17c478bd9Sstevel@tonic-gate /*
27c478bd9Sstevel@tonic-gate * CDDL HEADER START
37c478bd9Sstevel@tonic-gate *
47c478bd9Sstevel@tonic-gate * The contents of this file are subject to the terms of the
545916cd2Sjpk * Common Development and Distribution License (the "License").
645916cd2Sjpk * You may not use this file except in compliance with the License.
77c478bd9Sstevel@tonic-gate *
87c478bd9Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
97c478bd9Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing.
107c478bd9Sstevel@tonic-gate * See the License for the specific language governing permissions
117c478bd9Sstevel@tonic-gate * and limitations under the License.
127c478bd9Sstevel@tonic-gate *
137c478bd9Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each
147c478bd9Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
157c478bd9Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the
167c478bd9Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying
177c478bd9Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner]
187c478bd9Sstevel@tonic-gate *
197c478bd9Sstevel@tonic-gate * CDDL HEADER END
207c478bd9Sstevel@tonic-gate */
21794f0adbSRoger A. Faulkner
227c478bd9Sstevel@tonic-gate /*
234a0fa546SMarek Pospisil * Copyright (c) 1992, 2010, Oracle and/or its affiliates. All rights reserved.
2489b43686SBayard Bell * Copyright (c) 2011 Bayard G. Bell. All rights reserved.
2515c07adcSJohn Levon * Copyright (c) 2018, Joyent, Inc.
26*2b395c3cSAndy Fiddaman * Copyright 2024 Oxide Computer Company
277c478bd9Sstevel@tonic-gate */
287c478bd9Sstevel@tonic-gate
297c478bd9Sstevel@tonic-gate /*
307c478bd9Sstevel@tonic-gate * This file contains the audit event table used to control the production
317c478bd9Sstevel@tonic-gate * of audit records for each system call.
327c478bd9Sstevel@tonic-gate */
337c478bd9Sstevel@tonic-gate
347c478bd9Sstevel@tonic-gate #include <sys/policy.h>
357c478bd9Sstevel@tonic-gate #include <sys/cred.h>
367c478bd9Sstevel@tonic-gate #include <sys/types.h>
377c478bd9Sstevel@tonic-gate #include <sys/systm.h>
387c478bd9Sstevel@tonic-gate #include <sys/systeminfo.h> /* for sysinfo auditing */
397c478bd9Sstevel@tonic-gate #include <sys/utsname.h> /* for sysinfo auditing */
407c478bd9Sstevel@tonic-gate #include <sys/proc.h>
417c478bd9Sstevel@tonic-gate #include <sys/vnode.h>
427c478bd9Sstevel@tonic-gate #include <sys/mman.h> /* for mmap(2) auditing etc. */
437c478bd9Sstevel@tonic-gate #include <sys/fcntl.h>
447c478bd9Sstevel@tonic-gate #include <sys/modctl.h> /* for modctl auditing */
457c478bd9Sstevel@tonic-gate #include <sys/vnode.h>
467c478bd9Sstevel@tonic-gate #include <sys/user.h>
477c478bd9Sstevel@tonic-gate #include <sys/types.h>
487c478bd9Sstevel@tonic-gate #include <sys/processor.h>
497c478bd9Sstevel@tonic-gate #include <sys/procset.h>
507c478bd9Sstevel@tonic-gate #include <sys/acl.h>
517c478bd9Sstevel@tonic-gate #include <sys/ipc.h>
527c478bd9Sstevel@tonic-gate #include <sys/door.h>
537c478bd9Sstevel@tonic-gate #include <sys/sem.h>
547c478bd9Sstevel@tonic-gate #include <sys/msg.h>
557c478bd9Sstevel@tonic-gate #include <sys/shm.h>
567c478bd9Sstevel@tonic-gate #include <sys/kmem.h>
577c478bd9Sstevel@tonic-gate #include <sys/file.h> /* for accept */
587c478bd9Sstevel@tonic-gate #include <sys/utssys.h> /* for fuser */
5945916cd2Sjpk #include <sys/tsol/label.h>
6061b9bf51Srica #include <sys/tsol/tndb.h>
6161b9bf51Srica #include <sys/tsol/tsyscall.h>
627c478bd9Sstevel@tonic-gate #include <c2/audit.h>
637c478bd9Sstevel@tonic-gate #include <c2/audit_kernel.h>
647c478bd9Sstevel@tonic-gate #include <c2/audit_kevents.h>
657c478bd9Sstevel@tonic-gate #include <c2/audit_record.h>
667c478bd9Sstevel@tonic-gate #include <sys/procset.h>
677c478bd9Sstevel@tonic-gate #include <nfs/mount.h>
687c478bd9Sstevel@tonic-gate #include <sys/param.h>
697c478bd9Sstevel@tonic-gate #include <sys/debug.h>
707c478bd9Sstevel@tonic-gate #include <sys/sysmacros.h>
717c478bd9Sstevel@tonic-gate #include <sys/stream.h>
727c478bd9Sstevel@tonic-gate #include <sys/strsubr.h>
737c478bd9Sstevel@tonic-gate #include <sys/stropts.h>
747c478bd9Sstevel@tonic-gate #include <sys/tihdr.h>
757c478bd9Sstevel@tonic-gate #include <sys/socket.h>
767c478bd9Sstevel@tonic-gate #include <sys/socketvar.h>
770f1702c5SYu Xiangning #include <sys/vfs_opreg.h>
780f1702c5SYu Xiangning #include <fs/sockfs/sockcommon.h>
797c478bd9Sstevel@tonic-gate #include <netinet/in.h>
807c478bd9Sstevel@tonic-gate #include <sys/ddi.h>
81df2381bfSpraks #include <sys/port_impl.h>
82d2a70789SRichard Lowe #include <sys/secflags.h>
83*2b395c3cSAndy Fiddaman #include <sys/execx.h>
84df2381bfSpraks
858fd04b83SRoger A. Faulkner static au_event_t aui_fchownat(au_event_t);
86794f0adbSRoger A. Faulkner static au_event_t aui_fchmodat(au_event_t);
877c478bd9Sstevel@tonic-gate static au_event_t aui_open(au_event_t);
888fd04b83SRoger A. Faulkner static au_event_t aui_openat(au_event_t);
898fd04b83SRoger A. Faulkner static au_event_t aui_unlinkat(au_event_t);
908fd04b83SRoger A. Faulkner static au_event_t aui_fstatat(au_event_t);
917c478bd9Sstevel@tonic-gate static au_event_t aui_msgsys(au_event_t);
927c478bd9Sstevel@tonic-gate static au_event_t aui_shmsys(au_event_t);
937c478bd9Sstevel@tonic-gate static au_event_t aui_semsys(au_event_t);
947c478bd9Sstevel@tonic-gate static au_event_t aui_utssys(au_event_t);
957c478bd9Sstevel@tonic-gate static au_event_t aui_fcntl(au_event_t);
967c478bd9Sstevel@tonic-gate static au_event_t aui_execve(au_event_t);
977c478bd9Sstevel@tonic-gate static au_event_t aui_memcntl(au_event_t);
987c478bd9Sstevel@tonic-gate static au_event_t aui_sysinfo(au_event_t);
99df2381bfSpraks static au_event_t aui_portfs(au_event_t);
1007c478bd9Sstevel@tonic-gate static au_event_t aui_auditsys(au_event_t);
1017c478bd9Sstevel@tonic-gate static au_event_t aui_modctl(au_event_t);
1027c478bd9Sstevel@tonic-gate static au_event_t aui_acl(au_event_t);
1037c478bd9Sstevel@tonic-gate static au_event_t aui_doorfs(au_event_t);
1047c478bd9Sstevel@tonic-gate static au_event_t aui_privsys(au_event_t);
105657b1f3dSraf static au_event_t aui_forksys(au_event_t);
10661b9bf51Srica static au_event_t aui_labelsys(au_event_t);
1074be8c573SJan Friedel static au_event_t aui_setpgrp(au_event_t);
1087c478bd9Sstevel@tonic-gate
109d2a70789SRichard Lowe
110cb49a9fdSMarek Pospisil static void aus_exit(struct t_audit_data *);
1117c478bd9Sstevel@tonic-gate static void aus_open(struct t_audit_data *);
1128fd04b83SRoger A. Faulkner static void aus_openat(struct t_audit_data *);
1137c478bd9Sstevel@tonic-gate static void aus_acl(struct t_audit_data *);
1147c478bd9Sstevel@tonic-gate static void aus_acct(struct t_audit_data *);
1157c478bd9Sstevel@tonic-gate static void aus_chown(struct t_audit_data *);
1167c478bd9Sstevel@tonic-gate static void aus_fchown(struct t_audit_data *);
1177c478bd9Sstevel@tonic-gate static void aus_lchown(struct t_audit_data *);
1188fd04b83SRoger A. Faulkner static void aus_fchownat(struct t_audit_data *);
1197c478bd9Sstevel@tonic-gate static void aus_chmod(struct t_audit_data *);
1207c478bd9Sstevel@tonic-gate static void aus_facl(struct t_audit_data *);
1217c478bd9Sstevel@tonic-gate static void aus_fchmod(struct t_audit_data *);
122794f0adbSRoger A. Faulkner static void aus_fchmodat(struct t_audit_data *);
1237c478bd9Sstevel@tonic-gate static void aus_fcntl(struct t_audit_data *);
124*2b395c3cSAndy Fiddaman static void aus_execve(struct t_audit_data *);
1257c478bd9Sstevel@tonic-gate static void aus_mkdir(struct t_audit_data *);
126794f0adbSRoger A. Faulkner static void aus_mkdirat(struct t_audit_data *);
1277c478bd9Sstevel@tonic-gate static void aus_mknod(struct t_audit_data *);
128794f0adbSRoger A. Faulkner static void aus_mknodat(struct t_audit_data *);
1297c478bd9Sstevel@tonic-gate static void aus_mount(struct t_audit_data *);
1307c478bd9Sstevel@tonic-gate static void aus_umount2(struct t_audit_data *);
1317c478bd9Sstevel@tonic-gate static void aus_msgsys(struct t_audit_data *);
1327c478bd9Sstevel@tonic-gate static void aus_semsys(struct t_audit_data *);
1337c478bd9Sstevel@tonic-gate static void aus_close(struct t_audit_data *);
1347c478bd9Sstevel@tonic-gate static void aus_fstatfs(struct t_audit_data *);
1357c478bd9Sstevel@tonic-gate static void aus_setgid(struct t_audit_data *);
1364be8c573SJan Friedel static void aus_setpgrp(struct t_audit_data *);
1377c478bd9Sstevel@tonic-gate static void aus_setuid(struct t_audit_data *);
1387c478bd9Sstevel@tonic-gate static void aus_shmsys(struct t_audit_data *);
1397c478bd9Sstevel@tonic-gate static void aus_doorfs(struct t_audit_data *);
1407c478bd9Sstevel@tonic-gate static void aus_ioctl(struct t_audit_data *);
1417c478bd9Sstevel@tonic-gate static void aus_memcntl(struct t_audit_data *);
1427c478bd9Sstevel@tonic-gate static void aus_mmap(struct t_audit_data *);
1437c478bd9Sstevel@tonic-gate static void aus_munmap(struct t_audit_data *);
1447c478bd9Sstevel@tonic-gate static void aus_priocntlsys(struct t_audit_data *);
1457c478bd9Sstevel@tonic-gate static void aus_setegid(struct t_audit_data *);
1467c478bd9Sstevel@tonic-gate static void aus_setgroups(struct t_audit_data *);
1477c478bd9Sstevel@tonic-gate static void aus_seteuid(struct t_audit_data *);
1487c478bd9Sstevel@tonic-gate static void aus_putmsg(struct t_audit_data *);
1497c478bd9Sstevel@tonic-gate static void aus_putpmsg(struct t_audit_data *);
1507c478bd9Sstevel@tonic-gate static void aus_getmsg(struct t_audit_data *);
1517c478bd9Sstevel@tonic-gate static void aus_getpmsg(struct t_audit_data *);
1527c478bd9Sstevel@tonic-gate static void aus_auditsys(struct t_audit_data *);
1537c478bd9Sstevel@tonic-gate static void aus_sysinfo(struct t_audit_data *);
1547c478bd9Sstevel@tonic-gate static void aus_modctl(struct t_audit_data *);
1557c478bd9Sstevel@tonic-gate static void aus_kill(struct t_audit_data *);
1567c478bd9Sstevel@tonic-gate static void aus_setregid(struct t_audit_data *);
1577c478bd9Sstevel@tonic-gate static void aus_setreuid(struct t_audit_data *);
15861b9bf51Srica static void aus_labelsys(struct t_audit_data *);
1597c478bd9Sstevel@tonic-gate
1607c478bd9Sstevel@tonic-gate static void auf_mknod(struct t_audit_data *, int, rval_t *);
161794f0adbSRoger A. Faulkner static void auf_mknodat(struct t_audit_data *, int, rval_t *);
1627c478bd9Sstevel@tonic-gate static void auf_msgsys(struct t_audit_data *, int, rval_t *);
1637c478bd9Sstevel@tonic-gate static void auf_semsys(struct t_audit_data *, int, rval_t *);
1647c478bd9Sstevel@tonic-gate static void auf_shmsys(struct t_audit_data *, int, rval_t *);
1657c478bd9Sstevel@tonic-gate static void auf_read(struct t_audit_data *, int, rval_t *);
1667c478bd9Sstevel@tonic-gate static void auf_write(struct t_audit_data *, int, rval_t *);
1677c478bd9Sstevel@tonic-gate
1687c478bd9Sstevel@tonic-gate static void aus_sigqueue(struct t_audit_data *);
1697c478bd9Sstevel@tonic-gate static void aus_p_online(struct t_audit_data *);
1707c478bd9Sstevel@tonic-gate static void aus_processor_bind(struct t_audit_data *);
1717c478bd9Sstevel@tonic-gate static void aus_inst_sync(struct t_audit_data *);
1729acbbeafSnn static void aus_brandsys(struct t_audit_data *);
1737c478bd9Sstevel@tonic-gate
1747c478bd9Sstevel@tonic-gate static void auf_accept(struct t_audit_data *, int, rval_t *);
1757c478bd9Sstevel@tonic-gate
1767c478bd9Sstevel@tonic-gate static void auf_bind(struct t_audit_data *, int, rval_t *);
1777c478bd9Sstevel@tonic-gate static void auf_connect(struct t_audit_data *, int, rval_t *);
1787c478bd9Sstevel@tonic-gate static void aus_shutdown(struct t_audit_data *);
1797c478bd9Sstevel@tonic-gate static void auf_setsockopt(struct t_audit_data *, int, rval_t *);
1807c478bd9Sstevel@tonic-gate static void aus_sockconfig(struct t_audit_data *);
1817c478bd9Sstevel@tonic-gate static void auf_recv(struct t_audit_data *, int, rval_t *);
1827c478bd9Sstevel@tonic-gate static void auf_recvmsg(struct t_audit_data *, int, rval_t *);
1837c478bd9Sstevel@tonic-gate static void auf_send(struct t_audit_data *, int, rval_t *);
1847c478bd9Sstevel@tonic-gate static void auf_sendmsg(struct t_audit_data *, int, rval_t *);
1857c478bd9Sstevel@tonic-gate static void auf_recvfrom(struct t_audit_data *, int, rval_t *);
1867c478bd9Sstevel@tonic-gate static void auf_sendto(struct t_audit_data *, int, rval_t *);
1877c478bd9Sstevel@tonic-gate static void aus_socket(struct t_audit_data *);
1887c478bd9Sstevel@tonic-gate /*
1897c478bd9Sstevel@tonic-gate * This table contains mapping information for converting system call numbers
1907c478bd9Sstevel@tonic-gate * to audit event IDs. In several cases it is necessary to map a single system
1917c478bd9Sstevel@tonic-gate * call to several events.
1927c478bd9Sstevel@tonic-gate */
1937c478bd9Sstevel@tonic-gate
194f9d0e028Sgww #define aui_null NULL /* NULL initialize function */
195f9d0e028Sgww #define aus_null NULL /* NULL start function */
196f9d0e028Sgww #define auf_null NULL /* NULL finish function */
197f9d0e028Sgww
1987c478bd9Sstevel@tonic-gate struct audit_s2e audit_s2e[] =
1997c478bd9Sstevel@tonic-gate {
2007c478bd9Sstevel@tonic-gate /*
2010f48f68dSToomas Soome * ---------- ---------- ---------- ----------
2027c478bd9Sstevel@tonic-gate * INITIAL AUDIT START SYSTEM
2037c478bd9Sstevel@tonic-gate * PROCESSING EVENT PROCESSING CALL
2047c478bd9Sstevel@tonic-gate * ---------- ---------- ---------- -----------
2057c478bd9Sstevel@tonic-gate * FINISH EVENT
2067c478bd9Sstevel@tonic-gate * PROCESSING CONTROL
2077c478bd9Sstevel@tonic-gate * ----------------------------------------------------------
2087c478bd9Sstevel@tonic-gate */
2097c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 0 unused (indirect) */
2107c478bd9Sstevel@tonic-gate auf_null, 0,
211cb49a9fdSMarek Pospisil aui_null, AUE_EXIT, aus_exit, /* 1 exit */
2127c478bd9Sstevel@tonic-gate auf_null, S2E_NPT,
213d2a70789SRichard Lowe aui_null, AUE_PSECFLAGS, aus_null, /* 2 psecflags */
2147c478bd9Sstevel@tonic-gate auf_null, 0,
2157c478bd9Sstevel@tonic-gate aui_null, AUE_READ, aus_null, /* 3 read */
2167c478bd9Sstevel@tonic-gate auf_read, S2E_PUB,
2177c478bd9Sstevel@tonic-gate aui_null, AUE_WRITE, aus_null, /* 4 write */
2187c478bd9Sstevel@tonic-gate auf_write, 0,
2197c478bd9Sstevel@tonic-gate aui_open, AUE_OPEN, aus_open, /* 5 open */
2207c478bd9Sstevel@tonic-gate auf_null, S2E_SP,
2217c478bd9Sstevel@tonic-gate aui_null, AUE_CLOSE, aus_close, /* 6 close */
2227c478bd9Sstevel@tonic-gate auf_null, 0,
223794f0adbSRoger A. Faulkner aui_null, AUE_LINK, aus_null, /* 7 linkat */
2248fd04b83SRoger A. Faulkner auf_null, 0,
2258fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 8 (loadable) was creat */
2267c478bd9Sstevel@tonic-gate auf_null, 0,
2277c478bd9Sstevel@tonic-gate aui_null, AUE_LINK, aus_null, /* 9 link */
2287c478bd9Sstevel@tonic-gate auf_null, 0,
2297c478bd9Sstevel@tonic-gate aui_null, AUE_UNLINK, aus_null, /* 10 unlink */
2307c478bd9Sstevel@tonic-gate auf_null, 0,
231794f0adbSRoger A. Faulkner aui_null, AUE_SYMLINK, aus_null, /* 11 symlinkat */
2328fd04b83SRoger A. Faulkner auf_null, 0,
2337c478bd9Sstevel@tonic-gate aui_null, AUE_CHDIR, aus_null, /* 12 chdir */
2347c478bd9Sstevel@tonic-gate auf_null, S2E_SP,
2357c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 13 time */
2367c478bd9Sstevel@tonic-gate auf_null, 0,
2377c478bd9Sstevel@tonic-gate aui_null, AUE_MKNOD, aus_mknod, /* 14 mknod */
238794f0adbSRoger A. Faulkner auf_mknod, S2E_MLD,
2397c478bd9Sstevel@tonic-gate aui_null, AUE_CHMOD, aus_chmod, /* 15 chmod */
2407c478bd9Sstevel@tonic-gate auf_null, 0,
2417c478bd9Sstevel@tonic-gate aui_null, AUE_CHOWN, aus_chown, /* 16 chown */
2427c478bd9Sstevel@tonic-gate auf_null, 0,
2437c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 17 brk */
2447c478bd9Sstevel@tonic-gate auf_null, 0,
2457c478bd9Sstevel@tonic-gate aui_null, AUE_STAT, aus_null, /* 18 stat */
2467c478bd9Sstevel@tonic-gate auf_null, S2E_PUB,
2477c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 19 lseek */
2487c478bd9Sstevel@tonic-gate auf_null, 0,
2497c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 20 getpid */
2507c478bd9Sstevel@tonic-gate auf_null, 0,
2517c478bd9Sstevel@tonic-gate aui_null, AUE_MOUNT, aus_mount, /* 21 mount */
2527c478bd9Sstevel@tonic-gate auf_null, S2E_MLD,
253794f0adbSRoger A. Faulkner aui_null, AUE_READLINK, aus_null, /* 22 readlinkat */
254794f0adbSRoger A. Faulkner auf_null, S2E_PUB,
2557c478bd9Sstevel@tonic-gate aui_null, AUE_SETUID, aus_setuid, /* 23 setuid */
2567c478bd9Sstevel@tonic-gate auf_null, 0,
2577c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 24 getuid */
2587c478bd9Sstevel@tonic-gate auf_null, 0,
2597c478bd9Sstevel@tonic-gate aui_null, AUE_STIME, aus_null, /* 25 stime */
2607c478bd9Sstevel@tonic-gate auf_null, 0,
2618fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 26 pcsample */
2627c478bd9Sstevel@tonic-gate auf_null, 0,
2637c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 27 alarm */
2647c478bd9Sstevel@tonic-gate auf_null, 0,
2657c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 28 fstat */
2667c478bd9Sstevel@tonic-gate auf_null, 0,
2677c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 29 pause */
2687c478bd9Sstevel@tonic-gate auf_null, 0,
2698fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 30 (loadable) was utime */
2707c478bd9Sstevel@tonic-gate auf_null, 0,
2717c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 31 stty (TIOCSETP-audit?) */
2727c478bd9Sstevel@tonic-gate auf_null, 0,
2737c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 32 gtty */
2747c478bd9Sstevel@tonic-gate auf_null, 0,
2757c478bd9Sstevel@tonic-gate aui_null, AUE_ACCESS, aus_null, /* 33 access */
2767c478bd9Sstevel@tonic-gate auf_null, S2E_PUB,
2777c478bd9Sstevel@tonic-gate aui_null, AUE_NICE, aus_null, /* 34 nice */
2787c478bd9Sstevel@tonic-gate auf_null, 0,
2797c478bd9Sstevel@tonic-gate aui_null, AUE_STATFS, aus_null, /* 35 statfs */
2807c478bd9Sstevel@tonic-gate auf_null, S2E_PUB,
2817c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 36 sync */
2827c478bd9Sstevel@tonic-gate auf_null, 0,
2837c478bd9Sstevel@tonic-gate aui_null, AUE_KILL, aus_kill, /* 37 kill */
2847c478bd9Sstevel@tonic-gate auf_null, 0,
2857c478bd9Sstevel@tonic-gate aui_null, AUE_FSTATFS, aus_fstatfs, /* 38 fstatfs */
2867c478bd9Sstevel@tonic-gate auf_null, S2E_PUB,
2874be8c573SJan Friedel aui_setpgrp, AUE_SETPGRP, aus_setpgrp, /* 39 setpgrp */
2887c478bd9Sstevel@tonic-gate auf_null, 0,
2899acbbeafSnn aui_null, AUE_NULL, aus_null, /* 40 uucopystr */
2907c478bd9Sstevel@tonic-gate auf_null, 0,
2918fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 41 (loadable) was dup */
2927c478bd9Sstevel@tonic-gate auf_null, 0,
2938fd04b83SRoger A. Faulkner aui_null, AUE_PIPE, aus_null, /* 42 (loadable) pipe */
2947c478bd9Sstevel@tonic-gate auf_null, 0,
2957c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 43 times */
2967c478bd9Sstevel@tonic-gate auf_null, 0,
2977c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 44 profil */
2987c478bd9Sstevel@tonic-gate auf_null, 0,
2998fd04b83SRoger A. Faulkner aui_null, AUE_ACCESS, aus_null, /* 45 faccessat */
300c4d3e299SBrent Paulson auf_null, S2E_PUB,
3017c478bd9Sstevel@tonic-gate aui_null, AUE_SETGID, aus_setgid, /* 46 setgid */
3027c478bd9Sstevel@tonic-gate auf_null, 0,
3037c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 47 getgid */
3047c478bd9Sstevel@tonic-gate auf_null, 0,
305794f0adbSRoger A. Faulkner aui_null, AUE_MKNOD, aus_mknodat, /* 48 mknodat */
306794f0adbSRoger A. Faulkner auf_mknodat, S2E_MLD,
3078fd04b83SRoger A. Faulkner aui_msgsys, AUE_MSGSYS, aus_msgsys, /* 49 (loadable) msgsys */
3087c478bd9Sstevel@tonic-gate auf_msgsys, 0,
3097c478bd9Sstevel@tonic-gate #if defined(__x86)
3107c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 50 sysi86 */
3117c478bd9Sstevel@tonic-gate auf_null, 0,
3127c478bd9Sstevel@tonic-gate #else
3137c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 50 (loadable) was sys3b */
3147c478bd9Sstevel@tonic-gate auf_null, 0,
3157c478bd9Sstevel@tonic-gate #endif /* __x86 */
3168fd04b83SRoger A. Faulkner aui_null, AUE_ACCT, aus_acct, /* 51 (loadable) sysacct */
3177c478bd9Sstevel@tonic-gate auf_null, 0,
3188fd04b83SRoger A. Faulkner aui_shmsys, AUE_SHMSYS, aus_shmsys, /* 52 (loadable) shmsys */
3197c478bd9Sstevel@tonic-gate auf_shmsys, 0,
3208fd04b83SRoger A. Faulkner aui_semsys, AUE_SEMSYS, aus_semsys, /* 53 (loadable) semsys */
3217c478bd9Sstevel@tonic-gate auf_semsys, 0,
3227c478bd9Sstevel@tonic-gate aui_null, AUE_IOCTL, aus_ioctl, /* 54 ioctl */
3237c478bd9Sstevel@tonic-gate auf_null, 0,
3247c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 55 uadmin */
3257c478bd9Sstevel@tonic-gate auf_null, 0,
3268fd04b83SRoger A. Faulkner aui_fchownat, AUE_NULL, aus_fchownat, /* 56 fchownat */
327c4d3e299SBrent Paulson auf_null, 0,
3287c478bd9Sstevel@tonic-gate aui_utssys, AUE_FUSERS, aus_null, /* 57 utssys */
3297c478bd9Sstevel@tonic-gate auf_null, 0,
3307c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 58 fsync */
3317c478bd9Sstevel@tonic-gate auf_null, 0,
332*2b395c3cSAndy Fiddaman aui_execve, AUE_EXECVE, aus_execve, /* 59 exece */
3337c478bd9Sstevel@tonic-gate auf_null, S2E_MLD,
3347c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 60 umask */
3357c478bd9Sstevel@tonic-gate auf_null, 0,
3367c478bd9Sstevel@tonic-gate aui_null, AUE_CHROOT, aus_null, /* 61 chroot */
3377c478bd9Sstevel@tonic-gate auf_null, S2E_SP,
3387c478bd9Sstevel@tonic-gate aui_fcntl, AUE_FCNTL, aus_fcntl, /* 62 fcntl */
3397c478bd9Sstevel@tonic-gate auf_null, 0,
3407c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 63 ulimit */
3417c478bd9Sstevel@tonic-gate auf_null, 0,
3428fd04b83SRoger A. Faulkner aui_null, AUE_RENAME, aus_null, /* 64 renameat */
343c4d3e299SBrent Paulson auf_null, 0,
3448fd04b83SRoger A. Faulkner aui_unlinkat, AUE_NULL, aus_null, /* 65 unlinkat */
345c4d3e299SBrent Paulson auf_null, 0,
3468fd04b83SRoger A. Faulkner aui_fstatat, AUE_NULL, aus_null, /* 66 fstatat */
347c4d3e299SBrent Paulson auf_null, S2E_PUB,
3488fd04b83SRoger A. Faulkner aui_fstatat, AUE_NULL, aus_null, /* 67 fstatat64 */
349c4d3e299SBrent Paulson auf_null, S2E_PUB,
3508fd04b83SRoger A. Faulkner aui_openat, AUE_OPEN, aus_openat, /* 68 openat */
351c4d3e299SBrent Paulson auf_null, S2E_SP,
3528fd04b83SRoger A. Faulkner aui_openat, AUE_OPEN, aus_openat, /* 69 openat64 */
353c4d3e299SBrent Paulson auf_null, S2E_SP,
3548fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 70 tasksys */
3557c478bd9Sstevel@tonic-gate auf_null, 0,
3568fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 71 (loadable) acctctl */
3577c478bd9Sstevel@tonic-gate auf_null, 0,
3588fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 72 (loadable) exacct */
3597c478bd9Sstevel@tonic-gate auf_null, 0,
3608fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 73 getpagesizes */
3617c478bd9Sstevel@tonic-gate auf_null, 0,
3628fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 74 rctlsys */
3637c478bd9Sstevel@tonic-gate auf_null, 0,
364f48205beScasper aui_null, AUE_NULL, aus_null, /* 75 sidsys */
3657c478bd9Sstevel@tonic-gate auf_null, 0,
3668fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 76 (loadable) was fsat */
3677c478bd9Sstevel@tonic-gate auf_null, 0,
3688fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 77 syslwp_park */
3697c478bd9Sstevel@tonic-gate auf_null, 0,
3708fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 78 sendfilev */
3717c478bd9Sstevel@tonic-gate auf_null, 0,
3727c478bd9Sstevel@tonic-gate aui_null, AUE_RMDIR, aus_null, /* 79 rmdir */
3737c478bd9Sstevel@tonic-gate auf_null, 0,
3747c478bd9Sstevel@tonic-gate aui_null, AUE_MKDIR, aus_mkdir, /* 80 mkdir */
3757c478bd9Sstevel@tonic-gate auf_null, 0,
3767c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 81 getdents */
3777c478bd9Sstevel@tonic-gate auf_null, 0,
3787c478bd9Sstevel@tonic-gate aui_privsys, AUE_NULL, aus_null, /* 82 privsys */
3797c478bd9Sstevel@tonic-gate auf_null, 0,
3808fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 83 ucredsys */
3817c478bd9Sstevel@tonic-gate auf_null, 0,
3827c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 84 sysfs */
3837c478bd9Sstevel@tonic-gate auf_null, 0,
3847c478bd9Sstevel@tonic-gate aui_null, AUE_GETMSG, aus_getmsg, /* 85 getmsg */
3857c478bd9Sstevel@tonic-gate auf_null, 0,
3867c478bd9Sstevel@tonic-gate aui_null, AUE_PUTMSG, aus_putmsg, /* 86 putmsg */
3877c478bd9Sstevel@tonic-gate auf_null, 0,
3888fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 87 (loadable) was poll */
3897c478bd9Sstevel@tonic-gate auf_null, 0,
3907c478bd9Sstevel@tonic-gate aui_null, AUE_LSTAT, aus_null, /* 88 lstat */
3917c478bd9Sstevel@tonic-gate auf_null, S2E_PUB,
3927c478bd9Sstevel@tonic-gate aui_null, AUE_SYMLINK, aus_null, /* 89 symlink */
3937c478bd9Sstevel@tonic-gate auf_null, 0,
3947c478bd9Sstevel@tonic-gate aui_null, AUE_READLINK, aus_null, /* 90 readlink */
3957c478bd9Sstevel@tonic-gate auf_null, S2E_PUB,
3967c478bd9Sstevel@tonic-gate aui_null, AUE_SETGROUPS, aus_setgroups, /* 91 setgroups */
3977c478bd9Sstevel@tonic-gate auf_null, 0,
3987c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 92 getgroups */
3997c478bd9Sstevel@tonic-gate auf_null, 0,
4007c478bd9Sstevel@tonic-gate aui_null, AUE_FCHMOD, aus_fchmod, /* 93 fchmod */
4017c478bd9Sstevel@tonic-gate auf_null, 0,
4027c478bd9Sstevel@tonic-gate aui_null, AUE_FCHOWN, aus_fchown, /* 94 fchown */
4037c478bd9Sstevel@tonic-gate auf_null, 0,
4047c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 95 sigprocmask */
4057c478bd9Sstevel@tonic-gate auf_null, 0,
4067c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 96 sigsuspend */
4077c478bd9Sstevel@tonic-gate auf_null, 0,
4087c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 97 sigaltstack */
4097c478bd9Sstevel@tonic-gate auf_null, 0,
4107c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 98 sigaction */
4117c478bd9Sstevel@tonic-gate auf_null, 0,
4127c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 99 sigpending */
4137c478bd9Sstevel@tonic-gate auf_null, 0,
4147c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 100 setcontext */
4157c478bd9Sstevel@tonic-gate auf_null, 0,
416794f0adbSRoger A. Faulkner aui_fchmodat, AUE_NULL, aus_fchmodat, /* 101 fchmodat */
4177c478bd9Sstevel@tonic-gate auf_null, 0,
418794f0adbSRoger A. Faulkner aui_null, AUE_MKDIR, aus_mkdirat, /* 102 mkdirat */
4197c478bd9Sstevel@tonic-gate auf_null, 0,
4207c478bd9Sstevel@tonic-gate aui_null, AUE_STATVFS, aus_null, /* 103 statvfs */
4217c478bd9Sstevel@tonic-gate auf_null, S2E_PUB,
4227c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 104 fstatvfs */
4237c478bd9Sstevel@tonic-gate auf_null, 0,
4248fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 105 getloadavg */
4257c478bd9Sstevel@tonic-gate auf_null, 0,
4267c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 106 nfssys */
4277c478bd9Sstevel@tonic-gate auf_null, 0,
4288fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 107 waitsys */
4297c478bd9Sstevel@tonic-gate auf_null, 0,
4308fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 108 sigsendsys */
4317c478bd9Sstevel@tonic-gate auf_null, 0,
4327c478bd9Sstevel@tonic-gate #if defined(__x86)
4337c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 109 hrtsys */
4347c478bd9Sstevel@tonic-gate auf_null, 0,
4357c478bd9Sstevel@tonic-gate #else
4367c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 109 (loadable) */
4377c478bd9Sstevel@tonic-gate auf_null, 0,
4387c478bd9Sstevel@tonic-gate #endif /* __x86 */
4398fd04b83SRoger A. Faulkner aui_null, AUE_UTIMES, aus_null, /* 110 utimesys */
440c4d3e299SBrent Paulson auf_null, 0,
4418fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 111 sigresend */
4427c478bd9Sstevel@tonic-gate auf_null, 0,
4438fd04b83SRoger A. Faulkner aui_null, AUE_PRIOCNTLSYS, aus_priocntlsys, /* 112 priocntlsys */
4447c478bd9Sstevel@tonic-gate auf_null, 0,
4457c478bd9Sstevel@tonic-gate aui_null, AUE_PATHCONF, aus_null, /* 113 pathconf */
4467c478bd9Sstevel@tonic-gate auf_null, S2E_PUB,
4477c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 114 mincore */
4487c478bd9Sstevel@tonic-gate auf_null, 0,
4497c478bd9Sstevel@tonic-gate aui_null, AUE_MMAP, aus_mmap, /* 115 mmap */
4507c478bd9Sstevel@tonic-gate auf_null, 0,
4517c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 116 mprotect */
4527c478bd9Sstevel@tonic-gate auf_null, 0,
4537c478bd9Sstevel@tonic-gate aui_null, AUE_MUNMAP, aus_munmap, /* 117 munmap */
4547c478bd9Sstevel@tonic-gate auf_null, 0,
4557c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 118 fpathconf */
4567c478bd9Sstevel@tonic-gate auf_null, 0,
4577c478bd9Sstevel@tonic-gate aui_null, AUE_VFORK, aus_null, /* 119 vfork */
4587c478bd9Sstevel@tonic-gate auf_null, 0,
4597c478bd9Sstevel@tonic-gate aui_null, AUE_FCHDIR, aus_null, /* 120 fchdir */
4607c478bd9Sstevel@tonic-gate auf_null, 0,
4617c478bd9Sstevel@tonic-gate aui_null, AUE_READ, aus_null, /* 121 readv */
4627c478bd9Sstevel@tonic-gate auf_read, S2E_PUB,
4637c478bd9Sstevel@tonic-gate aui_null, AUE_WRITE, aus_null, /* 122 writev */
4647c478bd9Sstevel@tonic-gate auf_write, 0,
4658fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 123 (loadable) was xstat */
4667c478bd9Sstevel@tonic-gate auf_null, 0,
4678fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 124 (loadable) was lxstat */
4688fd04b83SRoger A. Faulkner auf_null, 0,
4698fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 125 (loadable) was fxstat */
4708fd04b83SRoger A. Faulkner auf_null, 0,
4718fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 126 (loadable) was xmknod */
4728fd04b83SRoger A. Faulkner auf_null, 0,
4738fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 127 mmapobj */
4747c478bd9Sstevel@tonic-gate auf_null, 0,
4757c478bd9Sstevel@tonic-gate aui_null, AUE_SETRLIMIT, aus_null, /* 128 setrlimit */
4767c478bd9Sstevel@tonic-gate auf_null, 0,
4777c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 129 getrlimit */
4787c478bd9Sstevel@tonic-gate auf_null, 0,
4797c478bd9Sstevel@tonic-gate aui_null, AUE_LCHOWN, aus_lchown, /* 130 lchown */
4807c478bd9Sstevel@tonic-gate auf_null, 0,
4817c478bd9Sstevel@tonic-gate aui_memcntl, AUE_MEMCNTL, aus_memcntl, /* 131 memcntl */
4827c478bd9Sstevel@tonic-gate auf_null, 0,
4837c478bd9Sstevel@tonic-gate aui_null, AUE_GETPMSG, aus_getpmsg, /* 132 getpmsg */
4847c478bd9Sstevel@tonic-gate auf_null, 0,
4857c478bd9Sstevel@tonic-gate aui_null, AUE_PUTPMSG, aus_putpmsg, /* 133 putpmsg */
4867c478bd9Sstevel@tonic-gate auf_null, 0,
4877c478bd9Sstevel@tonic-gate aui_null, AUE_RENAME, aus_null, /* 134 rename */
4887c478bd9Sstevel@tonic-gate auf_null, 0,
4897c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 135 uname */
4907c478bd9Sstevel@tonic-gate auf_null, 0,
4917c478bd9Sstevel@tonic-gate aui_null, AUE_SETEGID, aus_setegid, /* 136 setegid */
4927c478bd9Sstevel@tonic-gate auf_null, 0,
4937c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 137 sysconfig */
4947c478bd9Sstevel@tonic-gate auf_null, 0,
4957c478bd9Sstevel@tonic-gate aui_null, AUE_ADJTIME, aus_null, /* 138 adjtime */
4967c478bd9Sstevel@tonic-gate auf_null, 0,
4977c478bd9Sstevel@tonic-gate aui_sysinfo, AUE_SYSINFO, aus_sysinfo, /* 139 systeminfo */
4987c478bd9Sstevel@tonic-gate auf_null, 0,
4998fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 140 (loadable) sharefs */
5007c478bd9Sstevel@tonic-gate auf_null, 0,
5017c478bd9Sstevel@tonic-gate aui_null, AUE_SETEUID, aus_seteuid, /* 141 seteuid */
5027c478bd9Sstevel@tonic-gate auf_null, 0,
503657b1f3dSraf aui_forksys, AUE_NULL, aus_null, /* 142 forksys */
5047c478bd9Sstevel@tonic-gate auf_null, 0,
5058fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 143 (loadable) was fork1 */
5067c478bd9Sstevel@tonic-gate auf_null, 0,
5077c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 144 sigwait */
5087c478bd9Sstevel@tonic-gate auf_null, 0,
5097c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 145 lwp_info */
5107c478bd9Sstevel@tonic-gate auf_null, 0,
5117c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 146 yield */
5127c478bd9Sstevel@tonic-gate auf_null, 0,
5138fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 147 (loadable) */
5148fd04b83SRoger A. Faulkner /* was lwp_sema_wait */
5157c478bd9Sstevel@tonic-gate auf_null, 0,
5167c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 148 lwp_sema_post */
5177c478bd9Sstevel@tonic-gate auf_null, 0,
5187c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 149 lwp_sema_trywait */
5197c478bd9Sstevel@tonic-gate auf_null, 0,
5208fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 150 lwp_detach */
5217c478bd9Sstevel@tonic-gate auf_null, 0,
5228fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 151 corectl */
5237c478bd9Sstevel@tonic-gate auf_null, 0,
5247c478bd9Sstevel@tonic-gate aui_modctl, AUE_MODCTL, aus_modctl, /* 152 modctl */
5257c478bd9Sstevel@tonic-gate auf_null, 0,
5267c478bd9Sstevel@tonic-gate aui_null, AUE_FCHROOT, aus_null, /* 153 fchroot */
5277c478bd9Sstevel@tonic-gate auf_null, 0,
5288fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 154 (loadable) was utimes */
5297c478bd9Sstevel@tonic-gate auf_null, 0,
5307c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 155 vhangup */
5317c478bd9Sstevel@tonic-gate auf_null, 0,
5327c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 156 gettimeofday */
5337c478bd9Sstevel@tonic-gate auf_null, 0,
5347c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 157 getitimer */
5357c478bd9Sstevel@tonic-gate auf_null, 0,
5367c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 158 setitimer */
5377c478bd9Sstevel@tonic-gate auf_null, 0,
5387c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 159 lwp_create */
5397c478bd9Sstevel@tonic-gate auf_null, 0,
5407c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 160 lwp_exit */
5417c478bd9Sstevel@tonic-gate auf_null, 0,
5427c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 161 lwp_suspend */
5437c478bd9Sstevel@tonic-gate auf_null, 0,
5447c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 162 lwp_continue */
5457c478bd9Sstevel@tonic-gate auf_null, 0,
5467c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 163 lwp_kill */
5477c478bd9Sstevel@tonic-gate auf_null, 0,
5487c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 164 lwp_self */
5497c478bd9Sstevel@tonic-gate auf_null, 0,
5508fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 165 lwp_sigmask */
5517c478bd9Sstevel@tonic-gate auf_null, 0,
5528fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 166 lwp_private */
5537c478bd9Sstevel@tonic-gate auf_null, 0,
5547c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 167 lwp_wait */
5557c478bd9Sstevel@tonic-gate auf_null, 0,
556883492d5Sraf aui_null, AUE_NULL, aus_null, /* 168 lwp_mutex_wakeup */
5577c478bd9Sstevel@tonic-gate auf_null, 0,
5588fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 169 (loadable) */
5598fd04b83SRoger A. Faulkner /* was lwp_mutex_lock */
5607c478bd9Sstevel@tonic-gate auf_null, 0,
5617c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 170 lwp_cond_wait */
5627c478bd9Sstevel@tonic-gate auf_null, 0,
5637c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 171 lwp_cond_signal */
5647c478bd9Sstevel@tonic-gate auf_null, 0,
5657c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 172 lwp_cond_broadcast */
5667c478bd9Sstevel@tonic-gate auf_null, 0,
5677c478bd9Sstevel@tonic-gate aui_null, AUE_READ, aus_null, /* 173 pread */
5687c478bd9Sstevel@tonic-gate auf_read, S2E_PUB,
5697c478bd9Sstevel@tonic-gate aui_null, AUE_WRITE, aus_null, /* 174 pwrite */
5707c478bd9Sstevel@tonic-gate auf_write, 0,
5717c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 175 llseek */
5727c478bd9Sstevel@tonic-gate auf_null, 0,
5738fd04b83SRoger A. Faulkner aui_null, AUE_INST_SYNC, aus_inst_sync, /* 176 (loadable) inst_sync */
5747c478bd9Sstevel@tonic-gate auf_null, 0,
5759acbbeafSnn aui_null, AUE_BRANDSYS, aus_brandsys, /* 177 brandsys */
5767c478bd9Sstevel@tonic-gate auf_null, 0,
5778fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 178 (loadable) kaio */
5787c478bd9Sstevel@tonic-gate auf_null, 0,
5798fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 179 (loadable) cpc */
5807c478bd9Sstevel@tonic-gate auf_null, 0,
5818fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 180 lgrpsys */
5827c478bd9Sstevel@tonic-gate auf_null, 0,
5838fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 181 rusagesys */
5847c478bd9Sstevel@tonic-gate auf_null, 0,
585df2381bfSpraks aui_portfs, AUE_PORTFS, aus_null, /* 182 (loadable) portfs */
5867e309bc2SJan Friedel auf_null, S2E_MLD,
5878fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 183 pollsys */
5887c478bd9Sstevel@tonic-gate auf_null, 0,
58961b9bf51Srica aui_labelsys, AUE_NULL, aus_labelsys, /* 184 labelsys */
5907c478bd9Sstevel@tonic-gate auf_null, 0,
5917c478bd9Sstevel@tonic-gate aui_acl, AUE_ACLSET, aus_acl, /* 185 acl */
5927c478bd9Sstevel@tonic-gate auf_null, 0,
5937c478bd9Sstevel@tonic-gate aui_auditsys, AUE_AUDITSYS, aus_auditsys, /* 186 auditsys */
5947c478bd9Sstevel@tonic-gate auf_null, 0,
5958fd04b83SRoger A. Faulkner aui_null, AUE_PROCESSOR_BIND, aus_processor_bind, /* 187 processor_bind */
5968fd04b83SRoger A. Faulkner auf_null, 0,
5977c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 188 processor_info */
5987c478bd9Sstevel@tonic-gate auf_null, 0,
5997c478bd9Sstevel@tonic-gate aui_null, AUE_P_ONLINE, aus_p_online, /* 189 p_online */
6007c478bd9Sstevel@tonic-gate auf_null, 0,
6017c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_sigqueue, /* 190 sigqueue */
6027c478bd9Sstevel@tonic-gate auf_null, 0,
6037c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 191 clock_gettime */
6047c478bd9Sstevel@tonic-gate auf_null, 0,
6057c478bd9Sstevel@tonic-gate aui_null, AUE_CLOCK_SETTIME, aus_null, /* 192 clock_settime */
6067c478bd9Sstevel@tonic-gate auf_null, 0,
6077c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 193 clock_getres */
6087c478bd9Sstevel@tonic-gate auf_null, 0,
6097c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 194 timer_create */
6107c478bd9Sstevel@tonic-gate auf_null, 0,
6117c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 195 timer_delete */
6127c478bd9Sstevel@tonic-gate auf_null, 0,
6137c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 196 timer_settime */
6147c478bd9Sstevel@tonic-gate auf_null, 0,
6157c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 197 timer_gettime */
6167c478bd9Sstevel@tonic-gate auf_null, 0,
6177c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 198 timer_getoverrun */
6187c478bd9Sstevel@tonic-gate auf_null, 0,
6197c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 199 nanosleep */
6207c478bd9Sstevel@tonic-gate auf_null, 0,
6217c478bd9Sstevel@tonic-gate aui_acl, AUE_FACLSET, aus_facl, /* 200 facl */
6227c478bd9Sstevel@tonic-gate auf_null, 0,
6237c478bd9Sstevel@tonic-gate aui_doorfs, AUE_DOORFS, aus_doorfs, /* 201 (loadable) doorfs */
6247c478bd9Sstevel@tonic-gate auf_null, 0,
6257c478bd9Sstevel@tonic-gate aui_null, AUE_SETREUID, aus_setreuid, /* 202 setreuid */
6267c478bd9Sstevel@tonic-gate auf_null, 0,
6277c478bd9Sstevel@tonic-gate aui_null, AUE_SETREGID, aus_setregid, /* 203 setregid */
6287c478bd9Sstevel@tonic-gate auf_null, 0,
6297c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 204 install_utrap */
6307c478bd9Sstevel@tonic-gate auf_null, 0,
6317c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 205 signotify */
6327c478bd9Sstevel@tonic-gate auf_null, 0,
6337c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 206 schedctl */
6347c478bd9Sstevel@tonic-gate auf_null, 0,
6357c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 207 (loadable) pset */
6367c478bd9Sstevel@tonic-gate auf_null, 0,
6378fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 208 sparc_utrap_install */
6387c478bd9Sstevel@tonic-gate auf_null, 0,
6397c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 209 resolvepath */
6407c478bd9Sstevel@tonic-gate auf_null, 0,
6417c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 210 lwp_mutex_timedlock */
6427c478bd9Sstevel@tonic-gate auf_null, 0,
6437c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 211 lwp_sema_timedwait */
6447c478bd9Sstevel@tonic-gate auf_null, 0,
6457c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 212 lwp_rwlock_sys */
6467c478bd9Sstevel@tonic-gate auf_null, 0,
6478fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 213 getdents64 */
6487c478bd9Sstevel@tonic-gate auf_null, 0,
6497c478bd9Sstevel@tonic-gate aui_null, AUE_MMAP, aus_mmap, /* 214 mmap64 */
6507c478bd9Sstevel@tonic-gate auf_null, 0,
6517c478bd9Sstevel@tonic-gate aui_null, AUE_STAT, aus_null, /* 215 stat64 */
6527c478bd9Sstevel@tonic-gate auf_null, S2E_PUB,
6537c478bd9Sstevel@tonic-gate aui_null, AUE_LSTAT, aus_null, /* 216 lstat64 */
6547c478bd9Sstevel@tonic-gate auf_null, S2E_PUB,
6557c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 217 fstat64 */
6567c478bd9Sstevel@tonic-gate auf_null, 0,
6577c478bd9Sstevel@tonic-gate aui_null, AUE_STATVFS, aus_null, /* 218 statvfs64 */
6587c478bd9Sstevel@tonic-gate auf_null, S2E_PUB,
6597c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 219 fstatvfs64 */
6607c478bd9Sstevel@tonic-gate auf_null, 0,
6617c478bd9Sstevel@tonic-gate aui_null, AUE_SETRLIMIT, aus_null, /* 220 setrlimit64 */
6627c478bd9Sstevel@tonic-gate auf_null, 0,
6637c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 221 getrlimit64 */
6647c478bd9Sstevel@tonic-gate auf_null, 0,
6657c478bd9Sstevel@tonic-gate aui_null, AUE_READ, aus_null, /* 222 pread64 */
6667c478bd9Sstevel@tonic-gate auf_read, S2E_PUB,
6677c478bd9Sstevel@tonic-gate aui_null, AUE_WRITE, aus_null, /* 223 pwrite64 */
6687c478bd9Sstevel@tonic-gate auf_write, 0,
6698fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 224 (loadable) was creat64 */
6708fd04b83SRoger A. Faulkner auf_null, 0,
6717c478bd9Sstevel@tonic-gate aui_open, AUE_OPEN, aus_open, /* 225 open64 */
6727c478bd9Sstevel@tonic-gate auf_null, S2E_SP,
6737c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 226 (loadable) rpcsys */
6747c478bd9Sstevel@tonic-gate auf_null, 0,
6758fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 227 zone */
6767c478bd9Sstevel@tonic-gate auf_null, 0,
6778fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 228 (loadable) autofssys */
6787c478bd9Sstevel@tonic-gate auf_null, 0,
6798fd04b83SRoger A. Faulkner aui_null, AUE_NULL, aus_null, /* 229 getcwd */
6807c478bd9Sstevel@tonic-gate auf_null, 0,
6817c478bd9Sstevel@tonic-gate aui_null, AUE_SOCKET, aus_socket, /* 230 so_socket */
6827c478bd9Sstevel@tonic-gate auf_null, 0,
6837c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 231 so_socketpair */
6847c478bd9Sstevel@tonic-gate auf_null, 0,
6857c478bd9Sstevel@tonic-gate aui_null, AUE_BIND, aus_null, /* 232 bind */
6867c478bd9Sstevel@tonic-gate auf_bind, 0,
6877c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 233 listen */
6887c478bd9Sstevel@tonic-gate auf_null, 0,
6897c478bd9Sstevel@tonic-gate aui_null, AUE_ACCEPT, aus_null, /* 234 accept */
6907c478bd9Sstevel@tonic-gate auf_accept, 0,
6917c478bd9Sstevel@tonic-gate aui_null, AUE_CONNECT, aus_null, /* 235 connect */
6927c478bd9Sstevel@tonic-gate auf_connect, 0,
6937c478bd9Sstevel@tonic-gate aui_null, AUE_SHUTDOWN, aus_shutdown, /* 236 shutdown */
6947c478bd9Sstevel@tonic-gate auf_null, 0,
6957c478bd9Sstevel@tonic-gate aui_null, AUE_READ, aus_null, /* 237 recv */
6967c478bd9Sstevel@tonic-gate auf_recv, 0,
6977c478bd9Sstevel@tonic-gate aui_null, AUE_RECVFROM, aus_null, /* 238 recvfrom */
6987c478bd9Sstevel@tonic-gate auf_recvfrom, 0,
6997c478bd9Sstevel@tonic-gate aui_null, AUE_RECVMSG, aus_null, /* 239 recvmsg */
7007c478bd9Sstevel@tonic-gate auf_recvmsg, 0,
7017c478bd9Sstevel@tonic-gate aui_null, AUE_WRITE, aus_null, /* 240 send */
7027c478bd9Sstevel@tonic-gate auf_send, 0,
7037c478bd9Sstevel@tonic-gate aui_null, AUE_SENDMSG, aus_null, /* 241 sendmsg */
7047c478bd9Sstevel@tonic-gate auf_sendmsg, 0,
7057c478bd9Sstevel@tonic-gate aui_null, AUE_SENDTO, aus_null, /* 242 sendto */
7067c478bd9Sstevel@tonic-gate auf_sendto, 0,
7077c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 243 getpeername */
7087c478bd9Sstevel@tonic-gate auf_null, 0,
7097c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 244 getsockname */
7107c478bd9Sstevel@tonic-gate auf_null, 0,
7117c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 245 getsockopt */
7127c478bd9Sstevel@tonic-gate auf_null, 0,
7137c478bd9Sstevel@tonic-gate aui_null, AUE_SETSOCKOPT, aus_null, /* 246 setsockopt */
7147c478bd9Sstevel@tonic-gate auf_setsockopt, 0,
7157c478bd9Sstevel@tonic-gate aui_null, AUE_SOCKCONFIG, aus_sockconfig, /* 247 sockconfig */
7167c478bd9Sstevel@tonic-gate auf_null, 0,
7177c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 248 ntp_gettime */
7187c478bd9Sstevel@tonic-gate auf_null, 0,
7198fd04b83SRoger A. Faulkner aui_null, AUE_NTP_ADJTIME, aus_null, /* 249 ntp_adjtime */
7207c478bd9Sstevel@tonic-gate auf_null, 0,
7217c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 250 lwp_mutex_unlock */
7227c478bd9Sstevel@tonic-gate auf_null, 0,
7237c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 251 lwp_mutex_trylock */
7247c478bd9Sstevel@tonic-gate auf_null, 0,
725883492d5Sraf aui_null, AUE_NULL, aus_null, /* 252 lwp_mutex_register */
7267c478bd9Sstevel@tonic-gate auf_null, 0,
7277c478bd9Sstevel@tonic-gate aui_null, AUE_NULL, aus_null, /* 253 cladm */
7287c478bd9Sstevel@tonic-gate auf_null, 0,
7299acbbeafSnn aui_null, AUE_NULL, aus_null, /* 254 uucopy */
7307c478bd9Sstevel@tonic-gate auf_null, 0,
7317c478bd9Sstevel@tonic-gate aui_null, AUE_UMOUNT2, aus_umount2, /* 255 umount2 */
7327c478bd9Sstevel@tonic-gate auf_null, 0
7337c478bd9Sstevel@tonic-gate };
7347c478bd9Sstevel@tonic-gate
7357c478bd9Sstevel@tonic-gate uint_t num_syscall = sizeof (audit_s2e) / sizeof (struct audit_s2e);
7367c478bd9Sstevel@tonic-gate
7377c478bd9Sstevel@tonic-gate
738cb49a9fdSMarek Pospisil /* exit start function */
739cb49a9fdSMarek Pospisil /*ARGSUSED*/
740cb49a9fdSMarek Pospisil static void
aus_exit(struct t_audit_data * tad)741cb49a9fdSMarek Pospisil aus_exit(struct t_audit_data *tad)
742cb49a9fdSMarek Pospisil {
743cb49a9fdSMarek Pospisil uint32_t rval;
744cb49a9fdSMarek Pospisil struct a {
745cb49a9fdSMarek Pospisil long rval;
746cb49a9fdSMarek Pospisil } *uap = (struct a *)ttolwp(curthread)->lwp_ap;
747cb49a9fdSMarek Pospisil
748cb49a9fdSMarek Pospisil rval = (uint32_t)uap->rval;
749cb49a9fdSMarek Pospisil au_uwrite(au_to_arg32(1, "exit status", rval));
750cb49a9fdSMarek Pospisil }
751cb49a9fdSMarek Pospisil
752d2a70789SRichard Lowe
7537c478bd9Sstevel@tonic-gate /* acct start function */
7547c478bd9Sstevel@tonic-gate /*ARGSUSED*/
7557c478bd9Sstevel@tonic-gate static void
aus_acct(struct t_audit_data * tad)7567c478bd9Sstevel@tonic-gate aus_acct(struct t_audit_data *tad)
7577c478bd9Sstevel@tonic-gate {
7587c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
7597c478bd9Sstevel@tonic-gate uintptr_t fname;
7607c478bd9Sstevel@tonic-gate
7617c478bd9Sstevel@tonic-gate struct a {
7627c478bd9Sstevel@tonic-gate long fname; /* char * */
7637c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
7647c478bd9Sstevel@tonic-gate
7657c478bd9Sstevel@tonic-gate fname = (uintptr_t)uap->fname;
7667c478bd9Sstevel@tonic-gate
7677c478bd9Sstevel@tonic-gate if (fname == 0)
7687c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "accounting off", (uint32_t)0));
7697c478bd9Sstevel@tonic-gate }
7707c478bd9Sstevel@tonic-gate
7717c478bd9Sstevel@tonic-gate /* chown start function */
7727c478bd9Sstevel@tonic-gate /*ARGSUSED*/
7737c478bd9Sstevel@tonic-gate static void
aus_chown(struct t_audit_data * tad)7747c478bd9Sstevel@tonic-gate aus_chown(struct t_audit_data *tad)
7757c478bd9Sstevel@tonic-gate {
7767c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
7777c478bd9Sstevel@tonic-gate uint32_t uid, gid;
7787c478bd9Sstevel@tonic-gate
7797c478bd9Sstevel@tonic-gate struct a {
7807c478bd9Sstevel@tonic-gate long fname; /* char * */
7817c478bd9Sstevel@tonic-gate long uid;
7827c478bd9Sstevel@tonic-gate long gid;
7837c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
7847c478bd9Sstevel@tonic-gate
7857c478bd9Sstevel@tonic-gate uid = (uint32_t)uap->uid;
7867c478bd9Sstevel@tonic-gate gid = (uint32_t)uap->gid;
7877c478bd9Sstevel@tonic-gate
7887c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(2, "new file uid", uid));
7897c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(3, "new file gid", gid));
7907c478bd9Sstevel@tonic-gate }
7917c478bd9Sstevel@tonic-gate
7927c478bd9Sstevel@tonic-gate /* fchown start function */
7937c478bd9Sstevel@tonic-gate /*ARGSUSED*/
7947c478bd9Sstevel@tonic-gate static void
aus_fchown(struct t_audit_data * tad)7957c478bd9Sstevel@tonic-gate aus_fchown(struct t_audit_data *tad)
7967c478bd9Sstevel@tonic-gate {
7977c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
7987c478bd9Sstevel@tonic-gate uint32_t uid, gid, fd;
7997c478bd9Sstevel@tonic-gate struct file *fp;
8007c478bd9Sstevel@tonic-gate struct vnode *vp;
8017c478bd9Sstevel@tonic-gate struct f_audit_data *fad;
8027c478bd9Sstevel@tonic-gate
8037c478bd9Sstevel@tonic-gate struct a {
8047c478bd9Sstevel@tonic-gate long fd;
8057c478bd9Sstevel@tonic-gate long uid;
8067c478bd9Sstevel@tonic-gate long gid;
8077c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
8087c478bd9Sstevel@tonic-gate
8097c478bd9Sstevel@tonic-gate fd = (uint32_t)uap->fd;
8107c478bd9Sstevel@tonic-gate uid = (uint32_t)uap->uid;
8117c478bd9Sstevel@tonic-gate gid = (uint32_t)uap->gid;
8127c478bd9Sstevel@tonic-gate
8137c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(2, "new file uid", uid));
8147c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(3, "new file gid", gid));
8157c478bd9Sstevel@tonic-gate
8167c478bd9Sstevel@tonic-gate /*
8177c478bd9Sstevel@tonic-gate * convert file pointer to file descriptor
8187c478bd9Sstevel@tonic-gate * Note: fd ref count incremented here.
