xref: /illumos-gate/usr/src/uts/common/c2/audit_event.c (revision 0f48f68d9e0ad95b0edf718f68736cf3635a1f79)
17c478bd9Sstevel@tonic-gate /*
27c478bd9Sstevel@tonic-gate  * CDDL HEADER START
37c478bd9Sstevel@tonic-gate  *
47c478bd9Sstevel@tonic-gate  * The contents of this file are subject to the terms of the
545916cd2Sjpk  * Common Development and Distribution License (the "License").
645916cd2Sjpk  * You may not use this file except in compliance with the License.
77c478bd9Sstevel@tonic-gate  *
87c478bd9Sstevel@tonic-gate  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
97c478bd9Sstevel@tonic-gate  * or http://www.opensolaris.org/os/licensing.
107c478bd9Sstevel@tonic-gate  * See the License for the specific language governing permissions
117c478bd9Sstevel@tonic-gate  * and limitations under the License.
127c478bd9Sstevel@tonic-gate  *
137c478bd9Sstevel@tonic-gate  * When distributing Covered Code, include this CDDL HEADER in each
147c478bd9Sstevel@tonic-gate  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
157c478bd9Sstevel@tonic-gate  * If applicable, add the following below this CDDL HEADER, with the
167c478bd9Sstevel@tonic-gate  * fields enclosed by brackets "[]" replaced with your own identifying
177c478bd9Sstevel@tonic-gate  * information: Portions Copyright [yyyy] [name of copyright owner]
187c478bd9Sstevel@tonic-gate  *
197c478bd9Sstevel@tonic-gate  * CDDL HEADER END
207c478bd9Sstevel@tonic-gate  */
21794f0adbSRoger A. Faulkner 
227c478bd9Sstevel@tonic-gate /*
234a0fa546SMarek Pospisil  * Copyright (c) 1992, 2010, Oracle and/or its affiliates. All rights reserved.
2489b43686SBayard Bell  * Copyright (c) 2011 Bayard G. Bell. All rights reserved.
2515c07adcSJohn Levon  * Copyright (c) 2018, Joyent, Inc.
267c478bd9Sstevel@tonic-gate  */
277c478bd9Sstevel@tonic-gate 
287c478bd9Sstevel@tonic-gate /*
297c478bd9Sstevel@tonic-gate  * This file contains the audit event table used to control the production
307c478bd9Sstevel@tonic-gate  * of audit records for each system call.
317c478bd9Sstevel@tonic-gate  */
327c478bd9Sstevel@tonic-gate 
337c478bd9Sstevel@tonic-gate #include <sys/policy.h>
347c478bd9Sstevel@tonic-gate #include <sys/cred.h>
357c478bd9Sstevel@tonic-gate #include <sys/types.h>
367c478bd9Sstevel@tonic-gate #include <sys/systm.h>
377c478bd9Sstevel@tonic-gate #include <sys/systeminfo.h>	/* for sysinfo auditing */
387c478bd9Sstevel@tonic-gate #include <sys/utsname.h>	/* for sysinfo auditing */
397c478bd9Sstevel@tonic-gate #include <sys/proc.h>
407c478bd9Sstevel@tonic-gate #include <sys/vnode.h>
417c478bd9Sstevel@tonic-gate #include <sys/mman.h>		/* for mmap(2) auditing etc. */
427c478bd9Sstevel@tonic-gate #include <sys/fcntl.h>
437c478bd9Sstevel@tonic-gate #include <sys/modctl.h>		/* for modctl auditing */
447c478bd9Sstevel@tonic-gate #include <sys/vnode.h>
457c478bd9Sstevel@tonic-gate #include <sys/user.h>
467c478bd9Sstevel@tonic-gate #include <sys/types.h>
477c478bd9Sstevel@tonic-gate #include <sys/processor.h>
487c478bd9Sstevel@tonic-gate #include <sys/procset.h>
497c478bd9Sstevel@tonic-gate #include <sys/acl.h>
507c478bd9Sstevel@tonic-gate #include <sys/ipc.h>
517c478bd9Sstevel@tonic-gate #include <sys/door.h>
527c478bd9Sstevel@tonic-gate #include <sys/sem.h>
537c478bd9Sstevel@tonic-gate #include <sys/msg.h>
547c478bd9Sstevel@tonic-gate #include <sys/shm.h>
557c478bd9Sstevel@tonic-gate #include <sys/kmem.h>
567c478bd9Sstevel@tonic-gate #include <sys/file.h>		/* for accept */
577c478bd9Sstevel@tonic-gate #include <sys/utssys.h>		/* for fuser */
5845916cd2Sjpk #include <sys/tsol/label.h>
5961b9bf51Srica #include <sys/tsol/tndb.h>
6061b9bf51Srica #include <sys/tsol/tsyscall.h>
617c478bd9Sstevel@tonic-gate #include <c2/audit.h>
627c478bd9Sstevel@tonic-gate #include <c2/audit_kernel.h>
637c478bd9Sstevel@tonic-gate #include <c2/audit_kevents.h>
647c478bd9Sstevel@tonic-gate #include <c2/audit_record.h>
657c478bd9Sstevel@tonic-gate #include <sys/procset.h>
667c478bd9Sstevel@tonic-gate #include <nfs/mount.h>
677c478bd9Sstevel@tonic-gate #include <sys/param.h>
687c478bd9Sstevel@tonic-gate #include <sys/debug.h>
697c478bd9Sstevel@tonic-gate #include <sys/sysmacros.h>
707c478bd9Sstevel@tonic-gate #include <sys/stream.h>
717c478bd9Sstevel@tonic-gate #include <sys/strsubr.h>
727c478bd9Sstevel@tonic-gate #include <sys/stropts.h>
737c478bd9Sstevel@tonic-gate #include <sys/tihdr.h>
747c478bd9Sstevel@tonic-gate #include <sys/socket.h>
757c478bd9Sstevel@tonic-gate #include <sys/socketvar.h>
760f1702c5SYu Xiangning #include <sys/vfs_opreg.h>
770f1702c5SYu Xiangning #include <fs/sockfs/sockcommon.h>
787c478bd9Sstevel@tonic-gate #include <netinet/in.h>
797c478bd9Sstevel@tonic-gate #include <sys/ddi.h>
80df2381bfSpraks #include <sys/port_impl.h>
81d2a70789SRichard Lowe #include <sys/secflags.h>
82df2381bfSpraks 
838fd04b83SRoger A. Faulkner static au_event_t	aui_fchownat(au_event_t);
84794f0adbSRoger A. Faulkner static au_event_t	aui_fchmodat(au_event_t);
857c478bd9Sstevel@tonic-gate static au_event_t	aui_open(au_event_t);
868fd04b83SRoger A. Faulkner static au_event_t	aui_openat(au_event_t);
878fd04b83SRoger A. Faulkner static au_event_t	aui_unlinkat(au_event_t);
888fd04b83SRoger A. Faulkner static au_event_t	aui_fstatat(au_event_t);
897c478bd9Sstevel@tonic-gate static au_event_t	aui_msgsys(au_event_t);
907c478bd9Sstevel@tonic-gate static au_event_t	aui_shmsys(au_event_t);
917c478bd9Sstevel@tonic-gate static au_event_t	aui_semsys(au_event_t);
927c478bd9Sstevel@tonic-gate static au_event_t	aui_utssys(au_event_t);
937c478bd9Sstevel@tonic-gate static au_event_t	aui_fcntl(au_event_t);
947c478bd9Sstevel@tonic-gate static au_event_t	aui_execve(au_event_t);
957c478bd9Sstevel@tonic-gate static au_event_t	aui_memcntl(au_event_t);
967c478bd9Sstevel@tonic-gate static au_event_t	aui_sysinfo(au_event_t);
97df2381bfSpraks static au_event_t	aui_portfs(au_event_t);
987c478bd9Sstevel@tonic-gate static au_event_t	aui_auditsys(au_event_t);
997c478bd9Sstevel@tonic-gate static au_event_t	aui_modctl(au_event_t);
1007c478bd9Sstevel@tonic-gate static au_event_t	aui_acl(au_event_t);
1017c478bd9Sstevel@tonic-gate static au_event_t	aui_doorfs(au_event_t);
1027c478bd9Sstevel@tonic-gate static au_event_t	aui_privsys(au_event_t);
103657b1f3dSraf static au_event_t	aui_forksys(au_event_t);
10461b9bf51Srica static au_event_t	aui_labelsys(au_event_t);
1054be8c573SJan Friedel static au_event_t	aui_setpgrp(au_event_t);
1067c478bd9Sstevel@tonic-gate 
107d2a70789SRichard Lowe 
108cb49a9fdSMarek Pospisil static void	aus_exit(struct t_audit_data *);
1097c478bd9Sstevel@tonic-gate static void	aus_open(struct t_audit_data *);
1108fd04b83SRoger A. Faulkner static void	aus_openat(struct t_audit_data *);
1117c478bd9Sstevel@tonic-gate static void	aus_acl(struct t_audit_data *);
1127c478bd9Sstevel@tonic-gate static void	aus_acct(struct t_audit_data *);
1137c478bd9Sstevel@tonic-gate static void	aus_chown(struct t_audit_data *);
1147c478bd9Sstevel@tonic-gate static void	aus_fchown(struct t_audit_data *);
1157c478bd9Sstevel@tonic-gate static void	aus_lchown(struct t_audit_data *);
1168fd04b83SRoger A. Faulkner static void	aus_fchownat(struct t_audit_data *);
1177c478bd9Sstevel@tonic-gate static void	aus_chmod(struct t_audit_data *);
1187c478bd9Sstevel@tonic-gate static void	aus_facl(struct t_audit_data *);
1197c478bd9Sstevel@tonic-gate static void	aus_fchmod(struct t_audit_data *);
120794f0adbSRoger A. Faulkner static void	aus_fchmodat(struct t_audit_data *);
1217c478bd9Sstevel@tonic-gate static void	aus_fcntl(struct t_audit_data *);
1227c478bd9Sstevel@tonic-gate static void	aus_mkdir(struct t_audit_data *);
123794f0adbSRoger A. Faulkner static void	aus_mkdirat(struct t_audit_data *);
1247c478bd9Sstevel@tonic-gate static void	aus_mknod(struct t_audit_data *);
125794f0adbSRoger A. Faulkner static void	aus_mknodat(struct t_audit_data *);
1267c478bd9Sstevel@tonic-gate static void	aus_mount(struct t_audit_data *);
1277c478bd9Sstevel@tonic-gate static void	aus_umount2(struct t_audit_data *);
1287c478bd9Sstevel@tonic-gate static void	aus_msgsys(struct t_audit_data *);
1297c478bd9Sstevel@tonic-gate static void	aus_semsys(struct t_audit_data *);
1307c478bd9Sstevel@tonic-gate static void	aus_close(struct t_audit_data *);
1317c478bd9Sstevel@tonic-gate static void	aus_fstatfs(struct t_audit_data *);
1327c478bd9Sstevel@tonic-gate static void	aus_setgid(struct t_audit_data *);
1334be8c573SJan Friedel static void	aus_setpgrp(struct t_audit_data *);
1347c478bd9Sstevel@tonic-gate static void	aus_setuid(struct t_audit_data *);
1357c478bd9Sstevel@tonic-gate static void	aus_shmsys(struct t_audit_data *);
1367c478bd9Sstevel@tonic-gate static void	aus_doorfs(struct t_audit_data *);
1377c478bd9Sstevel@tonic-gate static void	aus_ioctl(struct t_audit_data *);
1387c478bd9Sstevel@tonic-gate static void	aus_memcntl(struct t_audit_data *);
1397c478bd9Sstevel@tonic-gate static void	aus_mmap(struct t_audit_data *);
1407c478bd9Sstevel@tonic-gate static void	aus_munmap(struct t_audit_data *);
1417c478bd9Sstevel@tonic-gate static void	aus_priocntlsys(struct t_audit_data *);
1427c478bd9Sstevel@tonic-gate static void	aus_setegid(struct t_audit_data *);
1437c478bd9Sstevel@tonic-gate static void	aus_setgroups(struct t_audit_data *);
1447c478bd9Sstevel@tonic-gate static void	aus_seteuid(struct t_audit_data *);
1457c478bd9Sstevel@tonic-gate static void	aus_putmsg(struct t_audit_data *);
1467c478bd9Sstevel@tonic-gate static void	aus_putpmsg(struct t_audit_data *);
1477c478bd9Sstevel@tonic-gate static void	aus_getmsg(struct t_audit_data *);
1487c478bd9Sstevel@tonic-gate static void	aus_getpmsg(struct t_audit_data *);
1497c478bd9Sstevel@tonic-gate static void	aus_auditsys(struct t_audit_data *);
1507c478bd9Sstevel@tonic-gate static void	aus_sysinfo(struct t_audit_data *);
1517c478bd9Sstevel@tonic-gate static void	aus_modctl(struct t_audit_data *);
1527c478bd9Sstevel@tonic-gate static void	aus_kill(struct t_audit_data *);
1537c478bd9Sstevel@tonic-gate static void	aus_setregid(struct t_audit_data *);
1547c478bd9Sstevel@tonic-gate static void	aus_setreuid(struct t_audit_data *);
15561b9bf51Srica static void	aus_labelsys(struct t_audit_data *);
1567c478bd9Sstevel@tonic-gate 
1577c478bd9Sstevel@tonic-gate static void	auf_mknod(struct t_audit_data *, int, rval_t *);
158794f0adbSRoger A. Faulkner static void	auf_mknodat(struct t_audit_data *, int, rval_t *);
1597c478bd9Sstevel@tonic-gate static void	auf_msgsys(struct t_audit_data *, int, rval_t *);
1607c478bd9Sstevel@tonic-gate static void	auf_semsys(struct t_audit_data *, int, rval_t *);
1617c478bd9Sstevel@tonic-gate static void	auf_shmsys(struct t_audit_data *, int, rval_t *);
1627c478bd9Sstevel@tonic-gate static void	auf_read(struct t_audit_data *, int, rval_t *);
1637c478bd9Sstevel@tonic-gate static void	auf_write(struct t_audit_data *, int, rval_t *);
1647c478bd9Sstevel@tonic-gate 
1657c478bd9Sstevel@tonic-gate static void	aus_sigqueue(struct t_audit_data *);
1667c478bd9Sstevel@tonic-gate static void	aus_p_online(struct t_audit_data *);
1677c478bd9Sstevel@tonic-gate static void	aus_processor_bind(struct t_audit_data *);
1687c478bd9Sstevel@tonic-gate static void	aus_inst_sync(struct t_audit_data *);
1699acbbeafSnn static void	aus_brandsys(struct t_audit_data *);
1707c478bd9Sstevel@tonic-gate 
1717c478bd9Sstevel@tonic-gate static void	auf_accept(struct t_audit_data *, int, rval_t *);
1727c478bd9Sstevel@tonic-gate 
1737c478bd9Sstevel@tonic-gate static void	auf_bind(struct t_audit_data *, int, rval_t *);
1747c478bd9Sstevel@tonic-gate static void	auf_connect(struct t_audit_data *, int, rval_t *);
1757c478bd9Sstevel@tonic-gate static void	aus_shutdown(struct t_audit_data *);
1767c478bd9Sstevel@tonic-gate static void	auf_setsockopt(struct t_audit_data *, int, rval_t *);
1777c478bd9Sstevel@tonic-gate static void	aus_sockconfig(struct t_audit_data *);
1787c478bd9Sstevel@tonic-gate static void	auf_recv(struct t_audit_data *, int, rval_t *);
1797c478bd9Sstevel@tonic-gate static void	auf_recvmsg(struct t_audit_data *, int, rval_t *);
1807c478bd9Sstevel@tonic-gate static void	auf_send(struct t_audit_data *, int, rval_t *);
1817c478bd9Sstevel@tonic-gate static void	auf_sendmsg(struct t_audit_data *, int, rval_t *);
1827c478bd9Sstevel@tonic-gate static void	auf_recvfrom(struct t_audit_data *, int, rval_t *);
1837c478bd9Sstevel@tonic-gate static void	auf_sendto(struct t_audit_data *, int, rval_t *);
1847c478bd9Sstevel@tonic-gate static void	aus_socket(struct t_audit_data *);
1857c478bd9Sstevel@tonic-gate /*
1867c478bd9Sstevel@tonic-gate  * This table contains mapping information for converting system call numbers
1877c478bd9Sstevel@tonic-gate  * to audit event IDs. In several cases it is necessary to map a single system
1887c478bd9Sstevel@tonic-gate  * call to several events.
1897c478bd9Sstevel@tonic-gate  */
1907c478bd9Sstevel@tonic-gate 
191f9d0e028Sgww #define	aui_null	NULL	/* NULL initialize function */
192f9d0e028Sgww #define	aus_null	NULL	/* NULL start function */
193f9d0e028Sgww #define	auf_null	NULL	/* NULL finish function */
194f9d0e028Sgww 
1957c478bd9Sstevel@tonic-gate struct audit_s2e audit_s2e[] =
1967c478bd9Sstevel@tonic-gate {
1977c478bd9Sstevel@tonic-gate /*
198*0f48f68dSToomas Soome  * ----------	----------	----------	----------
1997c478bd9Sstevel@tonic-gate  * INITIAL	AUDIT		START		SYSTEM
2007c478bd9Sstevel@tonic-gate  * PROCESSING	EVENT		PROCESSING	CALL
2017c478bd9Sstevel@tonic-gate  * ----------	----------	----------	-----------
2027c478bd9Sstevel@tonic-gate  *		FINISH		EVENT
2037c478bd9Sstevel@tonic-gate  *		PROCESSING	CONTROL
2047c478bd9Sstevel@tonic-gate  * ----------------------------------------------------------
2057c478bd9Sstevel@tonic-gate  */
2067c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 0 unused (indirect) */
2077c478bd9Sstevel@tonic-gate 		auf_null,	0,
208cb49a9fdSMarek Pospisil aui_null,	AUE_EXIT,	aus_exit,	/* 1 exit */
2097c478bd9Sstevel@tonic-gate 		auf_null,	S2E_NPT,
210d2a70789SRichard Lowe aui_null,	AUE_PSECFLAGS,	aus_null,	/* 2 psecflags */
2117c478bd9Sstevel@tonic-gate 		auf_null,	0,
2127c478bd9Sstevel@tonic-gate aui_null,	AUE_READ,	aus_null,	/* 3 read */
2137c478bd9Sstevel@tonic-gate 		auf_read,	S2E_PUB,
2147c478bd9Sstevel@tonic-gate aui_null,	AUE_WRITE,	aus_null,	/* 4 write */
2157c478bd9Sstevel@tonic-gate 		auf_write,	0,
2167c478bd9Sstevel@tonic-gate aui_open,	AUE_OPEN,	aus_open,	/* 5 open */
2177c478bd9Sstevel@tonic-gate 		auf_null,	S2E_SP,
2187c478bd9Sstevel@tonic-gate aui_null,	AUE_CLOSE,	aus_close,	/* 6 close */
2197c478bd9Sstevel@tonic-gate 		auf_null,	0,
220794f0adbSRoger A. Faulkner aui_null,	AUE_LINK,	aus_null,	/* 7 linkat */
2218fd04b83SRoger A. Faulkner 		auf_null,	0,
2228fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 8 (loadable) was creat */
2237c478bd9Sstevel@tonic-gate 		auf_null,	0,
2247c478bd9Sstevel@tonic-gate aui_null,	AUE_LINK,	aus_null,	/* 9 link */
2257c478bd9Sstevel@tonic-gate 		auf_null,	0,
2267c478bd9Sstevel@tonic-gate aui_null,	AUE_UNLINK,	aus_null,	/* 10 unlink */
2277c478bd9Sstevel@tonic-gate 		auf_null,	0,
228794f0adbSRoger A. Faulkner aui_null,	AUE_SYMLINK,	aus_null,	/* 11 symlinkat */
2298fd04b83SRoger A. Faulkner 		auf_null,	0,
2307c478bd9Sstevel@tonic-gate aui_null,	AUE_CHDIR,	aus_null,	/* 12 chdir */
2317c478bd9Sstevel@tonic-gate 		auf_null,	S2E_SP,
2327c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 13 time */
2337c478bd9Sstevel@tonic-gate 		auf_null,	0,
2347c478bd9Sstevel@tonic-gate aui_null,	AUE_MKNOD,	aus_mknod,	/* 14 mknod */
235794f0adbSRoger A. Faulkner 		auf_mknod,	S2E_MLD,
2367c478bd9Sstevel@tonic-gate aui_null,	AUE_CHMOD,	aus_chmod,	/* 15 chmod */
2377c478bd9Sstevel@tonic-gate 		auf_null,	0,
2387c478bd9Sstevel@tonic-gate aui_null,	AUE_CHOWN,	aus_chown,	/* 16 chown */
2397c478bd9Sstevel@tonic-gate 		auf_null,	0,
2407c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 17 brk */
2417c478bd9Sstevel@tonic-gate 		auf_null,	0,
2427c478bd9Sstevel@tonic-gate aui_null,	AUE_STAT,	aus_null,	/* 18 stat */
2437c478bd9Sstevel@tonic-gate 		auf_null,	S2E_PUB,
2447c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 19 lseek */
2457c478bd9Sstevel@tonic-gate 		auf_null,	0,
2467c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 20 getpid */
2477c478bd9Sstevel@tonic-gate 		auf_null,	0,
2487c478bd9Sstevel@tonic-gate aui_null,	AUE_MOUNT,	aus_mount,	/* 21 mount */
2497c478bd9Sstevel@tonic-gate 		auf_null,	S2E_MLD,
250794f0adbSRoger A. Faulkner aui_null,	AUE_READLINK,	aus_null,	/* 22 readlinkat */
251794f0adbSRoger A. Faulkner 		auf_null,	S2E_PUB,
2527c478bd9Sstevel@tonic-gate aui_null,	AUE_SETUID,	aus_setuid,	/* 23 setuid */
2537c478bd9Sstevel@tonic-gate 		auf_null,	0,
2547c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 24 getuid */
2557c478bd9Sstevel@tonic-gate 		auf_null,	0,
2567c478bd9Sstevel@tonic-gate aui_null,	AUE_STIME,	aus_null,	/* 25 stime */
2577c478bd9Sstevel@tonic-gate 		auf_null,	0,
2588fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 26 pcsample */
2597c478bd9Sstevel@tonic-gate 		auf_null,	0,
2607c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 27 alarm */
2617c478bd9Sstevel@tonic-gate 		auf_null,	0,
2627c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 28 fstat */
2637c478bd9Sstevel@tonic-gate 		auf_null,	0,
2647c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 29 pause */
2657c478bd9Sstevel@tonic-gate 		auf_null,	0,
2668fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 30 (loadable) was utime */
2677c478bd9Sstevel@tonic-gate 		auf_null,	0,
2687c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 31 stty (TIOCSETP-audit?) */
2697c478bd9Sstevel@tonic-gate 		auf_null,	0,
2707c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 32 gtty */
2717c478bd9Sstevel@tonic-gate 		auf_null,	0,
2727c478bd9Sstevel@tonic-gate aui_null,	AUE_ACCESS,	aus_null,	/* 33 access */
2737c478bd9Sstevel@tonic-gate 		auf_null,	S2E_PUB,
2747c478bd9Sstevel@tonic-gate aui_null,	AUE_NICE,	aus_null,	/* 34 nice */
2757c478bd9Sstevel@tonic-gate 		auf_null,	0,
2767c478bd9Sstevel@tonic-gate aui_null,	AUE_STATFS,	aus_null,	/* 35 statfs */
2777c478bd9Sstevel@tonic-gate 		auf_null,	S2E_PUB,
2787c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 36 sync */
2797c478bd9Sstevel@tonic-gate 		auf_null,	0,
2807c478bd9Sstevel@tonic-gate aui_null,	AUE_KILL,	aus_kill,	/* 37 kill */
2817c478bd9Sstevel@tonic-gate 		auf_null,	0,
2827c478bd9Sstevel@tonic-gate aui_null,	AUE_FSTATFS,	aus_fstatfs,	/* 38 fstatfs */
2837c478bd9Sstevel@tonic-gate 		auf_null,	S2E_PUB,
2844be8c573SJan Friedel aui_setpgrp,	AUE_SETPGRP,	aus_setpgrp,	/* 39 setpgrp */
2857c478bd9Sstevel@tonic-gate 		auf_null,	0,
2869acbbeafSnn aui_null,	AUE_NULL,	aus_null,	/* 40 uucopystr */
2877c478bd9Sstevel@tonic-gate 		auf_null,	0,
2888fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 41 (loadable) was dup */
2897c478bd9Sstevel@tonic-gate 		auf_null,	0,
2908fd04b83SRoger A. Faulkner aui_null,	AUE_PIPE,	aus_null,	/* 42 (loadable) pipe */
2917c478bd9Sstevel@tonic-gate 		auf_null,	0,
2927c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 43 times */
2937c478bd9Sstevel@tonic-gate 		auf_null,	0,
2947c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 44 profil */
2957c478bd9Sstevel@tonic-gate 		auf_null,	0,
2968fd04b83SRoger A. Faulkner aui_null,	AUE_ACCESS,	aus_null,	/* 45 faccessat */
297c4d3e299SBrent Paulson 		auf_null,	S2E_PUB,
2987c478bd9Sstevel@tonic-gate aui_null,	AUE_SETGID,	aus_setgid,	/* 46 setgid */
2997c478bd9Sstevel@tonic-gate 		auf_null,	0,
3007c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 47 getgid */
3017c478bd9Sstevel@tonic-gate 		auf_null,	0,
302794f0adbSRoger A. Faulkner aui_null,	AUE_MKNOD,	aus_mknodat,	/* 48 mknodat */
303794f0adbSRoger A. Faulkner 		auf_mknodat,	S2E_MLD,
3048fd04b83SRoger A. Faulkner aui_msgsys,	AUE_MSGSYS,	aus_msgsys,	/* 49 (loadable) msgsys */
3057c478bd9Sstevel@tonic-gate 		auf_msgsys,	0,
3067c478bd9Sstevel@tonic-gate #if defined(__x86)
3077c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 50 sysi86 */
3087c478bd9Sstevel@tonic-gate 		auf_null,	0,
3097c478bd9Sstevel@tonic-gate #else
3107c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 50 (loadable) was sys3b */
3117c478bd9Sstevel@tonic-gate 		auf_null,	0,
3127c478bd9Sstevel@tonic-gate #endif /* __x86 */
3138fd04b83SRoger A. Faulkner aui_null,	AUE_ACCT,	aus_acct,	/* 51 (loadable) sysacct */
3147c478bd9Sstevel@tonic-gate 		auf_null,	0,
3158fd04b83SRoger A. Faulkner aui_shmsys,	AUE_SHMSYS,	aus_shmsys,	/* 52 (loadable) shmsys */
3167c478bd9Sstevel@tonic-gate 		auf_shmsys,	0,
3178fd04b83SRoger A. Faulkner aui_semsys,	AUE_SEMSYS,	aus_semsys,	/* 53 (loadable) semsys */
3187c478bd9Sstevel@tonic-gate 		auf_semsys,	0,
3197c478bd9Sstevel@tonic-gate aui_null,	AUE_IOCTL,	aus_ioctl,	/* 54 ioctl */
3207c478bd9Sstevel@tonic-gate 		auf_null,	0,
3217c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 55 uadmin */
3227c478bd9Sstevel@tonic-gate 		auf_null,	0,
3238fd04b83SRoger A. Faulkner aui_fchownat,	AUE_NULL,	aus_fchownat,	/* 56 fchownat */
324c4d3e299SBrent Paulson 		auf_null,	0,
3257c478bd9Sstevel@tonic-gate aui_utssys,	AUE_FUSERS,	aus_null,	/* 57 utssys */
3267c478bd9Sstevel@tonic-gate 		auf_null,	0,
3277c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 58 fsync */
3287c478bd9Sstevel@tonic-gate 		auf_null,	0,
3297c478bd9Sstevel@tonic-gate aui_execve,	AUE_EXECVE,	aus_null,	/* 59 exece */
3307c478bd9Sstevel@tonic-gate 		auf_null,	S2E_MLD,
3317c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 60 umask */
3327c478bd9Sstevel@tonic-gate 		auf_null,	0,
3337c478bd9Sstevel@tonic-gate aui_null,	AUE_CHROOT,	aus_null,	/* 61 chroot */
3347c478bd9Sstevel@tonic-gate 		auf_null,	S2E_SP,
3357c478bd9Sstevel@tonic-gate aui_fcntl,	AUE_FCNTL,	aus_fcntl,	/* 62 fcntl */
3367c478bd9Sstevel@tonic-gate 		auf_null,	0,
3377c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 63 ulimit */
3387c478bd9Sstevel@tonic-gate 		auf_null,	0,
3398fd04b83SRoger A. Faulkner aui_null,	AUE_RENAME,	aus_null,	/* 64 renameat */
340c4d3e299SBrent Paulson 		auf_null,	0,
3418fd04b83SRoger A. Faulkner aui_unlinkat,	AUE_NULL,	aus_null,	/* 65 unlinkat */
342c4d3e299SBrent Paulson 		auf_null,	0,
3438fd04b83SRoger A. Faulkner aui_fstatat,	AUE_NULL,	aus_null,	/* 66 fstatat */
344c4d3e299SBrent Paulson 		auf_null,	S2E_PUB,
3458fd04b83SRoger A. Faulkner aui_fstatat,	AUE_NULL,	aus_null,	/* 67 fstatat64 */
346c4d3e299SBrent Paulson 		auf_null,	S2E_PUB,
3478fd04b83SRoger A. Faulkner aui_openat,	AUE_OPEN,	aus_openat,	/* 68 openat */
348c4d3e299SBrent Paulson 		auf_null,	S2E_SP,
3498fd04b83SRoger A. Faulkner aui_openat,	AUE_OPEN,	aus_openat,	/* 69 openat64 */
350c4d3e299SBrent Paulson 		auf_null,	S2E_SP,
3518fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 70 tasksys */
3527c478bd9Sstevel@tonic-gate 		auf_null,	0,
3538fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 71 (loadable) acctctl */
3547c478bd9Sstevel@tonic-gate 		auf_null,	0,
3558fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 72 (loadable) exacct */
3567c478bd9Sstevel@tonic-gate 		auf_null,	0,
3578fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 73 getpagesizes */
3587c478bd9Sstevel@tonic-gate 		auf_null,	0,
3598fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 74 rctlsys */
3607c478bd9Sstevel@tonic-gate 		auf_null,	0,
361f48205beScasper aui_null,	AUE_NULL,	aus_null,	/* 75 sidsys */
3627c478bd9Sstevel@tonic-gate 		auf_null,	0,
3638fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 76 (loadable) was fsat */
3647c478bd9Sstevel@tonic-gate 		auf_null,	0,
3658fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 77 syslwp_park */
3667c478bd9Sstevel@tonic-gate 		auf_null,	0,
3678fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 78 sendfilev */
3687c478bd9Sstevel@tonic-gate 		auf_null,	0,
3697c478bd9Sstevel@tonic-gate aui_null,	AUE_RMDIR,	aus_null,	/* 79 rmdir */
3707c478bd9Sstevel@tonic-gate 		auf_null,	0,
3717c478bd9Sstevel@tonic-gate aui_null,	AUE_MKDIR,	aus_mkdir,	/* 80 mkdir */
3727c478bd9Sstevel@tonic-gate 		auf_null,	0,
3737c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 81 getdents */
3747c478bd9Sstevel@tonic-gate 		auf_null,	0,
3757c478bd9Sstevel@tonic-gate aui_privsys,	AUE_NULL,	aus_null,	/* 82 privsys */
3767c478bd9Sstevel@tonic-gate 		auf_null,	0,
3778fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 83 ucredsys */
3787c478bd9Sstevel@tonic-gate 		auf_null,	0,
3797c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 84 sysfs */
3807c478bd9Sstevel@tonic-gate 		auf_null,	0,
3817c478bd9Sstevel@tonic-gate aui_null,	AUE_GETMSG,	aus_getmsg,	/* 85 getmsg */
3827c478bd9Sstevel@tonic-gate 		auf_null,	0,
3837c478bd9Sstevel@tonic-gate aui_null,	AUE_PUTMSG,	aus_putmsg,	/* 86 putmsg */
3847c478bd9Sstevel@tonic-gate 		auf_null,	0,
3858fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 87 (loadable) was poll */
3867c478bd9Sstevel@tonic-gate 		auf_null,	0,
3877c478bd9Sstevel@tonic-gate aui_null,	AUE_LSTAT,	aus_null,	/* 88 lstat */
3887c478bd9Sstevel@tonic-gate 		auf_null,	S2E_PUB,
3897c478bd9Sstevel@tonic-gate aui_null,	AUE_SYMLINK,	aus_null,	/* 89 symlink */
3907c478bd9Sstevel@tonic-gate 		auf_null,	0,
3917c478bd9Sstevel@tonic-gate aui_null,	AUE_READLINK,	aus_null,	/* 90 readlink */
3927c478bd9Sstevel@tonic-gate 		auf_null,	S2E_PUB,
3937c478bd9Sstevel@tonic-gate aui_null,	AUE_SETGROUPS,	aus_setgroups,	/* 91 setgroups */
3947c478bd9Sstevel@tonic-gate 		auf_null,	0,
3957c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 92 getgroups */
3967c478bd9Sstevel@tonic-gate 		auf_null,	0,
3977c478bd9Sstevel@tonic-gate aui_null,	AUE_FCHMOD,	aus_fchmod,	/* 93 fchmod */
3987c478bd9Sstevel@tonic-gate 		auf_null,	0,
3997c478bd9Sstevel@tonic-gate aui_null,	AUE_FCHOWN,	aus_fchown,	/* 94 fchown */
4007c478bd9Sstevel@tonic-gate 		auf_null,	0,
4017c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 95 sigprocmask */
4027c478bd9Sstevel@tonic-gate 		auf_null,	0,
4037c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 96 sigsuspend */
4047c478bd9Sstevel@tonic-gate 		auf_null,	0,
4057c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 97 sigaltstack */
4067c478bd9Sstevel@tonic-gate 		auf_null,	0,
4077c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 98 sigaction */
4087c478bd9Sstevel@tonic-gate 		auf_null,	0,
4097c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 99 sigpending */
4107c478bd9Sstevel@tonic-gate 		auf_null,	0,
4117c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 100 setcontext */
4127c478bd9Sstevel@tonic-gate 		auf_null,	0,
413794f0adbSRoger A. Faulkner aui_fchmodat,	AUE_NULL,	aus_fchmodat,	/* 101 fchmodat */
4147c478bd9Sstevel@tonic-gate 		auf_null,	0,
415794f0adbSRoger A. Faulkner aui_null,	AUE_MKDIR,	aus_mkdirat,	/* 102 mkdirat */
4167c478bd9Sstevel@tonic-gate 		auf_null,	0,
4177c478bd9Sstevel@tonic-gate aui_null,	AUE_STATVFS,	aus_null,	/* 103 statvfs */
4187c478bd9Sstevel@tonic-gate 		auf_null,	S2E_PUB,
4197c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 104 fstatvfs */
4207c478bd9Sstevel@tonic-gate 		auf_null,	0,
4218fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 105 getloadavg */
4227c478bd9Sstevel@tonic-gate 		auf_null,	0,
4237c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 106 nfssys */
4247c478bd9Sstevel@tonic-gate 		auf_null,	0,
4258fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 107 waitsys */
4267c478bd9Sstevel@tonic-gate 		auf_null,	0,
4278fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 108 sigsendsys */
4287c478bd9Sstevel@tonic-gate 		auf_null,	0,
4297c478bd9Sstevel@tonic-gate #if defined(__x86)
4307c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 109 hrtsys */
4317c478bd9Sstevel@tonic-gate 		auf_null,	0,
4327c478bd9Sstevel@tonic-gate #else
4337c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 109 (loadable) */
4347c478bd9Sstevel@tonic-gate 		auf_null,	0,
4357c478bd9Sstevel@tonic-gate #endif /* __x86 */
4368fd04b83SRoger A. Faulkner aui_null,	AUE_UTIMES,	aus_null,	/* 110 utimesys */
437c4d3e299SBrent Paulson 		auf_null,	0,
4388fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 111 sigresend */
4397c478bd9Sstevel@tonic-gate 		auf_null,	0,
4408fd04b83SRoger A. Faulkner aui_null,	AUE_PRIOCNTLSYS, aus_priocntlsys, /* 112 priocntlsys */
4417c478bd9Sstevel@tonic-gate 		auf_null,	0,
4427c478bd9Sstevel@tonic-gate aui_null,	AUE_PATHCONF,	aus_null,	/* 113 pathconf */
4437c478bd9Sstevel@tonic-gate 		auf_null,	S2E_PUB,
4447c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 114 mincore */
4457c478bd9Sstevel@tonic-gate 		auf_null,	0,
4467c478bd9Sstevel@tonic-gate aui_null,	AUE_MMAP,	aus_mmap,	/* 115 mmap */
4477c478bd9Sstevel@tonic-gate 		auf_null,	0,
4487c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 116 mprotect */
4497c478bd9Sstevel@tonic-gate 		auf_null,	0,
4507c478bd9Sstevel@tonic-gate aui_null,	AUE_MUNMAP,	aus_munmap,	/* 117 munmap */
4517c478bd9Sstevel@tonic-gate 		auf_null,	0,
4527c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 118 fpathconf */
4537c478bd9Sstevel@tonic-gate 		auf_null,	0,
4547c478bd9Sstevel@tonic-gate aui_null,	AUE_VFORK,	aus_null,	/* 119 vfork */
4557c478bd9Sstevel@tonic-gate 		auf_null,	0,
4567c478bd9Sstevel@tonic-gate aui_null,	AUE_FCHDIR,	aus_null,	/* 120 fchdir */
4577c478bd9Sstevel@tonic-gate 		auf_null,	0,
4587c478bd9Sstevel@tonic-gate aui_null,	AUE_READ,	aus_null,	/* 121 readv */
4597c478bd9Sstevel@tonic-gate 		auf_read,	S2E_PUB,
4607c478bd9Sstevel@tonic-gate aui_null,	AUE_WRITE,	aus_null,	/* 122 writev */
4617c478bd9Sstevel@tonic-gate 		auf_write,	0,
4628fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 123 (loadable) was xstat */
4637c478bd9Sstevel@tonic-gate 		auf_null,	0,
4648fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 124 (loadable) was lxstat */
4658fd04b83SRoger A. Faulkner 		auf_null,	0,
4668fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 125 (loadable) was fxstat */
4678fd04b83SRoger A. Faulkner 		auf_null,	0,
4688fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 126 (loadable) was xmknod */
4698fd04b83SRoger A. Faulkner 		auf_null,	0,
4708fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 127 mmapobj */
4717c478bd9Sstevel@tonic-gate 		auf_null,	0,
4727c478bd9Sstevel@tonic-gate aui_null,	AUE_SETRLIMIT,	aus_null,	/* 128 setrlimit */
4737c478bd9Sstevel@tonic-gate 		auf_null,	0,
4747c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 129 getrlimit */
4757c478bd9Sstevel@tonic-gate 		auf_null,	0,
4767c478bd9Sstevel@tonic-gate aui_null,	AUE_LCHOWN,	aus_lchown,	/* 130 lchown */
4777c478bd9Sstevel@tonic-gate 		auf_null,	0,
4787c478bd9Sstevel@tonic-gate aui_memcntl,	AUE_MEMCNTL,	aus_memcntl,	/* 131 memcntl */
4797c478bd9Sstevel@tonic-gate 		auf_null,	0,
4807c478bd9Sstevel@tonic-gate aui_null,	AUE_GETPMSG,	aus_getpmsg,	/* 132 getpmsg */
4817c478bd9Sstevel@tonic-gate 		auf_null,	0,
4827c478bd9Sstevel@tonic-gate aui_null,	AUE_PUTPMSG,	aus_putpmsg,	/* 133 putpmsg */
4837c478bd9Sstevel@tonic-gate 		auf_null,	0,
4847c478bd9Sstevel@tonic-gate aui_null,	AUE_RENAME,	aus_null,	/* 134 rename */
4857c478bd9Sstevel@tonic-gate 		auf_null,	0,
4867c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 135 uname */
4877c478bd9Sstevel@tonic-gate 		auf_null,	0,
4887c478bd9Sstevel@tonic-gate aui_null,	AUE_SETEGID,	aus_setegid,	/* 136 setegid */
4897c478bd9Sstevel@tonic-gate 		auf_null,	0,
4907c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 137 sysconfig */
4917c478bd9Sstevel@tonic-gate 		auf_null,	0,
4927c478bd9Sstevel@tonic-gate aui_null,	AUE_ADJTIME,	aus_null,	/* 138 adjtime */
4937c478bd9Sstevel@tonic-gate 		auf_null,	0,
4947c478bd9Sstevel@tonic-gate aui_sysinfo,	AUE_SYSINFO,	aus_sysinfo,	/* 139 systeminfo */
4957c478bd9Sstevel@tonic-gate 		auf_null,	0,
4968fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 140 (loadable) sharefs */
4977c478bd9Sstevel@tonic-gate 		auf_null,	0,
4987c478bd9Sstevel@tonic-gate aui_null,	AUE_SETEUID,	aus_seteuid,	/* 141 seteuid */
4997c478bd9Sstevel@tonic-gate 		auf_null,	0,
500657b1f3dSraf aui_forksys,	AUE_NULL,	aus_null,	/* 142 forksys */
5017c478bd9Sstevel@tonic-gate 		auf_null,	0,
5028fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 143 (loadable) was fork1 */
5037c478bd9Sstevel@tonic-gate 		auf_null,	0,
5047c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 144 sigwait */
5057c478bd9Sstevel@tonic-gate 		auf_null,	0,
5067c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 145 lwp_info */
5077c478bd9Sstevel@tonic-gate 		auf_null,	0,
5087c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 146 yield */
5097c478bd9Sstevel@tonic-gate 		auf_null,	0,
5108fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 147 (loadable) */
5118fd04b83SRoger A. Faulkner 						/*	was lwp_sema_wait */
5127c478bd9Sstevel@tonic-gate 		auf_null,	0,
5137c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 148 lwp_sema_post */
5147c478bd9Sstevel@tonic-gate 		auf_null,	0,
5157c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 149 lwp_sema_trywait */
5167c478bd9Sstevel@tonic-gate 		auf_null,	0,
5178fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 150 lwp_detach */
5187c478bd9Sstevel@tonic-gate 		auf_null,	0,
5198fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 151 corectl */
5207c478bd9Sstevel@tonic-gate 		auf_null,	0,
5217c478bd9Sstevel@tonic-gate aui_modctl,	AUE_MODCTL,	aus_modctl,	/* 152 modctl */
5227c478bd9Sstevel@tonic-gate 		auf_null,	0,
5237c478bd9Sstevel@tonic-gate aui_null,	AUE_FCHROOT,	aus_null,	/* 153 fchroot */
5247c478bd9Sstevel@tonic-gate 		auf_null,	0,
5258fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 154 (loadable) was utimes */
5267c478bd9Sstevel@tonic-gate 		auf_null,	0,
5277c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 155 vhangup */
5287c478bd9Sstevel@tonic-gate 		auf_null,	0,
5297c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 156 gettimeofday */
5307c478bd9Sstevel@tonic-gate 		auf_null,	0,
5317c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 157 getitimer */
5327c478bd9Sstevel@tonic-gate 		auf_null,	0,
5337c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 158 setitimer */
5347c478bd9Sstevel@tonic-gate 		auf_null,	0,
5357c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 159 lwp_create */
5367c478bd9Sstevel@tonic-gate 		auf_null,	0,
5377c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 160 lwp_exit */
5387c478bd9Sstevel@tonic-gate 		auf_null,	0,
5397c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 161 lwp_suspend */
5407c478bd9Sstevel@tonic-gate 		auf_null,	0,
5417c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 162 lwp_continue */
5427c478bd9Sstevel@tonic-gate 		auf_null,	0,
5437c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 163 lwp_kill */
5447c478bd9Sstevel@tonic-gate 		auf_null,	0,
5457c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 164 lwp_self */
5467c478bd9Sstevel@tonic-gate 		auf_null,	0,
5478fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 165 lwp_sigmask */
5487c478bd9Sstevel@tonic-gate 		auf_null,	0,
5498fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 166 lwp_private */
5507c478bd9Sstevel@tonic-gate 		auf_null,	0,
5517c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 167 lwp_wait */
5527c478bd9Sstevel@tonic-gate 		auf_null,	0,
553883492d5Sraf aui_null,	AUE_NULL,	aus_null,	/* 168 lwp_mutex_wakeup  */
5547c478bd9Sstevel@tonic-gate 		auf_null,	0,
5558fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 169 (loadable) */
5568fd04b83SRoger A. Faulkner 						/*	was lwp_mutex_lock */
5577c478bd9Sstevel@tonic-gate 		auf_null,	0,
5587c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 170 lwp_cond_wait */
5597c478bd9Sstevel@tonic-gate 		auf_null,	0,
5607c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 171 lwp_cond_signal */
5617c478bd9Sstevel@tonic-gate 		auf_null,	0,
5627c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 172 lwp_cond_broadcast */
5637c478bd9Sstevel@tonic-gate 		auf_null,	0,
5647c478bd9Sstevel@tonic-gate aui_null,	AUE_READ,	aus_null,	/* 173 pread */
5657c478bd9Sstevel@tonic-gate 		auf_read,	S2E_PUB,
5667c478bd9Sstevel@tonic-gate aui_null,	AUE_WRITE,	aus_null,	/* 174 pwrite */
5677c478bd9Sstevel@tonic-gate 		auf_write,	0,
5687c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 175 llseek */
5697c478bd9Sstevel@tonic-gate 		auf_null,	0,
5708fd04b83SRoger A. Faulkner aui_null,	AUE_INST_SYNC,	aus_inst_sync,  /* 176 (loadable) inst_sync */
5717c478bd9Sstevel@tonic-gate 		auf_null,	0,
5729acbbeafSnn aui_null,	AUE_BRANDSYS,	aus_brandsys,	/* 177 brandsys */
5737c478bd9Sstevel@tonic-gate 		auf_null,	0,
5748fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 178 (loadable) kaio */
5757c478bd9Sstevel@tonic-gate 		auf_null,	0,
5768fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 179 (loadable) cpc */
5777c478bd9Sstevel@tonic-gate 		auf_null,	0,
5788fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 180 lgrpsys */
5797c478bd9Sstevel@tonic-gate 		auf_null,	0,
5808fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 181 rusagesys */
5817c478bd9Sstevel@tonic-gate 		auf_null,	0,
582df2381bfSpraks aui_portfs,	AUE_PORTFS,	aus_null,	/* 182 (loadable) portfs */
5837e309bc2SJan Friedel 		auf_null,	S2E_MLD,
5848fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 183 pollsys */
5857c478bd9Sstevel@tonic-gate 		auf_null,	0,
58661b9bf51Srica aui_labelsys,	AUE_NULL,	aus_labelsys,	/* 184 labelsys */
5877c478bd9Sstevel@tonic-gate 		auf_null,	0,
5887c478bd9Sstevel@tonic-gate aui_acl,	AUE_ACLSET,	aus_acl,	/* 185 acl */
5897c478bd9Sstevel@tonic-gate 		auf_null,	0,
5907c478bd9Sstevel@tonic-gate aui_auditsys,	AUE_AUDITSYS,	aus_auditsys,	/* 186 auditsys  */
5917c478bd9Sstevel@tonic-gate 		auf_null,	0,
5928fd04b83SRoger A. Faulkner aui_null,	AUE_PROCESSOR_BIND, aus_processor_bind, /* 187 processor_bind */
5938fd04b83SRoger A. Faulkner 		auf_null,	0,
5947c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 188 processor_info */
5957c478bd9Sstevel@tonic-gate 		auf_null,	0,
5967c478bd9Sstevel@tonic-gate aui_null,	AUE_P_ONLINE,	aus_p_online,	/* 189 p_online */
5977c478bd9Sstevel@tonic-gate 		auf_null,	0,
5987c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_sigqueue,	/* 190 sigqueue */
5997c478bd9Sstevel@tonic-gate 		auf_null,	0,
6007c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 191 clock_gettime */
6017c478bd9Sstevel@tonic-gate 		auf_null,	0,
6027c478bd9Sstevel@tonic-gate aui_null,	AUE_CLOCK_SETTIME,	aus_null,	/* 192 clock_settime */
6037c478bd9Sstevel@tonic-gate 		auf_null,	0,
6047c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 193 clock_getres */
6057c478bd9Sstevel@tonic-gate 		auf_null,	0,
6067c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 194 timer_create */
6077c478bd9Sstevel@tonic-gate 		auf_null,	0,
6087c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 195 timer_delete */
6097c478bd9Sstevel@tonic-gate 		auf_null,	0,
6107c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 196 timer_settime */
6117c478bd9Sstevel@tonic-gate 		auf_null,	0,
6127c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 197 timer_gettime */
6137c478bd9Sstevel@tonic-gate 		auf_null,	0,
6147c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 198 timer_getoverrun */
6157c478bd9Sstevel@tonic-gate 		auf_null,	0,
6167c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 199 nanosleep */
6177c478bd9Sstevel@tonic-gate 		auf_null,	0,
6187c478bd9Sstevel@tonic-gate aui_acl,	AUE_FACLSET,	aus_facl,	/* 200 facl */
6197c478bd9Sstevel@tonic-gate 		auf_null,	0,
6207c478bd9Sstevel@tonic-gate aui_doorfs,	AUE_DOORFS,	aus_doorfs,	/* 201 (loadable) doorfs */
6217c478bd9Sstevel@tonic-gate 		auf_null,	0,
6227c478bd9Sstevel@tonic-gate aui_null,	AUE_SETREUID,	aus_setreuid,	/* 202 setreuid */
6237c478bd9Sstevel@tonic-gate 		auf_null,	0,
6247c478bd9Sstevel@tonic-gate aui_null,	AUE_SETREGID,	aus_setregid,	/* 203 setregid */
6257c478bd9Sstevel@tonic-gate 		auf_null,	0,
6267c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 204 install_utrap */
6277c478bd9Sstevel@tonic-gate 		auf_null,	0,
6287c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 205 signotify */
6297c478bd9Sstevel@tonic-gate 		auf_null,	0,
6307c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 206 schedctl */
6317c478bd9Sstevel@tonic-gate 		auf_null,	0,
6327c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 207 (loadable) pset */
6337c478bd9Sstevel@tonic-gate 		auf_null,	0,
6348fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 208 sparc_utrap_install */
6357c478bd9Sstevel@tonic-gate 		auf_null,	0,
6367c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 209 resolvepath */
6377c478bd9Sstevel@tonic-gate 		auf_null,	0,
6387c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 210 lwp_mutex_timedlock */
6397c478bd9Sstevel@tonic-gate 		auf_null,	0,
6407c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 211 lwp_sema_timedwait */
6417c478bd9Sstevel@tonic-gate 		auf_null,	0,
6427c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 212 lwp_rwlock_sys */
6437c478bd9Sstevel@tonic-gate 		auf_null,	0,
6448fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 213 getdents64 */
6457c478bd9Sstevel@tonic-gate 		auf_null,	0,
6467c478bd9Sstevel@tonic-gate aui_null,	AUE_MMAP,	aus_mmap,	/* 214 mmap64 */
6477c478bd9Sstevel@tonic-gate 		auf_null,	0,
6487c478bd9Sstevel@tonic-gate aui_null,	AUE_STAT,	aus_null,	/* 215 stat64 */
6497c478bd9Sstevel@tonic-gate 		auf_null,	S2E_PUB,
6507c478bd9Sstevel@tonic-gate aui_null,	AUE_LSTAT,	aus_null,	/* 216 lstat64 */
6517c478bd9Sstevel@tonic-gate 		auf_null,	S2E_PUB,
6527c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 217 fstat64 */
6537c478bd9Sstevel@tonic-gate 		auf_null,	0,
6547c478bd9Sstevel@tonic-gate aui_null,	AUE_STATVFS,	aus_null,	/* 218 statvfs64 */
6557c478bd9Sstevel@tonic-gate 		auf_null,	S2E_PUB,
6567c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 219 fstatvfs64 */
6577c478bd9Sstevel@tonic-gate 		auf_null,	0,
6587c478bd9Sstevel@tonic-gate aui_null,	AUE_SETRLIMIT,	aus_null,	/* 220 setrlimit64 */
6597c478bd9Sstevel@tonic-gate 		auf_null,	0,
6607c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 221 getrlimit64 */
6617c478bd9Sstevel@tonic-gate 		auf_null,	0,
6627c478bd9Sstevel@tonic-gate aui_null,	AUE_READ,	aus_null,	/* 222 pread64  */
6637c478bd9Sstevel@tonic-gate 		auf_read,	S2E_PUB,
6647c478bd9Sstevel@tonic-gate aui_null,	AUE_WRITE,	aus_null,	/* 223 pwrite64 */
6657c478bd9Sstevel@tonic-gate 		auf_write,	0,
6668fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 224 (loadable) was creat64 */
6678fd04b83SRoger A. Faulkner 		auf_null,	0,
6687c478bd9Sstevel@tonic-gate aui_open,	AUE_OPEN,	aus_open,	/* 225 open64 */
6697c478bd9Sstevel@tonic-gate 		auf_null,	S2E_SP,
6707c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 226 (loadable) rpcsys */
6717c478bd9Sstevel@tonic-gate 		auf_null,	0,
6728fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 227 zone */
6737c478bd9Sstevel@tonic-gate 		auf_null,	0,
6748fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 228 (loadable) autofssys */
6757c478bd9Sstevel@tonic-gate 		auf_null,	0,
6768fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 229 getcwd */
6777c478bd9Sstevel@tonic-gate 		auf_null,	0,
6787c478bd9Sstevel@tonic-gate aui_null,	AUE_SOCKET,	aus_socket,	/* 230 so_socket */
6797c478bd9Sstevel@tonic-gate 		auf_null,	0,
6807c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 231 so_socketpair */
6817c478bd9Sstevel@tonic-gate 		auf_null,	0,
6827c478bd9Sstevel@tonic-gate aui_null,	AUE_BIND,	aus_null,	/* 232 bind */
6837c478bd9Sstevel@tonic-gate 		auf_bind,	0,
6847c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 233 listen */
6857c478bd9Sstevel@tonic-gate 		auf_null,	0,
6867c478bd9Sstevel@tonic-gate aui_null,	AUE_ACCEPT,	aus_null,	/* 234 accept */
6877c478bd9Sstevel@tonic-gate 		auf_accept,	0,
6887c478bd9Sstevel@tonic-gate aui_null,	AUE_CONNECT,	aus_null,	/* 235 connect */
6897c478bd9Sstevel@tonic-gate 		auf_connect,	0,
6907c478bd9Sstevel@tonic-gate aui_null,	AUE_SHUTDOWN,	aus_shutdown,	/* 236 shutdown */
6917c478bd9Sstevel@tonic-gate 		auf_null,	0,
6927c478bd9Sstevel@tonic-gate aui_null,	AUE_READ,	aus_null,	/* 237 recv */
6937c478bd9Sstevel@tonic-gate 		auf_recv,	0,
6947c478bd9Sstevel@tonic-gate aui_null,	AUE_RECVFROM,	aus_null,	/* 238 recvfrom */
6957c478bd9Sstevel@tonic-gate 		auf_recvfrom,	0,
6967c478bd9Sstevel@tonic-gate aui_null,	AUE_RECVMSG,	aus_null,	/* 239 recvmsg */
6977c478bd9Sstevel@tonic-gate 		auf_recvmsg,	0,
6987c478bd9Sstevel@tonic-gate aui_null,	AUE_WRITE,	aus_null,	/* 240 send */
6997c478bd9Sstevel@tonic-gate 		auf_send,	0,
7007c478bd9Sstevel@tonic-gate aui_null,	AUE_SENDMSG,	aus_null,	/* 241 sendmsg */
7017c478bd9Sstevel@tonic-gate 		auf_sendmsg,	0,
7027c478bd9Sstevel@tonic-gate aui_null,	AUE_SENDTO,	aus_null,	/* 242 sendto */
7037c478bd9Sstevel@tonic-gate 		auf_sendto,	0,
7047c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 243 getpeername */
7057c478bd9Sstevel@tonic-gate 		auf_null,	0,
7067c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 244 getsockname */
7077c478bd9Sstevel@tonic-gate 		auf_null,	0,
7087c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 245 getsockopt */
7097c478bd9Sstevel@tonic-gate 		auf_null,	0,
7107c478bd9Sstevel@tonic-gate aui_null,	AUE_SETSOCKOPT,	aus_null,	/* 246 setsockopt */
7117c478bd9Sstevel@tonic-gate 		auf_setsockopt,	0,
7127c478bd9Sstevel@tonic-gate aui_null,	AUE_SOCKCONFIG,	aus_sockconfig,	/* 247 sockconfig */
7137c478bd9Sstevel@tonic-gate 		auf_null,	0,
7147c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 248 ntp_gettime */
7157c478bd9Sstevel@tonic-gate 		auf_null,	0,
7168fd04b83SRoger A. Faulkner aui_null,	AUE_NTP_ADJTIME, aus_null,	/* 249 ntp_adjtime */
7177c478bd9Sstevel@tonic-gate 		auf_null,	0,
7187c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 250 lwp_mutex_unlock */
7197c478bd9Sstevel@tonic-gate 		auf_null,	0,
7207c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 251 lwp_mutex_trylock */
7217c478bd9Sstevel@tonic-gate 		auf_null,	0,
722883492d5Sraf aui_null,	AUE_NULL,	aus_null,	/* 252 lwp_mutex_register */
7237c478bd9Sstevel@tonic-gate 		auf_null,	0,
7247c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 253 cladm */
7257c478bd9Sstevel@tonic-gate 		auf_null,	0,
7269acbbeafSnn aui_null,	AUE_NULL,	aus_null,	/* 254 uucopy */
7277c478bd9Sstevel@tonic-gate 		auf_null,	0,
7287c478bd9Sstevel@tonic-gate aui_null,	AUE_UMOUNT2,	aus_umount2,	/* 255 umount2 */
7297c478bd9Sstevel@tonic-gate 		auf_null,	0
7307c478bd9Sstevel@tonic-gate };
7317c478bd9Sstevel@tonic-gate 
7327c478bd9Sstevel@tonic-gate uint_t num_syscall = sizeof (audit_s2e) / sizeof (struct audit_s2e);
7337c478bd9Sstevel@tonic-gate 
7347c478bd9Sstevel@tonic-gate 
735cb49a9fdSMarek Pospisil /* exit start function */
736cb49a9fdSMarek Pospisil /*ARGSUSED*/
737cb49a9fdSMarek Pospisil static void
738cb49a9fdSMarek Pospisil aus_exit(struct t_audit_data *tad)
739cb49a9fdSMarek Pospisil {
740cb49a9fdSMarek Pospisil 	uint32_t rval;
741cb49a9fdSMarek Pospisil 	struct a {
742cb49a9fdSMarek Pospisil 		long rval;
743cb49a9fdSMarek Pospisil 	} *uap = (struct a *)ttolwp(curthread)->lwp_ap;
744cb49a9fdSMarek Pospisil 
745cb49a9fdSMarek Pospisil 	rval = (uint32_t)uap->rval;
746cb49a9fdSMarek Pospisil 	au_uwrite(au_to_arg32(1, "exit status", rval));
747cb49a9fdSMarek Pospisil }
748cb49a9fdSMarek Pospisil 
749d2a70789SRichard Lowe 
7507c478bd9Sstevel@tonic-gate /* acct start function */
7517c478bd9Sstevel@tonic-gate /*ARGSUSED*/
7527c478bd9Sstevel@tonic-gate static void
7537c478bd9Sstevel@tonic-gate aus_acct(struct t_audit_data *tad)
7547c478bd9Sstevel@tonic-gate {
7557c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
7567c478bd9Sstevel@tonic-gate 	uintptr_t fname;
7577c478bd9Sstevel@tonic-gate 
7587c478bd9Sstevel@tonic-gate 	struct a {
7597c478bd9Sstevel@tonic-gate 		long	fname;		/* char * */
7607c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
7617c478bd9Sstevel@tonic-gate 
7627c478bd9Sstevel@tonic-gate 	fname = (uintptr_t)uap->fname;
7637c478bd9Sstevel@tonic-gate 
7647c478bd9Sstevel@tonic-gate 	if (fname == 0)
7657c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "accounting off", (uint32_t)0));
7667c478bd9Sstevel@tonic-gate }
7677c478bd9Sstevel@tonic-gate 
7687c478bd9Sstevel@tonic-gate /* chown start function */
7697c478bd9Sstevel@tonic-gate /*ARGSUSED*/
7707c478bd9Sstevel@tonic-gate static void
7717c478bd9Sstevel@tonic-gate aus_chown(struct t_audit_data *tad)
7727c478bd9Sstevel@tonic-gate {
7737c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
7747c478bd9Sstevel@tonic-gate 	uint32_t uid, gid;
7757c478bd9Sstevel@tonic-gate 
7767c478bd9Sstevel@tonic-gate 	struct a {
7777c478bd9Sstevel@tonic-gate 		long	fname;		/* char * */
7787c478bd9Sstevel@tonic-gate 		long	uid;
7797c478bd9Sstevel@tonic-gate 		long	gid;
7807c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
7817c478bd9Sstevel@tonic-gate 
7827c478bd9Sstevel@tonic-gate 	uid = (uint32_t)uap->uid;
7837c478bd9Sstevel@tonic-gate 	gid = (uint32_t)uap->gid;
7847c478bd9Sstevel@tonic-gate 
7857c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(2, "new file uid", uid));
7867c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(3, "new file gid", gid));
7877c478bd9Sstevel@tonic-gate }
7887c478bd9Sstevel@tonic-gate 
7897c478bd9Sstevel@tonic-gate /* fchown start function */
7907c478bd9Sstevel@tonic-gate /*ARGSUSED*/
7917c478bd9Sstevel@tonic-gate static void
7927c478bd9Sstevel@tonic-gate aus_fchown(struct t_audit_data *tad)
7937c478bd9Sstevel@tonic-gate {
7947c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
7957c478bd9Sstevel@tonic-gate 	uint32_t uid, gid, fd;
7967c478bd9Sstevel@tonic-gate 	struct file  *fp;
7977c478bd9Sstevel@tonic-gate 	struct vnode *vp;
7987c478bd9Sstevel@tonic-gate 	struct f_audit_data *fad;
7997c478bd9Sstevel@tonic-gate 
8007c478bd9Sstevel@tonic-gate 	struct a {
8017c478bd9Sstevel@tonic-gate 		long fd;
8027c478bd9Sstevel@tonic-gate 		long uid;
8037c478bd9Sstevel@tonic-gate 		long gid;
8047c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
8057c478bd9Sstevel@tonic-gate 
8067c478bd9Sstevel@tonic-gate 	fd  = (uint32_t)uap->fd;
8077c478bd9Sstevel@tonic-gate 	uid = (uint32_t)uap->uid;
8087c478bd9Sstevel@tonic-gate 	gid = (uint32_t)uap->gid;
8097c478bd9Sstevel@tonic-gate 
8107c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(2, "new file uid", uid));
8117c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(3, "new file gid", gid));
8127c478bd9Sstevel@tonic-gate 
8137c478bd9Sstevel@tonic-gate 		/*
8147c478bd9Sstevel@tonic-gate 		 * convert file pointer to file descriptor
8157c478bd9Sstevel@tonic-gate 		 *   Note: fd ref count incremented here.
