xref: /illumos-gate/usr/src/uts/common/c2/audit_event.c (revision 8fd04b83)
17c478bd9Sstevel@tonic-gate /*
27c478bd9Sstevel@tonic-gate  * CDDL HEADER START
37c478bd9Sstevel@tonic-gate  *
47c478bd9Sstevel@tonic-gate  * The contents of this file are subject to the terms of the
545916cd2Sjpk  * Common Development and Distribution License (the "License").
645916cd2Sjpk  * You may not use this file except in compliance with the License.
77c478bd9Sstevel@tonic-gate  *
87c478bd9Sstevel@tonic-gate  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
97c478bd9Sstevel@tonic-gate  * or http://www.opensolaris.org/os/licensing.
107c478bd9Sstevel@tonic-gate  * See the License for the specific language governing permissions
117c478bd9Sstevel@tonic-gate  * and limitations under the License.
127c478bd9Sstevel@tonic-gate  *
137c478bd9Sstevel@tonic-gate  * When distributing Covered Code, include this CDDL HEADER in each
147c478bd9Sstevel@tonic-gate  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
157c478bd9Sstevel@tonic-gate  * If applicable, add the following below this CDDL HEADER, with the
167c478bd9Sstevel@tonic-gate  * fields enclosed by brackets "[]" replaced with your own identifying
177c478bd9Sstevel@tonic-gate  * information: Portions Copyright [yyyy] [name of copyright owner]
187c478bd9Sstevel@tonic-gate  *
197c478bd9Sstevel@tonic-gate  * CDDL HEADER END
207c478bd9Sstevel@tonic-gate  */
21657b1f3dSraf 
227c478bd9Sstevel@tonic-gate /*
23*8fd04b83SRoger A. Faulkner  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
247c478bd9Sstevel@tonic-gate  * Use is subject to license terms.
257c478bd9Sstevel@tonic-gate  */
267c478bd9Sstevel@tonic-gate 
277c478bd9Sstevel@tonic-gate /*
287c478bd9Sstevel@tonic-gate  * This file contains the audit event table used to control the production
297c478bd9Sstevel@tonic-gate  * of audit records for each system call.
307c478bd9Sstevel@tonic-gate  */
317c478bd9Sstevel@tonic-gate 
327c478bd9Sstevel@tonic-gate #include <sys/policy.h>
337c478bd9Sstevel@tonic-gate #include <sys/cred.h>
347c478bd9Sstevel@tonic-gate #include <sys/types.h>
357c478bd9Sstevel@tonic-gate #include <sys/systm.h>
367c478bd9Sstevel@tonic-gate #include <sys/systeminfo.h>	/* for sysinfo auditing */
377c478bd9Sstevel@tonic-gate #include <sys/utsname.h>	/* for sysinfo auditing */
387c478bd9Sstevel@tonic-gate #include <sys/proc.h>
397c478bd9Sstevel@tonic-gate #include <sys/vnode.h>
407c478bd9Sstevel@tonic-gate #include <sys/mman.h>		/* for mmap(2) auditing etc. */
417c478bd9Sstevel@tonic-gate #include <sys/fcntl.h>
427c478bd9Sstevel@tonic-gate #include <sys/modctl.h>		/* for modctl auditing */
437c478bd9Sstevel@tonic-gate #include <sys/vnode.h>
447c478bd9Sstevel@tonic-gate #include <sys/user.h>
457c478bd9Sstevel@tonic-gate #include <sys/types.h>
467c478bd9Sstevel@tonic-gate #include <sys/processor.h>
477c478bd9Sstevel@tonic-gate #include <sys/procset.h>
487c478bd9Sstevel@tonic-gate #include <sys/acl.h>
497c478bd9Sstevel@tonic-gate #include <sys/ipc.h>
507c478bd9Sstevel@tonic-gate #include <sys/door.h>
517c478bd9Sstevel@tonic-gate #include <sys/sem.h>
527c478bd9Sstevel@tonic-gate #include <sys/msg.h>
537c478bd9Sstevel@tonic-gate #include <sys/shm.h>
547c478bd9Sstevel@tonic-gate #include <sys/kmem.h>
557c478bd9Sstevel@tonic-gate #include <sys/file.h>		/* for accept */
567c478bd9Sstevel@tonic-gate #include <sys/utssys.h>		/* for fuser */
5745916cd2Sjpk #include <sys/tsol/label.h>
5861b9bf51Srica #include <sys/tsol/tndb.h>
5961b9bf51Srica #include <sys/tsol/tsyscall.h>
607c478bd9Sstevel@tonic-gate #include <c2/audit.h>
617c478bd9Sstevel@tonic-gate #include <c2/audit_kernel.h>
627c478bd9Sstevel@tonic-gate #include <c2/audit_kevents.h>
637c478bd9Sstevel@tonic-gate #include <c2/audit_record.h>
647c478bd9Sstevel@tonic-gate #include <sys/procset.h>
657c478bd9Sstevel@tonic-gate #include <nfs/mount.h>
667c478bd9Sstevel@tonic-gate #include <sys/param.h>
677c478bd9Sstevel@tonic-gate #include <sys/debug.h>
687c478bd9Sstevel@tonic-gate #include <sys/sysmacros.h>
697c478bd9Sstevel@tonic-gate #include <sys/stream.h>
707c478bd9Sstevel@tonic-gate #include <sys/strsubr.h>
717c478bd9Sstevel@tonic-gate #include <sys/stropts.h>
727c478bd9Sstevel@tonic-gate #include <sys/tihdr.h>
737c478bd9Sstevel@tonic-gate #include <sys/socket.h>
747c478bd9Sstevel@tonic-gate #include <sys/socketvar.h>
750f1702c5SYu Xiangning #include <sys/vfs_opreg.h>
760f1702c5SYu Xiangning #include <fs/sockfs/sockcommon.h>
777c478bd9Sstevel@tonic-gate #include <netinet/in.h>
787c478bd9Sstevel@tonic-gate #include <sys/ddi.h>
79df2381bfSpraks #include <sys/port_impl.h>
80df2381bfSpraks 
817c478bd9Sstevel@tonic-gate 
827c478bd9Sstevel@tonic-gate char	_depends_on[] = "fs/sockfs";
837c478bd9Sstevel@tonic-gate 
84*8fd04b83SRoger A. Faulkner static au_event_t	aui_fchownat(au_event_t);
857c478bd9Sstevel@tonic-gate static au_event_t	aui_open(au_event_t);
86*8fd04b83SRoger A. Faulkner static au_event_t	aui_openat(au_event_t);
87*8fd04b83SRoger A. Faulkner static au_event_t	aui_unlinkat(au_event_t);
88*8fd04b83SRoger A. Faulkner static au_event_t	aui_fstatat(au_event_t);
897c478bd9Sstevel@tonic-gate static au_event_t	aui_msgsys(au_event_t);
907c478bd9Sstevel@tonic-gate static au_event_t	aui_shmsys(au_event_t);
917c478bd9Sstevel@tonic-gate static au_event_t	aui_semsys(au_event_t);
927c478bd9Sstevel@tonic-gate static au_event_t	aui_utssys(au_event_t);
937c478bd9Sstevel@tonic-gate static au_event_t	aui_fcntl(au_event_t);
947c478bd9Sstevel@tonic-gate static au_event_t	aui_execve(au_event_t);
957c478bd9Sstevel@tonic-gate static au_event_t	aui_memcntl(au_event_t);
967c478bd9Sstevel@tonic-gate static au_event_t	aui_sysinfo(au_event_t);
97df2381bfSpraks static au_event_t	aui_portfs(au_event_t);
987c478bd9Sstevel@tonic-gate static au_event_t	aui_auditsys(au_event_t);
997c478bd9Sstevel@tonic-gate static au_event_t	aui_modctl(au_event_t);
1007c478bd9Sstevel@tonic-gate static au_event_t	aui_acl(au_event_t);
1017c478bd9Sstevel@tonic-gate static au_event_t	aui_doorfs(au_event_t);
1027c478bd9Sstevel@tonic-gate static au_event_t	aui_privsys(au_event_t);
103657b1f3dSraf static au_event_t	aui_forksys(au_event_t);
10461b9bf51Srica static au_event_t	aui_labelsys(au_event_t);
1054be8c573SJan Friedel static au_event_t	aui_setpgrp(au_event_t);
1067c478bd9Sstevel@tonic-gate 
1077c478bd9Sstevel@tonic-gate static void	aus_open(struct t_audit_data *);
108*8fd04b83SRoger A. Faulkner static void	aus_openat(struct t_audit_data *);
1097c478bd9Sstevel@tonic-gate static void	aus_acl(struct t_audit_data *);
1107c478bd9Sstevel@tonic-gate static void	aus_acct(struct t_audit_data *);
1117c478bd9Sstevel@tonic-gate static void	aus_chown(struct t_audit_data *);
1127c478bd9Sstevel@tonic-gate static void	aus_fchown(struct t_audit_data *);
1137c478bd9Sstevel@tonic-gate static void	aus_lchown(struct t_audit_data *);
114*8fd04b83SRoger A. Faulkner static void	aus_fchownat(struct t_audit_data *);
1157c478bd9Sstevel@tonic-gate static void	aus_chmod(struct t_audit_data *);
1167c478bd9Sstevel@tonic-gate static void	aus_facl(struct t_audit_data *);
1177c478bd9Sstevel@tonic-gate static void	aus_fchmod(struct t_audit_data *);
1187c478bd9Sstevel@tonic-gate static void	aus_fcntl(struct t_audit_data *);
1197c478bd9Sstevel@tonic-gate static void	aus_mkdir(struct t_audit_data *);
1207c478bd9Sstevel@tonic-gate static void	aus_mknod(struct t_audit_data *);
1217c478bd9Sstevel@tonic-gate static void	aus_mount(struct t_audit_data *);
1227c478bd9Sstevel@tonic-gate static void	aus_umount2(struct t_audit_data *);
1237c478bd9Sstevel@tonic-gate static void	aus_msgsys(struct t_audit_data *);
1247c478bd9Sstevel@tonic-gate static void	aus_semsys(struct t_audit_data *);
1257c478bd9Sstevel@tonic-gate static void	aus_close(struct t_audit_data *);
1267c478bd9Sstevel@tonic-gate static void	aus_fstatfs(struct t_audit_data *);
1277c478bd9Sstevel@tonic-gate static void	aus_setgid(struct t_audit_data *);
1284be8c573SJan Friedel static void	aus_setpgrp(struct t_audit_data *);
1297c478bd9Sstevel@tonic-gate static void	aus_setuid(struct t_audit_data *);
1307c478bd9Sstevel@tonic-gate static void	aus_shmsys(struct t_audit_data *);
1317c478bd9Sstevel@tonic-gate static void	aus_doorfs(struct t_audit_data *);
1327c478bd9Sstevel@tonic-gate static void	aus_ioctl(struct t_audit_data *);
1337c478bd9Sstevel@tonic-gate static void	aus_memcntl(struct t_audit_data *);
1347c478bd9Sstevel@tonic-gate static void	aus_mmap(struct t_audit_data *);
1357c478bd9Sstevel@tonic-gate static void	aus_munmap(struct t_audit_data *);
1367c478bd9Sstevel@tonic-gate static void	aus_priocntlsys(struct t_audit_data *);
1377c478bd9Sstevel@tonic-gate static void	aus_setegid(struct t_audit_data *);
1387c478bd9Sstevel@tonic-gate static void	aus_setgroups(struct t_audit_data *);
1397c478bd9Sstevel@tonic-gate static void	aus_seteuid(struct t_audit_data *);
1407c478bd9Sstevel@tonic-gate static void	aus_putmsg(struct t_audit_data *);
1417c478bd9Sstevel@tonic-gate static void	aus_putpmsg(struct t_audit_data *);
1427c478bd9Sstevel@tonic-gate static void	aus_getmsg(struct t_audit_data *);
1437c478bd9Sstevel@tonic-gate static void	aus_getpmsg(struct t_audit_data *);
1447c478bd9Sstevel@tonic-gate static void	aus_auditsys(struct t_audit_data *);
1457c478bd9Sstevel@tonic-gate static void	aus_sysinfo(struct t_audit_data *);
1467c478bd9Sstevel@tonic-gate static void	aus_modctl(struct t_audit_data *);
1477c478bd9Sstevel@tonic-gate static void	aus_kill(struct t_audit_data *);
1487c478bd9Sstevel@tonic-gate static void	aus_setregid(struct t_audit_data *);
1497c478bd9Sstevel@tonic-gate static void	aus_setreuid(struct t_audit_data *);
15061b9bf51Srica static void	aus_labelsys(struct t_audit_data *);
1517c478bd9Sstevel@tonic-gate 
1527c478bd9Sstevel@tonic-gate static void	auf_mknod(struct t_audit_data *, int, rval_t *);
1537c478bd9Sstevel@tonic-gate static void	auf_msgsys(struct t_audit_data *, int, rval_t *);
1547c478bd9Sstevel@tonic-gate static void	auf_semsys(struct t_audit_data *, int, rval_t *);
1557c478bd9Sstevel@tonic-gate static void	auf_shmsys(struct t_audit_data *, int, rval_t *);
1567c478bd9Sstevel@tonic-gate static void	auf_read(struct t_audit_data *, int, rval_t *);
1577c478bd9Sstevel@tonic-gate static void	auf_write(struct t_audit_data *, int, rval_t *);
1587c478bd9Sstevel@tonic-gate 
1597c478bd9Sstevel@tonic-gate static void	aus_sigqueue(struct t_audit_data *);
1607c478bd9Sstevel@tonic-gate static void	aus_p_online(struct t_audit_data *);
1617c478bd9Sstevel@tonic-gate static void	aus_processor_bind(struct t_audit_data *);
1627c478bd9Sstevel@tonic-gate static void	aus_inst_sync(struct t_audit_data *);
1639acbbeafSnn static void	aus_brandsys(struct t_audit_data *);
1647c478bd9Sstevel@tonic-gate 
1657c478bd9Sstevel@tonic-gate static void	auf_accept(struct t_audit_data *, int, rval_t *);
1667c478bd9Sstevel@tonic-gate 
1677c478bd9Sstevel@tonic-gate static void	auf_bind(struct t_audit_data *, int, rval_t *);
1687c478bd9Sstevel@tonic-gate static void	auf_connect(struct t_audit_data *, int, rval_t *);
1697c478bd9Sstevel@tonic-gate static void	aus_shutdown(struct t_audit_data *);
1707c478bd9Sstevel@tonic-gate static void	auf_setsockopt(struct t_audit_data *, int, rval_t *);
1717c478bd9Sstevel@tonic-gate static void	aus_sockconfig(struct t_audit_data *);
1727c478bd9Sstevel@tonic-gate static void	auf_recv(struct t_audit_data *, int, rval_t *);
1737c478bd9Sstevel@tonic-gate static void	auf_recvmsg(struct t_audit_data *, int, rval_t *);
1747c478bd9Sstevel@tonic-gate static void	auf_send(struct t_audit_data *, int, rval_t *);
1757c478bd9Sstevel@tonic-gate static void	auf_sendmsg(struct t_audit_data *, int, rval_t *);
1767c478bd9Sstevel@tonic-gate static void	auf_recvfrom(struct t_audit_data *, int, rval_t *);
1777c478bd9Sstevel@tonic-gate static void	auf_sendto(struct t_audit_data *, int, rval_t *);
1787c478bd9Sstevel@tonic-gate static void	aus_socket(struct t_audit_data *);
1797c478bd9Sstevel@tonic-gate /*
1807c478bd9Sstevel@tonic-gate  * This table contains mapping information for converting system call numbers
1817c478bd9Sstevel@tonic-gate  * to audit event IDs. In several cases it is necessary to map a single system
1827c478bd9Sstevel@tonic-gate  * call to several events.
1837c478bd9Sstevel@tonic-gate  */
1847c478bd9Sstevel@tonic-gate 
185f9d0e028Sgww #define	aui_null	NULL	/* NULL initialize function */
186f9d0e028Sgww #define	aus_null	NULL	/* NULL start function */
187f9d0e028Sgww #define	auf_null	NULL	/* NULL finish function */
188f9d0e028Sgww 
1897c478bd9Sstevel@tonic-gate struct audit_s2e audit_s2e[] =
1907c478bd9Sstevel@tonic-gate {
1917c478bd9Sstevel@tonic-gate /*
1927c478bd9Sstevel@tonic-gate  * ----------	---------- 	----------	----------
1937c478bd9Sstevel@tonic-gate  * INITIAL	AUDIT		START		SYSTEM
1947c478bd9Sstevel@tonic-gate  * PROCESSING	EVENT		PROCESSING	CALL
1957c478bd9Sstevel@tonic-gate  * ----------	----------	----------	-----------
1967c478bd9Sstevel@tonic-gate  *		FINISH		EVENT
1977c478bd9Sstevel@tonic-gate  *		PROCESSING	CONTROL
1987c478bd9Sstevel@tonic-gate  * ----------------------------------------------------------
1997c478bd9Sstevel@tonic-gate  */
2007c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 0 unused (indirect) */
2017c478bd9Sstevel@tonic-gate 		auf_null,	0,
2027c478bd9Sstevel@tonic-gate aui_null,	AUE_EXIT,	aus_null,	/* 1 exit */
2037c478bd9Sstevel@tonic-gate 		auf_null,	S2E_NPT,
204*8fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 2 (loadable) was forkall */
2057c478bd9Sstevel@tonic-gate 		auf_null,	0,
2067c478bd9Sstevel@tonic-gate aui_null,	AUE_READ,	aus_null,	/* 3 read */
2077c478bd9Sstevel@tonic-gate 		auf_read,	S2E_PUB,
2087c478bd9Sstevel@tonic-gate aui_null,	AUE_WRITE,	aus_null,	/* 4 write */
2097c478bd9Sstevel@tonic-gate 		auf_write,	0,
2107c478bd9Sstevel@tonic-gate aui_open,	AUE_OPEN,	aus_open,	/* 5 open */
2117c478bd9Sstevel@tonic-gate 		auf_null,	S2E_SP,
2127c478bd9Sstevel@tonic-gate aui_null,	AUE_CLOSE,	aus_close,	/* 6 close */
2137c478bd9Sstevel@tonic-gate 		auf_null,	0,
214*8fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 7 (loadable) was wait */
215*8fd04b83SRoger A. Faulkner 		auf_null,	0,
216*8fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 8 (loadable) was creat */
2177c478bd9Sstevel@tonic-gate 		auf_null,	0,
2187c478bd9Sstevel@tonic-gate aui_null,	AUE_LINK,	aus_null,	/* 9 link */
2197c478bd9Sstevel@tonic-gate 		auf_null,	0,
2207c478bd9Sstevel@tonic-gate aui_null,	AUE_UNLINK,	aus_null,	/* 10 unlink */
2217c478bd9Sstevel@tonic-gate 		auf_null,	0,
222*8fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 11 (loadable) was exec */
223*8fd04b83SRoger A. Faulkner 		auf_null,	0,
2247c478bd9Sstevel@tonic-gate aui_null,	AUE_CHDIR,	aus_null,	/* 12 chdir */
2257c478bd9Sstevel@tonic-gate 		auf_null,	S2E_SP,
2267c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 13 time */
2277c478bd9Sstevel@tonic-gate 		auf_null,	0,
2287c478bd9Sstevel@tonic-gate aui_null,	AUE_MKNOD,	aus_mknod,	/* 14 mknod */
2297c478bd9Sstevel@tonic-gate 		auf_mknod,	0,
2307c478bd9Sstevel@tonic-gate aui_null,	AUE_CHMOD,	aus_chmod,	/* 15 chmod */
2317c478bd9Sstevel@tonic-gate 		auf_null,	0,
2327c478bd9Sstevel@tonic-gate aui_null,	AUE_CHOWN,	aus_chown,	/* 16 chown */
2337c478bd9Sstevel@tonic-gate 		auf_null,	0,
2347c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 17 brk */
2357c478bd9Sstevel@tonic-gate 		auf_null,	0,
2367c478bd9Sstevel@tonic-gate aui_null,	AUE_STAT,	aus_null,	/* 18 stat */
2377c478bd9Sstevel@tonic-gate 		auf_null,	S2E_PUB,
2387c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 19 lseek */
2397c478bd9Sstevel@tonic-gate 		auf_null,	0,
2407c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 20 getpid */
2417c478bd9Sstevel@tonic-gate 		auf_null,	0,
2427c478bd9Sstevel@tonic-gate aui_null,	AUE_MOUNT,	aus_mount,	/* 21 mount */
2437c478bd9Sstevel@tonic-gate 		auf_null,	S2E_MLD,
244*8fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 22 (loadable) was umount */
2457c478bd9Sstevel@tonic-gate 		auf_null,	0,
2467c478bd9Sstevel@tonic-gate aui_null,	AUE_SETUID,	aus_setuid,	/* 23 setuid */
2477c478bd9Sstevel@tonic-gate 		auf_null,	0,
2487c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 24 getuid */
2497c478bd9Sstevel@tonic-gate 		auf_null,	0,
2507c478bd9Sstevel@tonic-gate aui_null,	AUE_STIME,	aus_null,	/* 25 stime */
2517c478bd9Sstevel@tonic-gate 		auf_null,	0,
252*8fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 26 pcsample */
2537c478bd9Sstevel@tonic-gate 		auf_null,	0,
2547c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 27 alarm */
2557c478bd9Sstevel@tonic-gate 		auf_null,	0,
2567c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 28 fstat */
2577c478bd9Sstevel@tonic-gate 		auf_null,	0,
2587c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 29 pause */
2597c478bd9Sstevel@tonic-gate 		auf_null,	0,
260*8fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 30 (loadable) was utime */
2617c478bd9Sstevel@tonic-gate 		auf_null,	0,
2627c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 31 stty (TIOCSETP-audit?) */
2637c478bd9Sstevel@tonic-gate 		auf_null,	0,
2647c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 32 gtty */
2657c478bd9Sstevel@tonic-gate 		auf_null,	0,
2667c478bd9Sstevel@tonic-gate aui_null,	AUE_ACCESS,	aus_null,	/* 33 access */
2677c478bd9Sstevel@tonic-gate 		auf_null,	S2E_PUB,
2687c478bd9Sstevel@tonic-gate aui_null,	AUE_NICE,	aus_null,	/* 34 nice */
2697c478bd9Sstevel@tonic-gate 		auf_null,	0,
2707c478bd9Sstevel@tonic-gate aui_null,	AUE_STATFS,	aus_null,	/* 35 statfs */
2717c478bd9Sstevel@tonic-gate 		auf_null,	S2E_PUB,
2727c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 36 sync */
2737c478bd9Sstevel@tonic-gate 		auf_null,	0,
2747c478bd9Sstevel@tonic-gate aui_null,	AUE_KILL,	aus_kill,	/* 37 kill */
2757c478bd9Sstevel@tonic-gate 		auf_null,	0,
2767c478bd9Sstevel@tonic-gate aui_null,	AUE_FSTATFS,	aus_fstatfs,	/* 38 fstatfs */
2777c478bd9Sstevel@tonic-gate 		auf_null,	S2E_PUB,
2784be8c573SJan Friedel aui_setpgrp,	AUE_SETPGRP,	aus_setpgrp,	/* 39 setpgrp */
2797c478bd9Sstevel@tonic-gate 		auf_null,	0,
2809acbbeafSnn aui_null,	AUE_NULL,	aus_null,	/* 40 uucopystr */
2817c478bd9Sstevel@tonic-gate 		auf_null,	0,
282*8fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 41 (loadable) was dup */
2837c478bd9Sstevel@tonic-gate 		auf_null,	0,
284*8fd04b83SRoger A. Faulkner aui_null,	AUE_PIPE,	aus_null,	/* 42 (loadable) pipe */
2857c478bd9Sstevel@tonic-gate 		auf_null,	0,
2867c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 43 times */
2877c478bd9Sstevel@tonic-gate 		auf_null,	0,
2887c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 44 profil */
2897c478bd9Sstevel@tonic-gate 		auf_null,	0,
290*8fd04b83SRoger A. Faulkner aui_null,	AUE_ACCESS,	aus_null,	/* 45 faccessat */
291*8fd04b83SRoger A. Faulkner 		auf_null,	S2E_PUB | S2E_ATC,
2927c478bd9Sstevel@tonic-gate aui_null,	AUE_SETGID,	aus_setgid,	/* 46 setgid */
2937c478bd9Sstevel@tonic-gate 		auf_null,	0,
2947c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 47 getgid */
2957c478bd9Sstevel@tonic-gate 		auf_null,	0,
296*8fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 48 (loadable) was ssig */
2977c478bd9Sstevel@tonic-gate 		auf_null,	0,
298*8fd04b83SRoger A. Faulkner aui_msgsys,	AUE_MSGSYS,	aus_msgsys,	/* 49 (loadable) msgsys */
2997c478bd9Sstevel@tonic-gate 		auf_msgsys,	0,
3007c478bd9Sstevel@tonic-gate #if defined(__x86)
3017c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 50 sysi86 */
3027c478bd9Sstevel@tonic-gate 		auf_null,	0,
3037c478bd9Sstevel@tonic-gate #else
3047c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 50 (loadable) was sys3b */
3057c478bd9Sstevel@tonic-gate 		auf_null,	0,
3067c478bd9Sstevel@tonic-gate #endif /* __x86 */
307*8fd04b83SRoger A. Faulkner aui_null,	AUE_ACCT,	aus_acct,	/* 51 (loadable) sysacct */
3087c478bd9Sstevel@tonic-gate 		auf_null,	0,
309*8fd04b83SRoger A. Faulkner aui_shmsys,	AUE_SHMSYS,	aus_shmsys,	/* 52 (loadable) shmsys */
3107c478bd9Sstevel@tonic-gate 		auf_shmsys,	0,
311*8fd04b83SRoger A. Faulkner aui_semsys,	AUE_SEMSYS,	aus_semsys,	/* 53 (loadable) semsys */
3127c478bd9Sstevel@tonic-gate 		auf_semsys,	0,
3137c478bd9Sstevel@tonic-gate aui_null,	AUE_IOCTL,	aus_ioctl,	/* 54 ioctl */
3147c478bd9Sstevel@tonic-gate 		auf_null,	0,
3157c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 55 uadmin */
3167c478bd9Sstevel@tonic-gate 		auf_null,	0,
317*8fd04b83SRoger A. Faulkner aui_fchownat,	AUE_NULL,	aus_fchownat,	/* 56 fchownat */
318*8fd04b83SRoger A. Faulkner 		auf_null,	S2E_ATC,
3197c478bd9Sstevel@tonic-gate aui_utssys,	AUE_FUSERS,	aus_null,	/* 57 utssys */
3207c478bd9Sstevel@tonic-gate 		auf_null,	0,
3217c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 58 fsync */
3227c478bd9Sstevel@tonic-gate 		auf_null,	0,
3237c478bd9Sstevel@tonic-gate aui_execve,	AUE_EXECVE,	aus_null,	/* 59 exece */
3247c478bd9Sstevel@tonic-gate 		auf_null,	S2E_MLD,
3257c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 60 umask */
3267c478bd9Sstevel@tonic-gate 		auf_null,	0,
3277c478bd9Sstevel@tonic-gate aui_null,	AUE_CHROOT,	aus_null,	/* 61 chroot */
3287c478bd9Sstevel@tonic-gate 		auf_null,	S2E_SP,
3297c478bd9Sstevel@tonic-gate aui_fcntl,	AUE_FCNTL,	aus_fcntl,	/* 62 fcntl */
3307c478bd9Sstevel@tonic-gate 		auf_null,	0,
3317c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 63 ulimit */
3327c478bd9Sstevel@tonic-gate 		auf_null,	0,
333*8fd04b83SRoger A. Faulkner aui_null,	AUE_RENAME,	aus_null,	/* 64 renameat */
334*8fd04b83SRoger A. Faulkner 		auf_null,	S2E_ATC,
335*8fd04b83SRoger A. Faulkner aui_unlinkat,	AUE_NULL,	aus_null,	/* 65 unlinkat */
336*8fd04b83SRoger A. Faulkner 		auf_null,	S2E_ATC,
337*8fd04b83SRoger A. Faulkner aui_fstatat,	AUE_NULL,	aus_null,	/* 66 fstatat */
338*8fd04b83SRoger A. Faulkner 		auf_null,	S2E_PUB | S2E_ATC,
339*8fd04b83SRoger A. Faulkner aui_fstatat,	AUE_NULL,	aus_null,	/* 67 fstatat64 */
340*8fd04b83SRoger A. Faulkner 		auf_null,	S2E_PUB | S2E_ATC,
341*8fd04b83SRoger A. Faulkner aui_openat,	AUE_OPEN,	aus_openat,	/* 68 openat */
342*8fd04b83SRoger A. Faulkner 		auf_null,	S2E_SP | S2E_ATC,
343*8fd04b83SRoger A. Faulkner aui_openat,	AUE_OPEN,	aus_openat,	/* 69 openat64 */
344*8fd04b83SRoger A. Faulkner 		auf_null,	S2E_SP | S2E_ATC,
345*8fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 70 tasksys */
3467c478bd9Sstevel@tonic-gate 		auf_null,	0,
347*8fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 71 (loadable) acctctl */
3487c478bd9Sstevel@tonic-gate 		auf_null,	0,
349*8fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 72 (loadable) exacct */
3507c478bd9Sstevel@tonic-gate 		auf_null,	0,
351*8fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 73 getpagesizes */
3527c478bd9Sstevel@tonic-gate 		auf_null,	0,
353*8fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 74 rctlsys */
3547c478bd9Sstevel@tonic-gate 		auf_null,	0,
355f48205beScasper aui_null,	AUE_NULL,	aus_null,	/* 75 sidsys */
3567c478bd9Sstevel@tonic-gate 		auf_null,	0,
357*8fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 76 (loadable) was fsat */
3587c478bd9Sstevel@tonic-gate 		auf_null,	0,
359*8fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 77 syslwp_park */
3607c478bd9Sstevel@tonic-gate 		auf_null,	0,
361*8fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 78 sendfilev */
3627c478bd9Sstevel@tonic-gate 		auf_null,	0,
3637c478bd9Sstevel@tonic-gate aui_null,	AUE_RMDIR,	aus_null,	/* 79 rmdir */
3647c478bd9Sstevel@tonic-gate 		auf_null,	0,
3657c478bd9Sstevel@tonic-gate aui_null,	AUE_MKDIR,	aus_mkdir,	/* 80 mkdir */
3667c478bd9Sstevel@tonic-gate 		auf_null,	0,
3677c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 81 getdents */
3687c478bd9Sstevel@tonic-gate 		auf_null,	0,
3697c478bd9Sstevel@tonic-gate aui_privsys,	AUE_NULL,	aus_null,	/* 82 privsys */
3707c478bd9Sstevel@tonic-gate 		auf_null,	0,
371*8fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 83 ucredsys */
3727c478bd9Sstevel@tonic-gate 		auf_null,	0,
3737c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 84 sysfs */
3747c478bd9Sstevel@tonic-gate 		auf_null,	0,
3757c478bd9Sstevel@tonic-gate aui_null,	AUE_GETMSG,	aus_getmsg,	/* 85 getmsg */
3767c478bd9Sstevel@tonic-gate 		auf_null,	0,
3777c478bd9Sstevel@tonic-gate aui_null,	AUE_PUTMSG,	aus_putmsg,	/* 86 putmsg */
3787c478bd9Sstevel@tonic-gate 		auf_null,	0,
379*8fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 87 (loadable) was poll */
3807c478bd9Sstevel@tonic-gate 		auf_null,	0,
3817c478bd9Sstevel@tonic-gate aui_null,	AUE_LSTAT,	aus_null,	/* 88 lstat */
3827c478bd9Sstevel@tonic-gate 		auf_null,	S2E_PUB,
3837c478bd9Sstevel@tonic-gate aui_null,	AUE_SYMLINK,	aus_null,	/* 89 symlink */
3847c478bd9Sstevel@tonic-gate 		auf_null,	0,
3857c478bd9Sstevel@tonic-gate aui_null,	AUE_READLINK,	aus_null,	/* 90 readlink */
