xref: /titanic_50/usr/src/uts/common/c2/audit_event.c (revision 657b1f3d64bcf8eaa2385dba72a6047f089433b2)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
24  * Use is subject to license terms.
25  */
26 
27 #pragma ident	"%Z%%M%	%I%	%E% SMI"
28 
29 /*
30  * This file contains the audit event table used to control the production
31  * of audit records for each system call.
32  */
33 
34 #include <sys/policy.h>
35 #include <sys/cred.h>
36 #include <sys/types.h>
37 #include <sys/systm.h>
38 #include <sys/systeminfo.h>	/* for sysinfo auditing */
39 #include <sys/utsname.h>	/* for sysinfo auditing */
40 #include <sys/proc.h>
41 #include <sys/vnode.h>
42 #include <sys/mman.h>		/* for mmap(2) auditing etc. */
43 #include <sys/fcntl.h>
44 #include <sys/modctl.h>		/* for modctl auditing */
45 #include <sys/vnode.h>
46 #include <sys/user.h>
47 #include <sys/types.h>
48 #include <sys/processor.h>
49 #include <sys/procset.h>
50 #include <sys/acl.h>
51 #include <sys/ipc.h>
52 #include <sys/door.h>
53 #include <sys/sem.h>
54 #include <sys/msg.h>
55 #include <sys/shm.h>
56 #include <sys/kmem.h>
57 #include <sys/file.h>		/* for accept */
58 #include <sys/utssys.h>		/* for fuser */
59 #include <sys/tsol/label.h>
60 #include <c2/audit.h>
61 #include <c2/audit_kernel.h>
62 #include <c2/audit_kevents.h>
63 #include <c2/audit_record.h>
64 #include <sys/procset.h>
65 #include <nfs/mount.h>
66 #include <sys/param.h>
67 #include <sys/debug.h>
68 #include <sys/sysmacros.h>
69 #include <sys/stream.h>
70 #include <sys/strsubr.h>
71 #include <sys/stropts.h>
72 #include <sys/tihdr.h>
73 #include <sys/socket.h>
74 #include <sys/socketvar.h>
75 #include <netinet/in.h>
76 #include <sys/ddi.h>
77 
78 extern token_t	*au_to_sock_inet(struct sockaddr_in *);
79 
80 int	au_naevent;
81 char	_depends_on[] = "fs/sockfs";
82 
83 static au_event_t	aui_null(au_event_t);
84 static au_event_t	aui_open(au_event_t);
85 static au_event_t	aui_fsat(au_event_t);
86 static au_event_t	aui_msgsys(au_event_t);
87 static au_event_t	aui_shmsys(au_event_t);
88 static au_event_t	aui_semsys(au_event_t);
89 static au_event_t	aui_utssys(au_event_t);
90 static au_event_t	aui_fcntl(au_event_t);
91 static au_event_t	aui_execv(au_event_t);
92 static au_event_t	aui_execve(au_event_t);
93 static au_event_t	aui_memcntl(au_event_t);
94 static au_event_t	aui_sysinfo(au_event_t);
95 static au_event_t	aui_auditsys(au_event_t);
96 static au_event_t	aui_modctl(au_event_t);
97 static au_event_t	aui_acl(au_event_t);
98 static au_event_t	aui_doorfs(au_event_t);
99 static au_event_t	aui_privsys(au_event_t);
100 static au_event_t	aui_forksys(au_event_t);
101 
102 static void	aus_null(struct t_audit_data *);
103 static void	aus_open(struct t_audit_data *);
104 static void	aus_acl(struct t_audit_data *);
105 static void	aus_acct(struct t_audit_data *);
106 static void	aus_chown(struct t_audit_data *);
107 static void	aus_fchown(struct t_audit_data *);
108 static void	aus_lchown(struct t_audit_data *);
109 static void	aus_chmod(struct t_audit_data *);
110 static void	aus_facl(struct t_audit_data *);
111 static void	aus_fchmod(struct t_audit_data *);
112 static void	aus_fcntl(struct t_audit_data *);
113 static void	aus_fsat(struct t_audit_data *);
114 static void	aus_mkdir(struct t_audit_data *);
115 static void	aus_mknod(struct t_audit_data *);
116 static void	aus_mount(struct t_audit_data *);
117 static void	aus_umount(struct t_audit_data *);
118 static void	aus_umount2(struct t_audit_data *);
119 static void	aus_msgsys(struct t_audit_data *);
120 static void	aus_semsys(struct t_audit_data *);
121 static void	aus_close(struct t_audit_data *);
122 static void	aus_fstatfs(struct t_audit_data *);
123 static void	aus_setgid(struct t_audit_data *);
124 static void	aus_setuid(struct t_audit_data *);
125 static void	aus_shmsys(struct t_audit_data *);
126 static void	aus_doorfs(struct t_audit_data *);
127 static void	aus_ioctl(struct t_audit_data *);
128 static void	aus_memcntl(struct t_audit_data *);
129 static void	aus_mmap(struct t_audit_data *);
130 static void	aus_munmap(struct t_audit_data *);
131 static void	aus_priocntlsys(struct t_audit_data *);
132 static void	aus_setegid(struct t_audit_data *);
133 static void	aus_setgroups(struct t_audit_data *);
134 static void	aus_seteuid(struct t_audit_data *);
135 static void	aus_putmsg(struct t_audit_data *);
136 static void	aus_putpmsg(struct t_audit_data *);
137 static void	aus_getmsg(struct t_audit_data *);
138 static void	aus_getpmsg(struct t_audit_data *);
139 static void	aus_auditsys(struct t_audit_data *);
140 static void	aus_sysinfo(struct t_audit_data *);
141 static void	aus_modctl(struct t_audit_data *);
142 static void	aus_kill(struct t_audit_data *);
143 static void	aus_xmknod(struct t_audit_data *);
144 static void	aus_setregid(struct t_audit_data *);
145 static void	aus_setreuid(struct t_audit_data *);
146 
147 static void	auf_null(struct t_audit_data *, int, rval_t *);
148 static void	auf_mknod(struct t_audit_data *, int, rval_t *);
149 static void	auf_msgsys(struct t_audit_data *, int, rval_t *);
150 static void	auf_semsys(struct t_audit_data *, int, rval_t *);
151 static void	auf_shmsys(struct t_audit_data *, int, rval_t *);
152 #if 0
153 static void	auf_open(struct t_audit_data *, int, rval_t *);
154 #endif
155 static void	auf_xmknod(struct t_audit_data *, int, rval_t *);
156 static void	auf_read(struct t_audit_data *, int, rval_t *);
157 static void	auf_write(struct t_audit_data *, int, rval_t *);
158 
159 static void	aus_sigqueue(struct t_audit_data *);
160 static void	aus_p_online(struct t_audit_data *);
161 static void	aus_processor_bind(struct t_audit_data *);
162 static void	aus_inst_sync(struct t_audit_data *);
163 static void	aus_brandsys(struct t_audit_data *);
164 
165 static void	auf_accept(struct t_audit_data *, int, rval_t *);
166 
167 static void	auf_bind(struct t_audit_data *, int, rval_t *);
168 static void	auf_connect(struct t_audit_data *, int, rval_t *);
169 static void	aus_shutdown(struct t_audit_data *);
170 static void	auf_setsockopt(struct t_audit_data *, int, rval_t *);
171 static void	aus_sockconfig(struct t_audit_data *);
172 static void	auf_recv(struct t_audit_data *, int, rval_t *);
173 static void	auf_recvmsg(struct t_audit_data *, int, rval_t *);
174 static void	auf_send(struct t_audit_data *, int, rval_t *);
175 static void	auf_sendmsg(struct t_audit_data *, int, rval_t *);
176 static void	auf_recvfrom(struct t_audit_data *, int, rval_t *);
177 static void	auf_sendto(struct t_audit_data *, int, rval_t *);
178 static void	aus_socket(struct t_audit_data *);
179 /*
180  * This table contains mapping information for converting system call numbers
181  * to audit event IDs. In several cases it is necessary to map a single system
182  * call to several events.
183  */
184 
185 struct audit_s2e audit_s2e[] =
186 {
187 /*
188  * ----------	---------- 	----------	----------
189  * INITIAL	AUDIT		START		SYSTEM
190  * PROCESSING	EVENT		PROCESSING	CALL
191  * ----------	----------	----------	-----------
192  *		FINISH		EVENT
193  *		PROCESSING	CONTROL
194  * ----------------------------------------------------------
195  */
196 aui_null,	AUE_NULL,	aus_null,	/* 0 unused (indirect) */
197 		auf_null,	0,
198 aui_null,	AUE_EXIT,	aus_null,	/* 1 exit */
199 		auf_null,	S2E_NPT,
200 aui_null,	AUE_FORKALL,	aus_null,	/* 2 forkall */
201 		auf_null,	0,
202 aui_null,	AUE_READ,	aus_null,	/* 3 read */
203 		auf_read,	S2E_PUB,
204 aui_null,	AUE_WRITE,	aus_null,	/* 4 write */
205 		auf_write,	0,
206 aui_open,	AUE_OPEN,	aus_open,	/* 5 open */
207 		auf_null,	S2E_SP,
208 aui_null,	AUE_CLOSE,	aus_close,	/* 6 close */
209 		auf_null,	0,
210 aui_null,	AUE_NULL,	aus_null,	/* 7 wait */
211 		auf_null,	0,
212 aui_null,	AUE_CREAT,	aus_null,	/* 8 create */
213 		auf_null,	S2E_SP,
214 aui_null,	AUE_LINK,	aus_null,	/* 9 link */
215 		auf_null,	0,
216 aui_null,	AUE_UNLINK,	aus_null,	/* 10 unlink */
217 		auf_null,	0,
218 aui_execv,	AUE_EXEC,	aus_null,	/* 11 exec */
219 		auf_null,	S2E_MLD,
220 aui_null,	AUE_CHDIR,	aus_null,	/* 12 chdir */
221 		auf_null,	S2E_SP,
222 aui_null,	AUE_NULL,	aus_null,	/* 13 time */
223 		auf_null,	0,
224 aui_null,	AUE_MKNOD,	aus_mknod,	/* 14 mknod */
225 		auf_mknod,	0,
226 aui_null,	AUE_CHMOD,	aus_chmod,	/* 15 chmod */
227 		auf_null,	0,
228 aui_null,	AUE_CHOWN,	aus_chown,	/* 16 chown */
229 		auf_null,	0,
230 aui_null,	AUE_NULL,	aus_null,	/* 17 brk */
231 		auf_null,	0,
232 aui_null,	AUE_STAT,	aus_null,	/* 18 stat */
233 		auf_null,	S2E_PUB,
234 aui_null,	AUE_NULL,	aus_null,	/* 19 lseek */
235 		auf_null,	0,
236 aui_null,	AUE_NULL,	aus_null,	/* 20 getpid */
237 		auf_null,	0,
238 aui_null,	AUE_MOUNT,	aus_mount,	/* 21 mount */
239 		auf_null,	S2E_MLD,
240 aui_null,	AUE_UMOUNT,	aus_umount,	/* 22 umount */
241 		auf_null,	0,
242 aui_null,	AUE_SETUID,	aus_setuid,	/* 23 setuid */
243 		auf_null,	0,
244 aui_null,	AUE_NULL,	aus_null,	/* 24 getuid */
245 		auf_null,	0,
246 aui_null,	AUE_STIME,	aus_null,	/* 25 stime */
247 		auf_null,	0,
248 aui_null,	AUE_NULL,	aus_null,	/* 26 (loadable) was ptrace */
249 		auf_null,	0,
250 aui_null,	AUE_NULL,	aus_null,	/* 27 alarm */
251 		auf_null,	0,
252 aui_null,	AUE_NULL,	aus_null,	/* 28 fstat */
253 		auf_null,	0,
254 aui_null,	AUE_NULL,	aus_null,	/* 29 pause */
255 		auf_null,	0,
256 aui_null,	AUE_UTIME,	aus_null,	/* 30 utime */
257 		auf_null,	0,
258 aui_null,	AUE_NULL,	aus_null,	/* 31 stty (TIOCSETP-audit?) */
259 		auf_null,	0,
260 aui_null,	AUE_NULL,	aus_null,	/* 32 gtty */
261 		auf_null,	0,
262 aui_null,	AUE_ACCESS,	aus_null,	/* 33 access */
263 		auf_null,	S2E_PUB,
264 aui_null,	AUE_NICE,	aus_null,	/* 34 nice */
265 		auf_null,	0,
266 aui_null,	AUE_STATFS,	aus_null,	/* 35 statfs */
267 		auf_null,	S2E_PUB,
268 aui_null,	AUE_NULL,	aus_null,	/* 36 sync */
269 		auf_null,	0,
270 aui_null,	AUE_KILL,	aus_kill,	/* 37 kill */
271 		auf_null,	0,
272 aui_null,	AUE_FSTATFS,	aus_fstatfs,	/* 38 fstatfs */
273 		auf_null,	S2E_PUB,
274 aui_null,	AUE_SETPGRP,	aus_null,	/* 39 setpgrp */
275 		auf_null,	0,
276 aui_null,	AUE_NULL,	aus_null,	/* 40 uucopystr */
277 		auf_null,	0,
278 aui_null,	AUE_NULL,	aus_null,	/* 41 dup */
279 		auf_null,	0,
280 aui_null,	AUE_PIPE,	aus_null,	/* 42 pipe */
281 		auf_null,	0,
282 aui_null,	AUE_NULL,	aus_null,	/* 43 times */
283 		auf_null,	0,
284 aui_null,	AUE_NULL,	aus_null,	/* 44 profil */
285 		auf_null,	0,
286 aui_null,	AUE_NULL,	aus_null,	/* 45 (loadable) */
287 						/*	was proc lock */
288 		auf_null,	0,
289 aui_null,	AUE_SETGID,	aus_setgid,	/* 46 setgid */
290 		auf_null,	0,
291 aui_null,	AUE_NULL,	aus_null,	/* 47 getgid */
292 		auf_null,	0,
293 aui_null,	AUE_NULL,	aus_null,	/* 48 sig */
294 		auf_null,	0,
295 aui_msgsys,	AUE_MSGSYS,	aus_msgsys,	/* 49 (loadable) was msgsys */
296 		auf_msgsys,	0,
297 #if defined(__x86)
298 aui_null,	AUE_NULL,	aus_null,	/* 50 sysi86 */
299 		auf_null,	0,
300 #else
301 aui_null,	AUE_NULL,	aus_null,	/* 50 (loadable) was sys3b */
302 		auf_null,	0,
303 #endif /* __x86 */
304 aui_null,	AUE_ACCT,	aus_acct,	/* 51 acct */
305 		auf_null,	0,
306 aui_shmsys,	AUE_SHMSYS,	aus_shmsys,	/* 52 shared memory */
307 		auf_shmsys,	0,
308 aui_semsys,	AUE_SEMSYS,	aus_semsys,	/* 53 IPC semaphores */
309 		auf_semsys,	0,
310 aui_null,	AUE_IOCTL,	aus_ioctl,	/* 54 ioctl */
311 		auf_null,	0,
312 aui_null,	AUE_NULL,	aus_null,	/* 55 uadmin */
313 		auf_null,	0,
314 aui_null,	AUE_NULL,	aus_null,	/* 56 (loadable) was uexch */
315 		auf_null,	0,
316 aui_utssys,	AUE_FUSERS,	aus_null,	/* 57 utssys */
317 		auf_null,	0,
318 aui_null,	AUE_NULL,	aus_null,	/* 58 fsync */
319 		auf_null,	0,
320 aui_execve,	AUE_EXECVE,	aus_null,	/* 59 exece */
321 		auf_null,	S2E_MLD,
322 aui_null,	AUE_NULL,	aus_null,	/* 60 umask */
323 		auf_null,	0,
324 aui_null,	AUE_CHROOT,	aus_null,	/* 61 chroot */
325 		auf_null,	S2E_SP,
326 aui_fcntl,	AUE_FCNTL,	aus_fcntl,	/* 62 fcntl */
327 		auf_null,	0,
328 aui_null,	AUE_NULL,	aus_null,	/* 63 ulimit */
329 		auf_null,	0,
330 aui_null,	AUE_NULL,	aus_null,	/* 64 (loadable) */
331 		auf_null,	0,
332 aui_null,	AUE_NULL,	aus_null,	/* 65 (loadable) */
333 		auf_null,	0,
334 aui_null,	AUE_NULL,	aus_null,	/* 66 (loadable) */
335 		auf_null,	0,
336 aui_null,	AUE_NULL,	aus_null,	/* 67 (loadable) */
337 						/*	file locking call */
338 		auf_null,	0,
339 aui_null,	AUE_NULL,	aus_null,	/* 68 (loadable) */
340 						/*	local system calls */
341 		auf_null,	0,
342 aui_null,	AUE_NULL,	aus_null,	/* 69 (loadable) inode open */
343 		auf_null,	0,
344 aui_null,	AUE_NULL,	aus_null,	/* 70 (loadable) was advfs */
345 		auf_null,	0,
346 aui_null,	AUE_NULL,	aus_null,	/* 71 (loadable) was unadvfs */
347 		auf_null,	0,
348 aui_null,	AUE_NULL,	aus_null,	/* 72 (loadable) was notused */
349 		auf_null,	0,
350 aui_null,	AUE_NULL,	aus_null,	/* 73 (loadable) was notused */
351 		auf_null,	0,
352 aui_null,	AUE_NULL,	aus_null,	/* 74 (loadable) was notused */
353 		auf_null,	0,
354 aui_null,	AUE_NULL,	aus_null,	/* 75 issetugid */
355 						/*	was sigret (SunOS) */
356 		auf_null,	0,
357 aui_fsat,	AUE_FSAT,	aus_fsat,	/* 76 fsat */
358 		auf_null,	0,
359 aui_null,	AUE_NULL,	aus_null,	/* 77 (loadable) was rfstop */
360 		auf_null,	0,
361 aui_null,	AUE_NULL,	aus_null,	/* 78 (loadable) was rfssys */
362 		auf_null,	0,
363 aui_null,	AUE_RMDIR,	aus_null,	/* 79 rmdir */
364 		auf_null,	0,
365 aui_null,	AUE_MKDIR,	aus_mkdir,	/* 80 mkdir */
366 		auf_null,	0,
367 aui_null,	AUE_NULL,	aus_null,	/* 81 getdents */
368 		auf_null,	0,
369 aui_privsys,	AUE_NULL,	aus_null,	/* 82 privsys */
370 						/*	was libattach */
371 		auf_null,	0,
372 aui_null,	AUE_NULL,	aus_null,	/* 83 (loadable) */
373 						/*	was libdetach */
374 		auf_null,	0,
375 aui_null,	AUE_NULL,	aus_null,	/* 84 sysfs */
376 		auf_null,	0,
377 aui_null,	AUE_GETMSG,	aus_getmsg,	/* 85 getmsg */
378 		auf_null,	0,
379 aui_null,	AUE_PUTMSG,	aus_putmsg,	/* 86 putmsg */
380 		auf_null,	0,
381 aui_null,	AUE_NULL,	aus_null,	/* 87 poll */
382 		auf_null,	0,
383 aui_null,	AUE_LSTAT,	aus_null,	/* 88 lstat */
384 		auf_null,	S2E_PUB,
385 aui_null,	AUE_SYMLINK,	aus_null,	/* 89 symlink */
386 		auf_null,	0,
387 aui_null,	AUE_READLINK,	aus_null,	/* 90 readlink */
388 		auf_null,	S2E_PUB,
389 aui_null,	AUE_SETGROUPS,	aus_setgroups,	/* 91 setgroups */
390 		auf_null,	0,
391 aui_null,	AUE_NULL,	aus_null,	/* 92 getgroups */
392 		auf_null,	0,
393 aui_null,	AUE_FCHMOD,	aus_fchmod,	/* 93 fchmod */
394 		auf_null,	0,
395 aui_null,	AUE_FCHOWN,	aus_fchown,	/* 94 fchown */
396 		auf_null,	0,
397 aui_null,	AUE_NULL,	aus_null,	/* 95 sigprocmask */
398 		auf_null,	0,
399 aui_null,	AUE_NULL,	aus_null,	/* 96 sigsuspend */
400 		auf_null,	0,
401 aui_null,	AUE_NULL,	aus_null,	/* 97 sigaltstack */
402 		auf_null,	0,
403 aui_null,	AUE_NULL,	aus_null,	/* 98 sigaction */
404 		auf_null,	0,
405 aui_null,	AUE_NULL,	aus_null,	/* 99 sigpending */
406 		auf_null,	0,
407 aui_null,	AUE_NULL,	aus_null,	/* 100 setcontext */
408 		auf_null,	0,
409 aui_null,	AUE_NULL,	aus_null,	/* 101 (loadable) was evsys */
410 		auf_null,	0,
411 aui_null,	AUE_NULL,	aus_null,	/* 102 (loadable) */
412 						/*	was evtrapret */
413 		auf_null,	0,
414 aui_null,	AUE_STATVFS,	aus_null,	/* 103 statvfs */
415 		auf_null,	S2E_PUB,
416 aui_null,	AUE_NULL,	aus_null,	/* 104 fstatvfs */
417 		auf_null,	0,
418 aui_null,	AUE_NULL,	aus_null,	/* 105 (loadable) */
419 		auf_null,	0,
420 aui_null,	AUE_NULL,	aus_null,	/* 106 nfssys */
421 		auf_null,	0,
422 aui_null,	AUE_NULL,	aus_null,	/* 107 waitset */
423 		auf_null,	0,
424 aui_null,	AUE_NULL,	aus_null,	/* 108 sigsendset */
425 		auf_null,	0,
426 #if defined(__x86)
427 aui_null,	AUE_NULL,	aus_null,	/* 109 hrtsys */
428 		auf_null,	0,
429 #else
430 aui_null,	AUE_NULL,	aus_null,	/* 109 (loadable) */
431 		auf_null,	0,
432 #endif /* __x86 */
433 aui_null,	AUE_NULL,	aus_null,	/* 110 (loadable) was acancel */
434 		auf_null,	0,
435 aui_null,	AUE_NULL,	aus_null,	/* 111 (loadable) was async */
436 		auf_null,	0,
437 aui_null,	AUE_PRIOCNTLSYS,	aus_priocntlsys,
438 		auf_null,	0,		/* 112 priocntlsys */
439 aui_null,	AUE_PATHCONF,	aus_null,	/* 113 pathconf */
440 		auf_null,	S2E_PUB,
441 aui_null,	AUE_NULL,	aus_null,	/* 114 mincore */
442 		auf_null,	0,
443 aui_null,	AUE_MMAP,	aus_mmap,	/* 115 mmap */
444 		auf_null,	0,
445 aui_null,	AUE_NULL,	aus_null,	/* 116 mprotect */
446 		auf_null,	0,
447 aui_null,	AUE_MUNMAP,	aus_munmap,	/* 117 munmap */
448 		auf_null,	0,
449 aui_null,	AUE_NULL,	aus_null,	/* 118 fpathconf */
450 		auf_null,	0,
451 aui_null,	AUE_VFORK,	aus_null,	/* 119 vfork */
452 		auf_null,	0,
453 aui_null,	AUE_FCHDIR,	aus_null,	/* 120 fchdir */
454 		auf_null,	0,
455 aui_null,	AUE_READ,	aus_null,	/* 121 readv */
456 		auf_read,	S2E_PUB,
457 aui_null,	AUE_WRITE,	aus_null,	/* 122 writev */
458 		auf_write,	0,
459 aui_null,	AUE_STAT,	aus_null,	/* 123 xstat (x86) */
460 		auf_null,	S2E_PUB,
461 aui_null,	AUE_LSTAT,	aus_null,	/* 124 lxstat (x86) */
462 		auf_null,	S2E_PUB,
463 aui_null,	AUE_NULL,	aus_null,	/* 125 fxstat (x86) */
464 		auf_null,	0,
465 aui_null,	AUE_MKNOD,	aus_xmknod,	/* 126 xmknod (x86) */
466 		auf_xmknod,	0,
467 aui_null,	AUE_NULL,	aus_null,	/* 127 (loadable) was clocal */
468 		auf_null,	0,
469 aui_null,	AUE_SETRLIMIT,	aus_null,	/* 128 setrlimit */
470 		auf_null,	0,
471 aui_null,	AUE_NULL,	aus_null,	/* 129 getrlimit */
472 		auf_null,	0,
473 aui_null,	AUE_LCHOWN,	aus_lchown,	/* 130 lchown */
474 		auf_null,	0,
475 aui_memcntl,	AUE_MEMCNTL,	aus_memcntl,	/* 131 memcntl */
476 		auf_null,	0,
477 aui_null,	AUE_GETPMSG,	aus_getpmsg,	/* 132 getpmsg */
478 		auf_null,	0,
479 aui_null,	AUE_PUTPMSG,	aus_putpmsg,	/* 133 putpmsg */
480 		auf_null,	0,
481 aui_null,	AUE_RENAME,	aus_null,	/* 134 rename */
482 		auf_null,	0,
483 aui_null,	AUE_NULL,	aus_null,	/* 135 uname */
484 		auf_null,	0,
485 aui_null,	AUE_SETEGID,	aus_setegid,	/* 136 setegid */
486 		auf_null,	0,
487 aui_null,	AUE_NULL,	aus_null,	/* 137 sysconfig */
488 		auf_null,	0,
489 aui_null,	AUE_ADJTIME,	aus_null,	/* 138 adjtime */
490 		auf_null,	0,
491 aui_sysinfo,	AUE_SYSINFO,	aus_sysinfo,	/* 139 systeminfo */
492 		auf_null,	0,
493 aui_null,	AUE_NULL,	aus_null,	/* 140 reserved */
494 		auf_null,	0,
495 aui_null,	AUE_SETEUID,	aus_seteuid,	/* 141 seteuid */
496 		auf_null,	0,
497 aui_forksys,	AUE_NULL,	aus_null,	/* 142 forksys */
498 		auf_null,	0,
499 aui_null,	AUE_FORK1,	aus_null,	/* 143 fork1 */
500 		auf_null,	0,
501 aui_null,	AUE_NULL,	aus_null,	/* 144 sigwait */
502 		auf_null,	0,
503 aui_null,	AUE_NULL,	aus_null,	/* 145 lwp_info */
504 		auf_null,	0,
505 aui_null,	AUE_NULL,	aus_null,	/* 146 yield */
506 		auf_null,	0,
507 aui_null,	AUE_NULL,	aus_null,	/* 147 lwp_sema_wait */
508 		auf_null,	0,
509 aui_null,	AUE_NULL,	aus_null,	/* 148 lwp_sema_post */
510 		auf_null,	0,
511 aui_null,	AUE_NULL,	aus_null,	/* 149 lwp_sema_trywait */
512 		auf_null,	0,
513 aui_null,	AUE_NULL,	aus_null,	/* 150 (loadable reserved) */
514 		auf_null,	0,
515 aui_null,	AUE_NULL,	aus_null,	/* 151 (loadable reserved) */
516 		auf_null,	0,
517 aui_modctl,	AUE_MODCTL,	aus_modctl,	/* 152 modctl */
518 		auf_null,	0,
519 aui_null,	AUE_FCHROOT,	aus_null,	/* 153 fchroot */
520 		auf_null,	0,
521 aui_null,	AUE_UTIMES,	aus_null,	/* 154 utimes */
522 		auf_null,	0,
523 aui_null,	AUE_NULL,	aus_null,	/* 155 vhangup */
524 		auf_null,	0,
525 aui_null,	AUE_NULL,	aus_null,	/* 156 gettimeofday */
526 		auf_null,	0,
527 aui_null,	AUE_NULL,	aus_null,	/* 157 getitimer */
528 		auf_null,	0,
529 aui_null,	AUE_NULL,	aus_null,	/* 158 setitimer */
530 		auf_null,	0,
531 aui_null,	AUE_NULL,	aus_null,	/* 159 lwp_create */
532 		auf_null,	0,
533 aui_null,	AUE_NULL,	aus_null,	/* 160 lwp_exit */
534 		auf_null,	0,
535 aui_null,	AUE_NULL,	aus_null,	/* 161 lwp_suspend */
536 		auf_null,	0,
537 aui_null,	AUE_NULL,	aus_null,	/* 162 lwp_continue */
538 		auf_null,	0,
539 aui_null,	AUE_NULL,	aus_null,	/* 163 lwp_kill */
540 		auf_null,	0,
541 aui_null,	AUE_NULL,	aus_null,	/* 164 lwp_self */
542 		auf_null,	0,
543 aui_null,	AUE_NULL,	aus_null,	/* 165 (loadable) */
544 						/*	was lwp_setprivate */
545 		auf_null,	0,
546 aui_null,	AUE_NULL,	aus_null,	/* 166 (loadable) */
547 						/*	was lwp_getprivate */
548 		auf_null,	0,
549 aui_null,	AUE_NULL,	aus_null,	/* 167 lwp_wait */
550 		auf_null,	0,
551 aui_null,	AUE_NULL,	aus_null,	/* 168 lwp_mutex_unlock  */
552 		auf_null,	0,
553 aui_null,	AUE_NULL,	aus_null,	/* 169 lwp_mutex_lock */
554 		auf_null,	0,
555 aui_null,	AUE_NULL,	aus_null,	/* 170 lwp_cond_wait */
556 		auf_null,	0,
557 aui_null,	AUE_NULL,	aus_null,	/* 171 lwp_cond_signal */
558 		auf_null,	0,
