17c478bdstevel@tonic-gate/*
27c478bdstevel@tonic-gate * CDDL HEADER START
37c478bdstevel@tonic-gate *
47c478bdstevel@tonic-gate * The contents of this file are subject to the terms of the
545916cdjpk * Common Development and Distribution License (the "License").
645916cdjpk * You may not use this file except in compliance with the License.
77c478bdstevel@tonic-gate *
87c478bdstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
97c478bdstevel@tonic-gate * or http://www.opensolaris.org/os/licensing.
107c478bdstevel@tonic-gate * See the License for the specific language governing permissions
117c478bdstevel@tonic-gate * and limitations under the License.
127c478bdstevel@tonic-gate *
137c478bdstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each
147c478bdstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
157c478bdstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the
167c478bdstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying
177c478bdstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner]
187c478bdstevel@tonic-gate *
197c478bdstevel@tonic-gate * CDDL HEADER END
207c478bdstevel@tonic-gate */
21794f0adRoger A. Faulkner
227c478bdstevel@tonic-gate/*
234a0fa54Marek Pospisil * Copyright (c) 1992, 2010, Oracle and/or its affiliates. All rights reserved.
2489b4368Bayard Bell * Copyright (c) 2011 Bayard G. Bell. All rights reserved.
2515c07adJohn Levon * Copyright (c) 2018, Joyent, Inc.
267c478bdstevel@tonic-gate */
277c478bdstevel@tonic-gate
287c478bdstevel@tonic-gate/*
297c478bdstevel@tonic-gate * This file contains the audit event table used to control the production
307c478bdstevel@tonic-gate * of audit records for each system call.
317c478bdstevel@tonic-gate */
327c478bdstevel@tonic-gate
337c478bdstevel@tonic-gate#include <sys/policy.h>
347c478bdstevel@tonic-gate#include <sys/cred.h>
357c478bdstevel@tonic-gate#include <sys/types.h>
367c478bdstevel@tonic-gate#include <sys/systm.h>
377c478bdstevel@tonic-gate#include <sys/systeminfo.h>	/* for sysinfo auditing */
387c478bdstevel@tonic-gate#include <sys/utsname.h>	/* for sysinfo auditing */
397c478bdstevel@tonic-gate#include <sys/proc.h>
407c478bdstevel@tonic-gate#include <sys/vnode.h>
417c478bdstevel@tonic-gate#include <sys/mman.h>		/* for mmap(2) auditing etc. */
427c478bdstevel@tonic-gate#include <sys/fcntl.h>
437c478bdstevel@tonic-gate#include <sys/modctl.h>		/* for modctl auditing */
447c478bdstevel@tonic-gate#include <sys/vnode.h>
457c478bdstevel@tonic-gate#include <sys/user.h>
467c478bdstevel@tonic-gate#include <sys/types.h>
477c478bdstevel@tonic-gate#include <sys/processor.h>
487c478bdstevel@tonic-gate#include <sys/procset.h>
497c478bdstevel@tonic-gate#include <sys/acl.h>
507c478bdstevel@tonic-gate#include <sys/ipc.h>
517c478bdstevel@tonic-gate#include <sys/door.h>
527c478bdstevel@tonic-gate#include <sys/sem.h>
537c478bdstevel@tonic-gate#include <sys/msg.h>
547c478bdstevel@tonic-gate#include <sys/shm.h>
557c478bdstevel@tonic-gate#include <sys/kmem.h>
567c478bdstevel@tonic-gate#include <sys/file.h>		/* for accept */
577c478bdstevel@tonic-gate#include <sys/utssys.h>		/* for fuser */
5845916cdjpk#include <sys/tsol/label.h>
5961b9bf5rica#include <sys/tsol/tndb.h>
6061b9bf5rica#include <sys/tsol/tsyscall.h>
617c478bdstevel@tonic-gate#include <c2/audit.h>
627c478bdstevel@tonic-gate#include <c2/audit_kernel.h>
637c478bdstevel@tonic-gate#include <c2/audit_kevents.h>
647c478bdstevel@tonic-gate#include <c2/audit_record.h>
657c478bdstevel@tonic-gate#include <sys/procset.h>
667c478bdstevel@tonic-gate#include <nfs/mount.h>
677c478bdstevel@tonic-gate#include <sys/param.h>
687c478bdstevel@tonic-gate#include <sys/debug.h>
697c478bdstevel@tonic-gate#include <sys/sysmacros.h>
707c478bdstevel@tonic-gate#include <sys/stream.h>
717c478bdstevel@tonic-gate#include <sys/strsubr.h>
727c478bdstevel@tonic-gate#include <sys/stropts.h>
737c478bdstevel@tonic-gate#include <sys/tihdr.h>
747c478bdstevel@tonic-gate#include <sys/socket.h>
757c478bdstevel@tonic-gate#include <sys/socketvar.h>
760f1702cYu Xiangning<Eric.Yu@Sun.COM>#include <sys/vfs_opreg.h>
770f1702cYu Xiangning<Eric.Yu@Sun.COM>#include <fs/sockfs/sockcommon.h>
787c478bdstevel@tonic-gate#include <netinet/in.h>
797c478bdstevel@tonic-gate#include <sys/ddi.h>
80df2381bpraks#include <sys/port_impl.h>
81d2a7078Richard Lowe#include <sys/secflags.h>
82df2381bpraks
838fd04b8Roger A. Faulknerstatic au_event_t	aui_fchownat(au_event_t);
84794f0adRoger A. Faulknerstatic au_event_t	aui_fchmodat(au_event_t);
857c478bdstevel@tonic-gatestatic au_event_t	aui_open(au_event_t);
868fd04b8Roger A. Faulknerstatic au_event_t	aui_openat(au_event_t);
878fd04b8Roger A. Faulknerstatic au_event_t	aui_unlinkat(au_event_t);
888fd04b8Roger A. Faulknerstatic au_event_t	aui_fstatat(au_event_t);
897c478bdstevel@tonic-gatestatic au_event_t	aui_msgsys(au_event_t);
907c478bdstevel@tonic-gatestatic au_event_t	aui_shmsys(au_event_t);
917c478bdstevel@tonic-gatestatic au_event_t	aui_semsys(au_event_t);
927c478bdstevel@tonic-gatestatic au_event_t	aui_utssys(au_event_t);
937c478bdstevel@tonic-gatestatic au_event_t	aui_fcntl(au_event_t);
947c478bdstevel@tonic-gatestatic au_event_t	aui_execve(au_event_t);
957c478bdstevel@tonic-gatestatic au_event_t	aui_memcntl(au_event_t);
967c478bdstevel@tonic-gatestatic au_event_t	aui_sysinfo(au_event_t);
97df2381bpraksstatic au_event_t	aui_portfs(au_event_t);
987c478bdstevel@tonic-gatestatic au_event_t	aui_auditsys(au_event_t);
997c478bdstevel@tonic-gatestatic au_event_t	aui_modctl(au_event_t);
1007c478bdstevel@tonic-gatestatic au_event_t	aui_acl(au_event_t);
1017c478bdstevel@tonic-gatestatic au_event_t	aui_doorfs(au_event_t);
1027c478bdstevel@tonic-gatestatic au_event_t	aui_privsys(au_event_t);
103657b1f3rafstatic au_event_t	aui_forksys(au_event_t);
10461b9bf5ricastatic au_event_t	aui_labelsys(au_event_t);
1054be8c57Jan Friedelstatic au_event_t	aui_setpgrp(au_event_t);
1067c478bdstevel@tonic-gate
107d2a7078Richard Lowe
108cb49a9fMarek Pospisilstatic void	aus_exit(struct t_audit_data *);
1097c478bdstevel@tonic-gatestatic void	aus_open(struct t_audit_data *);
1108fd04b8Roger A. Faulknerstatic void	aus_openat(struct t_audit_data *);
1117c478bdstevel@tonic-gatestatic void	aus_acl(struct t_audit_data *);
1127c478bdstevel@tonic-gatestatic void	aus_acct(struct t_audit_data *);
1137c478bdstevel@tonic-gatestatic void	aus_chown(struct t_audit_data *);
1147c478bdstevel@tonic-gatestatic void	aus_fchown(struct t_audit_data *);
1157c478bdstevel@tonic-gatestatic void	aus_lchown(struct t_audit_data *);
1168fd04b8Roger A. Faulknerstatic void	aus_fchownat(struct t_audit_data *);
1177c478bdstevel@tonic-gatestatic void	aus_chmod(struct t_audit_data *);
1187c478bdstevel@tonic-gatestatic void	aus_facl(struct t_audit_data *);
1197c478bdstevel@tonic-gatestatic void	aus_fchmod(struct t_audit_data *);
120794f0adRoger A. Faulknerstatic void	aus_fchmodat(struct t_audit_data *);
1217c478bdstevel@tonic-gatestatic void	aus_fcntl(struct t_audit_data *);
1227c478bdstevel@tonic-gatestatic void	aus_mkdir(struct t_audit_data *);
123794f0adRoger A. Faulknerstatic void	aus_mkdirat(struct t_audit_data *);
1247c478bdstevel@tonic-gatestatic void	aus_mknod(struct t_audit_data *);
125794f0adRoger A. Faulknerstatic void	aus_mknodat(struct t_audit_data *);
1267c478bdstevel@tonic-gatestatic void	aus_mount(struct t_audit_data *);
1277c478bdstevel@tonic-gatestatic void	aus_umount2(struct t_audit_data *);
1287c478bdstevel@tonic-gatestatic void	aus_msgsys(struct t_audit_data *);
1297c478bdstevel@tonic-gatestatic void	aus_semsys(struct t_audit_data *);
1307c478bdstevel@tonic-gatestatic void	aus_close(struct t_audit_data *);
1317c478bdstevel@tonic-gatestatic void	aus_fstatfs(struct t_audit_data *);
1327c478bdstevel@tonic-gatestatic void	aus_setgid(struct t_audit_data *);
1334be8c57Jan Friedelstatic void	aus_setpgrp(struct t_audit_data *);
1347c478bdstevel@tonic-gatestatic void	aus_setuid(struct t_audit_data *);
1357c478bdstevel@tonic-gatestatic void	aus_shmsys(struct t_audit_data *);
1367c478bdstevel@tonic-gatestatic void	aus_doorfs(struct t_audit_data *);
1377c478bdstevel@tonic-gatestatic void	aus_ioctl(struct t_audit_data *);
1387c478bdstevel@tonic-gatestatic void	aus_memcntl(struct t_audit_data *);
1397c478bdstevel@tonic-gatestatic void	aus_mmap(struct t_audit_data *);
1407c478bdstevel@tonic-gatestatic void	aus_munmap(struct t_audit_data *);
1417c478bdstevel@tonic-gatestatic void	aus_priocntlsys(struct t_audit_data *);
1427c478bdstevel@tonic-gatestatic void	aus_setegid(struct t_audit_data *);
1437c478bdstevel@tonic-gatestatic void	aus_setgroups(struct t_audit_data *);
1447c478bdstevel@tonic-gatestatic void	aus_seteuid(struct t_audit_data *);
1457c478bdstevel@tonic-gatestatic void	aus_putmsg(struct t_audit_data *);
1467c478bdstevel@tonic-gatestatic void	aus_putpmsg(struct t_audit_data *);
1477c478bdstevel@tonic-gatestatic void	aus_getmsg(struct t_audit_data *);
1487c478bdstevel@tonic-gatestatic void	aus_getpmsg(struct t_audit_data *);
1497c478bdstevel@tonic-gatestatic void	aus_auditsys(struct t_audit_data *);
1507c478bdstevel@tonic-gatestatic void	aus_sysinfo(struct t_audit_data *);
1517c478bdstevel@tonic-gatestatic void	aus_modctl(struct t_audit_data *);
1527c478bdstevel@tonic-gatestatic void	aus_kill(struct t_audit_data *);
1537c478bdstevel@tonic-gatestatic void	aus_setregid(struct t_audit_data *);
1547c478bdstevel@tonic-gatestatic void	aus_setreuid(struct t_audit_data *);
15561b9bf5ricastatic void	aus_labelsys(struct t_audit_data *);
1567c478bdstevel@tonic-gate
1577c478bdstevel@tonic-gatestatic void	auf_mknod(struct t_audit_data *, int, rval_t *);
158794f0adRoger A. Faulknerstatic void	auf_mknodat(struct t_audit_data *, int, rval_t *);
1597c478bdstevel@tonic-gatestatic void	auf_msgsys(struct t_audit_data *, int, rval_t *);
1607c478bdstevel@tonic-gatestatic void	auf_semsys(struct t_audit_data *, int, rval_t *);
1617c478bdstevel@tonic-gatestatic void	auf_shmsys(struct t_audit_data *, int, rval_t *);
1627c478bdstevel@tonic-gatestatic void	auf_read(struct t_audit_data *, int, rval_t *);
1637c478bdstevel@tonic-gatestatic void	auf_write(struct t_audit_data *, int, rval_t *);
1647c478bdstevel@tonic-gate
1657c478bdstevel@tonic-gatestatic void	aus_sigqueue(struct t_audit_data *);
1667c478bdstevel@tonic-gatestatic void	aus_p_online(struct t_audit_data *);
1677c478bdstevel@tonic-gatestatic void	aus_processor_bind(struct t_audit_data *);
1687c478bdstevel@tonic-gatestatic void	aus_inst_sync(struct t_audit_data *);
1699acbbeannstatic void	aus_brandsys(struct t_audit_data *);
1707c478bdstevel@tonic-gate
1717c478bdstevel@tonic-gatestatic void	auf_accept(struct t_audit_data *, int, rval_t *);
1727c478bdstevel@tonic-gate
1737c478bdstevel@tonic-gatestatic void	auf_bind(struct t_audit_data *, int, rval_t *);
1747c478bdstevel@tonic-gatestatic void	auf_connect(struct t_audit_data *, int, rval_t *);
1757c478bdstevel@tonic-gatestatic void	aus_shutdown(struct t_audit_data *);
1767c478bdstevel@tonic-gatestatic void	auf_setsockopt(struct t_audit_data *, int, rval_t *);
1777c478bdstevel@tonic-gatestatic void	aus_sockconfig(struct t_audit_data *);
1787c478bdstevel@tonic-gatestatic void	auf_recv(struct t_audit_data *, int, rval_t *);
1797c478bdstevel@tonic-gatestatic void	auf_recvmsg(struct t_audit_data *, int, rval_t *);
1807c478bdstevel@tonic-gatestatic void	auf_send(struct t_audit_data *, int, rval_t *);
1817c478bdstevel@tonic-gatestatic void	auf_sendmsg(struct t_audit_data *, int, rval_t *);
1827c478bdstevel@tonic-gatestatic void	auf_recvfrom(struct t_audit_data *, int, rval_t *);
1837c478bdstevel@tonic-gatestatic void	auf_sendto(struct t_audit_data *, int, rval_t *);
1847c478bdstevel@tonic-gatestatic void	aus_socket(struct t_audit_data *);
1857c478bdstevel@tonic-gate/*
1867c478bdstevel@tonic-gate * This table contains mapping information for converting system call numbers
1877c478bdstevel@tonic-gate * to audit event IDs. In several cases it is necessary to map a single system
1887c478bdstevel@tonic-gate * call to several events.