3867c478bd9Sstevel@tonic-gate 		auf_null,	S2E_PUB,
3877c478bd9Sstevel@tonic-gate aui_null,	AUE_SETGROUPS,	aus_setgroups,	/* 91 setgroups */
3887c478bd9Sstevel@tonic-gate 		auf_null,	0,
3897c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 92 getgroups */
3907c478bd9Sstevel@tonic-gate 		auf_null,	0,
3917c478bd9Sstevel@tonic-gate aui_null,	AUE_FCHMOD,	aus_fchmod,	/* 93 fchmod */
3927c478bd9Sstevel@tonic-gate 		auf_null,	0,
3937c478bd9Sstevel@tonic-gate aui_null,	AUE_FCHOWN,	aus_fchown,	/* 94 fchown */
3947c478bd9Sstevel@tonic-gate 		auf_null,	0,
3957c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 95 sigprocmask */
3967c478bd9Sstevel@tonic-gate 		auf_null,	0,
3977c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 96 sigsuspend */
3987c478bd9Sstevel@tonic-gate 		auf_null,	0,
3997c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 97 sigaltstack */
4007c478bd9Sstevel@tonic-gate 		auf_null,	0,
4017c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 98 sigaction */
4027c478bd9Sstevel@tonic-gate 		auf_null,	0,
4037c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 99 sigpending */
4047c478bd9Sstevel@tonic-gate 		auf_null,	0,
4057c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 100 setcontext */
4067c478bd9Sstevel@tonic-gate 		auf_null,	0,
407*8fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 101 (loadable) */
4087c478bd9Sstevel@tonic-gate 		auf_null,	0,
4097c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 102 (loadable) */
4107c478bd9Sstevel@tonic-gate 		auf_null,	0,
4117c478bd9Sstevel@tonic-gate aui_null,	AUE_STATVFS,	aus_null,	/* 103 statvfs */
4127c478bd9Sstevel@tonic-gate 		auf_null,	S2E_PUB,
4137c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 104 fstatvfs */
4147c478bd9Sstevel@tonic-gate 		auf_null,	0,
415*8fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 105 getloadavg */
4167c478bd9Sstevel@tonic-gate 		auf_null,	0,
4177c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 106 nfssys */
4187c478bd9Sstevel@tonic-gate 		auf_null,	0,
419*8fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 107 waitsys */
4207c478bd9Sstevel@tonic-gate 		auf_null,	0,
421*8fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 108 sigsendsys */
4227c478bd9Sstevel@tonic-gate 		auf_null,	0,
4237c478bd9Sstevel@tonic-gate #if defined(__x86)
4247c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 109 hrtsys */
4257c478bd9Sstevel@tonic-gate 		auf_null,	0,
4267c478bd9Sstevel@tonic-gate #else
4277c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 109 (loadable) */
4287c478bd9Sstevel@tonic-gate 		auf_null,	0,
4297c478bd9Sstevel@tonic-gate #endif /* __x86 */
430*8fd04b83SRoger A. Faulkner aui_null,	AUE_UTIMES,	aus_null,	/* 110 utimesys */
431*8fd04b83SRoger A. Faulkner 		auf_null,	S2E_ATC,
432*8fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 111 sigresend */
4337c478bd9Sstevel@tonic-gate 		auf_null,	0,
434*8fd04b83SRoger A. Faulkner aui_null,	AUE_PRIOCNTLSYS, aus_priocntlsys, /* 112 priocntlsys */
4357c478bd9Sstevel@tonic-gate 		auf_null,	0,
4367c478bd9Sstevel@tonic-gate aui_null,	AUE_PATHCONF,	aus_null,	/* 113 pathconf */
4377c478bd9Sstevel@tonic-gate 		auf_null,	S2E_PUB,
4387c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 114 mincore */
4397c478bd9Sstevel@tonic-gate 		auf_null,	0,
4407c478bd9Sstevel@tonic-gate aui_null,	AUE_MMAP,	aus_mmap,	/* 115 mmap */
4417c478bd9Sstevel@tonic-gate 		auf_null,	0,
4427c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 116 mprotect */
4437c478bd9Sstevel@tonic-gate 		auf_null,	0,
4447c478bd9Sstevel@tonic-gate aui_null,	AUE_MUNMAP,	aus_munmap,	/* 117 munmap */
4457c478bd9Sstevel@tonic-gate 		auf_null,	0,
4467c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 118 fpathconf */
4477c478bd9Sstevel@tonic-gate 		auf_null,	0,
4487c478bd9Sstevel@tonic-gate aui_null,	AUE_VFORK,	aus_null,	/* 119 vfork */
4497c478bd9Sstevel@tonic-gate 		auf_null,	0,
4507c478bd9Sstevel@tonic-gate aui_null,	AUE_FCHDIR,	aus_null,	/* 120 fchdir */
4517c478bd9Sstevel@tonic-gate 		auf_null,	0,
4527c478bd9Sstevel@tonic-gate aui_null,	AUE_READ,	aus_null,	/* 121 readv */
4537c478bd9Sstevel@tonic-gate 		auf_read,	S2E_PUB,
4547c478bd9Sstevel@tonic-gate aui_null,	AUE_WRITE,	aus_null,	/* 122 writev */
4557c478bd9Sstevel@tonic-gate 		auf_write,	0,
456*8fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 123 (loadable) was xstat */
4577c478bd9Sstevel@tonic-gate 		auf_null,	0,
458*8fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 124 (loadable) was lxstat */
459*8fd04b83SRoger A. Faulkner 		auf_null,	0,
460*8fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 125 (loadable) was fxstat */
461*8fd04b83SRoger A. Faulkner 		auf_null,	0,
462*8fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 126 (loadable) was xmknod */
463*8fd04b83SRoger A. Faulkner 		auf_null,	0,
464*8fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 127 mmapobj */
4657c478bd9Sstevel@tonic-gate 		auf_null,	0,
4667c478bd9Sstevel@tonic-gate aui_null,	AUE_SETRLIMIT,	aus_null,	/* 128 setrlimit */
4677c478bd9Sstevel@tonic-gate 		auf_null,	0,
4687c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 129 getrlimit */
4697c478bd9Sstevel@tonic-gate 		auf_null,	0,
4707c478bd9Sstevel@tonic-gate aui_null,	AUE_LCHOWN,	aus_lchown,	/* 130 lchown */
4717c478bd9Sstevel@tonic-gate 		auf_null,	0,
4727c478bd9Sstevel@tonic-gate aui_memcntl,	AUE_MEMCNTL,	aus_memcntl,	/* 131 memcntl */
4737c478bd9Sstevel@tonic-gate 		auf_null,	0,
4747c478bd9Sstevel@tonic-gate aui_null,	AUE_GETPMSG,	aus_getpmsg,	/* 132 getpmsg */
4757c478bd9Sstevel@tonic-gate 		auf_null,	0,
4767c478bd9Sstevel@tonic-gate aui_null,	AUE_PUTPMSG,	aus_putpmsg,	/* 133 putpmsg */
4777c478bd9Sstevel@tonic-gate 		auf_null,	0,
4787c478bd9Sstevel@tonic-gate aui_null,	AUE_RENAME,	aus_null,	/* 134 rename */
4797c478bd9Sstevel@tonic-gate 		auf_null,	0,
4807c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 135 uname */
4817c478bd9Sstevel@tonic-gate 		auf_null,	0,
4827c478bd9Sstevel@tonic-gate aui_null,	AUE_SETEGID,	aus_setegid,	/* 136 setegid */
4837c478bd9Sstevel@tonic-gate 		auf_null,	0,
4847c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 137 sysconfig */
4857c478bd9Sstevel@tonic-gate 		auf_null,	0,
4867c478bd9Sstevel@tonic-gate aui_null,	AUE_ADJTIME,	aus_null,	/* 138 adjtime */
4877c478bd9Sstevel@tonic-gate 		auf_null,	0,
4887c478bd9Sstevel@tonic-gate aui_sysinfo,	AUE_SYSINFO,	aus_sysinfo,	/* 139 systeminfo */
4897c478bd9Sstevel@tonic-gate 		auf_null,	0,
490*8fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 140 (loadable) sharefs */
4917c478bd9Sstevel@tonic-gate 		auf_null,	0,
4927c478bd9Sstevel@tonic-gate aui_null,	AUE_SETEUID,	aus_seteuid,	/* 141 seteuid */
4937c478bd9Sstevel@tonic-gate 		auf_null,	0,
494657b1f3dSraf aui_forksys,	AUE_NULL,	aus_null,	/* 142 forksys */
4957c478bd9Sstevel@tonic-gate 		auf_null,	0,
496*8fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 143 (loadable) was fork1 */
4977c478bd9Sstevel@tonic-gate 		auf_null,	0,
4987c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 144 sigwait */
4997c478bd9Sstevel@tonic-gate 		auf_null,	0,
5007c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 145 lwp_info */
5017c478bd9Sstevel@tonic-gate 		auf_null,	0,
5027c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 146 yield */
5037c478bd9Sstevel@tonic-gate 		auf_null,	0,
504*8fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 147 (loadable) */
505*8fd04b83SRoger A. Faulkner 						/*	was lwp_sema_wait */
5067c478bd9Sstevel@tonic-gate 		auf_null,	0,
5077c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 148 lwp_sema_post */
5087c478bd9Sstevel@tonic-gate 		auf_null,	0,
5097c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 149 lwp_sema_trywait */
5107c478bd9Sstevel@tonic-gate 		auf_null,	0,
511*8fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 150 lwp_detach */
5127c478bd9Sstevel@tonic-gate 		auf_null,	0,
513*8fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 151 corectl */
5147c478bd9Sstevel@tonic-gate 		auf_null,	0,
5157c478bd9Sstevel@tonic-gate aui_modctl,	AUE_MODCTL,	aus_modctl,	/* 152 modctl */
5167c478bd9Sstevel@tonic-gate 		auf_null,	0,
5177c478bd9Sstevel@tonic-gate aui_null,	AUE_FCHROOT,	aus_null,	/* 153 fchroot */
5187c478bd9Sstevel@tonic-gate 		auf_null,	0,
519*8fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 154 (loadable) was utimes */
5207c478bd9Sstevel@tonic-gate 		auf_null,	0,
5217c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 155 vhangup */
5227c478bd9Sstevel@tonic-gate 		auf_null,	0,
5237c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 156 gettimeofday */
5247c478bd9Sstevel@tonic-gate 		auf_null,	0,
5257c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 157 getitimer */
5267c478bd9Sstevel@tonic-gate 		auf_null,	0,
5277c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 158 setitimer */
5287c478bd9Sstevel@tonic-gate 		auf_null,	0,
5297c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 159 lwp_create */
5307c478bd9Sstevel@tonic-gate 		auf_null,	0,
5317c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 160 lwp_exit */
5327c478bd9Sstevel@tonic-gate 		auf_null,	0,
5337c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 161 lwp_suspend */
5347c478bd9Sstevel@tonic-gate 		auf_null,	0,
5357c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 162 lwp_continue */
5367c478bd9Sstevel@tonic-gate 		auf_null,	0,
5377c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 163 lwp_kill */
5387c478bd9Sstevel@tonic-gate 		auf_null,	0,
5397c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 164 lwp_self */
5407c478bd9Sstevel@tonic-gate 		auf_null,	0,
541*8fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 165 lwp_sigmask */
5427c478bd9Sstevel@tonic-gate 		auf_null,	0,
543*8fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 166 lwp_private */
5447c478bd9Sstevel@tonic-gate 		auf_null,	0,
5457c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 167 lwp_wait */
5467c478bd9Sstevel@tonic-gate 		auf_null,	0,
547883492d5Sraf aui_null,	AUE_NULL,	aus_null,	/* 168 lwp_mutex_wakeup  */
5487c478bd9Sstevel@tonic-gate 		auf_null,	0,
549*8fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 169 (loadable) */
550*8fd04b83SRoger A. Faulkner 						/*	was lwp_mutex_lock */
5517c478bd9Sstevel@tonic-gate 		auf_null,	0,
5527c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 170 lwp_cond_wait */
5537c478bd9Sstevel@tonic-gate 		auf_null,	0,
5547c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 171 lwp_cond_signal */
5557c478bd9Sstevel@tonic-gate 		auf_null,	0,
5567c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 172 lwp_cond_broadcast */
5577c478bd9Sstevel@tonic-gate 		auf_null,	0,
5587c478bd9Sstevel@tonic-gate aui_null,	AUE_READ,	aus_null,	/* 173 pread */
5597c478bd9Sstevel@tonic-gate 		auf_read,	S2E_PUB,
5607c478bd9Sstevel@tonic-gate aui_null,	AUE_WRITE,	aus_null,	/* 174 pwrite */
5617c478bd9Sstevel@tonic-gate 		auf_write,	0,
5627c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 175 llseek */
5637c478bd9Sstevel@tonic-gate 		auf_null,	0,
564*8fd04b83SRoger A. Faulkner aui_null,	AUE_INST_SYNC,	aus_inst_sync,  /* 176 (loadable) inst_sync */
5657c478bd9Sstevel@tonic-gate 		auf_null,	0,
5669acbbeafSnn aui_null,	AUE_BRANDSYS,	aus_brandsys,	/* 177 brandsys */
5677c478bd9Sstevel@tonic-gate 		auf_null,	0,
568*8fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 178 (loadable) kaio */
5697c478bd9Sstevel@tonic-gate 		auf_null,	0,
570*8fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 179 (loadable) cpc */
5717c478bd9Sstevel@tonic-gate 		auf_null,	0,
572*8fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 180 lgrpsys */
5737c478bd9Sstevel@tonic-gate 		auf_null,	0,
574*8fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 181 rusagesys */
5757c478bd9Sstevel@tonic-gate 		auf_null,	0,
576df2381bfSpraks aui_portfs,	AUE_PORTFS,	aus_null,	/* 182 (loadable) portfs */
5777e309bc2SJan Friedel 		auf_null,	S2E_MLD,
578*8fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 183 pollsys */
5797c478bd9Sstevel@tonic-gate 		auf_null,	0,
58061b9bf51Srica aui_labelsys,	AUE_NULL,	aus_labelsys,	/* 184 labelsys */
5817c478bd9Sstevel@tonic-gate 		auf_null,	0,
5827c478bd9Sstevel@tonic-gate aui_acl,	AUE_ACLSET,	aus_acl,	/* 185 acl */
5837c478bd9Sstevel@tonic-gate 		auf_null,	0,
5847c478bd9Sstevel@tonic-gate aui_auditsys,	AUE_AUDITSYS,	aus_auditsys,	/* 186 auditsys  */
5857c478bd9Sstevel@tonic-gate 		auf_null,	0,
586*8fd04b83SRoger A. Faulkner aui_null,	AUE_PROCESSOR_BIND, aus_processor_bind, /* 187 processor_bind */
587*8fd04b83SRoger A. Faulkner 		auf_null,	0,
5887c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 188 processor_info */
5897c478bd9Sstevel@tonic-gate 		auf_null,	0,
5907c478bd9Sstevel@tonic-gate aui_null,	AUE_P_ONLINE,	aus_p_online,	/* 189 p_online */
5917c478bd9Sstevel@tonic-gate 		auf_null,	0,
5927c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_sigqueue,	/* 190 sigqueue */
5937c478bd9Sstevel@tonic-gate 		auf_null,	0,
5947c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 191 clock_gettime */
5957c478bd9Sstevel@tonic-gate 		auf_null,	0,
5967c478bd9Sstevel@tonic-gate aui_null,	AUE_CLOCK_SETTIME,	aus_null,	/* 192 clock_settime */
5977c478bd9Sstevel@tonic-gate 		auf_null,	0,
5987c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 193 clock_getres */
5997c478bd9Sstevel@tonic-gate 		auf_null,	0,
6007c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 194 timer_create */
6017c478bd9Sstevel@tonic-gate 		auf_null,	0,
6027c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 195 timer_delete */
6037c478bd9Sstevel@tonic-gate 		auf_null,	0,
6047c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 196 timer_settime */
6057c478bd9Sstevel@tonic-gate 		auf_null,	0,
6067c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 197 timer_gettime */
6077c478bd9Sstevel@tonic-gate 		auf_null,	0,
6087c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 198 timer_getoverrun */
6097c478bd9Sstevel@tonic-gate 		auf_null,	0,
6107c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 199 nanosleep */
6117c478bd9Sstevel@tonic-gate 		auf_null,	0,
6127c478bd9Sstevel@tonic-gate aui_acl,	AUE_FACLSET,	aus_facl,	/* 200 facl */
6137c478bd9Sstevel@tonic-gate 		auf_null,	0,
6147c478bd9Sstevel@tonic-gate aui_doorfs,	AUE_DOORFS,	aus_doorfs,	/* 201 (loadable) doorfs */
6157c478bd9Sstevel@tonic-gate 		auf_null,	0,
6167c478bd9Sstevel@tonic-gate aui_null,	AUE_SETREUID,	aus_setreuid,	/* 202 setreuid */
6177c478bd9Sstevel@tonic-gate 		auf_null,	0,
6187c478bd9Sstevel@tonic-gate aui_null,	AUE_SETREGID,	aus_setregid,	/* 203 setregid */
6197c478bd9Sstevel@tonic-gate 		auf_null,	0,
6207c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 204 install_utrap */
6217c478bd9Sstevel@tonic-gate 		auf_null,	0,
6227c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 205 signotify */
6237c478bd9Sstevel@tonic-gate 		auf_null,	0,
6247c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 206 schedctl */
6257c478bd9Sstevel@tonic-gate 		auf_null,	0,
6267c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 207 (loadable) pset */
6277c478bd9Sstevel@tonic-gate 		auf_null,	0,
628*8fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 208 sparc_utrap_install */
6297c478bd9Sstevel@tonic-gate 		auf_null,	0,
6307c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 209 resolvepath */
6317c478bd9Sstevel@tonic-gate 		auf_null,	0,
6327c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 210 lwp_mutex_timedlock */
6337c478bd9Sstevel@tonic-gate 		auf_null,	0,
6347c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 211 lwp_sema_timedwait */
6357c478bd9Sstevel@tonic-gate 		auf_null,	0,
6367c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 212 lwp_rwlock_sys */
6377c478bd9Sstevel@tonic-gate 		auf_null,	0,
638*8fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 213 getdents64 */
6397c478bd9Sstevel@tonic-gate 		auf_null,	0,
6407c478bd9Sstevel@tonic-gate aui_null,	AUE_MMAP,	aus_mmap,	/* 214 mmap64 */
6417c478bd9Sstevel@tonic-gate 		auf_null,	0,
6427c478bd9Sstevel@tonic-gate aui_null,	AUE_STAT,	aus_null,	/* 215 stat64 */
6437c478bd9Sstevel@tonic-gate 		auf_null,	S2E_PUB,
6447c478bd9Sstevel@tonic-gate aui_null,	AUE_LSTAT,	aus_null,	/* 216 lstat64 */
6457c478bd9Sstevel@tonic-gate 		auf_null,	S2E_PUB,
6467c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 217 fstat64 */
6477c478bd9Sstevel@tonic-gate 		auf_null,	0,
6487c478bd9Sstevel@tonic-gate aui_null,	AUE_STATVFS,	aus_null,	/* 218 statvfs64 */
6497c478bd9Sstevel@tonic-gate 		auf_null,	S2E_PUB,
6507c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 219 fstatvfs64 */
6517c478bd9Sstevel@tonic-gate 		auf_null,	0,
6527c478bd9Sstevel@tonic-gate aui_null,	AUE_SETRLIMIT,	aus_null,	/* 220 setrlimit64 */
6537c478bd9Sstevel@tonic-gate 		auf_null,	0,
6547c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 221 getrlimit64 */
6557c478bd9Sstevel@tonic-gate 		auf_null,	0,
6567c478bd9Sstevel@tonic-gate aui_null,	AUE_READ,	aus_null,	/* 222 pread64  */
6577c478bd9Sstevel@tonic-gate 		auf_read,	S2E_PUB,
6587c478bd9Sstevel@tonic-gate aui_null,	AUE_WRITE,	aus_null,	/* 223 pwrite64 */
6597c478bd9Sstevel@tonic-gate 		auf_write,	0,
660*8fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 224 (loadable) was creat64 */
661*8fd04b83SRoger A. Faulkner 		auf_null,	0,
6627c478bd9Sstevel@tonic-gate aui_open,	AUE_OPEN,	aus_open,	/* 225 open64 */
6637c478bd9Sstevel@tonic-gate 		auf_null,	S2E_SP,
6647c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 226 (loadable) rpcsys */
6657c478bd9Sstevel@tonic-gate 		auf_null,	0,
666*8fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 227 zone */
6677c478bd9Sstevel@tonic-gate 		auf_null,	0,
668*8fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 228 (loadable) autofssys */
6697c478bd9Sstevel@tonic-gate 		auf_null,	0,
670*8fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 229 getcwd */
6717c478bd9Sstevel@tonic-gate 		auf_null,	0,
6727c478bd9Sstevel@tonic-gate aui_null,	AUE_SOCKET,	aus_socket,	/* 230 so_socket */
6737c478bd9Sstevel@tonic-gate 		auf_null,	0,
6747c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 231 so_socketpair */
6757c478bd9Sstevel@tonic-gate 		auf_null,	0,
6767c478bd9Sstevel@tonic-gate aui_null,	AUE_BIND,	aus_null,	/* 232 bind */
6777c478bd9Sstevel@tonic-gate 		auf_bind,	0,
6787c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 233 listen */
6797c478bd9Sstevel@tonic-gate 		auf_null,	0,
6807c478bd9Sstevel@tonic-gate aui_null,	AUE_ACCEPT,	aus_null,	/* 234 accept */
6817c478bd9Sstevel@tonic-gate 		auf_accept,	0,
6827c478bd9Sstevel@tonic-gate aui_null,	AUE_CONNECT,	aus_null,	/* 235 connect */
6837c478bd9Sstevel@tonic-gate 		auf_connect,	0,
6847c478bd9Sstevel@tonic-gate aui_null,	AUE_SHUTDOWN,	aus_shutdown,	/* 236 shutdown */
6857c478bd9Sstevel@tonic-gate 		auf_null,	0,
6867c478bd9Sstevel@tonic-gate aui_null,	AUE_READ,	aus_null,	/* 237 recv */
6877c478bd9Sstevel@tonic-gate 		auf_recv,	0,
6887c478bd9Sstevel@tonic-gate aui_null,	AUE_RECVFROM,	aus_null,	/* 238 recvfrom */
6897c478bd9Sstevel@tonic-gate 		auf_recvfrom,	0,
6907c478bd9Sstevel@tonic-gate aui_null,	AUE_RECVMSG,	aus_null,	/* 239 recvmsg */
6917c478bd9Sstevel@tonic-gate 		auf_recvmsg,	0,
6927c478bd9Sstevel@tonic-gate aui_null,	AUE_WRITE,	aus_null,	/* 240 send */
6937c478bd9Sstevel@tonic-gate 		auf_send,	0,
6947c478bd9Sstevel@tonic-gate aui_null,	AUE_SENDMSG,	aus_null,	/* 241 sendmsg */
6957c478bd9Sstevel@tonic-gate 		auf_sendmsg,	0,
6967c478bd9Sstevel@tonic-gate aui_null,	AUE_SENDTO,	aus_null,	/* 242 sendto */
6977c478bd9Sstevel@tonic-gate 		auf_sendto,	0,
6987c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 243 getpeername */
6997c478bd9Sstevel@tonic-gate 		auf_null,	0,
7007c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 244 getsockname */
7017c478bd9Sstevel@tonic-gate 		auf_null,	0,
7027c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 245 getsockopt */
7037c478bd9Sstevel@tonic-gate 		auf_null,	0,
7047c478bd9Sstevel@tonic-gate aui_null,	AUE_SETSOCKOPT,	aus_null,	/* 246 setsockopt */
7057c478bd9Sstevel@tonic-gate 		auf_setsockopt,	0,
7067c478bd9Sstevel@tonic-gate aui_null,	AUE_SOCKCONFIG,	aus_sockconfig,	/* 247 sockconfig */
7077c478bd9Sstevel@tonic-gate 		auf_null,	0,
7087c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 248 ntp_gettime */
7097c478bd9Sstevel@tonic-gate 		auf_null,	0,
710*8fd04b83SRoger A. Faulkner aui_null,	AUE_NTP_ADJTIME, aus_null,	/* 249 ntp_adjtime */
7117c478bd9Sstevel@tonic-gate 		auf_null,	0,
7127c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 250 lwp_mutex_unlock */
7137c478bd9Sstevel@tonic-gate 		auf_null,	0,
7147c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 251 lwp_mutex_trylock */
7157c478bd9Sstevel@tonic-gate 		auf_null,	0,
716883492d5Sraf aui_null,	AUE_NULL,	aus_null,	/* 252 lwp_mutex_register */
7177c478bd9Sstevel@tonic-gate 		auf_null,	0,
7187c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 253 cladm */
7197c478bd9Sstevel@tonic-gate 		auf_null,	0,
7209acbbeafSnn aui_null,	AUE_NULL,	aus_null,	/* 254 uucopy */
7217c478bd9Sstevel@tonic-gate 		auf_null,	0,
7227c478bd9Sstevel@tonic-gate aui_null,	AUE_UMOUNT2,	aus_umount2,	/* 255 umount2 */
7237c478bd9Sstevel@tonic-gate 		auf_null,	0
7247c478bd9Sstevel@tonic-gate };
7257c478bd9Sstevel@tonic-gate 
7267c478bd9Sstevel@tonic-gate uint_t num_syscall = sizeof (audit_s2e) / sizeof (struct audit_s2e);
7277c478bd9Sstevel@tonic-gate 
7287c478bd9Sstevel@tonic-gate 
7297c478bd9Sstevel@tonic-gate /* acct start function */
7307c478bd9Sstevel@tonic-gate /*ARGSUSED*/
7317c478bd9Sstevel@tonic-gate static void
7327c478bd9Sstevel@tonic-gate aus_acct(struct t_audit_data *tad)
7337c478bd9Sstevel@tonic-gate {
7347c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
7357c478bd9Sstevel@tonic-gate 	uintptr_t fname;
7367c478bd9Sstevel@tonic-gate 
7377c478bd9Sstevel@tonic-gate 	struct a {
7387c478bd9Sstevel@tonic-gate 		long	fname;		/* char * */
7397c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
7407c478bd9Sstevel@tonic-gate 
7417c478bd9Sstevel@tonic-gate 	fname = (uintptr_t)uap->fname;
7427c478bd9Sstevel@tonic-gate 
7437c478bd9Sstevel@tonic-gate 	if (fname == 0)
7447c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "accounting off", (uint32_t)0));
7457c478bd9Sstevel@tonic-gate }
7467c478bd9Sstevel@tonic-gate 
7477c478bd9Sstevel@tonic-gate /* chown start function */
7487c478bd9Sstevel@tonic-gate /*ARGSUSED*/
7497c478bd9Sstevel@tonic-gate static void
7507c478bd9Sstevel@tonic-gate aus_chown(struct t_audit_data *tad)
7517c478bd9Sstevel@tonic-gate {
7527c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
7537c478bd9Sstevel@tonic-gate 	uint32_t uid, gid;
7547c478bd9Sstevel@tonic-gate 
7557c478bd9Sstevel@tonic-gate 	struct a {
7567c478bd9Sstevel@tonic-gate 		long	fname;		/* char * */
7577c478bd9Sstevel@tonic-gate 		long	uid;
7587c478bd9Sstevel@tonic-gate 		long	gid;
7597c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
7607c478bd9Sstevel@tonic-gate 
7617c478bd9Sstevel@tonic-gate 	uid = (uint32_t)uap->uid;
7627c478bd9Sstevel@tonic-gate 	gid = (uint32_t)uap->gid;
7637c478bd9Sstevel@tonic-gate 
7647c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(2, "new file uid", uid));
7657c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(3, "new file gid", gid));
7667c478bd9Sstevel@tonic-gate }
7677c478bd9Sstevel@tonic-gate 
7687c478bd9Sstevel@tonic-gate /* fchown start function */
7697c478bd9Sstevel@tonic-gate /*ARGSUSED*/
7707c478bd9Sstevel@tonic-gate static void
7717c478bd9Sstevel@tonic-gate aus_fchown(struct t_audit_data *tad)
7727c478bd9Sstevel@tonic-gate {
7737c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
7747c478bd9Sstevel@tonic-gate 	uint32_t uid, gid, fd;
7757c478bd9Sstevel@tonic-gate 	struct file  *fp;
7767c478bd9Sstevel@tonic-gate 	struct vnode *vp;
7777c478bd9Sstevel@tonic-gate 	struct f_audit_data *fad;
7787c478bd9Sstevel@tonic-gate 
7797c478bd9Sstevel@tonic-gate 	struct a {
7807c478bd9Sstevel@tonic-gate 		long fd;
7817c478bd9Sstevel@tonic-gate 		long uid;
7827c478bd9Sstevel@tonic-gate 		long gid;
7837c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
7847c478bd9Sstevel@tonic-gate 
7857c478bd9Sstevel@tonic-gate 	fd  = (uint32_t)uap->fd;
7867c478bd9Sstevel@tonic-gate 	uid = (uint32_t)uap->uid;
7877c478bd9Sstevel@tonic-gate 	gid = (uint32_t)uap->gid;
7887c478bd9Sstevel@tonic-gate 
7897c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(2, "new file uid", uid));
7907c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(3, "new file gid", gid));
7917c478bd9Sstevel@tonic-gate 
7927c478bd9Sstevel@tonic-gate 		/*
7937c478bd9Sstevel@tonic-gate 		 * convert file pointer to file descriptor
7947c478bd9Sstevel@tonic-gate 		 *   Note: fd ref count incremented here.
