ttolwp(curthread);
49399acbbeafSnn35248
49409acbbeafSnn35248 struct a {
49419acbbeafSnn35248 long cmd;
49429acbbeafSnn35248 long arg1;
49439acbbeafSnn35248 long arg2;
49449acbbeafSnn35248 long arg3;
49459acbbeafSnn35248 long arg4;
49469acbbeafSnn35248 long arg5;
49479acbbeafSnn35248 long arg6;
49489acbbeafSnn35248 } *uap = (struct a *)clwp->lwp_ap;
49499acbbeafSnn35248
49509acbbeafSnn35248 au_uwrite(au_to_arg32(1, "cmd", (uint_t)uap->cmd));
49519acbbeafSnn35248 #ifdef _LP64
49529acbbeafSnn35248 au_uwrite(au_to_arg64(2, "arg1", (uint64_t)uap->arg1));
49539acbbeafSnn35248 au_uwrite(au_to_arg64(3, "arg2", (uint64_t)uap->arg2));
49549acbbeafSnn35248 au_uwrite(au_to_arg64(4, "arg3", (uint64_t)uap->arg3));
49559acbbeafSnn35248 au_uwrite(au_to_arg64(5, "arg4", (uint64_t)uap->arg4));
49569acbbeafSnn35248 au_uwrite(au_to_arg64(6, "arg5", (uint64_t)uap->arg5));
49579acbbeafSnn35248 au_uwrite(au_to_arg64(7, "arg6", (uint64_t)uap->arg6));
49589acbbeafSnn35248 #else
49599acbbeafSnn35248 au_uwrite(au_to_arg32(2, "arg1", (uint32_t)uap->arg1));
49609acbbeafSnn35248 au_uwrite(au_to_arg32(3, "arg2", (uint32_t)uap->arg2));
49619acbbeafSnn35248 au_uwrite(au_to_arg32(4, "arg3", (uint32_t)uap->arg3));
49629acbbeafSnn35248 au_uwrite(au_to_arg32(5, "arg4", (uint32_t)uap->arg4));
49639acbbeafSnn35248 au_uwrite(au_to_arg32(6, "arg5", (uint32_t)uap->arg5));
49649acbbeafSnn35248 au_uwrite(au_to_arg32(7, "arg6", (uint32_t)uap->arg6));
49659acbbeafSnn35248 #endif
49669acbbeafSnn35248 }
49679acbbeafSnn35248
49689acbbeafSnn35248 /*ARGSUSED*/
49699acbbeafSnn35248 static void
aus_p_online(struct t_audit_data * tad)49707c478bd9Sstevel@tonic-gate aus_p_online(struct t_audit_data *tad)
49717c478bd9Sstevel@tonic-gate {
49727c478bd9Sstevel@tonic-gate struct a {
49737c478bd9Sstevel@tonic-gate long processor_id;
49747c478bd9Sstevel@tonic-gate long flag;
49757c478bd9Sstevel@tonic-gate } *uap = (struct a *)ttolwp(curthread)->lwp_ap;
49767c478bd9Sstevel@tonic-gate
49777c478bd9Sstevel@tonic-gate struct flags {
49787c478bd9Sstevel@tonic-gate int flag;
49797c478bd9Sstevel@tonic-gate char *cflag;
49807c478bd9Sstevel@tonic-gate } aflags[6] = {
49817c478bd9Sstevel@tonic-gate { P_ONLINE, "P_ONLINE"},
49827c478bd9Sstevel@tonic-gate { P_OFFLINE, "P_OFFLINE"},
49837c478bd9Sstevel@tonic-gate { P_NOINTR, "P_NOINTR"},
49847c478bd9Sstevel@tonic-gate { P_SPARE, "P_SPARE"},
49857c478bd9Sstevel@tonic-gate { P_FAULTED, "P_FAULTED"},
49867c478bd9Sstevel@tonic-gate { P_STATUS, "P_STATUS"}
49877c478bd9Sstevel@tonic-gate };
49887c478bd9Sstevel@tonic-gate int i;
49897c478bd9Sstevel@tonic-gate char *cflag;
49907c478bd9Sstevel@tonic-gate
49917c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "processor ID", (uint32_t)uap->processor_id));
49927c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(2, "flag", (uint32_t)uap->flag));
49937c478bd9Sstevel@tonic-gate
49947c478bd9Sstevel@tonic-gate for (i = 0; i < 6; i++) {
49957c478bd9Sstevel@tonic-gate if (aflags[i].flag == uap->flag)
49967c478bd9Sstevel@tonic-gate break;
49977c478bd9Sstevel@tonic-gate }
49987c478bd9Sstevel@tonic-gate cflag = (i == 6) ? "bad flag":aflags[i].cflag;
49997c478bd9Sstevel@tonic-gate
50007c478bd9Sstevel@tonic-gate au_uwrite(au_to_text(cflag));
50017c478bd9Sstevel@tonic-gate }
50027c478bd9Sstevel@tonic-gate
50037c478bd9Sstevel@tonic-gate /*ARGSUSED*/
50047c478bd9Sstevel@tonic-gate static void
aus_processor_bind(struct t_audit_data * tad)50057c478bd9Sstevel@tonic-gate aus_processor_bind(struct t_audit_data *tad)
50067c478bd9Sstevel@tonic-gate {
50077c478bd9Sstevel@tonic-gate struct a {
50087c478bd9Sstevel@tonic-gate long id_type;
50097c478bd9Sstevel@tonic-gate long id;
50107c478bd9Sstevel@tonic-gate long processor_id;
50117c478bd9Sstevel@tonic-gate long obind;
50127c478bd9Sstevel@tonic-gate } *uap = (struct a *)ttolwp(curthread)->lwp_ap;
50137c478bd9Sstevel@tonic-gate
50147c478bd9Sstevel@tonic-gate struct proc *p;
50157c478bd9Sstevel@tonic-gate int lwpcnt;
50167c478bd9Sstevel@tonic-gate uid_t uid, ruid;
50177c478bd9Sstevel@tonic-gate gid_t gid, rgid;
50187c478bd9Sstevel@tonic-gate pid_t pid;
50197c478bd9Sstevel@tonic-gate const auditinfo_addr_t *ainfo;
50207c478bd9Sstevel@tonic-gate cred_t *cr;
50217c478bd9Sstevel@tonic-gate
50227c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "ID type", (uint32_t)uap->id_type));
50237c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(2, "ID", (uint32_t)uap->id));
50247c478bd9Sstevel@tonic-gate if (uap->processor_id == PBIND_NONE)
50257c478bd9Sstevel@tonic-gate au_uwrite(au_to_text("PBIND_NONE"));
50267c478bd9Sstevel@tonic-gate else
50277c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(3, "processor_id",
50287c478bd9Sstevel@tonic-gate (uint32_t)uap->processor_id));
50297c478bd9Sstevel@tonic-gate
50307c478bd9Sstevel@tonic-gate switch (uap->id_type) {
50317c478bd9Sstevel@tonic-gate case P_MYID:
50327c478bd9Sstevel@tonic-gate case P_LWPID:
50337c478bd9Sstevel@tonic-gate mutex_enter(&pidlock);
50347c478bd9Sstevel@tonic-gate p = ttoproc(curthread);
50357c478bd9Sstevel@tonic-gate if (p == NULL || p->p_as == &kas) {
50367c478bd9Sstevel@tonic-gate mutex_exit(&pidlock);
50377c478bd9Sstevel@tonic-gate return;
50387c478bd9Sstevel@tonic-gate }
50397c478bd9Sstevel@tonic-gate mutex_enter(&p->p_lock);
50407c478bd9Sstevel@tonic-gate mutex_exit(&pidlock);
50417c478bd9Sstevel@tonic-gate lwpcnt = p->p_lwpcnt;
50427c478bd9Sstevel@tonic-gate pid = p->p_pid;
50437c478bd9Sstevel@tonic-gate
50447c478bd9Sstevel@tonic-gate mutex_enter(&p->p_crlock);
50457c478bd9Sstevel@tonic-gate crhold(cr = p->p_cred);
50467c478bd9Sstevel@tonic-gate mutex_exit(&p->p_crlock);
50477c478bd9Sstevel@tonic-gate mutex_exit(&p->p_lock);
50487c478bd9Sstevel@tonic-gate
50497c478bd9Sstevel@tonic-gate ainfo = crgetauinfo(cr);
50507c478bd9Sstevel@tonic-gate if (ainfo == NULL) {
50517c478bd9Sstevel@tonic-gate crfree(cr);
50527c478bd9Sstevel@tonic-gate return;