8197c478bd9Sstevel@tonic-gate */
8207c478bd9Sstevel@tonic-gate if ((fp = getf(fd)) == NULL)
8217c478bd9Sstevel@tonic-gate return;
8227c478bd9Sstevel@tonic-gate
8237c478bd9Sstevel@tonic-gate /* get path from file struct here */
8247c478bd9Sstevel@tonic-gate fad = F2A(fp);
8257c478bd9Sstevel@tonic-gate if (fad->fad_aupath != NULL) {
8267c478bd9Sstevel@tonic-gate au_uwrite(au_to_path(fad->fad_aupath));
8277c478bd9Sstevel@tonic-gate } else {
8287c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "no path: fd", fd));
8297c478bd9Sstevel@tonic-gate }
8307c478bd9Sstevel@tonic-gate
8317c478bd9Sstevel@tonic-gate vp = fp->f_vnode;
8327c478bd9Sstevel@tonic-gate audit_attributes(vp);
8337c478bd9Sstevel@tonic-gate
8347c478bd9Sstevel@tonic-gate /* decrement file descriptor reference count */
8357c478bd9Sstevel@tonic-gate releasef(fd);
8367c478bd9Sstevel@tonic-gate }
8377c478bd9Sstevel@tonic-gate
8387c478bd9Sstevel@tonic-gate /*ARGSUSED*/
8397c478bd9Sstevel@tonic-gate static void
aus_lchown(struct t_audit_data * tad)8407c478bd9Sstevel@tonic-gate aus_lchown(struct t_audit_data *tad)
8417c478bd9Sstevel@tonic-gate {
8427c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
8437c478bd9Sstevel@tonic-gate uint32_t uid, gid;
8447c478bd9Sstevel@tonic-gate
8457c478bd9Sstevel@tonic-gate
8467c478bd9Sstevel@tonic-gate struct a {
8477c478bd9Sstevel@tonic-gate long fname; /* char * */
8487c478bd9Sstevel@tonic-gate long uid;
8497c478bd9Sstevel@tonic-gate long gid;
8507c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
8517c478bd9Sstevel@tonic-gate
8527c478bd9Sstevel@tonic-gate uid = (uint32_t)uap->uid;
8537c478bd9Sstevel@tonic-gate gid = (uint32_t)uap->gid;
8547c478bd9Sstevel@tonic-gate
8557c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(2, "new file uid", uid));
8567c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(3, "new file gid", gid));
8577c478bd9Sstevel@tonic-gate }
8587c478bd9Sstevel@tonic-gate
8598fd04b83SRoger A. Faulkner static au_event_t
aui_fchownat(au_event_t e)8608fd04b83SRoger A. Faulkner aui_fchownat(au_event_t e)
8618fd04b83SRoger A. Faulkner {
8628fd04b83SRoger A. Faulkner klwp_t *clwp = ttolwp(curthread);
8638fd04b83SRoger A. Faulkner
8648fd04b83SRoger A. Faulkner struct a {
8658fd04b83SRoger A. Faulkner long fd;
8668fd04b83SRoger A. Faulkner long fname; /* char * */
8678fd04b83SRoger A. Faulkner long uid;
8688fd04b83SRoger A. Faulkner long gid;
8698fd04b83SRoger A. Faulkner long flags;
8708fd04b83SRoger A. Faulkner } *uap = (struct a *)clwp->lwp_ap;
8718fd04b83SRoger A. Faulkner
8720f48f68dSToomas Soome if (uap->fname == 0)
8738fd04b83SRoger A. Faulkner e = AUE_FCHOWN;
8748fd04b83SRoger A. Faulkner else if (uap->flags & AT_SYMLINK_NOFOLLOW)
8758fd04b83SRoger A. Faulkner e = AUE_LCHOWN;
8768fd04b83SRoger A. Faulkner else
8778fd04b83SRoger A. Faulkner e = AUE_CHOWN;
8788fd04b83SRoger A. Faulkner
8798fd04b83SRoger A. Faulkner return (e);
8808fd04b83SRoger A. Faulkner }
8818fd04b83SRoger A. Faulkner
8828fd04b83SRoger A. Faulkner /*ARGSUSED*/
8838fd04b83SRoger A. Faulkner static void
aus_fchownat(struct t_audit_data * tad)8848fd04b83SRoger A. Faulkner aus_fchownat(struct t_audit_data *tad)
8858fd04b83SRoger A. Faulkner {
8868fd04b83SRoger A. Faulkner klwp_t *clwp = ttolwp(curthread);
8878fd04b83SRoger A. Faulkner uint32_t uid, gid;
8888fd04b83SRoger A. Faulkner
8898fd04b83SRoger A. Faulkner struct a {
8908fd04b83SRoger A. Faulkner long fd;
8918fd04b83SRoger A. Faulkner long fname; /* char * */
8928fd04b83SRoger A. Faulkner long uid;
8938fd04b83SRoger A. Faulkner long gid;
8948fd04b83SRoger A. Faulkner long flags;
8958fd04b83SRoger A. Faulkner } *uap = (struct a *)clwp->lwp_ap;
8968fd04b83SRoger A. Faulkner
8978fd04b83SRoger A. Faulkner uid = (uint32_t)uap->uid;
8988fd04b83SRoger A. Faulkner gid = (uint32_t)uap->gid;
8998fd04b83SRoger A. Faulkner
9008fd04b83SRoger A. Faulkner au_uwrite(au_to_arg32(3, "new file uid", uid));
9018fd04b83SRoger A. Faulkner au_uwrite(au_to_arg32(4, "new file gid", gid));
9028fd04b83SRoger A. Faulkner }
9038fd04b83SRoger A. Faulkner
9047c478bd9Sstevel@tonic-gate /*ARGSUSED*/
9057c478bd9Sstevel@tonic-gate static void
aus_chmod(struct t_audit_data * tad)9067c478bd9Sstevel@tonic-gate aus_chmod(struct t_audit_data *tad)
9077c478bd9Sstevel@tonic-gate {
9087c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
9097c478bd9Sstevel@tonic-gate uint32_t fmode;
9107c478bd9Sstevel@tonic-gate
9117c478bd9Sstevel@tonic-gate struct a {
9127c478bd9Sstevel@tonic-gate long fname; /* char * */
9137c478bd9Sstevel@tonic-gate long fmode;
9147c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
9157c478bd9Sstevel@tonic-gate
9167c478bd9Sstevel@tonic-gate fmode = (uint32_t)uap->fmode;
9177c478bd9Sstevel@tonic-gate
9187c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(2, "new file mode", fmode&07777));
9197c478bd9Sstevel@tonic-gate }
9207c478bd9Sstevel@tonic-gate
9217c478bd9Sstevel@tonic-gate /*ARGSUSED*/
9227c478bd9Sstevel@tonic-gate static void
aus_fchmod(struct t_audit_data * tad)9237c478bd9Sstevel@tonic-gate aus_fchmod(struct t_audit_data *tad)
9247c478bd9Sstevel@tonic-gate {
9257c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
9267c478bd9Sstevel@tonic-gate uint32_t fmode, fd;
9277c478bd9Sstevel@tonic-gate struct file *fp;
9287c478bd9Sstevel@tonic-gate struct vnode *vp;
9297c478bd9Sstevel@tonic-gate struct f_audit_data *fad;
9307c478bd9Sstevel@tonic-gate
9317c478bd9Sstevel@tonic-gate struct a {
9327c478bd9Sstevel@tonic-gate long fd;
9337c478bd9Sstevel@tonic-gate long fmode;
9347c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
9357c478bd9Sstevel@tonic-gate
9367c478bd9Sstevel@tonic-gate fd = (uint32_t)uap->fd;
9377c478bd9Sstevel@tonic-gate fmode = (uint32_t)uap->fmode;
9387c478bd9Sstevel@tonic-gate
9397c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(2, "new file mode", fmode&07777));
9407c478bd9Sstevel@tonic-gate
941794f0adbSRoger A. Faulkner /*
942794f0adbSRoger A. Faulkner * convert file pointer to file descriptor
943794f0adbSRoger A. Faulkner * Note: fd ref count incremented here.
944794f0adbSRoger A. Faulkner */
9457c478bd9Sstevel@tonic-gate if ((fp = getf(fd)) == NULL)
9467c478bd9Sstevel@tonic-gate return;
9477c478bd9Sstevel@tonic-gate
948794f0adbSRoger A. Faulkner /* get path from file struct here */
949794f0adbSRoger A. Faulkner fad = F2A(fp);
950794f0adbSRoger A. Faulkner if (fad->fad_aupath != NULL) {
951794f0adbSRoger A. Faulkner au_uwrite(au_to_path(fad->fad_aupath));
952794f0adbSRoger A. Faulkner } else {
953794f0adbSRoger A. Faulkner au_uwrite(au_to_arg32(1, "no path: fd", fd));
954794f0adbSRoger A. Faulkner }
955794f0adbSRoger A. Faulkner
956794f0adbSRoger A. Faulkner vp = fp->f_vnode;
957794f0adbSRoger A. Faulkner audit_attributes(vp);
958794f0adbSRoger A. Faulkner
959794f0adbSRoger A. Faulkner /* decrement file descriptor reference count */
960794f0adbSRoger A. Faulkner releasef(fd);
961794f0adbSRoger A. Faulkner }
962794f0adbSRoger A. Faulkner
963794f0adbSRoger A. Faulkner static au_event_t
aui_fchmodat(au_event_t e)964794f0adbSRoger A. Faulkner aui_fchmodat(au_event_t e)
965794f0adbSRoger A. Faulkner {
966794f0adbSRoger A. Faulkner klwp_t *clwp = ttolwp(curthread);
967794f0adbSRoger A. Faulkner
968794f0adbSRoger A. Faulkner struct a {
969794f0adbSRoger A. Faulkner long fd;
970794f0adbSRoger A. Faulkner long fname; /* char * */
971794f0adbSRoger A. Faulkner long fmode;
972794f0adbSRoger A. Faulkner long flag;
973794f0adbSRoger A. Faulkner } *uap = (struct a *)clwp->lwp_ap;
974794f0adbSRoger A. Faulkner
9750f48f68dSToomas Soome if (uap->fname == 0)
976794f0adbSRoger A. Faulkner e = AUE_FCHMOD;
977794f0adbSRoger A. Faulkner else
978794f0adbSRoger A. Faulkner e = AUE_CHMOD;
979794f0adbSRoger A. Faulkner
980794f0adbSRoger A. Faulkner return (e);
981794f0adbSRoger A. Faulkner }
982794f0adbSRoger A. Faulkner
983794f0adbSRoger A. Faulkner /*ARGSUSED*/
984794f0adbSRoger A. Faulkner static void
aus_fchmodat(struct t_audit_data * tad)985794f0adbSRoger A. Faulkner aus_fchmodat(struct t_audit_data *tad)
986794f0adbSRoger A. Faulkner {
987794f0adbSRoger A. Faulkner klwp_t *clwp = ttolwp(curthread);
988794f0adbSRoger A. Faulkner uint32_t fmode;
989794f0adbSRoger A. Faulkner uint32_t fd;
990794f0adbSRoger A. Faulkner struct file *fp;
991794f0adbSRoger A. Faulkner struct vnode *vp;
992794f0adbSRoger A. Faulkner struct f_audit_data *fad;
993794f0adbSRoger A. Faulkner
994794f0adbSRoger A. Faulkner struct a {
995794f0adbSRoger A. Faulkner long fd;
996794f0adbSRoger A. Faulkner long fname; /* char * */
997794f0adbSRoger A. Faulkner long fmode;
998794f0adbSRoger A. Faulkner long flag;
999794f0adbSRoger A. Faulkner } *uap = (struct a *)clwp->lwp_ap;
1000794f0adbSRoger A. Faulkner
1001794f0adbSRoger A. Faulkner fd = (uint32_t)uap->fd;
1002794f0adbSRoger A. Faulkner fmode = (uint32_t)uap->fmode;
1003794f0adbSRoger A. Faulkner
1004794f0adbSRoger A. Faulkner au_uwrite(au_to_arg32(2, "new file mode", fmode&07777));
1005794f0adbSRoger A. Faulkner
10060f48f68dSToomas Soome if (fd == AT_FDCWD || uap->fname != 0) /* same as chmod() */
1007794f0adbSRoger A. Faulkner return;
1008794f0adbSRoger A. Faulkner
1009794f0adbSRoger A. Faulkner /*
1010794f0adbSRoger A. Faulkner * convert file pointer to file descriptor
1011794f0adbSRoger A. Faulkner * Note: fd ref count incremented here.
1012794f0adbSRoger A. Faulkner */
1013794f0adbSRoger A. Faulkner if ((fp = getf(fd)) == NULL)
1014794f0adbSRoger A. Faulkner return;
1015794f0adbSRoger A. Faulkner
1016794f0adbSRoger A. Faulkner /* get path from file struct here */
10177c478bd9Sstevel@tonic-gate fad = F2A(fp);
10187c478bd9Sstevel@tonic-gate if (fad->fad_aupath != NULL) {
10197c478bd9Sstevel@tonic-gate au_uwrite(au_to_path(fad->fad_aupath));
10207c478bd9Sstevel@tonic-gate } else {
10217c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "no path: fd", fd));
10227c478bd9Sstevel@tonic-gate }
10237c478bd9Sstevel@tonic-gate
10247c478bd9Sstevel@tonic-gate vp = fp->f_vnode;
10257c478bd9Sstevel@tonic-gate audit_attributes(vp);
10267c478bd9Sstevel@tonic-gate
10277c478bd9Sstevel@tonic-gate /* decrement file descriptor reference count */
10287c478bd9Sstevel@tonic-gate releasef(fd);
10297c478bd9Sstevel@tonic-gate }
10307c478bd9Sstevel@tonic-gate
10318fd04b83SRoger A. Faulkner /*
10328fd04b83SRoger A. Faulkner * convert open mode to appropriate open event
10338fd04b83SRoger A. Faulkner */
10348fd04b83SRoger A. Faulkner au_event_t
open_event(uint_t fm)10358fd04b83SRoger A. Faulkner open_event(uint_t fm)
10368fd04b83SRoger A. Faulkner {
10378fd04b83SRoger A. Faulkner au_event_t e;
10388fd04b83SRoger A. Faulkner
1039794f0adbSRoger A. Faulkner switch (fm & (O_ACCMODE | O_CREAT | O_TRUNC)) {
10408fd04b83SRoger A. Faulkner case O_RDONLY:
10418fd04b83SRoger A. Faulkner e = AUE_OPEN_R;
10428fd04b83SRoger A. Faulkner break;
10438fd04b83SRoger A. Faulkner case O_RDONLY | O_CREAT:
10448fd04b83SRoger A. Faulkner e = AUE_OPEN_RC;
10458fd04b83SRoger A. Faulkner break;
10468fd04b83SRoger A. Faulkner case O_RDONLY | O_TRUNC:
10478fd04b83SRoger A. Faulkner e = AUE_OPEN_RT;
10488fd04b83SRoger A. Faulkner break;
10498fd04b83SRoger A. Faulkner case O_RDONLY | O_TRUNC | O_CREAT:
10508fd04b83SRoger A. Faulkner e = AUE_OPEN_RTC;
10518fd04b83SRoger A. Faulkner break;
10528fd04b83SRoger A. Faulkner case O_WRONLY:
10538fd04b83SRoger A. Faulkner e = AUE_OPEN_W;
10548fd04b83SRoger A. Faulkner break;
10558fd04b83SRoger A. Faulkner case O_WRONLY | O_CREAT:
10568fd04b83SRoger A. Faulkner e = AUE_OPEN_WC;
10578fd04b83SRoger A. Faulkner break;
10588fd04b83SRoger A. Faulkner case O_WRONLY | O_TRUNC:
10598fd04b83SRoger A. Faulkner e = AUE_OPEN_WT;
10608fd04b83SRoger A. Faulkner break;
10618fd04b83SRoger A. Faulkner case O_WRONLY | O_TRUNC | O_CREAT:
10628fd04b83SRoger A. Faulkner e = AUE_OPEN_WTC;
10638fd04b83SRoger A. Faulkner break;
10648fd04b83SRoger A. Faulkner case O_RDWR:
10658fd04b83SRoger A. Faulkner e = AUE_OPEN_RW;
10668fd04b83SRoger A. Faulkner break;
10678fd04b83SRoger A. Faulkner case O_RDWR | O_CREAT:
10688fd04b83SRoger A. Faulkner e = AUE_OPEN_RWC;
10698fd04b83SRoger A. Faulkner break;
10708fd04b83SRoger A. Faulkner case O_RDWR | O_TRUNC:
10718fd04b83SRoger A. Faulkner e = AUE_OPEN_RWT;
10728fd04b83SRoger A. Faulkner break;
10738fd04b83SRoger A. Faulkner case O_RDWR | O_TRUNC | O_CREAT:
10748fd04b83SRoger A. Faulkner e = AUE_OPEN_RWTC;
10758fd04b83SRoger A. Faulkner break;
1076794f0adbSRoger A. Faulkner case O_SEARCH:
1077794f0adbSRoger A. Faulkner e = AUE_OPEN_S;
1078794f0adbSRoger A. Faulkner break;
1079794f0adbSRoger A. Faulkner case O_EXEC:
1080794f0adbSRoger A. Faulkner e = AUE_OPEN_E;
1081794f0adbSRoger A. Faulkner break;
10828fd04b83SRoger A. Faulkner default:
10838fd04b83SRoger A. Faulkner e = AUE_NULL;
10848fd04b83SRoger A. Faulkner break;
10858fd04b83SRoger A. Faulkner }
10867c478bd9Sstevel@tonic-gate
10878fd04b83SRoger A. Faulkner return (e);
10888fd04b83SRoger A. Faulkner }
10898fd04b83SRoger A. Faulkner
10908fd04b83SRoger A. Faulkner /* ARGSUSED */
10917c478bd9Sstevel@tonic-gate static au_event_t
aui_open(au_event_t e)10927c478bd9Sstevel@tonic-gate aui_open(au_event_t e)
10937c478bd9Sstevel@tonic-gate {
10947c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
10957c478bd9Sstevel@tonic-gate uint_t fm;
10967c478bd9Sstevel@tonic-gate
10977c478bd9Sstevel@tonic-gate struct a {
10987c478bd9Sstevel@tonic-gate long fnamep; /* char * */
10997c478bd9Sstevel@tonic-gate long fmode;
11007c478bd9Sstevel@tonic-gate long cmode;
11017c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
11027c478bd9Sstevel@tonic-gate
11037c478bd9Sstevel@tonic-gate fm = (uint_t)uap->fmode;
11047c478bd9Sstevel@tonic-gate
11058fd04b83SRoger A. Faulkner return (open_event(fm));
11067c478bd9Sstevel@tonic-gate }
11077c478bd9Sstevel@tonic-gate
11087c478bd9Sstevel@tonic-gate static void
aus_open(struct t_audit_data * tad)11097c478bd9Sstevel@tonic-gate aus_open(struct t_audit_data *tad)
11107c478bd9Sstevel@tonic-gate {
11117c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
11127c478bd9Sstevel@tonic-gate uint_t fm;
11137c478bd9Sstevel@tonic-gate
11147c478bd9Sstevel@tonic-gate struct a {
11157c478bd9Sstevel@tonic-gate long fnamep; /* char * */
11167c478bd9Sstevel@tonic-gate long fmode;
11177c478bd9Sstevel@tonic-gate long cmode;
11187c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
11197c478bd9Sstevel@tonic-gate
11207c478bd9Sstevel@tonic-gate fm = (uint_t)uap->fmode;
11217c478bd9Sstevel@tonic-gate
11227c478bd9Sstevel@tonic-gate /* If no write, create, or trunc modes, mark as a public op */
11238fd04b83SRoger A. Faulkner if ((fm & (O_RDONLY|O_WRONLY|O_RDWR|O_CREAT|O_TRUNC)) == O_RDONLY)
11244a0fa546SMarek Pospisil tad->tad_ctrl |= TAD_PUBLIC_EV;
11257c478bd9Sstevel@tonic-gate }
11267c478bd9Sstevel@tonic-gate
11278fd04b83SRoger A. Faulkner /* ARGSUSED */
11287c478bd9Sstevel@tonic-gate static au_event_t
aui_openat(au_event_t e)11298fd04b83SRoger A. Faulkner aui_openat(au_event_t e)
11307c478bd9Sstevel@tonic-gate {
11318fd04b83SRoger A. Faulkner t_audit_data_t *tad = T2A(curthread);
11327c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
11338fd04b83SRoger A. Faulkner uint_t fm;
11348fd04b83SRoger A. Faulkner
11357c478bd9Sstevel@tonic-gate struct a {
11368fd04b83SRoger A. Faulkner long filedes;
11378fd04b83SRoger A. Faulkner long fnamep; /* char * */
11388fd04b83SRoger A. Faulkner long fmode;
11398fd04b83SRoger A. Faulkner long cmode;
11407c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
11417c478bd9Sstevel@tonic-gate
11428fd04b83SRoger A. Faulkner fm = (uint_t)uap->fmode;
11437c478bd9Sstevel@tonic-gate
1144c4d3e299SBrent Paulson /*
1145c4d3e299SBrent Paulson * __openattrdirat() does an extra pathname lookup in order to
1146c4d3e299SBrent Paulson * enter the extended system attribute namespace of the referenced
1147c4d3e299SBrent Paulson * extended attribute filename.
1148c4d3e299SBrent Paulson */
1149c4d3e299SBrent Paulson if (fm & FXATTRDIROPEN)
1150c4d3e299SBrent Paulson tad->tad_ctrl |= TAD_MLD;
11517c478bd9Sstevel@tonic-gate
11528fd04b83SRoger A. Faulkner return (open_event(fm));
11538fd04b83SRoger A. Faulkner }
11547c478bd9Sstevel@tonic-gate
11558fd04b83SRoger A. Faulkner static void
aus_openat(struct t_audit_data * tad)11568fd04b83SRoger A. Faulkner aus_openat(struct t_audit_data *tad)
11578fd04b83SRoger A. Faulkner {
11588fd04b83SRoger A. Faulkner klwp_t *clwp = ttolwp(curthread);
11598fd04b83SRoger A. Faulkner uint_t fm;
11607c478bd9Sstevel@tonic-gate
11618fd04b83SRoger A. Faulkner struct a {
11628fd04b83SRoger A. Faulkner long filedes;
11638fd04b83SRoger A. Faulkner long fnamep; /* char * */
11648fd04b83SRoger A. Faulkner long fmode;
11658fd04b83SRoger A. Faulkner long cmode;
11668fd04b83SRoger A. Faulkner } *uap = (struct a *)clwp->lwp_ap;
11677c478bd9Sstevel@tonic-gate
11688fd04b83SRoger A. Faulkner fm = (uint_t)uap->fmode;
11697c478bd9Sstevel@tonic-gate
11708fd04b83SRoger A. Faulkner /* If no write, create, or trunc modes, mark as a public op */
11718fd04b83SRoger A. Faulkner if ((fm & (O_RDONLY|O_WRONLY|O_RDWR|O_CREAT|O_TRUNC)) == O_RDONLY)
11724a0fa546SMarek Pospisil tad->tad_ctrl |= TAD_PUBLIC_EV;
11737c478bd9Sstevel@tonic-gate }
11747c478bd9Sstevel@tonic-gate
11758fd04b83SRoger A. Faulkner static au_event_t
aui_unlinkat(au_event_t e)11768fd04b83SRoger A. Faulkner aui_unlinkat(au_event_t e)
11777c478bd9Sstevel@tonic-gate {
11787c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
11798fd04b83SRoger A. Faulkner
11807c478bd9Sstevel@tonic-gate struct a {
11818fd04b83SRoger A. Faulkner long filedes;
11828fd04b83SRoger A. Faulkner long fnamep; /* char * */
11838fd04b83SRoger A. Faulkner long flags;
11847c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
11857c478bd9Sstevel@tonic-gate
11868fd04b83SRoger A. Faulkner if (uap->flags & AT_REMOVEDIR)
11878fd04b83SRoger A. Faulkner e = AUE_RMDIR;
11888fd04b83SRoger A. Faulkner else
11898fd04b83SRoger A. Faulkner e = AUE_UNLINK;
11907c478bd9Sstevel@tonic-gate
11918fd04b83SRoger A. Faulkner return (e);
11928fd04b83SRoger A. Faulkner }
11937c478bd9Sstevel@tonic-gate
11948fd04b83SRoger A. Faulkner static au_event_t
aui_fstatat(au_event_t e)11958fd04b83SRoger A. Faulkner aui_fstatat(au_event_t e)
11968fd04b83SRoger A. Faulkner {
11978fd04b83SRoger A. Faulkner klwp_t *clwp = ttolwp(curthread);
11987c478bd9Sstevel@tonic-gate
11998fd04b83SRoger A. Faulkner struct a {
12008fd04b83SRoger A. Faulkner long filedes;
12018fd04b83SRoger A. Faulkner long fnamep; /* char * */
12028fd04b83SRoger A. Faulkner long statb;
12038fd04b83SRoger A. Faulkner long flags;
12048fd04b83SRoger A. Faulkner } *uap = (struct a *)clwp->lwp_ap;
12058fd04b83SRoger A. Faulkner
12060f48f68dSToomas Soome if (uap->fnamep == 0)
12078fd04b83SRoger A. Faulkner e = AUE_FSTAT;
12088fd04b83SRoger A. Faulkner else if (uap->flags & AT_SYMLINK_NOFOLLOW)
12098fd04b83SRoger A. Faulkner e = AUE_LSTAT;
12108fd04b83SRoger A. Faulkner else
12118fd04b83SRoger A. Faulkner e = AUE_STAT;
12128fd04b83SRoger A. Faulkner
12138fd04b83SRoger A. Faulkner return (e);
12147c478bd9Sstevel@tonic-gate }
12157c478bd9Sstevel@tonic-gate
12167c478bd9Sstevel@tonic-gate /* msgsys */
12177c478bd9Sstevel@tonic-gate static au_event_t
aui_msgsys(au_event_t e)12187c478bd9Sstevel@tonic-gate aui_msgsys(au_event_t e)
12197c478bd9Sstevel@tonic-gate {
12207c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
12217c478bd9Sstevel@tonic-gate uint_t fm;
12227c478bd9Sstevel@tonic-gate
12237c478bd9Sstevel@tonic-gate struct a {
12247c478bd9Sstevel@tonic-gate long id; /* function code id */
12257c478bd9Sstevel@tonic-gate long ap; /* arg pointer for recvmsg */
12267c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
12277c478bd9Sstevel@tonic-gate
12287c478bd9Sstevel@tonic-gate struct b {
12297c478bd9Sstevel@tonic-gate long msgid;
12307c478bd9Sstevel@tonic-gate long cmd;
12317c478bd9Sstevel@tonic-gate long buf; /* struct msqid_ds * */
12327c478bd9Sstevel@tonic-gate } *uap1 = (struct b *)&clwp->lwp_ap[1];
12337c478bd9Sstevel@tonic-gate
12347c478bd9Sstevel@tonic-gate fm = (uint_t)uap->id;
12357c478bd9Sstevel@tonic-gate
12367c478bd9Sstevel@tonic-gate switch (fm) {
12377c478bd9Sstevel@tonic-gate case 0: /* msgget */
12387c478bd9Sstevel@tonic-gate e = AUE_MSGGET;
12397c478bd9Sstevel@tonic-gate break;
12407c478bd9Sstevel@tonic-gate case 1: /* msgctl */
12417c478bd9Sstevel@tonic-gate switch ((uint_t)uap1->cmd) {
12427c478bd9Sstevel@tonic-gate case IPC_RMID:
12437c478bd9Sstevel@tonic-gate e = AUE_MSGCTL_RMID;
12447c478bd9Sstevel@tonic-gate break;
12457c478bd9Sstevel@tonic-gate case IPC_SET:
12467c478bd9Sstevel@tonic-gate e = AUE_MSGCTL_SET;
12477c478bd9Sstevel@tonic-gate break;
12487c478bd9Sstevel@tonic-gate case IPC_STAT:
12497c478bd9Sstevel@tonic-gate e = AUE_MSGCTL_STAT;
12507c478bd9Sstevel@tonic-gate break;
12517c478bd9Sstevel@tonic-gate default:
12527c478bd9Sstevel@tonic-gate e = AUE_MSGCTL;
12537c478bd9Sstevel@tonic-gate break;
12547c478bd9Sstevel@tonic-gate }
12557c478bd9Sstevel@tonic-gate break;
12567c478bd9Sstevel@tonic-gate case 2: /* msgrcv */
12577c478bd9Sstevel@tonic-gate e = AUE_MSGRCV;
12587c478bd9Sstevel@tonic-gate break;
12597c478bd9Sstevel@tonic-gate case 3: /* msgsnd */
12607c478bd9Sstevel@tonic-gate e = AUE_MSGSND;
12617c478bd9Sstevel@tonic-gate break;
12627c478bd9Sstevel@tonic-gate default: /* illegal system call */
12637c478bd9Sstevel@tonic-gate e = AUE_NULL;
12647c478bd9Sstevel@tonic-gate break;
12657c478bd9Sstevel@tonic-gate }
12667c478bd9Sstevel@tonic-gate
12677c478bd9Sstevel@tonic-gate return (e);
12687c478bd9Sstevel@tonic-gate }
12697c478bd9Sstevel@tonic-gate
12707c478bd9Sstevel@tonic-gate
12717c478bd9Sstevel@tonic-gate /* shmsys */
12727c478bd9Sstevel@tonic-gate static au_event_t
aui_shmsys(au_event_t e)12737c478bd9Sstevel@tonic-gate aui_shmsys(au_event_t e)
12747c478bd9Sstevel@tonic-gate {
12757c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
12767c478bd9Sstevel@tonic-gate int fm;
12777c478bd9Sstevel@tonic-gate
12787c478bd9Sstevel@tonic-gate struct a { /* shmsys */
12797c478bd9Sstevel@tonic-gate long id; /* function code id */
12807c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
12817c478bd9Sstevel@tonic-gate
12827c478bd9Sstevel@tonic-gate struct b { /* ctrl */
12837c478bd9Sstevel@tonic-gate long shmid;
12847c478bd9Sstevel@tonic-gate long cmd;
12857c478bd9Sstevel@tonic-gate long arg; /* struct shmid_ds * */
12867c478bd9Sstevel@tonic-gate } *uap1 = (struct b *)&clwp->lwp_ap[1];
12877c478bd9Sstevel@tonic-gate fm = (uint_t)uap->id;
12887c478bd9Sstevel@tonic-gate
12897c478bd9Sstevel@tonic-gate switch (fm) {
12907c478bd9Sstevel@tonic-gate case 0: /* shmat */
12917c478bd9Sstevel@tonic-gate e = AUE_SHMAT;
12927c478bd9Sstevel@tonic-gate break;
12937c478bd9Sstevel@tonic-gate case 1: /* shmctl */
12947c478bd9Sstevel@tonic-gate switch ((uint_t)uap1->cmd) {
12957c478bd9Sstevel@tonic-gate case IPC_RMID:
12967c478bd9Sstevel@tonic-gate e = AUE_SHMCTL_RMID;
12977c478bd9Sstevel@tonic-gate break;
12987c478bd9Sstevel@tonic-gate case IPC_SET:
12997c478bd9Sstevel@tonic-gate e = AUE_SHMCTL_SET;
13007c478bd9Sstevel@tonic-gate break;
13017c478bd9Sstevel@tonic-gate case IPC_STAT:
13027c478bd9Sstevel@tonic-gate e = AUE_SHMCTL_STAT;
13037c478bd9Sstevel@tonic-gate break;
13047c478bd9Sstevel@tonic-gate default:
13057c478bd9Sstevel@tonic-gate e = AUE_SHMCTL;
13067c478bd9Sstevel@tonic-gate break;
13077c478bd9Sstevel@tonic-gate }
13087c478bd9Sstevel@tonic-gate break;
13097c478bd9Sstevel@tonic-gate case 2: /* shmdt */
13107c478bd9Sstevel@tonic-gate e = AUE_SHMDT;
13117c478bd9Sstevel@tonic-gate break;
13127c478bd9Sstevel@tonic-gate case 3: /* shmget */
13137c478bd9Sstevel@tonic-gate e = AUE_SHMGET;
13147c478bd9Sstevel@tonic-gate break;
13157c478bd9Sstevel@tonic-gate default: /* illegal system call */
13167c478bd9Sstevel@tonic-gate e = AUE_NULL;
13177c478bd9Sstevel@tonic-gate break;
13187c478bd9Sstevel@tonic-gate }
13197c478bd9Sstevel@tonic-gate
13207c478bd9Sstevel@tonic-gate return (e);
13217c478bd9Sstevel@tonic-gate }
13227c478bd9Sstevel@tonic-gate
13237c478bd9Sstevel@tonic-gate
13247c478bd9Sstevel@tonic-gate /* semsys */
13257c478bd9Sstevel@tonic-gate static au_event_t
aui_semsys(au_event_t e)13267c478bd9Sstevel@tonic-gate aui_semsys(au_event_t e)
13277c478bd9Sstevel@tonic-gate {
13287c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
13297c478bd9Sstevel@tonic-gate uint_t fm;
13307c478bd9Sstevel@tonic-gate
13317c478bd9Sstevel@tonic-gate struct a { /* semsys */
13327c478bd9Sstevel@tonic-gate long id;
13337c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
13347c478bd9Sstevel@tonic-gate
13357c478bd9Sstevel@tonic-gate struct b { /* ctrl */
13367c478bd9Sstevel@tonic-gate long semid;
13377c478bd9Sstevel@tonic-gate long semnum;
13387c478bd9Sstevel@tonic-gate long cmd;
13397c478bd9Sstevel@tonic-gate long arg;
13407c478bd9Sstevel@tonic-gate } *uap1 = (struct b *)&clwp->lwp_ap[1];
13417c478bd9Sstevel@tonic-gate
13427c478bd9Sstevel@tonic-gate fm = (uint_t)uap->id;
13437c478bd9Sstevel@tonic-gate
13447c478bd9Sstevel@tonic-gate switch (fm) {
13457c478bd9Sstevel@tonic-gate case 0: /* semctl */
13467c478bd9Sstevel@tonic-gate switch ((uint_t)uap1->cmd) {
13477c478bd9Sstevel@tonic-gate case IPC_RMID:
13487c478bd9Sstevel@tonic-gate e = AUE_SEMCTL_RMID;
13497c478bd9Sstevel@tonic-gate break;
13507c478bd9Sstevel@tonic-gate case IPC_SET:
13517c478bd9Sstevel@tonic-gate e = AUE_SEMCTL_SET;
13527c478bd9Sstevel@tonic-gate break;
13537c478bd9Sstevel@tonic-gate case IPC_STAT:
13547c478bd9Sstevel@tonic-gate e = AUE_SEMCTL_STAT;
13557c478bd9Sstevel@tonic-gate break;
13567c478bd9Sstevel@tonic-gate case GETNCNT:
13577c478bd9Sstevel@tonic-gate e = AUE_SEMCTL_GETNCNT;
13587c478bd9Sstevel@tonic-gate break;
13597c478bd9Sstevel@tonic-gate case GETPID:
13607c478bd9Sstevel@tonic-gate e = AUE_SEMCTL_GETPID;
13617c478bd9Sstevel@tonic-gate break;
13627c478bd9Sstevel@tonic-gate case GETVAL:
13637c478bd9Sstevel@tonic-gate e = AUE_SEMCTL_GETVAL;
13647c478bd9Sstevel@tonic-gate break;
13657c478bd9Sstevel@tonic-gate case GETALL:
13667c478bd9Sstevel@tonic-gate e = AUE_SEMCTL_GETALL;
13677c478bd9Sstevel@tonic-gate break;
13687c478bd9Sstevel@tonic-gate case GETZCNT:
13697c478bd9Sstevel@tonic-gate e = AUE_SEMCTL_GETZCNT;
13707c478bd9Sstevel@tonic-gate break;
13717c478bd9Sstevel@tonic-gate case SETVAL:
13727c478bd9Sstevel@tonic-gate e = AUE_SEMCTL_SETVAL;
13737c478bd9Sstevel@tonic-gate break;
13747c478bd9Sstevel@tonic-gate case SETALL:
13757c478bd9Sstevel@tonic-gate e = AUE_SEMCTL_SETALL;
13767c478bd9Sstevel@tonic-gate break;
13777c478bd9Sstevel@tonic-gate default:
13787c478bd9Sstevel@tonic-gate e = AUE_SEMCTL;
13797c478bd9Sstevel@tonic-gate break;
13807c478bd9Sstevel@tonic-gate }
13817c478bd9Sstevel@tonic-gate break;
13827c478bd9Sstevel@tonic-gate case 1: /* semget */
13837c478bd9Sstevel@tonic-gate e = AUE_SEMGET;
13847c478bd9Sstevel@tonic-gate break;
13857c478bd9Sstevel@tonic-gate case 2: /* semop */
13867c478bd9Sstevel@tonic-gate e = AUE_SEMOP;
13877c478bd9Sstevel@tonic-gate break;
13887c478bd9Sstevel@tonic-gate default: /* illegal system call */
13897c478bd9Sstevel@tonic-gate e = AUE_NULL;
13907c478bd9Sstevel@tonic-gate break;
13917c478bd9Sstevel@tonic-gate }
13927c478bd9Sstevel@tonic-gate
13937c478bd9Sstevel@tonic-gate return (e);
13947c478bd9Sstevel@tonic-gate }
13957c478bd9Sstevel@tonic-gate
13967c478bd9Sstevel@tonic-gate /* utssys - uname(2), ustat(2), fusers(2) */
13977c478bd9Sstevel@tonic-gate static au_event_t
aui_utssys(au_event_t e)13987c478bd9Sstevel@tonic-gate aui_utssys(au_event_t e)
13997c478bd9Sstevel@tonic-gate {
14007c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
14017c478bd9Sstevel@tonic-gate uint_t type;
14027c478bd9Sstevel@tonic-gate
14037c478bd9Sstevel@tonic-gate struct a {
14047c478bd9Sstevel@tonic-gate union {
14057c478bd9Sstevel@tonic-gate long cbuf; /* char * */
14067c478bd9Sstevel@tonic-gate long ubuf; /* struct stat * */
14077c478bd9Sstevel@tonic-gate } ub;
14087c478bd9Sstevel@tonic-gate union {
14097c478bd9Sstevel@tonic-gate long mv; /* for USTAT */
14107c478bd9Sstevel@tonic-gate long flags; /* for FUSERS */
14117c478bd9Sstevel@tonic-gate } un;
14127c478bd9Sstevel@tonic-gate long type;
14137c478bd9Sstevel@tonic-gate long outbp; /* char * for FUSERS */
14147c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
14157c478bd9Sstevel@tonic-gate
14167c478bd9Sstevel@tonic-gate type = (uint_t)uap->type;
14177c478bd9Sstevel@tonic-gate
14187c478bd9Sstevel@tonic-gate if (type == UTS_FUSERS)
14197c478bd9Sstevel@tonic-gate return (e);
14207c478bd9Sstevel@tonic-gate else
14217c478bd9Sstevel@tonic-gate return ((au_event_t)AUE_NULL);
14227c478bd9Sstevel@tonic-gate }
14237c478bd9Sstevel@tonic-gate
14247c478bd9Sstevel@tonic-gate static au_event_t
aui_fcntl(au_event_t e)14257c478bd9Sstevel@tonic-gate aui_fcntl(au_event_t e)
14267c478bd9Sstevel@tonic-gate {
14277c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
14287c478bd9Sstevel@tonic-gate uint_t cmd;
14297c478bd9Sstevel@tonic-gate
14307c478bd9Sstevel@tonic-gate struct a {
14317c478bd9Sstevel@tonic-gate long fdes;
14327c478bd9Sstevel@tonic-gate long cmd;
14337c478bd9Sstevel@tonic-gate long arg;
14347c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
14357c478bd9Sstevel@tonic-gate
14367c478bd9Sstevel@tonic-gate cmd = (uint_t)uap->cmd;
14377c478bd9Sstevel@tonic-gate
14387c478bd9Sstevel@tonic-gate switch (cmd) {
14397c478bd9Sstevel@tonic-gate case F_GETLK:
14407c478bd9Sstevel@tonic-gate case F_SETLK:
14417c478bd9Sstevel@tonic-gate case F_SETLKW:
14427c478bd9Sstevel@tonic-gate break;
14437c478bd9Sstevel@tonic-gate case F_SETFL:
14447c478bd9Sstevel@tonic-gate case F_GETFL:
14457c478bd9Sstevel@tonic-gate case F_GETFD:
14467c478bd9Sstevel@tonic-gate break;
14477c478bd9Sstevel@tonic-gate default:
14487c478bd9Sstevel@tonic-gate e = (au_event_t)AUE_NULL;
14497c478bd9Sstevel@tonic-gate break;
14507c478bd9Sstevel@tonic-gate }
14517c478bd9Sstevel@tonic-gate return ((au_event_t)e);
14527c478bd9Sstevel@tonic-gate }
14537c478bd9Sstevel@tonic-gate
14547c478bd9Sstevel@tonic-gate /* null function for now */
14557c478bd9Sstevel@tonic-gate static au_event_t
aui_execve(au_event_t e)14567c478bd9Sstevel@tonic-gate aui_execve(au_event_t e)
14577c478bd9Sstevel@tonic-gate {
14587c478bd9Sstevel@tonic-gate return (e);
14597c478bd9Sstevel@tonic-gate }
14607c478bd9Sstevel@tonic-gate
1461*2b395c3cSAndy Fiddaman static void
aus_execve(struct t_audit_data * tad)1462*2b395c3cSAndy Fiddaman aus_execve(struct t_audit_data *tad)
1463*2b395c3cSAndy Fiddaman {
1464*2b395c3cSAndy Fiddaman klwp_t *clwp = ttolwp(curthread);
1465*2b395c3cSAndy Fiddaman uint32_t flags, fd;
1466*2b395c3cSAndy Fiddaman struct file *fp;
1467*2b395c3cSAndy Fiddaman struct f_audit_data *fad;
1468*2b395c3cSAndy Fiddaman
1469*2b395c3cSAndy Fiddaman struct a {
1470*2b395c3cSAndy Fiddaman long file;
1471*2b395c3cSAndy Fiddaman long argv;
1472*2b395c3cSAndy Fiddaman long envp;
1473*2b395c3cSAndy Fiddaman long flags;
1474*2b395c3cSAndy Fiddaman } *uap = (struct a *)clwp->lwp_ap;
1475*2b395c3cSAndy Fiddaman
1476*2b395c3cSAndy Fiddaman fd = (uint32_t)uap->file;
1477*2b395c3cSAndy Fiddaman flags = (uint32_t)uap->flags;
1478*2b395c3cSAndy Fiddaman
1479*2b395c3cSAndy Fiddaman if ((flags & EXEC_DESCRIPTOR) == 0)
1480*2b395c3cSAndy Fiddaman return;
1481*2b395c3cSAndy Fiddaman
1482*2b395c3cSAndy Fiddaman if ((fp = getf(fd)) == NULL)
1483*2b395c3cSAndy Fiddaman return;
1484*2b395c3cSAndy Fiddaman
1485*2b395c3cSAndy Fiddaman fad = F2A(fp);
1486*2b395c3cSAndy Fiddaman
1487*2b395c3cSAndy Fiddaman if (fad->fad_aupath != NULL)
1488*2b395c3cSAndy Fiddaman au_uwrite(au_to_path(fad->fad_aupath));
1489*2b395c3cSAndy Fiddaman else
1490*2b395c3cSAndy Fiddaman au_uwrite(au_to_arg32(1, "no path: fd", fd));
1491*2b395c3cSAndy Fiddaman
1492*2b395c3cSAndy Fiddaman audit_attributes(fp->f_vnode);
1493*2b395c3cSAndy Fiddaman
1494*2b395c3cSAndy Fiddaman /* Flag that the path is already included in this audit record */
1495*2b395c3cSAndy Fiddaman tad->tad_ctrl |= TAD_PATHFND;
1496*2b395c3cSAndy Fiddaman
1497*2b395c3cSAndy Fiddaman releasef(fd);
1498*2b395c3cSAndy Fiddaman }
1499*2b395c3cSAndy Fiddaman
15007c478bd9Sstevel@tonic-gate /*ARGSUSED*/
15017c478bd9Sstevel@tonic-gate static void
aus_fcntl(struct t_audit_data * tad)15027c478bd9Sstevel@tonic-gate aus_fcntl(struct t_audit_data *tad)
15037c478bd9Sstevel@tonic-gate {
15047c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
150551b433b7SMarek Pospisil uint32_t cmd, fd, flags;
15067c478bd9Sstevel@tonic-gate struct file *fp;
15077c478bd9Sstevel@tonic-gate struct vnode *vp;
15087c478bd9Sstevel@tonic-gate struct f_audit_data *fad;
15097c478bd9Sstevel@tonic-gate
15107c478bd9Sstevel@tonic-gate struct a {
15117c478bd9Sstevel@tonic-gate long fd;
15127c478bd9Sstevel@tonic-gate long cmd;
15137c478bd9Sstevel@tonic-gate long arg;
15147c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
15157c478bd9Sstevel@tonic-gate
151651b433b7SMarek Pospisil cmd = (uint32_t)uap->cmd;
151751b433b7SMarek Pospisil fd = (uint32_t)uap->fd;
151851b433b7SMarek Pospisil flags = (uint32_t)uap->arg;
15197c478bd9Sstevel@tonic-gate
15207c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(2, "cmd", cmd));
15217c478bd9Sstevel@tonic-gate
152251b433b7SMarek Pospisil if (cmd == F_SETFL)
152351b433b7SMarek Pospisil au_uwrite(au_to_arg32(3, "flags", flags));
152451b433b7SMarek Pospisil
15257c478bd9Sstevel@tonic-gate /*
15267c478bd9Sstevel@tonic-gate * convert file pointer to file descriptor
15277c478bd9Sstevel@tonic-gate * Note: fd ref count incremented here.