7957c478bd9Sstevel@tonic-gate 		 */
7967c478bd9Sstevel@tonic-gate 	if ((fp = getf(fd)) == NULL)
7977c478bd9Sstevel@tonic-gate 		return;
7987c478bd9Sstevel@tonic-gate 
7997c478bd9Sstevel@tonic-gate 	/* get path from file struct here */
8007c478bd9Sstevel@tonic-gate 	fad = F2A(fp);
8017c478bd9Sstevel@tonic-gate 	if (fad->fad_aupath != NULL) {
8027c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_path(fad->fad_aupath));
8037c478bd9Sstevel@tonic-gate 	} else {
8047c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "no path: fd", fd));
8057c478bd9Sstevel@tonic-gate 	}
8067c478bd9Sstevel@tonic-gate 
8077c478bd9Sstevel@tonic-gate 	vp = fp->f_vnode;
8087c478bd9Sstevel@tonic-gate 	audit_attributes(vp);
8097c478bd9Sstevel@tonic-gate 
8107c478bd9Sstevel@tonic-gate 	/* decrement file descriptor reference count */
8117c478bd9Sstevel@tonic-gate 	releasef(fd);
8127c478bd9Sstevel@tonic-gate }
8137c478bd9Sstevel@tonic-gate 
8147c478bd9Sstevel@tonic-gate /*ARGSUSED*/
8157c478bd9Sstevel@tonic-gate static void
8167c478bd9Sstevel@tonic-gate aus_lchown(struct t_audit_data *tad)
8177c478bd9Sstevel@tonic-gate {
8187c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
8197c478bd9Sstevel@tonic-gate 	uint32_t uid, gid;
8207c478bd9Sstevel@tonic-gate 
8217c478bd9Sstevel@tonic-gate 
8227c478bd9Sstevel@tonic-gate 	struct a {
8237c478bd9Sstevel@tonic-gate 		long	fname;		/* char	* */
8247c478bd9Sstevel@tonic-gate 		long	uid;
8257c478bd9Sstevel@tonic-gate 		long	gid;
8267c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
8277c478bd9Sstevel@tonic-gate 
8287c478bd9Sstevel@tonic-gate 	uid = (uint32_t)uap->uid;
8297c478bd9Sstevel@tonic-gate 	gid = (uint32_t)uap->gid;
8307c478bd9Sstevel@tonic-gate 
8317c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(2, "new file uid", uid));
8327c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(3, "new file gid", gid));
8337c478bd9Sstevel@tonic-gate }
8347c478bd9Sstevel@tonic-gate 
835*8fd04b83SRoger A. Faulkner static au_event_t
836*8fd04b83SRoger A. Faulkner aui_fchownat(au_event_t e)
837*8fd04b83SRoger A. Faulkner {
838*8fd04b83SRoger A. Faulkner 	klwp_t *clwp = ttolwp(curthread);
839*8fd04b83SRoger A. Faulkner 
840*8fd04b83SRoger A. Faulkner 	struct a {
841*8fd04b83SRoger A. Faulkner 		long	fd;
842*8fd04b83SRoger A. Faulkner 		long	fname;		/* char * */
843*8fd04b83SRoger A. Faulkner 		long	uid;
844*8fd04b83SRoger A. Faulkner 		long	gid;
845*8fd04b83SRoger A. Faulkner 		long	flags;
846*8fd04b83SRoger A. Faulkner 	} *uap = (struct a *)clwp->lwp_ap;
847*8fd04b83SRoger A. Faulkner 
848*8fd04b83SRoger A. Faulkner 	if (uap->fname == NULL)
849*8fd04b83SRoger A. Faulkner 		e = AUE_FCHOWN;
850*8fd04b83SRoger A. Faulkner 	else if (uap->flags & AT_SYMLINK_NOFOLLOW)
851*8fd04b83SRoger A. Faulkner 		e = AUE_LCHOWN;
852*8fd04b83SRoger A. Faulkner 	else
853*8fd04b83SRoger A. Faulkner 		e = AUE_CHOWN;
854*8fd04b83SRoger A. Faulkner 
855*8fd04b83SRoger A. Faulkner 	return (e);
856*8fd04b83SRoger A. Faulkner }
857*8fd04b83SRoger A. Faulkner 
858*8fd04b83SRoger A. Faulkner /*ARGSUSED*/
859*8fd04b83SRoger A. Faulkner static void
860*8fd04b83SRoger A. Faulkner aus_fchownat(struct t_audit_data *tad)
861*8fd04b83SRoger A. Faulkner {
862*8fd04b83SRoger A. Faulkner 	klwp_t *clwp = ttolwp(curthread);
863*8fd04b83SRoger A. Faulkner 	uint32_t uid, gid;
864*8fd04b83SRoger A. Faulkner 
865*8fd04b83SRoger A. Faulkner 	struct a {
866*8fd04b83SRoger A. Faulkner 		long	fd;
867*8fd04b83SRoger A. Faulkner 		long	fname;		/* char * */
868*8fd04b83SRoger A. Faulkner 		long	uid;
869*8fd04b83SRoger A. Faulkner 		long	gid;
870*8fd04b83SRoger A. Faulkner 		long	flags;
871*8fd04b83SRoger A. Faulkner 	} *uap = (struct a *)clwp->lwp_ap;
872*8fd04b83SRoger A. Faulkner 
873*8fd04b83SRoger A. Faulkner 	uid = (uint32_t)uap->uid;
874*8fd04b83SRoger A. Faulkner 	gid = (uint32_t)uap->gid;
875*8fd04b83SRoger A. Faulkner 
876*8fd04b83SRoger A. Faulkner 	au_uwrite(au_to_arg32(3, "new file uid", uid));
877*8fd04b83SRoger A. Faulkner 	au_uwrite(au_to_arg32(4, "new file gid", gid));
878*8fd04b83SRoger A. Faulkner }
879*8fd04b83SRoger A. Faulkner 
8807c478bd9Sstevel@tonic-gate /* chmod start function */
8817c478bd9Sstevel@tonic-gate /*ARGSUSED*/
8827c478bd9Sstevel@tonic-gate static void
8837c478bd9Sstevel@tonic-gate aus_chmod(struct t_audit_data *tad)
8847c478bd9Sstevel@tonic-gate {
8857c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
8867c478bd9Sstevel@tonic-gate 	uint32_t fmode;
8877c478bd9Sstevel@tonic-gate 
8887c478bd9Sstevel@tonic-gate 	struct a {
8897c478bd9Sstevel@tonic-gate 		long	fname;		/* char	* */
8907c478bd9Sstevel@tonic-gate 		long	fmode;
8917c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
8927c478bd9Sstevel@tonic-gate 
8937c478bd9Sstevel@tonic-gate 	fmode = (uint32_t)uap->fmode;
8947c478bd9Sstevel@tonic-gate 
8957c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(2, "new file mode", fmode&07777));
8967c478bd9Sstevel@tonic-gate }
8977c478bd9Sstevel@tonic-gate 
8987c478bd9Sstevel@tonic-gate /* chmod start function */
8997c478bd9Sstevel@tonic-gate /*ARGSUSED*/
9007c478bd9Sstevel@tonic-gate static void
9017c478bd9Sstevel@tonic-gate aus_fchmod(struct t_audit_data *tad)
9027c478bd9Sstevel@tonic-gate {
9037c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
9047c478bd9Sstevel@tonic-gate 	uint32_t fmode, fd;
9057c478bd9Sstevel@tonic-gate 	struct file  *fp;
9067c478bd9Sstevel@tonic-gate 	struct vnode *vp;
9077c478bd9Sstevel@tonic-gate 	struct f_audit_data *fad;
9087c478bd9Sstevel@tonic-gate 
9097c478bd9Sstevel@tonic-gate 	struct a {
9107c478bd9Sstevel@tonic-gate 		long	fd;
9117c478bd9Sstevel@tonic-gate 		long	fmode;
9127c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
9137c478bd9Sstevel@tonic-gate 
9147c478bd9Sstevel@tonic-gate 	fd = (uint32_t)uap->fd;
9157c478bd9Sstevel@tonic-gate 	fmode = (uint32_t)uap->fmode;
9167c478bd9Sstevel@tonic-gate 
9177c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(2, "new file mode", fmode&07777));
9187c478bd9Sstevel@tonic-gate 
9197c478bd9Sstevel@tonic-gate 		/*
9207c478bd9Sstevel@tonic-gate 		 * convert file pointer to file descriptor
9217c478bd9Sstevel@tonic-gate 		 *   Note: fd ref count incremented here.
9227c478bd9Sstevel@tonic-gate 		 */
9237c478bd9Sstevel@tonic-gate 	if ((fp = getf(fd)) == NULL)
9247c478bd9Sstevel@tonic-gate 		return;
9257c478bd9Sstevel@tonic-gate 
9267c478bd9Sstevel@tonic-gate 		/* get path from file struct here */
9277c478bd9Sstevel@tonic-gate 	fad = F2A(fp);
9287c478bd9Sstevel@tonic-gate 	if (fad->fad_aupath != NULL) {
9297c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_path(fad->fad_aupath));
9307c478bd9Sstevel@tonic-gate 	} else {
9317c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "no path: fd", fd));
9327c478bd9Sstevel@tonic-gate 	}
9337c478bd9Sstevel@tonic-gate 
9347c478bd9Sstevel@tonic-gate 	vp = fp->f_vnode;
9357c478bd9Sstevel@tonic-gate 	audit_attributes(vp);
9367c478bd9Sstevel@tonic-gate 
9377c478bd9Sstevel@tonic-gate 	/* decrement file descriptor reference count */
9387c478bd9Sstevel@tonic-gate 	releasef(fd);
9397c478bd9Sstevel@tonic-gate }
9407c478bd9Sstevel@tonic-gate 
941*8fd04b83SRoger A. Faulkner /*
942*8fd04b83SRoger A. Faulkner  * convert open mode to appropriate open event
943*8fd04b83SRoger A. Faulkner  */
944*8fd04b83SRoger A. Faulkner au_event_t
945*8fd04b83SRoger A. Faulkner open_event(uint_t fm)
946*8fd04b83SRoger A. Faulkner {
947*8fd04b83SRoger A. Faulkner 	au_event_t e;
948*8fd04b83SRoger A. Faulkner 
949*8fd04b83SRoger A. Faulkner 	switch (fm & (O_RDONLY|O_WRONLY|O_RDWR|O_CREAT|O_TRUNC)) {
950*8fd04b83SRoger A. Faulkner 	case O_RDONLY:
951*8fd04b83SRoger A. Faulkner 		e = AUE_OPEN_R;
952*8fd04b83SRoger A. Faulkner 		break;
953*8fd04b83SRoger A. Faulkner 	case O_RDONLY | O_CREAT:
954*8fd04b83SRoger A. Faulkner 		e = AUE_OPEN_RC;
955*8fd04b83SRoger A. Faulkner 		break;
956*8fd04b83SRoger A. Faulkner 	case O_RDONLY | O_TRUNC:
957*8fd04b83SRoger A. Faulkner 		e = AUE_OPEN_RT;
958*8fd04b83SRoger A. Faulkner 		break;
959*8fd04b83SRoger A. Faulkner 	case O_RDONLY | O_TRUNC | O_CREAT:
960*8fd04b83SRoger A. Faulkner 		e = AUE_OPEN_RTC;
961*8fd04b83SRoger A. Faulkner 		break;
962*8fd04b83SRoger A. Faulkner 	case O_WRONLY:
963*8fd04b83SRoger A. Faulkner 		e = AUE_OPEN_W;
964*8fd04b83SRoger A. Faulkner 		break;
965*8fd04b83SRoger A. Faulkner 	case O_WRONLY | O_CREAT:
966*8fd04b83SRoger A. Faulkner 		e = AUE_OPEN_WC;
967*8fd04b83SRoger A. Faulkner 		break;
968*8fd04b83SRoger A. Faulkner 	case O_WRONLY | O_TRUNC:
969*8fd04b83SRoger A. Faulkner 		e = AUE_OPEN_WT;
970*8fd04b83SRoger A. Faulkner 		break;
971*8fd04b83SRoger A. Faulkner 	case O_WRONLY | O_TRUNC | O_CREAT:
972*8fd04b83SRoger A. Faulkner 		e = AUE_OPEN_WTC;
973*8fd04b83SRoger A. Faulkner 		break;
974*8fd04b83SRoger A. Faulkner 	case O_RDWR:
975*8fd04b83SRoger A. Faulkner 		e = AUE_OPEN_RW;
976*8fd04b83SRoger A. Faulkner 		break;
977*8fd04b83SRoger A. Faulkner 	case O_RDWR | O_CREAT:
978*8fd04b83SRoger A. Faulkner 		e = AUE_OPEN_RWC;
979*8fd04b83SRoger A. Faulkner 		break;
980*8fd04b83SRoger A. Faulkner 	case O_RDWR | O_TRUNC:
981*8fd04b83SRoger A. Faulkner 		e = AUE_OPEN_RWT;
982*8fd04b83SRoger A. Faulkner 		break;
983*8fd04b83SRoger A. Faulkner 	case O_RDWR | O_TRUNC | O_CREAT:
984*8fd04b83SRoger A. Faulkner 		e = AUE_OPEN_RWTC;
985*8fd04b83SRoger A. Faulkner 		break;
986*8fd04b83SRoger A. Faulkner 	default:
987*8fd04b83SRoger A. Faulkner 		e = AUE_NULL;
988*8fd04b83SRoger A. Faulkner 		break;
989*8fd04b83SRoger A. Faulkner 	}
9907c478bd9Sstevel@tonic-gate 
991*8fd04b83SRoger A. Faulkner 	return (e);
992*8fd04b83SRoger A. Faulkner }
993*8fd04b83SRoger A. Faulkner 
994*8fd04b83SRoger A. Faulkner /* ARGSUSED */
9957c478bd9Sstevel@tonic-gate static au_event_t
9967c478bd9Sstevel@tonic-gate aui_open(au_event_t e)
9977c478bd9Sstevel@tonic-gate {
998*8fd04b83SRoger A. Faulkner 	t_audit_data_t *tad = T2A(curthread);
9997c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
10007c478bd9Sstevel@tonic-gate 	uint_t fm;
10017c478bd9Sstevel@tonic-gate 
10027c478bd9Sstevel@tonic-gate 	struct a {
10037c478bd9Sstevel@tonic-gate 		long	fnamep;		/* char	* */
10047c478bd9Sstevel@tonic-gate 		long	fmode;
10057c478bd9Sstevel@tonic-gate 		long	cmode;
10067c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
10077c478bd9Sstevel@tonic-gate 
10087c478bd9Sstevel@tonic-gate 	fm = (uint_t)uap->fmode;
10097c478bd9Sstevel@tonic-gate 
1010*8fd04b83SRoger A. Faulkner 	/* convert to appropriate au_ctrl */
1011*8fd04b83SRoger A. Faulkner 	if (fm & (FXATTR | FXATTRDIROPEN))
1012*8fd04b83SRoger A. Faulkner 		tad->tad_ctrl |= PAD_ATTPATH;
10137c478bd9Sstevel@tonic-gate 
1014*8fd04b83SRoger A. Faulkner 	return (open_event(fm));
10157c478bd9Sstevel@tonic-gate }
10167c478bd9Sstevel@tonic-gate 
10177c478bd9Sstevel@tonic-gate static void
10187c478bd9Sstevel@tonic-gate aus_open(struct t_audit_data *tad)
10197c478bd9Sstevel@tonic-gate {
10207c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
10217c478bd9Sstevel@tonic-gate 	uint_t fm;
10227c478bd9Sstevel@tonic-gate 
10237c478bd9Sstevel@tonic-gate 	struct a {
10247c478bd9Sstevel@tonic-gate 		long	fnamep;		/* char	* */
10257c478bd9Sstevel@tonic-gate 		long	fmode;
10267c478bd9Sstevel@tonic-gate 		long	cmode;
10277c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
10287c478bd9Sstevel@tonic-gate 
10297c478bd9Sstevel@tonic-gate 	fm = (uint_t)uap->fmode;
10307c478bd9Sstevel@tonic-gate 
10317c478bd9Sstevel@tonic-gate 	/* If no write, create, or trunc modes, mark as a public op */
1032*8fd04b83SRoger A. Faulkner 	if ((fm & (O_RDONLY|O_WRONLY|O_RDWR|O_CREAT|O_TRUNC)) == O_RDONLY)
10337c478bd9Sstevel@tonic-gate 		tad->tad_ctrl |= PAD_PUBLIC_EV;
10347c478bd9Sstevel@tonic-gate }
10357c478bd9Sstevel@tonic-gate 
1036*8fd04b83SRoger A. Faulkner /* ARGSUSED */
10377c478bd9Sstevel@tonic-gate static au_event_t
1038*8fd04b83SRoger A. Faulkner aui_openat(au_event_t e)
10397c478bd9Sstevel@tonic-gate {
1040*8fd04b83SRoger A. Faulkner 	t_audit_data_t *tad = T2A(curthread);
10417c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
1042*8fd04b83SRoger A. Faulkner 	uint_t fm;
1043*8fd04b83SRoger A. Faulkner 
10447c478bd9Sstevel@tonic-gate 	struct a {
1045*8fd04b83SRoger A. Faulkner 		long	filedes;
1046*8fd04b83SRoger A. Faulkner 		long	fnamep;		/* char	* */
1047*8fd04b83SRoger A. Faulkner 		long	fmode;
1048*8fd04b83SRoger A. Faulkner 		long	cmode;
10497c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
10507c478bd9Sstevel@tonic-gate 
1051*8fd04b83SRoger A. Faulkner 	fm = (uint_t)uap->fmode;
10527c478bd9Sstevel@tonic-gate 
1053*8fd04b83SRoger A. Faulkner 	/* convert to appropriate au_ctrl */
1054*8fd04b83SRoger A. Faulkner 	if (fm & (FXATTR | FXATTRDIROPEN))
1055*8fd04b83SRoger A. Faulkner 		tad->tad_ctrl |= PAD_ATTPATH;
10567c478bd9Sstevel@tonic-gate 
1057*8fd04b83SRoger A. Faulkner 	return (open_event(fm));
1058*8fd04b83SRoger A. Faulkner }
10597c478bd9Sstevel@tonic-gate 
1060*8fd04b83SRoger A. Faulkner static void
1061*8fd04b83SRoger A. Faulkner aus_openat(struct t_audit_data *tad)
1062*8fd04b83SRoger A. Faulkner {
1063*8fd04b83SRoger A. Faulkner 	klwp_t *clwp = ttolwp(curthread);
1064*8fd04b83SRoger A. Faulkner 	uint_t fm;
10657c478bd9Sstevel@tonic-gate 
1066*8fd04b83SRoger A. Faulkner 	struct a {
1067*8fd04b83SRoger A. Faulkner 		long	filedes;
1068*8fd04b83SRoger A. Faulkner 		long	fnamep;		/* char	* */
1069*8fd04b83SRoger A. Faulkner 		long	fmode;
1070*8fd04b83SRoger A. Faulkner 		long	cmode;
1071*8fd04b83SRoger A. Faulkner 	} *uap = (struct a *)clwp->lwp_ap;
10727c478bd9Sstevel@tonic-gate 
1073*8fd04b83SRoger A. Faulkner 	fm = (uint_t)uap->fmode;
10747c478bd9Sstevel@tonic-gate 
1075*8fd04b83SRoger A. Faulkner 	/* If no write, create, or trunc modes, mark as a public op */
1076*8fd04b83SRoger A. Faulkner 	if ((fm & (O_RDONLY|O_WRONLY|O_RDWR|O_CREAT|O_TRUNC)) == O_RDONLY)
1077*8fd04b83SRoger A. Faulkner 		tad->tad_ctrl |= PAD_PUBLIC_EV;
10787c478bd9Sstevel@tonic-gate }
10797c478bd9Sstevel@tonic-gate 
1080*8fd04b83SRoger A. Faulkner static au_event_t
1081*8fd04b83SRoger A. Faulkner aui_unlinkat(au_event_t e)
10827c478bd9Sstevel@tonic-gate {
10837c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
1084*8fd04b83SRoger A. Faulkner 
10857c478bd9Sstevel@tonic-gate 	struct a {
1086*8fd04b83SRoger A. Faulkner 		long	filedes;
1087*8fd04b83SRoger A. Faulkner 		long	fnamep;		/* char	* */
1088*8fd04b83SRoger A. Faulkner 		long	flags;
10897c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
10907c478bd9Sstevel@tonic-gate 
1091*8fd04b83SRoger A. Faulkner 	if (uap->flags & AT_REMOVEDIR)
1092*8fd04b83SRoger A. Faulkner 		e = AUE_RMDIR;
1093*8fd04b83SRoger A. Faulkner 	else
1094*8fd04b83SRoger A. Faulkner 		e = AUE_UNLINK;
10957c478bd9Sstevel@tonic-gate 
1096*8fd04b83SRoger A. Faulkner 	return (e);
1097*8fd04b83SRoger A. Faulkner }
10987c478bd9Sstevel@tonic-gate 
1099*8fd04b83SRoger A. Faulkner static au_event_t
1100*8fd04b83SRoger A. Faulkner aui_fstatat(au_event_t e)
1101*8fd04b83SRoger A. Faulkner {
1102*8fd04b83SRoger A. Faulkner 	klwp_t *clwp = ttolwp(curthread);
11037c478bd9Sstevel@tonic-gate 
1104*8fd04b83SRoger A. Faulkner 	struct a {
1105*8fd04b83SRoger A. Faulkner 		long	filedes;
1106*8fd04b83SRoger A. Faulkner 		long	fnamep;		/* char	* */
1107*8fd04b83SRoger A. Faulkner 		long	statb;
1108*8fd04b83SRoger A. Faulkner 		long	flags;
1109*8fd04b83SRoger A. Faulkner 	} *uap = (struct a *)clwp->lwp_ap;
1110*8fd04b83SRoger A. Faulkner 
1111*8fd04b83SRoger A. Faulkner 	if (uap->fnamep == NULL)
1112*8fd04b83SRoger A. Faulkner 		e = AUE_FSTAT;
1113*8fd04b83SRoger A. Faulkner 	else if (uap->flags & AT_SYMLINK_NOFOLLOW)
1114*8fd04b83SRoger A. Faulkner 		e = AUE_LSTAT;
1115*8fd04b83SRoger A. Faulkner 	else
1116*8fd04b83SRoger A. Faulkner 		e = AUE_STAT;
1117*8fd04b83SRoger A. Faulkner 
1118*8fd04b83SRoger A. Faulkner 	return (e);
11197c478bd9Sstevel@tonic-gate }
11207c478bd9Sstevel@tonic-gate 
11217c478bd9Sstevel@tonic-gate /* msgsys */
11227c478bd9Sstevel@tonic-gate static au_event_t
11237c478bd9Sstevel@tonic-gate aui_msgsys(au_event_t e)
11247c478bd9Sstevel@tonic-gate {
11257c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
11267c478bd9Sstevel@tonic-gate 	uint_t fm;
11277c478bd9Sstevel@tonic-gate 
11287c478bd9Sstevel@tonic-gate 	struct a {
11297c478bd9Sstevel@tonic-gate 		long	id;	/* function code id */
11307c478bd9Sstevel@tonic-gate 		long	ap;	/* arg pointer for recvmsg */
11317c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
11327c478bd9Sstevel@tonic-gate 
11337c478bd9Sstevel@tonic-gate 	struct b {
11347c478bd9Sstevel@tonic-gate 		long	msgid;
11357c478bd9Sstevel@tonic-gate 		long	cmd;
11367c478bd9Sstevel@tonic-gate 		long	buf;	/* struct msqid_ds * */
11377c478bd9Sstevel@tonic-gate 	} *uap1 = (struct b *)&clwp->lwp_ap[1];
11387c478bd9Sstevel@tonic-gate 
11397c478bd9Sstevel@tonic-gate 	fm  = (uint_t)uap->id;
11407c478bd9Sstevel@tonic-gate 
11417c478bd9Sstevel@tonic-gate 	switch (fm) {
11427c478bd9Sstevel@tonic-gate 	case 0:		/* msgget */
11437c478bd9Sstevel@tonic-gate 		e = AUE_MSGGET;
11447c478bd9Sstevel@tonic-gate 		break;
11457c478bd9Sstevel@tonic-gate 	case 1:		/* msgctl */
11467c478bd9Sstevel@tonic-gate 		switch ((uint_t)uap1->cmd) {
11477c478bd9Sstevel@tonic-gate 		case IPC_RMID:
11487c478bd9Sstevel@tonic-gate 			e = AUE_MSGCTL_RMID;
11497c478bd9Sstevel@tonic-gate 			break;
11507c478bd9Sstevel@tonic-gate 		case IPC_SET:
11517c478bd9Sstevel@tonic-gate 			e = AUE_MSGCTL_SET;
11527c478bd9Sstevel@tonic-gate 			break;
11537c478bd9Sstevel@tonic-gate 		case IPC_STAT:
11547c478bd9Sstevel@tonic-gate 			e = AUE_MSGCTL_STAT;
11557c478bd9Sstevel@tonic-gate 			break;
11567c478bd9Sstevel@tonic-gate 		default:
11577c478bd9Sstevel@tonic-gate 			e = AUE_MSGCTL;
11587c478bd9Sstevel@tonic-gate 			break;
11597c478bd9Sstevel@tonic-gate 		}
11607c478bd9Sstevel@tonic-gate 		break;
11617c478bd9Sstevel@tonic-gate 	case 2:		/* msgrcv */
11627c478bd9Sstevel@tonic-gate 		e = AUE_MSGRCV;
11637c478bd9Sstevel@tonic-gate 		break;
11647c478bd9Sstevel@tonic-gate 	case 3:		/* msgsnd */
11657c478bd9Sstevel@tonic-gate 		e = AUE_MSGSND;
11667c478bd9Sstevel@tonic-gate 		break;
11677c478bd9Sstevel@tonic-gate 	default:	/* illegal system call */
11687c478bd9Sstevel@tonic-gate 		e = AUE_NULL;
11697c478bd9Sstevel@tonic-gate 		break;
11707c478bd9Sstevel@tonic-gate 	}
11717c478bd9Sstevel@tonic-gate 
11727c478bd9Sstevel@tonic-gate 	return (e);
11737c478bd9Sstevel@tonic-gate }
11747c478bd9Sstevel@tonic-gate 
11757c478bd9Sstevel@tonic-gate 
11767c478bd9Sstevel@tonic-gate /* shmsys */
11777c478bd9Sstevel@tonic-gate static au_event_t
11787c478bd9Sstevel@tonic-gate aui_shmsys(au_event_t e)
11797c478bd9Sstevel@tonic-gate {
11807c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
11817c478bd9Sstevel@tonic-gate 	int fm;
11827c478bd9Sstevel@tonic-gate 
11837c478bd9Sstevel@tonic-gate 	struct a {		/* shmsys */
11847c478bd9Sstevel@tonic-gate 		long	id;	/* function code id */
11857c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
11867c478bd9Sstevel@tonic-gate 
11877c478bd9Sstevel@tonic-gate 	struct b {		/* ctrl */
11887c478bd9Sstevel@tonic-gate 		long	shmid;
11897c478bd9Sstevel@tonic-gate 		long	cmd;
11907c478bd9Sstevel@tonic-gate 		long	arg;		/* struct shmid_ds * */
11917c478bd9Sstevel@tonic-gate 	} *uap1 = (struct b *)&clwp->lwp_ap[1];
11927c478bd9Sstevel@tonic-gate 	fm  = (uint_t)uap->id;
11937c478bd9Sstevel@tonic-gate 
11947c478bd9Sstevel@tonic-gate 	switch (fm) {
11957c478bd9Sstevel@tonic-gate 	case 0:		/* shmat */
11967c478bd9Sstevel@tonic-gate 		e = AUE_SHMAT;
11977c478bd9Sstevel@tonic-gate 		break;
11987c478bd9Sstevel@tonic-gate 	case 1:		/* shmctl */
11997c478bd9Sstevel@tonic-gate 		switch ((uint_t)uap1->cmd) {
12007c478bd9Sstevel@tonic-gate 		case IPC_RMID:
12017c478bd9Sstevel@tonic-gate 			e = AUE_SHMCTL_RMID;
12027c478bd9Sstevel@tonic-gate 			break;
12037c478bd9Sstevel@tonic-gate 		case IPC_SET:
12047c478bd9Sstevel@tonic-gate 			e = AUE_SHMCTL_SET;
12057c478bd9Sstevel@tonic-gate 			break;
12067c478bd9Sstevel@tonic-gate 		case IPC_STAT:
12077c478bd9Sstevel@tonic-gate 			e = AUE_SHMCTL_STAT;
12087c478bd9Sstevel@tonic-gate 			break;
12097c478bd9Sstevel@tonic-gate 		default:
12107c478bd9Sstevel@tonic-gate 			e = AUE_SHMCTL;
12117c478bd9Sstevel@tonic-gate 			break;
12127c478bd9Sstevel@tonic-gate 		}
12137c478bd9Sstevel@tonic-gate 		break;
12147c478bd9Sstevel@tonic-gate 	case 2:		/* shmdt */
12157c478bd9Sstevel@tonic-gate 		e = AUE_SHMDT;
12167c478bd9Sstevel@tonic-gate 		break;
12177c478bd9Sstevel@tonic-gate 	case 3:		/* shmget */
12187c478bd9Sstevel@tonic-gate 		e = AUE_SHMGET;
12197c478bd9Sstevel@tonic-gate 		break;
12207c478bd9Sstevel@tonic-gate 	default:	/* illegal system call */
12217c478bd9Sstevel@tonic-gate 		e = AUE_NULL;
12227c478bd9Sstevel@tonic-gate 		break;
12237c478bd9Sstevel@tonic-gate 	}
12247c478bd9Sstevel@tonic-gate 
12257c478bd9Sstevel@tonic-gate 	return (e);
12267c478bd9Sstevel@tonic-gate }
12277c478bd9Sstevel@tonic-gate 
12287c478bd9Sstevel@tonic-gate 
12297c478bd9Sstevel@tonic-gate /* semsys */
12307c478bd9Sstevel@tonic-gate static au_event_t
12317c478bd9Sstevel@tonic-gate aui_semsys(au_event_t e)
12327c478bd9Sstevel@tonic-gate {
12337c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
12347c478bd9Sstevel@tonic-gate 	uint_t fm;
12357c478bd9Sstevel@tonic-gate 
12367c478bd9Sstevel@tonic-gate 	struct a {		/* semsys */
12377c478bd9Sstevel@tonic-gate 		long	id;
12387c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
12397c478bd9Sstevel@tonic-gate 
12407c478bd9Sstevel@tonic-gate 	struct b {		/* ctrl */
12417c478bd9Sstevel@tonic-gate 		long	semid;
12427c478bd9Sstevel@tonic-gate 		long	semnum;
12437c478bd9Sstevel@tonic-gate 		long	cmd;
12447c478bd9Sstevel@tonic-gate 		long	arg;
12457c478bd9Sstevel@tonic-gate 	} *uap1 = (struct b *)&clwp->lwp_ap[1];
12467c478bd9Sstevel@tonic-gate 
12477c478bd9Sstevel@tonic-gate 	fm = (uint_t)uap->id;
12487c478bd9Sstevel@tonic-gate 
12497c478bd9Sstevel@tonic-gate 	switch (fm) {
12507c478bd9Sstevel@tonic-gate 	case 0:		/* semctl */
12517c478bd9Sstevel@tonic-gate 		switch ((uint_t)uap1->cmd) {
12527c478bd9Sstevel@tonic-gate 		case IPC_RMID:
12537c478bd9Sstevel@tonic-gate 			e = AUE_SEMCTL_RMID;
12547c478bd9Sstevel@tonic-gate 			break;
12557c478bd9Sstevel@tonic-gate 		case IPC_SET:
12567c478bd9Sstevel@tonic-gate 			e = AUE_SEMCTL_SET;
12577c478bd9Sstevel@tonic-gate 			break;
12587c478bd9Sstevel@tonic-gate 		case IPC_STAT:
12597c478bd9Sstevel@tonic-gate 			e = AUE_SEMCTL_STAT;
12607c478bd9Sstevel@tonic-gate 			break;
12617c478bd9Sstevel@tonic-gate 		case GETNCNT:
12627c478bd9Sstevel@tonic-gate 			e = AUE_SEMCTL_GETNCNT;
12637c478bd9Sstevel@tonic-gate 			break;
12647c478bd9Sstevel@tonic-gate 		case GETPID:
12657c478bd9Sstevel@tonic-gate 			e = AUE_SEMCTL_GETPID;
12667c478bd9Sstevel@tonic-gate 			break;
12677c478bd9Sstevel@tonic-gate 		case GETVAL:
12687c478bd9Sstevel@tonic-gate 			e = AUE_SEMCTL_GETVAL;
12697c478bd9Sstevel@tonic-gate 			break;
12707c478bd9Sstevel@tonic-gate 		case GETALL:
12717c478bd9Sstevel@tonic-gate 			e = AUE_SEMCTL_GETALL;
12727c478bd9Sstevel@tonic-gate 			break;
12737c478bd9Sstevel@tonic-gate 		case GETZCNT:
12747c478bd9Sstevel@tonic-gate 			e = AUE_SEMCTL_GETZCNT;
12757c478bd9Sstevel@tonic-gate 			break;
12767c478bd9Sstevel@tonic-gate 		case SETVAL:
12777c478bd9Sstevel@tonic-gate 			e = AUE_SEMCTL_SETVAL;
12787c478bd9Sstevel@tonic-gate 			break;
12797c478bd9Sstevel@tonic-gate 		case SETALL:
12807c478bd9Sstevel@tonic-gate 			e = AUE_SEMCTL_SETALL;
12817c478bd9Sstevel@tonic-gate 			break;
12827c478bd9Sstevel@tonic-gate 		default:
12837c478bd9Sstevel@tonic-gate 			e = AUE_SEMCTL;
12847c478bd9Sstevel@tonic-gate 			break;
12857c478bd9Sstevel@tonic-gate 		}
12867c478bd9Sstevel@tonic-gate 		break;
12877c478bd9Sstevel@tonic-gate 	case 1:		/* semget */
12887c478bd9Sstevel@tonic-gate 		e = AUE_SEMGET;
12897c478bd9Sstevel@tonic-gate 		break;
12907c478bd9Sstevel@tonic-gate 	case 2:		/* semop */
12917c478bd9Sstevel@tonic-gate 		e = AUE_SEMOP;
12927c478bd9Sstevel@tonic-gate 		break;
12937c478bd9Sstevel@tonic-gate 	default:	/* illegal system call */
12947c478bd9Sstevel@tonic-gate 		e = AUE_NULL;
12957c478bd9Sstevel@tonic-gate 		break;
12967c478bd9Sstevel@tonic-gate 	}
12977c478bd9Sstevel@tonic-gate 
12987c478bd9Sstevel@tonic-gate 	return (e);
12997c478bd9Sstevel@tonic-gate }
13007c478bd9Sstevel@tonic-gate 
13017c478bd9Sstevel@tonic-gate /* utssys - uname(2), ustat(2), fusers(2) */
13027c478bd9Sstevel@tonic-gate static au_event_t
13037c478bd9Sstevel@tonic-gate aui_utssys(au_event_t e)
13047c478bd9Sstevel@tonic-gate {
13057c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
13067c478bd9Sstevel@tonic-gate 	uint_t type;
13077c478bd9Sstevel@tonic-gate 
13087c478bd9Sstevel@tonic-gate 	struct a {
13097c478bd9Sstevel@tonic-gate 		union {
13107c478bd9Sstevel@tonic-gate 			long	cbuf;		/* char * */
13117c478bd9Sstevel@tonic-gate 			long	ubuf;		/* struct stat * */
13127c478bd9Sstevel@tonic-gate 		} ub;
13137c478bd9Sstevel@tonic-gate 		union {
13147c478bd9Sstevel@tonic-gate 			long	mv;	/* for USTAT */
13157c478bd9Sstevel@tonic-gate 			long	flags;	/* for FUSERS */
13167c478bd9Sstevel@tonic-gate 		} un;
13177c478bd9Sstevel@tonic-gate 		long	type;
13187c478bd9Sstevel@tonic-gate 		long	outbp;		/* char * for FUSERS */
13197c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
13207c478bd9Sstevel@tonic-gate 
13217c478bd9Sstevel@tonic-gate 	type = (uint_t)uap->type;
13227c478bd9Sstevel@tonic-gate 
13237c478bd9Sstevel@tonic-gate 	if (type == UTS_FUSERS)
13247c478bd9Sstevel@tonic-gate 		return (e);
13257c478bd9Sstevel@tonic-gate 	else
13267c478bd9Sstevel@tonic-gate 		return ((au_event_t)AUE_NULL);
13277c478bd9Sstevel@tonic-gate }
13287c478bd9Sstevel@tonic-gate 
13297c478bd9Sstevel@tonic-gate static au_event_t
13307c478bd9Sstevel@tonic-gate aui_fcntl(au_event_t e)
13317c478bd9Sstevel@tonic-gate {
13327c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
13337c478bd9Sstevel@tonic-gate 	uint_t cmd;
13347c478bd9Sstevel@tonic-gate 
13357c478bd9Sstevel@tonic-gate 	struct a {
13367c478bd9Sstevel@tonic-gate 		long	fdes;
13377c478bd9Sstevel@tonic-gate 		long	cmd;
13387c478bd9Sstevel@tonic-gate 		long	arg;
13397c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
13407c478bd9Sstevel@tonic-gate 
13417c478bd9Sstevel@tonic-gate 	cmd = (uint_t)uap->cmd;
13427c478bd9Sstevel@tonic-gate 
13437c478bd9Sstevel@tonic-gate 	switch (cmd) {
13447c478bd9Sstevel@tonic-gate 	case F_GETLK:
13457c478bd9Sstevel@tonic-gate 	case F_SETLK:
13467c478bd9Sstevel@tonic-gate 	case F_SETLKW:
13477c478bd9Sstevel@tonic-gate 		break;
13487c478bd9Sstevel@tonic-gate 	case F_SETFL:
13497c478bd9Sstevel@tonic-gate 	case F_GETFL:
13507c478bd9Sstevel@tonic-gate 	case F_GETFD:
13517c478bd9Sstevel@tonic-gate 		break;
13527c478bd9Sstevel@tonic-gate 	default:
13537c478bd9Sstevel@tonic-gate 		e = (au_event_t)AUE_NULL;
13547c478bd9Sstevel@tonic-gate 		break;
13557c478bd9Sstevel@tonic-gate 	}
13567c478bd9Sstevel@tonic-gate 	return ((au_event_t)e);
13577c478bd9Sstevel@tonic-gate }
13587c478bd9Sstevel@tonic-gate 
13597c478bd9Sstevel@tonic-gate /* null function for now */
13607c478bd9Sstevel@tonic-gate static au_event_t
13617c478bd9Sstevel@tonic-gate aui_execve(au_event_t e)
13627c478bd9Sstevel@tonic-gate {
13637c478bd9Sstevel@tonic-gate 	return (e);
13647c478bd9Sstevel@tonic-gate }
13657c478bd9Sstevel@tonic-gate 
13667c478bd9Sstevel@tonic-gate /*ARGSUSED*/
13677c478bd9Sstevel@tonic-gate static void
13687c478bd9Sstevel@tonic-gate aus_fcntl(struct t_audit_data *tad)
13697c478bd9Sstevel@tonic-gate {
13707c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
13717c478bd9Sstevel@tonic-gate 	uint32_t cmd, fd;
13727c478bd9Sstevel@tonic-gate 	struct file  *fp;
13737c478bd9Sstevel@tonic-gate 	struct vnode *vp;
13747c478bd9Sstevel@tonic-gate 	struct f_audit_data *fad;
13757c478bd9Sstevel@tonic-gate 
13767c478bd9Sstevel@tonic-gate 	struct a {
13777c478bd9Sstevel@tonic-gate 		long	fd;
13787c478bd9Sstevel@tonic-gate 		long	cmd;
13797c478bd9Sstevel@tonic-gate 		long	arg;
13807c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
13817c478bd9Sstevel@tonic-gate 
13827c478bd9Sstevel@tonic-gate 	cmd = (uint32_t)uap->cmd;
13837c478bd9Sstevel@tonic-gate 	fd  = (uint32_t)uap->fd;
13847c478bd9Sstevel@tonic-gate 
13857c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(2, "cmd", cmd));
13867c478bd9Sstevel@tonic-gate 
13877c478bd9Sstevel@tonic-gate 		/*
13887c478bd9Sstevel@tonic-gate 		 * convert file pointer to file descriptor
13897c478bd9Sstevel@tonic-gate 		 *   Note: fd ref count incremented here.