559 aui_null,	AUE_NULL,	aus_null,	/* 172 lwp_cond_broadcast */
560 		auf_null,	0,
561 aui_null,	AUE_READ,	aus_null,	/* 173 pread */
562 		auf_read,	S2E_PUB,
563 aui_null,	AUE_WRITE,	aus_null,	/* 174 pwrite */
564 		auf_write,	0,
565 aui_null,	AUE_NULL,	aus_null,	/* 175 llseek */
566 		auf_null,	0,
567 aui_null,	AUE_INST_SYNC,	aus_inst_sync,  /* 176 (loadable) */
568 						/* aus_inst_sync */
569 		auf_null,	0,
570 aui_null,	AUE_BRANDSYS,	aus_brandsys,	/* 177 brandsys */
571 		auf_null,	0,
572 aui_null,	AUE_NULL,	aus_null,	/* 178 (loadable) */
573 		auf_null,	0,
574 aui_null,	AUE_NULL,	aus_null,	/* 179 (loadable) */
575 		auf_null,	0,
576 aui_null,	AUE_NULL,	aus_null,	/* 180 (loadable) kaio */
577 		auf_null,	0,
578 aui_null,	AUE_NULL,	aus_null,	/* 181 (loadable) */
579 		auf_null,	0,
580 aui_null,	AUE_NULL,	aus_null,	/* 182 (loadable) */
581 		auf_null,	0,
582 aui_null,	AUE_NULL,	aus_null,	/* 183 (loadable) */
583 		auf_null,	0,
584 aui_null,	AUE_NULL,	aus_null,	/* 184 (loadable) tsolsys */
585 		auf_null,	0,
586 aui_acl,	AUE_ACLSET,	aus_acl,	/* 185 acl */
587 		auf_null,	0,
588 aui_auditsys,	AUE_AUDITSYS,	aus_auditsys,	/* 186 auditsys  */
589 		auf_null,	0,
590 aui_null,	AUE_PROCESSOR_BIND,	aus_processor_bind,
591 		auf_null,	0,		/* 187 processor_bind */
592 aui_null,	AUE_NULL,	aus_null,	/* 188 processor_info */
593 		auf_null,	0,
594 aui_null,	AUE_P_ONLINE,	aus_p_online,	/* 189 p_online */
595 		auf_null,	0,
596 aui_null,	AUE_NULL,	aus_sigqueue,	/* 190 sigqueue */
597 		auf_null,	0,
598 aui_null,	AUE_NULL,	aus_null,	/* 191 clock_gettime */
599 		auf_null,	0,
600 aui_null,	AUE_CLOCK_SETTIME,	aus_null,	/* 192 clock_settime */
601 		auf_null,	0,
602 aui_null,	AUE_NULL,	aus_null,	/* 193 clock_getres */
603 		auf_null,	0,
604 aui_null,	AUE_NULL,	aus_null,	/* 194 timer_create */
605 		auf_null,	0,
606 aui_null,	AUE_NULL,	aus_null,	/* 195 timer_delete */
607 		auf_null,	0,
608 aui_null,	AUE_NULL,	aus_null,	/* 196 timer_settime */
609 		auf_null,	0,
610 aui_null,	AUE_NULL,	aus_null,	/* 197 timer_gettime */
611 		auf_null,	0,
612 aui_null,	AUE_NULL,	aus_null,	/* 198 timer_getoverrun */
613 		auf_null,	0,
614 aui_null,	AUE_NULL,	aus_null,	/* 199 nanosleep */
615 		auf_null,	0,
616 aui_acl,	AUE_FACLSET,	aus_facl,	/* 200 facl */
617 		auf_null,	0,
618 aui_doorfs,	AUE_DOORFS,	aus_doorfs,	/* 201 (loadable) doorfs */
619 		auf_null,	0,
620 aui_null,	AUE_SETREUID,	aus_setreuid,	/* 202 setreuid */
621 		auf_null,	0,
622 aui_null,	AUE_SETREGID,	aus_setregid,	/* 203 setregid */
623 		auf_null,	0,
624 aui_null,	AUE_NULL,	aus_null,	/* 204 install_utrap */
625 		auf_null,	0,
626 aui_null,	AUE_NULL,	aus_null,	/* 205 signotify */
627 		auf_null,	0,
628 aui_null,	AUE_NULL,	aus_null,	/* 206 schedctl */
629 		auf_null,	0,
630 aui_null,	AUE_NULL,	aus_null,	/* 207 (loadable) pset */
631 		auf_null,	0,
632 aui_null,	AUE_NULL,	aus_null,	/* 208 (loadable) */
633 		auf_null,	0,
634 aui_null,	AUE_NULL,	aus_null,	/* 209 resolvepath */
635 		auf_null,	0,
636 aui_null,	AUE_NULL,	aus_null,	/* 210 lwp_mutex_timedlock */
637 		auf_null,	0,
638 aui_null,	AUE_NULL,	aus_null,	/* 211 lwp_sema_timedwait */
639 		auf_null,	0,
640 aui_null,	AUE_NULL,	aus_null,	/* 212 lwp_rwlock_sys */
641 		auf_null,	0,
642 aui_null,	AUE_NULL,	aus_null,	/* 213 getdents64 (__ppc) */
643 		auf_null,	0,
644 aui_null,	AUE_MMAP,	aus_mmap,	/* 214 mmap64 */
645 		auf_null,	0,
646 aui_null,	AUE_STAT,	aus_null,	/* 215 stat64 */
647 		auf_null,	S2E_PUB,
648 aui_null,	AUE_LSTAT,	aus_null,	/* 216 lstat64 */
649 		auf_null,	S2E_PUB,
650 aui_null,	AUE_NULL,	aus_null,	/* 217 fstat64 */
651 		auf_null,	0,
652 aui_null,	AUE_STATVFS,	aus_null,	/* 218 statvfs64 */
653 		auf_null,	S2E_PUB,
654 aui_null,	AUE_NULL,	aus_null,	/* 219 fstatvfs64 */
655 		auf_null,	0,
656 aui_null,	AUE_SETRLIMIT,	aus_null,	/* 220 setrlimit64 */
657 		auf_null,	0,
658 aui_null,	AUE_NULL,	aus_null,	/* 221 getrlimit64 */
659 		auf_null,	0,
660 aui_null,	AUE_READ,	aus_null,	/* 222 pread64  */
661 		auf_read,	S2E_PUB,
662 aui_null,	AUE_WRITE,	aus_null,	/* 223 pwrite64 */
663 		auf_write,	0,
664 aui_null,	AUE_CREAT,	aus_null,	/* 224 creat64 */
665 		auf_null,	S2E_SP,
666 aui_open,	AUE_OPEN,	aus_open,	/* 225 open64 */
667 		auf_null,	S2E_SP,
668 aui_null,	AUE_NULL,	aus_null,	/* 226 (loadable) rpcsys */
669 		auf_null,	0,
670 aui_null,	AUE_NULL,	aus_null,	/* 227 (loadable) */
671 		auf_null,	0,
672 aui_null,	AUE_NULL,	aus_null,	/* 228 (loadable) */
673 		auf_null,	0,
674 aui_null,	AUE_NULL,	aus_null,	/* 229 (loadable) */
675 		auf_null,	0,
676 aui_null,	AUE_SOCKET,	aus_socket,	/* 230 so_socket */
677 		auf_null,	0,
678 aui_null,	AUE_NULL,	aus_null,	/* 231 so_socketpair */
679 		auf_null,	0,
680 aui_null,	AUE_BIND,	aus_null,	/* 232 bind */
681 		auf_bind,	0,
682 aui_null,	AUE_NULL,	aus_null,	/* 233 listen */
683 		auf_null,	0,
684 aui_null,	AUE_ACCEPT,	aus_null,	/* 234 accept */
685 		auf_accept,	0,
686 aui_null,	AUE_CONNECT,	aus_null,	/* 235 connect */
687 		auf_connect,	0,
688 aui_null,	AUE_SHUTDOWN,	aus_shutdown,	/* 236 shutdown */
689 		auf_null,	0,
690 aui_null,	AUE_READ,	aus_null,	/* 237 recv */
691 		auf_recv,	0,
692 aui_null,	AUE_RECVFROM,	aus_null,	/* 238 recvfrom */
693 		auf_recvfrom,	0,
694 aui_null,	AUE_RECVMSG,	aus_null,	/* 239 recvmsg */
695 		auf_recvmsg,	0,
696 aui_null,	AUE_WRITE,	aus_null,	/* 240 send */
697 		auf_send,	0,
698 aui_null,	AUE_SENDMSG,	aus_null,	/* 241 sendmsg */
699 		auf_sendmsg,	0,
700 aui_null,	AUE_SENDTO,	aus_null,	/* 242 sendto */
701 		auf_sendto,	0,
702 aui_null,	AUE_NULL,	aus_null,	/* 243 getpeername */
703 		auf_null,	0,
704 aui_null,	AUE_NULL,	aus_null,	/* 244 getsockname */
705 		auf_null,	0,
706 aui_null,	AUE_NULL,	aus_null,	/* 245 getsockopt */
707 		auf_null,	0,
708 aui_null,	AUE_SETSOCKOPT,	aus_null,	/* 246 setsockopt */
709 		auf_setsockopt,	0,
710 aui_null,	AUE_SOCKCONFIG,	aus_sockconfig,	/* 247 sockconfig */
711 		auf_null,	0,
712 aui_null,	AUE_NULL,	aus_null,	/* 248 ntp_gettime */
713 		auf_null,	0,
714 aui_null,	AUE_NTP_ADJTIME,	aus_null,	/* 249 ntp_adjtime */
715 		auf_null,	0,
716 aui_null,	AUE_NULL,	aus_null,	/* 250 lwp_mutex_unlock */
717 		auf_null,	0,
718 aui_null,	AUE_NULL,	aus_null,	/* 251 lwp_mutex_trylock */
719 		auf_null,	0,
720 aui_null,	AUE_NULL,	aus_null,	/* 252 lwp_mutex_init */
721 		auf_null,	0,
722 aui_null,	AUE_NULL,	aus_null,	/* 253 cladm */
723 		auf_null,	0,
724 aui_null,	AUE_NULL,	aus_null,	/* 254 uucopy */
725 		auf_null,	0,
726 aui_null,	AUE_UMOUNT2,	aus_umount2,	/* 255 umount2 */
727 		auf_null,	0
728 };
729 
730 uint_t num_syscall = sizeof (audit_s2e) / sizeof (struct audit_s2e);
731 
732 char *so_not_bound = "socket not bound";
733 char *so_not_conn  = "socket not connected";
734 char *so_bad_addr  = "bad socket address";
735 char *so_bad_peer_addr  = "bad peer address";
736 
737 /* null start function */
738 /*ARGSUSED*/
739 static void
740 aus_null(struct t_audit_data *tad)
741 {
742 }
743 
744 /* acct start function */
745 /*ARGSUSED*/
746 static void
747 aus_acct(struct t_audit_data *tad)
748 {
749 	klwp_t *clwp = ttolwp(curthread);
750 	uintptr_t fname;
751 
752 	struct a {
753 		long	fname;		/* char * */
754 	} *uap = (struct a *)clwp->lwp_ap;
755 
756 	fname = (uintptr_t)uap->fname;
757 
758 	if (fname == 0)
759 		au_uwrite(au_to_arg32(1, "accounting off", (uint32_t)0));
760 }
761 
762 /* chown start function */
763 /*ARGSUSED*/
764 static void
765 aus_chown(struct t_audit_data *tad)
766 {
767 	klwp_t *clwp = ttolwp(curthread);
768 	uint32_t uid, gid;
769 
770 	struct a {
771 		long	fname;		/* char * */
772 		long	uid;
773 		long	gid;
774 	} *uap = (struct a *)clwp->lwp_ap;
775 
776 	uid = (uint32_t)uap->uid;
777 	gid = (uint32_t)uap->gid;
778 
779 	au_uwrite(au_to_arg32(2, "new file uid", uid));
780 	au_uwrite(au_to_arg32(3, "new file gid", gid));
781 }
782 
783 /* fchown start function */
784 /*ARGSUSED*/
785 static void
786 aus_fchown(struct t_audit_data *tad)
787 {
788 	klwp_t *clwp = ttolwp(curthread);
789 	uint32_t uid, gid, fd;
790 	struct file  *fp;
791 	struct vnode *vp;
792 	struct f_audit_data *fad;
793 
794 	struct a {
795 		long fd;
796 		long uid;
797 		long gid;
798 	} *uap = (struct a *)clwp->lwp_ap;
799 
800 	fd  = (uint32_t)uap->fd;
801 	uid = (uint32_t)uap->uid;
802 	gid = (uint32_t)uap->gid;
803 
804 	au_uwrite(au_to_arg32(2, "new file uid", uid));
805 	au_uwrite(au_to_arg32(3, "new file gid", gid));
806 
807 		/*
808 		 * convert file pointer to file descriptor
809 		 *   Note: fd ref count incremented here.
810 		 */
811 	if ((fp = getf(fd)) == NULL)
812 		return;
813 
814 	/* get path from file struct here */
815 	fad = F2A(fp);
816 	if (fad->fad_aupath != NULL) {
817 		au_uwrite(au_to_path(fad->fad_aupath));
818 	} else {
819 		au_uwrite(au_to_arg32(1, "no path: fd", fd));
820 	}
821 
822 	vp = fp->f_vnode;
823 	audit_attributes(vp);
824 
825 	/* decrement file descriptor reference count */
826 	releasef(fd);
827 }
828 
829 /*ARGSUSED*/
830 static void
831 aus_lchown(struct t_audit_data *tad)
832 {
833 	klwp_t *clwp = ttolwp(curthread);
834 	uint32_t uid, gid;
835 
836 
837 	struct a {
838 		long	fname;		/* char	* */
839 		long	uid;
840 		long	gid;
841 	} *uap = (struct a *)clwp->lwp_ap;
842 
843 	uid = (uint32_t)uap->uid;
844 	gid = (uint32_t)uap->gid;
845 
846 	au_uwrite(au_to_arg32(2, "new file uid", uid));
847 	au_uwrite(au_to_arg32(3, "new file gid", gid));
848 }
849 
850 /* chmod start function */
851 /*ARGSUSED*/
852 static void
853 aus_chmod(struct t_audit_data *tad)
854 {
855 	klwp_t *clwp = ttolwp(curthread);
856 	uint32_t fmode;
857 
858 	struct a {
859 		long	fname;		/* char	* */
860 		long	fmode;
861 	} *uap = (struct a *)clwp->lwp_ap;
862 
863 	fmode = (uint32_t)uap->fmode;
864 
865 	au_uwrite(au_to_arg32(2, "new file mode", fmode&07777));
866 }
867 
868 /* chmod start function */
869 /*ARGSUSED*/
870 static void
871 aus_fchmod(struct t_audit_data *tad)
872 {
873 	klwp_t *clwp = ttolwp(curthread);
874 	uint32_t fmode, fd;
875 	struct file  *fp;
876 	struct vnode *vp;
877 	struct f_audit_data *fad;
878 
879 	struct a {
880 		long	fd;
881 		long	fmode;
882 	} *uap = (struct a *)clwp->lwp_ap;
883 
884 	fd = (uint32_t)uap->fd;
885 	fmode = (uint32_t)uap->fmode;
886 
887 	au_uwrite(au_to_arg32(2, "new file mode", fmode&07777));
888 
889 		/*
890 		 * convert file pointer to file descriptor
891 		 *   Note: fd ref count incremented here.
892 		 */
893 	if ((fp = getf(fd)) == NULL)
894 		return;
895 
896 		/* get path from file struct here */
897 	fad = F2A(fp);
898 	if (fad->fad_aupath != NULL) {
899 		au_uwrite(au_to_path(fad->fad_aupath));
900 	} else {
901 		au_uwrite(au_to_arg32(1, "no path: fd", fd));
902 	}
903 
904 	vp = fp->f_vnode;
905 	audit_attributes(vp);
906 
907 	/* decrement file descriptor reference count */
908 	releasef(fd);
909 }
910 
911 /* null function */
912 /*ARGSUSED*/
913 static void
914 auf_null(struct t_audit_data *tad, int error, rval_t *rval)
915 {
916 }
917 
918 /* null function */
919 static au_event_t
920 aui_null(au_event_t e)
921 {
922 	return (e);
923 }
924 
925 /* convert open to appropriate event */
926 static au_event_t
927 aui_open(au_event_t e)
928 {
929 	klwp_t *clwp = ttolwp(curthread);
930 	uint_t fm;
931 
932 	struct a {
933 		long	fnamep;		/* char	* */
934 		long	fmode;
935 		long	cmode;
936 	} *uap = (struct a *)clwp->lwp_ap;
937 
938 	fm = (uint_t)uap->fmode;
939 
940 	if (fm & O_WRONLY)
941 		e = AUE_OPEN_W;
942 	else if (fm & O_RDWR)
943 		e = AUE_OPEN_RW;
944 	else
945 		e = AUE_OPEN_R;
946 
947 	if (fm & O_CREAT)
948 		e += 1;
949 	if (fm & O_TRUNC)
950 		e += 2;
951 
952 	return (e);
953 }
954 
955 /*ARGSUSED*/
956 static void
957 aus_open(struct t_audit_data *tad)
958 {
959 	klwp_t *clwp = ttolwp(curthread);
960 	uint_t fm;
961 
962 	struct a {
963 		long	fnamep;		/* char	* */
964 		long	fmode;
965 		long	cmode;
966 	} *uap = (struct a *)clwp->lwp_ap;
967 
968 	fm = (uint_t)uap->fmode;
969 
970 	/* If no write, create, or trunc modes, mark as a public op */
971 	if (!(fm & (O_WRONLY|O_RDWR|O_CREAT|O_TRUNC)))
972 		tad->tad_ctrl |= PAD_PUBLIC_EV;
973 }
974 
975 /* convert openat(2) to appropriate event */
976 static au_event_t
977 aui_fsat(au_event_t e)
978 {
979 	t_audit_data_t	*tad = U2A(u);
980 	klwp_t *clwp = ttolwp(curthread);
981 	uint_t fmcode, fm;
982 	struct a {
983 		long id;
984 		long arg1;
985 		long arg2;
986 		long arg3;
987 		long arg4;
988 		long arg5;
989 	} *uap = (struct a *)clwp->lwp_ap;
990 
991 	fmcode  = (uint_t)uap->id;
992 
993 	switch (fmcode) {
994 
995 	case 0: /* openat */
996 	case 1: /* openat64 */
997 		fm = (uint_t)uap->arg3;
998 		if (fm & O_WRONLY)
999 			e = AUE_OPENAT_W;
1000 		else if (fm & O_RDWR)
1001 			e = AUE_OPENAT_RW;
1002 		else
1003 			e = AUE_OPENAT_R;
1004 
1005 		/*
1006 		 * openat modes are defined in the following order:
1007 		 * Read only
1008 		 * Read|Create
1009 		 * Read|Trunc
1010 		 * Read|Create|Trunc
1011 		 * Write Only
1012 		 * Write|Create
1013 		 * Write|Trunc
1014 		 * Write|Create|Trunc * RW Only
1015 		 * RW|Create
1016 		 * RW|Trunc
1017 		 * RW|Create|Trunc
1018 		 */
1019 		if (fm & O_CREAT)
1020 			e += 1;		/* increment to include CREAT in mode */
1021 		if (fm & O_TRUNC)
1022 			e += 2;		/* increment to include TRUNC in mode */
1023 
1024 		/* convert to appropriate au_ctrl */
1025 		tad->tad_ctrl |= PAD_SAVPATH;
1026 		if (fm & FXATTR)
1027 			tad->tad_ctrl |= PAD_ATPATH;
1028 
1029 
1030 		break;
1031 	case 2: /* fstatat64 */
1032 	case 3: /* fstatat */
1033 		e = AUE_FSTATAT;
1034 		break;
1035 	case 4: /* fchownat */
1036 		e = AUE_FCHOWNAT;
1037 		break;
1038 	case 5: /* unlinkat */
1039 		e = AUE_UNLINKAT;
1040 		break;
1041 	case 6: /* futimesat */
1042 		e = AUE_FUTIMESAT;
1043 		break;
1044 	case 7: /* renameat */
1045 		e = AUE_RENAMEAT;
1046 		break;
1047 	default:
1048 		e = AUE_NULL;
1049 		break;
1050 	}
1051 
1052 	return (e);
1053 }
1054 
1055 /*ARGSUSED*/
1056 static void
1057 aus_fsat(struct t_audit_data *tad)
1058 {
1059 	klwp_t *clwp = ttolwp(curthread);
1060 	uint_t fmcode, fm;
1061 	struct a {
1062 		long id;
1063 		long arg1;
1064 		long arg2;
1065 		long arg3;
1066 		long arg4;
1067 		long arg5;
1068 	} *uap = (struct a *)clwp->lwp_ap;
1069 
1070 	fmcode  = (uint_t)uap->id;
1071 
1072 	switch (fmcode) {
1073 
1074 	case 0: /* openat */
1075 	case 1: /* openat64 */
1076 		fm = (uint_t)uap->arg3;
1077 		/* If no write, create, or trunc modes, mark as a public op */
1078 		if (!(fm & (O_WRONLY|O_RDWR|O_CREAT|O_TRUNC)))
1079 			tad->tad_ctrl |= PAD_PUBLIC_EV;
1080 
1081 		break;
1082 	case 2: /* fstatat64 */
1083 	case 3: /* fstatat */
1084 		tad->tad_ctrl |= PAD_PUBLIC_EV;
1085 		break;
1086 	default:
1087 		break;
1088 	}
1089 }
1090 
1091 /* msgsys */
1092 static au_event_t
1093 aui_msgsys(au_event_t e)
1094 {
1095 	klwp_t *clwp = ttolwp(curthread);
1096 	uint_t fm;
1097 
1098 	struct a {
1099 		long	id;	/* function code id */
1100 		long	ap;	/* arg pointer for recvmsg */
1101 	} *uap = (struct a *)clwp->lwp_ap;
1102 
1103 	struct b {
1104 		long	msgid;
1105 		long	cmd;
1106 		long	buf;	/* struct msqid_ds * */
1107 	} *uap1 = (struct b *)&clwp->lwp_ap[1];
1108 
1109 	fm  = (uint_t)uap->id;
1110 
1111 	switch (fm) {
1112 	case 0:		/* msgget */
1113 		e = AUE_MSGGET;
1114 		break;
1115 	case 1:		/* msgctl */
1116 		switch ((uint_t)uap1->cmd) {
1117 		case IPC_RMID:
1118 			e = AUE_MSGCTL_RMID;
1119 			break;
1120 		case IPC_SET:
1121 			e = AUE_MSGCTL_SET;
1122 			break;
1123 		case IPC_STAT:
1124 			e = AUE_MSGCTL_STAT;
1125 			break;
1126 		default:
1127 			e = AUE_MSGCTL;
1128 			break;
1129 		}
1130 		break;
1131 	case 2:		/* msgrcv */
1132 		e = AUE_MSGRCV;
1133 		break;
1134 	case 3:		/* msgsnd */
1135 		e = AUE_MSGSND;
1136 		break;
1137 	default:	/* illegal system call */
1138 		e = AUE_NULL;
1139 		break;
1140 	}
1141 
1142 	return (e);
1143 }
1144 
1145 
1146 /* shmsys */
1147 static au_event_t
1148 aui_shmsys(au_event_t e)
1149 {
1150 	klwp_t *clwp = ttolwp(curthread);
1151 	int fm;
1152 
1153 	struct a {		/* shmsys */
1154 		long	id;	/* function code id */
1155 	} *uap = (struct a *)clwp->lwp_ap;
1156 
1157 	struct b {		/* ctrl */
1158 		long	shmid;
1159 		long	cmd;
1160 		long	arg;		/* struct shmid_ds * */
1161 	} *uap1 = (struct b *)&clwp->lwp_ap[1];
1162 	fm  = (uint_t)uap->id;
1163 
1164 	switch (fm) {
1165 	case 0:		/* shmat */
1166 		e = AUE_SHMAT;
1167 		break;
1168 	case 1:		/* shmctl */
1169 		switch ((uint_t)uap1->cmd) {
1170 		case IPC_RMID:
1171 			e = AUE_SHMCTL_RMID;
1172 			break;
1173 		case IPC_SET:
1174 			e = AUE_SHMCTL_SET;
1175 			break;
1176 		case IPC_STAT:
1177 			e = AUE_SHMCTL_STAT;
1178 			break;
1179 		default:
1180 			e = AUE_SHMCTL;
1181 			break;
1182 		}
1183 		break;
1184 	case 2:		/* shmdt */
1185 		e = AUE_SHMDT;
1186 		break;
1187 	case 3:		/* shmget */
1188 		e = AUE_SHMGET;
1189 		break;
1190 	default:	/* illegal system call */
1191 		e = AUE_NULL;
1192 		break;
1193 	}
1194 
1195 	return (e);
1196 }
1197 
1198 
1199 /* semsys */
1200 static au_event_t
1201 aui_semsys(au_event_t e)
1202 {
1203 	klwp_t *clwp = ttolwp(curthread);
1204 	uint_t fm;
1205 
1206 	struct a {		/* semsys */
1207 		long	id;
1208 	} *uap = (struct a *)clwp->lwp_ap;
1209 
1210 	struct b {		/* ctrl */
1211 		long	semid;
1212 		long	semnum;
1213 		long	cmd;
1214 		long	arg;
1215 	} *uap1 = (struct b *)&clwp->lwp_ap[1];
1216 
1217 	fm = (uint_t)uap->id;
1218 
1219 	switch (fm) {
1220 	case 0:		/* semctl */
1221 		switch ((uint_t)uap1->cmd) {
1222 		case IPC_RMID:
1223 			e = AUE_SEMCTL_RMID;
1224 			break;
1225 		case IPC_SET:
1226 			e = AUE_SEMCTL_SET;
1227 			break;
1228 		case IPC_STAT:
1229 			e = AUE_SEMCTL_STAT;
1230 			break;
1231 		case GETNCNT:
1232 			e = AUE_SEMCTL_GETNCNT;
1233 			break;
1234 		case GETPID:
1235 			e = AUE_SEMCTL_GETPID;
1236 			break;
1237 		case GETVAL:
1238 			e = AUE_SEMCTL_GETVAL;
1239 			break;
1240 		case GETALL:
1241 			e = AUE_SEMCTL_GETALL;
1242 			break;
1243 		case GETZCNT:
1244 			e = AUE_SEMCTL_GETZCNT;
1245 			break;
1246 		case SETVAL:
1247 			e = AUE_SEMCTL_SETVAL;
1248 			break;
1249 		case SETALL:
1250 			e = AUE_SEMCTL_SETALL;
1251 			break;
1252 		default:
1253 			e = AUE_SEMCTL;
1254 			break;
1255 		}
1256 		break;
1257 	case 1:		/* semget */
1258 		e = AUE_SEMGET;
1259 		break;
1260 	case 2:		/* semop */
1261 		e = AUE_SEMOP;
1262 		break;
1263 	default:	/* illegal system call */
1264 		e = AUE_NULL;
1265 		break;
1266 	}
1267 
1268 	return (e);
1269 }
1270 
1271 /* utssys - uname(2), ustat(2), fusers(2) */
1272 static au_event_t
1273 aui_utssys(au_event_t e)
1274 {
1275 	klwp_t *clwp = ttolwp(curthread);
1276 	uint_t type;
1277 
1278 	struct a {
1279 		union {
1280 			long	cbuf;		/* char * */
1281 			long	ubuf;		/* struct stat * */
1282 		} ub;
1283 		union {
1284 			long	mv;	/* for USTAT */
1285 			long	flags;	/* for FUSERS */
1286 		} un;
1287 		long	type;
1288 		long	outbp;		/* char * for FUSERS */
1289 	} *uap = (struct a *)clwp->lwp_ap;
1290 
1291 	type = (uint_t)uap->type;
1292 
1293 	if (type == UTS_FUSERS)
1294 		return (e);
1295 	else
1296 		return ((au_event_t)AUE_NULL);
1297 }
1298 
1299 static au_event_t
1300 aui_fcntl(au_event_t e)
1301 {
1302 	klwp_t *clwp = ttolwp(curthread);
1303 	uint_t cmd;
1304 
1305 	struct a {
1306 		long	fdes;
1307 		long	cmd;
1308 		long	arg;
1309 	} *uap = (struct a *)clwp->lwp_ap;
1310 
1311 	cmd = (uint_t)uap->cmd;
1312 
1313 	switch (cmd) {
1314 	case F_GETLK:
1315 	case F_SETLK:
1316 	case F_SETLKW:
1317 		break;
1318 	case F_SETFL:
1319 	case F_GETFL:
1320 	case F_GETFD:
1321 		break;
1322 	default:
1323 		e = (au_event_t)AUE_NULL;
1324 		break;
1325 	}
1326 	return ((au_event_t)e);
1327 }
1328 
1329 /* null function for now */
1330 static au_event_t
1331 aui_execv(au_event_t e)
1332 {
1333 	return (e);
1334 }
1335 
1336 /* null function for now */
1337 static au_event_t
1338 aui_execve(au_event_t e)
1339 {
1340 	return (e);
1341 }
1342 
1343 /*ARGSUSED*/
1344 static void
1345 aus_fcntl(struct t_audit_data *tad)
1346 {
1347 	klwp_t *clwp = ttolwp(curthread);
1348 	uint32_t cmd, fd;
1349 	struct file  *fp;
1350 	struct vnode *vp;
1351 	struct f_audit_data *fad;
1352 
1353 	struct a {
1354 		long	fd;
1355 		long	cmd;
1356 		long	arg;
1357 	} *uap = (struct a *)clwp->lwp_ap;
1358 
1359 	cmd = (uint32_t)uap->cmd;
1360 	fd  = (uint32_t)uap->fd;
1361 
1362 	au_uwrite(au_to_arg32(2, "cmd", cmd));
1363 
1364 		/*
1365 		 * convert file pointer to file descriptor
1366 		 *   Note: fd ref count incremented here.
