xref: /illumos-gate/usr/src/uts/common/c2/audit_event.c (revision 241bfedf)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright (c) 1992, 2010, Oracle and/or its affiliates. All rights reserved.
24  * Copyright (c) 2011 Bayard G. Bell. All rights reserved.
25  * Copyright (c) 2018, Joyent, Inc.
26  */
27 
28 /*
29  * This file contains the audit event table used to control the production
30  * of audit records for each system call.
31  */
32 
33 #include <sys/policy.h>
34 #include <sys/cred.h>
35 #include <sys/types.h>
36 #include <sys/systm.h>
37 #include <sys/systeminfo.h>	/* for sysinfo auditing */
38 #include <sys/utsname.h>	/* for sysinfo auditing */
39 #include <sys/proc.h>
40 #include <sys/vnode.h>
41 #include <sys/mman.h>		/* for mmap(2) auditing etc. */
42 #include <sys/fcntl.h>
43 #include <sys/modctl.h>		/* for modctl auditing */
44 #include <sys/vnode.h>
45 #include <sys/user.h>
46 #include <sys/types.h>
47 #include <sys/processor.h>
48 #include <sys/procset.h>
49 #include <sys/acl.h>
50 #include <sys/ipc.h>
51 #include <sys/door.h>
52 #include <sys/sem.h>
53 #include <sys/msg.h>
54 #include <sys/shm.h>
55 #include <sys/kmem.h>
56 #include <sys/file.h>		/* for accept */
57 #include <sys/utssys.h>		/* for fuser */
58 #include <sys/tsol/label.h>
59 #include <sys/tsol/tndb.h>
60 #include <sys/tsol/tsyscall.h>
61 #include <c2/audit.h>
62 #include <c2/audit_kernel.h>
63 #include <c2/audit_kevents.h>
64 #include <c2/audit_record.h>
65 #include <sys/procset.h>
66 #include <nfs/mount.h>
67 #include <sys/param.h>
68 #include <sys/debug.h>
69 #include <sys/sysmacros.h>
70 #include <sys/stream.h>
71 #include <sys/strsubr.h>
72 #include <sys/stropts.h>
73 #include <sys/tihdr.h>
74 #include <sys/socket.h>
75 #include <sys/socketvar.h>
76 #include <sys/vfs_opreg.h>
77 #include <fs/sockfs/sockcommon.h>
78 #include <netinet/in.h>
79 #include <sys/ddi.h>
80 #include <sys/port_impl.h>
81 #include <sys/secflags.h>
82 
83 static au_event_t	aui_fchownat(au_event_t);
84 static au_event_t	aui_fchmodat(au_event_t);
85 static au_event_t	aui_open(au_event_t);
86 static au_event_t	aui_openat(au_event_t);
87 static au_event_t	aui_unlinkat(au_event_t);
88 static au_event_t	aui_fstatat(au_event_t);
89 static au_event_t	aui_msgsys(au_event_t);
90 static au_event_t	aui_shmsys(au_event_t);
91 static au_event_t	aui_semsys(au_event_t);
92 static au_event_t	aui_utssys(au_event_t);
93 static au_event_t	aui_fcntl(au_event_t);
94 static au_event_t	aui_execve(au_event_t);
95 static au_event_t	aui_memcntl(au_event_t);
96 static au_event_t	aui_sysinfo(au_event_t);
97 static au_event_t	aui_portfs(au_event_t);
98 static au_event_t	aui_auditsys(au_event_t);
99 static au_event_t	aui_modctl(au_event_t);
100 static au_event_t	aui_acl(au_event_t);
101 static au_event_t	aui_doorfs(au_event_t);
102 static au_event_t	aui_privsys(au_event_t);
103 static au_event_t	aui_forksys(au_event_t);
104 static au_event_t	aui_labelsys(au_event_t);
105 static au_event_t	aui_setpgrp(au_event_t);
106 
107 
108 static void	aus_exit(struct t_audit_data *);
109 static void	aus_open(struct t_audit_data *);
110 static void	aus_openat(struct t_audit_data *);
111 static void	aus_acl(struct t_audit_data *);
112 static void	aus_acct(struct t_audit_data *);
113 static void	aus_chown(struct t_audit_data *);
114 static void	aus_fchown(struct t_audit_data *);
115 static void	aus_lchown(struct t_audit_data *);
116 static void	aus_fchownat(struct t_audit_data *);
117 static void	aus_chmod(struct t_audit_data *);
118 static void	aus_facl(struct t_audit_data *);
119 static void	aus_fchmod(struct t_audit_data *);
120 static void	aus_fchmodat(struct t_audit_data *);
121 static void	aus_fcntl(struct t_audit_data *);
122 static void	aus_mkdir(struct t_audit_data *);
123 static void	aus_mkdirat(struct t_audit_data *);
124 static void	aus_mknod(struct t_audit_data *);
125 static void	aus_mknodat(struct t_audit_data *);
126 static void	aus_mount(struct t_audit_data *);
127 static void	aus_umount2(struct t_audit_data *);
128 static void	aus_msgsys(struct t_audit_data *);
129 static void	aus_semsys(struct t_audit_data *);
130 static void	aus_close(struct t_audit_data *);
131 static void	aus_fstatfs(struct t_audit_data *);
132 static void	aus_setgid(struct t_audit_data *);
133 static void	aus_setpgrp(struct t_audit_data *);
134 static void	aus_setuid(struct t_audit_data *);
135 static void	aus_shmsys(struct t_audit_data *);
136 static void	aus_doorfs(struct t_audit_data *);
137 static void	aus_ioctl(struct t_audit_data *);
138 static void	aus_memcntl(struct t_audit_data *);
139 static void	aus_mmap(struct t_audit_data *);
140 static void	aus_munmap(struct t_audit_data *);
141 static void	aus_priocntlsys(struct t_audit_data *);
142 static void	aus_setegid(struct t_audit_data *);
143 static void	aus_setgroups(struct t_audit_data *);
144 static void	aus_seteuid(struct t_audit_data *);
145 static void	aus_putmsg(struct t_audit_data *);
146 static void	aus_putpmsg(struct t_audit_data *);
147 static void	aus_getmsg(struct t_audit_data *);
148 static void	aus_getpmsg(struct t_audit_data *);
149 static void	aus_auditsys(struct t_audit_data *);
150 static void	aus_sysinfo(struct t_audit_data *);
151 static void	aus_modctl(struct t_audit_data *);
152 static void	aus_kill(struct t_audit_data *);
153 static void	aus_setregid(struct t_audit_data *);
154 static void	aus_setreuid(struct t_audit_data *);
155 static void	aus_labelsys(struct t_audit_data *);
156 
157 static void	auf_mknod(struct t_audit_data *, int, rval_t *);
158 static void	auf_mknodat(struct t_audit_data *, int, rval_t *);
159 static void	auf_msgsys(struct t_audit_data *, int, rval_t *);
160 static void	auf_semsys(struct t_audit_data *, int, rval_t *);
161 static void	auf_shmsys(struct t_audit_data *, int, rval_t *);
162 static void	auf_read(struct t_audit_data *, int, rval_t *);
163 static void	auf_write(struct t_audit_data *, int, rval_t *);
164 
165 static void	aus_sigqueue(struct t_audit_data *);
166 static void	aus_p_online(struct t_audit_data *);
167 static void	aus_processor_bind(struct t_audit_data *);
168 static void	aus_inst_sync(struct t_audit_data *);
169 static void	aus_brandsys(struct t_audit_data *);
170 
171 static void	auf_accept(struct t_audit_data *, int, rval_t *);
172 
173 static void	auf_bind(struct t_audit_data *, int, rval_t *);
174 static void	auf_connect(struct t_audit_data *, int, rval_t *);
175 static void	aus_shutdown(struct t_audit_data *);
176 static void	auf_setsockopt(struct t_audit_data *, int, rval_t *);
177 static void	aus_sockconfig(struct t_audit_data *);
178 static void	auf_recv(struct t_audit_data *, int, rval_t *);
179 static void	auf_recvmsg(struct t_audit_data *, int, rval_t *);
180 static void	auf_send(struct t_audit_data *, int, rval_t *);
181 static void	auf_sendmsg(struct t_audit_data *, int, rval_t *);
182 static void	auf_recvfrom(struct t_audit_data *, int, rval_t *);
183 static void	auf_sendto(struct t_audit_data *, int, rval_t *);
184 static void	aus_socket(struct t_audit_data *);
185 /*
186  * This table contains mapping information for converting system call numbers
187  * to audit event IDs. In several cases it is necessary to map a single system
188  * call to several events.
189  */
190 
191 #define	aui_null	NULL	/* NULL initialize function */
192 #define	aus_null	NULL	/* NULL start function */
193 #define	auf_null	NULL	/* NULL finish function */
194 
195 struct audit_s2e audit_s2e[] =
196 {
197 /*
198  * ----------	----------	----------	----------
199  * INITIAL	AUDIT		START		SYSTEM
200  * PROCESSING	EVENT		PROCESSING	CALL
201  * ----------	----------	----------	-----------
202  *		FINISH		EVENT
203  *		PROCESSING	CONTROL
204  * ----------------------------------------------------------
205  */
206 aui_null,	AUE_NULL,	aus_null,	/* 0 unused (indirect) */
207 		auf_null,	0,
208 aui_null,	AUE_EXIT,	aus_exit,	/* 1 exit */
209 		auf_null,	S2E_NPT,
210 aui_null,	AUE_PSECFLAGS,	aus_null,	/* 2 psecflags */
211 		auf_null,	0,
212 aui_null,	AUE_READ,	aus_null,	/* 3 read */
213 		auf_read,	S2E_PUB,
214 aui_null,	AUE_WRITE,	aus_null,	/* 4 write */
215 		auf_write,	0,
216 aui_open,	AUE_OPEN,	aus_open,	/* 5 open */
217 		auf_null,	S2E_SP,
218 aui_null,	AUE_CLOSE,	aus_close,	/* 6 close */
219 		auf_null,	0,
220 aui_null,	AUE_LINK,	aus_null,	/* 7 linkat */
221 		auf_null,	0,
222 aui_null,	AUE_NULL,	aus_null,	/* 8 (loadable) was creat */
223 		auf_null,	0,
224 aui_null,	AUE_LINK,	aus_null,	/* 9 link */
225 		auf_null,	0,
226 aui_null,	AUE_UNLINK,	aus_null,	/* 10 unlink */
227 		auf_null,	0,
228 aui_null,	AUE_SYMLINK,	aus_null,	/* 11 symlinkat */
229 		auf_null,	0,
230 aui_null,	AUE_CHDIR,	aus_null,	/* 12 chdir */
231 		auf_null,	S2E_SP,
232 aui_null,	AUE_NULL,	aus_null,	/* 13 time */
233 		auf_null,	0,
234 aui_null,	AUE_MKNOD,	aus_mknod,	/* 14 mknod */
235 		auf_mknod,	S2E_MLD,
236 aui_null,	AUE_CHMOD,	aus_chmod,	/* 15 chmod */
237 		auf_null,	0,
238 aui_null,	AUE_CHOWN,	aus_chown,	/* 16 chown */
239 		auf_null,	0,
240 aui_null,	AUE_NULL,	aus_null,	/* 17 brk */
241 		auf_null,	0,
242 aui_null,	AUE_STAT,	aus_null,	/* 18 stat */
243 		auf_null,	S2E_PUB,
244 aui_null,	AUE_NULL,	aus_null,	/* 19 lseek */
245 		auf_null,	0,
246 aui_null,	AUE_NULL,	aus_null,	/* 20 getpid */
247 		auf_null,	0,
248 aui_null,	AUE_MOUNT,	aus_mount,	/* 21 mount */
249 		auf_null,	S2E_MLD,
250 aui_null,	AUE_READLINK,	aus_null,	/* 22 readlinkat */
251 		auf_null,	S2E_PUB,
252 aui_null,	AUE_SETUID,	aus_setuid,	/* 23 setuid */
253 		auf_null,	0,
254 aui_null,	AUE_NULL,	aus_null,	/* 24 getuid */
255 		auf_null,	0,
256 aui_null,	AUE_STIME,	aus_null,	/* 25 stime */
257 		auf_null,	0,
258 aui_null,	AUE_NULL,	aus_null,	/* 26 pcsample */
259 		auf_null,	0,
260 aui_null,	AUE_NULL,	aus_null,	/* 27 alarm */
261 		auf_null,	0,
262 aui_null,	AUE_NULL,	aus_null,	/* 28 fstat */
263 		auf_null,	0,
264 aui_null,	AUE_NULL,	aus_null,	/* 29 pause */
265 		auf_null,	0,
266 aui_null,	AUE_NULL,	aus_null,	/* 30 (loadable) was utime */
267 		auf_null,	0,
268 aui_null,	AUE_NULL,	aus_null,	/* 31 stty (TIOCSETP-audit?) */
269 		auf_null,	0,
270 aui_null,	AUE_NULL,	aus_null,	/* 32 gtty */
271 		auf_null,	0,
272 aui_null,	AUE_ACCESS,	aus_null,	/* 33 access */
273 		auf_null,	S2E_PUB,
274 aui_null,	AUE_NICE,	aus_null,	/* 34 nice */
275 		auf_null,	0,
276 aui_null,	AUE_STATFS,	aus_null,	/* 35 statfs */
277 		auf_null,	S2E_PUB,
278 aui_null,	AUE_NULL,	aus_null,	/* 36 sync */
279 		auf_null,	0,
280 aui_null,	AUE_KILL,	aus_kill,	/* 37 kill */
281 		auf_null,	0,
282 aui_null,	AUE_FSTATFS,	aus_fstatfs,	/* 38 fstatfs */
283 		auf_null,	S2E_PUB,
284 aui_setpgrp,	AUE_SETPGRP,	aus_setpgrp,	/* 39 setpgrp */
285 		auf_null,	0,
286 aui_null,	AUE_NULL,	aus_null,	/* 40 uucopystr */
287 		auf_null,	0,
288 aui_null,	AUE_NULL,	aus_null,	/* 41 (loadable) was dup */
289 		auf_null,	0,
290 aui_null,	AUE_PIPE,	aus_null,	/* 42 (loadable) pipe */
291 		auf_null,	0,
292 aui_null,	AUE_NULL,	aus_null,	/* 43 times */
293 		auf_null,	0,
294 aui_null,	AUE_NULL,	aus_null,	/* 44 profil */
295 		auf_null,	0,
296 aui_null,	AUE_ACCESS,	aus_null,	/* 45 faccessat */
297 		auf_null,	S2E_PUB,
298 aui_null,	AUE_SETGID,	aus_setgid,	/* 46 setgid */
299 		auf_null,	0,
300 aui_null,	AUE_NULL,	aus_null,	/* 47 getgid */
301 		auf_null,	0,
302 aui_null,	AUE_MKNOD,	aus_mknodat,	/* 48 mknodat */
303 		auf_mknodat,	S2E_MLD,