8167c478bd9Sstevel@tonic-gate 		 */
8177c478bd9Sstevel@tonic-gate 	if ((fp = getf(fd)) == NULL)
8187c478bd9Sstevel@tonic-gate 		return;
8197c478bd9Sstevel@tonic-gate 
8207c478bd9Sstevel@tonic-gate 	/* get path from file struct here */
8217c478bd9Sstevel@tonic-gate 	fad = F2A(fp);
8227c478bd9Sstevel@tonic-gate 	if (fad->fad_aupath != NULL) {
8237c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_path(fad->fad_aupath));
8247c478bd9Sstevel@tonic-gate 	} else {
8257c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "no path: fd", fd));
8267c478bd9Sstevel@tonic-gate 	}
8277c478bd9Sstevel@tonic-gate 
8287c478bd9Sstevel@tonic-gate 	vp = fp->f_vnode;
8297c478bd9Sstevel@tonic-gate 	audit_attributes(vp);
8307c478bd9Sstevel@tonic-gate 
8317c478bd9Sstevel@tonic-gate 	/* decrement file descriptor reference count */
8327c478bd9Sstevel@tonic-gate 	releasef(fd);
8337c478bd9Sstevel@tonic-gate }
8347c478bd9Sstevel@tonic-gate 
8357c478bd9Sstevel@tonic-gate /*ARGSUSED*/
8367c478bd9Sstevel@tonic-gate static void
8377c478bd9Sstevel@tonic-gate aus_lchown(struct t_audit_data *tad)
8387c478bd9Sstevel@tonic-gate {
8397c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
8407c478bd9Sstevel@tonic-gate 	uint32_t uid, gid;
8417c478bd9Sstevel@tonic-gate 
8427c478bd9Sstevel@tonic-gate 
8437c478bd9Sstevel@tonic-gate 	struct a {
8447c478bd9Sstevel@tonic-gate 		long	fname;		/* char	* */
8457c478bd9Sstevel@tonic-gate 		long	uid;
8467c478bd9Sstevel@tonic-gate 		long	gid;
8477c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
8487c478bd9Sstevel@tonic-gate 
8497c478bd9Sstevel@tonic-gate 	uid = (uint32_t)uap->uid;
8507c478bd9Sstevel@tonic-gate 	gid = (uint32_t)uap->gid;
8517c478bd9Sstevel@tonic-gate 
8527c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(2, "new file uid", uid));
8537c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(3, "new file gid", gid));
8547c478bd9Sstevel@tonic-gate }
8557c478bd9Sstevel@tonic-gate 
8568fd04b83SRoger A. Faulkner static au_event_t
8578fd04b83SRoger A. Faulkner aui_fchownat(au_event_t e)
8588fd04b83SRoger A. Faulkner {
8598fd04b83SRoger A. Faulkner 	klwp_t *clwp = ttolwp(curthread);
8608fd04b83SRoger A. Faulkner 
8618fd04b83SRoger A. Faulkner 	struct a {
8628fd04b83SRoger A. Faulkner 		long	fd;
8638fd04b83SRoger A. Faulkner 		long	fname;		/* char * */
8648fd04b83SRoger A. Faulkner 		long	uid;
8658fd04b83SRoger A. Faulkner 		long	gid;
8668fd04b83SRoger A. Faulkner 		long	flags;
8678fd04b83SRoger A. Faulkner 	} *uap = (struct a *)clwp->lwp_ap;
8688fd04b83SRoger A. Faulkner 
869*0f48f68dSToomas Soome 	if (uap->fname == 0)
8708fd04b83SRoger A. Faulkner 		e = AUE_FCHOWN;
8718fd04b83SRoger A. Faulkner 	else if (uap->flags & AT_SYMLINK_NOFOLLOW)
8728fd04b83SRoger A. Faulkner 		e = AUE_LCHOWN;
8738fd04b83SRoger A. Faulkner 	else
8748fd04b83SRoger A. Faulkner 		e = AUE_CHOWN;
8758fd04b83SRoger A. Faulkner 
8768fd04b83SRoger A. Faulkner 	return (e);
8778fd04b83SRoger A. Faulkner }
8788fd04b83SRoger A. Faulkner 
8798fd04b83SRoger A. Faulkner /*ARGSUSED*/
8808fd04b83SRoger A. Faulkner static void
8818fd04b83SRoger A. Faulkner aus_fchownat(struct t_audit_data *tad)
8828fd04b83SRoger A. Faulkner {
8838fd04b83SRoger A. Faulkner 	klwp_t *clwp = ttolwp(curthread);
8848fd04b83SRoger A. Faulkner 	uint32_t uid, gid;
8858fd04b83SRoger A. Faulkner 
8868fd04b83SRoger A. Faulkner 	struct a {
8878fd04b83SRoger A. Faulkner 		long	fd;
8888fd04b83SRoger A. Faulkner 		long	fname;		/* char * */
8898fd04b83SRoger A. Faulkner 		long	uid;
8908fd04b83SRoger A. Faulkner 		long	gid;
8918fd04b83SRoger A. Faulkner 		long	flags;
8928fd04b83SRoger A. Faulkner 	} *uap = (struct a *)clwp->lwp_ap;
8938fd04b83SRoger A. Faulkner 
8948fd04b83SRoger A. Faulkner 	uid = (uint32_t)uap->uid;
8958fd04b83SRoger A. Faulkner 	gid = (uint32_t)uap->gid;
8968fd04b83SRoger A. Faulkner 
8978fd04b83SRoger A. Faulkner 	au_uwrite(au_to_arg32(3, "new file uid", uid));
8988fd04b83SRoger A. Faulkner 	au_uwrite(au_to_arg32(4, "new file gid", gid));
8998fd04b83SRoger A. Faulkner }
9008fd04b83SRoger A. Faulkner 
9017c478bd9Sstevel@tonic-gate /*ARGSUSED*/
9027c478bd9Sstevel@tonic-gate static void
9037c478bd9Sstevel@tonic-gate aus_chmod(struct t_audit_data *tad)
9047c478bd9Sstevel@tonic-gate {
9057c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
9067c478bd9Sstevel@tonic-gate 	uint32_t fmode;
9077c478bd9Sstevel@tonic-gate 
9087c478bd9Sstevel@tonic-gate 	struct a {
9097c478bd9Sstevel@tonic-gate 		long	fname;		/* char	* */
9107c478bd9Sstevel@tonic-gate 		long	fmode;
9117c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
9127c478bd9Sstevel@tonic-gate 
9137c478bd9Sstevel@tonic-gate 	fmode = (uint32_t)uap->fmode;
9147c478bd9Sstevel@tonic-gate 
9157c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(2, "new file mode", fmode&07777));
9167c478bd9Sstevel@tonic-gate }
9177c478bd9Sstevel@tonic-gate 
9187c478bd9Sstevel@tonic-gate /*ARGSUSED*/
9197c478bd9Sstevel@tonic-gate static void
9207c478bd9Sstevel@tonic-gate aus_fchmod(struct t_audit_data *tad)
9217c478bd9Sstevel@tonic-gate {
9227c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
9237c478bd9Sstevel@tonic-gate 	uint32_t fmode, fd;
9247c478bd9Sstevel@tonic-gate 	struct file  *fp;
9257c478bd9Sstevel@tonic-gate 	struct vnode *vp;
9267c478bd9Sstevel@tonic-gate 	struct f_audit_data *fad;
9277c478bd9Sstevel@tonic-gate 
9287c478bd9Sstevel@tonic-gate 	struct a {
9297c478bd9Sstevel@tonic-gate 		long	fd;
9307c478bd9Sstevel@tonic-gate 		long	fmode;
9317c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
9327c478bd9Sstevel@tonic-gate 
9337c478bd9Sstevel@tonic-gate 	fd = (uint32_t)uap->fd;
9347c478bd9Sstevel@tonic-gate 	fmode = (uint32_t)uap->fmode;
9357c478bd9Sstevel@tonic-gate 
9367c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(2, "new file mode", fmode&07777));
9377c478bd9Sstevel@tonic-gate 
938794f0adbSRoger A. Faulkner 	/*
939794f0adbSRoger A. Faulkner 	 * convert file pointer to file descriptor
940794f0adbSRoger A. Faulkner 	 *   Note: fd ref count incremented here.
941794f0adbSRoger A. Faulkner 	 */
9427c478bd9Sstevel@tonic-gate 	if ((fp = getf(fd)) == NULL)
9437c478bd9Sstevel@tonic-gate 		return;
9447c478bd9Sstevel@tonic-gate 
945794f0adbSRoger A. Faulkner 	/* get path from file struct here */
946794f0adbSRoger A. Faulkner 	fad = F2A(fp);
947794f0adbSRoger A. Faulkner 	if (fad->fad_aupath != NULL) {
948794f0adbSRoger A. Faulkner 		au_uwrite(au_to_path(fad->fad_aupath));
949794f0adbSRoger A. Faulkner 	} else {
950794f0adbSRoger A. Faulkner 		au_uwrite(au_to_arg32(1, "no path: fd", fd));
951794f0adbSRoger A. Faulkner 	}
952794f0adbSRoger A. Faulkner 
953794f0adbSRoger A. Faulkner 	vp = fp->f_vnode;
954794f0adbSRoger A. Faulkner 	audit_attributes(vp);
955794f0adbSRoger A. Faulkner 
956794f0adbSRoger A. Faulkner 	/* decrement file descriptor reference count */
957794f0adbSRoger A. Faulkner 	releasef(fd);
958794f0adbSRoger A. Faulkner }
959794f0adbSRoger A. Faulkner 
960794f0adbSRoger A. Faulkner static au_event_t
961794f0adbSRoger A. Faulkner aui_fchmodat(au_event_t e)
962794f0adbSRoger A. Faulkner {
963794f0adbSRoger A. Faulkner 	klwp_t *clwp = ttolwp(curthread);
964794f0adbSRoger A. Faulkner 
965794f0adbSRoger A. Faulkner 	struct a {
966794f0adbSRoger A. Faulkner 		long	fd;
967794f0adbSRoger A. Faulkner 		long	fname;		/* char	* */
968794f0adbSRoger A. Faulkner 		long	fmode;
969794f0adbSRoger A. Faulkner 		long	flag;
970794f0adbSRoger A. Faulkner 	} *uap = (struct a *)clwp->lwp_ap;
971794f0adbSRoger A. Faulkner 
972*0f48f68dSToomas Soome 	if (uap->fname == 0)
973794f0adbSRoger A. Faulkner 		e = AUE_FCHMOD;
974794f0adbSRoger A. Faulkner 	else
975794f0adbSRoger A. Faulkner 		e = AUE_CHMOD;
976794f0adbSRoger A. Faulkner 
977794f0adbSRoger A. Faulkner 	return (e);
978794f0adbSRoger A. Faulkner }
979794f0adbSRoger A. Faulkner 
980794f0adbSRoger A. Faulkner /*ARGSUSED*/
981794f0adbSRoger A. Faulkner static void
982794f0adbSRoger A. Faulkner aus_fchmodat(struct t_audit_data *tad)
983794f0adbSRoger A. Faulkner {
984794f0adbSRoger A. Faulkner 	klwp_t *clwp = ttolwp(curthread);
985794f0adbSRoger A. Faulkner 	uint32_t fmode;
986794f0adbSRoger A. Faulkner 	uint32_t fd;
987794f0adbSRoger A. Faulkner 	struct file  *fp;
988794f0adbSRoger A. Faulkner 	struct vnode *vp;
989794f0adbSRoger A. Faulkner 	struct f_audit_data *fad;
990794f0adbSRoger A. Faulkner 
991794f0adbSRoger A. Faulkner 	struct a {
992794f0adbSRoger A. Faulkner 		long	fd;
993794f0adbSRoger A. Faulkner 		long	fname;		/* char	* */
994794f0adbSRoger A. Faulkner 		long	fmode;
995794f0adbSRoger A. Faulkner 		long	flag;
996794f0adbSRoger A. Faulkner 	} *uap = (struct a *)clwp->lwp_ap;
997794f0adbSRoger A. Faulkner 
998794f0adbSRoger A. Faulkner 	fd = (uint32_t)uap->fd;
999794f0adbSRoger A. Faulkner 	fmode = (uint32_t)uap->fmode;
1000794f0adbSRoger A. Faulkner 
1001794f0adbSRoger A. Faulkner 	au_uwrite(au_to_arg32(2, "new file mode", fmode&07777));
1002794f0adbSRoger A. Faulkner 
1003*0f48f68dSToomas Soome 	if (fd == AT_FDCWD || uap->fname != 0)	/* same as chmod() */
1004794f0adbSRoger A. Faulkner 		return;
1005794f0adbSRoger A. Faulkner 
1006794f0adbSRoger A. Faulkner 	/*
1007794f0adbSRoger A. Faulkner 	 * convert file pointer to file descriptor
1008794f0adbSRoger A. Faulkner 	 *   Note: fd ref count incremented here.
1009794f0adbSRoger A. Faulkner 	 */
1010794f0adbSRoger A. Faulkner 	if ((fp = getf(fd)) == NULL)
1011794f0adbSRoger A. Faulkner 		return;
1012794f0adbSRoger A. Faulkner 
1013794f0adbSRoger A. Faulkner 	/* get path from file struct here */
10147c478bd9Sstevel@tonic-gate 	fad = F2A(fp);
10157c478bd9Sstevel@tonic-gate 	if (fad->fad_aupath != NULL) {
10167c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_path(fad->fad_aupath));
10177c478bd9Sstevel@tonic-gate 	} else {
10187c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "no path: fd", fd));
10197c478bd9Sstevel@tonic-gate 	}
10207c478bd9Sstevel@tonic-gate 
10217c478bd9Sstevel@tonic-gate 	vp = fp->f_vnode;
10227c478bd9Sstevel@tonic-gate 	audit_attributes(vp);
10237c478bd9Sstevel@tonic-gate 
10247c478bd9Sstevel@tonic-gate 	/* decrement file descriptor reference count */
10257c478bd9Sstevel@tonic-gate 	releasef(fd);
10267c478bd9Sstevel@tonic-gate }
10277c478bd9Sstevel@tonic-gate 
10288fd04b83SRoger A. Faulkner /*
10298fd04b83SRoger A. Faulkner  * convert open mode to appropriate open event
10308fd04b83SRoger A. Faulkner  */
10318fd04b83SRoger A. Faulkner au_event_t
10328fd04b83SRoger A. Faulkner open_event(uint_t fm)
10338fd04b83SRoger A. Faulkner {
10348fd04b83SRoger A. Faulkner 	au_event_t e;
10358fd04b83SRoger A. Faulkner 
1036794f0adbSRoger A. Faulkner 	switch (fm & (O_ACCMODE | O_CREAT | O_TRUNC)) {
10378fd04b83SRoger A. Faulkner 	case O_RDONLY:
10388fd04b83SRoger A. Faulkner 		e = AUE_OPEN_R;
10398fd04b83SRoger A. Faulkner 		break;
10408fd04b83SRoger A. Faulkner 	case O_RDONLY | O_CREAT:
10418fd04b83SRoger A. Faulkner 		e = AUE_OPEN_RC;
10428fd04b83SRoger A. Faulkner 		break;
10438fd04b83SRoger A. Faulkner 	case O_RDONLY | O_TRUNC:
10448fd04b83SRoger A. Faulkner 		e = AUE_OPEN_RT;
10458fd04b83SRoger A. Faulkner 		break;
10468fd04b83SRoger A. Faulkner 	case O_RDONLY | O_TRUNC | O_CREAT:
10478fd04b83SRoger A. Faulkner 		e = AUE_OPEN_RTC;
10488fd04b83SRoger A. Faulkner 		break;
10498fd04b83SRoger A. Faulkner 	case O_WRONLY:
10508fd04b83SRoger A. Faulkner 		e = AUE_OPEN_W;
10518fd04b83SRoger A. Faulkner 		break;
10528fd04b83SRoger A. Faulkner 	case O_WRONLY | O_CREAT:
10538fd04b83SRoger A. Faulkner 		e = AUE_OPEN_WC;
10548fd04b83SRoger A. Faulkner 		break;
10558fd04b83SRoger A. Faulkner 	case O_WRONLY | O_TRUNC:
10568fd04b83SRoger A. Faulkner 		e = AUE_OPEN_WT;
10578fd04b83SRoger A. Faulkner 		break;
10588fd04b83SRoger A. Faulkner 	case O_WRONLY | O_TRUNC | O_CREAT:
10598fd04b83SRoger A. Faulkner 		e = AUE_OPEN_WTC;
10608fd04b83SRoger A. Faulkner 		break;
10618fd04b83SRoger A. Faulkner 	case O_RDWR:
10628fd04b83SRoger A. Faulkner 		e = AUE_OPEN_RW;
10638fd04b83SRoger A. Faulkner 		break;
10648fd04b83SRoger A. Faulkner 	case O_RDWR | O_CREAT:
10658fd04b83SRoger A. Faulkner 		e = AUE_OPEN_RWC;
10668fd04b83SRoger A. Faulkner 		break;
10678fd04b83SRoger A. Faulkner 	case O_RDWR | O_TRUNC:
10688fd04b83SRoger A. Faulkner 		e = AUE_OPEN_RWT;
10698fd04b83SRoger A. Faulkner 		break;
10708fd04b83SRoger A. Faulkner 	case O_RDWR | O_TRUNC | O_CREAT:
10718fd04b83SRoger A. Faulkner 		e = AUE_OPEN_RWTC;
10728fd04b83SRoger A. Faulkner 		break;
1073794f0adbSRoger A. Faulkner 	case O_SEARCH:
1074794f0adbSRoger A. Faulkner 		e = AUE_OPEN_S;
1075794f0adbSRoger A. Faulkner 		break;
1076794f0adbSRoger A. Faulkner 	case O_EXEC:
1077794f0adbSRoger A. Faulkner 		e = AUE_OPEN_E;
1078794f0adbSRoger A. Faulkner 		break;
10798fd04b83SRoger A. Faulkner 	default:
10808fd04b83SRoger A. Faulkner 		e = AUE_NULL;
10818fd04b83SRoger A. Faulkner 		break;
10828fd04b83SRoger A. Faulkner 	}
10837c478bd9Sstevel@tonic-gate 
10848fd04b83SRoger A. Faulkner 	return (e);
10858fd04b83SRoger A. Faulkner }
10868fd04b83SRoger A. Faulkner 
10878fd04b83SRoger A. Faulkner /* ARGSUSED */
10887c478bd9Sstevel@tonic-gate static au_event_t
10897c478bd9Sstevel@tonic-gate aui_open(au_event_t e)
10907c478bd9Sstevel@tonic-gate {
10917c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
10927c478bd9Sstevel@tonic-gate 	uint_t fm;
10937c478bd9Sstevel@tonic-gate 
10947c478bd9Sstevel@tonic-gate 	struct a {
10957c478bd9Sstevel@tonic-gate 		long	fnamep;		/* char	* */
10967c478bd9Sstevel@tonic-gate 		long	fmode;
10977c478bd9Sstevel@tonic-gate 		long	cmode;
10987c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
10997c478bd9Sstevel@tonic-gate 
11007c478bd9Sstevel@tonic-gate 	fm = (uint_t)uap->fmode;
11017c478bd9Sstevel@tonic-gate 
11028fd04b83SRoger A. Faulkner 	return (open_event(fm));
11037c478bd9Sstevel@tonic-gate }
11047c478bd9Sstevel@tonic-gate 
11057c478bd9Sstevel@tonic-gate static void
11067c478bd9Sstevel@tonic-gate aus_open(struct t_audit_data *tad)
11077c478bd9Sstevel@tonic-gate {
11087c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
11097c478bd9Sstevel@tonic-gate 	uint_t fm;
11107c478bd9Sstevel@tonic-gate 
11117c478bd9Sstevel@tonic-gate 	struct a {
11127c478bd9Sstevel@tonic-gate 		long	fnamep;		/* char	* */
11137c478bd9Sstevel@tonic-gate 		long	fmode;
11147c478bd9Sstevel@tonic-gate 		long	cmode;
11157c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
11167c478bd9Sstevel@tonic-gate 
11177c478bd9Sstevel@tonic-gate 	fm = (uint_t)uap->fmode;
11187c478bd9Sstevel@tonic-gate 
11197c478bd9Sstevel@tonic-gate 	/* If no write, create, or trunc modes, mark as a public op */
11208fd04b83SRoger A. Faulkner 	if ((fm & (O_RDONLY|O_WRONLY|O_RDWR|O_CREAT|O_TRUNC)) == O_RDONLY)
11214a0fa546SMarek Pospisil 		tad->tad_ctrl |= TAD_PUBLIC_EV;
11227c478bd9Sstevel@tonic-gate }
11237c478bd9Sstevel@tonic-gate 
11248fd04b83SRoger A. Faulkner /* ARGSUSED */
11257c478bd9Sstevel@tonic-gate static au_event_t
11268fd04b83SRoger A. Faulkner aui_openat(au_event_t e)
11277c478bd9Sstevel@tonic-gate {
11288fd04b83SRoger A. Faulkner 	t_audit_data_t *tad = T2A(curthread);
11297c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
11308fd04b83SRoger A. Faulkner 	uint_t fm;
11318fd04b83SRoger A. Faulkner 
11327c478bd9Sstevel@tonic-gate 	struct a {
11338fd04b83SRoger A. Faulkner 		long	filedes;
11348fd04b83SRoger A. Faulkner 		long	fnamep;		/* char	* */
11358fd04b83SRoger A. Faulkner 		long	fmode;
11368fd04b83SRoger A. Faulkner 		long	cmode;
11377c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
11387c478bd9Sstevel@tonic-gate 
11398fd04b83SRoger A. Faulkner 	fm = (uint_t)uap->fmode;
11407c478bd9Sstevel@tonic-gate 
1141c4d3e299SBrent Paulson 	/*
1142c4d3e299SBrent Paulson 	 * __openattrdirat() does an extra pathname lookup in order to
1143c4d3e299SBrent Paulson 	 * enter the extended system attribute namespace of the referenced
1144c4d3e299SBrent Paulson 	 * extended attribute filename.
1145c4d3e299SBrent Paulson 	 */
1146c4d3e299SBrent Paulson 	if (fm & FXATTRDIROPEN)
1147c4d3e299SBrent Paulson 		tad->tad_ctrl |= TAD_MLD;
11487c478bd9Sstevel@tonic-gate 
11498fd04b83SRoger A. Faulkner 	return (open_event(fm));
11508fd04b83SRoger A. Faulkner }
11517c478bd9Sstevel@tonic-gate 
11528fd04b83SRoger A. Faulkner static void
11538fd04b83SRoger A. Faulkner aus_openat(struct t_audit_data *tad)
11548fd04b83SRoger A. Faulkner {
11558fd04b83SRoger A. Faulkner 	klwp_t *clwp = ttolwp(curthread);
11568fd04b83SRoger A. Faulkner 	uint_t fm;
11577c478bd9Sstevel@tonic-gate 
11588fd04b83SRoger A. Faulkner 	struct a {
11598fd04b83SRoger A. Faulkner 		long	filedes;
11608fd04b83SRoger A. Faulkner 		long	fnamep;		/* char	* */
11618fd04b83SRoger A. Faulkner 		long	fmode;
11628fd04b83SRoger A. Faulkner 		long	cmode;
11638fd04b83SRoger A. Faulkner 	} *uap = (struct a *)clwp->lwp_ap;
11647c478bd9Sstevel@tonic-gate 
11658fd04b83SRoger A. Faulkner 	fm = (uint_t)uap->fmode;
11667c478bd9Sstevel@tonic-gate 
11678fd04b83SRoger A. Faulkner 	/* If no write, create, or trunc modes, mark as a public op */
11688fd04b83SRoger A. Faulkner 	if ((fm & (O_RDONLY|O_WRONLY|O_RDWR|O_CREAT|O_TRUNC)) == O_RDONLY)
11694a0fa546SMarek Pospisil 		tad->tad_ctrl |= TAD_PUBLIC_EV;
11707c478bd9Sstevel@tonic-gate }
11717c478bd9Sstevel@tonic-gate 
11728fd04b83SRoger A. Faulkner static au_event_t
11738fd04b83SRoger A. Faulkner aui_unlinkat(au_event_t e)
11747c478bd9Sstevel@tonic-gate {
11757c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
11768fd04b83SRoger A. Faulkner 
11777c478bd9Sstevel@tonic-gate 	struct a {
11788fd04b83SRoger A. Faulkner 		long	filedes;
11798fd04b83SRoger A. Faulkner 		long	fnamep;		/* char	* */
11808fd04b83SRoger A. Faulkner 		long	flags;
11817c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
11827c478bd9Sstevel@tonic-gate 
11838fd04b83SRoger A. Faulkner 	if (uap->flags & AT_REMOVEDIR)
11848fd04b83SRoger A. Faulkner 		e = AUE_RMDIR;
11858fd04b83SRoger A. Faulkner 	else
11868fd04b83SRoger A. Faulkner 		e = AUE_UNLINK;
11877c478bd9Sstevel@tonic-gate 
11888fd04b83SRoger A. Faulkner 	return (e);
11898fd04b83SRoger A. Faulkner }
11907c478bd9Sstevel@tonic-gate 
11918fd04b83SRoger A. Faulkner static au_event_t
11928fd04b83SRoger A. Faulkner aui_fstatat(au_event_t e)
11938fd04b83SRoger A. Faulkner {
11948fd04b83SRoger A. Faulkner 	klwp_t *clwp = ttolwp(curthread);
11957c478bd9Sstevel@tonic-gate 
11968fd04b83SRoger A. Faulkner 	struct a {
11978fd04b83SRoger A. Faulkner 		long	filedes;
11988fd04b83SRoger A. Faulkner 		long	fnamep;		/* char	* */
11998fd04b83SRoger A. Faulkner 		long	statb;
12008fd04b83SRoger A. Faulkner 		long	flags;
12018fd04b83SRoger A. Faulkner 	} *uap = (struct a *)clwp->lwp_ap;
12028fd04b83SRoger A. Faulkner 
1203*0f48f68dSToomas Soome 	if (uap->fnamep == 0)
12048fd04b83SRoger A. Faulkner 		e = AUE_FSTAT;
12058fd04b83SRoger A. Faulkner 	else if (uap->flags & AT_SYMLINK_NOFOLLOW)
12068fd04b83SRoger A. Faulkner 		e = AUE_LSTAT;
12078fd04b83SRoger A. Faulkner 	else
12088fd04b83SRoger A. Faulkner 		e = AUE_STAT;
12098fd04b83SRoger A. Faulkner 
12108fd04b83SRoger A. Faulkner 	return (e);
12117c478bd9Sstevel@tonic-gate }
12127c478bd9Sstevel@tonic-gate 
12137c478bd9Sstevel@tonic-gate /* msgsys */
12147c478bd9Sstevel@tonic-gate static au_event_t
12157c478bd9Sstevel@tonic-gate aui_msgsys(au_event_t e)
12167c478bd9Sstevel@tonic-gate {
12177c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
12187c478bd9Sstevel@tonic-gate 	uint_t fm;
12197c478bd9Sstevel@tonic-gate 
12207c478bd9Sstevel@tonic-gate 	struct a {
12217c478bd9Sstevel@tonic-gate 		long	id;	/* function code id */
12227c478bd9Sstevel@tonic-gate 		long	ap;	/* arg pointer for recvmsg */
12237c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
12247c478bd9Sstevel@tonic-gate 
12257c478bd9Sstevel@tonic-gate 	struct b {
12267c478bd9Sstevel@tonic-gate 		long	msgid;
12277c478bd9Sstevel@tonic-gate 		long	cmd;
12287c478bd9Sstevel@tonic-gate 		long	buf;	/* struct msqid_ds * */
12297c478bd9Sstevel@tonic-gate 	} *uap1 = (struct b *)&clwp->lwp_ap[1];
12307c478bd9Sstevel@tonic-gate 
12317c478bd9Sstevel@tonic-gate 	fm  = (uint_t)uap->id;
12327c478bd9Sstevel@tonic-gate 
12337c478bd9Sstevel@tonic-gate 	switch (fm) {
12347c478bd9Sstevel@tonic-gate 	case 0:		/* msgget */
12357c478bd9Sstevel@tonic-gate 		e = AUE_MSGGET;
12367c478bd9Sstevel@tonic-gate 		break;
12377c478bd9Sstevel@tonic-gate 	case 1:		/* msgctl */
12387c478bd9Sstevel@tonic-gate 		switch ((uint_t)uap1->cmd) {
12397c478bd9Sstevel@tonic-gate 		case IPC_RMID:
12407c478bd9Sstevel@tonic-gate 			e = AUE_MSGCTL_RMID;
12417c478bd9Sstevel@tonic-gate 			break;
12427c478bd9Sstevel@tonic-gate 		case IPC_SET:
12437c478bd9Sstevel@tonic-gate 			e = AUE_MSGCTL_SET;
12447c478bd9Sstevel@tonic-gate 			break;
12457c478bd9Sstevel@tonic-gate 		case IPC_STAT:
12467c478bd9Sstevel@tonic-gate 			e = AUE_MSGCTL_STAT;
12477c478bd9Sstevel@tonic-gate 			break;
12487c478bd9Sstevel@tonic-gate 		default:
12497c478bd9Sstevel@tonic-gate 			e = AUE_MSGCTL;
12507c478bd9Sstevel@tonic-gate 			break;
12517c478bd9Sstevel@tonic-gate 		}
12527c478bd9Sstevel@tonic-gate 		break;
12537c478bd9Sstevel@tonic-gate 	case 2:		/* msgrcv */
12547c478bd9Sstevel@tonic-gate 		e = AUE_MSGRCV;
12557c478bd9Sstevel@tonic-gate 		break;
12567c478bd9Sstevel@tonic-gate 	case 3:		/* msgsnd */
12577c478bd9Sstevel@tonic-gate 		e = AUE_MSGSND;
12587c478bd9Sstevel@tonic-gate 		break;
12597c478bd9Sstevel@tonic-gate 	default:	/* illegal system call */
12607c478bd9Sstevel@tonic-gate 		e = AUE_NULL;
12617c478bd9Sstevel@tonic-gate 		break;
12627c478bd9Sstevel@tonic-gate 	}
12637c478bd9Sstevel@tonic-gate 
12647c478bd9Sstevel@tonic-gate 	return (e);
12657c478bd9Sstevel@tonic-gate }
12667c478bd9Sstevel@tonic-gate 
12677c478bd9Sstevel@tonic-gate 
12687c478bd9Sstevel@tonic-gate /* shmsys */
12697c478bd9Sstevel@tonic-gate static au_event_t
12707c478bd9Sstevel@tonic-gate aui_shmsys(au_event_t e)
12717c478bd9Sstevel@tonic-gate {
12727c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
12737c478bd9Sstevel@tonic-gate 	int fm;
12747c478bd9Sstevel@tonic-gate 
12757c478bd9Sstevel@tonic-gate 	struct a {		/* shmsys */
12767c478bd9Sstevel@tonic-gate 		long	id;	/* function code id */
12777c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
12787c478bd9Sstevel@tonic-gate 
12797c478bd9Sstevel@tonic-gate 	struct b {		/* ctrl */
12807c478bd9Sstevel@tonic-gate 		long	shmid;
12817c478bd9Sstevel@tonic-gate 		long	cmd;
12827c478bd9Sstevel@tonic-gate 		long	arg;		/* struct shmid_ds * */
12837c478bd9Sstevel@tonic-gate 	} *uap1 = (struct b *)&clwp->lwp_ap[1];
12847c478bd9Sstevel@tonic-gate 	fm  = (uint_t)uap->id;
12857c478bd9Sstevel@tonic-gate 
12867c478bd9Sstevel@tonic-gate 	switch (fm) {
12877c478bd9Sstevel@tonic-gate 	case 0:		/* shmat */
12887c478bd9Sstevel@tonic-gate 		e = AUE_SHMAT;
12897c478bd9Sstevel@tonic-gate 		break;
12907c478bd9Sstevel@tonic-gate 	case 1:		/* shmctl */
12917c478bd9Sstevel@tonic-gate 		switch ((uint_t)uap1->cmd) {
12927c478bd9Sstevel@tonic-gate 		case IPC_RMID:
12937c478bd9Sstevel@tonic-gate 			e = AUE_SHMCTL_RMID;
12947c478bd9Sstevel@tonic-gate 			break;
12957c478bd9Sstevel@tonic-gate 		case IPC_SET:
12967c478bd9Sstevel@tonic-gate 			e = AUE_SHMCTL_SET;
12977c478bd9Sstevel@tonic-gate 			break;
12987c478bd9Sstevel@tonic-gate 		case IPC_STAT:
12997c478bd9Sstevel@tonic-gate 			e = AUE_SHMCTL_STAT;
13007c478bd9Sstevel@tonic-gate 			break;
13017c478bd9Sstevel@tonic-gate 		default:
13027c478bd9Sstevel@tonic-gate 			e = AUE_SHMCTL;
13037c478bd9Sstevel@tonic-gate 			break;
13047c478bd9Sstevel@tonic-gate 		}
13057c478bd9Sstevel@tonic-gate 		break;
13067c478bd9Sstevel@tonic-gate 	case 2:		/* shmdt */
13077c478bd9Sstevel@tonic-gate 		e = AUE_SHMDT;
13087c478bd9Sstevel@tonic-gate 		break;
13097c478bd9Sstevel@tonic-gate 	case 3:		/* shmget */
13107c478bd9Sstevel@tonic-gate 		e = AUE_SHMGET;
13117c478bd9Sstevel@tonic-gate 		break;
13127c478bd9Sstevel@tonic-gate 	default:	/* illegal system call */
13137c478bd9Sstevel@tonic-gate 		e = AUE_NULL;
13147c478bd9Sstevel@tonic-gate 		break;
13157c478bd9Sstevel@tonic-gate 	}
13167c478bd9Sstevel@tonic-gate 
13177c478bd9Sstevel@tonic-gate 	return (e);
13187c478bd9Sstevel@tonic-gate }
13197c478bd9Sstevel@tonic-gate 
13207c478bd9Sstevel@tonic-gate 
13217c478bd9Sstevel@tonic-gate /* semsys */
13227c478bd9Sstevel@tonic-gate static au_event_t
13237c478bd9Sstevel@tonic-gate aui_semsys(au_event_t e)
13247c478bd9Sstevel@tonic-gate {
13257c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
13267c478bd9Sstevel@tonic-gate 	uint_t fm;
13277c478bd9Sstevel@tonic-gate 
13287c478bd9Sstevel@tonic-gate 	struct a {		/* semsys */
13297c478bd9Sstevel@tonic-gate 		long	id;
13307c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
13317c478bd9Sstevel@tonic-gate 
13327c478bd9Sstevel@tonic-gate 	struct b {		/* ctrl */
13337c478bd9Sstevel@tonic-gate 		long	semid;
13347c478bd9Sstevel@tonic-gate 		long	semnum;
13357c478bd9Sstevel@tonic-gate 		long	cmd;
13367c478bd9Sstevel@tonic-gate 		long	arg;
13377c478bd9Sstevel@tonic-gate 	} *uap1 = (struct b *)&clwp->lwp_ap[1];
13387c478bd9Sstevel@tonic-gate 
13397c478bd9Sstevel@tonic-gate 	fm = (uint_t)uap->id;
13407c478bd9Sstevel@tonic-gate 
13417c478bd9Sstevel@tonic-gate 	switch (fm) {
13427c478bd9Sstevel@tonic-gate 	case 0:		/* semctl */
13437c478bd9Sstevel@tonic-gate 		switch ((uint_t)uap1->cmd) {
13447c478bd9Sstevel@tonic-gate 		case IPC_RMID:
13457c478bd9Sstevel@tonic-gate 			e = AUE_SEMCTL_RMID;
13467c478bd9Sstevel@tonic-gate 			break;
13477c478bd9Sstevel@tonic-gate 		case IPC_SET:
13487c478bd9Sstevel@tonic-gate 			e = AUE_SEMCTL_SET;
13497c478bd9Sstevel@tonic-gate 			break;
13507c478bd9Sstevel@tonic-gate 		case IPC_STAT:
13517c478bd9Sstevel@tonic-gate 			e = AUE_SEMCTL_STAT;
13527c478bd9Sstevel@tonic-gate 			break;
13537c478bd9Sstevel@tonic-gate 		case GETNCNT:
13547c478bd9Sstevel@tonic-gate 			e = AUE_SEMCTL_GETNCNT;
13557c478bd9Sstevel@tonic-gate 			break;
13567c478bd9Sstevel@tonic-gate 		case GETPID:
13577c478bd9Sstevel@tonic-gate 			e = AUE_SEMCTL_GETPID;
13587c478bd9Sstevel@tonic-gate 			break;
13597c478bd9Sstevel@tonic-gate 		case GETVAL:
13607c478bd9Sstevel@tonic-gate 			e = AUE_SEMCTL_GETVAL;
13617c478bd9Sstevel@tonic-gate 			break;
13627c478bd9Sstevel@tonic-gate 		case GETALL:
13637c478bd9Sstevel@tonic-gate 			e = AUE_SEMCTL_GETALL;
13647c478bd9Sstevel@tonic-gate 			break;
13657c478bd9Sstevel@tonic-gate 		case GETZCNT:
13667c478bd9Sstevel@tonic-gate 			e = AUE_SEMCTL_GETZCNT;
13677c478bd9Sstevel@tonic-gate 			break;
13687c478bd9Sstevel@tonic-gate 		case SETVAL:
13697c478bd9Sstevel@tonic-gate 			e = AUE_SEMCTL_SETVAL;
13707c478bd9Sstevel@tonic-gate 			break;
13717c478bd9Sstevel@tonic-gate 		case SETALL:
13727c478bd9Sstevel@tonic-gate 			e = AUE_SEMCTL_SETALL;
13737c478bd9Sstevel@tonic-gate 			break;
13747c478bd9Sstevel@tonic-gate 		default:
13757c478bd9Sstevel@tonic-gate 			e = AUE_SEMCTL;
13767c478bd9Sstevel@tonic-gate 			break;
13777c478bd9Sstevel@tonic-gate 		}
13787c478bd9Sstevel@tonic-gate 		break;
13797c478bd9Sstevel@tonic-gate 	case 1:		/* semget */
13807c478bd9Sstevel@tonic-gate 		e = AUE_SEMGET;
13817c478bd9Sstevel@tonic-gate 		break;
13827c478bd9Sstevel@tonic-gate 	case 2:		/* semop */
13837c478bd9Sstevel@tonic-gate 		e = AUE_SEMOP;
13847c478bd9Sstevel@tonic-gate 		break;
13857c478bd9Sstevel@tonic-gate 	default:	/* illegal system call */
13867c478bd9Sstevel@tonic-gate 		e = AUE_NULL;
13877c478bd9Sstevel@tonic-gate 		break;
13887c478bd9Sstevel@tonic-gate 	}
13897c478bd9Sstevel@tonic-gate 
13907c478bd9Sstevel@tonic-gate 	return (e);
13917c478bd9Sstevel@tonic-gate }
13927c478bd9Sstevel@tonic-gate 
13937c478bd9Sstevel@tonic-gate /* utssys - uname(2), ustat(2), fusers(2) */
13947c478bd9Sstevel@tonic-gate static au_event_t
13957c478bd9Sstevel@tonic-gate aui_utssys(au_event_t e)
13967c478bd9Sstevel@tonic-gate {
13977c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
13987c478bd9Sstevel@tonic-gate 	uint_t type;
13997c478bd9Sstevel@tonic-gate 
14007c478bd9Sstevel@tonic-gate 	struct a {
14017c478bd9Sstevel@tonic-gate 		union {
14027c478bd9Sstevel@tonic-gate 			long	cbuf;		/* char * */
14037c478bd9Sstevel@tonic-gate 			long	ubuf;		/* struct stat * */
14047c478bd9Sstevel@tonic-gate 		} ub;
14057c478bd9Sstevel@tonic-gate 		union {
14067c478bd9Sstevel@tonic-gate 			long	mv;	/* for USTAT */
14077c478bd9Sstevel@tonic-gate 			long	flags;	/* for FUSERS */
14087c478bd9Sstevel@tonic-gate 		} un;
14097c478bd9Sstevel@tonic-gate 		long	type;
14107c478bd9Sstevel@tonic-gate 		long	outbp;		/* char * for FUSERS */
14117c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
14127c478bd9Sstevel@tonic-gate 
14137c478bd9Sstevel@tonic-gate 	type = (uint_t)uap->type;
14147c478bd9Sstevel@tonic-gate 
14157c478bd9Sstevel@tonic-gate 	if (type == UTS_FUSERS)
14167c478bd9Sstevel@tonic-gate 		return (e);
14177c478bd9Sstevel@tonic-gate 	else
14187c478bd9Sstevel@tonic-gate 		return ((au_event_t)AUE_NULL);
14197c478bd9Sstevel@tonic-gate }
14207c478bd9Sstevel@tonic-gate 
14217c478bd9Sstevel@tonic-gate static au_event_t
14227c478bd9Sstevel@tonic-gate aui_fcntl(au_event_t e)
14237c478bd9Sstevel@tonic-gate {
14247c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
14257c478bd9Sstevel@tonic-gate 	uint_t cmd;
14267c478bd9Sstevel@tonic-gate 
14277c478bd9Sstevel@tonic-gate 	struct a {
14287c478bd9Sstevel@tonic-gate 		long	fdes;
14297c478bd9Sstevel@tonic-gate 		long	cmd;
14307c478bd9Sstevel@tonic-gate 		long	arg;
14317c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
14327c478bd9Sstevel@tonic-gate 
14337c478bd9Sstevel@tonic-gate 	cmd = (uint_t)uap->cmd;
14347c478bd9Sstevel@tonic-gate 
14357c478bd9Sstevel@tonic-gate 	switch (cmd) {
14367c478bd9Sstevel@tonic-gate 	case F_GETLK:
14377c478bd9Sstevel@tonic-gate 	case F_SETLK:
14387c478bd9Sstevel@tonic-gate 	case F_SETLKW:
14397c478bd9Sstevel@tonic-gate 		break;
14407c478bd9Sstevel@tonic-gate 	case F_SETFL:
14417c478bd9Sstevel@tonic-gate 	case F_GETFL:
14427c478bd9Sstevel@tonic-gate 	case F_GETFD:
14437c478bd9Sstevel@tonic-gate 		break;
14447c478bd9Sstevel@tonic-gate 	default:
14457c478bd9Sstevel@tonic-gate 		e = (au_event_t)AUE_NULL;
14467c478bd9Sstevel@tonic-gate 		break;
14477c478bd9Sstevel@tonic-gate 	}
14487c478bd9Sstevel@tonic-gate 	return ((au_event_t)e);
14497c478bd9Sstevel@tonic-gate }
14507c478bd9Sstevel@tonic-gate 
14517c478bd9Sstevel@tonic-gate /* null function for now */
14527c478bd9Sstevel@tonic-gate static au_event_t
14537c478bd9Sstevel@tonic-gate aui_execve(au_event_t e)
14547c478bd9Sstevel@tonic-gate {
14557c478bd9Sstevel@tonic-gate 	return (e);
14567c478bd9Sstevel@tonic-gate }
14577c478bd9Sstevel@tonic-gate 
14587c478bd9Sstevel@tonic-gate /*ARGSUSED*/
14597c478bd9Sstevel@tonic-gate static void
14607c478bd9Sstevel@tonic-gate aus_fcntl(struct t_audit_data *tad)
14617c478bd9Sstevel@tonic-gate {
14627c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
146351b433b7SMarek Pospisil 	uint32_t cmd, fd, flags;
14647c478bd9Sstevel@tonic-gate 	struct file  *fp;
14657c478bd9Sstevel@tonic-gate 	struct vnode *vp;
14667c478bd9Sstevel@tonic-gate 	struct f_audit_data *fad;
14677c478bd9Sstevel@tonic-gate 
14687c478bd9Sstevel@tonic-gate 	struct a {
14697c478bd9Sstevel@tonic-gate 		long	fd;
14707c478bd9Sstevel@tonic-gate 		long	cmd;
14717c478bd9Sstevel@tonic-gate 		long	arg;
14727c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
14737c478bd9Sstevel@tonic-gate 
147451b433b7SMarek Pospisil 	cmd	= (uint32_t)uap->cmd;
147551b433b7SMarek Pospisil 	fd	= (uint32_t)uap->fd;
147651b433b7SMarek Pospisil 	flags	= (uint32_t)uap->arg;
14777c478bd9Sstevel@tonic-gate 
14787c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(2, "cmd", cmd));
14797c478bd9Sstevel@tonic-gate 
148051b433b7SMarek Pospisil 	if (cmd == F_SETFL)
148151b433b7SMarek Pospisil 		au_uwrite(au_to_arg32(3, "flags", flags));
148251b433b7SMarek Pospisil 
14837c478bd9Sstevel@tonic-gate 		/*
14847c478bd9Sstevel@tonic-gate 		 * convert file pointer to file descriptor
14857c478bd9Sstevel@tonic-gate 		 *   Note: fd ref count incremented here.