1897c478bdstevel@tonic-gate */
1907c478bdstevel@tonic-gate
191f9d0e02gww#define	aui_null	NULL	/* NULL initialize function */
192f9d0e02gww#define	aus_null	NULL	/* NULL start function */
193f9d0e02gww#define	auf_null	NULL	/* NULL finish function */
194f9d0e02gww
1957c478bdstevel@tonic-gatestruct audit_s2e audit_s2e[] =
1967c478bdstevel@tonic-gate{
1977c478bdstevel@tonic-gate/*
1980f48f68Toomas Soome * ----------	----------	----------	----------
1997c478bdstevel@tonic-gate * INITIAL	AUDIT		START		SYSTEM
2007c478bdstevel@tonic-gate * PROCESSING	EVENT		PROCESSING	CALL
2017c478bdstevel@tonic-gate * ----------	----------	----------	-----------
2027c478bdstevel@tonic-gate *		FINISH		EVENT
2037c478bdstevel@tonic-gate *		PROCESSING	CONTROL
2047c478bdstevel@tonic-gate * ----------------------------------------------------------
2057c478bdstevel@tonic-gate */
2067c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 0 unused (indirect) */
2077c478bdstevel@tonic-gate		auf_null,	0,
208cb49a9fMarek Pospisilaui_null,	AUE_EXIT,	aus_exit,	/* 1 exit */
2097c478bdstevel@tonic-gate		auf_null,	S2E_NPT,
210d2a7078Richard Loweaui_null,	AUE_PSECFLAGS,	aus_null,	/* 2 psecflags */
2117c478bdstevel@tonic-gate		auf_null,	0,
2127c478bdstevel@tonic-gateaui_null,	AUE_READ,	aus_null,	/* 3 read */
2137c478bdstevel@tonic-gate		auf_read,	S2E_PUB,
2147c478bdstevel@tonic-gateaui_null,	AUE_WRITE,	aus_null,	/* 4 write */
2157c478bdstevel@tonic-gate		auf_write,	0,
2167c478bdstevel@tonic-gateaui_open,	AUE_OPEN,	aus_open,	/* 5 open */
2177c478bdstevel@tonic-gate		auf_null,	S2E_SP,
2187c478bdstevel@tonic-gateaui_null,	AUE_CLOSE,	aus_close,	/* 6 close */
2197c478bdstevel@tonic-gate		auf_null,	0,
220794f0adRoger A. Faulkneraui_null,	AUE_LINK,	aus_null,	/* 7 linkat */
2218fd04b8Roger A. Faulkner		auf_null,	0,
2228fd04b8Roger A. Faulkneraui_null,	AUE_NULL,	aus_null,	/* 8 (loadable) was creat */
2237c478bdstevel@tonic-gate		auf_null,	0,
2247c478bdstevel@tonic-gateaui_null,	AUE_LINK,	aus_null,	/* 9 link */
2257c478bdstevel@tonic-gate		auf_null,	0,
2267c478bdstevel@tonic-gateaui_null,	AUE_UNLINK,	aus_null,	/* 10 unlink */
2277c478bdstevel@tonic-gate		auf_null,	0,
228794f0adRoger A. Faulkneraui_null,	AUE_SYMLINK,	aus_null,	/* 11 symlinkat */
2298fd04b8Roger A. Faulkner		auf_null,	0,
2307c478bdstevel@tonic-gateaui_null,	AUE_CHDIR,	aus_null,	/* 12 chdir */
2317c478bdstevel@tonic-gate		auf_null,	S2E_SP,
2327c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 13 time */
2337c478bdstevel@tonic-gate		auf_null,	0,
2347c478bdstevel@tonic-gateaui_null,	AUE_MKNOD,	aus_mknod,	/* 14 mknod */
235794f0adRoger A. Faulkner		auf_mknod,	S2E_MLD,
2367c478bdstevel@tonic-gateaui_null,	AUE_CHMOD,	aus_chmod,	/* 15 chmod */
2377c478bdstevel@tonic-gate		auf_null,	0,
2387c478bdstevel@tonic-gateaui_null,	AUE_CHOWN,	aus_chown,	/* 16 chown */
2397c478bdstevel@tonic-gate		auf_null,	0,
2407c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 17 brk */
2417c478bdstevel@tonic-gate		auf_null,	0,
2427c478bdstevel@tonic-gateaui_null,	AUE_STAT,	aus_null,	/* 18 stat */
2437c478bdstevel@tonic-gate		auf_null,	S2E_PUB,
2447c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 19 lseek */
2457c478bdstevel@tonic-gate		auf_null,	0,
2467c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 20 getpid */
2477c478bdstevel@tonic-gate		auf_null,	0,
2487c478bdstevel@tonic-gateaui_null,	AUE_MOUNT,	aus_mount,	/* 21 mount */
2497c478bdstevel@tonic-gate		auf_null,	S2E_MLD,
250794f0adRoger A. Faulkneraui_null,	AUE_READLINK,	aus_null,	/* 22 readlinkat */
251794f0adRoger A. Faulkner		auf_null,	S2E_PUB,
2527c478bdstevel@tonic-gateaui_null,	AUE_SETUID,	aus_setuid,	/* 23 setuid */
2537c478bdstevel@tonic-gate		auf_null,	0,
2547c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 24 getuid */
2557c478bdstevel@tonic-gate		auf_null,	0,
2567c478bdstevel@tonic-gateaui_null,	AUE_STIME,	aus_null,	/* 25 stime */
2577c478bdstevel@tonic-gate		auf_null,	0,
2588fd04b8Roger A. Faulkneraui_null,	AUE_NULL,	aus_null,	/* 26 pcsample */
2597c478bdstevel@tonic-gate		auf_null,	0,
2607c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 27 alarm */
2617c478bdstevel@tonic-gate		auf_null,	0,
2627c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 28 fstat */
2637c478bdstevel@tonic-gate		auf_null,	0,
2647c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 29 pause */
2657c478bdstevel@tonic-gate		auf_null,	0,
2668fd04b8Roger A. Faulkneraui_null,	AUE_NULL,	aus_null,	/* 30 (loadable) was utime */
2677c478bdstevel@tonic-gate		auf_null,	0,
2687c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 31 stty (TIOCSETP-audit?) */
2697c478bdstevel@tonic-gate		auf_null,	0,
2707c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 32 gtty */
2717c478bdstevel@tonic-gate		auf_null,	0,
2727c478bdstevel@tonic-gateaui_null,	AUE_ACCESS,	aus_null,	/* 33 access */
2737c478bdstevel@tonic-gate		auf_null,	S2E_PUB,
2747c478bdstevel@tonic-gateaui_null,	AUE_NICE,	aus_null,	/* 34 nice */
2757c478bdstevel@tonic-gate		auf_null,	0,
2767c478bdstevel@tonic-gateaui_null,	AUE_STATFS,	aus_null,	/* 35 statfs */
2777c478bdstevel@tonic-gate		auf_null,	S2E_PUB,
2787c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 36 sync */
2797c478bdstevel@tonic-gate		auf_null,	0,
2807c478bdstevel@tonic-gateaui_null,	AUE_KILL,	aus_kill,	/* 37 kill */
2817c478bdstevel@tonic-gate		auf_null,	0,
2827c478bdstevel@tonic-gateaui_null,	AUE_FSTATFS,	aus_fstatfs,	/* 38 fstatfs */
2837c478bdstevel@tonic-gate		auf_null,	S2E_PUB,
2844be8c57Jan Friedelaui_setpgrp,	AUE_SETPGRP,	aus_setpgrp,	/* 39 setpgrp */
2857c478bdstevel@tonic-gate		auf_null,	0,
2869acbbeannaui_null,	AUE_NULL,	aus_null,	/* 40 uucopystr */
2877c478bdstevel@tonic-gate		auf_null,	0,
2888fd04b8Roger A. Faulkneraui_null,	AUE_NULL,	aus_null,	/* 41 (loadable) was dup */
2897c478bdstevel@tonic-gate		auf_null,	0,
2908fd04b8Roger A. Faulkneraui_null,	AUE_PIPE,	aus_null,	/* 42 (loadable) pipe */
2917c478bdstevel@tonic-gate		auf_null,	0,
2927c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 43 times */
2937c478bdstevel@tonic-gate		auf_null,	0,
2947c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 44 profil */
2957c478bdstevel@tonic-gate		auf_null,	0,
2968fd04b8Roger A. Faulkneraui_null,	AUE_ACCESS,	aus_null,	/* 45 faccessat */
297c4d3e29Brent Paulson		auf_null,	S2E_PUB,
2987c478bdstevel@tonic-gateaui_null,	AUE_SETGID,	aus_setgid,	/* 46 setgid */
2997c478bdstevel@tonic-gate		auf_null,	0,
3007c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 47 getgid */
3017c478bdstevel@tonic-gate		auf_null,	0,
302794f0adRoger A. Faulkneraui_null,	AUE_MKNOD,	aus_mknodat,	/* 48 mknodat */
303794f0adRoger A. Faulkner		auf_mknodat,	S2E_MLD,
3048fd04b8Roger A. Faulkneraui_msgsys,	AUE_MSGSYS,	aus_msgsys,	/* 49 (loadable) msgsys */
3057c478bdstevel@tonic-gate		auf_msgsys,	0,
3067c478bdstevel@tonic-gate#if defined(__x86)
3077c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 50 sysi86 */
3087c478bdstevel@tonic-gate		auf_null,	0,
3097c478bdstevel@tonic-gate#else
3107c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 50 (loadable) was sys3b */
3117c478bdstevel@tonic-gate		auf_null,	0,
3127c478bdstevel@tonic-gate#endif /* __x86 */
3138fd04b8Roger A. Faulkneraui_null,	AUE_ACCT,	aus_acct,	/* 51 (loadable) sysacct */
3147c478bdstevel@tonic-gate		auf_null,	0,
3158fd04b8Roger A. Faulkneraui_shmsys,	AUE_SHMSYS,	aus_shmsys,	/* 52 (loadable) shmsys */
3167c478bdstevel@tonic-gate		auf_shmsys,	0,
3178fd04b8Roger A. Faulkneraui_semsys,	AUE_SEMSYS,	aus_semsys,	/* 53 (loadable) semsys */
3187c478bdstevel@tonic-gate		auf_semsys,	0,
3197c478bdstevel@tonic-gateaui_null,	AUE_IOCTL,	aus_ioctl,	/* 54 ioctl */
3207c478bdstevel@tonic-gate		auf_null,	0,
3217c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 55 uadmin */
3227c478bdstevel@tonic-gate		auf_null,	0,
3238fd04b8Roger A. Faulkneraui_fchownat,	AUE_NULL,	aus_fchownat,	/* 56 fchownat */
324c4d3e29Brent Paulson		auf_null,	0,
3257c478bdstevel@tonic-gateaui_utssys,	AUE_FUSERS,	aus_null,	/* 57 utssys */
3267c478bdstevel@tonic-gate		auf_null,	0,
3277c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 58 fsync */
3287c478bdstevel@tonic-gate		auf_null,	0,
3297c478bdstevel@tonic-gateaui_execve,	AUE_EXECVE,	aus_null,	/* 59 exece */
3307c478bdstevel@tonic-gate		auf_null,	S2E_MLD,
3317c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 60 umask */
3327c478bdstevel@tonic-gate		auf_null,	0,
3337c478bdstevel@tonic-gateaui_null,	AUE_CHROOT,	aus_null,	/* 61 chroot */
3347c478bdstevel@tonic-gate		auf_null,	S2E_SP,
3357c478bdstevel@tonic-gateaui_fcntl,	AUE_FCNTL,	aus_fcntl,	/* 62 fcntl */
3367c478bdstevel@tonic-gate		auf_null,	0,
3377c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 63 ulimit */
3387c478bdstevel@tonic-gate		auf_null,	0,
3398fd04b8Roger A. Faulkneraui_null,	AUE_RENAME,	aus_null,	/* 64 renameat */
340c4d3e29Brent Paulson		auf_null,	0,
3418fd04b8Roger A. Faulkneraui_unlinkat,	AUE_NULL,	aus_null,	/* 65 unlinkat */
342c4d3e29Brent Paulson		auf_null,	0,
3438fd04b8Roger A. Faulkneraui_fstatat,	AUE_NULL,	aus_null,	/* 66 fstatat */
344c4d3e29Brent Paulson		auf_null,	S2E_PUB,
3458fd04b8Roger A. Faulkneraui_fstatat,	AUE_NULL,	aus_null,	/* 67 fstatat64 */
346c4d3e29Brent Paulson		auf_null,	S2E_PUB,
3478fd04b8Roger A. Faulkneraui_openat,	AUE_OPEN,	aus_openat,	/* 68 openat */
348c4d3e29Brent Paulson		auf_null,	S2E_SP,
3498fd04b8Roger A. Faulkneraui_openat,	AUE_OPEN,	aus_openat,	/* 69 openat64 */
350c4d3e29Brent Paulson		auf_null,	S2E_SP,
3518fd04b8Roger A. Faulkneraui_null,	AUE_NULL,	aus_null,	/* 70 tasksys */
3527c478bdstevel@tonic-gate		auf_null,	0,
3538fd04b8Roger A. Faulkneraui_null,	AUE_NULL,	aus_null,	/* 71 (loadable) acctctl */
3547c478bdstevel@tonic-gate		auf_null,	0,
3558fd04b8Roger A. Faulkneraui_null,	AUE_NULL,	aus_null,	/* 72 (loadable) exacct */
3567c478bdstevel@tonic-gate		auf_null,	0,
3578fd04b8Roger A. Faulkneraui_null,	AUE_NULL,	aus_null,	/* 73 getpagesizes */
3587c478bdstevel@tonic-gate		auf_null,	0,
3598fd04b8Roger A. Faulkneraui_null,	AUE_NULL,	aus_null,	/* 74 rctlsys */
3607c478bdstevel@tonic-gate		auf_null,	0,
361f48205bcasperaui_null,	AUE_NULL,	aus_null,	/* 75 sidsys */
3627c478bdstevel@tonic-gate		auf_null,	0,
3638fd04b8Roger A. Faulkneraui_null,	AUE_NULL,	aus_null,	/* 76 (loadable) was fsat */
3647c478bdstevel@tonic-gate		auf_null,	0,
3658fd04b8Roger A. Faulkneraui_null,	AUE_NULL,	aus_null,	/* 77 syslwp_park */
3667c478bdstevel@tonic-gate		auf_null,	0,
3678fd04b8Roger A. Faulkneraui_null,	AUE_NULL,	aus_null,	/* 78 sendfilev */