304 aui_msgsys,	AUE_MSGSYS,	aus_msgsys,	/* 49 (loadable) msgsys */
305 		auf_msgsys,	0,
306 #if defined(__x86)
307 aui_null,	AUE_NULL,	aus_null,	/* 50 sysi86 */
308 		auf_null,	0,
309 #else
310 aui_null,	AUE_NULL,	aus_null,	/* 50 (loadable) was sys3b */
311 		auf_null,	0,
312 #endif /* __x86 */
313 aui_null,	AUE_ACCT,	aus_acct,	/* 51 (loadable) sysacct */
314 		auf_null,	0,
315 aui_shmsys,	AUE_SHMSYS,	aus_shmsys,	/* 52 (loadable) shmsys */
316 		auf_shmsys,	0,
317 aui_semsys,	AUE_SEMSYS,	aus_semsys,	/* 53 (loadable) semsys */
318 		auf_semsys,	0,
319 aui_null,	AUE_IOCTL,	aus_ioctl,	/* 54 ioctl */
320 		auf_null,	0,
321 aui_null,	AUE_NULL,	aus_null,	/* 55 uadmin */
322 		auf_null,	0,
323 aui_fchownat,	AUE_NULL,	aus_fchownat,	/* 56 fchownat */
324 		auf_null,	0,
325 aui_utssys,	AUE_FUSERS,	aus_null,	/* 57 utssys */
326 		auf_null,	0,
327 aui_null,	AUE_NULL,	aus_null,	/* 58 fsync */
328 		auf_null,	0,
329 aui_execve,	AUE_EXECVE,	aus_null,	/* 59 exece */
330 		auf_null,	S2E_MLD,
331 aui_null,	AUE_NULL,	aus_null,	/* 60 umask */
332 		auf_null,	0,
333 aui_null,	AUE_CHROOT,	aus_null,	/* 61 chroot */
334 		auf_null,	S2E_SP,
335 aui_fcntl,	AUE_FCNTL,	aus_fcntl,	/* 62 fcntl */
336 		auf_null,	0,
337 aui_null,	AUE_NULL,	aus_null,	/* 63 ulimit */
338 		auf_null,	0,
339 aui_null,	AUE_RENAME,	aus_null,	/* 64 renameat */
340 		auf_null,	0,
341 aui_unlinkat,	AUE_NULL,	aus_null,	/* 65 unlinkat */
342 		auf_null,	0,
343 aui_fstatat,	AUE_NULL,	aus_null,	/* 66 fstatat */
344 		auf_null,	S2E_PUB,
345 aui_fstatat,	AUE_NULL,	aus_null,	/* 67 fstatat64 */
346 		auf_null,	S2E_PUB,
347 aui_openat,	AUE_OPEN,	aus_openat,	/* 68 openat */
348 		auf_null,	S2E_SP,
349 aui_openat,	AUE_OPEN,	aus_openat,	/* 69 openat64 */
350 		auf_null,	S2E_SP,
351 aui_null,	AUE_NULL,	aus_null,	/* 70 tasksys */
352 		auf_null,	0,
353 aui_null,	AUE_NULL,	aus_null,	/* 71 (loadable) acctctl */
354 		auf_null,	0,
355 aui_null,	AUE_NULL,	aus_null,	/* 72 (loadable) exacct */
356 		auf_null,	0,
357 aui_null,	AUE_NULL,	aus_null,	/* 73 getpagesizes */
358 		auf_null,	0,
359 aui_null,	AUE_NULL,	aus_null,	/* 74 rctlsys */
360 		auf_null,	0,
361 aui_null,	AUE_NULL,	aus_null,	/* 75 sidsys */
362 		auf_null,	0,
363 aui_null,	AUE_NULL,	aus_null,	/* 76 (loadable) was fsat */
364 		auf_null,	0,
365 aui_null,	AUE_NULL,	aus_null,	/* 77 syslwp_park */
366 		auf_null,	0,
367 aui_null,	AUE_NULL,	aus_null,	/* 78 sendfilev */
368 		auf_null,	0,
369 aui_null,	AUE_RMDIR,	aus_null,	/* 79 rmdir */
370 		auf_null,	0,
371 aui_null,	AUE_MKDIR,	aus_mkdir,	/* 80 mkdir */
372 		auf_null,	0,
373 aui_null,	AUE_NULL,	aus_null,	/* 81 getdents */
374 		auf_null,	0,
375 aui_privsys,	AUE_NULL,	aus_null,	/* 82 privsys */
376 		auf_null,	0,
377 aui_null,	AUE_NULL,	aus_null,	/* 83 ucredsys */
378 		auf_null,	0,
379 aui_null,	AUE_NULL,	aus_null,	/* 84 sysfs */
380 		auf_null,	0,
381 aui_null,	AUE_GETMSG,	aus_getmsg,	/* 85 getmsg */
382 		auf_null,	0,
383 aui_null,	AUE_PUTMSG,	aus_putmsg,	/* 86 putmsg */
384 		auf_null,	0,
385 aui_null,	AUE_NULL,	aus_null,	/* 87 (loadable) was poll */
386 		auf_null,	0,
387 aui_null,	AUE_LSTAT,	aus_null,	/* 88 lstat */
388 		auf_null,	S2E_PUB,
389 aui_null,	AUE_SYMLINK,	aus_null,	/* 89 symlink */
390 		auf_null,	0,
391 aui_null,	AUE_READLINK,	aus_null,	/* 90 readlink */
392 		auf_null,	S2E_PUB,
393 aui_null,	AUE_SETGROUPS,	aus_setgroups,	/* 91 setgroups */
394 		auf_null,	0,
395 aui_null,	AUE_NULL,	aus_null,	/* 92 getgroups */
396 		auf_null,	0,
397 aui_null,	AUE_FCHMOD,	aus_fchmod,	/* 93 fchmod */
398 		auf_null,	0,
399 aui_null,	AUE_FCHOWN,	aus_fchown,	/* 94 fchown */
400 		auf_null,	0,
401 aui_null,	AUE_NULL,	aus_null,	/* 95 sigprocmask */
402 		auf_null,	0,
403 aui_null,	AUE_NULL,	aus_null,	/* 96 sigsuspend */
404 		auf_null,	0,
405 aui_null,	AUE_NULL,	aus_null,	/* 97 sigaltstack */
406 		auf_null,	0,
407 aui_null,	AUE_NULL,	aus_null,	/* 98 sigaction */
408 		auf_null,	0,
409 aui_null,	AUE_NULL,	aus_null,	/* 99 sigpending */
410 		auf_null,	0,
411 aui_null,	AUE_NULL,	aus_null,	/* 100 setcontext */
412 		auf_null,	0,
413 aui_fchmodat,	AUE_NULL,	aus_fchmodat,	/* 101 fchmodat */
414 		auf_null,	0,
415 aui_null,	AUE_MKDIR,	aus_mkdirat,	/* 102 mkdirat */
416 		auf_null,	0,
417 aui_null,	AUE_STATVFS,	aus_null,	/* 103 statvfs */
418 		auf_null,	S2E_PUB,
419 aui_null,	AUE_NULL,	aus_null,	/* 104 fstatvfs */
420 		auf_null,	0,
421 aui_null,	AUE_NULL,	aus_null,	/* 105 getloadavg */
422 		auf_null,	0,
423 aui_null,	AUE_NULL,	aus_null,	/* 106 nfssys */
424 		auf_null,	0,
425 aui_null,	AUE_NULL,	aus_null,	/* 107 waitsys */
426 		auf_null,	0,
427 aui_null,	AUE_NULL,	aus_null,	/* 108 sigsendsys */
428 		auf_null,	0,
429 #if defined(__x86)
430 aui_null,	AUE_NULL,	aus_null,	/* 109 hrtsys */
431 		auf_null,	0,
432 #else
433 aui_null,	AUE_NULL,	aus_null,	/* 109 (loadable) */
434 		auf_null,	0,
435 #endif /* __x86 */
436 aui_null,	AUE_UTIMES,	aus_null,	/* 110 utimesys */
437 		auf_null,	0,
438 aui_null,	AUE_NULL,	aus_null,	/* 111 sigresend */
439 		auf_null,	0,
440 aui_null,	AUE_PRIOCNTLSYS, aus_priocntlsys, /* 112 priocntlsys */
441 		auf_null,	0,
442 aui_null,	AUE_PATHCONF,	aus_null,	/* 113 pathconf */
443 		auf_null,	S2E_PUB,
444 aui_null,	AUE_NULL,	aus_null,	/* 114 mincore */
445 		auf_null,	0,
446 aui_null,	AUE_MMAP,	aus_mmap,	/* 115 mmap */
447 		auf_null,	0,
448 aui_null,	AUE_NULL,	aus_null,	/* 116 mprotect */
449 		auf_null,	0,
450 aui_null,	AUE_MUNMAP,	aus_munmap,	/* 117 munmap */
451 		auf_null,	0,
452 aui_null,	AUE_NULL,	aus_null,	/* 118 fpathconf */
453 		auf_null,	0,
454 aui_null,	AUE_VFORK,	aus_null,	/* 119 vfork */
455 		auf_null,	0,
456 aui_null,	AUE_FCHDIR,	aus_null,	/* 120 fchdir */
457 		auf_null,	0,
458 aui_null,	AUE_READ,	aus_null,	/* 121 readv */
459 		auf_read,	S2E_PUB,
460 aui_null,	AUE_WRITE,	aus_null,	/* 122 writev */
461 		auf_write,	0,
462 aui_null,	AUE_NULL,	aus_null,	/* 123 (loadable) was xstat */
463 		auf_null,	0,
464 aui_null,	AUE_NULL,	aus_null,	/* 124 (loadable) was lxstat */
465 		auf_null,	0,
466 aui_null,	AUE_NULL,	aus_null,	/* 125 (loadable) was fxstat */
467 		auf_null,	0,
468 aui_null,	AUE_NULL,	aus_null,	/* 126 (loadable) was xmknod */
469 		auf_null,	0,
470 aui_null,	AUE_NULL,	aus_null,	/* 127 mmapobj */
471 		auf_null,	0,
472 aui_null,	AUE_SETRLIMIT,	aus_null,	/* 128 setrlimit */
473 		auf_null,	0,
474 aui_null,	AUE_NULL,	aus_null,	/* 129 getrlimit */
475 		auf_null,	0,
476 aui_null,	AUE_LCHOWN,	aus_lchown,	/* 130 lchown */
477 		auf_null,	0,
478 aui_memcntl,	AUE_MEMCNTL,	aus_memcntl,	/* 131 memcntl */
479 		auf_null,	0,
480 aui_null,	AUE_GETPMSG,	aus_getpmsg,	/* 132 getpmsg */
481 		auf_null,	0,
482 aui_null,	AUE_PUTPMSG,	aus_putpmsg,	/* 133 putpmsg */
483 		auf_null,	0,
484 aui_null,	AUE_RENAME,	aus_null,	/* 134 rename */
485 		auf_null,	0,
486 aui_null,	AUE_NULL,	aus_null,	/* 135 uname */
487 		auf_null,	0,
488 aui_null,	AUE_SETEGID,	aus_setegid,	/* 136 setegid */
489 		auf_null,	0,
490 aui_null,	AUE_NULL,	aus_null,	/* 137 sysconfig */
491 		auf_null,	0,
492 aui_null,	AUE_ADJTIME,	aus_null,	/* 138 adjtime */
493 		auf_null,	0,
494 aui_sysinfo,	AUE_SYSINFO,	aus_sysinfo,	/* 139 systeminfo */
495 		auf_null,	0,
496 aui_null,	AUE_NULL,	aus_null,	/* 140 (loadable) sharefs */
497 		auf_null,	0,
498 aui_null,	AUE_SETEUID,	aus_seteuid,	/* 141 seteuid */
499 		auf_null,	0,
500 aui_forksys,	AUE_NULL,	aus_null,	/* 142 forksys */
501 		auf_null,	0,
502 aui_null,	AUE_NULL,	aus_null,	/* 143 (loadable) was fork1 */
503 		auf_null,	0,
504 aui_null,	AUE_NULL,	aus_null,	/* 144 sigwait */
505 		auf_null,	0,
506 aui_null,	AUE_NULL,	aus_null,	/* 145 lwp_info */
507 		auf_null,	0,
508 aui_null,	AUE_NULL,	aus_null,	/* 146 yield */
509 		auf_null,	0,
510 aui_null,	AUE_NULL,	aus_null,	/* 147 (loadable) */
511 						/*	was lwp_sema_wait */
512 		auf_null,	0,
513 aui_null,	AUE_NULL,	aus_null,	/* 148 lwp_sema_post */
514 		auf_null,	0,
515 aui_null,	AUE_NULL,	aus_null,	/* 149 lwp_sema_trywait */
516 		auf_null,	0,
517 aui_null,	AUE_NULL,	aus_null,	/* 150 lwp_detach */
518 		auf_null,	0,
519 aui_null,	AUE_NULL,	aus_null,	/* 151 corectl */
520 		auf_null,	0,
521 aui_modctl,	AUE_MODCTL,	aus_modctl,	/* 152 modctl */
522 		auf_null,	0,
523 aui_null,	AUE_FCHROOT,	aus_null,	/* 153 fchroot */
524 		auf_null,	0,
525 aui_null,	AUE_NULL,	aus_null,	/* 154 (loadable) was utimes */
526 		auf_null,	0,
527 aui_null,	AUE_NULL,	aus_null,	/* 155 vhangup */
528 		auf_null,	0,
529 aui_null,	AUE_NULL,	aus_null,	/* 156 gettimeofday */
530 		auf_null,	0,
531 aui_null,	AUE_NULL,	aus_null,	/* 157 getitimer */
532 		auf_null,	0,
533 aui_null,	AUE_NULL,	aus_null,	/* 158 setitimer */
534 		auf_null,	0,
535 aui_null,	AUE_NULL,	aus_null,	/* 159 lwp_create */
536 		auf_null,	0,
537 aui_null,	AUE_NULL,	aus_null,	/* 160 lwp_exit */
538 		auf_null,	0,
539 aui_null,	AUE_NULL,	aus_null,	/* 161 lwp_suspend */
540 		auf_null,	0,
541 aui_null,	AUE_NULL,	aus_null,	/* 162 lwp_continue */
542 		auf_null,	0,
543 aui_null,	AUE_NULL,	aus_null,	/* 163 lwp_kill */
544 		auf_null,	0,
545 aui_null,	AUE_NULL,	aus_null,	/* 164 lwp_self */
546 		auf_null,	0,
547 aui_null,	AUE_NULL,	aus_null,	/* 165 lwp_sigmask */
548 		auf_null,	0,
549 aui_null,	AUE_NULL,	aus_null,	/* 166 lwp_private */
550 		auf_null,	0,
551 aui_null,	AUE_NULL,	aus_null,	/* 167 lwp_wait */
552 		auf_null,	0,
553 aui_null,	AUE_NULL,	aus_null,	/* 168 lwp_mutex_wakeup  */
554 		auf_null,	0,
555 aui_null,	AUE_NULL,	aus_null,	/* 169 (loadable) */
556 						/*	was lwp_mutex_lock */
557 		auf_null,	0,
558 aui_null,	AUE_NULL,	aus_null,	/* 170 lwp_cond_wait */
559 		auf_null,	0,
560 aui_null,	AUE_NULL,	aus_null,	/* 171 lwp_cond_signal */
561 		auf_null,	0,
562 aui_null,	AUE_NULL,	aus_null,	/* 172 lwp_cond_broadcast */
563 		auf_null,	0,
564 aui_null,	AUE_READ,	aus_null,	/* 173 pread */
565 		auf_read,	S2E_PUB,
566 aui_null,	AUE_WRITE,	aus_null,	/* 174 pwrite */
567 		auf_write,	0,
568 aui_null,	AUE_NULL,	aus_null,	/* 175 llseek */
569 		auf_null,	0,
570 aui_null,	AUE_INST_SYNC,	aus_inst_sync,  /* 176 (loadable) inst_sync */
571 		auf_null,	0,
572 aui_null,	AUE_BRANDSYS,	aus_brandsys,	/* 177 brandsys */
573 		auf_null,	0,
574 aui_null,	AUE_NULL,	aus_null,	/* 178 (loadable) kaio */
575 		auf_null,	0,
576 aui_null,	AUE_NULL,	aus_null,	/* 179 (loadable) cpc */
577 		auf_null,	0,
578 aui_null,	AUE_NULL,	aus_null,	/* 180 lgrpsys */
579 		auf_null,	0,
580 aui_null,	AUE_NULL,	aus_null,	/* 181 rusagesys */
581 		auf_null,	0,
582 aui_portfs,	AUE_PORTFS,	aus_null,	/* 182 (loadable) portfs */
583 		auf_null,	S2E_MLD,
584 aui_null,	AUE_NULL,	aus_null,	/* 183 pollsys */
585 		auf_null,	0,
586 aui_labelsys,	AUE_NULL,	aus_labelsys,	/* 184 labelsys */
587 		auf_null,	0,
588 aui_acl,	AUE_ACLSET,	aus_acl,	/* 185 acl */
589 		auf_null,	0,
590 aui_auditsys,	AUE_AUDITSYS,	aus_auditsys,	/* 186 auditsys  */
591 		auf_null,	0,
592 aui_null,	AUE_PROCESSOR_BIND, aus_processor_bind, /* 187 processor_bind */
593 		auf_null,	0,
594 aui_null,	AUE_NULL,	aus_null,	/* 188 processor_info */
595 		auf_null,	0,
596 aui_null,	AUE_P_ONLINE,	aus_p_online,	/* 189 p_online */
597 		auf_null,	0,
598 aui_null,	AUE_NULL,	aus_sigqueue,	/* 190 sigqueue */
599 		auf_null,	0,
600 aui_null,	AUE_NULL,	aus_null,	/* 191 clock_gettime */
601 		auf_null,	0,
602 aui_null,	AUE_CLOCK_SETTIME,	aus_null,	/* 192 clock_settime */
603 		auf_null,	0,
604 aui_null,	AUE_NULL,	aus_null,	/* 193 clock_getres */
605 		auf_null,	0,