14867c478bd9Sstevel@tonic-gate 		 */
14877c478bd9Sstevel@tonic-gate 	if ((fp = getf(fd)) == NULL)
14887c478bd9Sstevel@tonic-gate 		return;
14897c478bd9Sstevel@tonic-gate 
14907c478bd9Sstevel@tonic-gate 	/* get path from file struct here */
14917c478bd9Sstevel@tonic-gate 	fad = F2A(fp);
14927c478bd9Sstevel@tonic-gate 	if (fad->fad_aupath != NULL) {
14937c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_path(fad->fad_aupath));
14947c478bd9Sstevel@tonic-gate 	} else {
14957c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "no path: fd", fd));
14967c478bd9Sstevel@tonic-gate 	}
14977c478bd9Sstevel@tonic-gate 
14987c478bd9Sstevel@tonic-gate 	vp = fp->f_vnode;
14997c478bd9Sstevel@tonic-gate 	audit_attributes(vp);
15007c478bd9Sstevel@tonic-gate 
15017c478bd9Sstevel@tonic-gate 	/* decrement file descriptor reference count */
15027c478bd9Sstevel@tonic-gate 	releasef(fd);
15037c478bd9Sstevel@tonic-gate }
15047c478bd9Sstevel@tonic-gate 
15057c478bd9Sstevel@tonic-gate /*ARGSUSED*/
15067c478bd9Sstevel@tonic-gate static void
15077c478bd9Sstevel@tonic-gate aus_kill(struct t_audit_data *tad)
15087c478bd9Sstevel@tonic-gate {
15097c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
15107c478bd9Sstevel@tonic-gate 	struct proc *p;
15117c478bd9Sstevel@tonic-gate 	uint32_t signo;
15127c478bd9Sstevel@tonic-gate 	uid_t uid, ruid;
15137c478bd9Sstevel@tonic-gate 	gid_t gid, rgid;
15147c478bd9Sstevel@tonic-gate 	pid_t pid;
15157c478bd9Sstevel@tonic-gate 	const auditinfo_addr_t *ainfo;
15167c478bd9Sstevel@tonic-gate 	cred_t *cr;
15177c478bd9Sstevel@tonic-gate 
15187c478bd9Sstevel@tonic-gate 	struct a {
15197c478bd9Sstevel@tonic-gate 		long	pid;
15207c478bd9Sstevel@tonic-gate 		long	signo;
15217c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
15227c478bd9Sstevel@tonic-gate 
15237c478bd9Sstevel@tonic-gate 	pid   = (pid_t)uap->pid;
15247c478bd9Sstevel@tonic-gate 	signo = (uint32_t)uap->signo;
15257c478bd9Sstevel@tonic-gate 
15267c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(2, "signal", signo));
15277c478bd9Sstevel@tonic-gate 	if (pid > 0) {
15287c478bd9Sstevel@tonic-gate 		mutex_enter(&pidlock);
15297c478bd9Sstevel@tonic-gate 		if (((p = prfind(pid)) == (struct proc *)0) ||
15307c478bd9Sstevel@tonic-gate 		    (p->p_stat == SIDL)) {
15317c478bd9Sstevel@tonic-gate 			mutex_exit(&pidlock);
15327c478bd9Sstevel@tonic-gate 			au_uwrite(au_to_arg32(1, "process", (uint32_t)pid));
15337c478bd9Sstevel@tonic-gate 			return;
15347c478bd9Sstevel@tonic-gate 		}
15357c478bd9Sstevel@tonic-gate 		mutex_enter(&p->p_lock); /* so process doesn't go away */
15367c478bd9Sstevel@tonic-gate 		mutex_exit(&pidlock);
15377c478bd9Sstevel@tonic-gate 
15387c478bd9Sstevel@tonic-gate 		mutex_enter(&p->p_crlock);
15397c478bd9Sstevel@tonic-gate 		crhold(cr = p->p_cred);
15407c478bd9Sstevel@tonic-gate 		mutex_exit(&p->p_crlock);
15417c478bd9Sstevel@tonic-gate 		mutex_exit(&p->p_lock);
15427c478bd9Sstevel@tonic-gate 
15437c478bd9Sstevel@tonic-gate 		ainfo = crgetauinfo(cr);
15447c478bd9Sstevel@tonic-gate 		if (ainfo == NULL) {
15457c478bd9Sstevel@tonic-gate 			crfree(cr);
15467c478bd9Sstevel@tonic-gate 			au_uwrite(au_to_arg32(1, "process", (uint32_t)pid));
15477c478bd9Sstevel@tonic-gate 			return;
15487c478bd9Sstevel@tonic-gate 		}
15497c478bd9Sstevel@tonic-gate 
15507c478bd9Sstevel@tonic-gate 		uid  = crgetuid(cr);
15517c478bd9Sstevel@tonic-gate 		gid  = crgetgid(cr);
15527c478bd9Sstevel@tonic-gate 		ruid = crgetruid(cr);
15537c478bd9Sstevel@tonic-gate 		rgid = crgetrgid(cr);
15547c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_process(uid, gid, ruid, rgid, pid,
15557c478bd9Sstevel@tonic-gate 		    ainfo->ai_auid, ainfo->ai_asid, &ainfo->ai_termid));
155645916cd2Sjpk 
155745916cd2Sjpk 		if (is_system_labeled())
155845916cd2Sjpk 			au_uwrite(au_to_label(CR_SL(cr)));
155945916cd2Sjpk 
15607c478bd9Sstevel@tonic-gate 		crfree(cr);
15617c478bd9Sstevel@tonic-gate 	}
15627c478bd9Sstevel@tonic-gate 	else
15637c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "process", (uint32_t)pid));
15647c478bd9Sstevel@tonic-gate }
15657c478bd9Sstevel@tonic-gate 
15667c478bd9Sstevel@tonic-gate /*ARGSUSED*/
15677c478bd9Sstevel@tonic-gate static void
15687c478bd9Sstevel@tonic-gate aus_mkdir(struct t_audit_data *tad)
15697c478bd9Sstevel@tonic-gate {
15707c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
15717c478bd9Sstevel@tonic-gate 	uint32_t dmode;
15727c478bd9Sstevel@tonic-gate 
15737c478bd9Sstevel@tonic-gate 	struct a {
15747c478bd9Sstevel@tonic-gate 		long	dirnamep;		/* char * */
15757c478bd9Sstevel@tonic-gate 		long	dmode;
15767c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
15777c478bd9Sstevel@tonic-gate 
15787c478bd9Sstevel@tonic-gate 	dmode = (uint32_t)uap->dmode;
15797c478bd9Sstevel@tonic-gate 
15807c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(2, "mode", dmode));
15817c478bd9Sstevel@tonic-gate }
15827c478bd9Sstevel@tonic-gate 
1583794f0adbSRoger A. Faulkner /*ARGSUSED*/
1584794f0adbSRoger A. Faulkner static void
1585794f0adbSRoger A. Faulkner aus_mkdirat(struct t_audit_data *tad)
1586794f0adbSRoger A. Faulkner {
1587794f0adbSRoger A. Faulkner 	klwp_t *clwp = ttolwp(curthread);
1588794f0adbSRoger A. Faulkner 	uint32_t dmode;
1589794f0adbSRoger A. Faulkner 
1590794f0adbSRoger A. Faulkner 	struct a {
1591794f0adbSRoger A. Faulkner 		long	fd;
1592794f0adbSRoger A. Faulkner 		long	dirnamep;		/* char * */
1593794f0adbSRoger A. Faulkner 		long	dmode;
1594794f0adbSRoger A. Faulkner 	} *uap = (struct a *)clwp->lwp_ap;
1595794f0adbSRoger A. Faulkner 
1596794f0adbSRoger A. Faulkner 	dmode = (uint32_t)uap->dmode;
1597794f0adbSRoger A. Faulkner 
1598794f0adbSRoger A. Faulkner 	au_uwrite(au_to_arg32(2, "mode", dmode));
1599794f0adbSRoger A. Faulkner }
1600794f0adbSRoger A. Faulkner 
16017c478bd9Sstevel@tonic-gate /*ARGSUSED*/
16027c478bd9Sstevel@tonic-gate static void
16037c478bd9Sstevel@tonic-gate aus_mknod(struct t_audit_data *tad)
16047c478bd9Sstevel@tonic-gate {
16057c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
16067c478bd9Sstevel@tonic-gate 	uint32_t fmode;
16077c478bd9Sstevel@tonic-gate 	dev_t dev;
16087c478bd9Sstevel@tonic-gate 
16097c478bd9Sstevel@tonic-gate 	struct a {
16107c478bd9Sstevel@tonic-gate 		long	pnamep;		/* char * */
16117c478bd9Sstevel@tonic-gate 		long	fmode;
16127c478bd9Sstevel@tonic-gate 		long	dev;
16137c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
16147c478bd9Sstevel@tonic-gate 
16157c478bd9Sstevel@tonic-gate 	fmode = (uint32_t)uap->fmode;
16167c478bd9Sstevel@tonic-gate 	dev   = (dev_t)uap->dev;
16177c478bd9Sstevel@tonic-gate 
16187c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(2, "mode", fmode));
16197c478bd9Sstevel@tonic-gate #ifdef _LP64
16207c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg64(3, "dev", dev));
16217c478bd9Sstevel@tonic-gate #else
16227c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(3, "dev", dev));
16237c478bd9Sstevel@tonic-gate #endif
16247c478bd9Sstevel@tonic-gate }
16257c478bd9Sstevel@tonic-gate 
16267c478bd9Sstevel@tonic-gate /*ARGSUSED*/
16277c478bd9Sstevel@tonic-gate static void
16287c478bd9Sstevel@tonic-gate auf_mknod(struct t_audit_data *tad, int error, rval_t *rval)
16297c478bd9Sstevel@tonic-gate {
16307c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
16317c478bd9Sstevel@tonic-gate 	vnode_t	*dvp;
16327c478bd9Sstevel@tonic-gate 	caddr_t pnamep;
16337c478bd9Sstevel@tonic-gate 
16347c478bd9Sstevel@tonic-gate 	struct a {
16357c478bd9Sstevel@tonic-gate 		long	pnamep;		/* char * */
16367c478bd9Sstevel@tonic-gate 		long	fmode;
16377c478bd9Sstevel@tonic-gate 		long	dev;
16387c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
16397c478bd9Sstevel@tonic-gate 
16407c478bd9Sstevel@tonic-gate 	/* no error, then already path token in audit record */
1641794f0adbSRoger A. Faulkner 	if (error != EPERM && error != EINVAL)
16427c478bd9Sstevel@tonic-gate 		return;
16437c478bd9Sstevel@tonic-gate 
1644794f0adbSRoger A. Faulkner 	/* do the lookup to force generation of path token */
1645794f0adbSRoger A. Faulkner 	pnamep = (caddr_t)uap->pnamep;
1646794f0adbSRoger A. Faulkner 	tad->tad_ctrl |= TAD_NOATTRB;
1647794f0adbSRoger A. Faulkner 	error = lookupname(pnamep, UIO_USERSPACE, NO_FOLLOW, &dvp, NULLVPP);
1648794f0adbSRoger A. Faulkner 	if (error == 0)
1649794f0adbSRoger A. Faulkner 		VN_RELE(dvp);
1650794f0adbSRoger A. Faulkner }
1651794f0adbSRoger A. Faulkner 
1652794f0adbSRoger A. Faulkner /*ARGSUSED*/
1653794f0adbSRoger A. Faulkner static void
1654794f0adbSRoger A. Faulkner aus_mknodat(struct t_audit_data *tad)
1655794f0adbSRoger A. Faulkner {
1656794f0adbSRoger A. Faulkner 	klwp_t *clwp = ttolwp(curthread);
1657794f0adbSRoger A. Faulkner 	uint32_t fmode;
1658794f0adbSRoger A. Faulkner 	dev_t dev;
1659794f0adbSRoger A. Faulkner 
1660794f0adbSRoger A. Faulkner 	struct a {
1661794f0adbSRoger A. Faulkner 		long	fd;
1662794f0adbSRoger A. Faulkner 		long	pnamep;		/* char * */
1663794f0adbSRoger A. Faulkner 		long	fmode;
1664794f0adbSRoger A. Faulkner 		long	dev;
1665794f0adbSRoger A. Faulkner 	} *uap = (struct a *)clwp->lwp_ap;
1666794f0adbSRoger A. Faulkner 
1667794f0adbSRoger A. Faulkner 	fmode = (uint32_t)uap->fmode;
1668794f0adbSRoger A. Faulkner 	dev   = (dev_t)uap->dev;
1669794f0adbSRoger A. Faulkner 
1670794f0adbSRoger A. Faulkner 	au_uwrite(au_to_arg32(2, "mode", fmode));
1671794f0adbSRoger A. Faulkner #ifdef _LP64
1672794f0adbSRoger A. Faulkner 	au_uwrite(au_to_arg64(3, "dev", dev));
1673794f0adbSRoger A. Faulkner #else
1674794f0adbSRoger A. Faulkner 	au_uwrite(au_to_arg32(3, "dev", dev));
1675794f0adbSRoger A. Faulkner #endif
1676794f0adbSRoger A. Faulkner }
1677794f0adbSRoger A. Faulkner 
1678794f0adbSRoger A. Faulkner /*ARGSUSED*/
1679794f0adbSRoger A. Faulkner static void
1680794f0adbSRoger A. Faulkner auf_mknodat(struct t_audit_data *tad, int error, rval_t *rval)
1681794f0adbSRoger A. Faulkner {
1682794f0adbSRoger A. Faulkner 	klwp_t *clwp = ttolwp(curthread);
1683794f0adbSRoger A. Faulkner 	vnode_t	*startvp;
1684794f0adbSRoger A. Faulkner 	vnode_t	*dvp;
1685794f0adbSRoger A. Faulkner 	caddr_t pnamep;
1686794f0adbSRoger A. Faulkner 	int fd;
1687794f0adbSRoger A. Faulkner 
1688794f0adbSRoger A. Faulkner 	struct a {
1689794f0adbSRoger A. Faulkner 		long	fd;
1690794f0adbSRoger A. Faulkner 		long	pnamep;		/* char * */
1691794f0adbSRoger A. Faulkner 		long	fmode;
1692794f0adbSRoger A. Faulkner 		long	dev;
1693794f0adbSRoger A. Faulkner 	} *uap = (struct a *)clwp->lwp_ap;
1694794f0adbSRoger A. Faulkner 
1695794f0adbSRoger A. Faulkner 	/* no error, then already path token in audit record */
1696794f0adbSRoger A. Faulkner 	if (error != EPERM && error != EINVAL)
16977c478bd9Sstevel@tonic-gate 		return;
16987c478bd9Sstevel@tonic-gate 
16997c478bd9Sstevel@tonic-gate 	/* do the lookup to force generation of path token */
1700794f0adbSRoger A. Faulkner 	fd = (int)uap->fd;
17017c478bd9Sstevel@tonic-gate 	pnamep = (caddr_t)uap->pnamep;
1702794f0adbSRoger A. Faulkner 	if (pnamep == NULL ||
1703794f0adbSRoger A. Faulkner 	    fgetstartvp(fd, pnamep, &startvp) != 0)
1704794f0adbSRoger A. Faulkner 		return;
17054a0fa546SMarek Pospisil 	tad->tad_ctrl |= TAD_NOATTRB;
1706794f0adbSRoger A. Faulkner 	error = lookupnameat(pnamep, UIO_USERSPACE, NO_FOLLOW, &dvp, NULLVPP,
1707794f0adbSRoger A. Faulkner 	    startvp);
17087c478bd9Sstevel@tonic-gate 	if (error == 0)
17097c478bd9Sstevel@tonic-gate 		VN_RELE(dvp);
1710794f0adbSRoger A. Faulkner 	if (startvp != NULL)
1711794f0adbSRoger A. Faulkner 		VN_RELE(startvp);
17127c478bd9Sstevel@tonic-gate }
17137c478bd9Sstevel@tonic-gate 
17147c478bd9Sstevel@tonic-gate /*ARGSUSED*/
17157c478bd9Sstevel@tonic-gate static void
17167c478bd9Sstevel@tonic-gate aus_mount(struct t_audit_data *tad)
1717*0f48f68dSToomas Soome {
1718*0f48f68dSToomas Soome 	/* AUS_START */
17197c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
17207c478bd9Sstevel@tonic-gate 	uint32_t flags;
17217c478bd9Sstevel@tonic-gate 	uintptr_t u_fstype, dataptr;
17227c478bd9Sstevel@tonic-gate 	STRUCT_DECL(nfs_args, nfsargs);
17237c478bd9Sstevel@tonic-gate 	size_t len;
17247c478bd9Sstevel@tonic-gate 	char *fstype, *hostname;
17257c478bd9Sstevel@tonic-gate 
17267c478bd9Sstevel@tonic-gate 	struct a {
17277c478bd9Sstevel@tonic-gate 		long	spec;		/* char    * */
17287c478bd9Sstevel@tonic-gate 		long	dir;		/* char    * */
17297c478bd9Sstevel@tonic-gate 		long	flags;
17307c478bd9Sstevel@tonic-gate 		long	fstype;		/* char    * */
17317c478bd9Sstevel@tonic-gate 		long	dataptr;	/* char    * */
17327c478bd9Sstevel@tonic-gate 		long	datalen;
17337c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
17347c478bd9Sstevel@tonic-gate 
17357c478bd9Sstevel@tonic-gate 	u_fstype = (uintptr_t)uap->fstype;
17367c478bd9Sstevel@tonic-gate 	flags    = (uint32_t)uap->flags;
17377c478bd9Sstevel@tonic-gate 	dataptr  = (uintptr_t)uap->dataptr;
17387c478bd9Sstevel@tonic-gate 
17397c478bd9Sstevel@tonic-gate 	fstype = kmem_alloc(MAXNAMELEN, KM_SLEEP);
17407c478bd9Sstevel@tonic-gate 	if (copyinstr((caddr_t)u_fstype, (caddr_t)fstype, MAXNAMELEN, &len))
17417c478bd9Sstevel@tonic-gate 		goto mount_free_fstype;
17427c478bd9Sstevel@tonic-gate 
17437c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(3, "flags", flags));
17447c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_text(fstype));
17457c478bd9Sstevel@tonic-gate 
17467c478bd9Sstevel@tonic-gate 	if (strncmp(fstype, "nfs", 3) == 0) {
17477c478bd9Sstevel@tonic-gate 
17487c478bd9Sstevel@tonic-gate 		STRUCT_INIT(nfsargs, get_udatamodel());
17497c478bd9Sstevel@tonic-gate 		bzero(STRUCT_BUF(nfsargs), STRUCT_SIZE(nfsargs));
17507c478bd9Sstevel@tonic-gate 
1751*0f48f68dSToomas Soome 		if (copyin((caddr_t)dataptr, STRUCT_BUF(nfsargs),
1752*0f48f68dSToomas Soome 		    MIN(uap->datalen, STRUCT_SIZE(nfsargs)))) {
17537c478bd9Sstevel@tonic-gate 			/* DEBUG debug_enter((char *)NULL); */
17547c478bd9Sstevel@tonic-gate 			goto mount_free_fstype;
17557c478bd9Sstevel@tonic-gate 		}
17567c478bd9Sstevel@tonic-gate 		hostname = kmem_alloc(MAXNAMELEN, KM_SLEEP);
17577c478bd9Sstevel@tonic-gate 		if (copyinstr(STRUCT_FGETP(nfsargs, hostname),
1758*0f48f68dSToomas Soome 		    (caddr_t)hostname, MAXNAMELEN, &len)) {
17597c478bd9Sstevel@tonic-gate 			goto mount_free_hostname;
17607c478bd9Sstevel@tonic-gate 		}
17617c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_text(hostname));
17627c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(3, "internal flags",
1763*0f48f68dSToomas Soome 		    (uint_t)STRUCT_FGET(nfsargs, flags)));
17647c478bd9Sstevel@tonic-gate 
17657c478bd9Sstevel@tonic-gate mount_free_hostname:
17667c478bd9Sstevel@tonic-gate 		kmem_free(hostname, MAXNAMELEN);
17677c478bd9Sstevel@tonic-gate 	}
17687c478bd9Sstevel@tonic-gate 
17697c478bd9Sstevel@tonic-gate mount_free_fstype:
17707c478bd9Sstevel@tonic-gate 	kmem_free(fstype, MAXNAMELEN);
17717c478bd9Sstevel@tonic-gate }	/* AUS_MOUNT */
17727c478bd9Sstevel@tonic-gate 
17737c478bd9Sstevel@tonic-gate static void
17747c478bd9Sstevel@tonic-gate aus_umount_path(caddr_t umount_dir)
17757c478bd9Sstevel@tonic-gate {
17767c478bd9Sstevel@tonic-gate 	char			*dir_path;
17777c478bd9Sstevel@tonic-gate 	struct audit_path	*path;
17787c478bd9Sstevel@tonic-gate 	size_t			path_len, dir_len;
17797c478bd9Sstevel@tonic-gate 
17807c478bd9Sstevel@tonic-gate 	/* length alloc'd for two string pointers */
17817c478bd9Sstevel@tonic-gate 	path_len = sizeof (struct audit_path) + sizeof (char *);
17827c478bd9Sstevel@tonic-gate 	path = kmem_alloc(path_len, KM_SLEEP);
17837c478bd9Sstevel@tonic-gate 	dir_path = kmem_alloc(MAXPATHLEN, KM_SLEEP);
17847c478bd9Sstevel@tonic-gate 
17857c478bd9Sstevel@tonic-gate 	if (copyinstr(umount_dir, (caddr_t)dir_path,
17867c478bd9Sstevel@tonic-gate 	    MAXPATHLEN, &dir_len))
17877c478bd9Sstevel@tonic-gate 		goto umount2_free_dir;
17887c478bd9Sstevel@tonic-gate 
17897c478bd9Sstevel@tonic-gate 	/*
17907c478bd9Sstevel@tonic-gate 	 * the audit_path struct assumes that the buffer pointed to
17917c478bd9Sstevel@tonic-gate 	 * by audp_sect[n] contains string 0 immediatedly followed
17927c478bd9Sstevel@tonic-gate 	 * by string 1.
17937c478bd9Sstevel@tonic-gate 	 */
17947c478bd9Sstevel@tonic-gate 	path->audp_sect[0] = dir_path;
17957c478bd9Sstevel@tonic-gate 	path->audp_sect[1] = dir_path + strlen(dir_path) + 1;
17967c478bd9Sstevel@tonic-gate 	path->audp_size = path_len;
17977c478bd9Sstevel@tonic-gate 	path->audp_ref = 1;		/* not used */
17987c478bd9Sstevel@tonic-gate 	path->audp_cnt = 1;		/* one path string */
17997c478bd9Sstevel@tonic-gate 
18007c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_path(path));
18017c478bd9Sstevel@tonic-gate 
18027c478bd9Sstevel@tonic-gate umount2_free_dir:
18037c478bd9Sstevel@tonic-gate 	kmem_free(dir_path, MAXPATHLEN);
18047c478bd9Sstevel@tonic-gate 	kmem_free(path, path_len);
18057c478bd9Sstevel@tonic-gate }
18067c478bd9Sstevel@tonic-gate 
18077c478bd9Sstevel@tonic-gate /*ARGSUSED*/
18087c478bd9Sstevel@tonic-gate static void
18097c478bd9Sstevel@tonic-gate aus_umount2(struct t_audit_data *tad)
18107c478bd9Sstevel@tonic-gate {
18117c478bd9Sstevel@tonic-gate 	klwp_t			*clwp = ttolwp(curthread);
18127c478bd9Sstevel@tonic-gate 	struct a {
18137c478bd9Sstevel@tonic-gate 		long	dir;		/* char    * */
18147c478bd9Sstevel@tonic-gate 		long	flags;
18157c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
18167c478bd9Sstevel@tonic-gate 
18177c478bd9Sstevel@tonic-gate 	aus_umount_path((caddr_t)uap->dir);
18187c478bd9Sstevel@tonic-gate 
18197c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(2, "flags", (uint32_t)uap->flags));
18207c478bd9Sstevel@tonic-gate }
18217c478bd9Sstevel@tonic-gate 
18227c478bd9Sstevel@tonic-gate static void
18237c478bd9Sstevel@tonic-gate aus_msgsys(struct t_audit_data *tad)
18247c478bd9Sstevel@tonic-gate {
18257c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
18267c478bd9Sstevel@tonic-gate 	uint32_t msgid;
18277c478bd9Sstevel@tonic-gate 
18287c478bd9Sstevel@tonic-gate 	struct b {
18297c478bd9Sstevel@tonic-gate 		long	msgid;
18307c478bd9Sstevel@tonic-gate 		long	cmd;
18317c478bd9Sstevel@tonic-gate 		long	buf;		/* struct msqid_ds * */
18327c478bd9Sstevel@tonic-gate 	} *uap1 = (struct b *)&clwp->lwp_ap[1];
18337c478bd9Sstevel@tonic-gate 
18347c478bd9Sstevel@tonic-gate 	msgid = (uint32_t)uap1->msgid;
18357c478bd9Sstevel@tonic-gate 
18367c478bd9Sstevel@tonic-gate 
18377c478bd9Sstevel@tonic-gate 	switch (tad->tad_event) {
18387c478bd9Sstevel@tonic-gate 	case AUE_MSGGET:		/* msgget */
18397c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "msg key", msgid));
18407c478bd9Sstevel@tonic-gate 		break;
18417c478bd9Sstevel@tonic-gate 	case AUE_MSGCTL:		/* msgctl */
18427c478bd9Sstevel@tonic-gate 	case AUE_MSGCTL_RMID:		/* msgctl */
1843f158b2dfSJan Friedel 	case AUE_MSGCTL_SET:		/* msgctl */
18447c478bd9Sstevel@tonic-gate 	case AUE_MSGCTL_STAT:		/* msgctl */
18457c478bd9Sstevel@tonic-gate 	case AUE_MSGRCV:		/* msgrcv */
18467c478bd9Sstevel@tonic-gate 	case AUE_MSGSND:		/* msgsnd */
18477c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "msg ID", msgid));
18487c478bd9Sstevel@tonic-gate 		break;
18497c478bd9Sstevel@tonic-gate 	}
18507c478bd9Sstevel@tonic-gate }
18517c478bd9Sstevel@tonic-gate 
18527c478bd9Sstevel@tonic-gate /*ARGSUSED*/
18537c478bd9Sstevel@tonic-gate static void
18547c478bd9Sstevel@tonic-gate auf_msgsys(struct t_audit_data *tad, int error, rval_t *rval)
18557c478bd9Sstevel@tonic-gate {
18567c478bd9Sstevel@tonic-gate 	int id;
18577c478bd9Sstevel@tonic-gate 
18587c478bd9Sstevel@tonic-gate 	if (error != 0)
18597c478bd9Sstevel@tonic-gate 		return;
18607c478bd9Sstevel@tonic-gate 	if (tad->tad_event == AUE_MSGGET) {
18617c478bd9Sstevel@tonic-gate 		uint32_t scid;
18627c478bd9Sstevel@tonic-gate 		uint32_t sy_flags;
18637c478bd9Sstevel@tonic-gate 
18647c478bd9Sstevel@tonic-gate 		/* need to determine type of executing binary */
18657c478bd9Sstevel@tonic-gate 		scid = tad->tad_scid;
18667c478bd9Sstevel@tonic-gate #ifdef _SYSCALL32_IMPL
18677c478bd9Sstevel@tonic-gate 		if (lwp_getdatamodel(ttolwp(curthread)) == DATAMODEL_NATIVE)
18687c478bd9Sstevel@tonic-gate 			sy_flags = sysent[scid].sy_flags & SE_RVAL_MASK;
18697c478bd9Sstevel@tonic-gate 		else
18707c478bd9Sstevel@tonic-gate 			sy_flags = sysent32[scid].sy_flags & SE_RVAL_MASK;
18717c478bd9Sstevel@tonic-gate #else
18727c478bd9Sstevel@tonic-gate 		sy_flags = sysent[scid].sy_flags & SE_RVAL_MASK;
18737c478bd9Sstevel@tonic-gate #endif
18747c478bd9Sstevel@tonic-gate 		if (sy_flags == SE_32RVAL1)
18757c478bd9Sstevel@tonic-gate 			id = rval->r_val1;
18767c478bd9Sstevel@tonic-gate 		if (sy_flags == (SE_32RVAL2|SE_32RVAL1))
18777c478bd9Sstevel@tonic-gate 			id = rval->r_val1;
18787c478bd9Sstevel@tonic-gate 		if (sy_flags == SE_64RVAL)
18797c478bd9Sstevel@tonic-gate 			id = (int)rval->r_vals;
18807c478bd9Sstevel@tonic-gate 
18817c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_ipc(AT_IPC_MSG, id));
18827c478bd9Sstevel@tonic-gate 	}
18837c478bd9Sstevel@tonic-gate }
18847c478bd9Sstevel@tonic-gate 
18857c478bd9Sstevel@tonic-gate static void
18867c478bd9Sstevel@tonic-gate aus_semsys(struct t_audit_data *tad)
18877c478bd9Sstevel@tonic-gate {
18887c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
18897c478bd9Sstevel@tonic-gate 	uint32_t semid;
18907c478bd9Sstevel@tonic-gate 
18917c478bd9Sstevel@tonic-gate 	struct b {		/* ctrl */
18927c478bd9Sstevel@tonic-gate 		long	semid;
18937c478bd9Sstevel@tonic-gate 		long	semnum;
18947c478bd9Sstevel@tonic-gate 		long	cmd;
18957c478bd9Sstevel@tonic-gate 		long	arg;
18967c478bd9Sstevel@tonic-gate 	} *uap1 = (struct b *)&clwp->lwp_ap[1];
18977c478bd9Sstevel@tonic-gate 
18987c478bd9Sstevel@tonic-gate 	semid = (uint32_t)uap1->semid;
18997c478bd9Sstevel@tonic-gate 
19007c478bd9Sstevel@tonic-gate 	switch (tad->tad_event) {
19017c478bd9Sstevel@tonic-gate 	case AUE_SEMCTL_RMID:
19027c478bd9Sstevel@tonic-gate 	case AUE_SEMCTL_STAT:
19037c478bd9Sstevel@tonic-gate 	case AUE_SEMCTL_GETNCNT:
19047c478bd9Sstevel@tonic-gate 	case AUE_SEMCTL_GETPID:
19057c478bd9Sstevel@tonic-gate 	case AUE_SEMCTL_GETVAL:
19067c478bd9Sstevel@tonic-gate 	case AUE_SEMCTL_GETALL:
19077c478bd9Sstevel@tonic-gate 	case AUE_SEMCTL_GETZCNT:
1908f158b2dfSJan Friedel 	case AUE_SEMCTL_SET:
19097c478bd9Sstevel@tonic-gate 	case AUE_SEMCTL_SETVAL:
19107c478bd9Sstevel@tonic-gate 	case AUE_SEMCTL_SETALL:
19117c478bd9Sstevel@tonic-gate 	case AUE_SEMCTL:
19127c478bd9Sstevel@tonic-gate 	case AUE_SEMOP:
19137c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "sem ID", semid));
19147c478bd9Sstevel@tonic-gate 		break;
19157c478bd9Sstevel@tonic-gate 	case AUE_SEMGET:
19167c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "sem key", semid));
19177c478bd9Sstevel@tonic-gate 		break;
19187c478bd9Sstevel@tonic-gate 	}
19197c478bd9Sstevel@tonic-gate }
19207c478bd9Sstevel@tonic-gate 
19217c478bd9Sstevel@tonic-gate /*ARGSUSED*/
19227c478bd9Sstevel@tonic-gate static void
19237c478bd9Sstevel@tonic-gate auf_semsys(struct t_audit_data *tad, int error, rval_t *rval)
19247c478bd9Sstevel@tonic-gate {
19257c478bd9Sstevel@tonic-gate 	int id;
19267c478bd9Sstevel@tonic-gate 
19277c478bd9Sstevel@tonic-gate 	if (error != 0)
19287c478bd9Sstevel@tonic-gate 		return;
19297c478bd9Sstevel@tonic-gate 	if (tad->tad_event == AUE_SEMGET) {
19307c478bd9Sstevel@tonic-gate 		uint32_t scid;
19317c478bd9Sstevel@tonic-gate 		uint32_t sy_flags;
19327c478bd9Sstevel@tonic-gate 
19337c478bd9Sstevel@tonic-gate 		/* need to determine type of executing binary */
19347c478bd9Sstevel@tonic-gate 		scid = tad->tad_scid;
19357c478bd9Sstevel@tonic-gate #ifdef _SYSCALL32_IMPL
19367c478bd9Sstevel@tonic-gate 		if (lwp_getdatamodel(ttolwp(curthread)) == DATAMODEL_NATIVE)
19377c478bd9Sstevel@tonic-gate 			sy_flags = sysent[scid].sy_flags & SE_RVAL_MASK;
19387c478bd9Sstevel@tonic-gate 		else
19397c478bd9Sstevel@tonic-gate 			sy_flags = sysent32[scid].sy_flags & SE_RVAL_MASK;
19407c478bd9Sstevel@tonic-gate #else
19417c478bd9Sstevel@tonic-gate 		sy_flags = sysent[scid].sy_flags & SE_RVAL_MASK;
19427c478bd9Sstevel@tonic-gate #endif
19437c478bd9Sstevel@tonic-gate 		if (sy_flags == SE_32RVAL1)
19447c478bd9Sstevel@tonic-gate 			id = rval->r_val1;
19457c478bd9Sstevel@tonic-gate 		if (sy_flags == (SE_32RVAL2|SE_32RVAL1))
19467c478bd9Sstevel@tonic-gate 			id = rval->r_val1;
19477c478bd9Sstevel@tonic-gate 		if (sy_flags == SE_64RVAL)
19487c478bd9Sstevel@tonic-gate 			id = (int)rval->r_vals;
19497c478bd9Sstevel@tonic-gate 
19507c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_ipc(AT_IPC_SEM, id));
19517c478bd9Sstevel@tonic-gate 	}
19527c478bd9Sstevel@tonic-gate }
19537c478bd9Sstevel@tonic-gate 
19547c478bd9Sstevel@tonic-gate /*ARGSUSED*/
19557c478bd9Sstevel@tonic-gate static void
19567c478bd9Sstevel@tonic-gate aus_close(struct t_audit_data *tad)
19577c478bd9Sstevel@tonic-gate {
19587c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
19597c478bd9Sstevel@tonic-gate 	uint32_t fd;
19607c478bd9Sstevel@tonic-gate 	struct file *fp;
19617c478bd9Sstevel@tonic-gate 	struct f_audit_data *fad;
19627c478bd9Sstevel@tonic-gate 	struct vnode *vp;
19637c478bd9Sstevel@tonic-gate 	struct vattr attr;
19649e9e6ab8Spaulson 	au_kcontext_t	*kctx = GET_KCTX_PZ;
19657c478bd9Sstevel@tonic-gate 
19667c478bd9Sstevel@tonic-gate 	struct a {
19677c478bd9Sstevel@tonic-gate 		long	i;
19687c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
19697c478bd9Sstevel@tonic-gate 
19707c478bd9Sstevel@tonic-gate 	fd = (uint32_t)uap->i;
19717c478bd9Sstevel@tonic-gate 
19727c478bd9Sstevel@tonic-gate 	attr.va_mask = 0;
19737c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(1, "fd", fd));
19747c478bd9Sstevel@tonic-gate 
19757c478bd9Sstevel@tonic-gate 		/*
19767c478bd9Sstevel@tonic-gate 		 * convert file pointer to file descriptor
19777c478bd9Sstevel@tonic-gate 		 *   Note: fd ref count incremented here.
19787c478bd9Sstevel@tonic-gate 		 */
19797c478bd9Sstevel@tonic-gate 	if ((fp = getf(fd)) == NULL)
19807c478bd9Sstevel@tonic-gate 		return;
19817c478bd9Sstevel@tonic-gate 
19827c478bd9Sstevel@tonic-gate 	fad = F2A(fp);
1983d0fa49b7STony Nguyen 	tad->tad_evmod = (au_emod_t)fad->fad_flags;
19847c478bd9Sstevel@tonic-gate 	if (fad->fad_aupath != NULL) {
19857c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_path(fad->fad_aupath));
19867c478bd9Sstevel@tonic-gate 		if ((vp = fp->f_vnode) != NULL) {
19877c478bd9Sstevel@tonic-gate 			attr.va_mask = AT_ALL;
1988da6c28aaSamw 			if (VOP_GETATTR(vp, &attr, 0, CRED(), NULL) == 0) {
19897c478bd9Sstevel@tonic-gate 				/*
19907c478bd9Sstevel@tonic-gate 				 * When write was not used and the file can be
19917c478bd9Sstevel@tonic-gate 				 * considered public, skip the audit.
19927c478bd9Sstevel@tonic-gate 				 */
19937c478bd9Sstevel@tonic-gate 				if (((fp->f_flag & FWRITE) == 0) &&
19944a0fa546SMarek Pospisil 				    object_is_public(&attr)) {
19957c478bd9Sstevel@tonic-gate 					tad->tad_flag = 0;
19967c478bd9Sstevel@tonic-gate 					tad->tad_evmod = 0;
19977c478bd9Sstevel@tonic-gate 					/* free any residual audit data */
1998005d3febSMarek Pospisil 					au_close(kctx, &(u_ad), 0, 0, 0, NULL);
19997c478bd9Sstevel@tonic-gate 					releasef(fd);
20007c478bd9Sstevel@tonic-gate 					return;
20017c478bd9Sstevel@tonic-gate 				}
200245916cd2Sjpk 				au_uwrite(au_to_attr(&attr));
200345916cd2Sjpk 				audit_sec_attributes(&(u_ad), vp);
20047c478bd9Sstevel@tonic-gate 			}
20057c478bd9Sstevel@tonic-gate 		}
20067c478bd9Sstevel@tonic-gate 	}
20077c478bd9Sstevel@tonic-gate 
20087c478bd9Sstevel@tonic-gate 	/* decrement file descriptor reference count */
20097c478bd9Sstevel@tonic-gate 	releasef(fd);
20107c478bd9Sstevel@tonic-gate }
20117c478bd9Sstevel@tonic-gate 
20127c478bd9Sstevel@tonic-gate /*ARGSUSED*/
20137c478bd9Sstevel@tonic-gate static void
20147c478bd9Sstevel@tonic-gate aus_fstatfs(struct t_audit_data *tad)
20157c478bd9Sstevel@tonic-gate {
20167c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
20177c478bd9Sstevel@tonic-gate 	uint32_t fd;
20187c478bd9Sstevel@tonic-gate 	struct file  *fp;
20197c478bd9Sstevel@tonic-gate 	struct vnode *vp;
20207c478bd9Sstevel@tonic-gate 	struct f_audit_data *fad;
20217c478bd9Sstevel@tonic-gate 
20227c478bd9Sstevel@tonic-gate 	struct a {
20237c478bd9Sstevel@tonic-gate 		long	fd;
20247c478bd9Sstevel@tonic-gate 		long	buf;		/* struct statfs * */
20257c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
20267c478bd9Sstevel@tonic-gate 
20277c478bd9Sstevel@tonic-gate 	fd = (uint_t)uap->fd;
20287c478bd9Sstevel@tonic-gate 
20297c478bd9Sstevel@tonic-gate 		/*
20307c478bd9Sstevel@tonic-gate 		 * convert file pointer to file descriptor
20317c478bd9Sstevel@tonic-gate 		 *   Note: fd ref count incremented here.