3687c478bdstevel@tonic-gate		auf_null,	0,
3697c478bdstevel@tonic-gateaui_null,	AUE_RMDIR,	aus_null,	/* 79 rmdir */
3707c478bdstevel@tonic-gate		auf_null,	0,
3717c478bdstevel@tonic-gateaui_null,	AUE_MKDIR,	aus_mkdir,	/* 80 mkdir */
3727c478bdstevel@tonic-gate		auf_null,	0,
3737c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 81 getdents */
3747c478bdstevel@tonic-gate		auf_null,	0,
3757c478bdstevel@tonic-gateaui_privsys,	AUE_NULL,	aus_null,	/* 82 privsys */
3767c478bdstevel@tonic-gate		auf_null,	0,
3778fd04b8Roger A. Faulkneraui_null,	AUE_NULL,	aus_null,	/* 83 ucredsys */
3787c478bdstevel@tonic-gate		auf_null,	0,
3797c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 84 sysfs */
3807c478bdstevel@tonic-gate		auf_null,	0,
3817c478bdstevel@tonic-gateaui_null,	AUE_GETMSG,	aus_getmsg,	/* 85 getmsg */
3827c478bdstevel@tonic-gate		auf_null,	0,
3837c478bdstevel@tonic-gateaui_null,	AUE_PUTMSG,	aus_putmsg,	/* 86 putmsg */
3847c478bdstevel@tonic-gate		auf_null,	0,
3858fd04b8Roger A. Faulkneraui_null,	AUE_NULL,	aus_null,	/* 87 (loadable) was poll */
3867c478bdstevel@tonic-gate		auf_null,	0,
3877c478bdstevel@tonic-gateaui_null,	AUE_LSTAT,	aus_null,	/* 88 lstat */
3887c478bdstevel@tonic-gate		auf_null,	S2E_PUB,
3897c478bdstevel@tonic-gateaui_null,	AUE_SYMLINK,	aus_null,	/* 89 symlink */
3907c478bdstevel@tonic-gate		auf_null,	0,
3917c478bdstevel@tonic-gateaui_null,	AUE_READLINK,	aus_null,	/* 90 readlink */
3927c478bdstevel@tonic-gate		auf_null,	S2E_PUB,
3937c478bdstevel@tonic-gateaui_null,	AUE_SETGROUPS,	aus_setgroups,	/* 91 setgroups */
3947c478bdstevel@tonic-gate		auf_null,	0,
3957c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 92 getgroups */
3967c478bdstevel@tonic-gate		auf_null,	0,
3977c478bdstevel@tonic-gateaui_null,	AUE_FCHMOD,	aus_fchmod,	/* 93 fchmod */
3987c478bdstevel@tonic-gate		auf_null,	0,
3997c478bdstevel@tonic-gateaui_null,	AUE_FCHOWN,	aus_fchown,	/* 94 fchown */
4007c478bdstevel@tonic-gate		auf_null,	0,
4017c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 95 sigprocmask */
4027c478bdstevel@tonic-gate		auf_null,	0,
4037c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 96 sigsuspend */
4047c478bdstevel@tonic-gate		auf_null,	0,
4057c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 97 sigaltstack */
4067c478bdstevel@tonic-gate		auf_null,	0,
4077c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 98 sigaction */
4087c478bdstevel@tonic-gate		auf_null,	0,
4097c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 99 sigpending */
4107c478bdstevel@tonic-gate		auf_null,	0,
4117c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 100 setcontext */
4127c478bdstevel@tonic-gate		auf_null,	0,
413794f0adRoger A. Faulkneraui_fchmodat,	AUE_NULL,	aus_fchmodat,	/* 101 fchmodat */
4147c478bdstevel@tonic-gate		auf_null,	0,
415794f0adRoger A. Faulkneraui_null,	AUE_MKDIR,	aus_mkdirat,	/* 102 mkdirat */
4167c478bdstevel@tonic-gate		auf_null,	0,
4177c478bdstevel@tonic-gateaui_null,	AUE_STATVFS,	aus_null,	/* 103 statvfs */
4187c478bdstevel@tonic-gate		auf_null,	S2E_PUB,
4197c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 104 fstatvfs */
4207c478bdstevel@tonic-gate		auf_null,	0,
4218fd04b8Roger A. Faulkneraui_null,	AUE_NULL,	aus_null,	/* 105 getloadavg */
4227c478bdstevel@tonic-gate		auf_null,	0,
4237c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 106 nfssys */
4247c478bdstevel@tonic-gate		auf_null,	0,
4258fd04b8Roger A. Faulkneraui_null,	AUE_NULL,	aus_null,	/* 107 waitsys */
4267c478bdstevel@tonic-gate		auf_null,	0,
4278fd04b8Roger A. Faulkneraui_null,	AUE_NULL,	aus_null,	/* 108 sigsendsys */
4287c478bdstevel@tonic-gate		auf_null,	0,
4297c478bdstevel@tonic-gate#if defined(__x86)
4307c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 109 hrtsys */
4317c478bdstevel@tonic-gate		auf_null,	0,
4327c478bdstevel@tonic-gate#else
4337c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 109 (loadable) */
4347c478bdstevel@tonic-gate		auf_null,	0,
4357c478bdstevel@tonic-gate#endif /* __x86 */
4368fd04b8Roger A. Faulkneraui_null,	AUE_UTIMES,	aus_null,	/* 110 utimesys */
437c4d3e29Brent Paulson		auf_null,	0,
4388fd04b8Roger A. Faulkneraui_null,	AUE_NULL,	aus_null,	/* 111 sigresend */
4397c478bdstevel@tonic-gate		auf_null,	0,
4408fd04b8Roger A. Faulkneraui_null,	AUE_PRIOCNTLSYS, aus_priocntlsys, /* 112 priocntlsys */
4417c478bdstevel@tonic-gate		auf_null,	0,
4427c478bdstevel@tonic-gateaui_null,	AUE_PATHCONF,	aus_null,	/* 113 pathconf */
4437c478bdstevel@tonic-gate		auf_null,	S2E_PUB,
4447c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 114 mincore */
4457c478bdstevel@tonic-gate		auf_null,	0,
4467c478bdstevel@tonic-gateaui_null,	AUE_MMAP,	aus_mmap,	/* 115 mmap */
4477c478bdstevel@tonic-gate		auf_null,	0,
4487c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 116 mprotect */
4497c478bdstevel@tonic-gate		auf_null,	0,
4507c478bdstevel@tonic-gateaui_null,	AUE_MUNMAP,	aus_munmap,	/* 117 munmap */
4517c478bdstevel@tonic-gate		auf_null,	0,
4527c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 118 fpathconf */
4537c478bdstevel@tonic-gate		auf_null,	0,
4547c478bdstevel@tonic-gateaui_null,	AUE_VFORK,	aus_null,	/* 119 vfork */
4557c478bdstevel@tonic-gate		auf_null,	0,
4567c478bdstevel@tonic-gateaui_null,	AUE_FCHDIR,	aus_null,	/* 120 fchdir */
4577c478bdstevel@tonic-gate		auf_null,	0,
4587c478bdstevel@tonic-gateaui_null,	AUE_READ,	aus_null,	/* 121 readv */
4597c478bdstevel@tonic-gate		auf_read,	S2E_PUB,
4607c478bdstevel@tonic-gateaui_null,	AUE_WRITE,	aus_null,	/* 122 writev */
4617c478bdstevel@tonic-gate		auf_write,	0,
4628fd04b8Roger A. Faulkneraui_null,	AUE_NULL,	aus_null,	/* 123 (loadable) was xstat */
4637c478bdstevel@tonic-gate		auf_null,	0,
4648fd04b8Roger A. Faulkneraui_null,	AUE_NULL,	aus_null,	/* 124 (loadable) was lxstat */
4658fd04b8Roger A. Faulkner		auf_null,	0,
4668fd04b8Roger A. Faulkneraui_null,	AUE_NULL,	aus_null,	/* 125 (loadable) was fxstat */
4678fd04b8Roger A. Faulkner		auf_null,	0,
4688fd04b8Roger A. Faulkneraui_null,	AUE_NULL,	aus_null,	/* 126 (loadable) was xmknod */
4698fd04b8Roger A. Faulkner		auf_null,	0,
4708fd04b8Roger A. Faulkneraui_null,	AUE_NULL,	aus_null,	/* 127 mmapobj */
4717c478bdstevel@tonic-gate		auf_null,	0,
4727c478bdstevel@tonic-gateaui_null,	AUE_SETRLIMIT,	aus_null,	/* 128 setrlimit */
4737c478bdstevel@tonic-gate		auf_null,	0,
4747c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 129 getrlimit */
4757c478bdstevel@tonic-gate		auf_null,	0,
4767c478bdstevel@tonic-gateaui_null,	AUE_LCHOWN,	aus_lchown,	/* 130 lchown */
4777c478bdstevel@tonic-gate		auf_null,	0,
4787c478bdstevel@tonic-gateaui_memcntl,	AUE_MEMCNTL,	aus_memcntl,	/* 131 memcntl */
4797c478bdstevel@tonic-gate		auf_null,	0,
4807c478bdstevel@tonic-gateaui_null,	AUE_GETPMSG,	aus_getpmsg,	/* 132 getpmsg */
4817c478bdstevel@tonic-gate		auf_null,	0,
4827c478bdstevel@tonic-gateaui_null,	AUE_PUTPMSG,	aus_putpmsg,	/* 133 putpmsg */
4837c478bdstevel@tonic-gate		auf_null,	0,
4847c478bdstevel@tonic-gateaui_null,	AUE_RENAME,	aus_null,	/* 134 rename */
4857c478bdstevel@tonic-gate		auf_null,	0,
4867c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 135 uname */
4877c478bdstevel@tonic-gate		auf_null,	0,
4887c478bdstevel@tonic-gateaui_null,	AUE_SETEGID,	aus_setegid,	/* 136 setegid */
4897c478bdstevel@tonic-gate		auf_null,	0,
4907c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 137 sysconfig */
4917c478bdstevel@tonic-gate		auf_null,	0,
4927c478bdstevel@tonic-gateaui_null,	AUE_ADJTIME,	aus_null,	/* 138 adjtime */
4937c478bdstevel@tonic-gate		auf_null,	0,
4947c478bdstevel@tonic-gateaui_sysinfo,	AUE_SYSINFO,	aus_sysinfo,	/* 139 systeminfo */
4957c478bdstevel@tonic-gate		auf_null,	0,
4968fd04b8Roger A. Faulkneraui_null,	AUE_NULL,	aus_null,	/* 140 (loadable) sharefs */
4977c478bdstevel@tonic-gate		auf_null,	0,
4987c478bdstevel@tonic-gateaui_null,	AUE_SETEUID,	aus_seteuid,	/* 141 seteuid */
4997c478bdstevel@tonic-gate		auf_null,	0,
500657b1f3rafaui_forksys,	AUE_NULL,	aus_null,	/* 142 forksys */
5017c478bdstevel@tonic-gate		auf_null,	0,
5028fd04b8Roger A. Faulkneraui_null,	AUE_NULL,	aus_null,	/* 143 (loadable) was fork1 */
5037c478bdstevel@tonic-gate		auf_null,	0,
5047c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 144 sigwait */
5057c478bdstevel@tonic-gate		auf_null,	0,
5067c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 145 lwp_info */
5077c478bdstevel@tonic-gate		auf_null,	0,
5087c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 146 yield */
5097c478bdstevel@tonic-gate		auf_null,	0,
5108fd04b8Roger A. Faulkneraui_null,	AUE_NULL,	aus_null,	/* 147 (loadable) */
5118fd04b8Roger A. Faulkner						/*	was lwp_sema_wait */
5127c478bdstevel@tonic-gate		auf_null,	0,
5137c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 148 lwp_sema_post */
5147c478bdstevel@tonic-gate		auf_null,	0,
5157c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 149 lwp_sema_trywait */
5167c478bdstevel@tonic-gate		auf_null,	0,
5178fd04b8Roger A. Faulkneraui_null,	AUE_NULL,	aus_null,	/* 150 lwp_detach */
5187c478bdstevel@tonic-gate		auf_null,	0,
5198fd04b8Roger A. Faulkneraui_null,	AUE_NULL,	aus_null,	/* 151 corectl */
5207c478bdstevel@tonic-gate		auf_null,	0,
5217c478bdstevel@tonic-gateaui_modctl,	AUE_MODCTL,	aus_modctl,	/* 152 modctl */
5227c478bdstevel@tonic-gate		auf_null,	0,
5237c478bdstevel@tonic-gateaui_null,	AUE_FCHROOT,	aus_null,	/* 153 fchroot */
5247c478bdstevel@tonic-gate		auf_null,	0,
5258fd04b8Roger A. Faulkneraui_null,	AUE_NULL,	aus_null,	/* 154 (loadable) was utimes */
5267c478bdstevel@tonic-gate		auf_null,	0,
5277c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 155 vhangup */
5287c478bdstevel@tonic-gate		auf_null,	0,
5297c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 156 gettimeofday */
5307c478bdstevel@tonic-gate		auf_null,	0,
5317c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 157 getitimer */
5327c478bdstevel@tonic-gate		auf_null,	0,
5337c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 158 setitimer */
5347c478bdstevel@tonic-gate		auf_null,	0,
5357c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 159 lwp_create */
5367c478bdstevel@tonic-gate		auf_null,	0,
5377c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 160 lwp_exit */
5387c478bdstevel@tonic-gate		auf_null,	0,
5397c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 161 lwp_suspend */
5407c478bdstevel@tonic-gate		auf_null,	0,
5417c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 162 lwp_continue */
5427c478bdstevel@tonic-gate		auf_null,	0,