606 aui_null,	AUE_NULL,	aus_null,	/* 194 timer_create */
607 		auf_null,	0,
608 aui_null,	AUE_NULL,	aus_null,	/* 195 timer_delete */
609 		auf_null,	0,
610 aui_null,	AUE_NULL,	aus_null,	/* 196 timer_settime */
611 		auf_null,	0,
612 aui_null,	AUE_NULL,	aus_null,	/* 197 timer_gettime */
613 		auf_null,	0,
614 aui_null,	AUE_NULL,	aus_null,	/* 198 timer_getoverrun */
615 		auf_null,	0,
616 aui_null,	AUE_NULL,	aus_null,	/* 199 nanosleep */
617 		auf_null,	0,
618 aui_acl,	AUE_FACLSET,	aus_facl,	/* 200 facl */
619 		auf_null,	0,
620 aui_doorfs,	AUE_DOORFS,	aus_doorfs,	/* 201 (loadable) doorfs */
621 		auf_null,	0,
622 aui_null,	AUE_SETREUID,	aus_setreuid,	/* 202 setreuid */
623 		auf_null,	0,
624 aui_null,	AUE_SETREGID,	aus_setregid,	/* 203 setregid */
625 		auf_null,	0,
626 aui_null,	AUE_NULL,	aus_null,	/* 204 install_utrap */
627 		auf_null,	0,
628 aui_null,	AUE_NULL,	aus_null,	/* 205 signotify */
629 		auf_null,	0,
630 aui_null,	AUE_NULL,	aus_null,	/* 206 schedctl */
631 		auf_null,	0,
632 aui_null,	AUE_NULL,	aus_null,	/* 207 (loadable) pset */
633 		auf_null,	0,
634 aui_null,	AUE_NULL,	aus_null,	/* 208 sparc_utrap_install */
635 		auf_null,	0,
636 aui_null,	AUE_NULL,	aus_null,	/* 209 resolvepath */
637 		auf_null,	0,
638 aui_null,	AUE_NULL,	aus_null,	/* 210 lwp_mutex_timedlock */
639 		auf_null,	0,
640 aui_null,	AUE_NULL,	aus_null,	/* 211 lwp_sema_timedwait */
641 		auf_null,	0,
642 aui_null,	AUE_NULL,	aus_null,	/* 212 lwp_rwlock_sys */
643 		auf_null,	0,
644 aui_null,	AUE_NULL,	aus_null,	/* 213 getdents64 */
645 		auf_null,	0,
646 aui_null,	AUE_MMAP,	aus_mmap,	/* 214 mmap64 */
647 		auf_null,	0,
648 aui_null,	AUE_STAT,	aus_null,	/* 215 stat64 */
649 		auf_null,	S2E_PUB,
650 aui_null,	AUE_LSTAT,	aus_null,	/* 216 lstat64 */
651 		auf_null,	S2E_PUB,
652 aui_null,	AUE_NULL,	aus_null,	/* 217 fstat64 */
653 		auf_null,	0,
654 aui_null,	AUE_STATVFS,	aus_null,	/* 218 statvfs64 */
655 		auf_null,	S2E_PUB,
656 aui_null,	AUE_NULL,	aus_null,	/* 219 fstatvfs64 */
657 		auf_null,	0,
658 aui_null,	AUE_SETRLIMIT,	aus_null,	/* 220 setrlimit64 */
659 		auf_null,	0,
660 aui_null,	AUE_NULL,	aus_null,	/* 221 getrlimit64 */
661 		auf_null,	0,
662 aui_null,	AUE_READ,	aus_null,	/* 222 pread64  */
663 		auf_read,	S2E_PUB,
664 aui_null,	AUE_WRITE,	aus_null,	/* 223 pwrite64 */
665 		auf_write,	0,
666 aui_null,	AUE_NULL,	aus_null,	/* 224 (loadable) was creat64 */
667 		auf_null,	0,
668 aui_open,	AUE_OPEN,	aus_open,	/* 225 open64 */
669 		auf_null,	S2E_SP,
670 aui_null,	AUE_NULL,	aus_null,	/* 226 (loadable) rpcsys */
671 		auf_null,	0,
672 aui_null,	AUE_NULL,	aus_null,	/* 227 zone */
673 		auf_null,	0,
674 aui_null,	AUE_NULL,	aus_null,	/* 228 (loadable) autofssys */
675 		auf_null,	0,
676 aui_null,	AUE_NULL,	aus_null,	/* 229 getcwd */
677 		auf_null,	0,
678 aui_null,	AUE_SOCKET,	aus_socket,	/* 230 so_socket */
679 		auf_null,	0,
680 aui_null,	AUE_NULL,	aus_null,	/* 231 so_socketpair */
681 		auf_null,	0,
682 aui_null,	AUE_BIND,	aus_null,	/* 232 bind */
683 		auf_bind,	0,
684 aui_null,	AUE_NULL,	aus_null,	/* 233 listen */
685 		auf_null,	0,
686 aui_null,	AUE_ACCEPT,	aus_null,	/* 234 accept */
687 		auf_accept,	0,
688 aui_null,	AUE_CONNECT,	aus_null,	/* 235 connect */
689 		auf_connect,	0,
690 aui_null,	AUE_SHUTDOWN,	aus_shutdown,	/* 236 shutdown */
691 		auf_null,	0,
692 aui_null,	AUE_READ,	aus_null,	/* 237 recv */
693 		auf_recv,	0,
694 aui_null,	AUE_RECVFROM,	aus_null,	/* 238 recvfrom */
695 		auf_recvfrom,	0,
696 aui_null,	AUE_RECVMSG,	aus_null,	/* 239 recvmsg */
697 		auf_recvmsg,	0,
698 aui_null,	AUE_WRITE,	aus_null,	/* 240 send */
699 		auf_send,	0,
700 aui_null,	AUE_SENDMSG,	aus_null,	/* 241 sendmsg */
701 		auf_sendmsg,	0,
702 aui_null,	AUE_SENDTO,	aus_null,	/* 242 sendto */
703 		auf_sendto,	0,
704 aui_null,	AUE_NULL,	aus_null,	/* 243 getpeername */
705 		auf_null,	0,
706 aui_null,	AUE_NULL,	aus_null,	/* 244 getsockname */
707 		auf_null,	0,
708 aui_null,	AUE_NULL,	aus_null,	/* 245 getsockopt */
709 		auf_null,	0,
710 aui_null,	AUE_SETSOCKOPT,	aus_null,	/* 246 setsockopt */
711 		auf_setsockopt,	0,
712 aui_null,	AUE_SOCKCONFIG,	aus_sockconfig,	/* 247 sockconfig */
713 		auf_null,	0,
714 aui_null,	AUE_NULL,	aus_null,	/* 248 ntp_gettime */
715 		auf_null,	0,
716 aui_null,	AUE_NTP_ADJTIME, aus_null,	/* 249 ntp_adjtime */
717 		auf_null,	0,
718 aui_null,	AUE_NULL,	aus_null,	/* 250 lwp_mutex_unlock */
719 		auf_null,	0,
720 aui_null,	AUE_NULL,	aus_null,	/* 251 lwp_mutex_trylock */
721 		auf_null,	0,
722 aui_null,	AUE_NULL,	aus_null,	/* 252 lwp_mutex_register */
723 		auf_null,	0,
724 aui_null,	AUE_NULL,	aus_null,	/* 253 cladm */
725 		auf_null,	0,
726 aui_null,	AUE_NULL,	aus_null,	/* 254 uucopy */
727 		auf_null,	0,
728 aui_null,	AUE_UMOUNT2,	aus_umount2,	/* 255 umount2 */
729 		auf_null,	0
730 };
731 
732 uint_t num_syscall = sizeof (audit_s2e) / sizeof (struct audit_s2e);
733 
734 
735 /* exit start function */
736 /*ARGSUSED*/
737 static void
aus_exit(struct t_audit_data * tad)738 aus_exit(struct t_audit_data *tad)
739 {
740 	uint32_t rval;
741 	struct a {
742 		long rval;
743 	} *uap = (struct a *)ttolwp(curthread)->lwp_ap;
744 
745 	rval = (uint32_t)uap->rval;
746 	au_uwrite(au_to_arg32(1, "exit status", rval));
747 }
748 
749 
750 /* acct start function */
751 /*ARGSUSED*/
752 static void
aus_acct(struct t_audit_data * tad)753 aus_acct(struct t_audit_data *tad)
754 {
755 	klwp_t *clwp = ttolwp(curthread);
756 	uintptr_t fname;
757 
758 	struct a {
759 		long	fname;		/* char * */
760 	} *uap = (struct a *)clwp->lwp_ap;
761 
762 	fname = (uintptr_t)uap->fname;
763 
764 	if (fname == 0)
765 		au_uwrite(au_to_arg32(1, "accounting off", (uint32_t)0));
766 }
767 
768 /* chown start function */
769 /*ARGSUSED*/
770 static void
aus_chown(struct t_audit_data * tad)771 aus_chown(struct t_audit_data *tad)
772 {
773 	klwp_t *clwp = ttolwp(curthread);
774 	uint32_t uid, gid;
775 
776 	struct a {
777 		long	fname;		/* char * */
778 		long	uid;
779 		long	gid;
780 	} *uap = (struct a *)clwp->lwp_ap;
781 
782 	uid = (uint32_t)uap->uid;
783 	gid = (uint32_t)uap->gid;
784 
785 	au_uwrite(au_to_arg32(2, "new file uid", uid));
786 	au_uwrite(au_to_arg32(3, "new file gid", gid));
787 }
788 
789 /* fchown start function */
790 /*ARGSUSED*/
791 static void
aus_fchown(struct t_audit_data * tad)792 aus_fchown(struct t_audit_data *tad)
793 {
794 	klwp_t *clwp = ttolwp(curthread);
795 	uint32_t uid, gid, fd;
796 	struct file  *fp;
797 	struct vnode *vp;
798 	struct f_audit_data *fad;
799 
800 	struct a {
801 		long fd;
802 		long uid;
803 		long gid;
804 	} *uap = (struct a *)clwp->lwp_ap;
805 
806 	fd  = (uint32_t)uap->fd;
807 	uid = (uint32_t)uap->uid;
808 	gid = (uint32_t)uap->gid;
809 
810 	au_uwrite(au_to_arg32(2, "new file uid", uid));
811 	au_uwrite(au_to_arg32(3, "new file gid", gid));
812 
813 		/*
814 		 * convert file pointer to file descriptor
815 		 *   Note: fd ref count incremented here.
816 		 */
817 	if ((fp = getf(fd)) == NULL)
818 		return;
819 
820 	/* get path from file struct here */
821 	fad = F2A(fp);
822 	if (fad->fad_aupath != NULL) {
823 		au_uwrite(au_to_path(fad->fad_aupath));
824 	} else {
825 		au_uwrite(au_to_arg32(1, "no path: fd", fd));
826 	}
827 
828 	vp = fp->f_vnode;
829 	audit_attributes(vp);
830 
831 	/* decrement file descriptor reference count */
832 	releasef(fd);
833 }
834 
835 /*ARGSUSED*/
836 static void
aus_lchown(struct t_audit_data * tad)837 aus_lchown(struct t_audit_data *tad)
838 {
839 	klwp_t *clwp = ttolwp(curthread);
840 	uint32_t uid, gid;
841 
842 
843 	struct a {
844 		long	fname;		/* char	* */
845 		long	uid;
846 		long	gid;
847 	} *uap = (struct a *)clwp->lwp_ap;
848 
849 	uid = (uint32_t)uap->uid;
850 	gid = (uint32_t)uap->gid;
851 
852 	au_uwrite(au_to_arg32(2, "new file uid", uid));
853 	au_uwrite(au_to_arg32(3, "new file gid", gid));
854 }
855 
856 static au_event_t
aui_fchownat(au_event_t e)857 aui_fchownat(au_event_t e)
858 {
859 	klwp_t *clwp = ttolwp(curthread);
860 
861 	struct a {
862 		long	fd;
863 		long	fname;		/* char * */
864 		long	uid;
865 		long	gid;
866 		long	flags;
867 	} *uap = (struct a *)clwp->lwp_ap;
868 
869 	if (uap->fname == 0)
870 		e = AUE_FCHOWN;
871 	else if (uap->flags & AT_SYMLINK_NOFOLLOW)
872 		e = AUE_LCHOWN;
873 	else
874 		e = AUE_CHOWN;
875 
876 	return (e);
877 }
878 
879 /*ARGSUSED*/
880 static void
aus_fchownat(struct t_audit_data * tad)881 aus_fchownat(struct t_audit_data *tad)
882 {
883 	klwp_t *clwp = ttolwp(curthread);
884 	uint32_t uid, gid;
885 
886 	struct a {
887 		long	fd;
888 		long	fname;		/* char * */
889 		long	uid;
890 		long	gid;
891 		long	flags;
892 	} *uap = (struct a *)clwp->lwp_ap;
893 
894 	uid = (uint32_t)uap->uid;
895 	gid = (uint32_t)uap->gid;
896 
897 	au_uwrite(au_to_arg32(3, "new file uid", uid));
898 	au_uwrite(au_to_arg32(4, "new file gid", gid));
899 }
900 
901 /*ARGSUSED*/
902 static void
aus_chmod(struct t_audit_data * tad)903 aus_chmod(struct t_audit_data *tad)
904 {
905 	klwp_t *clwp = ttolwp(curthread);
906 	uint32_t fmode;
907 
908 	struct a {
909 		long	fname;		/* char	* */
910 		long	fmode;
911 	} *uap = (struct a *)clwp->lwp_ap;
912 
913 	fmode = (uint32_t)uap->fmode;
914 
915 	au_uwrite(au_to_arg32(2, "new file mode", fmode&07777));
916 }
917 
918 /*ARGSUSED*/
919 static void
aus_fchmod(struct t_audit_data * tad)920 aus_fchmod(struct t_audit_data *tad)
921 {
922 	klwp_t *clwp = ttolwp(curthread);
923 	uint32_t fmode, fd;
924 	struct file  *fp;
925 	struct vnode *vp;
926 	struct f_audit_data *fad;
927 
928 	struct a {
929 		long	fd;
930 		long	fmode;
931 	} *uap = (struct a *)clwp->lwp_ap;
932 
933 	fd = (uint32_t)uap->fd;
934 	fmode = (uint32_t)uap->fmode;
935 
936 	au_uwrite(au_to_arg32(2, "new file mode", fmode&07777));
937 
938 	/*
939 	 * convert file pointer to file descriptor
940 	 *   Note: fd ref count incremented here.
941 	 */
942 	if ((fp = getf(fd)) == NULL)
943 		return;
944 
945 	/* get path from file struct here */
946 	fad = F2A(fp);
947 	if (fad->fad_aupath != NULL) {
948 		au_uwrite(au_to_path(fad->fad_aupath));
949 	} else {
950 		au_uwrite(au_to_arg32(1, "no path: fd", fd));
951 	}
952 
953 	vp = fp->f_vnode;
954 	audit_attributes(vp);
955 
956 	/* decrement file descriptor reference count */
957 	releasef(fd);
958 }
959 
960 static au_event_t
aui_fchmodat(au_event_t e)961 aui_fchmodat(au_event_t e)
962 {
963 	klwp_t *clwp = ttolwp(curthread);
964 
965 	struct a {
966 		long	fd;
967 		long	fname;		/* char	* */
968 		long	fmode;
969 		long	flag;
970 	} *uap = (struct a *)clwp->lwp_ap;
971 
972 	if (uap->fname == 0)
973 		e = AUE_FCHMOD;
974 	else
975 		e = AUE_CHMOD;
976 
977 	return (e);
978 }
979 
980 /*ARGSUSED*/
981 static void
aus_fchmodat(struct t_audit_data * tad)982 aus_fchmodat(struct t_audit_data *tad)
983 {
984 	klwp_t *clwp = ttolwp(curthread);
985 	uint32_t fmode;
986 	uint32_t fd;
987 	struct file  *fp;
988 	struct vnode *vp;
989 	struct f_audit_data *fad;
990 
991 	struct a {
992 		long	fd;
993 		long	fname;		/* char	* */
994 		long	fmode;
995 		long	flag;
996 	} *uap = (struct a *)clwp->lwp_ap;
997 
998 	fd = (uint32_t)uap->fd;
999 	fmode = (uint32_t)uap->fmode;
1000 
1001 	au_uwrite(au_to_arg32(2, "new file mode", fmode&07777));
1002 
1003 	if (fd == AT_FDCWD || uap->fname != 0)	/* same as chmod() */
1004 		return;
1005 
1006 	/*
1007 	 * convert file pointer to file descriptor
1008 	 *   Note: fd ref count incremented here.