50537c478bd9Sstevel@tonic-gate }
50547c478bd9Sstevel@tonic-gate
50557c478bd9Sstevel@tonic-gate uid = crgetuid(cr);
50567c478bd9Sstevel@tonic-gate gid = crgetgid(cr);
50577c478bd9Sstevel@tonic-gate ruid = crgetruid(cr);
50587c478bd9Sstevel@tonic-gate rgid = crgetrgid(cr);
50597c478bd9Sstevel@tonic-gate au_uwrite(au_to_process(uid, gid, ruid, rgid, pid,
50607c478bd9Sstevel@tonic-gate ainfo->ai_auid, ainfo->ai_asid, &ainfo->ai_termid));
50617c478bd9Sstevel@tonic-gate crfree(cr);
50627c478bd9Sstevel@tonic-gate break;
50637c478bd9Sstevel@tonic-gate case P_PID:
50647c478bd9Sstevel@tonic-gate mutex_enter(&pidlock);
50657c478bd9Sstevel@tonic-gate p = prfind(uap->id);
50667c478bd9Sstevel@tonic-gate if (p == NULL || p->p_as == &kas) {
50677c478bd9Sstevel@tonic-gate mutex_exit(&pidlock);
50687c478bd9Sstevel@tonic-gate return;
50697c478bd9Sstevel@tonic-gate }
50707c478bd9Sstevel@tonic-gate mutex_enter(&p->p_lock);
50717c478bd9Sstevel@tonic-gate mutex_exit(&pidlock);
50727c478bd9Sstevel@tonic-gate lwpcnt = p->p_lwpcnt;
50737c478bd9Sstevel@tonic-gate pid = p->p_pid;
50747c478bd9Sstevel@tonic-gate
50757c478bd9Sstevel@tonic-gate mutex_enter(&p->p_crlock);
50767c478bd9Sstevel@tonic-gate crhold(cr = p->p_cred);
50777c478bd9Sstevel@tonic-gate mutex_exit(&p->p_crlock);
50787c478bd9Sstevel@tonic-gate mutex_exit(&p->p_lock);
50797c478bd9Sstevel@tonic-gate
50807c478bd9Sstevel@tonic-gate ainfo = crgetauinfo(cr);
50817c478bd9Sstevel@tonic-gate if (ainfo == NULL) {
50827c478bd9Sstevel@tonic-gate crfree(cr);
50837c478bd9Sstevel@tonic-gate return;
50847c478bd9Sstevel@tonic-gate }
50857c478bd9Sstevel@tonic-gate
50867c478bd9Sstevel@tonic-gate uid = crgetuid(cr);
50877c478bd9Sstevel@tonic-gate gid = crgetgid(cr);
50887c478bd9Sstevel@tonic-gate ruid = crgetruid(cr);
50897c478bd9Sstevel@tonic-gate rgid = crgetrgid(cr);
50907c478bd9Sstevel@tonic-gate au_uwrite(au_to_process(uid, gid, ruid, rgid, pid,
50917c478bd9Sstevel@tonic-gate ainfo->ai_auid, ainfo->ai_asid, &ainfo->ai_termid));
50927c478bd9Sstevel@tonic-gate crfree(cr);
50937c478bd9Sstevel@tonic-gate
50947c478bd9Sstevel@tonic-gate break;
50957c478bd9Sstevel@tonic-gate default:
50967c478bd9Sstevel@tonic-gate return;
50977c478bd9Sstevel@tonic-gate }
50987c478bd9Sstevel@tonic-gate
50997c478bd9Sstevel@tonic-gate if (uap->processor_id == PBIND_NONE &&
51007c478bd9Sstevel@tonic-gate (!(uap->id_type == P_LWPID && lwpcnt > 1)))
51017c478bd9Sstevel@tonic-gate au_uwrite(au_to_text("PBIND_NONE for process"));
51027c478bd9Sstevel@tonic-gate else
51037c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(3, "processor_id",
51047c478bd9Sstevel@tonic-gate (uint32_t)uap->processor_id));
51057c478bd9Sstevel@tonic-gate }
51067c478bd9Sstevel@tonic-gate
51077c478bd9Sstevel@tonic-gate /*ARGSUSED*/
51087c478bd9Sstevel@tonic-gate static au_event_t
aui_doorfs(au_event_t e)51097c478bd9Sstevel@tonic-gate aui_doorfs(au_event_t e)
51107c478bd9Sstevel@tonic-gate {
51117c478bd9Sstevel@tonic-gate uint32_t code;
51127c478bd9Sstevel@tonic-gate
51137c478bd9Sstevel@tonic-gate struct a { /* doorfs */
51147c478bd9Sstevel@tonic-gate long a1;
51157c478bd9Sstevel@tonic-gate long a2;
51167c478bd9Sstevel@tonic-gate long a3;
51177c478bd9Sstevel@tonic-gate long a4;
51187c478bd9Sstevel@tonic-gate long a5;
51197c478bd9Sstevel@tonic-gate long code;
51207c478bd9Sstevel@tonic-gate } *uap = (struct a *)ttolwp(curthread)->lwp_ap;
51217c478bd9Sstevel@tonic-gate
51227c478bd9Sstevel@tonic-gate /*
51237c478bd9Sstevel@tonic-gate * audit formats for several of the
51247c478bd9Sstevel@tonic-gate * door calls have not yet been determined
51257c478bd9Sstevel@tonic-gate */
51267c478bd9Sstevel@tonic-gate code = (uint32_t)uap->code;
51277c478bd9Sstevel@tonic-gate switch (code) {
51287c478bd9Sstevel@tonic-gate case DOOR_CALL:
51297c478bd9Sstevel@tonic-gate e = AUE_DOORFS_DOOR_CALL;
51307c478bd9Sstevel@tonic-gate break;
51317c478bd9Sstevel@tonic-gate case DOOR_RETURN:
51327c478bd9Sstevel@tonic-gate e = AUE_NULL;
51337c478bd9Sstevel@tonic-gate break;
51347c478bd9Sstevel@tonic-gate case DOOR_CREATE:
51357c478bd9Sstevel@tonic-gate e = AUE_DOORFS_DOOR_CREATE;
51367c478bd9Sstevel@tonic-gate break;
51377c478bd9Sstevel@tonic-gate case DOOR_REVOKE:
51387c478bd9Sstevel@tonic-gate e = AUE_DOORFS_DOOR_REVOKE;
51397c478bd9Sstevel@tonic-gate break;
51407c478bd9Sstevel@tonic-gate case DOOR_INFO:
51417c478bd9Sstevel@tonic-gate e = AUE_NULL;
51427c478bd9Sstevel@tonic-gate break;
51437c478bd9Sstevel@tonic-gate case DOOR_UCRED:
51447c478bd9Sstevel@tonic-gate e = AUE_NULL;
51457c478bd9Sstevel@tonic-gate break;
51467c478bd9Sstevel@tonic-gate case DOOR_BIND:
51477c478bd9Sstevel@tonic-gate e = AUE_NULL;
51487c478bd9Sstevel@tonic-gate break;
51497c478bd9Sstevel@tonic-gate case DOOR_UNBIND:
51507c478bd9Sstevel@tonic-gate e = AUE_NULL;
51517c478bd9Sstevel@tonic-gate break;
51527c478bd9Sstevel@tonic-gate case DOOR_GETPARAM:
51537c478bd9Sstevel@tonic-gate e = AUE_NULL;
51547c478bd9Sstevel@tonic-gate break;
51557c478bd9Sstevel@tonic-gate case DOOR_SETPARAM:
51567c478bd9Sstevel@tonic-gate e = AUE_NULL;
51577c478bd9Sstevel@tonic-gate break;
51587c478bd9Sstevel@tonic-gate default: /* illegal system call */
51597c478bd9Sstevel@tonic-gate e = AUE_NULL;
51607c478bd9Sstevel@tonic-gate break;
51617c478bd9Sstevel@tonic-gate }
51627c478bd9Sstevel@tonic-gate
51637c478bd9Sstevel@tonic-gate return (e);
51647c478bd9Sstevel@tonic-gate }
51657c478bd9Sstevel@tonic-gate
51667c478bd9Sstevel@tonic-gate static door_node_t *
au_door_lookup(int did)51677c478bd9Sstevel@tonic-gate au_door_lookup(int did)
51687c478bd9Sstevel@tonic-gate {
51697c478bd9Sstevel@tonic-gate vnode_t *vp;
51707c478bd9Sstevel@tonic-gate file_t *fp;
51717c478bd9Sstevel@tonic-gate
51727c478bd9Sstevel@tonic-gate if ((fp = getf(did)) == NULL)
51737c478bd9Sstevel@tonic-gate return (NULL);
51747c478bd9Sstevel@tonic-gate /*
51757c478bd9Sstevel@tonic-gate * Use the underlying vnode (we may be namefs mounted)