15287c478bd9Sstevel@tonic-gate */
15297c478bd9Sstevel@tonic-gate if ((fp = getf(fd)) == NULL)
15307c478bd9Sstevel@tonic-gate return;
15317c478bd9Sstevel@tonic-gate
15327c478bd9Sstevel@tonic-gate /* get path from file struct here */
15337c478bd9Sstevel@tonic-gate fad = F2A(fp);
15347c478bd9Sstevel@tonic-gate if (fad->fad_aupath != NULL) {
15357c478bd9Sstevel@tonic-gate au_uwrite(au_to_path(fad->fad_aupath));
15367c478bd9Sstevel@tonic-gate } else {
15377c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "no path: fd", fd));
15387c478bd9Sstevel@tonic-gate }
15397c478bd9Sstevel@tonic-gate
15407c478bd9Sstevel@tonic-gate vp = fp->f_vnode;
15417c478bd9Sstevel@tonic-gate audit_attributes(vp);
15427c478bd9Sstevel@tonic-gate
15437c478bd9Sstevel@tonic-gate /* decrement file descriptor reference count */
15447c478bd9Sstevel@tonic-gate releasef(fd);
15457c478bd9Sstevel@tonic-gate }
15467c478bd9Sstevel@tonic-gate
15477c478bd9Sstevel@tonic-gate /*ARGSUSED*/
15487c478bd9Sstevel@tonic-gate static void
aus_kill(struct t_audit_data * tad)15497c478bd9Sstevel@tonic-gate aus_kill(struct t_audit_data *tad)
15507c478bd9Sstevel@tonic-gate {
15517c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
15527c478bd9Sstevel@tonic-gate struct proc *p;
15537c478bd9Sstevel@tonic-gate uint32_t signo;
15547c478bd9Sstevel@tonic-gate uid_t uid, ruid;
15557c478bd9Sstevel@tonic-gate gid_t gid, rgid;
15567c478bd9Sstevel@tonic-gate pid_t pid;
15577c478bd9Sstevel@tonic-gate const auditinfo_addr_t *ainfo;
15587c478bd9Sstevel@tonic-gate cred_t *cr;
15597c478bd9Sstevel@tonic-gate
15607c478bd9Sstevel@tonic-gate struct a {
15617c478bd9Sstevel@tonic-gate long pid;
15627c478bd9Sstevel@tonic-gate long signo;
15637c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
15647c478bd9Sstevel@tonic-gate
15657c478bd9Sstevel@tonic-gate pid = (pid_t)uap->pid;
15667c478bd9Sstevel@tonic-gate signo = (uint32_t)uap->signo;
15677c478bd9Sstevel@tonic-gate
15687c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(2, "signal", signo));
15697c478bd9Sstevel@tonic-gate if (pid > 0) {
15707c478bd9Sstevel@tonic-gate mutex_enter(&pidlock);
15717c478bd9Sstevel@tonic-gate if (((p = prfind(pid)) == (struct proc *)0) ||
15727c478bd9Sstevel@tonic-gate (p->p_stat == SIDL)) {
15737c478bd9Sstevel@tonic-gate mutex_exit(&pidlock);
15747c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "process", (uint32_t)pid));
15757c478bd9Sstevel@tonic-gate return;
15767c478bd9Sstevel@tonic-gate }
15777c478bd9Sstevel@tonic-gate mutex_enter(&p->p_lock); /* so process doesn't go away */
15787c478bd9Sstevel@tonic-gate mutex_exit(&pidlock);
15797c478bd9Sstevel@tonic-gate
15807c478bd9Sstevel@tonic-gate mutex_enter(&p->p_crlock);
15817c478bd9Sstevel@tonic-gate crhold(cr = p->p_cred);
15827c478bd9Sstevel@tonic-gate mutex_exit(&p->p_crlock);
15837c478bd9Sstevel@tonic-gate mutex_exit(&p->p_lock);
15847c478bd9Sstevel@tonic-gate
15857c478bd9Sstevel@tonic-gate ainfo = crgetauinfo(cr);
15867c478bd9Sstevel@tonic-gate if (ainfo == NULL) {
15877c478bd9Sstevel@tonic-gate crfree(cr);
15887c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "process", (uint32_t)pid));
15897c478bd9Sstevel@tonic-gate return;
15907c478bd9Sstevel@tonic-gate }
15917c478bd9Sstevel@tonic-gate
15927c478bd9Sstevel@tonic-gate uid = crgetuid(cr);
15937c478bd9Sstevel@tonic-gate gid = crgetgid(cr);
15947c478bd9Sstevel@tonic-gate ruid = crgetruid(cr);
15957c478bd9Sstevel@tonic-gate rgid = crgetrgid(cr);
15967c478bd9Sstevel@tonic-gate au_uwrite(au_to_process(uid, gid, ruid, rgid, pid,
15977c478bd9Sstevel@tonic-gate ainfo->ai_auid, ainfo->ai_asid, &ainfo->ai_termid));
159845916cd2Sjpk
159945916cd2Sjpk if (is_system_labeled())
160045916cd2Sjpk au_uwrite(au_to_label(CR_SL(cr)));
160145916cd2Sjpk
16027c478bd9Sstevel@tonic-gate crfree(cr);
16037c478bd9Sstevel@tonic-gate }
16047c478bd9Sstevel@tonic-gate else
16057c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "process", (uint32_t)pid));
16067c478bd9Sstevel@tonic-gate }
16077c478bd9Sstevel@tonic-gate
16087c478bd9Sstevel@tonic-gate /*ARGSUSED*/
16097c478bd9Sstevel@tonic-gate static void
aus_mkdir(struct t_audit_data * tad)16107c478bd9Sstevel@tonic-gate aus_mkdir(struct t_audit_data *tad)
16117c478bd9Sstevel@tonic-gate {
16127c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
16137c478bd9Sstevel@tonic-gate uint32_t dmode;
16147c478bd9Sstevel@tonic-gate
16157c478bd9Sstevel@tonic-gate struct a {
16167c478bd9Sstevel@tonic-gate long dirnamep; /* char * */
16177c478bd9Sstevel@tonic-gate long dmode;
16187c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
16197c478bd9Sstevel@tonic-gate
16207c478bd9Sstevel@tonic-gate dmode = (uint32_t)uap->dmode;
16217c478bd9Sstevel@tonic-gate
16227c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(2, "mode", dmode));
16237c478bd9Sstevel@tonic-gate }
16247c478bd9Sstevel@tonic-gate
1625794f0adbSRoger A. Faulkner /*ARGSUSED*/
1626794f0adbSRoger A. Faulkner static void
aus_mkdirat(struct t_audit_data * tad)1627794f0adbSRoger A. Faulkner aus_mkdirat(struct t_audit_data *tad)
1628794f0adbSRoger A. Faulkner {
1629794f0adbSRoger A. Faulkner klwp_t *clwp = ttolwp(curthread);
1630794f0adbSRoger A. Faulkner uint32_t dmode;
1631794f0adbSRoger A. Faulkner
1632794f0adbSRoger A. Faulkner struct a {
1633794f0adbSRoger A. Faulkner long fd;
1634794f0adbSRoger A. Faulkner long dirnamep; /* char * */
1635794f0adbSRoger A. Faulkner long dmode;
1636794f0adbSRoger A. Faulkner } *uap = (struct a *)clwp->lwp_ap;
1637794f0adbSRoger A. Faulkner
1638794f0adbSRoger A. Faulkner dmode = (uint32_t)uap->dmode;
1639794f0adbSRoger A. Faulkner
1640794f0adbSRoger A. Faulkner au_uwrite(au_to_arg32(2, "mode", dmode));
1641794f0adbSRoger A. Faulkner }
1642794f0adbSRoger A. Faulkner
16437c478bd9Sstevel@tonic-gate /*ARGSUSED*/
16447c478bd9Sstevel@tonic-gate static void
aus_mknod(struct t_audit_data * tad)16457c478bd9Sstevel@tonic-gate aus_mknod(struct t_audit_data *tad)
16467c478bd9Sstevel@tonic-gate {
16477c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
16487c478bd9Sstevel@tonic-gate uint32_t fmode;
16497c478bd9Sstevel@tonic-gate dev_t dev;
16507c478bd9Sstevel@tonic-gate
16517c478bd9Sstevel@tonic-gate struct a {
16527c478bd9Sstevel@tonic-gate long pnamep; /* char * */
16537c478bd9Sstevel@tonic-gate long fmode;
16547c478bd9Sstevel@tonic-gate long dev;
16557c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
16567c478bd9Sstevel@tonic-gate
16577c478bd9Sstevel@tonic-gate fmode = (uint32_t)uap->fmode;
16587c478bd9Sstevel@tonic-gate dev = (dev_t)uap->dev;
16597c478bd9Sstevel@tonic-gate
16607c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(2, "mode", fmode));
16617c478bd9Sstevel@tonic-gate #ifdef _LP64
16627c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg64(3, "dev", dev));
16637c478bd9Sstevel@tonic-gate #else
16647c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(3, "dev", dev));
16657c478bd9Sstevel@tonic-gate #endif
16667c478bd9Sstevel@tonic-gate }
16677c478bd9Sstevel@tonic-gate
16687c478bd9Sstevel@tonic-gate /*ARGSUSED*/
16697c478bd9Sstevel@tonic-gate static void
auf_mknod(struct t_audit_data * tad,int error,rval_t * rval)16707c478bd9Sstevel@tonic-gate auf_mknod(struct t_audit_data *tad, int error, rval_t *rval)
16717c478bd9Sstevel@tonic-gate {
16727c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
16737c478bd9Sstevel@tonic-gate vnode_t *dvp;
16747c478bd9Sstevel@tonic-gate caddr_t pnamep;
16757c478bd9Sstevel@tonic-gate
16767c478bd9Sstevel@tonic-gate struct a {
16777c478bd9Sstevel@tonic-gate long pnamep; /* char * */
16787c478bd9Sstevel@tonic-gate long fmode;
16797c478bd9Sstevel@tonic-gate long dev;
16807c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
16817c478bd9Sstevel@tonic-gate
16827c478bd9Sstevel@tonic-gate /* no error, then already path token in audit record */
1683794f0adbSRoger A. Faulkner if (error != EPERM && error != EINVAL)
16847c478bd9Sstevel@tonic-gate return;
16857c478bd9Sstevel@tonic-gate
1686794f0adbSRoger A. Faulkner /* do the lookup to force generation of path token */
1687794f0adbSRoger A. Faulkner pnamep = (caddr_t)uap->pnamep;
1688794f0adbSRoger A. Faulkner tad->tad_ctrl |= TAD_NOATTRB;
1689794f0adbSRoger A. Faulkner error = lookupname(pnamep, UIO_USERSPACE, NO_FOLLOW, &dvp, NULLVPP);
1690794f0adbSRoger A. Faulkner if (error == 0)
1691794f0adbSRoger A. Faulkner VN_RELE(dvp);
1692794f0adbSRoger A. Faulkner }
1693794f0adbSRoger A. Faulkner
1694794f0adbSRoger A. Faulkner /*ARGSUSED*/
1695794f0adbSRoger A. Faulkner static void
aus_mknodat(struct t_audit_data * tad)1696794f0adbSRoger A. Faulkner aus_mknodat(struct t_audit_data *tad)
1697794f0adbSRoger A. Faulkner {
1698794f0adbSRoger A. Faulkner klwp_t *clwp = ttolwp(curthread);
1699794f0adbSRoger A. Faulkner uint32_t fmode;
1700794f0adbSRoger A. Faulkner dev_t dev;
1701794f0adbSRoger A. Faulkner
1702794f0adbSRoger A. Faulkner struct a {
1703794f0adbSRoger A. Faulkner long fd;
1704794f0adbSRoger A. Faulkner long pnamep; /* char * */
1705794f0adbSRoger A. Faulkner long fmode;
1706794f0adbSRoger A. Faulkner long dev;
1707794f0adbSRoger A. Faulkner } *uap = (struct a *)clwp->lwp_ap;
1708794f0adbSRoger A. Faulkner
1709794f0adbSRoger A. Faulkner fmode = (uint32_t)uap->fmode;
1710794f0adbSRoger A. Faulkner dev = (dev_t)uap->dev;
1711794f0adbSRoger A. Faulkner
1712794f0adbSRoger A. Faulkner au_uwrite(au_to_arg32(2, "mode", fmode));
1713794f0adbSRoger A. Faulkner #ifdef _LP64
1714794f0adbSRoger A. Faulkner au_uwrite(au_to_arg64(3, "dev", dev));
1715794f0adbSRoger A. Faulkner #else
1716794f0adbSRoger A. Faulkner au_uwrite(au_to_arg32(3, "dev", dev));
1717794f0adbSRoger A. Faulkner #endif
1718794f0adbSRoger A. Faulkner }
1719794f0adbSRoger A. Faulkner
1720794f0adbSRoger A. Faulkner /*ARGSUSED*/
1721794f0adbSRoger A. Faulkner static void
auf_mknodat(struct t_audit_data * tad,int error,rval_t * rval)1722794f0adbSRoger A. Faulkner auf_mknodat(struct t_audit_data *tad, int error, rval_t *rval)
1723794f0adbSRoger A. Faulkner {
1724794f0adbSRoger A. Faulkner klwp_t *clwp = ttolwp(curthread);
1725794f0adbSRoger A. Faulkner vnode_t *startvp;
1726794f0adbSRoger A. Faulkner vnode_t *dvp;
1727794f0adbSRoger A. Faulkner caddr_t pnamep;
1728794f0adbSRoger A. Faulkner int fd;
1729794f0adbSRoger A. Faulkner
1730794f0adbSRoger A. Faulkner struct a {
1731794f0adbSRoger A. Faulkner long fd;
1732794f0adbSRoger A. Faulkner long pnamep; /* char * */
1733794f0adbSRoger A. Faulkner long fmode;
1734794f0adbSRoger A. Faulkner long dev;
1735794f0adbSRoger A. Faulkner } *uap = (struct a *)clwp->lwp_ap;
1736794f0adbSRoger A. Faulkner
1737794f0adbSRoger A. Faulkner /* no error, then already path token in audit record */
1738794f0adbSRoger A. Faulkner if (error != EPERM && error != EINVAL)
17397c478bd9Sstevel@tonic-gate return;
17407c478bd9Sstevel@tonic-gate
17417c478bd9Sstevel@tonic-gate /* do the lookup to force generation of path token */
1742794f0adbSRoger A. Faulkner fd = (int)uap->fd;
17437c478bd9Sstevel@tonic-gate pnamep = (caddr_t)uap->pnamep;
1744794f0adbSRoger A. Faulkner if (pnamep == NULL ||
1745794f0adbSRoger A. Faulkner fgetstartvp(fd, pnamep, &startvp) != 0)
1746794f0adbSRoger A. Faulkner return;
17474a0fa546SMarek Pospisil tad->tad_ctrl |= TAD_NOATTRB;
1748794f0adbSRoger A. Faulkner error = lookupnameat(pnamep, UIO_USERSPACE, NO_FOLLOW, &dvp, NULLVPP,
1749794f0adbSRoger A. Faulkner startvp);
17507c478bd9Sstevel@tonic-gate if (error == 0)
17517c478bd9Sstevel@tonic-gate VN_RELE(dvp);
1752794f0adbSRoger A. Faulkner if (startvp != NULL)
1753794f0adbSRoger A. Faulkner VN_RELE(startvp);
17547c478bd9Sstevel@tonic-gate }
17557c478bd9Sstevel@tonic-gate
17567c478bd9Sstevel@tonic-gate /*ARGSUSED*/
17577c478bd9Sstevel@tonic-gate static void
aus_mount(struct t_audit_data * tad)17587c478bd9Sstevel@tonic-gate aus_mount(struct t_audit_data *tad)
17590f48f68dSToomas Soome {
17600f48f68dSToomas Soome /* AUS_START */
17617c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
17627c478bd9Sstevel@tonic-gate uint32_t flags;
17637c478bd9Sstevel@tonic-gate uintptr_t u_fstype, dataptr;
17647c478bd9Sstevel@tonic-gate STRUCT_DECL(nfs_args, nfsargs);
17657c478bd9Sstevel@tonic-gate size_t len;
17667c478bd9Sstevel@tonic-gate char *fstype, *hostname;
17677c478bd9Sstevel@tonic-gate
17687c478bd9Sstevel@tonic-gate struct a {
17697c478bd9Sstevel@tonic-gate long spec; /* char * */
17707c478bd9Sstevel@tonic-gate long dir; /* char * */
17717c478bd9Sstevel@tonic-gate long flags;
17727c478bd9Sstevel@tonic-gate long fstype; /* char * */
17737c478bd9Sstevel@tonic-gate long dataptr; /* char * */
17747c478bd9Sstevel@tonic-gate long datalen;
17757c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
17767c478bd9Sstevel@tonic-gate
17777c478bd9Sstevel@tonic-gate u_fstype = (uintptr_t)uap->fstype;
17787c478bd9Sstevel@tonic-gate flags = (uint32_t)uap->flags;
17797c478bd9Sstevel@tonic-gate dataptr = (uintptr_t)uap->dataptr;
17807c478bd9Sstevel@tonic-gate
17817c478bd9Sstevel@tonic-gate fstype = kmem_alloc(MAXNAMELEN, KM_SLEEP);
17827c478bd9Sstevel@tonic-gate if (copyinstr((caddr_t)u_fstype, (caddr_t)fstype, MAXNAMELEN, &len))
17837c478bd9Sstevel@tonic-gate goto mount_free_fstype;
17847c478bd9Sstevel@tonic-gate
17857c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(3, "flags", flags));
17867c478bd9Sstevel@tonic-gate au_uwrite(au_to_text(fstype));
17877c478bd9Sstevel@tonic-gate
17887c478bd9Sstevel@tonic-gate if (strncmp(fstype, "nfs", 3) == 0) {
17897c478bd9Sstevel@tonic-gate
17907c478bd9Sstevel@tonic-gate STRUCT_INIT(nfsargs, get_udatamodel());
17917c478bd9Sstevel@tonic-gate bzero(STRUCT_BUF(nfsargs), STRUCT_SIZE(nfsargs));
17927c478bd9Sstevel@tonic-gate
17930f48f68dSToomas Soome if (copyin((caddr_t)dataptr, STRUCT_BUF(nfsargs),
17940f48f68dSToomas Soome MIN(uap->datalen, STRUCT_SIZE(nfsargs)))) {
17957c478bd9Sstevel@tonic-gate /* DEBUG debug_enter((char *)NULL); */
17967c478bd9Sstevel@tonic-gate goto mount_free_fstype;
17977c478bd9Sstevel@tonic-gate }
17987c478bd9Sstevel@tonic-gate hostname = kmem_alloc(MAXNAMELEN, KM_SLEEP);
17997c478bd9Sstevel@tonic-gate if (copyinstr(STRUCT_FGETP(nfsargs, hostname),
18000f48f68dSToomas Soome (caddr_t)hostname, MAXNAMELEN, &len)) {
18017c478bd9Sstevel@tonic-gate goto mount_free_hostname;
18027c478bd9Sstevel@tonic-gate }
18037c478bd9Sstevel@tonic-gate au_uwrite(au_to_text(hostname));
18047c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(3, "internal flags",
18050f48f68dSToomas Soome (uint_t)STRUCT_FGET(nfsargs, flags)));
18067c478bd9Sstevel@tonic-gate
18077c478bd9Sstevel@tonic-gate mount_free_hostname:
18087c478bd9Sstevel@tonic-gate kmem_free(hostname, MAXNAMELEN);
18097c478bd9Sstevel@tonic-gate }
18107c478bd9Sstevel@tonic-gate
18117c478bd9Sstevel@tonic-gate mount_free_fstype:
18127c478bd9Sstevel@tonic-gate kmem_free(fstype, MAXNAMELEN);
18137c478bd9Sstevel@tonic-gate } /* AUS_MOUNT */
18147c478bd9Sstevel@tonic-gate
18157c478bd9Sstevel@tonic-gate static void
aus_umount_path(caddr_t umount_dir)18167c478bd9Sstevel@tonic-gate aus_umount_path(caddr_t umount_dir)
18177c478bd9Sstevel@tonic-gate {
18187c478bd9Sstevel@tonic-gate char *dir_path;
18197c478bd9Sstevel@tonic-gate struct audit_path *path;
18207c478bd9Sstevel@tonic-gate size_t path_len, dir_len;
18217c478bd9Sstevel@tonic-gate
18227c478bd9Sstevel@tonic-gate /* length alloc'd for two string pointers */
18237c478bd9Sstevel@tonic-gate path_len = sizeof (struct audit_path) + sizeof (char *);
18247c478bd9Sstevel@tonic-gate path = kmem_alloc(path_len, KM_SLEEP);
18257c478bd9Sstevel@tonic-gate dir_path = kmem_alloc(MAXPATHLEN, KM_SLEEP);
18267c478bd9Sstevel@tonic-gate
18277c478bd9Sstevel@tonic-gate if (copyinstr(umount_dir, (caddr_t)dir_path,
18287c478bd9Sstevel@tonic-gate MAXPATHLEN, &dir_len))
18297c478bd9Sstevel@tonic-gate goto umount2_free_dir;
18307c478bd9Sstevel@tonic-gate
18317c478bd9Sstevel@tonic-gate /*
18327c478bd9Sstevel@tonic-gate * the audit_path struct assumes that the buffer pointed to
18337c478bd9Sstevel@tonic-gate * by audp_sect[n] contains string 0 immediatedly followed
18347c478bd9Sstevel@tonic-gate * by string 1.
18357c478bd9Sstevel@tonic-gate */
18367c478bd9Sstevel@tonic-gate path->audp_sect[0] = dir_path;
18377c478bd9Sstevel@tonic-gate path->audp_sect[1] = dir_path + strlen(dir_path) + 1;
18387c478bd9Sstevel@tonic-gate path->audp_size = path_len;
18397c478bd9Sstevel@tonic-gate path->audp_ref = 1; /* not used */
18407c478bd9Sstevel@tonic-gate path->audp_cnt = 1; /* one path string */
18417c478bd9Sstevel@tonic-gate
18427c478bd9Sstevel@tonic-gate au_uwrite(au_to_path(path));
18437c478bd9Sstevel@tonic-gate
18447c478bd9Sstevel@tonic-gate umount2_free_dir:
18457c478bd9Sstevel@tonic-gate kmem_free(dir_path, MAXPATHLEN);
18467c478bd9Sstevel@tonic-gate kmem_free(path, path_len);
18477c478bd9Sstevel@tonic-gate }
18487c478bd9Sstevel@tonic-gate
18497c478bd9Sstevel@tonic-gate /*ARGSUSED*/
18507c478bd9Sstevel@tonic-gate static void
aus_umount2(struct t_audit_data * tad)18517c478bd9Sstevel@tonic-gate aus_umount2(struct t_audit_data *tad)
18527c478bd9Sstevel@tonic-gate {
18537c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
18547c478bd9Sstevel@tonic-gate struct a {
18557c478bd9Sstevel@tonic-gate long dir; /* char * */
18567c478bd9Sstevel@tonic-gate long flags;
18577c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
18587c478bd9Sstevel@tonic-gate
18597c478bd9Sstevel@tonic-gate aus_umount_path((caddr_t)uap->dir);
18607c478bd9Sstevel@tonic-gate
18617c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(2, "flags", (uint32_t)uap->flags));
18627c478bd9Sstevel@tonic-gate }
18637c478bd9Sstevel@tonic-gate
18647c478bd9Sstevel@tonic-gate static void
aus_msgsys(struct t_audit_data * tad)18657c478bd9Sstevel@tonic-gate aus_msgsys(struct t_audit_data *tad)
18667c478bd9Sstevel@tonic-gate {
18677c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
18687c478bd9Sstevel@tonic-gate uint32_t msgid;
18697c478bd9Sstevel@tonic-gate
18707c478bd9Sstevel@tonic-gate struct b {
18717c478bd9Sstevel@tonic-gate long msgid;
18727c478bd9Sstevel@tonic-gate long cmd;
18737c478bd9Sstevel@tonic-gate long buf; /* struct msqid_ds * */
18747c478bd9Sstevel@tonic-gate } *uap1 = (struct b *)&clwp->lwp_ap[1];
18757c478bd9Sstevel@tonic-gate
18767c478bd9Sstevel@tonic-gate msgid = (uint32_t)uap1->msgid;
18777c478bd9Sstevel@tonic-gate
18787c478bd9Sstevel@tonic-gate
18797c478bd9Sstevel@tonic-gate switch (tad->tad_event) {
18807c478bd9Sstevel@tonic-gate case AUE_MSGGET: /* msgget */
18817c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "msg key", msgid));
18827c478bd9Sstevel@tonic-gate break;
18837c478bd9Sstevel@tonic-gate case AUE_MSGCTL: /* msgctl */
18847c478bd9Sstevel@tonic-gate case AUE_MSGCTL_RMID: /* msgctl */
1885f158b2dfSJan Friedel case AUE_MSGCTL_SET: /* msgctl */
18867c478bd9Sstevel@tonic-gate case AUE_MSGCTL_STAT: /* msgctl */
18877c478bd9Sstevel@tonic-gate case AUE_MSGRCV: /* msgrcv */
18887c478bd9Sstevel@tonic-gate case AUE_MSGSND: /* msgsnd */
18897c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "msg ID", msgid));
18907c478bd9Sstevel@tonic-gate break;
18917c478bd9Sstevel@tonic-gate }
18927c478bd9Sstevel@tonic-gate }
18937c478bd9Sstevel@tonic-gate
18947c478bd9Sstevel@tonic-gate /*ARGSUSED*/
18957c478bd9Sstevel@tonic-gate static void
auf_msgsys(struct t_audit_data * tad,int error,rval_t * rval)18967c478bd9Sstevel@tonic-gate auf_msgsys(struct t_audit_data *tad, int error, rval_t *rval)
18977c478bd9Sstevel@tonic-gate {
18987c478bd9Sstevel@tonic-gate int id;
18997c478bd9Sstevel@tonic-gate
19007c478bd9Sstevel@tonic-gate if (error != 0)
19017c478bd9Sstevel@tonic-gate return;
19027c478bd9Sstevel@tonic-gate if (tad->tad_event == AUE_MSGGET) {
19037c478bd9Sstevel@tonic-gate uint32_t scid;
19047c478bd9Sstevel@tonic-gate uint32_t sy_flags;
19057c478bd9Sstevel@tonic-gate
19067c478bd9Sstevel@tonic-gate /* need to determine type of executing binary */
19077c478bd9Sstevel@tonic-gate scid = tad->tad_scid;
19087c478bd9Sstevel@tonic-gate #ifdef _SYSCALL32_IMPL
19097c478bd9Sstevel@tonic-gate if (lwp_getdatamodel(ttolwp(curthread)) == DATAMODEL_NATIVE)
19107c478bd9Sstevel@tonic-gate sy_flags = sysent[scid].sy_flags & SE_RVAL_MASK;
19117c478bd9Sstevel@tonic-gate else
19127c478bd9Sstevel@tonic-gate sy_flags = sysent32[scid].sy_flags & SE_RVAL_MASK;
19137c478bd9Sstevel@tonic-gate #else
19147c478bd9Sstevel@tonic-gate sy_flags = sysent[scid].sy_flags & SE_RVAL_MASK;
19157c478bd9Sstevel@tonic-gate #endif
19167c478bd9Sstevel@tonic-gate if (sy_flags == SE_32RVAL1)
19177c478bd9Sstevel@tonic-gate id = rval->r_val1;
19187c478bd9Sstevel@tonic-gate if (sy_flags == (SE_32RVAL2|SE_32RVAL1))
19197c478bd9Sstevel@tonic-gate id = rval->r_val1;
19207c478bd9Sstevel@tonic-gate if (sy_flags == SE_64RVAL)
19217c478bd9Sstevel@tonic-gate id = (int)rval->r_vals;
19227c478bd9Sstevel@tonic-gate
19237c478bd9Sstevel@tonic-gate au_uwrite(au_to_ipc(AT_IPC_MSG, id));
19247c478bd9Sstevel@tonic-gate }
19257c478bd9Sstevel@tonic-gate }
19267c478bd9Sstevel@tonic-gate
19277c478bd9Sstevel@tonic-gate static void
aus_semsys(struct t_audit_data * tad)19287c478bd9Sstevel@tonic-gate aus_semsys(struct t_audit_data *tad)
19297c478bd9Sstevel@tonic-gate {
19307c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
19317c478bd9Sstevel@tonic-gate uint32_t semid;
19327c478bd9Sstevel@tonic-gate
19337c478bd9Sstevel@tonic-gate struct b { /* ctrl */
19347c478bd9Sstevel@tonic-gate long semid;
19357c478bd9Sstevel@tonic-gate long semnum;
19367c478bd9Sstevel@tonic-gate long cmd;
19377c478bd9Sstevel@tonic-gate long arg;
19387c478bd9Sstevel@tonic-gate } *uap1 = (struct b *)&clwp->lwp_ap[1];
19397c478bd9Sstevel@tonic-gate
19407c478bd9Sstevel@tonic-gate semid = (uint32_t)uap1->semid;
19417c478bd9Sstevel@tonic-gate
19427c478bd9Sstevel@tonic-gate switch (tad->tad_event) {
19437c478bd9Sstevel@tonic-gate case AUE_SEMCTL_RMID:
19447c478bd9Sstevel@tonic-gate case AUE_SEMCTL_STAT:
19457c478bd9Sstevel@tonic-gate case AUE_SEMCTL_GETNCNT:
19467c478bd9Sstevel@tonic-gate case AUE_SEMCTL_GETPID:
19477c478bd9Sstevel@tonic-gate case AUE_SEMCTL_GETVAL:
19487c478bd9Sstevel@tonic-gate case AUE_SEMCTL_GETALL:
19497c478bd9Sstevel@tonic-gate case AUE_SEMCTL_GETZCNT:
1950f158b2dfSJan Friedel case AUE_SEMCTL_SET:
19517c478bd9Sstevel@tonic-gate case AUE_SEMCTL_SETVAL:
19527c478bd9Sstevel@tonic-gate case AUE_SEMCTL_SETALL:
19537c478bd9Sstevel@tonic-gate case AUE_SEMCTL:
19547c478bd9Sstevel@tonic-gate case AUE_SEMOP:
19557c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "sem ID", semid));
19567c478bd9Sstevel@tonic-gate break;
19577c478bd9Sstevel@tonic-gate case AUE_SEMGET:
19587c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "sem key", semid));
19597c478bd9Sstevel@tonic-gate break;
19607c478bd9Sstevel@tonic-gate }
19617c478bd9Sstevel@tonic-gate }
19627c478bd9Sstevel@tonic-gate
19637c478bd9Sstevel@tonic-gate /*ARGSUSED*/
19647c478bd9Sstevel@tonic-gate static void
auf_semsys(struct t_audit_data * tad,int error,rval_t * rval)19657c478bd9Sstevel@tonic-gate auf_semsys(struct t_audit_data *tad, int error, rval_t *rval)
19667c478bd9Sstevel@tonic-gate {
19677c478bd9Sstevel@tonic-gate int id;
19687c478bd9Sstevel@tonic-gate
19697c478bd9Sstevel@tonic-gate if (error != 0)
19707c478bd9Sstevel@tonic-gate return;
19717c478bd9Sstevel@tonic-gate if (tad->tad_event == AUE_SEMGET) {
19727c478bd9Sstevel@tonic-gate uint32_t scid;
19737c478bd9Sstevel@tonic-gate uint32_t sy_flags;
19747c478bd9Sstevel@tonic-gate
19757c478bd9Sstevel@tonic-gate /* need to determine type of executing binary */
19767c478bd9Sstevel@tonic-gate scid = tad->tad_scid;
19777c478bd9Sstevel@tonic-gate #ifdef _SYSCALL32_IMPL
19787c478bd9Sstevel@tonic-gate if (lwp_getdatamodel(ttolwp(curthread)) == DATAMODEL_NATIVE)
19797c478bd9Sstevel@tonic-gate sy_flags = sysent[scid].sy_flags & SE_RVAL_MASK;
19807c478bd9Sstevel@tonic-gate else
19817c478bd9Sstevel@tonic-gate sy_flags = sysent32[scid].sy_flags & SE_RVAL_MASK;
19827c478bd9Sstevel@tonic-gate #else
19837c478bd9Sstevel@tonic-gate sy_flags = sysent[scid].sy_flags & SE_RVAL_MASK;
19847c478bd9Sstevel@tonic-gate #endif
19857c478bd9Sstevel@tonic-gate if (sy_flags == SE_32RVAL1)
19867c478bd9Sstevel@tonic-gate id = rval->r_val1;
19877c478bd9Sstevel@tonic-gate if (sy_flags == (SE_32RVAL2|SE_32RVAL1))
19887c478bd9Sstevel@tonic-gate id = rval->r_val1;
19897c478bd9Sstevel@tonic-gate if (sy_flags == SE_64RVAL)
19907c478bd9Sstevel@tonic-gate id = (int)rval->r_vals;
19917c478bd9Sstevel@tonic-gate
19927c478bd9Sstevel@tonic-gate au_uwrite(au_to_ipc(AT_IPC_SEM, id));
19937c478bd9Sstevel@tonic-gate }
19947c478bd9Sstevel@tonic-gate }
19957c478bd9Sstevel@tonic-gate
19967c478bd9Sstevel@tonic-gate /*ARGSUSED*/
19977c478bd9Sstevel@tonic-gate static void
aus_close(struct t_audit_data * tad)19987c478bd9Sstevel@tonic-gate aus_close(struct t_audit_data *tad)
19997c478bd9Sstevel@tonic-gate {
20007c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
20017c478bd9Sstevel@tonic-gate uint32_t fd;
20027c478bd9Sstevel@tonic-gate struct file *fp;
20037c478bd9Sstevel@tonic-gate struct f_audit_data *fad;
20047c478bd9Sstevel@tonic-gate struct vnode *vp;
20057c478bd9Sstevel@tonic-gate struct vattr attr;
20069e9e6ab8Spaulson au_kcontext_t *kctx = GET_KCTX_PZ;
20077c478bd9Sstevel@tonic-gate
20087c478bd9Sstevel@tonic-gate struct a {
20097c478bd9Sstevel@tonic-gate long i;
20107c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
20117c478bd9Sstevel@tonic-gate
20127c478bd9Sstevel@tonic-gate fd = (uint32_t)uap->i;
20137c478bd9Sstevel@tonic-gate
20147c478bd9Sstevel@tonic-gate attr.va_mask = 0;
20157c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "fd", fd));
20167c478bd9Sstevel@tonic-gate
20177c478bd9Sstevel@tonic-gate /*
20187c478bd9Sstevel@tonic-gate * convert file pointer to file descriptor
20197c478bd9Sstevel@tonic-gate * Note: fd ref count incremented here.
20207c478bd9Sstevel@tonic-gate */
20217c478bd9Sstevel@tonic-gate if ((fp = getf(fd)) == NULL)
20227c478bd9Sstevel@tonic-gate return;
20237c478bd9Sstevel@tonic-gate
20247c478bd9Sstevel@tonic-gate fad = F2A(fp);
2025d0fa49b7STony Nguyen tad->tad_evmod = (au_emod_t)fad->fad_flags;
20267c478bd9Sstevel@tonic-gate if (fad->fad_aupath != NULL) {
20277c478bd9Sstevel@tonic-gate au_uwrite(au_to_path(fad->fad_aupath));
20287c478bd9Sstevel@tonic-gate if ((vp = fp->f_vnode) != NULL) {
20297c478bd9Sstevel@tonic-gate attr.va_mask = AT_ALL;
2030da6c28aaSamw if (VOP_GETATTR(vp, &attr, 0, CRED(), NULL) == 0) {
20317c478bd9Sstevel@tonic-gate /*
20327c478bd9Sstevel@tonic-gate * When write was not used and the file can be
20337c478bd9Sstevel@tonic-gate * considered public, skip the audit.
20347c478bd9Sstevel@tonic-gate */
20357c478bd9Sstevel@tonic-gate if (((fp->f_flag & FWRITE) == 0) &&
20364a0fa546SMarek Pospisil object_is_public(&attr)) {
20377c478bd9Sstevel@tonic-gate tad->tad_flag = 0;
20387c478bd9Sstevel@tonic-gate tad->tad_evmod = 0;
20397c478bd9Sstevel@tonic-gate /* free any residual audit data */
2040005d3febSMarek Pospisil au_close(kctx, &(u_ad), 0, 0, 0, NULL);
20417c478bd9Sstevel@tonic-gate releasef(fd);
20427c478bd9Sstevel@tonic-gate return;
20437c478bd9Sstevel@tonic-gate }
204445916cd2Sjpk au_uwrite(au_to_attr(&attr));
204545916cd2Sjpk audit_sec_attributes(&(u_ad), vp);
20467c478bd9Sstevel@tonic-gate }
20477c478bd9Sstevel@tonic-gate }
20487c478bd9Sstevel@tonic-gate }
20497c478bd9Sstevel@tonic-gate
20507c478bd9Sstevel@tonic-gate /* decrement file descriptor reference count */
20517c478bd9Sstevel@tonic-gate releasef(fd);
20527c478bd9Sstevel@tonic-gate }
20537c478bd9Sstevel@tonic-gate
20547c478bd9Sstevel@tonic-gate /*ARGSUSED*/
20557c478bd9Sstevel@tonic-gate static void
aus_fstatfs(struct t_audit_data * tad)20567c478bd9Sstevel@tonic-gate aus_fstatfs(struct t_audit_data *tad)
20577c478bd9Sstevel@tonic-gate {
20587c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
20597c478bd9Sstevel@tonic-gate uint32_t fd;
20607c478bd9Sstevel@tonic-gate struct file *fp;
20617c478bd9Sstevel@tonic-gate struct vnode *vp;
20627c478bd9Sstevel@tonic-gate struct f_audit_data *fad;
20637c478bd9Sstevel@tonic-gate
20647c478bd9Sstevel@tonic-gate struct a {
20657c478bd9Sstevel@tonic-gate long fd;
20667c478bd9Sstevel@tonic-gate long buf; /* struct statfs * */
20677c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
20687c478bd9Sstevel@tonic-gate
20697c478bd9Sstevel@tonic-gate fd = (uint_t)uap->fd;
20707c478bd9Sstevel@tonic-gate
20717c478bd9Sstevel@tonic-gate /*
20727c478bd9Sstevel@tonic-gate * convert file pointer to file descriptor
20737c478bd9Sstevel@tonic-gate * Note: fd ref count incremented here.
