The Design and Implementation of the FreeBSD Operating System, Second Edition
Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]

FreeBSD/Linux Kernel Cross Reference
sys/security/audit/audit_bsm.c

Version: -  FREEBSD  -  FREEBSD-13-STABLE  -  FREEBSD-13-0  -  FREEBSD-12-STABLE  -  FREEBSD-12-0  -  FREEBSD-11-STABLE  -  FREEBSD-11-0  -  FREEBSD-10-STABLE  -  FREEBSD-10-0  -  FREEBSD-9-STABLE  -  FREEBSD-9-0  -  FREEBSD-8-STABLE  -  FREEBSD-8-0  -  FREEBSD-7-STABLE  -  FREEBSD-7-0  -  FREEBSD-6-STABLE  -  FREEBSD-6-0  -  FREEBSD-5-STABLE  -  FREEBSD-5-0  -  FREEBSD-4-STABLE  -  FREEBSD-3-STABLE  -  FREEBSD22  -  l41  -  OPENBSD  -  linux-2.6  -  MK84  -  PLAN9  -  xnu-8792 
SearchContext: -  none  -  3  -  10 

    1 /*
    2  * Copyright (c) 1999-2009 Apple Inc.
    3  * All rights reserved.
    4  *
    5  * Redistribution and use in source and binary forms, with or without
    6  * modification, are permitted provided that the following conditions
    7  * are met:
    8  * 1.  Redistributions of source code must retain the above copyright
    9  *     notice, this list of conditions and the following disclaimer.
   10  * 2.  Redistributions in binary form must reproduce the above copyright
   11  *     notice, this list of conditions and the following disclaimer in the
   12  *     documentation and/or other materials provided with the distribution.
   13  * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
   14  *     its contributors may be used to endorse or promote products derived
   15  *     from this software without specific prior written permission.
   16  *
   17  * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND
   18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
   19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
   20  * ARE DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR
   21  * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
   22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
   23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
   24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
   25  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
   26  * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
   27  * POSSIBILITY OF SUCH DAMAGE.
   28  */
   29 
   30 #include <sys/cdefs.h>
   31 __FBSDID("$FreeBSD: releng/9.1/sys/security/audit/audit_bsm.c 224181 2011-07-18 12:58:18Z jonathan $");
   32 
   33 #include <sys/param.h>
   34 #include <sys/vnode.h>
   35 #include <sys/ipc.h>
   36 #include <sys/lock.h>
   37 #include <sys/malloc.h>
   38 #include <sys/mutex.h>
   39 #include <sys/socket.h>
   40 #include <sys/extattr.h>
   41 #include <sys/fcntl.h>
   42 #include <sys/user.h>
   43 #include <sys/systm.h>
   44 
   45 #include <bsm/audit.h>
   46 #include <bsm/audit_internal.h>
   47 #include <bsm/audit_record.h>
   48 #include <bsm/audit_kevents.h>
   49 
   50 #include <security/audit/audit.h>
   51 #include <security/audit/audit_private.h>
   52 
   53 #include <netinet/in_systm.h>
   54 #include <netinet/in.h>
   55 #include <netinet/ip.h>
   56 
   57 MALLOC_DEFINE(M_AUDITBSM, "audit_bsm", "Audit BSM data");
   58 
   59 static void     audit_sys_auditon(struct audit_record *ar,
   60                     struct au_record *rec);
   61 
   62 /*
   63  * Initialize the BSM auditing subsystem.
   64  */
   65 void
   66 kau_init(void)
   67 {
   68 
   69         au_evclassmap_init();
   70 }
   71 
   72 /*
   73  * This call reserves memory for the audit record.  Memory must be guaranteed
   74  * before any auditable event can be generated.  The au_record structure
   75  * maintains a reference to the memory allocated above and also the list of
   76  * tokens associated with this record.
   77  */
   78 static struct au_record *
   79 kau_open(void)
   80 {
   81         struct au_record *rec;
   82 
   83         rec = malloc(sizeof(*rec), M_AUDITBSM, M_WAITOK);
   84         rec->data = NULL;
   85         TAILQ_INIT(&rec->token_q);
   86         rec->len = 0;
   87         rec->used = 1;
   88 
   89         return (rec);
   90 }
   91 
   92 /*
   93  * Store the token with the record descriptor.
   94  */
   95 static void
   96 kau_write(struct au_record *rec, struct au_token *tok)
   97 {
   98 
   99         KASSERT(tok != NULL, ("kau_write: tok == NULL"));
  100 
  101         TAILQ_INSERT_TAIL(&rec->token_q, tok, tokens);
  102         rec->len += tok->len;
  103 }
  104 
  105 /*
  106  * Close out the audit record by adding the header token, identifying any
  107  * missing tokens.  Write out the tokens to the record memory.
  108  */
  109 static void
  110 kau_close(struct au_record *rec, struct timespec *ctime, short event)
  111 {
  112         u_char *dptr;
  113         size_t tot_rec_size;
  114         token_t *cur, *hdr, *trail;
  115         struct timeval tm;
  116         size_t hdrsize;
  117         struct auditinfo_addr ak;
  118         struct in6_addr *ap;
  119 
  120         audit_get_kinfo(&ak);
  121         hdrsize = 0;
  122         switch (ak.ai_termid.at_type) {
  123         case AU_IPv4:
  124                 hdrsize = (ak.ai_termid.at_addr[0] == INADDR_ANY) ?
  125                     AUDIT_HEADER_SIZE : AUDIT_HEADER_EX_SIZE(&ak);
  126                 break;
  127         case AU_IPv6:
  128                 ap = (struct in6_addr *)&ak.ai_termid.at_addr[0];
  129                 hdrsize = (IN6_IS_ADDR_UNSPECIFIED(ap)) ? AUDIT_HEADER_SIZE :
  130                     AUDIT_HEADER_EX_SIZE(&ak);
  131                 break;
  132         default:
  133                 panic("kau_close: invalid address family");
  134         }
  135         tot_rec_size = rec->len + hdrsize + AUDIT_TRAILER_SIZE;
  136         rec->data = malloc(tot_rec_size, M_AUDITBSM, M_WAITOK | M_ZERO);
  137 
  138         tm.tv_usec = ctime->tv_nsec / 1000;
  139         tm.tv_sec = ctime->tv_sec;
  140         if (hdrsize != AUDIT_HEADER_SIZE)
  141                 hdr = au_to_header32_ex_tm(tot_rec_size, event, 0, tm, &ak);
  142         else
  143                 hdr = au_to_header32_tm(tot_rec_size, event, 0, tm);
  144         TAILQ_INSERT_HEAD(&rec->token_q, hdr, tokens);
  145 
  146         trail = au_to_trailer(tot_rec_size);
  147         TAILQ_INSERT_TAIL(&rec->token_q, trail, tokens);
  148 
  149         rec->len = tot_rec_size;
  150         dptr = rec->data;
  151         TAILQ_FOREACH(cur, &rec->token_q, tokens) {
  152                 memcpy(dptr, cur->t_data, cur->len);
  153                 dptr += cur->len;
  154         }
  155 }
  156 
  157 /*
  158  * Free a BSM audit record by releasing all the tokens and clearing the audit
  159  * record information.
  160  */
  161 void
  162 kau_free(struct au_record *rec)
  163 {
  164         struct au_token *tok;
  165 
  166         /* Free the token list. */
  167         while ((tok = TAILQ_FIRST(&rec->token_q))) {
  168                 TAILQ_REMOVE(&rec->token_q, tok, tokens);
  169                 free(tok->t_data, M_AUDITBSM);
  170                 free(tok, M_AUDITBSM);
  171         }
  172 
  173         rec->used = 0;
  174         rec->len = 0;
  175         free(rec->data, M_AUDITBSM);
  176         free(rec, M_AUDITBSM);
  177 }
  178 
  179 /*
  180  * XXX: May want turn some (or all) of these macros into functions in order
  181  * to reduce the generated code size.
  182  *
  183  * XXXAUDIT: These macros assume that 'kar', 'ar', 'rec', and 'tok' in the
  184  * caller are OK with this.