5437c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 163 lwp_kill */
5447c478bdstevel@tonic-gate		auf_null,	0,
5457c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 164 lwp_self */
5467c478bdstevel@tonic-gate		auf_null,	0,
5478fd04b8Roger A. Faulkneraui_null,	AUE_NULL,	aus_null,	/* 165 lwp_sigmask */
5487c478bdstevel@tonic-gate		auf_null,	0,
5498fd04b8Roger A. Faulkneraui_null,	AUE_NULL,	aus_null,	/* 166 lwp_private */
5507c478bdstevel@tonic-gate		auf_null,	0,
5517c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 167 lwp_wait */
5527c478bdstevel@tonic-gate		auf_null,	0,
553883492drafaui_null,	AUE_NULL,	aus_null,	/* 168 lwp_mutex_wakeup  */
5547c478bdstevel@tonic-gate		auf_null,	0,
5558fd04b8Roger A. Faulkneraui_null,	AUE_NULL,	aus_null,	/* 169 (loadable) */
5568fd04b8Roger A. Faulkner						/*	was lwp_mutex_lock */
5577c478bdstevel@tonic-gate		auf_null,	0,
5587c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 170 lwp_cond_wait */
5597c478bdstevel@tonic-gate		auf_null,	0,
5607c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 171 lwp_cond_signal */
5617c478bdstevel@tonic-gate		auf_null,	0,
5627c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 172 lwp_cond_broadcast */
5637c478bdstevel@tonic-gate		auf_null,	0,
5647c478bdstevel@tonic-gateaui_null,	AUE_READ,	aus_null,	/* 173 pread */
5657c478bdstevel@tonic-gate		auf_read,	S2E_PUB,
5667c478bdstevel@tonic-gateaui_null,	AUE_WRITE,	aus_null,	/* 174 pwrite */
5677c478bdstevel@tonic-gate		auf_write,	0,
5687c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 175 llseek */
5697c478bdstevel@tonic-gate		auf_null,	0,
5708fd04b8Roger A. Faulkneraui_null,	AUE_INST_SYNC,	aus_inst_sync,  /* 176 (loadable) inst_sync */
5717c478bdstevel@tonic-gate		auf_null,	0,
5729acbbeannaui_null,	AUE_BRANDSYS,	aus_brandsys,	/* 177 brandsys */
5737c478bdstevel@tonic-gate		auf_null,	0,
5748fd04b8Roger A. Faulkneraui_null,	AUE_NULL,	aus_null,	/* 178 (loadable) kaio */
5757c478bdstevel@tonic-gate		auf_null,	0,
5768fd04b8Roger A. Faulkneraui_null,	AUE_NULL,	aus_null,	/* 179 (loadable) cpc */
5777c478bdstevel@tonic-gate		auf_null,	0,
5788fd04b8Roger A. Faulkneraui_null,	AUE_NULL,	aus_null,	/* 180 lgrpsys */
5797c478bdstevel@tonic-gate		auf_null,	0,
5808fd04b8Roger A. Faulkneraui_null,	AUE_NULL,	aus_null,	/* 181 rusagesys */
5817c478bdstevel@tonic-gate		auf_null,	0,
582df2381bpraksaui_portfs,	AUE_PORTFS,	aus_null,	/* 182 (loadable) portfs */
5837e309bcJan Friedel		auf_null,	S2E_MLD,
5848fd04b8Roger A. Faulkneraui_null,	AUE_NULL,	aus_null,	/* 183 pollsys */
5857c478bdstevel@tonic-gate		auf_null,	0,
58661b9bf5ricaaui_labelsys,	AUE_NULL,	aus_labelsys,	/* 184 labelsys */
5877c478bdstevel@tonic-gate		auf_null,	0,
5887c478bdstevel@tonic-gateaui_acl,	AUE_ACLSET,	aus_acl,	/* 185 acl */
5897c478bdstevel@tonic-gate		auf_null,	0,
5907c478bdstevel@tonic-gateaui_auditsys,	AUE_AUDITSYS,	aus_auditsys,	/* 186 auditsys  */
5917c478bdstevel@tonic-gate		auf_null,	0,
5928fd04b8Roger A. Faulkneraui_null,	AUE_PROCESSOR_BIND, aus_processor_bind, /* 187 processor_bind */
5938fd04b8Roger A. Faulkner		auf_null,	0,
5947c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 188 processor_info */
5957c478bdstevel@tonic-gate		auf_null,	0,
5967c478bdstevel@tonic-gateaui_null,	AUE_P_ONLINE,	aus_p_online,	/* 189 p_online */
5977c478bdstevel@tonic-gate		auf_null,	0,
5987c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_sigqueue,	/* 190 sigqueue */
5997c478bdstevel@tonic-gate		auf_null,	0,
6007c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 191 clock_gettime */
6017c478bdstevel@tonic-gate		auf_null,	0,
6027c478bdstevel@tonic-gateaui_null,	AUE_CLOCK_SETTIME,	aus_null,	/* 192 clock_settime */
6037c478bdstevel@tonic-gate		auf_null,	0,
6047c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 193 clock_getres */
6057c478bdstevel@tonic-gate		auf_null,	0,
6067c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 194 timer_create */
6077c478bdstevel@tonic-gate		auf_null,	0,
6087c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 195 timer_delete */
6097c478bdstevel@tonic-gate		auf_null,	0,
6107c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 196 timer_settime */
6117c478bdstevel@tonic-gate		auf_null,	0,
6127c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 197 timer_gettime */
6137c478bdstevel@tonic-gate		auf_null,	0,
6147c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 198 timer_getoverrun */
6157c478bdstevel@tonic-gate		auf_null,	0,
6167c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 199 nanosleep */
6177c478bdstevel@tonic-gate		auf_null,	0,
6187c478bdstevel@tonic-gateaui_acl,	AUE_FACLSET,	aus_facl,	/* 200 facl */
6197c478bdstevel@tonic-gate		auf_null,	0,
6207c478bdstevel@tonic-gateaui_doorfs,	AUE_DOORFS,	aus_doorfs,	/* 201 (loadable) doorfs */
6217c478bdstevel@tonic-gate		auf_null,	0,
6227c478bdstevel@tonic-gateaui_null,	AUE_SETREUID,	aus_setreuid,	/* 202 setreuid */
6237c478bdstevel@tonic-gate		auf_null,	0,
6247c478bdstevel@tonic-gateaui_null,	AUE_SETREGID,	aus_setregid,	/* 203 setregid */
6257c478bdstevel@tonic-gate		auf_null,	0,
6267c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 204 install_utrap */
6277c478bdstevel@tonic-gate		auf_null,	0,
6287c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 205 signotify */
6297c478bdstevel@tonic-gate		auf_null,	0,
6307c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 206 schedctl */
6317c478bdstevel@tonic-gate		auf_null,	0,
6327c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 207 (loadable) pset */
6337c478bdstevel@tonic-gate		auf_null,	0,
6348fd04b8Roger A. Faulkneraui_null,	AUE_NULL,	aus_null,	/* 208 sparc_utrap_install */
6357c478bdstevel@tonic-gate		auf_null,	0,
6367c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 209 resolvepath */
6377c478bdstevel@tonic-gate		auf_null,	0,
6387c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 210 lwp_mutex_timedlock */
6397c478bdstevel@tonic-gate		auf_null,	0,
6407c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 211 lwp_sema_timedwait */
6417c478bdstevel@tonic-gate		auf_null,	0,
6427c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 212 lwp_rwlock_sys */
6437c478bdstevel@tonic-gate		auf_null,	0,
6448fd04b8Roger A. Faulkneraui_null,	AUE_NULL,	aus_null,	/* 213 getdents64 */
6457c478bdstevel@tonic-gate		auf_null,	0,
6467c478bdstevel@tonic-gateaui_null,	AUE_MMAP,	aus_mmap,	/* 214 mmap64 */
6477c478bdstevel@tonic-gate		auf_null,	0,
6487c478bdstevel@tonic-gateaui_null,	AUE_STAT,	aus_null,	/* 215 stat64 */
6497c478bdstevel@tonic-gate		auf_null,	S2E_PUB,
6507c478bdstevel@tonic-gateaui_null,	AUE_LSTAT,	aus_null,	/* 216 lstat64 */
6517c478bdstevel@tonic-gate		auf_null,	S2E_PUB,
6527c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 217 fstat64 */
6537c478bdstevel@tonic-gate		auf_null,	0,
6547c478bdstevel@tonic-gateaui_null,	AUE_STATVFS,	aus_null,	/* 218 statvfs64 */
6557c478bdstevel@tonic-gate		auf_null,	S2E_PUB,
6567c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 219 fstatvfs64 */
6577c478bdstevel@tonic-gate		auf_null,	0,
6587c478bdstevel@tonic-gateaui_null,	AUE_SETRLIMIT,	aus_null,	/* 220 setrlimit64 */
6597c478bdstevel@tonic-gate		auf_null,	0,
6607c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 221 getrlimit64 */
6617c478bdstevel@tonic-gate		auf_null,	0,
6627c478bdstevel@tonic-gateaui_null,	AUE_READ,	aus_null,	/* 222 pread64  */
6637c478bdstevel@tonic-gate		auf_read,	S2E_PUB,
6647c478bdstevel@tonic-gateaui_null,	AUE_WRITE,	aus_null,	/* 223 pwrite64 */
6657c478bdstevel@tonic-gate		auf_write,	0,
6668fd04b8Roger A. Faulkneraui_null,	AUE_NULL,	aus_null,	/* 224 (loadable) was creat64 */
6678fd04b8Roger A. Faulkner		auf_null,	0,
6687c478bdstevel@tonic-gateaui_open,	AUE_OPEN,	aus_open,	/* 225 open64 */
6697c478bdstevel@tonic-gate		auf_null,	S2E_SP,
6707c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 226 (loadable) rpcsys */
6717c478bdstevel@tonic-gate		auf_null,	0,
6728fd04b8Roger A. Faulkneraui_null,	AUE_NULL,	aus_null,	/* 227 zone */
6737c478bdstevel@tonic-gate		auf_null,	0,
6748fd04b8Roger A. Faulkneraui_null,	AUE_NULL,	aus_null,	/* 228 (loadable) autofssys */
6757c478bdstevel@tonic-gate		auf_null,	0,
6768fd04b8Roger A. Faulkneraui_null,	AUE_NULL,	aus_null,	/* 229 getcwd */
6777c478bdstevel@tonic-gate		auf_null,	0,
6787c478bdstevel@tonic-gateaui_null,	AUE_SOCKET,	aus_socket,	/* 230 so_socket */
6797c478bdstevel@tonic-gate		auf_null,	0,
6807c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 231 so_socketpair */
6817c478bdstevel@tonic-gate		auf_null,	0,
6827c478bdstevel@tonic-gateaui_null,	AUE_BIND,	aus_null,	/* 232 bind */
6837c478bdstevel@tonic-gate		auf_bind,	0,
6847c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 233 listen */
6857c478bdstevel@tonic-gate		auf_null,	0,
6867c478bdstevel@tonic-gateaui_null,	AUE_ACCEPT,	aus_null,	/* 234 accept */
6877c478bdstevel@tonic-gate		auf_accept,	0,
6887c478bdstevel@tonic-gateaui_null,	AUE_CONNECT,	aus_null,	/* 235 connect */
6897c478bdstevel@tonic-gate		auf_connect,	0,
6907c478bdstevel@tonic-gateaui_null,	AUE_SHUTDOWN,	aus_shutdown,	/* 236 shutdown */
6917c478bdstevel@tonic-gate		auf_null,	0,
6927c478bdstevel@tonic-gateaui_null,	AUE_READ,	aus_null,	/* 237 recv */
6937c478bdstevel@tonic-gate		auf_recv,	0,
6947c478bdstevel@tonic-gateaui_null,	AUE_RECVFROM,	aus_null,	/* 238 recvfrom */
6957c478bdstevel@tonic-gate		auf_recvfrom,	0,
6967c478bdstevel@tonic-gateaui_null,	AUE_RECVMSG,	aus_null,	/* 239 recvmsg */
6977c478bdstevel@tonic-gate		auf_recvmsg,	0,
6987c478bdstevel@tonic-gateaui_null,	AUE_WRITE,	aus_null,	/* 240 send */
6997c478bdstevel@tonic-gate		auf_send,	0,
7007c478bdstevel@tonic-gateaui_null,	AUE_SENDMSG,	aus_null,	/* 241 sendmsg */
7017c478bdstevel@tonic-gate		auf_sendmsg,	0,
7027c478bdstevel@tonic-gateaui_null,	AUE_SENDTO,	aus_null,	/* 242 sendto */
7037c478bdstevel@tonic-gate		auf_sendto,	0,
7047c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 243 getpeername */
7057c478bdstevel@tonic-gate		auf_null,	0,
7067c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 244 getsockname */
7077c478bdstevel@tonic-gate		auf_null,	0,
7087c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 245 getsockopt */
7097c478bdstevel@tonic-gate		auf_null,	0,
7107c478bdstevel@tonic-gateaui_null,	AUE_SETSOCKOPT,	aus_null,	/* 246 setsockopt */
7117c478bdstevel@tonic-gate		auf_setsockopt,	0,
7127c478bdstevel@tonic-gateaui_null,	AUE_SOCKCONFIG,	aus_sockconfig,	/* 247 sockconfig */
7137c478bdstevel@tonic-gate		auf_null,	0,
