1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright 2007 Sun Microsystems, Inc. All rights reserved. 23 * Use is subject to license terms. 24 */ 25 26 #ifndef _BSM_AUDIT_RECORD_H 27 #define _BSM_AUDIT_RECORD_H 28 29 #pragma ident "%Z%%M% %I% %E% SMI" 30 31 #ifdef _KERNEL 32 #include <sys/priv.h> 33 #else 34 #include <priv.h> 35 #endif 36 #include <sys/socket.h> 37 #include <sys/acl.h> 38 39 #include <sys/tsol/label.h> 40 41 #ifdef __cplusplus 42 extern "C" { 43 #endif 44 45 /* 46 * Version of audit attributes 47 * 48 * OS Release Version Number Comments 49 * ========== ============== ======== 50 * SunOS 5.1 2 Unbundled Package 51 * SunOS 5.3 2 Bundled into the base OS 52 * SunOS 5.4-5.x 2 53 * Trusted Solaris 2.5 3 To distinguish potential new tokens 54 * Trusted Solaris 7-8 4 Redefine X tokens that overlap with 55 * SunOS 5.7 56 */ 57 58 #define TOKEN_VERSION 2 59 60 /* 61 * Audit record token type codes 62 */ 63 64 /* 65 * Control token types 66 */ 67 68 #define AUT_INVALID ((char)0x00) 69 #define AUT_OTHER_FILE ((char)0x11) 70 #define AUT_OTHER_FILE32 AUT_OTHER_FILE 71 #define AUT_OHEADER ((char)0x12) 72 #define AUT_TRAILER ((char)0x13) 73 #define AUT_HEADER ((char)0x14) 74 #define AUT_HEADER32 AUT_HEADER 75 #define AUT_HEADER32_EX ((char)0x15) 76 #define AUT_TRAILER_MAGIC ((short)0xB105) 77 78 /* 79 * Data token types 80 */ 81 82 #define AUT_FMRI ((char)0x20) 83 #define AUT_DATA ((char)0x21) 84 #define AUT_IPC ((char)0x22) 85 #define AUT_PATH ((char)0x23) 86 #define AUT_SUBJECT ((char)0x24) 87 #define AUT_SUBJECT32 AUT_SUBJECT 88 #define AUT_XATPATH ((char)0x25) 89 #define AUT_PROCESS ((char)0x26) 90 #define AUT_PROCESS32 AUT_PROCESS 91 #define AUT_RETURN ((char)0x27) 92 #define AUT_RETURN32 AUT_RETURN 93 #define AUT_TEXT ((char)0x28) 94 #define AUT_OPAQUE ((char)0x29) 95 #define AUT_IN_ADDR ((char)0x2A) 96 #define AUT_IP ((char)0x2B) 97 #define AUT_IPORT ((char)0x2C) 98 #define AUT_ARG ((char)0x2D) 99 #define AUT_ARG32 AUT_ARG 100 #define AUT_SOCKET ((char)0x2E) 101 #define AUT_SEQ ((char)0x2F) 102 #define AUT_TID ((char)0x61) 103 104 /* 105 * Modifier token types 106 */ 107 108 #define AUT_ACL ((char)0x30) 109 #define AUT_ATTR ((char)0x31) 110 #define AUT_IPC_PERM ((char)0x32) 111 #define AUT_LABEL ((char)0x33) 112 #define AUT_GROUPS ((char)0x34) 113 #define AUT_ACE ((char)0x35) 114 /* 115 * 0x36, 0x37 unused 116 */ 117 #define AUT_PRIV ((char)0x38) 118 #define AUT_UPRIV ((char)0x39) 119 #define AUT_LIAISON ((char)0x3A) 120 #define AUT_NEWGROUPS ((char)0x3B) 121 #define AUT_EXEC_ARGS ((char)0x3C) 122 #define AUT_EXEC_ENV ((char)0x3D) 123 #define AUT_ATTR32 ((char)0x3E) 124 #define AUT_UAUTH ((char)0x3F) 125 #define AUT_ZONENAME ((char)0x60) 126 127 /* 128 * X windows token types 129 */ 130 131 #define AUT_XATOM ((char)0x40) 132 #define AUT_XOBJ ((char)0x41) 133 #define AUT_XPROTO ((char)0x42) 134 #define AUT_XSELECT ((char)0x43) 135 136 #if TOKEN_VERSION != 3 137 #define AUT_XCOLORMAP ((char)0x44) 138 #define AUT_XCURSOR ((char)0x45) 139 #define AUT_XFONT ((char)0x46) 140 #define AUT_XGC ((char)0x47) 141 #define AUT_XPIXMAP ((char)0x48) 