xref: /illumos-gate/usr/src/cmd/auditconfig/auditconfig.c

/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright (c) 1992, 2010, Oracle and/or its affiliates. All rights reserved.
 */

/*
 * Copyright (c) 2019, Joyent, Inc.
 */

/*
 * auditconfig - set and display audit parameters
 */

#include <locale.h>
#include <sys/types.h>
#include <ctype.h>
#include <stdlib.h>
#include <stdarg.h>
#include <unistd.h>
#include <errno.h>
#include <sys/param.h>
#include <stdio.h>
#include <string.h>
#include <strings.h>
#include <nlist.h>
#include <fcntl.h>
#include <sys/socket.h>
#include <netdb.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <sys/mkdev.h>
#include <sys/param.h>
#include <pwd.h>
#include <libintl.h>
#include <zone.h>
#include <libscf_priv.h>
#include <tsol/label.h>
#include <bsm/libbsm.h>
#include <audit_policy.h>
#include <audit_scf.h>

enum	commands {
	AC_ARG_ACONF,
	AC_ARG_AUDIT,
	AC_ARG_CHKACONF,
	AC_ARG_CHKCONF,
	AC_ARG_CONF,
	AC_ARG_GETASID,
	AC_ARG_GETAUDIT,
	AC_ARG_GETAUID,
	AC_ARG_GETCAR,
	AC_ARG_GETCLASS,
	AC_ARG_GETCOND,
	AC_ARG_GETCWD,
	AC_ARG_GETESTATE,
	AC_ARG_GETFLAGS,
	AC_ARG_GETKAUDIT,
	AC_ARG_GETKMASK,
	AC_ARG_GETNAFLAGS,
	AC_ARG_GETPINFO,
	AC_ARG_GETPLUGIN,
	AC_ARG_GETPOLICY,
	AC_ARG_GETQBUFSZ,
	AC_ARG_GETQCTRL,
	AC_ARG_GETQDELAY,
	AC_ARG_GETQHIWATER,
	AC_ARG_GETQLOWATER,
	AC_ARG_GETSTAT,
	AC_ARG_GETTERMID,
	AC_ARG_LSEVENT,
	AC_ARG_LSPOLICY,
	AC_ARG_SETASID,
	AC_ARG_SETAUDIT,
	AC_ARG_SETAUID,
	AC_ARG_SETCLASS,
	AC_ARG_SETFLAGS,
	AC_ARG_SETKAUDIT,
	AC_ARG_SETKMASK,
	AC_ARG_SETNAFLAGS,
	AC_ARG_SETPLUGIN,
	AC_ARG_SETPMASK,
	AC_ARG_SETPOLICY,
	AC_ARG_SETQBUFSZ,
	AC_ARG_SETQCTRL,
	AC_ARG_SETQDELAY,
	AC_ARG_SETQHIWATER,
	AC_ARG_SETQLOWATER,
	AC_ARG_SETSMASK,
	AC_ARG_SETSTAT,
	AC_ARG_SETUMASK,
	AC_ARG_SET_TEMPORARY
};

#define	AC_KERN_EVENT		0
#define	AC_USER_EVENT		1

#define	NONE(s) (!strlen(s) ? gettext("none") : s)

#define	ONEK 1024

/*
 * remove this after the audit.h is fixed
 */
struct arg_entry {
	char		*arg_str;
	char		*arg_opts;
	enum commands	auditconfig_cmd;
	boolean_t	temporary_allowed;	/* -t allowed for the option */
};
typedef struct arg_entry arg_entry_t;