7147c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 248 ntp_gettime */
7157c478bdstevel@tonic-gate		auf_null,	0,
7168fd04b8Roger A. Faulkneraui_null,	AUE_NTP_ADJTIME, aus_null,	/* 249 ntp_adjtime */
7177c478bdstevel@tonic-gate		auf_null,	0,
7187c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 250 lwp_mutex_unlock */
7197c478bdstevel@tonic-gate		auf_null,	0,
7207c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 251 lwp_mutex_trylock */
7217c478bdstevel@tonic-gate		auf_null,	0,
722883492drafaui_null,	AUE_NULL,	aus_null,	/* 252 lwp_mutex_register */
7237c478bdstevel@tonic-gate		auf_null,	0,
7247c478bdstevel@tonic-gateaui_null,	AUE_NULL,	aus_null,	/* 253 cladm */
7257c478bdstevel@tonic-gate		auf_null,	0,
7269acbbeannaui_null,	AUE_NULL,	aus_null,	/* 254 uucopy */
7277c478bdstevel@tonic-gate		auf_null,	0,
7287c478bdstevel@tonic-gateaui_null,	AUE_UMOUNT2,	aus_umount2,	/* 255 umount2 */
7297c478bdstevel@tonic-gate		auf_null,	0
7307c478bdstevel@tonic-gate};
7317c478bdstevel@tonic-gate
7327c478bdstevel@tonic-gateuint_t num_syscall = sizeof (audit_s2e) / sizeof (struct audit_s2e);
7337c478bdstevel@tonic-gate
7347c478bdstevel@tonic-gate
735cb49a9fMarek Pospisil/* exit start function */
736cb49a9fMarek Pospisil/*ARGSUSED*/
737cb49a9fMarek Pospisilstatic void
738cb49a9fMarek Pospisilaus_exit(struct t_audit_data *tad)
739cb49a9fMarek Pospisil{
740cb49a9fMarek Pospisil	uint32_t rval;
741cb49a9fMarek Pospisil	struct a {
742cb49a9fMarek Pospisil		long rval;
743cb49a9fMarek Pospisil	} *uap = (struct a *)ttolwp(curthread)->lwp_ap;
744cb49a9fMarek Pospisil
745cb49a9fMarek Pospisil	rval = (uint32_t)uap->rval;
746cb49a9fMarek Pospisil	au_uwrite(au_to_arg32(1, "exit status", rval));
747cb49a9fMarek Pospisil}
748cb49a9fMarek Pospisil
749d2a7078Richard Lowe
7507c478bdstevel@tonic-gate/* acct start function */
7517c478bdstevel@tonic-gate/*ARGSUSED*/
7527c478bdstevel@tonic-gatestatic void
7537c478bdstevel@tonic-gateaus_acct(struct t_audit_data *tad)
7547c478bdstevel@tonic-gate{
7557c478bdstevel@tonic-gate	klwp_t *clwp = ttolwp(curthread);
7567c478bdstevel@tonic-gate	uintptr_t fname;
7577c478bdstevel@tonic-gate
7587c478bdstevel@tonic-gate	struct a {
7597c478bdstevel@tonic-gate		long	fname;		/* char * */
7607c478bdstevel@tonic-gate	} *uap = (struct a *)clwp->lwp_ap;
7617c478bdstevel@tonic-gate
7627c478bdstevel@tonic-gate	fname = (uintptr_t)uap->fname;
7637c478bdstevel@tonic-gate
7647c478bdstevel@tonic-gate	if (fname == 0)
7657c478bdstevel@tonic-gate		au_uwrite(au_to_arg32(1, "accounting off", (uint32_t)0));
7667c478bdstevel@tonic-gate}
7677c478bdstevel@tonic-gate
7687c478bdstevel@tonic-gate/* chown start function */
7697c478bdstevel@tonic-gate/*ARGSUSED*/
7707c478bdstevel@tonic-gatestatic void
7717c478bdstevel@tonic-gateaus_chown(struct t_audit_data *tad)
7727c478bdstevel@tonic-gate{
7737c478bdstevel@tonic-gate	klwp_t *clwp = ttolwp(curthread);
7747c478bdstevel@tonic-gate	uint32_t uid, gid;
7757c478bdstevel@tonic-gate
7767c478bdstevel@tonic-gate	struct a {
7777c478bdstevel@tonic-gate		long	fname;		/* char * */
7787c478bdstevel@tonic-gate		long	uid;
7797c478bdstevel@tonic-gate		long	gid;
7807c478bdstevel@tonic-gate	} *uap = (struct a *)clwp->lwp_ap;
7817c478bdstevel@tonic-gate
7827c478bdstevel@tonic-gate	uid = (uint32_t)uap->uid;
7837c478bdstevel@tonic-gate	gid = (uint32_t)uap->gid;
7847c478bdstevel@tonic-gate
7857c478bdstevel@tonic-gate	au_uwrite(au_to_arg32(2, "new file uid", uid));
7867c478bdstevel@tonic-gate	au_uwrite(au_to_arg32(3, "new file gid", gid));
7877c478bdstevel@tonic-gate}
7887c478bdstevel@tonic-gate
7897c478bdstevel@tonic-gate/* fchown start function */
7907c478bdstevel@tonic-gate/*ARGSUSED*/
7917c478bdstevel@tonic-gatestatic void
7927c478bdstevel@tonic-gateaus_fchown(struct t_audit_data *tad)
7937c478bdstevel@tonic-gate{
7947c478bdstevel@tonic-gate	klwp_t *clwp = ttolwp(curthread);
7957c478bdstevel@tonic-gate	uint32_t uid, gid, fd;
7967c478bdstevel@tonic-gate	struct file  *fp;
7977c478bdstevel@tonic-gate	struct vnode *vp;
7987c478bdstevel@tonic-gate	struct f_audit_data *fad;
7997c478bdstevel@tonic-gate
8007c478bdstevel@tonic-gate	struct a {
8017c478bdstevel@tonic-gate		long fd;
8027c478bdstevel@tonic-gate		long uid;
8037c478bdstevel@tonic-gate		long gid;
8047c478bdstevel@tonic-gate	} *uap = (struct a *)clwp->lwp_ap;
8057c478bdstevel@tonic-gate
8067c478bdstevel@tonic-gate	fd  = (uint32_t)uap->fd;
8077c478bdstevel@tonic-gate	uid = (uint32_t)uap->uid;
8087c478bdstevel@tonic-gate	gid = (uint32_t)uap->gid;
8097c478bdstevel@tonic-gate
8107c478bdstevel@tonic-gate	au_uwrite(au_to_arg32(2, "new file uid", uid));
8117c478bdstevel@tonic-gate	au_uwrite(au_to_arg32(3, "new file gid", gid));
8127c478bdstevel@tonic-gate
8137c478bdstevel@tonic-gate		/*
8147c478bdstevel@tonic-gate		 * convert file pointer to file descriptor
8157c478bdstevel@tonic-gate		 *   Note: fd ref count incremented here.
8167c478bdstevel@tonic-gate		 */
8177c478bdstevel@tonic-gate	if ((fp = getf(fd)) == NULL)
8187c478bdstevel@tonic-gate		return;
8197c478bdstevel@tonic-gate
8207c478bdstevel@tonic-gate	/* get path from file struct here */
8217c478bdstevel@tonic-gate	fad = F2A(fp);
8227c478bdstevel@tonic-gate	if (fad->fad_aupath != NULL) {
8237c478bdstevel@tonic-gate		au_uwrite(au_to_path(fad->fad_aupath));
8247c478bdstevel@tonic-gate	} else {
8257c478bdstevel@tonic-gate		au_uwrite(au_to_arg32(1, "no path: fd", fd));
8267c478bdstevel@tonic-gate	}
8277c478bdstevel@tonic-gate
8287c478bdstevel@tonic-gate	vp = fp->f_vnode;
8297c478bdstevel@tonic-gate	audit_attributes(vp);
8307c478bdstevel@tonic-gate
8317c478bdstevel@tonic-gate	/* decrement file descriptor reference count */
8327c478bdstevel@tonic-gate	releasef(fd);
8337c478bdstevel@tonic-gate}
8347c478bdstevel@tonic-gate
8357c478bdstevel@tonic-gate/*ARGSUSED*/
8367c478bdstevel@tonic-gatestatic void
8377c478bdstevel@tonic-gateaus_lchown(struct t_audit_data *tad)
8387c478bdstevel@tonic-gate{
8397c478bdstevel@tonic-gate	klwp_t *clwp = ttolwp(curthread);
8407c478bdstevel@tonic-gate	uint32_t uid, gid;
8417c478bdstevel@tonic-gate
8427c478bdstevel@tonic-gate
8437c478bdstevel@tonic-gate	struct a {
8447c478bdstevel@tonic-gate		long	fname;		/* char	* */
8457c478bdstevel@tonic-gate		long	uid;
8467c478bdstevel@tonic-gate		long	gid;
8477c478bdstevel@tonic-gate	} *uap = (struct a *)clwp->lwp_ap;
8487c478bdstevel@tonic-gate
8497c478bdstevel@tonic-gate	uid = (uint32_t)uap->uid;
8507c478bdstevel@tonic-gate	gid = (uint32_t)uap->gid;
8517c478bdstevel@tonic-gate
8527c478bdstevel@tonic-gate	au_uwrite(au_to_arg32(2, "new file uid", uid));
8537c478bdstevel@tonic-gate	au_uwrite(au_to_arg32(3, "new file gid", gid));
8547c478bdstevel@tonic-gate}
8557c478bdstevel@tonic-gate
8568fd04b8Roger A. Faulknerstatic au_event_t
8578fd04b8Roger A. Faulkneraui_fchownat(au_event_t e)
8588fd04b8Roger A. Faulkner{
8598fd04b8Roger A. Faulkner	klwp_t *clwp = ttolwp(curthread);
8608fd04b8Roger A. Faulkner
8618fd04b8Roger A. Faulkner	struct a {
8628fd04b8Roger A. Faulkner		long	fd;
8638fd04b8Roger A. Faulkner		long	fname;		/* char * */
8648fd04b8Roger A. Faulkner		long	uid;
8658fd04b8Roger A. Faulkner		long	gid;
8668fd04b8Roger A. Faulkner		long	flags;
8678fd04b8Roger A. Faulkner	} *uap = (struct a *)clwp->lwp_ap;
8688fd04b8Roger A. Faulkner
8690f48f68Toomas Soome	if (uap->fname == 0)
8708fd04b8Roger A. Faulkner		e = AUE_FCHOWN;
8718fd04b8Roger A. Faulkner	else if (uap->flags & AT_SYMLINK_NOFOLLOW)
8728fd04b8Roger A. Faulkner		e = AUE_LCHOWN;
8738fd04b8Roger A. Faulkner	else
8748fd04b8Roger A. Faulkner		e = AUE_CHOWN;
8758fd04b8Roger A. Faulkner
8768fd04b8Roger A. Faulkner	return (e);
8778fd04b8Roger A. Faulkner}
8788fd04b8Roger A. Faulkner
8798fd04b8Roger A. Faulkner/*ARGSUSED*/
8808fd04b8Roger A. Faulknerstatic void
8818fd04b8Roger A. Faulkneraus_fchownat(struct t_audit_data *tad)
8828fd04b8Roger A. Faulkner{
8838fd04b8Roger A. Faulkner	klwp_t *clwp = ttolwp(curthread);
8848fd04b8Roger A. Faulkner	uint32_t uid, gid;
8858fd04b8Roger A. Faulkner
8868fd04b8Roger A. Faulkner	struct a {
8878fd04b8Roger A. Faulkner		long	fd;
8888fd04b8Roger A. Faulkner		long	fname;		/* char * */
8898fd04b8Roger A. Faulkner		long	uid;
8908fd04b8Roger A. Faulkner		long	gid;
8918fd04b8Roger A. Faulkner		long	flags;
8928fd04b8Roger A. Faulkner	} *uap = (struct a *)clwp->lwp_ap;
8938fd04b8Roger A. Faulkner
8948fd04b8Roger A. Faulkner	uid = (uint32_t)uap->uid;
8958fd04b8Roger A. Faulkner	gid = (uint32_t)uap->gid;
8968fd04b8Roger A. Faulkner
8978fd04b8Roger A. Faulkner	au_uwrite(au_to_arg32(3, "new file uid", uid));
8988fd04b8Roger A. Faulkner	au_uwrite(au_to_arg32(4, "new file gid", gid));
8998fd04b8Roger A. Faulkner}
9008fd04b8Roger A. Faulkner
9017c478bdstevel@tonic-gate/*ARGSUSED*/
9027c478bdstevel@tonic-gatestatic void
9037c478bdstevel@tonic-gateaus_chmod(struct t_audit_data *tad)
9047c478bdstevel@tonic-gate{
9057c478bdstevel@tonic-gate	klwp_t *clwp = ttolwp(curthread);
9067c478bdstevel@tonic-gate	uint32_t fmode;
9077c478bdstevel@tonic-gate
9087c478bdstevel@tonic-gate	struct a {
9097c478bdstevel@tonic-gate		long	fname;		/* char	* */
9107c478bdstevel@tonic-gate		long	fmode;
9117c478bdstevel@tonic-gate	} *uap = (struct a *)clwp->lwp_ap;
9127c478bdstevel@tonic-gate
9137c478bdstevel@tonic-gate	fmode = (uint32_t)uap->fmode;
9147c478bdstevel@tonic-gate
9157c478bdstevel@tonic-gate	au_uwrite(au_to_arg32(2, "new file mode", fmode&07777));
9167c478bdstevel@tonic-gate}
9177c478bdstevel@tonic-gate
9187c478bdstevel@tonic-gate/*ARGSUSED*/
9197c478bdstevel@tonic-gatestatic void
9207c478bdstevel@tonic-gateaus_fchmod(struct t_audit_data *tad)
9217c478bdstevel@tonic-gate{
9227c478bdstevel@tonic-gate	klwp_t *clwp = ttolwp(curthread);
9237c478bdstevel@tonic-gate	uint32_t fmode, fd;
9247c478bdstevel@tonic-gate	struct file  *fp;
9257c478bdstevel@tonic-gate	struct vnode *vp;
9267c478bdstevel@tonic-gate	struct f_audit_data *fad;
9277c478bdstevel@tonic-gate
9287c478bdstevel@tonic-gate	struct a {
9297c478bdstevel@tonic-gate		long	fd;
9307c478bdstevel@tonic-gate		long	fmode;
9317c478bdstevel@tonic-gate	} *uap = (struct a *)clwp->lwp_ap;
9327c478bdstevel@tonic-gate
9337c478bdstevel@tonic-gate	fd = (uint32_t)uap->fd;
9347c478bdstevel@tonic-gate	fmode = (uint32_t)uap->fmode;
9357c478bdstevel@tonic-gate
9367c478bdstevel@tonic-gate	au_uwrite(au_to_arg32(2, "new file mode", fmode&07777));
9377c478bdstevel@tonic-gate
938794f0adRoger A. Faulkner	/*
939794f0adRoger A. Faulkner	 * convert file pointer to file descriptor
940794f0adRoger A. Faulkner	 *   Note: fd ref count incremented here.