51767c478bd9Sstevel@tonic-gate */
5177da6c28aaSamw if (VOP_REALVP(fp->f_vnode, &vp, NULL))
51787c478bd9Sstevel@tonic-gate vp = fp->f_vnode;
51797c478bd9Sstevel@tonic-gate
51807c478bd9Sstevel@tonic-gate if (vp == NULL || vp->v_type != VDOOR) {
51817c478bd9Sstevel@tonic-gate releasef(did);
51827c478bd9Sstevel@tonic-gate return (NULL);
51837c478bd9Sstevel@tonic-gate }
51847c478bd9Sstevel@tonic-gate
51857c478bd9Sstevel@tonic-gate return (VTOD(vp));
51867c478bd9Sstevel@tonic-gate }
51877c478bd9Sstevel@tonic-gate
51887c478bd9Sstevel@tonic-gate /*ARGSUSED*/
51897c478bd9Sstevel@tonic-gate static void
aus_doorfs(struct t_audit_data * tad)51907c478bd9Sstevel@tonic-gate aus_doorfs(struct t_audit_data *tad)
51917c478bd9Sstevel@tonic-gate {
51927c478bd9Sstevel@tonic-gate
51937c478bd9Sstevel@tonic-gate struct a { /* doorfs */
51947c478bd9Sstevel@tonic-gate long a1;
51957c478bd9Sstevel@tonic-gate long a2;
51967c478bd9Sstevel@tonic-gate long a3;
51977c478bd9Sstevel@tonic-gate long a4;
51987c478bd9Sstevel@tonic-gate long a5;
51997c478bd9Sstevel@tonic-gate long code;
52007c478bd9Sstevel@tonic-gate } *uap = (struct a *)ttolwp(curthread)->lwp_ap;
52017c478bd9Sstevel@tonic-gate
52027c478bd9Sstevel@tonic-gate door_node_t *dp;
52037c478bd9Sstevel@tonic-gate struct proc *p;
52047c478bd9Sstevel@tonic-gate uint32_t did;
52057c478bd9Sstevel@tonic-gate uid_t uid, ruid;
52067c478bd9Sstevel@tonic-gate gid_t gid, rgid;
52077c478bd9Sstevel@tonic-gate pid_t pid;
52087c478bd9Sstevel@tonic-gate const auditinfo_addr_t *ainfo;
52097c478bd9Sstevel@tonic-gate cred_t *cr;
52107c478bd9Sstevel@tonic-gate
52117c478bd9Sstevel@tonic-gate did = (uint32_t)uap->a1;
52127c478bd9Sstevel@tonic-gate
52137c478bd9Sstevel@tonic-gate switch (tad->tad_event) {
52147c478bd9Sstevel@tonic-gate case AUE_DOORFS_DOOR_CALL:
52157c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "door ID", (uint32_t)did));
52167c478bd9Sstevel@tonic-gate if ((dp = au_door_lookup(did)) == NULL)
52177c478bd9Sstevel@tonic-gate break;
52187c478bd9Sstevel@tonic-gate
52197c478bd9Sstevel@tonic-gate if (DOOR_INVALID(dp)) {
52207c478bd9Sstevel@tonic-gate releasef(did);
52217c478bd9Sstevel@tonic-gate break;
52227c478bd9Sstevel@tonic-gate }
52237c478bd9Sstevel@tonic-gate
52247c478bd9Sstevel@tonic-gate if ((p = dp->door_target) == NULL) {
52257c478bd9Sstevel@tonic-gate releasef(did);
52267c478bd9Sstevel@tonic-gate break;
52277c478bd9Sstevel@tonic-gate }
52287c478bd9Sstevel@tonic-gate mutex_enter(&p->p_lock);
52297c478bd9Sstevel@tonic-gate releasef(did);
52307c478bd9Sstevel@tonic-gate
52317c478bd9Sstevel@tonic-gate pid = p->p_pid;
52327c478bd9Sstevel@tonic-gate
52337c478bd9Sstevel@tonic-gate mutex_enter(&p->p_crlock);
52347c478bd9Sstevel@tonic-gate crhold(cr = p->p_cred);
52357c478bd9Sstevel@tonic-gate mutex_exit(&p->p_crlock);
52367c478bd9Sstevel@tonic-gate mutex_exit(&p->p_lock);
52377c478bd9Sstevel@tonic-gate
52387c478bd9Sstevel@tonic-gate ainfo = crgetauinfo(cr);
52397c478bd9Sstevel@tonic-gate if (ainfo == NULL) {
52407c478bd9Sstevel@tonic-gate crfree(cr);
52417c478bd9Sstevel@tonic-gate return;
52427c478bd9Sstevel@tonic-gate }
52437c478bd9Sstevel@tonic-gate uid = crgetuid(cr);
52447c478bd9Sstevel@tonic-gate gid = crgetgid(cr);
52457c478bd9Sstevel@tonic-gate ruid = crgetruid(cr);
52467c478bd9Sstevel@tonic-gate rgid = crgetrgid(cr);
52477c478bd9Sstevel@tonic-gate au_uwrite(au_to_process(uid, gid, ruid, rgid, pid,
52487c478bd9Sstevel@tonic-gate ainfo->ai_auid, ainfo->ai_asid, &ainfo->ai_termid));
52497c478bd9Sstevel@tonic-gate crfree(cr);
52507c478bd9Sstevel@tonic-gate break;
52517c478bd9Sstevel@tonic-gate case AUE_DOORFS_DOOR_RETURN:
52527c478bd9Sstevel@tonic-gate /*
52537c478bd9Sstevel@tonic-gate * We may want to write information about
52547c478bd9Sstevel@tonic-gate * all doors (if any) which will be copied
52557c478bd9Sstevel@tonic-gate * by this call to the user space
52567c478bd9Sstevel@tonic-gate */
52577c478bd9Sstevel@tonic-gate break;
52587c478bd9Sstevel@tonic-gate case AUE_DOORFS_DOOR_CREATE:
52597c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(3, "door attr", (uint32_t)uap->a3));
52607c478bd9Sstevel@tonic-gate break;
52617c478bd9Sstevel@tonic-gate case AUE_DOORFS_DOOR_REVOKE:
52627c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "door ID", (uint32_t)did));
52637c478bd9Sstevel@tonic-gate break;
52647c478bd9Sstevel@tonic-gate case AUE_DOORFS_DOOR_INFO:
52657c478bd9Sstevel@tonic-gate break;
52667c478bd9Sstevel@tonic-gate case AUE_DOORFS_DOOR_CRED:
52677c478bd9Sstevel@tonic-gate break;
52687c478bd9Sstevel@tonic-gate case AUE_DOORFS_DOOR_BIND:
52697c478bd9Sstevel@tonic-gate break;
52707c478bd9Sstevel@tonic-gate case AUE_DOORFS_DOOR_UNBIND: {
52717c478bd9Sstevel@tonic-gate break;
52727c478bd9Sstevel@tonic-gate }
52737c478bd9Sstevel@tonic-gate default: /* illegal system call */
52747c478bd9Sstevel@tonic-gate break;
52757c478bd9Sstevel@tonic-gate }
52767c478bd9Sstevel@tonic-gate }
52777c478bd9Sstevel@tonic-gate
52787c478bd9Sstevel@tonic-gate /*ARGSUSED*/
52797c478bd9Sstevel@tonic-gate static au_event_t
aui_acl(au_event_t e)52807c478bd9Sstevel@tonic-gate aui_acl(au_event_t e)
52817c478bd9Sstevel@tonic-gate {
52827c478bd9Sstevel@tonic-gate struct a {
52837c478bd9Sstevel@tonic-gate union {
52847c478bd9Sstevel@tonic-gate long name; /* char */
52857c478bd9Sstevel@tonic-gate long fd;
52867c478bd9Sstevel@tonic-gate } obj;
52877c478bd9Sstevel@tonic-gate
52887c478bd9Sstevel@tonic-gate long cmd;
52897c478bd9Sstevel@tonic-gate long nentries;
52907c478bd9Sstevel@tonic-gate long arg; /* aclent_t */
52917c478bd9Sstevel@tonic-gate } *uap = (struct a *)ttolwp(curthread)->lwp_ap;
52927c478bd9Sstevel@tonic-gate
52937c478bd9Sstevel@tonic-gate switch (uap->cmd) {
52947c478bd9Sstevel@tonic-gate case SETACL:
5295a7746f66Stz204579 case ACE_SETACL:
5296a7746f66Stz204579 /*
5297a7746f66Stz204579 * acl(SETACL/ACE_SETACL, ...) and facl(SETACL/ACE_SETACL, ...)