/* arg_table - command option and usage message table */
static arg_entry_t arg_table[] = {
	{ "-aconf",	"",			AC_ARG_ACONF,	B_FALSE},
	{ "-audit",	" event sorf retval string", AC_ARG_AUDIT, B_FALSE},
	{ "-chkaconf",	"",			AC_ARG_CHKACONF, B_FALSE},
	{ "-chkconf",	"",			AC_ARG_CHKCONF,	B_FALSE},
	{ "-conf",	"",			AC_ARG_CONF,	B_FALSE},
	{ "-getasid",	"",			AC_ARG_GETASID,	B_FALSE},
	{ "-getaudit",	"",			AC_ARG_GETAUDIT, B_FALSE},
	{ "-getauid",	"",			AC_ARG_GETAUID, B_FALSE},
	{ "-getcar",	"",			AC_ARG_GETCAR,	B_FALSE},
	{ "-getclass",	" event",		AC_ARG_GETCLASS, B_FALSE},
	{ "-getcond",	"",			AC_ARG_GETCOND,	B_FALSE},
	{ "-getcwd",	"",			AC_ARG_GETCWD,	B_FALSE},
	{ "-getestate",	" event",		AC_ARG_GETESTATE, B_FALSE},
	{ "-getflags",	"",			AC_ARG_GETFLAGS, B_FALSE},
	{ "-getkaudit",	"",			AC_ARG_GETKAUDIT, B_FALSE},
	{ "-getkmask",	"",			AC_ARG_GETKMASK, B_FALSE},
	{ "-getnaflags", "",			AC_ARG_GETNAFLAGS, B_FALSE},
	{ "-getpinfo",	" pid",			AC_ARG_GETPINFO, B_FALSE},
	{ "-getplugin",	" [plugin]",		AC_ARG_GETPLUGIN, B_FALSE},
	{ "-getpolicy",	"",			AC_ARG_GETPOLICY, B_TRUE},
	{ "-getqbufsz",	"",			AC_ARG_GETQBUFSZ, B_TRUE},
	{ "-getqctrl",	"",			AC_ARG_GETQCTRL, B_TRUE},
	{ "-getqdelay",	"",			AC_ARG_GETQDELAY, B_TRUE},
	{ "-getqhiwater", "",			AC_ARG_GETQHIWATER, B_TRUE},
	{ "-getqlowater", "",			AC_ARG_GETQLOWATER, B_TRUE},
	{ "-getstat",	"",			AC_ARG_GETSTAT,	B_FALSE},
	{ "-gettid",	"",			AC_ARG_GETTERMID, B_FALSE},
	{ "-lsevent",	"",			AC_ARG_LSEVENT,	B_FALSE},
	{ "-lspolicy",	"",			AC_ARG_LSPOLICY, B_FALSE},
	{ "-setasid",	" asid [cmd]",		AC_ARG_SETASID,	B_FALSE},
	{ "-setaudit",	" auid audit_flags termid asid [cmd]",
						AC_ARG_SETAUDIT, B_FALSE},
	{ "-setauid",	" auid [cmd]",		AC_ARG_SETAUID,	B_FALSE},
	{ "-setclass",	" event audit_flags",	AC_ARG_SETCLASS, B_FALSE},
	{ "-setflags",	" audit_flags",		AC_ARG_SETFLAGS, B_FALSE},
	{ "-setkaudit",	" type IP_address",	AC_ARG_SETKAUDIT, B_FALSE},
	{ "-setkmask",	" audit_flags",		AC_ARG_SETKMASK, B_FALSE},
	{ "-setnaflags", " audit_naflags",	AC_ARG_SETNAFLAGS, B_FALSE},
	{ "-setplugin",	" name active|inactive [attributes [qsize]]",
						AC_ARG_SETPLUGIN, B_FALSE},
	{ "-setpmask",	" pid audit_flags",	AC_ARG_SETPMASK, B_FALSE},
	{ "-setpolicy",	" [+|-]policy_flags",	AC_ARG_SETPOLICY, B_TRUE},
	{ "-setqbufsz",	" bufsz",		AC_ARG_SETQBUFSZ, B_TRUE},
	{ "-setqctrl",	" hiwater lowater bufsz delay",
						AC_ARG_SETQCTRL, B_TRUE},
	{ "-setqdelay",	" delay",		AC_ARG_SETQDELAY, B_TRUE},
	{ "-setqhiwater", " hiwater",		AC_ARG_SETQHIWATER, B_TRUE},
	{ "-setqlowater", " lowater",		AC_ARG_SETQLOWATER, B_TRUE},
	{ "-setsmask",	" asid audit_flags",	AC_ARG_SETSMASK, B_FALSE},
	{ "-setstat",	"",			AC_ARG_SETSTAT, B_FALSE},
	{ "-setumask",	" user audit_flags",	AC_ARG_SETUMASK, B_FALSE},
	{ "-t",		"",			AC_ARG_SET_TEMPORARY, B_FALSE},
};

#define	ARG_TBL_SZ (sizeof (arg_table) / sizeof (arg_entry_t))

char	*progname = "auditconfig";