142 #define AUT_XPROPERTY ((char)0x49) 143 #define AUT_XWINDOW ((char)0x4A) 144 #define AUT_XCLIENT ((char)0x4B) 145 #else /* TOKEN_VERSION == 3 */ 146 #define AUT_XCOLORMAP ((char)0x74) 147 #define AUT_XCURSOR ((char)0x75) 148 #define AUT_XFONT ((char)0x76) 149 #define AUT_XGC ((char)0x77) 150 #define AUT_XPIXMAP ((char)0x78) 151 #define AUT_XPROPERTY ((char)0x79) 152 #define AUT_XWINDOW ((char)0x7A) 153 #define AUT_XCLIENT ((char)0x7B) 154 #endif /* TOKEN_VERSION != 3 */ 155 156 /* 157 * Command token types 158 */ 159 160 #define AUT_CMD ((char)0x51) 161 #define AUT_EXIT ((char)0x52) 162 163 /* 164 * Miscellaneous token types 165 */ 166 167 #define AUT_HOST ((char)0x70) 168 169 /* 170 * Solaris64 token types 171 */ 172 173 #define AUT_ARG64 ((char)0x71) 174 #define AUT_RETURN64 ((char)0x72) 175 #define AUT_ATTR64 ((char)0x73) 176 #define AUT_HEADER64 ((char)0x74) 177 #define AUT_SUBJECT64 ((char)0x75) 178 #define AUT_PROCESS64 ((char)0x77) 179 #define AUT_OTHER_FILE64 ((char)0x78) 180 181 /* 182 * Extended network address token types 183 */ 184 185 #define AUT_HEADER64_EX ((char)0x79) 186 #define AUT_SUBJECT32_EX ((char)0x7a) 187 #define AUT_PROCESS32_EX ((char)0x7b) 188 #define AUT_SUBJECT64_EX ((char)0x7c) 189 #define AUT_PROCESS64_EX ((char)0x7d) 190 #define AUT_IN_ADDR_EX ((char)0x7e) 191 #define AUT_SOCKET_EX ((char)0x7f) 192 193 194 /* 195 * Audit print suggestion types. 196 */ 197 198 #define AUP_BINARY ((char)0) 199 #define AUP_OCTAL ((char)1) 200 #define AUP_DECIMAL ((char)2) 201 #define AUP_HEX ((char)3) 202 #define AUP_STRING ((char)4) 203 204 /* 205 * Audit data member types. 206 */ 207 208 #define AUR_BYTE ((char)0) 209 #define AUR_CHAR ((char)0) 210 #define AUR_SHORT ((char)1) 211 #define AUR_INT ((char)2) 212 #define AUR_INT32 ((char)2) 213 #define AUR_INT64 ((char)3) 214 215 /* 216 * Adr structures 217 */ 218 219 struct adr_s { 220 char *adr_stream; /* The base of the stream */ 221 char *adr_now; /* The location within the stream */ 222 }; 223 224 typedef struct adr_s adr_t; 225 226 227 #ifdef _KERNEL 228 229 #include <sys/param.h> 230 #include <sys/systm.h> /* for rval */ 231 #include <sys/time.h> 232 #include <sys/types.h> 233 #include <sys/vnode.h> 234 #include <sys/mode.h> 235 #include <sys/user.h> 236 #include <sys/session.h> 237 #include <sys/ipc_impl.h> 238 #include <netinet/in_systm.h> 239 #include <netinet/in.h> 240 #include <netinet/ip.h> 241 #include <sys/socket.h> 242 #include <net/route.h> 243 #include <netinet/in_pcb.h> 244 245 /* 246 * au_close flag arguments 247 */ 248 249 #define AU_OK 0x1 /* Good audit record */ 250 #define AU_DONTBLOCK 0x2 /* Don't block or discard if queue full */ 251 #define AU_DEFER 0x4 /* Defer record queueing to syscall end */ 252 253 /* 254 * Audit token type is really an au_membuf pointer 255 */ 256 typedef au_buff_t token_t; 257 /* 258 * token generation functions 259 */ 260 token_t *au_append_token(token_t *, token_t *); 261 token_t *au_set(caddr_t, uint_t); 262 263 void au_free_rec(au_buff_t *); 264 265 #define au_getclr() ((token_t *)au_get_buff()) 266 #define au_toss_token(tok) (au_free_rec((au_buff_t *)(tok))) 267 268 token_t *au_to_acl(); 269 token_t *au_to_ace(); 270 token_t *au_to_attr(struct vattr *); 271 token_t *au_to_data(char, char, char, char *); 272 token_t *au_to_header(int, au_event_t, au_emod_t); 273 token_t *au_to_header_ex(int, au_event_t, au_emod_t); 274 token_t *au_to_ipc(char, int); 275 token_t *au_to_ipc_perm(kipc_perm_t *); 276 token_t *au_to_iport(ushort_t); 277 token_t *au_to_in_addr(struct in_addr *); 278 token_t *au_to_in_addr_ex(int32_t *); 279 token_t *au_to_ip(struct ip *); 280 token_t *au_to_groups(const gid_t *, uint_t); 281 token_t *au_to_path(struct audit_path *); 282 token_t *au_to_seq(); 283 token_t *au_to_process(uid_t, gid_t, uid_t, gid_t, pid_t, 284 au_id_t, au_asid_t, const au_tid_addr_t *); 285 token_t *au_to_subject(uid_t, gid_t, uid_t, gid_t, pid_t, 286 au_id_t, au_asid_t, const au_tid_addr_t *); 287 token_t *au_to_return32(int, int32_t); 288 token_t *au_to_return64(int, int64_t); 289 token_t *au_to_text(const char *); 290 /* token_t *au_to_tid(au_generic_tid_t *); no kernel implementation */ 291 token_t *au_to_trailer(int); 292 token_t *au_to_uauth(char *); 293 size_t au_zonename_length(zone_t *); 294 token_t *au_to_zonename(size_t, zone_t *); 295 token_t *au_to_arg32(char, char *, uint32_t); 296 token_t *au_to_arg64(char, char *, uint64_t); 297 token_t *au_to_socket(struct socket *); 298 token_t *au_to_socket_ex(short, short, char *, char *); 299 token_t *au_to_sock_inet(struct sockaddr_in *); 300 token_t *au_to_exec_args(const char *, ssize_t); 301 token_t *au_to_exec_env(const char *, ssize_t); 302 token_t *au_to_label(bslabel_t *); 303 token_t *au_to_privset(const char *, const priv_set_t *, char, int); 304 305 void au_uwrite(); 306 void au_close(au_kcontext_t *, caddr_t *, int, au_event_t, au_emod_t); 307 void au_close_defer(token_t *, int, au_event_t, au_emod_t); 308 void au_close_time(au_kcontext_t *, token_t *, int, au_event_t, au_emod_t, 309 timestruc_t *); 310 void au_free_rec(au_buff_t *); 311 void au_write(caddr_t *, token_t *); 312 void au_mem_init(void); 313 void au_zone_setup(); 314 void au_enqueue(au_kcontext_t *, au_buff_t *, adr_t *, adr_t *, int, int); 315 int au_doorio(au_kcontext_t *); 316 int au_doormsg(au_kcontext_t *, uint32_t, void *); 317 int au_doio(struct vnode *, int); 318 int au_token_size(token_t *); 319 int au_append_rec(au_buff_t *, au_buff_t *, int); 320 int au_append_buf(const char *, int, au_buff_t *); 321 322 #else /* !_KERNEL */ 323 324 #include <limits.h> 325 #include <sys/types.h> 326 #include <sys/vnode.h> 327 #include <netinet/in_systm.h> 328 #include <netinet/in.h> 329 #include <netinet/ip.h> 330 #include <sys/ipc.h> 331 332 struct token_s { 333 struct token_s *tt_next; /* Next in the list */ 334 short tt_size; /* Size of data */ 335 char *tt_data; /* The data */ 336 }; 337 typedef struct token_s token_t; 338 339 struct au_arg32_tok { 340 uchar_t num; 341 uint32_t val; 342 ushort_t length; 343 char *data; 344 }; 345 typedef struct au_arg32_tok au_arg32_tok_t; 346 347 struct au_acl_tok { 348 ulong_t type; 349 ulong_t id; 350 ulong_t mode; 351 }; 