5298a7746f66Stz204579 * are expected.
5299a7746f66Stz204579 */
53007c478bd9Sstevel@tonic-gate break;
53017c478bd9Sstevel@tonic-gate case GETACL:
53027c478bd9Sstevel@tonic-gate case GETACLCNT:
5303ebbb0311SJan Friedel case ACE_GETACL:
5304a7746f66Stz204579 case ACE_GETACLCNT:
5305ebbb0311SJan Friedel /* do nothing for these four values. */
53067c478bd9Sstevel@tonic-gate e = AUE_NULL;
53077c478bd9Sstevel@tonic-gate break;
53087c478bd9Sstevel@tonic-gate default:
53097c478bd9Sstevel@tonic-gate /* illegal system call */
53107c478bd9Sstevel@tonic-gate break;
53117c478bd9Sstevel@tonic-gate }
53127c478bd9Sstevel@tonic-gate
53137c478bd9Sstevel@tonic-gate return (e);
53147c478bd9Sstevel@tonic-gate }
53157c478bd9Sstevel@tonic-gate
5316a7746f66Stz204579 static void
au_acl(int cmd,int nentries,caddr_t bufp)5317a7746f66Stz204579 au_acl(int cmd, int nentries, caddr_t bufp)
5318a7746f66Stz204579 {
5319a7746f66Stz204579 size_t a_size;
5320a7746f66Stz204579 aclent_t *aclbufp;
5321a7746f66Stz204579 ace_t *acebufp;
5322a7746f66Stz204579 int i;
5323a7746f66Stz204579
5324a7746f66Stz204579 switch (cmd) {
5325a7746f66Stz204579 case GETACL:
5326a7746f66Stz204579 case GETACLCNT:
5327a7746f66Stz204579 break;
5328a7746f66Stz204579 case SETACL:
5329a7746f66Stz204579 if (nentries < 3)
5330a7746f66Stz204579 break;
5331a7746f66Stz204579
5332a7746f66Stz204579 a_size = nentries * sizeof (aclent_t);
5333a7746f66Stz204579
5334a7746f66Stz204579 if ((aclbufp = kmem_alloc(a_size, KM_SLEEP)) == NULL)
5335a7746f66Stz204579 break;
5336a7746f66Stz204579 if (copyin(bufp, aclbufp, a_size)) {
5337a7746f66Stz204579 kmem_free(aclbufp, a_size);
5338a7746f66Stz204579 break;
5339a7746f66Stz204579 }
5340a7746f66Stz204579 for (i = 0; i < nentries; i++) {
5341a7746f66Stz204579 au_uwrite(au_to_acl(aclbufp + i));
5342a7746f66Stz204579 }
5343a7746f66Stz204579 kmem_free(aclbufp, a_size);
5344a7746f66Stz204579 break;
5345a7746f66Stz204579
5346a7746f66Stz204579 case ACE_SETACL:
5347a7746f66Stz204579 if (nentries < 1 || nentries > MAX_ACL_ENTRIES)
5348a7746f66Stz204579 break;
5349a7746f66Stz204579
5350a7746f66Stz204579 a_size = nentries * sizeof (ace_t);
5351a7746f66Stz204579 if ((acebufp = kmem_alloc(a_size, KM_SLEEP)) == NULL)
5352a7746f66Stz204579 break;
5353a7746f66Stz204579 if (copyin(bufp, acebufp, a_size)) {
5354a7746f66Stz204579 kmem_free(acebufp, a_size);
5355a7746f66Stz204579 break;
5356a7746f66Stz204579 }
5357a7746f66Stz204579 for (i = 0; i < nentries; i++) {
5358a7746f66Stz204579 au_uwrite(au_to_ace(acebufp + i));
5359a7746f66Stz204579 }
5360a7746f66Stz204579 kmem_free(acebufp, a_size);
5361a7746f66Stz204579 break;
5362a7746f66Stz204579 default:
5363a7746f66Stz204579 break;
5364a7746f66Stz204579 }
5365a7746f66Stz204579 }
53667c478bd9Sstevel@tonic-gate
53677c478bd9Sstevel@tonic-gate /*ARGSUSED*/
53687c478bd9Sstevel@tonic-gate static void
aus_acl(struct t_audit_data * tad)53697c478bd9Sstevel@tonic-gate aus_acl(struct t_audit_data *tad)
53707c478bd9Sstevel@tonic-gate {
53717c478bd9Sstevel@tonic-gate struct a {
53727c478bd9Sstevel@tonic-gate long fname;
53737c478bd9Sstevel@tonic-gate long cmd;
53747c478bd9Sstevel@tonic-gate long nentries;
53757c478bd9Sstevel@tonic-gate long aclbufp;
53767c478bd9Sstevel@tonic-gate } *uap = (struct a *)ttolwp(curthread)->lwp_ap;
53777c478bd9Sstevel@tonic-gate
53787c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(2, "cmd", (uint32_t)uap->cmd));
53797c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(3, "nentries", (uint32_t)uap->nentries));
53807c478bd9Sstevel@tonic-gate
5381a7746f66Stz204579 au_acl(uap->cmd, uap->nentries, (caddr_t)uap->aclbufp);
53827c478bd9Sstevel@tonic-gate }
53837c478bd9Sstevel@tonic-gate
53847c478bd9Sstevel@tonic-gate /*ARGSUSED*/
53857c478bd9Sstevel@tonic-gate static void
aus_facl(struct t_audit_data * tad)53867c478bd9Sstevel@tonic-gate aus_facl(struct t_audit_data *tad)
53877c478bd9Sstevel@tonic-gate {
53887c478bd9Sstevel@tonic-gate struct a {
53897c478bd9Sstevel@tonic-gate long fd;
53907c478bd9Sstevel@tonic-gate long cmd;
53917c478bd9Sstevel@tonic-gate long nentries;
53927c478bd9Sstevel@tonic-gate long aclbufp;
53937c478bd9Sstevel@tonic-gate } *uap = (struct a *)ttolwp(curthread)->lwp_ap;
53947c478bd9Sstevel@tonic-gate struct file *fp;
53957c478bd9Sstevel@tonic-gate struct vnode *vp;
53967c478bd9Sstevel@tonic-gate struct f_audit_data *fad;
53977c478bd9Sstevel@tonic-gate int fd;
53987c478bd9Sstevel@tonic-gate
53997c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(2, "cmd", (uint32_t)uap->cmd));
54007c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(3, "nentries", (uint32_t)uap->nentries));
54017c478bd9Sstevel@tonic-gate
54027c478bd9Sstevel@tonic-gate fd = (int)uap->fd;
54037c478bd9Sstevel@tonic-gate
54047c478bd9Sstevel@tonic-gate if ((fp = getf(fd)) == NULL)
54057c478bd9Sstevel@tonic-gate return;
54067c478bd9Sstevel@tonic-gate