/*
 * temporary_set true to get/set only kernel settings,
 *		 false to get/set kernel settings and service properties
 */
static boolean_t temporary_set = B_FALSE;

static au_event_ent_t *egetauevnam(char *event_name);
static au_event_ent_t *egetauevnum(au_event_t event_number);
static int arg_ent_compare(const void *aep1, const void *aep2);
static char *cond2str(void);
static int policy2str(uint32_t policy, char *policy_str, size_t len);
static int str2type(char *s, uint_t *type);
static int str2policy(char *policy_str, uint32_t *policy_mask);
static int str2ipaddr(char *s, uint32_t *addr, uint32_t type);
static int strisipaddr(char *s);
static int strisnum(char *s);
static arg_entry_t *get_arg_ent(char *arg_str);
static uid_t get_user_id(char *user);
static void chk_arg_len(char *argv, uint_t len);
static void chk_event_num(int etype, au_event_t event);
static void chk_event_str(int etype, char *event_str);
static void chk_known_plugin(char *plugin_str);
static void chk_retval(char *retval_str);
static void chk_sorf(char *sorf_str);
static void do_aconf(void);
static void do_args(char **argv, au_mask_t *mask);
static void do_audit(char *, char, int, char *);
static void do_chkaconf(void);
static void do_chkconf(void);
static void do_conf(void);
static void do_getasid(void);
static void do_getaudit(void);
static void do_getkaudit(void);
static void do_setkaudit(char *t, char *s);
static void do_getauid(void);
static void do_getcar(void);
static void do_getclass(char *event_str);
static void do_getcond(void);
static void do_getcwd(void);
static void do_getflags(void);
static void do_getkmask(void);
static void do_getnaflags(void);
static void do_getpinfo(char *pid_str);
static void do_getplugin(char *plugin_str);
static void do_getpolicy(void);
static void do_getqbufsz(void);
static void do_getqctrl(void);
static void do_getqdelay(void);
static void do_getqhiwater(void);
static void do_getqlowater(void);
static void do_getstat(void);
static void do_gettermid(void);
static void do_lsevent(void);
static void do_lspolicy(void);
static void do_setasid(char *sid_str, char **argv);
static void do_setaudit(char *user_str, char *mask_str, char *tid_str,
    char *sid_str, char **argv);
static void do_setauid(char *user, char **argv);
static void do_setclass(char *event_str, au_mask_t *mask);
static void do_setflags(char *audit_flags, au_mask_t *amask);
static void do_setkmask(au_mask_t *pmask);
static void do_setnaflags(char *audit_naflags, au_mask_t *namask);
static void do_setpmask(char *pid_str, au_mask_t *mask);
static void do_setsmask(char *asid_str, au_mask_t *mask);
static void do_setumask(char *auid_str, au_mask_t *mask);
static void do_setplugin(char *plugin_str, boolean_t plugin_state,
    char *plugin_attr, int plugin_qsize);
static void do_setpolicy(char *policy_str);
static void do_setqbufsz(char *bufsz);
static void do_setqctrl(char *hiwater, char *lowater, char *bufsz, char *delay);
static void do_setqdelay(char *delay);
static void do_setqhiwater(char *hiwater);
static void do_setqlowater(char *lowater);
static void do_setstat(void);
static void str2tid(char *tid_str, au_tid_addr_t *tp);

static void eauditon(int cmd, caddr_t data, int length);
static void echkflags(char *auditflags, au_mask_t *mask);
static void egetaudit(auditinfo_addr_t *ai, int size);
static void egetauditflagsbin(char *auditflags, au_mask_t *pmask);
static void egetauid(au_id_t *auid);
static void egetkaudit(auditinfo_addr_t *ai, int size);
static void esetaudit(auditinfo_addr_t *ai, int size);
static void esetauid(au_id_t *auid);
static void esetkaudit(auditinfo_addr_t *ai, int size);
static void execit(char **argv);
static void exit_error(char *fmt, ...);
static void exit_usage(int status);
static void parse_args(int argc, char **argv, au_mask_t *mask);
static void print_asid(au_asid_t asid);
static void print_auid(au_id_t auid);
static void print_mask(char *desc, au_mask_t *pmp);
static void print_plugin(char *plugin_name, kva_t *plugin_kva);
static void print_tid_ex(au_tid_addr_t *tidp);

#if !defined(TEXT_DOMAIN)
#define	TEXT_DOMAIN	"SUNW_OST_OSCMD"
#endif

int
main(int argc, char **argv)
{
	au_mask_t mask;			/* for options manipulating flags */