20327c478bd9Sstevel@tonic-gate 		 */
20337c478bd9Sstevel@tonic-gate 	if ((fp = getf(fd)) == NULL)
20347c478bd9Sstevel@tonic-gate 		return;
20357c478bd9Sstevel@tonic-gate 
20367c478bd9Sstevel@tonic-gate 		/* get path from file struct here */
20377c478bd9Sstevel@tonic-gate 	fad = F2A(fp);
20387c478bd9Sstevel@tonic-gate 	if (fad->fad_aupath != NULL) {
20397c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_path(fad->fad_aupath));
20407c478bd9Sstevel@tonic-gate 	} else {
20417c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "no path: fd", fd));
20427c478bd9Sstevel@tonic-gate 	}
20437c478bd9Sstevel@tonic-gate 
20447c478bd9Sstevel@tonic-gate 	vp = fp->f_vnode;
20457c478bd9Sstevel@tonic-gate 	audit_attributes(vp);
20467c478bd9Sstevel@tonic-gate 
20477c478bd9Sstevel@tonic-gate 	/* decrement file descriptor reference count */
20487c478bd9Sstevel@tonic-gate 	releasef(fd);
20497c478bd9Sstevel@tonic-gate }
20507c478bd9Sstevel@tonic-gate 
20514be8c573SJan Friedel static au_event_t
20524be8c573SJan Friedel aui_setpgrp(au_event_t e)
20534be8c573SJan Friedel {
20544be8c573SJan Friedel 	klwp_t *clwp = ttolwp(curthread);
20554be8c573SJan Friedel 	int flag;
20564be8c573SJan Friedel 
20574be8c573SJan Friedel 	struct a {
20584be8c573SJan Friedel 		long	flag;
20594be8c573SJan Friedel 		long	pid;
20604be8c573SJan Friedel 		long	pgid;
20614be8c573SJan Friedel 	} *uap = (struct a *)clwp->lwp_ap;
20624be8c573SJan Friedel 
20634be8c573SJan Friedel 	flag = (int)uap->flag;
20644be8c573SJan Friedel 
20654be8c573SJan Friedel 
20664be8c573SJan Friedel 	switch (flag) {
20674be8c573SJan Friedel 
20684be8c573SJan Friedel 	case 1:	/* setpgrp() */
20694be8c573SJan Friedel 		e = AUE_SETPGRP;
20704be8c573SJan Friedel 		break;
20714be8c573SJan Friedel 
20724be8c573SJan Friedel 	case 3: /* setsid() */
20734be8c573SJan Friedel 		e = AUE_SETSID;
20744be8c573SJan Friedel 		break;
20754be8c573SJan Friedel 
20764be8c573SJan Friedel 	case 5: /* setpgid() */
20774be8c573SJan Friedel 		e = AUE_SETPGID;
20784be8c573SJan Friedel 		break;
20794be8c573SJan Friedel 
20804be8c573SJan Friedel 	case 0: /* getpgrp()	- not security relevant */
20814be8c573SJan Friedel 	case 2: /* getsid()	- not security relevant */
2082*0f48f68dSToomas Soome 	case 4: /* getpgid()	- not security relevant */
20834be8c573SJan Friedel 		e = AUE_NULL;
20844be8c573SJan Friedel 		break;
20854be8c573SJan Friedel 
20864be8c573SJan Friedel 	default:
20874be8c573SJan Friedel 		e = AUE_NULL;
20884be8c573SJan Friedel 		break;
20894be8c573SJan Friedel 	}
20904be8c573SJan Friedel 
20914be8c573SJan Friedel 	return (e);
20924be8c573SJan Friedel }
20934be8c573SJan Friedel 
209445a9a7b1SJan Friedel /*ARGSUSED*/
20957c478bd9Sstevel@tonic-gate static void
20967c478bd9Sstevel@tonic-gate aus_setpgrp(struct t_audit_data *tad)
20977c478bd9Sstevel@tonic-gate {
20984be8c573SJan Friedel 	klwp_t		*clwp = ttolwp(curthread);
20994be8c573SJan Friedel 	pid_t		pgid;
21004be8c573SJan Friedel 	struct proc	*p;
21014be8c573SJan Friedel 	uid_t		uid, ruid;
21024be8c573SJan Friedel 	gid_t		gid, rgid;
21034be8c573SJan Friedel 	pid_t		pid;
21044be8c573SJan Friedel 	cred_t		*cr;
21054be8c573SJan Friedel 	int		flag;
21064be8c573SJan Friedel 	const auditinfo_addr_t	*ainfo;
21077c478bd9Sstevel@tonic-gate 
21087c478bd9Sstevel@tonic-gate 	struct a {
21094be8c573SJan Friedel 		long	flag;
21107c478bd9Sstevel@tonic-gate 		long	pid;
21114be8c573SJan Friedel 		long	pgid;
21127c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
21137c478bd9Sstevel@tonic-gate 
21144be8c573SJan Friedel 	flag = (int)uap->flag;
21157c478bd9Sstevel@tonic-gate 	pid  = (pid_t)uap->pid;
21164be8c573SJan Friedel 	pgid = (pid_t)uap->pgid;
21174be8c573SJan Friedel 
21184be8c573SJan Friedel 
21194be8c573SJan Friedel 	switch (flag) {
21204be8c573SJan Friedel 
21214be8c573SJan Friedel 	case 0: /* getpgrp() */
21224be8c573SJan Friedel 	case 1: /* setpgrp() */
21234be8c573SJan Friedel 	case 2: /* getsid() */
21244be8c573SJan Friedel 	case 3: /* setsid() */
21254be8c573SJan Friedel 	case 4: /* getpgid() */
21264be8c573SJan Friedel 		break;
21274be8c573SJan Friedel 
21284be8c573SJan Friedel 	case 5: /* setpgid() */
21297c478bd9Sstevel@tonic-gate 
21307c478bd9Sstevel@tonic-gate 		/* current process? */
21314be8c573SJan Friedel 		if (pid == 0) {
21324be8c573SJan Friedel 			return;
21334be8c573SJan Friedel 		}
21347c478bd9Sstevel@tonic-gate 
21354be8c573SJan Friedel 		mutex_enter(&pidlock);
21364be8c573SJan Friedel 		p = prfind(pid);
21374be8c573SJan Friedel 		if (p == NULL || p->p_as == &kas ||
21384be8c573SJan Friedel 		    p->p_stat == SIDL || p->p_stat == SZOMB) {
21394be8c573SJan Friedel 			mutex_exit(&pidlock);
21404be8c573SJan Friedel 			return;
21414be8c573SJan Friedel 		}
21424be8c573SJan Friedel 		mutex_enter(&p->p_lock);	/* so process doesn't go away */
21437c478bd9Sstevel@tonic-gate 		mutex_exit(&pidlock);
21447c478bd9Sstevel@tonic-gate 
21454be8c573SJan Friedel 		mutex_enter(&p->p_crlock);
21464be8c573SJan Friedel 		crhold(cr = p->p_cred);
21474be8c573SJan Friedel 		mutex_exit(&p->p_crlock);
21484be8c573SJan Friedel 		mutex_exit(&p->p_lock);
21494be8c573SJan Friedel 
21504be8c573SJan Friedel 		ainfo = crgetauinfo(cr);
21514be8c573SJan Friedel 		if (ainfo == NULL) {
21524be8c573SJan Friedel 			crfree(cr);
21534be8c573SJan Friedel 			return;
21544be8c573SJan Friedel 		}
21557c478bd9Sstevel@tonic-gate 
21564be8c573SJan Friedel 		uid  = crgetuid(cr);
21574be8c573SJan Friedel 		gid  = crgetgid(cr);
21584be8c573SJan Friedel 		ruid = crgetruid(cr);
21594be8c573SJan Friedel 		rgid = crgetrgid(cr);
21604be8c573SJan Friedel 		au_uwrite(au_to_process(uid, gid, ruid, rgid, pid,
21614be8c573SJan Friedel 		    ainfo->ai_auid, ainfo->ai_asid, &ainfo->ai_termid));
21627c478bd9Sstevel@tonic-gate 		crfree(cr);
21634be8c573SJan Friedel 		au_uwrite(au_to_arg32(2, "pgid", pgid));
21644be8c573SJan Friedel 		break;
21657c478bd9Sstevel@tonic-gate 
21664be8c573SJan Friedel 	default:
21674be8c573SJan Friedel 		break;
21684be8c573SJan Friedel 	}
21697c478bd9Sstevel@tonic-gate }
21704be8c573SJan Friedel 
21717c478bd9Sstevel@tonic-gate 
21727c478bd9Sstevel@tonic-gate /*ARGSUSED*/
21737c478bd9Sstevel@tonic-gate static void
21747c478bd9Sstevel@tonic-gate aus_setregid(struct t_audit_data *tad)
21757c478bd9Sstevel@tonic-gate {
21767c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
21777c478bd9Sstevel@tonic-gate 	uint32_t rgid, egid;
21787c478bd9Sstevel@tonic-gate 
21797c478bd9Sstevel@tonic-gate 	struct a {
21807c478bd9Sstevel@tonic-gate 		long	 rgid;
21817c478bd9Sstevel@tonic-gate 		long	 egid;
21827c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
21837c478bd9Sstevel@tonic-gate 
21847c478bd9Sstevel@tonic-gate 	rgid  = (uint32_t)uap->rgid;
21857c478bd9Sstevel@tonic-gate 	egid  = (uint32_t)uap->egid;
21867c478bd9Sstevel@tonic-gate 
21877c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(1, "rgid", rgid));
21887c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(2, "egid", egid));
21897c478bd9Sstevel@tonic-gate }
21907c478bd9Sstevel@tonic-gate 
21917c478bd9Sstevel@tonic-gate /*ARGSUSED*/
21927c478bd9Sstevel@tonic-gate static void
21937c478bd9Sstevel@tonic-gate aus_setgid(struct t_audit_data *tad)
21947c478bd9Sstevel@tonic-gate {
21957c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
21967c478bd9Sstevel@tonic-gate 	uint32_t gid;
21977c478bd9Sstevel@tonic-gate 
21987c478bd9Sstevel@tonic-gate 	struct a {
21997c478bd9Sstevel@tonic-gate 		long	gid;
22007c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
22017c478bd9Sstevel@tonic-gate 
22027c478bd9Sstevel@tonic-gate 	gid = (uint32_t)uap->gid;
22037c478bd9Sstevel@tonic-gate 
22047c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(1, "gid", gid));
22057c478bd9Sstevel@tonic-gate }
22067c478bd9Sstevel@tonic-gate 
22077c478bd9Sstevel@tonic-gate 
22087c478bd9Sstevel@tonic-gate /*ARGSUSED*/
22097c478bd9Sstevel@tonic-gate static void
22107c478bd9Sstevel@tonic-gate aus_setreuid(struct t_audit_data *tad)
22117c478bd9Sstevel@tonic-gate {
22127c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
22137c478bd9Sstevel@tonic-gate 	uint32_t ruid, euid;
22147c478bd9Sstevel@tonic-gate 
22157c478bd9Sstevel@tonic-gate 	struct a {
22167c478bd9Sstevel@tonic-gate 		long	ruid;
22177c478bd9Sstevel@tonic-gate 		long	euid;
22187c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
22197c478bd9Sstevel@tonic-gate 
22207c478bd9Sstevel@tonic-gate 	ruid = (uint32_t)uap->ruid;
22217c478bd9Sstevel@tonic-gate 	euid  = (uint32_t)uap->euid;
22227c478bd9Sstevel@tonic-gate 
22237c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(1, "ruid", ruid));
22247c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(2, "euid", euid));
22257c478bd9Sstevel@tonic-gate }
22267c478bd9Sstevel@tonic-gate 
22277c478bd9Sstevel@tonic-gate 
22287c478bd9Sstevel@tonic-gate /*ARGSUSED*/
22297c478bd9Sstevel@tonic-gate static void
22307c478bd9Sstevel@tonic-gate aus_setuid(struct t_audit_data *tad)
22317c478bd9Sstevel@tonic-gate {
22327c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
22337c478bd9Sstevel@tonic-gate 	uint32_t uid;
22347c478bd9Sstevel@tonic-gate 
22357c478bd9Sstevel@tonic-gate 	struct a {
22367c478bd9Sstevel@tonic-gate 		long	uid;
22377c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
22387c478bd9Sstevel@tonic-gate 
22397c478bd9Sstevel@tonic-gate 	uid = (uint32_t)uap->uid;
22407c478bd9Sstevel@tonic-gate 
22417c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(1, "uid", uid));
22427c478bd9Sstevel@tonic-gate }
22437c478bd9Sstevel@tonic-gate 
22447c478bd9Sstevel@tonic-gate /*ARGSUSED*/
22457c478bd9Sstevel@tonic-gate static void
22467c478bd9Sstevel@tonic-gate aus_shmsys(struct t_audit_data *tad)
22477c478bd9Sstevel@tonic-gate {
22487c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
22497c478bd9Sstevel@tonic-gate 	uint32_t id, cmd;
22507c478bd9Sstevel@tonic-gate 
22517c478bd9Sstevel@tonic-gate 	struct b {
22527c478bd9Sstevel@tonic-gate 		long	id;
22537c478bd9Sstevel@tonic-gate 		long	cmd;
22547c478bd9Sstevel@tonic-gate 		long	buf;		/* struct shmid_ds * */
22557c478bd9Sstevel@tonic-gate 	} *uap1 = (struct b *)&clwp->lwp_ap[1];
22567c478bd9Sstevel@tonic-gate 
22577c478bd9Sstevel@tonic-gate 	id  = (uint32_t)uap1->id;
22587c478bd9Sstevel@tonic-gate 	cmd = (uint32_t)uap1->cmd;
22597c478bd9Sstevel@tonic-gate 
22607c478bd9Sstevel@tonic-gate 	switch (tad->tad_event) {
22617c478bd9Sstevel@tonic-gate 	case AUE_SHMGET:			/* shmget */
22627c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "shm key", id));
22637c478bd9Sstevel@tonic-gate 		break;
22647c478bd9Sstevel@tonic-gate 	case AUE_SHMCTL:			/* shmctl */
22657c478bd9Sstevel@tonic-gate 	case AUE_SHMCTL_RMID:			/* shmctl */
22667c478bd9Sstevel@tonic-gate 	case AUE_SHMCTL_STAT:			/* shmctl */
22677c478bd9Sstevel@tonic-gate 	case AUE_SHMCTL_SET:			/* shmctl */
22687c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "shm ID", id));
22697c478bd9Sstevel@tonic-gate 		break;
22707c478bd9Sstevel@tonic-gate 	case AUE_SHMDT:				/* shmdt */
22717c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "shm adr", id));
22727c478bd9Sstevel@tonic-gate 		break;
22737c478bd9Sstevel@tonic-gate 	case AUE_SHMAT:				/* shmat */
22747c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "shm ID", id));
22757c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(2, "shm adr", cmd));
22767c478bd9Sstevel@tonic-gate 		break;
22777c478bd9Sstevel@tonic-gate 	}
22787c478bd9Sstevel@tonic-gate }
22797c478bd9Sstevel@tonic-gate 
22807c478bd9Sstevel@tonic-gate /*ARGSUSED*/
22817c478bd9Sstevel@tonic-gate static void
22827c478bd9Sstevel@tonic-gate auf_shmsys(struct t_audit_data *tad, int error, rval_t *rval)
22837c478bd9Sstevel@tonic-gate {
22847c478bd9Sstevel@tonic-gate 	int id;
22857c478bd9Sstevel@tonic-gate 
22867c478bd9Sstevel@tonic-gate 	if (error != 0)
22877c478bd9Sstevel@tonic-gate 		return;
22887c478bd9Sstevel@tonic-gate 	if (tad->tad_event == AUE_SHMGET) {
22897c478bd9Sstevel@tonic-gate 		uint32_t scid;
22907c478bd9Sstevel@tonic-gate 		uint32_t sy_flags;
22917c478bd9Sstevel@tonic-gate 
22927c478bd9Sstevel@tonic-gate 		/* need to determine type of executing binary */
22937c478bd9Sstevel@tonic-gate 		scid = tad->tad_scid;
22947c478bd9Sstevel@tonic-gate #ifdef _SYSCALL32_IMPL
22957c478bd9Sstevel@tonic-gate 		if (lwp_getdatamodel(ttolwp(curthread)) == DATAMODEL_NATIVE)
22967c478bd9Sstevel@tonic-gate 			sy_flags = sysent[scid].sy_flags & SE_RVAL_MASK;
22977c478bd9Sstevel@tonic-gate 		else
22987c478bd9Sstevel@tonic-gate 			sy_flags = sysent32[scid].sy_flags & SE_RVAL_MASK;
22997c478bd9Sstevel@tonic-gate #else
23007c478bd9Sstevel@tonic-gate 		sy_flags = sysent[scid].sy_flags & SE_RVAL_MASK;
23017c478bd9Sstevel@tonic-gate #endif
23027c478bd9Sstevel@tonic-gate 		if (sy_flags == SE_32RVAL1)
23037c478bd9Sstevel@tonic-gate 			id = rval->r_val1;
23047c478bd9Sstevel@tonic-gate 		if (sy_flags == (SE_32RVAL2|SE_32RVAL1))
23057c478bd9Sstevel@tonic-gate 			id = rval->r_val1;
23067c478bd9Sstevel@tonic-gate 		if (sy_flags == SE_64RVAL)
23077c478bd9Sstevel@tonic-gate 			id = (int)rval->r_vals;
23087c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_ipc(AT_IPC_SHM, id));
23097c478bd9Sstevel@tonic-gate 	}
23107c478bd9Sstevel@tonic-gate }
23117c478bd9Sstevel@tonic-gate 
23127c478bd9Sstevel@tonic-gate 
23137c478bd9Sstevel@tonic-gate /*ARGSUSED*/
23147c478bd9Sstevel@tonic-gate static void
23157c478bd9Sstevel@tonic-gate aus_ioctl(struct t_audit_data *tad)
23167c478bd9Sstevel@tonic-gate {
23177c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
23187c478bd9Sstevel@tonic-gate 	struct file *fp;
23197c478bd9Sstevel@tonic-gate 	struct vnode *vp;
23207c478bd9Sstevel@tonic-gate 	struct f_audit_data *fad;
23217c478bd9Sstevel@tonic-gate 	uint32_t fd, cmd;
23227c478bd9Sstevel@tonic-gate 	uintptr_t cmarg;
23237c478bd9Sstevel@tonic-gate 
23247c478bd9Sstevel@tonic-gate 	/* XX64 */
23257c478bd9Sstevel@tonic-gate 	struct a {
23267c478bd9Sstevel@tonic-gate 		long	fd;
23277c478bd9Sstevel@tonic-gate 		long	cmd;
23287c478bd9Sstevel@tonic-gate 		long	cmarg;		/* caddr_t */
23297c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
23307c478bd9Sstevel@tonic-gate 
23317c478bd9Sstevel@tonic-gate 	fd    = (uint32_t)uap->fd;
23327c478bd9Sstevel@tonic-gate 	cmd   = (uint32_t)uap->cmd;
23337c478bd9Sstevel@tonic-gate 	cmarg = (uintptr_t)uap->cmarg;
23347c478bd9Sstevel@tonic-gate 
23357c478bd9Sstevel@tonic-gate 		/*
23367c478bd9Sstevel@tonic-gate 		 * convert file pointer to file descriptor
23377c478bd9Sstevel@tonic-gate 		 *   Note: fd ref count incremented here.
23387c478bd9Sstevel@tonic-gate 		 */
23397c478bd9Sstevel@tonic-gate 	if ((fp = getf(fd)) == NULL) {
23407c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "fd", fd));
23417c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(2, "cmd", cmd));
23427c478bd9Sstevel@tonic-gate #ifndef _LP64
234315c07adcSJohn Levon 		au_uwrite(au_to_arg32(3, "arg", (uint32_t)cmarg));
23447c478bd9Sstevel@tonic-gate #else
234515c07adcSJohn Levon 		au_uwrite(au_to_arg64(3, "arg", (uint64_t)cmarg));
23467c478bd9Sstevel@tonic-gate #endif
23477c478bd9Sstevel@tonic-gate 		return;
23487c478bd9Sstevel@tonic-gate 	}
23497c478bd9Sstevel@tonic-gate 
23507c478bd9Sstevel@tonic-gate 	/* get path from file struct here */
23517c478bd9Sstevel@tonic-gate 	fad = F2A(fp);
23527c478bd9Sstevel@tonic-gate 	if (fad->fad_aupath != NULL) {
23537c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_path(fad->fad_aupath));
23547c478bd9Sstevel@tonic-gate 	} else {
23557c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "no path: fd", fd));
23567c478bd9Sstevel@tonic-gate 	}
23577c478bd9Sstevel@tonic-gate 
23587c478bd9Sstevel@tonic-gate 	vp = fp->f_vnode;
23597c478bd9Sstevel@tonic-gate 	audit_attributes(vp);
23607c478bd9Sstevel@tonic-gate 
23617c478bd9Sstevel@tonic-gate 	/* decrement file descriptor reference count */
23627c478bd9Sstevel@tonic-gate 	releasef(fd);
23637c478bd9Sstevel@tonic-gate 
23647c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(2, "cmd", cmd));
23657c478bd9Sstevel@tonic-gate #ifndef _LP64
236615c07adcSJohn Levon 	au_uwrite(au_to_arg32(3, "arg", (uint32_t)cmarg));
23677c478bd9Sstevel@tonic-gate #else
236815c07adcSJohn Levon 	au_uwrite(au_to_arg64(3, "arg", (uint64_t)cmarg));
23697c478bd9Sstevel@tonic-gate #endif
23707c478bd9Sstevel@tonic-gate }
23717c478bd9Sstevel@tonic-gate 
23727c478bd9Sstevel@tonic-gate /*
23737c478bd9Sstevel@tonic-gate  * null function for memcntl for now. We might want to limit memcntl()
23747c478bd9Sstevel@tonic-gate  * auditing to commands: MC_LOCKAS, MC_LOCK, MC_UNLOCKAS, MC_UNLOCK which
23757c478bd9Sstevel@tonic-gate  * require privileges.
23767c478bd9Sstevel@tonic-gate  */
23777c478bd9Sstevel@tonic-gate static au_event_t
23787c478bd9Sstevel@tonic-gate aui_memcntl(au_event_t e)
23797c478bd9Sstevel@tonic-gate {
23807c478bd9Sstevel@tonic-gate 	return (e);
23817c478bd9Sstevel@tonic-gate }
23827c478bd9Sstevel@tonic-gate 
23837c478bd9Sstevel@tonic-gate /*ARGSUSED*/
23847c478bd9Sstevel@tonic-gate static au_event_t
23857c478bd9Sstevel@tonic-gate aui_privsys(au_event_t e)
23867c478bd9Sstevel@tonic-gate {
23877c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
23887c478bd9Sstevel@tonic-gate 
23897c478bd9Sstevel@tonic-gate 	struct a {
23907c478bd9Sstevel@tonic-gate 		long	opcode;
23917c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
23927c478bd9Sstevel@tonic-gate 
23937c478bd9Sstevel@tonic-gate 	switch (uap->opcode) {
23947c478bd9Sstevel@tonic-gate 	case PRIVSYS_SETPPRIV:
23957c478bd9Sstevel@tonic-gate 		return (AUE_SETPPRIV);
23967c478bd9Sstevel@tonic-gate 	default:
23977c478bd9Sstevel@tonic-gate 		return (AUE_NULL);
23987c478bd9Sstevel@tonic-gate 	}
23997c478bd9Sstevel@tonic-gate }
24007c478bd9Sstevel@tonic-gate 
24017c478bd9Sstevel@tonic-gate /*ARGSUSED*/
24027c478bd9Sstevel@tonic-gate static void
24037c478bd9Sstevel@tonic-gate aus_memcntl(struct t_audit_data *tad)
24047c478bd9Sstevel@tonic-gate {
24057c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
24067c478bd9Sstevel@tonic-gate 
24077c478bd9Sstevel@tonic-gate 	struct a {
24087c478bd9Sstevel@tonic-gate 		long	addr;
24097c478bd9Sstevel@tonic-gate 		long	len;
24107c478bd9Sstevel@tonic-gate 		long	cmd;
24117c478bd9Sstevel@tonic-gate 		long	arg;
24127c478bd9Sstevel@tonic-gate 		long	attr;
24137c478bd9Sstevel@tonic-gate 		long	mask;
24147c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
24157c478bd9Sstevel@tonic-gate 
24167c478bd9Sstevel@tonic-gate #ifdef _LP64
24177c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg64(1, "base", (uint64_t)uap->addr));
24187c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg64(2, "len", (uint64_t)uap->len));
24197c478bd9Sstevel@tonic-gate #else
24207c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(1, "base", (uint32_t)uap->addr));
24217c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(2, "len", (uint32_t)uap->len));
24227c478bd9Sstevel@tonic-gate #endif
24237c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(3, "cmd", (uint_t)uap->cmd));
24247c478bd9Sstevel@tonic-gate #ifdef _LP64
24257c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg64(4, "arg", (uint64_t)uap->arg));
24267c478bd9Sstevel@tonic-gate #else
24277c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(4, "arg", (uint32_t)uap->arg));
24287c478bd9Sstevel@tonic-gate #endif
24297c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(5, "attr", (uint_t)uap->attr));
24307c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(6, "mask", (uint_t)uap->mask));
24317c478bd9Sstevel@tonic-gate }
24327c478bd9Sstevel@tonic-gate 
24337c478bd9Sstevel@tonic-gate /*ARGSUSED*/
24347c478bd9Sstevel@tonic-gate static void
24357c478bd9Sstevel@tonic-gate aus_mmap(struct t_audit_data *tad)
24367c478bd9Sstevel@tonic-gate {
24377c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
24387c478bd9Sstevel@tonic-gate 	struct file *fp;
24397c478bd9Sstevel@tonic-gate 	struct f_audit_data *fad;
24407c478bd9Sstevel@tonic-gate 	struct vnode *vp;
24417c478bd9Sstevel@tonic-gate 	uint32_t fd;
24427c478bd9Sstevel@tonic-gate 
24437c478bd9Sstevel@tonic-gate 	struct a {
24447c478bd9Sstevel@tonic-gate 		long	addr;
24457c478bd9Sstevel@tonic-gate 		long	len;
24467c478bd9Sstevel@tonic-gate 		long	prot;
24477c478bd9Sstevel@tonic-gate 		long	flags;
24487c478bd9Sstevel@tonic-gate 		long	fd;
24497c478bd9Sstevel@tonic-gate 		long	pos;
24507c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
24517c478bd9Sstevel@tonic-gate 
24527c478bd9Sstevel@tonic-gate 	fd = (uint32_t)uap->fd;
24537c478bd9Sstevel@tonic-gate 
24547c478bd9Sstevel@tonic-gate #ifdef _LP64
24557c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg64(1, "addr", (uint64_t)uap->addr));
24567c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg64(2, "len", (uint64_t)uap->len));
24577c478bd9Sstevel@tonic-gate #else
24587c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(1, "addr", (uint32_t)uap->addr));
24597c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(2, "len", (uint32_t)uap->len));
24607c478bd9Sstevel@tonic-gate #endif
24617c478bd9Sstevel@tonic-gate 
24627c478bd9Sstevel@tonic-gate 	if ((fp = getf(fd)) == NULL) {
24637c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(5, "fd", (uint32_t)uap->fd));
24647c478bd9Sstevel@tonic-gate 		return;
24657c478bd9Sstevel@tonic-gate 	}
24667c478bd9Sstevel@tonic-gate 
24677c478bd9Sstevel@tonic-gate 	/*
24687c478bd9Sstevel@tonic-gate 	 * Mark in the tad if write access is NOT requested... if
24697c478bd9Sstevel@tonic-gate 	 * this is later detected (in audit_attributes) to be a
24707c478bd9Sstevel@tonic-gate 	 * public object, the mmap event may be discarded.
24717c478bd9Sstevel@tonic-gate 	 */
24727c478bd9Sstevel@tonic-gate 	if (((uap->prot) & PROT_WRITE) == 0) {
24734a0fa546SMarek Pospisil 		tad->tad_ctrl |= TAD_PUBLIC_EV;
24747c478bd9Sstevel@tonic-gate 	}
24757c478bd9Sstevel@tonic-gate 
24767c478bd9Sstevel@tonic-gate 	fad = F2A(fp);
24777c478bd9Sstevel@tonic-gate 	if (fad->fad_aupath != NULL) {
24787c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_path(fad->fad_aupath));
24797c478bd9Sstevel@tonic-gate 	} else {
24807c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "no path: fd", fd));
24817c478bd9Sstevel@tonic-gate 	}
24827c478bd9Sstevel@tonic-gate 
24837c478bd9Sstevel@tonic-gate 	vp = (struct vnode *)fp->f_vnode;
24847c478bd9Sstevel@tonic-gate 	audit_attributes(vp);
24857c478bd9Sstevel@tonic-gate 
24867c478bd9Sstevel@tonic-gate 	/* mark READ/WRITE since we can't predict access */
24877c478bd9Sstevel@tonic-gate 	if (uap->prot & PROT_READ)
24887c478bd9Sstevel@tonic-gate 		fad->fad_flags |= FAD_READ;
24897c478bd9Sstevel@tonic-gate 	if (uap->prot & PROT_WRITE)
24907c478bd9Sstevel@tonic-gate 		fad->fad_flags |= FAD_WRITE;
24917c478bd9Sstevel@tonic-gate 
24927c478bd9Sstevel@tonic-gate 	/* decrement file descriptor reference count */
24937c478bd9Sstevel@tonic-gate 	releasef(fd);
24947c478bd9Sstevel@tonic-gate 
24957c478bd9Sstevel@tonic-gate }	/* AUS_MMAP */
24967c478bd9Sstevel@tonic-gate 
24977c478bd9Sstevel@tonic-gate 
24987c478bd9Sstevel@tonic-gate 
24997c478bd9Sstevel@tonic-gate 
25007c478bd9Sstevel@tonic-gate /*ARGSUSED*/
25017c478bd9Sstevel@tonic-gate static void
25027c478bd9Sstevel@tonic-gate aus_munmap(struct t_audit_data *tad)
25037c478bd9Sstevel@tonic-gate {
25047c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
25057c478bd9Sstevel@tonic-gate 
25067c478bd9Sstevel@tonic-gate 	struct a {
25077c478bd9Sstevel@tonic-gate 		long	addr;
25087c478bd9Sstevel@tonic-gate 		long	len;
25097c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
25107c478bd9Sstevel@tonic-gate 
25117c478bd9Sstevel@tonic-gate #ifdef _LP64
25127c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg64(1, "addr", (uint64_t)uap->addr));
25137c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg64(2, "len", (uint64_t)uap->len));
25147c478bd9Sstevel@tonic-gate #else
25157c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(1, "addr", (uint32_t)uap->addr));
25167c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(2, "len", (uint32_t)uap->len));
25177c478bd9Sstevel@tonic-gate #endif
25187c478bd9Sstevel@tonic-gate 
25197c478bd9Sstevel@tonic-gate }	/* AUS_MUNMAP */
25207c478bd9Sstevel@tonic-gate 
25217c478bd9Sstevel@tonic-gate 
25227c478bd9Sstevel@tonic-gate 
25237c478bd9Sstevel@tonic-gate 
25247c478bd9Sstevel@tonic-gate 
25257c478bd9Sstevel@tonic-gate 
25267c478bd9Sstevel@tonic-gate 
25277c478bd9Sstevel@tonic-gate /*ARGSUSED*/
25287c478bd9Sstevel@tonic-gate static void
25297c478bd9Sstevel@tonic-gate aus_priocntlsys(struct t_audit_data *tad)
25307c478bd9Sstevel@tonic-gate {
25317c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
25327c478bd9Sstevel@tonic-gate 
25337c478bd9Sstevel@tonic-gate 	struct a {
25347c478bd9Sstevel@tonic-gate 		long	pc_version;
25357c478bd9Sstevel@tonic-gate 		long	psp;		/* procset_t */
25367c478bd9Sstevel@tonic-gate 		long	cmd;
25377c478bd9Sstevel@tonic-gate 		long	arg;
25387c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
25397c478bd9Sstevel@tonic-gate 
25407c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(1, "pc_version", (uint32_t)uap->pc_version));
25417c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(3, "cmd", (uint32_t)uap->cmd));
25427c478bd9Sstevel@tonic-gate 
25437c478bd9Sstevel@tonic-gate }	/* AUS_PRIOCNTLSYS */
25447c478bd9Sstevel@tonic-gate 
25457c478bd9Sstevel@tonic-gate 
25467c478bd9Sstevel@tonic-gate /*ARGSUSED*/
25477c478bd9Sstevel@tonic-gate static void
25487c478bd9Sstevel@tonic-gate aus_setegid(struct t_audit_data *tad)
25497c478bd9Sstevel@tonic-gate {
25507c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
25517c478bd9Sstevel@tonic-gate 	uint32_t gid;
25527c478bd9Sstevel@tonic-gate 
25537c478bd9Sstevel@tonic-gate 	struct a {
25547c478bd9Sstevel@tonic-gate 		long	gid;
25557c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
25567c478bd9Sstevel@tonic-gate 
25577c478bd9Sstevel@tonic-gate 	gid = (uint32_t)uap->gid;
25587c478bd9Sstevel@tonic-gate 
25597c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(1, "gid", gid));
25607c478bd9Sstevel@tonic-gate }	/* AUS_SETEGID */
25617c478bd9Sstevel@tonic-gate 
25627c478bd9Sstevel@tonic-gate 
25637c478bd9Sstevel@tonic-gate 
25647c478bd9Sstevel@tonic-gate 
25657c478bd9Sstevel@tonic-gate /*ARGSUSED*/
25667c478bd9Sstevel@tonic-gate static void
25677c478bd9Sstevel@tonic-gate aus_setgroups(struct t_audit_data *tad)
25687c478bd9Sstevel@tonic-gate {
25697c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
25707c478bd9Sstevel@tonic-gate 	int i;
25717c478bd9Sstevel@tonic-gate 	int gidsetsize;
25727c478bd9Sstevel@tonic-gate 	uintptr_t gidset;
25737c478bd9Sstevel@tonic-gate 	gid_t *gidlist;
25747c478bd9Sstevel@tonic-gate 
25757c478bd9Sstevel@tonic-gate 	struct a {
25767c478bd9Sstevel@tonic-gate 		long	gidsetsize;
25777c478bd9Sstevel@tonic-gate 		long	gidset;
25787c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
25797c478bd9Sstevel@tonic-gate 
25807c478bd9Sstevel@tonic-gate 	gidsetsize = (uint_t)uap->gidsetsize;
25817c478bd9Sstevel@tonic-gate 	gidset = (uintptr_t)uap->gidset;
25827c478bd9Sstevel@tonic-gate 
25837c478bd9Sstevel@tonic-gate 	if ((gidsetsize > NGROUPS_MAX_DEFAULT) || (gidsetsize < 0))
25847c478bd9Sstevel@tonic-gate 		return;
25857c478bd9Sstevel@tonic-gate 	if (gidsetsize != 0) {
25867c478bd9Sstevel@tonic-gate 		gidlist = kmem_alloc(gidsetsize * sizeof (gid_t),
2587745b2690Stz 		    KM_SLEEP);
25887c478bd9Sstevel@tonic-gate 		if (copyin((caddr_t)gidset, gidlist,
2589745b2690Stz 		    gidsetsize * sizeof (gid_t)) == 0)
25907c478bd9Sstevel@tonic-gate 			for (i = 0; i < gidsetsize; i++)
25917c478bd9Sstevel@tonic-gate 				au_uwrite(au_to_arg32(1, "setgroups",
2592745b2690Stz 				    (uint32_t)gidlist[i]));
25937c478bd9Sstevel@tonic-gate 		kmem_free(gidlist, gidsetsize * sizeof (gid_t));
25947c478bd9Sstevel@tonic-gate 	} else
25957c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "setgroups", (uint32_t)0));
25967c478bd9Sstevel@tonic-gate 
25977c478bd9Sstevel@tonic-gate }	/* AUS_SETGROUPS */
25987c478bd9Sstevel@tonic-gate 
25997c478bd9Sstevel@tonic-gate 
26007c478bd9Sstevel@tonic-gate 
26017c478bd9Sstevel@tonic-gate 
26027c478bd9Sstevel@tonic-gate 
26037c478bd9Sstevel@tonic-gate /*ARGSUSED*/
26047c478bd9Sstevel@tonic-gate static void
26057c478bd9Sstevel@tonic-gate aus_seteuid(struct t_audit_data *tad)
26067c478bd9Sstevel@tonic-gate {
26077c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
26087c478bd9Sstevel@tonic-gate 	uint32_t uid;
26097c478bd9Sstevel@tonic-gate 
26107c478bd9Sstevel@tonic-gate 	struct a {
26117c478bd9Sstevel@tonic-gate 		long	uid;
26127c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
26137c478bd9Sstevel@tonic-gate 
26147c478bd9Sstevel@tonic-gate 	uid = (uint32_t)uap->uid;
26157c478bd9Sstevel@tonic-gate 
26167c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(1, "euid", uid));
26177c478bd9Sstevel@tonic-gate 
26187c478bd9Sstevel@tonic-gate }	/* AUS_SETEUID */
26197c478bd9Sstevel@tonic-gate 
26207c478bd9Sstevel@tonic-gate /*ARGSUSED*/
26217c478bd9Sstevel@tonic-gate static void
26227c478bd9Sstevel@tonic-gate aus_putmsg(struct t_audit_data *tad)
26237c478bd9Sstevel@tonic-gate {
26247c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
26257c478bd9Sstevel@tonic-gate 	uint32_t fd, pri;
26267c478bd9Sstevel@tonic-gate 	struct file *fp;
26277c478bd9Sstevel@tonic-gate 	struct f_audit_data *fad;
26287c478bd9Sstevel@tonic-gate 
26297c478bd9Sstevel@tonic-gate 	struct a {
26307c478bd9Sstevel@tonic-gate 		long	fdes;
26317c478bd9Sstevel@tonic-gate 		long	ctl;		/* struct strbuf * */
26327c478bd9Sstevel@tonic-gate 		long	data;		/* struct strbuf * */
26337c478bd9Sstevel@tonic-gate 		long	pri;
26347c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
26357c478bd9Sstevel@tonic-gate 
26367c478bd9Sstevel@tonic-gate 	fd  = (uint32_t)uap->fdes;
26377c478bd9Sstevel@tonic-gate 	pri = (uint32_t)uap->pri;
26387c478bd9Sstevel@tonic-gate 
26397c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(1, "fd", fd));
26407c478bd9Sstevel@tonic-gate 
26417c478bd9Sstevel@tonic-gate 	if ((fp = getf(fd)) != NULL) {
26427c478bd9Sstevel@tonic-gate 		fad = F2A(fp);
26437c478bd9Sstevel@tonic-gate 
26447c478bd9Sstevel@tonic-gate 		fad->fad_flags |= FAD_WRITE;
26457c478bd9Sstevel@tonic-gate 
26467c478bd9Sstevel@tonic-gate 		/* add path name to audit record */
26477c478bd9Sstevel@tonic-gate 		if (fad->fad_aupath != NULL) {
26487c478bd9Sstevel@tonic-gate 			au_uwrite(au_to_path(fad->fad_aupath));
26497c478bd9Sstevel@tonic-gate 		}
26507c478bd9Sstevel@tonic-gate 		audit_attributes(fp->f_vnode);
26517c478bd9Sstevel@tonic-gate 
26527c478bd9Sstevel@tonic-gate 		releasef(fd);
26537c478bd9Sstevel@tonic-gate 	}
26547c478bd9Sstevel@tonic-gate 
26557c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(4, "pri", pri));
26567c478bd9Sstevel@tonic-gate }
26577c478bd9Sstevel@tonic-gate 
26587c478bd9Sstevel@tonic-gate /*ARGSUSED*/
26597c478bd9Sstevel@tonic-gate static void
26607c478bd9Sstevel@tonic-gate aus_putpmsg(struct t_audit_data *tad)
26617c478bd9Sstevel@tonic-gate {
26627c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
26637c478bd9Sstevel@tonic-gate 	uint32_t fd, pri, flags;
26647c478bd9Sstevel@tonic-gate 	struct file *fp;
26657c478bd9Sstevel@tonic-gate 	struct f_audit_data *fad;
26667c478bd9Sstevel@tonic-gate 
26677c478bd9Sstevel@tonic-gate 	struct a {
26687c478bd9Sstevel@tonic-gate 		long	fdes;
26697c478bd9Sstevel@tonic-gate 		long	ctl;		/* struct strbuf * */
26707c478bd9Sstevel@tonic-gate 		long	data;		/* struct strbuf * */
26717c478bd9Sstevel@tonic-gate 		long	pri;
26727c478bd9Sstevel@tonic-gate 		long	flags;
26737c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
26747c478bd9Sstevel@tonic-gate 
26757c478bd9Sstevel@tonic-gate 	fd = (uint32_t)uap->fdes;
26767c478bd9Sstevel@tonic-gate 	pri  = (uint32_t)uap->pri;
26777c478bd9Sstevel@tonic-gate 	flags  = (uint32_t)uap->flags;
26787c478bd9Sstevel@tonic-gate 
26797c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(1, "fd", fd));
26807c478bd9Sstevel@tonic-gate 
26817c478bd9Sstevel@tonic-gate 	if ((fp = getf(fd)) != NULL) {
26827c478bd9Sstevel@tonic-gate 		fad = F2A(fp);
26837c478bd9Sstevel@tonic-gate 
26847c478bd9Sstevel@tonic-gate 		fad->fad_flags |= FAD_WRITE;
26857c478bd9Sstevel@tonic-gate 
26867c478bd9Sstevel@tonic-gate 		/* add path name to audit record */
26877c478bd9Sstevel@tonic-gate 		if (fad->fad_aupath != NULL) {
26887c478bd9Sstevel@tonic-gate 			au_uwrite(au_to_path(fad->fad_aupath));
26897c478bd9Sstevel@tonic-gate 		}
26907c478bd9Sstevel@tonic-gate 		audit_attributes(fp->f_vnode);
26917c478bd9Sstevel@tonic-gate 
26927c478bd9Sstevel@tonic-gate 		releasef(fd);
26937c478bd9Sstevel@tonic-gate 	}
26947c478bd9Sstevel@tonic-gate 
26957c478bd9Sstevel@tonic-gate 
26967c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(4, "pri", pri));
26977c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(5, "flags", flags));
26987c478bd9Sstevel@tonic-gate }
26997c478bd9Sstevel@tonic-gate 
27007c478bd9Sstevel@tonic-gate /*ARGSUSED*/
27017c478bd9Sstevel@tonic-gate static void
27027c478bd9Sstevel@tonic-gate aus_getmsg(struct t_audit_data *tad)
27037c478bd9Sstevel@tonic-gate {
27047c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
27057c478bd9Sstevel@tonic-gate 	uint32_t fd, pri;
27067c478bd9Sstevel@tonic-gate 	struct file *fp;
27077c478bd9Sstevel@tonic-gate 	struct f_audit_data *fad;
27087c478bd9Sstevel@tonic-gate 
27097c478bd9Sstevel@tonic-gate 	struct a {
27107c478bd9Sstevel@tonic-gate 		long	fdes;
27117c478bd9Sstevel@tonic-gate 		long	ctl;		/* struct strbuf * */
27127c478bd9Sstevel@tonic-gate 		long	data;		/* struct strbuf * */
27137c478bd9Sstevel@tonic-gate 		long	pri;
27147c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
27157c478bd9Sstevel@tonic-gate 
27167c478bd9Sstevel@tonic-gate 	fd  = (uint32_t)uap->fdes;
27177c478bd9Sstevel@tonic-gate 	pri = (uint32_t)uap->pri;
27187c478bd9Sstevel@tonic-gate 
27197c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(1, "fd", fd));
27207c478bd9Sstevel@tonic-gate 
27217c478bd9Sstevel@tonic-gate 	if ((fp = getf(fd)) != NULL) {
27227c478bd9Sstevel@tonic-gate 		fad = F2A(fp);
27237c478bd9Sstevel@tonic-gate 
27247c478bd9Sstevel@tonic-gate 		/*
27257c478bd9Sstevel@tonic-gate 		 * read operation on this object
27267c478bd9Sstevel@tonic-gate 		 */
27277c478bd9Sstevel@tonic-gate 		fad->fad_flags |= FAD_READ;
27287c478bd9Sstevel@tonic-gate 
27297c478bd9Sstevel@tonic-gate 		/* add path name to audit record */
27307c478bd9Sstevel@tonic-gate 		if (fad->fad_aupath != NULL) {
27317c478bd9Sstevel@tonic-gate 			au_uwrite(au_to_path(fad->fad_aupath));
27327c478bd9Sstevel@tonic-gate 		}
27337c478bd9Sstevel@tonic-gate 		audit_attributes(fp->f_vnode);
27347c478bd9Sstevel@tonic-gate 
27357c478bd9Sstevel@tonic-gate 		releasef(fd);
27367c478bd9Sstevel@tonic-gate 	}
27377c478bd9Sstevel@tonic-gate 
27387c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(4, "pri", pri));
27397c478bd9Sstevel@tonic-gate }
27407c478bd9Sstevel@tonic-gate 
27417c478bd9Sstevel@tonic-gate /*ARGSUSED*/
27427c478bd9Sstevel@tonic-gate static void
27437c478bd9Sstevel@tonic-gate aus_getpmsg(struct t_audit_data *tad)
27447c478bd9Sstevel@tonic-gate {
27457c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
27467c478bd9Sstevel@tonic-gate 	uint32_t fd;
27477c478bd9Sstevel@tonic-gate 	struct file *fp;
27487c478bd9Sstevel@tonic-gate 	struct f_audit_data *fad;
27497c478bd9Sstevel@tonic-gate 
27507c478bd9Sstevel@tonic-gate 	struct a {
27517c478bd9Sstevel@tonic-gate 		long	fdes;
27527c478bd9Sstevel@tonic-gate 		long	ctl;		/* struct strbuf * */
27537c478bd9Sstevel@tonic-gate 		long	data;		/* struct strbuf * */
27547c478bd9Sstevel@tonic-gate 		long	pri;
27557c478bd9Sstevel@tonic-gate 		long	flags;
27567c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
27577c478bd9Sstevel@tonic-gate 
27587c478bd9Sstevel@tonic-gate 	fd = (uint32_t)uap->fdes;
27597c478bd9Sstevel@tonic-gate 
27607c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(1, "fd", fd));
27617c478bd9Sstevel@tonic-gate 
27627c478bd9Sstevel@tonic-gate 	if ((fp = getf(fd)) != NULL) {
27637c478bd9Sstevel@tonic-gate 		fad = F2A(fp);
27647c478bd9Sstevel@tonic-gate 
27657c478bd9Sstevel@tonic-gate 		/*
27667c478bd9Sstevel@tonic-gate 		 * read operation on this object
27677c478bd9Sstevel@tonic-gate 		 */
27687c478bd9Sstevel@tonic-gate 		fad->fad_flags |= FAD_READ;
27697c478bd9Sstevel@tonic-gate 
27707c478bd9Sstevel@tonic-gate 		/* add path name to audit record */
27717c478bd9Sstevel@tonic-gate 		if (fad->fad_aupath != NULL) {
27727c478bd9Sstevel@tonic-gate 			au_uwrite(au_to_path(fad->fad_aupath));
27737c478bd9Sstevel@tonic-gate 		}
27747c478bd9Sstevel@tonic-gate 		audit_attributes(fp->f_vnode);
27757c478bd9Sstevel@tonic-gate 
27767c478bd9Sstevel@tonic-gate 		releasef(fd);
27777c478bd9Sstevel@tonic-gate 	}
27787c478bd9Sstevel@tonic-gate }
27797c478bd9Sstevel@tonic-gate 
278061b9bf51Srica static au_event_t
278161b9bf51Srica aui_labelsys(au_event_t e)
278261b9bf51Srica {
278361b9bf51Srica 	klwp_t *clwp = ttolwp(curthread);
278461b9bf51Srica 	uint32_t code;
278561b9bf51Srica 	uint32_t cmd;
278661b9bf51Srica 
278761b9bf51Srica 	struct a {
278861b9bf51Srica 		long	code;
278961b9bf51Srica 		long	cmd;
279061b9bf51Srica 	} *uap = (struct a *)clwp->lwp_ap;
279161b9bf51Srica 
279261b9bf51Srica 	code = (uint32_t)uap->code;
279361b9bf51Srica 	cmd = (uint32_t)uap->cmd;
279461b9bf51Srica 
279561b9bf51Srica 	/* not security relevant if not changing kernel cache */
279661b9bf51Srica 	if (cmd == TNDB_GET)
2797d3e710c8SRic Aleshire 		return (AUE_NULL);
279861b9bf51Srica 
279961b9bf51Srica 	switch (code) {
280061b9bf51Srica 	case TSOL_TNRH:
280161b9bf51Srica 		e = AUE_LABELSYS_TNRH;
280261b9bf51Srica 		break;
280361b9bf51Srica 	case TSOL_TNRHTP:
280461b9bf51Srica 		e = AUE_LABELSYS_TNRHTP;
280561b9bf51Srica 		break;
280661b9bf51Srica 	case TSOL_TNMLP:
280761b9bf51Srica 		e = AUE_LABELSYS_TNMLP;
280861b9bf51Srica 		break;
280961b9bf51Srica 	default:
281061b9bf51Srica 		e = AUE_NULL;
281161b9bf51Srica 		break;
281261b9bf51Srica 	}
281361b9bf51Srica 
281461b9bf51Srica 	return (e);
281561b9bf51Srica 
281661b9bf51Srica }
281761b9bf51Srica 
281861b9bf51Srica static void
281961b9bf51Srica aus_labelsys(struct t_audit_data *tad)
282061b9bf51Srica {
282161b9bf51Srica 	klwp_t *clwp = ttolwp(curthread);
282261b9bf51Srica 	uint32_t cmd;
282361b9bf51Srica 	uintptr_t a2;
282461b9bf51Srica 
282561b9bf51Srica 	struct a {
282661b9bf51Srica 		long	code;
282761b9bf51Srica 		long	cmd;
282861b9bf51Srica 		long	a2;
282961b9bf51Srica 	} *uap = (struct a *)clwp->lwp_ap;
283061b9bf51Srica 
283161b9bf51Srica 	cmd = (uint32_t)uap->cmd;
283261b9bf51Srica 	a2 = (uintptr_t)uap->a2;
283361b9bf51Srica 
283461b9bf51Srica 	switch (tad->tad_event) {
283561b9bf51Srica 	case AUE_LABELSYS_TNRH:
283661b9bf51Srica 	{
283761b9bf51Srica 		tsol_rhent_t	*rhent;
283861b9bf51Srica 		tnaddr_t	*rh_addr;
283961b9bf51Srica 
284061b9bf51Srica 		au_uwrite(au_to_arg32(1, "cmd", cmd));
284161b9bf51Srica 
284261b9bf51Srica 		/* Remaining args don't apply for FLUSH, so skip */
284361b9bf51Srica 		if (cmd == TNDB_FLUSH)
284461b9bf51Srica 			break;
284561b9bf51Srica 
284661b9bf51Srica 		rhent = kmem_alloc(sizeof (tsol_rhent_t), KM_SLEEP);
284761b9bf51Srica 		if (copyin((caddr_t)a2, rhent, sizeof (tsol_rhent_t))) {
284861b9bf51Srica 			kmem_free(rhent, sizeof (tsol_rhent_t));
284961b9bf51Srica 			return;
285061b9bf51Srica 		}
285161b9bf51Srica 
285261b9bf51Srica 		rh_addr = &rhent->rh_address;
285361b9bf51Srica 		if (rh_addr->ta_family == AF_INET) {
285461b9bf51Srica 			struct in_addr	*ipaddr;
285561b9bf51Srica 
285661b9bf51Srica 			ipaddr = &(rh_addr->ta_addr_v4);
285761b9bf51Srica 			au_uwrite(au_to_in_addr(ipaddr));
285861b9bf51Srica 		} else if (rh_addr->ta_family == AF_INET6) {
285961b9bf51Srica 			int32_t		*ipaddr;
286061b9bf51Srica 
286161b9bf51Srica 			ipaddr = (int32_t *)&(rh_addr->ta_addr_v6);
286261b9bf51Srica 			au_uwrite(au_to_in_addr_ex(ipaddr));
286361b9bf51Srica 		}
286461b9bf51Srica 		au_uwrite(au_to_arg32(2, "prefix len", rhent->rh_prefix));
286561b9bf51Srica 
286661b9bf51Srica 		kmem_free(rhent, sizeof (tsol_rhent_t));
286761b9bf51Srica 
286861b9bf51Srica 		break;
286961b9bf51Srica 	}
287061b9bf51Srica 	case AUE_LABELSYS_TNRHTP:
287161b9bf51Srica 	{