54077c478bd9Sstevel@tonic-gate /* get path from file struct here */
54087c478bd9Sstevel@tonic-gate fad = F2A(fp);
54097c478bd9Sstevel@tonic-gate if (fad->fad_aupath != NULL) {
54107c478bd9Sstevel@tonic-gate au_uwrite(au_to_path(fad->fad_aupath));
54117c478bd9Sstevel@tonic-gate } else {
54127c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "no path: fd", (uint32_t)fd));
54137c478bd9Sstevel@tonic-gate }
54147c478bd9Sstevel@tonic-gate
54157c478bd9Sstevel@tonic-gate vp = fp->f_vnode;
54167c478bd9Sstevel@tonic-gate audit_attributes(vp);
54177c478bd9Sstevel@tonic-gate
54187c478bd9Sstevel@tonic-gate /* decrement file descriptor reference count */
54197c478bd9Sstevel@tonic-gate releasef(fd);
54207c478bd9Sstevel@tonic-gate
5421a7746f66Stz204579 au_acl(uap->cmd, uap->nentries, (caddr_t)uap->aclbufp);
54227c478bd9Sstevel@tonic-gate }
54237c478bd9Sstevel@tonic-gate
54247c478bd9Sstevel@tonic-gate /*ARGSUSED*/
54257c478bd9Sstevel@tonic-gate static void
auf_read(tad,error,rval)54267c478bd9Sstevel@tonic-gate auf_read(tad, error, rval)
54277c478bd9Sstevel@tonic-gate struct t_audit_data *tad;
54287c478bd9Sstevel@tonic-gate int error;
54297c478bd9Sstevel@tonic-gate rval_t *rval;
54307c478bd9Sstevel@tonic-gate {
54317c478bd9Sstevel@tonic-gate struct file *fp;
54327c478bd9Sstevel@tonic-gate struct f_audit_data *fad;
54337c478bd9Sstevel@tonic-gate int fd;
54347c478bd9Sstevel@tonic-gate register struct a {
54357c478bd9Sstevel@tonic-gate long fd;
54367c478bd9Sstevel@tonic-gate } *uap = (struct a *)ttolwp(curthread)->lwp_ap;
54379e9e6ab8Spaulson au_kcontext_t *kctx = GET_KCTX_PZ;
54387c478bd9Sstevel@tonic-gate
54397c478bd9Sstevel@tonic-gate fd = (int)uap->fd;
54407c478bd9Sstevel@tonic-gate
54417c478bd9Sstevel@tonic-gate /*
54427c478bd9Sstevel@tonic-gate * convert file pointer to file descriptor
54437c478bd9Sstevel@tonic-gate * Note: fd ref count incremented here.
54447c478bd9Sstevel@tonic-gate */
54457c478bd9Sstevel@tonic-gate if ((fp = getf(fd)) == NULL)
54467c478bd9Sstevel@tonic-gate return;
54477c478bd9Sstevel@tonic-gate
54487c478bd9Sstevel@tonic-gate /* get path from file struct here */
54497c478bd9Sstevel@tonic-gate fad = F2A(fp);
54507c478bd9Sstevel@tonic-gate ASSERT(fad);
54517c478bd9Sstevel@tonic-gate
54527c478bd9Sstevel@tonic-gate /*
54537c478bd9Sstevel@tonic-gate * already processed this file for read attempt
54547c478bd9Sstevel@tonic-gate *
54557c478bd9Sstevel@tonic-gate * XXX might be better to turn off auditing in a aui_read() routine.
54567c478bd9Sstevel@tonic-gate */
54577c478bd9Sstevel@tonic-gate if (fad->fad_flags & FAD_READ) {
54587c478bd9Sstevel@tonic-gate /* don't really want to audit every read attempt */
54597c478bd9Sstevel@tonic-gate tad->tad_flag = 0;
54607c478bd9Sstevel@tonic-gate /* free any residual audit data */
5461005d3febSMarek Pospisil au_close(kctx, &(u_ad), 0, 0, 0, NULL);
54627c478bd9Sstevel@tonic-gate releasef(fd);
54637c478bd9Sstevel@tonic-gate return;
54647c478bd9Sstevel@tonic-gate }
54657c478bd9Sstevel@tonic-gate /* mark things so we know what happened and don't repeat things */
54667c478bd9Sstevel@tonic-gate fad->fad_flags |= FAD_READ;
54677c478bd9Sstevel@tonic-gate
54687c478bd9Sstevel@tonic-gate if (fad->fad_aupath != NULL) {
54697c478bd9Sstevel@tonic-gate au_uwrite(au_to_path(fad->fad_aupath));
54707c478bd9Sstevel@tonic-gate } else {
54717c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "no path: fd", (uint32_t)fd));
54727c478bd9Sstevel@tonic-gate }
54737c478bd9Sstevel@tonic-gate
54747c478bd9Sstevel@tonic-gate /* include attributes */
54757c478bd9Sstevel@tonic-gate audit_attributes(fp->f_vnode);
54767c478bd9Sstevel@tonic-gate
54777c478bd9Sstevel@tonic-gate /* decrement file descriptor reference count */
54787c478bd9Sstevel@tonic-gate releasef(fd);
54797c478bd9Sstevel@tonic-gate }
54807c478bd9Sstevel@tonic-gate
54817c478bd9Sstevel@tonic-gate /*ARGSUSED*/
54827c478bd9Sstevel@tonic-gate static void
auf_write(tad,error,rval)54837c478bd9Sstevel@tonic-gate auf_write(tad, error, rval)
54847c478bd9Sstevel@tonic-gate struct t_audit_data *tad;
54857c478bd9Sstevel@tonic-gate int error;
54867c478bd9Sstevel@tonic-gate rval_t *rval;
54877c478bd9Sstevel@tonic-gate {
54887c478bd9Sstevel@tonic-gate struct file *fp;
54897c478bd9Sstevel@tonic-gate struct f_audit_data *fad;
54907c478bd9Sstevel@tonic-gate int fd;
54917c478bd9Sstevel@tonic-gate register struct a {
54927c478bd9Sstevel@tonic-gate long fd;
54937c478bd9Sstevel@tonic-gate } *uap = (struct a *)ttolwp(curthread)->lwp_ap;
54949e9e6ab8Spaulson au_kcontext_t *kctx = GET_KCTX_PZ;
54957c478bd9Sstevel@tonic-gate
54967c478bd9Sstevel@tonic-gate fd = (int)uap->fd;
54977c478bd9Sstevel@tonic-gate
54987c478bd9Sstevel@tonic-gate /*
54997c478bd9Sstevel@tonic-gate * convert file pointer to file descriptor
55007c478bd9Sstevel@tonic-gate * Note: fd ref count incremented here.