	(void) setlocale(LC_ALL, "");
	(void) textdomain(TEXT_DOMAIN);

	if (argc == 1) {
		exit_usage(0);
	}

	if (argc == 2 &&
	    (argv[1][0] == '?' ||
	    strcmp(argv[1], "-h") == 0 ||
	    strcmp(argv[1], "-?") == 0)) {
		exit_usage(0);
	}

	parse_args(argc, argv, &mask);
	do_args(argv, &mask);

	return (0);
}

/*
 * parse_args()
 *     Desc: Checks command line argument syntax.
 *     Inputs: Command line argv;
 *     Returns: If a syntax error is detected, a usage message is printed
 *              and exit() is called. If a syntax error is not detected,
 *              parse_args() returns without a value.
 */
static void
parse_args(int argc, char **argv, au_mask_t *mask)
{
	arg_entry_t *ae;

	uint_t type;
	uint_t addr[4];

	for (++argv; *argv; argv++) {
		if ((ae = get_arg_ent(*argv)) == NULL) {
			exit_usage(1);
		}

		switch (ae->auditconfig_cmd) {

		case AC_ARG_AUDIT:
			++argv;
			if (!*argv)
				exit_usage(1);
			if (strisnum(*argv)) {
				chk_event_num(AC_USER_EVENT,
				    (au_event_t)atol(*argv));
			} else {
				chk_event_str(AC_USER_EVENT, *argv);
			}
			++argv;
			if (!*argv)
				exit_usage(1);
			chk_sorf(*argv);
			++argv;
			if (!*argv)
				exit_usage(1);
			chk_retval(*argv);
			++argv;
			if (!*argv)
				exit_usage(1);
			break;

		case AC_ARG_CHKCONF:
		case AC_ARG_CONF:
		case AC_ARG_ACONF:
		case AC_ARG_CHKACONF:
		case AC_ARG_GETASID:
		case AC_ARG_GETAUID:
		case AC_ARG_GETAUDIT:
		case AC_ARG_GETKAUDIT:
			break;

		case AC_ARG_GETCLASS:
		case AC_ARG_GETESTATE:
			++argv;
			if (!*argv)
				exit_usage(1);
			if (strisnum(*argv)) {
				chk_event_num(AC_KERN_EVENT,
				    (au_event_t)atol(*argv));
			} else {
				chk_event_str(AC_KERN_EVENT, *argv);
			}
			break;

		case AC_ARG_GETCAR:
		case AC_ARG_GETCOND:
		case AC_ARG_GETCWD:
		case AC_ARG_GETFLAGS:
		case AC_ARG_GETKMASK:
		case AC_ARG_GETNAFLAGS:
			break;

		case AC_ARG_GETPLUGIN:
			if (*++argv == NULL) {
				--argv;
				break;
			}
			if (get_arg_ent(*argv) != NULL) {
				--argv;
			} else {
				chk_arg_len(*argv, PLUGIN_MAXBUF);
				chk_known_plugin(*argv);
			}
			break;

		case AC_ARG_GETPOLICY:
		case AC_ARG_GETQBUFSZ:
		case AC_ARG_GETQCTRL:
		case AC_ARG_GETQDELAY:
		case AC_ARG_GETQHIWATER:
		case AC_ARG_GETQLOWATER:
		case AC_ARG_GETSTAT:
		case AC_ARG_GETTERMID:
		case AC_ARG_LSEVENT:
		case AC_ARG_LSPOLICY:
			break;

		case AC_ARG_SETASID:
		case AC_ARG_SETAUID:
		case AC_ARG_SETAUDIT:
			++argv;
			if (!*argv)
				exit_usage(1);

			while (*argv)
				++argv;
			--argv;

			break;

		case AC_ARG_SETKAUDIT:
			++argv;
			if (!*argv)
				exit_usage(1);
			if (str2type (*argv, &type))
				exit_error(gettext(
				    "Invalid IP address type specified."));
			++argv;
			if (!*argv)
				exit_usage(1);

			if (str2ipaddr(*argv, addr, type))
				exit_error(
				    gettext("Invalid IP address specified."));
			break;

		case AC_ARG_SETCLASS:
			++argv;
			if (!*argv)
				exit_usage(1);
			if (strisnum(*argv))
				chk_event_num(AC_KERN_EVENT,
				    (au_event_t)atol(*argv));
			else
				chk_event_str(AC_KERN_EVENT, *argv);
			++argv;
			if (!*argv)
				exit_usage(1);
			echkflags(*argv, mask);
			break;

		case AC_ARG_SETFLAGS:
			++argv;
			if (!*argv)
				exit_usage(1);
			chk_arg_len(*argv, PRESELECTION_MAXBUF);
			echkflags(*argv, mask);
			break;

		case AC_ARG_SETKMASK:
			++argv;
			if (!*argv)
				exit_usage(1);
			echkflags(*argv, mask);
			break;

		case AC_ARG_SETNAFLAGS:
			++argv;
			if (!*argv)
				exit_usage(1);
			chk_arg_len(*argv, PRESELECTION_MAXBUF);
			echkflags(*argv, mask);
			break;