13907c478bd9Sstevel@tonic-gate 		 */
13917c478bd9Sstevel@tonic-gate 	if ((fp = getf(fd)) == NULL)
13927c478bd9Sstevel@tonic-gate 		return;
13937c478bd9Sstevel@tonic-gate 
13947c478bd9Sstevel@tonic-gate 	/* get path from file struct here */
13957c478bd9Sstevel@tonic-gate 	fad = F2A(fp);
13967c478bd9Sstevel@tonic-gate 	if (fad->fad_aupath != NULL) {
13977c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_path(fad->fad_aupath));
13987c478bd9Sstevel@tonic-gate 	} else {
13997c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "no path: fd", fd));
14007c478bd9Sstevel@tonic-gate 	}
14017c478bd9Sstevel@tonic-gate 
14027c478bd9Sstevel@tonic-gate 	vp = fp->f_vnode;
14037c478bd9Sstevel@tonic-gate 	audit_attributes(vp);
14047c478bd9Sstevel@tonic-gate 
14057c478bd9Sstevel@tonic-gate 	/* decrement file descriptor reference count */
14067c478bd9Sstevel@tonic-gate 	releasef(fd);
14077c478bd9Sstevel@tonic-gate }
14087c478bd9Sstevel@tonic-gate 
14097c478bd9Sstevel@tonic-gate /*ARGSUSED*/
14107c478bd9Sstevel@tonic-gate static void
14117c478bd9Sstevel@tonic-gate aus_kill(struct t_audit_data *tad)
14127c478bd9Sstevel@tonic-gate {
14137c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
14147c478bd9Sstevel@tonic-gate 	struct proc *p;
14157c478bd9Sstevel@tonic-gate 	uint32_t signo;
14167c478bd9Sstevel@tonic-gate 	uid_t uid, ruid;
14177c478bd9Sstevel@tonic-gate 	gid_t gid, rgid;
14187c478bd9Sstevel@tonic-gate 	pid_t pid;
14197c478bd9Sstevel@tonic-gate 	const auditinfo_addr_t *ainfo;
14207c478bd9Sstevel@tonic-gate 	cred_t *cr;
14217c478bd9Sstevel@tonic-gate 
14227c478bd9Sstevel@tonic-gate 	struct a {
14237c478bd9Sstevel@tonic-gate 		long	pid;
14247c478bd9Sstevel@tonic-gate 		long	signo;
14257c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
14267c478bd9Sstevel@tonic-gate 
14277c478bd9Sstevel@tonic-gate 	pid   = (pid_t)uap->pid;
14287c478bd9Sstevel@tonic-gate 	signo = (uint32_t)uap->signo;
14297c478bd9Sstevel@tonic-gate 
14307c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(2, "signal", signo));
14317c478bd9Sstevel@tonic-gate 	if (pid > 0) {
14327c478bd9Sstevel@tonic-gate 		mutex_enter(&pidlock);
14337c478bd9Sstevel@tonic-gate 		if (((p = prfind(pid)) == (struct proc *)0) ||
14347c478bd9Sstevel@tonic-gate 		    (p->p_stat == SIDL)) {
14357c478bd9Sstevel@tonic-gate 			mutex_exit(&pidlock);
14367c478bd9Sstevel@tonic-gate 			au_uwrite(au_to_arg32(1, "process", (uint32_t)pid));
14377c478bd9Sstevel@tonic-gate 			return;
14387c478bd9Sstevel@tonic-gate 		}
14397c478bd9Sstevel@tonic-gate 		mutex_enter(&p->p_lock); /* so process doesn't go away */
14407c478bd9Sstevel@tonic-gate 		mutex_exit(&pidlock);
14417c478bd9Sstevel@tonic-gate 
14427c478bd9Sstevel@tonic-gate 		mutex_enter(&p->p_crlock);
14437c478bd9Sstevel@tonic-gate 		crhold(cr = p->p_cred);
14447c478bd9Sstevel@tonic-gate 		mutex_exit(&p->p_crlock);
14457c478bd9Sstevel@tonic-gate 		mutex_exit(&p->p_lock);
14467c478bd9Sstevel@tonic-gate 
14477c478bd9Sstevel@tonic-gate 		ainfo = crgetauinfo(cr);
14487c478bd9Sstevel@tonic-gate 		if (ainfo == NULL) {
14497c478bd9Sstevel@tonic-gate 			crfree(cr);
14507c478bd9Sstevel@tonic-gate 			au_uwrite(au_to_arg32(1, "process", (uint32_t)pid));
14517c478bd9Sstevel@tonic-gate 			return;
14527c478bd9Sstevel@tonic-gate 		}
14537c478bd9Sstevel@tonic-gate 
14547c478bd9Sstevel@tonic-gate 		uid  = crgetuid(cr);
14557c478bd9Sstevel@tonic-gate 		gid  = crgetgid(cr);
14567c478bd9Sstevel@tonic-gate 		ruid = crgetruid(cr);
14577c478bd9Sstevel@tonic-gate 		rgid = crgetrgid(cr);
14587c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_process(uid, gid, ruid, rgid, pid,
14597c478bd9Sstevel@tonic-gate 		    ainfo->ai_auid, ainfo->ai_asid, &ainfo->ai_termid));
146045916cd2Sjpk 
146145916cd2Sjpk 		if (is_system_labeled())
146245916cd2Sjpk 			au_uwrite(au_to_label(CR_SL(cr)));
146345916cd2Sjpk 
14647c478bd9Sstevel@tonic-gate 		crfree(cr);
14657c478bd9Sstevel@tonic-gate 	}
14667c478bd9Sstevel@tonic-gate 	else
14677c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "process", (uint32_t)pid));
14687c478bd9Sstevel@tonic-gate }
14697c478bd9Sstevel@tonic-gate 
14707c478bd9Sstevel@tonic-gate /*ARGSUSED*/
14717c478bd9Sstevel@tonic-gate static void
14727c478bd9Sstevel@tonic-gate aus_mkdir(struct t_audit_data *tad)
14737c478bd9Sstevel@tonic-gate {
14747c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
14757c478bd9Sstevel@tonic-gate 	uint32_t dmode;
14767c478bd9Sstevel@tonic-gate 
14777c478bd9Sstevel@tonic-gate 	struct a {
14787c478bd9Sstevel@tonic-gate 		long	dirnamep;		/* char * */
14797c478bd9Sstevel@tonic-gate 		long	dmode;
14807c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
14817c478bd9Sstevel@tonic-gate 
14827c478bd9Sstevel@tonic-gate 	dmode = (uint32_t)uap->dmode;
14837c478bd9Sstevel@tonic-gate 
14847c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(2, "mode", dmode));
14857c478bd9Sstevel@tonic-gate }
14867c478bd9Sstevel@tonic-gate 
14877c478bd9Sstevel@tonic-gate /*ARGSUSED*/
14887c478bd9Sstevel@tonic-gate static void
14897c478bd9Sstevel@tonic-gate aus_mknod(struct t_audit_data *tad)
14907c478bd9Sstevel@tonic-gate {
14917c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
14927c478bd9Sstevel@tonic-gate 	uint32_t fmode;
14937c478bd9Sstevel@tonic-gate 	dev_t dev;
14947c478bd9Sstevel@tonic-gate 
14957c478bd9Sstevel@tonic-gate 	struct a {
14967c478bd9Sstevel@tonic-gate 		long	pnamep;		/* char * */
14977c478bd9Sstevel@tonic-gate 		long	fmode;
14987c478bd9Sstevel@tonic-gate 		long	dev;
14997c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
15007c478bd9Sstevel@tonic-gate 
15017c478bd9Sstevel@tonic-gate 	fmode = (uint32_t)uap->fmode;
15027c478bd9Sstevel@tonic-gate 	dev   = (dev_t)uap->dev;
15037c478bd9Sstevel@tonic-gate 
15047c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(2, "mode", fmode));
15057c478bd9Sstevel@tonic-gate #ifdef _LP64
15067c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg64(3, "dev", dev));
15077c478bd9Sstevel@tonic-gate #else
15087c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(3, "dev", dev));
15097c478bd9Sstevel@tonic-gate #endif
15107c478bd9Sstevel@tonic-gate }
15117c478bd9Sstevel@tonic-gate 
15127c478bd9Sstevel@tonic-gate /*ARGSUSED*/
15137c478bd9Sstevel@tonic-gate static void
15147c478bd9Sstevel@tonic-gate auf_mknod(struct t_audit_data *tad, int error, rval_t *rval)
15157c478bd9Sstevel@tonic-gate {
15167c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
15177c478bd9Sstevel@tonic-gate 	vnode_t	*dvp;
15187c478bd9Sstevel@tonic-gate 	caddr_t pnamep;
15197c478bd9Sstevel@tonic-gate 
15207c478bd9Sstevel@tonic-gate 	struct a {
15217c478bd9Sstevel@tonic-gate 		long	pnamep;		/* char * */
15227c478bd9Sstevel@tonic-gate 		long	fmode;
15237c478bd9Sstevel@tonic-gate 		long	dev;
15247c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
15257c478bd9Sstevel@tonic-gate 
15267c478bd9Sstevel@tonic-gate 	/* no error, then already path token in audit record */
15277c478bd9Sstevel@tonic-gate 	if (error != EPERM)
15287c478bd9Sstevel@tonic-gate 		return;
15297c478bd9Sstevel@tonic-gate 
15307c478bd9Sstevel@tonic-gate 	/* not auditing this event, nothing then to do */
15317c478bd9Sstevel@tonic-gate 	if (tad->tad_flag == 0)
15327c478bd9Sstevel@tonic-gate 		return;
15337c478bd9Sstevel@tonic-gate 
15347c478bd9Sstevel@tonic-gate 	/* do the lookup to force generation of path token */
15357c478bd9Sstevel@tonic-gate 	pnamep = (caddr_t)uap->pnamep;
15367c478bd9Sstevel@tonic-gate 	tad->tad_ctrl |= PAD_NOATTRB;
15377c478bd9Sstevel@tonic-gate 	error = lookupname(pnamep, UIO_USERSPACE, NO_FOLLOW, &dvp, NULLVPP);
15387c478bd9Sstevel@tonic-gate 	if (error == 0)
15397c478bd9Sstevel@tonic-gate 		VN_RELE(dvp);
15407c478bd9Sstevel@tonic-gate }
15417c478bd9Sstevel@tonic-gate 
15427c478bd9Sstevel@tonic-gate /*ARGSUSED*/
15437c478bd9Sstevel@tonic-gate static void
15447c478bd9Sstevel@tonic-gate aus_mount(struct t_audit_data *tad)
15457c478bd9Sstevel@tonic-gate {	/* AUS_START */
15467c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
15477c478bd9Sstevel@tonic-gate 	uint32_t flags;
15487c478bd9Sstevel@tonic-gate 	uintptr_t u_fstype, dataptr;
15497c478bd9Sstevel@tonic-gate 	STRUCT_DECL(nfs_args, nfsargs);
15507c478bd9Sstevel@tonic-gate 	size_t len;
15517c478bd9Sstevel@tonic-gate 	char *fstype, *hostname;
15527c478bd9Sstevel@tonic-gate 
15537c478bd9Sstevel@tonic-gate 	struct a {
15547c478bd9Sstevel@tonic-gate 		long	spec;		/* char    * */
15557c478bd9Sstevel@tonic-gate 		long	dir;		/* char    * */
15567c478bd9Sstevel@tonic-gate 		long	flags;
15577c478bd9Sstevel@tonic-gate 		long	fstype;		/* char    * */
15587c478bd9Sstevel@tonic-gate 		long	dataptr;	/* char    * */
15597c478bd9Sstevel@tonic-gate 		long	datalen;
15607c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
15617c478bd9Sstevel@tonic-gate 
15627c478bd9Sstevel@tonic-gate 	u_fstype = (uintptr_t)uap->fstype;
15637c478bd9Sstevel@tonic-gate 	flags    = (uint32_t)uap->flags;
15647c478bd9Sstevel@tonic-gate 	dataptr  = (uintptr_t)uap->dataptr;
15657c478bd9Sstevel@tonic-gate 
15667c478bd9Sstevel@tonic-gate 	fstype = kmem_alloc(MAXNAMELEN, KM_SLEEP);
15677c478bd9Sstevel@tonic-gate 	if (copyinstr((caddr_t)u_fstype, (caddr_t)fstype, MAXNAMELEN, &len))
15687c478bd9Sstevel@tonic-gate 		goto mount_free_fstype;
15697c478bd9Sstevel@tonic-gate 
15707c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(3, "flags", flags));
15717c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_text(fstype));
15727c478bd9Sstevel@tonic-gate 
15737c478bd9Sstevel@tonic-gate 	if (strncmp(fstype, "nfs", 3) == 0) {
15747c478bd9Sstevel@tonic-gate 
15757c478bd9Sstevel@tonic-gate 		STRUCT_INIT(nfsargs, get_udatamodel());
15767c478bd9Sstevel@tonic-gate 		bzero(STRUCT_BUF(nfsargs), STRUCT_SIZE(nfsargs));
15777c478bd9Sstevel@tonic-gate 
15787c478bd9Sstevel@tonic-gate 		if (copyin((caddr_t)dataptr,
15797c478bd9Sstevel@tonic-gate 				STRUCT_BUF(nfsargs),
15807c478bd9Sstevel@tonic-gate 				MIN(uap->datalen, STRUCT_SIZE(nfsargs)))) {
15817c478bd9Sstevel@tonic-gate 			/* DEBUG debug_enter((char *)NULL); */
15827c478bd9Sstevel@tonic-gate 			goto mount_free_fstype;
15837c478bd9Sstevel@tonic-gate 		}
15847c478bd9Sstevel@tonic-gate 		hostname = kmem_alloc(MAXNAMELEN, KM_SLEEP);
15857c478bd9Sstevel@tonic-gate 		if (copyinstr(STRUCT_FGETP(nfsargs, hostname),
15867c478bd9Sstevel@tonic-gate 				(caddr_t)hostname,
15877c478bd9Sstevel@tonic-gate 				MAXNAMELEN, &len)) {
15887c478bd9Sstevel@tonic-gate 			goto mount_free_hostname;
15897c478bd9Sstevel@tonic-gate 		}
15907c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_text(hostname));
15917c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(3, "internal flags",
15927c478bd9Sstevel@tonic-gate 			(uint_t)STRUCT_FGET(nfsargs, flags)));
15937c478bd9Sstevel@tonic-gate 
15947c478bd9Sstevel@tonic-gate mount_free_hostname:
15957c478bd9Sstevel@tonic-gate 		kmem_free(hostname, MAXNAMELEN);
15967c478bd9Sstevel@tonic-gate 	}
15977c478bd9Sstevel@tonic-gate 
15987c478bd9Sstevel@tonic-gate mount_free_fstype:
15997c478bd9Sstevel@tonic-gate 	kmem_free(fstype, MAXNAMELEN);
16007c478bd9Sstevel@tonic-gate }	/* AUS_MOUNT */
16017c478bd9Sstevel@tonic-gate 
16027c478bd9Sstevel@tonic-gate static void
16037c478bd9Sstevel@tonic-gate aus_umount_path(caddr_t umount_dir)
16047c478bd9Sstevel@tonic-gate {
16057c478bd9Sstevel@tonic-gate 	char			*dir_path;
16067c478bd9Sstevel@tonic-gate 	struct audit_path	*path;
16077c478bd9Sstevel@tonic-gate 	size_t			path_len, dir_len;
16087c478bd9Sstevel@tonic-gate 
16097c478bd9Sstevel@tonic-gate 	/* length alloc'd for two string pointers */
16107c478bd9Sstevel@tonic-gate 	path_len = sizeof (struct audit_path) + sizeof (char *);
16117c478bd9Sstevel@tonic-gate 	path = kmem_alloc(path_len, KM_SLEEP);
16127c478bd9Sstevel@tonic-gate 	dir_path = kmem_alloc(MAXPATHLEN, KM_SLEEP);
16137c478bd9Sstevel@tonic-gate 
16147c478bd9Sstevel@tonic-gate 	if (copyinstr(umount_dir, (caddr_t)dir_path,
16157c478bd9Sstevel@tonic-gate 	    MAXPATHLEN, &dir_len))
16167c478bd9Sstevel@tonic-gate 		goto umount2_free_dir;
16177c478bd9Sstevel@tonic-gate 
16187c478bd9Sstevel@tonic-gate 	/*
16197c478bd9Sstevel@tonic-gate 	 * the audit_path struct assumes that the buffer pointed to
16207c478bd9Sstevel@tonic-gate 	 * by audp_sect[n] contains string 0 immediatedly followed
16217c478bd9Sstevel@tonic-gate 	 * by string 1.
16227c478bd9Sstevel@tonic-gate 	 */
16237c478bd9Sstevel@tonic-gate 	path->audp_sect[0] = dir_path;
16247c478bd9Sstevel@tonic-gate 	path->audp_sect[1] = dir_path + strlen(dir_path) + 1;
16257c478bd9Sstevel@tonic-gate 	path->audp_size = path_len;
16267c478bd9Sstevel@tonic-gate 	path->audp_ref = 1;		/* not used */
16277c478bd9Sstevel@tonic-gate 	path->audp_cnt = 1;		/* one path string */
16287c478bd9Sstevel@tonic-gate 
16297c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_path(path));
16307c478bd9Sstevel@tonic-gate 
16317c478bd9Sstevel@tonic-gate umount2_free_dir:
16327c478bd9Sstevel@tonic-gate 	kmem_free(dir_path, MAXPATHLEN);
16337c478bd9Sstevel@tonic-gate 	kmem_free(path, path_len);
16347c478bd9Sstevel@tonic-gate }
16357c478bd9Sstevel@tonic-gate 
16367c478bd9Sstevel@tonic-gate /*ARGSUSED*/
16377c478bd9Sstevel@tonic-gate static void
16387c478bd9Sstevel@tonic-gate aus_umount2(struct t_audit_data *tad)
16397c478bd9Sstevel@tonic-gate {
16407c478bd9Sstevel@tonic-gate 	klwp_t			*clwp = ttolwp(curthread);
16417c478bd9Sstevel@tonic-gate 	struct a {
16427c478bd9Sstevel@tonic-gate 		long	dir;		/* char    * */
16437c478bd9Sstevel@tonic-gate 		long	flags;
16447c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
16457c478bd9Sstevel@tonic-gate 
16467c478bd9Sstevel@tonic-gate 	aus_umount_path((caddr_t)uap->dir);
16477c478bd9Sstevel@tonic-gate 
16487c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(2, "flags", (uint32_t)uap->flags));
16497c478bd9Sstevel@tonic-gate }
16507c478bd9Sstevel@tonic-gate 
16517c478bd9Sstevel@tonic-gate static void
16527c478bd9Sstevel@tonic-gate aus_msgsys(struct t_audit_data *tad)
16537c478bd9Sstevel@tonic-gate {
16547c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
16557c478bd9Sstevel@tonic-gate 	uint32_t msgid;
16567c478bd9Sstevel@tonic-gate 
16577c478bd9Sstevel@tonic-gate 	struct b {
16587c478bd9Sstevel@tonic-gate 		long	msgid;
16597c478bd9Sstevel@tonic-gate 		long	cmd;
16607c478bd9Sstevel@tonic-gate 		long	buf;		/* struct msqid_ds * */
16617c478bd9Sstevel@tonic-gate 	} *uap1 = (struct b *)&clwp->lwp_ap[1];
16627c478bd9Sstevel@tonic-gate 
16637c478bd9Sstevel@tonic-gate 	msgid = (uint32_t)uap1->msgid;
16647c478bd9Sstevel@tonic-gate 
16657c478bd9Sstevel@tonic-gate 
16667c478bd9Sstevel@tonic-gate 	switch (tad->tad_event) {
16677c478bd9Sstevel@tonic-gate 	case AUE_MSGGET:		/* msgget */
16687c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "msg key", msgid));
16697c478bd9Sstevel@tonic-gate 		break;
16707c478bd9Sstevel@tonic-gate 	case AUE_MSGCTL:		/* msgctl */
16717c478bd9Sstevel@tonic-gate 	case AUE_MSGCTL_RMID:		/* msgctl */
1672f158b2dfSJan Friedel 	case AUE_MSGCTL_SET:		/* msgctl */
16737c478bd9Sstevel@tonic-gate 	case AUE_MSGCTL_STAT:		/* msgctl */
16747c478bd9Sstevel@tonic-gate 	case AUE_MSGRCV:		/* msgrcv */
16757c478bd9Sstevel@tonic-gate 	case AUE_MSGSND:		/* msgsnd */
16767c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "msg ID", msgid));
16777c478bd9Sstevel@tonic-gate 		break;
16787c478bd9Sstevel@tonic-gate 	}
16797c478bd9Sstevel@tonic-gate }
16807c478bd9Sstevel@tonic-gate 
16817c478bd9Sstevel@tonic-gate /*ARGSUSED*/
16827c478bd9Sstevel@tonic-gate static void
16837c478bd9Sstevel@tonic-gate auf_msgsys(struct t_audit_data *tad, int error, rval_t *rval)
16847c478bd9Sstevel@tonic-gate {
16857c478bd9Sstevel@tonic-gate 	int id;
16867c478bd9Sstevel@tonic-gate 
16877c478bd9Sstevel@tonic-gate 	if (error != 0)
16887c478bd9Sstevel@tonic-gate 		return;
16897c478bd9Sstevel@tonic-gate 	if (tad->tad_event == AUE_MSGGET) {
16907c478bd9Sstevel@tonic-gate 		uint32_t scid;
16917c478bd9Sstevel@tonic-gate 		uint32_t sy_flags;
16927c478bd9Sstevel@tonic-gate 
16937c478bd9Sstevel@tonic-gate 		/* need to determine type of executing binary */
16947c478bd9Sstevel@tonic-gate 		scid = tad->tad_scid;
16957c478bd9Sstevel@tonic-gate #ifdef _SYSCALL32_IMPL
16967c478bd9Sstevel@tonic-gate 		if (lwp_getdatamodel(ttolwp(curthread)) == DATAMODEL_NATIVE)
16977c478bd9Sstevel@tonic-gate 			sy_flags = sysent[scid].sy_flags & SE_RVAL_MASK;
16987c478bd9Sstevel@tonic-gate 		else
16997c478bd9Sstevel@tonic-gate 			sy_flags = sysent32[scid].sy_flags & SE_RVAL_MASK;
17007c478bd9Sstevel@tonic-gate #else
17017c478bd9Sstevel@tonic-gate 		sy_flags = sysent[scid].sy_flags & SE_RVAL_MASK;
17027c478bd9Sstevel@tonic-gate #endif
17037c478bd9Sstevel@tonic-gate 		if (sy_flags == SE_32RVAL1)
17047c478bd9Sstevel@tonic-gate 			id = rval->r_val1;
17057c478bd9Sstevel@tonic-gate 		if (sy_flags == (SE_32RVAL2|SE_32RVAL1))
17067c478bd9Sstevel@tonic-gate 			id = rval->r_val1;
17077c478bd9Sstevel@tonic-gate 		if (sy_flags == SE_64RVAL)
17087c478bd9Sstevel@tonic-gate 			id = (int)rval->r_vals;
17097c478bd9Sstevel@tonic-gate 
17107c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_ipc(AT_IPC_MSG, id));
17117c478bd9Sstevel@tonic-gate 	}
17127c478bd9Sstevel@tonic-gate }
17137c478bd9Sstevel@tonic-gate 
17147c478bd9Sstevel@tonic-gate static void
17157c478bd9Sstevel@tonic-gate aus_semsys(struct t_audit_data *tad)
17167c478bd9Sstevel@tonic-gate {
17177c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
17187c478bd9Sstevel@tonic-gate 	uint32_t semid;
17197c478bd9Sstevel@tonic-gate 
17207c478bd9Sstevel@tonic-gate 	struct b {		/* ctrl */
17217c478bd9Sstevel@tonic-gate 		long	semid;
17227c478bd9Sstevel@tonic-gate 		long	semnum;
17237c478bd9Sstevel@tonic-gate 		long	cmd;
17247c478bd9Sstevel@tonic-gate 		long	arg;
17257c478bd9Sstevel@tonic-gate 	} *uap1 = (struct b *)&clwp->lwp_ap[1];
17267c478bd9Sstevel@tonic-gate 
17277c478bd9Sstevel@tonic-gate 	semid = (uint32_t)uap1->semid;
17287c478bd9Sstevel@tonic-gate 
17297c478bd9Sstevel@tonic-gate 	switch (tad->tad_event) {
17307c478bd9Sstevel@tonic-gate 	case AUE_SEMCTL_RMID:
17317c478bd9Sstevel@tonic-gate 	case AUE_SEMCTL_STAT:
17327c478bd9Sstevel@tonic-gate 	case AUE_SEMCTL_GETNCNT:
17337c478bd9Sstevel@tonic-gate 	case AUE_SEMCTL_GETPID:
17347c478bd9Sstevel@tonic-gate 	case AUE_SEMCTL_GETVAL:
17357c478bd9Sstevel@tonic-gate 	case AUE_SEMCTL_GETALL:
17367c478bd9Sstevel@tonic-gate 	case AUE_SEMCTL_GETZCNT:
1737f158b2dfSJan Friedel 	case AUE_SEMCTL_SET:
17387c478bd9Sstevel@tonic-gate 	case AUE_SEMCTL_SETVAL:
17397c478bd9Sstevel@tonic-gate 	case AUE_SEMCTL_SETALL:
17407c478bd9Sstevel@tonic-gate 	case AUE_SEMCTL:
17417c478bd9Sstevel@tonic-gate 	case AUE_SEMOP:
17427c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "sem ID", semid));
17437c478bd9Sstevel@tonic-gate 		break;
17447c478bd9Sstevel@tonic-gate 	case AUE_SEMGET:
17457c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "sem key", semid));
17467c478bd9Sstevel@tonic-gate 		break;
17477c478bd9Sstevel@tonic-gate 	}
17487c478bd9Sstevel@tonic-gate }
17497c478bd9Sstevel@tonic-gate 
17507c478bd9Sstevel@tonic-gate /*ARGSUSED*/
17517c478bd9Sstevel@tonic-gate static void
17527c478bd9Sstevel@tonic-gate auf_semsys(struct t_audit_data *tad, int error, rval_t *rval)
17537c478bd9Sstevel@tonic-gate {
17547c478bd9Sstevel@tonic-gate 	int id;
17557c478bd9Sstevel@tonic-gate 
17567c478bd9Sstevel@tonic-gate 	if (error != 0)
17577c478bd9Sstevel@tonic-gate 		return;
17587c478bd9Sstevel@tonic-gate 	if (tad->tad_event == AUE_SEMGET) {
17597c478bd9Sstevel@tonic-gate 		uint32_t scid;
17607c478bd9Sstevel@tonic-gate 		uint32_t sy_flags;
17617c478bd9Sstevel@tonic-gate 
17627c478bd9Sstevel@tonic-gate 		/* need to determine type of executing binary */
17637c478bd9Sstevel@tonic-gate 		scid = tad->tad_scid;
17647c478bd9Sstevel@tonic-gate #ifdef _SYSCALL32_IMPL
17657c478bd9Sstevel@tonic-gate 		if (lwp_getdatamodel(ttolwp(curthread)) == DATAMODEL_NATIVE)
17667c478bd9Sstevel@tonic-gate 			sy_flags = sysent[scid].sy_flags & SE_RVAL_MASK;
17677c478bd9Sstevel@tonic-gate 		else
17687c478bd9Sstevel@tonic-gate 			sy_flags = sysent32[scid].sy_flags & SE_RVAL_MASK;
17697c478bd9Sstevel@tonic-gate #else
17707c478bd9Sstevel@tonic-gate 		sy_flags = sysent[scid].sy_flags & SE_RVAL_MASK;
17717c478bd9Sstevel@tonic-gate #endif
17727c478bd9Sstevel@tonic-gate 		if (sy_flags == SE_32RVAL1)
17737c478bd9Sstevel@tonic-gate 			id = rval->r_val1;
17747c478bd9Sstevel@tonic-gate 		if (sy_flags == (SE_32RVAL2|SE_32RVAL1))
17757c478bd9Sstevel@tonic-gate 			id = rval->r_val1;
17767c478bd9Sstevel@tonic-gate 		if (sy_flags == SE_64RVAL)
17777c478bd9Sstevel@tonic-gate 			id = (int)rval->r_vals;
17787c478bd9Sstevel@tonic-gate 
17797c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_ipc(AT_IPC_SEM, id));
17807c478bd9Sstevel@tonic-gate 	}
17817c478bd9Sstevel@tonic-gate }
17827c478bd9Sstevel@tonic-gate 
17837c478bd9Sstevel@tonic-gate /*ARGSUSED*/
17847c478bd9Sstevel@tonic-gate static void
17857c478bd9Sstevel@tonic-gate aus_close(struct t_audit_data *tad)
17867c478bd9Sstevel@tonic-gate {
17877c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
17887c478bd9Sstevel@tonic-gate 	uint32_t fd;
17897c478bd9Sstevel@tonic-gate 	struct file *fp;
17907c478bd9Sstevel@tonic-gate 	struct f_audit_data *fad;
17917c478bd9Sstevel@tonic-gate 	struct vnode *vp;
17927c478bd9Sstevel@tonic-gate 	struct vattr attr;
17939e9e6ab8Spaulson 	au_kcontext_t	*kctx = GET_KCTX_PZ;
17947c478bd9Sstevel@tonic-gate 
17957c478bd9Sstevel@tonic-gate 	struct a {
17967c478bd9Sstevel@tonic-gate 		long	i;
17977c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
17987c478bd9Sstevel@tonic-gate 
17997c478bd9Sstevel@tonic-gate 	fd = (uint32_t)uap->i;
18007c478bd9Sstevel@tonic-gate 
18017c478bd9Sstevel@tonic-gate 	attr.va_mask = 0;
18027c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(1, "fd", fd));
18037c478bd9Sstevel@tonic-gate 
18047c478bd9Sstevel@tonic-gate 		/*
18057c478bd9Sstevel@tonic-gate 		 * convert file pointer to file descriptor
18067c478bd9Sstevel@tonic-gate 		 *   Note: fd ref count incremented here.