1367 		 */
1368 	if ((fp = getf(fd)) == NULL)
1369 		return;
1370 
1371 	/* get path from file struct here */
1372 	fad = F2A(fp);
1373 	if (fad->fad_aupath != NULL) {
1374 		au_uwrite(au_to_path(fad->fad_aupath));
1375 	} else {
1376 		au_uwrite(au_to_arg32(1, "no path: fd", fd));
1377 	}
1378 
1379 	vp = fp->f_vnode;
1380 	audit_attributes(vp);
1381 
1382 	/* decrement file descriptor reference count */
1383 	releasef(fd);
1384 }
1385 
1386 /*ARGSUSED*/
1387 static void
1388 aus_kill(struct t_audit_data *tad)
1389 {
1390 	klwp_t *clwp = ttolwp(curthread);
1391 	struct proc *p;
1392 	uint32_t signo;
1393 	uid_t uid, ruid;
1394 	gid_t gid, rgid;
1395 	pid_t pid;
1396 	const auditinfo_addr_t *ainfo;
1397 	cred_t *cr;
1398 
1399 	struct a {
1400 		long	pid;
1401 		long	signo;
1402 	} *uap = (struct a *)clwp->lwp_ap;
1403 
1404 	pid   = (pid_t)uap->pid;
1405 	signo = (uint32_t)uap->signo;
1406 
1407 	au_uwrite(au_to_arg32(2, "signal", signo));
1408 	if (pid > 0) {
1409 		mutex_enter(&pidlock);
1410 		if (((p = prfind(pid)) == (struct proc *)0) ||
1411 		    (p->p_stat == SIDL)) {
1412 			mutex_exit(&pidlock);
1413 			au_uwrite(au_to_arg32(1, "process", (uint32_t)pid));
1414 			return;
1415 		}
1416 		mutex_enter(&p->p_lock); /* so process doesn't go away */
1417 		mutex_exit(&pidlock);
1418 
1419 		mutex_enter(&p->p_crlock);
1420 		crhold(cr = p->p_cred);
1421 		mutex_exit(&p->p_crlock);
1422 		mutex_exit(&p->p_lock);
1423 
1424 		ainfo = crgetauinfo(cr);
1425 		if (ainfo == NULL) {
1426 			crfree(cr);
1427 			au_uwrite(au_to_arg32(1, "process", (uint32_t)pid));
1428 			return;
1429 		}
1430 
1431 		uid  = crgetuid(cr);
1432 		gid  = crgetgid(cr);
1433 		ruid = crgetruid(cr);
1434 		rgid = crgetrgid(cr);
1435 		au_uwrite(au_to_process(uid, gid, ruid, rgid, pid,
1436 		    ainfo->ai_auid, ainfo->ai_asid, &ainfo->ai_termid));
1437 
1438 		if (is_system_labeled())
1439 			au_uwrite(au_to_label(CR_SL(cr)));
1440 
1441 		crfree(cr);
1442 	}
1443 	else
1444 		au_uwrite(au_to_arg32(1, "process", (uint32_t)pid));
1445 }
1446 
1447 /*ARGSUSED*/
1448 static void
1449 aus_mkdir(struct t_audit_data *tad)
1450 {
1451 	klwp_t *clwp = ttolwp(curthread);
1452 	uint32_t dmode;
1453 
1454 	struct a {
1455 		long	dirnamep;		/* char * */
1456 		long	dmode;
1457 	} *uap = (struct a *)clwp->lwp_ap;
1458 
1459 	dmode = (uint32_t)uap->dmode;
1460 
1461 	au_uwrite(au_to_arg32(2, "mode", dmode));
1462 }
1463 
1464 /*ARGSUSED*/
1465 static void
1466 aus_mknod(struct t_audit_data *tad)
1467 {
1468 	klwp_t *clwp = ttolwp(curthread);
1469 	uint32_t fmode;
1470 	dev_t dev;
1471 
1472 	struct a {
1473 		long	pnamep;		/* char * */
1474 		long	fmode;
1475 		long	dev;
1476 	} *uap = (struct a *)clwp->lwp_ap;
1477 
1478 	fmode = (uint32_t)uap->fmode;
1479 	dev   = (dev_t)uap->dev;
1480 
1481 	au_uwrite(au_to_arg32(2, "mode", fmode));
1482 #ifdef _LP64
1483 	au_uwrite(au_to_arg64(3, "dev", dev));
1484 #else
1485 	au_uwrite(au_to_arg32(3, "dev", dev));
1486 #endif
1487 }
1488 
1489 /*ARGSUSED*/
1490 static void
1491 aus_xmknod(struct t_audit_data *tad)
1492 {
1493 	klwp_t *clwp = ttolwp(curthread);
1494 	uint32_t fmode;
1495 	dev_t dev;
1496 
1497 	struct a {
1498 		long	version;	/* version */
1499 		long	pnamep;		/* char * */
1500 		long	fmode;
1501 		long	dev;
1502 	} *uap = (struct a *)clwp->lwp_ap;
1503 
1504 	fmode = (uint32_t)uap->fmode;
1505 	dev   = (dev_t)uap->dev;
1506 
1507 	au_uwrite(au_to_arg32(2, "mode", fmode));
1508 #ifdef _LP64
1509 	au_uwrite(au_to_arg64(3, "dev", dev));
1510 #else
1511 	au_uwrite(au_to_arg32(3, "dev", dev));
1512 #endif
1513 }
1514 
1515 /*ARGSUSED*/
1516 static void
1517 auf_mknod(struct t_audit_data *tad, int error, rval_t *rval)
1518 {
1519 	klwp_t *clwp = ttolwp(curthread);
1520 	vnode_t	*dvp;
1521 	caddr_t pnamep;
1522 
1523 	struct a {
1524 		long	pnamep;		/* char * */
1525 		long	fmode;
1526 		long	dev;
1527 	} *uap = (struct a *)clwp->lwp_ap;
1528 
1529 	/* no error, then already path token in audit record */
1530 	if (error != EPERM)
1531 		return;
1532 
1533 	/* not auditing this event, nothing then to do */
1534 	if (tad->tad_flag == 0)
1535 		return;
1536 
1537 	/* do the lookup to force generation of path token */
1538 	pnamep = (caddr_t)uap->pnamep;
1539 	tad->tad_ctrl |= PAD_NOATTRB;
1540 	error = lookupname(pnamep, UIO_USERSPACE, NO_FOLLOW, &dvp, NULLVPP);
1541 	if (error == 0)
1542 		VN_RELE(dvp);
1543 }
1544 
1545 /*ARGSUSED*/
1546 static void
1547 auf_xmknod(struct t_audit_data *tad, int error, rval_t *rval)
1548 {
1549 	klwp_t *clwp = ttolwp(curthread);
1550 	vnode_t	*dvp;
1551 	caddr_t pnamep;
1552 
1553 	struct a {
1554 		long	version;	/* version */
1555 		long	pnamep;		/* char * */
1556 		long	fmode;
1557 		long	dev;
1558 	} *uap = (struct a *)clwp->lwp_arg;
1559 
1560 
1561 	/* no error, then already path token in audit record */
1562 	if (error != EPERM)
1563 		return;
1564 
1565 	/* not auditing this event, nothing then to do */
1566 	if (tad->tad_flag == 0)
1567 		return;
1568 
1569 	/* do the lookup to force generation of path token */
1570 	pnamep = (caddr_t)uap->pnamep;
1571 	tad->tad_ctrl |= PAD_NOATTRB;
1572 	error = lookupname(pnamep, UIO_USERSPACE, NO_FOLLOW, &dvp, NULLVPP);
1573 	if (error == 0)
1574 		VN_RELE(dvp);
1575 }
1576 
1577 /*ARGSUSED*/
1578 static void
1579 aus_mount(struct t_audit_data *tad)
1580 {	/* AUS_START */
1581 	klwp_t *clwp = ttolwp(curthread);
1582 	uint32_t flags;
1583 	uintptr_t u_fstype, dataptr;
1584 	STRUCT_DECL(nfs_args, nfsargs);
1585 	size_t len;
1586 	char *fstype, *hostname;
1587 
1588 	struct a {
1589 		long	spec;		/* char    * */
1590 		long	dir;		/* char    * */
1591 		long	flags;
1592 		long	fstype;		/* char    * */
1593 		long	dataptr;	/* char    * */
1594 		long	datalen;
1595 	} *uap = (struct a *)clwp->lwp_ap;
1596 
1597 	u_fstype = (uintptr_t)uap->fstype;
1598 	flags    = (uint32_t)uap->flags;
1599 	dataptr  = (uintptr_t)uap->dataptr;
1600 
1601 	fstype = kmem_alloc(MAXNAMELEN, KM_SLEEP);
1602 	if (copyinstr((caddr_t)u_fstype, (caddr_t)fstype, MAXNAMELEN, &len))
1603 		goto mount_free_fstype;
1604 
1605 	au_uwrite(au_to_arg32(3, "flags", flags));
1606 	au_uwrite(au_to_text(fstype));
1607 
1608 	if (strncmp(fstype, "nfs", 3) == 0) {
1609 
1610 		STRUCT_INIT(nfsargs, get_udatamodel());
1611 		bzero(STRUCT_BUF(nfsargs), STRUCT_SIZE(nfsargs));
1612 
1613 		if (copyin((caddr_t)dataptr,
1614 				STRUCT_BUF(nfsargs),
1615 				MIN(uap->datalen, STRUCT_SIZE(nfsargs)))) {
1616 			/* DEBUG debug_enter((char *)NULL); */
1617 			goto mount_free_fstype;
1618 		}
1619 		hostname = kmem_alloc(MAXNAMELEN, KM_SLEEP);
1620 		if (copyinstr(STRUCT_FGETP(nfsargs, hostname),
1621 				(caddr_t)hostname,
1622 				MAXNAMELEN, &len)) {
1623 			goto mount_free_hostname;
1624 		}
1625 		au_uwrite(au_to_text(hostname));
1626 		au_uwrite(au_to_arg32(3, "internal flags",
1627 			(uint_t)STRUCT_FGET(nfsargs, flags)));
1628 
1629 mount_free_hostname:
1630 		kmem_free(hostname, MAXNAMELEN);
1631 	}
1632 
1633 mount_free_fstype:
1634 	kmem_free(fstype, MAXNAMELEN);
1635 }	/* AUS_MOUNT */
1636 
1637 static void
1638 aus_umount_path(caddr_t umount_dir)
1639 {
1640 	char			*dir_path;
1641 	struct audit_path	*path;
1642 	size_t			path_len, dir_len;
1643 
1644 	/* length alloc'd for two string pointers */
1645 	path_len = sizeof (struct audit_path) + sizeof (char *);
1646 	path = kmem_alloc(path_len, KM_SLEEP);
1647 	dir_path = kmem_alloc(MAXPATHLEN, KM_SLEEP);
1648 
1649 	if (copyinstr(umount_dir, (caddr_t)dir_path,
1650 	    MAXPATHLEN, &dir_len))
1651 		goto umount2_free_dir;
1652 
1653 	/*
1654 	 * the audit_path struct assumes that the buffer pointed to
1655 	 * by audp_sect[n] contains string 0 immediatedly followed
1656 	 * by string 1.
1657 	 */
1658 	path->audp_sect[0] = dir_path;
1659 	path->audp_sect[1] = dir_path + strlen(dir_path) + 1;
1660 	path->audp_size = path_len;
1661 	path->audp_ref = 1;		/* not used */
1662 	path->audp_cnt = 1;		/* one path string */
1663 
1664 	au_uwrite(au_to_path(path));
1665 
1666 umount2_free_dir:
1667 	kmem_free(dir_path, MAXPATHLEN);
1668 	kmem_free(path, path_len);
1669 }
1670 
1671 /*
1672  * the umount syscall is implemented as a call to umount2, but the args
1673  * are different...
1674  */
1675 
1676 /*ARGSUSED*/
1677 static void
1678 aus_umount(struct t_audit_data *tad)
1679 {
1680 	klwp_t			*clwp = ttolwp(curthread);
1681 	struct a {
1682 		long	dir;		/* char    * */
1683 	} *uap = (struct a *)clwp->lwp_ap;
1684 
1685 	aus_umount_path((caddr_t)uap->dir);
1686 }
1687 
1688 /*ARGSUSED*/
1689 static void
1690 aus_umount2(struct t_audit_data *tad)
1691 {
1692 	klwp_t			*clwp = ttolwp(curthread);
1693 	struct a {
1694 		long	dir;		/* char    * */
1695 		long	flags;
1696 	} *uap = (struct a *)clwp->lwp_ap;
1697 
1698 	aus_umount_path((caddr_t)uap->dir);
1699 
1700 	au_uwrite(au_to_arg32(2, "flags", (uint32_t)uap->flags));
1701 }
1702 
1703 static void
1704 aus_msgsys(struct t_audit_data *tad)
1705 {
1706 	klwp_t *clwp = ttolwp(curthread);
1707 	uint32_t msgid;
1708 
1709 	struct b {
1710 		long	msgid;
1711 		long	cmd;
1712 		long	buf;		/* struct msqid_ds * */
1713 	} *uap1 = (struct b *)&clwp->lwp_ap[1];
1714 
1715 	msgid = (uint32_t)uap1->msgid;
1716 
1717 
1718 	switch (tad->tad_event) {
1719 	case AUE_MSGGET:		/* msgget */
1720 		au_uwrite(au_to_arg32(1, "msg key", msgid));
1721 		break;
1722 	case AUE_MSGCTL:		/* msgctl */
1723 	case AUE_MSGCTL_RMID:		/* msgctl */
1724 	case AUE_MSGCTL_STAT:		/* msgctl */
1725 	case AUE_MSGRCV:		/* msgrcv */
1726 	case AUE_MSGSND:		/* msgsnd */
1727 		au_uwrite(au_to_arg32(1, "msg ID", msgid));
1728 		break;
1729 	case AUE_MSGCTL_SET:		/* msgctl */
1730 		au_uwrite(au_to_arg32(1, "msg ID", msgid));
1731 		break;
1732 	}
1733 }
1734 
1735 /*ARGSUSED*/
1736 static void
1737 auf_msgsys(struct t_audit_data *tad, int error, rval_t *rval)
1738 {
1739 	int id;
1740 
1741 	if (error != 0)
1742 		return;
1743 	if (tad->tad_event == AUE_MSGGET) {
1744 		uint32_t scid;
1745 		uint32_t sy_flags;
1746 
1747 		/* need to determine type of executing binary */
1748 		scid = tad->tad_scid;
1749 #ifdef _SYSCALL32_IMPL
1750 		if (lwp_getdatamodel(ttolwp(curthread)) == DATAMODEL_NATIVE)
1751 			sy_flags = sysent[scid].sy_flags & SE_RVAL_MASK;
1752 		else
1753 			sy_flags = sysent32[scid].sy_flags & SE_RVAL_MASK;
1754 #else
1755 		sy_flags = sysent[scid].sy_flags & SE_RVAL_MASK;
1756 #endif
1757 		if (sy_flags == SE_32RVAL1)
1758 			id = rval->r_val1;
1759 		if (sy_flags == (SE_32RVAL2|SE_32RVAL1))
1760 			id = rval->r_val1;
1761 		if (sy_flags == SE_64RVAL)
1762 			id = (int)rval->r_vals;
1763 
1764 		au_uwrite(au_to_ipc(AT_IPC_MSG, id));
1765 	}
1766 }
1767 
1768 static void
1769 aus_semsys(struct t_audit_data *tad)
1770 {
1771 	klwp_t *clwp = ttolwp(curthread);
1772 	uint32_t semid;
1773 
1774 	struct b {		/* ctrl */
1775 		long	semid;
1776 		long	semnum;
1777 		long	cmd;
1778 		long	arg;
1779 	} *uap1 = (struct b *)&clwp->lwp_ap[1];
1780 
1781 	semid = (uint32_t)uap1->semid;
1782 
1783 	switch (tad->tad_event) {
1784 	case AUE_SEMCTL_RMID:
1785 	case AUE_SEMCTL_STAT:
1786 	case AUE_SEMCTL_GETNCNT:
1787 	case AUE_SEMCTL_GETPID:
1788 	case AUE_SEMCTL_GETVAL:
1789 	case AUE_SEMCTL_GETALL:
1790 	case AUE_SEMCTL_GETZCNT:
1791 	case AUE_SEMCTL_SETVAL:
1792 	case AUE_SEMCTL_SETALL:
1793 	case AUE_SEMCTL:
1794 	case AUE_SEMOP:
1795 		au_uwrite(au_to_arg32(1, "sem ID", semid));
1796 		break;
1797 	case AUE_SEMCTL_SET:
1798 		au_uwrite(au_to_arg32(1, "sem ID", semid));
1799 		break;
1800 	case AUE_SEMGET:
1801 		au_uwrite(au_to_arg32(1, "sem key", semid));
1802 		break;
1803 	}
1804 }
1805 
1806 /*ARGSUSED*/
1807 static void
1808 auf_semsys(struct t_audit_data *tad, int error, rval_t *rval)
1809 {
1810 	int id;
1811 
1812 	if (error != 0)
1813 		return;
1814 	if (tad->tad_event == AUE_SEMGET) {
1815 		uint32_t scid;
1816 		uint32_t sy_flags;
1817 
1818 		/* need to determine type of executing binary */
1819 		scid = tad->tad_scid;
1820 #ifdef _SYSCALL32_IMPL
1821 		if (lwp_getdatamodel(ttolwp(curthread)) == DATAMODEL_NATIVE)
1822 			sy_flags = sysent[scid].sy_flags & SE_RVAL_MASK;
1823 		else
1824 			sy_flags = sysent32[scid].sy_flags & SE_RVAL_MASK;
1825 #else
1826 		sy_flags = sysent[scid].sy_flags & SE_RVAL_MASK;
1827 #endif
1828 		if (sy_flags == SE_32RVAL1)
1829 			id = rval->r_val1;
1830 		if (sy_flags == (SE_32RVAL2|SE_32RVAL1))
1831 			id = rval->r_val1;
1832 		if (sy_flags == SE_64RVAL)
1833 			id = (int)rval->r_vals;
1834 
1835 		au_uwrite(au_to_ipc(AT_IPC_SEM, id));
1836 	}
1837 }
1838 
1839 /*ARGSUSED*/
1840 static void
1841 aus_close(struct t_audit_data *tad)
1842 {
1843 	klwp_t *clwp = ttolwp(curthread);
1844 	uint32_t fd;
1845 	struct file *fp;
1846 	struct f_audit_data *fad;
1847 	struct vnode *vp;
1848 	struct vattr attr;
1849 	au_kcontext_t	*kctx = SET_KCTX_PZ;
1850 
1851 	struct a {
1852 		long	i;
1853 	} *uap = (struct a *)clwp->lwp_ap;
1854 
1855 	fd = (uint32_t)uap->i;
1856 
1857 	attr.va_mask = 0;
1858 	au_uwrite(au_to_arg32(1, "fd", fd));
1859 
1860 		/*
1861 		 * convert file pointer to file descriptor
1862 		 *   Note: fd ref count incremented here.
1863 		 */
1864 	if ((fp = getf(fd)) == NULL)
1865 		return;
1866 
1867 	fad = F2A(fp);
1868 	tad->tad_evmod = (short)fad->fad_flags;
1869 	if (fad->fad_aupath != NULL) {
1870 		au_uwrite(au_to_path(fad->fad_aupath));
1871 		if ((vp = fp->f_vnode) != NULL) {
1872 			attr.va_mask = AT_ALL;
1873 			if (VOP_GETATTR(vp, &attr, 0, CRED()) == 0) {
1874 				/*
1875 				 * When write was not used and the file can be
1876 				 * considered public, skip the audit.
1877 				 */
1878 				if (((fp->f_flag & FWRITE) == 0) &&
1879 				    file_is_public(&attr)) {
1880 					tad->tad_flag = 0;
1881 					tad->tad_evmod = 0;
1882 					/* free any residual audit data */
1883 					au_close(kctx, &(u_ad), 0, 0, 0);
1884 					releasef(fd);
1885 					return;
1886 				}
1887 				au_uwrite(au_to_attr(&attr));
1888 				audit_sec_attributes(&(u_ad), vp);
1889 			}
1890 		}
1891 	}
1892 
1893 	/* decrement file descriptor reference count */
1894 	releasef(fd);
1895 }
1896 
1897 /*ARGSUSED*/
1898 static void
1899 aus_fstatfs(struct t_audit_data *tad)
1900 {
1901 	klwp_t *clwp = ttolwp(curthread);
1902 	uint32_t fd;
1903 	struct file  *fp;
1904 	struct vnode *vp;
1905 	struct f_audit_data *fad;
1906 
1907 	struct a {
1908 		long	fd;
1909 		long	buf;		/* struct statfs * */
1910 	} *uap = (struct a *)clwp->lwp_ap;
1911 
1912 	fd = (uint_t)uap->fd;
1913 
1914 		/*
1915 		 * convert file pointer to file descriptor
1916 		 *   Note: fd ref count incremented here.