		case AC_ARG_SETPLUGIN:
			if (*++argv == NULL || get_arg_ent(*argv) != NULL) {
				exit_usage(1);
			}
			chk_known_plugin(*argv);
			chk_arg_len(*argv, PLUGIN_MAXBUF);
			if (*++argv == NULL || strcmp(*argv, "active") != 0 &&
			    strcmp(*argv, "inactive") != 0) {
				exit_usage(1);
			}
			if (*++argv == NULL || get_arg_ent(*argv) != NULL) {
				--argv;
				break;
			}
			chk_arg_len(*argv, PLUGIN_MAXATT);
			if (*++argv == NULL || get_arg_ent(*argv) != NULL) {
				--argv;
				break;
			}
			if (atoi(*argv) < 0) {
				exit_error(gettext("Incorrect qsize specified "
				    "(%s)."), *argv);
			}
			break;

		case AC_ARG_SETPOLICY:
			++argv;
			if (!*argv)
				exit_usage(1);
			break;

		case AC_ARG_SETSTAT:
			break;

		case AC_ARG_GETPINFO:
			++argv;
			if (!*argv)
				exit_usage(1);
			break;

		case AC_ARG_SETPMASK:
			++argv;
			if (!*argv)
				exit_usage(1);
			++argv;
			if (!*argv)
				exit_usage(1);
			echkflags(*argv, mask);
			break;

		case AC_ARG_SETQBUFSZ:
			++argv;
			if (!*argv)
				exit_usage(1);
			if (!strisnum(*argv))
				exit_error(gettext("Invalid bufsz specified."));
			break;

		case AC_ARG_SETQCTRL:
			++argv;
			if (!*argv)
				exit_usage(1);
			if (!strisnum(*argv))
				exit_error(
				    gettext("Invalid hiwater specified."));
			++argv;
			if (!*argv)
				exit_usage(1);
			if (!strisnum(*argv))
				exit_error(
				    gettext("Invalid lowater specified."));
			++argv;
			if (!*argv)
				exit_usage(1);
			if (!strisnum(*argv))
				exit_error(gettext("Invalid bufsz specified."));
			++argv;
			if (!*argv)
				exit_usage(1);
			if (!strisnum(*argv))
				exit_error(gettext("Invalid delay specified."));
			break;

		case AC_ARG_SETQDELAY:
			++argv;
			if (!*argv)
				exit_usage(1);
			if (!strisnum(*argv))
				exit_error(gettext("Invalid delay specified."));
			break;

		case AC_ARG_SETQHIWATER:
			++argv;
			if (!*argv)
				exit_usage(1);
			if (!strisnum(*argv)) {
				exit_error(
				    gettext("Invalid hiwater specified."));
			}
			break;

		case AC_ARG_SETQLOWATER:
			++argv;
			if (!*argv)
				exit_usage(1);
			if (!strisnum(*argv)) {
				exit_error(
				    gettext("Invalid lowater specified."));
			}
			break;

		case AC_ARG_SETSMASK:
		case AC_ARG_SETUMASK:
			++argv;
			if (!*argv)
				exit_usage(1);
			++argv;
			if (!*argv)
				exit_usage(1);
			echkflags(*argv, mask);
			break;

		case AC_ARG_SET_TEMPORARY:
			/* Do not accept single -t option. */
			if (argc == 2) {
				exit_error(
				    gettext("Only the -t option specified "
				    "(it is not a standalone option)."));
			}
			temporary_set = B_TRUE;
			break;

		default:
			exit_error(gettext("Internal error #1."));
			break;
		}
	}
}


/*
 * do_args() - do command line arguments in the order in which they appear.
 * Function return values returned by the underlying functions; the semantics
 * they should follow is to return B_TRUE on successful execution, B_FALSE
 * otherwise.
 */
static void
do_args(char **argv, au_mask_t *mask)
{
	arg_entry_t	*ae;

	for (++argv; *argv; argv++) {
		ae = get_arg_ent(*argv);

		switch (ae->auditconfig_cmd) {

		case AC_ARG_AUDIT:
			{
				char sorf;
				int  retval;
				char *event_name;
				char *audit_str;