18077c478bd9Sstevel@tonic-gate 		 */
18087c478bd9Sstevel@tonic-gate 	if ((fp = getf(fd)) == NULL)
18097c478bd9Sstevel@tonic-gate 		return;
18107c478bd9Sstevel@tonic-gate 
18117c478bd9Sstevel@tonic-gate 	fad = F2A(fp);
1812d0fa49b7STony Nguyen 	tad->tad_evmod = (au_emod_t)fad->fad_flags;
18137c478bd9Sstevel@tonic-gate 	if (fad->fad_aupath != NULL) {
18147c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_path(fad->fad_aupath));
18157c478bd9Sstevel@tonic-gate 		if ((vp = fp->f_vnode) != NULL) {
18167c478bd9Sstevel@tonic-gate 			attr.va_mask = AT_ALL;
1817da6c28aaSamw 			if (VOP_GETATTR(vp, &attr, 0, CRED(), NULL) == 0) {
18187c478bd9Sstevel@tonic-gate 				/*
18197c478bd9Sstevel@tonic-gate 				 * When write was not used and the file can be
18207c478bd9Sstevel@tonic-gate 				 * considered public, skip the audit.
18217c478bd9Sstevel@tonic-gate 				 */
18227c478bd9Sstevel@tonic-gate 				if (((fp->f_flag & FWRITE) == 0) &&
18237c478bd9Sstevel@tonic-gate 				    file_is_public(&attr)) {
18247c478bd9Sstevel@tonic-gate 					tad->tad_flag = 0;
18257c478bd9Sstevel@tonic-gate 					tad->tad_evmod = 0;
18267c478bd9Sstevel@tonic-gate 					/* free any residual audit data */
18277c478bd9Sstevel@tonic-gate 					au_close(kctx, &(u_ad), 0, 0, 0);
18287c478bd9Sstevel@tonic-gate 					releasef(fd);
18297c478bd9Sstevel@tonic-gate 					return;
18307c478bd9Sstevel@tonic-gate 				}
183145916cd2Sjpk 				au_uwrite(au_to_attr(&attr));
183245916cd2Sjpk 				audit_sec_attributes(&(u_ad), vp);
18337c478bd9Sstevel@tonic-gate 			}
18347c478bd9Sstevel@tonic-gate 		}
18357c478bd9Sstevel@tonic-gate 	}
18367c478bd9Sstevel@tonic-gate 
18377c478bd9Sstevel@tonic-gate 	/* decrement file descriptor reference count */
18387c478bd9Sstevel@tonic-gate 	releasef(fd);
18397c478bd9Sstevel@tonic-gate }
18407c478bd9Sstevel@tonic-gate 
18417c478bd9Sstevel@tonic-gate /*ARGSUSED*/
18427c478bd9Sstevel@tonic-gate static void
18437c478bd9Sstevel@tonic-gate aus_fstatfs(struct t_audit_data *tad)
18447c478bd9Sstevel@tonic-gate {
18457c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
18467c478bd9Sstevel@tonic-gate 	uint32_t fd;
18477c478bd9Sstevel@tonic-gate 	struct file  *fp;
18487c478bd9Sstevel@tonic-gate 	struct vnode *vp;
18497c478bd9Sstevel@tonic-gate 	struct f_audit_data *fad;
18507c478bd9Sstevel@tonic-gate 
18517c478bd9Sstevel@tonic-gate 	struct a {
18527c478bd9Sstevel@tonic-gate 		long	fd;
18537c478bd9Sstevel@tonic-gate 		long	buf;		/* struct statfs * */
18547c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
18557c478bd9Sstevel@tonic-gate 
18567c478bd9Sstevel@tonic-gate 	fd = (uint_t)uap->fd;
18577c478bd9Sstevel@tonic-gate 
18587c478bd9Sstevel@tonic-gate 		/*
18597c478bd9Sstevel@tonic-gate 		 * convert file pointer to file descriptor
18607c478bd9Sstevel@tonic-gate 		 *   Note: fd ref count incremented here.
18617c478bd9Sstevel@tonic-gate 		 */
18627c478bd9Sstevel@tonic-gate 	if ((fp = getf(fd)) == NULL)
18637c478bd9Sstevel@tonic-gate 		return;
18647c478bd9Sstevel@tonic-gate 
18657c478bd9Sstevel@tonic-gate 		/* get path from file struct here */
18667c478bd9Sstevel@tonic-gate 	fad = F2A(fp);
18677c478bd9Sstevel@tonic-gate 	if (fad->fad_aupath != NULL) {
18687c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_path(fad->fad_aupath));
18697c478bd9Sstevel@tonic-gate 	} else {
18707c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "no path: fd", fd));
18717c478bd9Sstevel@tonic-gate 	}
18727c478bd9Sstevel@tonic-gate 
18737c478bd9Sstevel@tonic-gate 	vp = fp->f_vnode;
18747c478bd9Sstevel@tonic-gate 	audit_attributes(vp);
18757c478bd9Sstevel@tonic-gate 
18767c478bd9Sstevel@tonic-gate 	/* decrement file descriptor reference count */
18777c478bd9Sstevel@tonic-gate 	releasef(fd);
18787c478bd9Sstevel@tonic-gate }
18797c478bd9Sstevel@tonic-gate 
18804be8c573SJan Friedel static au_event_t
18814be8c573SJan Friedel aui_setpgrp(au_event_t e)
18824be8c573SJan Friedel {
18834be8c573SJan Friedel 	klwp_t *clwp = ttolwp(curthread);
18844be8c573SJan Friedel 	int flag;
18854be8c573SJan Friedel 
18864be8c573SJan Friedel 	struct a {
18874be8c573SJan Friedel 		long	flag;
18884be8c573SJan Friedel 		long	pid;
18894be8c573SJan Friedel 		long	pgid;
18904be8c573SJan Friedel 	} *uap = (struct a *)clwp->lwp_ap;
18914be8c573SJan Friedel 
18924be8c573SJan Friedel 	flag = (int)uap->flag;
18934be8c573SJan Friedel 
18944be8c573SJan Friedel 
18954be8c573SJan Friedel 	switch (flag) {
18964be8c573SJan Friedel 
18974be8c573SJan Friedel 	case 1:	/* setpgrp() */
18984be8c573SJan Friedel 		e = AUE_SETPGRP;
18994be8c573SJan Friedel 		break;
19004be8c573SJan Friedel 
19014be8c573SJan Friedel 	case 3: /* setsid() */
19024be8c573SJan Friedel 		e = AUE_SETSID;
19034be8c573SJan Friedel 		break;
19044be8c573SJan Friedel 
19054be8c573SJan Friedel 	case 5: /* setpgid() */
19064be8c573SJan Friedel 		e = AUE_SETPGID;
19074be8c573SJan Friedel 		break;
19084be8c573SJan Friedel 
19094be8c573SJan Friedel 	case 0: /* getpgrp()	- not security relevant */
19104be8c573SJan Friedel 	case 2: /* getsid()	- not security relevant */
19114be8c573SJan Friedel 	case 4: /* getpgid() 	- not security relevant */
19124be8c573SJan Friedel 		e = AUE_NULL;
19134be8c573SJan Friedel 		break;
19144be8c573SJan Friedel 
19154be8c573SJan Friedel 	default:
19164be8c573SJan Friedel 		e = AUE_NULL;
19174be8c573SJan Friedel 		break;
19184be8c573SJan Friedel 	}
19194be8c573SJan Friedel 
19204be8c573SJan Friedel 	return (e);
19214be8c573SJan Friedel }
19224be8c573SJan Friedel 
192345a9a7b1SJan Friedel /*ARGSUSED*/
19247c478bd9Sstevel@tonic-gate static void
19257c478bd9Sstevel@tonic-gate aus_setpgrp(struct t_audit_data *tad)
19267c478bd9Sstevel@tonic-gate {
19274be8c573SJan Friedel 	klwp_t		*clwp = ttolwp(curthread);
19284be8c573SJan Friedel 	pid_t		pgid;
19294be8c573SJan Friedel 	struct proc	*p;
19304be8c573SJan Friedel 	uid_t		uid, ruid;
19314be8c573SJan Friedel 	gid_t		gid, rgid;
19324be8c573SJan Friedel 	pid_t		pid;
19334be8c573SJan Friedel 	cred_t		*cr;
19344be8c573SJan Friedel 	int		flag;
19354be8c573SJan Friedel 	const auditinfo_addr_t	*ainfo;
19367c478bd9Sstevel@tonic-gate 
19377c478bd9Sstevel@tonic-gate 	struct a {
19384be8c573SJan Friedel 		long	flag;
19397c478bd9Sstevel@tonic-gate 		long	pid;
19404be8c573SJan Friedel 		long	pgid;
19417c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
19427c478bd9Sstevel@tonic-gate 
19434be8c573SJan Friedel 	flag = (int)uap->flag;
19447c478bd9Sstevel@tonic-gate 	pid  = (pid_t)uap->pid;
19454be8c573SJan Friedel 	pgid = (pid_t)uap->pgid;
19464be8c573SJan Friedel 
19474be8c573SJan Friedel 
19484be8c573SJan Friedel 	switch (flag) {
19494be8c573SJan Friedel 
19504be8c573SJan Friedel 	case 0: /* getpgrp() */
19514be8c573SJan Friedel 	case 1: /* setpgrp() */
19524be8c573SJan Friedel 	case 2: /* getsid() */
19534be8c573SJan Friedel 	case 3: /* setsid() */
19544be8c573SJan Friedel 	case 4: /* getpgid() */
19554be8c573SJan Friedel 		break;
19564be8c573SJan Friedel 
19574be8c573SJan Friedel 	case 5: /* setpgid() */
19587c478bd9Sstevel@tonic-gate 
19597c478bd9Sstevel@tonic-gate 		/* current process? */
19604be8c573SJan Friedel 		if (pid == 0) {
19614be8c573SJan Friedel 			return;
19624be8c573SJan Friedel 		}
19637c478bd9Sstevel@tonic-gate 
19644be8c573SJan Friedel 		mutex_enter(&pidlock);
19654be8c573SJan Friedel 		p = prfind(pid);
19664be8c573SJan Friedel 		if (p == NULL || p->p_as == &kas ||
19674be8c573SJan Friedel 		    p->p_stat == SIDL || p->p_stat == SZOMB) {
19684be8c573SJan Friedel 			mutex_exit(&pidlock);
19694be8c573SJan Friedel 			return;
19704be8c573SJan Friedel 		}
19714be8c573SJan Friedel 		mutex_enter(&p->p_lock);	/* so process doesn't go away */
19727c478bd9Sstevel@tonic-gate 		mutex_exit(&pidlock);
19737c478bd9Sstevel@tonic-gate 
19744be8c573SJan Friedel 		mutex_enter(&p->p_crlock);
19754be8c573SJan Friedel 		crhold(cr = p->p_cred);
19764be8c573SJan Friedel 		mutex_exit(&p->p_crlock);
19774be8c573SJan Friedel 		mutex_exit(&p->p_lock);
19784be8c573SJan Friedel 
19794be8c573SJan Friedel 		ainfo = crgetauinfo(cr);
19804be8c573SJan Friedel 		if (ainfo == NULL) {
19814be8c573SJan Friedel 			crfree(cr);
19824be8c573SJan Friedel 			return;
19834be8c573SJan Friedel 		}
19847c478bd9Sstevel@tonic-gate 
19854be8c573SJan Friedel 		uid  = crgetuid(cr);
19864be8c573SJan Friedel 		gid  = crgetgid(cr);
19874be8c573SJan Friedel 		ruid = crgetruid(cr);
19884be8c573SJan Friedel 		rgid = crgetrgid(cr);
19894be8c573SJan Friedel 		au_uwrite(au_to_process(uid, gid, ruid, rgid, pid,
19904be8c573SJan Friedel 		    ainfo->ai_auid, ainfo->ai_asid, &ainfo->ai_termid));
19917c478bd9Sstevel@tonic-gate 		crfree(cr);
19924be8c573SJan Friedel 		au_uwrite(au_to_arg32(2, "pgid", pgid));
19934be8c573SJan Friedel 		break;
19947c478bd9Sstevel@tonic-gate 
19954be8c573SJan Friedel 	default:
19964be8c573SJan Friedel 		break;
19974be8c573SJan Friedel 	}
19987c478bd9Sstevel@tonic-gate }
19994be8c573SJan Friedel 
20007c478bd9Sstevel@tonic-gate 
20017c478bd9Sstevel@tonic-gate /*ARGSUSED*/
20027c478bd9Sstevel@tonic-gate static void
20037c478bd9Sstevel@tonic-gate aus_setregid(struct t_audit_data *tad)
20047c478bd9Sstevel@tonic-gate {
20057c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
20067c478bd9Sstevel@tonic-gate 	uint32_t rgid, egid;
20077c478bd9Sstevel@tonic-gate 
20087c478bd9Sstevel@tonic-gate 	struct a {
20097c478bd9Sstevel@tonic-gate 		long	 rgid;
20107c478bd9Sstevel@tonic-gate 		long	 egid;
20117c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
20127c478bd9Sstevel@tonic-gate 
20137c478bd9Sstevel@tonic-gate 	rgid  = (uint32_t)uap->rgid;
20147c478bd9Sstevel@tonic-gate 	egid  = (uint32_t)uap->egid;
20157c478bd9Sstevel@tonic-gate 
20167c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(1, "rgid", rgid));
20177c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(2, "egid", egid));
20187c478bd9Sstevel@tonic-gate }
20197c478bd9Sstevel@tonic-gate 
20207c478bd9Sstevel@tonic-gate /*ARGSUSED*/
20217c478bd9Sstevel@tonic-gate static void
20227c478bd9Sstevel@tonic-gate aus_setgid(struct t_audit_data *tad)
20237c478bd9Sstevel@tonic-gate {
20247c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
20257c478bd9Sstevel@tonic-gate 	uint32_t gid;
20267c478bd9Sstevel@tonic-gate 
20277c478bd9Sstevel@tonic-gate 	struct a {
20287c478bd9Sstevel@tonic-gate 		long	gid;
20297c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
20307c478bd9Sstevel@tonic-gate 
20317c478bd9Sstevel@tonic-gate 	gid = (uint32_t)uap->gid;
20327c478bd9Sstevel@tonic-gate 
20337c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(1, "gid", gid));
20347c478bd9Sstevel@tonic-gate }
20357c478bd9Sstevel@tonic-gate 
20367c478bd9Sstevel@tonic-gate 
20377c478bd9Sstevel@tonic-gate /*ARGSUSED*/
20387c478bd9Sstevel@tonic-gate static void
20397c478bd9Sstevel@tonic-gate aus_setreuid(struct t_audit_data *tad)
20407c478bd9Sstevel@tonic-gate {
20417c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
20427c478bd9Sstevel@tonic-gate 	uint32_t ruid, euid;
20437c478bd9Sstevel@tonic-gate 
20447c478bd9Sstevel@tonic-gate 	struct a {
20457c478bd9Sstevel@tonic-gate 		long	ruid;
20467c478bd9Sstevel@tonic-gate 		long	euid;
20477c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
20487c478bd9Sstevel@tonic-gate 
20497c478bd9Sstevel@tonic-gate 	ruid = (uint32_t)uap->ruid;
20507c478bd9Sstevel@tonic-gate 	euid  = (uint32_t)uap->euid;
20517c478bd9Sstevel@tonic-gate 
20527c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(1, "ruid", ruid));
20537c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(2, "euid", euid));
20547c478bd9Sstevel@tonic-gate }
20557c478bd9Sstevel@tonic-gate 
20567c478bd9Sstevel@tonic-gate 
20577c478bd9Sstevel@tonic-gate /*ARGSUSED*/
20587c478bd9Sstevel@tonic-gate static void
20597c478bd9Sstevel@tonic-gate aus_setuid(struct t_audit_data *tad)
20607c478bd9Sstevel@tonic-gate {
20617c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
20627c478bd9Sstevel@tonic-gate 	uint32_t uid;
20637c478bd9Sstevel@tonic-gate 
20647c478bd9Sstevel@tonic-gate 	struct a {
20657c478bd9Sstevel@tonic-gate 		long	uid;
20667c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
20677c478bd9Sstevel@tonic-gate 
20687c478bd9Sstevel@tonic-gate 	uid = (uint32_t)uap->uid;
20697c478bd9Sstevel@tonic-gate 
20707c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(1, "uid", uid));
20717c478bd9Sstevel@tonic-gate }
20727c478bd9Sstevel@tonic-gate 
20737c478bd9Sstevel@tonic-gate /*ARGSUSED*/
20747c478bd9Sstevel@tonic-gate static void
20757c478bd9Sstevel@tonic-gate aus_shmsys(struct t_audit_data *tad)
20767c478bd9Sstevel@tonic-gate {
20777c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
20787c478bd9Sstevel@tonic-gate 	uint32_t id, cmd;
20797c478bd9Sstevel@tonic-gate 
20807c478bd9Sstevel@tonic-gate 	struct b {
20817c478bd9Sstevel@tonic-gate 		long	id;
20827c478bd9Sstevel@tonic-gate 		long	cmd;
20837c478bd9Sstevel@tonic-gate 		long	buf;		/* struct shmid_ds * */
20847c478bd9Sstevel@tonic-gate 	} *uap1 = (struct b *)&clwp->lwp_ap[1];
20857c478bd9Sstevel@tonic-gate 
20867c478bd9Sstevel@tonic-gate 	id  = (uint32_t)uap1->id;
20877c478bd9Sstevel@tonic-gate 	cmd = (uint32_t)uap1->cmd;
20887c478bd9Sstevel@tonic-gate 
20897c478bd9Sstevel@tonic-gate 	switch (tad->tad_event) {
20907c478bd9Sstevel@tonic-gate 	case AUE_SHMGET:			/* shmget */
20917c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "shm key", id));
20927c478bd9Sstevel@tonic-gate 		break;
20937c478bd9Sstevel@tonic-gate 	case AUE_SHMCTL:			/* shmctl */
20947c478bd9Sstevel@tonic-gate 	case AUE_SHMCTL_RMID:			/* shmctl */
20957c478bd9Sstevel@tonic-gate 	case AUE_SHMCTL_STAT:			/* shmctl */
20967c478bd9Sstevel@tonic-gate 	case AUE_SHMCTL_SET:			/* shmctl */
20977c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "shm ID", id));
20987c478bd9Sstevel@tonic-gate 		break;
20997c478bd9Sstevel@tonic-gate 	case AUE_SHMDT:				/* shmdt */
21007c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "shm adr", id));
21017c478bd9Sstevel@tonic-gate 		break;
21027c478bd9Sstevel@tonic-gate 	case AUE_SHMAT:				/* shmat */
21037c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "shm ID", id));
21047c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(2, "shm adr", cmd));
21057c478bd9Sstevel@tonic-gate 		break;
21067c478bd9Sstevel@tonic-gate 	}
21077c478bd9Sstevel@tonic-gate }
21087c478bd9Sstevel@tonic-gate 
21097c478bd9Sstevel@tonic-gate /*ARGSUSED*/
21107c478bd9Sstevel@tonic-gate static void
21117c478bd9Sstevel@tonic-gate auf_shmsys(struct t_audit_data *tad, int error, rval_t *rval)
21127c478bd9Sstevel@tonic-gate {
21137c478bd9Sstevel@tonic-gate 	int id;
21147c478bd9Sstevel@tonic-gate 
21157c478bd9Sstevel@tonic-gate 	if (error != 0)
21167c478bd9Sstevel@tonic-gate 		return;
21177c478bd9Sstevel@tonic-gate 	if (tad->tad_event == AUE_SHMGET) {
21187c478bd9Sstevel@tonic-gate 		uint32_t scid;
21197c478bd9Sstevel@tonic-gate 		uint32_t sy_flags;
21207c478bd9Sstevel@tonic-gate 
21217c478bd9Sstevel@tonic-gate 		/* need to determine type of executing binary */
21227c478bd9Sstevel@tonic-gate 		scid = tad->tad_scid;
21237c478bd9Sstevel@tonic-gate #ifdef _SYSCALL32_IMPL
21247c478bd9Sstevel@tonic-gate 		if (lwp_getdatamodel(ttolwp(curthread)) == DATAMODEL_NATIVE)
21257c478bd9Sstevel@tonic-gate 			sy_flags = sysent[scid].sy_flags & SE_RVAL_MASK;
21267c478bd9Sstevel@tonic-gate 		else
21277c478bd9Sstevel@tonic-gate 			sy_flags = sysent32[scid].sy_flags & SE_RVAL_MASK;
21287c478bd9Sstevel@tonic-gate #else
21297c478bd9Sstevel@tonic-gate 		sy_flags = sysent[scid].sy_flags & SE_RVAL_MASK;
21307c478bd9Sstevel@tonic-gate #endif
21317c478bd9Sstevel@tonic-gate 		if (sy_flags == SE_32RVAL1)
21327c478bd9Sstevel@tonic-gate 			id = rval->r_val1;
21337c478bd9Sstevel@tonic-gate 		if (sy_flags == (SE_32RVAL2|SE_32RVAL1))
21347c478bd9Sstevel@tonic-gate 			id = rval->r_val1;
21357c478bd9Sstevel@tonic-gate 		if (sy_flags == SE_64RVAL)
21367c478bd9Sstevel@tonic-gate 			id = (int)rval->r_vals;
21377c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_ipc(AT_IPC_SHM, id));
21387c478bd9Sstevel@tonic-gate 	}
21397c478bd9Sstevel@tonic-gate }
21407c478bd9Sstevel@tonic-gate 
21417c478bd9Sstevel@tonic-gate 
21427c478bd9Sstevel@tonic-gate /*ARGSUSED*/
21437c478bd9Sstevel@tonic-gate static void
21447c478bd9Sstevel@tonic-gate aus_ioctl(struct t_audit_data *tad)
21457c478bd9Sstevel@tonic-gate {
21467c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
21477c478bd9Sstevel@tonic-gate 	struct file *fp;
21487c478bd9Sstevel@tonic-gate 	struct vnode *vp;
21497c478bd9Sstevel@tonic-gate 	struct f_audit_data *fad;
21507c478bd9Sstevel@tonic-gate 	uint32_t fd, cmd;
21517c478bd9Sstevel@tonic-gate 	uintptr_t cmarg;
21527c478bd9Sstevel@tonic-gate 
21537c478bd9Sstevel@tonic-gate 	/* XX64 */
21547c478bd9Sstevel@tonic-gate 	struct a {
21557c478bd9Sstevel@tonic-gate 		long	fd;
21567c478bd9Sstevel@tonic-gate 		long	cmd;
21577c478bd9Sstevel@tonic-gate 		long	cmarg;		/* caddr_t */
21587c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
21597c478bd9Sstevel@tonic-gate 
21607c478bd9Sstevel@tonic-gate 	fd    = (uint32_t)uap->fd;
21617c478bd9Sstevel@tonic-gate 	cmd   = (uint32_t)uap->cmd;
21627c478bd9Sstevel@tonic-gate 	cmarg = (uintptr_t)uap->cmarg;
21637c478bd9Sstevel@tonic-gate 
21647c478bd9Sstevel@tonic-gate 		/*
21657c478bd9Sstevel@tonic-gate 		 * convert file pointer to file descriptor
21667c478bd9Sstevel@tonic-gate 		 *   Note: fd ref count incremented here.
21677c478bd9Sstevel@tonic-gate 		 */
21687c478bd9Sstevel@tonic-gate 	if ((fp = getf(fd)) == NULL) {
21697c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "fd", fd));
21707c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(2, "cmd", cmd));
21717c478bd9Sstevel@tonic-gate #ifndef _LP64
21727c478bd9Sstevel@tonic-gate 			au_uwrite(au_to_arg32(3, "arg", (uint32_t)cmarg));
21737c478bd9Sstevel@tonic-gate #else
21747c478bd9Sstevel@tonic-gate 			au_uwrite(au_to_arg64(3, "arg", (uint64_t)cmarg));
21757c478bd9Sstevel@tonic-gate #endif
21767c478bd9Sstevel@tonic-gate 		return;
21777c478bd9Sstevel@tonic-gate 	}
21787c478bd9Sstevel@tonic-gate 
21797c478bd9Sstevel@tonic-gate 	/* get path from file struct here */
21807c478bd9Sstevel@tonic-gate 	fad = F2A(fp);
21817c478bd9Sstevel@tonic-gate 	if (fad->fad_aupath != NULL) {
21827c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_path(fad->fad_aupath));
21837c478bd9Sstevel@tonic-gate 	} else {
21847c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "no path: fd", fd));
21857c478bd9Sstevel@tonic-gate 	}
21867c478bd9Sstevel@tonic-gate 
21877c478bd9Sstevel@tonic-gate 	vp = fp->f_vnode;
21887c478bd9Sstevel@tonic-gate 	audit_attributes(vp);
21897c478bd9Sstevel@tonic-gate 
21907c478bd9Sstevel@tonic-gate 	/* decrement file descriptor reference count */
21917c478bd9Sstevel@tonic-gate 	releasef(fd);
21927c478bd9Sstevel@tonic-gate 
21937c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(2, "cmd", cmd));
21947c478bd9Sstevel@tonic-gate #ifndef _LP64
21957c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(3, "arg", (uint32_t)cmarg));
21967c478bd9Sstevel@tonic-gate #else
21977c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg64(3, "arg", (uint64_t)cmarg));
21987c478bd9Sstevel@tonic-gate #endif
21997c478bd9Sstevel@tonic-gate }
22007c478bd9Sstevel@tonic-gate 
22017c478bd9Sstevel@tonic-gate /*
22027c478bd9Sstevel@tonic-gate  * null function for memcntl for now. We might want to limit memcntl()
22037c478bd9Sstevel@tonic-gate  * auditing to commands: MC_LOCKAS, MC_LOCK, MC_UNLOCKAS, MC_UNLOCK which
22047c478bd9Sstevel@tonic-gate  * require privileges.
22057c478bd9Sstevel@tonic-gate  */
22067c478bd9Sstevel@tonic-gate static au_event_t
22077c478bd9Sstevel@tonic-gate aui_memcntl(au_event_t e)
22087c478bd9Sstevel@tonic-gate {
22097c478bd9Sstevel@tonic-gate 	return (e);
22107c478bd9Sstevel@tonic-gate }
22117c478bd9Sstevel@tonic-gate 
22127c478bd9Sstevel@tonic-gate /*ARGSUSED*/
22137c478bd9Sstevel@tonic-gate static au_event_t
22147c478bd9Sstevel@tonic-gate aui_privsys(au_event_t e)
22157c478bd9Sstevel@tonic-gate {
22167c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
22177c478bd9Sstevel@tonic-gate 
22187c478bd9Sstevel@tonic-gate 	struct a {
22197c478bd9Sstevel@tonic-gate 		long	opcode;
22207c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
22217c478bd9Sstevel@tonic-gate 
22227c478bd9Sstevel@tonic-gate 	switch (uap->opcode) {
22237c478bd9Sstevel@tonic-gate 	case PRIVSYS_SETPPRIV:
22247c478bd9Sstevel@tonic-gate 		return (AUE_SETPPRIV);
22257c478bd9Sstevel@tonic-gate 	default:
22267c478bd9Sstevel@tonic-gate 		return (AUE_NULL);
22277c478bd9Sstevel@tonic-gate 	}
22287c478bd9Sstevel@tonic-gate }
22297c478bd9Sstevel@tonic-gate 
22307c478bd9Sstevel@tonic-gate /*ARGSUSED*/
22317c478bd9Sstevel@tonic-gate static void
22327c478bd9Sstevel@tonic-gate aus_memcntl(struct t_audit_data *tad)
22337c478bd9Sstevel@tonic-gate {
22347c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
22357c478bd9Sstevel@tonic-gate 
22367c478bd9Sstevel@tonic-gate 	struct a {
22377c478bd9Sstevel@tonic-gate 		long	addr;
22387c478bd9Sstevel@tonic-gate 		long	len;
22397c478bd9Sstevel@tonic-gate 		long	cmd;
22407c478bd9Sstevel@tonic-gate 		long	arg;
22417c478bd9Sstevel@tonic-gate 		long	attr;
22427c478bd9Sstevel@tonic-gate 		long	mask;
22437c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
22447c478bd9Sstevel@tonic-gate 
22457c478bd9Sstevel@tonic-gate #ifdef _LP64
22467c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg64(1, "base", (uint64_t)uap->addr));
22477c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg64(2, "len", (uint64_t)uap->len));
22487c478bd9Sstevel@tonic-gate #else
22497c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(1, "base", (uint32_t)uap->addr));
22507c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(2, "len", (uint32_t)uap->len));
22517c478bd9Sstevel@tonic-gate #endif
22527c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(3, "cmd", (uint_t)uap->cmd));
22537c478bd9Sstevel@tonic-gate #ifdef _LP64
22547c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg64(4, "arg", (uint64_t)uap->arg));
22557c478bd9Sstevel@tonic-gate #else
22567c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(4, "arg", (uint32_t)uap->arg));
22577c478bd9Sstevel@tonic-gate #endif
22587c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(5, "attr", (uint_t)uap->attr));
22597c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(6, "mask", (uint_t)uap->mask));
22607c478bd9Sstevel@tonic-gate }
22617c478bd9Sstevel@tonic-gate 
22627c478bd9Sstevel@tonic-gate /*ARGSUSED*/
22637c478bd9Sstevel@tonic-gate static void
22647c478bd9Sstevel@tonic-gate aus_mmap(struct t_audit_data *tad)
22657c478bd9Sstevel@tonic-gate {
22667c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
22677c478bd9Sstevel@tonic-gate 	struct file *fp;
22687c478bd9Sstevel@tonic-gate 	struct f_audit_data *fad;
22697c478bd9Sstevel@tonic-gate 	struct vnode *vp;
22707c478bd9Sstevel@tonic-gate 	uint32_t fd;
22717c478bd9Sstevel@tonic-gate 
22727c478bd9Sstevel@tonic-gate 	struct a {
22737c478bd9Sstevel@tonic-gate 		long	addr;
22747c478bd9Sstevel@tonic-gate 		long	len;
22757c478bd9Sstevel@tonic-gate 		long	prot;
22767c478bd9Sstevel@tonic-gate 		long	flags;
22777c478bd9Sstevel@tonic-gate 		long	fd;
22787c478bd9Sstevel@tonic-gate 		long	pos;
22797c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
22807c478bd9Sstevel@tonic-gate 
22817c478bd9Sstevel@tonic-gate 	fd = (uint32_t)uap->fd;
22827c478bd9Sstevel@tonic-gate 
22837c478bd9Sstevel@tonic-gate #ifdef _LP64
22847c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg64(1, "addr", (uint64_t)uap->addr));
22857c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg64(2, "len", (uint64_t)uap->len));
22867c478bd9Sstevel@tonic-gate #else
22877c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(1, "addr", (uint32_t)uap->addr));
22887c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(2, "len", (uint32_t)uap->len));
22897c478bd9Sstevel@tonic-gate #endif
22907c478bd9Sstevel@tonic-gate 
22917c478bd9Sstevel@tonic-gate 	if ((fp = getf(fd)) == NULL) {
22927c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(5, "fd", (uint32_t)uap->fd));
22937c478bd9Sstevel@tonic-gate 		return;
22947c478bd9Sstevel@tonic-gate 	}
22957c478bd9Sstevel@tonic-gate 
22967c478bd9Sstevel@tonic-gate 	/*
22977c478bd9Sstevel@tonic-gate 	 * Mark in the tad if write access is NOT requested... if
22987c478bd9Sstevel@tonic-gate 	 * this is later detected (in audit_attributes) to be a
22997c478bd9Sstevel@tonic-gate 	 * public object, the mmap event may be discarded.