1917 		 */
1918 	if ((fp = getf(fd)) == NULL)
1919 		return;
1920 
1921 		/* get path from file struct here */
1922 	fad = F2A(fp);
1923 	if (fad->fad_aupath != NULL) {
1924 		au_uwrite(au_to_path(fad->fad_aupath));
1925 	} else {
1926 		au_uwrite(au_to_arg32(1, "no path: fd", fd));
1927 	}
1928 
1929 	vp = fp->f_vnode;
1930 	audit_attributes(vp);
1931 
1932 	/* decrement file descriptor reference count */
1933 	releasef(fd);
1934 }
1935 
1936 #ifdef NOTYET
1937 /*ARGSUSED*/
1938 static void
1939 aus_setpgrp(struct t_audit_data *tad)
1940 {
1941 	klwp_t *clwp = ttolwp(curthread);
1942 	uint32_t pgrp;
1943 	struct proc *p;
1944 	uid_t uid, ruid;
1945 	gid_t gid, rgid;
1946 	pid_t pid;
1947 	const auditinfo_addr_t *ainfo;
1948 	cred_t *cr;
1949 
1950 	struct a {
1951 		long	pid;
1952 		long	pgrp;
1953 	} *uap = (struct a *)clwp->lwp_ap;
1954 
1955 	pid  = (pid_t)uap->pid;
1956 	pgrp = (uint32_t)uap->pgrp;
1957 
1958 		/* current process? */
1959 	if (pid == 0)
1960 		(return);
1961 
1962 	mutex_enter(&pidlock);
1963 	p = prfind(pid);
1964 	if (p == NULL || p->p_as == &kas) {
1965 		mutex_exit(&pidlock);
1966 		return;
1967 	}
1968 	mutex_enter(&p->p_lock);	/* so process doesn't go away */
1969 	mutex_exit(&pidlock);
1970 
1971 	mutex_enter(&p->p_crlock);
1972 	crhold(cr = p->p_cred);
1973 	mutex_exit(&p->p_crlock);
1974 	mutex_exit(&p->p_lock);
1975 
1976 	ainfo = crgetauinfo(cr);
1977 	if (ainfo == NULL) {
1978 		crfree(cr);
1979 		return;
1980 	}
1981 
1982 	uid  = crgetuid(cr);
1983 	gid  = crgetgid(cr);
1984 	ruid = crgetruid(cr);
1985 	rgid = crgetrgid(cr);
1986 	au_uwrite(au_to_process(uid, gid, ruid, rgid, pid,
1987 	    ainfo->ai_auid, ainfo->ai_asid, &ainfo->ai_termid));
1988 	crfree(cr);
1989 	au_uwrite(au_to_arg32(2, "pgrp", pgrp));
1990 }
1991 #endif
1992 
1993 /*ARGSUSED*/
1994 static void
1995 aus_setregid(struct t_audit_data *tad)
1996 {
1997 	klwp_t *clwp = ttolwp(curthread);
1998 	uint32_t rgid, egid;
1999 
2000 	struct a {
2001 		long	 rgid;
2002 		long	 egid;
2003 	} *uap = (struct a *)clwp->lwp_ap;
2004 
2005 	rgid  = (uint32_t)uap->rgid;
2006 	egid  = (uint32_t)uap->egid;
2007 
2008 	au_uwrite(au_to_arg32(1, "rgid", rgid));
2009 	au_uwrite(au_to_arg32(2, "egid", egid));
2010 }
2011 
2012 /*ARGSUSED*/
2013 static void
2014 aus_setgid(struct t_audit_data *tad)
2015 {
2016 	klwp_t *clwp = ttolwp(curthread);
2017 	uint32_t gid;
2018 
2019 	struct a {
2020 		long	gid;
2021 	} *uap = (struct a *)clwp->lwp_ap;
2022 
2023 	gid = (uint32_t)uap->gid;
2024 
2025 	au_uwrite(au_to_arg32(1, "gid", gid));
2026 }
2027 
2028 
2029 /*ARGSUSED*/
2030 static void
2031 aus_setreuid(struct t_audit_data *tad)
2032 {
2033 	klwp_t *clwp = ttolwp(curthread);
2034 	uint32_t ruid, euid;
2035 
2036 	struct a {
2037 		long	ruid;
2038 		long	euid;
2039 	} *uap = (struct a *)clwp->lwp_ap;
2040 
2041 	ruid = (uint32_t)uap->ruid;
2042 	euid  = (uint32_t)uap->euid;
2043 
2044 	au_uwrite(au_to_arg32(1, "ruid", ruid));
2045 	au_uwrite(au_to_arg32(2, "euid", euid));
2046 }
2047 
2048 
2049 /*ARGSUSED*/
2050 static void
2051 aus_setuid(struct t_audit_data *tad)
2052 {
2053 	klwp_t *clwp = ttolwp(curthread);
2054 	uint32_t uid;
2055 
2056 	struct a {
2057 		long	uid;
2058 	} *uap = (struct a *)clwp->lwp_ap;
2059 
2060 	uid = (uint32_t)uap->uid;
2061 
2062 	au_uwrite(au_to_arg32(1, "uid", uid));
2063 }
2064 
2065 /*ARGSUSED*/
2066 static void
2067 aus_shmsys(struct t_audit_data *tad)
2068 {
2069 	klwp_t *clwp = ttolwp(curthread);
2070 	uint32_t id, cmd;
2071 
2072 	struct b {
2073 		long	id;
2074 		long	cmd;
2075 		long	buf;		/* struct shmid_ds * */
2076 	} *uap1 = (struct b *)&clwp->lwp_ap[1];
2077 
2078 	id  = (uint32_t)uap1->id;
2079 	cmd = (uint32_t)uap1->cmd;
2080 
2081 	switch (tad->tad_event) {
2082 	case AUE_SHMGET:			/* shmget */
2083 		au_uwrite(au_to_arg32(1, "shm key", id));
2084 		break;
2085 	case AUE_SHMCTL:			/* shmctl */
2086 	case AUE_SHMCTL_RMID:			/* shmctl */
2087 	case AUE_SHMCTL_STAT:			/* shmctl */
2088 	case AUE_SHMCTL_SET:			/* shmctl */
2089 		au_uwrite(au_to_arg32(1, "shm ID", id));
2090 		break;
2091 	case AUE_SHMDT:				/* shmdt */
2092 		au_uwrite(au_to_arg32(1, "shm adr", id));
2093 		break;
2094 	case AUE_SHMAT:				/* shmat */
2095 		au_uwrite(au_to_arg32(1, "shm ID", id));
2096 		au_uwrite(au_to_arg32(2, "shm adr", cmd));
2097 		break;
2098 	}
2099 }
2100 
2101 /*ARGSUSED*/
2102 static void
2103 auf_shmsys(struct t_audit_data *tad, int error, rval_t *rval)
2104 {
2105 	int id;
2106 
2107 	if (error != 0)
2108 		return;
2109 	if (tad->tad_event == AUE_SHMGET) {
2110 		uint32_t scid;
2111 		uint32_t sy_flags;
2112 
2113 		/* need to determine type of executing binary */
2114 		scid = tad->tad_scid;
2115 #ifdef _SYSCALL32_IMPL
2116 		if (lwp_getdatamodel(ttolwp(curthread)) == DATAMODEL_NATIVE)
2117 			sy_flags = sysent[scid].sy_flags & SE_RVAL_MASK;
2118 		else
2119 			sy_flags = sysent32[scid].sy_flags & SE_RVAL_MASK;
2120 #else
2121 		sy_flags = sysent[scid].sy_flags & SE_RVAL_MASK;
2122 #endif
2123 		if (sy_flags == SE_32RVAL1)
2124 			id = rval->r_val1;
2125 		if (sy_flags == (SE_32RVAL2|SE_32RVAL1))
2126 			id = rval->r_val1;
2127 		if (sy_flags == SE_64RVAL)
2128 			id = (int)rval->r_vals;
2129 		au_uwrite(au_to_ipc(AT_IPC_SHM, id));
2130 	}
2131 }
2132 
2133 
2134 /*ARGSUSED*/
2135 static void
2136 aus_ioctl(struct t_audit_data *tad)
2137 {
2138 	klwp_t *clwp = ttolwp(curthread);
2139 	struct file *fp;
2140 	struct vnode *vp;
2141 	struct f_audit_data *fad;
2142 	uint32_t fd, cmd;
2143 	uintptr_t cmarg;
2144 
2145 	/* XX64 */
2146 	struct a {
2147 		long	fd;
2148 		long	cmd;
2149 		long	cmarg;		/* caddr_t */
2150 	} *uap = (struct a *)clwp->lwp_ap;
2151 
2152 	fd    = (uint32_t)uap->fd;
2153 	cmd   = (uint32_t)uap->cmd;
2154 	cmarg = (uintptr_t)uap->cmarg;
2155 
2156 		/*
2157 		 * convert file pointer to file descriptor
2158 		 *   Note: fd ref count incremented here.
2159 		 */
2160 	if ((fp = getf(fd)) == NULL) {
2161 		au_uwrite(au_to_arg32(1, "fd", fd));
2162 		au_uwrite(au_to_arg32(2, "cmd", cmd));
2163 #ifndef _LP64
2164 			au_uwrite(au_to_arg32(3, "arg", (uint32_t)cmarg));
2165 #else
2166 			au_uwrite(au_to_arg64(3, "arg", (uint64_t)cmarg));
2167 #endif
2168 		return;
2169 	}
2170 
2171 	/* get path from file struct here */
2172 	fad = F2A(fp);
2173 	if (fad->fad_aupath != NULL) {
2174 		au_uwrite(au_to_path(fad->fad_aupath));
2175 	} else {
2176 		au_uwrite(au_to_arg32(1, "no path: fd", fd));
2177 	}
2178 
2179 	vp = fp->f_vnode;
2180 	audit_attributes(vp);
2181 
2182 	/* decrement file descriptor reference count */
2183 	releasef(fd);
2184 
2185 	au_uwrite(au_to_arg32(2, "cmd", cmd));
2186 #ifndef _LP64
2187 		au_uwrite(au_to_arg32(3, "arg", (uint32_t)cmarg));
2188 #else
2189 		au_uwrite(au_to_arg64(3, "arg", (uint64_t)cmarg));
2190 #endif
2191 }
2192 
2193 /*
2194  * null function for memcntl for now. We might want to limit memcntl()
2195  * auditing to commands: MC_LOCKAS, MC_LOCK, MC_UNLOCKAS, MC_UNLOCK which
2196  * require privileges.
2197  */
2198 static au_event_t
2199 aui_memcntl(au_event_t e)
2200 {
2201 	return (e);
2202 }
2203 
2204 /*ARGSUSED*/
2205 static au_event_t
2206 aui_privsys(au_event_t e)
2207 {
2208 	klwp_t *clwp = ttolwp(curthread);
2209 
2210 	struct a {
2211 		long	opcode;
2212 	} *uap = (struct a *)clwp->lwp_ap;
2213 
2214 	switch (uap->opcode) {
2215 	case PRIVSYS_SETPPRIV:
2216 		return (AUE_SETPPRIV);
2217 	default:
2218 		return (AUE_NULL);
2219 	}
2220 }
2221 
2222 /*ARGSUSED*/
2223 static void
2224 aus_memcntl(struct t_audit_data *tad)
2225 {
2226 	klwp_t *clwp = ttolwp(curthread);
2227 
2228 	struct a {
2229 		long	addr;
2230 		long	len;
2231 		long	cmd;
2232 		long	arg;
2233 		long	attr;
2234 		long	mask;
2235 	} *uap = (struct a *)clwp->lwp_ap;
2236 
2237 #ifdef _LP64
2238 	au_uwrite(au_to_arg64(1, "base", (uint64_t)uap->addr));
2239 	au_uwrite(au_to_arg64(2, "len", (uint64_t)uap->len));
2240 #else
2241 	au_uwrite(au_to_arg32(1, "base", (uint32_t)uap->addr));
2242 	au_uwrite(au_to_arg32(2, "len", (uint32_t)uap->len));
2243 #endif
2244 	au_uwrite(au_to_arg32(3, "cmd", (uint_t)uap->cmd));
2245 #ifdef _LP64
2246 	au_uwrite(au_to_arg64(4, "arg", (uint64_t)uap->arg));
2247 #else
2248 	au_uwrite(au_to_arg32(4, "arg", (uint32_t)uap->arg));
2249 #endif
2250 	au_uwrite(au_to_arg32(5, "attr", (uint_t)uap->attr));
2251 	au_uwrite(au_to_arg32(6, "mask", (uint_t)uap->mask));
2252 }
2253 
2254 /*ARGSUSED*/
2255 static void
2256 aus_mmap(struct t_audit_data *tad)
2257 {
2258 	klwp_t *clwp = ttolwp(curthread);
2259 	struct file *fp;
2260 	struct f_audit_data *fad;
2261 	struct vnode *vp;
2262 	uint32_t fd;
2263 
2264 	struct a {
2265 		long	addr;
2266 		long	len;
2267 		long	prot;
2268 		long	flags;
2269 		long	fd;
2270 		long	pos;
2271 	} *uap = (struct a *)clwp->lwp_ap;
2272 
2273 	fd = (uint32_t)uap->fd;
2274 
2275 #ifdef _LP64
2276 	au_uwrite(au_to_arg64(1, "addr", (uint64_t)uap->addr));
2277 	au_uwrite(au_to_arg64(2, "len", (uint64_t)uap->len));
2278 #else
2279 	au_uwrite(au_to_arg32(1, "addr", (uint32_t)uap->addr));
2280 	au_uwrite(au_to_arg32(2, "len", (uint32_t)uap->len));
2281 #endif
2282 
2283 	if ((fp = getf(fd)) == NULL) {
2284 		au_uwrite(au_to_arg32(5, "fd", (uint32_t)uap->fd));
2285 		return;
2286 	}
2287 
2288 	/*
2289 	 * Mark in the tad if write access is NOT requested... if
2290 	 * this is later detected (in audit_attributes) to be a
2291 	 * public object, the mmap event may be discarded.
2292 	 */
2293 	if (((uap->prot) & PROT_WRITE) == 0) {
2294 		tad->tad_ctrl |= PAD_PUBLIC_EV;
2295 	}
2296 
2297 	fad = F2A(fp);
2298 	if (fad->fad_aupath != NULL) {
2299 		au_uwrite(au_to_path(fad->fad_aupath));
2300 	} else {
2301 		au_uwrite(au_to_arg32(1, "no path: fd", fd));
2302 	}
2303 
2304 	vp = (struct vnode *)fp->f_vnode;
2305 	audit_attributes(vp);
2306 
2307 	/* mark READ/WRITE since we can't predict access */
2308 	if (uap->prot & PROT_READ)
2309 		fad->fad_flags |= FAD_READ;
2310 	if (uap->prot & PROT_WRITE)
2311 		fad->fad_flags |= FAD_WRITE;
2312 
2313 	/* decrement file descriptor reference count */
2314 	releasef(fd);
2315 
2316 }	/* AUS_MMAP */
2317 
2318 
2319 
2320 
2321 /*ARGSUSED*/
2322 static void
2323 aus_munmap(struct t_audit_data *tad)
2324 {
2325 	klwp_t *clwp = ttolwp(curthread);
2326 
2327 	struct a {
2328 		long	addr;
2329 		long	len;
2330 	} *uap = (struct a *)clwp->lwp_ap;
2331 
2332 #ifdef _LP64
2333 	au_uwrite(au_to_arg64(1, "addr", (uint64_t)uap->addr));
2334 	au_uwrite(au_to_arg64(2, "len", (uint64_t)uap->len));
2335 #else
2336 	au_uwrite(au_to_arg32(1, "addr", (uint32_t)uap->addr));
2337 	au_uwrite(au_to_arg32(2, "len", (uint32_t)uap->len));
2338 #endif
2339 
2340 }	/* AUS_MUNMAP */
2341 
2342 
2343 
2344 
2345 
2346 
2347 
2348 /*ARGSUSED*/
2349 static void
2350 aus_priocntlsys(struct t_audit_data *tad)
2351 {
2352 	klwp_t *clwp = ttolwp(curthread);
2353 
2354 	struct a {
2355 		long	pc_version;
2356 		long	psp;		/* procset_t */
2357 		long	cmd;
2358 		long	arg;
2359 	} *uap = (struct a *)clwp->lwp_ap;
2360 
2361 	au_uwrite(au_to_arg32(1, "pc_version", (uint32_t)uap->pc_version));
2362 	au_uwrite(au_to_arg32(3, "cmd", (uint32_t)uap->cmd));
2363 
2364 }	/* AUS_PRIOCNTLSYS */
2365 
2366 
2367 /*ARGSUSED*/
2368 static void
2369 aus_setegid(struct t_audit_data *tad)
2370 {
2371 	klwp_t *clwp = ttolwp(curthread);
2372 	uint32_t gid;
2373 
2374 	struct a {
2375 		long	gid;
2376 	} *uap = (struct a *)clwp->lwp_ap;
2377 
2378 	gid = (uint32_t)uap->gid;
2379 
2380 	au_uwrite(au_to_arg32(1, "gid", gid));
2381 }	/* AUS_SETEGID */
2382 
2383 
2384 
2385 
2386 /*ARGSUSED*/
2387 static void
2388 aus_setgroups(struct t_audit_data *tad)
2389 {
2390 	klwp_t *clwp = ttolwp(curthread);
2391 	int i;
2392 	int gidsetsize;
2393 	uintptr_t gidset;
2394 	gid_t *gidlist;
2395 
2396 	struct a {
2397 		long	gidsetsize;
2398 		long	gidset;
2399 	} *uap = (struct a *)clwp->lwp_ap;
2400 
2401 	gidsetsize = (uint_t)uap->gidsetsize;
2402 	gidset = (uintptr_t)uap->gidset;
2403 
2404 	if ((gidsetsize > NGROUPS_MAX_DEFAULT) || (gidsetsize < 0))
2405 		return;
2406 	if (gidsetsize != 0) {
2407 		gidlist = kmem_alloc(gidsetsize * sizeof (gid_t),
2408 						KM_SLEEP);
2409 		if (copyin((caddr_t)gidset, gidlist,
2410 			gidsetsize * sizeof (gid_t)) == 0)
2411 			for (i = 0; i < gidsetsize; i++)
2412 				au_uwrite(au_to_arg32(1, "setgroups",
2413 						(uint32_t)gidlist[i]));
2414 		kmem_free(gidlist, gidsetsize * sizeof (gid_t));
2415 	} else
2416 		au_uwrite(au_to_arg32(1, "setgroups", (uint32_t)0));
2417 
2418 }	/* AUS_SETGROUPS */
2419 
2420 
2421 
2422 
2423 
2424 /*ARGSUSED*/
2425 static void
2426 aus_seteuid(struct t_audit_data *tad)
2427 {
2428 	klwp_t *clwp = ttolwp(curthread);
2429 	uint32_t uid;
2430 
2431 	struct a {
2432 		long	uid;
2433 	} *uap = (struct a *)clwp->lwp_ap;
2434 
2435 	uid = (uint32_t)uap->uid;
2436 
2437 	au_uwrite(au_to_arg32(1, "euid", uid));
2438 
2439 }	/* AUS_SETEUID */
2440 
2441 /*ARGSUSED*/
2442 static void
2443 aus_putmsg(struct t_audit_data *tad)
2444 {
2445 	klwp_t *clwp = ttolwp(curthread);
2446 	uint32_t fd, pri;
2447 	struct file *fp;
2448 	struct f_audit_data *fad;
2449 
2450 	struct a {
2451 		long	fdes;
2452 		long	ctl;		/* struct strbuf * */
2453 		long	data;		/* struct strbuf * */
2454 		long	pri;
2455 	} *uap = (struct a *)clwp->lwp_ap;
2456 
2457 	fd  = (uint32_t)uap->fdes;
2458 	pri = (uint32_t)uap->pri;
2459 
2460 	au_uwrite(au_to_arg32(1, "fd", fd));
2461 
2462 	if ((fp = getf(fd)) != NULL) {
2463 		fad = F2A(fp);
2464 
2465 		fad->fad_flags |= FAD_WRITE;
2466 
2467 		/* add path name to audit record */
2468 		if (fad->fad_aupath != NULL) {
2469 			au_uwrite(au_to_path(fad->fad_aupath));
2470 		}
2471 		audit_attributes(fp->f_vnode);
2472 
2473 		releasef(fd);
2474 	}
2475 
2476 	au_uwrite(au_to_arg32(4, "pri", pri));
2477 }
2478 
2479 /*ARGSUSED*/
2480 static void
2481 aus_putpmsg(struct t_audit_data *tad)
2482 {
2483 	klwp_t *clwp = ttolwp(curthread);
2484 	uint32_t fd, pri, flags;
2485 	struct file *fp;
2486 	struct f_audit_data *fad;
2487 
2488 	struct a {
2489 		long	fdes;
2490 		long	ctl;		/* struct strbuf * */
2491 		long	data;		/* struct strbuf * */
2492 		long	pri;
2493 		long	flags;
2494 	} *uap = (struct a *)clwp->lwp_ap;
2495 
2496 	fd = (uint32_t)uap->fdes;
2497 	pri  = (uint32_t)uap->pri;
2498 	flags  = (uint32_t)uap->flags;
2499 
2500 	au_uwrite(au_to_arg32(1, "fd", fd));
2501 
2502 	if ((fp = getf(fd)) != NULL) {
2503 		fad = F2A(fp);
2504 
2505 		fad->fad_flags |= FAD_WRITE;
2506 
2507 		/* add path name to audit record */
2508 		if (fad->fad_aupath != NULL) {
2509 			au_uwrite(au_to_path(fad->fad_aupath));
2510 		}
2511 		audit_attributes(fp->f_vnode);
2512 
2513 		releasef(fd);
2514 	}
2515 
2516 
2517 	au_uwrite(au_to_arg32(4, "pri", pri));
2518 	au_uwrite(au_to_arg32(5, "flags", flags));
2519 }
2520 
2521 /*ARGSUSED*/
2522 static void
2523 aus_getmsg(struct t_audit_data *tad)
2524 {
2525 	klwp_t *clwp = ttolwp(curthread);
2526 	uint32_t fd, pri;
2527 	struct file *fp;
2528 	struct f_audit_data *fad;
2529 
2530 	struct a {
2531 		long	fdes;
2532 		long	ctl;		/* struct strbuf * */
2533 		long	data;		/* struct strbuf * */
2534 		long	pri;
2535 	} *uap = (struct a *)clwp->lwp_ap;
2536 
2537 	fd  = (uint32_t)uap->fdes;
2538 	pri = (uint32_t)uap->pri;
2539 
2540 	au_uwrite(au_to_arg32(1, "fd", fd));
2541 
2542 	if ((fp = getf(fd)) != NULL) {
2543 		fad = F2A(fp);
2544 
2545 		/*
2546 		 * read operation on this object
2547 		 */
2548 		fad->fad_flags |= FAD_READ;
2549 
2550 		/* add path name to audit record */
2551 		if (fad->fad_aupath != NULL) {
2552 			au_uwrite(au_to_path(fad->fad_aupath));
2553 		}
2554 		audit_attributes(fp->f_vnode);
2555 
2556 		releasef(fd);
2557 	}
2558 
2559 	au_uwrite(au_to_arg32(4, "pri", pri));
2560 }
2561 
2562 /*ARGSUSED*/
2563 static void
2564 aus_getpmsg(struct t_audit_data *tad)
2565 {
2566 	klwp_t *clwp = ttolwp(curthread);
2567 	uint32_t fd;
2568 	struct file *fp;
2569 	struct f_audit_data *fad;
2570 
2571 	struct a {
2572 		long	fdes;
2573 		long	ctl;		/* struct strbuf * */
2574 		long	data;		/* struct strbuf * */
2575 		long	pri;
2576 		long	flags;
2577 	} *uap = (struct a *)clwp->lwp_ap;
2578 
2579 	fd = (uint32_t)uap->fdes;
2580 
2581 	au_uwrite(au_to_arg32(1, "fd", fd));
2582 
2583 	if ((fp = getf(fd)) != NULL) {
2584 		fad = F2A(fp);
2585 
2586 		/*
2587 		 * read operation on this object
2588 		 */
2589 		fad->fad_flags |= FAD_READ;
2590 
2591 		/* add path name to audit record */
2592 		if (fad->fad_aupath != NULL) {
2593 			au_uwrite(au_to_path(fad->fad_aupath));
2594 		}
2595 		audit_attributes(fp->f_vnode);
2596 
2597 		releasef(fd);
2598 	}
2599 }
2600 
2601 static au_event_t
2602 aui_auditsys(au_event_t e)
2603 {
2604 	klwp_t *clwp = ttolwp(curthread);
2605 	uint32_t code;
2606 
2607 	struct a {
2608 		long	code;
2609 		long	a1;
2610 		long	a2;
2611 		long	a3;
2612 		long	a4;
2613 		long	a5;
2614 		long	a6;
2615 		long	a7;
2616 	} *uap = (struct a *)clwp->lwp_ap;
2617 
2618 	code = (uint32_t)uap->code;
2619 
2620 	switch (code) {
2621 
2622 	case BSM_GETAUID:
2623 		e = AUE_GETAUID;
2624 		break;
2625 	case BSM_SETAUID:
2626 		e = AUE_SETAUID;
2627 		break;
2628 	case BSM_GETAUDIT:
2629 		e = AUE_GETAUDIT;
2630 		break;
2631 	case BSM_GETAUDIT_ADDR:
2632 		e = AUE_GETAUDIT_ADDR;
2633 		break;
2634 	case BSM_SETAUDIT:
2635 		e = AUE_SETAUDIT;
2636 		break;
2637 	case BSM_SETAUDIT_ADDR:
2638 		e = AUE_SETAUDIT_ADDR;
2639 		break;
2640 	case BSM_AUDIT:
2641 		e = AUE_AUDIT;
2642 		break;
2643 	case BSM_AUDITSVC:
2644 		e = AUE_AUDITSVC;
2645 		break;
2646 	case BSM_GETPORTAUDIT:
2647 		e = AUE_GETPORTAUDIT;
2648 		break;
2649 	case BSM_AUDITON:
2650 	case BSM_AUDITCTL:
2651 
2652 		switch ((uint_t)uap->a1) {
2653 
2654 		case A_GETPOLICY:
2655 			e = AUE_AUDITON_GPOLICY;
2656 			break;
2657 		case A_SETPOLICY:
2658 			e = AUE_AUDITON_SPOLICY;
2659 			break;
2660 		case A_GETKMASK:
2661 			e = AUE_AUDITON_GETKMASK;
2662 			break;
2663 		case A_SETKMASK:
2664 			e = AUE_AUDITON_SETKMASK;
2665 			break;
2666 		case A_GETQCTRL:
2667 			e = AUE_AUDITON_GQCTRL;