1009 	 */
1010 	if ((fp = getf(fd)) == NULL)
1011 		return;
1012 
1013 	/* get path from file struct here */
1014 	fad = F2A(fp);
1015 	if (fad->fad_aupath != NULL) {
1016 		au_uwrite(au_to_path(fad->fad_aupath));
1017 	} else {
1018 		au_uwrite(au_to_arg32(1, "no path: fd", fd));
1019 	}
1020 
1021 	vp = fp->f_vnode;
1022 	audit_attributes(vp);
1023 
1024 	/* decrement file descriptor reference count */
1025 	releasef(fd);
1026 }
1027 
1028 /*
1029  * convert open mode to appropriate open event
1030  */
1031 au_event_t
open_event(uint_t fm)1032 open_event(uint_t fm)
1033 {
1034 	au_event_t e;
1035 
1036 	switch (fm & (O_ACCMODE | O_CREAT | O_TRUNC)) {
1037 	case O_RDONLY:
1038 		e = AUE_OPEN_R;
1039 		break;
1040 	case O_RDONLY | O_CREAT:
1041 		e = AUE_OPEN_RC;
1042 		break;
1043 	case O_RDONLY | O_TRUNC:
1044 		e = AUE_OPEN_RT;
1045 		break;
1046 	case O_RDONLY | O_TRUNC | O_CREAT:
1047 		e = AUE_OPEN_RTC;
1048 		break;
1049 	case O_WRONLY:
1050 		e = AUE_OPEN_W;
1051 		break;
1052 	case O_WRONLY | O_CREAT:
1053 		e = AUE_OPEN_WC;
1054 		break;
1055 	case O_WRONLY | O_TRUNC:
1056 		e = AUE_OPEN_WT;
1057 		break;
1058 	case O_WRONLY | O_TRUNC | O_CREAT:
1059 		e = AUE_OPEN_WTC;
1060 		break;
1061 	case O_RDWR:
1062 		e = AUE_OPEN_RW;
1063 		break;
1064 	case O_RDWR | O_CREAT:
1065 		e = AUE_OPEN_RWC;
1066 		break;
1067 	case O_RDWR | O_TRUNC:
1068 		e = AUE_OPEN_RWT;
1069 		break;
1070 	case O_RDWR | O_TRUNC | O_CREAT:
1071 		e = AUE_OPEN_RWTC;
1072 		break;
1073 	case O_SEARCH:
1074 		e = AUE_OPEN_S;
1075 		break;
1076 	case O_EXEC:
1077 		e = AUE_OPEN_E;
1078 		break;
1079 	default:
1080 		e = AUE_NULL;
1081 		break;
1082 	}
1083 
1084 	return (e);
1085 }
1086 
1087 /* ARGSUSED */
1088 static au_event_t
aui_open(au_event_t e)1089 aui_open(au_event_t e)
1090 {
1091 	klwp_t *clwp = ttolwp(curthread);
1092 	uint_t fm;
1093 
1094 	struct a {
1095 		long	fnamep;		/* char	* */
1096 		long	fmode;
1097 		long	cmode;
1098 	} *uap = (struct a *)clwp->lwp_ap;
1099 
1100 	fm = (uint_t)uap->fmode;
1101 
1102 	return (open_event(fm));
1103 }
1104 
1105 static void
aus_open(struct t_audit_data * tad)1106 aus_open(struct t_audit_data *tad)
1107 {
1108 	klwp_t *clwp = ttolwp(curthread);
1109 	uint_t fm;
1110 
1111 	struct a {
1112 		long	fnamep;		/* char	* */
1113 		long	fmode;
1114 		long	cmode;
1115 	} *uap = (struct a *)clwp->lwp_ap;
1116 
1117 	fm = (uint_t)uap->fmode;
1118 
1119 	/* If no write, create, or trunc modes, mark as a public op */
1120 	if ((fm & (O_RDONLY|O_WRONLY|O_RDWR|O_CREAT|O_TRUNC)) == O_RDONLY)
1121 		tad->tad_ctrl |= TAD_PUBLIC_EV;
1122 }
1123 
1124 /* ARGSUSED */
1125 static au_event_t
aui_openat(au_event_t e)1126 aui_openat(au_event_t e)
1127 {
1128 	t_audit_data_t *tad = T2A(curthread);
1129 	klwp_t *clwp = ttolwp(curthread);
1130 	uint_t fm;
1131 
1132 	struct a {
1133 		long	filedes;
1134 		long	fnamep;		/* char	* */
1135 		long	fmode;
1136 		long	cmode;
1137 	} *uap = (struct a *)clwp->lwp_ap;
1138 
1139 	fm = (uint_t)uap->fmode;
1140 
1141 	/*
1142 	 * __openattrdirat() does an extra pathname lookup in order to
1143 	 * enter the extended system attribute namespace of the referenced
1144 	 * extended attribute filename.
1145 	 */
1146 	if (fm & FXATTRDIROPEN)
1147 		tad->tad_ctrl |= TAD_MLD;
1148 
1149 	return (open_event(fm));
1150 }
1151 
1152 static void
aus_openat(struct t_audit_data * tad)1153 aus_openat(struct t_audit_data *tad)
1154 {
1155 	klwp_t *clwp = ttolwp(curthread);
1156 	uint_t fm;
1157 
1158 	struct a {
1159 		long	filedes;
1160 		long	fnamep;		/* char	* */
1161 		long	fmode;
1162 		long	cmode;
1163 	} *uap = (struct a *)clwp->lwp_ap;
1164 
1165 	fm = (uint_t)uap->fmode;
1166 
1167 	/* If no write, create, or trunc modes, mark as a public op */
1168 	if ((fm & (O_RDONLY|O_WRONLY|O_RDWR|O_CREAT|O_TRUNC)) == O_RDONLY)
1169 		tad->tad_ctrl |= TAD_PUBLIC_EV;
1170 }
1171 
1172 static au_event_t
aui_unlinkat(au_event_t e)1173 aui_unlinkat(au_event_t e)
1174 {
1175 	klwp_t *clwp = ttolwp(curthread);
1176 
1177 	struct a {
1178 		long	filedes;
1179 		long	fnamep;		/* char	* */
1180 		long	flags;
1181 	} *uap = (struct a *)clwp->lwp_ap;
1182 
1183 	if (uap->flags & AT_REMOVEDIR)
1184 		e = AUE_RMDIR;
1185 	else
1186 		e = AUE_UNLINK;
1187 
1188 	return (e);
1189 }
1190 
1191 static au_event_t
aui_fstatat(au_event_t e)1192 aui_fstatat(au_event_t e)
1193 {
1194 	klwp_t *clwp = ttolwp(curthread);
1195 
1196 	struct a {
1197 		long	filedes;
1198 		long	fnamep;		/* char	* */
1199 		long	statb;
1200 		long	flags;
1201 	} *uap = (struct a *)clwp->lwp_ap;
1202 
1203 	if (uap->fnamep == 0)
1204 		e = AUE_FSTAT;
1205 	else if (uap->flags & AT_SYMLINK_NOFOLLOW)
1206 		e = AUE_LSTAT;
1207 	else
1208 		e = AUE_STAT;
1209 
1210 	return (e);
1211 }
1212 
1213 /* msgsys */
1214 static au_event_t
aui_msgsys(au_event_t e)1215 aui_msgsys(au_event_t e)
1216 {
1217 	klwp_t *clwp = ttolwp(curthread);
1218 	uint_t fm;
1219 
1220 	struct a {
1221 		long	id;	/* function code id */
1222 		long	ap;	/* arg pointer for recvmsg */
1223 	} *uap = (struct a *)clwp->lwp_ap;
1224 
1225 	struct b {
1226 		long	msgid;
1227 		long	cmd;
1228 		long	buf;	/* struct msqid_ds * */
1229 	} *uap1 = (struct b *)&clwp->lwp_ap[1];
1230 
1231 	fm  = (uint_t)uap->id;
1232 
1233 	switch (fm) {
1234 	case 0:		/* msgget */
1235 		e = AUE_MSGGET;
1236 		break;
1237 	case 1:		/* msgctl */
1238 		switch ((uint_t)uap1->cmd) {
1239 		case IPC_RMID:
1240 			e = AUE_MSGCTL_RMID;
1241 			break;
1242 		case IPC_SET:
1243 			e = AUE_MSGCTL_SET;
1244 			break;
1245 		case IPC_STAT:
1246 			e = AUE_MSGCTL_STAT;
1247 			break;
1248 		default:
1249 			e = AUE_MSGCTL;
1250 			break;
1251 		}
1252 		break;
1253 	case 2:		/* msgrcv */
1254 		e = AUE_MSGRCV;
1255 		break;
1256 	case 3:		/* msgsnd */
1257 		e = AUE_MSGSND;
1258 		break;
1259 	default:	/* illegal system call */
1260 		e = AUE_NULL;
1261 		break;
1262 	}
1263 
1264 	return (e);
1265 }
1266 
1267 
1268 /* shmsys */
1269 static au_event_t
aui_shmsys(au_event_t e)1270 aui_shmsys(au_event_t e)
1271 {
1272 	klwp_t *clwp = ttolwp(curthread);
1273 	int fm;
1274 
1275 	struct a {		/* shmsys */
1276 		long	id;	/* function code id */
1277 	} *uap = (struct a *)clwp->lwp_ap;
1278 
1279 	struct b {		/* ctrl */
1280 		long	shmid;
1281 		long	cmd;
1282 		long	arg;		/* struct shmid_ds * */
1283 	} *uap1 = (struct b *)&clwp->lwp_ap[1];
1284 	fm  = (uint_t)uap->id;
1285 
1286 	switch (fm) {
1287 	case 0:		/* shmat */
1288 		e = AUE_SHMAT;
1289 		break;
1290 	case 1:		/* shmctl */
1291 		switch ((uint_t)uap1->cmd) {
1292 		case IPC_RMID:
1293 			e = AUE_SHMCTL_RMID;
1294 			break;
1295 		case IPC_SET:
1296 			e = AUE_SHMCTL_SET;
1297 			break;
1298 		case IPC_STAT:
1299 			e = AUE_SHMCTL_STAT;
1300 			break;
1301 		default:
1302 			e = AUE_SHMCTL;
1303 			break;
1304 		}
1305 		break;
1306 	case 2:		/* shmdt */
1307 		e = AUE_SHMDT;
1308 		break;
1309 	case 3:		/* shmget */
1310 		e = AUE_SHMGET;
1311 		break;
1312 	default:	/* illegal system call */
1313 		e = AUE_NULL;
1314 		break;
1315 	}
1316 
1317 	return (e);
1318 }
1319 
1320 
1321 /* semsys */
1322 static au_event_t
aui_semsys(au_event_t e)1323 aui_semsys(au_event_t e)
1324 {
1325 	klwp_t *clwp = ttolwp(curthread);
1326 	uint_t fm;
1327 
1328 	struct a {		/* semsys */
1329 		long	id;
1330 	} *uap = (struct a *)clwp->lwp_ap;
1331 
1332 	struct b {		/* ctrl */
1333 		long	semid;
1334 		long	semnum;
1335 		long	cmd;
1336 		long	arg;
1337 	} *uap1 = (struct b *)&clwp->lwp_ap[1];
1338 
1339 	fm = (uint_t)uap->id;
1340 
1341 	switch (fm) {
1342 	case 0:		/* semctl */
1343 		switch ((uint_t)uap1->cmd) {
1344 		case IPC_RMID:
1345 			e = AUE_SEMCTL_RMID;
1346 			break;
1347 		case IPC_SET:
1348 			e = AUE_SEMCTL_SET;
1349 			break;
1350 		case IPC_STAT:
1351 			e = AUE_SEMCTL_STAT;
1352 			break;
1353 		case GETNCNT:
1354 			e = AUE_SEMCTL_GETNCNT;
1355 			break;
1356 		case GETPID:
1357 			e = AUE_SEMCTL_GETPID;
1358 			break;
1359 		case GETVAL:
1360 			e = AUE_SEMCTL_GETVAL;
1361 			break;
1362 		case GETALL:
1363 			e = AUE_SEMCTL_GETALL;
1364 			break;
1365 		case GETZCNT:
1366 			e = AUE_SEMCTL_GETZCNT;
1367 			break;
1368 		case SETVAL:
1369 			e = AUE_SEMCTL_SETVAL;
1370 			break;
1371 		case SETALL:
1372 			e = AUE_SEMCTL_SETALL;
1373 			break;
1374 		default:
1375 			e = AUE_SEMCTL;
1376 			break;
1377 		}
1378 		break;
1379 	case 1:		/* semget */
1380 		e = AUE_SEMGET;
1381 		break;
1382 	case 2:		/* semop */
1383 		e = AUE_SEMOP;
1384 		break;
1385 	default:	/* illegal system call */
1386 		e = AUE_NULL;
1387 		break;
1388 	}
1389 
1390 	return (e);
1391 }
1392 
1393 /* utssys - uname(2), ustat(2), fusers(2) */
1394 static au_event_t
aui_utssys(au_event_t e)1395 aui_utssys(au_event_t e)
1396 {
1397 	klwp_t *clwp = ttolwp(curthread);
1398 	uint_t type;
1399 
1400 	struct a {
1401 		union {
1402 			long	cbuf;		/* char * */
1403 			long	ubuf;		/* struct stat * */
1404 		} ub;
1405 		union {
1406 			long	mv;	/* for USTAT */
1407 			long	flags;	/* for FUSERS */
1408 		} un;
1409 		long	type;
1410 		long	outbp;		/* char * for FUSERS */
1411 	} *uap = (struct a *)clwp->lwp_ap;
1412 
1413 	type = (uint_t)uap->type;
1414 
1415 	if (type == UTS_FUSERS)
1416 		return (e);
1417 	else
1418 		return ((au_event_t)AUE_NULL);
1419 }
1420 
1421 static au_event_t
aui_fcntl(au_event_t e)1422 aui_fcntl(au_event_t e)
1423 {
1424 	klwp_t *clwp = ttolwp(curthread);
1425 	uint_t cmd;
1426 
1427 	struct a {
1428 		long	fdes;
1429 		long	cmd;
1430 		long	arg;
1431 	} *uap = (struct a *)clwp->lwp_ap;
1432 
1433 	cmd = (uint_t)uap->cmd;
1434 
1435 	switch (cmd) {
1436 	case F_GETLK:
1437 	case F_SETLK:
1438 	case F_SETLKW:
1439 		break;
1440 	case F_SETFL:
1441 	case F_GETFL:
1442 	case F_GETFD:
1443 		break;
1444 	default:
1445 		e = (au_event_t)AUE_NULL;
1446 		break;
1447 	}
1448 	return ((au_event_t)e);
1449 }
1450 
1451 /* null function for now */
1452 static au_event_t
aui_execve(au_event_t e)1453 aui_execve(au_event_t e)
1454 {
1455 	return (e);
1456 }
1457 
1458 /*ARGSUSED*/
1459 static void
aus_fcntl(struct t_audit_data * tad)1460 aus_fcntl(struct t_audit_data *tad)
1461 {
1462 	klwp_t *clwp = ttolwp(curthread);
1463 	uint32_t cmd, fd, flags;
1464 	struct file  *fp;
1465 	struct vnode *vp;
1466 	struct f_audit_data *fad;
1467 
1468 	struct a {
1469 		long	fd;
1470 		long	cmd;
1471 		long	arg;
1472 	} *uap = (struct a *)clwp->lwp_ap;
1473 
1474 	cmd	= (uint32_t)uap->cmd;
1475 	fd	= (uint32_t)uap->fd;
1476 	flags	= (uint32_t)uap->arg;
1477 
1478 	au_uwrite(au_to_arg32(2, "cmd", cmd));
1479 
1480 	if (cmd == F_SETFL)
1481 		au_uwrite(au_to_arg32(3, "flags", flags));
1482 
1483 		/*
1484 		 * convert file pointer to file descriptor
1485 		 *   Note: fd ref count incremented here.