  185  */
  186 #define ATFD1_TOKENS(argnum) do {                                       \
  187         if (ARG_IS_VALID(kar, ARG_ATFD1)) {                             \
  188                 tok = au_to_arg32(argnum, "at fd 1", ar->ar_arg_atfd1); \
  189                 kau_write(rec, tok);                                    \
  190         }                                                               \
  191 } while (0)
  192 
  193 #define ATFD2_TOKENS(argnum) do {                                       \
  194         if (ARG_IS_VALID(kar, ARG_ATFD2)) {                             \
  195                 tok = au_to_arg32(argnum, "at fd 2", ar->ar_arg_atfd2); \
  196                 kau_write(rec, tok);                                    \
  197         }                                                               \
  198 } while (0)
  199 
  200 #define UPATH1_TOKENS do {                                              \
  201         if (ARG_IS_VALID(kar, ARG_UPATH1)) {                            \
  202                 tok = au_to_path(ar->ar_arg_upath1);                    \
  203                 kau_write(rec, tok);                                    \
  204         }                                                               \
  205 } while (0)
  206 
  207 #define UPATH2_TOKENS do {                                              \
  208         if (ARG_IS_VALID(kar, ARG_UPATH2)) {                            \
  209                 tok = au_to_path(ar->ar_arg_upath2);                    \
  210                 kau_write(rec, tok);                                    \
  211         }                                                               \
  212 } while (0)
  213 
  214 #define VNODE1_TOKENS do {                                              \
  215         if (ARG_IS_VALID(kar, ARG_ATFD)) {                              \
  216                 tok = au_to_arg32(1, "at fd", ar->ar_arg_atfd);         \
  217                 kau_write(rec, tok);                                    \
  218         }                                                               \
  219         if (ARG_IS_VALID(kar, ARG_VNODE1)) {                            \
  220                 tok = au_to_attr32(&ar->ar_arg_vnode1);                 \
  221                 kau_write(rec, tok);                                    \
  222         }                                                               \
  223 } while (0)
  224 
  225 #define UPATH1_VNODE1_TOKENS do {                                       \
  226         if (ARG_IS_VALID(kar, ARG_UPATH1)) {                            \
  227                 UPATH1_TOKENS;                                          \
  228         }                                                               \
  229         if (ARG_IS_VALID(kar, ARG_VNODE1)) {                            \
  230                 tok = au_to_attr32(&ar->ar_arg_vnode1);                 \
  231                 kau_write(rec, tok);                                    \
  232         }                                                               \
  233 } while (0)
  234 
  235 #define VNODE2_TOKENS do {                                              \
  236         if (ARG_IS_VALID(kar, ARG_VNODE2)) {                            \
  237                 tok = au_to_attr32(&ar->ar_arg_vnode2);                 \
  238                 kau_write(rec, tok);                                    \
  239         }                                                               \
  240 } while (0)
  241 
  242 #define FD_VNODE1_TOKENS do {                                           \
  243         if (ARG_IS_VALID(kar, ARG_VNODE1)) {                            \
  244                 if (ARG_IS_VALID(kar, ARG_FD)) {                        \
  245                         tok = au_to_arg32(1, "fd", ar->ar_arg_fd);      \
  246                         kau_write(rec, tok);                            \
  247                 }                                                       \
  248                 tok = au_to_attr32(&ar->ar_arg_vnode1);                 \
  249                 kau_write(rec, tok);                                    \
  250         } else {                                                        \
  251                 if (ARG_IS_VALID(kar, ARG_FD)) {                        \
  252                         tok = au_to_arg32(1, "non-file: fd",            \
  253                             ar->ar_arg_fd);                             \
  254                         kau_write(rec, tok);                            \
  255                 }                                                       \
  256         }                                                               \
  257 } while (0)
  258 
  259 #define PROCESS_PID_TOKENS(argn) do {                                   \
  260         if ((ar->ar_arg_pid > 0) /* Reference a single process */       \
  261             && (ARG_IS_VALID(kar, ARG_PROCESS))) {                      \
  262                 tok = au_to_process32_ex(ar->ar_arg_auid,               \
  263                     ar->ar_arg_euid, ar->ar_arg_egid,                   \
  264                     ar->ar_arg_ruid, ar->ar_arg_rgid,                   \
  265                     ar->ar_arg_pid, ar->ar_arg_asid,                    \
  266                     &ar->ar_arg_termid_addr);                           \
  267                 kau_write(rec, tok);                                    \
  268         } else if (ARG_IS_VALID(kar, ARG_PID)) {                        \
  269                 tok = au_to_arg32(argn, "process", ar->ar_arg_pid);     \
  270                 kau_write(rec, tok);                                    \
  271         }                                                               \
  272 } while (0)
  273 
  274 #define EXTATTR_TOKENS(namespace_argnum) do {                           \
  275         if (ARG_IS_VALID(kar, ARG_VALUE)) {                             \
  276                 switch (ar->ar_arg_value) {                             \
  277                 case EXTATTR_NAMESPACE_USER:                            \
  278                         tok = au_to_text(EXTATTR_NAMESPACE_USER_STRING);\
  279                         break;                                          \
  280                 case EXTATTR_NAMESPACE_SYSTEM:                          \
  281                         tok = au_to_text(EXTATTR_NAMESPACE_SYSTEM_STRING);\
  282                         break;                                          \
  283                 default:                                                \
  284                         tok = au_to_arg32((namespace_argnum),           \
  285                             "attrnamespace", ar->ar_arg_value);         \
  286                         break;                                          \
  287                 }                                                       \
  288                 kau_write(rec, tok);                                    \
  289         }                                                               \
  290         /* attrname is in the text field */                             \
  291         if (ARG_IS_VALID(kar, ARG_TEXT)) {                              \
  292                 tok = au_to_text(ar->ar_arg_text);                      \
  293                 kau_write(rec, tok);                                    \
  294         }                                                               \
  295 } while (0)
  296 
  297 /*
  298  * Not all pointer arguments to system calls are of interest, but in some
  299  * cases they reflect delegation of rights, such as mmap(2) followed by
  300  * minherit(2) before execve(2), so do the best we can.
  301  */
  302 #define ADDR_TOKEN(argnum, argname) do {                                \
  303         if (ARG_IS_VALID(kar, ARG_ADDR)) {                              \
  304                 if (sizeof(void *) == sizeof(uint32_t))                 \
  305                         tok = au_to_arg32((argnum), (argname),          \
  306                             (uint32_t)(uintptr_t)ar->ar_arg_addr);      \
  307                 else                                                    \
  308                         tok = au_to_arg64((argnum), (argname),          \
  309                             (uint64_t)(uintptr_t)ar->ar_arg_addr);      \
  310                 kau_write(rec, tok);                                    \
  311         }                                                               \
  312 } while (0)
  313 
  314 
  315 /*
  316  * Implement auditing for the auditon() system call. The audit tokens that
  317  * are generated depend on the command that was sent into the auditon()
  318  * system call.
  319  */
  320 static void
  321 audit_sys_auditon(struct audit_record *ar, struct au_record *rec)
  322 {
  323         struct au_token *tok;
  324 
  325         tok = au_to_arg32(3, "length", ar->ar_arg_len);
  326         kau_write(rec, tok);
  327         switch (ar->ar_arg_cmd) {
  328         case A_OLDSETPOLICY:
  329                 if ((size_t)ar->ar_arg_len == sizeof(int64_t)) {
  330                         tok = au_to_arg64(2, "policy",
  331                             ar->ar_arg_auditon.au_policy64);
  332                         kau_write(rec, tok);
  333                         break;
  334                 }
  335                 /* FALLTHROUGH */
  336 
  337         case A_SETPOLICY:
  338                 tok = au_to_arg32(2, "policy", ar->ar_arg_auditon.au_policy);
  339                 kau_write(rec, tok);
  340                 break;
  341 
  342         case A_SETKMASK:
  343                 tok = au_to_arg32(2, "setkmask:as_success",
  344                     ar->ar_arg_auditon.au_mask.am_success);
  345                 kau_write(rec, tok);
  346                 tok = au_to_arg32(2, "setkmask:as_failure",
  347                     ar->ar_arg_auditon.au_mask.am_failure);
  348                 kau_write(rec, tok);
  349                 break;
  350 
  351         case A_OLDSETQCTRL:
  352                 if ((size_t)ar->ar_arg_len == sizeof(au_qctrl64_t)) {
  353                         tok = au_to_arg64(2, "setqctrl:aq_hiwater",
  354                             ar->ar_arg_auditon.au_qctrl64.aq64_hiwater);
  355                         kau_write(rec, tok);
  356                         tok = au_to_arg64(2, "setqctrl:aq_lowater",
  357                             ar->ar_arg_auditon.au_qctrl64.aq64_lowater);
  358                         kau_write(rec, tok);
  359                         tok = au_to_arg64(2, "setqctrl:aq_bufsz",
  360                             ar->ar_arg_auditon.au_qctrl64.aq64_bufsz);
  361                         kau_write(rec, tok);
  362                         tok = au_to_arg64(2, "setqctrl:aq_delay",
  363                             ar->ar_arg_auditon.au_qctrl64.aq64_delay);
  364                         kau_write(rec, tok);
  365                         tok = au_to_arg64(2, "setqctrl:aq_minfree",
  366                             ar->ar_arg_auditon.au_qctrl64.aq64_minfree);
  367                         kau_write(rec, tok);
  368                         break;
  369                 }
  370                 /* FALLTHROUGH */
  371 
  372         case A_SETQCTRL:
  373                 tok = au_to_arg32(2, "setqctrl:aq_hiwater",
  374                     ar->ar_arg_auditon.au_qctrl.aq_hiwater);
  375                 kau_write(rec, tok);
  376                 tok = au_to_arg32(2, "setqctrl:aq_lowater",
  377                     ar->ar_arg_auditon.au_qctrl.aq_lowater);
  378                 kau_write(rec, tok);
  379                 tok = au_to_arg32(2, "setqctrl:aq_bufsz",
  380                     ar->ar_arg_auditon.au_qctrl.aq_bufsz);
  381                 kau_write(rec, tok);
  382                 tok = au_to_arg32(2, "setqctrl:aq_delay",
  383                     ar->ar_arg_auditon.au_qctrl.aq_delay);
  384                 kau_write(rec, tok);
  385                 tok = au_to_arg32(2, "setqctrl:aq_minfree",
  386                     ar->ar_arg_auditon.au_qctrl.aq_minfree);
  387                 kau_write(rec, tok);