2668 			break;
2669 		case A_SETQCTRL:
2670 			e = AUE_AUDITON_SQCTRL;
2671 			break;
2672 		case A_GETCWD:
2673 			e = AUE_AUDITON_GETCWD;
2674 			break;
2675 		case A_GETCAR:
2676 			e = AUE_AUDITON_GETCAR;
2677 			break;
2678 		case A_GETSTAT:
2679 			e = AUE_AUDITON_GETSTAT;
2680 			break;
2681 		case A_SETSTAT:
2682 			e = AUE_AUDITON_SETSTAT;
2683 			break;
2684 		case A_SETUMASK:
2685 			e = AUE_AUDITON_SETUMASK;
2686 			break;
2687 		case A_SETSMASK:
2688 			e = AUE_AUDITON_SETSMASK;
2689 			break;
2690 		case A_GETCOND:
2691 			e = AUE_AUDITON_GETCOND;
2692 			break;
2693 		case A_SETCOND:
2694 			e = AUE_AUDITON_SETCOND;
2695 			break;
2696 		case A_GETCLASS:
2697 			e = AUE_AUDITON_GETCLASS;
2698 			break;
2699 		case A_SETCLASS:
2700 			e = AUE_AUDITON_SETCLASS;
2701 			break;
2702 		default:
2703 			e = AUE_NULL;
2704 			break;
2705 		}
2706 		break;
2707 	default:
2708 		e = AUE_NULL;
2709 		break;
2710 	}
2711 
2712 	return (e);
2713 
2714 
2715 
2716 
2717 }	/* AUI_AUDITSYS */
2718 
2719 
2720 
2721 
2722 
2723 
2724 
2725 static void
2726 aus_auditsys(struct t_audit_data *tad)
2727 {
2728 	klwp_t *clwp = ttolwp(curthread);
2729 	uintptr_t a1, a2;
2730 	struct file *fp;
2731 	struct f_audit_data *fad;
2732 	struct vnode *vp;
2733 	STRUCT_DECL(auditinfo, ainfo);
2734 	STRUCT_DECL(auditinfo_addr, ainfo_addr);
2735 	au_evclass_map_t event;
2736 	au_mask_t mask;
2737 	int auditstate, policy;
2738 
2739 
2740 	struct a {
2741 		long	code;
2742 		long	a1;
2743 		long	a2;
2744 		long	a3;
2745 		long	a4;
2746 		long	a5;
2747 		long	a6;
2748 		long	a7;
2749 	} *uap = (struct a *)clwp->lwp_ap;
2750 
2751 	a1   = (uintptr_t)uap->a1;
2752 	a2   = (uintptr_t)uap->a2;
2753 
2754 	switch (tad->tad_event) {
2755 	case AUE_SETAUID:
2756 		au_uwrite(au_to_arg32(2, "setauid", (uint32_t)a1));
2757 		break;
2758 	case AUE_SETAUDIT:
2759 		STRUCT_INIT(ainfo, get_udatamodel());
2760 		if (copyin((caddr_t)a1, STRUCT_BUF(ainfo),
2761 				STRUCT_SIZE(ainfo))) {
2762 				return;
2763 		}
2764 		au_uwrite(au_to_arg32((char)1, "setaudit:auid",
2765 			(uint32_t)STRUCT_FGET(ainfo, ai_auid)));
2766 #ifdef _LP64
2767 		au_uwrite(au_to_arg64((char)1, "setaudit:port",
2768 			(uint64_t)STRUCT_FGET(ainfo, ai_termid.port)));
2769 #else
2770 		au_uwrite(au_to_arg32((char)1, "setaudit:port",
2771 			(uint32_t)STRUCT_FGET(ainfo, ai_termid.port)));
2772 #endif
2773 		au_uwrite(au_to_arg32((char)1, "setaudit:machine",
2774 			(uint32_t)STRUCT_FGET(ainfo, ai_termid.machine)));
2775 		au_uwrite(au_to_arg32((char)1, "setaudit:as_success",
2776 			(uint32_t)STRUCT_FGET(ainfo, ai_mask.as_success)));
2777 		au_uwrite(au_to_arg32((char)1, "setaudit:as_failure",
2778 			(uint32_t)STRUCT_FGET(ainfo, ai_mask.as_failure)));
2779 		au_uwrite(au_to_arg32((char)1, "setaudit:asid",
2780 			(uint32_t)STRUCT_FGET(ainfo, ai_asid)));
2781 		break;
2782 	case AUE_SETAUDIT_ADDR:
2783 		STRUCT_INIT(ainfo_addr, get_udatamodel());
2784 		if (copyin((caddr_t)a1, STRUCT_BUF(ainfo_addr),
2785 				STRUCT_SIZE(ainfo_addr))) {
2786 				return;
2787 		}
2788 		au_uwrite(au_to_arg32((char)1, "auid",
2789 			(uint32_t)STRUCT_FGET(ainfo_addr, ai_auid)));
2790 #ifdef _LP64
2791 		au_uwrite(au_to_arg64((char)1, "port",
2792 			(uint64_t)STRUCT_FGET(ainfo_addr, ai_termid.at_port)));
2793 #else
2794 		au_uwrite(au_to_arg32((char)1, "port",
2795 			(uint32_t)STRUCT_FGET(ainfo_addr, ai_termid.at_port)));
2796 #endif
2797 		au_uwrite(au_to_arg32((char)1, "type",
2798 			(uint32_t)STRUCT_FGET(ainfo_addr, ai_termid.at_type)));
2799 		if ((uint32_t)STRUCT_FGET(ainfo_addr, ai_termid.at_type) ==
2800 		    AU_IPv4) {
2801 			au_uwrite(au_to_in_addr(
2802 				(struct in_addr *)STRUCT_FGETP(ainfo_addr,
2803 					ai_termid.at_addr)));
2804 		} else {
2805 			au_uwrite(au_to_in_addr_ex(
2806 				(int32_t *)STRUCT_FGETP(ainfo_addr,
2807 					ai_termid.at_addr)));
2808 		}
2809 		au_uwrite(au_to_arg32((char)1, "as_success",
2810 			(uint32_t)STRUCT_FGET(ainfo_addr, ai_mask.as_success)));
2811 		au_uwrite(au_to_arg32((char)1, "as_failure",
2812 			(uint32_t)STRUCT_FGET(ainfo_addr, ai_mask.as_failure)));
2813 		au_uwrite(au_to_arg32((char)1, "asid",
2814 			(uint32_t)STRUCT_FGET(ainfo_addr, ai_asid)));
2815 		break;
2816 	case AUE_AUDITSVC:
2817 		/*
2818 		 * convert file pointer to file descriptor
2819 		 * Note: fd ref count incremented here
2820 		 */
2821 		if ((fp = getf((uint_t)a1)) == NULL)
2822 			return;
2823 		fad = F2A(fp);
2824 		if (fad->fad_aupath != NULL) {
2825 			au_uwrite(au_to_path(fad->fad_aupath));
2826 		} else {
2827 			au_uwrite(au_to_arg32(2, "no path: fd", (uint32_t)a1));
2828 		}
2829 
2830 		vp = fp->f_vnode;	/* include vnode attributes */
2831 		audit_attributes(vp);
2832 
2833 		/* decrement file descriptor ref count */
2834 		releasef((uint_t)a1);
2835 
2836 		au_uwrite(au_to_arg32(3, "limit", (uint32_t)a2));
2837 		break;
2838 	case AUE_AUDITON_SETKMASK:
2839 		if (copyin((caddr_t)a2, &mask, sizeof (au_mask_t)))
2840 				return;
2841 		au_uwrite(au_to_arg32(
2842 			2, "setkmask:as_success", (uint32_t)mask.as_success));
2843 		au_uwrite(au_to_arg32(
2844 			2, "setkmask:as_failure", (uint32_t)mask.as_failure));
2845 		break;
2846 	case AUE_AUDITON_SPOLICY:
2847 		if (copyin((caddr_t)a2, &policy, sizeof (int)))
2848 			return;
2849 		au_uwrite(au_to_arg32(3, "setpolicy", (uint32_t)policy));
2850 		break;
2851 	case AUE_AUDITON_SQCTRL: {
2852 		STRUCT_DECL(au_qctrl, qctrl);
2853 		model_t model;
2854 
2855 		model = get_udatamodel();
2856 		STRUCT_INIT(qctrl, model);
2857 		if (copyin((caddr_t)a2, STRUCT_BUF(qctrl), STRUCT_SIZE(qctrl)))
2858 				return;
2859 		if (model == DATAMODEL_ILP32) {
2860 			au_uwrite(au_to_arg32(
2861 				3, "setqctrl:aq_hiwater",
2862 				(uint32_t)STRUCT_FGET(qctrl, aq_hiwater)));
2863 			au_uwrite(au_to_arg32(
2864 				3, "setqctrl:aq_lowater",
2865 				(uint32_t)STRUCT_FGET(qctrl, aq_lowater)));
2866 			au_uwrite(au_to_arg32(
2867 				3, "setqctrl:aq_bufsz",
2868 				(uint32_t)STRUCT_FGET(qctrl, aq_bufsz)));
2869 			au_uwrite(au_to_arg32(
2870 				3, "setqctrl:aq_delay",
2871 				(uint32_t)STRUCT_FGET(qctrl, aq_delay)));
2872 		} else {
2873 			au_uwrite(au_to_arg64(
2874 				3, "setqctrl:aq_hiwater",
2875 				(uint64_t)STRUCT_FGET(qctrl, aq_hiwater)));
2876 			au_uwrite(au_to_arg64(
2877 				3, "setqctrl:aq_lowater",
2878 				(uint64_t)STRUCT_FGET(qctrl, aq_lowater)));
2879 			au_uwrite(au_to_arg64(
2880 				3, "setqctrl:aq_bufsz",
2881 				(uint64_t)STRUCT_FGET(qctrl, aq_bufsz)));
2882 			au_uwrite(au_to_arg64(
2883 				3, "setqctrl:aq_delay",
2884 				(uint64_t)STRUCT_FGET(qctrl, aq_delay)));
2885 		}
2886 		break;
2887 	}
2888 	case AUE_AUDITON_SETUMASK:
2889 		STRUCT_INIT(ainfo, get_udatamodel());
2890 		if (copyin((caddr_t)uap->a2, STRUCT_BUF(ainfo),
2891 				STRUCT_SIZE(ainfo))) {
2892 				return;
2893 		}
2894 		au_uwrite(au_to_arg32(3, "setumask:as_success",
2895 			(uint32_t)STRUCT_FGET(ainfo, ai_mask.as_success)));
2896 		au_uwrite(au_to_arg32(3, "setumask:as_failure",
2897 			(uint32_t)STRUCT_FGET(ainfo, ai_mask.as_failure)));
2898 		break;
2899 	case AUE_AUDITON_SETSMASK:
2900 		STRUCT_INIT(ainfo, get_udatamodel());
2901 		if (copyin((caddr_t)uap->a2, STRUCT_BUF(ainfo),
2902 				STRUCT_SIZE(ainfo))) {
2903 				return;
2904 		}
2905 		au_uwrite(au_to_arg32(3, "setsmask:as_success",
2906 			(uint32_t)STRUCT_FGET(ainfo, ai_mask.as_success)));
2907 		au_uwrite(au_to_arg32(3, "setsmask:as_failure",
2908 			(uint32_t)STRUCT_FGET(ainfo, ai_mask.as_failure)));
2909 		break;
2910 	case AUE_AUDITON_SETCOND:
2911 		if (copyin((caddr_t)a2, &auditstate, sizeof (int)))
2912 			return;
2913 		au_uwrite(au_to_arg32(3, "setcond", (uint32_t)auditstate));
2914 		break;
2915 	case AUE_AUDITON_SETCLASS:
2916 		if (copyin((caddr_t)a2, &event, sizeof (au_evclass_map_t)))
2917 			return;
2918 		au_uwrite(au_to_arg32(
2919 			2, "setclass:ec_event", (uint32_t)event.ec_number));
2920 		au_uwrite(au_to_arg32(
2921 			3, "setclass:ec_class", (uint32_t)event.ec_class));
2922 		break;
2923 	case AUE_GETAUID:
2924 	case AUE_GETAUDIT:
2925 	case AUE_GETAUDIT_ADDR:
2926 	case AUE_AUDIT:
2927 	case AUE_GETPORTAUDIT:
2928 	case AUE_AUDITON_GPOLICY:
2929 	case AUE_AUDITON_GQCTRL:
2930 	case AUE_AUDITON_GETKMASK:
2931 	case AUE_AUDITON_GETCWD:
2932 	case AUE_AUDITON_GETCAR:
2933 	case AUE_AUDITON_GETSTAT:
2934 	case AUE_AUDITON_SETSTAT:
2935 	case AUE_AUDITON_GETCOND:
2936 	case AUE_AUDITON_GETCLASS:
2937 		break;
2938 	default:
2939 		break;
2940 	}
2941 
2942 }	/* AUS_AUDITSYS */
2943 
2944 
2945 /* only audit privileged operations for systeminfo(2) system call */
2946 static au_event_t
2947 aui_sysinfo(au_event_t e)
2948 {
2949 	klwp_t *clwp = ttolwp(curthread);
2950 	uint32_t command;
2951 
2952 	struct a {
2953 		long	command;
2954 		long	buf;		/* char * */
2955 		long	count;
2956 	} *uap = (struct a *)clwp->lwp_ap;
2957 
2958 	command = (uint32_t)uap->command;
2959 
2960 	switch (command) {
2961 	case SI_SET_HOSTNAME:
2962 	case SI_SET_SRPC_DOMAIN:
2963 		e = (au_event_t)AUE_SYSINFO;
2964 		break;
2965 	default:
2966 		e = (au_event_t)AUE_NULL;
2967 		break;
2968 	}
2969 	return (e);
2970 }
2971 
2972 /*ARGSUSED*/
2973 static void
2974 aus_sysinfo(struct t_audit_data *tad)
2975 {
2976 	klwp_t *clwp = ttolwp(curthread);
2977 	uint32_t command;
2978 	size_t len, maxlen;
2979 	char *name;
2980 	uintptr_t buf;
2981 
2982 	struct a {
2983 		long	command;
2984 		long	buf;		/* char * */
2985 		long	count;
2986 	} *uap = (struct a *)clwp->lwp_ap;
2987 
2988 	command = (uint32_t)uap->command;
2989 	buf = (uintptr_t)uap->buf;
2990 
2991 	au_uwrite(au_to_arg32(1, "cmd", command));
2992 
2993 	switch (command) {
2994 	case SI_SET_HOSTNAME:
2995 	{
2996 		if (secpolicy_sys_config(CRED(), B_TRUE) != 0)
2997 			return;
2998 
2999 		maxlen = SYS_NMLN;
3000 		name = kmem_alloc(maxlen, KM_SLEEP);
3001 		if (copyinstr((caddr_t)buf, name, SYS_NMLN, &len))
3002 			break;
3003 
3004 		/*
3005 		 * Must be non-NULL string and string
3006 		 * must be less than SYS_NMLN chars.
3007 		 */
3008 		if (len < 2 || (len == SYS_NMLN && name[SYS_NMLN - 1] != '\0'))
3009 			break;
3010 
3011 		au_uwrite(au_to_text(name));
3012 		break;
3013 	}
3014 
3015 	case SI_SET_SRPC_DOMAIN:
3016 	{
3017 		if (secpolicy_sys_config(CRED(), B_TRUE) != 0)
3018 			return;
3019 
3020 		maxlen = SYS_NMLN;
3021 		name = kmem_alloc(maxlen, KM_SLEEP);
3022 		if (copyinstr((caddr_t)buf, name, SYS_NMLN, &len))
3023 			break;
3024 
3025 		/*
3026 		 * If string passed in is longer than length
3027 		 * allowed for domain name, fail.
3028 		 */
3029 		if (len == SYS_NMLN && name[SYS_NMLN - 1] != '\0')
3030 			break;
3031 
3032 		au_uwrite(au_to_text(name));
3033 		break;
3034 	}
3035 
3036 	default:
3037 		return;
3038 	}
3039 
3040 	kmem_free(name, maxlen);
3041 }
3042 
3043 static au_event_t
3044 aui_modctl(au_event_t e)
3045 {
3046 	klwp_t *clwp = ttolwp(curthread);
3047 	uint_t cmd;
3048 
3049 	struct a {
3050 		long	cmd;
3051 	} *uap = (struct a *)clwp->lwp_ap;
3052 
3053 	cmd = (uint_t)uap->cmd;
3054 
3055 	switch (cmd) {
3056 	case MODLOAD:
3057 		e = AUE_MODLOAD;
3058 		break;
3059 	case MODUNLOAD:
3060 		e = AUE_MODUNLOAD;
3061 		break;
3062 	case MODADDMAJBIND:
3063 		e = AUE_MODADDMAJ;
3064 		break;
3065 	case MODSETDEVPOLICY:
3066 		e = AUE_MODDEVPLCY;
3067 		break;
3068 	case MODALLOCPRIV:
3069 		e = AUE_MODADDPRIV;
3070 		break;
3071 	default:
3072 		e = AUE_NULL;
3073 		break;
3074 	}
3075 	return (e);
3076 }
3077 
3078 
3079 /*ARGSUSED*/
3080 static void
3081 aus_modctl(struct t_audit_data *tad)
3082 {
3083 	klwp_t *clwp = ttolwp(curthread);
3084 	void *a	= clwp->lwp_ap;
3085 	uint_t use_path;
3086 
3087 	switch (tad->tad_event) {
3088 	case AUE_MODLOAD: {
3089 		typedef struct {
3090 			long	cmd;
3091 			long	use_path;
3092 			long	filename;		/* char * */
3093 		} modloada_t;
3094 
3095 		char *filenamep;
3096 		uintptr_t fname;
3097 		extern char *default_path;
3098 
3099 		fname = (uintptr_t)((modloada_t *)a)->filename;
3100 		use_path = (uint_t)((modloada_t *)a)->use_path;
3101 
3102 			/* space to hold path */
3103 		filenamep = kmem_alloc(MOD_MAXPATH, KM_SLEEP);
3104 			/* get string */
3105 		if (copyinstr((caddr_t)fname, filenamep, MOD_MAXPATH, 0)) {
3106 				/* free allocated path */
3107 			kmem_free(filenamep, MOD_MAXPATH);
3108 			return;
3109 		}
3110 			/* ensure it's null terminated */
3111 		filenamep[MOD_MAXPATH - 1] = 0;
3112 
3113 		if (use_path)
3114 			au_uwrite(au_to_text(default_path));
3115 		au_uwrite(au_to_text(filenamep));
3116 
3117 			/* release temporary memory */
3118 		kmem_free(filenamep, MOD_MAXPATH);
3119 		break;
3120 	}
3121 	case AUE_MODUNLOAD: {
3122 		typedef struct {
3123 			long	cmd;
3124 			long	id;
3125 		} modunloada_t;
3126 
3127 		uint32_t id = (uint32_t)((modunloada_t *)a)->id;
3128 
3129 		au_uwrite(au_to_arg32(1, "id", id));
3130 		break;
3131 	}
3132 	case AUE_MODADDMAJ: {
3133 		STRUCT_DECL(modconfig, mc);
3134 		typedef struct {
3135 			long	cmd;
3136 			long	subcmd;
3137 			long	data;		/* int * */
3138 		} modconfiga_t;
3139 
3140 		STRUCT_DECL(aliases, alias);
3141 		caddr_t ap;
3142 		int i, num_aliases;
3143 		char *drvname, *mc_drvname;
3144 		char *name;
3145 		extern char *ddi_major_to_name(major_t);
3146 		model_t model;
3147 
3148 		uintptr_t data = (uintptr_t)((modconfiga_t *)a)->data;
3149 
3150 		model = get_udatamodel();
3151 		STRUCT_INIT(mc, model);
3152 			/* sanitize buffer */
3153 		bzero((caddr_t)STRUCT_BUF(mc), STRUCT_SIZE(mc));
3154 			/* get user arguments */
3155 		if (copyin((caddr_t)data, (caddr_t)STRUCT_BUF(mc),
3156 				STRUCT_SIZE(mc)) != 0)
3157 			return;
3158 
3159 		mc_drvname = STRUCT_FGET(mc, drvname);
3160 		if ((drvname = ddi_major_to_name(
3161 			(major_t)STRUCT_FGET(mc, major))) != NULL &&
3162 			strncmp(drvname, mc_drvname, MAXMODCONFNAME) != 0) {
3163 				/* safety */
3164 			if (mc_drvname[0] != '\0') {
3165 				mc_drvname[MAXMODCONFNAME-1] = '\0';
3166 				au_uwrite(au_to_text(mc_drvname));
3167 			}
3168 				/* drvname != NULL from test above */
3169 			au_uwrite(au_to_text(drvname));
3170 			return;
3171 		}
3172 
3173 		if (mc_drvname[0] != '\0') {
3174 				/* safety */
3175 			mc_drvname[MAXMODCONFNAME-1] = '\0';
3176 			au_uwrite(au_to_text(mc_drvname));
3177 		} else
3178 			au_uwrite(au_to_text("no drvname"));
3179 
3180 		num_aliases = STRUCT_FGET(mc, num_aliases);
3181 		au_uwrite(au_to_arg32(5, "", (uint32_t)num_aliases));
3182 		ap = (caddr_t)STRUCT_FGETP(mc, ap);
3183 		name = kmem_alloc(MAXMODCONFNAME, KM_SLEEP);
3184 		STRUCT_INIT(alias, model);
3185 		for (i = 0; i < num_aliases; i++) {
3186 			bzero((caddr_t)STRUCT_BUF(alias),
3187 					STRUCT_SIZE(alias));
3188 			if (copyin((caddr_t)ap, (caddr_t)STRUCT_BUF(alias),
3189 					STRUCT_SIZE(alias)) != 0)
3190 				break;
3191 			if (copyinstr(STRUCT_FGETP(alias, a_name), name,
3192 			    MAXMODCONFNAME, NULL) != 0) {
3193 				break;
3194 			}
3195 
3196 			au_uwrite(au_to_text(name));
3197 			ap = (caddr_t)STRUCT_FGETP(alias, a_next);
3198 		}
3199 		kmem_free(name, MAXMODCONFNAME);
3200 		break;
3201 	}
3202 	default:
3203 		break;
3204 	}
3205 }
3206 
3207 /*
3208  * private version of getsonode that does not do eprintsoline()
3209  */
3210 static struct sonode *
3211 au_getsonode(int sock, int *errorp, file_t **fpp)
3212 {
3213 	file_t *fp;
3214 	register vnode_t *vp;
3215 	struct sonode *so;
3216 
3217 	if ((fp = getf(sock)) == NULL) {
3218 		*errorp = EBADF;
3219 		return (NULL);
3220 	}
3221 	vp = fp->f_vnode;
3222 	/* Check if it is a socket */
3223 	if (vp->v_type != VSOCK) {
3224 		releasef(sock);
3225 		*errorp = ENOTSOCK;
3226 		return (NULL);
3227 	}
3228 	/*
3229 	 * Use the stream head to find the real socket vnode.
3230 	 * This is needed when namefs sits above sockfs.
3231 	 */
3232 	ASSERT(vp->v_stream);
3233 	ASSERT(vp->v_stream->sd_vnode);
3234 	vp = vp->v_stream->sd_vnode;
3235 	so = VTOSO(vp);
3236 	if (so->so_version == SOV_STREAM) {
3237 		releasef(sock);
3238 		*errorp = ENOTSOCK;
3239 		return (NULL);
3240 	}
3241 	if (fpp)
3242 		*fpp = fp;
3243 	return (so);
3244 }
3245 
3246 /*ARGSUSED*/
3247 static void
3248 auf_accept(
3249 	struct t_audit_data *tad,
3250 	int	error,
3251 	rval_t	*rval)
3252 {
3253 	uint32_t scid;
3254 	uint32_t sy_flags;
3255 	int fd;
3256 	struct sonode *so;
3257 	char so_laddr[sizeof (struct sockaddr_in6)];
3258 	char so_faddr[sizeof (struct sockaddr_in6)];
3259 	int err;
3260 	int len;
3261 	short so_family, so_type;
3262 	int add_sock_token = 0;
3263 
3264 	/* need to determine type of executing binary */
3265 	scid = tad->tad_scid;
3266 #ifdef _SYSCALL32_IMPL
3267 	if (lwp_getdatamodel(ttolwp(curthread)) == DATAMODEL_NATIVE)
3268 		sy_flags = sysent[scid].sy_flags & SE_RVAL_MASK;
3269 	else
3270 		sy_flags = sysent32[scid].sy_flags & SE_RVAL_MASK;
3271 #else
3272 	sy_flags = sysent[scid].sy_flags & SE_RVAL_MASK;
3273 #endif
3274 	if (sy_flags == SE_32RVAL1)
3275 		fd = rval->r_val1;
3276 	if (sy_flags == (SE_32RVAL2|SE_32RVAL1))
3277 		fd = rval->r_val1;
3278 	if (sy_flags == SE_64RVAL)
3279 		fd = (int)rval->r_vals;
3280 
3281 	if (error) {
3282 		/* can't trust socket contents. Just return */
3283 		au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
3284 		return;
3285 	}
3286 
3287 	if ((so = au_getsonode((int)fd, &err, NULL)) == NULL) {
3288 		/*
3289 		 * not security relevant if doing a accept from non socket
3290 		 * so no extra tokens. Should probably turn off audit record
3291 		 * generation here.
3292 		 */
3293 		return;
3294 	}
3295 
3296 	so_family = so->so_family;
3297 	so_type   = so->so_type;
3298 
3299 	switch (so_family) {
3300 	case AF_INET:
3301 	case AF_INET6:
3302 		/*
3303 		 * XXX - what about other socket types for AF_INET (e.g. DGRAM)
3304 		 */
3305 		if (so->so_type == SOCK_STREAM) {
3306 
3307 			bzero((void *)so_laddr, sizeof (so_laddr));
3308 			bzero((void *)so_faddr, sizeof (so_faddr));
3309 
3310 			/*
3311 			 * no local address then need to get it from lower
3312 			 * levels. only put out record on first read ala
3313 			 * AUE_WRITE.