352 typedef struct au_acl_tok au_acl_tok_t; 353 354 struct au_arg64_tok { 355 uchar_t num; 356 uint64_t val; 357 ushort_t length; 358 char *data; 359 }; 360 typedef struct au_arg64_tok au_arg64_tok_t; 361 362 struct au_attr_tok { 363 uint_t mode; 364 uint_t uid; 365 uint_t gid; 366 int fs; 367 int32_t node; 368 uint32_t dev; 369 }; 370 typedef struct au_attr_tok au_attr_tok_t; 371 372 struct au_attr32_tok { 373 uint_t mode; 374 uint_t uid; 375 uint_t gid; 376 int fs; 377 int64_t node; 378 uint32_t dev; 379 }; 380 typedef struct au_attr32_tok au_attr32_tok_t; 381 382 struct au_attr64_tok { 383 uint_t mode; 384 uint_t uid; 385 uint_t gid; 386 int fs; 387 int64_t node; 388 uint64_t dev; 389 }; 390 typedef struct au_attr64_tok au_attr64_tok_t; 391 392 struct au_data_tok { 393 uchar_t pfmt; 394 uchar_t size; 395 uchar_t number; 396 char *data; 397 }; 398 typedef struct au_data_tok au_data_tok_t; 399 400 struct au_exit_tok { 401 int status; 402 int retval; 403 }; 404 typedef struct au_exit_tok au_exit_tok_t; 405 406 struct au_file32_tok { 407 /* really struct timeval from gettimeofday() */ 408 int32_t sec; /* seconds since epoc */ 409 int32_t usec; /* microseconds */ 410 ushort_t length; 411 char *fname; 412 }; 413 typedef struct au_file32_tok au_file32_tok_t; 414 415 struct au_file64_tok { 416 /* really struct timeval */ 417 int64_t sec; /* seconds since epoc */ 418 int64_t usec; /* microseconds */ 419 ushort_t length; 420 char *fname; 421 }; 422 typedef struct au_file64_tok au_file64_tok_t; 423 424 425 struct au_groups_tok { 426 gid_t groups[NGROUPS_MAX]; 427 }; 428 typedef struct au_groups_tok au_groups_tok_t; 429 430 struct au_header32_tok { 431 uint_t length; 432 uchar_t version; 433 au_event_t event; 434 ushort_t emod; 435 /* really timestruct_t (struct timespec) from hrestime */ 436 int32_t sec; /* seconds since epoc */ 437 int32_t nsec; /* nanoseconds */ 438 }; 439 typedef struct au_header32_tok au_header32_tok_t; 440 441 struct au_header64_tok { 442 uint_t length; 443 uchar_t version; 444 au_event_t event; 445 ushort_t emod; 446 /* really timestruct_t (struct timespec) from hrestime */ 447 int64_t sec; /* seconds since epoc */ 448 int64_t nsec; /* nanoseconds */ 449 }; 450 typedef struct au_header64_tok au_header64_tok_t; 451 452 struct au_inaddr_tok { 453 struct in_addr ia; 454 }; 455 typedef struct au_inaddr_tok au_inaddr_tok_t; 456 457 struct au_ip_tok { 458 uchar_t version; 459 struct ip ip; 460 }; 461 typedef struct au_ip_tok au_ip_tok_t; 462 463 struct au_ipc_tok { 464 key_t id; 465 }; 466 typedef struct au_ipc_tok au_ipc_tok_t; 467 468 struct au_ipc_perm_tok { 469 struct ipc_perm ipc_perm; 470 }; 471 typedef struct au_ipc_perm_tok au_ipc_perm_tok_t; 472 473 struct au_iport_tok { 474 ushort_t iport; 475 }; 476 typedef struct au_iport_tok au_iport_tok_t; 477 478 struct au_invalid_tok { 479 ushort_t length; 480 char *data; 481 }; 482 typedef struct au_invalid_tok au_invalid_tok_t; 483 484 struct au_opaque_tok { 485 ushort_t length; 486 char *data; 487 }; 488 typedef struct au_opaque_tok au_opaque_tok_t; 489 490 struct au_path_tok { 491 ushort_t