				++argv;
				event_name = *argv;
				++argv;
				sorf = (char)atoi(*argv);
				++argv;
				retval = atoi(*argv);
				++argv;
				audit_str = *argv;
				do_audit(event_name, sorf, retval, audit_str);
			}
			break;

		case AC_ARG_CHKCONF:
			do_chkconf();
			break;

		case AC_ARG_CONF:
			do_conf();
			break;

		case AC_ARG_CHKACONF:
			do_chkaconf();
			break;

		case AC_ARG_ACONF:
			do_aconf();
			break;

		case AC_ARG_GETASID:
			do_getasid();
			break;

		case AC_ARG_GETAUID:
			do_getauid();
			break;

		case AC_ARG_GETAUDIT:
			do_getaudit();
			break;

		case AC_ARG_GETKAUDIT:
			do_getkaudit();
			break;

		case AC_ARG_GETCLASS:
		case AC_ARG_GETESTATE:
			++argv;
			do_getclass(*argv);
			break;

		case AC_ARG_GETCAR:
			do_getcar();
			break;

		case AC_ARG_GETCOND:
			do_getcond();
			break;

		case AC_ARG_GETCWD:
			do_getcwd();
			break;

		case AC_ARG_GETFLAGS:
			do_getflags();
			break;

		case AC_ARG_GETKMASK:
			do_getkmask();
			break;

		case AC_ARG_GETNAFLAGS:
			do_getnaflags();
			break;

		case AC_ARG_GETPLUGIN:
			{
				char	*plugin_str = NULL;

				++argv;
				if (*argv != NULL) {
					if (get_arg_ent(*argv) != NULL) {
						--argv;
					} else {
						plugin_str = *argv;
					}
				} else {
					--argv;
				}

				do_getplugin(plugin_str);
			}
			break;

		case AC_ARG_GETPOLICY:
			do_getpolicy();
			break;

		case AC_ARG_GETQBUFSZ:
			do_getqbufsz();
			break;

		case AC_ARG_GETQCTRL:
			do_getqctrl();
			break;

		case AC_ARG_GETQDELAY:
			do_getqdelay();
			break;

		case AC_ARG_GETQHIWATER:
			do_getqhiwater();
			break;

		case AC_ARG_GETQLOWATER:
			do_getqlowater();
			break;

		case AC_ARG_GETSTAT:
			do_getstat();
			break;

		case AC_ARG_GETTERMID:
			do_gettermid();
			break;

		case AC_ARG_LSEVENT:
			do_lsevent();
			break;

		case AC_ARG_LSPOLICY:
			do_lspolicy();
			break;

		case AC_ARG_SETASID:
			{
				char *sid_str;

				++argv;
				sid_str = *argv;
				++argv;
				do_setasid(sid_str, argv);
			}
			break;

		case AC_ARG_SETAUID:
			{
				char *user;

				++argv;
				user = *argv;
				++argv;
				do_setauid(user, argv);
			}
			break;

		case AC_ARG_SETAUDIT:
			{
				char *user_str;
				char *mask_str;
				char *tid_str;
				char *sid_str;

				++argv;
				user_str = *argv;
				++argv;
				mask_str = *argv;
				++argv;
				tid_str = *argv;
				++argv;
				sid_str = *argv;
				++argv;
				do_setaudit(user_str, mask_str, tid_str,
				    sid_str, argv);
			}
			break;

		case AC_ARG_SETKAUDIT:
			{
				char *address_type, *address;

				++argv; address_type = *argv;
				++argv; address = *argv;
				do_setkaudit(address_type, address);
			}
			break;

		case AC_ARG_SETCLASS:
			{
				char *event_str;

				++argv;
				event_str = *argv;
				do_setclass(event_str, mask);

				++argv;
			}
			break;

		case AC_ARG_SETFLAGS:
			++argv;
			do_setflags(*argv, mask);
			break;

		case AC_ARG_SETKMASK:
			++argv;
			do_setkmask(mask);
			break;

		case AC_ARG_SETNAFLAGS:
			++argv;
			do_setnaflags(*argv, mask);
			break;

		case AC_ARG_SETPLUGIN:
			{
				char		*plugin_str = NULL;
				boolean_t	plugin_state = B_FALSE;
				char		*plugin_att = NULL;
				int		plugin_qsize = -1;

				plugin_str = *++argv;
				if (strcmp(*++argv, "active") == 0) {
					plugin_state = B_TRUE;
				}
				if (*++argv != NULL &&
				    get_arg_ent(*argv) == NULL) {
					plugin_att = *argv;
					if (*++argv != NULL &&
					    get_arg_ent(*argv) == NULL) {
						plugin_qsize = atoi(*argv);
					} else {
						--argv;
					}
				} else {
					--argv;
				}

				do_setplugin(plugin_str, plugin_state,
				    plugin_att, plugin_qsize);
			}
			break;

		case AC_ARG_SETPOLICY:
			++argv;
			do_setpolicy(*argv);
			break;

		case AC_ARG_GETPINFO:
			{
				char *pid_str;

				++argv;
				pid_str = *argv;
				do_getpinfo(pid_str);
			}
			break;

		case AC_ARG_SETPMASK:
			{
				char *pid_str;