  388                 break;
  389 
  390         case A_SETUMASK:
  391                 tok = au_to_arg32(2, "setumask:as_success",
  392                     ar->ar_arg_auditon.au_auinfo.ai_mask.am_success);
  393                 kau_write(rec, tok);
  394                 tok = au_to_arg32(2, "setumask:as_failure",
  395                     ar->ar_arg_auditon.au_auinfo.ai_mask.am_failure);
  396                 kau_write(rec, tok);
  397                 break;
  398 
  399         case A_SETSMASK:
  400                 tok = au_to_arg32(2, "setsmask:as_success",
  401                     ar->ar_arg_auditon.au_auinfo.ai_mask.am_success);
  402                 kau_write(rec, tok);
  403                 tok = au_to_arg32(2, "setsmask:as_failure",
  404                     ar->ar_arg_auditon.au_auinfo.ai_mask.am_failure);
  405                 kau_write(rec, tok);
  406                 break;
  407 
  408         case A_OLDSETCOND:
  409                 if ((size_t)ar->ar_arg_len == sizeof(int64_t)) {
  410                         tok = au_to_arg64(2, "setcond",
  411                             ar->ar_arg_auditon.au_cond64);
  412                         kau_write(rec, tok);
  413                         break;
  414                 }
  415                 /* FALLTHROUGH */
  416 
  417         case A_SETCOND:
  418                 tok = au_to_arg32(2, "setcond", ar->ar_arg_auditon.au_cond);
  419                 kau_write(rec, tok);
  420                 break;
  421 
  422         case A_SETCLASS:
  423                 kau_write(rec, tok);
  424                 tok = au_to_arg32(2, "setclass:ec_event",
  425                     ar->ar_arg_auditon.au_evclass.ec_number);
  426                 kau_write(rec, tok);
  427                 tok = au_to_arg32(2, "setclass:ec_class",
  428                     ar->ar_arg_auditon.au_evclass.ec_class);
  429                 kau_write(rec, tok);
  430                 break;
  431 
  432         case A_SETPMASK:
  433                 tok = au_to_arg32(2, "setpmask:as_success",
  434                     ar->ar_arg_auditon.au_aupinfo.ap_mask.am_success);
  435                 kau_write(rec, tok);
  436                 tok = au_to_arg32(2, "setpmask:as_failure",
  437                     ar->ar_arg_auditon.au_aupinfo.ap_mask.am_failure);
  438                 kau_write(rec, tok);
  439                 break;
  440 
  441         case A_SETFSIZE:
  442                 tok = au_to_arg32(2, "setfsize:filesize",
  443                     ar->ar_arg_auditon.au_fstat.af_filesz);
  444                 kau_write(rec, tok);
  445                 break;
  446 
  447         default:
  448                 break;
  449         }
  450 }
  451 
  452 /*
  453  * Convert an internal kernel audit record to a BSM record and return a
  454  * success/failure indicator. The BSM record is passed as an out parameter to
  455  * this function.
  456  *
  457  * Return conditions:
  458  *   BSM_SUCCESS: The BSM record is valid
  459  *   BSM_FAILURE: Failure; the BSM record is NULL.
  460  *   BSM_NOAUDIT: The event is not auditable for BSM; the BSM record is NULL.
  461  */
  462 int
  463 kaudit_to_bsm(struct kaudit_record *kar, struct au_record **pau)
  464 {
  465         struct au_token *tok, *subj_tok;
  466         struct au_record *rec;
  467         au_tid_t tid;
  468         struct audit_record *ar;
  469         int ctr;
  470 
  471         KASSERT(kar != NULL, ("kaudit_to_bsm: kar == NULL"));
  472 
  473         *pau = NULL;
  474         ar = &kar->k_ar;
  475         rec = kau_open();
  476 
  477         /*
  478          * Create the subject token.
  479          */
  480         switch (ar->ar_subj_term_addr.at_type) {
  481         case AU_IPv4:
  482                 tid.port = ar->ar_subj_term_addr.at_port;
  483                 tid.machine = ar->ar_subj_term_addr.at_addr[0];
  484                 subj_tok = au_to_subject32(ar->ar_subj_auid,  /* audit ID */
  485                     ar->ar_subj_cred.cr_uid, /* eff uid */
  486                     ar->ar_subj_egid,   /* eff group id */
  487                     ar->ar_subj_ruid,   /* real uid */
  488                     ar->ar_subj_rgid,   /* real group id */
  489                     ar->ar_subj_pid,    /* process id */
  490                     ar->ar_subj_asid,   /* session ID */
  491                     &tid);
  492                 break;
  493         case AU_IPv6:
  494                 subj_tok = au_to_subject32_ex(ar->ar_subj_auid,
  495                     ar->ar_subj_cred.cr_uid,
  496                     ar->ar_subj_egid,
  497                     ar->ar_subj_ruid,
  498                     ar->ar_subj_rgid,
  499                     ar->ar_subj_pid,
  500                     ar->ar_subj_asid,
  501                     &ar->ar_subj_term_addr);
  502                 break;
  503         default:
  504                 bzero(&tid, sizeof(tid));
  505                 subj_tok = au_to_subject32(ar->ar_subj_auid,
  506                     ar->ar_subj_cred.cr_uid,
  507                     ar->ar_subj_egid,
  508                     ar->ar_subj_ruid,
  509                     ar->ar_subj_rgid,
  510                     ar->ar_subj_pid,
  511                     ar->ar_subj_asid,
  512                     &tid);
  513         }
  514 
  515         /*
  516          * The logic inside each case fills in the tokens required for the
  517          * event, except for the header, trailer, and return tokens.  The
  518          * header and trailer tokens are added by the kau_close() function.
  519          * The return token is added outside of the switch statement.
  520          */
  521         switch(ar->ar_event) {
  522         case AUE_ACCEPT:
  523         case AUE_BIND:
  524         case AUE_LISTEN:
  525         case AUE_CONNECT:
  526         case AUE_RECV:
  527         case AUE_RECVFROM:
  528         case AUE_RECVMSG:
  529         case AUE_SEND:
  530         case AUE_SENDFILE:
  531         case AUE_SENDMSG:
  532         case AUE_SENDTO:
  533                 /*
  534                  * Socket-related events.
  535                  */
  536                 if (ARG_IS_VALID(kar, ARG_FD)) {
  537                         tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
  538                         kau_write(rec, tok);
  539                 }
  540                 if (ARG_IS_VALID(kar, ARG_SADDRINET)) {
  541                         tok = au_to_sock_inet((struct sockaddr_in *)
  542                             &ar->ar_arg_sockaddr);
  543                         kau_write(rec, tok);
  544                 }
  545                 if (ARG_IS_VALID(kar, ARG_SADDRUNIX)) {
  546                         tok = au_to_sock_unix((struct sockaddr_un *)
  547                             &ar->ar_arg_sockaddr);
  548                         kau_write(rec, tok);
  549                         UPATH1_TOKENS;
  550                 }
  551                 /* XXX Need to handle ARG_SADDRINET6 */
  552                 break;
  553 
  554         case AUE_SOCKET:
  555         case AUE_SOCKETPAIR:
  556                 if (ARG_IS_VALID(kar, ARG_SOCKINFO)) {
  557                         tok = au_to_arg32(1, "domain",
  558                             ar->ar_arg_sockinfo.so_domain);
  559                         kau_write(rec, tok);
  560                         tok = au_to_arg32(2, "type",
  561                             ar->ar_arg_sockinfo.so_type);
  562                         kau_write(rec, tok);
  563                         tok = au_to_arg32(3, "protocol",
  564                             ar->ar_arg_sockinfo.so_protocol);
  565                         kau_write(rec, tok);
  566                 }
  567                 break;
  568 
  569         case AUE_SETSOCKOPT:
  570         case AUE_SHUTDOWN:
  571                 if (ARG_IS_VALID(kar, ARG_FD)) {
  572                         tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
  573                         kau_write(rec, tok);
  574                 }
  575                 break;
  576 
  577         case AUE_ACCT:
  578                 if (ARG_IS_VALID(kar, ARG_UPATH1)) {
  579                         UPATH1_VNODE1_TOKENS;
  580                 } else {
  581                         tok = au_to_arg32(1, "accounting off", 0);
  582                         kau_write(rec, tok);
  583                 }
  584                 break;
  585 
  586         case AUE_SETAUID:
  587                 if (ARG_IS_VALID(kar, ARG_AUID)) {
  588                         tok = au_to_arg32(2, "setauid", ar->ar_arg_auid);
  589                         kau_write(rec, tok);
  590                 }
  591                 break;
  592 
  593         case AUE_SETAUDIT:
  594                 if (ARG_IS_VALID(kar, ARG_AUID) &&
  595                     ARG_IS_VALID(kar, ARG_ASID) &&
  596                     ARG_IS_VALID(kar, ARG_AMASK) &&
  597                     ARG_IS_VALID(kar, ARG_TERMID)) {
  598                         tok = au_to_arg32(1, "setaudit:auid",
  599                             ar->ar_arg_auid);
  600                         kau_write(rec, tok);
  601                         tok = au_to_arg32(1, "setaudit:port",
  602                             ar->ar_arg_termid.port);
  603                         kau_write(rec, tok);
  604                         tok = au_to_arg32(1, "setaudit:machine",
  605                             ar->ar_arg_termid.machine);
  606                         kau_write(rec, tok);
  607                         tok = au_to_arg32(1, "setaudit:as_success",
  608                             ar->ar_arg_amask.am_success);
  609                         kau_write(rec, tok);
  610                         tok = au_to_arg32(1, "setaudit:as_failure",
  611                             ar->ar_arg_amask.am_failure);
  612                         kau_write(rec, tok);
  613                         tok = au_to_arg32(1, "setaudit:asid",
  614                             ar->ar_arg_asid);
  615                         kau_write(rec, tok);
  616                 }
  617                 break;
  618 
  619         case AUE_SETAUDIT_ADDR:
  620                 if (ARG_IS_VALID(kar, ARG_AUID) &&
  621                     ARG_IS_VALID(kar, ARG_ASID) &&
  622                     ARG_IS_VALID(kar, ARG_AMASK) &&
  623                     ARG_IS_VALID(kar, ARG_TERMID_ADDR)) {
  624                         tok = au_to_arg32(1, "setaudit_addr:auid",
  625                             ar->ar_arg_auid);
  626                         kau_write(rec, tok);
  627                         tok = au_to_arg32(1, "setaudit_addr:as_success",
  628                             ar->ar_arg_amask.am_success);
  629                         kau_write(rec, tok);
  630                         tok = au_to_arg32(1, "setaudit_addr:as_failure",
  631                             ar->ar_arg_amask.am_failure);
  632                         kau_write(rec, tok);
  633                         tok = au_to_arg32(1, "setaudit_addr:asid",
  634                             ar->ar_arg_asid);
  635                         kau_write(rec, tok);
  636                         tok = au_to_arg32(1, "setaudit_addr:type",
  637                             ar->ar_arg_termid_addr.at_type);
  638                         kau_write(rec, tok);
  639                         tok = au_to_arg32(1, "setaudit_addr:port",
  640                             ar->ar_arg_termid_addr.at_port);
  641                         kau_write(rec, tok);
  642                         if (ar->ar_arg_termid_addr.at_type == AU_IPv6)
  643                                 tok = au_to_in_addr_ex((struct in6_addr *)
  644                                     &ar->ar_arg_termid_addr.at_addr[0]);
  645                         if (ar->ar_arg_termid_addr.at_type == AU_IPv4)
  646                                 tok = au_to_in_addr((struct in_addr *)
  647                                     &ar->ar_arg_termid_addr.at_addr[0]);
  648                         kau_write(rec, tok);
  649                 }
  650                 break;
  651 
  652         case AUE_AUDITON:
  653                 /*
  654                  * For AUDITON commands without own event, audit the cmd.