55017c478bd9Sstevel@tonic-gate */
55027c478bd9Sstevel@tonic-gate if ((fp = getf(fd)) == NULL)
55037c478bd9Sstevel@tonic-gate return;
55047c478bd9Sstevel@tonic-gate
55057c478bd9Sstevel@tonic-gate /* get path from file struct here */
55067c478bd9Sstevel@tonic-gate fad = F2A(fp);
55077c478bd9Sstevel@tonic-gate ASSERT(fad);
55087c478bd9Sstevel@tonic-gate
55097c478bd9Sstevel@tonic-gate /*
55107c478bd9Sstevel@tonic-gate * already processed this file for write attempt
55117c478bd9Sstevel@tonic-gate *
55127c478bd9Sstevel@tonic-gate * XXX might be better to turn off auditing in a aus_write() routine.
55137c478bd9Sstevel@tonic-gate */
55147c478bd9Sstevel@tonic-gate if (fad->fad_flags & FAD_WRITE) {
55157c478bd9Sstevel@tonic-gate /* don't really want to audit every write attempt */
55167c478bd9Sstevel@tonic-gate tad->tad_flag = 0;
55177c478bd9Sstevel@tonic-gate /* free any residual audit data */
5518005d3febSMarek Pospisil au_close(kctx, &(u_ad), 0, 0, 0, NULL);
55197c478bd9Sstevel@tonic-gate releasef(fd);
55207c478bd9Sstevel@tonic-gate return;
55217c478bd9Sstevel@tonic-gate }
55227c478bd9Sstevel@tonic-gate /* mark things so we know what happened and don't repeat things */
55237c478bd9Sstevel@tonic-gate fad->fad_flags |= FAD_WRITE;
55247c478bd9Sstevel@tonic-gate
55257c478bd9Sstevel@tonic-gate if (fad->fad_aupath != NULL) {
55267c478bd9Sstevel@tonic-gate au_uwrite(au_to_path(fad->fad_aupath));
55277c478bd9Sstevel@tonic-gate } else {
55287c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "no path: fd", (uint32_t)fd));
55297c478bd9Sstevel@tonic-gate }
55307c478bd9Sstevel@tonic-gate
55317c478bd9Sstevel@tonic-gate /* include attributes */
55327c478bd9Sstevel@tonic-gate audit_attributes(fp->f_vnode);
55337c478bd9Sstevel@tonic-gate
55347c478bd9Sstevel@tonic-gate /* decrement file descriptor reference count */
55357c478bd9Sstevel@tonic-gate releasef(fd);
55367c478bd9Sstevel@tonic-gate }
55377c478bd9Sstevel@tonic-gate
55387c478bd9Sstevel@tonic-gate /*ARGSUSED*/
55397c478bd9Sstevel@tonic-gate static void
auf_recv(tad,error,rval)55407c478bd9Sstevel@tonic-gate auf_recv(tad, error, rval)
55417c478bd9Sstevel@tonic-gate struct t_audit_data *tad;
55427c478bd9Sstevel@tonic-gate int error;
55437c478bd9Sstevel@tonic-gate rval_t *rval;
55447c478bd9Sstevel@tonic-gate {
55457c478bd9Sstevel@tonic-gate struct sonode *so;
55467c478bd9Sstevel@tonic-gate char so_laddr[sizeof (struct sockaddr_in6)];
55477c478bd9Sstevel@tonic-gate char so_faddr[sizeof (struct sockaddr_in6)];
55487c478bd9Sstevel@tonic-gate struct file *fp;
55497c478bd9Sstevel@tonic-gate struct f_audit_data *fad;
55507c478bd9Sstevel@tonic-gate int fd;
55517c478bd9Sstevel@tonic-gate int err;
55520f1702c5SYu Xiangning socklen_t len;
55537c478bd9Sstevel@tonic-gate short so_family, so_type;
55547c478bd9Sstevel@tonic-gate register struct a {
55557c478bd9Sstevel@tonic-gate long fd;
55567c478bd9Sstevel@tonic-gate } *uap = (struct a *)ttolwp(curthread)->lwp_ap;
55579e9e6ab8Spaulson au_kcontext_t *kctx = GET_KCTX_PZ;
55587c478bd9Sstevel@tonic-gate
55597c478bd9Sstevel@tonic-gate /*
55607c478bd9Sstevel@tonic-gate * If there was an error, then nothing to do. Only generate
55617c478bd9Sstevel@tonic-gate * audit record on first successful recv.
55627c478bd9Sstevel@tonic-gate */
55637c478bd9Sstevel@tonic-gate if (error) {
55647c478bd9Sstevel@tonic-gate /* Turn off audit record generation here. */
55657c478bd9Sstevel@tonic-gate tad->tad_flag = 0;
55667c478bd9Sstevel@tonic-gate /* free any residual audit data */
5567005d3febSMarek Pospisil au_close(kctx, &(u_ad), 0, 0, 0, NULL);
55687c478bd9Sstevel@tonic-gate return;
55697c478bd9Sstevel@tonic-gate }
55707c478bd9Sstevel@tonic-gate
55717c478bd9Sstevel@tonic-gate fd = (int)uap->fd;
55727c478bd9Sstevel@tonic-gate
5573745b2690Stz204579 if ((so = getsonode(fd, &err, &fp)) == NULL) {
55747c478bd9Sstevel@tonic-gate /* Turn off audit record generation here. */
55757c478bd9Sstevel@tonic-gate tad->tad_flag = 0;
55767c478bd9Sstevel@tonic-gate /* free any residual audit data */
5577005d3febSMarek Pospisil au_close(kctx, &(u_ad), 0, 0, 0, NULL);
55787c478bd9Sstevel@tonic-gate return;
55797c478bd9Sstevel@tonic-gate }
55807c478bd9Sstevel@tonic-gate
55817c478bd9Sstevel@tonic-gate /* get path from file struct here */
55827c478bd9Sstevel@tonic-gate fad = F2A(fp);
55837c478bd9Sstevel@tonic-gate ASSERT(fad);
55847c478bd9Sstevel@tonic-gate
55857c478bd9Sstevel@tonic-gate /*
55867c478bd9Sstevel@tonic-gate * already processed this file for read attempt
55877c478bd9Sstevel@tonic-gate */
55887c478bd9Sstevel@tonic-gate if (fad->fad_flags & FAD_READ) {
55897c478bd9Sstevel@tonic-gate releasef(fd);
55907c478bd9Sstevel@tonic-gate /* don't really want to audit every recv call */
55917c478bd9Sstevel@tonic-gate tad->tad_flag = 0;
55927c478bd9Sstevel@tonic-gate /* free any residual audit data */
5593005d3febSMarek Pospisil au_close(kctx, &(u_ad), 0, 0, 0, NULL);
55947c478bd9Sstevel@tonic-gate return;
55957c478bd9Sstevel@tonic-gate }
55967c478bd9Sstevel@tonic-gate
55977c478bd9Sstevel@tonic-gate /* mark things so we know what happened and don't repeat things */
55987c478bd9Sstevel@tonic-gate fad->fad_flags |= FAD_READ;
55997c478bd9Sstevel@tonic-gate
56007c478bd9Sstevel@tonic-gate so_family = so->so_family;
56017c478bd9Sstevel@tonic-gate so_type = so->so_type;
56027c478bd9Sstevel@tonic-gate
56037c478bd9Sstevel@tonic-gate switch (so_family) {
56047c478bd9Sstevel@tonic-gate case AF_INET:
56057c478bd9Sstevel@tonic-gate case AF_INET6:
56067c478bd9Sstevel@tonic-gate /*
56077c478bd9Sstevel@tonic-gate * Only for connections.
56087c478bd9Sstevel@tonic-gate * XXX - do we need to worry about SOCK_DGRAM or other types???