941794f0adRoger A. Faulkner	 */
9427c478bdstevel@tonic-gate	if ((fp = getf(fd)) == NULL)
9437c478bdstevel@tonic-gate		return;
9447c478bdstevel@tonic-gate
945794f0adRoger A. Faulkner	/* get path from file struct here */
946794f0adRoger A. Faulkner	fad = F2A(fp);
947794f0adRoger A. Faulkner	if (fad->fad_aupath != NULL) {
948794f0adRoger A. Faulkner		au_uwrite(au_to_path(fad->fad_aupath));
949794f0adRoger A. Faulkner	} else {
950794f0adRoger A. Faulkner		au_uwrite(au_to_arg32(1, "no path: fd", fd));
951794f0adRoger A. Faulkner	}
952794f0adRoger A. Faulkner
953794f0adRoger A. Faulkner	vp = fp->f_vnode;
954794f0adRoger A. Faulkner	audit_attributes(vp);
955794f0adRoger A. Faulkner
956794f0adRoger A. Faulkner	/* decrement file descriptor reference count */
957794f0adRoger A. Faulkner	releasef(fd);
958794f0adRoger A. Faulkner}
959794f0adRoger A. Faulkner
960794f0adRoger A. Faulknerstatic au_event_t
961794f0adRoger A. Faulkneraui_fchmodat(au_event_t e)
962794f0adRoger A. Faulkner{
963794f0adRoger A. Faulkner	klwp_t *clwp = ttolwp(curthread);
964794f0adRoger A. Faulkner
965794f0adRoger A. Faulkner	struct a {
966794f0adRoger A. Faulkner		long	fd;
967794f0adRoger A. Faulkner		long	fname;		/* char	* */
968794f0adRoger A. Faulkner		long	fmode;
969794f0adRoger A. Faulkner		long	flag;
970794f0adRoger A. Faulkner	} *uap = (struct a *)clwp->lwp_ap;
971794f0adRoger A. Faulkner
9720f48f68Toomas Soome	if (uap->fname == 0)
973794f0adRoger A. Faulkner		e = AUE_FCHMOD;
974794f0adRoger A. Faulkner	else
975794f0adRoger A. Faulkner		e = AUE_CHMOD;
976794f0adRoger A. Faulkner
977794f0adRoger A. Faulkner	return (e);
978794f0adRoger A. Faulkner}
979794f0adRoger A. Faulkner
980794f0adRoger A. Faulkner/*ARGSUSED*/
981794f0adRoger A. Faulknerstatic void
982794f0adRoger A. Faulkneraus_fchmodat(struct t_audit_data *tad)
983794f0adRoger A. Faulkner{
984794f0adRoger A. Faulkner	klwp_t *clwp = ttolwp(curthread);
985794f0adRoger A. Faulkner	uint32_t fmode;
986794f0adRoger A. Faulkner	uint32_t fd;
987794f0adRoger A. Faulkner	struct file  *fp;
988794f0adRoger A. Faulkner	struct vnode *vp;
989794f0adRoger A. Faulkner	struct f_audit_data *fad;
990794f0adRoger A. Faulkner
991794f0adRoger A. Faulkner	struct a {
992794f0adRoger A. Faulkner		long	fd;
993794f0adRoger A. Faulkner		long	fname;		/* char	* */
994794f0adRoger A. Faulkner		long	fmode;
995794f0adRoger A. Faulkner		long	flag;
996794f0adRoger A. Faulkner	} *uap = (struct a *)clwp->lwp_ap;
997794f0adRoger A. Faulkner
998794f0adRoger A. Faulkner	fd = (uint32_t)uap->fd;
999794f0adRoger A. Faulkner	fmode = (uint32_t)uap->fmode;
1000794f0adRoger A. Faulkner
1001794f0adRoger A. Faulkner	au_uwrite(au_to_arg32(2, "new file mode", fmode&07777));
1002794f0adRoger A. Faulkner
10030f48f68Toomas Soome	if (fd == AT_FDCWD || uap->fname != 0)	/* same as chmod() */
1004794f0adRoger A. Faulkner		return;
1005794f0adRoger A. Faulkner
1006794f0adRoger A. Faulkner	/*
1007794f0adRoger A. Faulkner	 * convert file pointer to file descriptor
1008794f0adRoger A. Faulkner	 *   Note: fd ref count incremented here.
1009794f0adRoger A. Faulkner	 */
1010794f0adRoger A. Faulkner	if ((fp = getf(fd)) == NULL)
1011794f0adRoger A. Faulkner		return;
1012794f0adRoger A. Faulkner
1013794f0adRoger A. Faulkner	/* get path from file struct here */
10147c478bdstevel@tonic-gate	fad = F2A(fp);
10157c478bdstevel@tonic-gate	if (fad->fad_aupath != NULL) {
10167c478bdstevel@tonic-gate		au_uwrite(au_to_path(fad->fad_aupath));
10177c478bdstevel@tonic-gate	} else {
10187c478bdstevel@tonic-gate		au_uwrite(au_to_arg32(1, "no path: fd", fd));
10197c478bdstevel@tonic-gate	}
10207c478bdstevel@tonic-gate
10217c478bdstevel@tonic-gate	vp = fp->f_vnode;
10227c478bdstevel@tonic-gate	audit_attributes(vp);
10237c478bdstevel@tonic-gate
10247c478bdstevel@tonic-gate	/* decrement file descriptor reference count */
10257c478bdstevel@tonic-gate	releasef(fd);
10267c478bdstevel@tonic-gate}
10277c478bdstevel@tonic-gate
10288fd04b8Roger A. Faulkner/*
10298fd04b8Roger A. Faulkner * convert open mode to appropriate open event
10308fd04b8Roger A. Faulkner */
10318fd04b8Roger A. Faulknerau_event_t
10328fd04b8Roger A. Faulkneropen_event(uint_t fm)
10338fd04b8Roger A. Faulkner{
10348fd04b8Roger A. Faulkner	au_event_t e;
10358fd04b8Roger A. Faulkner
1036794f0adRoger A. Faulkner	switch (fm & (O_ACCMODE | O_CREAT | O_TRUNC)) {
10378fd04b8Roger A. Faulkner	case O_RDONLY:
10388fd04b8Roger A. Faulkner		e = AUE_OPEN_R;
10398fd04b8Roger A. Faulkner		break;
10408fd04b8Roger A. Faulkner	case O_RDONLY | O_CREAT:
10418fd04b8Roger A. Faulkner		e = AUE_OPEN_RC;
10428fd04b8Roger A. Faulkner		break;
10438fd04b8Roger A. Faulkner	case O_RDONLY | O_TRUNC:
10448fd04b8Roger A. Faulkner		e = AUE_OPEN_RT;
10458fd04b8Roger A. Faulkner		break;
10468fd04b8Roger A. Faulkner	case O_RDONLY | O_TRUNC | O_CREAT:
10478fd04b8Roger A. Faulkner		e = AUE_OPEN_RTC;
10488fd04b8Roger A. Faulkner		break;
10498fd04b8Roger A. Faulkner	case O_WRONLY:
10508fd04b8Roger A. Faulkner		e = AUE_OPEN_W;
10518fd04b8Roger A. Faulkner		break;
10528fd04b8Roger A. Faulkner	case O_WRONLY | O_CREAT:
10538fd04b8Roger A. Faulkner		e = AUE_OPEN_WC;
10548fd04b8Roger A. Faulkner		break;
10558fd04b8Roger A. Faulkner	case O_WRONLY | O_TRUNC:
10568fd04b8Roger A. Faulkner		e = AUE_OPEN_WT;
10578fd04b8Roger A. Faulkner		break;
10588fd04b8Roger A. Faulkner	case O_WRONLY | O_TRUNC | O_CREAT:
10598fd04b8Roger A. Faulkner		e = AUE_OPEN_WTC;
10608fd04b8Roger A. Faulkner		break;
10618fd04b8Roger A. Faulkner	case O_RDWR:
10628fd04b8Roger A. Faulkner		e = AUE_OPEN_RW;
10638fd04b8Roger A. Faulkner		break;
10648fd04b8Roger A. Faulkner	case O_RDWR | O_CREAT:
10658fd04b8Roger A. Faulkner		e = AUE_OPEN_RWC;
10668fd04b8Roger A. Faulkner		break;
10678fd04b8Roger A. Faulkner	case O_RDWR | O_TRUNC:
10688fd04b8Roger A. Faulkner		e = AUE_OPEN_RWT;
10698fd04b8Roger A. Faulkner		break;
10708fd04b8Roger A. Faulkner	case O_RDWR | O_TRUNC | O_CREAT:
10718fd04b8Roger A. Faulkner		e = AUE_OPEN_RWTC;
10728fd04b8Roger A. Faulkner		break;
1073794f0adRoger A. Faulkner	case O_SEARCH:
1074794f0adRoger A. Faulkner		e = AUE_OPEN_S;
1075794f0adRoger A. Faulkner		break;
1076794f0adRoger A. Faulkner	case O_EXEC:
1077794f0adRoger A. Faulkner		e = AUE_OPEN_E;
1078794f0adRoger A. Faulkner		break;
10798fd04b8Roger A. Faulkner	default:
10808fd04b8Roger A. Faulkner		e = AUE_NULL;
10818fd04b8Roger A. Faulkner		break;
10828fd04b8Roger A. Faulkner	}
10837c478bdstevel@tonic-gate
10848fd04b8Roger A. Faulkner	return (e);
10858fd04b8Roger A. Faulkner}
10868fd04b8Roger A. Faulkner
10878fd04b8Roger A. Faulkner/* ARGSUSED */
10887c478bdstevel@tonic-gatestatic au_event_t
10897c478bdstevel@tonic-gateaui_open(au_event_t e)
10907c478bdstevel@tonic-gate{
10917c478bdstevel@tonic-gate	klwp_t *clwp = ttolwp(curthread);
10927c478bdstevel@tonic-gate	uint_t fm;
10937c478bdstevel@tonic-gate
10947c478bdstevel@tonic-gate	struct a {
10957c478bdstevel@tonic-gate		long	fnamep;		/* char	* */
10967c478bdstevel@tonic-gate		long	fmode;
10977c478bdstevel@tonic-gate		long	cmode;
10987c478bdstevel@tonic-gate	} *uap = (struct a *)clwp->lwp_ap;
10997c478bdstevel@tonic-gate
11007c478bdstevel@tonic-gate	fm = (uint_t)uap->fmode;
11017c478bdstevel@tonic-gate
11028fd04b8Roger A. Faulkner	return (open_event(fm));
11037c478bdstevel@tonic-gate}
11047c478bdstevel@tonic-gate
11057c478bdstevel@tonic-gatestatic void
11067c478bdstevel@tonic-gateaus_open(struct t_audit_data *tad)
11077c478bdstevel@tonic-gate{
11087c478bdstevel@tonic-gate	klwp_t *clwp = ttolwp(curthread);
11097c478bdstevel@tonic-gate	uint_t fm;
11107c478bdstevel@tonic-gate
11117c478bdstevel@tonic-gate	struct a {
11127c478bdstevel@tonic-gate		long	fnamep;		/* char	* */
11137c478bdstevel@tonic-gate		long	fmode;
11147c478bdstevel@tonic-gate		long	cmode;
11157c478bdstevel@tonic-gate	} *uap = (struct a *)clwp->lwp_ap;
11167c478bdstevel@tonic-gate
11177c478bdstevel@tonic-gate	fm = (uint_t)uap->fmode;
11187c478bdstevel@tonic-gate
11197c478bdstevel@tonic-gate	/* If no write, create, or trunc modes, mark as a public op */
11208fd04b8Roger A. Faulkner	if ((fm & (O_RDONLY|O_WRONLY|O_RDWR|O_CREAT|O_TRUNC)) == O_RDONLY)
11214a0fa54Marek Pospisil		tad->tad_ctrl |= TAD_PUBLIC_EV;
11227c478bdstevel@tonic-gate}
11237c478bdstevel@tonic-gate
11248fd04b8Roger A. Faulkner/* ARGSUSED */
11257c478bdstevel@tonic-gatestatic au_event_t
11268fd04b8Roger A. Faulkneraui_openat(au_event_t e)
11277c478bdstevel@tonic-gate{
11288fd04b8Roger A. Faulkner	t_audit_data_t *tad = T2A(curthread);
11297c478bdstevel@tonic-gate	klwp_t *clwp = ttolwp(curthread);
11308fd04b8Roger A. Faulkner	uint_t fm;
11318fd04b8Roger A. Faulkner
11327c478bdstevel@tonic-gate	struct a {
11338fd04b8Roger A. Faulkner		long	filedes;
11348fd04b8Roger A. Faulkner		long	fnamep;		/* char	* */
11358fd04b8Roger A. Faulkner		long	fmode;
11368fd04b8Roger A. Faulkner		long	cmode;
11377c478bdstevel@tonic-gate	} *uap = (struct a *)clwp->lwp_ap;
11387c478bdstevel@tonic-gate
11398fd04b8Roger A. Faulkner	fm = (uint_t)uap->fmode;
11407c478bdstevel@tonic-gate
1141c4d3e29Brent Paulson	/*
1142c4d3e29Brent Paulson	 * __openattrdirat() does an extra pathname lookup in order to
1143c4d3e29Brent Paulson	 * enter the extended system attribute namespace of the referenced
1144c4d3e29Brent Paulson	 * extended attribute filename.