  655                  */
  656                 if (ARG_IS_VALID(kar, ARG_CMD)) {
  657                         tok = au_to_arg32(1, "cmd", ar->ar_arg_cmd);
  658                         kau_write(rec, tok);
  659                 }
  660                 /* FALLTHROUGH */
  661 
  662         case AUE_AUDITON_GETCAR:
  663         case AUE_AUDITON_GETCLASS:
  664         case AUE_AUDITON_GETCOND:
  665         case AUE_AUDITON_GETCWD:
  666         case AUE_AUDITON_GETKMASK:
  667         case AUE_AUDITON_GETSTAT:
  668         case AUE_AUDITON_GPOLICY:
  669         case AUE_AUDITON_GQCTRL:
  670         case AUE_AUDITON_SETCLASS:
  671         case AUE_AUDITON_SETCOND:
  672         case AUE_AUDITON_SETKMASK:
  673         case AUE_AUDITON_SETSMASK:
  674         case AUE_AUDITON_SETSTAT:
  675         case AUE_AUDITON_SETUMASK:
  676         case AUE_AUDITON_SPOLICY:
  677         case AUE_AUDITON_SQCTRL:
  678                 if (ARG_IS_VALID(kar, ARG_AUDITON))
  679                         audit_sys_auditon(ar, rec);
  680                 break;
  681 
  682         case AUE_AUDITCTL:
  683                 UPATH1_VNODE1_TOKENS;
  684                 break;
  685 
  686         case AUE_EXIT:
  687                 if (ARG_IS_VALID(kar, ARG_EXIT)) {
  688                         tok = au_to_exit(ar->ar_arg_exitretval,
  689                             ar->ar_arg_exitstatus);
  690                         kau_write(rec, tok);
  691                 }
  692                 break;
  693 
  694         case AUE_ADJTIME:
  695         case AUE_CLOCK_SETTIME:
  696         case AUE_AUDIT:
  697         case AUE_DUP2:
  698         case AUE_GETAUDIT:
  699         case AUE_GETAUDIT_ADDR:
  700         case AUE_GETAUID:
  701         case AUE_GETCWD:
  702         case AUE_GETFSSTAT:
  703         case AUE_GETRESUID:
  704         case AUE_GETRESGID:
  705         case AUE_KQUEUE:
  706         case AUE_MODLOAD:
  707         case AUE_MODUNLOAD:
  708         case AUE_MSGSYS:
  709         case AUE_NTP_ADJTIME:
  710         case AUE_PIPE:
  711         case AUE_POSIX_OPENPT:
  712         case AUE_PROFILE:
  713         case AUE_RTPRIO:
  714         case AUE_SEMSYS:
  715         case AUE_SHMSYS:
  716         case AUE_SETPGRP:
  717         case AUE_SETRLIMIT:
  718         case AUE_SETSID:
  719         case AUE_SETTIMEOFDAY:
  720         case AUE_SYSARCH:
  721 
  722                 /*
  723                  * Header, subject, and return tokens added at end.
  724                  */
  725                 break;
  726 
  727         case AUE_MKFIFO:
  728                 if (ARG_IS_VALID(kar, ARG_MODE)) {
  729                         tok = au_to_arg32(2, "mode", ar->ar_arg_mode);
  730                         kau_write(rec, tok);
  731                 }
  732                 /* FALLTHROUGH */
  733 
  734         case AUE_CHDIR:
  735         case AUE_CHROOT:
  736         case AUE_FSTATAT:
  737         case AUE_FUTIMESAT:
  738         case AUE_GETATTRLIST:
  739         case AUE_JAIL:
  740         case AUE_LUTIMES:
  741         case AUE_NFS_GETFH:
  742         case AUE_LSTAT:
  743         case AUE_LPATHCONF:
  744         case AUE_PATHCONF:
  745         case AUE_READLINK:
  746         case AUE_REVOKE:
  747         case AUE_RMDIR:
  748         case AUE_SEARCHFS:
  749         case AUE_SETATTRLIST:
  750         case AUE_STAT:
  751         case AUE_STATFS:
  752         case AUE_SWAPON:
  753         case AUE_SWAPOFF:
  754         case AUE_TRUNCATE:
  755         case AUE_UNDELETE:
  756         case AUE_UNLINK:
  757         case AUE_UNLINKAT:
  758         case AUE_UTIMES:
  759                 ATFD1_TOKENS(1);
  760                 UPATH1_VNODE1_TOKENS;
  761                 break;
  762 
  763         case AUE_ACCESS:
  764         case AUE_EACCESS:
  765                 UPATH1_VNODE1_TOKENS;
  766                 if (ARG_IS_VALID(kar, ARG_VALUE)) {
  767                         tok = au_to_arg32(2, "mode", ar->ar_arg_value);
  768                         kau_write(rec, tok);
  769                 }
  770                 break;
  771 
  772         case AUE_FHSTATFS:
  773         case AUE_FHOPEN:
  774         case AUE_FHSTAT:
  775                 /* XXXRW: Need to audit vnode argument. */
  776                 break;
  777 
  778         case AUE_CHFLAGS:
  779         case AUE_LCHFLAGS:
  780                 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
  781                         tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
  782                         kau_write(rec, tok);
  783                 }
  784                 UPATH1_VNODE1_TOKENS;
  785                 break;
  786 
  787         case AUE_CHMOD:
  788         case AUE_LCHMOD:
  789                 if (ARG_IS_VALID(kar, ARG_MODE)) {
  790                         tok = au_to_arg32(2, "new file mode",
  791                             ar->ar_arg_mode);
  792                         kau_write(rec, tok);
  793                 }
  794                 UPATH1_VNODE1_TOKENS;
  795                 break;
  796 
  797         case AUE_FCHMODAT:
  798                 ATFD1_TOKENS(1);
  799                 if (ARG_IS_VALID(kar, ARG_MODE)) {
  800                         tok = au_to_arg32(3, "new file mode",
  801                             ar->ar_arg_mode);
  802                         kau_write(rec, tok);
  803                 }
  804                 UPATH1_VNODE1_TOKENS;
  805                 break;
  806 
  807         case AUE_CHOWN:
  808         case AUE_LCHOWN:
  809                 if (ARG_IS_VALID(kar, ARG_UID)) {
  810                         tok = au_to_arg32(2, "new file uid", ar->ar_arg_uid);
  811                         kau_write(rec, tok);
  812                 }
  813                 if (ARG_IS_VALID(kar, ARG_GID)) {
  814                         tok = au_to_arg32(3, "new file gid", ar->ar_arg_gid);
  815                         kau_write(rec, tok);
  816                 }
  817                 UPATH1_VNODE1_TOKENS;
  818                 break;
  819 
  820         case AUE_FCHOWNAT:
  821                 ATFD1_TOKENS(1);
  822                 if (ARG_IS_VALID(kar, ARG_UID)) {
  823                         tok = au_to_arg32(3, "new file uid", ar->ar_arg_uid);
  824                         kau_write(rec, tok);
  825                 }
  826                 if (ARG_IS_VALID(kar, ARG_GID)) {
  827                         tok = au_to_arg32(4, "new file gid", ar->ar_arg_gid);
  828                         kau_write(rec, tok);
  829                 }
  830                 UPATH1_VNODE1_TOKENS;
  831                 break;
  832 
  833         case AUE_EXCHANGEDATA:
  834                 UPATH1_VNODE1_TOKENS;
  835                 UPATH2_TOKENS;
  836                 break;
  837 
  838         case AUE_CLOSE:
  839                 if (ARG_IS_VALID(kar, ARG_FD)) {
  840                         tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
  841                         kau_write(rec, tok);
  842                 }
  843                 UPATH1_VNODE1_TOKENS;
  844                 break;
  845 
  846         case AUE_CLOSEFROM:
  847                 if (ARG_IS_VALID(kar, ARG_FD)) {
  848                         tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
  849                         kau_write(rec, tok);
  850                 }
  851                 break;
  852 
  853         case AUE_CORE:
  854                 if (ARG_IS_VALID(kar, ARG_SIGNUM)) {
  855                         tok = au_to_arg32(1, "signal", ar->ar_arg_signum);
  856                         kau_write(rec, tok);
  857                 }
  858                 UPATH1_VNODE1_TOKENS;
  859                 break;
  860 
  861         case AUE_EXTATTRCTL:
  862                 UPATH1_VNODE1_TOKENS;
  863                 if (ARG_IS_VALID(kar, ARG_CMD)) {
  864                         tok = au_to_arg32(2, "cmd", ar->ar_arg_cmd);
  865                         kau_write(rec, tok);
  866                 }
  867                 /* extattrctl(2) filename parameter is in upath2/vnode2 */
  868                 UPATH2_TOKENS;
  869                 VNODE2_TOKENS;
  870                 EXTATTR_TOKENS(4);
  871                 break;
  872 
  873         case AUE_EXTATTR_GET_FILE:
  874         case AUE_EXTATTR_SET_FILE:
  875         case AUE_EXTATTR_LIST_FILE:
  876         case AUE_EXTATTR_DELETE_FILE:
  877         case AUE_EXTATTR_GET_LINK:
  878         case AUE_EXTATTR_SET_LINK:
  879         case AUE_EXTATTR_LIST_LINK:
  880         case AUE_EXTATTR_DELETE_LINK:
  881                 UPATH1_VNODE1_TOKENS;
  882                 EXTATTR_TOKENS(2);
  883                 break;
  884 
  885         case AUE_EXTATTR_GET_FD:
  886         case AUE_EXTATTR_SET_FD:
  887         case AUE_EXTATTR_LIST_FD:
  888         case AUE_EXTATTR_DELETE_FD:
  889                 if (ARG_IS_VALID(kar, ARG_FD)) {
  890                         tok = au_to_arg32(2, "fd", ar->ar_arg_fd);
  891                         kau_write(rec, tok);
  892                 }
  893                 EXTATTR_TOKENS(2);
  894                 break;
  895 
  896         case AUE_FEXECVE:
  897                 if (ARG_IS_VALID(kar, ARG_FD)) {
  898                         tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
  899                         kau_write(rec, tok);
  900                 }
  901                 /* FALLTHROUGH */
  902 
  903         case AUE_EXECVE:
  904         case AUE_MAC_EXECVE:
  905                 if (ARG_IS_VALID(kar, ARG_ARGV)) {
  906                         tok = au_to_exec_args(ar->ar_arg_argv,
  907                             ar->ar_arg_argc);
  908                         kau_write(rec, tok);
  909                 }
  910                 if (ARG_IS_VALID(kar, ARG_ENVV)) {
  911                         tok = au_to_exec_env(ar->ar_arg_envv,
  912                             ar->ar_arg_envc);
  913                         kau_write(rec, tok);
  914                 }
  915                 UPATH1_VNODE1_TOKENS;
  916                 break;
  917 
  918         case AUE_FCHMOD:
  919                 if (ARG_IS_VALID(kar, ARG_MODE)) {
  920                         tok = au_to_arg32(2, "new file mode",
  921                             ar->ar_arg_mode);
  922                         kau_write(rec, tok);
  923                 }
  924                 FD_VNODE1_TOKENS;
  925                 break;
  926 
  927         /*
  928          * XXXRW: Some of these need to handle non-vnode cases as well.
  929          */
  930         case AUE_FCHDIR:
  931         case AUE_FPATHCONF:
  932         case AUE_FSTAT:
  933         case AUE_FSTATFS:
  934         case AUE_FSYNC:
  935         case AUE_FTRUNCATE:
  936         case AUE_FUTIMES:
  937         case AUE_GETDIRENTRIES:
  938         case AUE_GETDIRENTRIESATTR:
  939         case AUE_LSEEK:
  940         case AUE_POLL:
  941         case AUE_READ:
  942         case AUE_READV:
  943         case AUE_WRITE:
  944         case AUE_WRITEV:
  945                 FD_VNODE1_TOKENS;
  946                 break;
  947 
  948         case AUE_FCHOWN:
  949                 if (ARG_IS_VALID(kar, ARG_UID)) {
  950                         tok = au_to_arg32(2, "new file uid", ar->ar_arg_uid);
  951                         kau_write(rec, tok);
  952                 }
  953                 if (ARG_IS_VALID(kar, ARG_GID)) {
  954                         tok = au_to_arg32(3, "new file gid", ar->ar_arg_gid);
  955                         kau_write(rec, tok);
  956                 }
  957                 FD_VNODE1_TOKENS;
  958                 break;
  959 
  960         case AUE_FCNTL:
  961                 if (ARG_IS_VALID(kar, ARG_CMD)) {
  962                         tok = au_to_arg32(2, "cmd",
  963                             au_fcntl_cmd_to_bsm(ar->ar_arg_cmd));
  964                         kau_write(rec, tok);
  965                 }
  966                 if (ar->ar_arg_cmd == F_GETLK || ar->ar_arg_cmd == F_SETLK ||
  967                     ar->ar_arg_cmd == F_SETLKW) {
  968                         FD_VNODE1_TOKENS;
  969                 }
  970                 break;
  971 
  972         case AUE_FCHFLAGS:
  973                 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
  974                         tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
  975                         kau_write(rec, tok);
  976                 }
  977                 FD_VNODE1_TOKENS;
  978                 break;
  979 
  980         case AUE_FLOCK:
  981                 if (ARG_IS_VALID(kar, ARG_CMD)) {
  982                         tok = au_to_arg32(2, "operation", ar->ar_arg_cmd);
  983                         kau_write(rec, tok);
  984                 }
  985                 FD_VNODE1_TOKENS;
  986                 break;
  987 
  988         case AUE_RFORK:
  989                 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
  990                         tok = au_to_arg32(1, "flags", ar->ar_arg_fflags);
  991                         kau_write(rec, tok);
  992                 }
  993                 /* FALLTHROUGH */
  994 
  995         case AUE_FORK:
  996         case AUE_VFORK:
  997                 if (ARG_IS_VALID(kar, ARG_PID)) {
  998                         tok = au_to_arg32(0, "child PID", ar->ar_arg_pid);
  999                         kau_write(rec, tok);
 1000                 }
 1001                 break;
 1002 
 1003         case AUE_IOCTL:
 1004                 if (ARG_IS_VALID(kar, ARG_CMD)) {
 1005                         tok = au_to_arg32(2, "cmd", ar->ar_arg_cmd);
 1006                         kau_write(rec, tok);
 1007                 }
 1008                 if (ARG_IS_VALID(kar, ARG_VNODE1))
 1009                         FD_VNODE1_TOKENS;
 1010                 else {
 1011                         if (ARG_IS_VALID(kar, ARG_SOCKINFO)) {
 1012                                 tok = kau_to_socket(&ar->ar_arg_sockinfo);
 1013                                 kau_write(rec, tok);
 1014                         } else {
 1015                                 if (ARG_IS_VALID(kar, ARG_FD)) {
 1016                                         tok = au_to_arg32(1, "fd",
 1017                                             ar->ar_arg_fd);
 1018                                         kau_write(rec, tok);
 1019                                 }
 1020                         }
 1021                 }
 1022                 break;
 1023 
 1024         case AUE_KILL:
 1025         case AUE_KILLPG:
 1026                 if (ARG_IS_VALID(kar, ARG_SIGNUM)) {
 1027                         tok = au_to_arg32(2, "signal", ar->ar_arg_signum);
 1028                         kau_write(rec, tok);
 1029                 }
 1030                 PROCESS_PID_TOKENS(1);
 1031                 break;
 1032 
 1033         case AUE_KTRACE:
 1034                 if (ARG_IS_VALID(kar, ARG_CMD)) {
 1035                         tok = au_to_arg32(2, "ops", ar->ar_arg_cmd);
 1036                         kau_write(rec, tok);
 1037                 }
 1038                 if (ARG_IS_VALID(kar, ARG_VALUE)) {
 1039                         tok = au_to_arg32(3, "trpoints", ar->ar_arg_value);
 1040                         kau_write(rec, tok);
 1041                 }
 1042                 PROCESS_PID_TOKENS(4);
 1043                 UPATH1_VNODE1_TOKENS;
 1044                 break;
 1045 
 1046         case AUE_LINK:
 1047         case AUE_LINKAT:
 1048         case AUE_RENAME:
 1049         case AUE_RENAMEAT:
 1050                 ATFD1_TOKENS(1);
 1051                 UPATH1_VNODE1_TOKENS;
 1052                 ATFD2_TOKENS(3);
 1053                 UPATH2_TOKENS;
 1054                 break;
 1055 
 1056         case AUE_LOADSHFILE:
 1057                 ADDR_TOKEN(4, "base addr");
 1058                 UPATH1_VNODE1_TOKENS;
 1059                 break;
 1060 
 1061         case AUE_MKDIR:
 1062                 if (ARG_IS_VALID(kar, ARG_MODE)) {
 1063                         tok = au_to_arg32(2, "mode", ar->ar_arg_mode);
 1064                         kau_write(rec, tok);
 1065                 }
 1066                 UPATH1_VNODE1_TOKENS;
 1067                 break;
 1068 
 1069         case AUE_MKNOD:
 1070                 if (ARG_IS_VALID(kar, ARG_MODE)) {
 1071                         tok = au_to_arg32(2, "mode", ar->ar_arg_mode);
 1072                         kau_write(rec, tok);
 1073                 }
 1074                 if (ARG_IS_VALID(kar, ARG_DEV)) {
 1075                         tok = au_to_arg32(3, "dev", ar->ar_arg_dev);
 1076                         kau_write(rec, tok);
 1077                 }
 1078                 UPATH1_VNODE1_TOKENS;
 1079                 break;
 1080 
 1081         case AUE_MMAP:
 1082         case AUE_MUNMAP:
 1083         case AUE_MPROTECT:
 1084         case AUE_MLOCK:
 1085         case AUE_MUNLOCK:
 1086         case AUE_MINHERIT:
 1087                 ADDR_TOKEN(1, "addr");
 1088                 if (ARG_IS_VALID(kar, ARG_LEN)) {
 1089                         tok = au_to_arg32(2, "len", ar->ar_arg_len);
 1090                         kau_write(rec, tok);
 1091                 }
 1092                 if (ar->ar_event == AUE_MMAP)
 1093                         FD_VNODE1_TOKENS;
 1094                 if (ar->ar_event == AUE_MPROTECT) {
 1095                         if (ARG_IS_VALID(kar, ARG_VALUE)) {
 1096                                 tok = au_to_arg32(3, "protection",
 1097                                     ar->ar_arg_value);
 1098                                 kau_write(rec, tok);
 1099                         }
 1100                 }
 1101                 if (ar->ar_event == AUE_MINHERIT) {
 1102                         if (ARG_IS_VALID(kar, ARG_VALUE)) {
 1103                                 tok = au_to_arg32(3, "inherit",
 1104                                     ar->ar_arg_value);
 1105                                 kau_write(rec, tok);
 1106                         }
 1107                 }
 1108                 break;
 1109 
 1110         case AUE_MOUNT:
 1111         case AUE_NMOUNT:
 1112                 /* XXX Need to handle NFS mounts */
 1113                 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
 1114                         tok = au_to_arg32(3, "flags", ar->ar_arg_fflags);
 1115                         kau_write(rec, tok);
 1116                 }
 1117                 if (ARG_IS_VALID(kar, ARG_TEXT)) {
 1118                         tok = au_to_text(ar->ar_arg_text);
 1119                         kau_write(rec, tok);
 1120                 }
 1121                 /* FALLTHROUGH */
 1122 
 1123         case AUE_NFS_SVC:
 1124                 if (ARG_IS_VALID(kar, ARG_CMD)) {
 1125                         tok = au_to_arg32(1, "flags", ar->ar_arg_cmd);
 1126                         kau_write(rec, tok);
 1127                 }
 1128                 break;
 1129 
 1130         case AUE_UMOUNT:
 1131                 if (ARG_IS_VALID(kar, ARG_VALUE)) {
 1132                         tok = au_to_arg32(2, "flags", ar->ar_arg_value);
 1133                         kau_write(rec, tok);
 1134                 }
 1135                 UPATH1_VNODE1_TOKENS;
 1136                 if (ARG_IS_VALID(kar, ARG_TEXT)) {
 1137                         tok = au_to_text(ar->ar_arg_text);
 1138                         kau_write(rec, tok);
 1139                 }
 1140                 break;
 1141 
 1142         case AUE_MSGCTL:
 1143                 ar->ar_event = audit_msgctl_to_event(ar->ar_arg_svipc_cmd);
 1144                 /* Fall through */
 1145 
 1146         case AUE_MSGRCV:
 1147         case AUE_MSGSND:
 1148                 tok = au_to_arg32(1, "msg ID", ar->ar_arg_svipc_id);
 1149                 kau_write(rec, tok);
 1150                 if (ar->ar_errno != EINVAL) {
 1151                         tok = au_to_ipc(AT_IPC_MSG, ar->ar_arg_svipc_id);
 1152                         kau_write(rec, tok);
 1153                 }
 1154                 break;
 1155 
 1156         case AUE_MSGGET:
 1157                 if (ar->ar_errno == 0) {
 1158                         if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
 1159                                 tok = au_to_ipc(AT_IPC_MSG,
 1160                                     ar->ar_arg_svipc_id);
 1161                                 kau_write(rec, tok);
 1162                         }
 1163                 }
 1164                 break;
 1165 
 1166         case AUE_RESETSHFILE:
 1167                 ADDR_TOKEN(1, "base addr");
 1168                 break;
 1169 
 1170         case AUE_OPEN_RC:
 1171         case AUE_OPEN_RTC:
 1172         case AUE_OPEN_RWC:
 1173         case AUE_OPEN_RWTC:
 1174         case AUE_OPEN_WC:
 1175         case AUE_OPEN_WTC:
 1176         case AUE_CREAT:
 1177                 if (ARG_IS_VALID(kar, ARG_MODE)) {
 1178                         tok = au_to_arg32(3, "mode", ar->ar_arg_mode);
 1179                         kau_write(rec, tok);
 1180                 }
 1181                 /* FALLTHROUGH */
 1182 
 1183         case AUE_OPEN_R:
 1184         case AUE_OPEN_RT:
 1185         case AUE_OPEN_RW:
 1186         case AUE_OPEN_RWT:
 1187         case AUE_OPEN_W:
 1188         case AUE_OPEN_WT:
 1189                 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
 1190                         tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
 1191                         kau_write(rec, tok);
 1192                 }
 1193                 UPATH1_VNODE1_TOKENS;
 1194                 break;
 1195 
 1196         case AUE_OPENAT_RC:
 1197         case AUE_OPENAT_RTC:
 1198         case AUE_OPENAT_RWC:
 1199         case AUE_OPENAT_RWTC:
 1200         case AUE_OPENAT_WC:
 1201         case AUE_OPENAT_WTC:
 1202                 if (ARG_IS_VALID(kar, ARG_MODE)) {
 1203                         tok = au_to_arg32(3, "mode", ar->ar_arg_mode);
 1204                         kau_write(rec, tok);
 1205                 }
 1206                 /* FALLTHROUGH */
 1207 
 1208         case AUE_OPENAT_R:
 1209         case AUE_OPENAT_RT:
 1210         case AUE_OPENAT_RW:
 1211         case AUE_OPENAT_RWT:
 1212         case AUE_OPENAT_W:
 1213         case AUE_OPENAT_WT:
 1214                 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
 1215                         tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
 1216                         kau_write(rec, tok);
 1217                 }
 1218                 ATFD1_TOKENS(1);
 1219                 UPATH1_VNODE1_TOKENS;
 1220                 break;
 1221 
 1222         case AUE_PTRACE:
 1223                 if (ARG_IS_VALID(kar, ARG_CMD)) {
 1224                         tok = au_to_arg32(1, "request", ar->ar_arg_cmd);
 1225                         kau_write(rec, tok);
 1226                 }
 1227                 if (ARG_IS_VALID(kar, ARG_VALUE)) {
 1228                         tok = au_to_arg32(4, "data", ar->ar_arg_value);
 1229                         kau_write(rec, tok);
 1230                 }
 1231                 PROCESS_PID_TOKENS(2);
 1232                 break;
 1233 
 1234         case AUE_QUOTACTL:
 1235                 if (ARG_IS_VALID(kar, ARG_CMD)) {
 1236                         tok = au_to_arg32(2, "command", ar->ar_arg_cmd);
 1237                         kau_write(rec, tok);
 1238                 }
 1239                 if (ARG_IS_VALID(kar, ARG_UID)) {
 1240                         tok = au_to_arg32(3, "uid", ar->ar_arg_uid);
 1241                         kau_write(rec, tok);
 1242                 }
 1243                 if (ARG_IS_VALID(kar, ARG_GID)) {
 1244                         tok = au_to_arg32(3, "gid", ar->ar_arg_gid);
 1245                         kau_write(rec, tok);
 1246                 }
 1247                 UPATH1_VNODE1_TOKENS;
 1248                 break;
 1249 
 1250         case AUE_REBOOT:
 1251                 if (ARG_IS_VALID(kar, ARG_CMD)) {
 1252                         tok = au_to_arg32(1, "howto", ar->ar_arg_cmd);
 1253                         kau_write(rec, tok);
 1254                 }
 1255                 break;
 1256 
 1257         case AUE_SEMCTL:
 1258                 ar->ar_event = audit_semctl_to_event(ar->ar_arg_svipc_cmd);
 1259                 /* Fall through */
 1260 
 1261         case AUE_SEMOP:
 1262                 if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
 1263                         tok = au_to_arg32(1, "sem ID", ar->ar_arg_svipc_id);
 1264                         kau_write(rec, tok);
 1265                         if (ar->ar_errno != EINVAL) {
 1266                                 tok = au_to_ipc(AT_IPC_SEM,
 1267                                     ar->ar_arg_svipc_id);
 1268                                 kau_write(rec, tok);
 1269                         }
 1270                 }
 1271                 break;
 1272 
 1273         case AUE_SEMGET:
 1274                 if (ar->ar_errno == 0) {
 1275                         if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
 1276                                 tok = au_to_ipc(AT_IPC_SEM,
 1277                                     ar->ar_arg_svipc_id);
 1278                                 kau_write(rec, tok);
 1279                         }
 1280                 }
 1281                 break;
 1282 
 1283         case AUE_SETEGID:
 1284                 if (ARG_IS_VALID(kar, ARG_EGID)) {
 1285                         tok = au_to_arg32(1, "egid", ar->ar_arg_egid);
 1286                         kau_write(rec, tok);
 1287                 }
 1288                 break;
 1289 
 1290         case AUE_SETEUID:
 1291                 if (ARG_IS_VALID(kar, ARG_EUID)) {
 1292                         tok = au_to_arg32(1, "euid", ar->ar_arg_euid);
 1293                         kau_write(rec, tok);
 1294                 }
 1295                 break;
 1296 
 1297         case AUE_SETREGID:
 1298                 if (ARG_IS_VALID(kar, ARG_RGID)) {
 1299                         tok = au_to_arg32(1, "rgid", ar->ar_arg_rgid);
 1300                         kau_write(rec, tok);
 1301                 }
 1302                 if (ARG_IS_VALID(kar, ARG_EGID)) {
 1303                         tok = au_to_arg32(2, "egid", ar->ar_arg_egid);
 1304                         kau_write(rec, tok);
 1305                 }
 1306                 break;
 1307 
 1308         case AUE_SETREUID:
 1309                 if (ARG_IS_VALID(kar, ARG_RUID)) {
 1310                         tok = au_to_arg32(1, "ruid", ar->ar_arg_ruid);
 1311                         kau_write(rec, tok);
 1312                 }
 1313                 if (ARG_IS_VALID(kar, ARG_EUID)) {
 1314                         tok = au_to_arg32(2, "euid", ar->ar_arg_euid);
 1315                         kau_write(rec, tok);
 1316                 }
 1317                 break;
 1318 
 1319         case AUE_SETRESGID:
 1320                 if (ARG_IS_VALID(kar, ARG_RGID)) {
 1321                         tok = au_to_arg32(1, "rgid", ar->ar_arg_rgid);
 1322                         kau_write(rec, tok);
 1323                 }
 1324                 if (ARG_IS_VALID(kar, ARG_EGID)) {
 1325                         tok = au_to_arg32(2, "egid", ar->ar_arg_egid);
 1326                         kau_write(rec, tok);
 1327                 }
 1328                 if (ARG_IS_VALID(kar, ARG_SGID)) {
 1329                         tok = au_to_arg32(3, "sgid", ar->ar_arg_sgid);
 1330                         kau_write(rec, tok);
 1331                 }
 1332                 break;
 1333 
 1334         case AUE_SETRESUID:
 1335                 if (ARG_IS_VALID(kar, ARG_RUID)) {
 1336                         tok = au_to_arg32(1, "ruid", ar->ar_arg_ruid);
 1337                         kau_write(rec, tok);
 1338                 }
 1339                 if (ARG_IS_VALID(kar, ARG_EUID)) {
 1340                         tok = au_to_arg32(2, "euid", ar->ar_arg_euid);
 1341                         kau_write(rec, tok);
 1342                 }
 1343                 if (ARG_IS_VALID(kar, ARG_SUID)) {
 1344                         tok = au_to_arg32(3, "suid", ar->ar_arg_suid);
 1345                         kau_write(rec, tok);
 1346                 }
 1347                 break;
 1348 
 1349         case AUE_SETGID:
 1350                 if (ARG_IS_VALID(kar, ARG_GID)) {
 1351                         tok = au_to_arg32(1, "gid", ar->ar_arg_gid);
 1352                         kau_write(rec, tok);
 1353                 }
 1354                 break;
 1355 
 1356         case AUE_SETUID:
 1357                 if (ARG_IS_VALID(kar, ARG_UID)) {
 1358                         tok = au_to_arg32(1, "uid", ar->ar_arg_uid);
 1359                         kau_write(rec, tok);
 1360                 }
 1361                 break;
 1362 
 1363         case AUE_SETGROUPS:
 1364                 if (ARG_IS_VALID(kar, ARG_GROUPSET)) {
 1365                         for(ctr = 0; ctr < ar->ar_arg_groups.gidset_size; ctr++)
 1366                         {
 1367                                 tok = au_to_arg32(1, "setgroups",
 1368                                     ar->ar_arg_groups.gidset[ctr]);
 1369                                 kau_write(rec, tok);
 1370                         }
 1371                 }
 1372                 break;
 1373 
 1374         case AUE_SETLOGIN:
 1375                 if (ARG_IS_VALID(kar, ARG_TEXT)) {
 1376                         tok = au_to_text(ar->ar_arg_text);
 1377                         kau_write(rec, tok);
 1378                 }
 1379                 break;
 1380 
 1381         case AUE_SETPRIORITY:
 1382                 if (ARG_IS_VALID(kar, ARG_CMD)) {
 1383                         tok = au_to_arg32(1, "which", ar->ar_arg_cmd);
 1384                         kau_write(rec, tok);
 1385                 }
 1386                 if (ARG_IS_VALID(kar, ARG_UID)) {
 1387                         tok = au_to_arg32(2, "who", ar->ar_arg_uid);
 1388                         kau_write(rec, tok);
 1389                 }
 1390                 PROCESS_PID_TOKENS(2);
 1391                 if (ARG_IS_VALID(kar, ARG_VALUE)) {
 1392                         tok = au_to_arg32(3, "priority", ar->ar_arg_value);
 1393                         kau_write(rec, tok);
 1394                 }
 1395                 break;
 1396 
 1397         case AUE_SETPRIVEXEC:
 1398                 if (ARG_IS_VALID(kar, ARG_VALUE)) {
 1399                         tok = au_to_arg32(1, "flag", ar->ar_arg_value);
 1400                         kau_write(rec, tok);
 1401                 }
 1402                 break;
 1403 
 1404         /* AUE_SHMAT, AUE_SHMCTL, AUE_SHMDT and AUE_SHMGET are SysV IPC */
 1405         case AUE_SHMAT:
 1406                 if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
 1407                         tok = au_to_arg32(1, "shmid", ar->ar_arg_svipc_id);
 1408                         kau_write(rec, tok);
 1409                         /* XXXAUDIT: Does having the ipc token make sense? */
 1410                         tok = au_to_ipc(AT_IPC_SHM, ar->ar_arg_svipc_id);
 1411                         kau_write(rec, tok);
 1412                 }
 1413                 if (ARG_IS_VALID(kar, ARG_SVIPC_ADDR)) {
 1414                         tok = au_to_arg32(2, "shmaddr",
 1415                             (int)(uintptr_t)ar->ar_arg_svipc_addr);
 1416                         kau_write(rec, tok);
 1417                 }
 1418                 if (ARG_IS_VALID(kar, ARG_SVIPC_PERM)) {
 1419                         tok = au_to_ipc_perm(&ar->ar_arg_svipc_perm);
 1420                         kau_write(rec, tok);
 1421                 }
 1422                 break;
 1423 
 1424         case AUE_SHMCTL:
 1425                 if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
 1426                         tok = au_to_arg32(1, "shmid", ar->ar_arg_svipc_id);
 1427                         kau_write(rec, tok);
 1428                         /* XXXAUDIT: Does having the ipc token make sense? */
 1429                         tok = au_to_ipc(AT_IPC_SHM, ar->ar_arg_svipc_id);
 1430                         kau_write(rec, tok);
 1431                 }
 1432                 switch (ar->ar_arg_svipc_cmd) {
 1433                 case IPC_STAT:
 1434                         ar->ar_event = AUE_SHMCTL_STAT;
 1435                         break;
 1436                 case IPC_RMID:
 1437                         ar->ar_event = AUE_SHMCTL_RMID;
 1438                         break;
 1439                 case IPC_SET:
 1440                         ar->ar_event = AUE_SHMCTL_SET;
 1441                         if (ARG_IS_VALID(kar, ARG_SVIPC_PERM)) {
 1442                                 tok = au_to_ipc_perm(&ar->ar_arg_svipc_perm);
 1443                                 kau_write(rec, tok);
 1444                         }
 1445                         break;
 1446                 default:
 1447                         break;  /* We will audit a bad command */
 1448                 }
 1449                 break;
 1450 
 1451         case AUE_SHMDT:
 1452                 if (ARG_IS_VALID(kar, ARG_SVIPC_ADDR)) {
 1453                         tok = au_to_arg32(1, "shmaddr",
 1454                             (int)(uintptr_t)ar->ar_arg_svipc_addr);
 1455                         kau_write(rec, tok);
 1456                 }
 1457                 break;
 1458 
 1459         case AUE_SHMGET:
 1460                 /* This is unusual; the return value is in an argument token */
 1461                 if (ARG_IS_VALID(kar, ARG_SVIPC_ID)) {
 1462                         tok = au_to_arg32(0, "shmid", ar->ar_arg_svipc_id);
 1463                         kau_write(rec, tok);
 1464                         tok = au_to_ipc(AT_IPC_SHM, ar->ar_arg_svipc_id);
 1465                         kau_write(rec, tok);