1486 		 */
1487 	if ((fp = getf(fd)) == NULL)
1488 		return;
1489 
1490 	/* get path from file struct here */
1491 	fad = F2A(fp);
1492 	if (fad->fad_aupath != NULL) {
1493 		au_uwrite(au_to_path(fad->fad_aupath));
1494 	} else {
1495 		au_uwrite(au_to_arg32(1, "no path: fd", fd));
1496 	}
1497 
1498 	vp = fp->f_vnode;
1499 	audit_attributes(vp);
1500 
1501 	/* decrement file descriptor reference count */
1502 	releasef(fd);
1503 }
1504 
1505 /*ARGSUSED*/
1506 static void
aus_kill(struct t_audit_data * tad)1507 aus_kill(struct t_audit_data *tad)
1508 {
1509 	klwp_t *clwp = ttolwp(curthread);
1510 	struct proc *p;
1511 	uint32_t signo;
1512 	uid_t uid, ruid;
1513 	gid_t gid, rgid;
1514 	pid_t pid;
1515 	const auditinfo_addr_t *ainfo;
1516 	cred_t *cr;
1517 
1518 	struct a {
1519 		long	pid;
1520 		long	signo;
1521 	} *uap = (struct a *)clwp->lwp_ap;
1522 
1523 	pid   = (pid_t)uap->pid;
1524 	signo = (uint32_t)uap->signo;
1525 
1526 	au_uwrite(au_to_arg32(2, "signal", signo));
1527 	if (pid > 0) {
1528 		mutex_enter(&pidlock);
1529 		if (((p = prfind(pid)) == (struct proc *)0) ||
1530 		    (p->p_stat == SIDL)) {
1531 			mutex_exit(&pidlock);
1532 			au_uwrite(au_to_arg32(1, "process", (uint32_t)pid));
1533 			return;
1534 		}
1535 		mutex_enter(&p->p_lock); /* so process doesn't go away */
1536 		mutex_exit(&pidlock);
1537 
1538 		mutex_enter(&p->p_crlock);
1539 		crhold(cr = p->p_cred);
1540 		mutex_exit(&p->p_crlock);
1541 		mutex_exit(&p->p_lock);
1542 
1543 		ainfo = crgetauinfo(cr);
1544 		if (ainfo == NULL) {
1545 			crfree(cr);
1546 			au_uwrite(au_to_arg32(1, "process", (uint32_t)pid));
1547 			return;
1548 		}
1549 
1550 		uid  = crgetuid(cr);
1551 		gid  = crgetgid(cr);
1552 		ruid = crgetruid(cr);
1553 		rgid = crgetrgid(cr);
1554 		au_uwrite(au_to_process(uid, gid, ruid, rgid, pid,
1555 		    ainfo->ai_auid, ainfo->ai_asid, &ainfo->ai_termid));
1556 
1557 		if (is_system_labeled())
1558 			au_uwrite(au_to_label(CR_SL(cr)));
1559 
1560 		crfree(cr);
1561 	}
1562 	else
1563 		au_uwrite(au_to_arg32(1, "process", (uint32_t)pid));
1564 }
1565 
1566 /*ARGSUSED*/
1567 static void
aus_mkdir(struct t_audit_data * tad)1568 aus_mkdir(struct t_audit_data *tad)
1569 {
1570 	klwp_t *clwp = ttolwp(curthread);
1571 	uint32_t dmode;
1572 
1573 	struct a {
1574 		long	dirnamep;		/* char * */
1575 		long	dmode;
1576 	} *uap = (struct a *)clwp->lwp_ap;
1577 
1578 	dmode = (uint32_t)uap->dmode;
1579 
1580 	au_uwrite(au_to_arg32(2, "mode", dmode));
1581 }
1582 
1583 /*ARGSUSED*/
1584 static void
aus_mkdirat(struct t_audit_data * tad)1585 aus_mkdirat(struct t_audit_data *tad)
1586 {
1587 	klwp_t *clwp = ttolwp(curthread);
1588 	uint32_t dmode;
1589 
1590 	struct a {
1591 		long	fd;
1592 		long	dirnamep;		/* char * */
1593 		long	dmode;
1594 	} *uap = (struct a *)clwp->lwp_ap;
1595 
1596 	dmode = (uint32_t)uap->dmode;
1597 
1598 	au_uwrite(au_to_arg32(2, "mode", dmode));
1599 }
1600 
1601 /*ARGSUSED*/
1602 static void
aus_mknod(struct t_audit_data * tad)1603 aus_mknod(struct t_audit_data *tad)
1604 {
1605 	klwp_t *clwp = ttolwp(curthread);
1606 	uint32_t fmode;
1607 	dev_t dev;
1608 
1609 	struct a {
1610 		long	pnamep;		/* char * */
1611 		long	fmode;
1612 		long	dev;
1613 	} *uap = (struct a *)clwp->lwp_ap;
1614 
1615 	fmode = (uint32_t)uap->fmode;
1616 	dev   = (dev_t)uap->dev;
1617 
1618 	au_uwrite(au_to_arg32(2, "mode", fmode));
1619 #ifdef _LP64
1620 	au_uwrite(au_to_arg64(3, "dev", dev));
1621 #else
1622 	au_uwrite(au_to_arg32(3, "dev", dev));
1623 #endif
1624 }
1625 
1626 /*ARGSUSED*/
1627 static void
auf_mknod(struct t_audit_data * tad,int error,rval_t * rval)1628 auf_mknod(struct t_audit_data *tad, int error, rval_t *rval)
1629 {
1630 	klwp_t *clwp = ttolwp(curthread);
1631 	vnode_t	*dvp;
1632 	caddr_t pnamep;
1633 
1634 	struct a {
1635 		long	pnamep;		/* char * */
1636 		long	fmode;
1637 		long	dev;
1638 	} *uap = (struct a *)clwp->lwp_ap;
1639 
1640 	/* no error, then already path token in audit record */
1641 	if (error != EPERM && error != EINVAL)
1642 		return;
1643 
1644 	/* do the lookup to force generation of path token */
1645 	pnamep = (caddr_t)uap->pnamep;
1646 	tad->tad_ctrl |= TAD_NOATTRB;
1647 	error = lookupname(pnamep, UIO_USERSPACE, NO_FOLLOW, &dvp, NULLVPP);
1648 	if (error == 0)
1649 		VN_RELE(dvp);
1650 }
1651 
1652 /*ARGSUSED*/
1653 static void
aus_mknodat(struct t_audit_data * tad)1654 aus_mknodat(struct t_audit_data *tad)
1655 {
1656 	klwp_t *clwp = ttolwp(curthread);
1657 	uint32_t fmode;
1658 	dev_t dev;
1659 
1660 	struct a {
1661 		long	fd;
1662 		long	pnamep;		/* char * */
1663 		long	fmode;
1664 		long	dev;
1665 	} *uap = (struct a *)clwp->lwp_ap;
1666 
1667 	fmode = (uint32_t)uap->fmode;
1668 	dev   = (dev_t)uap->dev;
1669 
1670 	au_uwrite(au_to_arg32(2, "mode", fmode));
1671 #ifdef _LP64
1672 	au_uwrite(au_to_arg64(3, "dev", dev));
1673 #else
1674 	au_uwrite(au_to_arg32(3, "dev", dev));
1675 #endif
1676 }
1677 
1678 /*ARGSUSED*/
1679 static void
auf_mknodat(struct t_audit_data * tad,int error,rval_t * rval)1680 auf_mknodat(struct t_audit_data *tad, int error, rval_t *rval)
1681 {
1682 	klwp_t *clwp = ttolwp(curthread);
1683 	vnode_t	*startvp;
1684 	vnode_t	*dvp;
1685 	caddr_t pnamep;
1686 	int fd;
1687 
1688 	struct a {
1689 		long	fd;
1690 		long	pnamep;		/* char * */
1691 		long	fmode;
1692 		long	dev;
1693 	} *uap = (struct a *)clwp->lwp_ap;
1694 
1695 	/* no error, then already path token in audit record */
1696 	if (error != EPERM && error != EINVAL)
1697 		return;
1698 
1699 	/* do the lookup to force generation of path token */
1700 	fd = (int)uap->fd;
1701 	pnamep = (caddr_t)uap->pnamep;
1702 	if (pnamep == NULL ||
1703 	    fgetstartvp(fd, pnamep, &startvp) != 0)
1704 		return;
1705 	tad->tad_ctrl |= TAD_NOATTRB;
1706 	error = lookupnameat(pnamep, UIO_USERSPACE, NO_FOLLOW, &dvp, NULLVPP,
1707 	    startvp);
1708 	if (error == 0)
1709 		VN_RELE(dvp);
1710 	if (startvp != NULL)
1711 		VN_RELE(startvp);
1712 }
1713 
1714 /*ARGSUSED*/
1715 static void
aus_mount(struct t_audit_data * tad)1716 aus_mount(struct t_audit_data *tad)
1717 {
1718 	/* AUS_START */
1719 	klwp_t *clwp = ttolwp(curthread);
1720 	uint32_t flags;
1721 	uintptr_t u_fstype, dataptr;
1722 	STRUCT_DECL(nfs_args, nfsargs);
1723 	size_t len;
1724 	char *fstype, *hostname;
1725 
1726 	struct a {
1727 		long	spec;		/* char    * */
1728 		long	dir;		/* char    * */
1729 		long	flags;
1730 		long	fstype;		/* char    * */
1731 		long	dataptr;	/* char    * */
1732 		long	datalen;
1733 	} *uap = (struct a *)clwp->lwp_ap;
1734 
1735 	u_fstype = (uintptr_t)uap->fstype;
1736 	flags    = (uint32_t)uap->flags;
1737 	dataptr  = (uintptr_t)uap->dataptr;
1738 
1739 	fstype = kmem_alloc(MAXNAMELEN, KM_SLEEP);
1740 	if (copyinstr((caddr_t)u_fstype, (caddr_t)fstype, MAXNAMELEN, &len))
1741 		goto mount_free_fstype;
1742 
1743 	au_uwrite(au_to_arg32(3, "flags", flags));
1744 	au_uwrite(au_to_text(fstype));
1745 
1746 	if (strncmp(fstype, "nfs", 3) == 0) {
1747 
1748 		STRUCT_INIT(nfsargs, get_udatamodel());
1749 		bzero(STRUCT_BUF(nfsargs), STRUCT_SIZE(nfsargs));
1750 
1751 		if (copyin((caddr_t)dataptr, STRUCT_BUF(nfsargs),
1752 		    MIN(uap->datalen, STRUCT_SIZE(nfsargs)))) {
1753 			/* DEBUG debug_enter((char *)NULL); */
1754 			goto mount_free_fstype;
1755 		}
1756 		hostname = kmem_alloc(MAXNAMELEN, KM_SLEEP);
1757 		if (copyinstr(STRUCT_FGETP(nfsargs, hostname),
1758 		    (caddr_t)hostname, MAXNAMELEN, &len)) {
1759 			goto mount_free_hostname;
1760 		}
1761 		au_uwrite(au_to_text(hostname));
1762 		au_uwrite(au_to_arg32(3, "internal flags",
1763 		    (uint_t)STRUCT_FGET(nfsargs, flags)));
1764 
1765 mount_free_hostname:
1766 		kmem_free(hostname, MAXNAMELEN);
1767 	}
1768 
1769 mount_free_fstype:
1770 	kmem_free(fstype, MAXNAMELEN);
1771 }	/* AUS_MOUNT */
1772 
1773 static void
aus_umount_path(caddr_t umount_dir)1774 aus_umount_path(caddr_t umount_dir)
1775 {
1776 	char			*dir_path;
1777 	struct audit_path	*path;
1778 	size_t			path_len, dir_len;
1779 
1780 	/* length alloc'd for two string pointers */
1781 	path_len = sizeof (struct audit_path) + sizeof (char *);
1782 	path = kmem_alloc(path_len, KM_SLEEP);
1783 	dir_path = kmem_alloc(MAXPATHLEN, KM_SLEEP);
1784 
1785 	if (copyinstr(umount_dir, (caddr_t)dir_path,
1786 	    MAXPATHLEN, &dir_len))
1787 		goto umount2_free_dir;
1788 
1789 	/*
1790 	 * the audit_path struct assumes that the buffer pointed to
1791 	 * by audp_sect[n] contains string 0 immediatedly followed
1792 	 * by string 1.
1793 	 */
1794 	path->audp_sect[0] = dir_path;
1795 	path->audp_sect[1] = dir_path + strlen(dir_path) + 1;
1796 	path->audp_size = path_len;
1797 	path->audp_ref = 1;		/* not used */
1798 	path->audp_cnt = 1;		/* one path string */
1799 
1800 	au_uwrite(au_to_path(path));
1801 
1802 umount2_free_dir:
1803 	kmem_free(dir_path, MAXPATHLEN);
1804 	kmem_free(path, path_len);
1805 }
1806 
1807 /*ARGSUSED*/
1808 static void
aus_umount2(struct t_audit_data * tad)1809 aus_umount2(struct t_audit_data *tad)
1810 {
1811 	klwp_t			*clwp = ttolwp(curthread);
1812 	struct a {
1813 		long	dir;		/* char    * */
1814 		long	flags;
1815 	} *uap = (struct a *)clwp->lwp_ap;
1816 
1817 	aus_umount_path((caddr_t)uap->dir);
1818 
1819 	au_uwrite(au_to_arg32(2, "flags", (uint32_t)uap->flags));
1820 }
1821 
1822 static void
aus_msgsys(struct t_audit_data * tad)1823 aus_msgsys(struct t_audit_data *tad)
1824 {
1825 	klwp_t *clwp = ttolwp(curthread);
1826 	uint32_t msgid;
1827 
1828 	struct b {
1829 		long	msgid;
1830 		long	cmd;
1831 		long	buf;		/* struct msqid_ds * */
1832 	} *uap1 = (struct b *)&clwp->lwp_ap[1];
1833 
1834 	msgid = (uint32_t)uap1->msgid;
1835 
1836 
1837 	switch (tad->tad_event) {
1838 	case AUE_MSGGET:		/* msgget */
1839 		au_uwrite(au_to_arg32(1, "msg key", msgid));
1840 		break;
1841 	case AUE_MSGCTL:		/* msgctl */
1842 	case AUE_MSGCTL_RMID:		/* msgctl */
1843 	case AUE_MSGCTL_SET:		/* msgctl */
1844 	case AUE_MSGCTL_STAT:		/* msgctl */
1845 	case AUE_MSGRCV:		/* msgrcv */
1846 	case AUE_MSGSND:		/* msgsnd */
1847 		au_uwrite(au_to_arg32(1, "msg ID", msgid));
1848 		break;
1849 	}
1850 }
1851 
1852 /*ARGSUSED*/
1853 static void
auf_msgsys(struct t_audit_data * tad,int error,rval_t * rval)1854 auf_msgsys(struct t_audit_data *tad, int error, rval_t *rval)
1855 {
1856 	int id;
1857 
1858 	if (error != 0)
1859 		return;
1860 	if (tad->tad_event == AUE_MSGGET) {
1861 		uint32_t scid;
1862 		uint32_t sy_flags;
1863 
1864 		/* need to determine type of executing binary */
1865 		scid = tad->tad_scid;
1866 #ifdef _SYSCALL32_IMPL
1867 		if (lwp_getdatamodel(ttolwp(curthread)) == DATAMODEL_NATIVE)
1868 			sy_flags = sysent[scid].sy_flags & SE_RVAL_MASK;
1869 		else
1870 			sy_flags = sysent32[scid].sy_flags & SE_RVAL_MASK;
1871 #else
1872 		sy_flags = sysent[scid].sy_flags & SE_RVAL_MASK;
1873 #endif
1874 		if (sy_flags == SE_32RVAL1)
1875 			id = rval->r_val1;
1876 		if (sy_flags == (SE_32RVAL2|SE_32RVAL1))
1877 			id = rval->r_val1;
1878 		if (sy_flags == SE_64RVAL)
1879 			id = (int)rval->r_vals;
1880 
1881 		au_uwrite(au_to_ipc(AT_IPC_MSG, id));
1882 	}
1883 }
1884 
1885 static void
aus_semsys(struct t_audit_data * tad)1886 aus_semsys(struct t_audit_data *tad)
1887 {
1888 	klwp_t *clwp = ttolwp(curthread);
1889 	uint32_t semid;
1890 
1891 	struct b {		/* ctrl */
1892 		long	semid;
1893 		long	semnum;
1894 		long	cmd;
1895 		long	arg;
1896 	} *uap1 = (struct b *)&clwp->lwp_ap[1];
1897 
1898 	semid = (uint32_t)uap1->semid;
1899 
1900 	switch (tad->tad_event) {
1901 	case AUE_SEMCTL_RMID:
1902 	case AUE_SEMCTL_STAT:
1903 	case AUE_SEMCTL_GETNCNT:
1904 	case AUE_SEMCTL_GETPID:
1905 	case AUE_SEMCTL_GETVAL:
1906 	case AUE_SEMCTL_GETALL:
1907 	case AUE_SEMCTL_GETZCNT:
1908 	case AUE_SEMCTL_SET:
1909 	case AUE_SEMCTL_SETVAL:
1910 	case AUE_SEMCTL_SETALL:
1911 	case AUE_SEMCTL:
1912 	case AUE_SEMOP:
1913 		au_uwrite(au_to_arg32(1, "sem ID", semid));
1914 		break;
1915 	case AUE_SEMGET:
1916 		au_uwrite(au_to_arg32(1, "sem key", semid));
1917 		break;
1918 	}
1919 }
1920 
1921 /*ARGSUSED*/
1922 static void
auf_semsys(struct t_audit_data * tad,int error,rval_t * rval)1923 auf_semsys(struct t_audit_data *tad, int error, rval_t *rval)
1924 {
1925 	int id;
1926 
1927 	if (error != 0)
1928 		return;
1929 	if (tad->tad_event == AUE_SEMGET) {
1930 		uint32_t scid;
1931 		uint32_t sy_flags;
1932 
1933 		/* need to determine type of executing binary */
1934 		scid = tad->tad_scid;
1935 #ifdef _SYSCALL32_IMPL
1936 		if (lwp_getdatamodel(ttolwp(curthread)) == DATAMODEL_NATIVE)
1937 			sy_flags = sysent[scid].sy_flags & SE_RVAL_MASK;
1938 		else
1939 			sy_flags = sysent32[scid].sy_flags & SE_RVAL_MASK;
1940 #else
1941 		sy_flags = sysent[scid].sy_flags & SE_RVAL_MASK;
1942 #endif
1943 		if (sy_flags == SE_32RVAL1)
1944 			id = rval->r_val1;
1945 		if (sy_flags == (SE_32RVAL2|SE_32RVAL1))
1946 			id = rval->r_val1;
1947 		if (sy_flags == SE_64RVAL)
1948 			id = (int)rval->r_vals;
1949 
1950 		au_uwrite(au_to_ipc(AT_IPC_SEM, id));
1951 	}
1952 }
1953 
1954 /*ARGSUSED*/
1955 static void
aus_close(struct t_audit_data * tad)1956 aus_close(struct t_audit_data *tad)
1957 {
1958 	klwp_t *clwp = ttolwp(curthread);
1959 	uint32_t fd;
1960 	struct file *fp;
1961 	struct f_audit_data *fad;
1962 	struct vnode *vp;
1963 	struct vattr attr;
1964 	au_kcontext_t	*kctx = GET_KCTX_PZ;
1965 
1966 	struct a {
1967 		long	i;
1968 	} *uap = (struct a *)clwp->lwp_ap;
1969 
1970 	fd = (uint32_t)uap->i;
1971 
1972 	attr.va_mask = 0;
1973 	au_uwrite(au_to_arg32(1, "fd", fd));
1974 
1975 		/*
1976 		 * convert file pointer to file descriptor
1977 		 *   Note: fd ref count incremented here.