56097c478bd9Sstevel@tonic-gate */
56107c478bd9Sstevel@tonic-gate if (so->so_state & SS_ISBOUND) {
56117c478bd9Sstevel@tonic-gate
56127c478bd9Sstevel@tonic-gate bzero((void *)so_laddr, sizeof (so_laddr));
56137c478bd9Sstevel@tonic-gate bzero((void *)so_faddr, sizeof (so_faddr));
56147c478bd9Sstevel@tonic-gate
56157c478bd9Sstevel@tonic-gate /* get local and foreign addresses */
56160f1702c5SYu Xiangning len = sizeof (so_laddr);
56170f1702c5SYu Xiangning (void) socket_getsockname(so,
56180f1702c5SYu Xiangning (struct sockaddr *)so_laddr, &len, CRED());
56190f1702c5SYu Xiangning len = sizeof (so_faddr);
56200f1702c5SYu Xiangning (void) socket_getpeername(so,
56210f1702c5SYu Xiangning (struct sockaddr *)so_faddr, &len, B_FALSE, CRED());
56227c478bd9Sstevel@tonic-gate
56237c478bd9Sstevel@tonic-gate /*
56247c478bd9Sstevel@tonic-gate * only way to drop out of switch. Note that we
56257c478bd9Sstevel@tonic-gate * we release fd below.
56267c478bd9Sstevel@tonic-gate */
56277c478bd9Sstevel@tonic-gate
56287c478bd9Sstevel@tonic-gate break;
56297c478bd9Sstevel@tonic-gate }
56307c478bd9Sstevel@tonic-gate
56317c478bd9Sstevel@tonic-gate releasef(fd);
56327c478bd9Sstevel@tonic-gate
56337c478bd9Sstevel@tonic-gate /* don't really want to audit every recv call */
56347c478bd9Sstevel@tonic-gate tad->tad_flag = 0;
56357c478bd9Sstevel@tonic-gate /* free any residual audit data */
5636005d3febSMarek Pospisil au_close(kctx, &(u_ad), 0, 0, 0, NULL);
56377c478bd9Sstevel@tonic-gate
56387c478bd9Sstevel@tonic-gate return;
56397c478bd9Sstevel@tonic-gate
56407c478bd9Sstevel@tonic-gate case AF_UNIX:
56417c478bd9Sstevel@tonic-gate
56427c478bd9Sstevel@tonic-gate if (fad->fad_aupath != NULL) {
56437c478bd9Sstevel@tonic-gate au_uwrite(au_to_path(fad->fad_aupath));
56447c478bd9Sstevel@tonic-gate } else {
56457c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "no path: fd", fd));
56467c478bd9Sstevel@tonic-gate }
56477c478bd9Sstevel@tonic-gate
56487c478bd9Sstevel@tonic-gate audit_attributes(fp->f_vnode);
56497c478bd9Sstevel@tonic-gate
56507c478bd9Sstevel@tonic-gate releasef(fd);
56517c478bd9Sstevel@tonic-gate
56527c478bd9Sstevel@tonic-gate return;
56537c478bd9Sstevel@tonic-gate
56547c478bd9Sstevel@tonic-gate default:
56557c478bd9Sstevel@tonic-gate releasef(fd);
56567c478bd9Sstevel@tonic-gate
56577c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
56587c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "family", (uint32_t)so_family));
56597c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "type", (uint32_t)so_type));
56607c478bd9Sstevel@tonic-gate
56617c478bd9Sstevel@tonic-gate return;
56627c478bd9Sstevel@tonic-gate }
56637c478bd9Sstevel@tonic-gate
56647c478bd9Sstevel@tonic-gate releasef(fd);
56657c478bd9Sstevel@tonic-gate
56667c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
56677c478bd9Sstevel@tonic-gate
56687c478bd9Sstevel@tonic-gate au_uwrite(au_to_socket_ex(so_family, so_type, so_laddr, so_faddr));
56697c478bd9Sstevel@tonic-gate
56707c478bd9Sstevel@tonic-gate }
56717c478bd9Sstevel@tonic-gate
56727c478bd9Sstevel@tonic-gate /*ARGSUSED*/
56737c478bd9Sstevel@tonic-gate static void
auf_send(tad,error,rval)56747c478bd9Sstevel@tonic-gate auf_send(tad, error, rval)
56757c478bd9Sstevel@tonic-gate struct t_audit_data *tad;
56767c478bd9Sstevel@tonic-gate int error;
56777c478bd9Sstevel@tonic-gate rval_t *rval;
56787c478bd9Sstevel@tonic-gate {
56797c478bd9Sstevel@tonic-gate struct sonode *so;
56807c478bd9Sstevel@tonic-gate char so_laddr[sizeof (struct sockaddr_in6)];
56817c478bd9Sstevel@tonic-gate char so_faddr[sizeof (struct sockaddr_in6)];
56827c478bd9Sstevel@tonic-gate struct file *fp;
56837c478bd9Sstevel@tonic-gate struct f_audit_data *fad;
56847c478bd9Sstevel@tonic-gate int fd;
56857c478bd9Sstevel@tonic-gate int err;
56860f1702c5SYu Xiangning socklen_t len;
56877c478bd9Sstevel@tonic-gate short so_family, so_type;
56887c478bd9Sstevel@tonic-gate register struct a {
56897c478bd9Sstevel@tonic-gate long fd;
56907c478bd9Sstevel@tonic-gate } *uap = (struct a *)ttolwp(curthread)->lwp_ap;
56919e9e6ab8Spaulson au_kcontext_t *kctx = GET_KCTX_PZ;
56927c478bd9Sstevel@tonic-gate
56937c478bd9Sstevel@tonic-gate fd = (int)uap->fd;
56947c478bd9Sstevel@tonic-gate
56957c478bd9Sstevel@tonic-gate /*
56967c478bd9Sstevel@tonic-gate * If there was an error, then nothing to do. Only generate
56977c478bd9Sstevel@tonic-gate * audit record on first successful send.
56987c478bd9Sstevel@tonic-gate */
56997c478bd9Sstevel@tonic-gate if (error != 0) {
57007c478bd9Sstevel@tonic-gate /* Turn off audit record generation here. */
57017c478bd9Sstevel@tonic-gate tad->tad_flag = 0;
57027c478bd9Sstevel@tonic-gate /* free any residual audit data */
5703005d3febSMarek Pospisil au_close(kctx, &(u_ad), 0, 0, 0, NULL);
57047c478bd9Sstevel@tonic-gate return;
57057c478bd9Sstevel@tonic-gate }
57067c478bd9Sstevel@tonic-gate
57077c478bd9Sstevel@tonic-gate fd = (int)uap->fd;
57087c478bd9Sstevel@tonic-gate
5709745b2690Stz204579 if ((so = getsonode(fd, &err, &fp)) == NULL) {
57107c478bd9Sstevel@tonic-gate /* Turn off audit record generation here. */
57117c478bd9Sstevel@tonic-gate tad->tad_flag = 0;
57127c478bd9Sstevel@tonic-gate /* free any residual audit data */
5713005d3febSMarek Pospisil au_close(kctx, &(u_ad), 0, 0, 0, NULL);
57147c478bd9Sstevel@tonic-gate return;
57157c478bd9Sstevel@tonic-gate }
57167c478bd9Sstevel@tonic-gate
57177c478bd9Sstevel@tonic-gate /* get path from file struct here */
57187c478bd9Sstevel@tonic-gate fad = F2A(fp);
57197c478bd9Sstevel@tonic-gate ASSERT(fad);
57207c478bd9Sstevel@tonic-gate
57217c478bd9Sstevel@tonic-gate /*
57227c478bd9Sstevel@tonic-gate * already processed this file for write attempt
57237c478bd9Sstevel@tonic-gate */
57247c478bd9Sstevel@tonic-gate if (fad->fad_flags & FAD_WRITE) {
57257c478bd9Sstevel@tonic-gate releasef(fd);
57267c478bd9Sstevel@tonic-gate /* don't really want to audit every send call */
57277c478bd9Sstevel@tonic-gate tad->tad_flag = 0;
57287c478bd9Sstevel@tonic-gate /* free any residual audit data */
5729005d3febSMarek Pospisil au_close(kctx, &(u_ad), 0, 0, 0, NULL);
57307c478bd9Sstevel@tonic-gate return;
57317c478bd9Sstevel@tonic-gate }
57327c478bd9Sstevel@tonic-gate
57337c478bd9Sstevel@tonic-gate /* mark things so we know what happened and don't repeat things */
57347c478bd9Sstevel@tonic-gate fad->fad_flags |= FAD_WRITE;
57357c478bd9Sstevel@tonic-gate
57367c478bd9Sstevel@tonic-gate so_family = so->so_family;
57377c478bd9Sstevel@tonic-gate so_type = so->so_type;
57387c478bd9Sstevel@tonic-gate
57397c478bd9Sstevel@tonic-gate switch (so_family) {
57407c478bd9Sstevel@tonic-gate case AF_INET:
57417c478bd9Sstevel@tonic-gate case AF_INET6:
57427c478bd9Sstevel@tonic-gate /*
57437c478bd9Sstevel@tonic-gate * Only for connections.