3314 			 */
3315 			if (so->so_state & SS_ISBOUND) {
3316 				/* only done once on a connection */
3317 				(void) SOP_GETSOCKNAME(so);
3318 				(void) SOP_GETPEERNAME(so);
3319 
3320 				/* get local and foreign addresses */
3321 				mutex_enter(&so->so_lock);
3322 				len = min(so->so_laddr_len, sizeof (so_laddr));
3323 				bcopy(so->so_laddr_sa, so_laddr, len);
3324 				len = min(so->so_faddr_len, sizeof (so_faddr));
3325 				bcopy(so->so_faddr_sa, so_faddr, len);
3326 				mutex_exit(&so->so_lock);
3327 			}
3328 
3329 			add_sock_token = 1;
3330 		}
3331 		break;
3332 
3333 	default:
3334 		/* AF_UNIX, AF_ROUTE, AF_KEY do not support accept */
3335 		break;
3336 	}
3337 
3338 	releasef(fd);
3339 
3340 	au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
3341 
3342 	if (add_sock_token == 0) {
3343 		au_uwrite(au_to_arg32(0, "family", (uint32_t)(so_family)));
3344 		au_uwrite(au_to_arg32(0, "type", (uint32_t)(so_type)));
3345 		return;
3346 	}
3347 
3348 	au_uwrite(au_to_socket_ex(so_family, so_type, so_laddr, so_faddr));
3349 
3350 }
3351 
3352 /*ARGSUSED*/
3353 static void
3354 auf_bind(struct t_audit_data *tad, int error, rval_t *rvp)
3355 {
3356 	struct a {
3357 		long	fd;
3358 		long	addr;
3359 		long	len;
3360 	} *uap = (struct a *)ttolwp(curthread)->lwp_ap;
3361 
3362 	struct sonode *so;
3363 	char so_laddr[sizeof (struct sockaddr_in6)];
3364 	char so_faddr[sizeof (struct sockaddr_in6)];
3365 	int err, fd;
3366 	int len;
3367 	short so_family, so_type;
3368 	int add_sock_token = 0;
3369 
3370 	fd = (int)uap->fd;
3371 
3372 	/*
3373 	 * bind failed, then nothing extra to add to audit record.
3374 	 */
3375 	if (error) {
3376 		au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
3377 		/* XXX may want to add failed address some day */
3378 		return;
3379 	}
3380 
3381 	if ((so = au_getsonode(fd, &err, NULL)) == NULL) {
3382 		/*
3383 		 * not security relevant if doing a bind from non socket
3384 		 * so no extra tokens. Should probably turn off audit record
3385 		 * generation here.
3386 		 */
3387 		return;
3388 	}
3389 
3390 	so_family = so->so_family;
3391 	so_type   = so->so_type;
3392 
3393 	switch (so_family) {
3394 	case AF_INET:
3395 	case AF_INET6:
3396 
3397 		bzero(so_faddr, sizeof (so_faddr));
3398 
3399 		if (so->so_state & SS_ISBOUND) {
3400 			/* only done once on a connection */
3401 			(void) SOP_GETSOCKNAME(so);
3402 		}
3403 
3404 		mutex_enter(&so->so_lock);
3405 		len = min(so->so_laddr_len, sizeof (so_laddr));
3406 		bcopy(so->so_laddr_sa, so_laddr, len);
3407 		mutex_exit(&so->so_lock);
3408 
3409 		add_sock_token = 1;
3410 
3411 		break;
3412 
3413 	case AF_UNIX:
3414 		/* token added by lookup */
3415 		break;
3416 	default:
3417 		/* AF_ROUTE, AF_KEY do not support accept */
3418 		break;
3419 	}
3420 
3421 	releasef(fd);
3422 
3423 	au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
3424 
3425 	if (add_sock_token == 0) {
3426 		au_uwrite(au_to_arg32(1, "family", (uint32_t)(so_family)));
3427 		au_uwrite(au_to_arg32(1, "type", (uint32_t)(so_type)));
3428 		return;
3429 	}
3430 
3431 	au_uwrite(au_to_socket_ex(so_family, so_type, so_laddr, so_faddr));
3432 
3433 }
3434 
3435 /*ARGSUSED*/
3436 static void
3437 auf_connect(struct t_audit_data *tad, int error, rval_t *rval)
3438 {
3439 	struct a {
3440 		long	fd;
3441 		long	addr;
3442 		long	len;
3443 	} *uap = (struct a *)ttolwp(curthread)->lwp_ap;
3444 
3445 	struct sonode *so;
3446 	char so_laddr[sizeof (struct sockaddr_in6)];
3447 	char so_faddr[sizeof (struct sockaddr_in6)];
3448 	int err, fd;
3449 	int len;
3450 	short so_family, so_type;
3451 	int add_sock_token = 0;
3452 
3453 	fd = (int)uap->fd;
3454 
3455 
3456 	if ((so = au_getsonode(fd, &err, NULL)) == NULL) {
3457 		/*
3458 		 * not security relevant if doing a connect from non socket
3459 		 * so no extra tokens. Should probably turn off audit record
3460 		 * generation here.
3461 		 */
3462 		return;
3463 	}
3464 
3465 	so_family = so->so_family;
3466 	so_type   = so->so_type;
3467 
3468 	switch (so_family) {
3469 	case AF_INET:
3470 	case AF_INET6:
3471 		/*
3472 		 * no local address then need to get it from lower
3473 		 * levels.
3474 		 */
3475 		if (so->so_state & SS_ISBOUND) {
3476 			/* only done once on a connection */
3477 			(void) SOP_GETSOCKNAME(so);
3478 			(void) SOP_GETPEERNAME(so);
3479 		}
3480 
3481 		bzero(so_laddr, sizeof (so_laddr));
3482 		bzero(so_faddr, sizeof (so_faddr));
3483 
3484 		mutex_enter(&so->so_lock);
3485 		len = min(so->so_laddr_len, sizeof (so_laddr));
3486 		bcopy(so->so_laddr_sa, so_laddr, len);
3487 		if (error) {
3488 			mutex_exit(&so->so_lock);
3489 			if (uap->addr == NULL)
3490 				break;
3491 			if (uap->len <= 0)
3492 				break;
3493 			len = min(uap->len, sizeof (so_faddr));
3494 			if (copyin((caddr_t)(uap->addr), so_faddr, len) != 0)
3495 				break;
3496 #ifdef NOTYET
3497 			au_uwrite(au_to_data(AUP_HEX, AUR_CHAR, len, so_faddr));
3498 #endif
3499 		} else {
3500 			/* sanity check on length */
3501 			len = min(so->so_faddr_len, sizeof (so_faddr));
3502 			bcopy(so->so_faddr_sa, so_faddr, len);
3503 			mutex_exit(&so->so_lock);
3504 		}
3505 
3506 		add_sock_token = 1;
3507 
3508 		break;
3509 
3510 	case AF_UNIX:
3511 		/* does a lookup on name */
3512 		break;
3513 
3514 	default:
3515 		/* AF_ROUTE, AF_KEY do not support accept */
3516 		break;
3517 	}
3518 
3519 	releasef(fd);
3520 
3521 	au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
3522 
3523 	if (add_sock_token == 0) {
3524 		au_uwrite(au_to_arg32(1, "family", (uint32_t)(so_family)));
3525 		au_uwrite(au_to_arg32(1, "type", (uint32_t)(so_type)));
3526 		return;
3527 	}
3528 
3529 	au_uwrite(au_to_socket_ex(so_family, so_type, so_laddr, so_faddr));
3530 
3531 }
3532 
3533 /*ARGSUSED*/
3534 static void
3535 aus_shutdown(struct t_audit_data *tad)
3536 {
3537 	struct a {
3538 		long	fd;
3539 		long	how;
3540 	} *uap = (struct a *)ttolwp(curthread)->lwp_ap;
3541 
3542 	struct sonode *so;
3543 	char so_laddr[sizeof (struct sockaddr_in6)];
3544 	char so_faddr[sizeof (struct sockaddr_in6)];
3545 	int err, fd;
3546 	int len;
3547 	short so_family, so_type;
3548 	int add_sock_token = 0;
3549 	file_t *fp;				/* unix domain sockets */
3550 	struct f_audit_data *fad;		/* unix domain sockets */
3551 
3552 	fd = (int)uap->fd;
3553 
3554 	if ((so = au_getsonode(fd, &err, &fp)) == NULL) {
3555 		/*
3556 		 * not security relevant if doing a shutdown using non socket
3557 		 * so no extra tokens. Should probably turn off audit record
3558 		 * generation here.
3559 		 */
3560 		return;
3561 	}
3562 
3563 	so_family = so->so_family;
3564 	so_type   = so->so_type;
3565 
3566 	switch (so_family) {
3567 	case AF_INET:
3568 	case AF_INET6:
3569 
3570 		bzero(so_laddr, sizeof (so_laddr));
3571 		bzero(so_faddr, sizeof (so_faddr));
3572 
3573 		if (so->so_state & SS_ISBOUND) {
3574 			/*
3575 			 * no local address then need to get it from lower
3576 			 * levels.
3577 			 */
3578 			if (so->so_laddr_len == 0)
3579 				(void) SOP_GETSOCKNAME(so);
3580 			if (so->so_faddr_len == 0)
3581 				(void) SOP_GETPEERNAME(so);
3582 		}
3583 
3584 		mutex_enter(&so->so_lock);
3585 		len = min(so->so_laddr_len, sizeof (so_laddr));
3586 		bcopy(so->so_laddr_sa, so_laddr, len);
3587 		len = min(so->so_faddr_len, sizeof (so_faddr));
3588 		bcopy(so->so_faddr_sa, so_faddr, len);
3589 		mutex_exit(&so->so_lock);
3590 
3591 		add_sock_token = 1;
3592 
3593 		break;
3594 
3595 	case AF_UNIX:
3596 
3597 		/* get path from file struct here */
3598 		fad = F2A(fp);
3599 		ASSERT(fad);
3600 
3601 		if (fad->fad_aupath != NULL) {
3602 			au_uwrite(au_to_path(fad->fad_aupath));
3603 		} else {
3604 			au_uwrite(au_to_arg32(1, "no path: fd", fd));
3605 		}
3606 
3607 		audit_attributes(fp->f_vnode);
3608 
3609 		break;
3610 
3611 	default:
3612 		/*
3613 		 * AF_KEY and AF_ROUTE support shutdown. No socket token
3614 		 * added.
3615 		 */
3616 		break;
3617 	}
3618 
3619 	releasef(fd);
3620 
3621 	au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
3622 
3623 	if (add_sock_token == 0) {
3624 		au_uwrite(au_to_arg32(1, "family", (uint32_t)(so_family)));
3625 		au_uwrite(au_to_arg32(1, "type", (uint32_t)(so_type)));
3626 		au_uwrite(au_to_arg32(2, "how", (uint32_t)(uap->how)));
3627 		return;
3628 	}
3629 
3630 	au_uwrite(au_to_arg32(2, "how", (uint32_t)(uap->how)));
3631 
3632 	au_uwrite(au_to_socket_ex(so_family, so_type, so_laddr, so_faddr));
3633 
3634 }
3635 
3636 /*ARGSUSED*/
3637 static void
3638 auf_setsockopt(struct t_audit_data *tad, int error, rval_t *rval)
3639 {
3640 	struct a {
3641 		long	fd;
3642 		long	level;
3643 		long	optname;
3644 		long	*optval;
3645 		long	optlen;
3646 	} *uap = (struct a *)ttolwp(curthread)->lwp_ap;
3647 
3648 	struct sonode	*so;
3649 	char so_laddr[sizeof (struct sockaddr_in6)];
3650 	char so_faddr[sizeof (struct sockaddr_in6)];
3651 	char		val[AU_BUFSIZE];
3652 	int		err, fd;
3653 	int		len;
3654 	short so_family, so_type;
3655 	int		add_sock_token = 0;
3656 	file_t *fp;				/* unix domain sockets */
3657 	struct f_audit_data *fad;		/* unix domain sockets */
3658 
3659 	fd = (int)uap->fd;
3660 
3661 	if (error) {
3662 		au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
3663 		au_uwrite(au_to_arg32(2, "level", (uint32_t)uap->level));
3664 		/* XXX may want to include other arguments */
3665 		return;
3666 	}
3667 
3668 	if ((so = au_getsonode(fd, &err, &fp)) == NULL) {
3669 		/*
3670 		 * not security relevant if doing a setsockopt from non socket
3671 		 * so no extra tokens. Should probably turn off audit record
3672 		 * generation here.
3673 		 */
3674 		return;
3675 	}
3676 
3677 	so_family = so->so_family;
3678 	so_type   = so->so_type;
3679 
3680 	switch (so_family) {
3681 	case AF_INET:
3682 	case AF_INET6:
3683 
3684 		bzero((void *)so_laddr, sizeof (so_laddr));
3685 		bzero((void *)so_faddr, sizeof (so_faddr));
3686 
3687 		if (so->so_state & SS_ISBOUND) {
3688 			if (so->so_laddr_len == 0)
3689 				(void) SOP_GETSOCKNAME(so);
3690 			if (so->so_faddr_len == 0)
3691 				(void) SOP_GETPEERNAME(so);
3692 		}
3693 
3694 		/* get local and foreign addresses */
3695 		mutex_enter(&so->so_lock);
3696 		len = min(so->so_laddr_len, sizeof (so_laddr));
3697 		bcopy(so->so_laddr_sa, so_laddr, len);
3698 		len = min(so->so_faddr_len, sizeof (so_faddr));
3699 		bcopy(so->so_faddr_sa, so_faddr, len);
3700 		mutex_exit(&so->so_lock);
3701 
3702 		add_sock_token = 1;
3703 
3704 		break;
3705 
3706 	case AF_UNIX:
3707 
3708 		/* get path from file struct here */
3709 		fad = F2A(fp);
3710 		ASSERT(fad);
3711 
3712 		if (fad->fad_aupath != NULL) {
3713 			au_uwrite(au_to_path(fad->fad_aupath));
3714 		} else {
3715 			au_uwrite(au_to_arg32(1, "no path: fd", fd));
3716 		}
3717 
3718 		audit_attributes(fp->f_vnode);
3719 
3720 		break;
3721 
3722 	default:
3723 		/*
3724 		 * AF_KEY and AF_ROUTE support setsockopt. No socket token
3725 		 * added.
3726 		 */
3727 		break;
3728 	}
3729 
3730 	releasef(fd);
3731 
3732 	au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
3733 
3734 	if (add_sock_token == 0) {
3735 		au_uwrite(au_to_arg32(1, "family", (uint32_t)(so_family)));
3736 		au_uwrite(au_to_arg32(1, "type", (uint32_t)(so_type)));
3737 	}
3738 	au_uwrite(au_to_arg32(2, "level", (uint32_t)(uap->level)));
3739 	au_uwrite(au_to_arg32(3, "optname", (uint32_t)(uap->optname)));
3740 
3741 	bzero(val, sizeof (val));
3742 	len = min(uap->optlen, sizeof (val));
3743 	if ((len > 0) &&
3744 	    (copyin((caddr_t)(uap->optval), (caddr_t)val, len) == 0)) {
3745 		au_uwrite(au_to_arg32(5, "optlen", (uint32_t)(uap->optlen)));
3746 		au_uwrite(au_to_data(AUP_HEX, AUR_BYTE, len, val));
3747 	}
3748 
3749 	if (add_sock_token == 0)
3750 		return;
3751 
3752 	au_uwrite(au_to_socket_ex(so_family, so_type, so_laddr, so_faddr));
3753 
3754 }
3755 
3756 /*ARGSUSED*/
3757 static void
3758 aus_sockconfig(tad)
3759 	struct t_audit_data *tad;
3760 {
3761 	struct a {
3762 		long	domain;
3763 		long	type;
3764 		long	protocol;
3765 		long	devpath;
3766 	} *uap = (struct a *)ttolwp(curthread)->lwp_ap;
3767 
3768 	char	*kdevpath;
3769 	int	kdevpathlen = MAXPATHLEN + 1;
3770 	size_t	size;
3771 
3772 	au_uwrite(au_to_arg32(1, "domain", (uint32_t)uap->domain));
3773 	au_uwrite(au_to_arg32(2, "type", (uint32_t)uap->type));
3774 	au_uwrite(au_to_arg32(3, "protocol", (uint32_t)uap->protocol));
3775 
3776 	if (uap->devpath == 0) {
3777 		au_uwrite(au_to_arg32(3, "devpath", (uint32_t)0));
3778 	} else {
3779 		kdevpath = kmem_alloc(kdevpathlen, KM_SLEEP);
3780 
3781 		if (copyinstr((caddr_t)uap->devpath, kdevpath, kdevpathlen,
3782 			&size)) {
3783 			kmem_free(kdevpath, kdevpathlen);
3784 			return;
3785 		}
3786 
3787 		if (size > MAXPATHLEN) {
3788 			kmem_free(kdevpath, kdevpathlen);
3789 			return;
3790 		}
3791 
3792 		au_uwrite(au_to_text(kdevpath));
3793 		kmem_free(kdevpath, kdevpathlen);
3794 	}
3795 }
3796 
3797 /*
3798  * only audit recvmsg when the system call represents the creation of a new
3799  * circuit. This effectively occurs for all UDP packets and may occur for
3800  * special TCP situations where the local host has not set a local address
3801  * in the socket structure.
3802  */
3803 /*ARGSUSED*/
3804 static void
3805 auf_recvmsg(
3806 	struct t_audit_data *tad,
3807 	int error,
3808 	rval_t *rvp)
3809 {
3810 	struct a {
3811 		long	fd;
3812 		long	msg;	/* struct msghdr */
3813 		long	flags;
3814 	} *uap = (struct a *)ttolwp(curthread)->lwp_ap;
3815 
3816 	struct sonode	*so;
3817 	STRUCT_DECL(msghdr, msg);
3818 	caddr_t msg_name;
3819 	socklen_t msg_namelen;
3820 	int fd;
3821 	int err;
3822 	char so_laddr[sizeof (struct sockaddr_in6)];
3823 	char so_faddr[sizeof (struct sockaddr_in6)];
3824 	int len;
3825 	file_t *fp;				/* unix domain sockets */
3826 	struct f_audit_data *fad;		/* unix domain sockets */
3827 	short so_family, so_type;
3828 	int add_sock_token = 0;
3829 	au_kcontext_t	*kctx = SET_KCTX_PZ;
3830 
3831 	fd = (int)uap->fd;
3832 
3833 	/* bail if an error */
3834 	if (error) {
3835 		au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
3836 		au_uwrite(au_to_arg32(3, "flags", (uint32_t)(uap->flags)));
3837 		return;
3838 	}
3839 
3840 	if ((so = au_getsonode(fd, &err, &fp)) == NULL) {
3841 		/*
3842 		 * not security relevant if doing a recvmsg from non socket
3843 		 * so no extra tokens. Should probably turn off audit record
3844 		 * generation here.
3845 		 */
3846 		return;
3847 	}
3848 
3849 	so_family = so->so_family;
3850 	so_type   = so->so_type;
3851 
3852 	/*
3853 	 * only putout SOCKET_EX token if INET/INET6 family.
3854 	 * XXX - what do we do about other families?
3855 	 */
3856 
3857 	switch (so_family) {
3858 	case AF_INET:
3859 	case AF_INET6:
3860 
3861 		/*
3862 		 * if datagram type socket, then just use what is in
3863 		 * socket structure for local address.
3864 		 * XXX - what do we do for other types?
3865 		 */
3866 		if ((so->so_type == SOCK_DGRAM) ||
3867 		    (so->so_type == SOCK_RAW)) {
3868 			add_sock_token = 1;
3869 
3870 			bzero((void *)so_laddr, sizeof (so_laddr));
3871 			bzero((void *)so_faddr, sizeof (so_faddr));
3872 
3873 			/* get local address */
3874 			mutex_enter(&so->so_lock);
3875 			len = min(so->so_laddr_len, sizeof (so_laddr));
3876 			bcopy(so->so_laddr_sa, so_laddr, len);
3877 			mutex_exit(&so->so_lock);
3878 
3879 			/* get peer address */
3880 			STRUCT_INIT(msg, get_udatamodel());
3881 
3882 			if (copyin((caddr_t)(uap->msg),
3883 			    (caddr_t)STRUCT_BUF(msg), STRUCT_SIZE(msg)) != 0) {
3884 				break;
3885 			}
3886 			msg_name = (caddr_t)STRUCT_FGETP(msg, msg_name);
3887 			if (msg_name == NULL) {
3888 				break;
3889 			}
3890 
3891 			/* length is value from recvmsg - sanity check */
3892 			msg_namelen = (socklen_t)STRUCT_FGET(msg, msg_namelen);
3893 			if (msg_namelen == 0) {
3894 				break;
3895 			}
3896 			if (copyin(msg_name, so_faddr,
3897 			    sizeof (so_faddr)) != 0) {
3898 				break;
3899 			}
3900 
3901 		} else if (so->so_type == SOCK_STREAM) {
3902 
3903 			/* get path from file struct here */
3904 			fad = F2A(fp);
3905 			ASSERT(fad);
3906 
3907 			/*
3908 			 * already processed this file for read attempt
3909 			 */
3910 			if (fad->fad_flags & FAD_READ) {
3911 				/* don't want to audit every recvmsg attempt */
3912 				tad->tad_flag = 0;
3913 				/* free any residual audit data */
3914 				au_close(kctx, &(u_ad), 0, 0, 0);
3915 				releasef(fd);
3916 				return;
3917 			}
3918 			/*
3919 			 * mark things so we know what happened and don't
3920 			 * repeat things
3921 			 */
3922 			fad->fad_flags |= FAD_READ;
3923 
3924 			bzero((void *)so_laddr, sizeof (so_laddr));
3925 			bzero((void *)so_faddr, sizeof (so_faddr));
3926 
3927 			if (so->so_state & SS_ISBOUND) {
3928 
3929 				if (so->so_laddr_len == 0)
3930 					(void) SOP_GETSOCKNAME(so);
3931 				if (so->so_faddr_len == 0)
3932 					(void) SOP_GETPEERNAME(so);
3933 
3934 				/* get local and foreign addresses */
3935 				mutex_enter(&so->so_lock);
3936 				len = min(so->so_laddr_len, sizeof (so_laddr));
3937 				bcopy(so->so_laddr_sa, so_laddr, len);
3938 				len = min(so->so_faddr_len, sizeof (so_faddr));
3939 				bcopy(so->so_faddr_sa, so_faddr, len);
3940 				mutex_exit(&so->so_lock);
3941 			}
3942 
3943 			add_sock_token = 1;
3944 		}
3945 
3946 		/* XXX - what about SOCK_RDM/SOCK_SEQPACKET ??? */
3947 
3948 		break;
3949 
3950 	case AF_UNIX:
3951 		/*
3952 		 * first check if this is first time through. Too much
3953 		 * duplicate code to put this in an aui_ routine.
3954 		 */
3955 
3956 		/* get path from file struct here */
3957 		fad = F2A(fp);
3958 		ASSERT(fad);
3959 
3960 		/*
3961 		 * already processed this file for read attempt
3962 		 */
3963 		if (fad->fad_flags & FAD_READ) {
3964 			releasef(fd);
3965 			/* don't want to audit every recvmsg attempt */
3966 			tad->tad_flag = 0;
3967 			/* free any residual audit data */
3968 			au_close(kctx, &(u_ad), 0, 0, 0);
3969 			return;
3970 		}
3971 		/*
3972 		 * mark things so we know what happened and don't
3973 		 * repeat things
3974 		 */
3975 		fad->fad_flags |= FAD_READ;
3976 
3977 		if (fad->fad_aupath != NULL) {
3978 			au_uwrite(au_to_path(fad->fad_aupath));
3979 		} else {
3980 			au_uwrite(au_to_arg32(1, "no path: fd", fd));
3981 		}
3982 
3983 		audit_attributes(fp->f_vnode);
3984 
3985 		releasef(fd);
3986 
3987 		return;
3988 
3989 	default:
3990 		break;
3991 
3992 	}
3993 
3994 	releasef(fd);
3995 
3996 	au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
3997 
3998 	if (add_sock_token == 0) {
3999 		au_uwrite(au_to_arg32(1, "family", (uint32_t)so_family));
4000 		au_uwrite(au_to_arg32(1, "type", (uint32_t)so_type));
4001 		au_uwrite(au_to_arg32(3, "flags", (uint32_t)(uap->flags)));
4002 		return;
4003 	}
4004 
4005 	au_uwrite(au_to_arg32(3, "flags", (uint32_t)(uap->flags)));
4006 
4007 	au_uwrite(au_to_socket_ex(so_family, so_type, so_laddr, so_faddr));
4008 
4009 }
4010 
4011 /*ARGSUSED*/
4012 static void
4013 auf_recvfrom(
4014 	struct t_audit_data *tad,
4015 	int error,
4016 	rval_t *rvp)
4017 {
4018 
4019 	struct a {
4020 		long	fd;
4021 		long	msg;	/* char */
4022 		long	len;
4023 		long	flags;
4024 		long	from;	/* struct sockaddr */
4025 		long	fromlen;
4026 	} *uap = (struct a *)ttolwp(curthread)->lwp_ap;
4027 
4028 	socklen_t	fromlen;
4029 	struct sonode	*so;
4030 	char so_laddr[sizeof (struct sockaddr_in6)];
4031 	char so_faddr[sizeof (struct sockaddr_in6)];
4032 	int		fd;
4033 	short so_family, so_type;
4034 	int add_sock_token = 0;
4035 	int len;
4036 	int err;
4037 	struct file *fp;
4038 	struct f_audit_data *fad;		/* unix domain sockets */
4039 	au_kcontext_t	*kctx = SET_KCTX_PZ;
4040 
4041 	fd = (int)uap->fd;
4042 
4043 	/* bail if an error */
4044 	if (error) {
4045 		au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
4046 		au_uwrite(au_to_arg32(3, "flags", (uint32_t)(uap->flags)));
4047 		return;
4048 	}
4049 
4050 	if ((so = au_getsonode(fd, &err, &fp)) == NULL) {
4051 		/*
4052 		 * not security relevant if doing a recvmsg from non socket
4053 		 * so no extra tokens. Should probably turn off audit record
4054 		 * generation here.
4055 		 */
4056 		return;
4057 	}
4058 
4059 	so_family = so->so_family;
4060 	so_type   = so->so_type;
4061 
4062 	/*
4063 	 * only putout SOCKET_EX token if INET/INET6 family.
4064 	 * XXX - what do we do about other families?
4065 	 */
4066 
4067 	switch (so_family) {
4068 	case AF_INET:
4069 	case AF_INET6:
4070 
4071 		/*
4072 		 * if datagram type socket, then just use what is in
4073 		 * socket structure for local address.
4074 		 * XXX - what do we do for other types?