23007c478bd9Sstevel@tonic-gate 	 */
23017c478bd9Sstevel@tonic-gate 	if (((uap->prot) & PROT_WRITE) == 0) {
23027c478bd9Sstevel@tonic-gate 		tad->tad_ctrl |= PAD_PUBLIC_EV;
23037c478bd9Sstevel@tonic-gate 	}
23047c478bd9Sstevel@tonic-gate 
23057c478bd9Sstevel@tonic-gate 	fad = F2A(fp);
23067c478bd9Sstevel@tonic-gate 	if (fad->fad_aupath != NULL) {
23077c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_path(fad->fad_aupath));
23087c478bd9Sstevel@tonic-gate 	} else {
23097c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "no path: fd", fd));
23107c478bd9Sstevel@tonic-gate 	}
23117c478bd9Sstevel@tonic-gate 
23127c478bd9Sstevel@tonic-gate 	vp = (struct vnode *)fp->f_vnode;
23137c478bd9Sstevel@tonic-gate 	audit_attributes(vp);
23147c478bd9Sstevel@tonic-gate 
23157c478bd9Sstevel@tonic-gate 	/* mark READ/WRITE since we can't predict access */
23167c478bd9Sstevel@tonic-gate 	if (uap->prot & PROT_READ)
23177c478bd9Sstevel@tonic-gate 		fad->fad_flags |= FAD_READ;
23187c478bd9Sstevel@tonic-gate 	if (uap->prot & PROT_WRITE)
23197c478bd9Sstevel@tonic-gate 		fad->fad_flags |= FAD_WRITE;
23207c478bd9Sstevel@tonic-gate 
23217c478bd9Sstevel@tonic-gate 	/* decrement file descriptor reference count */
23227c478bd9Sstevel@tonic-gate 	releasef(fd);
23237c478bd9Sstevel@tonic-gate 
23247c478bd9Sstevel@tonic-gate }	/* AUS_MMAP */
23257c478bd9Sstevel@tonic-gate 
23267c478bd9Sstevel@tonic-gate 
23277c478bd9Sstevel@tonic-gate 
23287c478bd9Sstevel@tonic-gate 
23297c478bd9Sstevel@tonic-gate /*ARGSUSED*/
23307c478bd9Sstevel@tonic-gate static void
23317c478bd9Sstevel@tonic-gate aus_munmap(struct t_audit_data *tad)
23327c478bd9Sstevel@tonic-gate {
23337c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
23347c478bd9Sstevel@tonic-gate 
23357c478bd9Sstevel@tonic-gate 	struct a {
23367c478bd9Sstevel@tonic-gate 		long	addr;
23377c478bd9Sstevel@tonic-gate 		long	len;
23387c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
23397c478bd9Sstevel@tonic-gate 
23407c478bd9Sstevel@tonic-gate #ifdef _LP64
23417c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg64(1, "addr", (uint64_t)uap->addr));
23427c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg64(2, "len", (uint64_t)uap->len));
23437c478bd9Sstevel@tonic-gate #else
23447c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(1, "addr", (uint32_t)uap->addr));
23457c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(2, "len", (uint32_t)uap->len));
23467c478bd9Sstevel@tonic-gate #endif
23477c478bd9Sstevel@tonic-gate 
23487c478bd9Sstevel@tonic-gate }	/* AUS_MUNMAP */
23497c478bd9Sstevel@tonic-gate 
23507c478bd9Sstevel@tonic-gate 
23517c478bd9Sstevel@tonic-gate 
23527c478bd9Sstevel@tonic-gate 
23537c478bd9Sstevel@tonic-gate 
23547c478bd9Sstevel@tonic-gate 
23557c478bd9Sstevel@tonic-gate 
23567c478bd9Sstevel@tonic-gate /*ARGSUSED*/
23577c478bd9Sstevel@tonic-gate static void
23587c478bd9Sstevel@tonic-gate aus_priocntlsys(struct t_audit_data *tad)
23597c478bd9Sstevel@tonic-gate {
23607c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
23617c478bd9Sstevel@tonic-gate 
23627c478bd9Sstevel@tonic-gate 	struct a {
23637c478bd9Sstevel@tonic-gate 		long	pc_version;
23647c478bd9Sstevel@tonic-gate 		long	psp;		/* procset_t */
23657c478bd9Sstevel@tonic-gate 		long	cmd;
23667c478bd9Sstevel@tonic-gate 		long	arg;
23677c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
23687c478bd9Sstevel@tonic-gate 
23697c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(1, "pc_version", (uint32_t)uap->pc_version));
23707c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(3, "cmd", (uint32_t)uap->cmd));
23717c478bd9Sstevel@tonic-gate 
23727c478bd9Sstevel@tonic-gate }	/* AUS_PRIOCNTLSYS */
23737c478bd9Sstevel@tonic-gate 
23747c478bd9Sstevel@tonic-gate 
23757c478bd9Sstevel@tonic-gate /*ARGSUSED*/
23767c478bd9Sstevel@tonic-gate static void
23777c478bd9Sstevel@tonic-gate aus_setegid(struct t_audit_data *tad)
23787c478bd9Sstevel@tonic-gate {
23797c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
23807c478bd9Sstevel@tonic-gate 	uint32_t gid;
23817c478bd9Sstevel@tonic-gate 
23827c478bd9Sstevel@tonic-gate 	struct a {
23837c478bd9Sstevel@tonic-gate 		long	gid;
23847c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
23857c478bd9Sstevel@tonic-gate 
23867c478bd9Sstevel@tonic-gate 	gid = (uint32_t)uap->gid;
23877c478bd9Sstevel@tonic-gate 
23887c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(1, "gid", gid));
23897c478bd9Sstevel@tonic-gate }	/* AUS_SETEGID */
23907c478bd9Sstevel@tonic-gate 
23917c478bd9Sstevel@tonic-gate 
23927c478bd9Sstevel@tonic-gate 
23937c478bd9Sstevel@tonic-gate 
23947c478bd9Sstevel@tonic-gate /*ARGSUSED*/
23957c478bd9Sstevel@tonic-gate static void
23967c478bd9Sstevel@tonic-gate aus_setgroups(struct t_audit_data *tad)
23977c478bd9Sstevel@tonic-gate {
23987c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
23997c478bd9Sstevel@tonic-gate 	int i;
24007c478bd9Sstevel@tonic-gate 	int gidsetsize;
24017c478bd9Sstevel@tonic-gate 	uintptr_t gidset;
24027c478bd9Sstevel@tonic-gate 	gid_t *gidlist;
24037c478bd9Sstevel@tonic-gate 
24047c478bd9Sstevel@tonic-gate 	struct a {
24057c478bd9Sstevel@tonic-gate 		long	gidsetsize;
24067c478bd9Sstevel@tonic-gate 		long	gidset;
24077c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
24087c478bd9Sstevel@tonic-gate 
24097c478bd9Sstevel@tonic-gate 	gidsetsize = (uint_t)uap->gidsetsize;
24107c478bd9Sstevel@tonic-gate 	gidset = (uintptr_t)uap->gidset;
24117c478bd9Sstevel@tonic-gate 
24127c478bd9Sstevel@tonic-gate 	if ((gidsetsize > NGROUPS_MAX_DEFAULT) || (gidsetsize < 0))
24137c478bd9Sstevel@tonic-gate 		return;
24147c478bd9Sstevel@tonic-gate 	if (gidsetsize != 0) {
24157c478bd9Sstevel@tonic-gate 		gidlist = kmem_alloc(gidsetsize * sizeof (gid_t),
2416745b2690Stz 		    KM_SLEEP);
24177c478bd9Sstevel@tonic-gate 		if (copyin((caddr_t)gidset, gidlist,
2418745b2690Stz 		    gidsetsize * sizeof (gid_t)) == 0)
24197c478bd9Sstevel@tonic-gate 			for (i = 0; i < gidsetsize; i++)
24207c478bd9Sstevel@tonic-gate 				au_uwrite(au_to_arg32(1, "setgroups",
2421745b2690Stz 				    (uint32_t)gidlist[i]));
24227c478bd9Sstevel@tonic-gate 		kmem_free(gidlist, gidsetsize * sizeof (gid_t));
24237c478bd9Sstevel@tonic-gate 	} else
24247c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "setgroups", (uint32_t)0));
24257c478bd9Sstevel@tonic-gate 
24267c478bd9Sstevel@tonic-gate }	/* AUS_SETGROUPS */
24277c478bd9Sstevel@tonic-gate 
24287c478bd9Sstevel@tonic-gate 
24297c478bd9Sstevel@tonic-gate 
24307c478bd9Sstevel@tonic-gate 
24317c478bd9Sstevel@tonic-gate 
24327c478bd9Sstevel@tonic-gate /*ARGSUSED*/
24337c478bd9Sstevel@tonic-gate static void
24347c478bd9Sstevel@tonic-gate aus_seteuid(struct t_audit_data *tad)
24357c478bd9Sstevel@tonic-gate {
24367c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
24377c478bd9Sstevel@tonic-gate 	uint32_t uid;
24387c478bd9Sstevel@tonic-gate 
24397c478bd9Sstevel@tonic-gate 	struct a {
24407c478bd9Sstevel@tonic-gate 		long	uid;
24417c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
24427c478bd9Sstevel@tonic-gate 
24437c478bd9Sstevel@tonic-gate 	uid = (uint32_t)uap->uid;
24447c478bd9Sstevel@tonic-gate 
24457c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(1, "euid", uid));
24467c478bd9Sstevel@tonic-gate 
24477c478bd9Sstevel@tonic-gate }	/* AUS_SETEUID */
24487c478bd9Sstevel@tonic-gate 
24497c478bd9Sstevel@tonic-gate /*ARGSUSED*/
24507c478bd9Sstevel@tonic-gate static void
24517c478bd9Sstevel@tonic-gate aus_putmsg(struct t_audit_data *tad)
24527c478bd9Sstevel@tonic-gate {
24537c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
24547c478bd9Sstevel@tonic-gate 	uint32_t fd, pri;
24557c478bd9Sstevel@tonic-gate 	struct file *fp;
24567c478bd9Sstevel@tonic-gate 	struct f_audit_data *fad;
24577c478bd9Sstevel@tonic-gate 
24587c478bd9Sstevel@tonic-gate 	struct a {
24597c478bd9Sstevel@tonic-gate 		long	fdes;
24607c478bd9Sstevel@tonic-gate 		long	ctl;		/* struct strbuf * */
24617c478bd9Sstevel@tonic-gate 		long	data;		/* struct strbuf * */
24627c478bd9Sstevel@tonic-gate 		long	pri;
24637c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
24647c478bd9Sstevel@tonic-gate 
24657c478bd9Sstevel@tonic-gate 	fd  = (uint32_t)uap->fdes;
24667c478bd9Sstevel@tonic-gate 	pri = (uint32_t)uap->pri;
24677c478bd9Sstevel@tonic-gate 
24687c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(1, "fd", fd));
24697c478bd9Sstevel@tonic-gate 
24707c478bd9Sstevel@tonic-gate 	if ((fp = getf(fd)) != NULL) {
24717c478bd9Sstevel@tonic-gate 		fad = F2A(fp);
24727c478bd9Sstevel@tonic-gate 
24737c478bd9Sstevel@tonic-gate 		fad->fad_flags |= FAD_WRITE;
24747c478bd9Sstevel@tonic-gate 
24757c478bd9Sstevel@tonic-gate 		/* add path name to audit record */
24767c478bd9Sstevel@tonic-gate 		if (fad->fad_aupath != NULL) {
24777c478bd9Sstevel@tonic-gate 			au_uwrite(au_to_path(fad->fad_aupath));
24787c478bd9Sstevel@tonic-gate 		}
24797c478bd9Sstevel@tonic-gate 		audit_attributes(fp->f_vnode);
24807c478bd9Sstevel@tonic-gate 
24817c478bd9Sstevel@tonic-gate 		releasef(fd);
24827c478bd9Sstevel@tonic-gate 	}
24837c478bd9Sstevel@tonic-gate 
24847c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(4, "pri", pri));
24857c478bd9Sstevel@tonic-gate }
24867c478bd9Sstevel@tonic-gate 
24877c478bd9Sstevel@tonic-gate /*ARGSUSED*/
24887c478bd9Sstevel@tonic-gate static void
24897c478bd9Sstevel@tonic-gate aus_putpmsg(struct t_audit_data *tad)
24907c478bd9Sstevel@tonic-gate {
24917c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
24927c478bd9Sstevel@tonic-gate 	uint32_t fd, pri, flags;
24937c478bd9Sstevel@tonic-gate 	struct file *fp;
24947c478bd9Sstevel@tonic-gate 	struct f_audit_data *fad;
24957c478bd9Sstevel@tonic-gate 
24967c478bd9Sstevel@tonic-gate 	struct a {
24977c478bd9Sstevel@tonic-gate 		long	fdes;
24987c478bd9Sstevel@tonic-gate 		long	ctl;		/* struct strbuf * */
24997c478bd9Sstevel@tonic-gate 		long	data;		/* struct strbuf * */
25007c478bd9Sstevel@tonic-gate 		long	pri;
25017c478bd9Sstevel@tonic-gate 		long	flags;
25027c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
25037c478bd9Sstevel@tonic-gate 
25047c478bd9Sstevel@tonic-gate 	fd = (uint32_t)uap->fdes;
25057c478bd9Sstevel@tonic-gate 	pri  = (uint32_t)uap->pri;
25067c478bd9Sstevel@tonic-gate 	flags  = (uint32_t)uap->flags;
25077c478bd9Sstevel@tonic-gate 
25087c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(1, "fd", fd));
25097c478bd9Sstevel@tonic-gate 
25107c478bd9Sstevel@tonic-gate 	if ((fp = getf(fd)) != NULL) {
25117c478bd9Sstevel@tonic-gate 		fad = F2A(fp);
25127c478bd9Sstevel@tonic-gate 
25137c478bd9Sstevel@tonic-gate 		fad->fad_flags |= FAD_WRITE;
25147c478bd9Sstevel@tonic-gate 
25157c478bd9Sstevel@tonic-gate 		/* add path name to audit record */
25167c478bd9Sstevel@tonic-gate 		if (fad->fad_aupath != NULL) {
25177c478bd9Sstevel@tonic-gate 			au_uwrite(au_to_path(fad->fad_aupath));
25187c478bd9Sstevel@tonic-gate 		}
25197c478bd9Sstevel@tonic-gate 		audit_attributes(fp->f_vnode);
25207c478bd9Sstevel@tonic-gate 
25217c478bd9Sstevel@tonic-gate 		releasef(fd);
25227c478bd9Sstevel@tonic-gate 	}
25237c478bd9Sstevel@tonic-gate 
25247c478bd9Sstevel@tonic-gate 
25257c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(4, "pri", pri));
25267c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(5, "flags", flags));
25277c478bd9Sstevel@tonic-gate }
25287c478bd9Sstevel@tonic-gate 
25297c478bd9Sstevel@tonic-gate /*ARGSUSED*/
25307c478bd9Sstevel@tonic-gate static void
25317c478bd9Sstevel@tonic-gate aus_getmsg(struct t_audit_data *tad)
25327c478bd9Sstevel@tonic-gate {
25337c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
25347c478bd9Sstevel@tonic-gate 	uint32_t fd, pri;
25357c478bd9Sstevel@tonic-gate 	struct file *fp;
25367c478bd9Sstevel@tonic-gate 	struct f_audit_data *fad;
25377c478bd9Sstevel@tonic-gate 
25387c478bd9Sstevel@tonic-gate 	struct a {
25397c478bd9Sstevel@tonic-gate 		long	fdes;
25407c478bd9Sstevel@tonic-gate 		long	ctl;		/* struct strbuf * */
25417c478bd9Sstevel@tonic-gate 		long	data;		/* struct strbuf * */
25427c478bd9Sstevel@tonic-gate 		long	pri;
25437c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
25447c478bd9Sstevel@tonic-gate 
25457c478bd9Sstevel@tonic-gate 	fd  = (uint32_t)uap->fdes;
25467c478bd9Sstevel@tonic-gate 	pri = (uint32_t)uap->pri;
25477c478bd9Sstevel@tonic-gate 
25487c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(1, "fd", fd));
25497c478bd9Sstevel@tonic-gate 
25507c478bd9Sstevel@tonic-gate 	if ((fp = getf(fd)) != NULL) {
25517c478bd9Sstevel@tonic-gate 		fad = F2A(fp);
25527c478bd9Sstevel@tonic-gate 
25537c478bd9Sstevel@tonic-gate 		/*
25547c478bd9Sstevel@tonic-gate 		 * read operation on this object
25557c478bd9Sstevel@tonic-gate 		 */
25567c478bd9Sstevel@tonic-gate 		fad->fad_flags |= FAD_READ;
25577c478bd9Sstevel@tonic-gate 
25587c478bd9Sstevel@tonic-gate 		/* add path name to audit record */
25597c478bd9Sstevel@tonic-gate 		if (fad->fad_aupath != NULL) {
25607c478bd9Sstevel@tonic-gate 			au_uwrite(au_to_path(fad->fad_aupath));
25617c478bd9Sstevel@tonic-gate 		}
25627c478bd9Sstevel@tonic-gate 		audit_attributes(fp->f_vnode);
25637c478bd9Sstevel@tonic-gate 
25647c478bd9Sstevel@tonic-gate 		releasef(fd);
25657c478bd9Sstevel@tonic-gate 	}
25667c478bd9Sstevel@tonic-gate 
25677c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(4, "pri", pri));
25687c478bd9Sstevel@tonic-gate }
25697c478bd9Sstevel@tonic-gate 
25707c478bd9Sstevel@tonic-gate /*ARGSUSED*/
25717c478bd9Sstevel@tonic-gate static void
25727c478bd9Sstevel@tonic-gate aus_getpmsg(struct t_audit_data *tad)
25737c478bd9Sstevel@tonic-gate {
25747c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
25757c478bd9Sstevel@tonic-gate 	uint32_t fd;
25767c478bd9Sstevel@tonic-gate 	struct file *fp;
25777c478bd9Sstevel@tonic-gate 	struct f_audit_data *fad;
25787c478bd9Sstevel@tonic-gate 
25797c478bd9Sstevel@tonic-gate 	struct a {
25807c478bd9Sstevel@tonic-gate 		long	fdes;
25817c478bd9Sstevel@tonic-gate 		long	ctl;		/* struct strbuf * */
25827c478bd9Sstevel@tonic-gate 		long	data;		/* struct strbuf * */
25837c478bd9Sstevel@tonic-gate 		long	pri;
25847c478bd9Sstevel@tonic-gate 		long	flags;
25857c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
25867c478bd9Sstevel@tonic-gate 
25877c478bd9Sstevel@tonic-gate 	fd = (uint32_t)uap->fdes;
25887c478bd9Sstevel@tonic-gate 
25897c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(1, "fd", fd));
25907c478bd9Sstevel@tonic-gate 
25917c478bd9Sstevel@tonic-gate 	if ((fp = getf(fd)) != NULL) {
25927c478bd9Sstevel@tonic-gate 		fad = F2A(fp);
25937c478bd9Sstevel@tonic-gate 
25947c478bd9Sstevel@tonic-gate 		/*
25957c478bd9Sstevel@tonic-gate 		 * read operation on this object
25967c478bd9Sstevel@tonic-gate 		 */
25977c478bd9Sstevel@tonic-gate 		fad->fad_flags |= FAD_READ;
25987c478bd9Sstevel@tonic-gate 
25997c478bd9Sstevel@tonic-gate 		/* add path name to audit record */
26007c478bd9Sstevel@tonic-gate 		if (fad->fad_aupath != NULL) {
26017c478bd9Sstevel@tonic-gate 			au_uwrite(au_to_path(fad->fad_aupath));
26027c478bd9Sstevel@tonic-gate 		}
26037c478bd9Sstevel@tonic-gate 		audit_attributes(fp->f_vnode);
26047c478bd9Sstevel@tonic-gate 
26057c478bd9Sstevel@tonic-gate 		releasef(fd);
26067c478bd9Sstevel@tonic-gate 	}
26077c478bd9Sstevel@tonic-gate }
26087c478bd9Sstevel@tonic-gate 
260961b9bf51Srica static au_event_t
261061b9bf51Srica aui_labelsys(au_event_t e)
261161b9bf51Srica {
261261b9bf51Srica 	klwp_t *clwp = ttolwp(curthread);
261361b9bf51Srica 	uint32_t code;
261461b9bf51Srica 	uint32_t cmd;
261561b9bf51Srica 
261661b9bf51Srica 	struct a {
261761b9bf51Srica 		long	code;
261861b9bf51Srica 		long	cmd;
261961b9bf51Srica 	} *uap = (struct a *)clwp->lwp_ap;
262061b9bf51Srica 
262161b9bf51Srica 	code = (uint32_t)uap->code;
262261b9bf51Srica 	cmd = (uint32_t)uap->cmd;
262361b9bf51Srica 
262461b9bf51Srica 	/* not security relevant if not changing kernel cache */
262561b9bf51Srica 	if (cmd == TNDB_GET)
2626d3e710c8SRic Aleshire 		return (AUE_NULL);
262761b9bf51Srica 
262861b9bf51Srica 	switch (code) {
262961b9bf51Srica 	case TSOL_TNRH:
263061b9bf51Srica 		e = AUE_LABELSYS_TNRH;
263161b9bf51Srica 		break;
263261b9bf51Srica 	case TSOL_TNRHTP:
263361b9bf51Srica 		e = AUE_LABELSYS_TNRHTP;
263461b9bf51Srica 		break;
263561b9bf51Srica 	case TSOL_TNMLP:
263661b9bf51Srica 		e = AUE_LABELSYS_TNMLP;
263761b9bf51Srica 		break;
263861b9bf51Srica 	default:
263961b9bf51Srica 		e = AUE_NULL;
264061b9bf51Srica 		break;
264161b9bf51Srica 	}
264261b9bf51Srica 
264361b9bf51Srica 	return (e);
264461b9bf51Srica 
264561b9bf51Srica }
264661b9bf51Srica 
264761b9bf51Srica static void
264861b9bf51Srica aus_labelsys(struct t_audit_data *tad)
264961b9bf51Srica {
265061b9bf51Srica 	klwp_t *clwp = ttolwp(curthread);
265161b9bf51Srica 	uint32_t cmd;
265261b9bf51Srica 	uintptr_t a2;
265361b9bf51Srica 
265461b9bf51Srica 	struct a {
265561b9bf51Srica 		long	code;
265661b9bf51Srica 		long	cmd;
265761b9bf51Srica 		long	a2;
265861b9bf51Srica 	} *uap = (struct a *)clwp->lwp_ap;
265961b9bf51Srica 
266061b9bf51Srica 	cmd = (uint32_t)uap->cmd;
266161b9bf51Srica 	a2 = (uintptr_t)uap->a2;
266261b9bf51Srica 
266361b9bf51Srica 	switch (tad->tad_event) {
266461b9bf51Srica 	case AUE_LABELSYS_TNRH:
266561b9bf51Srica 	{
266661b9bf51Srica 		tsol_rhent_t	*rhent;
266761b9bf51Srica 		tnaddr_t	*rh_addr;
266861b9bf51Srica 
266961b9bf51Srica 		au_uwrite(au_to_arg32(1, "cmd", cmd));
267061b9bf51Srica 
267161b9bf51Srica 		/* Remaining args don't apply for FLUSH, so skip */
267261b9bf51Srica 		if (cmd == TNDB_FLUSH)
267361b9bf51Srica 			break;
267461b9bf51Srica 
267561b9bf51Srica 		rhent = kmem_alloc(sizeof (tsol_rhent_t), KM_SLEEP);
267661b9bf51Srica 		if (copyin((caddr_t)a2, rhent, sizeof (tsol_rhent_t))) {
267761b9bf51Srica 			kmem_free(rhent, sizeof (tsol_rhent_t));
267861b9bf51Srica 			return;
267961b9bf51Srica 		}
268061b9bf51Srica 
268161b9bf51Srica 		rh_addr = &rhent->rh_address;
268261b9bf51Srica 		if (rh_addr->ta_family == AF_INET) {
268361b9bf51Srica 			struct in_addr	*ipaddr;
268461b9bf51Srica 
268561b9bf51Srica 			ipaddr = &(rh_addr->ta_addr_v4);
268661b9bf51Srica 			au_uwrite(au_to_in_addr(ipaddr));
268761b9bf51Srica 		} else if (rh_addr->ta_family == AF_INET6) {
268861b9bf51Srica 			int32_t		*ipaddr;
268961b9bf51Srica 
269061b9bf51Srica 			ipaddr = (int32_t *)&(rh_addr->ta_addr_v6);
269161b9bf51Srica 			au_uwrite(au_to_in_addr_ex(ipaddr));
269261b9bf51Srica 		}
269361b9bf51Srica 		au_uwrite(au_to_arg32(2, "prefix len", rhent->rh_prefix));
269461b9bf51Srica 
269561b9bf51Srica 		kmem_free(rhent, sizeof (tsol_rhent_t));
269661b9bf51Srica 
269761b9bf51Srica 		break;
269861b9bf51Srica 	}
269961b9bf51Srica 	case AUE_LABELSYS_TNRHTP:
270061b9bf51Srica 	{
270161b9bf51Srica 		tsol_tpent_t	*tpent;
270261b9bf51Srica 
270361b9bf51Srica 		au_uwrite(au_to_arg32(1, "cmd", cmd));
270461b9bf51Srica 
270561b9bf51Srica 		/* Remaining args don't apply for FLUSH, so skip */
270661b9bf51Srica 		if (cmd == TNDB_FLUSH)
270761b9bf51Srica 			break;
270861b9bf51Srica 
270961b9bf51Srica 		tpent = kmem_alloc(sizeof (tsol_tpent_t), KM_SLEEP);
271061b9bf51Srica 		if (copyin((caddr_t)a2, tpent, sizeof (tsol_tpent_t))) {
271161b9bf51Srica 			kmem_free(tpent, sizeof (tsol_tpent_t));
271261b9bf51Srica 			return;
271361b9bf51Srica 		}
271461b9bf51Srica 
2715d3e710c8SRic Aleshire 		/* Make sure that the template name is null-terminated. */
2716d3e710c8SRic Aleshire 		*(tpent->name + TNTNAMSIZ - 1) = '\0';
2717d3e710c8SRic Aleshire 
271861b9bf51Srica 		au_uwrite(au_to_text(tpent->name));
271961b9bf51Srica 		kmem_free(tpent, sizeof (tsol_tpent_t));
272061b9bf51Srica 
272161b9bf51Srica 		break;
272261b9bf51Srica 	}
272361b9bf51Srica 	case AUE_LABELSYS_TNMLP:
272461b9bf51Srica 	{
272561b9bf51Srica 		tsol_mlpent_t	*mlpent;
272661b9bf51Srica 
272761b9bf51Srica 		au_uwrite(au_to_arg32(1, "cmd", cmd));
272861b9bf51Srica 
272961b9bf51Srica 		mlpent = kmem_alloc(sizeof (tsol_mlpent_t), KM_SLEEP);
273061b9bf51Srica 		if (copyin((caddr_t)a2, mlpent, sizeof (tsol_mlpent_t))) {
273161b9bf51Srica 			kmem_free(mlpent, sizeof (tsol_mlpent_t));
273261b9bf51Srica 			return;
273361b9bf51Srica 		}
273461b9bf51Srica 
273561b9bf51Srica 		if (mlpent->tsme_flags & TSOL_MEF_SHARED) {
273661b9bf51Srica 			au_uwrite(au_to_text("shared"));
273761b9bf51Srica 		} else {
273861b9bf51Srica 			zone_t	*zone;
273961b9bf51Srica 
274061b9bf51Srica 			zone = zone_find_by_id(mlpent->tsme_zoneid);
274161b9bf51Srica 			if (zone != NULL) {
274261b9bf51Srica 				au_uwrite(au_to_text(zone->zone_name));
274361b9bf51Srica 				zone_rele(zone);
274461b9bf51Srica 			}
274561b9bf51Srica 		}
274661b9bf51Srica 
274761b9bf51Srica 		/* Remaining args don't apply for FLUSH, so skip */
274861b9bf51Srica 		if (cmd == TNDB_FLUSH) {
274961b9bf51Srica 			kmem_free(mlpent, sizeof (tsol_mlpent_t));
275061b9bf51Srica 			break;
275161b9bf51Srica 		}
275261b9bf51Srica 
275361b9bf51Srica 		au_uwrite(au_to_arg32(2, "proto num",
275461b9bf51Srica 		    (uint32_t)mlpent->tsme_mlp.mlp_ipp));
275561b9bf51Srica 		au_uwrite(au_to_arg32(2, "mlp_port",
275661b9bf51Srica 		    (uint32_t)mlpent->tsme_mlp.mlp_port));
275761b9bf51Srica 
275861b9bf51Srica 		if (mlpent->tsme_mlp.mlp_port_upper != 0)