1978 		 */
1979 	if ((fp = getf(fd)) == NULL)
1980 		return;
1981 
1982 	fad = F2A(fp);
1983 	tad->tad_evmod = (au_emod_t)fad->fad_flags;
1984 	if (fad->fad_aupath != NULL) {
1985 		au_uwrite(au_to_path(fad->fad_aupath));
1986 		if ((vp = fp->f_vnode) != NULL) {
1987 			attr.va_mask = AT_ALL;
1988 			if (VOP_GETATTR(vp, &attr, 0, CRED(), NULL) == 0) {
1989 				/*
1990 				 * When write was not used and the file can be
1991 				 * considered public, skip the audit.
1992 				 */
1993 				if (((fp->f_flag & FWRITE) == 0) &&
1994 				    object_is_public(&attr)) {
1995 					tad->tad_flag = 0;
1996 					tad->tad_evmod = 0;
1997 					/* free any residual audit data */
1998 					au_close(kctx, &(u_ad), 0, 0, 0, NULL);
1999 					releasef(fd);
2000 					return;
2001 				}
2002 				au_uwrite(au_to_attr(&attr));
2003 				audit_sec_attributes(&(u_ad), vp);
2004 			}
2005 		}
2006 	}
2007 
2008 	/* decrement file descriptor reference count */
2009 	releasef(fd);
2010 }
2011 
2012 /*ARGSUSED*/
2013 static void
aus_fstatfs(struct t_audit_data * tad)2014 aus_fstatfs(struct t_audit_data *tad)
2015 {
2016 	klwp_t *clwp = ttolwp(curthread);
2017 	uint32_t fd;
2018 	struct file  *fp;
2019 	struct vnode *vp;
2020 	struct f_audit_data *fad;
2021 
2022 	struct a {
2023 		long	fd;
2024 		long	buf;		/* struct statfs * */
2025 	} *uap = (struct a *)clwp->lwp_ap;
2026 
2027 	fd = (uint_t)uap->fd;
2028 
2029 		/*
2030 		 * convert file pointer to file descriptor
2031 		 *   Note: fd ref count incremented here.
2032 		 */
2033 	if ((fp = getf(fd)) == NULL)
2034 		return;
2035 
2036 		/* get path from file struct here */
2037 	fad = F2A(fp);
2038 	if (fad->fad_aupath != NULL) {
2039 		au_uwrite(au_to_path(fad->fad_aupath));
2040 	} else {
2041 		au_uwrite(au_to_arg32(1, "no path: fd", fd));
2042 	}
2043 
2044 	vp = fp->f_vnode;
2045 	audit_attributes(vp);
2046 
2047 	/* decrement file descriptor reference count */
2048 	releasef(fd);
2049 }
2050 
2051 static au_event_t
aui_setpgrp(au_event_t e)2052 aui_setpgrp(au_event_t e)
2053 {
2054 	klwp_t *clwp = ttolwp(curthread);
2055 	int flag;
2056 
2057 	struct a {
2058 		long	flag;
2059 		long	pid;
2060 		long	pgid;
2061 	} *uap = (struct a *)clwp->lwp_ap;
2062 
2063 	flag = (int)uap->flag;
2064 
2065 
2066 	switch (flag) {
2067 
2068 	case 1:	/* setpgrp() */
2069 		e = AUE_SETPGRP;
2070 		break;
2071 
2072 	case 3: /* setsid() */
2073 		e = AUE_SETSID;
2074 		break;
2075 
2076 	case 5: /* setpgid() */
2077 		e = AUE_SETPGID;
2078 		break;
2079 
2080 	case 0: /* getpgrp()	- not security relevant */
2081 	case 2: /* getsid()	- not security relevant */
2082 	case 4: /* getpgid()	- not security relevant */
2083 		e = AUE_NULL;
2084 		break;
2085 
2086 	default:
2087 		e = AUE_NULL;
2088 		break;
2089 	}
2090 
2091 	return (e);
2092 }
2093 
2094 /*ARGSUSED*/
2095 static void
aus_setpgrp(struct t_audit_data * tad)2096 aus_setpgrp(struct t_audit_data *tad)
2097 {
2098 	klwp_t		*clwp = ttolwp(curthread);
2099 	pid_t		pgid;
2100 	struct proc	*p;
2101 	uid_t		uid, ruid;
2102 	gid_t		gid, rgid;
2103 	pid_t		pid;
2104 	cred_t		*cr;
2105 	int		flag;
2106 	const auditinfo_addr_t	*ainfo;
2107 
2108 	struct a {
2109 		long	flag;
2110 		long	pid;
2111 		long	pgid;
2112 	} *uap = (struct a *)clwp->lwp_ap;
2113 
2114 	flag = (int)uap->flag;
2115 	pid  = (pid_t)uap->pid;
2116 	pgid = (pid_t)uap->pgid;
2117 
2118 
2119 	switch (flag) {
2120 
2121 	case 0: /* getpgrp() */
2122 	case 1: /* setpgrp() */
2123 	case 2: /* getsid() */
2124 	case 3: /* setsid() */
2125 	case 4: /* getpgid() */
2126 		break;
2127 
2128 	case 5: /* setpgid() */
2129 
2130 		/* current process? */
2131 		if (pid == 0) {
2132 			return;
2133 		}
2134 
2135 		mutex_enter(&pidlock);
2136 		p = prfind(pid);
2137 		if (p == NULL || p->p_as == &kas ||
2138 		    p->p_stat == SIDL || p->p_stat == SZOMB) {
2139 			mutex_exit(&pidlock);
2140 			return;
2141 		}
2142 		mutex_enter(&p->p_lock);	/* so process doesn't go away */
2143 		mutex_exit(&pidlock);
2144 
2145 		mutex_enter(&p->p_crlock);
2146 		crhold(cr = p->p_cred);
2147 		mutex_exit(&p->p_crlock);
2148 		mutex_exit(&p->p_lock);
2149 
2150 		ainfo = crgetauinfo(cr);
2151 		if (ainfo == NULL) {
2152 			crfree(cr);
2153 			return;
2154 		}
2155 
2156 		uid  = crgetuid(cr);
2157 		gid  = crgetgid(cr);
2158 		ruid = crgetruid(cr);
2159 		rgid = crgetrgid(cr);
2160 		au_uwrite(au_to_process(uid, gid, ruid, rgid, pid,
2161 		    ainfo->ai_auid, ainfo->ai_asid, &ainfo->ai_termid));
2162 		crfree(cr);
2163 		au_uwrite(au_to_arg32(2, "pgid", pgid));
2164 		break;
2165 
2166 	default:
2167 		break;
2168 	}
2169 }
2170 
2171 
2172 /*ARGSUSED*/
2173 static void
aus_setregid(struct t_audit_data * tad)2174 aus_setregid(struct t_audit_data *tad)
2175 {
2176 	klwp_t *clwp = ttolwp(curthread);
2177 	uint32_t rgid, egid;
2178 
2179 	struct a {
2180 		long	 rgid;
2181 		long	 egid;
2182 	} *uap = (struct a *)clwp->lwp_ap;
2183 
2184 	rgid  = (uint32_t)uap->rgid;
2185 	egid  = (uint32_t)uap->egid;
2186 
2187 	au_uwrite(au_to_arg32(1, "rgid", rgid));
2188 	au_uwrite(au_to_arg32(2, "egid", egid));
2189 }
2190 
2191 /*ARGSUSED*/
2192 static void
aus_setgid(struct t_audit_data * tad)2193 aus_setgid(struct t_audit_data *tad)
2194 {
2195 	klwp_t *clwp = ttolwp(curthread);
2196 	uint32_t gid;
2197 
2198 	struct a {
2199 		long	gid;
2200 	} *uap = (struct a *)clwp->lwp_ap;
2201 
2202 	gid = (uint32_t)uap->gid;
2203 
2204 	au_uwrite(au_to_arg32(1, "gid", gid));
2205 }
2206 
2207 
2208 /*ARGSUSED*/
2209 static void
aus_setreuid(struct t_audit_data * tad)2210 aus_setreuid(struct t_audit_data *tad)
2211 {
2212 	klwp_t *clwp = ttolwp(curthread);
2213 	uint32_t ruid, euid;
2214 
2215 	struct a {
2216 		long	ruid;
2217 		long	euid;
2218 	} *uap = (struct a *)clwp->lwp_ap;
2219 
2220 	ruid = (uint32_t)uap->ruid;
2221 	euid  = (uint32_t)uap->euid;
2222 
2223 	au_uwrite(au_to_arg32(1, "ruid", ruid));
2224 	au_uwrite(au_to_arg32(2, "euid", euid));
2225 }
2226 
2227 
2228 /*ARGSUSED*/
2229 static void
aus_setuid(struct t_audit_data * tad)2230 aus_setuid(struct t_audit_data *tad)
2231 {
2232 	klwp_t *clwp = ttolwp(curthread);
2233 	uint32_t uid;
2234 
2235 	struct a {
2236 		long	uid;
2237 	} *uap = (struct a *)clwp->lwp_ap;
2238 
2239 	uid = (uint32_t)uap->uid;
2240 
2241 	au_uwrite(au_to_arg32(1, "uid", uid));
2242 }
2243 
2244 /*ARGSUSED*/
2245 static void
aus_shmsys(struct t_audit_data * tad)2246 aus_shmsys(struct t_audit_data *tad)
2247 {
2248 	klwp_t *clwp = ttolwp(curthread);
2249 	uint32_t id, cmd;
2250 
2251 	struct b {
2252 		long	id;
2253 		long	cmd;
2254 		long	buf;		/* struct shmid_ds * */
2255 	} *uap1 = (struct b *)&clwp->lwp_ap[1];
2256 
2257 	id  = (uint32_t)uap1->id;
2258 	cmd = (uint32_t)uap1->cmd;
2259 
2260 	switch (tad->tad_event) {
2261 	case AUE_SHMGET:			/* shmget */
2262 		au_uwrite(au_to_arg32(1, "shm key", id));
2263 		break;
2264 	case AUE_SHMCTL:			/* shmctl */
2265 	case AUE_SHMCTL_RMID:			/* shmctl */
2266 	case AUE_SHMCTL_STAT:			/* shmctl */
2267 	case AUE_SHMCTL_SET:			/* shmctl */
2268 		au_uwrite(au_to_arg32(1, "shm ID", id));
2269 		break;
2270 	case AUE_SHMDT:				/* shmdt */
2271 		au_uwrite(au_to_arg32(1, "shm adr", id));
2272 		break;
2273 	case AUE_SHMAT:				/* shmat */
2274 		au_uwrite(au_to_arg32(1, "shm ID", id));
2275 		au_uwrite(au_to_arg32(2, "shm adr", cmd));
2276 		break;
2277 	}
2278 }
2279 
2280 /*ARGSUSED*/
2281 static void
auf_shmsys(struct t_audit_data * tad,int error,rval_t * rval)2282 auf_shmsys(struct t_audit_data *tad, int error, rval_t *rval)
2283 {
2284 	int id;
2285 
2286 	if (error != 0)
2287 		return;
2288 	if (tad->tad_event == AUE_SHMGET) {
2289 		uint32_t scid;
2290 		uint32_t sy_flags;
2291 
2292 		/* need to determine type of executing binary */
2293 		scid = tad->tad_scid;
2294 #ifdef _SYSCALL32_IMPL
2295 		if (lwp_getdatamodel(ttolwp(curthread)) == DATAMODEL_NATIVE)
2296 			sy_flags = sysent[scid].sy_flags & SE_RVAL_MASK;
2297 		else
2298 			sy_flags = sysent32[scid].sy_flags & SE_RVAL_MASK;
2299 #else
2300 		sy_flags = sysent[scid].sy_flags & SE_RVAL_MASK;
2301 #endif
2302 		if (sy_flags == SE_32RVAL1)
2303 			id = rval->r_val1;
2304 		if (sy_flags == (SE_32RVAL2|SE_32RVAL1))
2305 			id = rval->r_val1;
2306 		if (sy_flags == SE_64RVAL)
2307 			id = (int)rval->r_vals;
2308 		au_uwrite(au_to_ipc(AT_IPC_SHM, id));
2309 	}
2310 }
2311 
2312 
2313 /*ARGSUSED*/
2314 static void
aus_ioctl(struct t_audit_data * tad)2315 aus_ioctl(struct t_audit_data *tad)
2316 {
2317 	klwp_t *clwp = ttolwp(curthread);
2318 	struct file *fp;
2319 	struct vnode *vp;
2320 	struct f_audit_data *fad;
2321 	uint32_t fd, cmd;
2322 	uintptr_t cmarg;
2323 
2324 	/* XX64 */
2325 	struct a {
2326 		long	fd;
2327 		long	cmd;
2328 		long	cmarg;		/* caddr_t */
2329 	} *uap = (struct a *)clwp->lwp_ap;
2330 
2331 	fd    = (uint32_t)uap->fd;
2332 	cmd   = (uint32_t)uap->cmd;
2333 	cmarg = (uintptr_t)uap->cmarg;
2334 
2335 		/*
2336 		 * convert file pointer to file descriptor
2337 		 *   Note: fd ref count incremented here.
2338 		 */
2339 	if ((fp = getf(fd)) == NULL) {
2340 		au_uwrite(au_to_arg32(1, "fd", fd));
2341 		au_uwrite(au_to_arg32(2, "cmd", cmd));
2342 #ifndef _LP64
2343 		au_uwrite(au_to_arg32(3, "arg", (uint32_t)cmarg));
2344 #else
2345 		au_uwrite(au_to_arg64(3, "arg", (uint64_t)cmarg));
2346 #endif
2347 		return;
2348 	}
2349 
2350 	/* get path from file struct here */
2351 	fad = F2A(fp);
2352 	if (fad->fad_aupath != NULL) {
2353 		au_uwrite(au_to_path(fad->fad_aupath));
2354 	} else {
2355 		au_uwrite(au_to_arg32(1, "no path: fd", fd));
2356 	}
2357 
2358 	vp = fp->f_vnode;
2359 	audit_attributes(vp);
2360 
2361 	/* decrement file descriptor reference count */
2362 	releasef(fd);
2363 
2364 	au_uwrite(au_to_arg32(2, "cmd", cmd));
2365 #ifndef _LP64
2366 	au_uwrite(au_to_arg32(3, "arg", (uint32_t)cmarg));
2367 #else
2368 	au_uwrite(au_to_arg64(3, "arg", (uint64_t)cmarg));
2369 #endif
2370 }
2371 
2372 /*
2373  * null function for memcntl for now. We might want to limit memcntl()
2374  * auditing to commands: MC_LOCKAS, MC_LOCK, MC_UNLOCKAS, MC_UNLOCK which
2375  * require privileges.
2376  */
2377 static au_event_t
aui_memcntl(au_event_t e)2378 aui_memcntl(au_event_t e)
2379 {
2380 	return (e);
2381 }
2382 
2383 /*ARGSUSED*/
2384 static au_event_t
aui_privsys(au_event_t e)2385 aui_privsys(au_event_t e)
2386 {
2387 	klwp_t *clwp = ttolwp(curthread);
2388 
2389 	struct a {
2390 		long	opcode;
2391 	} *uap = (struct a *)clwp->lwp_ap;
2392 
2393 	switch (uap->opcode) {
2394 	case PRIVSYS_SETPPRIV:
2395 		return (AUE_SETPPRIV);
2396 	default:
2397 		return (AUE_NULL);
2398 	}
2399 }
2400 
2401 /*ARGSUSED*/
2402 static void
aus_memcntl(struct t_audit_data * tad)2403 aus_memcntl(struct t_audit_data *tad)
2404 {
2405 	klwp_t *clwp = ttolwp(curthread);
2406 
2407 	struct a {
2408 		long	addr;
2409 		long	len;
2410 		long	cmd;
2411 		long	arg;
2412 		long	attr;
2413 		long	mask;
2414 	} *uap = (struct a *)clwp->lwp_ap;
2415 
2416 #ifdef _LP64
2417 	au_uwrite(au_to_arg64(1, "base", (uint64_t)uap->addr));
2418 	au_uwrite(au_to_arg64(2, "len", (uint64_t)uap->len));
2419 #else
2420 	au_uwrite(au_to_arg32(1, "base", (uint32_t)uap->addr));
2421 	au_uwrite(au_to_arg32(2, "len", (uint32_t)uap->len));
2422 #endif
2423 	au_uwrite(au_to_arg32(3, "cmd", (uint_t)uap->cmd));
2424 #ifdef _LP64
2425 	au_uwrite(au_to_arg64(4, "arg", (uint64_t)uap->arg));
2426 #else
2427 	au_uwrite(au_to_arg32(4, "arg", (uint32_t)uap->arg));
2428 #endif
2429 	au_uwrite(au_to_arg32(5, "attr", (uint_t)uap->attr));
2430 	au_uwrite(au_to_arg32(6, "mask", (uint_t)uap->mask));
2431 }
2432 
2433 /*ARGSUSED*/
2434 static void
aus_mmap(struct t_audit_data * tad)2435 aus_mmap(struct t_audit_data *tad)
2436 {
2437 	klwp_t *clwp = ttolwp(curthread);
2438 	struct file *fp;
2439 	struct f_audit_data *fad;
2440 	struct vnode *vp;
2441 	uint32_t fd;
2442 
2443 	struct a {
2444 		long	addr;
2445 		long	len;
2446 		long	prot;
2447 		long	flags;
2448 		long	fd;
2449 		long	pos;
2450 	} *uap = (struct a *)clwp->lwp_ap;
2451 
2452 	fd = (uint32_t)uap->fd;
2453 
2454 #ifdef _LP64
2455 	au_uwrite(au_to_arg64(1, "addr", (uint64_t)uap->addr));
2456 	au_uwrite(au_to_arg64(2, "len", (uint64_t)uap->len));
2457 #else
2458 	au_uwrite(au_to_arg32(1, "addr", (uint32_t)uap->addr));
2459 	au_uwrite(au_to_arg32(2, "len", (uint32_t)uap->len));
2460 #endif
2461 
2462 	if ((fp = getf(fd)) == NULL) {
2463 		au_uwrite(au_to_arg32(5, "fd", (uint32_t)uap->fd));
2464 		return;
2465 	}
2466 
2467 	/*
2468 	 * Mark in the tad if write access is NOT requested... if
2469 	 * this is later detected (in audit_attributes) to be a
2470 	 * public object, the mmap event may be discarded.