287261b9bf51Srica 		tsol_tpent_t	*tpent;
287361b9bf51Srica 
287461b9bf51Srica 		au_uwrite(au_to_arg32(1, "cmd", cmd));
287561b9bf51Srica 
287661b9bf51Srica 		/* Remaining args don't apply for FLUSH, so skip */
287761b9bf51Srica 		if (cmd == TNDB_FLUSH)
287861b9bf51Srica 			break;
287961b9bf51Srica 
288061b9bf51Srica 		tpent = kmem_alloc(sizeof (tsol_tpent_t), KM_SLEEP);
288161b9bf51Srica 		if (copyin((caddr_t)a2, tpent, sizeof (tsol_tpent_t))) {
288261b9bf51Srica 			kmem_free(tpent, sizeof (tsol_tpent_t));
288361b9bf51Srica 			return;
288461b9bf51Srica 		}
288561b9bf51Srica 
2886d3e710c8SRic Aleshire 		/* Make sure that the template name is null-terminated. */
2887d3e710c8SRic Aleshire 		*(tpent->name + TNTNAMSIZ - 1) = '\0';
2888d3e710c8SRic Aleshire 
288961b9bf51Srica 		au_uwrite(au_to_text(tpent->name));
289061b9bf51Srica 		kmem_free(tpent, sizeof (tsol_tpent_t));
289161b9bf51Srica 
289261b9bf51Srica 		break;
289361b9bf51Srica 	}
289461b9bf51Srica 	case AUE_LABELSYS_TNMLP:
289561b9bf51Srica 	{
289661b9bf51Srica 		tsol_mlpent_t	*mlpent;
289761b9bf51Srica 
289861b9bf51Srica 		au_uwrite(au_to_arg32(1, "cmd", cmd));
289961b9bf51Srica 
290061b9bf51Srica 		mlpent = kmem_alloc(sizeof (tsol_mlpent_t), KM_SLEEP);
290161b9bf51Srica 		if (copyin((caddr_t)a2, mlpent, sizeof (tsol_mlpent_t))) {
290261b9bf51Srica 			kmem_free(mlpent, sizeof (tsol_mlpent_t));
290361b9bf51Srica 			return;
290461b9bf51Srica 		}
290561b9bf51Srica 
290661b9bf51Srica 		if (mlpent->tsme_flags & TSOL_MEF_SHARED) {
290761b9bf51Srica 			au_uwrite(au_to_text("shared"));
290861b9bf51Srica 		} else {
290961b9bf51Srica 			zone_t	*zone;
291061b9bf51Srica 
291161b9bf51Srica 			zone = zone_find_by_id(mlpent->tsme_zoneid);
291261b9bf51Srica 			if (zone != NULL) {
291361b9bf51Srica 				au_uwrite(au_to_text(zone->zone_name));
291461b9bf51Srica 				zone_rele(zone);
291561b9bf51Srica 			}
291661b9bf51Srica 		}
291761b9bf51Srica 
291861b9bf51Srica 		/* Remaining args don't apply for FLUSH, so skip */
291961b9bf51Srica 		if (cmd == TNDB_FLUSH) {
292061b9bf51Srica 			kmem_free(mlpent, sizeof (tsol_mlpent_t));
292161b9bf51Srica 			break;
292261b9bf51Srica 		}
292361b9bf51Srica 
292461b9bf51Srica 		au_uwrite(au_to_arg32(2, "proto num",
292561b9bf51Srica 		    (uint32_t)mlpent->tsme_mlp.mlp_ipp));
292661b9bf51Srica 		au_uwrite(au_to_arg32(2, "mlp_port",
292761b9bf51Srica 		    (uint32_t)mlpent->tsme_mlp.mlp_port));
292861b9bf51Srica 
292961b9bf51Srica 		if (mlpent->tsme_mlp.mlp_port_upper != 0)
293061b9bf51Srica 			au_uwrite(au_to_arg32(2, "mlp_port_upper",
293161b9bf51Srica 			    (uint32_t)mlpent->tsme_mlp.mlp_port_upper));
293261b9bf51Srica 
293361b9bf51Srica 		kmem_free(mlpent, sizeof (tsol_mlpent_t));
293461b9bf51Srica 
293561b9bf51Srica 		break;
293661b9bf51Srica 	}
293761b9bf51Srica 	default:
293861b9bf51Srica 		break;
293961b9bf51Srica 	}
294061b9bf51Srica }
294161b9bf51Srica 
294261b9bf51Srica 
29437c478bd9Sstevel@tonic-gate static au_event_t
29447c478bd9Sstevel@tonic-gate aui_auditsys(au_event_t e)
29457c478bd9Sstevel@tonic-gate {
29467c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
29477c478bd9Sstevel@tonic-gate 	uint32_t code;
29487c478bd9Sstevel@tonic-gate 
29497c478bd9Sstevel@tonic-gate 	struct a {
29507c478bd9Sstevel@tonic-gate 		long	code;
29517c478bd9Sstevel@tonic-gate 		long	a1;
29527c478bd9Sstevel@tonic-gate 		long	a2;
29537c478bd9Sstevel@tonic-gate 		long	a3;
29547c478bd9Sstevel@tonic-gate 		long	a4;
29557c478bd9Sstevel@tonic-gate 		long	a5;
29567c478bd9Sstevel@tonic-gate 		long	a6;
29577c478bd9Sstevel@tonic-gate 		long	a7;
29587c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
29597c478bd9Sstevel@tonic-gate 
29607c478bd9Sstevel@tonic-gate 	code = (uint32_t)uap->code;
29617c478bd9Sstevel@tonic-gate 
29627c478bd9Sstevel@tonic-gate 	switch (code) {
29637c478bd9Sstevel@tonic-gate 
29647c478bd9Sstevel@tonic-gate 	case BSM_GETAUID:
29657c478bd9Sstevel@tonic-gate 		e = AUE_GETAUID;
29667c478bd9Sstevel@tonic-gate 		break;
29677c478bd9Sstevel@tonic-gate 	case BSM_SETAUID:
29687c478bd9Sstevel@tonic-gate 		e = AUE_SETAUID;
29697c478bd9Sstevel@tonic-gate 		break;
29707c478bd9Sstevel@tonic-gate 	case BSM_GETAUDIT:
29717c478bd9Sstevel@tonic-gate 		e = AUE_GETAUDIT;
29727c478bd9Sstevel@tonic-gate 		break;
29737c478bd9Sstevel@tonic-gate 	case BSM_GETAUDIT_ADDR:
29747c478bd9Sstevel@tonic-gate 		e = AUE_GETAUDIT_ADDR;
29757c478bd9Sstevel@tonic-gate 		break;
29767c478bd9Sstevel@tonic-gate 	case BSM_SETAUDIT:
29777c478bd9Sstevel@tonic-gate 		e = AUE_SETAUDIT;
29787c478bd9Sstevel@tonic-gate 		break;
29797c478bd9Sstevel@tonic-gate 	case BSM_SETAUDIT_ADDR:
29807c478bd9Sstevel@tonic-gate 		e = AUE_SETAUDIT_ADDR;
29817c478bd9Sstevel@tonic-gate 		break;
29827c478bd9Sstevel@tonic-gate 	case BSM_AUDIT:
29837c478bd9Sstevel@tonic-gate 		e = AUE_AUDIT;
29847c478bd9Sstevel@tonic-gate 		break;
29857c478bd9Sstevel@tonic-gate 	case BSM_AUDITCTL:
29867c478bd9Sstevel@tonic-gate 		switch ((uint_t)uap->a1) {
29877c478bd9Sstevel@tonic-gate 
29887c478bd9Sstevel@tonic-gate 		case A_GETPOLICY:
29897c478bd9Sstevel@tonic-gate 			e = AUE_AUDITON_GPOLICY;
29907c478bd9Sstevel@tonic-gate 			break;
29917c478bd9Sstevel@tonic-gate 		case A_SETPOLICY:
29927c478bd9Sstevel@tonic-gate 			e = AUE_AUDITON_SPOLICY;
29937c478bd9Sstevel@tonic-gate 			break;
2994f8994074SJan Friedel 		case A_GETAMASK:
2995f8994074SJan Friedel 			e = AUE_AUDITON_GETAMASK;
2996f8994074SJan Friedel 			break;
2997f8994074SJan Friedel 		case A_SETAMASK:
2998f8994074SJan Friedel 			e = AUE_AUDITON_SETAMASK;
2999f8994074SJan Friedel 			break;
30007c478bd9Sstevel@tonic-gate 		case A_GETKMASK:
30017c478bd9Sstevel@tonic-gate 			e = AUE_AUDITON_GETKMASK;
30027c478bd9Sstevel@tonic-gate 			break;
30037c478bd9Sstevel@tonic-gate 		case A_SETKMASK:
30047c478bd9Sstevel@tonic-gate 			e = AUE_AUDITON_SETKMASK;
30057c478bd9Sstevel@tonic-gate 			break;
30067c478bd9Sstevel@tonic-gate 		case A_GETQCTRL:
30077c478bd9Sstevel@tonic-gate 			e = AUE_AUDITON_GQCTRL;
30087c478bd9Sstevel@tonic-gate 			break;
30097c478bd9Sstevel@tonic-gate 		case A_SETQCTRL:
30107c478bd9Sstevel@tonic-gate 			e = AUE_AUDITON_SQCTRL;
30117c478bd9Sstevel@tonic-gate 			break;
30127c478bd9Sstevel@tonic-gate 		case A_GETCWD:
30137c478bd9Sstevel@tonic-gate 			e = AUE_AUDITON_GETCWD;
30147c478bd9Sstevel@tonic-gate 			break;
30157c478bd9Sstevel@tonic-gate 		case A_GETCAR:
30167c478bd9Sstevel@tonic-gate 			e = AUE_AUDITON_GETCAR;
30177c478bd9Sstevel@tonic-gate 			break;
30187c478bd9Sstevel@tonic-gate 		case A_GETSTAT:
30197c478bd9Sstevel@tonic-gate 			e = AUE_AUDITON_GETSTAT;
30207c478bd9Sstevel@tonic-gate 			break;
30217c478bd9Sstevel@tonic-gate 		case A_SETSTAT:
30227c478bd9Sstevel@tonic-gate 			e = AUE_AUDITON_SETSTAT;
30237c478bd9Sstevel@tonic-gate 			break;
30247c478bd9Sstevel@tonic-gate 		case A_SETUMASK:
30257c478bd9Sstevel@tonic-gate 			e = AUE_AUDITON_SETUMASK;
30267c478bd9Sstevel@tonic-gate 			break;
30277c478bd9Sstevel@tonic-gate 		case A_SETSMASK:
30287c478bd9Sstevel@tonic-gate 			e = AUE_AUDITON_SETSMASK;
30297c478bd9Sstevel@tonic-gate 			break;
30307c478bd9Sstevel@tonic-gate 		case A_GETCOND:
30317c478bd9Sstevel@tonic-gate 			e = AUE_AUDITON_GETCOND;
30327c478bd9Sstevel@tonic-gate 			break;
30337c478bd9Sstevel@tonic-gate 		case A_SETCOND:
30347c478bd9Sstevel@tonic-gate 			e = AUE_AUDITON_SETCOND;
30357c478bd9Sstevel@tonic-gate 			break;
30367c478bd9Sstevel@tonic-gate 		case A_GETCLASS:
30377c478bd9Sstevel@tonic-gate 			e = AUE_AUDITON_GETCLASS;
30387c478bd9Sstevel@tonic-gate 			break;
30397c478bd9Sstevel@tonic-gate 		case A_SETCLASS:
30407c478bd9Sstevel@tonic-gate 			e = AUE_AUDITON_SETCLASS;
30417c478bd9Sstevel@tonic-gate 			break;
30427c478bd9Sstevel@tonic-gate 		default:
30437c478bd9Sstevel@tonic-gate 			e = AUE_NULL;
30447c478bd9Sstevel@tonic-gate 			break;
30457c478bd9Sstevel@tonic-gate 		}
30467c478bd9Sstevel@tonic-gate 		break;
30477c478bd9Sstevel@tonic-gate 	default:
30487c478bd9Sstevel@tonic-gate 		e = AUE_NULL;
30497c478bd9Sstevel@tonic-gate 		break;
30507c478bd9Sstevel@tonic-gate 	}
30517c478bd9Sstevel@tonic-gate 
30527c478bd9Sstevel@tonic-gate 	return (e);
30537c478bd9Sstevel@tonic-gate 
30547c478bd9Sstevel@tonic-gate }	/* AUI_AUDITSYS */
30557c478bd9Sstevel@tonic-gate 
30567c478bd9Sstevel@tonic-gate 
30577c478bd9Sstevel@tonic-gate static void
30587c478bd9Sstevel@tonic-gate aus_auditsys(struct t_audit_data *tad)
30597c478bd9Sstevel@tonic-gate {
30607c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
30617c478bd9Sstevel@tonic-gate 	uintptr_t a1, a2;
30627c478bd9Sstevel@tonic-gate 	STRUCT_DECL(auditinfo, ainfo);
30637c478bd9Sstevel@tonic-gate 	STRUCT_DECL(auditinfo_addr, ainfo_addr);
30647c478bd9Sstevel@tonic-gate 	au_evclass_map_t event;
30657c478bd9Sstevel@tonic-gate 	au_mask_t mask;
30667c478bd9Sstevel@tonic-gate 	int auditstate, policy;
3067f2fcf18cStz 	au_id_t auid;
30687c478bd9Sstevel@tonic-gate 
30697c478bd9Sstevel@tonic-gate 
30707c478bd9Sstevel@tonic-gate 	struct a {
30717c478bd9Sstevel@tonic-gate 		long	code;
30727c478bd9Sstevel@tonic-gate 		long	a1;
30737c478bd9Sstevel@tonic-gate 		long	a2;
30747c478bd9Sstevel@tonic-gate 		long	a3;
30757c478bd9Sstevel@tonic-gate 		long	a4;
30767c478bd9Sstevel@tonic-gate 		long	a5;
30777c478bd9Sstevel@tonic-gate 		long	a6;
30787c478bd9Sstevel@tonic-gate 		long	a7;
30797c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
30807c478bd9Sstevel@tonic-gate 
30817c478bd9Sstevel@tonic-gate 	a1   = (uintptr_t)uap->a1;
30827c478bd9Sstevel@tonic-gate 	a2   = (uintptr_t)uap->a2;
30837c478bd9Sstevel@tonic-gate 
30847c478bd9Sstevel@tonic-gate 	switch (tad->tad_event) {
30857c478bd9Sstevel@tonic-gate 	case AUE_SETAUID:
3086f2fcf18cStz 		if (copyin((caddr_t)a1, &auid, sizeof (au_id_t)))
3087f2fcf18cStz 				return;
3088f2fcf18cStz 		au_uwrite(au_to_arg32(2, "setauid", auid));
30897c478bd9Sstevel@tonic-gate 		break;
30907c478bd9Sstevel@tonic-gate 	case AUE_SETAUDIT:
30917c478bd9Sstevel@tonic-gate 		STRUCT_INIT(ainfo, get_udatamodel());
30927c478bd9Sstevel@tonic-gate 		if (copyin((caddr_t)a1, STRUCT_BUF(ainfo),
3093745b2690Stz 		    STRUCT_SIZE(ainfo))) {
30947c478bd9Sstevel@tonic-gate 				return;
30957c478bd9Sstevel@tonic-gate 		}
30967c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32((char)1, "setaudit:auid",
3097745b2690Stz 		    (uint32_t)STRUCT_FGET(ainfo, ai_auid)));
30987c478bd9Sstevel@tonic-gate #ifdef _LP64
30997c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg64((char)1, "setaudit:port",
3100745b2690Stz 		    (uint64_t)STRUCT_FGET(ainfo, ai_termid.port)));
31017c478bd9Sstevel@tonic-gate #else
31027c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32((char)1, "setaudit:port",
3103745b2690Stz 		    (uint32_t)STRUCT_FGET(ainfo, ai_termid.port)));
31047c478bd9Sstevel@tonic-gate #endif
31057c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32((char)1, "setaudit:machine",
3106745b2690Stz 		    (uint32_t)STRUCT_FGET(ainfo, ai_termid.machine)));
31077c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32((char)1, "setaudit:as_success",
3108745b2690Stz 		    (uint32_t)STRUCT_FGET(ainfo, ai_mask.as_success)));
31097c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32((char)1, "setaudit:as_failure",
3110745b2690Stz 		    (uint32_t)STRUCT_FGET(ainfo, ai_mask.as_failure)));
31117c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32((char)1, "setaudit:asid",
3112745b2690Stz 		    (uint32_t)STRUCT_FGET(ainfo, ai_asid)));
31137c478bd9Sstevel@tonic-gate 		break;
31147c478bd9Sstevel@tonic-gate 	case AUE_SETAUDIT_ADDR:
31157c478bd9Sstevel@tonic-gate 		STRUCT_INIT(ainfo_addr, get_udatamodel());
31167c478bd9Sstevel@tonic-gate 		if (copyin((caddr_t)a1, STRUCT_BUF(ainfo_addr),
3117745b2690Stz 		    STRUCT_SIZE(ainfo_addr))) {
31187c478bd9Sstevel@tonic-gate 				return;
31197c478bd9Sstevel@tonic-gate 		}
31207c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32((char)1, "auid",
3121745b2690Stz 		    (uint32_t)STRUCT_FGET(ainfo_addr, ai_auid)));
31227c478bd9Sstevel@tonic-gate #ifdef _LP64
31237c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg64((char)1, "port",
3124745b2690Stz 		    (uint64_t)STRUCT_FGET(ainfo_addr, ai_termid.at_port)));
31257c478bd9Sstevel@tonic-gate #else
31267c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32((char)1, "port",
3127745b2690Stz 		    (uint32_t)STRUCT_FGET(ainfo_addr, ai_termid.at_port)));
31287c478bd9Sstevel@tonic-gate #endif
31297c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32((char)1, "type",
3130745b2690Stz 		    (uint32_t)STRUCT_FGET(ainfo_addr, ai_termid.at_type)));
31317c478bd9Sstevel@tonic-gate 		if ((uint32_t)STRUCT_FGET(ainfo_addr, ai_termid.at_type) ==
31327c478bd9Sstevel@tonic-gate 		    AU_IPv4) {
31337c478bd9Sstevel@tonic-gate 			au_uwrite(au_to_in_addr(
3134745b2690Stz 			    (struct in_addr *)STRUCT_FGETP(ainfo_addr,
3135745b2690Stz 			    ai_termid.at_addr)));
31367c478bd9Sstevel@tonic-gate 		} else {
31377c478bd9Sstevel@tonic-gate 			au_uwrite(au_to_in_addr_ex(
3138745b2690Stz 			    (int32_t *)STRUCT_FGETP(ainfo_addr,
3139745b2690Stz 			    ai_termid.at_addr)));
31407c478bd9Sstevel@tonic-gate 		}
31417c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32((char)1, "as_success",
3142745b2690Stz 		    (uint32_t)STRUCT_FGET(ainfo_addr, ai_mask.as_success)));
31437c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32((char)1, "as_failure",
3144745b2690Stz 		    (uint32_t)STRUCT_FGET(ainfo_addr, ai_mask.as_failure)));
31457c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32((char)1, "asid",
3146745b2690Stz 		    (uint32_t)STRUCT_FGET(ainfo_addr, ai_asid)));
31477c478bd9Sstevel@tonic-gate 		break;
3148f8994074SJan Friedel 	case AUE_AUDITON_SETAMASK:
3149f8994074SJan Friedel 		if (copyin((caddr_t)a2, &mask, sizeof (au_mask_t)))
3150f8994074SJan Friedel 				return;
3151f8994074SJan Friedel 		au_uwrite(au_to_arg32(
3152f8994074SJan Friedel 		    2, "setamask:as_success", (uint32_t)mask.as_success));
3153f8994074SJan Friedel 		au_uwrite(au_to_arg32(
3154f8994074SJan Friedel 		    2, "setamask:as_failure", (uint32_t)mask.as_failure));
3155f8994074SJan Friedel 		break;
31567c478bd9Sstevel@tonic-gate 	case AUE_AUDITON_SETKMASK:
31577c478bd9Sstevel@tonic-gate 		if (copyin((caddr_t)a2, &mask, sizeof (au_mask_t)))
31587c478bd9Sstevel@tonic-gate 				return;
31597c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(
3160745b2690Stz 		    2, "setkmask:as_success", (uint32_t)mask.as_success));
31617c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(
3162745b2690Stz 		    2, "setkmask:as_failure", (uint32_t)mask.as_failure));
31637c478bd9Sstevel@tonic-gate 		break;
31647c478bd9Sstevel@tonic-gate 	case AUE_AUDITON_SPOLICY:
31657c478bd9Sstevel@tonic-gate 		if (copyin((caddr_t)a2, &policy, sizeof (int)))
31667c478bd9Sstevel@tonic-gate 			return;
31677c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(3, "setpolicy", (uint32_t)policy));
31687c478bd9Sstevel@tonic-gate 		break;
31697c478bd9Sstevel@tonic-gate 	case AUE_AUDITON_SQCTRL: {
31707c478bd9Sstevel@tonic-gate 		STRUCT_DECL(au_qctrl, qctrl);
31717c478bd9Sstevel@tonic-gate 		model_t model;
31727c478bd9Sstevel@tonic-gate 
31737c478bd9Sstevel@tonic-gate 		model = get_udatamodel();
31747c478bd9Sstevel@tonic-gate 		STRUCT_INIT(qctrl, model);
31757c478bd9Sstevel@tonic-gate 		if (copyin((caddr_t)a2, STRUCT_BUF(qctrl), STRUCT_SIZE(qctrl)))
31767c478bd9Sstevel@tonic-gate 				return;
31777c478bd9Sstevel@tonic-gate 		if (model == DATAMODEL_ILP32) {
31787c478bd9Sstevel@tonic-gate 			au_uwrite(au_to_arg32(
3179745b2690Stz 			    3, "setqctrl:aq_hiwater",
3180745b2690Stz 			    (uint32_t)STRUCT_FGET(qctrl, aq_hiwater)));
31817c478bd9Sstevel@tonic-gate 			au_uwrite(au_to_arg32(
3182745b2690Stz 			    3, "setqctrl:aq_lowater",
3183745b2690Stz 			    (uint32_t)STRUCT_FGET(qctrl, aq_lowater)));
31847c478bd9Sstevel@tonic-gate 			au_uwrite(au_to_arg32(
3185745b2690Stz 			    3, "setqctrl:aq_bufsz",
3186745b2690Stz 			    (uint32_t)STRUCT_FGET(qctrl, aq_bufsz)));
31877c478bd9Sstevel@tonic-gate 			au_uwrite(au_to_arg32(
3188745b2690Stz 			    3, "setqctrl:aq_delay",
3189745b2690Stz 			    (uint32_t)STRUCT_FGET(qctrl, aq_delay)));
31907c478bd9Sstevel@tonic-gate 		} else {
31917c478bd9Sstevel@tonic-gate 			au_uwrite(au_to_arg64(
3192745b2690Stz 			    3, "setqctrl:aq_hiwater",
3193745b2690Stz 			    (uint64_t)STRUCT_FGET(qctrl, aq_hiwater)));
31947c478bd9Sstevel@tonic-gate 			au_uwrite(au_to_arg64(
3195745b2690Stz 			    3, "setqctrl:aq_lowater",
3196745b2690Stz 			    (uint64_t)STRUCT_FGET(qctrl, aq_lowater)));
31977c478bd9Sstevel@tonic-gate 			au_uwrite(au_to_arg64(
3198745b2690Stz 			    3, "setqctrl:aq_bufsz",
3199745b2690Stz 			    (uint64_t)STRUCT_FGET(qctrl, aq_bufsz)));
32007c478bd9Sstevel@tonic-gate 			au_uwrite(au_to_arg64(
3201745b2690Stz 			    3, "setqctrl:aq_delay",
3202745b2690Stz 			    (uint64_t)STRUCT_FGET(qctrl, aq_delay)));
32037c478bd9Sstevel@tonic-gate 		}
32047c478bd9Sstevel@tonic-gate 		break;
32057c478bd9Sstevel@tonic-gate 	}
32067c478bd9Sstevel@tonic-gate 	case AUE_AUDITON_SETUMASK:
32077c478bd9Sstevel@tonic-gate 		STRUCT_INIT(ainfo, get_udatamodel());
32087c478bd9Sstevel@tonic-gate 		if (copyin((caddr_t)uap->a2, STRUCT_BUF(ainfo),
3209745b2690Stz 		    STRUCT_SIZE(ainfo))) {
3210745b2690Stz 			return;
32117c478bd9Sstevel@tonic-gate 		}
32127c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(3, "setumask:as_success",
3213745b2690Stz 		    (uint32_t)STRUCT_FGET(ainfo, ai_mask.as_success)));
32147c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(3, "setumask:as_failure",
3215745b2690Stz 		    (uint32_t)STRUCT_FGET(ainfo, ai_mask.as_failure)));
32167c478bd9Sstevel@tonic-gate 		break;
32177c478bd9Sstevel@tonic-gate 	case AUE_AUDITON_SETSMASK:
32187c478bd9Sstevel@tonic-gate 		STRUCT_INIT(ainfo, get_udatamodel());
32197c478bd9Sstevel@tonic-gate 		if (copyin((caddr_t)uap->a2, STRUCT_BUF(ainfo),
3220745b2690Stz 		    STRUCT_SIZE(ainfo))) {
3221745b2690Stz 			return;
32227c478bd9Sstevel@tonic-gate 		}
32237c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(3, "setsmask:as_success",
3224745b2690Stz 		    (uint32_t)STRUCT_FGET(ainfo, ai_mask.as_success)));
32257c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(3, "setsmask:as_failure",
3226745b2690Stz 		    (uint32_t)STRUCT_FGET(ainfo, ai_mask.as_failure)));
32277c478bd9Sstevel@tonic-gate 		break;
32287c478bd9Sstevel@tonic-gate 	case AUE_AUDITON_SETCOND:
32297c478bd9Sstevel@tonic-gate 		if (copyin((caddr_t)a2, &auditstate, sizeof (int)))
32307c478bd9Sstevel@tonic-gate 			return;
32317c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(3, "setcond", (uint32_t)auditstate));
32327c478bd9Sstevel@tonic-gate 		break;
32337c478bd9Sstevel@tonic-gate 	case AUE_AUDITON_SETCLASS:
32347c478bd9Sstevel@tonic-gate 		if (copyin((caddr_t)a2, &event, sizeof (au_evclass_map_t)))
32357c478bd9Sstevel@tonic-gate 			return;
32367c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(
3237745b2690Stz 		    2, "setclass:ec_event", (uint32_t)event.ec_number));
32387c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(
3239745b2690Stz 		    3, "setclass:ec_class", (uint32_t)event.ec_class));
32407c478bd9Sstevel@tonic-gate 		break;
32417c478bd9Sstevel@tonic-gate 	case AUE_GETAUID:
32427c478bd9Sstevel@tonic-gate 	case AUE_GETAUDIT:
32437c478bd9Sstevel@tonic-gate 	case AUE_GETAUDIT_ADDR:
32447c478bd9Sstevel@tonic-gate 	case AUE_AUDIT:
32457c478bd9Sstevel@tonic-gate 	case AUE_AUDITON_GPOLICY:
32467c478bd9Sstevel@tonic-gate 	case AUE_AUDITON_GQCTRL:
3247f8994074SJan Friedel 	case AUE_AUDITON_GETAMASK:
32487c478bd9Sstevel@tonic-gate 	case AUE_AUDITON_GETKMASK:
32497c478bd9Sstevel@tonic-gate 	case AUE_AUDITON_GETCWD:
32507c478bd9Sstevel@tonic-gate 	case AUE_AUDITON_GETCAR:
32517c478bd9Sstevel@tonic-gate 	case AUE_AUDITON_GETSTAT:
32527c478bd9Sstevel@tonic-gate 	case AUE_AUDITON_SETSTAT:
32537c478bd9Sstevel@tonic-gate 	case AUE_AUDITON_GETCOND:
32547c478bd9Sstevel@tonic-gate 	case AUE_AUDITON_GETCLASS:
32557c478bd9Sstevel@tonic-gate 		break;
32567c478bd9Sstevel@tonic-gate 	default:
32577c478bd9Sstevel@tonic-gate 		break;
32587c478bd9Sstevel@tonic-gate 	}
32597c478bd9Sstevel@tonic-gate 
32607c478bd9Sstevel@tonic-gate }	/* AUS_AUDITSYS */
32617c478bd9Sstevel@tonic-gate 
32627c478bd9Sstevel@tonic-gate 
32637c478bd9Sstevel@tonic-gate /* only audit privileged operations for systeminfo(2) system call */
32647c478bd9Sstevel@tonic-gate static au_event_t
32657c478bd9Sstevel@tonic-gate aui_sysinfo(au_event_t e)
32667c478bd9Sstevel@tonic-gate {
32677c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
32687c478bd9Sstevel@tonic-gate 	uint32_t command;
32697c478bd9Sstevel@tonic-gate 
32707c478bd9Sstevel@tonic-gate 	struct a {
32717c478bd9Sstevel@tonic-gate 		long	command;
32727c478bd9Sstevel@tonic-gate 		long	buf;		/* char * */
32737c478bd9Sstevel@tonic-gate 		long	count;
32747c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
32757c478bd9Sstevel@tonic-gate 
32767c478bd9Sstevel@tonic-gate 	command = (uint32_t)uap->command;
32777c478bd9Sstevel@tonic-gate 
32787c478bd9Sstevel@tonic-gate 	switch (command) {
32797c478bd9Sstevel@tonic-gate 	case SI_SET_HOSTNAME:
32807c478bd9Sstevel@tonic-gate 	case SI_SET_SRPC_DOMAIN:
32817c478bd9Sstevel@tonic-gate 		e = (au_event_t)AUE_SYSINFO;
32827c478bd9Sstevel@tonic-gate 		break;
32837c478bd9Sstevel@tonic-gate 	default:
32847c478bd9Sstevel@tonic-gate 		e = (au_event_t)AUE_NULL;
32857c478bd9Sstevel@tonic-gate 		break;
32867c478bd9Sstevel@tonic-gate 	}
32877c478bd9Sstevel@tonic-gate 	return (e);
32887c478bd9Sstevel@tonic-gate }
32897c478bd9Sstevel@tonic-gate 
32907c478bd9Sstevel@tonic-gate /*ARGSUSED*/
32917c478bd9Sstevel@tonic-gate static void
32927c478bd9Sstevel@tonic-gate aus_sysinfo(struct t_audit_data *tad)
32937c478bd9Sstevel@tonic-gate {
32947c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
32957c478bd9Sstevel@tonic-gate 	uint32_t command;
32967c478bd9Sstevel@tonic-gate 	size_t len, maxlen;
32977c478bd9Sstevel@tonic-gate 	char *name;
32987c478bd9Sstevel@tonic-gate 	uintptr_t buf;
32997c478bd9Sstevel@tonic-gate 
33007c478bd9Sstevel@tonic-gate 	struct a {
33017c478bd9Sstevel@tonic-gate 		long	command;
33027c478bd9Sstevel@tonic-gate 		long	buf;		/* char * */
33037c478bd9Sstevel@tonic-gate 		long	count;
33047c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
33057c478bd9Sstevel@tonic-gate 
33067c478bd9Sstevel@tonic-gate 	command = (uint32_t)uap->command;
33077c478bd9Sstevel@tonic-gate 	buf = (uintptr_t)uap->buf;
33087c478bd9Sstevel@tonic-gate 
33097c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(1, "cmd", command));
33107c478bd9Sstevel@tonic-gate 
33117c478bd9Sstevel@tonic-gate 	switch (command) {
33127c478bd9Sstevel@tonic-gate 	case SI_SET_HOSTNAME:
33137c478bd9Sstevel@tonic-gate 	{
33147c478bd9Sstevel@tonic-gate 		if (secpolicy_sys_config(CRED(), B_TRUE) != 0)
33157c478bd9Sstevel@tonic-gate 			return;
33167c478bd9Sstevel@tonic-gate 
33177c478bd9Sstevel@tonic-gate 		maxlen = SYS_NMLN;
33187c478bd9Sstevel@tonic-gate 		name = kmem_alloc(maxlen, KM_SLEEP);
33197c478bd9Sstevel@tonic-gate 		if (copyinstr((caddr_t)buf, name, SYS_NMLN, &len))
33207c478bd9Sstevel@tonic-gate 			break;
33217c478bd9Sstevel@tonic-gate 
33227c478bd9Sstevel@tonic-gate 		/*
33237c478bd9Sstevel@tonic-gate 		 * Must be non-NULL string and string
33247c478bd9Sstevel@tonic-gate 		 * must be less than SYS_NMLN chars.
33257c478bd9Sstevel@tonic-gate 		 */
33267c478bd9Sstevel@tonic-gate 		if (len < 2 || (len == SYS_NMLN && name[SYS_NMLN - 1] != '\0'))
33277c478bd9Sstevel@tonic-gate 			break;
33287c478bd9Sstevel@tonic-gate 
33297c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_text(name));
33307c478bd9Sstevel@tonic-gate 		break;
33317c478bd9Sstevel@tonic-gate 	}
33327c478bd9Sstevel@tonic-gate 
33337c478bd9Sstevel@tonic-gate 	case SI_SET_SRPC_DOMAIN:
33347c478bd9Sstevel@tonic-gate 	{
33357c478bd9Sstevel@tonic-gate 		if (secpolicy_sys_config(CRED(), B_TRUE) != 0)
33367c478bd9Sstevel@tonic-gate 			return;
33377c478bd9Sstevel@tonic-gate 
33387c478bd9Sstevel@tonic-gate 		maxlen = SYS_NMLN;
33397c478bd9Sstevel@tonic-gate 		name = kmem_alloc(maxlen, KM_SLEEP);
33407c478bd9Sstevel@tonic-gate 		if (copyinstr((caddr_t)buf, name, SYS_NMLN, &len))
33417c478bd9Sstevel@tonic-gate 			break;
33427c478bd9Sstevel@tonic-gate 
33437c478bd9Sstevel@tonic-gate 		/*
33447c478bd9Sstevel@tonic-gate 		 * If string passed in is longer than length
33457c478bd9Sstevel@tonic-gate 		 * allowed for domain name, fail.
33467c478bd9Sstevel@tonic-gate 		 */
33477c478bd9Sstevel@tonic-gate 		if (len == SYS_NMLN && name[SYS_NMLN - 1] != '\0')
33487c478bd9Sstevel@tonic-gate 			break;
33497c478bd9Sstevel@tonic-gate 
33507c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_text(name));
33517c478bd9Sstevel@tonic-gate 		break;
33527c478bd9Sstevel@tonic-gate 	}
33537c478bd9Sstevel@tonic-gate 
33547c478bd9Sstevel@tonic-gate 	default:
33557c478bd9Sstevel@tonic-gate 		return;
33567c478bd9Sstevel@tonic-gate 	}
33577c478bd9Sstevel@tonic-gate 
33587c478bd9Sstevel@tonic-gate 	kmem_free(name, maxlen);
33597c478bd9Sstevel@tonic-gate }
33607c478bd9Sstevel@tonic-gate 
33617c478bd9Sstevel@tonic-gate static au_event_t
33627c478bd9Sstevel@tonic-gate aui_modctl(au_event_t e)
33637c478bd9Sstevel@tonic-gate {
33647c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
33657c478bd9Sstevel@tonic-gate 	uint_t cmd;
33667c478bd9Sstevel@tonic-gate 
33677c478bd9Sstevel@tonic-gate 	struct a {
33687c478bd9Sstevel@tonic-gate 		long	cmd;
33697c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
33707c478bd9Sstevel@tonic-gate 
33717c478bd9Sstevel@tonic-gate 	cmd = (uint_t)uap->cmd;
33727c478bd9Sstevel@tonic-gate 
33737c478bd9Sstevel@tonic-gate 	switch (cmd) {
33747c478bd9Sstevel@tonic-gate 	case MODLOAD:
33757c478bd9Sstevel@tonic-gate 		e = AUE_MODLOAD;
33767c478bd9Sstevel@tonic-gate 		break;
33777c478bd9Sstevel@tonic-gate 	case MODUNLOAD:
33787c478bd9Sstevel@tonic-gate 		e = AUE_MODUNLOAD;
33797c478bd9Sstevel@tonic-gate 		break;
33807c478bd9Sstevel@tonic-gate 	case MODADDMAJBIND:
33817c478bd9Sstevel@tonic-gate 		e = AUE_MODADDMAJ;
33827c478bd9Sstevel@tonic-gate 		break;
33837c478bd9Sstevel@tonic-gate 	case MODSETDEVPOLICY:
33847c478bd9Sstevel@tonic-gate 		e = AUE_MODDEVPLCY;
33857c478bd9Sstevel@tonic-gate 		break;
33867c478bd9Sstevel@tonic-gate 	case MODALLOCPRIV:
33877c478bd9Sstevel@tonic-gate 		e = AUE_MODADDPRIV;
33887c478bd9Sstevel@tonic-gate 		break;
33897c478bd9Sstevel@tonic-gate 	default:
33907c478bd9Sstevel@tonic-gate 		e = AUE_NULL;
33917c478bd9Sstevel@tonic-gate 		break;
33927c478bd9Sstevel@tonic-gate 	}
33937c478bd9Sstevel@tonic-gate 	return (e);
33947c478bd9Sstevel@tonic-gate }
33957c478bd9Sstevel@tonic-gate 
33967c478bd9Sstevel@tonic-gate 
33977c478bd9Sstevel@tonic-gate /*ARGSUSED*/
33987c478bd9Sstevel@tonic-gate static void
33997c478bd9Sstevel@tonic-gate aus_modctl(struct t_audit_data *tad)
34007c478bd9Sstevel@tonic-gate {
34017c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
34027c478bd9Sstevel@tonic-gate 	void *a	= clwp->lwp_ap;
34037c478bd9Sstevel@tonic-gate 	uint_t use_path;
34047c478bd9Sstevel@tonic-gate 
34057c478bd9Sstevel@tonic-gate 	switch (tad->tad_event) {
34067c478bd9Sstevel@tonic-gate 	case AUE_MODLOAD: {
34077c478bd9Sstevel@tonic-gate 		typedef struct {
34087c478bd9Sstevel@tonic-gate 			long	cmd;
34097c478bd9Sstevel@tonic-gate 			long	use_path;
34107c478bd9Sstevel@tonic-gate 			long	filename;		/* char * */
34117c478bd9Sstevel@tonic-gate 		} modloada_t;
34127c478bd9Sstevel@tonic-gate 
34137c478bd9Sstevel@tonic-gate 		char *filenamep;
34147c478bd9Sstevel@tonic-gate 		uintptr_t fname;
34157c478bd9Sstevel@tonic-gate 		extern char *default_path;
34167c478bd9Sstevel@tonic-gate 
34177c478bd9Sstevel@tonic-gate 		fname = (uintptr_t)((modloada_t *)a)->filename;
34187c478bd9Sstevel@tonic-gate 		use_path = (uint_t)((modloada_t *)a)->use_path;
34197c478bd9Sstevel@tonic-gate 
34207c478bd9Sstevel@tonic-gate 			/* space to hold path */
34217c478bd9Sstevel@tonic-gate 		filenamep = kmem_alloc(MOD_MAXPATH, KM_SLEEP);
34227c478bd9Sstevel@tonic-gate 			/* get string */
34237c478bd9Sstevel@tonic-gate 		if (copyinstr((caddr_t)fname, filenamep, MOD_MAXPATH, 0)) {
34247c478bd9Sstevel@tonic-gate 				/* free allocated path */
34257c478bd9Sstevel@tonic-gate 			kmem_free(filenamep, MOD_MAXPATH);
34267c478bd9Sstevel@tonic-gate 			return;
34277c478bd9Sstevel@tonic-gate 		}
34287c478bd9Sstevel@tonic-gate 			/* ensure it's null terminated */
34297c478bd9Sstevel@tonic-gate 		filenamep[MOD_MAXPATH - 1] = 0;
34307c478bd9Sstevel@tonic-gate 
34317c478bd9Sstevel@tonic-gate 		if (use_path)
34327c478bd9Sstevel@tonic-gate 			au_uwrite(au_to_text(default_path));
34337c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_text(filenamep));
34347c478bd9Sstevel@tonic-gate 
34357c478bd9Sstevel@tonic-gate 			/* release temporary memory */
34367c478bd9Sstevel@tonic-gate 		kmem_free(filenamep, MOD_MAXPATH);
34377c478bd9Sstevel@tonic-gate 		break;
34387c478bd9Sstevel@tonic-gate 	}
34397c478bd9Sstevel@tonic-gate 	case AUE_MODUNLOAD: {
34407c478bd9Sstevel@tonic-gate 		typedef struct {
34417c478bd9Sstevel@tonic-gate 			long	cmd;
34427c478bd9Sstevel@tonic-gate 			long	id;
34437c478bd9Sstevel@tonic-gate 		} modunloada_t;
34447c478bd9Sstevel@tonic-gate 
34457c478bd9Sstevel@tonic-gate 		uint32_t id = (uint32_t)((modunloada_t *)a)->id;
34467c478bd9Sstevel@tonic-gate 
34477c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "id", id));
34487c478bd9Sstevel@tonic-gate 		break;
34497c478bd9Sstevel@tonic-gate 	}
34507c478bd9Sstevel@tonic-gate 	case AUE_MODADDMAJ: {
34517c478bd9Sstevel@tonic-gate 		STRUCT_DECL(modconfig, mc);
34527c478bd9Sstevel@tonic-gate 		typedef struct {
34537c478bd9Sstevel@tonic-gate 			long	cmd;
34547c478bd9Sstevel@tonic-gate 			long	subcmd;
34557c478bd9Sstevel@tonic-gate 			long	data;		/* int * */
34567c478bd9Sstevel@tonic-gate 		} modconfiga_t;
34577c478bd9Sstevel@tonic-gate 
34587c478bd9Sstevel@tonic-gate 		STRUCT_DECL(aliases, alias);
34597c478bd9Sstevel@tonic-gate 		caddr_t ap;
34607c478bd9Sstevel@tonic-gate 		int i, num_aliases;
34617c478bd9Sstevel@tonic-gate 		char *drvname, *mc_drvname;
34627c478bd9Sstevel@tonic-gate 		char *name;
34637c478bd9Sstevel@tonic-gate 		extern char *ddi_major_to_name(major_t);
34647c478bd9Sstevel@tonic-gate 		model_t model;
34657c478bd9Sstevel@tonic-gate 
34667c478bd9Sstevel@tonic-gate 		uintptr_t data = (uintptr_t)((modconfiga_t *)a)->data;
34677c478bd9Sstevel@tonic-gate 
34687c478bd9Sstevel@tonic-gate 		model = get_udatamodel();
34697c478bd9Sstevel@tonic-gate 		STRUCT_INIT(mc, model);
34707c478bd9Sstevel@tonic-gate 			/* sanitize buffer */
34717c478bd9Sstevel@tonic-gate 		bzero((caddr_t)STRUCT_BUF(mc), STRUCT_SIZE(mc));
34727c478bd9Sstevel@tonic-gate 			/* get user arguments */
34737c478bd9Sstevel@tonic-gate 		if (copyin((caddr_t)data, (caddr_t)STRUCT_BUF(mc),
3474745b2690Stz 		    STRUCT_SIZE(mc)) != 0)
34757c478bd9Sstevel@tonic-gate 			return;
34767c478bd9Sstevel@tonic-gate 
34777c478bd9Sstevel@tonic-gate 		mc_drvname = STRUCT_FGET(mc, drvname);
34787c478bd9Sstevel@tonic-gate 		if ((drvname = ddi_major_to_name(
3479745b2690Stz 		    (major_t)STRUCT_FGET(mc, major))) != NULL &&
3480745b2690Stz 		    strncmp(drvname, mc_drvname, MAXMODCONFNAME) != 0) {
34817c478bd9Sstevel@tonic-gate 				/* safety */
34827c478bd9Sstevel@tonic-gate 			if (mc_drvname[0] != '\0') {
34837c478bd9Sstevel@tonic-gate 				mc_drvname[MAXMODCONFNAME-1] = '\0';
34847c478bd9Sstevel@tonic-gate 				au_uwrite(au_to_text(mc_drvname));
34857c478bd9Sstevel@tonic-gate 			}
34867c478bd9Sstevel@tonic-gate 				/* drvname != NULL from test above */
34877c478bd9Sstevel@tonic-gate 			au_uwrite(au_to_text(drvname));
34887c478bd9Sstevel@tonic-gate 			return;
34897c478bd9Sstevel@tonic-gate 		}
34907c478bd9Sstevel@tonic-gate 
34917c478bd9Sstevel@tonic-gate 		if (mc_drvname[0] != '\0') {
34927c478bd9Sstevel@tonic-gate 				/* safety */
34937c478bd9Sstevel@tonic-gate 			mc_drvname[MAXMODCONFNAME-1] = '\0';
34947c478bd9Sstevel@tonic-gate 			au_uwrite(au_to_text(mc_drvname));
34957c478bd9Sstevel@tonic-gate 		} else
34967c478bd9Sstevel@tonic-gate 			au_uwrite(au_to_text("no drvname"));
34977c478bd9Sstevel@tonic-gate 
34987c478bd9Sstevel@tonic-gate 		num_aliases = STRUCT_FGET(mc, num_aliases);
34997c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(5, "", (uint32_t)num_aliases));
35007c478bd9Sstevel@tonic-gate 		ap = (caddr_t)STRUCT_FGETP(mc, ap);
35017c478bd9Sstevel@tonic-gate 		name = kmem_alloc(MAXMODCONFNAME, KM_SLEEP);
35027c478bd9Sstevel@tonic-gate 		STRUCT_INIT(alias, model);
35037c478bd9Sstevel@tonic-gate 		for (i = 0; i < num_aliases; i++) {
35047c478bd9Sstevel@tonic-gate 			bzero((caddr_t)STRUCT_BUF(alias),
3505745b2690Stz 			    STRUCT_SIZE(alias));
35067c478bd9Sstevel@tonic-gate 			if (copyin((caddr_t)ap, (caddr_t)STRUCT_BUF(alias),
3507745b2690Stz 			    STRUCT_SIZE(alias)) != 0)
35087c478bd9Sstevel@tonic-gate 				break;
35097c478bd9Sstevel@tonic-gate 			if (copyinstr(STRUCT_FGETP(alias, a_name), name,
35107c478bd9Sstevel@tonic-gate 			    MAXMODCONFNAME, NULL) != 0) {
35117c478bd9Sstevel@tonic-gate 				break;
35127c478bd9Sstevel@tonic-gate 			}
35137c478bd9Sstevel@tonic-gate 
35147c478bd9Sstevel@tonic-gate 			au_uwrite(au_to_text(name));
35157c478bd9Sstevel@tonic-gate 			ap = (caddr_t)STRUCT_FGETP(alias, a_next);
35167c478bd9Sstevel@tonic-gate 		}
35177c478bd9Sstevel@tonic-gate 		kmem_free(name, MAXMODCONFNAME);
35187c478bd9Sstevel@tonic-gate 		break;
35197c478bd9Sstevel@tonic-gate 	}
35207c478bd9Sstevel@tonic-gate 	default:
35217c478bd9Sstevel@tonic-gate 		break;
35227c478bd9Sstevel@tonic-gate 	}
35237c478bd9Sstevel@tonic-gate }
35247c478bd9Sstevel@tonic-gate 
35257c478bd9Sstevel@tonic-gate 
35267c478bd9Sstevel@tonic-gate /*ARGSUSED*/
35277c478bd9Sstevel@tonic-gate static void
35287c478bd9Sstevel@tonic-gate auf_accept(
35297c478bd9Sstevel@tonic-gate 	struct t_audit_data *tad,
35307c478bd9Sstevel@tonic-gate 	int	error,
35317c478bd9Sstevel@tonic-gate 	rval_t	*rval)
35327c478bd9Sstevel@tonic-gate {
35337c478bd9Sstevel@tonic-gate 	uint32_t scid;
35347c478bd9Sstevel@tonic-gate 	uint32_t sy_flags;
35357c478bd9Sstevel@tonic-gate 	int fd;
35367c478bd9Sstevel@tonic-gate 	struct sonode *so;
35377c478bd9Sstevel@tonic-gate 	char so_laddr[sizeof (struct sockaddr_in6)];
35387c478bd9Sstevel@tonic-gate 	char so_faddr[sizeof (struct sockaddr_in6)];
35397c478bd9Sstevel@tonic-gate 	int err;
35407c478bd9Sstevel@tonic-gate 	short so_family, so_type;
35417c478bd9Sstevel@tonic-gate 	int add_sock_token = 0;
35427c478bd9Sstevel@tonic-gate 
35437c478bd9Sstevel@tonic-gate 	/* need to determine type of executing binary */
35447c478bd9Sstevel@tonic-gate 	scid = tad->tad_scid;
35457c478bd9Sstevel@tonic-gate #ifdef _SYSCALL32_IMPL
35467c478bd9Sstevel@tonic-gate 	if (lwp_getdatamodel(ttolwp(curthread)) == DATAMODEL_NATIVE)
35477c478bd9Sstevel@tonic-gate 		sy_flags = sysent[scid].sy_flags & SE_RVAL_MASK;
35487c478bd9Sstevel@tonic-gate 	else
35497c478bd9Sstevel@tonic-gate 		sy_flags = sysent32[scid].sy_flags & SE_RVAL_MASK;
35507c478bd9Sstevel@tonic-gate #else
35517c478bd9Sstevel@tonic-gate 	sy_flags = sysent[scid].sy_flags & SE_RVAL_MASK;
35527c478bd9Sstevel@tonic-gate #endif
3553aeba2189SMarek Pospisil 	switch (sy_flags) {
3554aeba2189SMarek Pospisil 	case SE_32RVAL1:
3555aeba2189SMarek Pospisil 		/* FALLTHRU */
3556aeba2189SMarek Pospisil 	case SE_32RVAL2|SE_32RVAL1:
35577c478bd9Sstevel@tonic-gate 		fd = rval->r_val1;
3558aeba2189SMarek Pospisil 		break;
3559aeba2189SMarek Pospisil 	case SE_64RVAL:
35607c478bd9Sstevel@tonic-gate 		fd = (int)rval->r_vals;
3561aeba2189SMarek Pospisil 		break;
3562aeba2189SMarek Pospisil 	default:
3563aeba2189SMarek Pospisil 		/*
3564aeba2189SMarek Pospisil 		 * should never happen, seems to be an internal error
3565aeba2189SMarek Pospisil 		 * in sysent => no fd, nothing to audit here, returning
3566aeba2189SMarek Pospisil 		 */
3567aeba2189SMarek Pospisil 		return;
3568aeba2189SMarek Pospisil 	}
35697c478bd9Sstevel@tonic-gate 
35707c478bd9Sstevel@tonic-gate 	if (error) {
35717c478bd9Sstevel@tonic-gate 		/* can't trust socket contents. Just return */
35727c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
35737c478bd9Sstevel@tonic-gate 		return;
35747c478bd9Sstevel@tonic-gate 	}
35757c478bd9Sstevel@tonic-gate 
3576745b2690Stz 	if ((so = getsonode(fd, &err, NULL)) == NULL) {
35777c478bd9Sstevel@tonic-gate 		/*
35787c478bd9Sstevel@tonic-gate 		 * not security relevant if doing a accept from non socket
35797c478bd9Sstevel@tonic-gate 		 * so no extra tokens. Should probably turn off audit record
35807c478bd9Sstevel@tonic-gate 		 * generation here.
35817c478bd9Sstevel@tonic-gate 		 */
35827c478bd9Sstevel@tonic-gate 		return;
35837c478bd9Sstevel@tonic-gate 	}
35847c478bd9Sstevel@tonic-gate 
35857c478bd9Sstevel@tonic-gate 	so_family = so->so_family;
35867c478bd9Sstevel@tonic-gate 	so_type   = so->so_type;
35877c478bd9Sstevel@tonic-gate 
35887c478bd9Sstevel@tonic-gate 	switch (so_family) {
35897c478bd9Sstevel@tonic-gate 	case AF_INET:
35907c478bd9Sstevel@tonic-gate 	case AF_INET6:
35917c478bd9Sstevel@tonic-gate 		/*
35927c478bd9Sstevel@tonic-gate 		 * XXX - what about other socket types for AF_INET (e.g. DGRAM)
35937c478bd9Sstevel@tonic-gate 		 */
35947c478bd9Sstevel@tonic-gate 		if (so->so_type == SOCK_STREAM) {
35950f1702c5SYu Xiangning 			socklen_t len;
35967c478bd9Sstevel@tonic-gate 
35977c478bd9Sstevel@tonic-gate 			bzero((void *)so_laddr, sizeof (so_laddr));
35987c478bd9Sstevel@tonic-gate 			bzero((void *)so_faddr, sizeof (so_faddr));
35997c478bd9Sstevel@tonic-gate 
36000f1702c5SYu Xiangning 			len = sizeof (so_laddr);
36010f1702c5SYu Xiangning 			(void) socket_getsockname(so,
36020f1702c5SYu Xiangning 			    (struct sockaddr *)so_laddr, &len, CRED());
36030f1702c5SYu Xiangning 			len = sizeof (so_faddr);
36040f1702c5SYu Xiangning 			(void) socket_getpeername(so,
36050f1702c5SYu Xiangning 			    (struct sockaddr *)so_faddr, &len, B_FALSE, CRED());
36067c478bd9Sstevel@tonic-gate 
36077c478bd9Sstevel@tonic-gate 			add_sock_token = 1;
36087c478bd9Sstevel@tonic-gate 		}
36097c478bd9Sstevel@tonic-gate 		break;
36107c478bd9Sstevel@tonic-gate 
36117c478bd9Sstevel@tonic-gate 	default:
36127c478bd9Sstevel@tonic-gate 		/* AF_UNIX, AF_ROUTE, AF_KEY do not support accept */
36137c478bd9Sstevel@tonic-gate 		break;
36147c478bd9Sstevel@tonic-gate 	}
36157c478bd9Sstevel@tonic-gate 
36167c478bd9Sstevel@tonic-gate 	releasef(fd);
36177c478bd9Sstevel@tonic-gate 
36187c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
36197c478bd9Sstevel@tonic-gate 
36207c478bd9Sstevel@tonic-gate 	if (add_sock_token == 0) {
36217c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(0, "family", (uint32_t)(so_family)));
36227c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(0, "type", (uint32_t)(so_type)));
36237c478bd9Sstevel@tonic-gate 		return;
36247c478bd9Sstevel@tonic-gate 	}
36257c478bd9Sstevel@tonic-gate 
36267c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_socket_ex(so_family, so_type, so_laddr, so_faddr));
36277c478bd9Sstevel@tonic-gate 
36287c478bd9Sstevel@tonic-gate }
36297c478bd9Sstevel@tonic-gate 
36307c478bd9Sstevel@tonic-gate /*ARGSUSED*/
36317c478bd9Sstevel@tonic-gate static void
36327c478bd9Sstevel@tonic-gate auf_bind(struct t_audit_data *tad, int error, rval_t *rvp)
36337c478bd9Sstevel@tonic-gate {
36347c478bd9Sstevel@tonic-gate 	struct a {
36357c478bd9Sstevel@tonic-gate 		long	fd;
36367c478bd9Sstevel@tonic-gate 		long	addr;
36377c478bd9Sstevel@tonic-gate 		long	len;
36387c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)ttolwp(curthread)->lwp_ap;
36397c478bd9Sstevel@tonic-gate 
36407c478bd9Sstevel@tonic-gate 	struct sonode *so;
36417c478bd9Sstevel@tonic-gate 	char so_laddr[sizeof (struct sockaddr_in6)];
36427c478bd9Sstevel@tonic-gate 	char so_faddr[sizeof (struct sockaddr_in6)];
36437c478bd9Sstevel@tonic-gate 	int err, fd;
36440f1702c5SYu Xiangning 	socklen_t len;
36457c478bd9Sstevel@tonic-gate 	short so_family, so_type;
36467c478bd9Sstevel@tonic-gate 	int add_sock_token = 0;
36477c478bd9Sstevel@tonic-gate 
36487c478bd9Sstevel@tonic-gate 	fd = (int)uap->fd;
36497c478bd9Sstevel@tonic-gate 
36507c478bd9Sstevel@tonic-gate 	/*
36517c478bd9Sstevel@tonic-gate 	 * bind failed, then nothing extra to add to audit record.