275961b9bf51Srica 			au_uwrite(au_to_arg32(2, "mlp_port_upper",
276061b9bf51Srica 			    (uint32_t)mlpent->tsme_mlp.mlp_port_upper));
276161b9bf51Srica 
276261b9bf51Srica 		kmem_free(mlpent, sizeof (tsol_mlpent_t));
276361b9bf51Srica 
276461b9bf51Srica 		break;
276561b9bf51Srica 	}
276661b9bf51Srica 	default:
276761b9bf51Srica 		break;
276861b9bf51Srica 	}
276961b9bf51Srica }
277061b9bf51Srica 
277161b9bf51Srica 
27727c478bd9Sstevel@tonic-gate static au_event_t
27737c478bd9Sstevel@tonic-gate aui_auditsys(au_event_t e)
27747c478bd9Sstevel@tonic-gate {
27757c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
27767c478bd9Sstevel@tonic-gate 	uint32_t code;
27777c478bd9Sstevel@tonic-gate 
27787c478bd9Sstevel@tonic-gate 	struct a {
27797c478bd9Sstevel@tonic-gate 		long	code;
27807c478bd9Sstevel@tonic-gate 		long	a1;
27817c478bd9Sstevel@tonic-gate 		long	a2;
27827c478bd9Sstevel@tonic-gate 		long	a3;
27837c478bd9Sstevel@tonic-gate 		long	a4;
27847c478bd9Sstevel@tonic-gate 		long	a5;
27857c478bd9Sstevel@tonic-gate 		long	a6;
27867c478bd9Sstevel@tonic-gate 		long	a7;
27877c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
27887c478bd9Sstevel@tonic-gate 
27897c478bd9Sstevel@tonic-gate 	code = (uint32_t)uap->code;
27907c478bd9Sstevel@tonic-gate 
27917c478bd9Sstevel@tonic-gate 	switch (code) {
27927c478bd9Sstevel@tonic-gate 
27937c478bd9Sstevel@tonic-gate 	case BSM_GETAUID:
27947c478bd9Sstevel@tonic-gate 		e = AUE_GETAUID;
27957c478bd9Sstevel@tonic-gate 		break;
27967c478bd9Sstevel@tonic-gate 	case BSM_SETAUID:
27977c478bd9Sstevel@tonic-gate 		e = AUE_SETAUID;
27987c478bd9Sstevel@tonic-gate 		break;
27997c478bd9Sstevel@tonic-gate 	case BSM_GETAUDIT:
28007c478bd9Sstevel@tonic-gate 		e = AUE_GETAUDIT;
28017c478bd9Sstevel@tonic-gate 		break;
28027c478bd9Sstevel@tonic-gate 	case BSM_GETAUDIT_ADDR:
28037c478bd9Sstevel@tonic-gate 		e = AUE_GETAUDIT_ADDR;
28047c478bd9Sstevel@tonic-gate 		break;
28057c478bd9Sstevel@tonic-gate 	case BSM_SETAUDIT:
28067c478bd9Sstevel@tonic-gate 		e = AUE_SETAUDIT;
28077c478bd9Sstevel@tonic-gate 		break;
28087c478bd9Sstevel@tonic-gate 	case BSM_SETAUDIT_ADDR:
28097c478bd9Sstevel@tonic-gate 		e = AUE_SETAUDIT_ADDR;
28107c478bd9Sstevel@tonic-gate 		break;
28117c478bd9Sstevel@tonic-gate 	case BSM_AUDIT:
28127c478bd9Sstevel@tonic-gate 		e = AUE_AUDIT;
28137c478bd9Sstevel@tonic-gate 		break;
28147c478bd9Sstevel@tonic-gate 	case BSM_AUDITCTL:
28157c478bd9Sstevel@tonic-gate 		switch ((uint_t)uap->a1) {
28167c478bd9Sstevel@tonic-gate 
28177c478bd9Sstevel@tonic-gate 		case A_GETPOLICY:
28187c478bd9Sstevel@tonic-gate 			e = AUE_AUDITON_GPOLICY;
28197c478bd9Sstevel@tonic-gate 			break;
28207c478bd9Sstevel@tonic-gate 		case A_SETPOLICY:
28217c478bd9Sstevel@tonic-gate 			e = AUE_AUDITON_SPOLICY;
28227c478bd9Sstevel@tonic-gate 			break;
28237c478bd9Sstevel@tonic-gate 		case A_GETKMASK:
28247c478bd9Sstevel@tonic-gate 			e = AUE_AUDITON_GETKMASK;
28257c478bd9Sstevel@tonic-gate 			break;
28267c478bd9Sstevel@tonic-gate 		case A_SETKMASK:
28277c478bd9Sstevel@tonic-gate 			e = AUE_AUDITON_SETKMASK;
28287c478bd9Sstevel@tonic-gate 			break;
28297c478bd9Sstevel@tonic-gate 		case A_GETQCTRL:
28307c478bd9Sstevel@tonic-gate 			e = AUE_AUDITON_GQCTRL;
28317c478bd9Sstevel@tonic-gate 			break;
28327c478bd9Sstevel@tonic-gate 		case A_SETQCTRL:
28337c478bd9Sstevel@tonic-gate 			e = AUE_AUDITON_SQCTRL;
28347c478bd9Sstevel@tonic-gate 			break;
28357c478bd9Sstevel@tonic-gate 		case A_GETCWD:
28367c478bd9Sstevel@tonic-gate 			e = AUE_AUDITON_GETCWD;
28377c478bd9Sstevel@tonic-gate 			break;
28387c478bd9Sstevel@tonic-gate 		case A_GETCAR:
28397c478bd9Sstevel@tonic-gate 			e = AUE_AUDITON_GETCAR;
28407c478bd9Sstevel@tonic-gate 			break;
28417c478bd9Sstevel@tonic-gate 		case A_GETSTAT:
28427c478bd9Sstevel@tonic-gate 			e = AUE_AUDITON_GETSTAT;
28437c478bd9Sstevel@tonic-gate 			break;
28447c478bd9Sstevel@tonic-gate 		case A_SETSTAT:
28457c478bd9Sstevel@tonic-gate 			e = AUE_AUDITON_SETSTAT;
28467c478bd9Sstevel@tonic-gate 			break;
28477c478bd9Sstevel@tonic-gate 		case A_SETUMASK:
28487c478bd9Sstevel@tonic-gate 			e = AUE_AUDITON_SETUMASK;
28497c478bd9Sstevel@tonic-gate 			break;
28507c478bd9Sstevel@tonic-gate 		case A_SETSMASK:
28517c478bd9Sstevel@tonic-gate 			e = AUE_AUDITON_SETSMASK;
28527c478bd9Sstevel@tonic-gate 			break;
28537c478bd9Sstevel@tonic-gate 		case A_GETCOND:
28547c478bd9Sstevel@tonic-gate 			e = AUE_AUDITON_GETCOND;
28557c478bd9Sstevel@tonic-gate 			break;
28567c478bd9Sstevel@tonic-gate 		case A_SETCOND:
28577c478bd9Sstevel@tonic-gate 			e = AUE_AUDITON_SETCOND;
28587c478bd9Sstevel@tonic-gate 			break;
28597c478bd9Sstevel@tonic-gate 		case A_GETCLASS:
28607c478bd9Sstevel@tonic-gate 			e = AUE_AUDITON_GETCLASS;
28617c478bd9Sstevel@tonic-gate 			break;
28627c478bd9Sstevel@tonic-gate 		case A_SETCLASS:
28637c478bd9Sstevel@tonic-gate 			e = AUE_AUDITON_SETCLASS;
28647c478bd9Sstevel@tonic-gate 			break;
28657c478bd9Sstevel@tonic-gate 		default:
28667c478bd9Sstevel@tonic-gate 			e = AUE_NULL;
28677c478bd9Sstevel@tonic-gate 			break;
28687c478bd9Sstevel@tonic-gate 		}
28697c478bd9Sstevel@tonic-gate 		break;
28707c478bd9Sstevel@tonic-gate 	default:
28717c478bd9Sstevel@tonic-gate 		e = AUE_NULL;
28727c478bd9Sstevel@tonic-gate 		break;
28737c478bd9Sstevel@tonic-gate 	}
28747c478bd9Sstevel@tonic-gate 
28757c478bd9Sstevel@tonic-gate 	return (e);
28767c478bd9Sstevel@tonic-gate 
28777c478bd9Sstevel@tonic-gate }	/* AUI_AUDITSYS */
28787c478bd9Sstevel@tonic-gate 
28797c478bd9Sstevel@tonic-gate 
28807c478bd9Sstevel@tonic-gate static void
28817c478bd9Sstevel@tonic-gate aus_auditsys(struct t_audit_data *tad)
28827c478bd9Sstevel@tonic-gate {
28837c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
28847c478bd9Sstevel@tonic-gate 	uintptr_t a1, a2;
28857c478bd9Sstevel@tonic-gate 	STRUCT_DECL(auditinfo, ainfo);
28867c478bd9Sstevel@tonic-gate 	STRUCT_DECL(auditinfo_addr, ainfo_addr);
28877c478bd9Sstevel@tonic-gate 	au_evclass_map_t event;
28887c478bd9Sstevel@tonic-gate 	au_mask_t mask;
28897c478bd9Sstevel@tonic-gate 	int auditstate, policy;
2890f2fcf18cStz 	au_id_t auid;
28917c478bd9Sstevel@tonic-gate 
28927c478bd9Sstevel@tonic-gate 
28937c478bd9Sstevel@tonic-gate 	struct a {
28947c478bd9Sstevel@tonic-gate 		long	code;
28957c478bd9Sstevel@tonic-gate 		long	a1;
28967c478bd9Sstevel@tonic-gate 		long	a2;
28977c478bd9Sstevel@tonic-gate 		long	a3;
28987c478bd9Sstevel@tonic-gate 		long	a4;
28997c478bd9Sstevel@tonic-gate 		long	a5;
29007c478bd9Sstevel@tonic-gate 		long	a6;
29017c478bd9Sstevel@tonic-gate 		long	a7;
29027c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
29037c478bd9Sstevel@tonic-gate 
29047c478bd9Sstevel@tonic-gate 	a1   = (uintptr_t)uap->a1;
29057c478bd9Sstevel@tonic-gate 	a2   = (uintptr_t)uap->a2;
29067c478bd9Sstevel@tonic-gate 
29077c478bd9Sstevel@tonic-gate 	switch (tad->tad_event) {
29087c478bd9Sstevel@tonic-gate 	case AUE_SETAUID:
2909f2fcf18cStz 		if (copyin((caddr_t)a1, &auid, sizeof (au_id_t)))
2910f2fcf18cStz 				return;
2911f2fcf18cStz 		au_uwrite(au_to_arg32(2, "setauid", auid));
29127c478bd9Sstevel@tonic-gate 		break;
29137c478bd9Sstevel@tonic-gate 	case AUE_SETAUDIT:
29147c478bd9Sstevel@tonic-gate 		STRUCT_INIT(ainfo, get_udatamodel());
29157c478bd9Sstevel@tonic-gate 		if (copyin((caddr_t)a1, STRUCT_BUF(ainfo),
2916745b2690Stz 		    STRUCT_SIZE(ainfo))) {
29177c478bd9Sstevel@tonic-gate 				return;
29187c478bd9Sstevel@tonic-gate 		}
29197c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32((char)1, "setaudit:auid",
2920745b2690Stz 		    (uint32_t)STRUCT_FGET(ainfo, ai_auid)));
29217c478bd9Sstevel@tonic-gate #ifdef _LP64
29227c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg64((char)1, "setaudit:port",
2923745b2690Stz 		    (uint64_t)STRUCT_FGET(ainfo, ai_termid.port)));
29247c478bd9Sstevel@tonic-gate #else
29257c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32((char)1, "setaudit:port",
2926745b2690Stz 		    (uint32_t)STRUCT_FGET(ainfo, ai_termid.port)));
29277c478bd9Sstevel@tonic-gate #endif
29287c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32((char)1, "setaudit:machine",
2929745b2690Stz 		    (uint32_t)STRUCT_FGET(ainfo, ai_termid.machine)));
29307c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32((char)1, "setaudit:as_success",
2931745b2690Stz 		    (uint32_t)STRUCT_FGET(ainfo, ai_mask.as_success)));
29327c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32((char)1, "setaudit:as_failure",
2933745b2690Stz 		    (uint32_t)STRUCT_FGET(ainfo, ai_mask.as_failure)));
29347c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32((char)1, "setaudit:asid",
2935745b2690Stz 		    (uint32_t)STRUCT_FGET(ainfo, ai_asid)));
29367c478bd9Sstevel@tonic-gate 		break;
29377c478bd9Sstevel@tonic-gate 	case AUE_SETAUDIT_ADDR:
29387c478bd9Sstevel@tonic-gate 		STRUCT_INIT(ainfo_addr, get_udatamodel());
29397c478bd9Sstevel@tonic-gate 		if (copyin((caddr_t)a1, STRUCT_BUF(ainfo_addr),
2940745b2690Stz 		    STRUCT_SIZE(ainfo_addr))) {
29417c478bd9Sstevel@tonic-gate 				return;
29427c478bd9Sstevel@tonic-gate 		}
29437c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32((char)1, "auid",
2944745b2690Stz 		    (uint32_t)STRUCT_FGET(ainfo_addr, ai_auid)));
29457c478bd9Sstevel@tonic-gate #ifdef _LP64
29467c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg64((char)1, "port",
2947745b2690Stz 		    (uint64_t)STRUCT_FGET(ainfo_addr, ai_termid.at_port)));
29487c478bd9Sstevel@tonic-gate #else
29497c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32((char)1, "port",
2950745b2690Stz 		    (uint32_t)STRUCT_FGET(ainfo_addr, ai_termid.at_port)));
29517c478bd9Sstevel@tonic-gate #endif
29527c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32((char)1, "type",
2953745b2690Stz 		    (uint32_t)STRUCT_FGET(ainfo_addr, ai_termid.at_type)));
29547c478bd9Sstevel@tonic-gate 		if ((uint32_t)STRUCT_FGET(ainfo_addr, ai_termid.at_type) ==
29557c478bd9Sstevel@tonic-gate 		    AU_IPv4) {
29567c478bd9Sstevel@tonic-gate 			au_uwrite(au_to_in_addr(
2957745b2690Stz 			    (struct in_addr *)STRUCT_FGETP(ainfo_addr,
2958745b2690Stz 			    ai_termid.at_addr)));
29597c478bd9Sstevel@tonic-gate 		} else {
29607c478bd9Sstevel@tonic-gate 			au_uwrite(au_to_in_addr_ex(
2961745b2690Stz 			    (int32_t *)STRUCT_FGETP(ainfo_addr,
2962745b2690Stz 			    ai_termid.at_addr)));
29637c478bd9Sstevel@tonic-gate 		}
29647c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32((char)1, "as_success",
2965745b2690Stz 		    (uint32_t)STRUCT_FGET(ainfo_addr, ai_mask.as_success)));
29667c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32((char)1, "as_failure",
2967745b2690Stz 		    (uint32_t)STRUCT_FGET(ainfo_addr, ai_mask.as_failure)));
29687c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32((char)1, "asid",
2969745b2690Stz 		    (uint32_t)STRUCT_FGET(ainfo_addr, ai_asid)));
29707c478bd9Sstevel@tonic-gate 		break;
29717c478bd9Sstevel@tonic-gate 	case AUE_AUDITON_SETKMASK:
29727c478bd9Sstevel@tonic-gate 		if (copyin((caddr_t)a2, &mask, sizeof (au_mask_t)))
29737c478bd9Sstevel@tonic-gate 				return;
29747c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(
2975745b2690Stz 		    2, "setkmask:as_success", (uint32_t)mask.as_success));
29767c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(
2977745b2690Stz 		    2, "setkmask:as_failure", (uint32_t)mask.as_failure));
29787c478bd9Sstevel@tonic-gate 		break;
29797c478bd9Sstevel@tonic-gate 	case AUE_AUDITON_SPOLICY:
29807c478bd9Sstevel@tonic-gate 		if (copyin((caddr_t)a2, &policy, sizeof (int)))
29817c478bd9Sstevel@tonic-gate 			return;
29827c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(3, "setpolicy", (uint32_t)policy));
29837c478bd9Sstevel@tonic-gate 		break;
29847c478bd9Sstevel@tonic-gate 	case AUE_AUDITON_SQCTRL: {
29857c478bd9Sstevel@tonic-gate 		STRUCT_DECL(au_qctrl, qctrl);
29867c478bd9Sstevel@tonic-gate 		model_t model;
29877c478bd9Sstevel@tonic-gate 
29887c478bd9Sstevel@tonic-gate 		model = get_udatamodel();
29897c478bd9Sstevel@tonic-gate 		STRUCT_INIT(qctrl, model);
29907c478bd9Sstevel@tonic-gate 		if (copyin((caddr_t)a2, STRUCT_BUF(qctrl), STRUCT_SIZE(qctrl)))
29917c478bd9Sstevel@tonic-gate 				return;
29927c478bd9Sstevel@tonic-gate 		if (model == DATAMODEL_ILP32) {
29937c478bd9Sstevel@tonic-gate 			au_uwrite(au_to_arg32(
2994745b2690Stz 			    3, "setqctrl:aq_hiwater",
2995745b2690Stz 			    (uint32_t)STRUCT_FGET(qctrl, aq_hiwater)));
29967c478bd9Sstevel@tonic-gate 			au_uwrite(au_to_arg32(
2997745b2690Stz 			    3, "setqctrl:aq_lowater",
2998745b2690Stz 			    (uint32_t)STRUCT_FGET(qctrl, aq_lowater)));
29997c478bd9Sstevel@tonic-gate 			au_uwrite(au_to_arg32(
3000745b2690Stz 			    3, "setqctrl:aq_bufsz",
3001745b2690Stz 			    (uint32_t)STRUCT_FGET(qctrl, aq_bufsz)));
30027c478bd9Sstevel@tonic-gate 			au_uwrite(au_to_arg32(
3003745b2690Stz 			    3, "setqctrl:aq_delay",
3004745b2690Stz 			    (uint32_t)STRUCT_FGET(qctrl, aq_delay)));
30057c478bd9Sstevel@tonic-gate 		} else {
30067c478bd9Sstevel@tonic-gate 			au_uwrite(au_to_arg64(
3007745b2690Stz 			    3, "setqctrl:aq_hiwater",
3008745b2690Stz 			    (uint64_t)STRUCT_FGET(qctrl, aq_hiwater)));
30097c478bd9Sstevel@tonic-gate 			au_uwrite(au_to_arg64(
3010745b2690Stz 			    3, "setqctrl:aq_lowater",
3011745b2690Stz 			    (uint64_t)STRUCT_FGET(qctrl, aq_lowater)));
30127c478bd9Sstevel@tonic-gate 			au_uwrite(au_to_arg64(
3013745b2690Stz 			    3, "setqctrl:aq_bufsz",
3014745b2690Stz 			    (uint64_t)STRUCT_FGET(qctrl, aq_bufsz)));
30157c478bd9Sstevel@tonic-gate 			au_uwrite(au_to_arg64(
3016745b2690Stz 			    3, "setqctrl:aq_delay",
3017745b2690Stz 			    (uint64_t)STRUCT_FGET(qctrl, aq_delay)));
30187c478bd9Sstevel@tonic-gate 		}
30197c478bd9Sstevel@tonic-gate 		break;
30207c478bd9Sstevel@tonic-gate 	}
30217c478bd9Sstevel@tonic-gate 	case AUE_AUDITON_SETUMASK:
30227c478bd9Sstevel@tonic-gate 		STRUCT_INIT(ainfo, get_udatamodel());
30237c478bd9Sstevel@tonic-gate 		if (copyin((caddr_t)uap->a2, STRUCT_BUF(ainfo),
3024745b2690Stz 		    STRUCT_SIZE(ainfo))) {
3025745b2690Stz 			return;
30267c478bd9Sstevel@tonic-gate 		}
30277c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(3, "setumask:as_success",
3028745b2690Stz 		    (uint32_t)STRUCT_FGET(ainfo, ai_mask.as_success)));
30297c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(3, "setumask:as_failure",
3030745b2690Stz 		    (uint32_t)STRUCT_FGET(ainfo, ai_mask.as_failure)));
30317c478bd9Sstevel@tonic-gate 		break;
30327c478bd9Sstevel@tonic-gate 	case AUE_AUDITON_SETSMASK:
30337c478bd9Sstevel@tonic-gate 		STRUCT_INIT(ainfo, get_udatamodel());
30347c478bd9Sstevel@tonic-gate 		if (copyin((caddr_t)uap->a2, STRUCT_BUF(ainfo),
3035745b2690Stz 		    STRUCT_SIZE(ainfo))) {
3036745b2690Stz 			return;
30377c478bd9Sstevel@tonic-gate 		}
30387c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(3, "setsmask:as_success",
3039745b2690Stz 		    (uint32_t)STRUCT_FGET(ainfo, ai_mask.as_success)));
30407c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(3, "setsmask:as_failure",
3041745b2690Stz 		    (uint32_t)STRUCT_FGET(ainfo, ai_mask.as_failure)));
30427c478bd9Sstevel@tonic-gate 		break;
30437c478bd9Sstevel@tonic-gate 	case AUE_AUDITON_SETCOND:
30447c478bd9Sstevel@tonic-gate 		if (copyin((caddr_t)a2, &auditstate, sizeof (int)))
30457c478bd9Sstevel@tonic-gate 			return;
30467c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(3, "setcond", (uint32_t)auditstate));
30477c478bd9Sstevel@tonic-gate 		break;
30487c478bd9Sstevel@tonic-gate 	case AUE_AUDITON_SETCLASS:
30497c478bd9Sstevel@tonic-gate 		if (copyin((caddr_t)a2, &event, sizeof (au_evclass_map_t)))
30507c478bd9Sstevel@tonic-gate 			return;
30517c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(
3052745b2690Stz 		    2, "setclass:ec_event", (uint32_t)event.ec_number));
30537c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(
3054745b2690Stz 		    3, "setclass:ec_class", (uint32_t)event.ec_class));
30557c478bd9Sstevel@tonic-gate 		break;
30567c478bd9Sstevel@tonic-gate 	case AUE_GETAUID:
30577c478bd9Sstevel@tonic-gate 	case AUE_GETAUDIT:
30587c478bd9Sstevel@tonic-gate 	case AUE_GETAUDIT_ADDR:
30597c478bd9Sstevel@tonic-gate 	case AUE_AUDIT:
30607c478bd9Sstevel@tonic-gate 	case AUE_AUDITON_GPOLICY:
30617c478bd9Sstevel@tonic-gate 	case AUE_AUDITON_GQCTRL:
30627c478bd9Sstevel@tonic-gate 	case AUE_AUDITON_GETKMASK:
30637c478bd9Sstevel@tonic-gate 	case AUE_AUDITON_GETCWD:
30647c478bd9Sstevel@tonic-gate 	case AUE_AUDITON_GETCAR:
30657c478bd9Sstevel@tonic-gate 	case AUE_AUDITON_GETSTAT:
30667c478bd9Sstevel@tonic-gate 	case AUE_AUDITON_SETSTAT:
30677c478bd9Sstevel@tonic-gate 	case AUE_AUDITON_GETCOND:
30687c478bd9Sstevel@tonic-gate 	case AUE_AUDITON_GETCLASS:
30697c478bd9Sstevel@tonic-gate 		break;
30707c478bd9Sstevel@tonic-gate 	default:
30717c478bd9Sstevel@tonic-gate 		break;
30727c478bd9Sstevel@tonic-gate 	}
30737c478bd9Sstevel@tonic-gate 
30747c478bd9Sstevel@tonic-gate }	/* AUS_AUDITSYS */
30757c478bd9Sstevel@tonic-gate 
30767c478bd9Sstevel@tonic-gate 
30777c478bd9Sstevel@tonic-gate /* only audit privileged operations for systeminfo(2) system call */
30787c478bd9Sstevel@tonic-gate static au_event_t
30797c478bd9Sstevel@tonic-gate aui_sysinfo(au_event_t e)
30807c478bd9Sstevel@tonic-gate {
30817c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
30827c478bd9Sstevel@tonic-gate 	uint32_t command;
30837c478bd9Sstevel@tonic-gate 
30847c478bd9Sstevel@tonic-gate 	struct a {
30857c478bd9Sstevel@tonic-gate 		long	command;
30867c478bd9Sstevel@tonic-gate 		long	buf;		/* char * */
30877c478bd9Sstevel@tonic-gate 		long	count;
30887c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
30897c478bd9Sstevel@tonic-gate 
30907c478bd9Sstevel@tonic-gate 	command = (uint32_t)uap->command;
30917c478bd9Sstevel@tonic-gate 
30927c478bd9Sstevel@tonic-gate 	switch (command) {
30937c478bd9Sstevel@tonic-gate 	case SI_SET_HOSTNAME:
30947c478bd9Sstevel@tonic-gate 	case SI_SET_SRPC_DOMAIN:
30957c478bd9Sstevel@tonic-gate 		e = (au_event_t)AUE_SYSINFO;
30967c478bd9Sstevel@tonic-gate 		break;
30977c478bd9Sstevel@tonic-gate 	default:
30987c478bd9Sstevel@tonic-gate 		e = (au_event_t)AUE_NULL;
30997c478bd9Sstevel@tonic-gate 		break;
31007c478bd9Sstevel@tonic-gate 	}
31017c478bd9Sstevel@tonic-gate 	return (e);
31027c478bd9Sstevel@tonic-gate }
31037c478bd9Sstevel@tonic-gate 
31047c478bd9Sstevel@tonic-gate /*ARGSUSED*/
31057c478bd9Sstevel@tonic-gate static void
31067c478bd9Sstevel@tonic-gate aus_sysinfo(struct t_audit_data *tad)
31077c478bd9Sstevel@tonic-gate {
31087c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
31097c478bd9Sstevel@tonic-gate 	uint32_t command;
31107c478bd9Sstevel@tonic-gate 	size_t len, maxlen;
31117c478bd9Sstevel@tonic-gate 	char *name;
31127c478bd9Sstevel@tonic-gate 	uintptr_t buf;
31137c478bd9Sstevel@tonic-gate 
31147c478bd9Sstevel@tonic-gate 	struct a {
31157c478bd9Sstevel@tonic-gate 		long	command;
31167c478bd9Sstevel@tonic-gate 		long	buf;		/* char * */
31177c478bd9Sstevel@tonic-gate 		long	count;
31187c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
31197c478bd9Sstevel@tonic-gate 
31207c478bd9Sstevel@tonic-gate 	command = (uint32_t)uap->command;
31217c478bd9Sstevel@tonic-gate 	buf = (uintptr_t)uap->buf;
31227c478bd9Sstevel@tonic-gate 
31237c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(1, "cmd", command));
31247c478bd9Sstevel@tonic-gate 
31257c478bd9Sstevel@tonic-gate 	switch (command) {
31267c478bd9Sstevel@tonic-gate 	case SI_SET_HOSTNAME:
31277c478bd9Sstevel@tonic-gate 	{
31287c478bd9Sstevel@tonic-gate 		if (secpolicy_sys_config(CRED(), B_TRUE) != 0)
31297c478bd9Sstevel@tonic-gate 			return;
31307c478bd9Sstevel@tonic-gate 
31317c478bd9Sstevel@tonic-gate 		maxlen = SYS_NMLN;
31327c478bd9Sstevel@tonic-gate 		name = kmem_alloc(maxlen, KM_SLEEP);
31337c478bd9Sstevel@tonic-gate 		if (copyinstr((caddr_t)buf, name, SYS_NMLN, &len))
31347c478bd9Sstevel@tonic-gate 			break;
31357c478bd9Sstevel@tonic-gate 
31367c478bd9Sstevel@tonic-gate 		/*
31377c478bd9Sstevel@tonic-gate 		 * Must be non-NULL string and string
31387c478bd9Sstevel@tonic-gate 		 * must be less than SYS_NMLN chars.
31397c478bd9Sstevel@tonic-gate 		 */
31407c478bd9Sstevel@tonic-gate 		if (len < 2 || (len == SYS_NMLN && name[SYS_NMLN - 1] != '\0'))
31417c478bd9Sstevel@tonic-gate 			break;
31427c478bd9Sstevel@tonic-gate 
31437c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_text(name));
31447c478bd9Sstevel@tonic-gate 		break;
31457c478bd9Sstevel@tonic-gate 	}
31467c478bd9Sstevel@tonic-gate 
31477c478bd9Sstevel@tonic-gate 	case SI_SET_SRPC_DOMAIN:
31487c478bd9Sstevel@tonic-gate 	{
31497c478bd9Sstevel@tonic-gate 		if (secpolicy_sys_config(CRED(), B_TRUE) != 0)
31507c478bd9Sstevel@tonic-gate 			return;
31517c478bd9Sstevel@tonic-gate 
31527c478bd9Sstevel@tonic-gate 		maxlen = SYS_NMLN;
31537c478bd9Sstevel@tonic-gate 		name = kmem_alloc(maxlen, KM_SLEEP);
31547c478bd9Sstevel@tonic-gate 		if (copyinstr((caddr_t)buf, name, SYS_NMLN, &len))
31557c478bd9Sstevel@tonic-gate 			break;
31567c478bd9Sstevel@tonic-gate 
31577c478bd9Sstevel@tonic-gate 		/*
31587c478bd9Sstevel@tonic-gate 		 * If string passed in is longer than length
31597c478bd9Sstevel@tonic-gate 		 * allowed for domain name, fail.