4075 		 */
4076 		if ((so->so_type == SOCK_DGRAM) ||
4077 		    (so->so_type == SOCK_RAW)) {
4078 			add_sock_token = 1;
4079 
4080 			/* get local address */
4081 			mutex_enter(&so->so_lock);
4082 			len = min(so->so_laddr_len, sizeof (so_laddr));
4083 			bcopy(so->so_laddr_sa, so_laddr, len);
4084 			mutex_exit(&so->so_lock);
4085 
4086 			/* get peer address */
4087 			bzero((void *)so_faddr, sizeof (so_faddr));
4088 
4089 			/* sanity check */
4090 			if (uap->from == NULL)
4091 				break;
4092 
4093 			/* sanity checks */
4094 			if (uap->fromlen == 0)
4095 				break;
4096 
4097 			if (copyin((caddr_t)(uap->fromlen), (caddr_t)&fromlen,
4098 			    sizeof (fromlen)) != 0)
4099 				break;
4100 
4101 			if (fromlen == 0)
4102 				break;
4103 
4104 			/* enforce maximum size */
4105 			if (fromlen > sizeof (so_faddr))
4106 				fromlen = sizeof (so_faddr);
4107 
4108 			if (copyin((caddr_t)(uap->from), so_faddr,
4109 			    fromlen) != 0)
4110 				break;
4111 
4112 		} else if (so->so_type == SOCK_STREAM) {
4113 
4114 			/* get path from file struct here */
4115 			fad = F2A(fp);
4116 			ASSERT(fad);
4117 
4118 			/*
4119 			 * already processed this file for read attempt
4120 			 */
4121 			if (fad->fad_flags & FAD_READ) {
4122 				/* don't want to audit every recvfrom attempt */
4123 				tad->tad_flag = 0;
4124 				/* free any residual audit data */
4125 				au_close(kctx, &(u_ad), 0, 0, 0);
4126 				releasef(fd);
4127 				return;
4128 			}
4129 			/*
4130 			 * mark things so we know what happened and don't
4131 			 * repeat things
4132 			 */
4133 			fad->fad_flags |= FAD_READ;
4134 
4135 			bzero((void *)so_laddr, sizeof (so_laddr));
4136 			bzero((void *)so_faddr, sizeof (so_faddr));
4137 
4138 			if (so->so_state & SS_ISBOUND) {
4139 
4140 				if (so->so_laddr_len == 0)
4141 					(void) SOP_GETSOCKNAME(so);
4142 				if (so->so_faddr_len == 0)
4143 					(void) SOP_GETPEERNAME(so);
4144 
4145 				/* get local and foreign addresses */
4146 				mutex_enter(&so->so_lock);
4147 				len = min(so->so_laddr_len, sizeof (so_laddr));
4148 				bcopy(so->so_laddr_sa, so_laddr, len);
4149 				len = min(so->so_faddr_len, sizeof (so_faddr));
4150 				bcopy(so->so_faddr_sa, so_faddr, len);
4151 				mutex_exit(&so->so_lock);
4152 			}
4153 
4154 			add_sock_token = 1;
4155 		}
4156 
4157 		/* XXX - what about SOCK_RDM/SOCK_SEQPACKET ??? */
4158 
4159 		break;
4160 
4161 	case AF_UNIX:
4162 		/*
4163 		 * first check if this is first time through. Too much
4164 		 * duplicate code to put this in an aui_ routine.
4165 		 */
4166 
4167 		/* get path from file struct here */
4168 		fad = F2A(fp);
4169 		ASSERT(fad);
4170 
4171 		/*
4172 		 * already processed this file for read attempt
4173 		 */
4174 		if (fad->fad_flags & FAD_READ) {
4175 			/* don't want to audit every recvfrom attempt */
4176 			tad->tad_flag = 0;
4177 			/* free any residual audit data */
4178 			au_close(kctx, &(u_ad), 0, 0, 0);
4179 			releasef(fd);
4180 			return;
4181 		}
4182 		/*
4183 		 * mark things so we know what happened and don't
4184 		 * repeat things
4185 		 */
4186 		fad->fad_flags |= FAD_READ;
4187 
4188 		if (fad->fad_aupath != NULL) {
4189 			au_uwrite(au_to_path(fad->fad_aupath));
4190 		} else {
4191 			au_uwrite(au_to_arg32(1, "no path: fd", fd));
4192 		}
4193 
4194 		audit_attributes(fp->f_vnode);
4195 
4196 		releasef(fd);
4197 
4198 		return;
4199 
4200 	default:
4201 		break;
4202 
4203 	}
4204 
4205 	releasef(fd);
4206 
4207 	au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
4208 
4209 	if (add_sock_token == 0) {
4210 		au_uwrite(au_to_arg32(1, "family", (uint32_t)so_family));
4211 		au_uwrite(au_to_arg32(1, "type", (uint32_t)so_type));
4212 		au_uwrite(au_to_arg32(3, "flags", (uint32_t)(uap->flags)));
4213 		return;
4214 	}
4215 
4216 	au_uwrite(au_to_arg32(3, "flags", (uint32_t)(uap->flags)));
4217 
4218 	au_uwrite(au_to_socket_ex(so_family, so_type, so_laddr, so_faddr));
4219 }
4220 
4221 /*ARGSUSED*/
4222 static void
4223 auf_sendmsg(struct t_audit_data *tad, int error, rval_t *rval)
4224 {
4225 	struct a {
4226 		long	fd;
4227 		long	msg;	/* struct msghdr */
4228 		long	flags;
4229 	} *uap = (struct a *)ttolwp(curthread)->lwp_ap;
4230 
4231 	struct sonode	*so;
4232 	char so_laddr[sizeof (struct sockaddr_in6)];
4233 	char so_faddr[sizeof (struct sockaddr_in6)];
4234 	int		err;
4235 	int		fd;
4236 	short so_family, so_type;
4237 	int		add_sock_token = 0;
4238 	int		len;
4239 	struct file	*fp;
4240 	struct f_audit_data *fad;
4241 	caddr_t		msg_name;
4242 	socklen_t	msg_namelen;
4243 	STRUCT_DECL(msghdr, msg);
4244 	au_kcontext_t	*kctx = SET_KCTX_PZ;
4245 
4246 	fd = (int)uap->fd;
4247 
4248 	/* bail if an error */
4249 	if (error) {
4250 		/* XXX include destination address from system call arguments */
4251 		au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
4252 		au_uwrite(au_to_arg32(3, "flags", (uint32_t)(uap->flags)));
4253 		return;
4254 	}
4255 
4256 	if ((so = au_getsonode(fd, &err, &fp)) == NULL) {
4257 		/*
4258 		 * not security relevant if doing a sendmsg from non socket
4259 		 * so no extra tokens. Should probably turn off audit record
4260 		 * generation here.
4261 		 */
4262 		return;
4263 	}
4264 
4265 	so_family = so->so_family;
4266 	so_type   = so->so_type;
4267 
4268 	switch (so_family) {
4269 	case AF_INET:
4270 	case AF_INET6:
4271 		/*
4272 		 * if datagram type socket, then just use what is in
4273 		 * socket structure for local address.
4274 		 * XXX - what do we do for other types?
4275 		 */
4276 		if ((so->so_type == SOCK_DGRAM) ||
4277 		    (so->so_type == SOCK_RAW)) {
4278 
4279 			bzero((void *)so_laddr, sizeof (so_laddr));
4280 			bzero((void *)so_faddr, sizeof (so_faddr));
4281 
4282 			/* get local address */
4283 			mutex_enter(&so->so_lock);
4284 			len = min(so->so_laddr_len, sizeof (so_laddr));
4285 			bcopy(so->so_laddr_sa, so_laddr, len);
4286 			mutex_exit(&so->so_lock);
4287 
4288 			/* get peer address */
4289 			STRUCT_INIT(msg, get_udatamodel());
4290 
4291 			if (copyin((caddr_t)(uap->msg),
4292 			    (caddr_t)STRUCT_BUF(msg), STRUCT_SIZE(msg)) != 0) {
4293 				break;
4294 			}
4295 			msg_name = (caddr_t)STRUCT_FGETP(msg, msg_name);
4296 			if (msg_name == NULL)
4297 				break;
4298 
4299 			msg_namelen = (socklen_t)STRUCT_FGET(msg, msg_namelen);
4300 			/* length is value from recvmsg - sanity check */
4301 			if (msg_namelen == 0)
4302 				break;
4303 
4304 			if (copyin(msg_name, so_faddr,
4305 			    sizeof (so_faddr)) != 0)
4306 				break;
4307 
4308 			add_sock_token = 1;
4309 
4310 		} else if (so->so_type == SOCK_STREAM) {
4311 
4312 			/* get path from file struct here */
4313 			fad = F2A(fp);
4314 			ASSERT(fad);
4315 
4316 			/*
4317 			 * already processed this file for write attempt
4318 			 */
4319 			if (fad->fad_flags & FAD_WRITE) {
4320 				releasef(fd);
4321 				/* don't want to audit every sendmsg attempt */
4322 				tad->tad_flag = 0;
4323 				/* free any residual audit data */
4324 				au_close(kctx, &(u_ad), 0, 0, 0);
4325 				return;
4326 			}
4327 
4328 			/*
4329 			 * mark things so we know what happened and don't
4330 			 * repeat things
4331 			 */
4332 			fad->fad_flags |= FAD_WRITE;
4333 
4334 			bzero((void *)so_laddr, sizeof (so_laddr));
4335 			bzero((void *)so_faddr, sizeof (so_faddr));
4336 
4337 			if (so->so_state & SS_ISBOUND) {
4338 
4339 				if (so->so_laddr_len == 0)
4340 					(void) SOP_GETSOCKNAME(so);
4341 				if (so->so_faddr_len == 0)
4342 					(void) SOP_GETPEERNAME(so);
4343 
4344 				/* get local and foreign addresses */
4345 				mutex_enter(&so->so_lock);
4346 				len = min(so->so_laddr_len, sizeof (so_laddr));
4347 				bcopy(so->so_laddr_sa, so_laddr, len);
4348 				len = min(so->so_faddr_len, sizeof (so_faddr));
4349 				bcopy(so->so_faddr_sa, so_faddr, len);
4350 				mutex_exit(&so->so_lock);
4351 			}
4352 
4353 			add_sock_token = 1;
4354 		}
4355 
4356 		/* XXX - what about SOCK_RAW/SOCK_RDM/SOCK_SEQPACKET ??? */
4357 
4358 		break;
4359 
4360 	case AF_UNIX:
4361 		/*
4362 		 * first check if this is first time through. Too much
4363 		 * duplicate code to put this in an aui_ routine.
4364 		 */
4365 
4366 		/* get path from file struct here */
4367 		fad = F2A(fp);
4368 		ASSERT(fad);
4369 
4370 		/*
4371 		 * already processed this file for write attempt
4372 		 */
4373 		if (fad->fad_flags & FAD_WRITE) {
4374 			releasef(fd);
4375 			/* don't want to audit every sendmsg attempt */
4376 			tad->tad_flag = 0;
4377 			/* free any residual audit data */
4378 			au_close(kctx, &(u_ad), 0, 0, 0);
4379 			return;
4380 		}
4381 		/*
4382 		 * mark things so we know what happened and don't
4383 		 * repeat things
4384 		 */
4385 		fad->fad_flags |= FAD_WRITE;
4386 
4387 		if (fad->fad_aupath != NULL) {
4388 			au_uwrite(au_to_path(fad->fad_aupath));
4389 		} else {
4390 			au_uwrite(au_to_arg32(1, "no path: fd", fd));
4391 		}
4392 
4393 		audit_attributes(fp->f_vnode);
4394 
4395 		releasef(fd);
4396 
4397 		return;
4398 
4399 	default:
4400 		break;
4401 	}
4402 
4403 	releasef(fd);
4404 
4405 	au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
4406 
4407 	if (add_sock_token == 0) {
4408 		au_uwrite(au_to_arg32(1, "family", (uint32_t)so_family));
4409 		au_uwrite(au_to_arg32(1, "type", (uint32_t)so_type));
4410 		au_uwrite(au_to_arg32(3, "flags", (uint32_t)(uap->flags)));
4411 		return;
4412 	}
4413 
4414 	au_uwrite(au_to_arg32(3, "flags", (uint32_t)(uap->flags)));
4415 
4416 	au_uwrite(au_to_socket_ex(so_family, so_type, so_laddr, so_faddr));
4417 }
4418 
4419 /*ARGSUSED*/
4420 static void
4421 auf_sendto(struct t_audit_data *tad, int error, rval_t *rval)
4422 {
4423 	struct a {
4424 		long	fd;
4425 		long	msg;	/* char */
4426 		long	len;
4427 		long	flags;
4428 		long	to;	/* struct sockaddr */
4429 		long	tolen;
4430 	} *uap = (struct a *)ttolwp(curthread)->lwp_ap;
4431 
4432 	struct sonode	*so;
4433 	char so_laddr[sizeof (struct sockaddr_in6)];
4434 	char so_faddr[sizeof (struct sockaddr_in6)];
4435 	socklen_t	tolen;
4436 	int		err;
4437 	int		fd;
4438 	int		len;
4439 	short so_family, so_type;
4440 	int		add_sock_token = 0;
4441 	struct file	*fp;
4442 	struct f_audit_data *fad;
4443 	au_kcontext_t	*kctx = SET_KCTX_PZ;
4444 
4445 	fd = (int)uap->fd;
4446 
4447 	/* bail if an error */
4448 	if (error) {
4449 		au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
4450 		au_uwrite(au_to_arg32(3, "flags", (uint32_t)(uap->flags)));
4451 		/* XXX include destination address from system call arguments */
4452 		return;
4453 	}
4454 
4455 	if ((so = au_getsonode(fd, &err, &fp)) == NULL) {
4456 		/*
4457 		 * not security relevant if doing a sendto using non socket
4458 		 * so no extra tokens. Should probably turn off audit record
4459 		 * generation here.
4460 		 */
4461 		return;
4462 	}
4463 
4464 	so_family = so->so_family;
4465 	so_type   = so->so_type;
4466 
4467 	/*
4468 	 * only putout SOCKET_EX token if INET/INET6 family.
4469 	 * XXX - what do we do about other families?
4470 	 */
4471 
4472 	switch (so_family) {
4473 	case AF_INET:
4474 	case AF_INET6:
4475 
4476 		/*
4477 		 * if datagram type socket, then just use what is in
4478 		 * socket structure for local address.
4479 		 * XXX - what do we do for other types?
4480 		 */
4481 		if ((so->so_type == SOCK_DGRAM) ||
4482 		    (so->so_type == SOCK_RAW)) {
4483 
4484 			bzero((void *)so_laddr, sizeof (so_laddr));
4485 			bzero((void *)so_faddr, sizeof (so_faddr));
4486 
4487 			/* get local address */
4488 			mutex_enter(&so->so_lock);
4489 			len = min(so->so_laddr_len, sizeof (so_laddr));
4490 			bcopy(so->so_laddr_sa, so_laddr, len);
4491 			mutex_exit(&so->so_lock);
4492 
4493 			/* get peer address */
4494 
4495 			/* sanity check */
4496 			if (uap->to == NULL)
4497 				break;
4498 
4499 			/* sanity checks */
4500 			if (uap->tolen == 0)
4501 				break;
4502 
4503 			tolen = (socklen_t)uap->tolen;
4504 
4505 			/* enforce maximum size */
4506 			if (tolen > sizeof (so_faddr))
4507 				tolen = sizeof (so_faddr);
4508 
4509 			if (copyin((caddr_t)(uap->to), so_faddr, tolen) != 0)
4510 				break;
4511 
4512 			add_sock_token = 1;
4513 		} else {
4514 			/*
4515 			 * check if this is first time through.
4516 			 */
4517 
4518 			/* get path from file struct here */
4519 			fad = F2A(fp);
4520 			ASSERT(fad);
4521 
4522 			/*
4523 			 * already processed this file for write attempt
4524 			 */
4525 			if (fad->fad_flags & FAD_WRITE) {
4526 				/* don't want to audit every sendto attempt */
4527 				tad->tad_flag = 0;
4528 				/* free any residual audit data */
4529 				au_close(kctx, &(u_ad), 0, 0, 0);
4530 				releasef(fd);
4531 				return;
4532 			}
4533 			/*
4534 			 * mark things so we know what happened and don't
4535 			 * repeat things
4536 			 */
4537 			fad->fad_flags |= FAD_WRITE;
4538 
4539 			bzero((void *)so_laddr, sizeof (so_laddr));
4540 			bzero((void *)so_faddr, sizeof (so_faddr));
4541 
4542 			if (so->so_state & SS_ISBOUND) {
4543 
4544 				if (so->so_laddr_len == 0)
4545 					(void) SOP_GETSOCKNAME(so);
4546 				if (so->so_faddr_len == 0)
4547 					(void) SOP_GETPEERNAME(so);
4548 
4549 				/* get local and foreign addresses */
4550 				mutex_enter(&so->so_lock);
4551 				len = min(so->so_laddr_len, sizeof (so_laddr));
4552 				bcopy(so->so_laddr_sa, so_laddr, len);
4553 				len = min(so->so_faddr_len, sizeof (so_faddr));
4554 				bcopy(so->so_faddr_sa, so_faddr, len);
4555 				mutex_exit(&so->so_lock);
4556 			}
4557 
4558 			add_sock_token = 1;
4559 		}
4560 
4561 		/* XXX - what about SOCK_RDM/SOCK_SEQPACKET ??? */
4562 
4563 		break;
4564 
4565 	case AF_UNIX:
4566 		/*
4567 		 * first check if this is first time through. Too much
4568 		 * duplicate code to put this in an aui_ routine.
4569 		 */
4570 
4571 		/* get path from file struct here */
4572 		fad = F2A(fp);
4573 		ASSERT(fad);
4574 
4575 		/*
4576 		 * already processed this file for write attempt
4577 		 */
4578 		if (fad->fad_flags & FAD_WRITE) {
4579 			/* don't want to audit every sendto attempt */
4580 			tad->tad_flag = 0;
4581 			/* free any residual audit data */
4582 			au_close(kctx, &(u_ad), 0, 0, 0);
4583 			releasef(fd);
4584 			return;
4585 		}
4586 		/*
4587 		 * mark things so we know what happened and don't
4588 		 * repeat things
4589 		 */
4590 		fad->fad_flags |= FAD_WRITE;
4591 
4592 		if (fad->fad_aupath != NULL) {
4593 			au_uwrite(au_to_path(fad->fad_aupath));
4594 		} else {
4595 			au_uwrite(au_to_arg32(1, "no path: fd", fd));
4596 		}
4597 
4598 		audit_attributes(fp->f_vnode);
4599 
4600 		releasef(fd);
4601 
4602 		return;
4603 
4604 	default:
4605 		break;
4606 
4607 	}
4608 
4609 	releasef(fd);
4610 
4611 	au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
4612 
4613 	if (add_sock_token == 0) {
4614 		au_uwrite(au_to_arg32(1, "family", (uint32_t)so_family));
4615 		au_uwrite(au_to_arg32(1, "type", (uint32_t)so_type));
4616 		au_uwrite(au_to_arg32(3, "flags", (uint32_t)(uap->flags)));
4617 		return;
4618 	}
4619 
4620 	au_uwrite(au_to_arg32(3, "flags", (uint32_t)(uap->flags)));
4621 
4622 	au_uwrite(au_to_socket_ex(so_family, so_type, so_laddr, so_faddr));
4623 
4624 }
4625 
4626 /*
4627  * XXX socket(2) may be equivilent to open(2) on a unix domain
4628  * socket. This needs investigation.