36527c478bd9Sstevel@tonic-gate 	 */
36537c478bd9Sstevel@tonic-gate 	if (error) {
36547c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
36557c478bd9Sstevel@tonic-gate 		/* XXX may want to add failed address some day */
36567c478bd9Sstevel@tonic-gate 		return;
36577c478bd9Sstevel@tonic-gate 	}
36587c478bd9Sstevel@tonic-gate 
3659745b2690Stz 	if ((so = getsonode(fd, &err, NULL)) == NULL) {
36607c478bd9Sstevel@tonic-gate 		/*
36617c478bd9Sstevel@tonic-gate 		 * not security relevant if doing a bind from non socket
36627c478bd9Sstevel@tonic-gate 		 * so no extra tokens. Should probably turn off audit record
36637c478bd9Sstevel@tonic-gate 		 * generation here.
36647c478bd9Sstevel@tonic-gate 		 */
36657c478bd9Sstevel@tonic-gate 		return;
36667c478bd9Sstevel@tonic-gate 	}
36677c478bd9Sstevel@tonic-gate 
36687c478bd9Sstevel@tonic-gate 	so_family = so->so_family;
36697c478bd9Sstevel@tonic-gate 	so_type   = so->so_type;
36707c478bd9Sstevel@tonic-gate 
36717c478bd9Sstevel@tonic-gate 	switch (so_family) {
36727c478bd9Sstevel@tonic-gate 	case AF_INET:
36737c478bd9Sstevel@tonic-gate 	case AF_INET6:
36747c478bd9Sstevel@tonic-gate 
36757c478bd9Sstevel@tonic-gate 		bzero(so_faddr, sizeof (so_faddr));
36760f1702c5SYu Xiangning 		len = sizeof (so_faddr);
36777c478bd9Sstevel@tonic-gate 
36780f1702c5SYu Xiangning 		(void) socket_getpeername(so,
36790f1702c5SYu Xiangning 		    (struct sockaddr *)so_faddr, &len, B_FALSE, CRED());
36807c478bd9Sstevel@tonic-gate 		add_sock_token = 1;
36817c478bd9Sstevel@tonic-gate 
36827c478bd9Sstevel@tonic-gate 		break;
36837c478bd9Sstevel@tonic-gate 
36847c478bd9Sstevel@tonic-gate 	case AF_UNIX:
36857c478bd9Sstevel@tonic-gate 		/* token added by lookup */
36867c478bd9Sstevel@tonic-gate 		break;
36877c478bd9Sstevel@tonic-gate 	default:
36887c478bd9Sstevel@tonic-gate 		/* AF_ROUTE, AF_KEY do not support accept */
36897c478bd9Sstevel@tonic-gate 		break;
36907c478bd9Sstevel@tonic-gate 	}
36917c478bd9Sstevel@tonic-gate 
36927c478bd9Sstevel@tonic-gate 	releasef(fd);
36937c478bd9Sstevel@tonic-gate 
36947c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
36957c478bd9Sstevel@tonic-gate 
36967c478bd9Sstevel@tonic-gate 	if (add_sock_token == 0) {
36977c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "family", (uint32_t)(so_family)));
36987c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "type", (uint32_t)(so_type)));
36997c478bd9Sstevel@tonic-gate 		return;
37007c478bd9Sstevel@tonic-gate 	}
37017c478bd9Sstevel@tonic-gate 
37027c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_socket_ex(so_family, so_type, so_laddr, so_faddr));
37037c478bd9Sstevel@tonic-gate 
37047c478bd9Sstevel@tonic-gate }
37057c478bd9Sstevel@tonic-gate 
37067c478bd9Sstevel@tonic-gate /*ARGSUSED*/
37077c478bd9Sstevel@tonic-gate static void
37087c478bd9Sstevel@tonic-gate auf_connect(struct t_audit_data *tad, int error, rval_t *rval)
37097c478bd9Sstevel@tonic-gate {
37107c478bd9Sstevel@tonic-gate 	struct a {
37117c478bd9Sstevel@tonic-gate 		long	fd;
37127c478bd9Sstevel@tonic-gate 		long	addr;
37137c478bd9Sstevel@tonic-gate 		long	len;
37147c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)ttolwp(curthread)->lwp_ap;
37157c478bd9Sstevel@tonic-gate 
37167c478bd9Sstevel@tonic-gate 	struct sonode *so;
37177c478bd9Sstevel@tonic-gate 	char so_laddr[sizeof (struct sockaddr_in6)];
37187c478bd9Sstevel@tonic-gate 	char so_faddr[sizeof (struct sockaddr_in6)];
37197c478bd9Sstevel@tonic-gate 	int err, fd;
37200f1702c5SYu Xiangning 	socklen_t len;
37217c478bd9Sstevel@tonic-gate 	short so_family, so_type;
37227c478bd9Sstevel@tonic-gate 	int add_sock_token = 0;
37237c478bd9Sstevel@tonic-gate 
37247c478bd9Sstevel@tonic-gate 	fd = (int)uap->fd;
37257c478bd9Sstevel@tonic-gate 
37267c478bd9Sstevel@tonic-gate 
3727745b2690Stz 	if ((so = getsonode(fd, &err, NULL)) == NULL) {
37287c478bd9Sstevel@tonic-gate 		/*
37297c478bd9Sstevel@tonic-gate 		 * not security relevant if doing a connect from non socket
37307c478bd9Sstevel@tonic-gate 		 * so no extra tokens. Should probably turn off audit record
37317c478bd9Sstevel@tonic-gate 		 * generation here.
37327c478bd9Sstevel@tonic-gate 		 */
37337c478bd9Sstevel@tonic-gate 		return;
37347c478bd9Sstevel@tonic-gate 	}
37357c478bd9Sstevel@tonic-gate 
37367c478bd9Sstevel@tonic-gate 	so_family = so->so_family;
37377c478bd9Sstevel@tonic-gate 	so_type   = so->so_type;
37387c478bd9Sstevel@tonic-gate 
37397c478bd9Sstevel@tonic-gate 	switch (so_family) {
37407c478bd9Sstevel@tonic-gate 	case AF_INET:
37417c478bd9Sstevel@tonic-gate 	case AF_INET6:
37427c478bd9Sstevel@tonic-gate 
37437c478bd9Sstevel@tonic-gate 		bzero(so_laddr, sizeof (so_laddr));
37447c478bd9Sstevel@tonic-gate 		bzero(so_faddr, sizeof (so_faddr));
37457c478bd9Sstevel@tonic-gate 
37460f1702c5SYu Xiangning 		len = sizeof (so_laddr);
37470f1702c5SYu Xiangning 		(void) socket_getsockname(so, (struct sockaddr *)so_laddr,
37480f1702c5SYu Xiangning 		    &len, CRED());
37497c478bd9Sstevel@tonic-gate 		if (error) {
3750*0f48f68dSToomas Soome 			if (uap->addr == 0)
37517c478bd9Sstevel@tonic-gate 				break;
37527c478bd9Sstevel@tonic-gate 			if (uap->len <= 0)
37537c478bd9Sstevel@tonic-gate 				break;
37547c478bd9Sstevel@tonic-gate 			len = min(uap->len, sizeof (so_faddr));
37557c478bd9Sstevel@tonic-gate 			if (copyin((caddr_t)(uap->addr), so_faddr, len) != 0)
37567c478bd9Sstevel@tonic-gate 				break;
37577c478bd9Sstevel@tonic-gate #ifdef NOTYET
37587c478bd9Sstevel@tonic-gate 			au_uwrite(au_to_data(AUP_HEX, AUR_CHAR, len, so_faddr));
37597c478bd9Sstevel@tonic-gate #endif
37607c478bd9Sstevel@tonic-gate 		} else {
37617c478bd9Sstevel@tonic-gate 			/* sanity check on length */
37620f1702c5SYu Xiangning 			len = sizeof (so_faddr);
37630f1702c5SYu Xiangning 			(void) socket_getpeername(so,
37640f1702c5SYu Xiangning 			    (struct sockaddr *)so_faddr, &len, B_FALSE, CRED());
37657c478bd9Sstevel@tonic-gate 		}
37667c478bd9Sstevel@tonic-gate 
37677c478bd9Sstevel@tonic-gate 		add_sock_token = 1;
37687c478bd9Sstevel@tonic-gate 
37697c478bd9Sstevel@tonic-gate 		break;
37707c478bd9Sstevel@tonic-gate 
37717c478bd9Sstevel@tonic-gate 	case AF_UNIX:
37727c478bd9Sstevel@tonic-gate 		/* does a lookup on name */
37737c478bd9Sstevel@tonic-gate 		break;
37747c478bd9Sstevel@tonic-gate 
37757c478bd9Sstevel@tonic-gate 	default:
37767c478bd9Sstevel@tonic-gate 		/* AF_ROUTE, AF_KEY do not support accept */
37777c478bd9Sstevel@tonic-gate 		break;
37787c478bd9Sstevel@tonic-gate 	}
37797c478bd9Sstevel@tonic-gate 
37807c478bd9Sstevel@tonic-gate 	releasef(fd);
37817c478bd9Sstevel@tonic-gate 
37827c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
37837c478bd9Sstevel@tonic-gate 
37847c478bd9Sstevel@tonic-gate 	if (add_sock_token == 0) {
37857c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "family", (uint32_t)(so_family)));
37867c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "type", (uint32_t)(so_type)));
37877c478bd9Sstevel@tonic-gate 		return;
37887c478bd9Sstevel@tonic-gate 	}
37897c478bd9Sstevel@tonic-gate 
37907c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_socket_ex(so_family, so_type, so_laddr, so_faddr));
37917c478bd9Sstevel@tonic-gate 
37927c478bd9Sstevel@tonic-gate }
37937c478bd9Sstevel@tonic-gate 
37947c478bd9Sstevel@tonic-gate /*ARGSUSED*/
37957c478bd9Sstevel@tonic-gate static void
37967c478bd9Sstevel@tonic-gate aus_shutdown(struct t_audit_data *tad)
37977c478bd9Sstevel@tonic-gate {
37987c478bd9Sstevel@tonic-gate 	struct a {
37997c478bd9Sstevel@tonic-gate 		long	fd;
38007c478bd9Sstevel@tonic-gate 		long	how;
38017c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)ttolwp(curthread)->lwp_ap;
38027c478bd9Sstevel@tonic-gate 
38037c478bd9Sstevel@tonic-gate 	struct sonode *so;
38047c478bd9Sstevel@tonic-gate 	char so_laddr[sizeof (struct sockaddr_in6)];
38057c478bd9Sstevel@tonic-gate 	char so_faddr[sizeof (struct sockaddr_in6)];
38067c478bd9Sstevel@tonic-gate 	int err, fd;
38070f1702c5SYu Xiangning 	socklen_t len;
38087c478bd9Sstevel@tonic-gate 	short so_family, so_type;
38097c478bd9Sstevel@tonic-gate 	int add_sock_token = 0;
38107c478bd9Sstevel@tonic-gate 	file_t *fp;				/* unix domain sockets */
38117c478bd9Sstevel@tonic-gate 	struct f_audit_data *fad;		/* unix domain sockets */
38127c478bd9Sstevel@tonic-gate 
38137c478bd9Sstevel@tonic-gate 	fd = (int)uap->fd;
38147c478bd9Sstevel@tonic-gate 
3815745b2690Stz 	if ((so = getsonode(fd, &err, &fp)) == NULL) {
38167c478bd9Sstevel@tonic-gate 		/*
38177c478bd9Sstevel@tonic-gate 		 * not security relevant if doing a shutdown using non socket
38187c478bd9Sstevel@tonic-gate 		 * so no extra tokens. Should probably turn off audit record
38197c478bd9Sstevel@tonic-gate 		 * generation here.
38207c478bd9Sstevel@tonic-gate 		 */
38217c478bd9Sstevel@tonic-gate 		return;
38227c478bd9Sstevel@tonic-gate 	}
38237c478bd9Sstevel@tonic-gate 
38247c478bd9Sstevel@tonic-gate 	so_family = so->so_family;
38257c478bd9Sstevel@tonic-gate 	so_type   = so->so_type;
38267c478bd9Sstevel@tonic-gate 
38277c478bd9Sstevel@tonic-gate 	switch (so_family) {
38287c478bd9Sstevel@tonic-gate 	case AF_INET:
38297c478bd9Sstevel@tonic-gate 	case AF_INET6:
38307c478bd9Sstevel@tonic-gate 
38317c478bd9Sstevel@tonic-gate 		bzero(so_laddr, sizeof (so_laddr));
38327c478bd9Sstevel@tonic-gate 		bzero(so_faddr, sizeof (so_faddr));
38337c478bd9Sstevel@tonic-gate 
38340f1702c5SYu Xiangning 		len = sizeof (so_laddr);
38350f1702c5SYu Xiangning 		(void) socket_getsockname(so,
38360f1702c5SYu Xiangning 		    (struct sockaddr *)so_laddr, &len, CRED());
38370f1702c5SYu Xiangning 		len = sizeof (so_faddr);
38380f1702c5SYu Xiangning 		(void) socket_getpeername(so,
38390f1702c5SYu Xiangning 		    (struct sockaddr *)so_faddr, &len, B_FALSE, CRED());
38407c478bd9Sstevel@tonic-gate 
38417c478bd9Sstevel@tonic-gate 		add_sock_token = 1;
38427c478bd9Sstevel@tonic-gate 
38437c478bd9Sstevel@tonic-gate 		break;
38447c478bd9Sstevel@tonic-gate 
38457c478bd9Sstevel@tonic-gate 	case AF_UNIX:
38467c478bd9Sstevel@tonic-gate 
38477c478bd9Sstevel@tonic-gate 		/* get path from file struct here */
38487c478bd9Sstevel@tonic-gate 		fad = F2A(fp);
38497c478bd9Sstevel@tonic-gate 		ASSERT(fad);
38507c478bd9Sstevel@tonic-gate 
38517c478bd9Sstevel@tonic-gate 		if (fad->fad_aupath != NULL) {
38527c478bd9Sstevel@tonic-gate 			au_uwrite(au_to_path(fad->fad_aupath));
38537c478bd9Sstevel@tonic-gate 		} else {
38547c478bd9Sstevel@tonic-gate 			au_uwrite(au_to_arg32(1, "no path: fd", fd));
38557c478bd9Sstevel@tonic-gate 		}
38567c478bd9Sstevel@tonic-gate 
38577c478bd9Sstevel@tonic-gate 		audit_attributes(fp->f_vnode);
38587c478bd9Sstevel@tonic-gate 
38597c478bd9Sstevel@tonic-gate 		break;
38607c478bd9Sstevel@tonic-gate 
38617c478bd9Sstevel@tonic-gate 	default:
38627c478bd9Sstevel@tonic-gate 		/*
38637c478bd9Sstevel@tonic-gate 		 * AF_KEY and AF_ROUTE support shutdown. No socket token
38647c478bd9Sstevel@tonic-gate 		 * added.
38657c478bd9Sstevel@tonic-gate 		 */
38667c478bd9Sstevel@tonic-gate 		break;
38677c478bd9Sstevel@tonic-gate 	}
38687c478bd9Sstevel@tonic-gate 
38697c478bd9Sstevel@tonic-gate 	releasef(fd);
38707c478bd9Sstevel@tonic-gate 
38717c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
38727c478bd9Sstevel@tonic-gate 
38737c478bd9Sstevel@tonic-gate 	if (add_sock_token == 0) {
38747c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "family", (uint32_t)(so_family)));
38757c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "type", (uint32_t)(so_type)));
38767c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(2, "how", (uint32_t)(uap->how)));
38777c478bd9Sstevel@tonic-gate 		return;
38787c478bd9Sstevel@tonic-gate 	}
38797c478bd9Sstevel@tonic-gate 
38807c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(2, "how", (uint32_t)(uap->how)));
38817c478bd9Sstevel@tonic-gate 
38827c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_socket_ex(so_family, so_type, so_laddr, so_faddr));
38837c478bd9Sstevel@tonic-gate 
38847c478bd9Sstevel@tonic-gate }
38857c478bd9Sstevel@tonic-gate 
38867c478bd9Sstevel@tonic-gate /*ARGSUSED*/
38877c478bd9Sstevel@tonic-gate static void
38887c478bd9Sstevel@tonic-gate auf_setsockopt(struct t_audit_data *tad, int error, rval_t *rval)
38897c478bd9Sstevel@tonic-gate {
38907c478bd9Sstevel@tonic-gate 	struct a {
38917c478bd9Sstevel@tonic-gate 		long	fd;
38927c478bd9Sstevel@tonic-gate 		long	level;
38937c478bd9Sstevel@tonic-gate 		long	optname;
38947c478bd9Sstevel@tonic-gate 		long	*optval;
38957c478bd9Sstevel@tonic-gate 		long	optlen;
38967c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)ttolwp(curthread)->lwp_ap;
38977c478bd9Sstevel@tonic-gate 
38987c478bd9Sstevel@tonic-gate 	struct sonode	*so;
38997c478bd9Sstevel@tonic-gate 	char so_laddr[sizeof (struct sockaddr_in6)];
39007c478bd9Sstevel@tonic-gate 	char so_faddr[sizeof (struct sockaddr_in6)];
39017c478bd9Sstevel@tonic-gate 	char		val[AU_BUFSIZE];
39027c478bd9Sstevel@tonic-gate 	int		err, fd;
39030f1702c5SYu Xiangning 	socklen_t	len;
39047c478bd9Sstevel@tonic-gate 	short so_family, so_type;
39057c478bd9Sstevel@tonic-gate 	int		add_sock_token = 0;
39067c478bd9Sstevel@tonic-gate 	file_t *fp;				/* unix domain sockets */
39077c478bd9Sstevel@tonic-gate 	struct f_audit_data *fad;		/* unix domain sockets */
39087c478bd9Sstevel@tonic-gate 
39097c478bd9Sstevel@tonic-gate 	fd = (int)uap->fd;
39107c478bd9Sstevel@tonic-gate 
39117c478bd9Sstevel@tonic-gate 	if (error) {
39127c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
39137c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(2, "level", (uint32_t)uap->level));
39147c478bd9Sstevel@tonic-gate 		/* XXX may want to include other arguments */
39157c478bd9Sstevel@tonic-gate 		return;
39167c478bd9Sstevel@tonic-gate 	}
39177c478bd9Sstevel@tonic-gate 
3918745b2690Stz 	if ((so = getsonode(fd, &err, &fp)) == NULL) {
39197c478bd9Sstevel@tonic-gate 		/*
39207c478bd9Sstevel@tonic-gate 		 * not security relevant if doing a setsockopt from non socket
39217c478bd9Sstevel@tonic-gate 		 * so no extra tokens. Should probably turn off audit record
39227c478bd9Sstevel@tonic-gate 		 * generation here.
39237c478bd9Sstevel@tonic-gate 		 */
39247c478bd9Sstevel@tonic-gate 		return;
39257c478bd9Sstevel@tonic-gate 	}
39267c478bd9Sstevel@tonic-gate 
39277c478bd9Sstevel@tonic-gate 	so_family = so->so_family;
39287c478bd9Sstevel@tonic-gate 	so_type   = so->so_type;
39297c478bd9Sstevel@tonic-gate 
39307c478bd9Sstevel@tonic-gate 	switch (so_family) {
39317c478bd9Sstevel@tonic-gate 	case AF_INET:
39327c478bd9Sstevel@tonic-gate 	case AF_INET6:
39337c478bd9Sstevel@tonic-gate 		bzero((void *)so_laddr, sizeof (so_laddr));
39347c478bd9Sstevel@tonic-gate 		bzero((void *)so_faddr, sizeof (so_faddr));
39357c478bd9Sstevel@tonic-gate 
39367c478bd9Sstevel@tonic-gate 		/* get local and foreign addresses */
39370f1702c5SYu Xiangning 		len = sizeof (so_laddr);
39380f1702c5SYu Xiangning 		(void) socket_getsockname(so, (struct sockaddr *)so_laddr,
39390f1702c5SYu Xiangning 		    &len, CRED());
39400f1702c5SYu Xiangning 		len = sizeof (so_faddr);
39410f1702c5SYu Xiangning 		(void) socket_getpeername(so, (struct sockaddr *)so_faddr,
39420f1702c5SYu Xiangning 		    &len, B_FALSE, CRED());
39437c478bd9Sstevel@tonic-gate 
39447c478bd9Sstevel@tonic-gate 		add_sock_token = 1;
39457c478bd9Sstevel@tonic-gate 
39467c478bd9Sstevel@tonic-gate 		break;
39477c478bd9Sstevel@tonic-gate 
39487c478bd9Sstevel@tonic-gate 	case AF_UNIX:
39497c478bd9Sstevel@tonic-gate 
39507c478bd9Sstevel@tonic-gate 		/* get path from file struct here */
39517c478bd9Sstevel@tonic-gate 		fad = F2A(fp);
39527c478bd9Sstevel@tonic-gate 		ASSERT(fad);
39537c478bd9Sstevel@tonic-gate 
39547c478bd9Sstevel@tonic-gate 		if (fad->fad_aupath != NULL) {
39557c478bd9Sstevel@tonic-gate 			au_uwrite(au_to_path(fad->fad_aupath));
39567c478bd9Sstevel@tonic-gate 		} else {
39577c478bd9Sstevel@tonic-gate 			au_uwrite(au_to_arg32(1, "no path: fd", fd));
39587c478bd9Sstevel@tonic-gate 		}
39597c478bd9Sstevel@tonic-gate 
39607c478bd9Sstevel@tonic-gate 		audit_attributes(fp->f_vnode);
39617c478bd9Sstevel@tonic-gate 
39627c478bd9Sstevel@tonic-gate 		break;
39637c478bd9Sstevel@tonic-gate 
39647c478bd9Sstevel@tonic-gate 	default:
39657c478bd9Sstevel@tonic-gate 		/*
39667c478bd9Sstevel@tonic-gate 		 * AF_KEY and AF_ROUTE support setsockopt. No socket token
39677c478bd9Sstevel@tonic-gate 		 * added.
39687c478bd9Sstevel@tonic-gate 		 */
39697c478bd9Sstevel@tonic-gate 		break;
39707c478bd9Sstevel@tonic-gate 	}
39717c478bd9Sstevel@tonic-gate 
39727c478bd9Sstevel@tonic-gate 	releasef(fd);
39737c478bd9Sstevel@tonic-gate 
39747c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
39757c478bd9Sstevel@tonic-gate 
39767c478bd9Sstevel@tonic-gate 	if (add_sock_token == 0) {
39777c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "family", (uint32_t)(so_family)));
39787c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "type", (uint32_t)(so_type)));
39797c478bd9Sstevel@tonic-gate 	}
39807c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(2, "level", (uint32_t)(uap->level)));
39817c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(3, "optname", (uint32_t)(uap->optname)));
39827c478bd9Sstevel@tonic-gate 
39837c478bd9Sstevel@tonic-gate 	bzero(val, sizeof (val));
39847c478bd9Sstevel@tonic-gate 	len = min(uap->optlen, sizeof (val));
39857c478bd9Sstevel@tonic-gate 	if ((len > 0) &&
39867c478bd9Sstevel@tonic-gate 	    (copyin((caddr_t)(uap->optval), (caddr_t)val, len) == 0)) {
39877c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(5, "optlen", (uint32_t)(uap->optlen)));
39887c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_data(AUP_HEX, AUR_BYTE, len, val));
39897c478bd9Sstevel@tonic-gate 	}
39907c478bd9Sstevel@tonic-gate 
39917c478bd9Sstevel@tonic-gate 	if (add_sock_token == 0)
39927c478bd9Sstevel@tonic-gate 		return;
39937c478bd9Sstevel@tonic-gate 
39947c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_socket_ex(so_family, so_type, so_laddr, so_faddr));
39957c478bd9Sstevel@tonic-gate 
39967c478bd9Sstevel@tonic-gate }
39977c478bd9Sstevel@tonic-gate 
39987c478bd9Sstevel@tonic-gate /*ARGSUSED*/
39997c478bd9Sstevel@tonic-gate static void
4000*0f48f68dSToomas Soome aus_sockconfig(struct t_audit_data *tad)
40017c478bd9Sstevel@tonic-gate {
40027c478bd9Sstevel@tonic-gate 	struct a {
40033e95bd4aSAnders Persson 		long	cmd;
40043e95bd4aSAnders Persson 		long	arg1;
40053e95bd4aSAnders Persson 		long	arg2;
40063e95bd4aSAnders Persson 		long	arg3;
40073e95bd4aSAnders Persson 		long	arg4;
40087c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)ttolwp(curthread)->lwp_ap;
40097c478bd9Sstevel@tonic-gate 
40103e95bd4aSAnders Persson 	char	*buf;
40113e95bd4aSAnders Persson 	int	buflen;
40127c478bd9Sstevel@tonic-gate 	size_t	size;
40137c478bd9Sstevel@tonic-gate 
40143e95bd4aSAnders Persson 	au_uwrite(au_to_arg32(1, "cmd", (uint_t)uap->cmd));
40153e95bd4aSAnders Persson 	switch (uap->cmd) {
40163e95bd4aSAnders Persson 	case SOCKCONFIG_ADD_SOCK:
40173e95bd4aSAnders Persson 	case SOCKCONFIG_REMOVE_SOCK:
40183e95bd4aSAnders Persson 		au_uwrite(au_to_arg32(2, "domain", (uint32_t)uap->arg1));
40193e95bd4aSAnders Persson 		au_uwrite(au_to_arg32(3, "type", (uint32_t)uap->arg2));
40203e95bd4aSAnders Persson 		au_uwrite(au_to_arg32(4, "protocol", (uint32_t)uap->arg3));
40217c478bd9Sstevel@tonic-gate 
40223e95bd4aSAnders Persson 		if (uap->arg4 == 0) {
40233e95bd4aSAnders Persson 			au_uwrite(au_to_arg32(5, "devpath", (uint32_t)0));
40243e95bd4aSAnders Persson 		} else {
40253e95bd4aSAnders Persson 			buflen = MAXPATHLEN + 1;
40263e95bd4aSAnders Persson 			buf = kmem_alloc(buflen, KM_SLEEP);
40273e95bd4aSAnders Persson 			if (copyinstr((caddr_t)uap->arg4, buf, buflen,
40283e95bd4aSAnders Persson 			    &size)) {
40293e95bd4aSAnders Persson 				kmem_free(buf, buflen);
40303e95bd4aSAnders Persson 				return;
40313e95bd4aSAnders Persson 			}
40327c478bd9Sstevel@tonic-gate 
40333e95bd4aSAnders Persson 			if (size > MAXPATHLEN) {
40343e95bd4aSAnders Persson 				kmem_free(buf, buflen);
40353e95bd4aSAnders Persson 				return;
40363e95bd4aSAnders Persson 			}
40373e95bd4aSAnders Persson 
40383e95bd4aSAnders Persson 			au_uwrite(au_to_text(buf));
40393e95bd4aSAnders Persson 			kmem_free(buf, buflen);
40407c478bd9Sstevel@tonic-gate 		}
40413e95bd4aSAnders Persson 		break;
40423e95bd4aSAnders Persson 	case SOCKCONFIG_ADD_FILTER:
40433e95bd4aSAnders Persson 	case SOCKCONFIG_REMOVE_FILTER:
40443e95bd4aSAnders Persson 		buflen = FILNAME_MAX;
40453e95bd4aSAnders Persson 		buf = kmem_alloc(buflen, KM_SLEEP);
40467c478bd9Sstevel@tonic-gate 
40473e95bd4aSAnders Persson 		if (copyinstr((caddr_t)uap->arg1, buf, buflen, &size)) {
40483e95bd4aSAnders Persson 			kmem_free(buf, buflen);
40497c478bd9Sstevel@tonic-gate 			return;
40507c478bd9Sstevel@tonic-gate 		}
40517c478bd9Sstevel@tonic-gate 
40523e95bd4aSAnders Persson 		au_uwrite(au_to_text(buf));
40533e95bd4aSAnders Persson 		kmem_free(buf, buflen);
40543e95bd4aSAnders Persson 		break;
40553e95bd4aSAnders Persson 	default:
40563e95bd4aSAnders Persson 		break;
40577c478bd9Sstevel@tonic-gate 	}
40587c478bd9Sstevel@tonic-gate }
40597c478bd9Sstevel@tonic-gate 
40607c478bd9Sstevel@tonic-gate /*
40617c478bd9Sstevel@tonic-gate  * only audit recvmsg when the system call represents the creation of a new
40627c478bd9Sstevel@tonic-gate  * circuit. This effectively occurs for all UDP packets and may occur for
40637c478bd9Sstevel@tonic-gate  * special TCP situations where the local host has not set a local address
40647c478bd9Sstevel@tonic-gate  * in the socket structure.
40657c478bd9Sstevel@tonic-gate  */
40667c478bd9Sstevel@tonic-gate /*ARGSUSED*/
40677c478bd9Sstevel@tonic-gate static void
40687c478bd9Sstevel@tonic-gate auf_recvmsg(
40697c478bd9Sstevel@tonic-gate 	struct t_audit_data *tad,
40707c478bd9Sstevel@tonic-gate 	int error,
40717c478bd9Sstevel@tonic-gate 	rval_t *rvp)
40727c478bd9Sstevel@tonic-gate {
40737c478bd9Sstevel@tonic-gate 	struct a {
40747c478bd9Sstevel@tonic-gate 		long	fd;
40757c478bd9Sstevel@tonic-gate 		long	msg;	/* struct msghdr */
40767c478bd9Sstevel@tonic-gate 		long	flags;
40777c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)ttolwp(curthread)->lwp_ap;
40787c478bd9Sstevel@tonic-gate 
40797c478bd9Sstevel@tonic-gate 	struct sonode	*so;
40807c478bd9Sstevel@tonic-gate 	STRUCT_DECL(msghdr, msg);
40817c478bd9Sstevel@tonic-gate 	caddr_t msg_name;
40827c478bd9Sstevel@tonic-gate 	socklen_t msg_namelen;
40837c478bd9Sstevel@tonic-gate 	int fd;
40847c478bd9Sstevel@tonic-gate 	int err;
40857c478bd9Sstevel@tonic-gate 	char so_laddr[sizeof (struct sockaddr_in6)];
40867c478bd9Sstevel@tonic-gate 	char so_faddr[sizeof (struct sockaddr_in6)];
40870f1702c5SYu Xiangning 	socklen_t len;
40887c478bd9Sstevel@tonic-gate 	file_t *fp;				/* unix domain sockets */
40897c478bd9Sstevel@tonic-gate 	struct f_audit_data *fad;		/* unix domain sockets */
40907c478bd9Sstevel@tonic-gate 	short so_family, so_type;
40917c478bd9Sstevel@tonic-gate 	int add_sock_token = 0;
40929e9e6ab8Spaulson 	au_kcontext_t	*kctx = GET_KCTX_PZ;
40937c478bd9Sstevel@tonic-gate 
40947c478bd9Sstevel@tonic-gate 	fd = (int)uap->fd;
40957c478bd9Sstevel@tonic-gate 
40967c478bd9Sstevel@tonic-gate 	/* bail if an error */
40977c478bd9Sstevel@tonic-gate 	if (error) {
40987c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
40997c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(3, "flags", (uint32_t)(uap->flags)));
41007c478bd9Sstevel@tonic-gate 		return;
41017c478bd9Sstevel@tonic-gate 	}
41027c478bd9Sstevel@tonic-gate 
4103745b2690Stz 	if ((so = getsonode(fd, &err, &fp)) == NULL) {
41047c478bd9Sstevel@tonic-gate 		/*
41057c478bd9Sstevel@tonic-gate 		 * not security relevant if doing a recvmsg from non socket
41067c478bd9Sstevel@tonic-gate 		 * so no extra tokens. Should probably turn off audit record
41077c478bd9Sstevel@tonic-gate 		 * generation here.
41087c478bd9Sstevel@tonic-gate 		 */
41097c478bd9Sstevel@tonic-gate 		return;
41107c478bd9Sstevel@tonic-gate 	}
41117c478bd9Sstevel@tonic-gate 
41127c478bd9Sstevel@tonic-gate 	so_family = so->so_family;
41137c478bd9Sstevel@tonic-gate 	so_type   = so->so_type;
41147c478bd9Sstevel@tonic-gate 
41157c478bd9Sstevel@tonic-gate 	/*
41167c478bd9Sstevel@tonic-gate 	 * only putout SOCKET_EX token if INET/INET6 family.
41177c478bd9Sstevel@tonic-gate 	 * XXX - what do we do about other families?
41187c478bd9Sstevel@tonic-gate 	 */
41197c478bd9Sstevel@tonic-gate 
41207c478bd9Sstevel@tonic-gate 	switch (so_family) {
41217c478bd9Sstevel@tonic-gate 	case AF_INET:
41227c478bd9Sstevel@tonic-gate 	case AF_INET6:
41237c478bd9Sstevel@tonic-gate 
41247c478bd9Sstevel@tonic-gate 		/*
41257c478bd9Sstevel@tonic-gate 		 * if datagram type socket, then just use what is in
41267c478bd9Sstevel@tonic-gate 		 * socket structure for local address.
41277c478bd9Sstevel@tonic-gate 		 * XXX - what do we do for other types?
41287c478bd9Sstevel@tonic-gate 		 */
41297c478bd9Sstevel@tonic-gate 		if ((so->so_type == SOCK_DGRAM) ||
41307c478bd9Sstevel@tonic-gate 		    (so->so_type == SOCK_RAW)) {
41317c478bd9Sstevel@tonic-gate 			add_sock_token = 1;
41327c478bd9Sstevel@tonic-gate 
41337c478bd9Sstevel@tonic-gate 			bzero((void *)so_laddr, sizeof (so_laddr));
41347c478bd9Sstevel@tonic-gate 			bzero((void *)so_faddr, sizeof (so_faddr));
41357c478bd9Sstevel@tonic-gate 
41367c478bd9Sstevel@tonic-gate 			/* get local address */
41370f1702c5SYu Xiangning 			len = sizeof (so_laddr);
41380f1702c5SYu Xiangning 			(void) socket_getsockname(so,
41390f1702c5SYu Xiangning 			    (struct sockaddr *)so_laddr, &len, CRED());
41407c478bd9Sstevel@tonic-gate 
41417c478bd9Sstevel@tonic-gate 			/* get peer address */
41427c478bd9Sstevel@tonic-gate 			STRUCT_INIT(msg, get_udatamodel());
41437c478bd9Sstevel@tonic-gate 
41447c478bd9Sstevel@tonic-gate 			if (copyin((caddr_t)(uap->msg),
41457c478bd9Sstevel@tonic-gate 			    (caddr_t)STRUCT_BUF(msg), STRUCT_SIZE(msg)) != 0) {
41467c478bd9Sstevel@tonic-gate 				break;
41477c478bd9Sstevel@tonic-gate 			}
41487c478bd9Sstevel@tonic-gate 			msg_name = (caddr_t)STRUCT_FGETP(msg, msg_name);
41497c478bd9Sstevel@tonic-gate 			if (msg_name == NULL) {
41507c478bd9Sstevel@tonic-gate 				break;
41517c478bd9Sstevel@tonic-gate 			}
41527c478bd9Sstevel@tonic-gate 
41537c478bd9Sstevel@tonic-gate 			/* length is value from recvmsg - sanity check */
41547c478bd9Sstevel@tonic-gate 			msg_namelen = (socklen_t)STRUCT_FGET(msg, msg_namelen);
41557c478bd9Sstevel@tonic-gate 			if (msg_namelen == 0) {
41567c478bd9Sstevel@tonic-gate 				break;
41577c478bd9Sstevel@tonic-gate 			}
41587c478bd9Sstevel@tonic-gate 			if (copyin(msg_name, so_faddr,
41597c478bd9Sstevel@tonic-gate 			    sizeof (so_faddr)) != 0) {
41607c478bd9Sstevel@tonic-gate 				break;
41617c478bd9Sstevel@tonic-gate 			}
41627c478bd9Sstevel@tonic-gate 
41637c478bd9Sstevel@tonic-gate 		} else if (so->so_type == SOCK_STREAM) {
41647c478bd9Sstevel@tonic-gate 
41657c478bd9Sstevel@tonic-gate 			/* get path from file struct here */
41667c478bd9Sstevel@tonic-gate 			fad = F2A(fp);
41677c478bd9Sstevel@tonic-gate 			ASSERT(fad);
41687c478bd9Sstevel@tonic-gate 
41697c478bd9Sstevel@tonic-gate 			/*
41707c478bd9Sstevel@tonic-gate 			 * already processed this file for read attempt
41717c478bd9Sstevel@tonic-gate 			 */
41727c478bd9Sstevel@tonic-gate 			if (fad->fad_flags & FAD_READ) {
41737c478bd9Sstevel@tonic-gate 				/* don't want to audit every recvmsg attempt */
41747c478bd9Sstevel@tonic-gate 				tad->tad_flag = 0;
41757c478bd9Sstevel@tonic-gate 				/* free any residual audit data */
4176005d3febSMarek Pospisil 				au_close(kctx, &(u_ad), 0, 0, 0, NULL);
41777c478bd9Sstevel@tonic-gate 				releasef(fd);
41787c478bd9Sstevel@tonic-gate 				return;
41797c478bd9Sstevel@tonic-gate 			}
41807c478bd9Sstevel@tonic-gate 			/*
41817c478bd9Sstevel@tonic-gate 			 * mark things so we know what happened and don't
41827c478bd9Sstevel@tonic-gate 			 * repeat things
41837c478bd9Sstevel@tonic-gate 			 */
41847c478bd9Sstevel@tonic-gate 			fad->fad_flags |= FAD_READ;
41857c478bd9Sstevel@tonic-gate 
41867c478bd9Sstevel@tonic-gate 			bzero((void *)so_laddr, sizeof (so_laddr));
41877c478bd9Sstevel@tonic-gate 			bzero((void *)so_faddr, sizeof (so_faddr));
41887c478bd9Sstevel@tonic-gate 
41890f1702c5SYu Xiangning 			/* get local and foreign addresses */
41900f1702c5SYu Xiangning 			len = sizeof (so_laddr);
41910f1702c5SYu Xiangning 			(void) socket_getsockname(so,
41920f1702c5SYu Xiangning 			    (struct sockaddr *)so_laddr, &len, CRED());
41930f1702c5SYu Xiangning 			len = sizeof (so_faddr);
41940f1702c5SYu Xiangning 			(void) socket_getpeername(so,
41950f1702c5SYu Xiangning 			    (struct sockaddr *)so_faddr, &len, B_FALSE, CRED());
41967c478bd9Sstevel@tonic-gate 
41977c478bd9Sstevel@tonic-gate 			add_sock_token = 1;
41987c478bd9Sstevel@tonic-gate 		}
41997c478bd9Sstevel@tonic-gate 
42007c478bd9Sstevel@tonic-gate 		/* XXX - what about SOCK_RDM/SOCK_SEQPACKET ??? */
42017c478bd9Sstevel@tonic-gate 
42027c478bd9Sstevel@tonic-gate 		break;
42037c478bd9Sstevel@tonic-gate 
42047c478bd9Sstevel@tonic-gate 	case AF_UNIX:
42057c478bd9Sstevel@tonic-gate 		/*
42067c478bd9Sstevel@tonic-gate 		 * first check if this is first time through. Too much
42077c478bd9Sstevel@tonic-gate 		 * duplicate code to put this in an aui_ routine.
42087c478bd9Sstevel@tonic-gate 		 */
42097c478bd9Sstevel@tonic-gate 
42107c478bd9Sstevel@tonic-gate 		/* get path from file struct here */
42117c478bd9Sstevel@tonic-gate 		fad = F2A(fp);
42127c478bd9Sstevel@tonic-gate 		ASSERT(fad);
42137c478bd9Sstevel@tonic-gate 
42147c478bd9Sstevel@tonic-gate 		/*
42157c478bd9Sstevel@tonic-gate 		 * already processed this file for read attempt
42167c478bd9Sstevel@tonic-gate 		 */
42177c478bd9Sstevel@tonic-gate 		if (fad->fad_flags & FAD_READ) {
42187c478bd9Sstevel@tonic-gate 			releasef(fd);
42197c478bd9Sstevel@tonic-gate 			/* don't want to audit every recvmsg attempt */
42207c478bd9Sstevel@tonic-gate 			tad->tad_flag = 0;
42217c478bd9Sstevel@tonic-gate 			/* free any residual audit data */
4222005d3febSMarek Pospisil 			au_close(kctx, &(u_ad), 0, 0, 0, NULL);
42237c478bd9Sstevel@tonic-gate 			return;
42247c478bd9Sstevel@tonic-gate 		}
42257c478bd9Sstevel@tonic-gate 		/*
42267c478bd9Sstevel@tonic-gate 		 * mark things so we know what happened and don't
42277c478bd9Sstevel@tonic-gate 		 * repeat things
42287c478bd9Sstevel@tonic-gate 		 */
42297c478bd9Sstevel@tonic-gate 		fad->fad_flags |= FAD_READ;
42307c478bd9Sstevel@tonic-gate 
42317c478bd9Sstevel@tonic-gate 		if (fad->fad_aupath != NULL) {
42327c478bd9Sstevel@tonic-gate 			au_uwrite(au_to_path(fad->fad_aupath));
42337c478bd9Sstevel@tonic-gate 		} else {
42347c478bd9Sstevel@tonic-gate 			au_uwrite(au_to_arg32(1, "no path: fd", fd));
42357c478bd9Sstevel@tonic-gate 		}
42367c478bd9Sstevel@tonic-gate 
42377c478bd9Sstevel@tonic-gate 		audit_attributes(fp->f_vnode);
42387c478bd9Sstevel@tonic-gate 
42397c478bd9Sstevel@tonic-gate 		releasef(fd);
42407c478bd9Sstevel@tonic-gate 
42417c478bd9Sstevel@tonic-gate 		return;
42427c478bd9Sstevel@tonic-gate 
42437c478bd9Sstevel@tonic-gate 	default:
42447c478bd9Sstevel@tonic-gate 		break;
42457c478bd9Sstevel@tonic-gate 
42467c478bd9Sstevel@tonic-gate 	}
42477c478bd9Sstevel@tonic-gate 
42487c478bd9Sstevel@tonic-gate 	releasef(fd);
42497c478bd9Sstevel@tonic-gate 
42507c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
42517c478bd9Sstevel@tonic-gate 
42527c478bd9Sstevel@tonic-gate 	if (add_sock_token == 0) {
42537c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "family", (uint32_t)so_family));
42547c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "type", (uint32_t)so_type));
42557c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(3, "flags", (uint32_t)(uap->flags)));
42567c478bd9Sstevel@tonic-gate 		return;
42577c478bd9Sstevel@tonic-gate 	}
42587c478bd9Sstevel@tonic-gate 
42597c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(3, "flags", (uint32_t)(uap->flags)));
42607c478bd9Sstevel@tonic-gate 
42617c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_socket_ex(so_family, so_type, so_laddr, so_faddr));
42627c478bd9Sstevel@tonic-gate 
42637c478bd9Sstevel@tonic-gate }
42647c478bd9Sstevel@tonic-gate 
42657c478bd9Sstevel@tonic-gate /*ARGSUSED*/
42667c478bd9Sstevel@tonic-gate static void
42677c478bd9Sstevel@tonic-gate auf_recvfrom(
42687c478bd9Sstevel@tonic-gate 	struct t_audit_data *tad,
42697c478bd9Sstevel@tonic-gate 	int error,
42707c478bd9Sstevel@tonic-gate 	rval_t *rvp)
42717c478bd9Sstevel@tonic-gate {
42727c478bd9Sstevel@tonic-gate 
42737c478bd9Sstevel@tonic-gate 	struct a {
42747c478bd9Sstevel@tonic-gate 		long	fd;
42757c478bd9Sstevel@tonic-gate 		long	msg;	/* char */
42767c478bd9Sstevel@tonic-gate 		long	len;
42777c478bd9Sstevel@tonic-gate 		long	flags;
42787c478bd9Sstevel@tonic-gate 		long	from;	/* struct sockaddr */
42797c478bd9Sstevel@tonic-gate 		long	fromlen;
42807c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)ttolwp(curthread)->lwp_ap;
42817c478bd9Sstevel@tonic-gate 
42827c478bd9Sstevel@tonic-gate 	socklen_t	fromlen;
42837c478bd9Sstevel@tonic-gate 	struct sonode	*so;
42847c478bd9Sstevel@tonic-gate 	char so_laddr[sizeof (struct sockaddr_in6)];
42857c478bd9Sstevel@tonic-gate 	char so_faddr[sizeof (struct sockaddr_in6)];
42867c478bd9Sstevel@tonic-gate 	int		fd;
42877c478bd9Sstevel@tonic-gate 	short so_family, so_type;
42887c478bd9Sstevel@tonic-gate 	int add_sock_token = 0;
42890f1702c5SYu Xiangning 	socklen_t len;
42907c478bd9Sstevel@tonic-gate 	int err;
42917c478bd9Sstevel@tonic-gate 	struct file *fp;
42927c478bd9Sstevel@tonic-gate 	struct f_audit_data *fad;		/* unix domain sockets */
42939e9e6ab8Spaulson 	au_kcontext_t	*kctx = GET_KCTX_PZ;
42947c478bd9Sstevel@tonic-gate 
42957c478bd9Sstevel@tonic-gate 	fd = (int)uap->fd;
42967c478bd9Sstevel@tonic-gate 
42977c478bd9Sstevel@tonic-gate 	/* bail if an error */
42987c478bd9Sstevel@tonic-gate 	if (error) {
42997c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
43007c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(3, "flags", (uint32_t)(uap->flags)));
43017c478bd9Sstevel@tonic-gate 		return;
43027c478bd9Sstevel@tonic-gate 	}
43037c478bd9Sstevel@tonic-gate 
4304745b2690Stz 	if ((so = getsonode(fd, &err, &fp)) == NULL) {
43057c478bd9Sstevel@tonic-gate 		/*
43067c478bd9Sstevel@tonic-gate 		 * not security relevant if doing a recvmsg from non socket
43077c478bd9Sstevel@tonic-gate 		 * so no extra tokens. Should probably turn off audit record
43087c478bd9Sstevel@tonic-gate 		 * generation here.
43097c478bd9Sstevel@tonic-gate 		 */
43107c478bd9Sstevel@tonic-gate 		return;
43117c478bd9Sstevel@tonic-gate 	}
43127c478bd9Sstevel@tonic-gate 
43137c478bd9Sstevel@tonic-gate 	so_family = so->so_family;
43147c478bd9Sstevel@tonic-gate 	so_type   = so->so_type;
43157c478bd9Sstevel@tonic-gate 
43167c478bd9Sstevel@tonic-gate 	/*
43177c478bd9Sstevel@tonic-gate 	 * only putout SOCKET_EX token if INET/INET6 family.
43187c478bd9Sstevel@tonic-gate 	 * XXX - what do we do about other families?
43197c478bd9Sstevel@tonic-gate 	 */
43207c478bd9Sstevel@tonic-gate 
43217c478bd9Sstevel@tonic-gate 	switch (so_family) {
43227c478bd9Sstevel@tonic-gate 	case AF_INET:
43237c478bd9Sstevel@tonic-gate 	case AF_INET6:
43247c478bd9Sstevel@tonic-gate 
43257c478bd9Sstevel@tonic-gate 		/*
43267c478bd9Sstevel@tonic-gate 		 * if datagram type socket, then just use what is in
43277c478bd9Sstevel@tonic-gate 		 * socket structure for local address.
43287c478bd9Sstevel@tonic-gate 		 * XXX - what do we do for other types?
43297c478bd9Sstevel@tonic-gate 		 */
43307c478bd9Sstevel@tonic-gate 		if ((so->so_type == SOCK_DGRAM) ||
43317c478bd9Sstevel@tonic-gate 		    (so->so_type == SOCK_RAW)) {
43327c478bd9Sstevel@tonic-gate 			add_sock_token = 1;
43337c478bd9Sstevel@tonic-gate 
43347c478bd9Sstevel@tonic-gate 			/* get local address */
43350f1702c5SYu Xiangning 			len = sizeof (so_laddr);
43360f1702c5SYu Xiangning 			(void) socket_getsockname(so,
43370f1702c5SYu Xiangning 			    (struct sockaddr *)so_laddr, &len, CRED());
43387c478bd9Sstevel@tonic-gate 
43397c478bd9Sstevel@tonic-gate 			/* get peer address */
43407c478bd9Sstevel@tonic-gate 			bzero((void *)so_faddr, sizeof (so_faddr));
43417c478bd9Sstevel@tonic-gate 
43427c478bd9Sstevel@tonic-gate 			/* sanity check */
4343*0f48f68dSToomas Soome 			if (uap->from == 0)
43447c478bd9Sstevel@tonic-gate 				break;
43457c478bd9Sstevel@tonic-gate 
43467c478bd9Sstevel@tonic-gate 			/* sanity checks */
43477c478bd9Sstevel@tonic-gate 			if (uap->fromlen == 0)
43487c478bd9Sstevel@tonic-gate 				break;
43497c478bd9Sstevel@tonic-gate 
43507c478bd9Sstevel@tonic-gate 			if (copyin((caddr_t)(uap->fromlen), (caddr_t)&fromlen,
43517c478bd9Sstevel@tonic-gate 			    sizeof (fromlen)) != 0)
43527c478bd9Sstevel@tonic-gate 				break;
43537c478bd9Sstevel@tonic-gate 
43547c478bd9Sstevel@tonic-gate 			if (fromlen == 0)
43557c478bd9Sstevel@tonic-gate 				break;
43567c478bd9Sstevel@tonic-gate 
43577c478bd9Sstevel@tonic-gate 			/* enforce maximum size */
43587c478bd9Sstevel@tonic-gate 			if (fromlen > sizeof (so_faddr))
43597c478bd9Sstevel@tonic-gate 				fromlen = sizeof (so_faddr);
43607c478bd9Sstevel@tonic-gate 
43617c478bd9Sstevel@tonic-gate 			if (copyin((caddr_t)(uap->from), so_faddr,
43627c478bd9Sstevel@tonic-gate 			    fromlen) != 0)
43637c478bd9Sstevel@tonic-gate 				break;
43647c478bd9Sstevel@tonic-gate 
43657c478bd9Sstevel@tonic-gate 		} else if (so->so_type == SOCK_STREAM) {
43667c478bd9Sstevel@tonic-gate 
43677c478bd9Sstevel@tonic-gate 			/* get path from file struct here */
43687c478bd9Sstevel@tonic-gate 			fad = F2A(fp);
43697c478bd9Sstevel@tonic-gate 			ASSERT(fad);
43707c478bd9Sstevel@tonic-gate 
43717c478bd9Sstevel@tonic-gate 			/*
43727c478bd9Sstevel@tonic-gate 			 * already processed this file for read attempt
43737c478bd9Sstevel@tonic-gate 			 */
43747c478bd9Sstevel@tonic-gate 			if (fad->fad_flags & FAD_READ) {
43757c478bd9Sstevel@tonic-gate 				/* don't want to audit every recvfrom attempt */
43767c478bd9Sstevel@tonic-gate 				tad->tad_flag = 0;
43777c478bd9Sstevel@tonic-gate 				/* free any residual audit data */
4378005d3febSMarek Pospisil 				au_close(kctx, &(u_ad), 0, 0, 0, NULL);
43797c478bd9Sstevel@tonic-gate 				releasef(fd);
43807c478bd9Sstevel@tonic-gate 				return;
43817c478bd9Sstevel@tonic-gate 			}
43827c478bd9Sstevel@tonic-gate 			/*
43837c478bd9Sstevel@tonic-gate 			 * mark things so we know what happened and don't
43847c478bd9Sstevel@tonic-gate 			 * repeat things
43857c478bd9Sstevel@tonic-gate 			 */
43867c478bd9Sstevel@tonic-gate 			fad->fad_flags |= FAD_READ;
43877c478bd9Sstevel@tonic-gate 
43887c478bd9Sstevel@tonic-gate 			bzero((void *)so_laddr, sizeof (so_laddr));
43897c478bd9Sstevel@tonic-gate 			bzero((void *)so_faddr, sizeof (so_faddr));
43907c478bd9Sstevel@tonic-gate 
43910f1702c5SYu Xiangning 			/* get local and foreign addresses */
43920f1702c5SYu Xiangning 			len = sizeof (so_laddr);
43930f1702c5SYu Xiangning 			(void) socket_getsockname(so,
43940f1702c5SYu Xiangning 			    (struct sockaddr *)so_laddr, &len, CRED());
43950f1702c5SYu Xiangning 			len = sizeof (so_faddr);
43960f1702c5SYu Xiangning 			(void) socket_getpeername(so,
43970f1702c5SYu Xiangning 			    (struct sockaddr *)so_faddr, &len, B_FALSE, CRED());
43987c478bd9Sstevel@tonic-gate 
43997c478bd9Sstevel@tonic-gate 			add_sock_token = 1;
44007c478bd9Sstevel@tonic-gate 		}
44017c478bd9Sstevel@tonic-gate 
44027c478bd9Sstevel@tonic-gate 		/* XXX - what about SOCK_RDM/SOCK_SEQPACKET ??? */
44037c478bd9Sstevel@tonic-gate 
44047c478bd9Sstevel@tonic-gate 		break;
44057c478bd9Sstevel@tonic-gate 
44067c478bd9Sstevel@tonic-gate 	case AF_UNIX:
44077c478bd9Sstevel@tonic-gate 		/*
44087c478bd9Sstevel@tonic-gate 		 * first check if this is first time through. Too much
44097c478bd9Sstevel@tonic-gate 		 * duplicate code to put this in an aui_ routine.