57447c478bd9Sstevel@tonic-gate * XXX - do we need to worry about SOCK_DGRAM or other types???
57457c478bd9Sstevel@tonic-gate */
57467c478bd9Sstevel@tonic-gate if (so->so_state & SS_ISBOUND) {
57477c478bd9Sstevel@tonic-gate
57487c478bd9Sstevel@tonic-gate bzero((void *)so_laddr, sizeof (so_laddr));
57497c478bd9Sstevel@tonic-gate bzero((void *)so_faddr, sizeof (so_faddr));
57507c478bd9Sstevel@tonic-gate
57517c478bd9Sstevel@tonic-gate /* get local and foreign addresses */
57520f1702c5SYu Xiangning len = sizeof (so_laddr);
57530f1702c5SYu Xiangning (void) socket_getsockname(so,
57540f1702c5SYu Xiangning (struct sockaddr *)so_laddr, &len, CRED());
57550f1702c5SYu Xiangning len = sizeof (so_faddr);
57560f1702c5SYu Xiangning (void) socket_getpeername(so,
57570f1702c5SYu Xiangning (struct sockaddr *)so_faddr, &len, B_FALSE, CRED());
57587c478bd9Sstevel@tonic-gate
57597c478bd9Sstevel@tonic-gate /*
57607c478bd9Sstevel@tonic-gate * only way to drop out of switch. Note that we
57617c478bd9Sstevel@tonic-gate * we release fd below.
57627c478bd9Sstevel@tonic-gate */
57637c478bd9Sstevel@tonic-gate
57647c478bd9Sstevel@tonic-gate break;
57657c478bd9Sstevel@tonic-gate }
57667c478bd9Sstevel@tonic-gate
57677c478bd9Sstevel@tonic-gate releasef(fd);
57687c478bd9Sstevel@tonic-gate /* don't really want to audit every send call */
57697c478bd9Sstevel@tonic-gate tad->tad_flag = 0;
57707c478bd9Sstevel@tonic-gate /* free any residual audit data */
5771005d3febSMarek Pospisil au_close(kctx, &(u_ad), 0, 0, 0, NULL);
57727c478bd9Sstevel@tonic-gate
57737c478bd9Sstevel@tonic-gate return;
57747c478bd9Sstevel@tonic-gate
57757c478bd9Sstevel@tonic-gate case AF_UNIX:
57767c478bd9Sstevel@tonic-gate
57777c478bd9Sstevel@tonic-gate if (fad->fad_aupath != NULL) {
57787c478bd9Sstevel@tonic-gate au_uwrite(au_to_path(fad->fad_aupath));
57797c478bd9Sstevel@tonic-gate } else {
57807c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "no path: fd", fd));
57817c478bd9Sstevel@tonic-gate }
57827c478bd9Sstevel@tonic-gate
57837c478bd9Sstevel@tonic-gate audit_attributes(fp->f_vnode);
57847c478bd9Sstevel@tonic-gate
57857c478bd9Sstevel@tonic-gate releasef(fd);
57867c478bd9Sstevel@tonic-gate
57877c478bd9Sstevel@tonic-gate return;
57887c478bd9Sstevel@tonic-gate
57897c478bd9Sstevel@tonic-gate default:
57907c478bd9Sstevel@tonic-gate releasef(fd);
57917c478bd9Sstevel@tonic-gate
57927c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
57937c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "family", (uint32_t)so_family));
57947c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "type", (uint32_t)so_type));
57957c478bd9Sstevel@tonic-gate
57967c478bd9Sstevel@tonic-gate return;
57977c478bd9Sstevel@tonic-gate }
57987c478bd9Sstevel@tonic-gate
57997c478bd9Sstevel@tonic-gate releasef(fd);
58007c478bd9Sstevel@tonic-gate
58017c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
58027c478bd9Sstevel@tonic-gate
58037c478bd9Sstevel@tonic-gate au_uwrite(au_to_socket_ex(so_family, so_type, so_laddr, so_faddr));
58047c478bd9Sstevel@tonic-gate }
5805657b1f3dSraf
5806657b1f3dSraf static au_event_t
aui_forksys(au_event_t e)5807657b1f3dSraf aui_forksys(au_event_t e)
5808657b1f3dSraf {
5809657b1f3dSraf struct a {
5810657b1f3dSraf long subcode;
5811657b1f3dSraf long flags;
5812657b1f3dSraf } *uap = (struct a *)ttolwp(curthread)->lwp_ap;
5813657b1f3dSraf
5814657b1f3dSraf switch ((uint_t)uap->subcode) {
5815657b1f3dSraf case 0:
5816657b1f3dSraf e = AUE_FORK1;
5817657b1f3dSraf break;
5818657b1f3dSraf case 1:
5819657b1f3dSraf e = AUE_FORKALL;
5820657b1f3dSraf break;
5821657b1f3dSraf case 2:
5822657b1f3dSraf e = AUE_VFORK;
5823657b1f3dSraf break;
5824657b1f3dSraf default:
5825657b1f3dSraf e = AUE_NULL;
5826657b1f3dSraf break;
5827657b1f3dSraf }
5828657b1f3dSraf
5829657b1f3dSraf return (e);
5830657b1f3dSraf }
5831df2381bfSpraks
5832df2381bfSpraks /*ARGSUSED*/
5833df2381bfSpraks static au_event_t
aui_portfs(au_event_t e)5834df2381bfSpraks aui_portfs(au_event_t e)
5835df2381bfSpraks {
5836df2381bfSpraks struct a { /* portfs */
5837df2381bfSpraks long a1;
5838df2381bfSpraks long a2;
5839df2381bfSpraks long a3;
5840df2381bfSpraks } *uap = (struct a *)ttolwp(curthread)->lwp_ap;
5841df2381bfSpraks
5842df2381bfSpraks /*
5843df2381bfSpraks * check opcode
5844df2381bfSpraks */
5845df2381bfSpraks switch (((uint_t)uap->a1) & PORT_CODE_MASK) {
5846df2381bfSpraks case PORT_ASSOCIATE:
58478350182dSJan Friedel /* check source */
58488350182dSJan Friedel if (((uint_t)uap->a3 == PORT_SOURCE_FILE) ||
58498350182dSJan Friedel ((uint_t)uap->a3 == PORT_SOURCE_FD)) {
58508350182dSJan Friedel e = AUE_PORTFS_ASSOCIATE;
58518350182dSJan Friedel } else {
58528350182dSJan Friedel e = AUE_NULL;
58538350182dSJan Friedel }
58548350182dSJan Friedel break;
5855df2381bfSpraks case PORT_DISSOCIATE:
58568350182dSJan Friedel /* check source */
58578350182dSJan Friedel if (((uint_t)uap->a3 == PORT_SOURCE_FILE) ||
58588350182dSJan Friedel ((uint_t)uap->a3 == PORT_SOURCE_FD)) {
58598350182dSJan Friedel e = AUE_PORTFS_DISSOCIATE;
5860df2381bfSpraks } else {
5861df2381bfSpraks e = AUE_NULL;
5862df2381bfSpraks }
5863df2381bfSpraks break;
5864df2381bfSpraks default:
5865df2381bfSpraks e = AUE_NULL;
5866df2381bfSpraks }
5867df2381bfSpraks return (e);
5868df2381bfSpraks }
5869