20747c478bd9Sstevel@tonic-gate */
20757c478bd9Sstevel@tonic-gate if ((fp = getf(fd)) == NULL)
20767c478bd9Sstevel@tonic-gate return;
20777c478bd9Sstevel@tonic-gate
20787c478bd9Sstevel@tonic-gate /* get path from file struct here */
20797c478bd9Sstevel@tonic-gate fad = F2A(fp);
20807c478bd9Sstevel@tonic-gate if (fad->fad_aupath != NULL) {
20817c478bd9Sstevel@tonic-gate au_uwrite(au_to_path(fad->fad_aupath));
20827c478bd9Sstevel@tonic-gate } else {
20837c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "no path: fd", fd));
20847c478bd9Sstevel@tonic-gate }
20857c478bd9Sstevel@tonic-gate
20867c478bd9Sstevel@tonic-gate vp = fp->f_vnode;
20877c478bd9Sstevel@tonic-gate audit_attributes(vp);
20887c478bd9Sstevel@tonic-gate
20897c478bd9Sstevel@tonic-gate /* decrement file descriptor reference count */
20907c478bd9Sstevel@tonic-gate releasef(fd);
20917c478bd9Sstevel@tonic-gate }
20927c478bd9Sstevel@tonic-gate
20934be8c573SJan Friedel static au_event_t
aui_setpgrp(au_event_t e)20944be8c573SJan Friedel aui_setpgrp(au_event_t e)
20954be8c573SJan Friedel {
20964be8c573SJan Friedel klwp_t *clwp = ttolwp(curthread);
20974be8c573SJan Friedel int flag;
20984be8c573SJan Friedel
20994be8c573SJan Friedel struct a {
21004be8c573SJan Friedel long flag;
21014be8c573SJan Friedel long pid;
21024be8c573SJan Friedel long pgid;
21034be8c573SJan Friedel } *uap = (struct a *)clwp->lwp_ap;
21044be8c573SJan Friedel
21054be8c573SJan Friedel flag = (int)uap->flag;
21064be8c573SJan Friedel
21074be8c573SJan Friedel
21084be8c573SJan Friedel switch (flag) {
21094be8c573SJan Friedel
21104be8c573SJan Friedel case 1: /* setpgrp() */
21114be8c573SJan Friedel e = AUE_SETPGRP;
21124be8c573SJan Friedel break;
21134be8c573SJan Friedel
21144be8c573SJan Friedel case 3: /* setsid() */
21154be8c573SJan Friedel e = AUE_SETSID;
21164be8c573SJan Friedel break;
21174be8c573SJan Friedel
21184be8c573SJan Friedel case 5: /* setpgid() */
21194be8c573SJan Friedel e = AUE_SETPGID;
21204be8c573SJan Friedel break;
21214be8c573SJan Friedel
21224be8c573SJan Friedel case 0: /* getpgrp() - not security relevant */
21234be8c573SJan Friedel case 2: /* getsid() - not security relevant */
21240f48f68dSToomas Soome case 4: /* getpgid() - not security relevant */
21254be8c573SJan Friedel e = AUE_NULL;
21264be8c573SJan Friedel break;
21274be8c573SJan Friedel
21284be8c573SJan Friedel default:
21294be8c573SJan Friedel e = AUE_NULL;
21304be8c573SJan Friedel break;
21314be8c573SJan Friedel }
21324be8c573SJan Friedel
21334be8c573SJan Friedel return (e);
21344be8c573SJan Friedel }
21354be8c573SJan Friedel
213645a9a7b1SJan Friedel /*ARGSUSED*/
21377c478bd9Sstevel@tonic-gate static void
aus_setpgrp(struct t_audit_data * tad)21387c478bd9Sstevel@tonic-gate aus_setpgrp(struct t_audit_data *tad)
21397c478bd9Sstevel@tonic-gate {
21404be8c573SJan Friedel klwp_t *clwp = ttolwp(curthread);
21414be8c573SJan Friedel pid_t pgid;
21424be8c573SJan Friedel struct proc *p;
21434be8c573SJan Friedel uid_t uid, ruid;
21444be8c573SJan Friedel gid_t gid, rgid;
21454be8c573SJan Friedel pid_t pid;
21464be8c573SJan Friedel cred_t *cr;
21474be8c573SJan Friedel int flag;
21484be8c573SJan Friedel const auditinfo_addr_t *ainfo;
21497c478bd9Sstevel@tonic-gate
21507c478bd9Sstevel@tonic-gate struct a {
21514be8c573SJan Friedel long flag;
21527c478bd9Sstevel@tonic-gate long pid;
21534be8c573SJan Friedel long pgid;
21547c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
21557c478bd9Sstevel@tonic-gate
21564be8c573SJan Friedel flag = (int)uap->flag;
21577c478bd9Sstevel@tonic-gate pid = (pid_t)uap->pid;
21584be8c573SJan Friedel pgid = (pid_t)uap->pgid;
21594be8c573SJan Friedel
21604be8c573SJan Friedel
21614be8c573SJan Friedel switch (flag) {
21624be8c573SJan Friedel
21634be8c573SJan Friedel case 0: /* getpgrp() */
21644be8c573SJan Friedel case 1: /* setpgrp() */
21654be8c573SJan Friedel case 2: /* getsid() */
21664be8c573SJan Friedel case 3: /* setsid() */
21674be8c573SJan Friedel case 4: /* getpgid() */
21684be8c573SJan Friedel break;
21694be8c573SJan Friedel
21704be8c573SJan Friedel case 5: /* setpgid() */
21717c478bd9Sstevel@tonic-gate
21727c478bd9Sstevel@tonic-gate /* current process? */
21734be8c573SJan Friedel if (pid == 0) {
21744be8c573SJan Friedel return;
21754be8c573SJan Friedel }
21767c478bd9Sstevel@tonic-gate
21774be8c573SJan Friedel mutex_enter(&pidlock);
21784be8c573SJan Friedel p = prfind(pid);
21794be8c573SJan Friedel if (p == NULL || p->p_as == &kas ||
21804be8c573SJan Friedel p->p_stat == SIDL || p->p_stat == SZOMB) {
21814be8c573SJan Friedel mutex_exit(&pidlock);
21824be8c573SJan Friedel return;
21834be8c573SJan Friedel }
21844be8c573SJan Friedel mutex_enter(&p->p_lock); /* so process doesn't go away */
21857c478bd9Sstevel@tonic-gate mutex_exit(&pidlock);
21867c478bd9Sstevel@tonic-gate
21874be8c573SJan Friedel mutex_enter(&p->p_crlock);
21884be8c573SJan Friedel crhold(cr = p->p_cred);
21894be8c573SJan Friedel mutex_exit(&p->p_crlock);
21904be8c573SJan Friedel mutex_exit(&p->p_lock);
21914be8c573SJan Friedel
21924be8c573SJan Friedel ainfo = crgetauinfo(cr);
21934be8c573SJan Friedel if (ainfo == NULL) {
21944be8c573SJan Friedel crfree(cr);
21954be8c573SJan Friedel return;
21964be8c573SJan Friedel }
21977c478bd9Sstevel@tonic-gate
21984be8c573SJan Friedel uid = crgetuid(cr);
21994be8c573SJan Friedel gid = crgetgid(cr);
22004be8c573SJan Friedel ruid = crgetruid(cr);
22014be8c573SJan Friedel rgid = crgetrgid(cr);
22024be8c573SJan Friedel au_uwrite(au_to_process(uid, gid, ruid, rgid, pid,
22034be8c573SJan Friedel ainfo->ai_auid, ainfo->ai_asid, &ainfo->ai_termid));
22047c478bd9Sstevel@tonic-gate crfree(cr);
22054be8c573SJan Friedel au_uwrite(au_to_arg32(2, "pgid", pgid));
22064be8c573SJan Friedel break;
22077c478bd9Sstevel@tonic-gate
22084be8c573SJan Friedel default:
22094be8c573SJan Friedel break;
22104be8c573SJan Friedel }
22117c478bd9Sstevel@tonic-gate }
22124be8c573SJan Friedel
22137c478bd9Sstevel@tonic-gate
22147c478bd9Sstevel@tonic-gate /*ARGSUSED*/
22157c478bd9Sstevel@tonic-gate static void
aus_setregid(struct t_audit_data * tad)22167c478bd9Sstevel@tonic-gate aus_setregid(struct t_audit_data *tad)
22177c478bd9Sstevel@tonic-gate {
22187c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
22197c478bd9Sstevel@tonic-gate uint32_t rgid, egid;
22207c478bd9Sstevel@tonic-gate
22217c478bd9Sstevel@tonic-gate struct a {
22227c478bd9Sstevel@tonic-gate long rgid;
22237c478bd9Sstevel@tonic-gate long egid;
22247c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
22257c478bd9Sstevel@tonic-gate
22267c478bd9Sstevel@tonic-gate rgid = (uint32_t)uap->rgid;
22277c478bd9Sstevel@tonic-gate egid = (uint32_t)uap->egid;
22287c478bd9Sstevel@tonic-gate
22297c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "rgid", rgid));
22307c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(2, "egid", egid));
22317c478bd9Sstevel@tonic-gate }
22327c478bd9Sstevel@tonic-gate
22337c478bd9Sstevel@tonic-gate /*ARGSUSED*/
22347c478bd9Sstevel@tonic-gate static void
aus_setgid(struct t_audit_data * tad)22357c478bd9Sstevel@tonic-gate aus_setgid(struct t_audit_data *tad)
22367c478bd9Sstevel@tonic-gate {
22377c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
22387c478bd9Sstevel@tonic-gate uint32_t gid;
22397c478bd9Sstevel@tonic-gate
22407c478bd9Sstevel@tonic-gate struct a {
22417c478bd9Sstevel@tonic-gate long gid;
22427c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
22437c478bd9Sstevel@tonic-gate
22447c478bd9Sstevel@tonic-gate gid = (uint32_t)uap->gid;
22457c478bd9Sstevel@tonic-gate
22467c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "gid", gid));
22477c478bd9Sstevel@tonic-gate }
22487c478bd9Sstevel@tonic-gate
22497c478bd9Sstevel@tonic-gate
22507c478bd9Sstevel@tonic-gate /*ARGSUSED*/
22517c478bd9Sstevel@tonic-gate static void
aus_setreuid(struct t_audit_data * tad)22527c478bd9Sstevel@tonic-gate aus_setreuid(struct t_audit_data *tad)
22537c478bd9Sstevel@tonic-gate {
22547c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
22557c478bd9Sstevel@tonic-gate uint32_t ruid, euid;
22567c478bd9Sstevel@tonic-gate
22577c478bd9Sstevel@tonic-gate struct a {
22587c478bd9Sstevel@tonic-gate long ruid;
22597c478bd9Sstevel@tonic-gate long euid;
22607c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
22617c478bd9Sstevel@tonic-gate
22627c478bd9Sstevel@tonic-gate ruid = (uint32_t)uap->ruid;
22637c478bd9Sstevel@tonic-gate euid = (uint32_t)uap->euid;
22647c478bd9Sstevel@tonic-gate
22657c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "ruid", ruid));
22667c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(2, "euid", euid));
22677c478bd9Sstevel@tonic-gate }
22687c478bd9Sstevel@tonic-gate
22697c478bd9Sstevel@tonic-gate
22707c478bd9Sstevel@tonic-gate /*ARGSUSED*/
22717c478bd9Sstevel@tonic-gate static void
aus_setuid(struct t_audit_data * tad)22727c478bd9Sstevel@tonic-gate aus_setuid(struct t_audit_data *tad)
22737c478bd9Sstevel@tonic-gate {
22747c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
22757c478bd9Sstevel@tonic-gate uint32_t uid;
22767c478bd9Sstevel@tonic-gate
22777c478bd9Sstevel@tonic-gate struct a {
22787c478bd9Sstevel@tonic-gate long uid;
22797c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
22807c478bd9Sstevel@tonic-gate
22817c478bd9Sstevel@tonic-gate uid = (uint32_t)uap->uid;
22827c478bd9Sstevel@tonic-gate
22837c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "uid", uid));
22847c478bd9Sstevel@tonic-gate }
22857c478bd9Sstevel@tonic-gate
22867c478bd9Sstevel@tonic-gate /*ARGSUSED*/
22877c478bd9Sstevel@tonic-gate static void
aus_shmsys(struct t_audit_data * tad)22887c478bd9Sstevel@tonic-gate aus_shmsys(struct t_audit_data *tad)
22897c478bd9Sstevel@tonic-gate {
22907c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
22917c478bd9Sstevel@tonic-gate uint32_t id, cmd;
22927c478bd9Sstevel@tonic-gate
22937c478bd9Sstevel@tonic-gate struct b {
22947c478bd9Sstevel@tonic-gate long id;
22957c478bd9Sstevel@tonic-gate long cmd;
22967c478bd9Sstevel@tonic-gate long buf; /* struct shmid_ds * */
22977c478bd9Sstevel@tonic-gate } *uap1 = (struct b *)&clwp->lwp_ap[1];
22987c478bd9Sstevel@tonic-gate
22997c478bd9Sstevel@tonic-gate id = (uint32_t)uap1->id;
23007c478bd9Sstevel@tonic-gate cmd = (uint32_t)uap1->cmd;
23017c478bd9Sstevel@tonic-gate
23027c478bd9Sstevel@tonic-gate switch (tad->tad_event) {
23037c478bd9Sstevel@tonic-gate case AUE_SHMGET: /* shmget */
23047c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "shm key", id));
23057c478bd9Sstevel@tonic-gate break;
23067c478bd9Sstevel@tonic-gate case AUE_SHMCTL: /* shmctl */
23077c478bd9Sstevel@tonic-gate case AUE_SHMCTL_RMID: /* shmctl */
23087c478bd9Sstevel@tonic-gate case AUE_SHMCTL_STAT: /* shmctl */
23097c478bd9Sstevel@tonic-gate case AUE_SHMCTL_SET: /* shmctl */
23107c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "shm ID", id));
23117c478bd9Sstevel@tonic-gate break;
23127c478bd9Sstevel@tonic-gate case AUE_SHMDT: /* shmdt */
23137c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "shm adr", id));
23147c478bd9Sstevel@tonic-gate break;
23157c478bd9Sstevel@tonic-gate case AUE_SHMAT: /* shmat */
23167c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "shm ID", id));
23177c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(2, "shm adr", cmd));
23187c478bd9Sstevel@tonic-gate break;
23197c478bd9Sstevel@tonic-gate }
23207c478bd9Sstevel@tonic-gate }
23217c478bd9Sstevel@tonic-gate
23227c478bd9Sstevel@tonic-gate /*ARGSUSED*/
23237c478bd9Sstevel@tonic-gate static void
auf_shmsys(struct t_audit_data * tad,int error,rval_t * rval)23247c478bd9Sstevel@tonic-gate auf_shmsys(struct t_audit_data *tad, int error, rval_t *rval)
23257c478bd9Sstevel@tonic-gate {
23267c478bd9Sstevel@tonic-gate int id;
23277c478bd9Sstevel@tonic-gate
23287c478bd9Sstevel@tonic-gate if (error != 0)
23297c478bd9Sstevel@tonic-gate return;
23307c478bd9Sstevel@tonic-gate if (tad->tad_event == AUE_SHMGET) {
23317c478bd9Sstevel@tonic-gate uint32_t scid;
23327c478bd9Sstevel@tonic-gate uint32_t sy_flags;
23337c478bd9Sstevel@tonic-gate
23347c478bd9Sstevel@tonic-gate /* need to determine type of executing binary */
23357c478bd9Sstevel@tonic-gate scid = tad->tad_scid;
23367c478bd9Sstevel@tonic-gate #ifdef _SYSCALL32_IMPL
23377c478bd9Sstevel@tonic-gate if (lwp_getdatamodel(ttolwp(curthread)) == DATAMODEL_NATIVE)
23387c478bd9Sstevel@tonic-gate sy_flags = sysent[scid].sy_flags & SE_RVAL_MASK;
23397c478bd9Sstevel@tonic-gate else
23407c478bd9Sstevel@tonic-gate sy_flags = sysent32[scid].sy_flags & SE_RVAL_MASK;
23417c478bd9Sstevel@tonic-gate #else
23427c478bd9Sstevel@tonic-gate sy_flags = sysent[scid].sy_flags & SE_RVAL_MASK;
23437c478bd9Sstevel@tonic-gate #endif
23447c478bd9Sstevel@tonic-gate if (sy_flags == SE_32RVAL1)
23457c478bd9Sstevel@tonic-gate id = rval->r_val1;
23467c478bd9Sstevel@tonic-gate if (sy_flags == (SE_32RVAL2|SE_32RVAL1))
23477c478bd9Sstevel@tonic-gate id = rval->r_val1;
23487c478bd9Sstevel@tonic-gate if (sy_flags == SE_64RVAL)
23497c478bd9Sstevel@tonic-gate id = (int)rval->r_vals;
23507c478bd9Sstevel@tonic-gate au_uwrite(au_to_ipc(AT_IPC_SHM, id));
23517c478bd9Sstevel@tonic-gate }
23527c478bd9Sstevel@tonic-gate }
23537c478bd9Sstevel@tonic-gate
23547c478bd9Sstevel@tonic-gate
23557c478bd9Sstevel@tonic-gate /*ARGSUSED*/
23567c478bd9Sstevel@tonic-gate static void
aus_ioctl(struct t_audit_data * tad)23577c478bd9Sstevel@tonic-gate aus_ioctl(struct t_audit_data *tad)
23587c478bd9Sstevel@tonic-gate {
23597c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
23607c478bd9Sstevel@tonic-gate struct file *fp;
23617c478bd9Sstevel@tonic-gate struct vnode *vp;
23627c478bd9Sstevel@tonic-gate struct f_audit_data *fad;
23637c478bd9Sstevel@tonic-gate uint32_t fd, cmd;
23647c478bd9Sstevel@tonic-gate uintptr_t cmarg;
23657c478bd9Sstevel@tonic-gate
23667c478bd9Sstevel@tonic-gate /* XX64 */
23677c478bd9Sstevel@tonic-gate struct a {
23687c478bd9Sstevel@tonic-gate long fd;
23697c478bd9Sstevel@tonic-gate long cmd;
23707c478bd9Sstevel@tonic-gate long cmarg; /* caddr_t */
23717c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
23727c478bd9Sstevel@tonic-gate
23737c478bd9Sstevel@tonic-gate fd = (uint32_t)uap->fd;
23747c478bd9Sstevel@tonic-gate cmd = (uint32_t)uap->cmd;
23757c478bd9Sstevel@tonic-gate cmarg = (uintptr_t)uap->cmarg;
23767c478bd9Sstevel@tonic-gate
23777c478bd9Sstevel@tonic-gate /*
23787c478bd9Sstevel@tonic-gate * convert file pointer to file descriptor
23797c478bd9Sstevel@tonic-gate * Note: fd ref count incremented here.
23807c478bd9Sstevel@tonic-gate */
23817c478bd9Sstevel@tonic-gate if ((fp = getf(fd)) == NULL) {
23827c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "fd", fd));
23837c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(2, "cmd", cmd));
23847c478bd9Sstevel@tonic-gate #ifndef _LP64
238515c07adcSJohn Levon au_uwrite(au_to_arg32(3, "arg", (uint32_t)cmarg));
23867c478bd9Sstevel@tonic-gate #else
238715c07adcSJohn Levon au_uwrite(au_to_arg64(3, "arg", (uint64_t)cmarg));
23887c478bd9Sstevel@tonic-gate #endif
23897c478bd9Sstevel@tonic-gate return;
23907c478bd9Sstevel@tonic-gate }
23917c478bd9Sstevel@tonic-gate
23927c478bd9Sstevel@tonic-gate /* get path from file struct here */
23937c478bd9Sstevel@tonic-gate fad = F2A(fp);
23947c478bd9Sstevel@tonic-gate if (fad->fad_aupath != NULL) {
23957c478bd9Sstevel@tonic-gate au_uwrite(au_to_path(fad->fad_aupath));
23967c478bd9Sstevel@tonic-gate } else {
23977c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "no path: fd", fd));
23987c478bd9Sstevel@tonic-gate }
23997c478bd9Sstevel@tonic-gate
24007c478bd9Sstevel@tonic-gate vp = fp->f_vnode;
24017c478bd9Sstevel@tonic-gate audit_attributes(vp);
24027c478bd9Sstevel@tonic-gate
24037c478bd9Sstevel@tonic-gate /* decrement file descriptor reference count */
24047c478bd9Sstevel@tonic-gate releasef(fd);
24057c478bd9Sstevel@tonic-gate
24067c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(2, "cmd", cmd));
24077c478bd9Sstevel@tonic-gate #ifndef _LP64
240815c07adcSJohn Levon au_uwrite(au_to_arg32(3, "arg", (uint32_t)cmarg));
24097c478bd9Sstevel@tonic-gate #else
241015c07adcSJohn Levon au_uwrite(au_to_arg64(3, "arg", (uint64_t)cmarg));
24117c478bd9Sstevel@tonic-gate #endif
24127c478bd9Sstevel@tonic-gate }
24137c478bd9Sstevel@tonic-gate
24147c478bd9Sstevel@tonic-gate /*
24157c478bd9Sstevel@tonic-gate * null function for memcntl for now. We might want to limit memcntl()
24167c478bd9Sstevel@tonic-gate * auditing to commands: MC_LOCKAS, MC_LOCK, MC_UNLOCKAS, MC_UNLOCK which
24177c478bd9Sstevel@tonic-gate * require privileges.
24187c478bd9Sstevel@tonic-gate */
24197c478bd9Sstevel@tonic-gate static au_event_t
aui_memcntl(au_event_t e)24207c478bd9Sstevel@tonic-gate aui_memcntl(au_event_t e)
24217c478bd9Sstevel@tonic-gate {
24227c478bd9Sstevel@tonic-gate return (e);
24237c478bd9Sstevel@tonic-gate }
24247c478bd9Sstevel@tonic-gate
24257c478bd9Sstevel@tonic-gate /*ARGSUSED*/
24267c478bd9Sstevel@tonic-gate static au_event_t
aui_privsys(au_event_t e)24277c478bd9Sstevel@tonic-gate aui_privsys(au_event_t e)
24287c478bd9Sstevel@tonic-gate {
24297c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
24307c478bd9Sstevel@tonic-gate
24317c478bd9Sstevel@tonic-gate struct a {
24327c478bd9Sstevel@tonic-gate long opcode;
24337c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
24347c478bd9Sstevel@tonic-gate
24357c478bd9Sstevel@tonic-gate switch (uap->opcode) {
24367c478bd9Sstevel@tonic-gate case PRIVSYS_SETPPRIV:
24377c478bd9Sstevel@tonic-gate return (AUE_SETPPRIV);
24387c478bd9Sstevel@tonic-gate default:
24397c478bd9Sstevel@tonic-gate return (AUE_NULL);
24407c478bd9Sstevel@tonic-gate }
24417c478bd9Sstevel@tonic-gate }
24427c478bd9Sstevel@tonic-gate
24437c478bd9Sstevel@tonic-gate /*ARGSUSED*/
24447c478bd9Sstevel@tonic-gate static void
aus_memcntl(struct t_audit_data * tad)24457c478bd9Sstevel@tonic-gate aus_memcntl(struct t_audit_data *tad)
24467c478bd9Sstevel@tonic-gate {
24477c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
24487c478bd9Sstevel@tonic-gate
24497c478bd9Sstevel@tonic-gate struct a {
24507c478bd9Sstevel@tonic-gate long addr;
24517c478bd9Sstevel@tonic-gate long len;
24527c478bd9Sstevel@tonic-gate long cmd;
24537c478bd9Sstevel@tonic-gate long arg;
24547c478bd9Sstevel@tonic-gate long attr;
24557c478bd9Sstevel@tonic-gate long mask;
24567c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
24577c478bd9Sstevel@tonic-gate
24587c478bd9Sstevel@tonic-gate #ifdef _LP64
24597c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg64(1, "base", (uint64_t)uap->addr));
24607c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg64(2, "len", (uint64_t)uap->len));
24617c478bd9Sstevel@tonic-gate #else
24627c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "base", (uint32_t)uap->addr));
24637c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(2, "len", (uint32_t)uap->len));
24647c478bd9Sstevel@tonic-gate #endif
24657c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(3, "cmd", (uint_t)uap->cmd));
24667c478bd9Sstevel@tonic-gate #ifdef _LP64
24677c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg64(4, "arg", (uint64_t)uap->arg));
24687c478bd9Sstevel@tonic-gate #else
24697c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(4, "arg", (uint32_t)uap->arg));
24707c478bd9Sstevel@tonic-gate #endif
24717c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(5, "attr", (uint_t)uap->attr));
24727c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(6, "mask", (uint_t)uap->mask));
24737c478bd9Sstevel@tonic-gate }
24747c478bd9Sstevel@tonic-gate
24757c478bd9Sstevel@tonic-gate /*ARGSUSED*/
24767c478bd9Sstevel@tonic-gate static void
aus_mmap(struct t_audit_data * tad)24777c478bd9Sstevel@tonic-gate aus_mmap(struct t_audit_data *tad)
24787c478bd9Sstevel@tonic-gate {
24797c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
24807c478bd9Sstevel@tonic-gate struct file *fp;
24817c478bd9Sstevel@tonic-gate struct f_audit_data *fad;
24827c478bd9Sstevel@tonic-gate struct vnode *vp;
24837c478bd9Sstevel@tonic-gate uint32_t fd;
24847c478bd9Sstevel@tonic-gate
24857c478bd9Sstevel@tonic-gate struct a {
24867c478bd9Sstevel@tonic-gate long addr;
24877c478bd9Sstevel@tonic-gate long len;
24887c478bd9Sstevel@tonic-gate long prot;
24897c478bd9Sstevel@tonic-gate long flags;
24907c478bd9Sstevel@tonic-gate long fd;
24917c478bd9Sstevel@tonic-gate long pos;
24927c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
24937c478bd9Sstevel@tonic-gate
24947c478bd9Sstevel@tonic-gate fd = (uint32_t)uap->fd;
24957c478bd9Sstevel@tonic-gate
24967c478bd9Sstevel@tonic-gate #ifdef _LP64
24977c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg64(1, "addr", (uint64_t)uap->addr));
24987c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg64(2, "len", (uint64_t)uap->len));
24997c478bd9Sstevel@tonic-gate #else
25007c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "addr", (uint32_t)uap->addr));
25017c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(2, "len", (uint32_t)uap->len));
25027c478bd9Sstevel@tonic-gate #endif
25037c478bd9Sstevel@tonic-gate
25047c478bd9Sstevel@tonic-gate if ((fp = getf(fd)) == NULL) {
25057c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(5, "fd", (uint32_t)uap->fd));
25067c478bd9Sstevel@tonic-gate return;
25077c478bd9Sstevel@tonic-gate }
25087c478bd9Sstevel@tonic-gate
25097c478bd9Sstevel@tonic-gate /*
25107c478bd9Sstevel@tonic-gate * Mark in the tad if write access is NOT requested... if
25117c478bd9Sstevel@tonic-gate * this is later detected (in audit_attributes) to be a
25127c478bd9Sstevel@tonic-gate * public object, the mmap event may be discarded.
25137c478bd9Sstevel@tonic-gate */
25147c478bd9Sstevel@tonic-gate if (((uap->prot) & PROT_WRITE) == 0) {
25154a0fa546SMarek Pospisil tad->tad_ctrl |= TAD_PUBLIC_EV;
25167c478bd9Sstevel@tonic-gate }
25177c478bd9Sstevel@tonic-gate
25187c478bd9Sstevel@tonic-gate fad = F2A(fp);
25197c478bd9Sstevel@tonic-gate if (fad->fad_aupath != NULL) {
25207c478bd9Sstevel@tonic-gate au_uwrite(au_to_path(fad->fad_aupath));
25217c478bd9Sstevel@tonic-gate } else {
25227c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "no path: fd", fd));
25237c478bd9Sstevel@tonic-gate }
25247c478bd9Sstevel@tonic-gate
25257c478bd9Sstevel@tonic-gate vp = (struct vnode *)fp->f_vnode;
25267c478bd9Sstevel@tonic-gate audit_attributes(vp);
25277c478bd9Sstevel@tonic-gate
25287c478bd9Sstevel@tonic-gate /* mark READ/WRITE since we can't predict access */
25297c478bd9Sstevel@tonic-gate if (uap->prot & PROT_READ)
25307c478bd9Sstevel@tonic-gate fad->fad_flags |= FAD_READ;
25317c478bd9Sstevel@tonic-gate if (uap->prot & PROT_WRITE)
25327c478bd9Sstevel@tonic-gate fad->fad_flags |= FAD_WRITE;
25337c478bd9Sstevel@tonic-gate
25347c478bd9Sstevel@tonic-gate /* decrement file descriptor reference count */
25357c478bd9Sstevel@tonic-gate releasef(fd);
25367c478bd9Sstevel@tonic-gate
25377c478bd9Sstevel@tonic-gate } /* AUS_MMAP */
25387c478bd9Sstevel@tonic-gate
25397c478bd9Sstevel@tonic-gate
25407c478bd9Sstevel@tonic-gate
25417c478bd9Sstevel@tonic-gate
25427c478bd9Sstevel@tonic-gate /*ARGSUSED*/
25437c478bd9Sstevel@tonic-gate static void
aus_munmap(struct t_audit_data * tad)25447c478bd9Sstevel@tonic-gate aus_munmap(struct t_audit_data *tad)
25457c478bd9Sstevel@tonic-gate {
25467c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
25477c478bd9Sstevel@tonic-gate
25487c478bd9Sstevel@tonic-gate struct a {
25497c478bd9Sstevel@tonic-gate long addr;
25507c478bd9Sstevel@tonic-gate long len;
25517c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
25527c478bd9Sstevel@tonic-gate
25537c478bd9Sstevel@tonic-gate #ifdef _LP64
25547c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg64(1, "addr", (uint64_t)uap->addr));
25557c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg64(2, "len", (uint64_t)uap->len));
25567c478bd9Sstevel@tonic-gate #else
25577c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "addr", (uint32_t)uap->addr));
25587c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(2, "len", (uint32_t)uap->len));
25597c478bd9Sstevel@tonic-gate #endif
25607c478bd9Sstevel@tonic-gate
25617c478bd9Sstevel@tonic-gate } /* AUS_MUNMAP */
25627c478bd9Sstevel@tonic-gate
25637c478bd9Sstevel@tonic-gate
25647c478bd9Sstevel@tonic-gate
25657c478bd9Sstevel@tonic-gate
25667c478bd9Sstevel@tonic-gate
25677c478bd9Sstevel@tonic-gate
25687c478bd9Sstevel@tonic-gate
25697c478bd9Sstevel@tonic-gate /*ARGSUSED*/
25707c478bd9Sstevel@tonic-gate static void
aus_priocntlsys(struct t_audit_data * tad)25717c478bd9Sstevel@tonic-gate aus_priocntlsys(struct t_audit_data *tad)
25727c478bd9Sstevel@tonic-gate {
25737c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
25747c478bd9Sstevel@tonic-gate
25757c478bd9Sstevel@tonic-gate struct a {
25767c478bd9Sstevel@tonic-gate long pc_version;
25777c478bd9Sstevel@tonic-gate long psp; /* procset_t */
25787c478bd9Sstevel@tonic-gate long cmd;
25797c478bd9Sstevel@tonic-gate long arg;
25807c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
25817c478bd9Sstevel@tonic-gate
25827c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "pc_version", (uint32_t)uap->pc_version));
25837c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(3, "cmd", (uint32_t)uap->cmd));
25847c478bd9Sstevel@tonic-gate
25857c478bd9Sstevel@tonic-gate } /* AUS_PRIOCNTLSYS */
25867c478bd9Sstevel@tonic-gate
25877c478bd9Sstevel@tonic-gate
25887c478bd9Sstevel@tonic-gate /*ARGSUSED*/
25897c478bd9Sstevel@tonic-gate static void
aus_setegid(struct t_audit_data * tad)25907c478bd9Sstevel@tonic-gate aus_setegid(struct t_audit_data *tad)
25917c478bd9Sstevel@tonic-gate {
25927c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
25937c478bd9Sstevel@tonic-gate uint32_t gid;
25947c478bd9Sstevel@tonic-gate
25957c478bd9Sstevel@tonic-gate struct a {
25967c478bd9Sstevel@tonic-gate long gid;
25977c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
25987c478bd9Sstevel@tonic-gate
25997c478bd9Sstevel@tonic-gate gid = (uint32_t)uap->gid;
26007c478bd9Sstevel@tonic-gate
26017c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "gid", gid));
26027c478bd9Sstevel@tonic-gate } /* AUS_SETEGID */
26037c478bd9Sstevel@tonic-gate
26047c478bd9Sstevel@tonic-gate
26057c478bd9Sstevel@tonic-gate
26067c478bd9Sstevel@tonic-gate
26077c478bd9Sstevel@tonic-gate /*ARGSUSED*/
26087c478bd9Sstevel@tonic-gate static void
aus_setgroups(struct t_audit_data * tad)26097c478bd9Sstevel@tonic-gate aus_setgroups(struct t_audit_data *tad)
26107c478bd9Sstevel@tonic-gate {
26117c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
26127c478bd9Sstevel@tonic-gate int i;
26137c478bd9Sstevel@tonic-gate int gidsetsize;
26147c478bd9Sstevel@tonic-gate uintptr_t gidset;
26157c478bd9Sstevel@tonic-gate gid_t *gidlist;
26167c478bd9Sstevel@tonic-gate
26177c478bd9Sstevel@tonic-gate struct a {
26187c478bd9Sstevel@tonic-gate long gidsetsize;
26197c478bd9Sstevel@tonic-gate long gidset;
26207c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
26217c478bd9Sstevel@tonic-gate
26227c478bd9Sstevel@tonic-gate gidsetsize = (uint_t)uap->gidsetsize;
26237c478bd9Sstevel@tonic-gate gidset = (uintptr_t)uap->gidset;
26247c478bd9Sstevel@tonic-gate
26257c478bd9Sstevel@tonic-gate if ((gidsetsize > NGROUPS_MAX_DEFAULT) || (gidsetsize < 0))
26267c478bd9Sstevel@tonic-gate return;
26277c478bd9Sstevel@tonic-gate if (gidsetsize != 0) {
26287c478bd9Sstevel@tonic-gate gidlist = kmem_alloc(gidsetsize * sizeof (gid_t),
2629745b2690Stz KM_SLEEP);
26307c478bd9Sstevel@tonic-gate if (copyin((caddr_t)gidset, gidlist,
2631745b2690Stz gidsetsize * sizeof (gid_t)) == 0)
26327c478bd9Sstevel@tonic-gate for (i = 0; i < gidsetsize; i++)
26337c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "setgroups",
2634745b2690Stz (uint32_t)gidlist[i]));
26357c478bd9Sstevel@tonic-gate kmem_free(gidlist, gidsetsize * sizeof (gid_t));
26367c478bd9Sstevel@tonic-gate } else
26377c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "setgroups", (uint32_t)0));
26387c478bd9Sstevel@tonic-gate
26397c478bd9Sstevel@tonic-gate } /* AUS_SETGROUPS */
26407c478bd9Sstevel@tonic-gate
26417c478bd9Sstevel@tonic-gate
26427c478bd9Sstevel@tonic-gate
26437c478bd9Sstevel@tonic-gate
26447c478bd9Sstevel@tonic-gate
26457c478bd9Sstevel@tonic-gate /*ARGSUSED*/
26467c478bd9Sstevel@tonic-gate static void
aus_seteuid(struct t_audit_data * tad)26477c478bd9Sstevel@tonic-gate aus_seteuid(struct t_audit_data *tad)
26487c478bd9Sstevel@tonic-gate {
26497c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
26507c478bd9Sstevel@tonic-gate uint32_t uid;
26517c478bd9Sstevel@tonic-gate
26527c478bd9Sstevel@tonic-gate struct a {
26537c478bd9Sstevel@tonic-gate long uid;
26547c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
26557c478bd9Sstevel@tonic-gate
26567c478bd9Sstevel@tonic-gate uid = (uint32_t)uap->uid;
26577c478bd9Sstevel@tonic-gate
26587c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "euid", uid));
26597c478bd9Sstevel@tonic-gate
26607c478bd9Sstevel@tonic-gate } /* AUS_SETEUID */
26617c478bd9Sstevel@tonic-gate
26627c478bd9Sstevel@tonic-gate /*ARGSUSED*/
26637c478bd9Sstevel@tonic-gate static void
aus_putmsg(struct t_audit_data * tad)26647c478bd9Sstevel@tonic-gate aus_putmsg(struct t_audit_data *tad)
26657c478bd9Sstevel@tonic-gate {
26667c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
26677c478bd9Sstevel@tonic-gate uint32_t fd, pri;
26687c478bd9Sstevel@tonic-gate struct file *fp;
26697c478bd9Sstevel@tonic-gate struct f_audit_data *fad;
26707c478bd9Sstevel@tonic-gate
26717c478bd9Sstevel@tonic-gate struct a {
26727c478bd9Sstevel@tonic-gate long fdes;
26737c478bd9Sstevel@tonic-gate long ctl; /* struct strbuf * */
26747c478bd9Sstevel@tonic-gate long data; /* struct strbuf * */
26757c478bd9Sstevel@tonic-gate long pri;
26767c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
26777c478bd9Sstevel@tonic-gate
26787c478bd9Sstevel@tonic-gate fd = (uint32_t)uap->fdes;
26797c478bd9Sstevel@tonic-gate pri = (uint32_t)uap->pri;
26807c478bd9Sstevel@tonic-gate
26817c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "fd", fd));
26827c478bd9Sstevel@tonic-gate
26837c478bd9Sstevel@tonic-gate if ((fp = getf(fd)) != NULL) {
26847c478bd9Sstevel@tonic-gate fad = F2A(fp);
26857c478bd9Sstevel@tonic-gate
26867c478bd9Sstevel@tonic-gate fad->fad_flags |= FAD_WRITE;
26877c478bd9Sstevel@tonic-gate
26887c478bd9Sstevel@tonic-gate /* add path name to audit record */
26897c478bd9Sstevel@tonic-gate if (fad->fad_aupath != NULL) {
26907c478bd9Sstevel@tonic-gate au_uwrite(au_to_path(fad->fad_aupath));
26917c478bd9Sstevel@tonic-gate }
26927c478bd9Sstevel@tonic-gate audit_attributes(fp->f_vnode);
26937c478bd9Sstevel@tonic-gate
26947c478bd9Sstevel@tonic-gate releasef(fd);
26957c478bd9Sstevel@tonic-gate }
26967c478bd9Sstevel@tonic-gate
26977c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(4, "pri", pri));
26987c478bd9Sstevel@tonic-gate }
26997c478bd9Sstevel@tonic-gate
27007c478bd9Sstevel@tonic-gate /*ARGSUSED*/
27017c478bd9Sstevel@tonic-gate static void
aus_putpmsg(struct t_audit_data * tad)27027c478bd9Sstevel@tonic-gate aus_putpmsg(struct t_audit_data *tad)
27037c478bd9Sstevel@tonic-gate {
27047c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
27057c478bd9Sstevel@tonic-gate uint32_t fd, pri, flags;
27067c478bd9Sstevel@tonic-gate struct file *fp;
27077c478bd9Sstevel@tonic-gate struct f_audit_data *fad;
27087c478bd9Sstevel@tonic-gate
27097c478bd9Sstevel@tonic-gate struct a {
27107c478bd9Sstevel@tonic-gate long fdes;
27117c478bd9Sstevel@tonic-gate long ctl; /* struct strbuf * */
27127c478bd9Sstevel@tonic-gate long data; /* struct strbuf * */
27137c478bd9Sstevel@tonic-gate long pri;
27147c478bd9Sstevel@tonic-gate long flags;
27157c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
27167c478bd9Sstevel@tonic-gate
27177c478bd9Sstevel@tonic-gate fd = (uint32_t)uap->fdes;
27187c478bd9Sstevel@tonic-gate pri = (uint32_t)uap->pri;
27197c478bd9Sstevel@tonic-gate flags = (uint32_t)uap->flags;
27207c478bd9Sstevel@tonic-gate
27217c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "fd", fd));
27227c478bd9Sstevel@tonic-gate
27237c478bd9Sstevel@tonic-gate if ((fp = getf(fd)) != NULL) {
27247c478bd9Sstevel@tonic-gate fad = F2A(fp);
27257c478bd9Sstevel@tonic-gate
27267c478bd9Sstevel@tonic-gate fad->fad_flags |= FAD_WRITE;
27277c478bd9Sstevel@tonic-gate
27287c478bd9Sstevel@tonic-gate /* add path name to audit record */
27297c478bd9Sstevel@tonic-gate if (fad->fad_aupath != NULL) {
27307c478bd9Sstevel@tonic-gate au_uwrite(au_to_path(fad->fad_aupath));
27317c478bd9Sstevel@tonic-gate }
27327c478bd9Sstevel@tonic-gate audit_attributes(fp->f_vnode);
27337c478bd9Sstevel@tonic-gate
27347c478bd9Sstevel@tonic-gate releasef(fd);
27357c478bd9Sstevel@tonic-gate }
27367c478bd9Sstevel@tonic-gate
27377c478bd9Sstevel@tonic-gate
27387c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(4, "pri", pri));
27397c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(5, "flags", flags));
27407c478bd9Sstevel@tonic-gate }
27417c478bd9Sstevel@tonic-gate
27427c478bd9Sstevel@tonic-gate /*ARGSUSED*/
27437c478bd9Sstevel@tonic-gate static void
aus_getmsg(struct t_audit_data * tad)27447c478bd9Sstevel@tonic-gate aus_getmsg(struct t_audit_data *tad)
27457c478bd9Sstevel@tonic-gate {
27467c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
27477c478bd9Sstevel@tonic-gate uint32_t fd, pri;
27487c478bd9Sstevel@tonic-gate struct file *fp;
27497c478bd9Sstevel@tonic-gate struct f_audit_data *fad;
27507c478bd9Sstevel@tonic-gate
27517c478bd9Sstevel@tonic-gate struct a {
27527c478bd9Sstevel@tonic-gate long fdes;
27537c478bd9Sstevel@tonic-gate long ctl; /* struct strbuf * */
27547c478bd9Sstevel@tonic-gate long data; /* struct strbuf * */
27557c478bd9Sstevel@tonic-gate long pri;
27567c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
27577c478bd9Sstevel@tonic-gate
27587c478bd9Sstevel@tonic-gate fd = (uint32_t)uap->fdes;
27597c478bd9Sstevel@tonic-gate pri = (uint32_t)uap->pri;
27607c478bd9Sstevel@tonic-gate
27617c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "fd", fd));
27627c478bd9Sstevel@tonic-gate
27637c478bd9Sstevel@tonic-gate if ((fp = getf(fd)) != NULL) {
27647c478bd9Sstevel@tonic-gate fad = F2A(fp);
27657c478bd9Sstevel@tonic-gate
27667c478bd9Sstevel@tonic-gate /*
27677c478bd9Sstevel@tonic-gate * read operation on this object
27687c478bd9Sstevel@tonic-gate */
27697c478bd9Sstevel@tonic-gate fad->fad_flags |= FAD_READ;
27707c478bd9Sstevel@tonic-gate
27717c478bd9Sstevel@tonic-gate /* add path name to audit record */
27727c478bd9Sstevel@tonic-gate if (fad->fad_aupath != NULL) {
27737c478bd9Sstevel@tonic-gate au_uwrite(au_to_path(fad->fad_aupath));
27747c478bd9Sstevel@tonic-gate }
27757c478bd9Sstevel@tonic-gate audit_attributes(fp->f_vnode);
27767c478bd9Sstevel@tonic-gate
27777c478bd9Sstevel@tonic-gate releasef(fd);
27787c478bd9Sstevel@tonic-gate }
27797c478bd9Sstevel@tonic-gate
27807c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(4, "pri", pri));
27817c478bd9Sstevel@tonic-gate }
27827c478bd9Sstevel@tonic-gate
27837c478bd9Sstevel@tonic-gate /*ARGSUSED*/
27847c478bd9Sstevel@tonic-gate static void
aus_getpmsg(struct t_audit_data * tad)27857c478bd9Sstevel@tonic-gate aus_getpmsg(struct t_audit_data *tad)
27867c478bd9Sstevel@tonic-gate {
27877c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
27887c478bd9Sstevel@tonic-gate uint32_t fd;
27897c478bd9Sstevel@tonic-gate struct file *fp;
27907c478bd9Sstevel@tonic-gate struct f_audit_data *fad;
27917c478bd9Sstevel@tonic-gate
27927c478bd9Sstevel@tonic-gate struct a {
27937c478bd9Sstevel@tonic-gate long fdes;
27947c478bd9Sstevel@tonic-gate long ctl; /* struct strbuf * */
27957c478bd9Sstevel@tonic-gate long data; /* struct strbuf * */
27967c478bd9Sstevel@tonic-gate long pri;
27977c478bd9Sstevel@tonic-gate long flags;
27987c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
27997c478bd9Sstevel@tonic-gate
28007c478bd9Sstevel@tonic-gate fd = (uint32_t)uap->fdes;
28017c478bd9Sstevel@tonic-gate
28027c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "fd", fd));
28037c478bd9Sstevel@tonic-gate
28047c478bd9Sstevel@tonic-gate if ((fp = getf(fd)) != NULL) {
28057c478bd9Sstevel@tonic-gate fad = F2A(fp);
28067c478bd9Sstevel@tonic-gate
28077c478bd9Sstevel@tonic-gate /*
28087c478bd9Sstevel@tonic-gate * read operation on this object
28097c478bd9Sstevel@tonic-gate */
28107c478bd9Sstevel@tonic-gate fad->fad_flags |= FAD_READ;
28117c478bd9Sstevel@tonic-gate
28127c478bd9Sstevel@tonic-gate /* add path name to audit record */
28137c478bd9Sstevel@tonic-gate if (fad->fad_aupath != NULL) {
28147c478bd9Sstevel@tonic-gate au_uwrite(au_to_path(fad->fad_aupath));
28157c478bd9Sstevel@tonic-gate }
28167c478bd9Sstevel@tonic-gate audit_attributes(fp->f_vnode);
28177c478bd9Sstevel@tonic-gate
28187c478bd9Sstevel@tonic-gate releasef(fd);
28197c478bd9Sstevel@tonic-gate }
28207c478bd9Sstevel@tonic-gate }
28217c478bd9Sstevel@tonic-gate
282261b9bf51Srica static au_event_t
aui_labelsys(au_event_t e)282361b9bf51Srica aui_labelsys(au_event_t e)
282461b9bf51Srica {
282561b9bf51Srica klwp_t *clwp = ttolwp(curthread);
282661b9bf51Srica uint32_t code;
282761b9bf51Srica uint32_t cmd;
282861b9bf51Srica
282961b9bf51Srica struct a {
283061b9bf51Srica long code;
283161b9bf51Srica long cmd;
283261b9bf51Srica } *uap = (struct a *)clwp->lwp_ap;
283361b9bf51Srica
283461b9bf51Srica code = (uint32_t)uap->code;
283561b9bf51Srica cmd = (uint32_t)uap->cmd;
283661b9bf51Srica
283761b9bf51Srica /* not security relevant if not changing kernel cache */
283861b9bf51Srica if (cmd == TNDB_GET)
2839d3e710c8SRic Aleshire return (AUE_NULL);
284061b9bf51Srica
284161b9bf51Srica switch (code) {
284261b9bf51Srica case TSOL_TNRH:
284361b9bf51Srica e = AUE_LABELSYS_TNRH;
284461b9bf51Srica break;
284561b9bf51Srica case TSOL_TNRHTP:
284661b9bf51Srica e = AUE_LABELSYS_TNRHTP;
284761b9bf51Srica break;
284861b9bf51Srica case TSOL_TNMLP:
284961b9bf51Srica e = AUE_LABELSYS_TNMLP;
285061b9bf51Srica break;
285161b9bf51Srica default:
285261b9bf51Srica e = AUE_NULL;
285361b9bf51Srica break;
285461b9bf51Srica }
285561b9bf51Srica
285661b9bf51Srica return (e);
285761b9bf51Srica
285861b9bf51Srica }
285961b9bf51Srica
286061b9bf51Srica static void
aus_labelsys(struct t_audit_data * tad)286161b9bf51Srica aus_labelsys(struct t_audit_data *tad)
286261b9bf51Srica {
286361b9bf51Srica klwp_t *clwp = ttolwp(curthread);
286461b9bf51Srica uint32_t cmd;
286561b9bf51Srica uintptr_t a2;
286661b9bf51Srica
286761b9bf51Srica struct a {
286861b9bf51Srica long code;
286961b9bf51Srica long cmd;
287061b9bf51Srica long a2;
287161b9bf51Srica } *uap = (struct a *)clwp->lwp_ap;
287261b9bf51Srica
287361b9bf51Srica cmd = (uint32_t)uap->cmd;
287461b9bf51Srica a2 = (uintptr_t)uap->a2;
287561b9bf51Srica
287661b9bf51Srica switch (tad->tad_event) {
287761b9bf51Srica case AUE_LABELSYS_TNRH:
287861b9bf51Srica {
287961b9bf51Srica tsol_rhent_t *rhent;
288061b9bf51Srica tnaddr_t *rh_addr;
288161b9bf51Srica
288261b9bf51Srica au_uwrite(au_to_arg32(1, "cmd", cmd));
288361b9bf51Srica
288461b9bf51Srica /* Remaining args don't apply for FLUSH, so skip */
288561b9bf51Srica if (cmd == TNDB_FLUSH)
288661b9bf51Srica break;
288761b9bf51Srica
288861b9bf51Srica rhent = kmem_alloc(sizeof (tsol_rhent_t), KM_SLEEP);
288961b9bf51Srica if (copyin((caddr_t)a2, rhent, sizeof (tsol_rhent_t))) {
289061b9bf51Srica kmem_free(rhent, sizeof (tsol_rhent_t));
289161b9bf51Srica return;
289261b9bf51Srica }
289361b9bf51Srica
289461b9bf51Srica rh_addr = &rhent->rh_address;
289561b9bf51Srica if (rh_addr->ta_family == AF_INET) {
289661b9bf51Srica struct in_addr *ipaddr;
289761b9bf51Srica
289861b9bf51Srica ipaddr = &(rh_addr->ta_addr_v4);