44107c478bd9Sstevel@tonic-gate 		 */
44117c478bd9Sstevel@tonic-gate 
44127c478bd9Sstevel@tonic-gate 		/* get path from file struct here */
44137c478bd9Sstevel@tonic-gate 		fad = F2A(fp);
44147c478bd9Sstevel@tonic-gate 		ASSERT(fad);
44157c478bd9Sstevel@tonic-gate 
44167c478bd9Sstevel@tonic-gate 		/*
44177c478bd9Sstevel@tonic-gate 		 * already processed this file for read attempt
44187c478bd9Sstevel@tonic-gate 		 */
44197c478bd9Sstevel@tonic-gate 		if (fad->fad_flags & FAD_READ) {
44207c478bd9Sstevel@tonic-gate 			/* don't want to audit every recvfrom attempt */
44217c478bd9Sstevel@tonic-gate 			tad->tad_flag = 0;
44227c478bd9Sstevel@tonic-gate 			/* free any residual audit data */
4423005d3febSMarek Pospisil 			au_close(kctx, &(u_ad), 0, 0, 0, NULL);
44247c478bd9Sstevel@tonic-gate 			releasef(fd);
44257c478bd9Sstevel@tonic-gate 			return;
44267c478bd9Sstevel@tonic-gate 		}
44277c478bd9Sstevel@tonic-gate 		/*
44287c478bd9Sstevel@tonic-gate 		 * mark things so we know what happened and don't
44297c478bd9Sstevel@tonic-gate 		 * repeat things
44307c478bd9Sstevel@tonic-gate 		 */
44317c478bd9Sstevel@tonic-gate 		fad->fad_flags |= FAD_READ;
44327c478bd9Sstevel@tonic-gate 
44337c478bd9Sstevel@tonic-gate 		if (fad->fad_aupath != NULL) {
44347c478bd9Sstevel@tonic-gate 			au_uwrite(au_to_path(fad->fad_aupath));
44357c478bd9Sstevel@tonic-gate 		} else {
44367c478bd9Sstevel@tonic-gate 			au_uwrite(au_to_arg32(1, "no path: fd", fd));
44377c478bd9Sstevel@tonic-gate 		}
44387c478bd9Sstevel@tonic-gate 
44397c478bd9Sstevel@tonic-gate 		audit_attributes(fp->f_vnode);
44407c478bd9Sstevel@tonic-gate 
44417c478bd9Sstevel@tonic-gate 		releasef(fd);
44427c478bd9Sstevel@tonic-gate 
44437c478bd9Sstevel@tonic-gate 		return;
44447c478bd9Sstevel@tonic-gate 
44457c478bd9Sstevel@tonic-gate 	default:
44467c478bd9Sstevel@tonic-gate 		break;
44477c478bd9Sstevel@tonic-gate 
44487c478bd9Sstevel@tonic-gate 	}
44497c478bd9Sstevel@tonic-gate 
44507c478bd9Sstevel@tonic-gate 	releasef(fd);
44517c478bd9Sstevel@tonic-gate 
44527c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
44537c478bd9Sstevel@tonic-gate 
44547c478bd9Sstevel@tonic-gate 	if (add_sock_token == 0) {
44557c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "family", (uint32_t)so_family));
44567c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "type", (uint32_t)so_type));
44577c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(3, "flags", (uint32_t)(uap->flags)));
44587c478bd9Sstevel@tonic-gate 		return;
44597c478bd9Sstevel@tonic-gate 	}
44607c478bd9Sstevel@tonic-gate 
44617c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(3, "flags", (uint32_t)(uap->flags)));
44627c478bd9Sstevel@tonic-gate 
44637c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_socket_ex(so_family, so_type, so_laddr, so_faddr));
44647c478bd9Sstevel@tonic-gate }
44657c478bd9Sstevel@tonic-gate 
44667c478bd9Sstevel@tonic-gate /*ARGSUSED*/
44677c478bd9Sstevel@tonic-gate static void
44687c478bd9Sstevel@tonic-gate auf_sendmsg(struct t_audit_data *tad, int error, rval_t *rval)
44697c478bd9Sstevel@tonic-gate {
44707c478bd9Sstevel@tonic-gate 	struct a {
44717c478bd9Sstevel@tonic-gate 		long	fd;
44727c478bd9Sstevel@tonic-gate 		long	msg;	/* struct msghdr */
44737c478bd9Sstevel@tonic-gate 		long	flags;
44747c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)ttolwp(curthread)->lwp_ap;
44757c478bd9Sstevel@tonic-gate 
44767c478bd9Sstevel@tonic-gate 	struct sonode	*so;
44777c478bd9Sstevel@tonic-gate 	char so_laddr[sizeof (struct sockaddr_in6)];
44787c478bd9Sstevel@tonic-gate 	char so_faddr[sizeof (struct sockaddr_in6)];
44797c478bd9Sstevel@tonic-gate 	int		err;
44807c478bd9Sstevel@tonic-gate 	int		fd;
44817c478bd9Sstevel@tonic-gate 	short so_family, so_type;
44827c478bd9Sstevel@tonic-gate 	int		add_sock_token = 0;
44830f1702c5SYu Xiangning 	socklen_t	len;
44847c478bd9Sstevel@tonic-gate 	struct file	*fp;
44857c478bd9Sstevel@tonic-gate 	struct f_audit_data *fad;
44867c478bd9Sstevel@tonic-gate 	caddr_t		msg_name;
44877c478bd9Sstevel@tonic-gate 	socklen_t	msg_namelen;
44887c478bd9Sstevel@tonic-gate 	STRUCT_DECL(msghdr, msg);
44899e9e6ab8Spaulson 	au_kcontext_t	*kctx = GET_KCTX_PZ;
44907c478bd9Sstevel@tonic-gate 
44917c478bd9Sstevel@tonic-gate 	fd = (int)uap->fd;
44927c478bd9Sstevel@tonic-gate 
44937c478bd9Sstevel@tonic-gate 	/* bail if an error */
44947c478bd9Sstevel@tonic-gate 	if (error) {
44957c478bd9Sstevel@tonic-gate 		/* XXX include destination address from system call arguments */
44967c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
44977c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(3, "flags", (uint32_t)(uap->flags)));
44987c478bd9Sstevel@tonic-gate 		return;
44997c478bd9Sstevel@tonic-gate 	}
45007c478bd9Sstevel@tonic-gate 
4501745b2690Stz 	if ((so = getsonode(fd, &err, &fp)) == NULL) {
45027c478bd9Sstevel@tonic-gate 		/*
45037c478bd9Sstevel@tonic-gate 		 * not security relevant if doing a sendmsg from non socket
45047c478bd9Sstevel@tonic-gate 		 * so no extra tokens. Should probably turn off audit record
45057c478bd9Sstevel@tonic-gate 		 * generation here.
45067c478bd9Sstevel@tonic-gate 		 */
45077c478bd9Sstevel@tonic-gate 		return;
45087c478bd9Sstevel@tonic-gate 	}
45097c478bd9Sstevel@tonic-gate 
45107c478bd9Sstevel@tonic-gate 	so_family = so->so_family;
45117c478bd9Sstevel@tonic-gate 	so_type   = so->so_type;
45127c478bd9Sstevel@tonic-gate 
45137c478bd9Sstevel@tonic-gate 	switch (so_family) {
45147c478bd9Sstevel@tonic-gate 	case AF_INET:
45157c478bd9Sstevel@tonic-gate 	case AF_INET6:
45167c478bd9Sstevel@tonic-gate 		/*
45177c478bd9Sstevel@tonic-gate 		 * if datagram type socket, then just use what is in
45187c478bd9Sstevel@tonic-gate 		 * socket structure for local address.
45197c478bd9Sstevel@tonic-gate 		 * XXX - what do we do for other types?
45207c478bd9Sstevel@tonic-gate 		 */
45217c478bd9Sstevel@tonic-gate 		if ((so->so_type == SOCK_DGRAM) ||
45227c478bd9Sstevel@tonic-gate 		    (so->so_type == SOCK_RAW)) {
45237c478bd9Sstevel@tonic-gate 
45247c478bd9Sstevel@tonic-gate 			bzero((void *)so_laddr, sizeof (so_laddr));
45257c478bd9Sstevel@tonic-gate 			bzero((void *)so_faddr, sizeof (so_faddr));
45267c478bd9Sstevel@tonic-gate 
45277c478bd9Sstevel@tonic-gate 			/* get local address */
45280f1702c5SYu Xiangning 			len = sizeof (so_laddr);
45290f1702c5SYu Xiangning 			(void) socket_getsockname(so,
45300f1702c5SYu Xiangning 			    (struct sockaddr *)so_laddr, &len, CRED());
45317c478bd9Sstevel@tonic-gate 
45327c478bd9Sstevel@tonic-gate 			/* get peer address */
45337c478bd9Sstevel@tonic-gate 			STRUCT_INIT(msg, get_udatamodel());
45347c478bd9Sstevel@tonic-gate 
45357c478bd9Sstevel@tonic-gate 			if (copyin((caddr_t)(uap->msg),
45367c478bd9Sstevel@tonic-gate 			    (caddr_t)STRUCT_BUF(msg), STRUCT_SIZE(msg)) != 0) {
45377c478bd9Sstevel@tonic-gate 				break;
45387c478bd9Sstevel@tonic-gate 			}
45397c478bd9Sstevel@tonic-gate 			msg_name = (caddr_t)STRUCT_FGETP(msg, msg_name);
45407c478bd9Sstevel@tonic-gate 			if (msg_name == NULL)
45417c478bd9Sstevel@tonic-gate 				break;
45427c478bd9Sstevel@tonic-gate 
45437c478bd9Sstevel@tonic-gate 			msg_namelen = (socklen_t)STRUCT_FGET(msg, msg_namelen);
45447c478bd9Sstevel@tonic-gate 			/* length is value from recvmsg - sanity check */
45457c478bd9Sstevel@tonic-gate 			if (msg_namelen == 0)
45467c478bd9Sstevel@tonic-gate 				break;
45477c478bd9Sstevel@tonic-gate 
45487c478bd9Sstevel@tonic-gate 			if (copyin(msg_name, so_faddr,
45497c478bd9Sstevel@tonic-gate 			    sizeof (so_faddr)) != 0)
45507c478bd9Sstevel@tonic-gate 				break;
45517c478bd9Sstevel@tonic-gate 
45527c478bd9Sstevel@tonic-gate 			add_sock_token = 1;
45537c478bd9Sstevel@tonic-gate 
45547c478bd9Sstevel@tonic-gate 		} else if (so->so_type == SOCK_STREAM) {
45557c478bd9Sstevel@tonic-gate 
45567c478bd9Sstevel@tonic-gate 			/* get path from file struct here */
45577c478bd9Sstevel@tonic-gate 			fad = F2A(fp);
45587c478bd9Sstevel@tonic-gate 			ASSERT(fad);
45597c478bd9Sstevel@tonic-gate 
45607c478bd9Sstevel@tonic-gate 			/*
45617c478bd9Sstevel@tonic-gate 			 * already processed this file for write attempt
45627c478bd9Sstevel@tonic-gate 			 */
45637c478bd9Sstevel@tonic-gate 			if (fad->fad_flags & FAD_WRITE) {
45647c478bd9Sstevel@tonic-gate 				releasef(fd);
45657c478bd9Sstevel@tonic-gate 				/* don't want to audit every sendmsg attempt */
45667c478bd9Sstevel@tonic-gate 				tad->tad_flag = 0;
45677c478bd9Sstevel@tonic-gate 				/* free any residual audit data */
4568005d3febSMarek Pospisil 				au_close(kctx, &(u_ad), 0, 0, 0, NULL);
45697c478bd9Sstevel@tonic-gate 				return;
45707c478bd9Sstevel@tonic-gate 			}
45717c478bd9Sstevel@tonic-gate 
45727c478bd9Sstevel@tonic-gate 			/*
45737c478bd9Sstevel@tonic-gate 			 * mark things so we know what happened and don't
45747c478bd9Sstevel@tonic-gate 			 * repeat things
45757c478bd9Sstevel@tonic-gate 			 */
45767c478bd9Sstevel@tonic-gate 			fad->fad_flags |= FAD_WRITE;
45777c478bd9Sstevel@tonic-gate 
45787c478bd9Sstevel@tonic-gate 			bzero((void *)so_laddr, sizeof (so_laddr));
45797c478bd9Sstevel@tonic-gate 			bzero((void *)so_faddr, sizeof (so_faddr));
45807c478bd9Sstevel@tonic-gate 
45810f1702c5SYu Xiangning 			/* get local and foreign addresses */
45820f1702c5SYu Xiangning 			len = sizeof (so_laddr);
45830f1702c5SYu Xiangning 			(void) socket_getsockname(so,
45840f1702c5SYu Xiangning 			    (struct sockaddr *)so_laddr, &len, CRED());
45850f1702c5SYu Xiangning 			len = sizeof (so_faddr);
45860f1702c5SYu Xiangning 			(void) socket_getpeername(so,
45870f1702c5SYu Xiangning 			    (struct sockaddr *)so_faddr, &len, B_FALSE, CRED());
45887c478bd9Sstevel@tonic-gate 
45897c478bd9Sstevel@tonic-gate 			add_sock_token = 1;
45907c478bd9Sstevel@tonic-gate 		}
45917c478bd9Sstevel@tonic-gate 
45927c478bd9Sstevel@tonic-gate 		/* XXX - what about SOCK_RAW/SOCK_RDM/SOCK_SEQPACKET ??? */
45937c478bd9Sstevel@tonic-gate 
45947c478bd9Sstevel@tonic-gate 		break;
45957c478bd9Sstevel@tonic-gate 
45967c478bd9Sstevel@tonic-gate 	case AF_UNIX:
45977c478bd9Sstevel@tonic-gate 		/*
45987c478bd9Sstevel@tonic-gate 		 * first check if this is first time through. Too much
45997c478bd9Sstevel@tonic-gate 		 * duplicate code to put this in an aui_ routine.
46007c478bd9Sstevel@tonic-gate 		 */
46017c478bd9Sstevel@tonic-gate 
46027c478bd9Sstevel@tonic-gate 		/* get path from file struct here */
46037c478bd9Sstevel@tonic-gate 		fad = F2A(fp);
46047c478bd9Sstevel@tonic-gate 		ASSERT(fad);
46057c478bd9Sstevel@tonic-gate 
46067c478bd9Sstevel@tonic-gate 		/*
46077c478bd9Sstevel@tonic-gate 		 * already processed this file for write attempt
46087c478bd9Sstevel@tonic-gate 		 */
46097c478bd9Sstevel@tonic-gate 		if (fad->fad_flags & FAD_WRITE) {
46107c478bd9Sstevel@tonic-gate 			releasef(fd);
46117c478bd9Sstevel@tonic-gate 			/* don't want to audit every sendmsg attempt */
46127c478bd9Sstevel@tonic-gate 			tad->tad_flag = 0;
46137c478bd9Sstevel@tonic-gate 			/* free any residual audit data */
4614005d3febSMarek Pospisil 			au_close(kctx, &(u_ad), 0, 0, 0, NULL);
46157c478bd9Sstevel@tonic-gate 			return;
46167c478bd9Sstevel@tonic-gate 		}
46177c478bd9Sstevel@tonic-gate 		/*
46187c478bd9Sstevel@tonic-gate 		 * mark things so we know what happened and don't
46197c478bd9Sstevel@tonic-gate 		 * repeat things
46207c478bd9Sstevel@tonic-gate 		 */
46217c478bd9Sstevel@tonic-gate 		fad->fad_flags |= FAD_WRITE;
46227c478bd9Sstevel@tonic-gate 
46237c478bd9Sstevel@tonic-gate 		if (fad->fad_aupath != NULL) {
46247c478bd9Sstevel@tonic-gate 			au_uwrite(au_to_path(fad->fad_aupath));
46257c478bd9Sstevel@tonic-gate 		} else {
46267c478bd9Sstevel@tonic-gate 			au_uwrite(au_to_arg32(1, "no path: fd", fd));
46277c478bd9Sstevel@tonic-gate 		}
46287c478bd9Sstevel@tonic-gate 
46297c478bd9Sstevel@tonic-gate 		audit_attributes(fp->f_vnode);
46307c478bd9Sstevel@tonic-gate 
46317c478bd9Sstevel@tonic-gate 		releasef(fd);
46327c478bd9Sstevel@tonic-gate 
46337c478bd9Sstevel@tonic-gate 		return;
46347c478bd9Sstevel@tonic-gate 
46357c478bd9Sstevel@tonic-gate 	default:
46367c478bd9Sstevel@tonic-gate 		break;
46377c478bd9Sstevel@tonic-gate 	}
46387c478bd9Sstevel@tonic-gate 
46397c478bd9Sstevel@tonic-gate 	releasef(fd);
46407c478bd9Sstevel@tonic-gate 
46417c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
46427c478bd9Sstevel@tonic-gate 
46437c478bd9Sstevel@tonic-gate 	if (add_sock_token == 0) {
46447c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "family", (uint32_t)so_family));
46457c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "type", (uint32_t)so_type));
46467c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(3, "flags", (uint32_t)(uap->flags)));
46477c478bd9Sstevel@tonic-gate 		return;
46487c478bd9Sstevel@tonic-gate 	}
46497c478bd9Sstevel@tonic-gate 
46507c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(3, "flags", (uint32_t)(uap->flags)));
46517c478bd9Sstevel@tonic-gate 
46527c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_socket_ex(so_family, so_type, so_laddr, so_faddr));
46537c478bd9Sstevel@tonic-gate }
46547c478bd9Sstevel@tonic-gate 
46557c478bd9Sstevel@tonic-gate /*ARGSUSED*/
46567c478bd9Sstevel@tonic-gate static void
46577c478bd9Sstevel@tonic-gate auf_sendto(struct t_audit_data *tad, int error, rval_t *rval)
46587c478bd9Sstevel@tonic-gate {
46597c478bd9Sstevel@tonic-gate 	struct a {
46607c478bd9Sstevel@tonic-gate 		long	fd;
46617c478bd9Sstevel@tonic-gate 		long	msg;	/* char */
46627c478bd9Sstevel@tonic-gate 		long	len;
46637c478bd9Sstevel@tonic-gate 		long	flags;
46647c478bd9Sstevel@tonic-gate 		long	to;	/* struct sockaddr */
46657c478bd9Sstevel@tonic-gate 		long	tolen;
46667c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)ttolwp(curthread)->lwp_ap;
46677c478bd9Sstevel@tonic-gate 
46687c478bd9Sstevel@tonic-gate 	struct sonode	*so;
46697c478bd9Sstevel@tonic-gate 	char so_laddr[sizeof (struct sockaddr_in6)];
46707c478bd9Sstevel@tonic-gate 	char so_faddr[sizeof (struct sockaddr_in6)];
46717c478bd9Sstevel@tonic-gate 	socklen_t	tolen;
46727c478bd9Sstevel@tonic-gate 	int		err;
46737c478bd9Sstevel@tonic-gate 	int		fd;
46740f1702c5SYu Xiangning 	socklen_t	len;
46757c478bd9Sstevel@tonic-gate 	short so_family, so_type;
46767c478bd9Sstevel@tonic-gate 	int		add_sock_token = 0;
46777c478bd9Sstevel@tonic-gate 	struct file	*fp;
46787c478bd9Sstevel@tonic-gate 	struct f_audit_data *fad;
46799e9e6ab8Spaulson 	au_kcontext_t	*kctx = GET_KCTX_PZ;
46807c478bd9Sstevel@tonic-gate 
46817c478bd9Sstevel@tonic-gate 	fd = (int)uap->fd;
46827c478bd9Sstevel@tonic-gate 
46837c478bd9Sstevel@tonic-gate 	/* bail if an error */
46847c478bd9Sstevel@tonic-gate 	if (error) {
46857c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
46867c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(3, "flags", (uint32_t)(uap->flags)));
46877c478bd9Sstevel@tonic-gate 		/* XXX include destination address from system call arguments */
46887c478bd9Sstevel@tonic-gate 		return;
46897c478bd9Sstevel@tonic-gate 	}
46907c478bd9Sstevel@tonic-gate 
4691745b2690Stz 	if ((so = getsonode(fd, &err, &fp)) == NULL) {
46927c478bd9Sstevel@tonic-gate 		/*
46937c478bd9Sstevel@tonic-gate 		 * not security relevant if doing a sendto using non socket
46947c478bd9Sstevel@tonic-gate 		 * so no extra tokens. Should probably turn off audit record
46957c478bd9Sstevel@tonic-gate 		 * generation here.
46967c478bd9Sstevel@tonic-gate 		 */
46977c478bd9Sstevel@tonic-gate 		return;
46987c478bd9Sstevel@tonic-gate 	}
46997c478bd9Sstevel@tonic-gate 
47007c478bd9Sstevel@tonic-gate 	so_family = so->so_family;
47017c478bd9Sstevel@tonic-gate 	so_type   = so->so_type;
47027c478bd9Sstevel@tonic-gate 
47037c478bd9Sstevel@tonic-gate 	/*
47047c478bd9Sstevel@tonic-gate 	 * only putout SOCKET_EX token if INET/INET6 family.
47057c478bd9Sstevel@tonic-gate 	 * XXX - what do we do about other families?
47067c478bd9Sstevel@tonic-gate 	 */
47077c478bd9Sstevel@tonic-gate 
47087c478bd9Sstevel@tonic-gate 	switch (so_family) {
47097c478bd9Sstevel@tonic-gate 	case AF_INET:
47107c478bd9Sstevel@tonic-gate 	case AF_INET6:
47117c478bd9Sstevel@tonic-gate 
47127c478bd9Sstevel@tonic-gate 		/*
47137c478bd9Sstevel@tonic-gate 		 * if datagram type socket, then just use what is in
47147c478bd9Sstevel@tonic-gate 		 * socket structure for local address.
47157c478bd9Sstevel@tonic-gate 		 * XXX - what do we do for other types?
47167c478bd9Sstevel@tonic-gate 		 */
47177c478bd9Sstevel@tonic-gate 		if ((so->so_type == SOCK_DGRAM) ||
47187c478bd9Sstevel@tonic-gate 		    (so->so_type == SOCK_RAW)) {
47197c478bd9Sstevel@tonic-gate 
47207c478bd9Sstevel@tonic-gate 			bzero((void *)so_laddr, sizeof (so_laddr));
47217c478bd9Sstevel@tonic-gate 			bzero((void *)so_faddr, sizeof (so_faddr));
47227c478bd9Sstevel@tonic-gate 
47237c478bd9Sstevel@tonic-gate 			/* get local address */
47240f1702c5SYu Xiangning 			len = sizeof (so_laddr);
47250f1702c5SYu Xiangning 			(void) socket_getsockname(so,
47260f1702c5SYu Xiangning 			    (struct sockaddr *)so_laddr, &len, CRED());
47277c478bd9Sstevel@tonic-gate 
47287c478bd9Sstevel@tonic-gate 			/* get peer address */
47297c478bd9Sstevel@tonic-gate 
47307c478bd9Sstevel@tonic-gate 			/* sanity check */
4731*0f48f68dSToomas Soome 			if (uap->to == 0)
47327c478bd9Sstevel@tonic-gate 				break;
47337c478bd9Sstevel@tonic-gate 
47347c478bd9Sstevel@tonic-gate 			/* sanity checks */
47357c478bd9Sstevel@tonic-gate 			if (uap->tolen == 0)
47367c478bd9Sstevel@tonic-gate 				break;
47377c478bd9Sstevel@tonic-gate 
47387c478bd9Sstevel@tonic-gate 			tolen = (socklen_t)uap->tolen;
47397c478bd9Sstevel@tonic-gate 
47407c478bd9Sstevel@tonic-gate 			/* enforce maximum size */
47417c478bd9Sstevel@tonic-gate 			if (tolen > sizeof (so_faddr))
47427c478bd9Sstevel@tonic-gate 				tolen = sizeof (so_faddr);
47437c478bd9Sstevel@tonic-gate 
47447c478bd9Sstevel@tonic-gate 			if (copyin((caddr_t)(uap->to), so_faddr, tolen) != 0)
47457c478bd9Sstevel@tonic-gate 				break;
47467c478bd9Sstevel@tonic-gate 
47477c478bd9Sstevel@tonic-gate 			add_sock_token = 1;
47487c478bd9Sstevel@tonic-gate 		} else {
47497c478bd9Sstevel@tonic-gate 			/*
47507c478bd9Sstevel@tonic-gate 			 * check if this is first time through.
47517c478bd9Sstevel@tonic-gate 			 */
47527c478bd9Sstevel@tonic-gate 
47537c478bd9Sstevel@tonic-gate 			/* get path from file struct here */
47547c478bd9Sstevel@tonic-gate 			fad = F2A(fp);
47557c478bd9Sstevel@tonic-gate 			ASSERT(fad);
47567c478bd9Sstevel@tonic-gate 
47577c478bd9Sstevel@tonic-gate 			/*
47587c478bd9Sstevel@tonic-gate 			 * already processed this file for write attempt
47597c478bd9Sstevel@tonic-gate 			 */
47607c478bd9Sstevel@tonic-gate 			if (fad->fad_flags & FAD_WRITE) {
47617c478bd9Sstevel@tonic-gate 				/* don't want to audit every sendto attempt */
47627c478bd9Sstevel@tonic-gate 				tad->tad_flag = 0;
47637c478bd9Sstevel@tonic-gate 				/* free any residual audit data */
4764005d3febSMarek Pospisil 				au_close(kctx, &(u_ad), 0, 0, 0, NULL);
47657c478bd9Sstevel@tonic-gate 				releasef(fd);
47667c478bd9Sstevel@tonic-gate 				return;
47677c478bd9Sstevel@tonic-gate 			}
47687c478bd9Sstevel@tonic-gate 			/*
47697c478bd9Sstevel@tonic-gate 			 * mark things so we know what happened and don't
47707c478bd9Sstevel@tonic-gate 			 * repeat things
47717c478bd9Sstevel@tonic-gate 			 */
47727c478bd9Sstevel@tonic-gate 			fad->fad_flags |= FAD_WRITE;
47737c478bd9Sstevel@tonic-gate 
47747c478bd9Sstevel@tonic-gate 			bzero((void *)so_laddr, sizeof (so_laddr));
47757c478bd9Sstevel@tonic-gate 			bzero((void *)so_faddr, sizeof (so_faddr));
47767c478bd9Sstevel@tonic-gate 
47770f1702c5SYu Xiangning 			/* get local and foreign addresses */
47780f1702c5SYu Xiangning 			len = sizeof (so_laddr);
47790f1702c5SYu Xiangning 			(void) socket_getsockname(so,
47800f1702c5SYu Xiangning 			    (struct sockaddr *)so_laddr, &len, CRED());
47810f1702c5SYu Xiangning 			len = sizeof (so_faddr);
47820f1702c5SYu Xiangning 			(void) socket_getpeername(so,
47830f1702c5SYu Xiangning 			    (struct sockaddr *)so_faddr, &len, B_FALSE, CRED());
47847c478bd9Sstevel@tonic-gate 
47857c478bd9Sstevel@tonic-gate 			add_sock_token = 1;
47867c478bd9Sstevel@tonic-gate 		}
47877c478bd9Sstevel@tonic-gate 
47887c478bd9Sstevel@tonic-gate 		/* XXX - what about SOCK_RDM/SOCK_SEQPACKET ??? */
47897c478bd9Sstevel@tonic-gate 
47907c478bd9Sstevel@tonic-gate 		break;
47917c478bd9Sstevel@tonic-gate 
47927c478bd9Sstevel@tonic-gate 	case AF_UNIX:
47937c478bd9Sstevel@tonic-gate 		/*
47947c478bd9Sstevel@tonic-gate 		 * first check if this is first time through. Too much
47957c478bd9Sstevel@tonic-gate 		 * duplicate code to put this in an aui_ routine.
47967c478bd9Sstevel@tonic-gate 		 */
47977c478bd9Sstevel@tonic-gate 
47987c478bd9Sstevel@tonic-gate 		/* get path from file struct here */
47997c478bd9Sstevel@tonic-gate 		fad = F2A(fp);
48007c478bd9Sstevel@tonic-gate 		ASSERT(fad);
48017c478bd9Sstevel@tonic-gate 
48027c478bd9Sstevel@tonic-gate 		/*
48037c478bd9Sstevel@tonic-gate 		 * already processed this file for write attempt
48047c478bd9Sstevel@tonic-gate 		 */
48057c478bd9Sstevel@tonic-gate 		if (fad->fad_flags & FAD_WRITE) {
48067c478bd9Sstevel@tonic-gate 			/* don't want to audit every sendto attempt */
48077c478bd9Sstevel@tonic-gate 			tad->tad_flag = 0;
48087c478bd9Sstevel@tonic-gate 			/* free any residual audit data */
4809005d3febSMarek Pospisil 			au_close(kctx, &(u_ad), 0, 0, 0, NULL);
48107c478bd9Sstevel@tonic-gate 			releasef(fd);
48117c478bd9Sstevel@tonic-gate 			return;
48127c478bd9Sstevel@tonic-gate 		}
48137c478bd9Sstevel@tonic-gate 		/*
48147c478bd9Sstevel@tonic-gate 		 * mark things so we know what happened and don't
48157c478bd9Sstevel@tonic-gate 		 * repeat things
48167c478bd9Sstevel@tonic-gate 		 */
48177c478bd9Sstevel@tonic-gate 		fad->fad_flags |= FAD_WRITE;
48187c478bd9Sstevel@tonic-gate 
48197c478bd9Sstevel@tonic-gate 		if (fad->fad_aupath != NULL) {
48207c478bd9Sstevel@tonic-gate 			au_uwrite(au_to_path(fad->fad_aupath));
48217c478bd9Sstevel@tonic-gate 		} else {
48227c478bd9Sstevel@tonic-gate 			au_uwrite(au_to_arg32(1, "no path: fd", fd));
48237c478bd9Sstevel@tonic-gate 		}
48247c478bd9Sstevel@tonic-gate 
48257c478bd9Sstevel@tonic-gate 		audit_attributes(fp->f_vnode);
48267c478bd9Sstevel@tonic-gate 
48277c478bd9Sstevel@tonic-gate 		releasef(fd);
48287c478bd9Sstevel@tonic-gate 
48297c478bd9Sstevel@tonic-gate 		return;
48307c478bd9Sstevel@tonic-gate 
48317c478bd9Sstevel@tonic-gate 	default:
48327c478bd9Sstevel@tonic-gate 		break;
48337c478bd9Sstevel@tonic-gate 
48347c478bd9Sstevel@tonic-gate 	}
48357c478bd9Sstevel@tonic-gate 
48367c478bd9Sstevel@tonic-gate 	releasef(fd);
48377c478bd9Sstevel@tonic-gate 
48387c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
48397c478bd9Sstevel@tonic-gate 
48407c478bd9Sstevel@tonic-gate 	if (add_sock_token == 0) {
48417c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "family", (uint32_t)so_family));
48427c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "type", (uint32_t)so_type));
48437c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(3, "flags", (uint32_t)(uap->flags)));
48447c478bd9Sstevel@tonic-gate 		return;
48457c478bd9Sstevel@tonic-gate 	}
48467c478bd9Sstevel@tonic-gate 
48477c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(3, "flags", (uint32_t)(uap->flags)));
48487c478bd9Sstevel@tonic-gate 
48497c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_socket_ex(so_family, so_type, so_laddr, so_faddr));
48507c478bd9Sstevel@tonic-gate 
48517c478bd9Sstevel@tonic-gate }
48527c478bd9Sstevel@tonic-gate 
48537c478bd9Sstevel@tonic-gate /*
4854da6c28aaSamw  * XXX socket(2) may be equivalent to open(2) on a unix domain
48557c478bd9Sstevel@tonic-gate  * socket. This needs investigation.
48567c478bd9Sstevel@tonic-gate  */
48577c478bd9Sstevel@tonic-gate 
48587c478bd9Sstevel@tonic-gate /*ARGSUSED*/
48597c478bd9Sstevel@tonic-gate static void
48607c478bd9Sstevel@tonic-gate aus_socket(struct t_audit_data *tad)
48617c478bd9Sstevel@tonic-gate {
48627c478bd9Sstevel@tonic-gate 	struct a {
48637c478bd9Sstevel@tonic-gate 		long	domain;
48647c478bd9Sstevel@tonic-gate 		long	type;
48657c478bd9Sstevel@tonic-gate 		long	protocol;
48667c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)ttolwp(curthread)->lwp_ap;
48677c478bd9Sstevel@tonic-gate 
48687c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(1, "domain", (uint32_t)uap->domain));
48697c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(2, "type", (uint32_t)uap->type));
48707c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(3, "protocol", (uint32_t)uap->protocol));
48717c478bd9Sstevel@tonic-gate }
48727c478bd9Sstevel@tonic-gate 
48737c478bd9Sstevel@tonic-gate /*ARGSUSED*/
48747c478bd9Sstevel@tonic-gate static void
48757c478bd9Sstevel@tonic-gate aus_sigqueue(struct t_audit_data *tad)
48767c478bd9Sstevel@tonic-gate {
48777c478bd9Sstevel@tonic-gate 	struct a {
48787c478bd9Sstevel@tonic-gate 		long	pid;
48797c478bd9Sstevel@tonic-gate 		long	signo;
48807c478bd9Sstevel@tonic-gate 		long	*val;
48817c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)ttolwp(curthread)->lwp_ap;
48827c478bd9Sstevel@tonic-gate 	struct proc *p;
48837c478bd9Sstevel@tonic-gate 	uid_t uid, ruid;
48847c478bd9Sstevel@tonic-gate 	gid_t gid, rgid;
48857c478bd9Sstevel@tonic-gate 	pid_t pid;
48867c478bd9Sstevel@tonic-gate 	const auditinfo_addr_t *ainfo;
48877c478bd9Sstevel@tonic-gate 	cred_t *cr;
48887c478bd9Sstevel@tonic-gate 
48897c478bd9Sstevel@tonic-gate 	pid = (pid_t)uap->pid;
48907c478bd9Sstevel@tonic-gate 
48917c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(2, "signal", (uint32_t)uap->signo));
48927c478bd9Sstevel@tonic-gate 	if (pid > 0) {
48937c478bd9Sstevel@tonic-gate 		mutex_enter(&pidlock);
48947c478bd9Sstevel@tonic-gate 		if ((p = prfind(pid)) == (struct proc *)0) {
48957c478bd9Sstevel@tonic-gate 			mutex_exit(&pidlock);
48967c478bd9Sstevel@tonic-gate 			return;
48977c478bd9Sstevel@tonic-gate 		}
48987c478bd9Sstevel@tonic-gate 		mutex_enter(&p->p_lock); /* so process doesn't go away */
48997c478bd9Sstevel@tonic-gate 		mutex_exit(&pidlock);
49007c478bd9Sstevel@tonic-gate 
49017c478bd9Sstevel@tonic-gate 		mutex_enter(&p->p_crlock);
49027c478bd9Sstevel@tonic-gate 		crhold(cr = p->p_cred);
49037c478bd9Sstevel@tonic-gate 		mutex_exit(&p->p_crlock);
49047c478bd9Sstevel@tonic-gate 		mutex_exit(&p->p_lock);
49057c478bd9Sstevel@tonic-gate 
49067c478bd9Sstevel@tonic-gate 		ainfo = crgetauinfo(cr);
49077c478bd9Sstevel@tonic-gate 		if (ainfo == NULL) {
49087c478bd9Sstevel@tonic-gate 			crfree(cr);
49097c478bd9Sstevel@tonic-gate 			return;
49107c478bd9Sstevel@tonic-gate 		}
49117c478bd9Sstevel@tonic-gate 
49127c478bd9Sstevel@tonic-gate 		uid  = crgetuid(cr);
49137c478bd9Sstevel@tonic-gate 		gid  = crgetgid(cr);
49147c478bd9Sstevel@tonic-gate 		ruid = crgetruid(cr);
49157c478bd9Sstevel@tonic-gate 		rgid = crgetrgid(cr);
49167c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_process(uid, gid, ruid, rgid, pid,
49177c478bd9Sstevel@tonic-gate 		    ainfo->ai_auid, ainfo->ai_asid, &ainfo->ai_termid));
49187c478bd9Sstevel@tonic-gate 		crfree(cr);
49197c478bd9Sstevel@tonic-gate 	}
49207c478bd9Sstevel@tonic-gate 	else
49217c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "process ID", (uint32_t)pid));
49227c478bd9Sstevel@tonic-gate }
49237c478bd9Sstevel@tonic-gate 
49247c478bd9Sstevel@tonic-gate /*ARGSUSED*/
49257c478bd9Sstevel@tonic-gate static void
49267c478bd9Sstevel@tonic-gate aus_inst_sync(struct t_audit_data *tad)
49277c478bd9Sstevel@tonic-gate {
49287c478bd9Sstevel@tonic-gate 	struct a {
49297c478bd9Sstevel@tonic-gate 		long	name;	/* char */
49307c478bd9Sstevel@tonic-gate 		long	flags;
49317c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)ttolwp(curthread)->lwp_ap;
49327c478bd9Sstevel@tonic-gate 
49337c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(2, "flags", (uint32_t)uap->flags));
49347c478bd9Sstevel@tonic-gate }
49357c478bd9Sstevel@tonic-gate 
49369acbbeafSnn /*ARGSUSED*/
49379acbbeafSnn static void
49389acbbeafSnn aus_brandsys(struct t_audit_data *tad)
49399acbbeafSnn {
49409acbbeafSnn 	klwp_t *clwp = ttolwp(curthread);
49419acbbeafSnn 
49429acbbeafSnn 	struct a {
49439acbbeafSnn 		long	cmd;
49449acbbeafSnn 		long	arg1;
49459acbbeafSnn 		long	arg2;
49469acbbeafSnn 		long	arg3;
49479acbbeafSnn 		long	arg4;
49489acbbeafSnn 		long	arg5;
49499acbbeafSnn 		long	arg6;
49509acbbeafSnn 	} *uap = (struct a *)clwp->lwp_ap;
49519acbbeafSnn 
49529acbbeafSnn 	au_uwrite(au_to_arg32(1, "cmd", (uint_t)uap->cmd));
49539acbbeafSnn #ifdef _LP64
49549acbbeafSnn 	au_uwrite(au_to_arg64(2, "arg1", (uint64_t)uap->arg1));
49559acbbeafSnn 	au_uwrite(au_to_arg64(3, "arg2", (uint64_t)uap->arg2));
49569acbbeafSnn 	au_uwrite(au_to_arg64(4, "arg3", (uint64_t)uap->arg3));
49579acbbeafSnn 	au_uwrite(au_to_arg64(5, "arg4", (uint64_t)uap->arg4));
49589acbbeafSnn 	au_uwrite(au_to_arg64(6, "arg5", (uint64_t)uap->arg5));
49599acbbeafSnn 	au_uwrite(au_to_arg64(7, "arg6", (uint64_t)uap->arg6));
49609acbbeafSnn #else
49619acbbeafSnn 	au_uwrite(au_to_arg32(2, "arg1", (uint32_t)uap->arg1));
49629acbbeafSnn 	au_uwrite(au_to_arg32(3, "arg2", (uint32_t)uap->arg2));
49639acbbeafSnn 	au_uwrite(au_to_arg32(4, "arg3", (uint32_t)uap->arg3));
49649acbbeafSnn 	au_uwrite(au_to_arg32(5, "arg4", (uint32_t)uap->arg4));
49659acbbeafSnn 	au_uwrite(au_to_arg32(6, "arg5", (uint32_t)uap->arg5));
49669acbbeafSnn 	au_uwrite(au_to_arg32(7, "arg6", (uint32_t)uap->arg6));
49679acbbeafSnn #endif
49689acbbeafSnn }
49699acbbeafSnn 
49707c478bd9Sstevel@tonic-gate /*ARGSUSED*/
49717c478bd9Sstevel@tonic-gate static void
49727c478bd9Sstevel@tonic-gate aus_p_online(struct t_audit_data *tad)
49737c478bd9Sstevel@tonic-gate {
49747c478bd9Sstevel@tonic-gate 	struct a {
49757c478bd9Sstevel@tonic-gate 		long	processor_id;
49767c478bd9Sstevel@tonic-gate 		long	flag;
49777c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)ttolwp(curthread)->lwp_ap;
49787c478bd9Sstevel@tonic-gate 
49797c478bd9Sstevel@tonic-gate 	struct flags {
49807c478bd9Sstevel@tonic-gate 			int	flag;
49817c478bd9Sstevel@tonic-gate 			char	*cflag;
49827c478bd9Sstevel@tonic-gate 	} aflags[6] = {
49837c478bd9Sstevel@tonic-gate 			{ P_ONLINE, "P_ONLINE"},
49847c478bd9Sstevel@tonic-gate 			{ P_OFFLINE, "P_OFFLINE"},
49857c478bd9Sstevel@tonic-gate 			{ P_NOINTR, "P_NOINTR"},
49867c478bd9Sstevel@tonic-gate 			{ P_SPARE, "P_SPARE"},
49877c478bd9Sstevel@tonic-gate 			{ P_FAULTED, "P_FAULTED"},
49887c478bd9Sstevel@tonic-gate 			{ P_STATUS, "P_STATUS"}
49897c478bd9Sstevel@tonic-gate 	};
49907c478bd9Sstevel@tonic-gate 	int i;
49917c478bd9Sstevel@tonic-gate 	char *cflag;
49927c478bd9Sstevel@tonic-gate 
49937c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(1, "processor ID", (uint32_t)uap->processor_id));
49947c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(2, "flag", (uint32_t)uap->flag));
49957c478bd9Sstevel@tonic-gate 
49967c478bd9Sstevel@tonic-gate 	for (i = 0; i < 6; i++) {
49977c478bd9Sstevel@tonic-gate 		if (aflags[i].flag == uap->flag)
49987c478bd9Sstevel@tonic-gate 			break;
49997c478bd9Sstevel@tonic-gate 	}
50007c478bd9Sstevel@tonic-gate 	cflag = (i == 6) ? "bad flag":aflags[i].cflag;
50017c478bd9Sstevel@tonic-gate 
50027c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_text(cflag));
50037c478bd9Sstevel@tonic-gate }
50047c478bd9Sstevel@tonic-gate 
50057c478bd9Sstevel@tonic-gate /*ARGSUSED*/
50067c478bd9Sstevel@tonic-gate static void
50077c478bd9Sstevel@tonic-gate aus_processor_bind(struct t_audit_data *tad)
50087c478bd9Sstevel@tonic-gate {
50097c478bd9Sstevel@tonic-gate 	struct a {
50107c478bd9Sstevel@tonic-gate 		long	id_type;
50117c478bd9Sstevel@tonic-gate 		long	id;
50127c478bd9Sstevel@tonic-gate 		long	processor_id;
50137c478bd9Sstevel@tonic-gate 		long	obind;
50147c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)ttolwp(curthread)->lwp_ap;
50157c478bd9Sstevel@tonic-gate 
50167c478bd9Sstevel@tonic-gate 	struct proc *p;
50177c478bd9Sstevel@tonic-gate 	int lwpcnt;
50187c478bd9Sstevel@tonic-gate 	uid_t uid, ruid;
50197c478bd9Sstevel@tonic-gate 	gid_t gid, rgid;
50207c478bd9Sstevel@tonic-gate 	pid_t pid;
50217c478bd9Sstevel@tonic-gate 	const auditinfo_addr_t *ainfo;
50227c478bd9Sstevel@tonic-gate 	cred_t *cr;
50237c478bd9Sstevel@tonic-gate 
50247c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(1, "ID type", (uint32_t)uap->id_type));
50257c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(2, "ID", (uint32_t)uap->id));
50267c478bd9Sstevel@tonic-gate 	if (uap->processor_id == PBIND_NONE)
50277c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_text("PBIND_NONE"));
50287c478bd9Sstevel@tonic-gate 	else
50297c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(3, "processor_id",
5030745b2690Stz 		    (uint32_t)uap->processor_id));
50317c478bd9Sstevel@tonic-gate 
50327c478bd9Sstevel@tonic-gate 	switch (uap->id_type) {
50337c478bd9Sstevel@tonic-gate 	case P_MYID:
50347c478bd9Sstevel@tonic-gate 	case P_LWPID:
50357c478bd9Sstevel@tonic-gate 		mutex_enter(&pidlock);
50367c478bd9Sstevel@tonic-gate 		p = ttoproc(curthread);
50377c478bd9Sstevel@tonic-gate 		if (p == NULL || p->p_as == &kas) {
50387c478bd9Sstevel@tonic-gate 			mutex_exit(&pidlock);
50397c478bd9Sstevel@tonic-gate 			return;
50407c478bd9Sstevel@tonic-gate 		}
50417c478bd9Sstevel@tonic-gate 		mutex_enter(&p->p_lock);
50427c478bd9Sstevel@tonic-gate 		mutex_exit(&pidlock);
50437c478bd9Sstevel@tonic-gate 		lwpcnt = p->p_lwpcnt;
50447c478bd9Sstevel@tonic-gate 		pid  = p->p_pid;
50457c478bd9Sstevel@tonic-gate 
50467c478bd9Sstevel@tonic-gate 		mutex_enter(&p->p_crlock);
50477c478bd9Sstevel@tonic-gate 		crhold(cr = p->p_cred);
50487c478bd9Sstevel@tonic-gate 		mutex_exit(&p->p_crlock);
50497c478bd9Sstevel@tonic-gate 		mutex_exit(&p->p_lock);
50507c478bd9Sstevel@tonic-gate 
50517c478bd9Sstevel@tonic-gate 		ainfo = crgetauinfo(cr);
50527c478bd9Sstevel@tonic-gate 		if (ainfo == NULL) {
50537c478bd9Sstevel@tonic-gate 			crfree(cr);
50547c478bd9Sstevel@tonic-gate 			return;
50557c478bd9Sstevel@tonic-gate 		}
50567c478bd9Sstevel@tonic-gate 
50577c478bd9Sstevel@tonic-gate 		uid  = crgetuid(cr);
50587c478bd9Sstevel@tonic-gate 		gid  = crgetgid(cr);
50597c478bd9Sstevel@tonic-gate 		ruid = crgetruid(cr);
50607c478bd9Sstevel@tonic-gate 		rgid = crgetrgid(cr);
50617c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_process(uid, gid, ruid, rgid, pid,
50627c478bd9Sstevel@tonic-gate 		    ainfo->ai_auid, ainfo->ai_asid, &ainfo->ai_termid));
50637c478bd9Sstevel@tonic-gate 		crfree(cr);
50647c478bd9Sstevel@tonic-gate 		break;
50657c478bd9Sstevel@tonic-gate 	case P_PID:
50667c478bd9Sstevel@tonic-gate 		mutex_enter(&pidlock);
50677c478bd9Sstevel@tonic-gate 		p = prfind(uap->id);
50687c478bd9Sstevel@tonic-gate 		if (p == NULL || p->p_as == &kas) {
50697c478bd9Sstevel@tonic-gate 			mutex_exit(&pidlock);
50707c478bd9Sstevel@tonic-gate 			return;
50717c478bd9Sstevel@tonic-gate 		}
50727c478bd9Sstevel@tonic-gate 		mutex_enter(&p->p_lock);
50737c478bd9Sstevel@tonic-gate 		mutex_exit(&pidlock);
50747c478bd9Sstevel@tonic-gate 		lwpcnt = p->p_lwpcnt;
50757c478bd9Sstevel@tonic-gate 		pid  = p->p_pid;
50767c478bd9Sstevel@tonic-gate 
50777c478bd9Sstevel@tonic-gate 		mutex_enter(&p->p_crlock);
50787c478bd9Sstevel@tonic-gate 		crhold(cr = p->p_cred);
50797c478bd9Sstevel@tonic-gate 		mutex_exit(&p->p_crlock);
50807c478bd9Sstevel@tonic-gate 		mutex_exit(&p->p_lock);
50817c478bd9Sstevel@tonic-gate 
50827c478bd9Sstevel@tonic-gate 		ainfo = crgetauinfo(cr);
50837c478bd9Sstevel@tonic-gate 		if (ainfo == NULL) {
50847c478bd9Sstevel@tonic-gate 			crfree(cr);
50857c478bd9Sstevel@tonic-gate 			return;
50867c478bd9Sstevel@tonic-gate 		}
50877c478bd9Sstevel@tonic-gate 
50887c478bd9Sstevel@tonic-gate 		uid  = crgetuid(cr);
50897c478bd9Sstevel@tonic-gate 		gid  = crgetgid(cr);
50907c478bd9Sstevel@tonic-gate 		ruid = crgetruid(cr);
50917c478bd9Sstevel@tonic-gate 		rgid = crgetrgid(cr);
50927c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_process(uid, gid, ruid, rgid, pid,
50937c478bd9Sstevel@tonic-gate 		    ainfo->ai_auid, ainfo->ai_asid, &ainfo->ai_termid));
50947c478bd9Sstevel@tonic-gate 		crfree(cr);
50957c478bd9Sstevel@tonic-gate 
50967c478bd9Sstevel@tonic-gate 		break;
50977c478bd9Sstevel@tonic-gate 	default:
50987c478bd9Sstevel@tonic-gate 		return;
50997c478bd9Sstevel@tonic-gate 	}
51007c478bd9Sstevel@tonic-gate 
51017c478bd9Sstevel@tonic-gate 	if (uap->processor_id == PBIND_NONE &&
51027c478bd9Sstevel@tonic-gate 	    (!(uap->id_type == P_LWPID && lwpcnt > 1)))
51037c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_text("PBIND_NONE for process"));
51047c478bd9Sstevel@tonic-gate 	else
51057c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(3, "processor_id",
5106745b2690Stz 		    (uint32_t)uap->processor_id));
51077c478bd9Sstevel@tonic-gate }
51087c478bd9Sstevel@tonic-gate 
51097c478bd9Sstevel@tonic-gate /*ARGSUSED*/
51107c478bd9Sstevel@tonic-gate static au_event_t
51117c478bd9Sstevel@tonic-gate aui_doorfs(au_event_t e)
51127c478bd9Sstevel@tonic-gate {
51137c478bd9Sstevel@tonic-gate 	uint32_t code;
51147c478bd9Sstevel@tonic-gate 
51157c478bd9Sstevel@tonic-gate 	struct a {		/* doorfs */
51167c478bd9Sstevel@tonic-gate 		long	a1;
51177c478bd9Sstevel@tonic-gate 		long	a2;
51187c478bd9Sstevel@tonic-gate 		long	a3;
51197c478bd9Sstevel@tonic-gate 		long	a4;
51207c478bd9Sstevel@tonic-gate 		long	a5;
51217c478bd9Sstevel@tonic-gate 		long	code;
51227c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)ttolwp(curthread)->lwp_ap;
51237c478bd9Sstevel@tonic-gate 
51247c478bd9Sstevel@tonic-gate 	/*
51257c478bd9Sstevel@tonic-gate 	 *	audit formats for several of the
51267c478bd9Sstevel@tonic-gate 	 *	door calls have not yet been determined
51277c478bd9Sstevel@tonic-gate 	 */
51287c478bd9Sstevel@tonic-gate 	code = (uint32_t)uap->code;
51297c478bd9Sstevel@tonic-gate 	switch (code) {
51307c478bd9Sstevel@tonic-gate 	case DOOR_CALL:
51317c478bd9Sstevel@tonic-gate 		e = AUE_DOORFS_DOOR_CALL;
51327c478bd9Sstevel@tonic-gate 		break;
51337c478bd9Sstevel@tonic-gate 	case DOOR_RETURN:
51347c478bd9Sstevel@tonic-gate 		e = AUE_NULL;
51357c478bd9Sstevel@tonic-gate 		break;
51367c478bd9Sstevel@tonic-gate 	case DOOR_CREATE:
51377c478bd9Sstevel@tonic-gate 		e = AUE_DOORFS_DOOR_CREATE;
51387c478bd9Sstevel@tonic-gate 		break;
51397c478bd9Sstevel@tonic-gate 	case DOOR_REVOKE:
51407c478bd9Sstevel@tonic-gate 		e = AUE_DOORFS_DOOR_REVOKE;
51417c478bd9Sstevel@tonic-gate 		break;
51427c478bd9Sstevel@tonic-gate 	case DOOR_INFO:
51437c478bd9Sstevel@tonic-gate 		e = AUE_NULL;
51447c478bd9Sstevel@tonic-gate 		break;
51457c478bd9Sstevel@tonic-gate 	case DOOR_UCRED:
51467c478bd9Sstevel@tonic-gate 		e = AUE_NULL;
51477c478bd9Sstevel@tonic-gate 		break;
51487c478bd9Sstevel@tonic-gate 	case DOOR_BIND:
51497c478bd9Sstevel@tonic-gate 		e = AUE_NULL;
51507c478bd9Sstevel@tonic-gate 		break;
51517c478bd9Sstevel@tonic-gate 	case DOOR_UNBIND:
51527c478bd9Sstevel@tonic-gate 		e = AUE_NULL;
51537c478bd9Sstevel@tonic-gate 		break;
51547c478bd9Sstevel@tonic-gate 	case DOOR_GETPARAM:
51557c478bd9Sstevel@tonic-gate 		e = AUE_NULL;
51567c478bd9Sstevel@tonic-gate 		break;
51577c478bd9Sstevel@tonic-gate 	case DOOR_SETPARAM:
51587c478bd9Sstevel@tonic-gate 		e = AUE_NULL;
51597c478bd9Sstevel@tonic-gate 		break;
51607c478bd9Sstevel@tonic-gate 	default:	/* illegal system call */
51617c478bd9Sstevel@tonic-gate 		e = AUE_NULL;
51627c478bd9Sstevel@tonic-gate 		break;
51637c478bd9Sstevel@tonic-gate 	}
51647c478bd9Sstevel@tonic-gate 
51657c478bd9Sstevel@tonic-gate 	return (e);
51667c478bd9Sstevel@tonic-gate }
51677c478bd9Sstevel@tonic-gate 
51687c478bd9Sstevel@tonic-gate static door_node_t *
51697c478bd9Sstevel@tonic-gate au_door_lookup(int did)
51707c478bd9Sstevel@tonic-gate {
51717c478bd9Sstevel@tonic-gate 	vnode_t	*vp;
51727c478bd9Sstevel@tonic-gate 	file_t *fp;
51737c478bd9Sstevel@tonic-gate 
51747c478bd9Sstevel@tonic-gate 	if ((fp = getf(did)) == NULL)
51757c478bd9Sstevel@tonic-gate 		return (NULL);
51767c478bd9Sstevel@tonic-gate 	/*
51777c478bd9Sstevel@tonic-gate 	 * Use the underlying vnode (we may be namefs mounted)
51787c478bd9Sstevel@tonic-gate 	 */
5179da6c28aaSamw 	if (VOP_REALVP(fp->f_vnode, &vp, NULL))
51807c478bd9Sstevel@tonic-gate 		vp = fp->f_vnode;
51817c478bd9Sstevel@tonic-gate 
51827c478bd9Sstevel@tonic-gate 	if (vp == NULL || vp->v_type != VDOOR) {
51837c478bd9Sstevel@tonic-gate 		releasef(did);
51847c478bd9Sstevel@tonic-gate 		return (NULL);
51857c478bd9Sstevel@tonic-gate 	}
51867c478bd9Sstevel@tonic-gate 
51877c478bd9Sstevel@tonic-gate 	return (VTOD(vp));
51887c478bd9Sstevel@tonic-gate }
51897c478bd9Sstevel@tonic-gate 
51907c478bd9Sstevel@tonic-gate /*ARGSUSED*/
51917c478bd9Sstevel@tonic-gate static void
51927c478bd9Sstevel@tonic-gate aus_doorfs(struct t_audit_data *tad)
51937c478bd9Sstevel@tonic-gate {
51947c478bd9Sstevel@tonic-gate 
51957c478bd9Sstevel@tonic-gate 	struct a {		/* doorfs */
51967c478bd9Sstevel@tonic-gate 		long	a1;
51977c478bd9Sstevel@tonic-gate 		long	a2;
51987c478bd9Sstevel@tonic-gate 		long	a3;
51997c478bd9Sstevel@tonic-gate 		long	a4;
52007c478bd9Sstevel@tonic-gate 		long	a5;
52017c478bd9Sstevel@tonic-gate 		long	code;
52027c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)ttolwp(curthread)->lwp_ap;
52037c478bd9Sstevel@tonic-gate 
52047c478bd9Sstevel@tonic-gate 	door_node_t	*dp;
52057c478bd9Sstevel@tonic-gate 	struct proc	*p;
52067c478bd9Sstevel@tonic-gate 	uint32_t	did;
52077c478bd9Sstevel@tonic-gate 	uid_t uid, ruid;
52087c478bd9Sstevel@tonic-gate 	gid_t gid, rgid;
52097c478bd9Sstevel@tonic-gate 	pid_t pid;
52107c478bd9Sstevel@tonic-gate 	const auditinfo_addr_t *ainfo;
52117c478bd9Sstevel@tonic-gate 	cred_t *cr;
52127c478bd9Sstevel@tonic-gate 
52137c478bd9Sstevel@tonic-gate 	did = (uint32_t)uap->a1;
52147c478bd9Sstevel@tonic-gate 
52157c478bd9Sstevel@tonic-gate 	switch (tad->tad_event) {
52167c478bd9Sstevel@tonic-gate 	case AUE_DOORFS_DOOR_CALL:
52177c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "door ID", (uint32_t)did));
52187c478bd9Sstevel@tonic-gate 		if ((dp = au_door_lookup(did)) == NULL)
52197c478bd9Sstevel@tonic-gate 			break;
52207c478bd9Sstevel@tonic-gate 
52217c478bd9Sstevel@tonic-gate 		if (DOOR_INVALID(dp)) {
52227c478bd9Sstevel@tonic-gate 			releasef(did);
52237c478bd9Sstevel@tonic-gate 			break;
52247c478bd9Sstevel@tonic-gate 		}
52257c478bd9Sstevel@tonic-gate 
52267c478bd9Sstevel@tonic-gate 		if ((p = dp->door_target) == NULL) {
52277c478bd9Sstevel@tonic-gate 			releasef(did);
52287c478bd9Sstevel@tonic-gate 			break;
52297c478bd9Sstevel@tonic-gate 		}
52307c478bd9Sstevel@tonic-gate 		mutex_enter(&p->p_lock);
52317c478bd9Sstevel@tonic-gate 		releasef(did);
52327c478bd9Sstevel@tonic-gate 
52337c478bd9Sstevel@tonic-gate 		pid  = p->p_pid;
52347c478bd9Sstevel@tonic-gate 
52357c478bd9Sstevel@tonic-gate 		mutex_enter(&p->p_crlock);
52367c478bd9Sstevel@tonic-gate 		crhold(cr = p->p_cred);
52377c478bd9Sstevel@tonic-gate 		mutex_exit(&p->p_crlock);
52387c478bd9Sstevel@tonic-gate 		mutex_exit(&p->p_lock);
52397c478bd9Sstevel@tonic-gate 
52407c478bd9Sstevel@tonic-gate 		ainfo = crgetauinfo(cr);
52417c478bd9Sstevel@tonic-gate 		if (ainfo == NULL) {
52427c478bd9Sstevel@tonic-gate 			crfree(cr);
52437c478bd9Sstevel@tonic-gate 			return;
52447c478bd9Sstevel@tonic-gate 		}
52457c478bd9Sstevel@tonic-gate 		uid  = crgetuid(cr);
52467c478bd9Sstevel@tonic-gate 		gid  = crgetgid(cr);
52477c478bd9Sstevel@tonic-gate 		ruid = crgetruid(cr);
52487c478bd9Sstevel@tonic-gate 		rgid = crgetrgid(cr);
52497c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_process(uid, gid, ruid, rgid, pid,
52507c478bd9Sstevel@tonic-gate 		    ainfo->ai_auid, ainfo->ai_asid, &ainfo->ai_termid));
52517c478bd9Sstevel@tonic-gate 		crfree(cr);
52527c478bd9Sstevel@tonic-gate 		break;
52537c478bd9Sstevel@tonic-gate 	case AUE_DOORFS_DOOR_RETURN:
52547c478bd9Sstevel@tonic-gate 		/*
52557c478bd9Sstevel@tonic-gate 		 * We may want to write information about
52567c478bd9Sstevel@tonic-gate 		 * all doors (if any) which will be copied
52577c478bd9Sstevel@tonic-gate 		 * by this call to the user space
52587c478bd9Sstevel@tonic-gate 		 */
52597c478bd9Sstevel@tonic-gate 		break;
52607c478bd9Sstevel@tonic-gate 	case AUE_DOORFS_DOOR_CREATE:
52617c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(3, "door attr", (uint32_t)uap->a3));
52627c478bd9Sstevel@tonic-gate 		break;
52637c478bd9Sstevel@tonic-gate 	case AUE_DOORFS_DOOR_REVOKE:
52647c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "door ID", (uint32_t)did));
52657c478bd9Sstevel@tonic-gate 		break;
52667c478bd9Sstevel@tonic-gate 	case AUE_DOORFS_DOOR_INFO:
52677c478bd9Sstevel@tonic-gate 		break;
52687c478bd9Sstevel@tonic-gate 	case AUE_DOORFS_DOOR_CRED:
52697c478bd9Sstevel@tonic-gate 		break;
52707c478bd9Sstevel@tonic-gate 	case AUE_DOORFS_DOOR_BIND:
52717c478bd9Sstevel@tonic-gate 		break;
52727c478bd9Sstevel@tonic-gate 	case AUE_DOORFS_DOOR_UNBIND: {
52737c478bd9Sstevel@tonic-gate 		break;
52747c478bd9Sstevel@tonic-gate 	}
52757c478bd9Sstevel@tonic-gate 	default:	/* illegal system call */
52767c478bd9Sstevel@tonic-gate 		break;
52777c478bd9Sstevel@tonic-gate 	}
52787c478bd9Sstevel@tonic-gate }
52797c478bd9Sstevel@tonic-gate 
52807c478bd9Sstevel@tonic-gate /*ARGSUSED*/
52817c478bd9Sstevel@tonic-gate static au_event_t
52827c478bd9Sstevel@tonic-gate aui_acl(au_event_t e)
52837c478bd9Sstevel@tonic-gate {
52847c478bd9Sstevel@tonic-gate 	struct a {
52857c478bd9Sstevel@tonic-gate 		union {
52867c478bd9Sstevel@tonic-gate 			long	name;	/* char */
52877c478bd9Sstevel@tonic-gate 			long	fd;
52887c478bd9Sstevel@tonic-gate 		}		obj;
52897c478bd9Sstevel@tonic-gate 
52907c478bd9Sstevel@tonic-gate 		long		cmd;
52917c478bd9Sstevel@tonic-gate 		long		nentries;
52927c478bd9Sstevel@tonic-gate 		long		arg;	/* aclent_t */
52937c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)ttolwp(curthread)->lwp_ap;
52947c478bd9Sstevel@tonic-gate 
52957c478bd9Sstevel@tonic-gate 	switch (uap->cmd) {
52967c478bd9Sstevel@tonic-gate 	case SETACL:
5297a7746f66Stz 	case ACE_SETACL:
5298a7746f66Stz 		/*
5299a7746f66Stz 		 * acl(SETACL/ACE_SETACL, ...) and facl(SETACL/ACE_SETACL, ...)