length; 492 char *name; 493 }; 494 typedef struct au_path_tok au_path_tok_t; 495 496 struct au_tid32 { 497 uint32_t port; 498 uint32_t machine; 499 }; 500 typedef struct au_tid32 au_tid32_t; 501 502 struct au_tid64 { 503 uint64_t port; 504 uint32_t machine; 505 }; 506 typedef struct au_tid64 au_tid64_t; 507 508 struct au_proc32_tok { 509 au_id_t auid; 510 uid_t euid; 511 gid_t egid; 512 uid_t ruid; 513 gid_t rgid; 514 pid_t pid; 515 pid_t sid; 516 au_tid32_t tid; 517 }; 518 typedef struct au_proc32_tok au_proc32_tok_t; 519 520 struct au_proc64_tok { 521 au_id_t auid; 522 uid_t euid; 523 gid_t egid; 524 uid_t ruid; 525 gid_t rgid; 526 pid_t pid; 527 pid_t sid; 528 au_tid64_t tid; 529 }; 530 typedef struct au_proc64_tok au_proc64_tok_t; 531 532 struct au_ret32_tok { 533 uchar_t error; 534 uint32_t retval; 535 }; 536 typedef struct au_ret32_tok au_ret32_tok_t; 537 538 struct au_ret64_tok { 539 uchar_t error; 540 uint64_t retval; 541 }; 542 typedef struct au_ret64_tok au_ret64_tok_t; 543 544 struct au_seq_tok { 545 uint_t num; 546 }; 547 typedef struct au_seq_tok au_seq_tok_t; 548 549 struct au_socket_tok { 550 short type; 551 ushort_t lport; 552 struct in_addr laddr; 553 ushort_t fport; 554 struct in_addr faddr; 555 }; 556 typedef struct au_socket_tok au_socket_tok_t; 557 558 struct au_subj32_tok { 559 au_id_t auid; 560 uid_t euid; 561 gid_t egid; 562 uid_t ruid; 563 gid_t rgid; 564 pid_t pid; 565 pid_t sid; 566 au_tid32_t tid; 567 }; 568 typedef struct au_subj32_tok au_subj32_tok_t; 569 570 struct au_subj64_tok { 571 au_id_t auid; 572 uid_t euid; 573 gid_t egid; 574 uid_t ruid; 575 gid_t rgid; 576 pid_t pid; 577 pid_t sid; 578 au_tid64_t tid; 579 }; 580 typedef struct au_subj64_tok au_subj64_tok_t; 581 582 struct au_server_tok { 583 au_id_t auid; 584 uid_t euid; 585 uid_t ruid; 586 gid_t egid; 587 pid_t pid; 588 }; 589 typedef struct au_server_tok au_server_tok_t; 590 591 struct au_text_tok { 592 ushort_t length; 593 char *data; 594 }; 595 typedef struct au_text_tok au_text_tok_t; 596 597 struct au_trailer_tok { 598 ushort_t magic; 599 uint_t length; 600 }; 601 typedef struct au_trailer_tok au_trailer_tok_t; 602 603 struct au_uauth_tok { 604 ushort_t length; 605 char *data; 606 }; 607 typedef struct au_uauth_tok au_uauth_tok_t; 608 609 struct au_token { 610 char id; 611 struct au_token *next; 612 struct au_token *prev; 613 char *data; 614 ushort_t size; 615 union { 616 au_arg32_tok_t arg32; 617 au_arg64_tok_t arg64; 618 au_acl_tok_t acl; 619 au_attr32_tok_t attr32; 620 au_attr64_tok_t attr64; 621 au_data_tok_t data; 622 au_exit_tok_t exit; 623 au_file32_tok_t file32; 624 au_file64_tok_t file64; 625 au_groups_tok_t groups; 626 au_header32_tok_t header32; 627 au_header64_tok_t header64; 628 au_inaddr_tok_t inaddr; 629 au_ip_tok_t ip; 630 au_ipc_perm_tok_t ipc_perm; 631 au_ipc_tok_t ipc; 632 au_iport_tok_t iport; 633 au_invalid_tok_t invalid; 634 au_opaque_tok_t opaque; 635 au_path_tok_t path; 636 au_proc32_tok_t proc32; 637 au_proc64_tok_t proc64; 638 au_ret32_tok_t ret32; 639 au_ret64_tok_t ret64; 640 au_server_tok_t server; 641 au_seq_tok_t seq; 642 