289961b9bf51Srica au_uwrite(au_to_in_addr(ipaddr));
290061b9bf51Srica } else if (rh_addr->ta_family == AF_INET6) {
290161b9bf51Srica int32_t *ipaddr;
290261b9bf51Srica
290361b9bf51Srica ipaddr = (int32_t *)&(rh_addr->ta_addr_v6);
290461b9bf51Srica au_uwrite(au_to_in_addr_ex(ipaddr));
290561b9bf51Srica }
290661b9bf51Srica au_uwrite(au_to_arg32(2, "prefix len", rhent->rh_prefix));
290761b9bf51Srica
290861b9bf51Srica kmem_free(rhent, sizeof (tsol_rhent_t));
290961b9bf51Srica
291061b9bf51Srica break;
291161b9bf51Srica }
291261b9bf51Srica case AUE_LABELSYS_TNRHTP:
291361b9bf51Srica {
291461b9bf51Srica tsol_tpent_t *tpent;
291561b9bf51Srica
291661b9bf51Srica au_uwrite(au_to_arg32(1, "cmd", cmd));
291761b9bf51Srica
291861b9bf51Srica /* Remaining args don't apply for FLUSH, so skip */
291961b9bf51Srica if (cmd == TNDB_FLUSH)
292061b9bf51Srica break;
292161b9bf51Srica
292261b9bf51Srica tpent = kmem_alloc(sizeof (tsol_tpent_t), KM_SLEEP);
292361b9bf51Srica if (copyin((caddr_t)a2, tpent, sizeof (tsol_tpent_t))) {
292461b9bf51Srica kmem_free(tpent, sizeof (tsol_tpent_t));
292561b9bf51Srica return;
292661b9bf51Srica }
292761b9bf51Srica
2928d3e710c8SRic Aleshire /* Make sure that the template name is null-terminated. */
2929d3e710c8SRic Aleshire *(tpent->name + TNTNAMSIZ - 1) = '\0';
2930d3e710c8SRic Aleshire
293161b9bf51Srica au_uwrite(au_to_text(tpent->name));
293261b9bf51Srica kmem_free(tpent, sizeof (tsol_tpent_t));
293361b9bf51Srica
293461b9bf51Srica break;
293561b9bf51Srica }
293661b9bf51Srica case AUE_LABELSYS_TNMLP:
293761b9bf51Srica {
293861b9bf51Srica tsol_mlpent_t *mlpent;
293961b9bf51Srica
294061b9bf51Srica au_uwrite(au_to_arg32(1, "cmd", cmd));
294161b9bf51Srica
294261b9bf51Srica mlpent = kmem_alloc(sizeof (tsol_mlpent_t), KM_SLEEP);
294361b9bf51Srica if (copyin((caddr_t)a2, mlpent, sizeof (tsol_mlpent_t))) {
294461b9bf51Srica kmem_free(mlpent, sizeof (tsol_mlpent_t));
294561b9bf51Srica return;
294661b9bf51Srica }
294761b9bf51Srica
294861b9bf51Srica if (mlpent->tsme_flags & TSOL_MEF_SHARED) {
294961b9bf51Srica au_uwrite(au_to_text("shared"));
295061b9bf51Srica } else {
295161b9bf51Srica zone_t *zone;
295261b9bf51Srica
295361b9bf51Srica zone = zone_find_by_id(mlpent->tsme_zoneid);
295461b9bf51Srica if (zone != NULL) {
295561b9bf51Srica au_uwrite(au_to_text(zone->zone_name));
295661b9bf51Srica zone_rele(zone);
295761b9bf51Srica }
295861b9bf51Srica }
295961b9bf51Srica
296061b9bf51Srica /* Remaining args don't apply for FLUSH, so skip */
296161b9bf51Srica if (cmd == TNDB_FLUSH) {
296261b9bf51Srica kmem_free(mlpent, sizeof (tsol_mlpent_t));
296361b9bf51Srica break;
296461b9bf51Srica }
296561b9bf51Srica
296661b9bf51Srica au_uwrite(au_to_arg32(2, "proto num",
296761b9bf51Srica (uint32_t)mlpent->tsme_mlp.mlp_ipp));
296861b9bf51Srica au_uwrite(au_to_arg32(2, "mlp_port",
296961b9bf51Srica (uint32_t)mlpent->tsme_mlp.mlp_port));
297061b9bf51Srica
297161b9bf51Srica if (mlpent->tsme_mlp.mlp_port_upper != 0)
297261b9bf51Srica au_uwrite(au_to_arg32(2, "mlp_port_upper",
297361b9bf51Srica (uint32_t)mlpent->tsme_mlp.mlp_port_upper));
297461b9bf51Srica
297561b9bf51Srica kmem_free(mlpent, sizeof (tsol_mlpent_t));
297661b9bf51Srica
297761b9bf51Srica break;
297861b9bf51Srica }
297961b9bf51Srica default:
298061b9bf51Srica break;
298161b9bf51Srica }
298261b9bf51Srica }
298361b9bf51Srica
298461b9bf51Srica
29857c478bd9Sstevel@tonic-gate static au_event_t
aui_auditsys(au_event_t e)29867c478bd9Sstevel@tonic-gate aui_auditsys(au_event_t e)
29877c478bd9Sstevel@tonic-gate {
29887c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
29897c478bd9Sstevel@tonic-gate uint32_t code;
29907c478bd9Sstevel@tonic-gate
29917c478bd9Sstevel@tonic-gate struct a {
29927c478bd9Sstevel@tonic-gate long code;
29937c478bd9Sstevel@tonic-gate long a1;
29947c478bd9Sstevel@tonic-gate long a2;
29957c478bd9Sstevel@tonic-gate long a3;
29967c478bd9Sstevel@tonic-gate long a4;
29977c478bd9Sstevel@tonic-gate long a5;
29987c478bd9Sstevel@tonic-gate long a6;
29997c478bd9Sstevel@tonic-gate long a7;
30007c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
30017c478bd9Sstevel@tonic-gate
30027c478bd9Sstevel@tonic-gate code = (uint32_t)uap->code;
30037c478bd9Sstevel@tonic-gate
30047c478bd9Sstevel@tonic-gate switch (code) {
30057c478bd9Sstevel@tonic-gate
30067c478bd9Sstevel@tonic-gate case BSM_GETAUID:
30077c478bd9Sstevel@tonic-gate e = AUE_GETAUID;
30087c478bd9Sstevel@tonic-gate break;
30097c478bd9Sstevel@tonic-gate case BSM_SETAUID:
30107c478bd9Sstevel@tonic-gate e = AUE_SETAUID;
30117c478bd9Sstevel@tonic-gate break;
30127c478bd9Sstevel@tonic-gate case BSM_GETAUDIT:
30137c478bd9Sstevel@tonic-gate e = AUE_GETAUDIT;
30147c478bd9Sstevel@tonic-gate break;
30157c478bd9Sstevel@tonic-gate case BSM_GETAUDIT_ADDR:
30167c478bd9Sstevel@tonic-gate e = AUE_GETAUDIT_ADDR;
30177c478bd9Sstevel@tonic-gate break;
30187c478bd9Sstevel@tonic-gate case BSM_SETAUDIT:
30197c478bd9Sstevel@tonic-gate e = AUE_SETAUDIT;
30207c478bd9Sstevel@tonic-gate break;
30217c478bd9Sstevel@tonic-gate case BSM_SETAUDIT_ADDR:
30227c478bd9Sstevel@tonic-gate e = AUE_SETAUDIT_ADDR;
30237c478bd9Sstevel@tonic-gate break;
30247c478bd9Sstevel@tonic-gate case BSM_AUDIT:
30257c478bd9Sstevel@tonic-gate e = AUE_AUDIT;
30267c478bd9Sstevel@tonic-gate break;
30277c478bd9Sstevel@tonic-gate case BSM_AUDITCTL:
30287c478bd9Sstevel@tonic-gate switch ((uint_t)uap->a1) {
30297c478bd9Sstevel@tonic-gate
30307c478bd9Sstevel@tonic-gate case A_GETPOLICY:
30317c478bd9Sstevel@tonic-gate e = AUE_AUDITON_GPOLICY;
30327c478bd9Sstevel@tonic-gate break;
30337c478bd9Sstevel@tonic-gate case A_SETPOLICY:
30347c478bd9Sstevel@tonic-gate e = AUE_AUDITON_SPOLICY;
30357c478bd9Sstevel@tonic-gate break;
3036f8994074SJan Friedel case A_GETAMASK:
3037f8994074SJan Friedel e = AUE_AUDITON_GETAMASK;
3038f8994074SJan Friedel break;
3039f8994074SJan Friedel case A_SETAMASK:
3040f8994074SJan Friedel e = AUE_AUDITON_SETAMASK;
3041f8994074SJan Friedel break;
30427c478bd9Sstevel@tonic-gate case A_GETKMASK:
30437c478bd9Sstevel@tonic-gate e = AUE_AUDITON_GETKMASK;
30447c478bd9Sstevel@tonic-gate break;
30457c478bd9Sstevel@tonic-gate case A_SETKMASK:
30467c478bd9Sstevel@tonic-gate e = AUE_AUDITON_SETKMASK;
30477c478bd9Sstevel@tonic-gate break;
30487c478bd9Sstevel@tonic-gate case A_GETQCTRL:
30497c478bd9Sstevel@tonic-gate e = AUE_AUDITON_GQCTRL;
30507c478bd9Sstevel@tonic-gate break;
30517c478bd9Sstevel@tonic-gate case A_SETQCTRL:
30527c478bd9Sstevel@tonic-gate e = AUE_AUDITON_SQCTRL;
30537c478bd9Sstevel@tonic-gate break;
30547c478bd9Sstevel@tonic-gate case A_GETCWD:
30557c478bd9Sstevel@tonic-gate e = AUE_AUDITON_GETCWD;
30567c478bd9Sstevel@tonic-gate break;
30577c478bd9Sstevel@tonic-gate case A_GETCAR:
30587c478bd9Sstevel@tonic-gate e = AUE_AUDITON_GETCAR;
30597c478bd9Sstevel@tonic-gate break;
30607c478bd9Sstevel@tonic-gate case A_GETSTAT:
30617c478bd9Sstevel@tonic-gate e = AUE_AUDITON_GETSTAT;
30627c478bd9Sstevel@tonic-gate break;
30637c478bd9Sstevel@tonic-gate case A_SETSTAT:
30647c478bd9Sstevel@tonic-gate e = AUE_AUDITON_SETSTAT;
30657c478bd9Sstevel@tonic-gate break;
30667c478bd9Sstevel@tonic-gate case A_SETUMASK:
30677c478bd9Sstevel@tonic-gate e = AUE_AUDITON_SETUMASK;
30687c478bd9Sstevel@tonic-gate break;
30697c478bd9Sstevel@tonic-gate case A_SETSMASK:
30707c478bd9Sstevel@tonic-gate e = AUE_AUDITON_SETSMASK;
30717c478bd9Sstevel@tonic-gate break;
30727c478bd9Sstevel@tonic-gate case A_GETCOND:
30737c478bd9Sstevel@tonic-gate e = AUE_AUDITON_GETCOND;
30747c478bd9Sstevel@tonic-gate break;
30757c478bd9Sstevel@tonic-gate case A_SETCOND:
30767c478bd9Sstevel@tonic-gate e = AUE_AUDITON_SETCOND;
30777c478bd9Sstevel@tonic-gate break;
30787c478bd9Sstevel@tonic-gate case A_GETCLASS:
30797c478bd9Sstevel@tonic-gate e = AUE_AUDITON_GETCLASS;
30807c478bd9Sstevel@tonic-gate break;
30817c478bd9Sstevel@tonic-gate case A_SETCLASS:
30827c478bd9Sstevel@tonic-gate e = AUE_AUDITON_SETCLASS;
30837c478bd9Sstevel@tonic-gate break;
3084241bfedfSAlex Wilson case A_GETPINFO:
3085241bfedfSAlex Wilson case A_GETPINFO_ADDR:
3086241bfedfSAlex Wilson e = AUE_AUDITON_GETPINFO;
3087241bfedfSAlex Wilson break;
3088241bfedfSAlex Wilson case A_SETPMASK:
3089241bfedfSAlex Wilson e = AUE_AUDITON_SETPMASK;
3090241bfedfSAlex Wilson break;
3091241bfedfSAlex Wilson case A_GETKAUDIT:
3092241bfedfSAlex Wilson e = AUE_AUDITON_GETKAUDIT;
3093241bfedfSAlex Wilson break;
3094241bfedfSAlex Wilson case A_SETKAUDIT:
3095241bfedfSAlex Wilson e = AUE_AUDITON_SETKAUDIT;
3096241bfedfSAlex Wilson break;
30977c478bd9Sstevel@tonic-gate default:
3098241bfedfSAlex Wilson e = AUE_AUDITON_OTHER;
30997c478bd9Sstevel@tonic-gate break;
31007c478bd9Sstevel@tonic-gate }
31017c478bd9Sstevel@tonic-gate break;
31027c478bd9Sstevel@tonic-gate default:
31037c478bd9Sstevel@tonic-gate e = AUE_NULL;
31047c478bd9Sstevel@tonic-gate break;
31057c478bd9Sstevel@tonic-gate }
31067c478bd9Sstevel@tonic-gate
31077c478bd9Sstevel@tonic-gate return (e);
31087c478bd9Sstevel@tonic-gate
31097c478bd9Sstevel@tonic-gate } /* AUI_AUDITSYS */
31107c478bd9Sstevel@tonic-gate
31117c478bd9Sstevel@tonic-gate
31127c478bd9Sstevel@tonic-gate static void
aus_auditsys(struct t_audit_data * tad)31137c478bd9Sstevel@tonic-gate aus_auditsys(struct t_audit_data *tad)
31147c478bd9Sstevel@tonic-gate {
31157c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
31167c478bd9Sstevel@tonic-gate uintptr_t a1, a2;
31177c478bd9Sstevel@tonic-gate STRUCT_DECL(auditinfo, ainfo);
31187c478bd9Sstevel@tonic-gate STRUCT_DECL(auditinfo_addr, ainfo_addr);
3119241bfedfSAlex Wilson STRUCT_DECL(auditpinfo, apinfo);
31207c478bd9Sstevel@tonic-gate au_evclass_map_t event;
31217c478bd9Sstevel@tonic-gate au_mask_t mask;
31227c478bd9Sstevel@tonic-gate int auditstate, policy;
3123f2fcf18cStz au_id_t auid;
31247c478bd9Sstevel@tonic-gate
31257c478bd9Sstevel@tonic-gate
31267c478bd9Sstevel@tonic-gate struct a {
31277c478bd9Sstevel@tonic-gate long code;
31287c478bd9Sstevel@tonic-gate long a1;
31297c478bd9Sstevel@tonic-gate long a2;
31307c478bd9Sstevel@tonic-gate long a3;
31317c478bd9Sstevel@tonic-gate long a4;
31327c478bd9Sstevel@tonic-gate long a5;
31337c478bd9Sstevel@tonic-gate long a6;
31347c478bd9Sstevel@tonic-gate long a7;
31357c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
31367c478bd9Sstevel@tonic-gate
31377c478bd9Sstevel@tonic-gate a1 = (uintptr_t)uap->a1;
31387c478bd9Sstevel@tonic-gate a2 = (uintptr_t)uap->a2;
31397c478bd9Sstevel@tonic-gate
31407c478bd9Sstevel@tonic-gate switch (tad->tad_event) {
31417c478bd9Sstevel@tonic-gate case AUE_SETAUID:
3142f2fcf18cStz if (copyin((caddr_t)a1, &auid, sizeof (au_id_t)))
3143f2fcf18cStz return;
3144f2fcf18cStz au_uwrite(au_to_arg32(2, "setauid", auid));
31457c478bd9Sstevel@tonic-gate break;
31467c478bd9Sstevel@tonic-gate case AUE_SETAUDIT:
31477c478bd9Sstevel@tonic-gate STRUCT_INIT(ainfo, get_udatamodel());
31487c478bd9Sstevel@tonic-gate if (copyin((caddr_t)a1, STRUCT_BUF(ainfo),
3149745b2690Stz STRUCT_SIZE(ainfo))) {
31507c478bd9Sstevel@tonic-gate return;
31517c478bd9Sstevel@tonic-gate }
31527c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32((char)1, "setaudit:auid",
3153745b2690Stz (uint32_t)STRUCT_FGET(ainfo, ai_auid)));
31547c478bd9Sstevel@tonic-gate #ifdef _LP64
31557c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg64((char)1, "setaudit:port",
3156745b2690Stz (uint64_t)STRUCT_FGET(ainfo, ai_termid.port)));
31577c478bd9Sstevel@tonic-gate #else
31587c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32((char)1, "setaudit:port",
3159745b2690Stz (uint32_t)STRUCT_FGET(ainfo, ai_termid.port)));
31607c478bd9Sstevel@tonic-gate #endif
31617c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32((char)1, "setaudit:machine",
3162745b2690Stz (uint32_t)STRUCT_FGET(ainfo, ai_termid.machine)));
31637c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32((char)1, "setaudit:as_success",
3164745b2690Stz (uint32_t)STRUCT_FGET(ainfo, ai_mask.as_success)));
31657c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32((char)1, "setaudit:as_failure",
3166745b2690Stz (uint32_t)STRUCT_FGET(ainfo, ai_mask.as_failure)));
31677c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32((char)1, "setaudit:asid",
3168745b2690Stz (uint32_t)STRUCT_FGET(ainfo, ai_asid)));
31697c478bd9Sstevel@tonic-gate break;
31707c478bd9Sstevel@tonic-gate case AUE_SETAUDIT_ADDR:
31717c478bd9Sstevel@tonic-gate STRUCT_INIT(ainfo_addr, get_udatamodel());
31727c478bd9Sstevel@tonic-gate if (copyin((caddr_t)a1, STRUCT_BUF(ainfo_addr),
3173745b2690Stz STRUCT_SIZE(ainfo_addr))) {
31747c478bd9Sstevel@tonic-gate return;
31757c478bd9Sstevel@tonic-gate }
31767c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32((char)1, "auid",
3177745b2690Stz (uint32_t)STRUCT_FGET(ainfo_addr, ai_auid)));
31787c478bd9Sstevel@tonic-gate #ifdef _LP64
31797c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg64((char)1, "port",
3180745b2690Stz (uint64_t)STRUCT_FGET(ainfo_addr, ai_termid.at_port)));
31817c478bd9Sstevel@tonic-gate #else
31827c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32((char)1, "port",
3183745b2690Stz (uint32_t)STRUCT_FGET(ainfo_addr, ai_termid.at_port)));
31847c478bd9Sstevel@tonic-gate #endif
31857c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32((char)1, "type",
3186745b2690Stz (uint32_t)STRUCT_FGET(ainfo_addr, ai_termid.at_type)));
31877c478bd9Sstevel@tonic-gate if ((uint32_t)STRUCT_FGET(ainfo_addr, ai_termid.at_type) ==
31887c478bd9Sstevel@tonic-gate AU_IPv4) {
31897c478bd9Sstevel@tonic-gate au_uwrite(au_to_in_addr(
3190745b2690Stz (struct in_addr *)STRUCT_FGETP(ainfo_addr,
3191745b2690Stz ai_termid.at_addr)));
31927c478bd9Sstevel@tonic-gate } else {
31937c478bd9Sstevel@tonic-gate au_uwrite(au_to_in_addr_ex(
3194745b2690Stz (int32_t *)STRUCT_FGETP(ainfo_addr,
3195745b2690Stz ai_termid.at_addr)));
31967c478bd9Sstevel@tonic-gate }
31977c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32((char)1, "as_success",
3198745b2690Stz (uint32_t)STRUCT_FGET(ainfo_addr, ai_mask.as_success)));
31997c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32((char)1, "as_failure",
3200745b2690Stz (uint32_t)STRUCT_FGET(ainfo_addr, ai_mask.as_failure)));
32017c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32((char)1, "asid",
3202745b2690Stz (uint32_t)STRUCT_FGET(ainfo_addr, ai_asid)));
32037c478bd9Sstevel@tonic-gate break;
3204f8994074SJan Friedel case AUE_AUDITON_SETAMASK:
3205f8994074SJan Friedel if (copyin((caddr_t)a2, &mask, sizeof (au_mask_t)))
3206f8994074SJan Friedel return;
3207f8994074SJan Friedel au_uwrite(au_to_arg32(
3208f8994074SJan Friedel 2, "setamask:as_success", (uint32_t)mask.as_success));
3209f8994074SJan Friedel au_uwrite(au_to_arg32(
3210f8994074SJan Friedel 2, "setamask:as_failure", (uint32_t)mask.as_failure));
3211f8994074SJan Friedel break;
32127c478bd9Sstevel@tonic-gate case AUE_AUDITON_SETKMASK:
32137c478bd9Sstevel@tonic-gate if (copyin((caddr_t)a2, &mask, sizeof (au_mask_t)))
32147c478bd9Sstevel@tonic-gate return;
32157c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(
3216745b2690Stz 2, "setkmask:as_success", (uint32_t)mask.as_success));
32177c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(
3218745b2690Stz 2, "setkmask:as_failure", (uint32_t)mask.as_failure));
32197c478bd9Sstevel@tonic-gate break;
32207c478bd9Sstevel@tonic-gate case AUE_AUDITON_SPOLICY:
32217c478bd9Sstevel@tonic-gate if (copyin((caddr_t)a2, &policy, sizeof (int)))
32227c478bd9Sstevel@tonic-gate return;
32237c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(3, "setpolicy", (uint32_t)policy));
32247c478bd9Sstevel@tonic-gate break;
32257c478bd9Sstevel@tonic-gate case AUE_AUDITON_SQCTRL: {
32267c478bd9Sstevel@tonic-gate STRUCT_DECL(au_qctrl, qctrl);
32277c478bd9Sstevel@tonic-gate model_t model;
32287c478bd9Sstevel@tonic-gate
32297c478bd9Sstevel@tonic-gate model = get_udatamodel();
32307c478bd9Sstevel@tonic-gate STRUCT_INIT(qctrl, model);
32317c478bd9Sstevel@tonic-gate if (copyin((caddr_t)a2, STRUCT_BUF(qctrl), STRUCT_SIZE(qctrl)))
32327c478bd9Sstevel@tonic-gate return;
32337c478bd9Sstevel@tonic-gate if (model == DATAMODEL_ILP32) {
32347c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(
3235745b2690Stz 3, "setqctrl:aq_hiwater",
3236745b2690Stz (uint32_t)STRUCT_FGET(qctrl, aq_hiwater)));
32377c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(
3238745b2690Stz 3, "setqctrl:aq_lowater",
3239745b2690Stz (uint32_t)STRUCT_FGET(qctrl, aq_lowater)));
32407c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(
3241745b2690Stz 3, "setqctrl:aq_bufsz",
3242745b2690Stz (uint32_t)STRUCT_FGET(qctrl, aq_bufsz)));
32437c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(
3244745b2690Stz 3, "setqctrl:aq_delay",
3245745b2690Stz (uint32_t)STRUCT_FGET(qctrl, aq_delay)));
32467c478bd9Sstevel@tonic-gate } else {
32477c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg64(
3248745b2690Stz 3, "setqctrl:aq_hiwater",
3249745b2690Stz (uint64_t)STRUCT_FGET(qctrl, aq_hiwater)));
32507c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg64(
3251745b2690Stz 3, "setqctrl:aq_lowater",
3252745b2690Stz (uint64_t)STRUCT_FGET(qctrl, aq_lowater)));
32537c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg64(
3254745b2690Stz 3, "setqctrl:aq_bufsz",
3255745b2690Stz (uint64_t)STRUCT_FGET(qctrl, aq_bufsz)));
32567c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg64(
3257745b2690Stz 3, "setqctrl:aq_delay",
3258745b2690Stz (uint64_t)STRUCT_FGET(qctrl, aq_delay)));
32597c478bd9Sstevel@tonic-gate }
32607c478bd9Sstevel@tonic-gate break;
32617c478bd9Sstevel@tonic-gate }
32627c478bd9Sstevel@tonic-gate case AUE_AUDITON_SETUMASK:
32637c478bd9Sstevel@tonic-gate STRUCT_INIT(ainfo, get_udatamodel());
32647c478bd9Sstevel@tonic-gate if (copyin((caddr_t)uap->a2, STRUCT_BUF(ainfo),
3265745b2690Stz STRUCT_SIZE(ainfo))) {
3266745b2690Stz return;
32677c478bd9Sstevel@tonic-gate }
32687c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(3, "setumask:as_success",
3269745b2690Stz (uint32_t)STRUCT_FGET(ainfo, ai_mask.as_success)));
32707c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(3, "setumask:as_failure",
3271745b2690Stz (uint32_t)STRUCT_FGET(ainfo, ai_mask.as_failure)));
32727c478bd9Sstevel@tonic-gate break;
32737c478bd9Sstevel@tonic-gate case AUE_AUDITON_SETSMASK:
32747c478bd9Sstevel@tonic-gate STRUCT_INIT(ainfo, get_udatamodel());
32757c478bd9Sstevel@tonic-gate if (copyin((caddr_t)uap->a2, STRUCT_BUF(ainfo),
3276745b2690Stz STRUCT_SIZE(ainfo))) {
3277745b2690Stz return;
32787c478bd9Sstevel@tonic-gate }
32797c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(3, "setsmask:as_success",
3280745b2690Stz (uint32_t)STRUCT_FGET(ainfo, ai_mask.as_success)));
32817c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(3, "setsmask:as_failure",
3282745b2690Stz (uint32_t)STRUCT_FGET(ainfo, ai_mask.as_failure)));
32837c478bd9Sstevel@tonic-gate break;
32847c478bd9Sstevel@tonic-gate case AUE_AUDITON_SETCOND:
32857c478bd9Sstevel@tonic-gate if (copyin((caddr_t)a2, &auditstate, sizeof (int)))
32867c478bd9Sstevel@tonic-gate return;
32877c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(3, "setcond", (uint32_t)auditstate));
32887c478bd9Sstevel@tonic-gate break;
32897c478bd9Sstevel@tonic-gate case AUE_AUDITON_SETCLASS:
32907c478bd9Sstevel@tonic-gate if (copyin((caddr_t)a2, &event, sizeof (au_evclass_map_t)))
32917c478bd9Sstevel@tonic-gate return;
32927c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(
3293745b2690Stz 2, "setclass:ec_event", (uint32_t)event.ec_number));
32947c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(
3295745b2690Stz 3, "setclass:ec_class", (uint32_t)event.ec_class));
32967c478bd9Sstevel@tonic-gate break;
3297241bfedfSAlex Wilson case AUE_AUDITON_SETPMASK:
3298241bfedfSAlex Wilson STRUCT_INIT(apinfo, get_udatamodel());
3299241bfedfSAlex Wilson if (copyin((caddr_t)uap->a2, STRUCT_BUF(apinfo),
3300241bfedfSAlex Wilson STRUCT_SIZE(apinfo))) {
3301241bfedfSAlex Wilson return;
3302241bfedfSAlex Wilson }
3303241bfedfSAlex Wilson au_uwrite(au_to_arg32(3, "setpmask:pid",
3304241bfedfSAlex Wilson (uint32_t)STRUCT_FGET(apinfo, ap_pid)));
3305241bfedfSAlex Wilson au_uwrite(au_to_arg32(3, "setpmask:as_success",
3306241bfedfSAlex Wilson (uint32_t)STRUCT_FGET(apinfo, ap_mask.as_success)));
3307241bfedfSAlex Wilson au_uwrite(au_to_arg32(3, "setpmask:as_failure",
3308241bfedfSAlex Wilson (uint32_t)STRUCT_FGET(apinfo, ap_mask.as_failure)));
3309241bfedfSAlex Wilson break;
3310241bfedfSAlex Wilson case AUE_AUDITON_SETKAUDIT:
3311241bfedfSAlex Wilson STRUCT_INIT(ainfo_addr, get_udatamodel());
3312241bfedfSAlex Wilson if (copyin((caddr_t)a1, STRUCT_BUF(ainfo_addr),
3313241bfedfSAlex Wilson STRUCT_SIZE(ainfo_addr))) {
3314241bfedfSAlex Wilson return;
3315241bfedfSAlex Wilson }
3316241bfedfSAlex Wilson au_uwrite(au_to_arg32((char)1, "auid",
3317241bfedfSAlex Wilson (uint32_t)STRUCT_FGET(ainfo_addr, ai_auid)));
3318241bfedfSAlex Wilson #ifdef _LP64
3319241bfedfSAlex Wilson au_uwrite(au_to_arg64((char)1, "port",
3320241bfedfSAlex Wilson (uint64_t)STRUCT_FGET(ainfo_addr, ai_termid.at_port)));
3321241bfedfSAlex Wilson #else
3322241bfedfSAlex Wilson au_uwrite(au_to_arg32((char)1, "port",
3323241bfedfSAlex Wilson (uint32_t)STRUCT_FGET(ainfo_addr, ai_termid.at_port)));
3324241bfedfSAlex Wilson #endif
3325241bfedfSAlex Wilson au_uwrite(au_to_arg32((char)1, "type",
3326241bfedfSAlex Wilson (uint32_t)STRUCT_FGET(ainfo_addr, ai_termid.at_type)));
3327241bfedfSAlex Wilson if ((uint32_t)STRUCT_FGET(ainfo_addr, ai_termid.at_type) ==
3328241bfedfSAlex Wilson AU_IPv4) {
3329241bfedfSAlex Wilson au_uwrite(au_to_in_addr(
3330241bfedfSAlex Wilson (struct in_addr *)STRUCT_FGETP(ainfo_addr,
3331241bfedfSAlex Wilson ai_termid.at_addr)));
3332241bfedfSAlex Wilson } else {
3333241bfedfSAlex Wilson au_uwrite(au_to_in_addr_ex(
3334241bfedfSAlex Wilson (int32_t *)STRUCT_FGETP(ainfo_addr,
3335241bfedfSAlex Wilson ai_termid.at_addr)));
3336241bfedfSAlex Wilson }
3337241bfedfSAlex Wilson au_uwrite(au_to_arg32((char)1, "as_success",
3338241bfedfSAlex Wilson (uint32_t)STRUCT_FGET(ainfo_addr, ai_mask.as_success)));
3339241bfedfSAlex Wilson au_uwrite(au_to_arg32((char)1, "as_failure",
3340241bfedfSAlex Wilson (uint32_t)STRUCT_FGET(ainfo_addr, ai_mask.as_failure)));
3341241bfedfSAlex Wilson au_uwrite(au_to_arg32((char)1, "asid",
3342241bfedfSAlex Wilson (uint32_t)STRUCT_FGET(ainfo_addr, ai_asid)));
3343241bfedfSAlex Wilson break;
33447c478bd9Sstevel@tonic-gate case AUE_GETAUID:
33457c478bd9Sstevel@tonic-gate case AUE_GETAUDIT:
33467c478bd9Sstevel@tonic-gate case AUE_GETAUDIT_ADDR:
33477c478bd9Sstevel@tonic-gate case AUE_AUDIT:
33487c478bd9Sstevel@tonic-gate case AUE_AUDITON_GPOLICY:
33497c478bd9Sstevel@tonic-gate case AUE_AUDITON_GQCTRL:
3350f8994074SJan Friedel case AUE_AUDITON_GETAMASK:
33517c478bd9Sstevel@tonic-gate case AUE_AUDITON_GETKMASK:
33527c478bd9Sstevel@tonic-gate case AUE_AUDITON_GETCWD:
33537c478bd9Sstevel@tonic-gate case AUE_AUDITON_GETCAR:
33547c478bd9Sstevel@tonic-gate case AUE_AUDITON_GETSTAT:
33557c478bd9Sstevel@tonic-gate case AUE_AUDITON_SETSTAT:
33567c478bd9Sstevel@tonic-gate case AUE_AUDITON_GETCOND:
33577c478bd9Sstevel@tonic-gate case AUE_AUDITON_GETCLASS:
3358241bfedfSAlex Wilson case AUE_AUDITON_GETPINFO:
3359241bfedfSAlex Wilson case AUE_AUDITON_GETKAUDIT:
3360241bfedfSAlex Wilson case AUE_AUDITON_OTHER:
33617c478bd9Sstevel@tonic-gate break;
33627c478bd9Sstevel@tonic-gate default:
33637c478bd9Sstevel@tonic-gate break;
33647c478bd9Sstevel@tonic-gate }
33657c478bd9Sstevel@tonic-gate
33667c478bd9Sstevel@tonic-gate } /* AUS_AUDITSYS */
33677c478bd9Sstevel@tonic-gate
33687c478bd9Sstevel@tonic-gate
33697c478bd9Sstevel@tonic-gate /* only audit privileged operations for systeminfo(2) system call */
33707c478bd9Sstevel@tonic-gate static au_event_t
aui_sysinfo(au_event_t e)33717c478bd9Sstevel@tonic-gate aui_sysinfo(au_event_t e)
33727c478bd9Sstevel@tonic-gate {
33737c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
33747c478bd9Sstevel@tonic-gate uint32_t command;
33757c478bd9Sstevel@tonic-gate
33767c478bd9Sstevel@tonic-gate struct a {
33777c478bd9Sstevel@tonic-gate long command;
33787c478bd9Sstevel@tonic-gate long buf; /* char * */
33797c478bd9Sstevel@tonic-gate long count;
33807c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
33817c478bd9Sstevel@tonic-gate
33827c478bd9Sstevel@tonic-gate command = (uint32_t)uap->command;
33837c478bd9Sstevel@tonic-gate
33847c478bd9Sstevel@tonic-gate switch (command) {
33857c478bd9Sstevel@tonic-gate case SI_SET_HOSTNAME:
33867c478bd9Sstevel@tonic-gate case SI_SET_SRPC_DOMAIN:
33877c478bd9Sstevel@tonic-gate e = (au_event_t)AUE_SYSINFO;
33887c478bd9Sstevel@tonic-gate break;
33897c478bd9Sstevel@tonic-gate default:
33907c478bd9Sstevel@tonic-gate e = (au_event_t)AUE_NULL;
33917c478bd9Sstevel@tonic-gate break;
33927c478bd9Sstevel@tonic-gate }
33937c478bd9Sstevel@tonic-gate return (e);
33947c478bd9Sstevel@tonic-gate }
33957c478bd9Sstevel@tonic-gate
33967c478bd9Sstevel@tonic-gate /*ARGSUSED*/
33977c478bd9Sstevel@tonic-gate static void
aus_sysinfo(struct t_audit_data * tad)33987c478bd9Sstevel@tonic-gate aus_sysinfo(struct t_audit_data *tad)
33997c478bd9Sstevel@tonic-gate {
34007c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
34017c478bd9Sstevel@tonic-gate uint32_t command;
34027c478bd9Sstevel@tonic-gate size_t len, maxlen;
34037c478bd9Sstevel@tonic-gate char *name;
34047c478bd9Sstevel@tonic-gate uintptr_t buf;
34057c478bd9Sstevel@tonic-gate
34067c478bd9Sstevel@tonic-gate struct a {
34077c478bd9Sstevel@tonic-gate long command;
34087c478bd9Sstevel@tonic-gate long buf; /* char * */
34097c478bd9Sstevel@tonic-gate long count;
34107c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
34117c478bd9Sstevel@tonic-gate
34127c478bd9Sstevel@tonic-gate command = (uint32_t)uap->command;
34137c478bd9Sstevel@tonic-gate buf = (uintptr_t)uap->buf;
34147c478bd9Sstevel@tonic-gate
34157c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "cmd", command));
34167c478bd9Sstevel@tonic-gate
34177c478bd9Sstevel@tonic-gate switch (command) {
34187c478bd9Sstevel@tonic-gate case SI_SET_HOSTNAME:
34197c478bd9Sstevel@tonic-gate {
34207c478bd9Sstevel@tonic-gate if (secpolicy_sys_config(CRED(), B_TRUE) != 0)
34217c478bd9Sstevel@tonic-gate return;
34227c478bd9Sstevel@tonic-gate
34237c478bd9Sstevel@tonic-gate maxlen = SYS_NMLN;
34247c478bd9Sstevel@tonic-gate name = kmem_alloc(maxlen, KM_SLEEP);
34257c478bd9Sstevel@tonic-gate if (copyinstr((caddr_t)buf, name, SYS_NMLN, &len))
34267c478bd9Sstevel@tonic-gate break;
34277c478bd9Sstevel@tonic-gate
34287c478bd9Sstevel@tonic-gate /*
34297c478bd9Sstevel@tonic-gate * Must be non-NULL string and string
34307c478bd9Sstevel@tonic-gate * must be less than SYS_NMLN chars.
34317c478bd9Sstevel@tonic-gate */
34327c478bd9Sstevel@tonic-gate if (len < 2 || (len == SYS_NMLN && name[SYS_NMLN - 1] != '\0'))
34337c478bd9Sstevel@tonic-gate break;
34347c478bd9Sstevel@tonic-gate
34357c478bd9Sstevel@tonic-gate au_uwrite(au_to_text(name));
34367c478bd9Sstevel@tonic-gate break;
34377c478bd9Sstevel@tonic-gate }
34387c478bd9Sstevel@tonic-gate
34397c478bd9Sstevel@tonic-gate case SI_SET_SRPC_DOMAIN:
34407c478bd9Sstevel@tonic-gate {
34417c478bd9Sstevel@tonic-gate if (secpolicy_sys_config(CRED(), B_TRUE) != 0)
34427c478bd9Sstevel@tonic-gate return;
34437c478bd9Sstevel@tonic-gate
34447c478bd9Sstevel@tonic-gate maxlen = SYS_NMLN;
34457c478bd9Sstevel@tonic-gate name = kmem_alloc(maxlen, KM_SLEEP);
34467c478bd9Sstevel@tonic-gate if (copyinstr((caddr_t)buf, name, SYS_NMLN, &len))
34477c478bd9Sstevel@tonic-gate break;
34487c478bd9Sstevel@tonic-gate
34497c478bd9Sstevel@tonic-gate /*
34507c478bd9Sstevel@tonic-gate * If string passed in is longer than length
34517c478bd9Sstevel@tonic-gate * allowed for domain name, fail.
34527c478bd9Sstevel@tonic-gate */
34537c478bd9Sstevel@tonic-gate if (len == SYS_NMLN && name[SYS_NMLN - 1] != '\0')
34547c478bd9Sstevel@tonic-gate break;
34557c478bd9Sstevel@tonic-gate
34567c478bd9Sstevel@tonic-gate au_uwrite(au_to_text(name));
34577c478bd9Sstevel@tonic-gate break;
34587c478bd9Sstevel@tonic-gate }
34597c478bd9Sstevel@tonic-gate
34607c478bd9Sstevel@tonic-gate default:
34617c478bd9Sstevel@tonic-gate return;
34627c478bd9Sstevel@tonic-gate }
34637c478bd9Sstevel@tonic-gate
34647c478bd9Sstevel@tonic-gate kmem_free(name, maxlen);
34657c478bd9Sstevel@tonic-gate }
34667c478bd9Sstevel@tonic-gate
34677c478bd9Sstevel@tonic-gate static au_event_t
aui_modctl(au_event_t e)34687c478bd9Sstevel@tonic-gate aui_modctl(au_event_t e)
34697c478bd9Sstevel@tonic-gate {
34707c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
34717c478bd9Sstevel@tonic-gate uint_t cmd;
34727c478bd9Sstevel@tonic-gate
34737c478bd9Sstevel@tonic-gate struct a {
34747c478bd9Sstevel@tonic-gate long cmd;
34757c478bd9Sstevel@tonic-gate } *uap = (struct a *)clwp->lwp_ap;
34767c478bd9Sstevel@tonic-gate
34777c478bd9Sstevel@tonic-gate cmd = (uint_t)uap->cmd;
34787c478bd9Sstevel@tonic-gate
34797c478bd9Sstevel@tonic-gate switch (cmd) {
34807c478bd9Sstevel@tonic-gate case MODLOAD:
34817c478bd9Sstevel@tonic-gate e = AUE_MODLOAD;
34827c478bd9Sstevel@tonic-gate break;
34837c478bd9Sstevel@tonic-gate case MODUNLOAD:
34847c478bd9Sstevel@tonic-gate e = AUE_MODUNLOAD;
34857c478bd9Sstevel@tonic-gate break;
34867c478bd9Sstevel@tonic-gate case MODADDMAJBIND:
34877c478bd9Sstevel@tonic-gate e = AUE_MODADDMAJ;
34887c478bd9Sstevel@tonic-gate break;
34897c478bd9Sstevel@tonic-gate case MODSETDEVPOLICY:
34907c478bd9Sstevel@tonic-gate e = AUE_MODDEVPLCY;
34917c478bd9Sstevel@tonic-gate break;
34927c478bd9Sstevel@tonic-gate case MODALLOCPRIV:
34937c478bd9Sstevel@tonic-gate e = AUE_MODADDPRIV;
34947c478bd9Sstevel@tonic-gate break;
34957c478bd9Sstevel@tonic-gate default:
34967c478bd9Sstevel@tonic-gate e = AUE_NULL;
34977c478bd9Sstevel@tonic-gate break;
34987c478bd9Sstevel@tonic-gate }
34997c478bd9Sstevel@tonic-gate return (e);
35007c478bd9Sstevel@tonic-gate }
35017c478bd9Sstevel@tonic-gate
35027c478bd9Sstevel@tonic-gate
35037c478bd9Sstevel@tonic-gate /*ARGSUSED*/
35047c478bd9Sstevel@tonic-gate static void
aus_modctl(struct t_audit_data * tad)35057c478bd9Sstevel@tonic-gate aus_modctl(struct t_audit_data *tad)
35067c478bd9Sstevel@tonic-gate {
35077c478bd9Sstevel@tonic-gate klwp_t *clwp = ttolwp(curthread);
35087c478bd9Sstevel@tonic-gate void *a = clwp->lwp_ap;
35097c478bd9Sstevel@tonic-gate uint_t use_path;
35107c478bd9Sstevel@tonic-gate
35117c478bd9Sstevel@tonic-gate switch (tad->tad_event) {
35127c478bd9Sstevel@tonic-gate case AUE_MODLOAD: {
35137c478bd9Sstevel@tonic-gate typedef struct {
35147c478bd9Sstevel@tonic-gate long cmd;
35157c478bd9Sstevel@tonic-gate long use_path;
35167c478bd9Sstevel@tonic-gate long filename; /* char * */
35177c478bd9Sstevel@tonic-gate } modloada_t;
35187c478bd9Sstevel@tonic-gate
35197c478bd9Sstevel@tonic-gate char *filenamep;
35207c478bd9Sstevel@tonic-gate uintptr_t fname;
35217c478bd9Sstevel@tonic-gate extern char *default_path;
35227c478bd9Sstevel@tonic-gate
35237c478bd9Sstevel@tonic-gate fname = (uintptr_t)((modloada_t *)a)->filename;
35247c478bd9Sstevel@tonic-gate use_path = (uint_t)((modloada_t *)a)->use_path;
35257c478bd9Sstevel@tonic-gate
35267c478bd9Sstevel@tonic-gate /* space to hold path */
35277c478bd9Sstevel@tonic-gate filenamep = kmem_alloc(MOD_MAXPATH, KM_SLEEP);
35287c478bd9Sstevel@tonic-gate /* get string */
35297c478bd9Sstevel@tonic-gate if (copyinstr((caddr_t)fname, filenamep, MOD_MAXPATH, 0)) {
35307c478bd9Sstevel@tonic-gate /* free allocated path */
35317c478bd9Sstevel@tonic-gate kmem_free(filenamep, MOD_MAXPATH);
35327c478bd9Sstevel@tonic-gate return;
35337c478bd9Sstevel@tonic-gate }
35347c478bd9Sstevel@tonic-gate /* ensure it's null terminated */
35357c478bd9Sstevel@tonic-gate filenamep[MOD_MAXPATH - 1] = 0;
35367c478bd9Sstevel@tonic-gate
35377c478bd9Sstevel@tonic-gate if (use_path)
35387c478bd9Sstevel@tonic-gate au_uwrite(au_to_text(default_path));
35397c478bd9Sstevel@tonic-gate au_uwrite(au_to_text(filenamep));
35407c478bd9Sstevel@tonic-gate
35417c478bd9Sstevel@tonic-gate /* release temporary memory */
35427c478bd9Sstevel@tonic-gate kmem_free(filenamep, MOD_MAXPATH);
35437c478bd9Sstevel@tonic-gate break;
35447c478bd9Sstevel@tonic-gate }
35457c478bd9Sstevel@tonic-gate case AUE_MODUNLOAD: {
35467c478bd9Sstevel@tonic-gate typedef struct {
35477c478bd9Sstevel@tonic-gate long cmd;
35487c478bd9Sstevel@tonic-gate long id;
35497c478bd9Sstevel@tonic-gate } modunloada_t;
35507c478bd9Sstevel@tonic-gate
35517c478bd9Sstevel@tonic-gate uint32_t id = (uint32_t)((modunloada_t *)a)->id;
35527c478bd9Sstevel@tonic-gate
35537c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "id", id));
35547c478bd9Sstevel@tonic-gate break;
35557c478bd9Sstevel@tonic-gate }
35567c478bd9Sstevel@tonic-gate case AUE_MODADDMAJ: {
35577c478bd9Sstevel@tonic-gate STRUCT_DECL(modconfig, mc);
35587c478bd9Sstevel@tonic-gate typedef struct {
35597c478bd9Sstevel@tonic-gate long cmd;
35607c478bd9Sstevel@tonic-gate long subcmd;
35617c478bd9Sstevel@tonic-gate long data; /* int * */
35627c478bd9Sstevel@tonic-gate } modconfiga_t;
35637c478bd9Sstevel@tonic-gate
35647c478bd9Sstevel@tonic-gate STRUCT_DECL(aliases, alias);
35657c478bd9Sstevel@tonic-gate caddr_t ap;
35667c478bd9Sstevel@tonic-gate int i, num_aliases;
35677c478bd9Sstevel@tonic-gate char *drvname, *mc_drvname;
35687c478bd9Sstevel@tonic-gate char *name;
35697c478bd9Sstevel@tonic-gate extern char *ddi_major_to_name(major_t);
35707c478bd9Sstevel@tonic-gate model_t model;
35717c478bd9Sstevel@tonic-gate
35727c478bd9Sstevel@tonic-gate uintptr_t data = (uintptr_t)((modconfiga_t *)a)->data;
35737c478bd9Sstevel@tonic-gate
35747c478bd9Sstevel@tonic-gate model = get_udatamodel();
35757c478bd9Sstevel@tonic-gate STRUCT_INIT(mc, model);
35767c478bd9Sstevel@tonic-gate /* sanitize buffer */
35777c478bd9Sstevel@tonic-gate bzero((caddr_t)STRUCT_BUF(mc), STRUCT_SIZE(mc));
35787c478bd9Sstevel@tonic-gate /* get user arguments */
35797c478bd9Sstevel@tonic-gate if (copyin((caddr_t)data, (caddr_t)STRUCT_BUF(mc),
3580745b2690Stz STRUCT_SIZE(mc)) != 0)
35817c478bd9Sstevel@tonic-gate return;
35827c478bd9Sstevel@tonic-gate
35837c478bd9Sstevel@tonic-gate mc_drvname = STRUCT_FGET(mc, drvname);
35847c478bd9Sstevel@tonic-gate if ((drvname = ddi_major_to_name(
3585745b2690Stz (major_t)STRUCT_FGET(mc, major))) != NULL &&
3586745b2690Stz strncmp(drvname, mc_drvname, MAXMODCONFNAME) != 0) {
35877c478bd9Sstevel@tonic-gate /* safety */
35887c478bd9Sstevel@tonic-gate if (mc_drvname[0] != '\0') {
35897c478bd9Sstevel@tonic-gate mc_drvname[MAXMODCONFNAME-1] = '\0';
35907c478bd9Sstevel@tonic-gate au_uwrite(au_to_text(mc_drvname));
35917c478bd9Sstevel@tonic-gate }
35927c478bd9Sstevel@tonic-gate /* drvname != NULL from test above */
35937c478bd9Sstevel@tonic-gate au_uwrite(au_to_text(drvname));
35947c478bd9Sstevel@tonic-gate return;
35957c478bd9Sstevel@tonic-gate }
35967c478bd9Sstevel@tonic-gate
35977c478bd9Sstevel@tonic-gate if (mc_drvname[0] != '\0') {
35987c478bd9Sstevel@tonic-gate /* safety */
35997c478bd9Sstevel@tonic-gate mc_drvname[MAXMODCONFNAME-1] = '\0';
36007c478bd9Sstevel@tonic-gate au_uwrite(au_to_text(mc_drvname));
36017c478bd9Sstevel@tonic-gate } else
36027c478bd9Sstevel@tonic-gate au_uwrite(au_to_text("no drvname"));
36037c478bd9Sstevel@tonic-gate
36047c478bd9Sstevel@tonic-gate num_aliases = STRUCT_FGET(mc, num_aliases);
36057c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(5, "", (uint32_t)num_aliases));
36067c478bd9Sstevel@tonic-gate ap = (caddr_t)STRUCT_FGETP(mc, ap);
36077c478bd9Sstevel@tonic-gate name = kmem_alloc(MAXMODCONFNAME, KM_SLEEP);
36087c478bd9Sstevel@tonic-gate STRUCT_INIT(alias, model);
36097c478bd9Sstevel@tonic-gate for (i = 0; i < num_aliases; i++) {
36107c478bd9Sstevel@tonic-gate bzero((caddr_t)STRUCT_BUF(alias),
3611745b2690Stz STRUCT_SIZE(alias));
36127c478bd9Sstevel@tonic-gate if (copyin((caddr_t)ap, (caddr_t)STRUCT_BUF(alias),
3613745b2690Stz STRUCT_SIZE(alias)) != 0)
36147c478bd9Sstevel@tonic-gate break;
36157c478bd9Sstevel@tonic-gate if (copyinstr(STRUCT_FGETP(alias, a_name), name,
36167c478bd9Sstevel@tonic-gate MAXMODCONFNAME, NULL) != 0) {
36177c478bd9Sstevel@tonic-gate break;
36187c478bd9Sstevel@tonic-gate }
36197c478bd9Sstevel@tonic-gate
36207c478bd9Sstevel@tonic-gate au_uwrite(au_to_text(name));
36217c478bd9Sstevel@tonic-gate ap = (caddr_t)STRUCT_FGETP(alias, a_next);
36227c478bd9Sstevel@tonic-gate }
36237c478bd9Sstevel@tonic-gate kmem_free(name, MAXMODCONFNAME);
36247c478bd9Sstevel@tonic-gate break;
36257c478bd9Sstevel@tonic-gate }
36267c478bd9Sstevel@tonic-gate default:
36277c478bd9Sstevel@tonic-gate break;
36287c478bd9Sstevel@tonic-gate }
36297c478bd9Sstevel@tonic-gate }
36307c478bd9Sstevel@tonic-gate
36317c478bd9Sstevel@tonic-gate
36327c478bd9Sstevel@tonic-gate /*ARGSUSED*/
36337c478bd9Sstevel@tonic-gate static void
auf_accept(struct t_audit_data * tad,int error,rval_t * rval)36347c478bd9Sstevel@tonic-gate auf_accept(
36357c478bd9Sstevel@tonic-gate struct t_audit_data *tad,
36367c478bd9Sstevel@tonic-gate int error,
36377c478bd9Sstevel@tonic-gate rval_t *rval)
36387c478bd9Sstevel@tonic-gate {
36397c478bd9Sstevel@tonic-gate uint32_t scid;
36407c478bd9Sstevel@tonic-gate uint32_t sy_flags;
36417c478bd9Sstevel@tonic-gate int fd;
36427c478bd9Sstevel@tonic-gate struct sonode *so;
36437c478bd9Sstevel@tonic-gate char so_laddr[sizeof (struct sockaddr_in6)];
36447c478bd9Sstevel@tonic-gate char so_faddr[sizeof (struct sockaddr_in6)];
36457c478bd9Sstevel@tonic-gate int err;
36467c478bd9Sstevel@tonic-gate short so_family, so_type;
36477c478bd9Sstevel@tonic-gate int add_sock_token = 0;
36487c478bd9Sstevel@tonic-gate
36497c478bd9Sstevel@tonic-gate /* need to determine type of executing binary */
36507c478bd9Sstevel@tonic-gate scid = tad->tad_scid;
36517c478bd9Sstevel@tonic-gate #ifdef _SYSCALL32_IMPL
36527c478bd9Sstevel@tonic-gate if (lwp_getdatamodel(ttolwp(curthread)) == DATAMODEL_NATIVE)
36537c478bd9Sstevel@tonic-gate sy_flags = sysent[scid].sy_flags & SE_RVAL_MASK;
36547c478bd9Sstevel@tonic-gate else
36557c478bd9Sstevel@tonic-gate sy_flags = sysent32[scid].sy_flags & SE_RVAL_MASK;
36567c478bd9Sstevel@tonic-gate #else
36577c478bd9Sstevel@tonic-gate sy_flags = sysent[scid].sy_flags & SE_RVAL_MASK;
36587c478bd9Sstevel@tonic-gate #endif
3659aeba2189SMarek Pospisil switch (sy_flags) {
3660aeba2189SMarek Pospisil case SE_32RVAL1:
3661aeba2189SMarek Pospisil /* FALLTHRU */
3662aeba2189SMarek Pospisil case SE_32RVAL2|SE_32RVAL1:
36637c478bd9Sstevel@tonic-gate fd = rval->r_val1;
3664aeba2189SMarek Pospisil break;
3665aeba2189SMarek Pospisil case SE_64RVAL:
36667c478bd9Sstevel@tonic-gate fd = (int)rval->r_vals;
3667aeba2189SMarek Pospisil break;
3668aeba2189SMarek Pospisil default:
3669aeba2189SMarek Pospisil /*
3670aeba2189SMarek Pospisil * should never happen, seems to be an internal error
3671aeba2189SMarek Pospisil * in sysent => no fd, nothing to audit here, returning
3672aeba2189SMarek Pospisil */
3673aeba2189SMarek Pospisil return;
3674aeba2189SMarek Pospisil }
36757c478bd9Sstevel@tonic-gate
36767c478bd9Sstevel@tonic-gate if (error) {
36777c478bd9Sstevel@tonic-gate /* can't trust socket contents. Just return */
36787c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
36797c478bd9Sstevel@tonic-gate return;
36807c478bd9Sstevel@tonic-gate }
36817c478bd9Sstevel@tonic-gate
3682745b2690Stz if ((so = getsonode(fd, &err, NULL)) == NULL) {
36837c478bd9Sstevel@tonic-gate /*
36847c478bd9Sstevel@tonic-gate * not security relevant if doing a accept from non socket
36857c478bd9Sstevel@tonic-gate * so no extra tokens. Should probably turn off audit record
36867c478bd9Sstevel@tonic-gate * generation here.