5300a7746f66Stz 		 * are expected.
5301a7746f66Stz 		 */
53027c478bd9Sstevel@tonic-gate 		break;
53037c478bd9Sstevel@tonic-gate 	case GETACL:
53047c478bd9Sstevel@tonic-gate 	case GETACLCNT:
5305ebbb0311SJan Friedel 	case ACE_GETACL:
5306a7746f66Stz 	case ACE_GETACLCNT:
5307ebbb0311SJan Friedel 		/* do nothing for these four values. */
53087c478bd9Sstevel@tonic-gate 		e = AUE_NULL;
53097c478bd9Sstevel@tonic-gate 		break;
53107c478bd9Sstevel@tonic-gate 	default:
53117c478bd9Sstevel@tonic-gate 		/* illegal system call */
53127c478bd9Sstevel@tonic-gate 		break;
53137c478bd9Sstevel@tonic-gate 	}
53147c478bd9Sstevel@tonic-gate 
53157c478bd9Sstevel@tonic-gate 	return (e);
53167c478bd9Sstevel@tonic-gate }
53177c478bd9Sstevel@tonic-gate 
53187c478bd9Sstevel@tonic-gate static void
5319a7746f66Stz au_acl(int cmd, int nentries, caddr_t bufp)
53207c478bd9Sstevel@tonic-gate {
5321a7746f66Stz 	size_t		a_size;
5322a7746f66Stz 	aclent_t	*aclbufp;
5323a7746f66Stz 	ace_t		*acebufp;
5324a7746f66Stz 	int		i;
53257c478bd9Sstevel@tonic-gate 
5326a7746f66Stz 	switch (cmd) {
53277c478bd9Sstevel@tonic-gate 	case GETACL:
53287c478bd9Sstevel@tonic-gate 	case GETACLCNT:
53297c478bd9Sstevel@tonic-gate 		break;
53307c478bd9Sstevel@tonic-gate 	case SETACL:
5331a7746f66Stz 		if (nentries < 3)
5332745b2690Stz 			break;
53337c478bd9Sstevel@tonic-gate 
5334a7746f66Stz 		a_size = nentries * sizeof (aclent_t);
5335a7746f66Stz 
5336a7746f66Stz 		if ((aclbufp = kmem_alloc(a_size, KM_SLEEP)) == NULL)
5337a7746f66Stz 			break;
5338a7746f66Stz 		if (copyin(bufp, aclbufp, a_size)) {
53397c478bd9Sstevel@tonic-gate 			kmem_free(aclbufp, a_size);
53407c478bd9Sstevel@tonic-gate 			break;
53417c478bd9Sstevel@tonic-gate 		}
5342a7746f66Stz 		for (i = 0; i < nentries; i++) {
5343a7746f66Stz 			au_uwrite(au_to_acl(aclbufp + i));
5344a7746f66Stz 		}
5345a7746f66Stz 		kmem_free(aclbufp, a_size);
5346a7746f66Stz 		break;
5347a7746f66Stz 
5348a7746f66Stz 	case ACE_SETACL:
5349a7746f66Stz 		if (nentries < 1 || nentries > MAX_ACL_ENTRIES)
5350a7746f66Stz 			break;
5351a7746f66Stz 
5352a7746f66Stz 		a_size = nentries * sizeof (ace_t);
5353a7746f66Stz 		if ((acebufp = kmem_alloc(a_size, KM_SLEEP)) == NULL)
5354a7746f66Stz 			break;
5355a7746f66Stz 		if (copyin(bufp, acebufp, a_size)) {
5356a7746f66Stz 			kmem_free(acebufp, a_size);
5357a7746f66Stz 			break;
5358a7746f66Stz 		}
5359a7746f66Stz 		for (i = 0; i < nentries; i++) {
5360a7746f66Stz 			au_uwrite(au_to_ace(acebufp + i));
5361a7746f66Stz 		}
5362a7746f66Stz 		kmem_free(acebufp, a_size);
5363a7746f66Stz 		break;
53647c478bd9Sstevel@tonic-gate 	default:
53657c478bd9Sstevel@tonic-gate 		break;
53667c478bd9Sstevel@tonic-gate 	}
53677c478bd9Sstevel@tonic-gate }
53687c478bd9Sstevel@tonic-gate 
5369a7746f66Stz /*ARGSUSED*/
5370a7746f66Stz static void
5371a7746f66Stz aus_acl(struct t_audit_data *tad)
5372a7746f66Stz {
5373a7746f66Stz 	struct a {
5374a7746f66Stz 		long	fname;
5375a7746f66Stz 		long	cmd;
5376a7746f66Stz 		long	nentries;
5377a7746f66Stz 		long	aclbufp;
5378a7746f66Stz 	} *uap = (struct a *)ttolwp(curthread)->lwp_ap;
5379a7746f66Stz 
5380a7746f66Stz 	au_uwrite(au_to_arg32(2, "cmd", (uint32_t)uap->cmd));
5381a7746f66Stz 	au_uwrite(au_to_arg32(3, "nentries", (uint32_t)uap->nentries));
5382a7746f66Stz 
5383a7746f66Stz 	au_acl(uap->cmd, uap->nentries, (caddr_t)uap->aclbufp);
5384a7746f66Stz }
5385a7746f66Stz 
53867c478bd9Sstevel@tonic-gate /*ARGSUSED*/
53877c478bd9Sstevel@tonic-gate static void
53887c478bd9Sstevel@tonic-gate aus_facl(struct t_audit_data *tad)
53897c478bd9Sstevel@tonic-gate {
53907c478bd9Sstevel@tonic-gate 	struct a {
53917c478bd9Sstevel@tonic-gate 		long	fd;
53927c478bd9Sstevel@tonic-gate 		long	cmd;
53937c478bd9Sstevel@tonic-gate 		long	nentries;
53947c478bd9Sstevel@tonic-gate 		long	aclbufp;
53957c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)ttolwp(curthread)->lwp_ap;
53967c478bd9Sstevel@tonic-gate 	struct file  *fp;
53977c478bd9Sstevel@tonic-gate 	struct vnode *vp;
53987c478bd9Sstevel@tonic-gate 	struct f_audit_data *fad;
53997c478bd9Sstevel@tonic-gate 	int fd;
54007c478bd9Sstevel@tonic-gate 
54017c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(2, "cmd", (uint32_t)uap->cmd));
54027c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(3, "nentries", (uint32_t)uap->nentries));
54037c478bd9Sstevel@tonic-gate 
54047c478bd9Sstevel@tonic-gate 	fd = (int)uap->fd;
54057c478bd9Sstevel@tonic-gate 
54067c478bd9Sstevel@tonic-gate 	if ((fp = getf(fd)) == NULL)
54077c478bd9Sstevel@tonic-gate 		return;
54087c478bd9Sstevel@tonic-gate 
54097c478bd9Sstevel@tonic-gate 	/* get path from file struct here */
54107c478bd9Sstevel@tonic-gate 	fad = F2A(fp);
54117c478bd9Sstevel@tonic-gate 	if (fad->fad_aupath != NULL) {
54127c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_path(fad->fad_aupath));
54137c478bd9Sstevel@tonic-gate 	} else {
54147c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "no path: fd", (uint32_t)fd));
54157c478bd9Sstevel@tonic-gate 	}
54167c478bd9Sstevel@tonic-gate 
54177c478bd9Sstevel@tonic-gate 	vp = fp->f_vnode;
54187c478bd9Sstevel@tonic-gate 	audit_attributes(vp);
54197c478bd9Sstevel@tonic-gate 
54207c478bd9Sstevel@tonic-gate 	/* decrement file descriptor reference count */
54217c478bd9Sstevel@tonic-gate 	releasef(fd);
54227c478bd9Sstevel@tonic-gate 
5423a7746f66Stz 	au_acl(uap->cmd, uap->nentries, (caddr_t)uap->aclbufp);
54247c478bd9Sstevel@tonic-gate }
54257c478bd9Sstevel@tonic-gate 
54267c478bd9Sstevel@tonic-gate /*ARGSUSED*/
54277c478bd9Sstevel@tonic-gate static void
5428*0f48f68dSToomas Soome auf_read(struct t_audit_data *tad, int error, rval_t *rval)
54297c478bd9Sstevel@tonic-gate {
54307c478bd9Sstevel@tonic-gate 	struct file *fp;
54317c478bd9Sstevel@tonic-gate 	struct f_audit_data *fad;
54327c478bd9Sstevel@tonic-gate 	int fd;
54337c478bd9Sstevel@tonic-gate 	register struct a {
54347c478bd9Sstevel@tonic-gate 		long	fd;
54357c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)ttolwp(curthread)->lwp_ap;
54369e9e6ab8Spaulson 	au_kcontext_t	*kctx = GET_KCTX_PZ;
54377c478bd9Sstevel@tonic-gate 
54387c478bd9Sstevel@tonic-gate 	fd = (int)uap->fd;
54397c478bd9Sstevel@tonic-gate 
54407c478bd9Sstevel@tonic-gate 	/*
54417c478bd9Sstevel@tonic-gate 	 * convert file pointer to file descriptor
54427c478bd9Sstevel@tonic-gate 	 *   Note: fd ref count incremented here.
54437c478bd9Sstevel@tonic-gate 	 */
54447c478bd9Sstevel@tonic-gate 	if ((fp = getf(fd)) == NULL)
54457c478bd9Sstevel@tonic-gate 		return;
54467c478bd9Sstevel@tonic-gate 
54477c478bd9Sstevel@tonic-gate 	/* get path from file struct here */
54487c478bd9Sstevel@tonic-gate 	fad = F2A(fp);
54497c478bd9Sstevel@tonic-gate 	ASSERT(fad);
54507c478bd9Sstevel@tonic-gate 
54517c478bd9Sstevel@tonic-gate 	/*
54527c478bd9Sstevel@tonic-gate 	 * already processed this file for read attempt
54537c478bd9Sstevel@tonic-gate 	 *
54547c478bd9Sstevel@tonic-gate 	 * XXX might be better to turn off auditing in a aui_read() routine.
54557c478bd9Sstevel@tonic-gate 	 */
54567c478bd9Sstevel@tonic-gate 	if (fad->fad_flags & FAD_READ) {
54577c478bd9Sstevel@tonic-gate 		/* don't really want to audit every read attempt */
54587c478bd9Sstevel@tonic-gate 		tad->tad_flag = 0;
54597c478bd9Sstevel@tonic-gate 		/* free any residual audit data */
5460005d3febSMarek Pospisil 		au_close(kctx, &(u_ad), 0, 0, 0, NULL);
54617c478bd9Sstevel@tonic-gate 		releasef(fd);
54627c478bd9Sstevel@tonic-gate 		return;
54637c478bd9Sstevel@tonic-gate 	}
54647c478bd9Sstevel@tonic-gate 	/* mark things so we know what happened and don't repeat things */
54657c478bd9Sstevel@tonic-gate 	fad->fad_flags |= FAD_READ;
54667c478bd9Sstevel@tonic-gate 
54677c478bd9Sstevel@tonic-gate 	if (fad->fad_aupath != NULL) {
54687c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_path(fad->fad_aupath));
54697c478bd9Sstevel@tonic-gate 	} else {
54707c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "no path: fd", (uint32_t)fd));
54717c478bd9Sstevel@tonic-gate 	}
54727c478bd9Sstevel@tonic-gate 
54737c478bd9Sstevel@tonic-gate 	/* include attributes */
54747c478bd9Sstevel@tonic-gate 	audit_attributes(fp->f_vnode);
54757c478bd9Sstevel@tonic-gate 
54767c478bd9Sstevel@tonic-gate 	/* decrement file descriptor reference count */
54777c478bd9Sstevel@tonic-gate 	releasef(fd);
54787c478bd9Sstevel@tonic-gate }
54797c478bd9Sstevel@tonic-gate 
54807c478bd9Sstevel@tonic-gate /*ARGSUSED*/
54817c478bd9Sstevel@tonic-gate static void
5482*0f48f68dSToomas Soome auf_write(struct t_audit_data *tad, int error, rval_t *rval)
54837c478bd9Sstevel@tonic-gate {
54847c478bd9Sstevel@tonic-gate 	struct file *fp;
54857c478bd9Sstevel@tonic-gate 	struct f_audit_data *fad;
54867c478bd9Sstevel@tonic-gate 	int fd;
54877c478bd9Sstevel@tonic-gate 	register struct a {
54887c478bd9Sstevel@tonic-gate 		long	fd;
54897c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)ttolwp(curthread)->lwp_ap;
54909e9e6ab8Spaulson 	au_kcontext_t	*kctx = GET_KCTX_PZ;
54917c478bd9Sstevel@tonic-gate 
54927c478bd9Sstevel@tonic-gate 	fd = (int)uap->fd;
54937c478bd9Sstevel@tonic-gate 
54947c478bd9Sstevel@tonic-gate 	/*
54957c478bd9Sstevel@tonic-gate 	 * convert file pointer to file descriptor
54967c478bd9Sstevel@tonic-gate 	 *   Note: fd ref count incremented here.
54977c478bd9Sstevel@tonic-gate 	 */
54987c478bd9Sstevel@tonic-gate 	if ((fp = getf(fd)) == NULL)
54997c478bd9Sstevel@tonic-gate 		return;
55007c478bd9Sstevel@tonic-gate 
55017c478bd9Sstevel@tonic-gate 	/* get path from file struct here */
55027c478bd9Sstevel@tonic-gate 	fad = F2A(fp);
55037c478bd9Sstevel@tonic-gate 	ASSERT(fad);
55047c478bd9Sstevel@tonic-gate 
55057c478bd9Sstevel@tonic-gate 	/*
55067c478bd9Sstevel@tonic-gate 	 * already processed this file for write attempt
55077c478bd9Sstevel@tonic-gate 	 *
55087c478bd9Sstevel@tonic-gate 	 * XXX might be better to turn off auditing in a aus_write() routine.
55097c478bd9Sstevel@tonic-gate 	 */
55107c478bd9Sstevel@tonic-gate 	if (fad->fad_flags & FAD_WRITE) {
55117c478bd9Sstevel@tonic-gate 		/* don't really want to audit every write attempt */
55127c478bd9Sstevel@tonic-gate 		tad->tad_flag = 0;
55137c478bd9Sstevel@tonic-gate 		/* free any residual audit data */
5514005d3febSMarek Pospisil 		au_close(kctx, &(u_ad), 0, 0, 0, NULL);
55157c478bd9Sstevel@tonic-gate 		releasef(fd);
55167c478bd9Sstevel@tonic-gate 		return;
55177c478bd9Sstevel@tonic-gate 	}
55187c478bd9Sstevel@tonic-gate 	/* mark things so we know what happened and don't repeat things */
55197c478bd9Sstevel@tonic-gate 	fad->fad_flags |= FAD_WRITE;
55207c478bd9Sstevel@tonic-gate 
55217c478bd9Sstevel@tonic-gate 	if (fad->fad_aupath != NULL) {
55227c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_path(fad->fad_aupath));
55237c478bd9Sstevel@tonic-gate 	} else {
55247c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "no path: fd", (uint32_t)fd));
55257c478bd9Sstevel@tonic-gate 	}
55267c478bd9Sstevel@tonic-gate 
55277c478bd9Sstevel@tonic-gate 	/* include attributes */
55287c478bd9Sstevel@tonic-gate 	audit_attributes(fp->f_vnode);
55297c478bd9Sstevel@tonic-gate 
55307c478bd9Sstevel@tonic-gate 	/* decrement file descriptor reference count */
55317c478bd9Sstevel@tonic-gate 	releasef(fd);
55327c478bd9Sstevel@tonic-gate }
55337c478bd9Sstevel@tonic-gate 
55347c478bd9Sstevel@tonic-gate /*ARGSUSED*/
55357c478bd9Sstevel@tonic-gate static void
5536*0f48f68dSToomas Soome auf_recv(struct t_audit_data *tad, int error, rval_t *rval)
55377c478bd9Sstevel@tonic-gate {
55387c478bd9Sstevel@tonic-gate 	struct sonode *so;
55397c478bd9Sstevel@tonic-gate 	char so_laddr[sizeof (struct sockaddr_in6)];
55407c478bd9Sstevel@tonic-gate 	char so_faddr[sizeof (struct sockaddr_in6)];
55417c478bd9Sstevel@tonic-gate 	struct file *fp;
55427c478bd9Sstevel@tonic-gate 	struct f_audit_data *fad;
55437c478bd9Sstevel@tonic-gate 	int fd;
55447c478bd9Sstevel@tonic-gate 	int err;
55450f1702c5SYu Xiangning 	socklen_t len;
55467c478bd9Sstevel@tonic-gate 	short so_family, so_type;
55477c478bd9Sstevel@tonic-gate 	register struct a {
55487c478bd9Sstevel@tonic-gate 		long	fd;
55497c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)ttolwp(curthread)->lwp_ap;
55509e9e6ab8Spaulson 	au_kcontext_t	*kctx = GET_KCTX_PZ;
55517c478bd9Sstevel@tonic-gate 
55527c478bd9Sstevel@tonic-gate 	/*
55537c478bd9Sstevel@tonic-gate 	 * If there was an error, then nothing to do. Only generate
55547c478bd9Sstevel@tonic-gate 	 * audit record on first successful recv.
55557c478bd9Sstevel@tonic-gate 	 */
55567c478bd9Sstevel@tonic-gate 	if (error) {
55577c478bd9Sstevel@tonic-gate 		/* Turn off audit record generation here. */
55587c478bd9Sstevel@tonic-gate 		tad->tad_flag = 0;
55597c478bd9Sstevel@tonic-gate 		/* free any residual audit data */
5560005d3febSMarek Pospisil 		au_close(kctx, &(u_ad), 0, 0, 0, NULL);
55617c478bd9Sstevel@tonic-gate 		return;
55627c478bd9Sstevel@tonic-gate 	}
55637c478bd9Sstevel@tonic-gate 
55647c478bd9Sstevel@tonic-gate 	fd = (int)uap->fd;
55657c478bd9Sstevel@tonic-gate 
5566745b2690Stz 	if ((so = getsonode(fd, &err, &fp)) == NULL) {
55677c478bd9Sstevel@tonic-gate 		/* Turn off audit record generation here. */
55687c478bd9Sstevel@tonic-gate 		tad->tad_flag = 0;
55697c478bd9Sstevel@tonic-gate 		/* free any residual audit data */
5570005d3febSMarek Pospisil 		au_close(kctx, &(u_ad), 0, 0, 0, NULL);
55717c478bd9Sstevel@tonic-gate 		return;
55727c478bd9Sstevel@tonic-gate 	}
55737c478bd9Sstevel@tonic-gate 
55747c478bd9Sstevel@tonic-gate 	/* get path from file struct here */
55757c478bd9Sstevel@tonic-gate 	fad = F2A(fp);
55767c478bd9Sstevel@tonic-gate 	ASSERT(fad);
55777c478bd9Sstevel@tonic-gate 
55787c478bd9Sstevel@tonic-gate 	/*
55797c478bd9Sstevel@tonic-gate 	 * already processed this file for read attempt
55807c478bd9Sstevel@tonic-gate 	 */
55817c478bd9Sstevel@tonic-gate 	if (fad->fad_flags & FAD_READ) {
55827c478bd9Sstevel@tonic-gate 		releasef(fd);
55837c478bd9Sstevel@tonic-gate 		/* don't really want to audit every recv call */
55847c478bd9Sstevel@tonic-gate 		tad->tad_flag = 0;
55857c478bd9Sstevel@tonic-gate 		/* free any residual audit data */
5586005d3febSMarek Pospisil 		au_close(kctx, &(u_ad), 0, 0, 0, NULL);
55877c478bd9Sstevel@tonic-gate 		return;
55887c478bd9Sstevel@tonic-gate 	}
55897c478bd9Sstevel@tonic-gate 
55907c478bd9Sstevel@tonic-gate 	/* mark things so we know what happened and don't repeat things */
55917c478bd9Sstevel@tonic-gate 	fad->fad_flags |= FAD_READ;
55927c478bd9Sstevel@tonic-gate 
55937c478bd9Sstevel@tonic-gate 	so_family = so->so_family;
55947c478bd9Sstevel@tonic-gate 	so_type   = so->so_type;
55957c478bd9Sstevel@tonic-gate 
55967c478bd9Sstevel@tonic-gate 	switch (so_family) {
55977c478bd9Sstevel@tonic-gate 	case AF_INET:
55987c478bd9Sstevel@tonic-gate 	case AF_INET6:
55997c478bd9Sstevel@tonic-gate 		/*
56007c478bd9Sstevel@tonic-gate 		 * Only for connections.
56017c478bd9Sstevel@tonic-gate 		 * XXX - do we need to worry about SOCK_DGRAM or other types???
56027c478bd9Sstevel@tonic-gate 		 */
56037c478bd9Sstevel@tonic-gate 		if (so->so_state & SS_ISBOUND) {
56047c478bd9Sstevel@tonic-gate 
56057c478bd9Sstevel@tonic-gate 			bzero((void *)so_laddr, sizeof (so_laddr));
56067c478bd9Sstevel@tonic-gate 			bzero((void *)so_faddr, sizeof (so_faddr));
56077c478bd9Sstevel@tonic-gate 
56087c478bd9Sstevel@tonic-gate 			/* get local and foreign addresses */
56090f1702c5SYu Xiangning 			len = sizeof (so_laddr);
56100f1702c5SYu Xiangning 			(void) socket_getsockname(so,
56110f1702c5SYu Xiangning 			    (struct sockaddr *)so_laddr, &len, CRED());
56120f1702c5SYu Xiangning 			len = sizeof (so_faddr);
56130f1702c5SYu Xiangning 			(void) socket_getpeername(so,
56140f1702c5SYu Xiangning 			    (struct sockaddr *)so_faddr, &len, B_FALSE, CRED());
56157c478bd9Sstevel@tonic-gate 
56167c478bd9Sstevel@tonic-gate 			/*
56177c478bd9Sstevel@tonic-gate 			 * only way to drop out of switch. Note that we
56187c478bd9Sstevel@tonic-gate 			 * we release fd below.
56197c478bd9Sstevel@tonic-gate 			 */
56207c478bd9Sstevel@tonic-gate 
56217c478bd9Sstevel@tonic-gate 			break;
56227c478bd9Sstevel@tonic-gate 		}
56237c478bd9Sstevel@tonic-gate 
56247c478bd9Sstevel@tonic-gate 		releasef(fd);
56257c478bd9Sstevel@tonic-gate 
56267c478bd9Sstevel@tonic-gate 		/* don't really want to audit every recv call */
56277c478bd9Sstevel@tonic-gate 		tad->tad_flag = 0;
56287c478bd9Sstevel@tonic-gate 		/* free any residual audit data */
5629005d3febSMarek Pospisil 		au_close(kctx, &(u_ad), 0, 0, 0, NULL);
56307c478bd9Sstevel@tonic-gate 
56317c478bd9Sstevel@tonic-gate 		return;
56327c478bd9Sstevel@tonic-gate 
56337c478bd9Sstevel@tonic-gate 	case AF_UNIX:
56347c478bd9Sstevel@tonic-gate 
56357c478bd9Sstevel@tonic-gate 		if (fad->fad_aupath != NULL) {
56367c478bd9Sstevel@tonic-gate 			au_uwrite(au_to_path(fad->fad_aupath));
56377c478bd9Sstevel@tonic-gate 		} else {
56387c478bd9Sstevel@tonic-gate 			au_uwrite(au_to_arg32(1, "no path: fd", fd));
56397c478bd9Sstevel@tonic-gate 		}
56407c478bd9Sstevel@tonic-gate 
56417c478bd9Sstevel@tonic-gate 		audit_attributes(fp->f_vnode);
56427c478bd9Sstevel@tonic-gate 
56437c478bd9Sstevel@tonic-gate 		releasef(fd);
56447c478bd9Sstevel@tonic-gate 
56457c478bd9Sstevel@tonic-gate 		return;
56467c478bd9Sstevel@tonic-gate 
56477c478bd9Sstevel@tonic-gate 	default:
56487c478bd9Sstevel@tonic-gate 		releasef(fd);
56497c478bd9Sstevel@tonic-gate 
56507c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
56517c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "family", (uint32_t)so_family));
56527c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "type", (uint32_t)so_type));
56537c478bd9Sstevel@tonic-gate 
56547c478bd9Sstevel@tonic-gate 		return;
56557c478bd9Sstevel@tonic-gate 	}
56567c478bd9Sstevel@tonic-gate 
56577c478bd9Sstevel@tonic-gate 	releasef(fd);
56587c478bd9Sstevel@tonic-gate 
56597c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
56607c478bd9Sstevel@tonic-gate 
56617c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_socket_ex(so_family, so_type, so_laddr, so_faddr));
56627c478bd9Sstevel@tonic-gate 
56637c478bd9Sstevel@tonic-gate }
56647c478bd9Sstevel@tonic-gate 
56657c478bd9Sstevel@tonic-gate /*ARGSUSED*/
56667c478bd9Sstevel@tonic-gate static void
5667*0f48f68dSToomas Soome auf_send(struct t_audit_data *tad, int error, rval_t *rval)
56687c478bd9Sstevel@tonic-gate {
56697c478bd9Sstevel@tonic-gate 	struct sonode *so;
56707c478bd9Sstevel@tonic-gate 	char so_laddr[sizeof (struct sockaddr_in6)];
56717c478bd9Sstevel@tonic-gate 	char so_faddr[sizeof (struct sockaddr_in6)];
56727c478bd9Sstevel@tonic-gate 	struct file *fp;
56737c478bd9Sstevel@tonic-gate 	struct f_audit_data *fad;
56747c478bd9Sstevel@tonic-gate 	int fd;
56757c478bd9Sstevel@tonic-gate 	int err;
56760f1702c5SYu Xiangning 	socklen_t len;
56777c478bd9Sstevel@tonic-gate 	short so_family, so_type;
56787c478bd9Sstevel@tonic-gate 	register struct a {
56797c478bd9Sstevel@tonic-gate 		long	fd;
56807c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)ttolwp(curthread)->lwp_ap;
56819e9e6ab8Spaulson 	au_kcontext_t	*kctx = GET_KCTX_PZ;
56827c478bd9Sstevel@tonic-gate 
56837c478bd9Sstevel@tonic-gate 	fd = (int)uap->fd;
56847c478bd9Sstevel@tonic-gate 
56857c478bd9Sstevel@tonic-gate 	/*
56867c478bd9Sstevel@tonic-gate 	 * If there was an error, then nothing to do. Only generate
56877c478bd9Sstevel@tonic-gate 	 * audit record on first successful send.
56887c478bd9Sstevel@tonic-gate 	 */
56897c478bd9Sstevel@tonic-gate 	if (error != 0) {
56907c478bd9Sstevel@tonic-gate 		/* Turn off audit record generation here. */
56917c478bd9Sstevel@tonic-gate 		tad->tad_flag = 0;
56927c478bd9Sstevel@tonic-gate 		/* free any residual audit data */
5693005d3febSMarek Pospisil 		au_close(kctx, &(u_ad), 0, 0, 0, NULL);
56947c478bd9Sstevel@tonic-gate 		return;
56957c478bd9Sstevel@tonic-gate 	}
56967c478bd9Sstevel@tonic-gate 
56977c478bd9Sstevel@tonic-gate 	fd = (int)uap->fd;
56987c478bd9Sstevel@tonic-gate 
5699745b2690Stz 	if ((so = getsonode(fd, &err, &fp)) == NULL) {
57007c478bd9Sstevel@tonic-gate 		/* Turn off audit record generation here. */
57017c478bd9Sstevel@tonic-gate 		tad->tad_flag = 0;
57027c478bd9Sstevel@tonic-gate 		/* free any residual audit data */
5703005d3febSMarek Pospisil 		au_close(kctx, &(u_ad), 0, 0, 0, NULL);
57047c478bd9Sstevel@tonic-gate 		return;
57057c478bd9Sstevel@tonic-gate 	}
57067c478bd9Sstevel@tonic-gate 
57077c478bd9Sstevel@tonic-gate 	/* get path from file struct here */
57087c478bd9Sstevel@tonic-gate 	fad = F2A(fp);
57097c478bd9Sstevel@tonic-gate 	ASSERT(fad);
57107c478bd9Sstevel@tonic-gate 
57117c478bd9Sstevel@tonic-gate 	/*
57127c478bd9Sstevel@tonic-gate 	 * already processed this file for write attempt
57137c478bd9Sstevel@tonic-gate 	 */
57147c478bd9Sstevel@tonic-gate 	if (fad->fad_flags & FAD_WRITE) {
57157c478bd9Sstevel@tonic-gate 		releasef(fd);
57167c478bd9Sstevel@tonic-gate 		/* don't really want to audit every send call */
57177c478bd9Sstevel@tonic-gate 		tad->tad_flag = 0;
57187c478bd9Sstevel@tonic-gate 		/* free any residual audit data */
5719005d3febSMarek Pospisil 		au_close(kctx, &(u_ad), 0, 0, 0, NULL);
57207c478bd9Sstevel@tonic-gate 		return;
57217c478bd9Sstevel@tonic-gate 	}
57227c478bd9Sstevel@tonic-gate 
57237c478bd9Sstevel@tonic-gate 	/* mark things so we know what happened and don't repeat things */
57247c478bd9Sstevel@tonic-gate 	fad->fad_flags |= FAD_WRITE;
57257c478bd9Sstevel@tonic-gate 
57267c478bd9Sstevel@tonic-gate 	so_family = so->so_family;
57277c478bd9Sstevel@tonic-gate 	so_type   = so->so_type;
57287c478bd9Sstevel@tonic-gate 
57297c478bd9Sstevel@tonic-gate 	switch (so_family) {
57307c478bd9Sstevel@tonic-gate 	case AF_INET:
57317c478bd9Sstevel@tonic-gate 	case AF_INET6:
57327c478bd9Sstevel@tonic-gate 		/*
57337c478bd9Sstevel@tonic-gate 		 * Only for connections.
57347c478bd9Sstevel@tonic-gate 		 * XXX - do we need to worry about SOCK_DGRAM or other types???
57357c478bd9Sstevel@tonic-gate 		 */
57367c478bd9Sstevel@tonic-gate 		if (so->so_state & SS_ISBOUND) {
57377c478bd9Sstevel@tonic-gate 
57387c478bd9Sstevel@tonic-gate 			bzero((void *)so_laddr, sizeof (so_laddr));
57397c478bd9Sstevel@tonic-gate 			bzero((void *)so_faddr, sizeof (so_faddr));
57407c478bd9Sstevel@tonic-gate 
57417c478bd9Sstevel@tonic-gate 			/* get local and foreign addresses */
57420f1702c5SYu Xiangning 			len = sizeof (so_laddr);
57430f1702c5SYu Xiangning 			(void) socket_getsockname(so,
57440f1702c5SYu Xiangning 			    (struct sockaddr *)so_laddr, &len, CRED());
57450f1702c5SYu Xiangning 			len = sizeof (so_faddr);
57460f1702c5SYu Xiangning 			(void) socket_getpeername(so,
57470f1702c5SYu Xiangning 			    (struct sockaddr *)so_faddr, &len, B_FALSE, CRED());
57487c478bd9Sstevel@tonic-gate 
57497c478bd9Sstevel@tonic-gate 			/*
57507c478bd9Sstevel@tonic-gate 			 * only way to drop out of switch. Note that we
57517c478bd9Sstevel@tonic-gate 			 * we release fd below.
57527c478bd9Sstevel@tonic-gate 			 */
57537c478bd9Sstevel@tonic-gate 
57547c478bd9Sstevel@tonic-gate 			break;
57557c478bd9Sstevel@tonic-gate 		}
57567c478bd9Sstevel@tonic-gate 
57577c478bd9Sstevel@tonic-gate 		releasef(fd);
57587c478bd9Sstevel@tonic-gate 		/* don't really want to audit every send call */
57597c478bd9Sstevel@tonic-gate 		tad->tad_flag = 0;
57607c478bd9Sstevel@tonic-gate 		/* free any residual audit data */
5761005d3febSMarek Pospisil 		au_close(kctx, &(u_ad), 0, 0, 0, NULL);
57627c478bd9Sstevel@tonic-gate 
57637c478bd9Sstevel@tonic-gate 		return;
57647c478bd9Sstevel@tonic-gate 
57657c478bd9Sstevel@tonic-gate 	case AF_UNIX:
57667c478bd9Sstevel@tonic-gate 
57677c478bd9Sstevel@tonic-gate 		if (fad->fad_aupath != NULL) {
57687c478bd9Sstevel@tonic-gate 			au_uwrite(au_to_path(fad->fad_aupath));
57697c478bd9Sstevel@tonic-gate 		} else {
57707c478bd9Sstevel@tonic-gate 			au_uwrite(au_to_arg32(1, "no path: fd", fd));
57717c478bd9Sstevel@tonic-gate 		}
57727c478bd9Sstevel@tonic-gate 
57737c478bd9Sstevel@tonic-gate 		audit_attributes(fp->f_vnode);
57747c478bd9Sstevel@tonic-gate 
57757c478bd9Sstevel@tonic-gate 		releasef(fd);
57767c478bd9Sstevel@tonic-gate 
57777c478bd9Sstevel@tonic-gate 		return;
57787c478bd9Sstevel@tonic-gate 
57797c478bd9Sstevel@tonic-gate 	default:
57807c478bd9Sstevel@tonic-gate 		releasef(fd);
57817c478bd9Sstevel@tonic-gate 
57827c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
57837c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "family", (uint32_t)so_family));
57847c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "type", (uint32_t)so_type));
57857c478bd9Sstevel@tonic-gate 
57867c478bd9Sstevel@tonic-gate 		return;
57877c478bd9Sstevel@tonic-gate 	}
57887c478bd9Sstevel@tonic-gate 
57897c478bd9Sstevel@tonic-gate 	releasef(fd);
57907c478bd9Sstevel@tonic-gate 
57917c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
57927c478bd9Sstevel@tonic-gate 
57937c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_socket_ex(so_family, so_type, so_laddr, so_faddr));
57947c478bd9Sstevel@tonic-gate }
5795657b1f3dSraf 
5796657b1f3dSraf static au_event_t
5797657b1f3dSraf aui_forksys(au_event_t e)
5798657b1f3dSraf {
5799657b1f3dSraf 	struct a {
5800657b1f3dSraf 		long	subcode;
5801657b1f3dSraf 		long	flags;
5802657b1f3dSraf 	} *uap = (struct a *)ttolwp(curthread)->lwp_ap;
5803657b1f3dSraf 
5804657b1f3dSraf 	switch ((uint_t)uap->subcode) {
5805657b1f3dSraf 	case 0:
5806657b1f3dSraf 		e = AUE_FORK1;
5807657b1f3dSraf 		break;
5808657b1f3dSraf 	case 1:
5809657b1f3dSraf 		e = AUE_FORKALL;
5810657b1f3dSraf 		break;
5811657b1f3dSraf 	case 2:
5812657b1f3dSraf 		e = AUE_VFORK;
5813657b1f3dSraf 		break;
5814657b1f3dSraf 	default:
5815657b1f3dSraf 		e = AUE_NULL;
5816657b1f3dSraf 		break;
5817657b1f3dSraf 	}
5818657b1f3dSraf 
5819657b1f3dSraf 	return (e);
5820657b1f3dSraf }
5821df2381bfSpraks 
5822df2381bfSpraks /*ARGSUSED*/
5823df2381bfSpraks static au_event_t
5824df2381bfSpraks aui_portfs(au_event_t e)
5825df2381bfSpraks {
5826df2381bfSpraks 	struct a {		/* portfs */
5827df2381bfSpraks 		long	a1;
5828df2381bfSpraks 		long	a2;
5829df2381bfSpraks 		long	a3;
5830df2381bfSpraks 	} *uap = (struct a *)ttolwp(curthread)->lwp_ap;
5831df2381bfSpraks 
5832df2381bfSpraks 	/*
5833df2381bfSpraks 	 * check opcode
5834df2381bfSpraks 	 */
5835df2381bfSpraks 	switch (((uint_t)uap->a1) & PORT_CODE_MASK) {
5836df2381bfSpraks 	case PORT_ASSOCIATE:
58378350182dSJan Friedel 		/* check source */
58388350182dSJan Friedel 		if (((uint_t)uap->a3 == PORT_SOURCE_FILE) ||
58398350182dSJan Friedel 		    ((uint_t)uap->a3 == PORT_SOURCE_FD)) {
58408350182dSJan Friedel 			e = AUE_PORTFS_ASSOCIATE;
58418350182dSJan Friedel 		} else {
58428350182dSJan Friedel 			e = AUE_NULL;
58438350182dSJan Friedel 		}
58448350182dSJan Friedel 		break;
5845df2381bfSpraks 	case PORT_DISSOCIATE:
58468350182dSJan Friedel 		/* check source */
58478350182dSJan Friedel 		if (((uint_t)uap->a3 == PORT_SOURCE_FILE) ||
58488350182dSJan Friedel 		    ((uint_t)uap->a3 == PORT_SOURCE_FD)) {
58498350182dSJan Friedel 			e = AUE_PORTFS_DISSOCIATE;
5850df2381bfSpraks 		} else {
5851df2381bfSpraks 			e = AUE_NULL;
5852df2381bfSpraks 		}
5853df2381bfSpraks 		break;
5854df2381bfSpraks 	default:
5855df2381bfSpraks 		e = AUE_NULL;
5856df2381bfSpraks 	}
5857df2381bfSpraks 	return (e);
5858df2381bfSpraks }
5859