au_socket_tok_t socket; 643 au_subj32_tok_t subj32; 644 au_subj64_tok_t subj64; 645 au_text_tok_t text; 646 au_trailer_tok_t trailer; 647 au_uauth_tok_t useofauth; 648 } un; 649 }; 650 typedef struct au_token au_token_t; 651 652 653 /* 654 * Old socket structure definition, formerly in <sys/socketvar.h> 655 */ 656 struct oldsocket { 657 short so_type; /* generic type, see socket.h */ 658 short so_options; /* from socket call, see socket.h */ 659 short so_linger; /* time to linger while closing */ 660 short so_state; /* internal state flags SS_*, below */ 661 struct inpcb *so_pcb; /* protocol control block */ 662 struct protosw *so_proto; /* protocol handle */ 663 /* 664 * Variables for connection queueing. 665 * Socket where accepts occur is so_head in all subsidiary sockets. 666 * If so_head is 0, socket is not related to an accept. 667 * For head socket so_q0 queues partially completed connections, 668 * while so_q is a queue of connections ready to be accepted. 669 * If a connection is aborted and it has so_head set, then 670 * it has to be pulled out of either so_q0 or so_q. 671 * We allow connections to queue up based on current queue lengths 672 * and limit on number of queued connections for this socket. 673 */ 674 struct oldsocket *so_head; /* back pointer to accept socket */ 675 struct oldsocket *so_q0; /* queue of partial connections */ 676 struct oldsocket *so_q; /* queue of incoming connections */ 677 short so_q0len; /* partials on so_q0 */ 678 short so_qlen; /* number of connections on so_q */ 679 short so_qlimit; /* max number queued connections */ 680 short so_timeo; /* connection timeout */ 681 ushort_t so_error; /* error affecting connection */ 682 short so_pgrp; /* pgrp for signals */ 683 ulong_t so_oobmark; /* chars to oob mark */ 684 /* 685 * Variables for socket buffering. 686 */ 687 struct sockbuf { 688 ulong_t sb_cc; /* actual chars in buffer */ 689 ulong_t sb_hiwat; /* max actual char count */ 690 ulong_t sb_mbcnt; /* chars of mbufs used */ 691 ulong_t sb_mbmax; /* max chars of mbufs to use */ 692 ulong_t sb_lowat; /* low water mark (not used yet) */ 693 struct mbuf *sb_mb; /* the mbuf chain */ 694 struct proc *sb_sel; /* process selecting read/write */ 695 short sb_timeo; /* timeout (not used yet) */ 696 short sb_flags; /* flags, see below */ 697 } so_rcv, so_snd; 698 /* 699 * Hooks for alternative wakeup strategies. 700 * These are used by kernel subsystems wishing to access the socket 701 * abstraction. If so_wupfunc is nonnull, it is called in place of 702 * wakeup any time that wakeup would otherwise be called with an 703 * argument whose value is an address lying within a socket structure. 