36877c478bd9Sstevel@tonic-gate */
36887c478bd9Sstevel@tonic-gate return;
36897c478bd9Sstevel@tonic-gate }
36907c478bd9Sstevel@tonic-gate
36917c478bd9Sstevel@tonic-gate so_family = so->so_family;
36927c478bd9Sstevel@tonic-gate so_type = so->so_type;
36937c478bd9Sstevel@tonic-gate
36947c478bd9Sstevel@tonic-gate switch (so_family) {
36957c478bd9Sstevel@tonic-gate case AF_INET:
36967c478bd9Sstevel@tonic-gate case AF_INET6:
36977c478bd9Sstevel@tonic-gate /*
36987c478bd9Sstevel@tonic-gate * XXX - what about other socket types for AF_INET (e.g. DGRAM)
36997c478bd9Sstevel@tonic-gate */
37007c478bd9Sstevel@tonic-gate if (so->so_type == SOCK_STREAM) {
37010f1702c5SYu Xiangning socklen_t len;
37027c478bd9Sstevel@tonic-gate
37037c478bd9Sstevel@tonic-gate bzero((void *)so_laddr, sizeof (so_laddr));
37047c478bd9Sstevel@tonic-gate bzero((void *)so_faddr, sizeof (so_faddr));
37057c478bd9Sstevel@tonic-gate
37060f1702c5SYu Xiangning len = sizeof (so_laddr);
37070f1702c5SYu Xiangning (void) socket_getsockname(so,
37080f1702c5SYu Xiangning (struct sockaddr *)so_laddr, &len, CRED());
37090f1702c5SYu Xiangning len = sizeof (so_faddr);
37100f1702c5SYu Xiangning (void) socket_getpeername(so,
37110f1702c5SYu Xiangning (struct sockaddr *)so_faddr, &len, B_FALSE, CRED());
37127c478bd9Sstevel@tonic-gate
37137c478bd9Sstevel@tonic-gate add_sock_token = 1;
37147c478bd9Sstevel@tonic-gate }
37157c478bd9Sstevel@tonic-gate break;
37167c478bd9Sstevel@tonic-gate
37177c478bd9Sstevel@tonic-gate default:
37187c478bd9Sstevel@tonic-gate /* AF_UNIX, AF_ROUTE, AF_KEY do not support accept */
37197c478bd9Sstevel@tonic-gate break;
37207c478bd9Sstevel@tonic-gate }
37217c478bd9Sstevel@tonic-gate
37227c478bd9Sstevel@tonic-gate releasef(fd);
37237c478bd9Sstevel@tonic-gate
37247c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
37257c478bd9Sstevel@tonic-gate
37267c478bd9Sstevel@tonic-gate if (add_sock_token == 0) {
37277c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(0, "family", (uint32_t)(so_family)));
37287c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(0, "type", (uint32_t)(so_type)));
37297c478bd9Sstevel@tonic-gate return;
37307c478bd9Sstevel@tonic-gate }
37317c478bd9Sstevel@tonic-gate
37327c478bd9Sstevel@tonic-gate au_uwrite(au_to_socket_ex(so_family, so_type, so_laddr, so_faddr));
37337c478bd9Sstevel@tonic-gate
37347c478bd9Sstevel@tonic-gate }
37357c478bd9Sstevel@tonic-gate
37367c478bd9Sstevel@tonic-gate /*ARGSUSED*/
37377c478bd9Sstevel@tonic-gate static void
auf_bind(struct t_audit_data * tad,int error,rval_t * rvp)37387c478bd9Sstevel@tonic-gate auf_bind(struct t_audit_data *tad, int error, rval_t *rvp)
37397c478bd9Sstevel@tonic-gate {
37407c478bd9Sstevel@tonic-gate struct a {
37417c478bd9Sstevel@tonic-gate long fd;
37427c478bd9Sstevel@tonic-gate long addr;
37437c478bd9Sstevel@tonic-gate long len;
37447c478bd9Sstevel@tonic-gate } *uap = (struct a *)ttolwp(curthread)->lwp_ap;
37457c478bd9Sstevel@tonic-gate
37467c478bd9Sstevel@tonic-gate struct sonode *so;
37477c478bd9Sstevel@tonic-gate char so_laddr[sizeof (struct sockaddr_in6)];
37487c478bd9Sstevel@tonic-gate char so_faddr[sizeof (struct sockaddr_in6)];
37497c478bd9Sstevel@tonic-gate int err, fd;
37500f1702c5SYu Xiangning socklen_t len;
37517c478bd9Sstevel@tonic-gate short so_family, so_type;
37527c478bd9Sstevel@tonic-gate int add_sock_token = 0;
37537c478bd9Sstevel@tonic-gate
37547c478bd9Sstevel@tonic-gate fd = (int)uap->fd;
37557c478bd9Sstevel@tonic-gate
37567c478bd9Sstevel@tonic-gate /*
37577c478bd9Sstevel@tonic-gate * bind failed, then nothing extra to add to audit record.
37587c478bd9Sstevel@tonic-gate */
37597c478bd9Sstevel@tonic-gate if (error) {
37607c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
37617c478bd9Sstevel@tonic-gate /* XXX may want to add failed address some day */
37627c478bd9Sstevel@tonic-gate return;
37637c478bd9Sstevel@tonic-gate }
37647c478bd9Sstevel@tonic-gate
3765745b2690Stz if ((so = getsonode(fd, &err, NULL)) == NULL) {
37667c478bd9Sstevel@tonic-gate /*
37677c478bd9Sstevel@tonic-gate * not security relevant if doing a bind from non socket
37687c478bd9Sstevel@tonic-gate * so no extra tokens. Should probably turn off audit record
37697c478bd9Sstevel@tonic-gate * generation here.
37707c478bd9Sstevel@tonic-gate */
37717c478bd9Sstevel@tonic-gate return;
37727c478bd9Sstevel@tonic-gate }
37737c478bd9Sstevel@tonic-gate
37747c478bd9Sstevel@tonic-gate so_family = so->so_family;
37757c478bd9Sstevel@tonic-gate so_type = so->so_type;
37767c478bd9Sstevel@tonic-gate
37777c478bd9Sstevel@tonic-gate switch (so_family) {
37787c478bd9Sstevel@tonic-gate case AF_INET:
37797c478bd9Sstevel@tonic-gate case AF_INET6:
37807c478bd9Sstevel@tonic-gate
37817c478bd9Sstevel@tonic-gate bzero(so_faddr, sizeof (so_faddr));
37820f1702c5SYu Xiangning len = sizeof (so_faddr);
37837c478bd9Sstevel@tonic-gate
37840f1702c5SYu Xiangning (void) socket_getpeername(so,
37850f1702c5SYu Xiangning (struct sockaddr *)so_faddr, &len, B_FALSE, CRED());
37867c478bd9Sstevel@tonic-gate add_sock_token = 1;
37877c478bd9Sstevel@tonic-gate
37887c478bd9Sstevel@tonic-gate break;
37897c478bd9Sstevel@tonic-gate
37907c478bd9Sstevel@tonic-gate case AF_UNIX:
37917c478bd9Sstevel@tonic-gate /* token added by lookup */
37927c478bd9Sstevel@tonic-gate break;
37937c478bd9Sstevel@tonic-gate default:
37947c478bd9Sstevel@tonic-gate /* AF_ROUTE, AF_KEY do not support accept */
37957c478bd9Sstevel@tonic-gate break;
37967c478bd9Sstevel@tonic-gate }
37977c478bd9Sstevel@tonic-gate
37987c478bd9Sstevel@tonic-gate releasef(fd);
37997c478bd9Sstevel@tonic-gate
38007c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
38017c478bd9Sstevel@tonic-gate
38027c478bd9Sstevel@tonic-gate if (add_sock_token == 0) {
38037c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "family", (uint32_t)(so_family)));
38047c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "type", (uint32_t)(so_type)));
38057c478bd9Sstevel@tonic-gate return;
38067c478bd9Sstevel@tonic-gate }
38077c478bd9Sstevel@tonic-gate
38087c478bd9Sstevel@tonic-gate au_uwrite(au_to_socket_ex(so_family, so_type, so_laddr, so_faddr));
38097c478bd9Sstevel@tonic-gate
38107c478bd9Sstevel@tonic-gate }
38117c478bd9Sstevel@tonic-gate
38127c478bd9Sstevel@tonic-gate /*ARGSUSED*/
38137c478bd9Sstevel@tonic-gate static void
auf_connect(struct t_audit_data * tad,int error,rval_t * rval)38147c478bd9Sstevel@tonic-gate auf_connect(struct t_audit_data *tad, int error, rval_t *rval)
38157c478bd9Sstevel@tonic-gate {
38167c478bd9Sstevel@tonic-gate struct a {
38177c478bd9Sstevel@tonic-gate long fd;
38187c478bd9Sstevel@tonic-gate long addr;
38197c478bd9Sstevel@tonic-gate long len;
38207c478bd9Sstevel@tonic-gate } *uap = (struct a *)ttolwp(curthread)->lwp_ap;
38217c478bd9Sstevel@tonic-gate
38227c478bd9Sstevel@tonic-gate struct sonode *so;
38237c478bd9Sstevel@tonic-gate char so_laddr[sizeof (struct sockaddr_in6)];
38247c478bd9Sstevel@tonic-gate char so_faddr[sizeof (struct sockaddr_in6)];
38257c478bd9Sstevel@tonic-gate int err, fd;
38260f1702c5SYu Xiangning socklen_t len;
38277c478bd9Sstevel@tonic-gate short so_family, so_type;
38287c478bd9Sstevel@tonic-gate int add_sock_token = 0;
38297c478bd9Sstevel@tonic-gate
38307c478bd9Sstevel@tonic-gate fd = (int)uap->fd;
38317c478bd9Sstevel@tonic-gate
38327c478bd9Sstevel@tonic-gate
3833745b2690Stz if ((so = getsonode(fd, &err, NULL)) == NULL) {
38347c478bd9Sstevel@tonic-gate /*
38357c478bd9Sstevel@tonic-gate * not security relevant if doing a connect from non socket
38367c478bd9Sstevel@tonic-gate * so no extra tokens. Should probably turn off audit record
38377c478bd9Sstevel@tonic-gate * generation here.
38387c478bd9Sstevel@tonic-gate */
38397c478bd9Sstevel@tonic-gate return;
38407c478bd9Sstevel@tonic-gate }
38417c478bd9Sstevel@tonic-gate
38427c478bd9Sstevel@tonic-gate so_family = so->so_family;
38437c478bd9Sstevel@tonic-gate so_type = so->so_type;
38447c478bd9Sstevel@tonic-gate
38457c478bd9Sstevel@tonic-gate switch (so_family) {
38467c478bd9Sstevel@tonic-gate case AF_INET:
38477c478bd9Sstevel@tonic-gate case AF_INET6:
38487c478bd9Sstevel@tonic-gate
38497c478bd9Sstevel@tonic-gate bzero(so_laddr, sizeof (so_laddr));
38507c478bd9Sstevel@tonic-gate bzero(so_faddr, sizeof (so_faddr));
38517c478bd9Sstevel@tonic-gate
38520f1702c5SYu Xiangning len = sizeof (so_laddr);
38530f1702c5SYu Xiangning (void) socket_getsockname(so, (struct sockaddr *)so_laddr,
38540f1702c5SYu Xiangning &len, CRED());
38557c478bd9Sstevel@tonic-gate if (error) {
38560f48f68dSToomas Soome if (uap->addr == 0)
38577c478bd9Sstevel@tonic-gate break;
38587c478bd9Sstevel@tonic-gate if (uap->len <= 0)
38597c478bd9Sstevel@tonic-gate break;
38607c478bd9Sstevel@tonic-gate len = min(uap->len, sizeof (so_faddr));
38617c478bd9Sstevel@tonic-gate if (copyin((caddr_t)(uap->addr), so_faddr, len) != 0)
38627c478bd9Sstevel@tonic-gate break;
38637c478bd9Sstevel@tonic-gate #ifdef NOTYET
38647c478bd9Sstevel@tonic-gate au_uwrite(au_to_data(AUP_HEX, AUR_CHAR, len, so_faddr));
38657c478bd9Sstevel@tonic-gate #endif
38667c478bd9Sstevel@tonic-gate } else {
38677c478bd9Sstevel@tonic-gate /* sanity check on length */
38680f1702c5SYu Xiangning len = sizeof (so_faddr);
38690f1702c5SYu Xiangning (void) socket_getpeername(so,
38700f1702c5SYu Xiangning (struct sockaddr *)so_faddr, &len, B_FALSE, CRED());
38717c478bd9Sstevel@tonic-gate }
38727c478bd9Sstevel@tonic-gate
38737c478bd9Sstevel@tonic-gate add_sock_token = 1;
38747c478bd9Sstevel@tonic-gate
38757c478bd9Sstevel@tonic-gate break;
38767c478bd9Sstevel@tonic-gate
38777c478bd9Sstevel@tonic-gate case AF_UNIX:
38787c478bd9Sstevel@tonic-gate /* does a lookup on name */
38797c478bd9Sstevel@tonic-gate break;
38807c478bd9Sstevel@tonic-gate
38817c478bd9Sstevel@tonic-gate default:
38827c478bd9Sstevel@tonic-gate /* AF_ROUTE, AF_KEY do not support accept */
38837c478bd9Sstevel@tonic-gate break;
38847c478bd9Sstevel@tonic-gate }
38857c478bd9Sstevel@tonic-gate
38867c478bd9Sstevel@tonic-gate releasef(fd);
38877c478bd9Sstevel@tonic-gate
38887c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
38897c478bd9Sstevel@tonic-gate
38907c478bd9Sstevel@tonic-gate if (add_sock_token == 0) {
38917c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "family", (uint32_t)(so_family)));
38927c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "type", (uint32_t)(so_type)));
38937c478bd9Sstevel@tonic-gate return;
38947c478bd9Sstevel@tonic-gate }
38957c478bd9Sstevel@tonic-gate
38967c478bd9Sstevel@tonic-gate au_uwrite(au_to_socket_ex(so_family, so_type, so_laddr, so_faddr));
38977c478bd9Sstevel@tonic-gate
38987c478bd9Sstevel@tonic-gate }
38997c478bd9Sstevel@tonic-gate
39007c478bd9Sstevel@tonic-gate /*ARGSUSED*/
39017c478bd9Sstevel@tonic-gate static void
aus_shutdown(struct t_audit_data * tad)39027c478bd9Sstevel@tonic-gate aus_shutdown(struct t_audit_data *tad)
39037c478bd9Sstevel@tonic-gate {
39047c478bd9Sstevel@tonic-gate struct a {
39057c478bd9Sstevel@tonic-gate long fd;
39067c478bd9Sstevel@tonic-gate long how;
39077c478bd9Sstevel@tonic-gate } *uap = (struct a *)ttolwp(curthread)->lwp_ap;
39087c478bd9Sstevel@tonic-gate
39097c478bd9Sstevel@tonic-gate struct sonode *so;
39107c478bd9Sstevel@tonic-gate char so_laddr[sizeof (struct sockaddr_in6)];
39117c478bd9Sstevel@tonic-gate char so_faddr[sizeof (struct sockaddr_in6)];
39127c478bd9Sstevel@tonic-gate int err, fd;
39130f1702c5SYu Xiangning socklen_t len;
39147c478bd9Sstevel@tonic-gate short so_family, so_type;
39157c478bd9Sstevel@tonic-gate int add_sock_token = 0;
39167c478bd9Sstevel@tonic-gate file_t *fp; /* unix domain sockets */
39177c478bd9Sstevel@tonic-gate struct f_audit_data *fad; /* unix domain sockets */
39187c478bd9Sstevel@tonic-gate
39197c478bd9Sstevel@tonic-gate fd = (int)uap->fd;
39207c478bd9Sstevel@tonic-gate
3921745b2690Stz if ((so = getsonode(fd, &err, &fp)) == NULL) {
39227c478bd9Sstevel@tonic-gate /*
39237c478bd9Sstevel@tonic-gate * not security relevant if doing a shutdown using non socket
39247c478bd9Sstevel@tonic-gate * so no extra tokens. Should probably turn off audit record
39257c478bd9Sstevel@tonic-gate * generation here.
39267c478bd9Sstevel@tonic-gate */
39277c478bd9Sstevel@tonic-gate return;
39287c478bd9Sstevel@tonic-gate }
39297c478bd9Sstevel@tonic-gate
39307c478bd9Sstevel@tonic-gate so_family = so->so_family;
39317c478bd9Sstevel@tonic-gate so_type = so->so_type;
39327c478bd9Sstevel@tonic-gate
39337c478bd9Sstevel@tonic-gate switch (so_family) {
39347c478bd9Sstevel@tonic-gate case AF_INET:
39357c478bd9Sstevel@tonic-gate case AF_INET6:
39367c478bd9Sstevel@tonic-gate
39377c478bd9Sstevel@tonic-gate bzero(so_laddr, sizeof (so_laddr));
39387c478bd9Sstevel@tonic-gate bzero(so_faddr, sizeof (so_faddr));
39397c478bd9Sstevel@tonic-gate
39400f1702c5SYu Xiangning len = sizeof (so_laddr);
39410f1702c5SYu Xiangning (void) socket_getsockname(so,
39420f1702c5SYu Xiangning (struct sockaddr *)so_laddr, &len, CRED());
39430f1702c5SYu Xiangning len = sizeof (so_faddr);
39440f1702c5SYu Xiangning (void) socket_getpeername(so,
39450f1702c5SYu Xiangning (struct sockaddr *)so_faddr, &len, B_FALSE, CRED());
39467c478bd9Sstevel@tonic-gate
39477c478bd9Sstevel@tonic-gate add_sock_token = 1;
39487c478bd9Sstevel@tonic-gate
39497c478bd9Sstevel@tonic-gate break;
39507c478bd9Sstevel@tonic-gate
39517c478bd9Sstevel@tonic-gate case AF_UNIX:
39527c478bd9Sstevel@tonic-gate
39537c478bd9Sstevel@tonic-gate /* get path from file struct here */
39547c478bd9Sstevel@tonic-gate fad = F2A(fp);
39557c478bd9Sstevel@tonic-gate ASSERT(fad);
39567c478bd9Sstevel@tonic-gate
39577c478bd9Sstevel@tonic-gate if (fad->fad_aupath != NULL) {
39587c478bd9Sstevel@tonic-gate au_uwrite(au_to_path(fad->fad_aupath));
39597c478bd9Sstevel@tonic-gate } else {
39607c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "no path: fd", fd));
39617c478bd9Sstevel@tonic-gate }
39627c478bd9Sstevel@tonic-gate
39637c478bd9Sstevel@tonic-gate audit_attributes(fp->f_vnode);
39647c478bd9Sstevel@tonic-gate
39657c478bd9Sstevel@tonic-gate break;
39667c478bd9Sstevel@tonic-gate
39677c478bd9Sstevel@tonic-gate default:
39687c478bd9Sstevel@tonic-gate /*
39697c478bd9Sstevel@tonic-gate * AF_KEY and AF_ROUTE support shutdown. No socket token
39707c478bd9Sstevel@tonic-gate * added.
39717c478bd9Sstevel@tonic-gate */
39727c478bd9Sstevel@tonic-gate break;
39737c478bd9Sstevel@tonic-gate }
39747c478bd9Sstevel@tonic-gate
39757c478bd9Sstevel@tonic-gate releasef(fd);
39767c478bd9Sstevel@tonic-gate
39777c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
39787c478bd9Sstevel@tonic-gate
39797c478bd9Sstevel@tonic-gate if (add_sock_token == 0) {
39807c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "family", (uint32_t)(so_family)));
39817c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "type", (uint32_t)(so_type)));
39827c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(2, "how", (uint32_t)(uap->how)));
39837c478bd9Sstevel@tonic-gate return;
39847c478bd9Sstevel@tonic-gate }
39857c478bd9Sstevel@tonic-gate
39867c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(2, "how", (uint32_t)(uap->how)));
39877c478bd9Sstevel@tonic-gate
39887c478bd9Sstevel@tonic-gate au_uwrite(au_to_socket_ex(so_family, so_type, so_laddr, so_faddr));
39897c478bd9Sstevel@tonic-gate
39907c478bd9Sstevel@tonic-gate }
39917c478bd9Sstevel@tonic-gate
39927c478bd9Sstevel@tonic-gate /*ARGSUSED*/
39937c478bd9Sstevel@tonic-gate static void
auf_setsockopt(struct t_audit_data * tad,int error,rval_t * rval)39947c478bd9Sstevel@tonic-gate auf_setsockopt(struct t_audit_data *tad, int error, rval_t *rval)
39957c478bd9Sstevel@tonic-gate {
39967c478bd9Sstevel@tonic-gate struct a {
39977c478bd9Sstevel@tonic-gate long fd;
39987c478bd9Sstevel@tonic-gate long level;
39997c478bd9Sstevel@tonic-gate long optname;
40007c478bd9Sstevel@tonic-gate long *optval;
40017c478bd9Sstevel@tonic-gate long optlen;
40027c478bd9Sstevel@tonic-gate } *uap = (struct a *)ttolwp(curthread)->lwp_ap;
40037c478bd9Sstevel@tonic-gate
40047c478bd9Sstevel@tonic-gate struct sonode *so;
40057c478bd9Sstevel@tonic-gate char so_laddr[sizeof (struct sockaddr_in6)];
40067c478bd9Sstevel@tonic-gate char so_faddr[sizeof (struct sockaddr_in6)];
40077c478bd9Sstevel@tonic-gate char val[AU_BUFSIZE];
40087c478bd9Sstevel@tonic-gate int err, fd;
40090f1702c5SYu Xiangning socklen_t len;
40107c478bd9Sstevel@tonic-gate short so_family, so_type;
40117c478bd9Sstevel@tonic-gate int add_sock_token = 0;
40127c478bd9Sstevel@tonic-gate file_t *fp; /* unix domain sockets */
40137c478bd9Sstevel@tonic-gate struct f_audit_data *fad; /* unix domain sockets */
40147c478bd9Sstevel@tonic-gate
40157c478bd9Sstevel@tonic-gate fd = (int)uap->fd;
40167c478bd9Sstevel@tonic-gate
40177c478bd9Sstevel@tonic-gate if (error) {
40187c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
40197c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(2, "level", (uint32_t)uap->level));
40207c478bd9Sstevel@tonic-gate /* XXX may want to include other arguments */
40217c478bd9Sstevel@tonic-gate return;
40227c478bd9Sstevel@tonic-gate }
40237c478bd9Sstevel@tonic-gate
4024745b2690Stz if ((so = getsonode(fd, &err, &fp)) == NULL) {
40257c478bd9Sstevel@tonic-gate /*
40267c478bd9Sstevel@tonic-gate * not security relevant if doing a setsockopt from non socket
40277c478bd9Sstevel@tonic-gate * so no extra tokens. Should probably turn off audit record
40287c478bd9Sstevel@tonic-gate * generation here.
40297c478bd9Sstevel@tonic-gate */
40307c478bd9Sstevel@tonic-gate return;
40317c478bd9Sstevel@tonic-gate }
40327c478bd9Sstevel@tonic-gate
40337c478bd9Sstevel@tonic-gate so_family = so->so_family;
40347c478bd9Sstevel@tonic-gate so_type = so->so_type;
40357c478bd9Sstevel@tonic-gate
40367c478bd9Sstevel@tonic-gate switch (so_family) {
40377c478bd9Sstevel@tonic-gate case AF_INET:
40387c478bd9Sstevel@tonic-gate case AF_INET6:
40397c478bd9Sstevel@tonic-gate bzero((void *)so_laddr, sizeof (so_laddr));
40407c478bd9Sstevel@tonic-gate bzero((void *)so_faddr, sizeof (so_faddr));
40417c478bd9Sstevel@tonic-gate
40427c478bd9Sstevel@tonic-gate /* get local and foreign addresses */
40430f1702c5SYu Xiangning len = sizeof (so_laddr);
40440f1702c5SYu Xiangning (void) socket_getsockname(so, (struct sockaddr *)so_laddr,
40450f1702c5SYu Xiangning &len, CRED());
40460f1702c5SYu Xiangning len = sizeof (so_faddr);
40470f1702c5SYu Xiangning (void) socket_getpeername(so, (struct sockaddr *)so_faddr,
40480f1702c5SYu Xiangning &len, B_FALSE, CRED());
40497c478bd9Sstevel@tonic-gate
40507c478bd9Sstevel@tonic-gate add_sock_token = 1;
40517c478bd9Sstevel@tonic-gate
40527c478bd9Sstevel@tonic-gate break;
40537c478bd9Sstevel@tonic-gate
40547c478bd9Sstevel@tonic-gate case AF_UNIX:
40557c478bd9Sstevel@tonic-gate
40567c478bd9Sstevel@tonic-gate /* get path from file struct here */
40577c478bd9Sstevel@tonic-gate fad = F2A(fp);
40587c478bd9Sstevel@tonic-gate ASSERT(fad);
40597c478bd9Sstevel@tonic-gate
40607c478bd9Sstevel@tonic-gate if (fad->fad_aupath != NULL) {
40617c478bd9Sstevel@tonic-gate au_uwrite(au_to_path(fad->fad_aupath));
40627c478bd9Sstevel@tonic-gate } else {
40637c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "no path: fd", fd));
40647c478bd9Sstevel@tonic-gate }
40657c478bd9Sstevel@tonic-gate
40667c478bd9Sstevel@tonic-gate audit_attributes(fp->f_vnode);
40677c478bd9Sstevel@tonic-gate
40687c478bd9Sstevel@tonic-gate break;
40697c478bd9Sstevel@tonic-gate
40707c478bd9Sstevel@tonic-gate default:
40717c478bd9Sstevel@tonic-gate /*
40727c478bd9Sstevel@tonic-gate * AF_KEY and AF_ROUTE support setsockopt. No socket token
40737c478bd9Sstevel@tonic-gate * added.
40747c478bd9Sstevel@tonic-gate */
40757c478bd9Sstevel@tonic-gate break;
40767c478bd9Sstevel@tonic-gate }
40777c478bd9Sstevel@tonic-gate
40787c478bd9Sstevel@tonic-gate releasef(fd);
40797c478bd9Sstevel@tonic-gate
40807c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
40817c478bd9Sstevel@tonic-gate
40827c478bd9Sstevel@tonic-gate if (add_sock_token == 0) {
40837c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "family", (uint32_t)(so_family)));
40847c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "type", (uint32_t)(so_type)));
40857c478bd9Sstevel@tonic-gate }
40867c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(2, "level", (uint32_t)(uap->level)));
40877c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(3, "optname", (uint32_t)(uap->optname)));
40887c478bd9Sstevel@tonic-gate
40897c478bd9Sstevel@tonic-gate bzero(val, sizeof (val));
40907c478bd9Sstevel@tonic-gate len = min(uap->optlen, sizeof (val));
40917c478bd9Sstevel@tonic-gate if ((len > 0) &&
40927c478bd9Sstevel@tonic-gate (copyin((caddr_t)(uap->optval), (caddr_t)val, len) == 0)) {
40937c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(5, "optlen", (uint32_t)(uap->optlen)));
40947c478bd9Sstevel@tonic-gate au_uwrite(au_to_data(AUP_HEX, AUR_BYTE, len, val));
40957c478bd9Sstevel@tonic-gate }
40967c478bd9Sstevel@tonic-gate
40977c478bd9Sstevel@tonic-gate if (add_sock_token == 0)
40987c478bd9Sstevel@tonic-gate return;
40997c478bd9Sstevel@tonic-gate
41007c478bd9Sstevel@tonic-gate au_uwrite(au_to_socket_ex(so_family, so_type, so_laddr, so_faddr));
41017c478bd9Sstevel@tonic-gate
41027c478bd9Sstevel@tonic-gate }
41037c478bd9Sstevel@tonic-gate
41047c478bd9Sstevel@tonic-gate /*ARGSUSED*/
41057c478bd9Sstevel@tonic-gate static void
aus_sockconfig(struct t_audit_data * tad)41060f48f68dSToomas Soome aus_sockconfig(struct t_audit_data *tad)
41077c478bd9Sstevel@tonic-gate {
41087c478bd9Sstevel@tonic-gate struct a {
41093e95bd4aSAnders Persson long cmd;
41103e95bd4aSAnders Persson long arg1;
41113e95bd4aSAnders Persson long arg2;
41123e95bd4aSAnders Persson long arg3;
41133e95bd4aSAnders Persson long arg4;
41147c478bd9Sstevel@tonic-gate } *uap = (struct a *)ttolwp(curthread)->lwp_ap;
41157c478bd9Sstevel@tonic-gate
41163e95bd4aSAnders Persson char *buf;
41173e95bd4aSAnders Persson int buflen;
41187c478bd9Sstevel@tonic-gate size_t size;
41197c478bd9Sstevel@tonic-gate
41203e95bd4aSAnders Persson au_uwrite(au_to_arg32(1, "cmd", (uint_t)uap->cmd));
41213e95bd4aSAnders Persson switch (uap->cmd) {
41223e95bd4aSAnders Persson case SOCKCONFIG_ADD_SOCK:
41233e95bd4aSAnders Persson case SOCKCONFIG_REMOVE_SOCK:
41243e95bd4aSAnders Persson au_uwrite(au_to_arg32(2, "domain", (uint32_t)uap->arg1));
41253e95bd4aSAnders Persson au_uwrite(au_to_arg32(3, "type", (uint32_t)uap->arg2));
41263e95bd4aSAnders Persson au_uwrite(au_to_arg32(4, "protocol", (uint32_t)uap->arg3));
41277c478bd9Sstevel@tonic-gate
41283e95bd4aSAnders Persson if (uap->arg4 == 0) {
41293e95bd4aSAnders Persson au_uwrite(au_to_arg32(5, "devpath", (uint32_t)0));
41303e95bd4aSAnders Persson } else {
41313e95bd4aSAnders Persson buflen = MAXPATHLEN + 1;
41323e95bd4aSAnders Persson buf = kmem_alloc(buflen, KM_SLEEP);
41333e95bd4aSAnders Persson if (copyinstr((caddr_t)uap->arg4, buf, buflen,
41343e95bd4aSAnders Persson &size)) {
41353e95bd4aSAnders Persson kmem_free(buf, buflen);
41363e95bd4aSAnders Persson return;
41373e95bd4aSAnders Persson }
41387c478bd9Sstevel@tonic-gate
41393e95bd4aSAnders Persson if (size > MAXPATHLEN) {
41403e95bd4aSAnders Persson kmem_free(buf, buflen);
41413e95bd4aSAnders Persson return;
41423e95bd4aSAnders Persson }
41433e95bd4aSAnders Persson
41443e95bd4aSAnders Persson au_uwrite(au_to_text(buf));
41453e95bd4aSAnders Persson kmem_free(buf, buflen);
41467c478bd9Sstevel@tonic-gate }
41473e95bd4aSAnders Persson break;
41483e95bd4aSAnders Persson case SOCKCONFIG_ADD_FILTER:
41493e95bd4aSAnders Persson case SOCKCONFIG_REMOVE_FILTER:
41503e95bd4aSAnders Persson buflen = FILNAME_MAX;
41513e95bd4aSAnders Persson buf = kmem_alloc(buflen, KM_SLEEP);
41527c478bd9Sstevel@tonic-gate
41533e95bd4aSAnders Persson if (copyinstr((caddr_t)uap->arg1, buf, buflen, &size)) {
41543e95bd4aSAnders Persson kmem_free(buf, buflen);
41557c478bd9Sstevel@tonic-gate return;
41567c478bd9Sstevel@tonic-gate }
41577c478bd9Sstevel@tonic-gate
41583e95bd4aSAnders Persson au_uwrite(au_to_text(buf));
41593e95bd4aSAnders Persson kmem_free(buf, buflen);
41603e95bd4aSAnders Persson break;
41613e95bd4aSAnders Persson default:
41623e95bd4aSAnders Persson break;
41637c478bd9Sstevel@tonic-gate }
41647c478bd9Sstevel@tonic-gate }
41657c478bd9Sstevel@tonic-gate
41667c478bd9Sstevel@tonic-gate /*
41677c478bd9Sstevel@tonic-gate * only audit recvmsg when the system call represents the creation of a new
41687c478bd9Sstevel@tonic-gate * circuit. This effectively occurs for all UDP packets and may occur for
41697c478bd9Sstevel@tonic-gate * special TCP situations where the local host has not set a local address
41707c478bd9Sstevel@tonic-gate * in the socket structure.
41717c478bd9Sstevel@tonic-gate */
41727c478bd9Sstevel@tonic-gate /*ARGSUSED*/
41737c478bd9Sstevel@tonic-gate static void
auf_recvmsg(struct t_audit_data * tad,int error,rval_t * rvp)41747c478bd9Sstevel@tonic-gate auf_recvmsg(
41757c478bd9Sstevel@tonic-gate struct t_audit_data *tad,
41767c478bd9Sstevel@tonic-gate int error,
41777c478bd9Sstevel@tonic-gate rval_t *rvp)
41787c478bd9Sstevel@tonic-gate {
41797c478bd9Sstevel@tonic-gate struct a {
41807c478bd9Sstevel@tonic-gate long fd;
41817c478bd9Sstevel@tonic-gate long msg; /* struct msghdr */
41827c478bd9Sstevel@tonic-gate long flags;
41837c478bd9Sstevel@tonic-gate } *uap = (struct a *)ttolwp(curthread)->lwp_ap;
41847c478bd9Sstevel@tonic-gate
41857c478bd9Sstevel@tonic-gate struct sonode *so;
41867c478bd9Sstevel@tonic-gate STRUCT_DECL(msghdr, msg);
41877c478bd9Sstevel@tonic-gate caddr_t msg_name;
41887c478bd9Sstevel@tonic-gate socklen_t msg_namelen;
41897c478bd9Sstevel@tonic-gate int fd;
41907c478bd9Sstevel@tonic-gate int err;
41917c478bd9Sstevel@tonic-gate char so_laddr[sizeof (struct sockaddr_in6)];
41927c478bd9Sstevel@tonic-gate char so_faddr[sizeof (struct sockaddr_in6)];
41930f1702c5SYu Xiangning socklen_t len;
41947c478bd9Sstevel@tonic-gate file_t *fp; /* unix domain sockets */
41957c478bd9Sstevel@tonic-gate struct f_audit_data *fad; /* unix domain sockets */
41967c478bd9Sstevel@tonic-gate short so_family, so_type;
41977c478bd9Sstevel@tonic-gate int add_sock_token = 0;
41989e9e6ab8Spaulson au_kcontext_t *kctx = GET_KCTX_PZ;
41997c478bd9Sstevel@tonic-gate
42007c478bd9Sstevel@tonic-gate fd = (int)uap->fd;
42017c478bd9Sstevel@tonic-gate
42027c478bd9Sstevel@tonic-gate /* bail if an error */
42037c478bd9Sstevel@tonic-gate if (error) {
42047c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
42057c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(3, "flags", (uint32_t)(uap->flags)));
42067c478bd9Sstevel@tonic-gate return;
42077c478bd9Sstevel@tonic-gate }
42087c478bd9Sstevel@tonic-gate
4209745b2690Stz if ((so = getsonode(fd, &err, &fp)) == NULL) {
42107c478bd9Sstevel@tonic-gate /*
42117c478bd9Sstevel@tonic-gate * not security relevant if doing a recvmsg from non socket
42127c478bd9Sstevel@tonic-gate * so no extra tokens. Should probably turn off audit record
42137c478bd9Sstevel@tonic-gate * generation here.
42147c478bd9Sstevel@tonic-gate */
42157c478bd9Sstevel@tonic-gate return;
42167c478bd9Sstevel@tonic-gate }
42177c478bd9Sstevel@tonic-gate
42187c478bd9Sstevel@tonic-gate so_family = so->so_family;
42197c478bd9Sstevel@tonic-gate so_type = so->so_type;
42207c478bd9Sstevel@tonic-gate
42217c478bd9Sstevel@tonic-gate /*
42227c478bd9Sstevel@tonic-gate * only putout SOCKET_EX token if INET/INET6 family.
42237c478bd9Sstevel@tonic-gate * XXX - what do we do about other families?
42247c478bd9Sstevel@tonic-gate */
42257c478bd9Sstevel@tonic-gate
42267c478bd9Sstevel@tonic-gate switch (so_family) {
42277c478bd9Sstevel@tonic-gate case AF_INET:
42287c478bd9Sstevel@tonic-gate case AF_INET6:
42297c478bd9Sstevel@tonic-gate
42307c478bd9Sstevel@tonic-gate /*
42317c478bd9Sstevel@tonic-gate * if datagram type socket, then just use what is in
42327c478bd9Sstevel@tonic-gate * socket structure for local address.
42337c478bd9Sstevel@tonic-gate * XXX - what do we do for other types?
42347c478bd9Sstevel@tonic-gate */
42357c478bd9Sstevel@tonic-gate if ((so->so_type == SOCK_DGRAM) ||
42367c478bd9Sstevel@tonic-gate (so->so_type == SOCK_RAW)) {
42377c478bd9Sstevel@tonic-gate add_sock_token = 1;
42387c478bd9Sstevel@tonic-gate
42397c478bd9Sstevel@tonic-gate bzero((void *)so_laddr, sizeof (so_laddr));
42407c478bd9Sstevel@tonic-gate bzero((void *)so_faddr, sizeof (so_faddr));
42417c478bd9Sstevel@tonic-gate
42427c478bd9Sstevel@tonic-gate /* get local address */
42430f1702c5SYu Xiangning len = sizeof (so_laddr);
42440f1702c5SYu Xiangning (void) socket_getsockname(so,
42450f1702c5SYu Xiangning (struct sockaddr *)so_laddr, &len, CRED());
42467c478bd9Sstevel@tonic-gate
42477c478bd9Sstevel@tonic-gate /* get peer address */
42487c478bd9Sstevel@tonic-gate STRUCT_INIT(msg, get_udatamodel());
42497c478bd9Sstevel@tonic-gate
42507c478bd9Sstevel@tonic-gate if (copyin((caddr_t)(uap->msg),
42517c478bd9Sstevel@tonic-gate (caddr_t)STRUCT_BUF(msg), STRUCT_SIZE(msg)) != 0) {
42527c478bd9Sstevel@tonic-gate break;
42537c478bd9Sstevel@tonic-gate }
42547c478bd9Sstevel@tonic-gate msg_name = (caddr_t)STRUCT_FGETP(msg, msg_name);
42557c478bd9Sstevel@tonic-gate if (msg_name == NULL) {
42567c478bd9Sstevel@tonic-gate break;
42577c478bd9Sstevel@tonic-gate }
42587c478bd9Sstevel@tonic-gate
42597c478bd9Sstevel@tonic-gate /* length is value from recvmsg - sanity check */
42607c478bd9Sstevel@tonic-gate msg_namelen = (socklen_t)STRUCT_FGET(msg, msg_namelen);
42617c478bd9Sstevel@tonic-gate if (msg_namelen == 0) {
42627c478bd9Sstevel@tonic-gate break;
42637c478bd9Sstevel@tonic-gate }
42647c478bd9Sstevel@tonic-gate if (copyin(msg_name, so_faddr,
42657c478bd9Sstevel@tonic-gate sizeof (so_faddr)) != 0) {
42667c478bd9Sstevel@tonic-gate break;
42677c478bd9Sstevel@tonic-gate }
42687c478bd9Sstevel@tonic-gate
42697c478bd9Sstevel@tonic-gate } else if (so->so_type == SOCK_STREAM) {
42707c478bd9Sstevel@tonic-gate
42717c478bd9Sstevel@tonic-gate /* get path from file struct here */
42727c478bd9Sstevel@tonic-gate fad = F2A(fp);
42737c478bd9Sstevel@tonic-gate ASSERT(fad);
42747c478bd9Sstevel@tonic-gate
42757c478bd9Sstevel@tonic-gate /*
42767c478bd9Sstevel@tonic-gate * already processed this file for read attempt
42777c478bd9Sstevel@tonic-gate */
42787c478bd9Sstevel@tonic-gate if (fad->fad_flags & FAD_READ) {
42797c478bd9Sstevel@tonic-gate /* don't want to audit every recvmsg attempt */
42807c478bd9Sstevel@tonic-gate tad->tad_flag = 0;
42817c478bd9Sstevel@tonic-gate /* free any residual audit data */
4282005d3febSMarek Pospisil au_close(kctx, &(u_ad), 0, 0, 0, NULL);
42837c478bd9Sstevel@tonic-gate releasef(fd);
42847c478bd9Sstevel@tonic-gate return;
42857c478bd9Sstevel@tonic-gate }
42867c478bd9Sstevel@tonic-gate /*
42877c478bd9Sstevel@tonic-gate * mark things so we know what happened and don't
42887c478bd9Sstevel@tonic-gate * repeat things
42897c478bd9Sstevel@tonic-gate */
42907c478bd9Sstevel@tonic-gate fad->fad_flags |= FAD_READ;
42917c478bd9Sstevel@tonic-gate
42927c478bd9Sstevel@tonic-gate bzero((void *)so_laddr, sizeof (so_laddr));
42937c478bd9Sstevel@tonic-gate bzero((void *)so_faddr, sizeof (so_faddr));
42947c478bd9Sstevel@tonic-gate
42950f1702c5SYu Xiangning /* get local and foreign addresses */
42960f1702c5SYu Xiangning len = sizeof (so_laddr);
42970f1702c5SYu Xiangning (void) socket_getsockname(so,
42980f1702c5SYu Xiangning (struct sockaddr *)so_laddr, &len, CRED());
42990f1702c5SYu Xiangning len = sizeof (so_faddr);
43000f1702c5SYu Xiangning (void) socket_getpeername(so,
43010f1702c5SYu Xiangning (struct sockaddr *)so_faddr, &len, B_FALSE, CRED());
43027c478bd9Sstevel@tonic-gate
43037c478bd9Sstevel@tonic-gate add_sock_token = 1;
43047c478bd9Sstevel@tonic-gate }
43057c478bd9Sstevel@tonic-gate
43067c478bd9Sstevel@tonic-gate /* XXX - what about SOCK_RDM/SOCK_SEQPACKET ??? */
43077c478bd9Sstevel@tonic-gate
43087c478bd9Sstevel@tonic-gate break;
43097c478bd9Sstevel@tonic-gate
43107c478bd9Sstevel@tonic-gate case AF_UNIX:
43117c478bd9Sstevel@tonic-gate /*
43127c478bd9Sstevel@tonic-gate * first check if this is first time through. Too much
43137c478bd9Sstevel@tonic-gate * duplicate code to put this in an aui_ routine.
43147c478bd9Sstevel@tonic-gate */
43157c478bd9Sstevel@tonic-gate
43167c478bd9Sstevel@tonic-gate /* get path from file struct here */
43177c478bd9Sstevel@tonic-gate fad = F2A(fp);
43187c478bd9Sstevel@tonic-gate ASSERT(fad);
43197c478bd9Sstevel@tonic-gate
43207c478bd9Sstevel@tonic-gate /*
43217c478bd9Sstevel@tonic-gate * already processed this file for read attempt
43227c478bd9Sstevel@tonic-gate */
43237c478bd9Sstevel@tonic-gate if (fad->fad_flags & FAD_READ) {
43247c478bd9Sstevel@tonic-gate releasef(fd);
43257c478bd9Sstevel@tonic-gate /* don't want to audit every recvmsg attempt */
43267c478bd9Sstevel@tonic-gate tad->tad_flag = 0;
43277c478bd9Sstevel@tonic-gate /* free any residual audit data */
4328005d3febSMarek Pospisil au_close(kctx, &(u_ad), 0, 0, 0, NULL);
43297c478bd9Sstevel@tonic-gate return;
43307c478bd9Sstevel@tonic-gate }
43317c478bd9Sstevel@tonic-gate /*
43327c478bd9Sstevel@tonic-gate * mark things so we know what happened and don't
43337c478bd9Sstevel@tonic-gate * repeat things
43347c478bd9Sstevel@tonic-gate */
43357c478bd9Sstevel@tonic-gate fad->fad_flags |= FAD_READ;
43367c478bd9Sstevel@tonic-gate
43377c478bd9Sstevel@tonic-gate if (fad->fad_aupath != NULL) {
43387c478bd9Sstevel@tonic-gate au_uwrite(au_to_path(fad->fad_aupath));
43397c478bd9Sstevel@tonic-gate } else {
43407c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "no path: fd", fd));
43417c478bd9Sstevel@tonic-gate }
43427c478bd9Sstevel@tonic-gate
43437c478bd9Sstevel@tonic-gate audit_attributes(fp->f_vnode);
43447c478bd9Sstevel@tonic-gate
43457c478bd9Sstevel@tonic-gate releasef(fd);
43467c478bd9Sstevel@tonic-gate
43477c478bd9Sstevel@tonic-gate return;
43487c478bd9Sstevel@tonic-gate
43497c478bd9Sstevel@tonic-gate default:
43507c478bd9Sstevel@tonic-gate break;
43517c478bd9Sstevel@tonic-gate
43527c478bd9Sstevel@tonic-gate }
43537c478bd9Sstevel@tonic-gate
43547c478bd9Sstevel@tonic-gate releasef(fd);
43557c478bd9Sstevel@tonic-gate
43567c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
43577c478bd9Sstevel@tonic-gate
43587c478bd9Sstevel@tonic-gate if (add_sock_token == 0) {
43597c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "family", (uint32_t)so_family));
43607c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "type", (uint32_t)so_type));
43617c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(3, "flags", (uint32_t)(uap->flags)));
43627c478bd9Sstevel@tonic-gate return;
43637c478bd9Sstevel@tonic-gate }
43647c478bd9Sstevel@tonic-gate
43657c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(3, "flags", (uint32_t)(uap->flags)));
43667c478bd9Sstevel@tonic-gate
43677c478bd9Sstevel@tonic-gate au_uwrite(au_to_socket_ex(so_family, so_type, so_laddr, so_faddr));
43687c478bd9Sstevel@tonic-gate
43697c478bd9Sstevel@tonic-gate }
43707c478bd9Sstevel@tonic-gate
43717c478bd9Sstevel@tonic-gate /*ARGSUSED*/
43727c478bd9Sstevel@tonic-gate static void
auf_recvfrom(struct t_audit_data * tad,int error,rval_t * rvp)43737c478bd9Sstevel@tonic-gate auf_recvfrom(
43747c478bd9Sstevel@tonic-gate struct t_audit_data *tad,
43757c478bd9Sstevel@tonic-gate int error,
43767c478bd9Sstevel@tonic-gate rval_t *rvp)
43777c478bd9Sstevel@tonic-gate {
43787c478bd9Sstevel@tonic-gate
43797c478bd9Sstevel@tonic-gate struct a {
43807c478bd9Sstevel@tonic-gate long fd;
43817c478bd9Sstevel@tonic-gate long msg; /* char */
43827c478bd9Sstevel@tonic-gate long len;
43837c478bd9Sstevel@tonic-gate long flags;
43847c478bd9Sstevel@tonic-gate long from; /* struct sockaddr */
43857c478bd9Sstevel@tonic-gate long fromlen;
43867c478bd9Sstevel@tonic-gate } *uap = (struct a *)ttolwp(curthread)->lwp_ap;
43877c478bd9Sstevel@tonic-gate
43887c478bd9Sstevel@tonic-gate socklen_t fromlen;
43897c478bd9Sstevel@tonic-gate struct sonode *so;
43907c478bd9Sstevel@tonic-gate char so_laddr[sizeof (struct sockaddr_in6)];
43917c478bd9Sstevel@tonic-gate char so_faddr[sizeof (struct sockaddr_in6)];
43927c478bd9Sstevel@tonic-gate int fd;
43937c478bd9Sstevel@tonic-gate short so_family, so_type;
43947c478bd9Sstevel@tonic-gate int add_sock_token = 0;
43950f1702c5SYu Xiangning socklen_t len;
43967c478bd9Sstevel@tonic-gate int err;
43977c478bd9Sstevel@tonic-gate struct file *fp;
43987c478bd9Sstevel@tonic-gate struct f_audit_data *fad; /* unix domain sockets */
43999e9e6ab8Spaulson au_kcontext_t *kctx = GET_KCTX_PZ;
44007c478bd9Sstevel@tonic-gate
44017c478bd9Sstevel@tonic-gate fd = (int)uap->fd;
44027c478bd9Sstevel@tonic-gate
44037c478bd9Sstevel@tonic-gate /* bail if an error */
44047c478bd9Sstevel@tonic-gate if (error) {
44057c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
44067c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(3, "flags", (uint32_t)(uap->flags)));
44077c478bd9Sstevel@tonic-gate return;
44087c478bd9Sstevel@tonic-gate }
44097c478bd9Sstevel@tonic-gate
4410745b2690Stz if ((so = getsonode(fd, &err, &fp)) == NULL) {
44117c478bd9Sstevel@tonic-gate /*
44127c478bd9Sstevel@tonic-gate * not security relevant if doing a recvmsg from non socket
44137c478bd9Sstevel@tonic-gate * so no extra tokens. Should probably turn off audit record
44147c478bd9Sstevel@tonic-gate * generation here.
44157c478bd9Sstevel@tonic-gate */
44167c478bd9Sstevel@tonic-gate return;
44177c478bd9Sstevel@tonic-gate }
44187c478bd9Sstevel@tonic-gate
44197c478bd9Sstevel@tonic-gate so_family = so->so_family;
44207c478bd9Sstevel@tonic-gate so_type = so->so_type;
44217c478bd9Sstevel@tonic-gate
44227c478bd9Sstevel@tonic-gate /*
44237c478bd9Sstevel@tonic-gate * only putout SOCKET_EX token if INET/INET6 family.
44247c478bd9Sstevel@tonic-gate * XXX - what do we do about other families?
44257c478bd9Sstevel@tonic-gate */
44267c478bd9Sstevel@tonic-gate
44277c478bd9Sstevel@tonic-gate switch (so_family) {
44287c478bd9Sstevel@tonic-gate case AF_INET:
44297c478bd9Sstevel@tonic-gate case AF_INET6:
44307c478bd9Sstevel@tonic-gate
44317c478bd9Sstevel@tonic-gate /*
44327c478bd9Sstevel@tonic-gate * if datagram type socket, then just use what is in
44337c478bd9Sstevel@tonic-gate * socket structure for local address.
44347c478bd9Sstevel@tonic-gate * XXX - what do we do for other types?