4629  */
4630 
4631 /*ARGSUSED*/
4632 static void
4633 aus_socket(struct t_audit_data *tad)
4634 {
4635 	struct a {
4636 		long	domain;
4637 		long	type;
4638 		long	protocol;
4639 	} *uap = (struct a *)ttolwp(curthread)->lwp_ap;
4640 
4641 	au_uwrite(au_to_arg32(1, "domain", (uint32_t)uap->domain));
4642 	au_uwrite(au_to_arg32(2, "type", (uint32_t)uap->type));
4643 	au_uwrite(au_to_arg32(3, "protocol", (uint32_t)uap->protocol));
4644 }
4645 
4646 /*ARGSUSED*/
4647 static void
4648 aus_sigqueue(struct t_audit_data *tad)
4649 {
4650 	struct a {
4651 		long	pid;
4652 		long	signo;
4653 		long	*val;
4654 	} *uap = (struct a *)ttolwp(curthread)->lwp_ap;
4655 	struct proc *p;
4656 	uid_t uid, ruid;
4657 	gid_t gid, rgid;
4658 	pid_t pid;
4659 	const auditinfo_addr_t *ainfo;
4660 	cred_t *cr;
4661 
4662 	pid = (pid_t)uap->pid;
4663 
4664 	au_uwrite(au_to_arg32(2, "signal", (uint32_t)uap->signo));
4665 	if (pid > 0) {
4666 		mutex_enter(&pidlock);
4667 		if ((p = prfind(pid)) == (struct proc *)0) {
4668 			mutex_exit(&pidlock);
4669 			return;
4670 		}
4671 		mutex_enter(&p->p_lock); /* so process doesn't go away */
4672 		mutex_exit(&pidlock);
4673 
4674 		mutex_enter(&p->p_crlock);
4675 		crhold(cr = p->p_cred);
4676 		mutex_exit(&p->p_crlock);
4677 		mutex_exit(&p->p_lock);
4678 
4679 		ainfo = crgetauinfo(cr);
4680 		if (ainfo == NULL) {
4681 			crfree(cr);
4682 			return;
4683 		}
4684 
4685 		uid  = crgetuid(cr);
4686 		gid  = crgetgid(cr);
4687 		ruid = crgetruid(cr);
4688 		rgid = crgetrgid(cr);
4689 		au_uwrite(au_to_process(uid, gid, ruid, rgid, pid,
4690 		    ainfo->ai_auid, ainfo->ai_asid, &ainfo->ai_termid));
4691 		crfree(cr);
4692 	}
4693 	else
4694 		au_uwrite(au_to_arg32(1, "process ID", (uint32_t)pid));
4695 }
4696 
4697 /*ARGSUSED*/
4698 static void
4699 aus_inst_sync(struct t_audit_data *tad)
4700 {
4701 	struct a {
4702 		long	name;	/* char */
4703 		long	flags;
4704 	} *uap = (struct a *)ttolwp(curthread)->lwp_ap;
4705 
4706 	au_uwrite(au_to_arg32(2, "flags", (uint32_t)uap->flags));
4707 }
4708 
4709 /*ARGSUSED*/
4710 static void
4711 aus_brandsys(struct t_audit_data *tad)
4712 {
4713 	klwp_t *clwp = ttolwp(curthread);
4714 
4715 	struct a {
4716 		long	cmd;
4717 		long	arg1;
4718 		long	arg2;
4719 		long	arg3;
4720 		long	arg4;
4721 		long	arg5;
4722 		long	arg6;
4723 	} *uap = (struct a *)clwp->lwp_ap;
4724 
4725 	au_uwrite(au_to_arg32(1, "cmd", (uint_t)uap->cmd));
4726 #ifdef _LP64
4727 	au_uwrite(au_to_arg64(2, "arg1", (uint64_t)uap->arg1));
4728 	au_uwrite(au_to_arg64(3, "arg2", (uint64_t)uap->arg2));
4729 	au_uwrite(au_to_arg64(4, "arg3", (uint64_t)uap->arg3));
4730 	au_uwrite(au_to_arg64(5, "arg4", (uint64_t)uap->arg4));
4731 	au_uwrite(au_to_arg64(6, "arg5", (uint64_t)uap->arg5));
4732 	au_uwrite(au_to_arg64(7, "arg6", (uint64_t)uap->arg6));
4733 #else
4734 	au_uwrite(au_to_arg32(2, "arg1", (uint32_t)uap->arg1));
4735 	au_uwrite(au_to_arg32(3, "arg2", (uint32_t)uap->arg2));
4736 	au_uwrite(au_to_arg32(4, "arg3", (uint32_t)uap->arg3));
4737 	au_uwrite(au_to_arg32(5, "arg4", (uint32_t)uap->arg4));
4738 	au_uwrite(au_to_arg32(6, "arg5", (uint32_t)uap->arg5));
4739 	au_uwrite(au_to_arg32(7, "arg6", (uint32_t)uap->arg6));
4740 #endif
4741 }
4742 
4743 /*ARGSUSED*/
4744 static void
4745 aus_p_online(struct t_audit_data *tad)
4746 {
4747 	struct a {
4748 		long	processor_id;
4749 		long	flag;
4750 	} *uap = (struct a *)ttolwp(curthread)->lwp_ap;
4751 
4752 	struct flags {
4753 			int	flag;
4754 			char	*cflag;
4755 	} aflags[6] = {
4756 			{ P_ONLINE, "P_ONLINE"},
4757 			{ P_OFFLINE, "P_OFFLINE"},
4758 			{ P_NOINTR, "P_NOINTR"},
4759 			{ P_SPARE, "P_SPARE"},
4760 			{ P_FAULTED, "P_FAULTED"},
4761 			{ P_STATUS, "P_STATUS"}
4762 	};
4763 	int i;
4764 	char *cflag;
4765 
4766 	au_uwrite(au_to_arg32(1, "processor ID", (uint32_t)uap->processor_id));
4767 	au_uwrite(au_to_arg32(2, "flag", (uint32_t)uap->flag));
4768 
4769 	for (i = 0; i < 6; i++) {
4770 		if (aflags[i].flag == uap->flag)
4771 			break;
4772 	}
4773 	cflag = (i == 6) ? "bad flag":aflags[i].cflag;
4774 
4775 	au_uwrite(au_to_text(cflag));
4776 }
4777 
4778 /*ARGSUSED*/
4779 static void
4780 aus_processor_bind(struct t_audit_data *tad)
4781 {
4782 	struct a {
4783 		long	id_type;
4784 		long	id;
4785 		long	processor_id;
4786 		long	obind;
4787 	} *uap = (struct a *)ttolwp(curthread)->lwp_ap;
4788 
4789 	struct proc *p;
4790 	int lwpcnt;
4791 	uid_t uid, ruid;
4792 	gid_t gid, rgid;
4793 	pid_t pid;
4794 	const auditinfo_addr_t *ainfo;
4795 	cred_t *cr;
4796 
4797 	au_uwrite(au_to_arg32(1, "ID type", (uint32_t)uap->id_type));
4798 	au_uwrite(au_to_arg32(2, "ID", (uint32_t)uap->id));
4799 	if (uap->processor_id == PBIND_NONE)
4800 		au_uwrite(au_to_text("PBIND_NONE"));
4801 	else
4802 		au_uwrite(au_to_arg32(3, "processor_id",
4803 					(uint32_t)uap->processor_id));
4804 
4805 	switch (uap->id_type) {
4806 	case P_MYID:
4807 	case P_LWPID:
4808 		mutex_enter(&pidlock);
4809 		p = ttoproc(curthread);
4810 		if (p == NULL || p->p_as == &kas) {
4811 			mutex_exit(&pidlock);
4812 			return;
4813 		}
4814 		mutex_enter(&p->p_lock);
4815 		mutex_exit(&pidlock);
4816 		lwpcnt = p->p_lwpcnt;
4817 		pid  = p->p_pid;
4818 
4819 		mutex_enter(&p->p_crlock);
4820 		crhold(cr = p->p_cred);
4821 		mutex_exit(&p->p_crlock);
4822 		mutex_exit(&p->p_lock);
4823 
4824 		ainfo = crgetauinfo(cr);
4825 		if (ainfo == NULL) {
4826 			crfree(cr);
4827 			return;
4828 		}
4829 
4830 		uid  = crgetuid(cr);
4831 		gid  = crgetgid(cr);
4832 		ruid = crgetruid(cr);
4833 		rgid = crgetrgid(cr);
4834 		au_uwrite(au_to_process(uid, gid, ruid, rgid, pid,
4835 		    ainfo->ai_auid, ainfo->ai_asid, &ainfo->ai_termid));
4836 		crfree(cr);
4837 		break;
4838 	case P_PID:
4839 		mutex_enter(&pidlock);
4840 		p = prfind(uap->id);
4841 		if (p == NULL || p->p_as == &kas) {
4842 			mutex_exit(&pidlock);
4843 			return;
4844 		}
4845 		mutex_enter(&p->p_lock);
4846 		mutex_exit(&pidlock);
4847 		lwpcnt = p->p_lwpcnt;
4848 		pid  = p->p_pid;
4849 
4850 		mutex_enter(&p->p_crlock);
4851 		crhold(cr = p->p_cred);
4852 		mutex_exit(&p->p_crlock);
4853 		mutex_exit(&p->p_lock);
4854 
4855 		ainfo = crgetauinfo(cr);
4856 		if (ainfo == NULL) {
4857 			crfree(cr);
4858 			return;
4859 		}
4860 
4861 		uid  = crgetuid(cr);
4862 		gid  = crgetgid(cr);
4863 		ruid = crgetruid(cr);
4864 		rgid = crgetrgid(cr);
4865 		au_uwrite(au_to_process(uid, gid, ruid, rgid, pid,
4866 		    ainfo->ai_auid, ainfo->ai_asid, &ainfo->ai_termid));
4867 		crfree(cr);
4868 
4869 		break;
4870 	default:
4871 		return;
4872 	}
4873 
4874 	if (uap->processor_id == PBIND_NONE &&
4875 	    (!(uap->id_type == P_LWPID && lwpcnt > 1)))
4876 		au_uwrite(au_to_text("PBIND_NONE for process"));
4877 	else
4878 		au_uwrite(au_to_arg32(3, "processor_id",
4879 					(uint32_t)uap->processor_id));
4880 }
4881 
4882 /*ARGSUSED*/
4883 static au_event_t
4884 aui_doorfs(au_event_t e)
4885 {
4886 	uint32_t code;
4887 
4888 	struct a {		/* doorfs */
4889 		long	a1;
4890 		long	a2;
4891 		long	a3;
4892 		long	a4;
4893 		long	a5;
4894 		long	code;
4895 	} *uap = (struct a *)ttolwp(curthread)->lwp_ap;
4896 
4897 	/*
4898 	 *	audit formats for several of the
4899 	 *	door calls have not yet been determined
4900 	 */
4901 	code = (uint32_t)uap->code;
4902 	switch (code) {
4903 	case DOOR_CALL:
4904 		e = AUE_DOORFS_DOOR_CALL;
4905 		break;
4906 	case DOOR_RETURN:
4907 		e = AUE_NULL;
4908 		break;
4909 	case DOOR_CREATE:
4910 		e = AUE_DOORFS_DOOR_CREATE;
4911 		break;
4912 	case DOOR_REVOKE:
4913 		e = AUE_DOORFS_DOOR_REVOKE;
4914 		break;
4915 	case DOOR_INFO:
4916 		e = AUE_NULL;
4917 		break;
4918 	case DOOR_UCRED:
4919 		e = AUE_NULL;
4920 		break;
4921 	case DOOR_BIND:
4922 		e = AUE_NULL;
4923 		break;
4924 	case DOOR_UNBIND:
4925 		e = AUE_NULL;
4926 		break;
4927 	case DOOR_GETPARAM:
4928 		e = AUE_NULL;
4929 		break;
4930 	case DOOR_SETPARAM:
4931 		e = AUE_NULL;
4932 		break;
4933 	default:	/* illegal system call */
4934 		e = AUE_NULL;
4935 		break;
4936 	}
4937 
4938 	return (e);
4939 }
4940 
4941 static door_node_t *
4942 au_door_lookup(int did)
4943 {
4944 	vnode_t	*vp;
4945 	file_t *fp;
4946 
4947 	if ((fp = getf(did)) == NULL)
4948 		return (NULL);
4949 	/*
4950 	 * Use the underlying vnode (we may be namefs mounted)
4951 	 */
4952 	if (VOP_REALVP(fp->f_vnode, &vp))
4953 		vp = fp->f_vnode;
4954 
4955 	if (vp == NULL || vp->v_type != VDOOR) {
4956 		releasef(did);
4957 		return (NULL);
4958 	}
4959 
4960 	return (VTOD(vp));
4961 }
4962 
4963 /*ARGSUSED*/
4964 static void
4965 aus_doorfs(struct t_audit_data *tad)
4966 {
4967 
4968 	struct a {		/* doorfs */
4969 		long	a1;
4970 		long	a2;
4971 		long	a3;
4972 		long	a4;
4973 		long	a5;
4974 		long	code;
4975 	} *uap = (struct a *)ttolwp(curthread)->lwp_ap;
4976 
4977 	door_node_t	*dp;
4978 	struct proc	*p;
4979 	uint32_t	did;
4980 	uid_t uid, ruid;
4981 	gid_t gid, rgid;
4982 	pid_t pid;
4983 	const auditinfo_addr_t *ainfo;
4984 	cred_t *cr;
4985 
4986 	did = (uint32_t)uap->a1;
4987 
4988 	switch (tad->tad_event) {
4989 	case AUE_DOORFS_DOOR_CALL:
4990 		au_uwrite(au_to_arg32(1, "door ID", (uint32_t)did));
4991 		if ((dp = au_door_lookup(did)) == NULL)
4992 			break;
4993 
4994 		if (DOOR_INVALID(dp)) {
4995 			releasef(did);
4996 			break;
4997 		}
4998 
4999 		if ((p = dp->door_target) == NULL) {
5000 			releasef(did);
5001 			break;
5002 		}
5003 		mutex_enter(&p->p_lock);
5004 		releasef(did);
5005 
5006 		pid  = p->p_pid;
5007 
5008 		mutex_enter(&p->p_crlock);
5009 		crhold(cr = p->p_cred);
5010 		mutex_exit(&p->p_crlock);
5011 		mutex_exit(&p->p_lock);
5012 
5013 		ainfo = crgetauinfo(cr);
5014 		if (ainfo == NULL) {
5015 			crfree(cr);
5016 			return;
5017 		}
5018 		uid  = crgetuid(cr);
5019 		gid  = crgetgid(cr);
5020 		ruid = crgetruid(cr);
5021 		rgid = crgetrgid(cr);
5022 		au_uwrite(au_to_process(uid, gid, ruid, rgid, pid,
5023 		    ainfo->ai_auid, ainfo->ai_asid, &ainfo->ai_termid));
5024 		crfree(cr);
5025 		break;
5026 	case AUE_DOORFS_DOOR_RETURN:
5027 		/*
5028 		 * We may want to write information about
5029 		 * all doors (if any) which will be copied
5030 		 * by this call to the user space
5031 		 */
5032 		break;
5033 	case AUE_DOORFS_DOOR_CREATE:
5034 		au_uwrite(au_to_arg32(3, "door attr", (uint32_t)uap->a3));
5035 		break;
5036 	case AUE_DOORFS_DOOR_REVOKE:
5037 		au_uwrite(au_to_arg32(1, "door ID", (uint32_t)did));
5038 		break;
5039 	case AUE_DOORFS_DOOR_INFO:
5040 		break;
5041 	case AUE_DOORFS_DOOR_CRED:
5042 		break;
5043 	case AUE_DOORFS_DOOR_BIND:
5044 		break;
5045 	case AUE_DOORFS_DOOR_UNBIND: {
5046 		break;
5047 	}
5048 	default:	/* illegal system call */
5049 		break;
5050 	}
5051 }
5052 
5053 /*ARGSUSED*/
5054 static au_event_t
5055 aui_acl(au_event_t e)
5056 {
5057 	struct a {
5058 		union {
5059 			long	name;	/* char */
5060 			long	fd;
5061 		}		obj;
5062 
5063 		long		cmd;
5064 		long		nentries;
5065 		long		arg;	/* aclent_t */
5066 	} *uap = (struct a *)ttolwp(curthread)->lwp_ap;
5067 
5068 	switch (uap->cmd) {
5069 	case SETACL:
5070 		/* ok, acl(SETACL, ...) and facl(SETACL, ...)  are expected. */
5071 		break;
5072 	case GETACL:
5073 	case GETACLCNT:
5074 		/* do nothing for these two values. */
5075 		e = AUE_NULL;
5076 		break;
5077 	default:
5078 		/* illegal system call */
5079 		break;
5080 	}
5081 
5082 	return (e);
5083 }
5084 
5085 
5086 /*ARGSUSED*/
5087 static void
5088 aus_acl(struct t_audit_data *tad)
5089 {
5090 	struct a {
5091 		long	fname;
5092 		long	cmd;
5093 		long	nentries;
5094 		long	aclbufp;
5095 	} *uap = (struct a *)ttolwp(curthread)->lwp_ap;
5096 	struct acl *aclbufp;
5097 
5098 	au_uwrite(au_to_arg32(2, "cmd", (uint32_t)uap->cmd));
5099 	au_uwrite(au_to_arg32(3, "nentries", (uint32_t)uap->nentries));
5100 
5101 	switch (uap->cmd) {
5102 	case GETACL:
5103 	case GETACLCNT:
5104 		break;
5105 	case SETACL:
5106 	    if (uap->nentries < 3)
5107 		break;
5108 	    else {
5109 		size_t a_size = uap->nentries * sizeof (struct acl);
5110 		int i;
5111 
5112 		aclbufp = kmem_alloc(a_size, KM_SLEEP);
5113 		if (copyin((caddr_t)(uap->aclbufp), aclbufp, a_size)) {
5114 			kmem_free(aclbufp, a_size);
5115 			break;
5116 		}
5117 		for (i = 0; i < uap->nentries; i++) {
5118 			au_uwrite(au_to_acl(aclbufp + i));
5119 		}
5120 		kmem_free(aclbufp, a_size);
5121 		break;
5122 	}
5123 	default:
5124 		break;
5125 	}
5126 }
5127 
5128 /*ARGSUSED*/
5129 static void
5130 aus_facl(struct t_audit_data *tad)
5131 {
5132 	struct a {
5133 		long	fd;
5134 		long	cmd;
5135 		long	nentries;
5136 		long	aclbufp;
5137 	} *uap = (struct a *)ttolwp(curthread)->lwp_ap;
5138 	struct file  *fp;
5139 	struct vnode *vp;
5140 	struct f_audit_data *fad;
5141 	struct acl *aclbufp;
5142 	int fd;
5143 
5144 	au_uwrite(au_to_arg32(2, "cmd", (uint32_t)uap->cmd));
5145 	au_uwrite(au_to_arg32(3, "nentries", (uint32_t)uap->nentries));
5146 
5147 	fd = (int)uap->fd;
5148 
5149 	if ((fp = getf(fd)) == NULL)
5150 		return;
5151 
5152 	/* get path from file struct here */
5153 	fad = F2A(fp);
5154 	if (fad->fad_aupath != NULL) {
5155 		au_uwrite(au_to_path(fad->fad_aupath));
5156 	} else {
5157 		au_uwrite(au_to_arg32(1, "no path: fd", (uint32_t)fd));
5158 	}
5159 
5160 	vp = fp->f_vnode;
5161 	audit_attributes(vp);
5162 
5163 	/* decrement file descriptor reference count */
5164 	releasef(fd);
5165 
5166 	switch (uap->cmd) {
5167 	case GETACL:
5168 	case GETACLCNT:
5169 		break;
5170 	case SETACL:
5171 	    if (uap->nentries < 3)
5172 		break;
5173 	    else {
5174 		size_t a_size = uap->nentries * sizeof (struct acl);
5175 		int i;
5176 
5177 		aclbufp = kmem_alloc(a_size, KM_SLEEP);
5178 		if (copyin((caddr_t)(uap->aclbufp), aclbufp, a_size)) {
5179 			kmem_free(aclbufp, a_size);
5180 			break;
5181 		}
5182 		for (i = 0; i < uap->nentries; i++) {
5183 			au_uwrite(au_to_acl(aclbufp + i));
5184 		}
5185 		kmem_free(aclbufp, a_size);
5186 		break;
5187 	}
5188 	default:
5189 		break;
5190 	}
5191 }
5192 
5193 /*ARGSUSED*/
5194 static void
5195 auf_read(tad, error, rval)
5196 	struct t_audit_data *tad;
5197 	int error;
5198 	rval_t *rval;
5199 {
5200 	struct file *fp;
5201 	struct f_audit_data *fad;
5202 	int fd;
5203 	register struct a {
5204 		long	fd;
5205 	} *uap = (struct a *)ttolwp(curthread)->lwp_ap;
5206 	au_kcontext_t	*kctx = SET_KCTX_PZ;
5207 
5208 	fd = (int)uap->fd;
5209 
5210 	/*
5211 	 * convert file pointer to file descriptor
5212 	 *   Note: fd ref count incremented here.
5213 	 */
5214 	if ((fp = getf(fd)) == NULL)
5215 		return;
5216 
5217 	/* get path from file struct here */
5218 	fad = F2A(fp);
5219 	ASSERT(fad);
5220 
5221 	/*
5222 	 * already processed this file for read attempt
5223 	 *
5224 	 * XXX might be better to turn off auditing in a aui_read() routine.
5225 	 */
5226 	if (fad->fad_flags & FAD_READ) {
5227 		/* don't really want to audit every read attempt */
5228 		tad->tad_flag = 0;
5229 		/* free any residual audit data */
5230 		au_close(kctx, &(u_ad), 0, 0, 0);
5231 		releasef(fd);
5232 		return;
5233 	}
5234 	/* mark things so we know what happened and don't repeat things */
5235 	fad->fad_flags |= FAD_READ;
5236 
5237 	if (fad->fad_aupath != NULL) {
5238 		au_uwrite(au_to_path(fad->fad_aupath));
5239 	} else {
5240 		au_uwrite(au_to_arg32(1, "no path: fd", (uint32_t)fd));
5241 	}
5242 
5243 	/* include attributes */
5244 	audit_attributes(fp->f_vnode);
5245 
5246 	/* decrement file descriptor reference count */
5247 	releasef(fd);
5248 }
5249 
5250 /*ARGSUSED*/
5251 static void
5252 auf_write(tad, error, rval)
5253 	struct t_audit_data *tad;
5254 	int error;
5255 	rval_t *rval;
5256 {
5257 	struct file *fp;
5258 	struct f_audit_data *fad;
5259 	int fd;
5260 	register struct a {
5261 		long	fd;
5262 	} *uap = (struct a *)ttolwp(curthread)->lwp_ap;
5263 	au_kcontext_t	*kctx = SET_KCTX_PZ;
5264 
5265 	fd = (int)uap->fd;
5266 
5267 	/*
5268 	 * convert file pointer to file descriptor
5269 	 *   Note: fd ref count incremented here.
5270 	 */
5271 	if ((fp = getf(fd)) == NULL)
5272 		return;
5273 
5274 	/* get path from file struct here */
5275 	fad = F2A(fp);
5276 	ASSERT(fad);
5277 
5278 	/*
5279 	 * already processed this file for write attempt
5280 	 *
5281 	 * XXX might be better to turn off auditing in a aus_write() routine.
5282 	 */
5283 	if (fad->fad_flags & FAD_WRITE) {
5284 		/* don't really want to audit every write attempt */
5285 		tad->tad_flag = 0;
5286 		/* free any residual audit data */
5287 		au_close(kctx, &(u_ad), 0, 0, 0);
5288 		releasef(fd);
5289 		return;
5290 	}
5291 	/* mark things so we know what happened and don't repeat things */
5292 	fad->fad_flags |= FAD_WRITE;
5293 
5294 	if (fad->fad_aupath != NULL) {
5295 		au_uwrite(au_to_path(fad->fad_aupath));
5296 	} else {
5297 		au_uwrite(au_to_arg32(1, "no path: fd", (uint32_t)fd));
5298 	}
5299 
5300 	/* include attributes */
5301 	audit_attributes(fp->f_vnode);
5302 
5303 	/* decrement file descriptor reference count */
5304 	releasef(fd);
5305 }
5306 
5307 /*ARGSUSED*/
5308 static void
5309 auf_recv(tad, error, rval)
5310 	struct t_audit_data *tad;
5311 	int error;
5312 	rval_t *rval;
5313 {
5314 	struct sonode *so;
5315 	char so_laddr[sizeof (struct sockaddr_in6)];
5316 	char so_faddr[sizeof (struct sockaddr_in6)];
5317 	struct file *fp;
5318 	struct f_audit_data *fad;
5319 	int fd;
5320 	int err;
5321 	int len;
5322 	short so_family, so_type;
5323 	register struct a {
5324 		long	fd;
5325 	} *uap = (struct a *)ttolwp(curthread)->lwp_ap;
5326 	au_kcontext_t	*kctx = SET_KCTX_PZ;
5327 
5328 	/*
5329 	 * If there was an error, then nothing to do. Only generate
5330 	 * audit record on first successful recv.
5331 	 */
5332 	if (error) {
5333 		/* Turn off audit record generation here. */
5334 		tad->tad_flag = 0;
5335 		/* free any residual audit data */
5336 		au_close(kctx, &(u_ad), 0, 0, 0);
5337 		return;
5338 	}
5339 
5340 	fd = (int)uap->fd;
5341 
5342 	if ((so = au_getsonode(fd, &err, &fp)) == NULL) {
5343 		/* Turn off audit record generation here. */
5344 		tad->tad_flag = 0;
5345 		/* free any residual audit data */
5346 		au_close(kctx, &(u_ad), 0, 0, 0);
5347 		return;
5348 	}
5349 
5350 	/* get path from file struct here */
5351 	fad = F2A(fp);
5352 	ASSERT(fad);
5353 
5354 	/*
5355 	 * already processed this file for read attempt
5356 	 */
5357 	if (fad->fad_flags & FAD_READ) {
5358 		releasef(fd);
5359 		/* don't really want to audit every recv call */
5360 		tad->tad_flag = 0;
5361 		/* free any residual audit data */
5362 		au_close(kctx, &(u_ad), 0, 0, 0);
5363 		return;
5364 	}
5365 
5366 	/* mark things so we know what happened and don't repeat things */
5367 	fad->fad_flags |= FAD_READ;
5368 
5369 	so_family = so->so_family;
5370 	so_type   = so->so_type;
5371 
5372 	switch (so_family) {
5373 	case AF_INET:
5374 	case AF_INET6:
5375 		/*
5376 		 * Only for connections.
5377 		 * XXX - do we need to worry about SOCK_DGRAM or other types???
5378 		 */
5379 		if (so->so_state & SS_ISBOUND) {
5380 
5381 			bzero((void *)so_laddr, sizeof (so_laddr));
5382 			bzero((void *)so_faddr, sizeof (so_faddr));
5383 
5384 			/* only done once on a connection */
5385 			(void) SOP_GETSOCKNAME(so);
5386 			(void) SOP_GETPEERNAME(so);
5387 
5388 			/* get local and foreign addresses */
5389 			mutex_enter(&so->so_lock);
5390 			len = min(so->so_laddr_len, sizeof (so_laddr));
5391 			bcopy(so->so_laddr_sa, so_laddr, len);
5392 			len = min(so->so_faddr_len, sizeof (so_faddr));
5393 			bcopy(so->so_faddr_sa, so_faddr, len);
5394 			mutex_exit(&so->so_lock);
5395 
5396 			/*
5397 			 * only way to drop out of switch. Note that we
5398 			 * we release fd below.
5399 			 */
5400 
5401 			break;
5402 		}
5403 
5404 		releasef(fd);
5405 
5406 		/* don't really want to audit every recv call */
5407 		tad->tad_flag = 0;
5408 		/* free any residual audit data */
5409 		au_close(kctx, &(u_ad), 0, 0, 0);
5410 
5411 		return;
5412 
5413 	case AF_UNIX:
5414 
5415 		if (fad->fad_aupath != NULL) {
5416 			au_uwrite(au_to_path(fad->fad_aupath));
5417 		} else {
5418 			au_uwrite(au_to_arg32(1, "no path: fd", fd));
5419 		}
5420 
5421 		audit_attributes(fp->f_vnode);
5422 
5423 		releasef(fd);
5424 
5425 		return;
5426 
5427 	default:
5428 		releasef(fd);
5429 
5430 		au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
5431 		au_uwrite(au_to_arg32(1, "family", (uint32_t)so_family));
5432 		au_uwrite(au_to_arg32(1, "type", (uint32_t)so_type));
5433 
5434 		return;
5435 	}
5436 
5437 	releasef(fd);
5438 
5439 	au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
5440 
5441 	au_uwrite(au_to_socket_ex(so_family, so_type, so_laddr, so_faddr));
5442 
5443 }
5444 
5445 /*ARGSUSED*/
5446 static void
5447 auf_send(tad, error, rval)
5448 	struct t_audit_data *tad;
5449 	int error;
5450 	rval_t *rval;
5451 {
5452 	struct sonode *so;
5453 	char so_laddr[sizeof (struct sockaddr_in6)];
5454 	char so_faddr[sizeof (struct sockaddr_in6)];
5455 	struct file *fp;
5456 	struct f_audit_data *fad;
5457 	int fd;
5458 	int err;
5459 	int len;
5460 	short so_family, so_type;
5461 	register struct a {
5462 		long	fd;
5463 	} *uap = (struct a *)ttolwp(curthread)->lwp_ap;
5464 	au_kcontext_t	*kctx = SET_KCTX_PZ;
5465 
5466 	fd = (int)uap->fd;
5467 
5468 	/*
5469 	 * If there was an error, then nothing to do. Only generate
5470 	 * audit record on first successful send.
5471 	 */
5472 	if (error != 0) {
5473 		/* Turn off audit record generation here. */
5474 		tad->tad_flag = 0;
5475 		/* free any residual audit data */
5476 		au_close(kctx, &(u_ad), 0, 0, 0);
5477 		return;
5478 	}
5479 
5480 	fd = (int)uap->fd;
5481 
5482 	if ((so = au_getsonode(fd, &err, &fp)) == NULL) {
5483 		/* Turn off audit record generation here. */
5484 		tad->tad_flag = 0;
5485 		/* free any residual audit data */
5486 		au_close(kctx, &(u_ad), 0, 0, 0);
5487 		return;
5488 	}
5489 
5490 	/* get path from file struct here */
5491 	fad = F2A(fp);
5492 	ASSERT(fad);
5493 
5494 	/*
5495 	 * already processed this file for write attempt
5496 	 */
5497 	if (fad->fad_flags & FAD_WRITE) {
5498 		releasef(fd);
5499 		/* don't really want to audit every send call */
5500 		tad->tad_flag = 0;
5501 		/* free any residual audit data */
5502 		au_close(kctx, &(u_ad), 0, 0, 0);
5503 		return;
5504 	}
5505 
5506 	/* mark things so we know what happened and don't repeat things */
5507 	fad->fad_flags |= FAD_WRITE;
5508 
5509 	so_family = so->so_family;
5510 	so_type   = so->so_type;
5511 
5512 	switch (so_family) {
5513 	case AF_INET:
5514 	case AF_INET6:
5515 		/*
5516 		 * Only for connections.
5517 		 * XXX - do we need to worry about SOCK_DGRAM or other types???
5518 		 */
5519 		if (so->so_state & SS_ISBOUND) {
5520 
5521 			bzero((void *)so_laddr, sizeof (so_laddr));
5522 			bzero((void *)so_faddr, sizeof (so_faddr));
5523 
5524 			/* only done once on a connection */
5525 			(void) SOP_GETSOCKNAME(so);
5526 			(void) SOP_GETPEERNAME(so);
5527 
5528 			/* get local and foreign addresses */
5529 			mutex_enter(&so->so_lock);
5530 			len = min(so->so_laddr_len, sizeof (so_laddr));
5531 			bcopy(so->so_laddr_sa, so_laddr, len);
5532 			len = min(so->so_faddr_len, sizeof (so_faddr));
5533 			bcopy(so->so_faddr_sa, so_faddr, len);
5534 			mutex_exit(&so->so_lock);
5535 
5536 			/*
5537 			 * only way to drop out of switch. Note that we
5538 			 * we release fd below.
5539 			 */
5540 
5541 			break;
5542 		}
5543 
5544 		releasef(fd);
5545 		/* don't really want to audit every send call */
5546 		tad->tad_flag = 0;
5547 		/* free any residual audit data */
5548 		au_close(kctx, &(u_ad), 0, 0, 0);
5549 
5550 		return;
5551 
5552 	case AF_UNIX:
5553 
5554 		if (fad->fad_aupath != NULL) {
5555 			au_uwrite(au_to_path(fad->fad_aupath));
5556 		} else {
5557 			au_uwrite(au_to_arg32(1, "no path: fd", fd));
5558 		}
5559 
5560 		audit_attributes(fp->f_vnode);
5561 
5562 		releasef(fd);
5563 
5564 		return;
5565 
5566 	default:
5567 		releasef(fd);
5568 
5569 		au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
5570 		au_uwrite(au_to_arg32(1, "family", (uint32_t)so_family));
5571 		au_uwrite(au_to_arg32(1, "type", (uint32_t)so_type));
5572 
5573 		return;
5574 	}
5575 
5576 	releasef(fd);
5577 
5578 	au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
5579 
5580 	au_uwrite(au_to_socket_ex(so_family, so_type, so_laddr, so_faddr));
5581 }
5582 
5583 static au_event_t
5584 aui_forksys(au_event_t e)
5585 {
5586 	struct a {
5587 		long	subcode;
5588 		long	flags;
5589 	} *uap = (struct a *)ttolwp(curthread)->lwp_ap;
5590 
5591 	switch ((uint_t)uap->subcode) {
5592 	case 0:
5593 		e = AUE_FORK1;
5594 		break;
5595 	case 1:
5596 		e = AUE_FORKALL;
5597 		break;
5598 	case 2:
5599 		e = AUE_VFORK;
5600 		break;
5601 	default:
5602 		e = AUE_NULL;
5603 		break;
5604 	}
5605 
5606 	return (e);
5607 }
5608