704 */ 705 struct wupalt *so_wupalt; 706 }; 707 extern token_t *au_to_arg32(char, char *, uint32_t); 708 extern token_t *au_to_arg64(char, char *, uint64_t); 709 extern token_t *au_to_acl(struct acl *); 710 extern token_t *au_to_attr(struct vattr *); 711 extern token_t *au_to_cmd(uint_t, char **, char **); 712 extern token_t *au_to_data(char, char, char, char *); 713 extern token_t *au_to_exec_args(char **); 714 extern token_t *au_to_exec_env(char **); 715 extern token_t *au_to_exit(int, int); 716 extern token_t *au_to_fmri(char *); 717 extern token_t *au_to_groups(int *); 718 extern token_t *au_to_newgroups(int, gid_t *); 719 extern token_t *au_to_header(au_event_t, au_emod_t); 720 extern token_t *au_to_header_ex(au_event_t, au_emod_t); 721 extern token_t *au_to_in_addr(struct in_addr *); 722 extern token_t *au_to_in_addr_ex(int32_t *); 723 extern token_t *au_to_ipc(char, int); 724 extern token_t *au_to_ipc_perm(struct ipc_perm *); 725 extern token_t *au_to_iport(ushort_t); 726 extern token_t *au_to_me(void); 727 extern token_t *au_to_mylabel(void); 728 extern token_t *au_to_opaque(char *, short); 729 extern token_t *au_to_path(char *); 730 extern token_t *au_to_privset(const char *, const priv_set_t *); 731 extern token_t *au_to_process(au_id_t, uid_t, gid_t, uid_t, gid_t, 732 pid_t, au_asid_t, au_tid_t *); 733 extern token_t *au_to_process_ex(au_id_t, uid_t, gid_t, uid_t, gid_t, 734 pid_t, au_asid_t, au_tid_addr_t *); 735 extern token_t *au_to_return32(char, uint32_t); 736 extern token_t *au_to_return64(char, uint64_t); 737 extern token_t *au_to_seq(int); 738 extern token_t *au_to_label(m_label_t *); 739 extern token_t *au_to_socket(struct oldsocket *); 740 extern token_t *au_to_subject(au_id_t, uid_t, gid_t, uid_t, gid_t, 741 pid_t, au_asid_t, au_tid_t *); 742 extern token_t *au_to_subject_ex(au_id_t, uid_t, gid_t, uid_t, gid_t, 743 pid_t, au_asid_t, au_tid_addr_t *); 744 extern token_t *au_to_text(char *); 745 extern token_t *au_to_tid(au_generic_tid_t *); 746 extern token_t *au_to_trailer(void); 747 extern token_t *au_to_uauth(char *); 748 extern token_t *au_to_upriv(char, char *); 749 extern token_t *au_to_xatom(char *); 750 extern token_t *au_to_xselect(char *, char *, char *); 751 extern token_t *au_to_xcolormap(int32_t, uid_t); 752 extern token_t *au_to_xcursor(int32_t, uid_t); 753 extern token_t *au_to_xfont(int32_t, uid_t); 754 extern token_t *au_to_xgc(int32_t, uid_t); 755 extern token_t *au_to_xpixmap(int32_t, uid_t); 756 extern token_t *au_to_xwindow(int32_t, uid_t); 757 extern token_t *au_to_xproperty(int32_t, uid_t, char *); 758 extern token_t *au_to_xclient(uint32_t); 759 extern token_t *au_to_zonename(char *); 760 #endif /* _KERNEL */ 761 762 #ifdef _KERNEL 763 764 void adr_char(adr_t *, char *, int); 765 void adr_int32(adr_t *, int32_t *, int); 766 void adr_uint32(adr_t *, uint32_t *, int); 767 void adr_int64(adr_t *, int64_t *, int); 768 void adr_uint64(adr_t *, uint64_t *, int); 769 void adr_short(adr_t *, short *, int); 770 void adr_ushort(adr_t *, ushort_t *, int); 771 void adr_start(adr_t *, char *); 772 773 char *adr_getchar(adr_t *, char *); 774 char *adr_getshort(adr_t *, short *); 775 char *adr_getushort(adr_t *, ushort_t *); 776 char *adr_getint32(adr_t *, int32_t *); 777 char *adr_getuint32(adr_t *, uint32_t *); 778 char *adr_getint64(adr_t *, int64_t *); 779 char *adr_getuint64(adr_t *, uint64_t *); 780 781 int adr_count(adr_t *); 782 783 #endif /* _KERNEL */ 784 785 #ifdef __cplusplus 786 } 787 #endif 788 789 #endif /* _BSM_AUDIT_RECORD_H */ 790