44357c478bd9Sstevel@tonic-gate */
44367c478bd9Sstevel@tonic-gate if ((so->so_type == SOCK_DGRAM) ||
44377c478bd9Sstevel@tonic-gate (so->so_type == SOCK_RAW)) {
44387c478bd9Sstevel@tonic-gate add_sock_token = 1;
44397c478bd9Sstevel@tonic-gate
44407c478bd9Sstevel@tonic-gate /* get local address */
44410f1702c5SYu Xiangning len = sizeof (so_laddr);
44420f1702c5SYu Xiangning (void) socket_getsockname(so,
44430f1702c5SYu Xiangning (struct sockaddr *)so_laddr, &len, CRED());
44447c478bd9Sstevel@tonic-gate
44457c478bd9Sstevel@tonic-gate /* get peer address */
44467c478bd9Sstevel@tonic-gate bzero((void *)so_faddr, sizeof (so_faddr));
44477c478bd9Sstevel@tonic-gate
44487c478bd9Sstevel@tonic-gate /* sanity check */
44490f48f68dSToomas Soome if (uap->from == 0)
44507c478bd9Sstevel@tonic-gate break;
44517c478bd9Sstevel@tonic-gate
44527c478bd9Sstevel@tonic-gate /* sanity checks */
44537c478bd9Sstevel@tonic-gate if (uap->fromlen == 0)
44547c478bd9Sstevel@tonic-gate break;
44557c478bd9Sstevel@tonic-gate
44567c478bd9Sstevel@tonic-gate if (copyin((caddr_t)(uap->fromlen), (caddr_t)&fromlen,
44577c478bd9Sstevel@tonic-gate sizeof (fromlen)) != 0)
44587c478bd9Sstevel@tonic-gate break;
44597c478bd9Sstevel@tonic-gate
44607c478bd9Sstevel@tonic-gate if (fromlen == 0)
44617c478bd9Sstevel@tonic-gate break;
44627c478bd9Sstevel@tonic-gate
44637c478bd9Sstevel@tonic-gate /* enforce maximum size */
44647c478bd9Sstevel@tonic-gate if (fromlen > sizeof (so_faddr))
44657c478bd9Sstevel@tonic-gate fromlen = sizeof (so_faddr);
44667c478bd9Sstevel@tonic-gate
44677c478bd9Sstevel@tonic-gate if (copyin((caddr_t)(uap->from), so_faddr,
44687c478bd9Sstevel@tonic-gate fromlen) != 0)
44697c478bd9Sstevel@tonic-gate break;
44707c478bd9Sstevel@tonic-gate
44717c478bd9Sstevel@tonic-gate } else if (so->so_type == SOCK_STREAM) {
44727c478bd9Sstevel@tonic-gate
44737c478bd9Sstevel@tonic-gate /* get path from file struct here */
44747c478bd9Sstevel@tonic-gate fad = F2A(fp);
44757c478bd9Sstevel@tonic-gate ASSERT(fad);
44767c478bd9Sstevel@tonic-gate
44777c478bd9Sstevel@tonic-gate /*
44787c478bd9Sstevel@tonic-gate * already processed this file for read attempt
44797c478bd9Sstevel@tonic-gate */
44807c478bd9Sstevel@tonic-gate if (fad->fad_flags & FAD_READ) {
44817c478bd9Sstevel@tonic-gate /* don't want to audit every recvfrom attempt */
44827c478bd9Sstevel@tonic-gate tad->tad_flag = 0;
44837c478bd9Sstevel@tonic-gate /* free any residual audit data */
4484005d3febSMarek Pospisil au_close(kctx, &(u_ad), 0, 0, 0, NULL);
44857c478bd9Sstevel@tonic-gate releasef(fd);
44867c478bd9Sstevel@tonic-gate return;
44877c478bd9Sstevel@tonic-gate }
44887c478bd9Sstevel@tonic-gate /*
44897c478bd9Sstevel@tonic-gate * mark things so we know what happened and don't
44907c478bd9Sstevel@tonic-gate * repeat things
44917c478bd9Sstevel@tonic-gate */
44927c478bd9Sstevel@tonic-gate fad->fad_flags |= FAD_READ;
44937c478bd9Sstevel@tonic-gate
44947c478bd9Sstevel@tonic-gate bzero((void *)so_laddr, sizeof (so_laddr));
44957c478bd9Sstevel@tonic-gate bzero((void *)so_faddr, sizeof (so_faddr));
44967c478bd9Sstevel@tonic-gate
44970f1702c5SYu Xiangning /* get local and foreign addresses */
44980f1702c5SYu Xiangning len = sizeof (so_laddr);
44990f1702c5SYu Xiangning (void) socket_getsockname(so,
45000f1702c5SYu Xiangning (struct sockaddr *)so_laddr, &len, CRED());
45010f1702c5SYu Xiangning len = sizeof (so_faddr);
45020f1702c5SYu Xiangning (void) socket_getpeername(so,
45030f1702c5SYu Xiangning (struct sockaddr *)so_faddr, &len, B_FALSE, CRED());
45047c478bd9Sstevel@tonic-gate
45057c478bd9Sstevel@tonic-gate add_sock_token = 1;
45067c478bd9Sstevel@tonic-gate }
45077c478bd9Sstevel@tonic-gate
45087c478bd9Sstevel@tonic-gate /* XXX - what about SOCK_RDM/SOCK_SEQPACKET ??? */
45097c478bd9Sstevel@tonic-gate
45107c478bd9Sstevel@tonic-gate break;
45117c478bd9Sstevel@tonic-gate
45127c478bd9Sstevel@tonic-gate case AF_UNIX:
45137c478bd9Sstevel@tonic-gate /*
45147c478bd9Sstevel@tonic-gate * first check if this is first time through. Too much
45157c478bd9Sstevel@tonic-gate * duplicate code to put this in an aui_ routine.
45167c478bd9Sstevel@tonic-gate */
45177c478bd9Sstevel@tonic-gate
45187c478bd9Sstevel@tonic-gate /* get path from file struct here */
45197c478bd9Sstevel@tonic-gate fad = F2A(fp);
45207c478bd9Sstevel@tonic-gate ASSERT(fad);
45217c478bd9Sstevel@tonic-gate
45227c478bd9Sstevel@tonic-gate /*
45237c478bd9Sstevel@tonic-gate * already processed this file for read attempt
45247c478bd9Sstevel@tonic-gate */
45257c478bd9Sstevel@tonic-gate if (fad->fad_flags & FAD_READ) {
45267c478bd9Sstevel@tonic-gate /* don't want to audit every recvfrom attempt */
45277c478bd9Sstevel@tonic-gate tad->tad_flag = 0;
45287c478bd9Sstevel@tonic-gate /* free any residual audit data */
4529005d3febSMarek Pospisil au_close(kctx, &(u_ad), 0, 0, 0, NULL);
45307c478bd9Sstevel@tonic-gate releasef(fd);
45317c478bd9Sstevel@tonic-gate return;
45327c478bd9Sstevel@tonic-gate }
45337c478bd9Sstevel@tonic-gate /*
45347c478bd9Sstevel@tonic-gate * mark things so we know what happened and don't
45357c478bd9Sstevel@tonic-gate * repeat things
45367c478bd9Sstevel@tonic-gate */
45377c478bd9Sstevel@tonic-gate fad->fad_flags |= FAD_READ;
45387c478bd9Sstevel@tonic-gate
45397c478bd9Sstevel@tonic-gate if (fad->fad_aupath != NULL) {
45407c478bd9Sstevel@tonic-gate au_uwrite(au_to_path(fad->fad_aupath));
45417c478bd9Sstevel@tonic-gate } else {
45427c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "no path: fd", fd));
45437c478bd9Sstevel@tonic-gate }
45447c478bd9Sstevel@tonic-gate
45457c478bd9Sstevel@tonic-gate audit_attributes(fp->f_vnode);
45467c478bd9Sstevel@tonic-gate
45477c478bd9Sstevel@tonic-gate releasef(fd);
45487c478bd9Sstevel@tonic-gate
45497c478bd9Sstevel@tonic-gate return;
45507c478bd9Sstevel@tonic-gate
45517c478bd9Sstevel@tonic-gate default:
45527c478bd9Sstevel@tonic-gate break;
45537c478bd9Sstevel@tonic-gate
45547c478bd9Sstevel@tonic-gate }
45557c478bd9Sstevel@tonic-gate
45567c478bd9Sstevel@tonic-gate releasef(fd);
45577c478bd9Sstevel@tonic-gate
45587c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
45597c478bd9Sstevel@tonic-gate
45607c478bd9Sstevel@tonic-gate if (add_sock_token == 0) {
45617c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "family", (uint32_t)so_family));
45627c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "type", (uint32_t)so_type));
45637c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(3, "flags", (uint32_t)(uap->flags)));
45647c478bd9Sstevel@tonic-gate return;
45657c478bd9Sstevel@tonic-gate }
45667c478bd9Sstevel@tonic-gate
45677c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(3, "flags", (uint32_t)(uap->flags)));
45687c478bd9Sstevel@tonic-gate
45697c478bd9Sstevel@tonic-gate au_uwrite(au_to_socket_ex(so_family, so_type, so_laddr, so_faddr));
45707c478bd9Sstevel@tonic-gate }
45717c478bd9Sstevel@tonic-gate
45727c478bd9Sstevel@tonic-gate /*ARGSUSED*/
45737c478bd9Sstevel@tonic-gate static void
auf_sendmsg(struct t_audit_data * tad,int error,rval_t * rval)45747c478bd9Sstevel@tonic-gate auf_sendmsg(struct t_audit_data *tad, int error, rval_t *rval)
45757c478bd9Sstevel@tonic-gate {
45767c478bd9Sstevel@tonic-gate struct a {
45777c478bd9Sstevel@tonic-gate long fd;
45787c478bd9Sstevel@tonic-gate long msg; /* struct msghdr */
45797c478bd9Sstevel@tonic-gate long flags;
45807c478bd9Sstevel@tonic-gate } *uap = (struct a *)ttolwp(curthread)->lwp_ap;
45817c478bd9Sstevel@tonic-gate
45827c478bd9Sstevel@tonic-gate struct sonode *so;
45837c478bd9Sstevel@tonic-gate char so_laddr[sizeof (struct sockaddr_in6)];
45847c478bd9Sstevel@tonic-gate char so_faddr[sizeof (struct sockaddr_in6)];
45857c478bd9Sstevel@tonic-gate int err;
45867c478bd9Sstevel@tonic-gate int fd;
45877c478bd9Sstevel@tonic-gate short so_family, so_type;
45887c478bd9Sstevel@tonic-gate int add_sock_token = 0;
45890f1702c5SYu Xiangning socklen_t len;
45907c478bd9Sstevel@tonic-gate struct file *fp;
45917c478bd9Sstevel@tonic-gate struct f_audit_data *fad;
45927c478bd9Sstevel@tonic-gate caddr_t msg_name;
45937c478bd9Sstevel@tonic-gate socklen_t msg_namelen;
45947c478bd9Sstevel@tonic-gate STRUCT_DECL(msghdr, msg);
45959e9e6ab8Spaulson au_kcontext_t *kctx = GET_KCTX_PZ;
45967c478bd9Sstevel@tonic-gate
45977c478bd9Sstevel@tonic-gate fd = (int)uap->fd;
45987c478bd9Sstevel@tonic-gate
45997c478bd9Sstevel@tonic-gate /* bail if an error */
46007c478bd9Sstevel@tonic-gate if (error) {
46017c478bd9Sstevel@tonic-gate /* XXX include destination address from system call arguments */
46027c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
46037c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(3, "flags", (uint32_t)(uap->flags)));
46047c478bd9Sstevel@tonic-gate return;
46057c478bd9Sstevel@tonic-gate }
46067c478bd9Sstevel@tonic-gate
4607745b2690Stz if ((so = getsonode(fd, &err, &fp)) == NULL) {
46087c478bd9Sstevel@tonic-gate /*
46097c478bd9Sstevel@tonic-gate * not security relevant if doing a sendmsg from non socket
46107c478bd9Sstevel@tonic-gate * so no extra tokens. Should probably turn off audit record
46117c478bd9Sstevel@tonic-gate * generation here.
46127c478bd9Sstevel@tonic-gate */
46137c478bd9Sstevel@tonic-gate return;
46147c478bd9Sstevel@tonic-gate }
46157c478bd9Sstevel@tonic-gate
46167c478bd9Sstevel@tonic-gate so_family = so->so_family;
46177c478bd9Sstevel@tonic-gate so_type = so->so_type;
46187c478bd9Sstevel@tonic-gate
46197c478bd9Sstevel@tonic-gate switch (so_family) {
46207c478bd9Sstevel@tonic-gate case AF_INET:
46217c478bd9Sstevel@tonic-gate case AF_INET6:
46227c478bd9Sstevel@tonic-gate /*
46237c478bd9Sstevel@tonic-gate * if datagram type socket, then just use what is in
46247c478bd9Sstevel@tonic-gate * socket structure for local address.
46257c478bd9Sstevel@tonic-gate * XXX - what do we do for other types?
46267c478bd9Sstevel@tonic-gate */
46277c478bd9Sstevel@tonic-gate if ((so->so_type == SOCK_DGRAM) ||
46287c478bd9Sstevel@tonic-gate (so->so_type == SOCK_RAW)) {
46297c478bd9Sstevel@tonic-gate
46307c478bd9Sstevel@tonic-gate bzero((void *)so_laddr, sizeof (so_laddr));
46317c478bd9Sstevel@tonic-gate bzero((void *)so_faddr, sizeof (so_faddr));
46327c478bd9Sstevel@tonic-gate
46337c478bd9Sstevel@tonic-gate /* get local address */
46340f1702c5SYu Xiangning len = sizeof (so_laddr);
46350f1702c5SYu Xiangning (void) socket_getsockname(so,
46360f1702c5SYu Xiangning (struct sockaddr *)so_laddr, &len, CRED());
46377c478bd9Sstevel@tonic-gate
46387c478bd9Sstevel@tonic-gate /* get peer address */
46397c478bd9Sstevel@tonic-gate STRUCT_INIT(msg, get_udatamodel());
46407c478bd9Sstevel@tonic-gate
46417c478bd9Sstevel@tonic-gate if (copyin((caddr_t)(uap->msg),
46427c478bd9Sstevel@tonic-gate (caddr_t)STRUCT_BUF(msg), STRUCT_SIZE(msg)) != 0) {
46437c478bd9Sstevel@tonic-gate break;
46447c478bd9Sstevel@tonic-gate }
46457c478bd9Sstevel@tonic-gate msg_name = (caddr_t)STRUCT_FGETP(msg, msg_name);
46467c478bd9Sstevel@tonic-gate if (msg_name == NULL)
46477c478bd9Sstevel@tonic-gate break;
46487c478bd9Sstevel@tonic-gate
46497c478bd9Sstevel@tonic-gate msg_namelen = (socklen_t)STRUCT_FGET(msg, msg_namelen);
46507c478bd9Sstevel@tonic-gate /* length is value from recvmsg - sanity check */
46517c478bd9Sstevel@tonic-gate if (msg_namelen == 0)
46527c478bd9Sstevel@tonic-gate break;
46537c478bd9Sstevel@tonic-gate
46547c478bd9Sstevel@tonic-gate if (copyin(msg_name, so_faddr,
46557c478bd9Sstevel@tonic-gate sizeof (so_faddr)) != 0)
46567c478bd9Sstevel@tonic-gate break;
46577c478bd9Sstevel@tonic-gate
46587c478bd9Sstevel@tonic-gate add_sock_token = 1;
46597c478bd9Sstevel@tonic-gate
46607c478bd9Sstevel@tonic-gate } else if (so->so_type == SOCK_STREAM) {
46617c478bd9Sstevel@tonic-gate
46627c478bd9Sstevel@tonic-gate /* get path from file struct here */
46637c478bd9Sstevel@tonic-gate fad = F2A(fp);
46647c478bd9Sstevel@tonic-gate ASSERT(fad);
46657c478bd9Sstevel@tonic-gate
46667c478bd9Sstevel@tonic-gate /*
46677c478bd9Sstevel@tonic-gate * already processed this file for write attempt
46687c478bd9Sstevel@tonic-gate */
46697c478bd9Sstevel@tonic-gate if (fad->fad_flags & FAD_WRITE) {
46707c478bd9Sstevel@tonic-gate releasef(fd);
46717c478bd9Sstevel@tonic-gate /* don't want to audit every sendmsg attempt */
46727c478bd9Sstevel@tonic-gate tad->tad_flag = 0;
46737c478bd9Sstevel@tonic-gate /* free any residual audit data */
4674005d3febSMarek Pospisil au_close(kctx, &(u_ad), 0, 0, 0, NULL);
46757c478bd9Sstevel@tonic-gate return;
46767c478bd9Sstevel@tonic-gate }
46777c478bd9Sstevel@tonic-gate
46787c478bd9Sstevel@tonic-gate /*
46797c478bd9Sstevel@tonic-gate * mark things so we know what happened and don't
46807c478bd9Sstevel@tonic-gate * repeat things
46817c478bd9Sstevel@tonic-gate */
46827c478bd9Sstevel@tonic-gate fad->fad_flags |= FAD_WRITE;
46837c478bd9Sstevel@tonic-gate
46847c478bd9Sstevel@tonic-gate bzero((void *)so_laddr, sizeof (so_laddr));
46857c478bd9Sstevel@tonic-gate bzero((void *)so_faddr, sizeof (so_faddr));
46867c478bd9Sstevel@tonic-gate
46870f1702c5SYu Xiangning /* get local and foreign addresses */
46880f1702c5SYu Xiangning len = sizeof (so_laddr);
46890f1702c5SYu Xiangning (void) socket_getsockname(so,
46900f1702c5SYu Xiangning (struct sockaddr *)so_laddr, &len, CRED());
46910f1702c5SYu Xiangning len = sizeof (so_faddr);
46920f1702c5SYu Xiangning (void) socket_getpeername(so,
46930f1702c5SYu Xiangning (struct sockaddr *)so_faddr, &len, B_FALSE, CRED());
46947c478bd9Sstevel@tonic-gate
46957c478bd9Sstevel@tonic-gate add_sock_token = 1;
46967c478bd9Sstevel@tonic-gate }
46977c478bd9Sstevel@tonic-gate
46987c478bd9Sstevel@tonic-gate /* XXX - what about SOCK_RAW/SOCK_RDM/SOCK_SEQPACKET ??? */
46997c478bd9Sstevel@tonic-gate
47007c478bd9Sstevel@tonic-gate break;
47017c478bd9Sstevel@tonic-gate
47027c478bd9Sstevel@tonic-gate case AF_UNIX:
47037c478bd9Sstevel@tonic-gate /*
47047c478bd9Sstevel@tonic-gate * first check if this is first time through. Too much
47057c478bd9Sstevel@tonic-gate * duplicate code to put this in an aui_ routine.
47067c478bd9Sstevel@tonic-gate */
47077c478bd9Sstevel@tonic-gate
47087c478bd9Sstevel@tonic-gate /* get path from file struct here */
47097c478bd9Sstevel@tonic-gate fad = F2A(fp);
47107c478bd9Sstevel@tonic-gate ASSERT(fad);
47117c478bd9Sstevel@tonic-gate
47127c478bd9Sstevel@tonic-gate /*
47137c478bd9Sstevel@tonic-gate * already processed this file for write attempt
47147c478bd9Sstevel@tonic-gate */
47157c478bd9Sstevel@tonic-gate if (fad->fad_flags & FAD_WRITE) {
47167c478bd9Sstevel@tonic-gate releasef(fd);
47177c478bd9Sstevel@tonic-gate /* don't want to audit every sendmsg attempt */
47187c478bd9Sstevel@tonic-gate tad->tad_flag = 0;
47197c478bd9Sstevel@tonic-gate /* free any residual audit data */
4720005d3febSMarek Pospisil au_close(kctx, &(u_ad), 0, 0, 0, NULL);
47217c478bd9Sstevel@tonic-gate return;
47227c478bd9Sstevel@tonic-gate }
47237c478bd9Sstevel@tonic-gate /*
47247c478bd9Sstevel@tonic-gate * mark things so we know what happened and don't
47257c478bd9Sstevel@tonic-gate * repeat things
47267c478bd9Sstevel@tonic-gate */
47277c478bd9Sstevel@tonic-gate fad->fad_flags |= FAD_WRITE;
47287c478bd9Sstevel@tonic-gate
47297c478bd9Sstevel@tonic-gate if (fad->fad_aupath != NULL) {
47307c478bd9Sstevel@tonic-gate au_uwrite(au_to_path(fad->fad_aupath));
47317c478bd9Sstevel@tonic-gate } else {
47327c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "no path: fd", fd));
47337c478bd9Sstevel@tonic-gate }
47347c478bd9Sstevel@tonic-gate
47357c478bd9Sstevel@tonic-gate audit_attributes(fp->f_vnode);
47367c478bd9Sstevel@tonic-gate
47377c478bd9Sstevel@tonic-gate releasef(fd);
47387c478bd9Sstevel@tonic-gate
47397c478bd9Sstevel@tonic-gate return;
47407c478bd9Sstevel@tonic-gate
47417c478bd9Sstevel@tonic-gate default:
47427c478bd9Sstevel@tonic-gate break;
47437c478bd9Sstevel@tonic-gate }
47447c478bd9Sstevel@tonic-gate
47457c478bd9Sstevel@tonic-gate releasef(fd);
47467c478bd9Sstevel@tonic-gate
47477c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
47487c478bd9Sstevel@tonic-gate
47497c478bd9Sstevel@tonic-gate if (add_sock_token == 0) {
47507c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "family", (uint32_t)so_family));
47517c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "type", (uint32_t)so_type));
47527c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(3, "flags", (uint32_t)(uap->flags)));
47537c478bd9Sstevel@tonic-gate return;
47547c478bd9Sstevel@tonic-gate }
47557c478bd9Sstevel@tonic-gate
47567c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(3, "flags", (uint32_t)(uap->flags)));
47577c478bd9Sstevel@tonic-gate
47587c478bd9Sstevel@tonic-gate au_uwrite(au_to_socket_ex(so_family, so_type, so_laddr, so_faddr));
47597c478bd9Sstevel@tonic-gate }
47607c478bd9Sstevel@tonic-gate
47617c478bd9Sstevel@tonic-gate /*ARGSUSED*/
47627c478bd9Sstevel@tonic-gate static void
auf_sendto(struct t_audit_data * tad,int error,rval_t * rval)47637c478bd9Sstevel@tonic-gate auf_sendto(struct t_audit_data *tad, int error, rval_t *rval)
47647c478bd9Sstevel@tonic-gate {
47657c478bd9Sstevel@tonic-gate struct a {
47667c478bd9Sstevel@tonic-gate long fd;
47677c478bd9Sstevel@tonic-gate long msg; /* char */
47687c478bd9Sstevel@tonic-gate long len;
47697c478bd9Sstevel@tonic-gate long flags;
47707c478bd9Sstevel@tonic-gate long to; /* struct sockaddr */
47717c478bd9Sstevel@tonic-gate long tolen;
47727c478bd9Sstevel@tonic-gate } *uap = (struct a *)ttolwp(curthread)->lwp_ap;
47737c478bd9Sstevel@tonic-gate
47747c478bd9Sstevel@tonic-gate struct sonode *so;
47757c478bd9Sstevel@tonic-gate char so_laddr[sizeof (struct sockaddr_in6)];
47767c478bd9Sstevel@tonic-gate char so_faddr[sizeof (struct sockaddr_in6)];
47777c478bd9Sstevel@tonic-gate socklen_t tolen;
47787c478bd9Sstevel@tonic-gate int err;
47797c478bd9Sstevel@tonic-gate int fd;
47800f1702c5SYu Xiangning socklen_t len;
47817c478bd9Sstevel@tonic-gate short so_family, so_type;
47827c478bd9Sstevel@tonic-gate int add_sock_token = 0;
47837c478bd9Sstevel@tonic-gate struct file *fp;
47847c478bd9Sstevel@tonic-gate struct f_audit_data *fad;
47859e9e6ab8Spaulson au_kcontext_t *kctx = GET_KCTX_PZ;
47867c478bd9Sstevel@tonic-gate
47877c478bd9Sstevel@tonic-gate fd = (int)uap->fd;
47887c478bd9Sstevel@tonic-gate
47897c478bd9Sstevel@tonic-gate /* bail if an error */
47907c478bd9Sstevel@tonic-gate if (error) {
47917c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
47927c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(3, "flags", (uint32_t)(uap->flags)));
47937c478bd9Sstevel@tonic-gate /* XXX include destination address from system call arguments */
47947c478bd9Sstevel@tonic-gate return;
47957c478bd9Sstevel@tonic-gate }
47967c478bd9Sstevel@tonic-gate
4797745b2690Stz if ((so = getsonode(fd, &err, &fp)) == NULL) {
47987c478bd9Sstevel@tonic-gate /*
47997c478bd9Sstevel@tonic-gate * not security relevant if doing a sendto using non socket
48007c478bd9Sstevel@tonic-gate * so no extra tokens. Should probably turn off audit record
48017c478bd9Sstevel@tonic-gate * generation here.
48027c478bd9Sstevel@tonic-gate */
48037c478bd9Sstevel@tonic-gate return;
48047c478bd9Sstevel@tonic-gate }
48057c478bd9Sstevel@tonic-gate
48067c478bd9Sstevel@tonic-gate so_family = so->so_family;
48077c478bd9Sstevel@tonic-gate so_type = so->so_type;
48087c478bd9Sstevel@tonic-gate
48097c478bd9Sstevel@tonic-gate /*
48107c478bd9Sstevel@tonic-gate * only putout SOCKET_EX token if INET/INET6 family.
48117c478bd9Sstevel@tonic-gate * XXX - what do we do about other families?
48127c478bd9Sstevel@tonic-gate */
48137c478bd9Sstevel@tonic-gate
48147c478bd9Sstevel@tonic-gate switch (so_family) {
48157c478bd9Sstevel@tonic-gate case AF_INET:
48167c478bd9Sstevel@tonic-gate case AF_INET6:
48177c478bd9Sstevel@tonic-gate
48187c478bd9Sstevel@tonic-gate /*
48197c478bd9Sstevel@tonic-gate * if datagram type socket, then just use what is in
48207c478bd9Sstevel@tonic-gate * socket structure for local address.
48217c478bd9Sstevel@tonic-gate * XXX - what do we do for other types?
48227c478bd9Sstevel@tonic-gate */
48237c478bd9Sstevel@tonic-gate if ((so->so_type == SOCK_DGRAM) ||
48247c478bd9Sstevel@tonic-gate (so->so_type == SOCK_RAW)) {
48257c478bd9Sstevel@tonic-gate
48267c478bd9Sstevel@tonic-gate bzero((void *)so_laddr, sizeof (so_laddr));
48277c478bd9Sstevel@tonic-gate bzero((void *)so_faddr, sizeof (so_faddr));
48287c478bd9Sstevel@tonic-gate
48297c478bd9Sstevel@tonic-gate /* get local address */
48300f1702c5SYu Xiangning len = sizeof (so_laddr);
48310f1702c5SYu Xiangning (void) socket_getsockname(so,
48320f1702c5SYu Xiangning (struct sockaddr *)so_laddr, &len, CRED());
48337c478bd9Sstevel@tonic-gate
48347c478bd9Sstevel@tonic-gate /* get peer address */
48357c478bd9Sstevel@tonic-gate
48367c478bd9Sstevel@tonic-gate /* sanity check */
48370f48f68dSToomas Soome if (uap->to == 0)
48387c478bd9Sstevel@tonic-gate break;
48397c478bd9Sstevel@tonic-gate
48407c478bd9Sstevel@tonic-gate /* sanity checks */
48417c478bd9Sstevel@tonic-gate if (uap->tolen == 0)
48427c478bd9Sstevel@tonic-gate break;
48437c478bd9Sstevel@tonic-gate
48447c478bd9Sstevel@tonic-gate tolen = (socklen_t)uap->tolen;
48457c478bd9Sstevel@tonic-gate
48467c478bd9Sstevel@tonic-gate /* enforce maximum size */
48477c478bd9Sstevel@tonic-gate if (tolen > sizeof (so_faddr))
48487c478bd9Sstevel@tonic-gate tolen = sizeof (so_faddr);
48497c478bd9Sstevel@tonic-gate
48507c478bd9Sstevel@tonic-gate if (copyin((caddr_t)(uap->to), so_faddr, tolen) != 0)
48517c478bd9Sstevel@tonic-gate break;
48527c478bd9Sstevel@tonic-gate
48537c478bd9Sstevel@tonic-gate add_sock_token = 1;
48547c478bd9Sstevel@tonic-gate } else {
48557c478bd9Sstevel@tonic-gate /*
48567c478bd9Sstevel@tonic-gate * check if this is first time through.
48577c478bd9Sstevel@tonic-gate */
48587c478bd9Sstevel@tonic-gate
48597c478bd9Sstevel@tonic-gate /* get path from file struct here */
48607c478bd9Sstevel@tonic-gate fad = F2A(fp);
48617c478bd9Sstevel@tonic-gate ASSERT(fad);
48627c478bd9Sstevel@tonic-gate
48637c478bd9Sstevel@tonic-gate /*
48647c478bd9Sstevel@tonic-gate * already processed this file for write attempt
48657c478bd9Sstevel@tonic-gate */
48667c478bd9Sstevel@tonic-gate if (fad->fad_flags & FAD_WRITE) {
48677c478bd9Sstevel@tonic-gate /* don't want to audit every sendto attempt */
48687c478bd9Sstevel@tonic-gate tad->tad_flag = 0;
48697c478bd9Sstevel@tonic-gate /* free any residual audit data */
4870005d3febSMarek Pospisil au_close(kctx, &(u_ad), 0, 0, 0, NULL);
48717c478bd9Sstevel@tonic-gate releasef(fd);
48727c478bd9Sstevel@tonic-gate return;
48737c478bd9Sstevel@tonic-gate }
48747c478bd9Sstevel@tonic-gate /*
48757c478bd9Sstevel@tonic-gate * mark things so we know what happened and don't
48767c478bd9Sstevel@tonic-gate * repeat things
48777c478bd9Sstevel@tonic-gate */
48787c478bd9Sstevel@tonic-gate fad->fad_flags |= FAD_WRITE;
48797c478bd9Sstevel@tonic-gate
48807c478bd9Sstevel@tonic-gate bzero((void *)so_laddr, sizeof (so_laddr));
48817c478bd9Sstevel@tonic-gate bzero((void *)so_faddr, sizeof (so_faddr));
48827c478bd9Sstevel@tonic-gate
48830f1702c5SYu Xiangning /* get local and foreign addresses */
48840f1702c5SYu Xiangning len = sizeof (so_laddr);
48850f1702c5SYu Xiangning (void) socket_getsockname(so,
48860f1702c5SYu Xiangning (struct sockaddr *)so_laddr, &len, CRED());
48870f1702c5SYu Xiangning len = sizeof (so_faddr);
48880f1702c5SYu Xiangning (void) socket_getpeername(so,
48890f1702c5SYu Xiangning (struct sockaddr *)so_faddr, &len, B_FALSE, CRED());
48907c478bd9Sstevel@tonic-gate
48917c478bd9Sstevel@tonic-gate add_sock_token = 1;
48927c478bd9Sstevel@tonic-gate }
48937c478bd9Sstevel@tonic-gate
48947c478bd9Sstevel@tonic-gate /* XXX - what about SOCK_RDM/SOCK_SEQPACKET ??? */
48957c478bd9Sstevel@tonic-gate
48967c478bd9Sstevel@tonic-gate break;
48977c478bd9Sstevel@tonic-gate
48987c478bd9Sstevel@tonic-gate case AF_UNIX:
48997c478bd9Sstevel@tonic-gate /*
49007c478bd9Sstevel@tonic-gate * first check if this is first time through. Too much
49017c478bd9Sstevel@tonic-gate * duplicate code to put this in an aui_ routine.
49027c478bd9Sstevel@tonic-gate */
49037c478bd9Sstevel@tonic-gate
49047c478bd9Sstevel@tonic-gate /* get path from file struct here */
49057c478bd9Sstevel@tonic-gate fad = F2A(fp);
49067c478bd9Sstevel@tonic-gate ASSERT(fad);
49077c478bd9Sstevel@tonic-gate
49087c478bd9Sstevel@tonic-gate /*
49097c478bd9Sstevel@tonic-gate * already processed this file for write attempt
49107c478bd9Sstevel@tonic-gate */
49117c478bd9Sstevel@tonic-gate if (fad->fad_flags & FAD_WRITE) {
49127c478bd9Sstevel@tonic-gate /* don't want to audit every sendto attempt */
49137c478bd9Sstevel@tonic-gate tad->tad_flag = 0;
49147c478bd9Sstevel@tonic-gate /* free any residual audit data */
4915005d3febSMarek Pospisil au_close(kctx, &(u_ad), 0, 0, 0, NULL);
49167c478bd9Sstevel@tonic-gate releasef(fd);
49177c478bd9Sstevel@tonic-gate return;
49187c478bd9Sstevel@tonic-gate }
49197c478bd9Sstevel@tonic-gate /*
49207c478bd9Sstevel@tonic-gate * mark things so we know what happened and don't
49217c478bd9Sstevel@tonic-gate * repeat things
49227c478bd9Sstevel@tonic-gate */
49237c478bd9Sstevel@tonic-gate fad->fad_flags |= FAD_WRITE;
49247c478bd9Sstevel@tonic-gate
49257c478bd9Sstevel@tonic-gate if (fad->fad_aupath != NULL) {
49267c478bd9Sstevel@tonic-gate au_uwrite(au_to_path(fad->fad_aupath));
49277c478bd9Sstevel@tonic-gate } else {
49287c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "no path: fd", fd));
49297c478bd9Sstevel@tonic-gate }
49307c478bd9Sstevel@tonic-gate
49317c478bd9Sstevel@tonic-gate audit_attributes(fp->f_vnode);
49327c478bd9Sstevel@tonic-gate
49337c478bd9Sstevel@tonic-gate releasef(fd);
49347c478bd9Sstevel@tonic-gate
49357c478bd9Sstevel@tonic-gate return;
49367c478bd9Sstevel@tonic-gate
49377c478bd9Sstevel@tonic-gate default:
49387c478bd9Sstevel@tonic-gate break;
49397c478bd9Sstevel@tonic-gate
49407c478bd9Sstevel@tonic-gate }
49417c478bd9Sstevel@tonic-gate
49427c478bd9Sstevel@tonic-gate releasef(fd);
49437c478bd9Sstevel@tonic-gate
49447c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
49457c478bd9Sstevel@tonic-gate
49467c478bd9Sstevel@tonic-gate if (add_sock_token == 0) {
49477c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "family", (uint32_t)so_family));
49487c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "type", (uint32_t)so_type));
49497c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(3, "flags", (uint32_t)(uap->flags)));
49507c478bd9Sstevel@tonic-gate return;
49517c478bd9Sstevel@tonic-gate }
49527c478bd9Sstevel@tonic-gate
49537c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(3, "flags", (uint32_t)(uap->flags)));
49547c478bd9Sstevel@tonic-gate
49557c478bd9Sstevel@tonic-gate au_uwrite(au_to_socket_ex(so_family, so_type, so_laddr, so_faddr));
49567c478bd9Sstevel@tonic-gate
49577c478bd9Sstevel@tonic-gate }
49587c478bd9Sstevel@tonic-gate
49597c478bd9Sstevel@tonic-gate /*
4960da6c28aaSamw * XXX socket(2) may be equivalent to open(2) on a unix domain
49617c478bd9Sstevel@tonic-gate * socket. This needs investigation.
49627c478bd9Sstevel@tonic-gate */
49637c478bd9Sstevel@tonic-gate
49647c478bd9Sstevel@tonic-gate /*ARGSUSED*/
49657c478bd9Sstevel@tonic-gate static void
aus_socket(struct t_audit_data * tad)49667c478bd9Sstevel@tonic-gate aus_socket(struct t_audit_data *tad)
49677c478bd9Sstevel@tonic-gate {
49687c478bd9Sstevel@tonic-gate struct a {
49697c478bd9Sstevel@tonic-gate long domain;
49707c478bd9Sstevel@tonic-gate long type;
49717c478bd9Sstevel@tonic-gate long protocol;
49727c478bd9Sstevel@tonic-gate } *uap = (struct a *)ttolwp(curthread)->lwp_ap;
49737c478bd9Sstevel@tonic-gate
49747c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "domain", (uint32_t)uap->domain));
49757c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(2, "type", (uint32_t)uap->type));
49767c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(3, "protocol", (uint32_t)uap->protocol));
49777c478bd9Sstevel@tonic-gate }
49787c478bd9Sstevel@tonic-gate
49797c478bd9Sstevel@tonic-gate /*ARGSUSED*/
49807c478bd9Sstevel@tonic-gate static void
aus_sigqueue(struct t_audit_data * tad)49817c478bd9Sstevel@tonic-gate aus_sigqueue(struct t_audit_data *tad)
49827c478bd9Sstevel@tonic-gate {
49837c478bd9Sstevel@tonic-gate struct a {
49847c478bd9Sstevel@tonic-gate long pid;
49857c478bd9Sstevel@tonic-gate long signo;
49867c478bd9Sstevel@tonic-gate long *val;
49877c478bd9Sstevel@tonic-gate } *uap = (struct a *)ttolwp(curthread)->lwp_ap;
49887c478bd9Sstevel@tonic-gate struct proc *p;
49897c478bd9Sstevel@tonic-gate uid_t uid, ruid;
49907c478bd9Sstevel@tonic-gate gid_t gid, rgid;
49917c478bd9Sstevel@tonic-gate pid_t pid;
49927c478bd9Sstevel@tonic-gate const auditinfo_addr_t *ainfo;
49937c478bd9Sstevel@tonic-gate cred_t *cr;
49947c478bd9Sstevel@tonic-gate
49957c478bd9Sstevel@tonic-gate pid = (pid_t)uap->pid;
49967c478bd9Sstevel@tonic-gate
49977c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(2, "signal", (uint32_t)uap->signo));
49987c478bd9Sstevel@tonic-gate if (pid > 0) {
49997c478bd9Sstevel@tonic-gate mutex_enter(&pidlock);
50007c478bd9Sstevel@tonic-gate if ((p = prfind(pid)) == (struct proc *)0) {
50017c478bd9Sstevel@tonic-gate mutex_exit(&pidlock);
50027c478bd9Sstevel@tonic-gate return;
50037c478bd9Sstevel@tonic-gate }
50047c478bd9Sstevel@tonic-gate mutex_enter(&p->p_lock); /* so process doesn't go away */
50057c478bd9Sstevel@tonic-gate mutex_exit(&pidlock);
50067c478bd9Sstevel@tonic-gate
50077c478bd9Sstevel@tonic-gate mutex_enter(&p->p_crlock);
50087c478bd9Sstevel@tonic-gate crhold(cr = p->p_cred);
50097c478bd9Sstevel@tonic-gate mutex_exit(&p->p_crlock);
50107c478bd9Sstevel@tonic-gate mutex_exit(&p->p_lock);
50117c478bd9Sstevel@tonic-gate
50127c478bd9Sstevel@tonic-gate ainfo = crgetauinfo(cr);
50137c478bd9Sstevel@tonic-gate if (ainfo == NULL) {
50147c478bd9Sstevel@tonic-gate crfree(cr);
50157c478bd9Sstevel@tonic-gate return;
50167c478bd9Sstevel@tonic-gate }
50177c478bd9Sstevel@tonic-gate
50187c478bd9Sstevel@tonic-gate uid = crgetuid(cr);
50197c478bd9Sstevel@tonic-gate gid = crgetgid(cr);
50207c478bd9Sstevel@tonic-gate ruid = crgetruid(cr);
50217c478bd9Sstevel@tonic-gate rgid = crgetrgid(cr);
50227c478bd9Sstevel@tonic-gate au_uwrite(au_to_process(uid, gid, ruid, rgid, pid,
50237c478bd9Sstevel@tonic-gate ainfo->ai_auid, ainfo->ai_asid, &ainfo->ai_termid));
50247c478bd9Sstevel@tonic-gate crfree(cr);
50257c478bd9Sstevel@tonic-gate }
50267c478bd9Sstevel@tonic-gate else
50277c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "process ID", (uint32_t)pid));
50287c478bd9Sstevel@tonic-gate }
50297c478bd9Sstevel@tonic-gate
50307c478bd9Sstevel@tonic-gate /*ARGSUSED*/
50317c478bd9Sstevel@tonic-gate static void
aus_inst_sync(struct t_audit_data * tad)50327c478bd9Sstevel@tonic-gate aus_inst_sync(struct t_audit_data *tad)
50337c478bd9Sstevel@tonic-gate {
50347c478bd9Sstevel@tonic-gate struct a {
50357c478bd9Sstevel@tonic-gate long name; /* char */
50367c478bd9Sstevel@tonic-gate long flags;
50377c478bd9Sstevel@tonic-gate } *uap = (struct a *)ttolwp(curthread)->lwp_ap;
50387c478bd9Sstevel@tonic-gate
50397c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(2, "flags", (uint32_t)uap->flags));
50407c478bd9Sstevel@tonic-gate }
50417c478bd9Sstevel@tonic-gate
50429acbbeafSnn /*ARGSUSED*/
50439acbbeafSnn static void
aus_brandsys(struct t_audit_data * tad)50449acbbeafSnn aus_brandsys(struct t_audit_data *tad)
50459acbbeafSnn {
50469acbbeafSnn klwp_t *clwp = ttolwp(curthread);
50479acbbeafSnn
50489acbbeafSnn struct a {
50499acbbeafSnn long cmd;
50509acbbeafSnn long arg1;
50519acbbeafSnn long arg2;
50529acbbeafSnn long arg3;
50539acbbeafSnn long arg4;
50549acbbeafSnn long arg5;
50559acbbeafSnn long arg6;
50569acbbeafSnn } *uap = (struct a *)clwp->lwp_ap;
50579acbbeafSnn
50589acbbeafSnn au_uwrite(au_to_arg32(1, "cmd", (uint_t)uap->cmd));
50599acbbeafSnn #ifdef _LP64
50609acbbeafSnn au_uwrite(au_to_arg64(2, "arg1", (uint64_t)uap->arg1));
50619acbbeafSnn au_uwrite(au_to_arg64(3, "arg2", (uint64_t)uap->arg2));
50629acbbeafSnn au_uwrite(au_to_arg64(4, "arg3", (uint64_t)uap->arg3));
50639acbbeafSnn au_uwrite(au_to_arg64(5, "arg4", (uint64_t)uap->arg4));
50649acbbeafSnn au_uwrite(au_to_arg64(6, "arg5", (uint64_t)uap->arg5));
50659acbbeafSnn au_uwrite(au_to_arg64(7, "arg6", (uint64_t)uap->arg6));
50669acbbeafSnn #else
50679acbbeafSnn au_uwrite(au_to_arg32(2, "arg1", (uint32_t)uap->arg1));
50689acbbeafSnn au_uwrite(au_to_arg32(3, "arg2", (uint32_t)uap->arg2));
50699acbbeafSnn au_uwrite(au_to_arg32(4, "arg3", (uint32_t)uap->arg3));
50709acbbeafSnn au_uwrite(au_to_arg32(5, "arg4", (uint32_t)uap->arg4));
50719acbbeafSnn au_uwrite(au_to_arg32(6, "arg5", (uint32_t)uap->arg5));
50729acbbeafSnn au_uwrite(au_to_arg32(7, "arg6", (uint32_t)uap->arg6));
50739acbbeafSnn #endif
50749acbbeafSnn }
50759acbbeafSnn
50767c478bd9Sstevel@tonic-gate /*ARGSUSED*/
50777c478bd9Sstevel@tonic-gate static void
aus_p_online(struct t_audit_data * tad)50787c478bd9Sstevel@tonic-gate aus_p_online(struct t_audit_data *tad)
50797c478bd9Sstevel@tonic-gate {
50807c478bd9Sstevel@tonic-gate struct a {
50817c478bd9Sstevel@tonic-gate long processor_id;
50827c478bd9Sstevel@tonic-gate long flag;
50837c478bd9Sstevel@tonic-gate } *uap = (struct a *)ttolwp(curthread)->lwp_ap;
50847c478bd9Sstevel@tonic-gate
50857c478bd9Sstevel@tonic-gate struct flags {
50867c478bd9Sstevel@tonic-gate int flag;
50877c478bd9Sstevel@tonic-gate char *cflag;
50887c478bd9Sstevel@tonic-gate } aflags[6] = {
50897c478bd9Sstevel@tonic-gate { P_ONLINE, "P_ONLINE"},
50907c478bd9Sstevel@tonic-gate { P_OFFLINE, "P_OFFLINE"},
50917c478bd9Sstevel@tonic-gate { P_NOINTR, "P_NOINTR"},
50927c478bd9Sstevel@tonic-gate { P_SPARE, "P_SPARE"},
50937c478bd9Sstevel@tonic-gate { P_FAULTED, "P_FAULTED"},
50947c478bd9Sstevel@tonic-gate { P_STATUS, "P_STATUS"}
50957c478bd9Sstevel@tonic-gate };
50967c478bd9Sstevel@tonic-gate int i;
50977c478bd9Sstevel@tonic-gate char *cflag;
50987c478bd9Sstevel@tonic-gate
50997c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "processor ID", (uint32_t)uap->processor_id));
51007c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(2, "flag", (uint32_t)uap->flag));
51017c478bd9Sstevel@tonic-gate
51027c478bd9Sstevel@tonic-gate for (i = 0; i < 6; i++) {
51037c478bd9Sstevel@tonic-gate if (aflags[i].flag == uap->flag)
51047c478bd9Sstevel@tonic-gate break;
51057c478bd9Sstevel@tonic-gate }
51067c478bd9Sstevel@tonic-gate cflag = (i == 6) ? "bad flag":aflags[i].cflag;
51077c478bd9Sstevel@tonic-gate
51087c478bd9Sstevel@tonic-gate au_uwrite(au_to_text(cflag));
51097c478bd9Sstevel@tonic-gate }
51107c478bd9Sstevel@tonic-gate
51117c478bd9Sstevel@tonic-gate /*ARGSUSED*/
51127c478bd9Sstevel@tonic-gate static void
aus_processor_bind(struct t_audit_data * tad)51137c478bd9Sstevel@tonic-gate aus_processor_bind(struct t_audit_data *tad)
51147c478bd9Sstevel@tonic-gate {
51157c478bd9Sstevel@tonic-gate struct a {
51167c478bd9Sstevel@tonic-gate long id_type;
51177c478bd9Sstevel@tonic-gate long id;
51187c478bd9Sstevel@tonic-gate long processor_id;
51197c478bd9Sstevel@tonic-gate long obind;
51207c478bd9Sstevel@tonic-gate } *uap = (struct a *)ttolwp(curthread)->lwp_ap;
51217c478bd9Sstevel@tonic-gate
51227c478bd9Sstevel@tonic-gate struct proc *p;
51237c478bd9Sstevel@tonic-gate int lwpcnt;
51247c478bd9Sstevel@tonic-gate uid_t uid, ruid;
51257c478bd9Sstevel@tonic-gate gid_t gid, rgid;
51267c478bd9Sstevel@tonic-gate pid_t pid;
51277c478bd9Sstevel@tonic-gate const auditinfo_addr_t *ainfo;
51287c478bd9Sstevel@tonic-gate cred_t *cr;
51297c478bd9Sstevel@tonic-gate
51307c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "ID type", (uint32_t)uap->id_type));
51317c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(2, "ID", (uint32_t)uap->id));
51327c478bd9Sstevel@tonic-gate if (uap->processor_id == PBIND_NONE)
51337c478bd9Sstevel@tonic-gate au_uwrite(au_to_text("PBIND_NONE"));
51347c478bd9Sstevel@tonic-gate else
51357c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(3, "processor_id",
5136745b2690Stz (uint32_t)uap->processor_id));
51377c478bd9Sstevel@tonic-gate
51387c478bd9Sstevel@tonic-gate switch (uap->id_type) {
51397c478bd9Sstevel@tonic-gate case P_MYID:
51407c478bd9Sstevel@tonic-gate case P_LWPID:
51417c478bd9Sstevel@tonic-gate mutex_enter(&pidlock);
51427c478bd9Sstevel@tonic-gate p = ttoproc(curthread);
51437c478bd9Sstevel@tonic-gate if (p == NULL || p->p_as == &kas) {
51447c478bd9Sstevel@tonic-gate mutex_exit(&pidlock);
51457c478bd9Sstevel@tonic-gate return;
51467c478bd9Sstevel@tonic-gate }
51477c478bd9Sstevel@tonic-gate mutex_enter(&p->p_lock);
51487c478bd9Sstevel@tonic-gate mutex_exit(&pidlock);
51497c478bd9Sstevel@tonic-gate lwpcnt = p->p_lwpcnt;
51507c478bd9Sstevel@tonic-gate pid = p->p_pid;
51517c478bd9Sstevel@tonic-gate
51527c478bd9Sstevel@tonic-gate mutex_enter(&p->p_crlock);
51537c478bd9Sstevel@tonic-gate crhold(cr = p->p_cred);
51547c478bd9Sstevel@tonic-gate mutex_exit(&p->p_crlock);
51557c478bd9Sstevel@tonic-gate mutex_exit(&p->p_lock);
51567c478bd9Sstevel@tonic-gate
51577c478bd9Sstevel@tonic-gate ainfo = crgetauinfo(cr);
51587c478bd9Sstevel@tonic-gate if (ainfo == NULL) {
51597c478bd9Sstevel@tonic-gate crfree(cr);
51607c478bd9Sstevel@tonic-gate return;
51617c478bd9Sstevel@tonic-gate }
51627c478bd9Sstevel@tonic-gate
51637c478bd9Sstevel@tonic-gate uid = crgetuid(cr);
51647c478bd9Sstevel@tonic-gate gid = crgetgid(cr);
51657c478bd9Sstevel@tonic-gate ruid = crgetruid(cr);
51667c478bd9Sstevel@tonic-gate rgid = crgetrgid(cr);
51677c478bd9Sstevel@tonic-gate au_uwrite(au_to_process(uid, gid, ruid, rgid, pid,
51687c478bd9Sstevel@tonic-gate ainfo->ai_auid, ainfo->ai_asid, &ainfo->ai_termid));
51697c478bd9Sstevel@tonic-gate crfree(cr);
51707c478bd9Sstevel@tonic-gate break;
51717c478bd9Sstevel@tonic-gate case P_PID:
51727c478bd9Sstevel@tonic-gate mutex_enter(&pidlock);
51737c478bd9Sstevel@tonic-gate p = prfind(uap->id);
51747c478bd9Sstevel@tonic-gate if (p == NULL || p->p_as == &kas) {
51757c478bd9Sstevel@tonic-gate mutex_exit(&pidlock);
51767c478bd9Sstevel@tonic-gate return;
51777c478bd9Sstevel@tonic-gate }
51787c478bd9Sstevel@tonic-gate mutex_enter(&p->p_lock);
51797c478bd9Sstevel@tonic-gate mutex_exit(&pidlock);
51807c478bd9Sstevel@tonic-gate lwpcnt = p->p_lwpcnt;
51817c478bd9Sstevel@tonic-gate pid = p->p_pid;
51827c478bd9Sstevel@tonic-gate
51837c478bd9Sstevel@tonic-gate mutex_enter(&p->p_crlock);
51847c478bd9Sstevel@tonic-gate crhold(cr = p->p_cred);
51857c478bd9Sstevel@tonic-gate mutex_exit(&p->p_crlock);
51867c478bd9Sstevel@tonic-gate mutex_exit(&p->p_lock);
51877c478bd9Sstevel@tonic-gate
51887c478bd9Sstevel@tonic-gate ainfo = crgetauinfo(cr);
51897c478bd9Sstevel@tonic-gate if (ainfo == NULL) {
51907c478bd9Sstevel@tonic-gate crfree(cr);
51917c478bd9Sstevel@tonic-gate return;
51927c478bd9Sstevel@tonic-gate }
51937c478bd9Sstevel@tonic-gate
51947c478bd9Sstevel@tonic-gate uid = crgetuid(cr);
51957c478bd9Sstevel@tonic-gate gid = crgetgid(cr);
51967c478bd9Sstevel@tonic-gate ruid = crgetruid(cr);
51977c478bd9Sstevel@tonic-gate rgid = crgetrgid(cr);
51987c478bd9Sstevel@tonic-gate au_uwrite(au_to_process(uid, gid, ruid, rgid, pid,
51997c478bd9Sstevel@tonic-gate ainfo->ai_auid, ainfo->ai_asid, &ainfo->ai_termid));
52007c478bd9Sstevel@tonic-gate crfree(cr);
52017c478bd9Sstevel@tonic-gate
52027c478bd9Sstevel@tonic-gate break;
52037c478bd9Sstevel@tonic-gate default:
52047c478bd9Sstevel@tonic-gate return;
52057c478bd9Sstevel@tonic-gate }
52067c478bd9Sstevel@tonic-gate
52077c478bd9Sstevel@tonic-gate if (uap->processor_id == PBIND_NONE &&
52087c478bd9Sstevel@tonic-gate (!(uap->id_type == P_LWPID && lwpcnt > 1)))
52097c478bd9Sstevel@tonic-gate au_uwrite(au_to_text("PBIND_NONE for process"));
52107c478bd9Sstevel@tonic-gate else
52117c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(3, "processor_id",
5212745b2690Stz (uint32_t)uap->processor_id));
52137c478bd9Sstevel@tonic-gate }
52147c478bd9Sstevel@tonic-gate
52157c478bd9Sstevel@tonic-gate /*ARGSUSED*/
52167c478bd9Sstevel@tonic-gate static au_event_t
aui_doorfs(au_event_t e)52177c478bd9Sstevel@tonic-gate aui_doorfs(au_event_t e)
52187c478bd9Sstevel@tonic-gate {
52197c478bd9Sstevel@tonic-gate uint32_t code;
52207c478bd9Sstevel@tonic-gate
52217c478bd9Sstevel@tonic-gate struct a { /* doorfs */
52227c478bd9Sstevel@tonic-gate long a1;
52237c478bd9Sstevel@tonic-gate long a2;
52247c478bd9Sstevel@tonic-gate long a3;
52257c478bd9Sstevel@tonic-gate long a4;
52267c478bd9Sstevel@tonic-gate long a5;
52277c478bd9Sstevel@tonic-gate long code;
52287c478bd9Sstevel@tonic-gate } *uap = (struct a *)ttolwp(curthread)->lwp_ap;
52297c478bd9Sstevel@tonic-gate
52307c478bd9Sstevel@tonic-gate /*
52317c478bd9Sstevel@tonic-gate * audit formats for several of the
52327c478bd9Sstevel@tonic-gate * door calls have not yet been determined
52337c478bd9Sstevel@tonic-gate */
52347c478bd9Sstevel@tonic-gate code = (uint32_t)uap->code;
52357c478bd9Sstevel@tonic-gate switch (code) {
52367c478bd9Sstevel@tonic-gate case DOOR_CALL:
52377c478bd9Sstevel@tonic-gate e = AUE_DOORFS_DOOR_CALL;
52387c478bd9Sstevel@tonic-gate break;
52397c478bd9Sstevel@tonic-gate case DOOR_RETURN:
52407c478bd9Sstevel@tonic-gate e = AUE_NULL;
52417c478bd9Sstevel@tonic-gate break;
52427c478bd9Sstevel@tonic-gate case DOOR_CREATE:
52437c478bd9Sstevel@tonic-gate e = AUE_DOORFS_DOOR_CREATE;
52447c478bd9Sstevel@tonic-gate break;
52457c478bd9Sstevel@tonic-gate case DOOR_REVOKE:
52467c478bd9Sstevel@tonic-gate e = AUE_DOORFS_DOOR_REVOKE;
52477c478bd9Sstevel@tonic-gate break;
52487c478bd9Sstevel@tonic-gate case DOOR_INFO:
52497c478bd9Sstevel@tonic-gate e = AUE_NULL;
52507c478bd9Sstevel@tonic-gate break;
52517c478bd9Sstevel@tonic-gate case DOOR_UCRED:
52527c478bd9Sstevel@tonic-gate e = AUE_NULL;
52537c478bd9Sstevel@tonic-gate break;
52547c478bd9Sstevel@tonic-gate case DOOR_BIND:
52557c478bd9Sstevel@tonic-gate e = AUE_NULL;
52567c478bd9Sstevel@tonic-gate break;
52577c478bd9Sstevel@tonic-gate case DOOR_UNBIND:
52587c478bd9Sstevel@tonic-gate e = AUE_NULL;
52597c478bd9Sstevel@tonic-gate break;
52607c478bd9Sstevel@tonic-gate case DOOR_GETPARAM:
52617c478bd9Sstevel@tonic-gate e = AUE_NULL;
52627c478bd9Sstevel@tonic-gate break;
52637c478bd9Sstevel@tonic-gate case DOOR_SETPARAM:
52647c478bd9Sstevel@tonic-gate e = AUE_NULL;
52657c478bd9Sstevel@tonic-gate break;
52667c478bd9Sstevel@tonic-gate default: /* illegal system call */
52677c478bd9Sstevel@tonic-gate e = AUE_NULL;
52687c478bd9Sstevel@tonic-gate break;
52697c478bd9Sstevel@tonic-gate }
52707c478bd9Sstevel@tonic-gate
52717c478bd9Sstevel@tonic-gate return (e);
52727c478bd9Sstevel@tonic-gate }
52737c478bd9Sstevel@tonic-gate
52747c478bd9Sstevel@tonic-gate static door_node_t *
au_door_lookup(int did)52757c478bd9Sstevel@tonic-gate au_door_lookup(int did)
52767c478bd9Sstevel@tonic-gate {
52777c478bd9Sstevel@tonic-gate vnode_t *vp;
52787c478bd9Sstevel@tonic-gate file_t *fp;
52797c478bd9Sstevel@tonic-gate
52807c478bd9Sstevel@tonic-gate if ((fp = getf(did)) == NULL)
52817c478bd9Sstevel@tonic-gate return (NULL);
52827c478bd9Sstevel@tonic-gate /*
52837c478bd9Sstevel@tonic-gate * Use the underlying vnode (we may be namefs mounted)
52847c478bd9Sstevel@tonic-gate */
5285da6c28aaSamw if (VOP_REALVP(fp->f_vnode, &vp, NULL))
52867c478bd9Sstevel@tonic-gate vp = fp->f_vnode;
52877c478bd9Sstevel@tonic-gate
52887c478bd9Sstevel@tonic-gate if (vp == NULL || vp->v_type != VDOOR) {
52897c478bd9Sstevel@tonic-gate releasef(did);
52907c478bd9Sstevel@tonic-gate return (NULL);
52917c478bd9Sstevel@tonic-gate }
52927c478bd9Sstevel@tonic-gate
52937c478bd9Sstevel@tonic-gate return (VTOD(vp));
52947c478bd9Sstevel@tonic-gate }
52957c478bd9Sstevel@tonic-gate
52967c478bd9Sstevel@tonic-gate /*ARGSUSED*/
52977c478bd9Sstevel@tonic-gate static void
aus_doorfs(struct t_audit_data * tad)52987c478bd9Sstevel@tonic-gate aus_doorfs(struct t_audit_data *tad)
52997c478bd9Sstevel@tonic-gate {
53007c478bd9Sstevel@tonic-gate
53017c478bd9Sstevel@tonic-gate struct a { /* doorfs */
53027c478bd9Sstevel@tonic-gate long a1;
53037c478bd9Sstevel@tonic-gate long a2;
53047c478bd9Sstevel@tonic-gate long a3;
53057c478bd9Sstevel@tonic-gate long a4;
53067c478bd9Sstevel@tonic-gate long a5;
53077c478bd9Sstevel@tonic-gate long code;
53087c478bd9Sstevel@tonic-gate } *uap = (struct a *)ttolwp(curthread)->lwp_ap;
53097c478bd9Sstevel@tonic-gate
53107c478bd9Sstevel@tonic-gate door_node_t *dp;
53117c478bd9Sstevel@tonic-gate struct proc *p;
53127c478bd9Sstevel@tonic-gate uint32_t did;
53137c478bd9Sstevel@tonic-gate uid_t uid, ruid;
53147c478bd9Sstevel@tonic-gate gid_t gid, rgid;
53157c478bd9Sstevel@tonic-gate pid_t pid;
53167c478bd9Sstevel@tonic-gate const auditinfo_addr_t *ainfo;
53177c478bd9Sstevel@tonic-gate cred_t *cr;
53187c478bd9Sstevel@tonic-gate
53197c478bd9Sstevel@tonic-gate did = (uint32_t)uap->a1;
53207c478bd9Sstevel@tonic-gate
53217c478bd9Sstevel@tonic-gate switch (tad->tad_event) {
53227c478bd9Sstevel@tonic-gate case AUE_DOORFS_DOOR_CALL:
53237c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "door ID", (uint32_t)did));
53247c478bd9Sstevel@tonic-gate if ((dp = au_door_lookup(did)) == NULL)
53257c478bd9Sstevel@tonic-gate break;
53267c478bd9Sstevel@tonic-gate
53277c478bd9Sstevel@tonic-gate if (DOOR_INVALID(dp)) {
53287c478bd9Sstevel@tonic-gate releasef(did);
53297c478bd9Sstevel@tonic-gate break;
53307c478bd9Sstevel@tonic-gate }
53317c478bd9Sstevel@tonic-gate
53327c478bd9Sstevel@tonic-gate if ((p = dp->door_target) == NULL) {
53337c478bd9Sstevel@tonic-gate releasef(did);
53347c478bd9Sstevel@tonic-gate break;
53357c478bd9Sstevel@tonic-gate }
53367c478bd9Sstevel@tonic-gate mutex_enter(&p->p_lock);
53377c478bd9Sstevel@tonic-gate releasef(did);
53387c478bd9Sstevel@tonic-gate
53397c478bd9Sstevel@tonic-gate pid = p->p_pid;
53407c478bd9Sstevel@tonic-gate
53417c478bd9Sstevel@tonic-gate mutex_enter(&p->p_crlock);
53427c478bd9Sstevel@tonic-gate crhold(cr = p->p_cred);
53437c478bd9Sstevel@tonic-gate mutex_exit(&p->p_crlock);
53447c478bd9Sstevel@tonic-gate mutex_exit(&p->p_lock);
53457c478bd9Sstevel@tonic-gate
53467c478bd9Sstevel@tonic-gate ainfo = crgetauinfo(cr);
53477c478bd9Sstevel@tonic-gate if (ainfo == NULL) {
53487c478bd9Sstevel@tonic-gate crfree(cr);
53497c478bd9Sstevel@tonic-gate return;
53507c478bd9Sstevel@tonic-gate }
53517c478bd9Sstevel@tonic-gate uid = crgetuid(cr);
53527c478bd9Sstevel@tonic-gate gid = crgetgid(cr);
53537c478bd9Sstevel@tonic-gate ruid = crgetruid(cr);
53547c478bd9Sstevel@tonic-gate rgid = crgetrgid(cr);
53557c478bd9Sstevel@tonic-gate au_uwrite(au_to_process(uid, gid, ruid, rgid, pid,
53567c478bd9Sstevel@tonic-gate ainfo->ai_auid, ainfo->ai_asid, &ainfo->ai_termid));
53577c478bd9Sstevel@tonic-gate crfree(cr);
53587c478bd9Sstevel@tonic-gate break;
53597c478bd9Sstevel@tonic-gate case AUE_DOORFS_DOOR_RETURN:
53607c478bd9Sstevel@tonic-gate /*
53617c478bd9Sstevel@tonic-gate * We may want to write information about
53627c478bd9Sstevel@tonic-gate * all doors (if any) which will be copied
53637c478bd9Sstevel@tonic-gate * by this call to the user space
53647c478bd9Sstevel@tonic-gate */
53657c478bd9Sstevel@tonic-gate break;
53667c478bd9Sstevel@tonic-gate case AUE_DOORFS_DOOR_CREATE:
53677c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(3, "door attr", (uint32_t)uap->a3));
53687c478bd9Sstevel@tonic-gate break;
53697c478bd9Sstevel@tonic-gate case AUE_DOORFS_DOOR_REVOKE:
53707c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "door ID", (uint32_t)did));
53717c478bd9Sstevel@tonic-gate break;
53727c478bd9Sstevel@tonic-gate case AUE_DOORFS_DOOR_INFO:
53737c478bd9Sstevel@tonic-gate break;
53747c478bd9Sstevel@tonic-gate case AUE_DOORFS_DOOR_CRED:
53757c478bd9Sstevel@tonic-gate break;
53767c478bd9Sstevel@tonic-gate case AUE_DOORFS_DOOR_BIND:
53777c478bd9Sstevel@tonic-gate break;
53787c478bd9Sstevel@tonic-gate case AUE_DOORFS_DOOR_UNBIND: {
53797c478bd9Sstevel@tonic-gate break;
53807c478bd9Sstevel@tonic-gate }
53817c478bd9Sstevel@tonic-gate default: /* illegal system call */
53827c478bd9Sstevel@tonic-gate break;
53837c478bd9Sstevel@tonic-gate }
53847c478bd9Sstevel@tonic-gate }
53857c478bd9Sstevel@tonic-gate
53867c478bd9Sstevel@tonic-gate /*ARGSUSED*/
53877c478bd9Sstevel@tonic-gate static au_event_t
aui_acl(au_event_t e)53887c478bd9Sstevel@tonic-gate aui_acl(au_event_t e)
53897c478bd9Sstevel@tonic-gate {
53907c478bd9Sstevel@tonic-gate struct a {
53917c478bd9Sstevel@tonic-gate union {
53927c478bd9Sstevel@tonic-gate long name; /* char */
53937c478bd9Sstevel@tonic-gate long fd;
53947c478bd9Sstevel@tonic-gate } obj;
53957c478bd9Sstevel@tonic-gate
53967c478bd9Sstevel@tonic-gate long cmd;
53977c478bd9Sstevel@tonic-gate long nentries;
53987c478bd9Sstevel@tonic-gate long arg; /* aclent_t */
53997c478bd9Sstevel@tonic-gate } *uap = (struct a *)ttolwp(curthread)->lwp_ap;
54007c478bd9Sstevel@tonic-gate
54017c478bd9Sstevel@tonic-gate switch (uap->cmd) {
54027c478bd9Sstevel@tonic-gate case SETACL:
5403a7746f66Stz case ACE_SETACL:
5404a7746f66Stz /*
5405a7746f66Stz * acl(SETACL/ACE_SETACL, ...) and facl(SETACL/ACE_SETACL, ...)