				++argv;
				pid_str = *argv;
				do_setpmask(pid_str, mask);

				++argv;
			}
			break;

		case AC_ARG_SETSTAT:
			do_setstat();
			break;

		case AC_ARG_SETQBUFSZ:
			++argv;
			do_setqbufsz(*argv);
			break;

		case AC_ARG_SETQCTRL:
			{
				char *hiwater, *lowater, *bufsz, *delay;

				++argv; hiwater = *argv;
				++argv; lowater = *argv;
				++argv; bufsz = *argv;
				++argv; delay = *argv;
				do_setqctrl(hiwater, lowater, bufsz, delay);
			}
			break;
		case AC_ARG_SETQDELAY:
			++argv;
			do_setqdelay(*argv);
			break;

		case AC_ARG_SETQHIWATER:
			++argv;
			do_setqhiwater(*argv);
			break;

		case AC_ARG_SETQLOWATER:
			++argv;
			do_setqlowater(*argv);
			break;

		case AC_ARG_SETSMASK:
			{
				char *asid_str;

				++argv;
				asid_str = *argv;
				do_setsmask(asid_str, mask);

				++argv;
			}
			break;
		case AC_ARG_SETUMASK:
			{
				char *auid_str;

				++argv;
				auid_str = *argv;
				do_setumask(auid_str, mask);

				++argv;
			}
			break;
		case AC_ARG_SET_TEMPORARY:
			break;

		default:
			exit_error(gettext("Internal error #2."));
			break;
		}
	}
}

/*
 * do_chkconf() - the returned value is for the global zone unless AUDIT_PERZONE
 * is set.
 */
static void
do_chkconf(void)
{
	register au_event_ent_t *evp;
	au_mask_t pmask;
	char conf_aflags[256];
	char run_aflags[256];
	au_stat_t as;
	int class;
	int			len;
	struct au_evclass_map	cmap;

	pmask.am_success = pmask.am_failure = 0;
	eauditon(A_GETSTAT, (caddr_t)&as, 0);

	setauevent();
	if (getauevent() == NULL) {
		exit_error(gettext("NO AUDIT EVENTS: Could not read %s\n."),
		    AUDITEVENTFILE);
	}

	setauevent();
	while ((evp = getauevent()) != NULL) {
		cmap.ec_number = evp->ae_number;
		len = sizeof (struct au_evclass_map);
		if (evp->ae_number <= as.as_numevent) {
			if (auditon(A_GETCLASS, (caddr_t)&cmap, len) == -1) {
				(void) printf("%s(%hu):%s",
				    evp->ae_name, evp->ae_number,
				    gettext("UNKNOWN EVENT: Could not get "
				    "class for event. Configuration may "
				    "be bad.\n"));
			} else {
				class = cmap.ec_class;
				if (class != evp->ae_class) {
					conf_aflags[0] = run_aflags[0] = '\0';
					pmask.am_success = class;
					pmask.am_failure = class;
					(void) getauditflagschar(run_aflags,
					    &pmask, 0);
					pmask.am_success = evp->ae_class;
					pmask.am_failure = evp->ae_class;
					(void) getauditflagschar(conf_aflags,
					    &pmask, 0);

					(void) printf(gettext(
					    "%s(%hu): CLASS MISMATCH: "
					    "runtime class (%s) != "
					    "configured class (%s)\n"),
					    evp->ae_name, evp->ae_number,
					    NONE(run_aflags),
					    NONE(conf_aflags));
				}
			}
		}
	}
	endauevent();
}

/*
 * do_conf() - configure the kernel events. The value returned to the user is
 * for the global zone unless AUDIT_PERZONE is set.
 */
static void
do_conf(void)
{
	register au_event_ent_t *evp;
	register int i;
	au_evclass_map_t ec;
	au_stat_t as;

	eauditon(A_GETSTAT, (caddr_t)&as, 0);

	i = 0;
	setauevent();
	while ((evp = getauevent()) != NULL) {
		if (evp->ae_number <= as.as_numevent) {
			++i;
			ec.ec_number = evp->ae_number;
			ec.ec_class = evp->ae_class;
			eauditon(A_SETCLASS, (caddr_t)&ec, sizeof (ec));
		}
	}
	endauevent();
	(void) printf(gettext("Configured %d kernel events.\n"), i);