1145c4d3e29Brent Paulson	 */
1146c4d3e29Brent Paulson	if (fm & FXATTRDIROPEN)
1147c4d3e29Brent Paulson		tad->tad_ctrl |= TAD_MLD;
11487c478bdstevel@tonic-gate
11498fd04b8Roger A. Faulkner	return (open_event(fm));
11508fd04b8Roger A. Faulkner}
11517c478bdstevel@tonic-gate
11528fd04b8Roger A. Faulknerstatic void
11538fd04b8Roger A. Faulkneraus_openat(struct t_audit_data *tad)
11548fd04b8Roger A. Faulkner{
11558fd04b8Roger A. Faulkner	klwp_t *clwp = ttolwp(curthread);
11568fd04b8Roger A. Faulkner	uint_t fm;
11577c478bdstevel@tonic-gate
11588fd04b8Roger A. Faulkner	struct a {
11598fd04b8Roger A. Faulkner		long	filedes;
11608fd04b8Roger A. Faulkner		long	fnamep;		/* char	* */
11618fd04b8Roger A. Faulkner		long	fmode;
11628fd04b8Roger A. Faulkner		long	cmode;
11638fd04b8Roger A. Faulkner	} *uap = (struct a *)clwp->lwp_ap;
11647c478bdstevel@tonic-gate
11658fd04b8Roger A. Faulkner	fm = (uint_t)uap->fmode;
11667c478bdstevel@tonic-gate
11678fd04b8Roger A. Faulkner	/* If no write, create, or trunc modes, mark as a public op */
11688fd04b8Roger A. Faulkner	if ((fm & (O_RDONLY|O_WRONLY|O_RDWR|O_CREAT|O_TRUNC)) == O_RDONLY)
11694a0fa54Marek Pospisil		tad->tad_ctrl |= TAD_PUBLIC_EV;
11707c478bdstevel@tonic-gate}
11717c478bdstevel@tonic-gate
11728fd04b8Roger A. Faulknerstatic au_event_t
11738fd04b8Roger A. Faulkneraui_unlinkat(au_event_t e)
11747c478bdstevel@tonic-gate{
11757c478bdstevel@tonic-gate	klwp_t *clwp = ttolwp(curthread);
11768fd04b8Roger A. Faulkner
11777c478bdstevel@tonic-gate	struct a {
11788fd04b8Roger A. Faulkner		long	filedes;
11798fd04b8Roger A. Faulkner		long	fnamep;		/* char	* */
11808fd04b8Roger A. Faulkner		long	flags;
11817c478bdstevel@tonic-gate	} *uap = (struct a *)clwp->lwp_ap;
11827c478bdstevel@tonic-gate
11838fd04b8Roger A. Faulkner	if (uap->flags & AT_REMOVEDIR)
11848fd04b8Roger A. Faulkner		e = AUE_RMDIR;
11858fd04b8Roger A. Faulkner	else
11868fd04b8Roger A. Faulkner		e = AUE_UNLINK;
11877c478bdstevel@tonic-gate
11888fd04b8Roger A. Faulkner	return (e);
11898fd04b8Roger A. Faulkner}
11907c478bdstevel@tonic-gate
11918fd04b8Roger A. Faulknerstatic au_event_t
11928fd04b8Roger A. Faulkneraui_fstatat(au_event_t e)
11938fd04b8Roger A. Faulkner{
11948fd04b8Roger A. Faulkner	klwp_t *clwp = ttolwp(curthread);
11957c478bdstevel@tonic-gate
11968fd04b8Roger A. Faulkner	struct a {
11978fd04b8Roger A. Faulkner		long	filedes;
11988fd04b8Roger A. Faulkner		long	fnamep;		/* char	* */
11998fd04b8Roger A. Faulkner		long	statb;
12008fd04b8Roger A. Faulkner		long	flags;
12018fd04b8Roger A. Faulkner	} *uap = (struct a *)clwp->lwp_ap;
12028fd04b8Roger A. Faulkner
12030f48f68Toomas Soome	if (uap->fnamep == 0)
12048fd04b8Roger A. Faulkner		e = AUE_FSTAT;
12058fd04b8Roger A. Faulkner	else if (uap->flags & AT_SYMLINK_NOFOLLOW)
12068fd04b8Roger A. Faulkner		e = AUE_LSTAT;
12078fd04b8Roger A. Faulkner	else
12088fd04b8Roger A. Faulkner		e = AUE_STAT;
12098fd04b8Roger A. Faulkner
12108fd04b8Roger A. Faulkner	return (e);
12117c478bdstevel@tonic-gate}
12127c478bdstevel@tonic-gate
12137c478bdstevel@tonic-gate/* msgsys */
12147c478bdstevel@tonic-gatestatic au_event_t
12157c478bdstevel@tonic-gateaui_msgsys(au_event_t e)
12167c478bdstevel@tonic-gate{
12177c478bdstevel@tonic-gate	klwp_t *clwp = ttolwp(curthread);
12187c478bdstevel@tonic-gate	uint_t fm;
12197c478bdstevel@tonic-gate
12207c478bdstevel@tonic-gate	struct a {
12217c478bdstevel@tonic-gate		long	id;	/* function code id */
12227c478bdstevel@tonic-gate		long	ap;	/* arg pointer for recvmsg */
12237c478bdstevel@tonic-gate	} *uap = (struct a *)clwp->lwp_ap;
12247c478bdstevel@tonic-gate
12257c478bdstevel@tonic-gate	struct b {
12267c478bdstevel@tonic-gate		long	msgid;
12277c478bdstevel@tonic-gate		long	cmd;
12287c478bdstevel@tonic-gate		long	buf;	/* struct msqid_ds * */
12297c478bdstevel@tonic-gate	} *uap1 = (struct b *)&clwp->lwp_ap[1];
12307c478bdstevel@tonic-gate
12317c478bdstevel@tonic-gate	fm  = (uint_t)uap->id;
12327c478bdstevel@tonic-gate
12337c478bdstevel@tonic-gate	switch (fm) {
12347c478bdstevel@tonic-gate	case 0:		/* msgget */
12357c478bdstevel@tonic-gate		e = AUE_MSGGET;
12367c478bdstevel@tonic-gate		break;
12377c478bdstevel@tonic-gate	case 1:		/* msgctl */
12387c478bdstevel@tonic-gate		switch ((uint_t)uap1->cmd) {
12397c478bdstevel@tonic-gate		case IPC_RMID:
12407c478bdstevel@tonic-gate			e = AUE_MSGCTL_RMID;
12417c478bdstevel@tonic-gate			break;
12427c478bdstevel@tonic-gate		case IPC_SET:
12437c478bdstevel@tonic-gate			e = AUE_MSGCTL_SET;
12447c478bdstevel@tonic-gate			break;
12457c478bdstevel@tonic-gate		case IPC_STAT:
12467c478bdstevel@tonic-gate			e = AUE_MSGCTL_STAT;
12477c478bdstevel@tonic-gate			break;
12487c478bdstevel@tonic-gate		default:
12497c478bdstevel@tonic-gate			e = AUE_MSGCTL;
12507c478bdstevel@tonic-gate			break;
12517c478bdstevel@tonic-gate		}
12527c478bdstevel@tonic-gate		break;
12537c478bdstevel@tonic-gate	case 2:		/* msgrcv */
12547c478bdstevel@tonic-gate		e = AUE_MSGRCV;
12557c478bdstevel@tonic-gate		break;
12567c478bdstevel@tonic-gate	case 3:		/* msgsnd */
12577c478bdstevel@tonic-gate		e = AUE_MSGSND;
12587c478bdstevel@tonic-gate		break;
12597c478bdstevel@tonic-gate	default:	/* illegal system call */
12607c478bdstevel@tonic-gate		e = AUE_NULL;
12617c478bdstevel@tonic-gate		break;
12627c478bdstevel@tonic-gate	}
12637c478bdstevel@tonic-gate
12647c478bdstevel@tonic-gate	return (e);
12657c478bdstevel@tonic-gate}
12667c478bdstevel@tonic-gate
12677c478bdstevel@tonic-gate
12687c478bdstevel@tonic-gate/* shmsys */
12697c478bdstevel@tonic-gatestatic au_event_t
12707c478bdstevel@tonic-gateaui_shmsys(au_event_t e)
12717c478bdstevel@tonic-gate{
12727c478bdstevel@tonic-gate	klwp_t *clwp = ttolwp(curthread);
12737c478bdstevel@tonic-gate	int fm;
12747c478bdstevel@tonic-gate
12757c478bdstevel@tonic-gate	struct a {		/* shmsys */
12767c478bdstevel@tonic-gate		long	id;	/* function code id */
12777c478bdstevel@tonic-gate	} *uap = (struct a *)clwp->lwp_ap;
12787c478bdstevel@tonic-gate
12797c478bdstevel@tonic-gate	struct b {		/* ctrl */
12807c478bdstevel@tonic-gate		long	shmid;
12817c478bdstevel@tonic-gate		long	cmd;
12827c478bdstevel@tonic-gate		long	arg;		/* struct shmid_ds * */
12837c478bdstevel@tonic-gate	} *uap1 = (struct b *)&clwp->lwp_ap[1];
12847c478bdstevel@tonic-gate	fm  = (uint_t)uap->id;
12857c478bdstevel@tonic-gate
12867c478bdstevel@tonic-gate	switch (fm) {
12877c478bdstevel@tonic-gate	case 0:		/* shmat */
12887c478bdstevel@tonic-gate		e = AUE_SHMAT;
12897c478bdstevel@tonic-gate		break;
12907c478bdstevel@tonic-gate	case 1:		/* shmctl */
12917c478bdstevel@tonic-gate		switch ((uint_t)uap1->cmd) {
12927c478bdstevel@tonic-gate		case IPC_RMID:
12937c478bdstevel@tonic-gate			e = AUE_SHMCTL_RMID;
12947c478bdstevel@tonic-gate			break;
12957c478bdstevel@tonic-gate		case IPC_SET:
12967c478bdstevel@tonic-gate			e = AUE_SHMCTL_SET;
12977c478bdstevel@tonic-gate			break;
12987c478bdstevel@tonic-gate		case IPC_STAT:
12997c478bdstevel@tonic-gate			e = AUE_SHMCTL_STAT;
13007c478bdstevel@tonic-gate			break;
13017c478bdstevel@tonic-gate		default:
13027c478bdstevel@tonic-gate			e = AUE_SHMCTL;
13037c478bdstevel@tonic-gate			break;
13047c478bdstevel@tonic-gate		}
13057c478bdstevel@tonic-gate		break;
13067c478bdstevel@tonic-gate	case 2:		/* shmdt */
13077c478bdstevel@tonic-gate		e = AUE_SHMDT;
13087c478bdstevel@tonic-gate		break;
13097c478bdstevel@tonic-gate	case 3:		/* shmget */
13107c478bdstevel@tonic-gate		e = AUE_SHMGET;
13117c478bdstevel@tonic-gate		break;
13127c478bdstevel@tonic-gate	default:	/* illegal system call */
13137c478bdstevel@tonic-gate		e = AUE_NULL;
13147c478bdstevel@tonic-gate		break;
13157c478bdstevel@tonic-gate	}
13167c478bdstevel@tonic-gate
13177c478bdstevel@tonic-gate	return (e);
13187c478bdstevel@tonic-gate}
13197c478bdstevel@tonic-gate
13207c478bdstevel@tonic-gate
13217c478bdstevel@tonic-gate/* semsys */
13227c478bdstevel@tonic-gatestatic au_event_t
13237c478bdstevel@tonic-gateaui_semsys(au_event_t e)
13247c478bdstevel@tonic-gate{
13257c478bdstevel@tonic-gate	klwp_t *clwp = ttolwp(curthread);
13267c478bdstevel@tonic-gate	uint_t fm;
13277c478bdstevel@tonic-gate
13287c478bdstevel@tonic-gate	struct a {		/* semsys */
13297c478bdstevel@tonic-gate		long	id;
13307c478bdstevel@tonic-gate	} *uap = (struct a *)clwp->lwp_ap;
13317c478bdstevel@tonic-gate
13327c478bdstevel@tonic-gate	struct b {		/* ctrl */
13337c478bdstevel@tonic-gate		long	semid;
13347c478bdstevel@tonic-gate		long	semnum;
13357c478bdstevel@tonic-gate		long	cmd;
13367c478bdstevel@tonic-gate		long	arg;
13377c478bdstevel@tonic-gate	} *uap1 = (struct b *)&clwp->lwp_ap[1];
13387c478bdstevel@tonic-gate
13397c478bdstevel@tonic-gate	fm = (uint_t)uap->id;
13407c478bdstevel@tonic-gate
13417c478bdstevel@tonic-gate	switch (fm) {
13427c478bdstevel@tonic-gate	case 0:		/* semctl */
13437c478bdstevel@tonic-gate		switch ((uint_t)uap1->cmd) {
13447c478bdstevel@tonic-gate		case IPC_RMID:
13457c478bdstevel@tonic-gate			e = AUE_SEMCTL_RMID;
13467c478bdstevel@tonic-gate			break;
13477c478bdstevel@tonic-gate		case IPC_SET:
13487c478bdstevel@tonic-gate			e = AUE_SEMCTL_SET;
13497c478bdstevel@tonic-gate			break;
13507c478bdstevel@tonic-gate		case IPC_STAT:
13517c478bdstevel@tonic-gate			e = AUE_SEMCTL_STAT;
13527c478bdstevel@tonic-gate			break;
13537c478bdstevel@tonic-gate		case GETNCNT:
13547c478bdstevel@tonic-gate			e = AUE_SEMCTL_GETNCNT;
13557c478bdstevel@tonic-gate			break;
13567c478bdstevel@tonic-gate		case GETPID:
13577c478bdstevel@tonic-gate			e = AUE_SEMCTL_GETPID;
13587c478bdstevel@tonic-gate			break;
13597c478bdstevel@tonic-gate		case GETVAL:
13607c478bdstevel@tonic-gate			e = AUE_SEMCTL_GETVAL;
13617c478bdstevel@tonic-gate			break;
13627c478bdstevel@tonic-gate		case GETALL:
13637c478bdstevel@tonic-gate			e = AUE_SEMCTL_GETALL;
13647c478bdstevel@tonic-gate			break;
13657c478bdstevel@tonic-gate		case GETZCNT:
13667c478bdstevel@tonic-gate			e = AUE_SEMCTL_GETZCNT;
13677c478bdstevel@tonic-gate			break;
13687c478bdstevel@tonic-gate		case SETVAL:
13697c478bdstevel@tonic-gate			e = AUE_SEMCTL_SETVAL;
13707c478bdstevel@tonic-gate			break;
13717c478bdstevel@tonic-gate		case SETALL:
13727c478bdstevel@tonic-gate			e = AUE_SEMCTL_SETALL;
13737c478bdstevel@tonic-gate			break;
13747c478bdstevel@tonic-gate		default:
13757c478bdstevel@tonic-gate			e = AUE_SEMCTL;
13767c478bdstevel@tonic-gate			break;
13777c478bdstevel@tonic-gate		}
13787c478bdstevel@tonic-gate		break;
13797c478bdstevel@tonic-gate	case 1:		/* semget */
13807c478bdstevel@tonic-gate		e = AUE_SEMGET;
13817c478bdstevel@tonic-gate		break;
13827c478bdstevel@tonic-gate	case 2:		/* semop */
13837c478bdstevel@tonic-gate		e = AUE_SEMOP;
13847c478bdstevel@tonic-gate		break;
13857c478bdstevel@tonic-gate	default:	/* illegal system call */
13867c478bdstevel@tonic-gate		e = AUE_NULL;
13877c478bdstevel@tonic-gate		break;
13887c478bdstevel@tonic-gate	}
13897c478bdstevel@tonic-gate
13907c478bdstevel@tonic-gate	return (e);
13917c478bdstevel@tonic-gate}
13927c478bdstevel@tonic-gate
13937c478bdstevel@tonic-gate/* utssys - uname(2), ustat(2), fusers(2) */
13947c478bdstevel@tonic-gatestatic au_event_t
13957c478bdstevel@tonic-gateaui_utssys(au_event_t e)
13967c478bdstevel@tonic-gate{
13977c478bdstevel@tonic-gate	klwp_t *clwp = ttolwp(curthread);
13987c478bdstevel@tonic-gate	uint_t type;
13997c478bdstevel@tonic-gate
14007c478bdstevel@tonic-gate	struct a {
14017c478bdstevel@tonic-gate		union {
14027c478bdstevel@tonic-gate			long	cbuf;		/* char * */
14037c478bdstevel@tonic-gate			long	ubuf;		/* struct stat * */
14047c478bdstevel@tonic-gate		} ub;
14057c478bdstevel@tonic-gate		union {
14067c478bdstevel@tonic-gate			long	mv;	/* for USTAT */
14077c478bdstevel@tonic-gate			long	flags;	/* for FUSERS */
14087c478bdstevel@tonic-gate		} un;
14097c478bdstevel@tonic-gate		long	type;
14107c478bdstevel@tonic-gate		long	outbp;		/* char * for FUSERS */
14117c478bdstevel@tonic-gate	} *uap = (struct a *)clwp->lwp_ap;
14127c478bdstevel@tonic-gate
14137c478bdstevel@tonic-gate	type = (uint_t)uap->type;
14147c478bdstevel@tonic-gate
14157c478bdstevel@tonic-gate	if (type == UTS_FUSERS)
14167c478bdstevel@tonic-gate		return (e);
14177c478bdstevel@tonic-gate	else
14187c478bdstevel@tonic-gate		return ((au_event_t)AUE_NULL);
14197c478bdstevel@tonic-gate}
14207c478bdstevel@tonic-gate
14217c478bdstevel@tonic-gatestatic au_event_t
14227c478bdstevel@tonic-gateaui_fcntl(au_event_t e)
14237c478bdstevel@tonic-gate{
14247c478bdstevel@tonic-gate	klwp_t *clwp = ttolwp(curthread);
14257c478bdstevel@tonic-gate	uint_t cmd;
14267c478bdstevel@tonic-gate
14277c478bdstevel@tonic-gate	struct a {
14287c478bdstevel@tonic-gate		long	fdes;
14297c478bdstevel@tonic-gate		long	cmd;
14307c478bdstevel@tonic-gate		long	arg;
14317c478bdstevel@tonic-gate	} *uap = (struct a *)clwp->lwp_ap;
14327c478bdstevel@tonic-gate
14337c478bdstevel@tonic-gate	cmd = (uint_t)uap->cmd;
14347c478bdstevel@tonic-gate
14357c478bdstevel@tonic-gate	switch (cmd) {
14367c478bdstevel@tonic-gate	case F_GETLK:
14377c478bdstevel@tonic-gate	case F_SETLK:
14387c478bdstevel@tonic-gate	case F_SETLKW:
14397c478bdstevel@tonic-gate		break;
14407c478bdstevel@tonic-gate	case F_SETFL:
14417c478bdstevel@tonic-gate	case F_GETFL:
14427c478bdstevel@tonic-gate	case F_GETFD:
14437c478bdstevel@tonic-gate		break;
14447c478bdstevel@tonic-gate	default:
14457c478bdstevel@tonic-gate		e = (au_event_t)AUE_NULL;
14467c478bdstevel@tonic-gate		break;
14477c478bdstevel@tonic-gate	}
14487c478bdstevel@tonic-gate	return ((au_event_t)e);
14497c478bdstevel@tonic-gate}
14507c478bdstevel@tonic-gate
14517c478bdstevel@tonic-gate/* null function for now */
14527c478bdstevel@tonic-gatestatic au_event_t
14537c478bdstevel@tonic-gateaui_execve(au_event_t e)
14547c478bdstevel@tonic-gate{
14557c478bdstevel@tonic-gate	return (e);
14567c478bdstevel@tonic-gate}
14577c478bdstevel@tonic-gate
14587c478bdstevel@tonic-gate/*ARGSUSED*/
14597c478bdstevel@tonic-gatestatic void
14607c478bdstevel@tonic-gateaus_fcntl(struct t_audit_data *tad)
14617c478bdstevel@tonic-gate{
14627c478bdstevel@tonic-gate	klwp_t *clwp = ttolwp(curthread);
146351b433bMarek Pospisil	uint32_t cmd, fd, flags;
14647c478bdstevel@tonic-gate	struct file  *fp;
14657c478bdstevel@tonic-gate	struct vnode *vp;
14667c478bdstevel@tonic-gate	struct f_audit_data *fad;
14677c478bdstevel@tonic-gate
14687c478bdstevel@tonic-gate	struct a {
14697c478bdstevel@tonic-gate		long	fd;
14707c478bdstevel@tonic-gate		long	cmd;
14717c478bdstevel@tonic-gate		long	arg;
14727c478bdstevel@tonic-gate	} *uap = (struct a *)clwp->lwp_ap;
14737c478bdstevel@tonic-gate
147451b433bMarek Pospisil	cmd	= (uint32_t)uap->cmd;
147551b433bMarek Pospisil	fd	= (uint32_t)uap->fd;
147651b433bMarek Pospisil	flags	= (uint32_t)uap->arg;
14777c478bdstevel@tonic-gate
14787c478bdstevel@tonic-gate	au_uwrite(au_to_arg32(2, "cmd", cmd));
14797c478bdstevel@tonic-gate
148051b433bMarek Pospisil	if (cmd == F_SETFL)
148151b433bMarek Pospisil		au_uwrite(au_to_arg32(3, "flags", flags));
148251b433bMarek Pospisil
14837c478bdstevel@tonic-gate		/*
14847c478bdstevel@tonic-gate		 * convert file pointer to file descriptor
14857c478bdstevel@tonic-gate		 *   Note: fd ref count incremented here.