2471 	 */
2472 	if (((uap->prot) & PROT_WRITE) == 0) {
2473 		tad->tad_ctrl |= TAD_PUBLIC_EV;
2474 	}
2475 
2476 	fad = F2A(fp);
2477 	if (fad->fad_aupath != NULL) {
2478 		au_uwrite(au_to_path(fad->fad_aupath));
2479 	} else {
2480 		au_uwrite(au_to_arg32(1, "no path: fd", fd));
2481 	}
2482 
2483 	vp = (struct vnode *)fp->f_vnode;
2484 	audit_attributes(vp);
2485 
2486 	/* mark READ/WRITE since we can't predict access */
2487 	if (uap->prot & PROT_READ)
2488 		fad->fad_flags |= FAD_READ;
2489 	if (uap->prot & PROT_WRITE)
2490 		fad->fad_flags |= FAD_WRITE;
2491 
2492 	/* decrement file descriptor reference count */
2493 	releasef(fd);
2494 
2495 }	/* AUS_MMAP */
2496 
2497 
2498 
2499 
2500 /*ARGSUSED*/
2501 static void
aus_munmap(struct t_audit_data * tad)2502 aus_munmap(struct t_audit_data *tad)
2503 {
2504 	klwp_t *clwp = ttolwp(curthread);
2505 
2506 	struct a {
2507 		long	addr;
2508 		long	len;
2509 	} *uap = (struct a *)clwp->lwp_ap;
2510 
2511 #ifdef _LP64
2512 	au_uwrite(au_to_arg64(1, "addr", (uint64_t)uap->addr));
2513 	au_uwrite(au_to_arg64(2, "len", (uint64_t)uap->len));
2514 #else
2515 	au_uwrite(au_to_arg32(1, "addr", (uint32_t)uap->addr));
2516 	au_uwrite(au_to_arg32(2, "len", (uint32_t)uap->len));
2517 #endif
2518 
2519 }	/* AUS_MUNMAP */
2520 
2521 
2522 
2523 
2524 
2525 
2526 
2527 /*ARGSUSED*/
2528 static void
aus_priocntlsys(struct t_audit_data * tad)2529 aus_priocntlsys(struct t_audit_data *tad)
2530 {
2531 	klwp_t *clwp = ttolwp(curthread);
2532 
2533 	struct a {
2534 		long	pc_version;
2535 		long	psp;		/* procset_t */
2536 		long	cmd;
2537 		long	arg;
2538 	} *uap = (struct a *)clwp->lwp_ap;
2539 
2540 	au_uwrite(au_to_arg32(1, "pc_version", (uint32_t)uap->pc_version));
2541 	au_uwrite(au_to_arg32(3, "cmd", (uint32_t)uap->cmd));
2542 
2543 }	/* AUS_PRIOCNTLSYS */
2544 
2545 
2546 /*ARGSUSED*/
2547 static void
aus_setegid(struct t_audit_data * tad)2548 aus_setegid(struct t_audit_data *tad)
2549 {
2550 	klwp_t *clwp = ttolwp(curthread);
2551 	uint32_t gid;
2552 
2553 	struct a {
2554 		long	gid;
2555 	} *uap = (struct a *)clwp->lwp_ap;
2556 
2557 	gid = (uint32_t)uap->gid;
2558 
2559 	au_uwrite(au_to_arg32(1, "gid", gid));
2560 }	/* AUS_SETEGID */
2561 
2562 
2563 
2564 
2565 /*ARGSUSED*/
2566 static void
aus_setgroups(struct t_audit_data * tad)2567 aus_setgroups(struct t_audit_data *tad)
2568 {
2569 	klwp_t *clwp = ttolwp(curthread);
2570 	int i;
2571 	int gidsetsize;
2572 	uintptr_t gidset;
2573 	gid_t *gidlist;
2574 
2575 	struct a {
2576 		long	gidsetsize;
2577 		long	gidset;
2578 	} *uap = (struct a *)clwp->lwp_ap;
2579 
2580 	gidsetsize = (uint_t)uap->gidsetsize;
2581 	gidset = (uintptr_t)uap->gidset;
2582 
2583 	if ((gidsetsize > NGROUPS_MAX_DEFAULT) || (gidsetsize < 0))
2584 		return;
2585 	if (gidsetsize != 0) {
2586 		gidlist = kmem_alloc(gidsetsize * sizeof (gid_t),
2587 		    KM_SLEEP);
2588 		if (copyin((caddr_t)gidset, gidlist,
2589 		    gidsetsize * sizeof (gid_t)) == 0)
2590 			for (i = 0; i < gidsetsize; i++)
2591 				au_uwrite(au_to_arg32(1, "setgroups",
2592 				    (uint32_t)gidlist[i]));
2593 		kmem_free(gidlist, gidsetsize * sizeof (gid_t));
2594 	} else
2595 		au_uwrite(au_to_arg32(1, "setgroups", (uint32_t)0));
2596 
2597 }	/* AUS_SETGROUPS */
2598 
2599 
2600 
2601 
2602 
2603 /*ARGSUSED*/
2604 static void
aus_seteuid(struct t_audit_data * tad)2605 aus_seteuid(struct t_audit_data *tad)
2606 {
2607 	klwp_t *clwp = ttolwp(curthread);
2608 	uint32_t uid;
2609 
2610 	struct a {
2611 		long	uid;
2612 	} *uap = (struct a *)clwp->lwp_ap;
2613 
2614 	uid = (uint32_t)uap->uid;
2615 
2616 	au_uwrite(au_to_arg32(1, "euid", uid));
2617 
2618 }	/* AUS_SETEUID */
2619 
2620 /*ARGSUSED*/
2621 static void
aus_putmsg(struct t_audit_data * tad)2622 aus_putmsg(struct t_audit_data *tad)
2623 {
2624 	klwp_t *clwp = ttolwp(curthread);
2625 	uint32_t fd, pri;
2626 	struct file *fp;
2627 	struct f_audit_data *fad;
2628 
2629 	struct a {
2630 		long	fdes;
2631 		long	ctl;		/* struct strbuf * */
2632 		long	data;		/* struct strbuf * */
2633 		long	pri;
2634 	} *uap = (struct a *)clwp->lwp_ap;
2635 
2636 	fd  = (uint32_t)uap->fdes;
2637 	pri = (uint32_t)uap->pri;
2638 
2639 	au_uwrite(au_to_arg32(1, "fd", fd));
2640 
2641 	if ((fp = getf(fd)) != NULL) {
2642 		fad = F2A(fp);
2643 
2644 		fad->fad_flags |= FAD_WRITE;
2645 
2646 		/* add path name to audit record */
2647 		if (fad->fad_aupath != NULL) {
2648 			au_uwrite(au_to_path(fad->fad_aupath));
2649 		}
2650 		audit_attributes(fp->f_vnode);
2651 
2652 		releasef(fd);
2653 	}
2654 
2655 	au_uwrite(au_to_arg32(4, "pri", pri));
2656 }
2657 
2658 /*ARGSUSED*/
2659 static void
aus_putpmsg(struct t_audit_data * tad)2660 aus_putpmsg(struct t_audit_data *tad)
2661 {
2662 	klwp_t *clwp = ttolwp(curthread);
2663 	uint32_t fd, pri, flags;
2664 	struct file *fp;
2665 	struct f_audit_data *fad;
2666 
2667 	struct a {
2668 		long	fdes;
2669 		long	ctl;		/* struct strbuf * */
2670 		long	data;		/* struct strbuf * */
2671 		long	pri;
2672 		long	flags;
2673 	} *uap = (struct a *)clwp->lwp_ap;
2674 
2675 	fd = (uint32_t)uap->fdes;
2676 	pri  = (uint32_t)uap->pri;
2677 	flags  = (uint32_t)uap->flags;
2678 
2679 	au_uwrite(au_to_arg32(1, "fd", fd));
2680 
2681 	if ((fp = getf(fd)) != NULL) {
2682 		fad = F2A(fp);
2683 
2684 		fad->fad_flags |= FAD_WRITE;
2685 
2686 		/* add path name to audit record */
2687 		if (fad->fad_aupath != NULL) {
2688 			au_uwrite(au_to_path(fad->fad_aupath));
2689 		}
2690 		audit_attributes(fp->f_vnode);
2691 
2692 		releasef(fd);
2693 	}
2694 
2695 
2696 	au_uwrite(au_to_arg32(4, "pri", pri));
2697 	au_uwrite(au_to_arg32(5, "flags", flags));
2698 }
2699 
2700 /*ARGSUSED*/
2701 static void
aus_getmsg(struct t_audit_data * tad)2702 aus_getmsg(struct t_audit_data *tad)
2703 {
2704 	klwp_t *clwp = ttolwp(curthread);
2705 	uint32_t fd, pri;
2706 	struct file *fp;
2707 	struct f_audit_data *fad;
2708 
2709 	struct a {
2710 		long	fdes;
2711 		long	ctl;		/* struct strbuf * */
2712 		long	data;		/* struct strbuf * */
2713 		long	pri;
2714 	} *uap = (struct a *)clwp->lwp_ap;
2715 
2716 	fd  = (uint32_t)uap->fdes;
2717 	pri = (uint32_t)uap->pri;
2718 
2719 	au_uwrite(au_to_arg32(1, "fd", fd));
2720 
2721 	if ((fp = getf(fd)) != NULL) {
2722 		fad = F2A(fp);
2723 
2724 		/*
2725 		 * read operation on this object
2726 		 */
2727 		fad->fad_flags |= FAD_READ;
2728 
2729 		/* add path name to audit record */
2730 		if (fad->fad_aupath != NULL) {
2731 			au_uwrite(au_to_path(fad->fad_aupath));
2732 		}
2733 		audit_attributes(fp->f_vnode);
2734 
2735 		releasef(fd);
2736 	}
2737 
2738 	au_uwrite(au_to_arg32(4, "pri", pri));
2739 }
2740 
2741 /*ARGSUSED*/
2742 static void
aus_getpmsg(struct t_audit_data * tad)2743 aus_getpmsg(struct t_audit_data *tad)
2744 {
2745 	klwp_t *clwp = ttolwp(curthread);
2746 	uint32_t fd;
2747 	struct file *fp;
2748 	struct f_audit_data *fad;
2749 
2750 	struct a {
2751 		long	fdes;
2752 		long	ctl;		/* struct strbuf * */
2753 		long	data;		/* struct strbuf * */
2754 		long	pri;
2755 		long	flags;
2756 	} *uap = (struct a *)clwp->lwp_ap;
2757 
2758 	fd = (uint32_t)uap->fdes;
2759 
2760 	au_uwrite(au_to_arg32(1, "fd", fd));
2761 
2762 	if ((fp = getf(fd)) != NULL) {
2763 		fad = F2A(fp);
2764 
2765 		/*
2766 		 * read operation on this object
2767 		 */
2768 		fad->fad_flags |= FAD_READ;
2769 
2770 		/* add path name to audit record */
2771 		if (fad->fad_aupath != NULL) {
2772 			au_uwrite(au_to_path(fad->fad_aupath));
2773 		}
2774 		audit_attributes(fp->f_vnode);
2775 
2776 		releasef(fd);
2777 	}
2778 }
2779 
2780 static au_event_t
aui_labelsys(au_event_t e)2781 aui_labelsys(au_event_t e)
2782 {
2783 	klwp_t *clwp = ttolwp(curthread);
2784 	uint32_t code;
2785 	uint32_t cmd;
2786 
2787 	struct a {
2788 		long	code;
2789 		long	cmd;
2790 	} *uap = (struct a *)clwp->lwp_ap;
2791 
2792 	code = (uint32_t)uap->code;
2793 	cmd = (uint32_t)uap->cmd;
2794 
2795 	/* not security relevant if not changing kernel cache */
2796 	if (cmd == TNDB_GET)
2797 		return (AUE_NULL);
2798 
2799 	switch (code) {
2800 	case TSOL_TNRH:
2801 		e = AUE_LABELSYS_TNRH;
2802 		break;
2803 	case TSOL_TNRHTP:
2804 		e = AUE_LABELSYS_TNRHTP;
2805 		break;
2806 	case TSOL_TNMLP:
2807 		e = AUE_LABELSYS_TNMLP;
2808 		break;
2809 	default:
2810 		e = AUE_NULL;
2811 		break;
2812 	}
2813 
2814 	return (e);
2815 
2816 }
2817 
2818 static void
aus_labelsys(struct t_audit_data * tad)2819 aus_labelsys(struct t_audit_data *tad)
2820 {
2821 	klwp_t *clwp = ttolwp(curthread);
2822 	uint32_t cmd;
2823 	uintptr_t a2;
2824 
2825 	struct a {
2826 		long	code;
2827 		long	cmd;
2828 		long	a2;
2829 	} *uap = (struct a *)clwp->lwp_ap;
2830 
2831 	cmd = (uint32_t)uap->cmd;
2832 	a2 = (uintptr_t)uap->a2;
2833 
2834 	switch (tad->tad_event) {
2835 	case AUE_LABELSYS_TNRH:
2836 	{
2837 		tsol_rhent_t	*rhent;
2838 		tnaddr_t	*rh_addr;
2839 
2840 		au_uwrite(au_to_arg32(1, "cmd", cmd));
2841 
2842 		/* Remaining args don't apply for FLUSH, so skip */
2843 		if (cmd == TNDB_FLUSH)
2844 			break;
2845 
2846 		rhent = kmem_alloc(sizeof (tsol_rhent_t), KM_SLEEP);
2847 		if (copyin((caddr_t)a2, rhent, sizeof (tsol_rhent_t))) {
2848 			kmem_free(rhent, sizeof (tsol_rhent_t));
2849 			return;
2850 		}
2851 
2852 		rh_addr = &rhent->rh_address;
2853 		if (rh_addr->ta_family == AF_INET) {
2854 			struct in_addr	*ipaddr;
2855 
2856 			ipaddr = &(rh_addr->ta_addr_v4);
2857 			au_uwrite(au_to_in_addr(ipaddr));
2858 		} else if (rh_addr->ta_family == AF_INET6) {
2859 			int32_t		*ipaddr;
2860 
2861 			ipaddr = (int32_t *)&(rh_addr->ta_addr_v6);
2862 			au_uwrite(au_to_in_addr_ex(ipaddr));
2863 		}
2864 		au_uwrite(au_to_arg32(2, "prefix len", rhent->rh_prefix));
2865 
2866 		kmem_free(rhent, sizeof (tsol_rhent_t));
2867 
2868 		break;
2869 	}
2870 	case AUE_LABELSYS_TNRHTP:
2871 	{
2872 		tsol_tpent_t	*tpent;
2873 
2874 		au_uwrite(au_to_arg32(1, "cmd", cmd));
2875 
2876 		/* Remaining args don't apply for FLUSH, so skip */
2877 		if (cmd == TNDB_FLUSH)
2878 			break;
2879 
2880 		tpent = kmem_alloc(sizeof (tsol_tpent_t), KM_SLEEP);
2881 		if (copyin((caddr_t)a2, tpent, sizeof (tsol_tpent_t))) {
2882 			kmem_free(tpent, sizeof (tsol_tpent_t));
2883 			return;
2884 		}
2885 
2886 		/* Make sure that the template name is null-terminated. */
2887 		*(tpent->name + TNTNAMSIZ - 1) = '\0';
2888 
2889 		au_uwrite(au_to_text(tpent->name));
2890 		kmem_free(tpent, sizeof (tsol_tpent_t));
2891 
2892 		break;
2893 	}
2894 	case AUE_LABELSYS_TNMLP:
2895 	{
2896 		tsol_mlpent_t	*mlpent;
2897 
2898 		au_uwrite(au_to_arg32(1, "cmd", cmd));
2899 
2900 		mlpent = kmem_alloc(sizeof (tsol_mlpent_t), KM_SLEEP);
2901 		if (copyin((caddr_t)a2, mlpent, sizeof (tsol_mlpent_t))) {
2902 			kmem_free(mlpent, sizeof (tsol_mlpent_t));