 1466                 }
 1467                 if (ARG_IS_VALID(kar, ARG_SVIPC_PERM)) {
 1468                         tok = au_to_ipc_perm(&ar->ar_arg_svipc_perm);
 1469                         kau_write(rec, tok);
 1470                 }
 1471                 break;
 1472 
 1473         /* AUE_SHMOPEN, AUE_SHMUNLINK, AUE_SEMOPEN, AUE_SEMCLOSE
 1474          * and AUE_SEMUNLINK are Posix IPC */
 1475         case AUE_SHMOPEN:
 1476                 if (ARG_IS_VALID(kar, ARG_SVIPC_ADDR)) {
 1477                         tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
 1478                         kau_write(rec, tok);
 1479                 }
 1480                 if (ARG_IS_VALID(kar, ARG_MODE)) {
 1481                         tok = au_to_arg32(3, "mode", ar->ar_arg_mode);
 1482                         kau_write(rec, tok);
 1483                 }
 1484                 /* FALLTHROUGH */
 1485 
 1486         case AUE_SHMUNLINK:
 1487                 if (ARG_IS_VALID(kar, ARG_TEXT)) {
 1488                         tok = au_to_text(ar->ar_arg_text);
 1489                         kau_write(rec, tok);
 1490                 }
 1491                 if (ARG_IS_VALID(kar, ARG_POSIX_IPC_PERM)) {
 1492                         struct ipc_perm perm;
 1493 
 1494                         perm.uid = ar->ar_arg_pipc_perm.pipc_uid;
 1495                         perm.gid = ar->ar_arg_pipc_perm.pipc_gid;
 1496                         perm.cuid = ar->ar_arg_pipc_perm.pipc_uid;
 1497                         perm.cgid = ar->ar_arg_pipc_perm.pipc_gid;
 1498                         perm.mode = ar->ar_arg_pipc_perm.pipc_mode;
 1499                         perm.seq = 0;
 1500                         perm.key = 0;
 1501                         tok = au_to_ipc_perm(&perm);
 1502                         kau_write(rec, tok);
 1503                 }
 1504                 break;
 1505 
 1506         case AUE_SEMOPEN:
 1507                 if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
 1508                         tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
 1509                         kau_write(rec, tok);
 1510                 }
 1511                 if (ARG_IS_VALID(kar, ARG_MODE)) {
 1512                         tok = au_to_arg32(3, "mode", ar->ar_arg_mode);
 1513                         kau_write(rec, tok);
 1514                 }
 1515                 if (ARG_IS_VALID(kar, ARG_VALUE)) {
 1516                         tok = au_to_arg32(4, "value", ar->ar_arg_value);
 1517                         kau_write(rec, tok);
 1518                 }
 1519                 /* FALLTHROUGH */
 1520 
 1521         case AUE_SEMUNLINK:
 1522                 if (ARG_IS_VALID(kar, ARG_TEXT)) {
 1523                         tok = au_to_text(ar->ar_arg_text);
 1524                         kau_write(rec, tok);
 1525                 }
 1526                 if (ARG_IS_VALID(kar, ARG_POSIX_IPC_PERM)) {
 1527                         struct ipc_perm perm;
 1528 
 1529                         perm.uid = ar->ar_arg_pipc_perm.pipc_uid;
 1530                         perm.gid = ar->ar_arg_pipc_perm.pipc_gid;
 1531                         perm.cuid = ar->ar_arg_pipc_perm.pipc_uid;
 1532                         perm.cgid = ar->ar_arg_pipc_perm.pipc_gid;
 1533                         perm.mode = ar->ar_arg_pipc_perm.pipc_mode;
 1534                         perm.seq = 0;
 1535                         perm.key = 0;
 1536                         tok = au_to_ipc_perm(&perm);
 1537                         kau_write(rec, tok);
 1538                 }
 1539                 break;
 1540 
 1541         case AUE_SEMCLOSE:
 1542                 if (ARG_IS_VALID(kar, ARG_FD)) {
 1543                         tok = au_to_arg32(1, "sem", ar->ar_arg_fd);
 1544                         kau_write(rec, tok);
 1545                 }
 1546                 break;
 1547 
 1548         case AUE_SYMLINK:
 1549                 if (ARG_IS_VALID(kar, ARG_TEXT)) {
 1550                         tok = au_to_text(ar->ar_arg_text);
 1551                         kau_write(rec, tok);
 1552                 }
 1553                 UPATH1_VNODE1_TOKENS;
 1554                 break;
 1555 
 1556         case AUE_SYSCTL:
 1557         case AUE_SYSCTL_NONADMIN:
 1558                 if (ARG_IS_VALID(kar, ARG_CTLNAME | ARG_LEN)) {
 1559                         for (ctr = 0; ctr < ar->ar_arg_len; ctr++) {
 1560                                 tok = au_to_arg32(1, "name",
 1561                                     ar->ar_arg_ctlname[ctr]);
 1562                                 kau_write(rec, tok);
 1563                         }
 1564                 }
 1565                 if (ARG_IS_VALID(kar, ARG_VALUE)) {
 1566                         tok = au_to_arg32(5, "newval", ar->ar_arg_value);
 1567                         kau_write(rec, tok);
 1568                 }
 1569                 if (ARG_IS_VALID(kar, ARG_TEXT)) {
 1570                         tok = au_to_text(ar->ar_arg_text);
 1571                         kau_write(rec, tok);
 1572                 }
 1573                 break;
 1574 
 1575         case AUE_UMASK:
 1576                 if (ARG_IS_VALID(kar, ARG_MASK)) {
 1577                         tok = au_to_arg32(1, "new mask", ar->ar_arg_mask);
 1578                         kau_write(rec, tok);
 1579                 }
 1580                 tok = au_to_arg32(0, "prev mask", ar->ar_retval);
 1581                 kau_write(rec, tok);
 1582                 break;
 1583 
 1584         case AUE_WAIT4:
 1585                 PROCESS_PID_TOKENS(1);
 1586                 if (ARG_IS_VALID(kar, ARG_VALUE)) {
 1587                         tok = au_to_arg32(3, "options", ar->ar_arg_value);
 1588                         kau_write(rec, tok);
 1589                 }
 1590                 break;
 1591 
 1592         case AUE_CAP_NEW:
 1593                 /*
 1594                  * XXXRW/XXXJA: Would be nice to audit socket/etc information.
 1595                  */
 1596                 FD_VNODE1_TOKENS;
 1597                 if (ARG_IS_VALID(kar, ARG_RIGHTS)) {
 1598                         tok = au_to_arg64(2, "rights", ar->ar_arg_rights);
 1599                         kau_write(rec, tok);
 1600                 }
 1601                 break;
 1602 
 1603         case AUE_CAP_GETRIGHTS:
 1604                 if (ARG_IS_VALID(kar, ARG_FD)) {
 1605                         tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
 1606                         kau_write(rec, tok);
 1607                 }
 1608                 break;
 1609 
 1610         case AUE_CAP_ENTER:
 1611         case AUE_CAP_GETMODE:
 1612                 break;
 1613 
 1614         case AUE_NULL:
 1615         default:
 1616                 printf("BSM conversion requested for unknown event %d\n",
 1617                     ar->ar_event);
 1618 
 1619                 /*
 1620                  * Write the subject token so it is properly freed here.
 1621                  */
 1622                 kau_write(rec, subj_tok);
 1623                 kau_free(rec);
 1624                 return (BSM_NOAUDIT);
 1625         }
 1626 
 1627         kau_write(rec, subj_tok);
 1628         tok = au_to_return32(au_errno_to_bsm(ar->ar_errno), ar->ar_retval);
 1629         kau_write(rec, tok);  /* Every record gets a return token */
 1630 
 1631         kau_close(rec, &ar->ar_endtime, ar->ar_event);
 1632 
 1633         *pau = rec;
 1634         return (BSM_SUCCESS);
 1635 }
 1636 
 1637 /*
 1638  * Verify that a record is a valid BSM record. This verification is simple
 1639  * now, but may be expanded on sometime in the future.  Return 1 if the
 1640  * record is good, 0 otherwise.
 1641  */
 1642 int
 1643 bsm_rec_verify(void *rec)
 1644 {
 1645         char c = *(char *)rec;
 1646 
 1647         /*
 1648          * Check the token ID of the first token; it has to be a header
 1649          * token.
 1650          *
 1651          * XXXAUDIT There needs to be a token structure to map a token.
 1652          * XXXAUDIT 'Shouldn't be simply looking at the first char.
 1653          */
 1654         if ((c != AUT_HEADER32) && (c != AUT_HEADER32_EX) &&
 1655             (c != AUT_HEADER64) && (c != AUT_HEADER64_EX))
 1656                 return (0);
 1657         return (1);
 1658 }

Cache object: ac46ec457e9987fbad60d320c9348c1a


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]


This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.