14867c478bdstevel@tonic-gate		 */
14877c478bdstevel@tonic-gate	if ((fp = getf(fd)) == NULL)
14887c478bdstevel@tonic-gate		return;
14897c478bdstevel@tonic-gate
14907c478bdstevel@tonic-gate	/* get path from file struct here */
14917c478bdstevel@tonic-gate	fad = F2A(fp);
14927c478bdstevel@tonic-gate	if (fad->fad_aupath != NULL) {
14937c478bdstevel@tonic-gate		au_uwrite(au_to_path(fad->fad_aupath));
14947c478bdstevel@tonic-gate	} else {
14957c478bdstevel@tonic-gate		au_uwrite(au_to_arg32(1, "no path: fd", fd));
14967c478bdstevel@tonic-gate	}
14977c478bdstevel@tonic-gate
14987c478bdstevel@tonic-gate	vp = fp->f_vnode;
14997c478bdstevel@tonic-gate	audit_attributes(vp);
15007c478bdstevel@tonic-gate
15017c478bdstevel@tonic-gate	/* decrement file descriptor reference count */
15027c478bdstevel@tonic-gate	releasef(fd);
15037c478bdstevel@tonic-gate}
15047c478bdstevel@tonic-gate
15057c478bdstevel@tonic-gate/*ARGSUSED*/
15067c478bdstevel@tonic-gatestatic void
15077c478bdstevel@tonic-gateaus_kill(struct t_audit_data *tad)
15087c478bdstevel@tonic-gate{
15097c478bdstevel@tonic-gate	klwp_t *clwp = ttolwp(curthread);
15107c478bdstevel@tonic-gate	struct proc *p;
15117c478bdstevel@tonic-gate	uint32_t signo;
15127c478bdstevel@tonic-gate	uid_t uid, ruid;
15137c478bdstevel@tonic-gate	gid_t gid, rgid;
15147c478bdstevel@tonic-gate	pid_t pid;
15157c478bdstevel@tonic-gate	const auditinfo_addr_t *ainfo;
15167c478bdstevel@tonic-gate	cred_t *cr;
15177c478bdstevel@tonic-gate
15187c478bdstevel@tonic-gate	struct a {
15197c478bdstevel@tonic-gate		long	pid;
15207c478bdstevel@tonic-gate		long	signo;
15217c478bdstevel@tonic-gate	} *uap = (struct a *)clwp->lwp_ap;
15227c478bdstevel@tonic-gate
15237c478bdstevel@tonic-gate	pid   = (pid_t)uap->pid;
15247c478bdstevel@tonic-gate	signo = (uint32_t)uap->signo;
15257c478bdstevel@tonic-gate
15267c478bdstevel@tonic-gate	au_uwrite(au_to_arg32(2, "signal", signo));
15277c478bdstevel@tonic-gate	if (pid > 0) {
15287c478bdstevel@tonic-gate		mutex_enter(&pidlock);
15297c478bdstevel@tonic-gate		if (((p = prfind(pid)) == (struct proc *)0) ||
15307c478bdstevel@tonic-gate		    (p->p_stat == SIDL)) {
15317c478bdstevel@tonic-gate			mutex_exit(&pidlock);
15327c478bdstevel@tonic-gate			au_uwrite(au_to_arg32(1, "process", (uint32_t)pid));
15337c478bdstevel@tonic-gate			return;
15347c478bdstevel@tonic-gate		}
15357c478bdstevel@tonic-gate		mutex_enter(&p->p_lock); /* so process doesn't go away */
15367c478bdstevel@tonic-gate		mutex_exit(&pidlock);
15377c478bdstevel@tonic-gate
15387c478bdstevel@tonic-gate		mutex_enter(&p->p_crlock);
15397c478bdstevel@tonic-gate		crhold(cr = p->p_cred);
15407c478bdstevel@tonic-gate		mutex_exit(&p->p_crlock);
15417c478bdstevel@tonic-gate		mutex_exit(&p->p_lock);
15427c478bdstevel@tonic-gate
15437c478bdstevel@tonic-gate		ainfo = crgetauinfo(cr);
15447c478bdstevel@tonic-gate		if (ainfo == NULL) {
15457c478bdstevel@tonic-gate			crfree(cr);
15467c478bdstevel@tonic-gate			au_uwrite(au_to_arg32(1, "process", (uint32_t)pid));
15477c478bdstevel@tonic-gate			return;
15487c478bdstevel@tonic-gate		}
15497c478bdstevel@tonic-gate
15507c478bdstevel@tonic-gate		uid  = crgetuid(cr);
15517c478bdstevel@tonic-gate		gid  = crgetgid(cr);
15527c478bdstevel@tonic-gate		ruid = crgetruid(cr);
15537c478bdstevel@tonic-gate		rgid = crgetrgid(cr);
15547c478bdstevel@tonic-gate		au_uwrite(au_to_process(uid, gid, ruid, rgid, pid,
15557c478bdstevel@tonic-gate		    ainfo->ai_auid, ainfo->ai_asid, &ainfo->ai_termid));
155645916cdjpk
155745916cdjpk		if (is_system_labeled())
155845916cdjpk			au_uwrite(au_to_label(CR_SL(cr)));
155945916cdjpk
15607c478bdstevel@tonic-gate		crfree(cr);
15617c478bdstevel@tonic-gate	}
15627c478bdstevel@tonic-gate	else
15637c478bdstevel@tonic-gate		au_uwrite(au_to_arg32(1, "process", (uint32_t)pid));
15647c478bdstevel@tonic-gate}
15657c478bdstevel@tonic-gate
15667c478bdstevel@tonic-gate/*ARGSUSED*/
15677c478bdstevel@tonic-gatestatic void
15687c478bdstevel@tonic-gateaus_mkdir(struct t_audit_data *tad)
15697c478bdstevel@tonic-gate{
15707c478bdstevel@tonic-gate	klwp_t *clwp = ttolwp(curthread);
15717c478bdstevel@tonic-gate	uint32_t dmode;
15727c478bdstevel@tonic-gate
15737c478bdstevel@tonic-gate	struct a {
15747c478bdstevel@tonic-gate		long	dirnamep;		/* char * */
15757c478bdstevel@tonic-gate		long	dmode;
15767c478bdstevel@tonic-gate	} *uap = (struct a *)clwp->lwp_ap;
15777c478bdstevel@tonic-gate
15787c478bdstevel@tonic-gate	dmode = (uint32_t)uap->dmode;
15797c478bdstevel@tonic-gate
15807c478bdstevel@tonic-gate	au_uwrite(au_to_arg32(2, "mode", dmode));
15817c478bdstevel@tonic-gate}
15827c478bdstevel@tonic-gate
15837c478bdstevel@tonic-gate/*ARGSUSED*/
15847c478bdstevel@tonic-gatestatic void
1585794f0adRoger A. Faulkneraus_mkdirat(struct t_audit_data *tad)
1586794f0adRoger A. Faulkner{
1587794f0adRoger A. Faulkner	klwp_t *clwp = ttolwp(curthread);
1588794f0adRoger A. Faulkner	uint32_t dmode;
1589794f0adRoger A. Faulkner
1590794f0adRoger A. Faulkner	struct a {
1591794f0adRoger A. Faulkner		long	fd;
1592794f0adRoger A. Faulkner		long	dirnamep;		/* char * */
1593794f0adRoger A. Faulkner		long	dmode;
1594794f0adRoger A. Faulkner	} *uap = (struct a *)clwp->lwp_ap;
1595794f0adRoger A. Faulkner
1596794f0adRoger A. Faulkner	dmode = (uint32_t)uap->dmode;
1597794f0adRoger A. Faulkner
1598794f0adRoger A. Faulkner	au_uwrite(au_to_arg32(2, "mode", dmode));
1599794f0adRoger A. Faulkner}
1600794f0adRoger A. Faulkner
1601794f0adRoger A. Faulkner/*ARGSUSED*/
1602794f0adRoger A. Faulknerstatic void
16037c478bdstevel@tonic-gateaus_mknod(struct t_audit_data *tad)
16047c478bdstevel@tonic-gate{
16057c478bdstevel@tonic-gate	klwp_t *clwp = ttolwp(curthread);
16067c478bdstevel@tonic-gate	uint32_t fmode;
16077c478bdstevel@tonic-gate	dev_t dev;
16087c478bdstevel@tonic-gate
16097c478bdstevel@tonic-gate	struct a {
16107c478bdstevel@tonic-gate		long	pnamep;		/* char * */
16117c478bdstevel@tonic-gate		long	fmode;
16127c478bdstevel@tonic-gate		long	dev;
16137c478bdstevel@tonic-gate	} *uap = (struct a *)clwp->lwp_ap;
16147c478bdstevel@tonic-gate
16157c478bdstevel@tonic-gate	fmode = (uint32_t)uap->fmode;
16167c478bdstevel@tonic-gate	dev   = (dev_t)uap->dev;
16177c478bdstevel@tonic-gate
16187c478bdstevel@tonic-gate	au_uwrite(au_to_arg32(2, "mode", fmode));
16197c478bdstevel@tonic-gate#ifdef _LP64
16207c478bdstevel@tonic-gate	au_uwrite(au_to_arg64(3, "dev", dev));
16217c478bdstevel@tonic-gate#else
16227c478bdstevel@tonic-gate	au_uwrite(au_to_arg32(3, "dev", dev));
16237c478bdstevel@tonic-gate#endif
16247c478bdstevel@tonic-gate}
16257c478bdstevel@tonic-gate
16267c478bdstevel@tonic-gate/*ARGSUSED*/
16277c478bdstevel@tonic-gatestatic void
16287c478bdstevel@tonic-gateauf_mknod(struct t_audit_data *tad, int error, rval_t *rval)
16297c478bdstevel@tonic-gate{
16307c478bdstevel@tonic-gate	klwp_t *clwp = ttolwp(curthread);
16317c478bdstevel@tonic-gate	vnode_t	*dvp;
16327c478bdstevel@tonic-gate	caddr_t pnamep;
16337c478bdstevel@tonic-gate
16347c478bdstevel@tonic-gate	struct a {
16357c478bdstevel@tonic-gate		long	pnamep;		/* char * */
16367c478bdstevel@tonic-gate		long	fmode;
16377c478bdstevel@tonic-gate		long	dev;
16387c478bdstevel@tonic-gate	} *uap = (struct a *)clwp->lwp_ap;
16397c478bdstevel@tonic-gate
16407c478bdstevel@tonic-gate	/* no error, then already path token in audit record */
1641794f0adRoger A. Faulkner	if (error != EPERM && error != EINVAL)
16427c478bdstevel@tonic-gate		return;
16437c478bdstevel@tonic-gate
1644794f0adRoger A. Faulkner	/* do the lookup to force generation of path token */
1645794f0adRoger A. Faulkner	pnamep = (