2903 			return;
2904 		}
2905 
2906 		if (mlpent->tsme_flags & TSOL_MEF_SHARED) {
2907 			au_uwrite(au_to_text("shared"));
2908 		} else {
2909 			zone_t	*zone;
2910 
2911 			zone = zone_find_by_id(mlpent->tsme_zoneid);
2912 			if (zone != NULL) {
2913 				au_uwrite(au_to_text(zone->zone_name));
2914 				zone_rele(zone);
2915 			}
2916 		}
2917 
2918 		/* Remaining args don't apply for FLUSH, so skip */
2919 		if (cmd == TNDB_FLUSH) {
2920 			kmem_free(mlpent, sizeof (tsol_mlpent_t));
2921 			break;
2922 		}
2923 
2924 		au_uwrite(au_to_arg32(2, "proto num",
2925 		    (uint32_t)mlpent->tsme_mlp.mlp_ipp));
2926 		au_uwrite(au_to_arg32(2, "mlp_port",
2927 		    (uint32_t)mlpent->tsme_mlp.mlp_port));
2928 
2929 		if (mlpent->tsme_mlp.mlp_port_upper != 0)
2930 			au_uwrite(au_to_arg32(2, "mlp_port_upper",
2931 			    (uint32_t)mlpent->tsme_mlp.mlp_port_upper));
2932 
2933 		kmem_free(mlpent, sizeof (tsol_mlpent_t));
2934 
2935 		break;
2936 	}
2937 	default:
2938 		break;
2939 	}
2940 }
2941 
2942 
2943 static au_event_t
aui_auditsys(au_event_t e)2944 aui_auditsys(au_event_t e)
2945 {
2946 	klwp_t *clwp = ttolwp(curthread);
2947 	uint32_t code;
2948 
2949 	struct a {
2950 		long	code;
2951 		long	a1;
2952 		long	a2;
2953 		long	a3;
2954 		long	a4;
2955 		long	a5;
2956 		long	a6;
2957 		long	a7;
2958 	} *uap = (struct a *)clwp->lwp_ap;
2959 
2960 	code = (uint32_t)uap->code;
2961 
2962 	switch (code) {
2963 
2964 	case BSM_GETAUID:
2965 		e = AUE_GETAUID;
2966 		break;
2967 	case BSM_SETAUID:
2968 		e = AUE_SETAUID;
2969 		break;
2970 	case BSM_GETAUDIT:
2971 		e = AUE_GETAUDIT;
2972 		break;
2973 	case BSM_GETAUDIT_ADDR:
2974 		e = AUE_GETAUDIT_ADDR;
2975 		break;
2976 	case BSM_SETAUDIT:
2977 		e = AUE_SETAUDIT;
2978 		break;
2979 	case BSM_SETAUDIT_ADDR:
2980 		e = AUE_SETAUDIT_ADDR;
2981 		break;
2982 	case BSM_AUDIT:
2983 		e = AUE_AUDIT;
2984 		break;
2985 	case BSM_AUDITCTL:
2986 		switch ((uint_t)uap->a1) {
2987 
2988 		case A_GETPOLICY:
2989 			e = AUE_AUDITON_GPOLICY;
2990 			break;
2991 		case A_SETPOLICY:
2992 			e = AUE_AUDITON_SPOLICY;
2993 			break;
2994 		case A_GETAMASK:
2995 			e = AUE_AUDITON_GETAMASK;
2996 			break;
2997 		case A_SETAMASK:
2998 			e = AUE_AUDITON_SETAMASK;
2999 			break;
3000 		case A_GETKMASK:
3001 			e = AUE_AUDITON_GETKMASK;
3002 			break;
3003 		case A_SETKMASK:
3004 			e = AUE_AUDITON_SETKMASK;
3005 			break;
3006 		case A_GETQCTRL:
3007 			e = AUE_AUDITON_GQCTRL;
3008 			break;
3009 		case A_SETQCTRL:
3010 			e = AUE_AUDITON_SQCTRL;
3011 			break;
3012 		case A_GETCWD:
3013 			e = AUE_AUDITON_GETCWD;
3014 			break;
3015 		case A_GETCAR:
3016 			e = AUE_AUDITON_GETCAR;
3017 			break;
3018 		case A_GETSTAT:
3019 			e = AUE_AUDITON_GETSTAT;
3020 			break;
3021 		case A_SETSTAT:
3022 			e = AUE_AUDITON_SETSTAT;
3023 			break;
3024 		case A_SETUMASK:
3025 			e = AUE_AUDITON_SETUMASK;
3026 			break;
3027 		case A_SETSMASK:
3028 			e = AUE_AUDITON_SETSMASK;
3029 			break;
3030 		case A_GETCOND:
3031 			e = AUE_AUDITON_GETCOND;
3032 			break;
3033 		case A_SETCOND:
3034 			e = AUE_AUDITON_SETCOND;
3035 			break;
3036 		case A_GETCLASS:
3037 			e = AUE_AUDITON_GETCLASS;
3038 			break;
3039 		case A_SETCLASS:
3040 			e = AUE_AUDITON_SETCLASS;
3041 			break;
3042 		case A_GETPINFO:
3043 		case A_GETPINFO_ADDR:
3044 			e = AUE_AUDITON_GETPINFO;
3045 			break;
3046 		case A_SETPMASK:
3047 			e = AUE_AUDITON_SETPMASK;
3048 			break;
3049 		case A_GETKAUDIT:
3050 			e = AUE_AUDITON_GETKAUDIT;
3051 			break;
3052 		case A_SETKAUDIT:
3053 			e = AUE_AUDITON_SETKAUDIT;
3054 			break;
3055 		default:
3056 			e = AUE_AUDITON_OTHER;
3057 			break;
3058 		}
3059 		break;
3060 	default:
3061 		e = AUE_NULL;
3062 		break;
3063 	}
3064 
3065 	return (e);
3066 
3067 }	/* AUI_AUDITSYS */
3068 
3069 
3070 static void
aus_auditsys(struct t_audit_data * tad)3071 aus_auditsys(struct t_audit_data *tad)
3072 {
3073 	klwp_t *clwp = ttolwp(curthread);
3074 	uintptr_t a1, a2;
3075 	STRUCT_DECL(auditinfo, ainfo);
3076 	STRUCT_DECL(auditinfo_addr, ainfo_addr);
3077 	STRUCT_DECL(auditpinfo, apinfo);
3078 	au_evclass_map_t event;
3079 	au_mask_t mask;
3080 	int auditstate, policy;
3081 	au_id_t auid;
3082 
3083 
3084 	struct a {
3085 		long	code;
3086 		long	a1;
3087 		long	a2;
3088 		long	a3;
3089 		long	a4;
3090 		long	a5;
3091 		long	a6;
3092 		long	a7;
3093 	} *uap = (struct a *)clwp->lwp_ap;
3094 
3095 	a1   = (uintptr_t)uap->a1;
3096 	a2   = (uintptr_t)uap->a2;
3097 
3098 	switch (tad->tad_event) {
3099 	case AUE_SETAUID:
3100 		if (copyin((caddr_t)a1, &auid, sizeof (au_id_t)))
3101 				return;
3102 		au_uwrite(au_to_arg32(2, "setauid", auid));
3103 		break;
3104 	case AUE_SETAUDIT:
3105 		STRUCT_INIT(ainfo, get_udatamodel());
3106 		if (copyin((caddr_t)a1, STRUCT_BUF(ainfo),
3107 		    STRUCT_SIZE(ainfo))) {
3108 				return;
3109 		}
3110 		au_uwrite(au_to_arg32((char)1, "setaudit:auid",
3111 		    (uint32_t)STRUCT_FGET(ainfo, ai_auid)));
3112 #ifdef _LP64
3113 		au_uwrite(au_to_arg64((char)1, "setaudit:port",
3114 		    (uint64_t)STRUCT_FGET(ainfo, ai_termid.port)));
3115 #else
3116 		au_uwrite(au_to_arg32((char)1, "setaudit:port",
3117 		    (uint32_t)STRUCT_FGET(ainfo, ai_termid.port)));
3118 #endif
3119 		au_uwrite(au_to_arg32((char)1, "setaudit:machine",
3120 		    (uint32_t)STRUCT_FGET(ainfo, ai_termid.machine)));
3121 		au_uwrite(au_to_arg32((char)1, "setaudit:as_success",
3122 		    (uint32_t)STRUCT_FGET(ainfo, ai_mask.as_success)));
3123 		au_uwrite(au_to_arg32((char)1, "setaudit:as_failure",
3124 		    (uint32_t)STRUCT_FGET(ainfo, ai_mask.as_failure)));
3125 		au_uwrite(au_to_arg32((char)1, "setaudit:asid",
3126 		    (uint32_t)STRUCT_FGET(ainfo, ai_asid)));
3127 		break;
3128 	case AUE_SETAUDIT_ADDR:
3129 		STRUCT_INIT(ainfo_addr, get_udatamodel());
3130 		if (copyin((caddr_t)a1, STRUCT_BUF(ainfo_addr),
3131 		    STRUCT_SIZE(ainfo_addr))) {
3132 				return;
3133 		}
3134 		au_uwrite(au_to_arg32((char)1, "auid",
3135 		    (uint32_t)STRUCT_FGET(ainfo_addr, ai_auid)));
3136 #ifdef _LP64
3137 		au_uwrite(au_to_arg64((char)1, "port",
3138 		    (uint64_t)STRUCT_FGET(ainfo_addr, ai_termid.at_port)));
3139 #else
3140 		au_uwrite(au_to_arg32((char)1, "port",
3141 		    (uint32_t)STRUCT_FGET(ainfo_addr, ai_termid.at_port)));
3142 #endif
3143 		au_uwrite(au_to_arg32((char)1, "type",
3144 		    (uint32_t)STRUCT_FGET(ainfo_addr, ai_termid.at_type)));
3145 		if ((uint32_t)STRUCT_FGET(ainfo_addr, ai_termid.at_type) ==
3146 		    AU_IPv4) {
3147 			au_uwrite(au_to_in_addr(
3148 			    (struct in_addr *)STRUCT_FGETP(ainfo_addr,
3149 			    ai_termid.at_addr)));
3150 		} else {
3151 			au_uwrite(au_to_in_addr_ex(
3152 			    (int32_t *)STRUCT_FGETP(ainfo_addr,
3153 			    ai_termid.at_addr)));
3154 		}
3155 		au_uwrite(au_to_arg32((char)1, "as_success",
3156 		    (uint32_t)STRUCT_FGET(ainfo_addr, ai_mask.as_success)));
3157 		au_uwrite(au_to_arg32((char)1, "as_failure",
3158 		    (uint32_t)STRUCT_FGET(ainfo_addr, ai_mask.as_failure)));
3159 		au_uwrite(au_to_arg32((char)1, "asid",
3160 		    (uint32_t)STRUCT_FGET(ainfo_addr, ai_asid)));
3161 		break;
3162 	case AUE_AUDITON_SETAMASK:
3163 		if (copyin((caddr_t)a2, &mask, sizeof (au_mask_t)))
3164 				return;
3165 		au_uwrite(au_to_arg32(
3166 		    2, "setamask:as_success", (uint32_t)mask.as_success));
3167 		au_uwrite(au_to_arg32(
3168 		    2, "setamask:as_failure", (uint32_t)mask.as_failure));
3169 		break;
3170 	case AUE_AUDITON_SETKMASK:
3171 		if (copyin((caddr_t)a2, &mask, sizeof (au_mask_t)))
3172 				return;
3173 		au_uwrite(au_to_arg32(
3174 		    2, "setkmask:as_success", (uint32_t)mask.as_success));
3175 		au_uwrite(au_to_arg32(
3176 		    2, "setkmask:as_failure", (uint32_t)mask.as_failure));
3177 		break;
3178 	case AUE_AUDITON_SPOLICY:
3179 		if (copyin((caddr_t)a2, &policy, sizeof (int)))
3180 			return;
3181 		au_uwrite(au_to_arg32(3, "setpolicy", (uint32_t)policy));
3182 		break;
3183 	case AUE_AUDITON_SQCTRL: {
3184 		STRUCT_DECL(au_qctrl, qctrl);
3185 		model_t model;
3186 
3187 		model = get_udatamodel();
3188 		STRUCT_INIT(qctrl, model);
3189 		if (copyin((caddr_t)a2, STRUCT_BUF(qctrl), STRUCT_SIZE(qctrl)))
3190 				return;
3191 		if (model == DATAMODEL_ILP32) {
3192 			au_uwrite(au_to_arg32(
3193 			    3, "setqctrl:aq_hiwater",
3194 			    (uint32_t)STRUCT_FGET(qctrl, aq_hiwater)));
3195 			au_uwrite(au_to_arg32(
3196 			    3, "setqctrl:aq_lowater",
3197 			    (uint32_t)STRUCT_FGET(qctrl, aq_lowater)));
3198 			au_uwrite(au_to_arg32(
3199 			    3, "setqctrl:aq_bufsz",
3200 			    (uint32_t)STRUCT_FGET(qctrl, aq_bufsz)));
3201 			au_uwrite(au_to_arg32(
3202 			    3, "setqctrl:aq_delay",
3203 			    (uint32_t)STRUCT_FGET(qctrl, aq_delay)));
3204 		} else {
3205 			au_uwrite(au_to_arg64(
3206 			    3, "setqctrl:aq_hiwater",
3207 			    (uint64_t)STRUCT_FGET(qctrl, aq_hiwater)));
3208 			au_uwrite(au_to_arg64(
3209 			    3, "setqctrl:aq_lowater",
3210 			    (uint64_t)STRUCT_FGET(qctrl, aq_lowater)));
3211 			au_uwrite(au_to_arg64(
3212 			    3, "setqctrl:aq_bufsz",
3213 			    (uint64_t)STRUCT_FGET(qctrl, aq_bufsz)));
3214 			au_uwrite(au_to_arg64(
3215 			    3, "setqctrl:aq_delay",
3216 			    (uint64_t)STRUCT_FGET(qctrl, aq_delay)));
3217 		}
3218 		break;
3219 	}
3220 	case AUE_AUDITON_SETUMASK:
3221 		STRUCT_INIT(ainfo, get_udatamodel());
3222 		if (copyin((caddr_t)uap->a2, STRUCT_BUF(ainfo),
3223 		    STRUCT_SIZE(ainfo))) {
3224 			return;
3225 		}
3226 		au_uwrite(au_to_arg32(3, "setumask:as_success",
3227 		    (uint32_t)STRUCT_FGET(ainfo, ai_mask.as_success)));
3228 		au_uwrite(au_to_arg32(3, "setumask:as_failure",
3229 		    (uint32_t)STRUCT_FGET(ainfo, ai_mask.as_failure)));
3230 		break;
3231 	case AUE_AUDITON_SETSMASK:
3232 		STRUCT_INIT(ainfo, get_udatamodel());
3233 		if (copyin((caddr_t)uap->a2, STRUCT_BUF(ainfo),
3234 		    STRUCT_SIZE(ainfo))) {
3235 			return;
3236 		}
3237 		au_uwrite(au_to_arg32(3, "setsmask:as_success",
3238 		    (uint32_t)STRUCT_FGET(ainfo, ai_mask.as_success)));
3239 		au_uwrite(au_to_arg32(3, "setsmask:as_failure",
3240 		    (uint32_t)STRUCT_FGET(ainfo, ai_mask.as_failure)));
3241 		break;
3242 	case AUE_AUDITON_SETCOND:
3243 		if (copyin((caddr_t)a2, &auditstate, sizeof (int)))
3244 			return;
3245 		au_uwrite(au_to_arg32(3, "setcond", (uint32_t)auditstate));
3246 		break;
3247 	case AUE_AUDITON_SETCLASS:
3248 		if (copyin((caddr_t)a2, &event, sizeof (au_evclass_map_t)))
3249 			return;
3250 		au_uwrite(au_to_arg32(
3251 		    2, "setclass:ec_event", (uint32_t)event.ec_number));
3252 		au_uwrite(au_to_arg32(
3253 		    3, "setclass:ec_class", (uint32_t)event.ec_class));
3254 		break;
3255 	case AUE_AUDITON_SETPMASK:
3256 		STRUCT_INIT(apinfo, get_udatamodel());
3257 		if (copyin((caddr_t)uap->a2, STRUCT_BUF(apinfo),
3258