5406a7746f66Stz * are expected.
5407a7746f66Stz */
54087c478bd9Sstevel@tonic-gate break;
54097c478bd9Sstevel@tonic-gate case GETACL:
54107c478bd9Sstevel@tonic-gate case GETACLCNT:
5411ebbb0311SJan Friedel case ACE_GETACL:
5412a7746f66Stz case ACE_GETACLCNT:
5413ebbb0311SJan Friedel /* do nothing for these four values. */
54147c478bd9Sstevel@tonic-gate e = AUE_NULL;
54157c478bd9Sstevel@tonic-gate break;
54167c478bd9Sstevel@tonic-gate default:
54177c478bd9Sstevel@tonic-gate /* illegal system call */
54187c478bd9Sstevel@tonic-gate break;
54197c478bd9Sstevel@tonic-gate }
54207c478bd9Sstevel@tonic-gate
54217c478bd9Sstevel@tonic-gate return (e);
54227c478bd9Sstevel@tonic-gate }
54237c478bd9Sstevel@tonic-gate
54247c478bd9Sstevel@tonic-gate static void
au_acl(int cmd,int nentries,caddr_t bufp)5425a7746f66Stz au_acl(int cmd, int nentries, caddr_t bufp)
54267c478bd9Sstevel@tonic-gate {
5427a7746f66Stz size_t a_size;
5428a7746f66Stz aclent_t *aclbufp;
5429a7746f66Stz ace_t *acebufp;
5430a7746f66Stz int i;
54317c478bd9Sstevel@tonic-gate
5432a7746f66Stz switch (cmd) {
54337c478bd9Sstevel@tonic-gate case GETACL:
54347c478bd9Sstevel@tonic-gate case GETACLCNT:
54357c478bd9Sstevel@tonic-gate break;
54367c478bd9Sstevel@tonic-gate case SETACL:
5437a7746f66Stz if (nentries < 3)
5438745b2690Stz break;
54397c478bd9Sstevel@tonic-gate
5440a7746f66Stz a_size = nentries * sizeof (aclent_t);
5441a7746f66Stz
5442a7746f66Stz if ((aclbufp = kmem_alloc(a_size, KM_SLEEP)) == NULL)
5443a7746f66Stz break;
5444a7746f66Stz if (copyin(bufp, aclbufp, a_size)) {
54457c478bd9Sstevel@tonic-gate kmem_free(aclbufp, a_size);
54467c478bd9Sstevel@tonic-gate break;
54477c478bd9Sstevel@tonic-gate }
5448a7746f66Stz for (i = 0; i < nentries; i++) {
5449a7746f66Stz au_uwrite(au_to_acl(aclbufp + i));
5450a7746f66Stz }
5451a7746f66Stz kmem_free(aclbufp, a_size);
5452a7746f66Stz break;
5453a7746f66Stz
5454a7746f66Stz case ACE_SETACL:
5455a7746f66Stz if (nentries < 1 || nentries > MAX_ACL_ENTRIES)
5456a7746f66Stz break;
5457a7746f66Stz
5458a7746f66Stz a_size = nentries * sizeof (ace_t);
5459a7746f66Stz if ((acebufp = kmem_alloc(a_size, KM_SLEEP)) == NULL)
5460a7746f66Stz break;
5461a7746f66Stz if (copyin(bufp, acebufp, a_size)) {
5462a7746f66Stz kmem_free(acebufp, a_size);
5463a7746f66Stz break;
5464a7746f66Stz }
5465a7746f66Stz for (i = 0; i < nentries; i++) {
5466a7746f66Stz au_uwrite(au_to_ace(acebufp + i));
5467a7746f66Stz }
5468a7746f66Stz kmem_free(acebufp, a_size);
5469a7746f66Stz break;
54707c478bd9Sstevel@tonic-gate default:
54717c478bd9Sstevel@tonic-gate break;
54727c478bd9Sstevel@tonic-gate }
54737c478bd9Sstevel@tonic-gate }
54747c478bd9Sstevel@tonic-gate
5475a7746f66Stz /*ARGSUSED*/
5476a7746f66Stz static void
aus_acl(struct t_audit_data * tad)5477a7746f66Stz aus_acl(struct t_audit_data *tad)
5478a7746f66Stz {
5479a7746f66Stz struct a {
5480a7746f66Stz long fname;
5481a7746f66Stz long cmd;
5482a7746f66Stz long nentries;
5483a7746f66Stz long aclbufp;
5484a7746f66Stz } *uap = (struct a *)ttolwp(curthread)->lwp_ap;
5485a7746f66Stz
5486a7746f66Stz au_uwrite(au_to_arg32(2, "cmd", (uint32_t)uap->cmd));
5487a7746f66Stz au_uwrite(au_to_arg32(3, "nentries", (uint32_t)uap->nentries));
5488a7746f66Stz
5489a7746f66Stz au_acl(uap->cmd, uap->nentries, (caddr_t)uap->aclbufp);
5490a7746f66Stz }
5491a7746f66Stz
54927c478bd9Sstevel@tonic-gate /*ARGSUSED*/
54937c478bd9Sstevel@tonic-gate static void
aus_facl(struct t_audit_data * tad)54947c478bd9Sstevel@tonic-gate aus_facl(struct t_audit_data *tad)
54957c478bd9Sstevel@tonic-gate {
54967c478bd9Sstevel@tonic-gate struct a {
54977c478bd9Sstevel@tonic-gate long fd;
54987c478bd9Sstevel@tonic-gate long cmd;
54997c478bd9Sstevel@tonic-gate long nentries;
55007c478bd9Sstevel@tonic-gate long aclbufp;
55017c478bd9Sstevel@tonic-gate } *uap = (struct a *)ttolwp(curthread)->lwp_ap;
55027c478bd9Sstevel@tonic-gate struct file *fp;
55037c478bd9Sstevel@tonic-gate struct vnode *vp;
55047c478bd9Sstevel@tonic-gate struct f_audit_data *fad;
55057c478bd9Sstevel@tonic-gate int fd;
55067c478bd9Sstevel@tonic-gate
55077c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(2, "cmd", (uint32_t)uap->cmd));
55087c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(3, "nentries", (uint32_t)uap->nentries));
55097c478bd9Sstevel@tonic-gate
55107c478bd9Sstevel@tonic-gate fd = (int)uap->fd;
55117c478bd9Sstevel@tonic-gate
55127c478bd9Sstevel@tonic-gate if ((fp = getf(fd)) == NULL)
55137c478bd9Sstevel@tonic-gate return;
55147c478bd9Sstevel@tonic-gate
55157c478bd9Sstevel@tonic-gate /* get path from file struct here */
55167c478bd9Sstevel@tonic-gate fad = F2A(fp);
55177c478bd9Sstevel@tonic-gate if (fad->fad_aupath != NULL) {
55187c478bd9Sstevel@tonic-gate au_uwrite(au_to_path(fad->fad_aupath));
55197c478bd9Sstevel@tonic-gate } else {
55207c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "no path: fd", (uint32_t)fd));
55217c478bd9Sstevel@tonic-gate }
55227c478bd9Sstevel@tonic-gate
55237c478bd9Sstevel@tonic-gate vp = fp->f_vnode;
55247c478bd9Sstevel@tonic-gate audit_attributes(vp);
55257c478bd9Sstevel@tonic-gate
55267c478bd9Sstevel@tonic-gate /* decrement file descriptor reference count */
55277c478bd9Sstevel@tonic-gate releasef(fd);
55287c478bd9Sstevel@tonic-gate
5529a7746f66Stz au_acl(uap->cmd, uap->nentries, (caddr_t)uap->aclbufp);
55307c478bd9Sstevel@tonic-gate }
55317c478bd9Sstevel@tonic-gate
55327c478bd9Sstevel@tonic-gate /*ARGSUSED*/
55337c478bd9Sstevel@tonic-gate static void
auf_read(struct t_audit_data * tad,int error,rval_t * rval)55340f48f68dSToomas Soome auf_read(struct t_audit_data *tad, int error, rval_t *rval)
55357c478bd9Sstevel@tonic-gate {
55367c478bd9Sstevel@tonic-gate struct file *fp;
55377c478bd9Sstevel@tonic-gate struct f_audit_data *fad;
55387c478bd9Sstevel@tonic-gate int fd;
55397c478bd9Sstevel@tonic-gate register struct a {
55407c478bd9Sstevel@tonic-gate long fd;
55417c478bd9Sstevel@tonic-gate } *uap = (struct a *)ttolwp(curthread)->lwp_ap;
55429e9e6ab8Spaulson au_kcontext_t *kctx = GET_KCTX_PZ;
55437c478bd9Sstevel@tonic-gate
55447c478bd9Sstevel@tonic-gate fd = (int)uap->fd;
55457c478bd9Sstevel@tonic-gate
55467c478bd9Sstevel@tonic-gate /*
55477c478bd9Sstevel@tonic-gate * convert file pointer to file descriptor
55487c478bd9Sstevel@tonic-gate * Note: fd ref count incremented here.
55497c478bd9Sstevel@tonic-gate */
55507c478bd9Sstevel@tonic-gate if ((fp = getf(fd)) == NULL)
55517c478bd9Sstevel@tonic-gate return;
55527c478bd9Sstevel@tonic-gate
55537c478bd9Sstevel@tonic-gate /* get path from file struct here */
55547c478bd9Sstevel@tonic-gate fad = F2A(fp);
55557c478bd9Sstevel@tonic-gate ASSERT(fad);
55567c478bd9Sstevel@tonic-gate
55577c478bd9Sstevel@tonic-gate /*
55587c478bd9Sstevel@tonic-gate * already processed this file for read attempt
55597c478bd9Sstevel@tonic-gate *
55607c478bd9Sstevel@tonic-gate * XXX might be better to turn off auditing in a aui_read() routine.
55617c478bd9Sstevel@tonic-gate */
55627c478bd9Sstevel@tonic-gate if (fad->fad_flags & FAD_READ) {
55637c478bd9Sstevel@tonic-gate /* don't really want to audit every read attempt */
55647c478bd9Sstevel@tonic-gate tad->tad_flag = 0;
55657c478bd9Sstevel@tonic-gate /* free any residual audit data */
5566005d3febSMarek Pospisil au_close(kctx, &(u_ad), 0, 0, 0, NULL);
55677c478bd9Sstevel@tonic-gate releasef(fd);
55687c478bd9Sstevel@tonic-gate return;
55697c478bd9Sstevel@tonic-gate }
55707c478bd9Sstevel@tonic-gate /* mark things so we know what happened and don't repeat things */
55717c478bd9Sstevel@tonic-gate fad->fad_flags |= FAD_READ;
55727c478bd9Sstevel@tonic-gate
55737c478bd9Sstevel@tonic-gate if (fad->fad_aupath != NULL) {
55747c478bd9Sstevel@tonic-gate au_uwrite(au_to_path(fad->fad_aupath));
55757c478bd9Sstevel@tonic-gate } else {
55767c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "no path: fd", (uint32_t)fd));
55777c478bd9Sstevel@tonic-gate }
55787c478bd9Sstevel@tonic-gate
55797c478bd9Sstevel@tonic-gate /* include attributes */
55807c478bd9Sstevel@tonic-gate audit_attributes(fp->f_vnode);
55817c478bd9Sstevel@tonic-gate
55827c478bd9Sstevel@tonic-gate /* decrement file descriptor reference count */
55837c478bd9Sstevel@tonic-gate releasef(fd);
55847c478bd9Sstevel@tonic-gate }
55857c478bd9Sstevel@tonic-gate
55867c478bd9Sstevel@tonic-gate /*ARGSUSED*/
55877c478bd9Sstevel@tonic-gate static void
auf_write(struct t_audit_data * tad,int error,rval_t * rval)55880f48f68dSToomas Soome auf_write(struct t_audit_data *tad, int error, rval_t *rval)
55897c478bd9Sstevel@tonic-gate {
55907c478bd9Sstevel@tonic-gate struct file *fp;
55917c478bd9Sstevel@tonic-gate struct f_audit_data *fad;
55927c478bd9Sstevel@tonic-gate int fd;
55937c478bd9Sstevel@tonic-gate register struct a {
55947c478bd9Sstevel@tonic-gate long fd;
55957c478bd9Sstevel@tonic-gate } *uap = (struct a *)ttolwp(curthread)->lwp_ap;
55969e9e6ab8Spaulson au_kcontext_t *kctx = GET_KCTX_PZ;
55977c478bd9Sstevel@tonic-gate
55987c478bd9Sstevel@tonic-gate fd = (int)uap->fd;
55997c478bd9Sstevel@tonic-gate
56007c478bd9Sstevel@tonic-gate /*
56017c478bd9Sstevel@tonic-gate * convert file pointer to file descriptor
56027c478bd9Sstevel@tonic-gate * Note: fd ref count incremented here.
56037c478bd9Sstevel@tonic-gate */
56047c478bd9Sstevel@tonic-gate if ((fp = getf(fd)) == NULL)
56057c478bd9Sstevel@tonic-gate return;
56067c478bd9Sstevel@tonic-gate
56077c478bd9Sstevel@tonic-gate /* get path from file struct here */
56087c478bd9Sstevel@tonic-gate fad = F2A(fp);
56097c478bd9Sstevel@tonic-gate ASSERT(fad);
56107c478bd9Sstevel@tonic-gate
56117c478bd9Sstevel@tonic-gate /*
56127c478bd9Sstevel@tonic-gate * already processed this file for write attempt
56137c478bd9Sstevel@tonic-gate *
56147c478bd9Sstevel@tonic-gate * XXX might be better to turn off auditing in a aus_write() routine.
56157c478bd9Sstevel@tonic-gate */
56167c478bd9Sstevel@tonic-gate if (fad->fad_flags & FAD_WRITE) {
56177c478bd9Sstevel@tonic-gate /* don't really want to audit every write attempt */
56187c478bd9Sstevel@tonic-gate tad->tad_flag = 0;
56197c478bd9Sstevel@tonic-gate /* free any residual audit data */
5620005d3febSMarek Pospisil au_close(kctx, &(u_ad), 0, 0, 0, NULL);
56217c478bd9Sstevel@tonic-gate releasef(fd);
56227c478bd9Sstevel@tonic-gate return;
56237c478bd9Sstevel@tonic-gate }
56247c478bd9Sstevel@tonic-gate /* mark things so we know what happened and don't repeat things */
56257c478bd9Sstevel@tonic-gate fad->fad_flags |= FAD_WRITE;
56267c478bd9Sstevel@tonic-gate
56277c478bd9Sstevel@tonic-gate if (fad->fad_aupath != NULL) {
56287c478bd9Sstevel@tonic-gate au_uwrite(au_to_path(fad->fad_aupath));
56297c478bd9Sstevel@tonic-gate } else {
56307c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "no path: fd", (uint32_t)fd));
56317c478bd9Sstevel@tonic-gate }
56327c478bd9Sstevel@tonic-gate
56337c478bd9Sstevel@tonic-gate /* include attributes */
56347c478bd9Sstevel@tonic-gate audit_attributes(fp->f_vnode);
56357c478bd9Sstevel@tonic-gate
56367c478bd9Sstevel@tonic-gate /* decrement file descriptor reference count */
56377c478bd9Sstevel@tonic-gate releasef(fd);
56387c478bd9Sstevel@tonic-gate }
56397c478bd9Sstevel@tonic-gate
56407c478bd9Sstevel@tonic-gate /*ARGSUSED*/
56417c478bd9Sstevel@tonic-gate static void
auf_recv(struct t_audit_data * tad,int error,rval_t * rval)56420f48f68dSToomas Soome auf_recv(struct t_audit_data *tad, int error, rval_t *rval)
56437c478bd9Sstevel@tonic-gate {
56447c478bd9Sstevel@tonic-gate struct sonode *so;
56457c478bd9Sstevel@tonic-gate char so_laddr[sizeof (struct sockaddr_in6)];
56467c478bd9Sstevel@tonic-gate char so_faddr[sizeof (struct sockaddr_in6)];
56477c478bd9Sstevel@tonic-gate struct file *fp;
56487c478bd9Sstevel@tonic-gate struct f_audit_data *fad;
56497c478bd9Sstevel@tonic-gate int fd;
56507c478bd9Sstevel@tonic-gate int err;
56510f1702c5SYu Xiangning socklen_t len;
56527c478bd9Sstevel@tonic-gate short so_family, so_type;
56537c478bd9Sstevel@tonic-gate register struct a {
56547c478bd9Sstevel@tonic-gate long fd;
56557c478bd9Sstevel@tonic-gate } *uap = (struct a *)ttolwp(curthread)->lwp_ap;
56569e9e6ab8Spaulson au_kcontext_t *kctx = GET_KCTX_PZ;
56577c478bd9Sstevel@tonic-gate
56587c478bd9Sstevel@tonic-gate /*
56597c478bd9Sstevel@tonic-gate * If there was an error, then nothing to do. Only generate
56607c478bd9Sstevel@tonic-gate * audit record on first successful recv.
56617c478bd9Sstevel@tonic-gate */
56627c478bd9Sstevel@tonic-gate if (error) {
56637c478bd9Sstevel@tonic-gate /* Turn off audit record generation here. */
56647c478bd9Sstevel@tonic-gate tad->tad_flag = 0;
56657c478bd9Sstevel@tonic-gate /* free any residual audit data */
5666005d3febSMarek Pospisil au_close(kctx, &(u_ad), 0, 0, 0, NULL);
56677c478bd9Sstevel@tonic-gate return;
56687c478bd9Sstevel@tonic-gate }
56697c478bd9Sstevel@tonic-gate
56707c478bd9Sstevel@tonic-gate fd = (int)uap->fd;
56717c478bd9Sstevel@tonic-gate
5672745b2690Stz if ((so = getsonode(fd, &err, &fp)) == NULL) {
56737c478bd9Sstevel@tonic-gate /* Turn off audit record generation here. */
56747c478bd9Sstevel@tonic-gate tad->tad_flag = 0;
56757c478bd9Sstevel@tonic-gate /* free any residual audit data */
5676005d3febSMarek Pospisil au_close(kctx, &(u_ad), 0, 0, 0, NULL);
56777c478bd9Sstevel@tonic-gate return;
56787c478bd9Sstevel@tonic-gate }
56797c478bd9Sstevel@tonic-gate
56807c478bd9Sstevel@tonic-gate /* get path from file struct here */
56817c478bd9Sstevel@tonic-gate fad = F2A(fp);
56827c478bd9Sstevel@tonic-gate ASSERT(fad);
56837c478bd9Sstevel@tonic-gate
56847c478bd9Sstevel@tonic-gate /*
56857c478bd9Sstevel@tonic-gate * already processed this file for read attempt
56867c478bd9Sstevel@tonic-gate */
56877c478bd9Sstevel@tonic-gate if (fad->fad_flags & FAD_READ) {
56887c478bd9Sstevel@tonic-gate releasef(fd);
56897c478bd9Sstevel@tonic-gate /* don't really want to audit every recv call */
56907c478bd9Sstevel@tonic-gate tad->tad_flag = 0;
56917c478bd9Sstevel@tonic-gate /* free any residual audit data */
5692005d3febSMarek Pospisil au_close(kctx, &(u_ad), 0, 0, 0, NULL);
56937c478bd9Sstevel@tonic-gate return;
56947c478bd9Sstevel@tonic-gate }
56957c478bd9Sstevel@tonic-gate
56967c478bd9Sstevel@tonic-gate /* mark things so we know what happened and don't repeat things */
56977c478bd9Sstevel@tonic-gate fad->fad_flags |= FAD_READ;
56987c478bd9Sstevel@tonic-gate
56997c478bd9Sstevel@tonic-gate so_family = so->so_family;
57007c478bd9Sstevel@tonic-gate so_type = so->so_type;
57017c478bd9Sstevel@tonic-gate
57027c478bd9Sstevel@tonic-gate switch (so_family) {
57037c478bd9Sstevel@tonic-gate case AF_INET:
57047c478bd9Sstevel@tonic-gate case AF_INET6:
57057c478bd9Sstevel@tonic-gate /*
57067c478bd9Sstevel@tonic-gate * Only for connections.
57077c478bd9Sstevel@tonic-gate * XXX - do we need to worry about SOCK_DGRAM or other types???
57087c478bd9Sstevel@tonic-gate */
57097c478bd9Sstevel@tonic-gate if (so->so_state & SS_ISBOUND) {
57107c478bd9Sstevel@tonic-gate
57117c478bd9Sstevel@tonic-gate bzero((void *)so_laddr, sizeof (so_laddr));
57127c478bd9Sstevel@tonic-gate bzero((void *)so_faddr, sizeof (so_faddr));
57137c478bd9Sstevel@tonic-gate
57147c478bd9Sstevel@tonic-gate /* get local and foreign addresses */
57150f1702c5SYu Xiangning len = sizeof (so_laddr);
57160f1702c5SYu Xiangning (void) socket_getsockname(so,
57170f1702c5SYu Xiangning (struct sockaddr *)so_laddr, &len, CRED());
57180f1702c5SYu Xiangning len = sizeof (so_faddr);
57190f1702c5SYu Xiangning (void) socket_getpeername(so,
57200f1702c5SYu Xiangning (struct sockaddr *)so_faddr, &len, B_FALSE, CRED());
57217c478bd9Sstevel@tonic-gate
57227c478bd9Sstevel@tonic-gate /*
57237c478bd9Sstevel@tonic-gate * only way to drop out of switch. Note that we
57247c478bd9Sstevel@tonic-gate * we release fd below.
57257c478bd9Sstevel@tonic-gate */
57267c478bd9Sstevel@tonic-gate
57277c478bd9Sstevel@tonic-gate break;
57287c478bd9Sstevel@tonic-gate }
57297c478bd9Sstevel@tonic-gate
57307c478bd9Sstevel@tonic-gate releasef(fd);
57317c478bd9Sstevel@tonic-gate
57327c478bd9Sstevel@tonic-gate /* don't really want to audit every recv call */
57337c478bd9Sstevel@tonic-gate tad->tad_flag = 0;
57347c478bd9Sstevel@tonic-gate /* free any residual audit data */
5735005d3febSMarek Pospisil au_close(kctx, &(u_ad), 0, 0, 0, NULL);
57367c478bd9Sstevel@tonic-gate
57377c478bd9Sstevel@tonic-gate return;
57387c478bd9Sstevel@tonic-gate
57397c478bd9Sstevel@tonic-gate case AF_UNIX:
57407c478bd9Sstevel@tonic-gate
57417c478bd9Sstevel@tonic-gate if (fad->fad_aupath != NULL) {
57427c478bd9Sstevel@tonic-gate au_uwrite(au_to_path(fad->fad_aupath));
57437c478bd9Sstevel@tonic-gate } else {
57447c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "no path: fd", fd));
57457c478bd9Sstevel@tonic-gate }
57467c478bd9Sstevel@tonic-gate
57477c478bd9Sstevel@tonic-gate audit_attributes(fp->f_vnode);
57487c478bd9Sstevel@tonic-gate
57497c478bd9Sstevel@tonic-gate releasef(fd);
57507c478bd9Sstevel@tonic-gate
57517c478bd9Sstevel@tonic-gate return;
57527c478bd9Sstevel@tonic-gate
57537c478bd9Sstevel@tonic-gate default:
57547c478bd9Sstevel@tonic-gate releasef(fd);
57557c478bd9Sstevel@tonic-gate
57567c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
57577c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "family", (uint32_t)so_family));
57587c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "type", (uint32_t)so_type));
57597c478bd9Sstevel@tonic-gate
57607c478bd9Sstevel@tonic-gate return;
57617c478bd9Sstevel@tonic-gate }
57627c478bd9Sstevel@tonic-gate
57637c478bd9Sstevel@tonic-gate releasef(fd);
57647c478bd9Sstevel@tonic-gate
57657c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
57667c478bd9Sstevel@tonic-gate
57677c478bd9Sstevel@tonic-gate au_uwrite(au_to_socket_ex(so_family, so_type, so_laddr, so_faddr));
57687c478bd9Sstevel@tonic-gate
57697c478bd9Sstevel@tonic-gate }
57707c478bd9Sstevel@tonic-gate
57717c478bd9Sstevel@tonic-gate /*ARGSUSED*/
57727c478bd9Sstevel@tonic-gate static void
auf_send(struct t_audit_data * tad,int error,rval_t * rval)57730f48f68dSToomas Soome auf_send(struct t_audit_data *tad, int error, rval_t *rval)
57747c478bd9Sstevel@tonic-gate {
57757c478bd9Sstevel@tonic-gate struct sonode *so;
57767c478bd9Sstevel@tonic-gate char so_laddr[sizeof (struct sockaddr_in6)];
57777c478bd9Sstevel@tonic-gate char so_faddr[sizeof (struct sockaddr_in6)];
57787c478bd9Sstevel@tonic-gate struct file *fp;
57797c478bd9Sstevel@tonic-gate struct f_audit_data *fad;
57807c478bd9Sstevel@tonic-gate int fd;
57817c478bd9Sstevel@tonic-gate int err;
57820f1702c5SYu Xiangning socklen_t len;
57837c478bd9Sstevel@tonic-gate short so_family, so_type;
57847c478bd9Sstevel@tonic-gate register struct a {
57857c478bd9Sstevel@tonic-gate long fd;
57867c478bd9Sstevel@tonic-gate } *uap = (struct a *)ttolwp(curthread)->lwp_ap;
57879e9e6ab8Spaulson au_kcontext_t *kctx = GET_KCTX_PZ;
57887c478bd9Sstevel@tonic-gate
57897c478bd9Sstevel@tonic-gate fd = (int)uap->fd;
57907c478bd9Sstevel@tonic-gate
57917c478bd9Sstevel@tonic-gate /*
57927c478bd9Sstevel@tonic-gate * If there was an error, then nothing to do. Only generate
57937c478bd9Sstevel@tonic-gate * audit record on first successful send.
57947c478bd9Sstevel@tonic-gate */
57957c478bd9Sstevel@tonic-gate if (error != 0) {
57967c478bd9Sstevel@tonic-gate /* Turn off audit record generation here. */
57977c478bd9Sstevel@tonic-gate tad->tad_flag = 0;
57987c478bd9Sstevel@tonic-gate /* free any residual audit data */
5799005d3febSMarek Pospisil au_close(kctx, &(u_ad), 0, 0, 0, NULL);
58007c478bd9Sstevel@tonic-gate return;
58017c478bd9Sstevel@tonic-gate }
58027c478bd9Sstevel@tonic-gate
58037c478bd9Sstevel@tonic-gate fd = (int)uap->fd;
58047c478bd9Sstevel@tonic-gate
5805745b2690Stz if ((so = getsonode(fd, &err, &fp)) == NULL) {
58067c478bd9Sstevel@tonic-gate /* Turn off audit record generation here. */
58077c478bd9Sstevel@tonic-gate tad->tad_flag = 0;
58087c478bd9Sstevel@tonic-gate /* free any residual audit data */
5809005d3febSMarek Pospisil au_close(kctx, &(u_ad), 0, 0, 0, NULL);
58107c478bd9Sstevel@tonic-gate return;
58117c478bd9Sstevel@tonic-gate }
58127c478bd9Sstevel@tonic-gate
58137c478bd9Sstevel@tonic-gate /* get path from file struct here */
58147c478bd9Sstevel@tonic-gate fad = F2A(fp);
58157c478bd9Sstevel@tonic-gate ASSERT(fad);
58167c478bd9Sstevel@tonic-gate
58177c478bd9Sstevel@tonic-gate /*
58187c478bd9Sstevel@tonic-gate * already processed this file for write attempt
58197c478bd9Sstevel@tonic-gate */
58207c478bd9Sstevel@tonic-gate if (fad->fad_flags & FAD_WRITE) {
58217c478bd9Sstevel@tonic-gate releasef(fd);
58227c478bd9Sstevel@tonic-gate /* don't really want to audit every send call */
58237c478bd9Sstevel@tonic-gate tad->tad_flag = 0;
58247c478bd9Sstevel@tonic-gate /* free any residual audit data */
5825005d3febSMarek Pospisil au_close(kctx, &(u_ad), 0, 0, 0, NULL);
58267c478bd9Sstevel@tonic-gate return;
58277c478bd9Sstevel@tonic-gate }
58287c478bd9Sstevel@tonic-gate
58297c478bd9Sstevel@tonic-gate /* mark things so we know what happened and don't repeat things */
58307c478bd9Sstevel@tonic-gate fad->fad_flags |= FAD_WRITE;
58317c478bd9Sstevel@tonic-gate
58327c478bd9Sstevel@tonic-gate so_family = so->so_family;
58337c478bd9Sstevel@tonic-gate so_type = so->so_type;
58347c478bd9Sstevel@tonic-gate
58357c478bd9Sstevel@tonic-gate switch (so_family) {
58367c478bd9Sstevel@tonic-gate case AF_INET:
58377c478bd9Sstevel@tonic-gate case AF_INET6:
58387c478bd9Sstevel@tonic-gate /*
58397c478bd9Sstevel@tonic-gate * Only for connections.
58407c478bd9Sstevel@tonic-gate * XXX - do we need to worry about SOCK_DGRAM or other types???
58417c478bd9Sstevel@tonic-gate */
58427c478bd9Sstevel@tonic-gate if (so->so_state & SS_ISBOUND) {
58437c478bd9Sstevel@tonic-gate
58447c478bd9Sstevel@tonic-gate bzero((void *)so_laddr, sizeof (so_laddr));
58457c478bd9Sstevel@tonic-gate bzero((void *)so_faddr, sizeof (so_faddr));
58467c478bd9Sstevel@tonic-gate
58477c478bd9Sstevel@tonic-gate /* get local and foreign addresses */
58480f1702c5SYu Xiangning len = sizeof (so_laddr);
58490f1702c5SYu Xiangning (void) socket_getsockname(so,
58500f1702c5SYu Xiangning (struct sockaddr *)so_laddr, &len, CRED());
58510f1702c5SYu Xiangning len = sizeof (so_faddr);
58520f1702c5SYu Xiangning (void) socket_getpeername(so,
58530f1702c5SYu Xiangning (struct sockaddr *)so_faddr, &len, B_FALSE, CRED());
58547c478bd9Sstevel@tonic-gate
58557c478bd9Sstevel@tonic-gate /*
58567c478bd9Sstevel@tonic-gate * only way to drop out of switch. Note that we
58577c478bd9Sstevel@tonic-gate * we release fd below.
58587c478bd9Sstevel@tonic-gate */
58597c478bd9Sstevel@tonic-gate
58607c478bd9Sstevel@tonic-gate break;
58617c478bd9Sstevel@tonic-gate }
58627c478bd9Sstevel@tonic-gate
58637c478bd9Sstevel@tonic-gate releasef(fd);
58647c478bd9Sstevel@tonic-gate /* don't really want to audit every send call */
58657c478bd9Sstevel@tonic-gate tad->tad_flag = 0;
58667c478bd9Sstevel@tonic-gate /* free any residual audit data */
5867005d3febSMarek Pospisil au_close(kctx, &(u_ad), 0, 0, 0, NULL);
58687c478bd9Sstevel@tonic-gate
58697c478bd9Sstevel@tonic-gate return;
58707c478bd9Sstevel@tonic-gate
58717c478bd9Sstevel@tonic-gate case AF_UNIX:
58727c478bd9Sstevel@tonic-gate
58737c478bd9Sstevel@tonic-gate if (fad->fad_aupath != NULL) {
58747c478bd9Sstevel@tonic-gate au_uwrite(au_to_path(fad->fad_aupath));
58757c478bd9Sstevel@tonic-gate } else {
58767c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "no path: fd", fd));
58777c478bd9Sstevel@tonic-gate }
58787c478bd9Sstevel@tonic-gate
58797c478bd9Sstevel@tonic-gate audit_attributes(fp->f_vnode);
58807c478bd9Sstevel@tonic-gate
58817c478bd9Sstevel@tonic-gate releasef(fd);
58827c478bd9Sstevel@tonic-gate
58837c478bd9Sstevel@tonic-gate return;
58847c478bd9Sstevel@tonic-gate
58857c478bd9Sstevel@tonic-gate default:
58867c478bd9Sstevel@tonic-gate releasef(fd);
58877c478bd9Sstevel@tonic-gate
58887c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
58897c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "family", (uint32_t)so_family));
58907c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "type", (uint32_t)so_type));
58917c478bd9Sstevel@tonic-gate
58927c478bd9Sstevel@tonic-gate return;
58937c478bd9Sstevel@tonic-gate }
58947c478bd9Sstevel@tonic-gate
58957c478bd9Sstevel@tonic-gate releasef(fd);
58967c478bd9Sstevel@tonic-gate
58977c478bd9Sstevel@tonic-gate au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
58987c478bd9Sstevel@tonic-gate
58997c478bd9Sstevel@tonic-gate au_uwrite(au_to_socket_ex(so_family, so_type, so_laddr, so_faddr));
59007c478bd9Sstevel@tonic-gate }
5901657b1f3dSraf
5902657b1f3dSraf static au_event_t
aui_forksys(au_event_t e)5903657b1f3dSraf aui_forksys(au_event_t e)
5904657b1f3dSraf {
5905657b1f3dSraf struct a {
5906657b1f3dSraf long subcode;
5907657b1f3dSraf long flags;
5908657b1f3dSraf } *uap = (struct a *)ttolwp(curthread)->lwp_ap;
5909657b1f3dSraf
5910657b1f3dSraf switch ((uint_t)uap->subcode) {
5911657b1f3dSraf case 0:
5912657b1f3dSraf e = AUE_FORK1;
5913657b1f3dSraf break;
5914657b1f3dSraf case 1:
5915657b1f3dSraf e = AUE_FORKALL;
5916657b1f3dSraf break;
5917657b1f3dSraf case 2:
5918657b1f3dSraf e = AUE_VFORK;
5919657b1f3dSraf break;
5920657b1f3dSraf default:
5921657b1f3dSraf e = AUE_NULL;
5922657b1f3dSraf break;
5923657b1f3dSraf }
5924657b1f3dSraf
5925657b1f3dSraf return (e);
5926657b1f3dSraf }
5927df2381bfSpraks
5928df2381bfSpraks /*ARGSUSED*/
5929df2381bfSpraks static au_event_t
aui_portfs(au_event_t e)5930df2381bfSpraks aui_portfs(au_event_t e)
5931df2381bfSpraks {
5932df2381bfSpraks struct a { /* portfs */
5933df2381bfSpraks long a1;
5934df2381bfSpraks long a2;
5935df2381bfSpraks long a3;
5936df2381bfSpraks } *uap = (struct a *)ttolwp(curthread)->lwp_ap;
5937df2381bfSpraks
5938df2381bfSpraks /*
5939df2381bfSpraks * check opcode
5940df2381bfSpraks */
5941df2381bfSpraks switch (((uint_t)uap->a1) & PORT_CODE_MASK) {
5942df2381bfSpraks case PORT_ASSOCIATE:
59438350182dSJan Friedel /* check source */
59448350182dSJan Friedel if (((uint_t)uap->a3 == PORT_SOURCE_FILE) ||
59458350182dSJan Friedel ((uint_t)uap->a3 == PORT_SOURCE_FD)) {
59468350182dSJan Friedel e = AUE_PORTFS_ASSOCIATE;
59478350182dSJan Friedel } else {
59488350182dSJan Friedel e = AUE_NULL;
59498350182dSJan Friedel }
59508350182dSJan Friedel break;
5951df2381bfSpraks case PORT_DISSOCIATE:
59528350182dSJan Friedel /* check source */
59538350182dSJan Friedel if (((uint_t)uap->a3 == PORT_SOURCE_FILE) ||
59548350182dSJan Friedel ((uint_t)uap->a3 == PORT_SOURCE_FD)) {
59558350182dSJan Friedel e = AUE_PORTFS_DISSOCIATE;
5956df2381bfSpraks } else {
5957df2381bfSpraks e = AUE_NULL;
5958df2381bfSpraks }
5959df2381bfSpraks break;
5960df2381bfSpraks default:
5961df2381bfSpraks e = AUE_NULL;
5962df2381bfSpraks }
5963df2381bfSpraks return (e);
5964df2381bfSpraks }
5965