}

/*
 * do_chkaconf() - report a mismatch if the runtime class mask of a kernel audit
 * event does not match the configured class mask. The value returned to the
 * user is for the global zone unless AUDIT_PERZONE is set.
 */
static void
do_chkaconf(void)
{
	char		*namask_cfg;
	au_mask_t	pmask, kmask;

	if (!do_getnaflags_scf(&namask_cfg) || namask_cfg == NULL) {
		exit_error(gettext("Could not get configured value."));
	}
	egetauditflagsbin(namask_cfg, &pmask);

	eauditon(A_GETKMASK, (caddr_t)&kmask, sizeof (kmask));

	if ((pmask.am_success != kmask.am_success) ||
	    (pmask.am_failure != kmask.am_failure)) {
		char kbuf[2048];
		if (getauditflagschar(kbuf, &kmask, 0) < 0) {
			free(namask_cfg);
			(void) fprintf(stderr,
			    gettext("bad kernel non-attributable mask\n"));
			exit(1);
		}
		(void) printf(
		    gettext("non-attributable event flags mismatch:\n"));
		(void) printf(gettext("active non-attributable audit flags "
		    "= %s\n"), kbuf);
		(void) printf(gettext("configured non-attributable audit flags "
		    "= %s\n"), namask_cfg);
	}
	free(namask_cfg);
}

/*
 * do_aconf - configures the non-attributable events. The value returned to the
 * user is for the global zone unless AUDIT_PERZONE is set.
 */
static void
do_aconf(void)
{
	au_mask_t	namask;
	char		*namask_cfg;

	if (!do_getnaflags_scf(&namask_cfg) || namask_cfg == NULL) {
		exit_error(gettext("Could not get configured value."));
	}
	egetauditflagsbin(namask_cfg, &namask);
	free(namask_cfg);

	eauditon(A_SETKMASK, (caddr_t)&namask, sizeof (namask));
	(void) printf(gettext("Configured non-attributable event mask.\n"));
}

/*
 * do_audit() - construct an audit record for audit event event using the
 * process's audit characteristics containing a text token string audit_str. The
 * return token is constructed from the success/failure flag sort. Returned
 * value retval is an errno value.
 */
static void
do_audit(char *event, char sorf, int retval, char *audit_str)
{
	int rtn;
	int rd;
	au_event_t event_num;
	au_event_ent_t *evp;
	auditinfo_addr_t ai;
	token_t *tokp;

	egetaudit(&ai, sizeof (ai));

	if (strisnum(event)) {
		event_num = (au_event_t)atoi(event);
		evp = egetauevnum(event_num);
	} else {
		evp = egetauevnam(event);
	}

	rtn = au_preselect(evp->ae_number, &ai.ai_mask, (int)sorf,
	    AU_PRS_USECACHE);

	if (rtn == -1) {
		exit_error("%s\n%s %hu\n",
		    gettext("Check audit event configuration."),
		    gettext("Could not get audit class for event number"),
		    evp->ae_number);
	}

	/* record is preselected */
	if (rtn == 1) {
		if ((rd = au_open()) == -1) {
			exit_error(gettext(
			    "Could not get and audit record descriptor\n"));
		}
		if ((tokp = au_to_me()) == NULL) {
			exit_error(
			    gettext("Could not allocate subject token\n"));
		}
		if (au_write(rd, tokp) == -1) {
			exit_error(gettext("Could not construct subject token "
			    "of audit record\n"));
		}
		if (is_system_labeled()) {
			if ((tokp = au_to_mylabel()) == NULL) {
				exit_error(gettext(
				    "Could not allocate label token\n"));
			}
			if (au_write(rd, tokp) == -1) {
				exit_error(gettext("Could not "
				    "construct label token of audit record\n"));
			}
		}

		if ((tokp = au_to_text(audit_str)) == NULL)
			exit_error(gettext("Could not allocate text token\n"));
		if (au_write(rd, tokp) == -1)
			exit_error(gettext("Could not construct text token of "
			    "audit record\n"));
#ifdef _LP64
		if ((tokp = au_to_return64(sorf, retval)) == NULL)
#else
		if ((tokp = au_to_return32(sorf, retval)) == NULL)
#endif
			exit_error(
			    gettext("Could not allocate return token\n"));
		if (au_write(rd, tokp) == -1) {
			exit_error(gettext("Could not construct return token "
			    "of audit record\n"));
		}
		if (au_close(rd, 1, evp->ae_number) == -1) {
			exit_error(
			    gettext("Could not write audit record: %s\n"),
			    strerror(errno));
		}
	}
}

/*
 * do_getauid() - print the audit id of the current process.
 */
static void
do_getauid(void)
{
	au_id_t auid;

	egetauid(&auid);
	print_auid(auid);
}

/*
 * do_getaudit() - print the audit characteristics of the current process.
 */
static void