31607c478bd9Sstevel@tonic-gate 		 */
31617c478bd9Sstevel@tonic-gate 		if (len == SYS_NMLN && name[SYS_NMLN - 1] != '\0')
31627c478bd9Sstevel@tonic-gate 			break;
31637c478bd9Sstevel@tonic-gate 
31647c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_text(name));
31657c478bd9Sstevel@tonic-gate 		break;
31667c478bd9Sstevel@tonic-gate 	}
31677c478bd9Sstevel@tonic-gate 
31687c478bd9Sstevel@tonic-gate 	default:
31697c478bd9Sstevel@tonic-gate 		return;
31707c478bd9Sstevel@tonic-gate 	}
31717c478bd9Sstevel@tonic-gate 
31727c478bd9Sstevel@tonic-gate 	kmem_free(name, maxlen);
31737c478bd9Sstevel@tonic-gate }
31747c478bd9Sstevel@tonic-gate 
31757c478bd9Sstevel@tonic-gate static au_event_t
31767c478bd9Sstevel@tonic-gate aui_modctl(au_event_t e)
31777c478bd9Sstevel@tonic-gate {
31787c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
31797c478bd9Sstevel@tonic-gate 	uint_t cmd;
31807c478bd9Sstevel@tonic-gate 
31817c478bd9Sstevel@tonic-gate 	struct a {
31827c478bd9Sstevel@tonic-gate 		long	cmd;
31837c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
31847c478bd9Sstevel@tonic-gate 
31857c478bd9Sstevel@tonic-gate 	cmd = (uint_t)uap->cmd;
31867c478bd9Sstevel@tonic-gate 
31877c478bd9Sstevel@tonic-gate 	switch (cmd) {
31887c478bd9Sstevel@tonic-gate 	case MODLOAD:
31897c478bd9Sstevel@tonic-gate 		e = AUE_MODLOAD;
31907c478bd9Sstevel@tonic-gate 		break;
31917c478bd9Sstevel@tonic-gate 	case MODUNLOAD:
31927c478bd9Sstevel@tonic-gate 		e = AUE_MODUNLOAD;
31937c478bd9Sstevel@tonic-gate 		break;
31947c478bd9Sstevel@tonic-gate 	case MODADDMAJBIND:
31957c478bd9Sstevel@tonic-gate 		e = AUE_MODADDMAJ;
31967c478bd9Sstevel@tonic-gate 		break;
31977c478bd9Sstevel@tonic-gate 	case MODSETDEVPOLICY:
31987c478bd9Sstevel@tonic-gate 		e = AUE_MODDEVPLCY;
31997c478bd9Sstevel@tonic-gate 		break;
32007c478bd9Sstevel@tonic-gate 	case MODALLOCPRIV:
32017c478bd9Sstevel@tonic-gate 		e = AUE_MODADDPRIV;
32027c478bd9Sstevel@tonic-gate 		break;
32037c478bd9Sstevel@tonic-gate 	default:
32047c478bd9Sstevel@tonic-gate 		e = AUE_NULL;
32057c478bd9Sstevel@tonic-gate 		break;
32067c478bd9Sstevel@tonic-gate 	}
32077c478bd9Sstevel@tonic-gate 	return (e);
32087c478bd9Sstevel@tonic-gate }
32097c478bd9Sstevel@tonic-gate 
32107c478bd9Sstevel@tonic-gate 
32117c478bd9Sstevel@tonic-gate /*ARGSUSED*/
32127c478bd9Sstevel@tonic-gate static void
32137c478bd9Sstevel@tonic-gate aus_modctl(struct t_audit_data *tad)
32147c478bd9Sstevel@tonic-gate {
32157c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
32167c478bd9Sstevel@tonic-gate 	void *a	= clwp->lwp_ap;
32177c478bd9Sstevel@tonic-gate 	uint_t use_path;
32187c478bd9Sstevel@tonic-gate 
32197c478bd9Sstevel@tonic-gate 	switch (tad->tad_event) {
32207c478bd9Sstevel@tonic-gate 	case AUE_MODLOAD: {
32217c478bd9Sstevel@tonic-gate 		typedef struct {
32227c478bd9Sstevel@tonic-gate 			long	cmd;
32237c478bd9Sstevel@tonic-gate 			long	use_path;
32247c478bd9Sstevel@tonic-gate 			long	filename;		/* char * */
32257c478bd9Sstevel@tonic-gate 		} modloada_t;
32267c478bd9Sstevel@tonic-gate 
32277c478bd9Sstevel@tonic-gate 		char *filenamep;
32287c478bd9Sstevel@tonic-gate 		uintptr_t fname;
32297c478bd9Sstevel@tonic-gate 		extern char *default_path;
32307c478bd9Sstevel@tonic-gate 
32317c478bd9Sstevel@tonic-gate 		fname = (uintptr_t)((modloada_t *)a)->filename;
32327c478bd9Sstevel@tonic-gate 		use_path = (uint_t)((modloada_t *)a)->use_path;
32337c478bd9Sstevel@tonic-gate 
32347c478bd9Sstevel@tonic-gate 			/* space to hold path */
32357c478bd9Sstevel@tonic-gate 		filenamep = kmem_alloc(MOD_MAXPATH, KM_SLEEP);
32367c478bd9Sstevel@tonic-gate 			/* get string */
32377c478bd9Sstevel@tonic-gate 		if (copyinstr((caddr_t)fname, filenamep, MOD_MAXPATH, 0)) {
32387c478bd9Sstevel@tonic-gate 				/* free allocated path */
32397c478bd9Sstevel@tonic-gate 			kmem_free(filenamep, MOD_MAXPATH);
32407c478bd9Sstevel@tonic-gate 			return;
32417c478bd9Sstevel@tonic-gate 		}
32427c478bd9Sstevel@tonic-gate 			/* ensure it's null terminated */
32437c478bd9Sstevel@tonic-gate 		filenamep[MOD_MAXPATH - 1] = 0;
32447c478bd9Sstevel@tonic-gate 
32457c478bd9Sstevel@tonic-gate 		if (use_path)
32467c478bd9Sstevel@tonic-gate 			au_uwrite(au_to_text(default_path));
32477c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_text(filenamep));
32487c478bd9Sstevel@tonic-gate 
32497c478bd9Sstevel@tonic-gate 			/* release temporary memory */
32507c478bd9Sstevel@tonic-gate 		kmem_free(filenamep, MOD_MAXPATH);
32517c478bd9Sstevel@tonic-gate 		break;
32527c478bd9Sstevel@tonic-gate 	}
32537c478bd9Sstevel@tonic-gate 	case AUE_MODUNLOAD: {
32547c478bd9Sstevel@tonic-gate 		typedef struct {
32557c478bd9Sstevel@tonic-gate 			long	cmd;
32567c478bd9Sstevel@tonic-gate 			long	id;
32577c478bd9Sstevel@tonic-gate 		} modunloada_t;
32587c478bd9Sstevel@tonic-gate 
32597c478bd9Sstevel@tonic-gate 		uint32_t id = (uint32_t)((modunloada_t *)a)->id;
32607c478bd9Sstevel@tonic-gate 
32617c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "id", id));
32627c478bd9Sstevel@tonic-gate 		break;
32637c478bd9Sstevel@tonic-gate 	}
32647c478bd9Sstevel@tonic-gate 	case AUE_MODADDMAJ: {
32657c478bd9Sstevel@tonic-gate 		STRUCT_DECL(modconfig, mc);
32667c478bd9Sstevel@tonic-gate 		typedef struct {
32677c478bd9Sstevel@tonic-gate 			long	cmd;
32687c478bd9Sstevel@tonic-gate 			long	subcmd;
32697c478bd9Sstevel@tonic-gate 			long	data;		/* int * */
32707c478bd9Sstevel@tonic-gate 		} modconfiga_t;
32717c478bd9Sstevel@tonic-gate 
32727c478bd9Sstevel@tonic-gate 		STRUCT_DECL(aliases, alias);
32737c478bd9Sstevel@tonic-gate 		caddr_t ap;
32747c478bd9Sstevel@tonic-gate 		int i, num_aliases;
32757c478bd9Sstevel@tonic-gate 		char *drvname, *mc_drvname;
32767c478bd9Sstevel@tonic-gate 		char *name;
32777c478bd9Sstevel@tonic-gate 		extern char *ddi_major_to_name(major_t);
32787c478bd9Sstevel@tonic-gate 		model_t model;
32797c478bd9Sstevel@tonic-gate 
32807c478bd9Sstevel@tonic-gate 		uintptr_t data = (uintptr_t)((modconfiga_t *)a)->data;
32817c478bd9Sstevel@tonic-gate 
32827c478bd9Sstevel@tonic-gate 		model = get_udatamodel();
32837c478bd9Sstevel@tonic-gate 		STRUCT_INIT(mc, model);
32847c478bd9Sstevel@tonic-gate 			/* sanitize buffer */
32857c478bd9Sstevel@tonic-gate 		bzero((caddr_t)STRUCT_BUF(mc), STRUCT_SIZE(mc));
32867c478bd9Sstevel@tonic-gate 			/* get user arguments */
32877c478bd9Sstevel@tonic-gate 		if (copyin((caddr_t)data, (caddr_t)STRUCT_BUF(mc),
3288745b2690Stz 		    STRUCT_SIZE(mc)) != 0)
32897c478bd9Sstevel@tonic-gate 			return;
32907c478bd9Sstevel@tonic-gate 
32917c478bd9Sstevel@tonic-gate 		mc_drvname = STRUCT_FGET(mc, drvname);
32927c478bd9Sstevel@tonic-gate 		if ((drvname = ddi_major_to_name(
3293745b2690Stz 		    (major_t)STRUCT_FGET(mc, major))) != NULL &&
3294745b2690Stz 		    strncmp(drvname, mc_drvname, MAXMODCONFNAME) != 0) {
32957c478bd9Sstevel@tonic-gate 				/* safety */
32967c478bd9Sstevel@tonic-gate 			if (mc_drvname[0] != '\0') {
32977c478bd9Sstevel@tonic-gate 				mc_drvname[MAXMODCONFNAME-1] = '\0';
32987c478bd9Sstevel@tonic-gate 				au_uwrite(au_to_text(mc_drvname));
32997c478bd9Sstevel@tonic-gate 			}
33007c478bd9Sstevel@tonic-gate 				/* drvname != NULL from test above */
33017c478bd9Sstevel@tonic-gate 			au_uwrite(au_to_text(drvname));
33027c478bd9Sstevel@tonic-gate 			return;
33037c478bd9Sstevel@tonic-gate 		}
33047c478bd9Sstevel@tonic-gate 
33057c478bd9Sstevel@tonic-gate 		if (mc_drvname[0] != '\0') {
33067c478bd9Sstevel@tonic-gate 				/* safety */
33077c478bd9Sstevel@tonic-gate 			mc_drvname[MAXMODCONFNAME-1] = '\0';
33087c478bd9Sstevel@tonic-gate 			au_uwrite(au_to_text(mc_drvname));
33097c478bd9Sstevel@tonic-gate 		} else
33107c478bd9Sstevel@tonic-gate 			au_uwrite(au_to_text("no drvname"));
33117c478bd9Sstevel@tonic-gate 
33127c478bd9Sstevel@tonic-gate 		num_aliases = STRUCT_FGET(mc, num_aliases);
33137c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(5, "", (uint32_t)num_aliases));
33147c478bd9Sstevel@tonic-gate 		ap = (caddr_t)STRUCT_FGETP(mc, ap);
33157c478bd9Sstevel@tonic-gate 		name = kmem_alloc(MAXMODCONFNAME, KM_SLEEP);
33167c478bd9Sstevel@tonic-gate 		STRUCT_INIT(alias, model);
33177c478bd9Sstevel@tonic-gate 		for (i = 0; i < num_aliases; i++) {
33187c478bd9Sstevel@tonic-gate 			bzero((caddr_t)STRUCT_BUF(alias),
3319745b2690Stz 			    STRUCT_SIZE(alias));
33207c478bd9Sstevel@tonic-gate 			if (copyin((caddr_t)ap, (caddr_t)STRUCT_BUF(alias),
3321745b2690Stz 			    STRUCT_SIZE(alias)) != 0)
33227c478bd9Sstevel@tonic-gate 				break;
33237c478bd9Sstevel@tonic-gate 			if (copyinstr(STRUCT_FGETP(alias, a_name), name,
33247c478bd9Sstevel@tonic-gate 			    MAXMODCONFNAME, NULL) != 0) {
33257c478bd9Sstevel@tonic-gate 				break;
33267c478bd9Sstevel@tonic-gate 			}
33277c478bd9Sstevel@tonic-gate 
33287c478bd9Sstevel@tonic-gate 			au_uwrite(au_to_text(name));
33297c478bd9Sstevel@tonic-gate 			ap = (caddr_t)STRUCT_FGETP(alias, a_next);
33307c478bd9Sstevel@tonic-gate 		}
33317c478bd9Sstevel@tonic-gate 		kmem_free(name, MAXMODCONFNAME);
33327c478bd9Sstevel@tonic-gate 		break;
33337c478bd9Sstevel@tonic-gate 	}
33347c478bd9Sstevel@tonic-gate 	default:
33357c478bd9Sstevel@tonic-gate 		break;
33367c478bd9Sstevel@tonic-gate 	}
33377c478bd9Sstevel@tonic-gate }
33387c478bd9Sstevel@tonic-gate 
33397c478bd9Sstevel@tonic-gate 
33407c478bd9Sstevel@tonic-gate /*ARGSUSED*/
33417c478bd9Sstevel@tonic-gate static void
33427c478bd9Sstevel@tonic-gate auf_accept(
33437c478bd9Sstevel@tonic-gate 	struct t_audit_data *tad,
33447c478bd9Sstevel@tonic-gate 	int	error,
33457c478bd9Sstevel@tonic-gate 	rval_t	*rval)
33467c478bd9Sstevel@tonic-gate {
33477c478bd9Sstevel@tonic-gate 	uint32_t scid;
33487c478bd9Sstevel@tonic-gate 	uint32_t sy_flags;
33497c478bd9Sstevel@tonic-gate 	int fd;
33507c478bd9Sstevel@tonic-gate 	struct sonode *so;
33517c478bd9Sstevel@tonic-gate 	char so_laddr[sizeof (struct sockaddr_in6)];
33527c478bd9Sstevel@tonic-gate 	char so_faddr[sizeof (struct sockaddr_in6)];
33537c478bd9Sstevel@tonic-gate 	int err;
33547c478bd9Sstevel@tonic-gate 	short so_family, so_type;
33557c478bd9Sstevel@tonic-gate 	int add_sock_token = 0;
33567c478bd9Sstevel@tonic-gate 
33577c478bd9Sstevel@tonic-gate 	/* need to determine type of executing binary */
33587c478bd9Sstevel@tonic-gate 	scid = tad->tad_scid;
33597c478bd9Sstevel@tonic-gate #ifdef _SYSCALL32_IMPL
33607c478bd9Sstevel@tonic-gate 	if (lwp_getdatamodel(ttolwp(curthread)) == DATAMODEL_NATIVE)
33617c478bd9Sstevel@tonic-gate 		sy_flags = sysent[scid].sy_flags & SE_RVAL_MASK;
33627c478bd9Sstevel@tonic-gate 	else
33637c478bd9Sstevel@tonic-gate 		sy_flags = sysent32[scid].sy_flags & SE_RVAL_MASK;
33647c478bd9Sstevel@tonic-gate #else
33657c478bd9Sstevel@tonic-gate 	sy_flags = sysent[scid].sy_flags & SE_RVAL_MASK;
33667c478bd9Sstevel@tonic-gate #endif
33677c478bd9Sstevel@tonic-gate 	if (sy_flags == SE_32RVAL1)
33687c478bd9Sstevel@tonic-gate 		fd = rval->r_val1;
33697c478bd9Sstevel@tonic-gate 	if (sy_flags == (SE_32RVAL2|SE_32RVAL1))
33707c478bd9Sstevel@tonic-gate 		fd = rval->r_val1;
33717c478bd9Sstevel@tonic-gate 	if (sy_flags == SE_64RVAL)
33727c478bd9Sstevel@tonic-gate 		fd = (int)rval->r_vals;
33737c478bd9Sstevel@tonic-gate 
33747c478bd9Sstevel@tonic-gate 	if (error) {
33757c478bd9Sstevel@tonic-gate 		/* can't trust socket contents. Just return */
33767c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
33777c478bd9Sstevel@tonic-gate 		return;
33787c478bd9Sstevel@tonic-gate 	}
33797c478bd9Sstevel@tonic-gate 
3380745b2690Stz 	if ((so = getsonode(fd, &err, NULL)) == NULL) {
33817c478bd9Sstevel@tonic-gate 		/*
33827c478bd9Sstevel@tonic-gate 		 * not security relevant if doing a accept from non socket
33837c478bd9Sstevel@tonic-gate 		 * so no extra tokens. Should probably turn off audit record
33847c478bd9Sstevel@tonic-gate 		 * generation here.
33857c478bd9Sstevel@tonic-gate 		 */
33867c478bd9Sstevel@tonic-gate 		return;
33877c478bd9Sstevel@tonic-gate 	}
33887c478bd9Sstevel@tonic-gate 
33897c478bd9Sstevel@tonic-gate 	so_family = so->so_family;
33907c478bd9Sstevel@tonic-gate 	so_type   = so->so_type;
33917c478bd9Sstevel@tonic-gate 
33927c478bd9Sstevel@tonic-gate 	switch (so_family) {
33937c478bd9Sstevel@tonic-gate 	case AF_INET:
33947c478bd9Sstevel@tonic-gate 	case AF_INET6:
33957c478bd9Sstevel@tonic-gate 		/*
33967c478bd9Sstevel@tonic-gate 		 * XXX - what about other socket types for AF_INET (e.g. DGRAM)
33977c478bd9Sstevel@tonic-gate 		 */
33987c478bd9Sstevel@tonic-gate 		if (so->so_type == SOCK_STREAM) {
33990f1702c5SYu Xiangning 			socklen_t len;
34007c478bd9Sstevel@tonic-gate 
34017c478bd9Sstevel@tonic-gate 			bzero((void *)so_laddr, sizeof (so_laddr));
34027c478bd9Sstevel@tonic-gate 			bzero((void *)so_faddr, sizeof (so_faddr));
34037c478bd9Sstevel@tonic-gate 
34040f1702c5SYu Xiangning 			len = sizeof (so_laddr);
34050f1702c5SYu Xiangning 			(void) socket_getsockname(so,
34060f1702c5SYu Xiangning 			    (struct sockaddr *)so_laddr, &len, CRED());
34070f1702c5SYu Xiangning 			len = sizeof (so_faddr);
34080f1702c5SYu Xiangning 			(void) socket_getpeername(so,
34090f1702c5SYu Xiangning 			    (struct sockaddr *)so_faddr, &len, B_FALSE, CRED());
34107c478bd9Sstevel@tonic-gate 
34117c478bd9Sstevel@tonic-gate 			add_sock_token = 1;
34127c478bd9Sstevel@tonic-gate 		}
34137c478bd9Sstevel@tonic-gate 		break;
34147c478bd9Sstevel@tonic-gate 
34157c478bd9Sstevel@tonic-gate 	default:
34167c478bd9Sstevel@tonic-gate 		/* AF_UNIX, AF_ROUTE, AF_KEY do not support accept */
34177c478bd9Sstevel@tonic-gate 		break;
34187c478bd9Sstevel@tonic-gate 	}
34197c478bd9Sstevel@tonic-gate 
34207c478bd9Sstevel@tonic-gate 	releasef(fd);
34217c478bd9Sstevel@tonic-gate 
34227c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
34237c478bd9Sstevel@tonic-gate 
34247c478bd9Sstevel@tonic-gate 	if (add_sock_token == 0) {
34257c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(0, "family", (uint32_t)(so_family)));
34267c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(0, "type", (uint32_t)(so_type)));
34277c478bd9Sstevel@tonic-gate 		return;
34287c478bd9Sstevel@tonic-gate 	}
34297c478bd9Sstevel@tonic-gate 
34307c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_socket_ex(so_family, so_type, so_laddr, so_faddr));
34317c478bd9Sstevel@tonic-gate 
34327c478bd9Sstevel@tonic-gate }
34337c478bd9Sstevel@tonic-gate 
34347c478bd9Sstevel@tonic-gate /*ARGSUSED*/
34357c478bd9Sstevel@tonic-gate static void
34367c478bd9Sstevel@tonic-gate auf_bind(struct t_audit_data *tad, int error, rval_t *rvp)
34377c478bd9Sstevel@tonic-gate {
34387c478bd9Sstevel@tonic-gate 	struct a {
34397c478bd9Sstevel@tonic-gate 		long	fd;
34407c478bd9Sstevel@tonic-gate 		long	addr;
34417c478bd9Sstevel@tonic-gate 		long	len;
34427c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)ttolwp(curthread)->lwp_ap;
34437c478bd9Sstevel@tonic-gate 
34447c478bd9Sstevel@tonic-gate 	struct sonode *so;
34457c478bd9Sstevel@tonic-gate 	char so_laddr[sizeof (struct sockaddr_in6)];
34467c478bd9Sstevel@tonic-gate 	char so_faddr[sizeof (struct sockaddr_in6)];
34477c478bd9Sstevel@tonic-gate 	int err, fd;
34480f1702c5SYu Xiangning 	socklen_t len;
34497c478bd9Sstevel@tonic-gate 	short so_family, so_type;
34507c478bd9Sstevel@tonic-gate 	int add_sock_token = 0;
34517c478bd9Sstevel@tonic-gate 
34527c478bd9Sstevel@tonic-gate 	fd = (int)uap->fd;
34537c478bd9Sstevel@tonic-gate 
34547c478bd9Sstevel@tonic-gate 	/*
34557c478bd9Sstevel@tonic-gate 	 * bind failed, then nothing extra to add to audit record.
34567c478bd9Sstevel@tonic-gate 	 */
34577c478bd9Sstevel@tonic-gate 	if (error) {
34587c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
34597c478bd9Sstevel@tonic-gate 		/* XXX may want to add failed address some day */
34607c478bd9Sstevel@tonic-gate 		return;
34617c478bd9Sstevel@tonic-gate 	}
34627c478bd9Sstevel@tonic-gate 
3463745b2690Stz 	if ((so = getsonode(fd, &err, NULL)) == NULL) {
34647c478bd9Sstevel@tonic-gate 		/*
34657c478bd9Sstevel@tonic-gate 		 * not security relevant if doing a bind from non socket
34667c478bd9Sstevel@tonic-gate 		 * so no extra tokens. Should probably turn off audit record
34677c478bd9Sstevel@tonic-gate 		 * generation here.
34687c478bd9Sstevel@tonic-gate 		 */
34697c478bd9Sstevel@tonic-gate 		return;
34707c478bd9Sstevel@tonic-gate 	}
34717c478bd9Sstevel@tonic-gate 
34727c478bd9Sstevel@tonic-gate 	so_family = so->so_family;
34737c478bd9Sstevel@tonic-gate 	so_type   = so->so_type;
34747c478bd9Sstevel@tonic-gate 
34757c478bd9Sstevel@tonic-gate 	switch (so_family) {
34767c478bd9Sstevel@tonic-gate 	case AF_INET:
34777c478bd9Sstevel@tonic-gate 	case AF_INET6:
34787c478bd9Sstevel@tonic-gate 
34797c478bd9Sstevel@tonic-gate 		bzero(so_faddr, sizeof (so_faddr));
34800f1702c5SYu Xiangning 		len = sizeof (so_faddr);
34817c478bd9Sstevel@tonic-gate 
34820f1702c5SYu Xiangning 		(void) socket_getpeername(so,
34830f1702c5SYu Xiangning 		    (struct sockaddr *)so_faddr, &len, B_FALSE, CRED());
34847c478bd9Sstevel@tonic-gate 		add_sock_token = 1;
34857c478bd9Sstevel@tonic-gate 
34867c478bd9Sstevel@tonic-gate 		break;
34877c478bd9Sstevel@tonic-gate 
34887c478bd9Sstevel@tonic-gate 	case AF_UNIX:
34897c478bd9Sstevel@tonic-gate 		/* token added by lookup */
34907c478bd9Sstevel@tonic-gate 		break;
34917c478bd9Sstevel@tonic-gate 	default:
34927c478bd9Sstevel@tonic-gate 		/* AF_ROUTE, AF_KEY do not support accept */
34937c478bd9Sstevel@tonic-gate 		break;
34947c478bd9Sstevel@tonic-gate 	}
34957c478bd9Sstevel@tonic-gate 
34967c478bd9Sstevel@tonic-gate 	releasef(fd);
34977c478bd9Sstevel@tonic-gate 
34987c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
34997c478bd9Sstevel@tonic-gate 
35007c478bd9Sstevel@tonic-gate 	if (add_sock_token == 0) {
35017c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "family", (uint32_t)(so_family)));
35027c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "type", (uint32_t)(so_type)));
35037c478bd9Sstevel@tonic-gate 		return;
35047c478bd9Sstevel@tonic-gate 	}
35057c478bd9Sstevel@tonic-gate 
35067c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_socket_ex(so_family, so_type, so_laddr, so_faddr));
35077c478bd9Sstevel@tonic-gate 
35087c478bd9Sstevel@tonic-gate }
35097c478bd9Sstevel@tonic-gate 
35107c478bd9Sstevel@tonic-gate /*ARGSUSED*/
35117c478bd9Sstevel@tonic-gate static void
35127c478bd9Sstevel@tonic-gate auf_connect(struct t_audit_data *tad, int error, rval_t *rval)
35137c478bd9Sstevel@tonic-gate {
35147c478bd9Sstevel@tonic-gate 	struct a {
35157c478bd9Sstevel@tonic-gate 		long	fd;
35167c478bd9Sstevel@tonic-gate 		long	addr;
35177c478bd9Sstevel@tonic-gate 		long	len;
35187c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)ttolwp(curthread)->lwp_ap;
35197c478bd9Sstevel@tonic-gate 
35207c478bd9Sstevel@tonic-gate 	struct sonode *so;
35217c478bd9Sstevel@tonic-gate 	char so_laddr[sizeof (struct sockaddr_in6)];
35227c478bd9Sstevel@tonic-gate 	char so_faddr[sizeof (struct sockaddr_in6)];
35237c478bd9Sstevel@tonic-gate 	int err, fd;
35240f1702c5SYu Xiangning 	socklen_t len;
35257c478bd9Sstevel@tonic-gate 	short so_family, so_type;
35267c478bd9Sstevel@tonic-gate 	int add_sock_token = 0;
35277c478bd9Sstevel@tonic-gate 
35287c478bd9Sstevel@tonic-gate 	fd = (int)uap->fd;
35297c478bd9Sstevel@tonic-gate 
35307c478bd9Sstevel@tonic-gate 
3531745b2690Stz 	if ((so = getsonode(fd, &err, NULL)) == NULL) {
35327c478bd9Sstevel@tonic-gate 		/*
35337c478bd9Sstevel@tonic-gate 		 * not security relevant if doing a connect from non socket
35347c478bd9Sstevel@tonic-gate 		 * so no extra tokens. Should probably turn off audit record
35357c478bd9Sstevel@tonic-gate 		 * generation here.
35367c478bd9Sstevel@tonic-gate 		 */
35377c478bd9Sstevel@tonic-gate 		return;
35387c478bd9Sstevel@tonic-gate 	}
35397c478bd9Sstevel@tonic-gate 
35407c478bd9Sstevel@tonic-gate 	so_family = so->so_family;
35417c478bd9Sstevel@tonic-gate 	so_type   = so->so_type;
35427c478bd9Sstevel@tonic-gate 
35437c478bd9Sstevel@tonic-gate 	switch (so_family) {
35447c478bd9Sstevel@tonic-gate 	case AF_INET:
35457c478bd9Sstevel@tonic-gate 	case AF_INET6:
35467c478bd9Sstevel@tonic-gate 
35477c478bd9Sstevel@tonic-gate 		bzero(so_laddr, sizeof (so_laddr));
35487c478bd9Sstevel@tonic-gate 		bzero(so_faddr, sizeof (so_faddr));
35497c478bd9Sstevel@tonic-gate 
35500f1702c5SYu Xiangning 		len = sizeof (so_laddr);
35510f1702c5SYu Xiangning 		(void) socket_getsockname(so, (struct sockaddr *)so_laddr,
35520f1702c5SYu Xiangning 		    &len, CRED());
35537c478bd9Sstevel@tonic-gate 		if (error) {
35547c478bd9Sstevel@tonic-gate 			if (uap->addr == NULL)
35557c478bd9Sstevel@tonic-gate 				break;
35567c478bd9Sstevel@tonic-gate 			if (uap->len <= 0)
35577c478bd9Sstevel@tonic-gate 				break;
35587c478bd9Sstevel@tonic-gate 			len = min(uap->len, sizeof (so_faddr));
35597c478bd9Sstevel@tonic-gate 			if (copyin((caddr_t)(uap->addr), so_faddr, len) != 0)
35607c478bd9Sstevel@tonic-gate 				break;
35617c478bd9Sstevel@tonic-gate #ifdef NOTYET
35627c478bd9Sstevel@tonic-gate 			au_uwrite(au_to_data(AUP_HEX, AUR_CHAR, len, so_faddr));
35637c478bd9Sstevel@tonic-gate #endif
35647c478bd9Sstevel@tonic-gate 		} else {
35657c478bd9Sstevel@tonic-gate 			/* sanity check on length */
35660f1702c5SYu Xiangning 			len = sizeof (so_faddr);
35670f1702c5SYu Xiangning 			(void) socket_getpeername(so,
35680f1702c5SYu Xiangning 			    (struct sockaddr *)so_faddr, &len, B_FALSE, CRED());
35697c478bd9Sstevel@tonic-gate 		}
35707c478bd9Sstevel@tonic-gate 
35717c478bd9Sstevel@tonic-gate 		add_sock_token = 1;
35727c478bd9Sstevel@tonic-gate 
35737c478bd9Sstevel@tonic-gate 		break;
35747c478bd9Sstevel@tonic-gate 
35757c478bd9Sstevel@tonic-gate 	case AF_UNIX:
35767c478bd9Sstevel@tonic-gate 		/* does a lookup on name */
35777c478bd9Sstevel@tonic-gate 		break;
35787c478bd9Sstevel@tonic-gate 
35797c478bd9Sstevel@tonic-gate 	default:
35807c478bd9Sstevel@tonic-gate 		/* AF_ROUTE, AF_KEY do not support accept */
35817c478bd9Sstevel@tonic-gate 		break;
35827c478bd9Sstevel@tonic-gate 	}
35837c478bd9Sstevel@tonic-gate 
35847c478bd9Sstevel@tonic-gate 	releasef(fd);
35857c478bd9Sstevel@tonic-gate 
35867c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
35877c478bd9Sstevel@tonic-gate 
35887c478bd9Sstevel@tonic-gate 	if (add_sock_token == 0) {
35897c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "family", (uint32_t)(so_family)));
35907c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "type", (uint32_t)(so_type)));
35917c478bd9Sstevel@tonic-gate 		return;
35927c478bd9Sstevel@tonic-gate 	}
35937c478bd9Sstevel@tonic-gate 
35947c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_socket_ex(so_family, so_type, so_laddr, so_faddr));
35957c478bd9Sstevel@tonic-gate 
35967c478bd9Sstevel@tonic-gate }
35977c478bd9Sstevel@tonic-gate 
35987c478bd9Sstevel@tonic-gate /*ARGSUSED*/
35997c478bd9Sstevel@tonic-gate static void
36007c478bd9Sstevel@tonic-gate aus_shutdown(struct t_audit_data *tad)
36017c478bd9Sstevel@tonic-gate {
36027c478bd9Sstevel@tonic-gate 	struct a {
36037c478bd9Sstevel@tonic-gate 		long	fd;
36047c478bd9Sstevel@tonic-gate 		long	how;
36057c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)ttolwp(curthread)->lwp_ap;
36067c478bd9Sstevel@tonic-gate 
36077c478bd9Sstevel@tonic-gate 	struct sonode *so;
36087c478bd9Sstevel@tonic-gate 	char so_laddr[sizeof (struct sockaddr_in6)];
36097c478bd9Sstevel@tonic-gate 	char so_faddr[sizeof (struct sockaddr_in6)];
36107c478bd9Sstevel@tonic-gate 	int err, fd;
36110f1702c5SYu Xiangning 	socklen_t len;
36127c478bd9Sstevel@tonic-gate 	short so_family, so_type;
36137c478bd9Sstevel@tonic-gate 	int add_sock_token = 0;
36147c478bd9Sstevel@tonic-gate 	file_t *fp;				/* unix domain sockets */
36157c478bd9Sstevel@tonic-gate 	struct f_audit_data *fad;		/* unix domain sockets */
36167c478bd9Sstevel@tonic-gate 
36177c478bd9Sstevel@tonic-gate 	fd = (int)uap->fd;
36187c478bd9Sstevel@tonic-gate 
3619745b2690Stz 	if ((so = getsonode(fd, &err, &fp)) == NULL) {
36207c478bd9Sstevel@tonic-gate 		/*
36217c478bd9Sstevel@tonic-gate 		 * not security relevant if doing a shutdown using non socket
36227c478bd9Sstevel@tonic-gate 		 * so no extra tokens. Should probably turn off audit record
36237c478bd9Sstevel@tonic-gate 		 * generation here.
36247c478bd9Sstevel@tonic-gate 		 */
36257c478bd9Sstevel@tonic-gate 		return;
36267c478bd9Sstevel@tonic-gate 	}
36277c478bd9Sstevel@tonic-gate 
36287c478bd9Sstevel@tonic-gate 	so_family = so->so_family;
36297c478bd9Sstevel@tonic-gate 	so_type   = so->so_type;
36307c478bd9Sstevel@tonic-gate 
36317c478bd9Sstevel@tonic-gate 	switch (so_family) {
36327c478bd9Sstevel@tonic-gate 	case AF_INET:
36337c478bd9Sstevel@tonic-gate 	case AF_INET6:
36347c478bd9Sstevel@tonic-gate 
36357c478bd9Sstevel@tonic-gate 		bzero(so_laddr, sizeof (so_laddr));
36367c478bd9Sstevel@tonic-gate 		bzero(so_faddr, sizeof (so_faddr));
36377c478bd9Sstevel@tonic-gate 
36380f1702c5SYu Xiangning 		len = sizeof (so_laddr);
36390f1702c5SYu Xiangning 		(void) socket_getsockname(so,
36400f1702c5SYu Xiangning 		    (struct sockaddr *)so_laddr, &len, CRED());
36410f1702c5SYu Xiangning 		len = sizeof (so_faddr);
36420f1702c5SYu Xiangning 		(void) socket_getpeername(so,
36430f1702c5SYu Xiangning 		    (struct sockaddr *)so_faddr, &len, B_FALSE, CRED());
36447c478bd9Sstevel@tonic-gate 
36457c478bd9Sstevel@tonic-gate 		add_sock_token = 1;
36467c478bd9Sstevel@tonic-gate 
36477c478bd9Sstevel@tonic-gate 		break;
36487c478bd9Sstevel@tonic-gate 
36497c478bd9Sstevel@tonic-gate 	case AF_UNIX:
36507c478bd9Sstevel@tonic-gate 
36517c478bd9Sstevel@tonic-gate 		/* get path from file struct here */
36527c478bd9Sstevel@tonic-gate 		fad = F2A(fp);
36537c478bd9Sstevel@tonic-gate 		ASSERT(fad);
36547c478bd9Sstevel@tonic-gate 
36557c478bd9Sstevel@tonic-gate 		if (fad->fad_aupath != NULL) {
36567c478bd9Sstevel@tonic-gate 			au_uwrite(au_to_path(fad->fad_aupath));
36577c478bd9Sstevel@tonic-gate 		} else {
36587c478bd9Sstevel@tonic-gate 			au_uwrite(au_to_arg32(1, "no path: fd", fd));
36597c478bd9Sstevel@tonic-gate 		}
36607c478bd9Sstevel@tonic-gate 
36617c478bd9Sstevel@tonic-gate 		audit_attributes(fp->f_vnode);
36627c478bd9Sstevel@tonic-gate 
36637c478bd9Sstevel@tonic-gate 		break;
36647c478bd9Sstevel@tonic-gate 
36657c478bd9Sstevel@tonic-gate 	default:
36667c478bd9Sstevel@tonic-gate 		/*
36677c478bd9Sstevel@tonic-gate 		 * AF_KEY and AF_ROUTE support shutdown. No socket token
36687c478bd9Sstevel@tonic-gate 		 * added.
36697c478bd9Sstevel@tonic-gate 		 */
36707c478bd9Sstevel@tonic-gate 		break;
36717c478bd9Sstevel@tonic-gate 	}
36727c478bd9Sstevel@tonic-gate 
36737c478bd9Sstevel@tonic-gate 	releasef(fd);
36747c478bd9Sstevel@tonic-gate 
36757c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
36767c478bd9Sstevel@tonic-gate 
36777c478bd9Sstevel@tonic-gate 	if (add_sock_token == 0) {
36787c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "family", (uint32_t)(so_family)));
36797c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "type", (uint32_t)(so_type)));
36807c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(2, "how", (uint32_t)(uap->how)));
36817c478bd9Sstevel@tonic-gate 		return;
36827c478bd9Sstevel@tonic-gate 	}
36837c478bd9Sstevel@tonic-gate 
36847c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(2, "how", (uint32_t)(uap->how)));
36857c478bd9Sstevel@tonic-gate 
36867c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_socket_ex(so_family, so_type, so_laddr, so_faddr));
36877c478bd9Sstevel@tonic-gate 
36887c478bd9Sstevel@tonic-gate }
36897c478bd9Sstevel@tonic-gate 
36907c478bd9Sstevel@tonic-gate /*ARGSUSED*/
36917c478bd9Sstevel@tonic-gate static void
36927c478bd9Sstevel@tonic-gate auf_setsockopt(struct t_audit_data *tad, int error, rval_t *rval)
36937c478bd9Sstevel@tonic-gate {
36947c478bd9Sstevel@tonic-gate 	struct a {
36957c478bd9Sstevel@tonic-gate 		long	fd;
36967c478bd9Sstevel@tonic-gate 		long	level;
36977c478bd9Sstevel@tonic-gate 		long	optname;
36987c478bd9Sstevel@tonic-gate 		long	*optval;
36997c478bd9Sstevel@tonic-gate 		long	optlen;
37007c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)ttolwp(curthread)->lwp_ap;
37017c478bd9Sstevel@tonic-gate 
37027c478bd9Sstevel@tonic-gate 	struct sonode	*so;
37037c478bd9Sstevel@tonic-gate 	char so_laddr[sizeof (struct sockaddr_in6)];
37047c478bd9Sstevel@tonic-gate 	char so_faddr[sizeof (struct sockaddr_in6)];
37057c478bd9Sstevel@tonic-gate 	char		val[AU_BUFSIZE];
37067c478bd9Sstevel@tonic-gate 	int		err, fd;
37070f1702c5SYu Xiangning 	socklen_t	len;
37087c478bd9Sstevel@tonic-gate 	short so_family, so_type;
37097c478bd9Sstevel@tonic-gate 	int		add_sock_token = 0;
37107c478bd9Sstevel@tonic-gate 	file_t *fp;				/* unix domain sockets */
37117c478bd9Sstevel@tonic-gate 	struct f_audit_data *fad;		/* unix domain sockets */
37127c478bd9Sstevel@tonic-gate 
37137c478bd9Sstevel@tonic-gate 	fd = (int)uap->fd;
37147c478bd9Sstevel@tonic-gate 
37157c478bd9Sstevel@tonic-gate 	if (error) {
37167c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
37177c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(2, "level", (uint32_t)uap->level));
37187c478bd9Sstevel@tonic-gate 		/* XXX may want to include other arguments */
37197c478bd9Sstevel@tonic-gate 		return;
37207c478bd9Sstevel@tonic-gate 	}
37217c478bd9Sstevel@tonic-gate 
3722745b2690Stz 	if ((so = getsonode(fd, &err, &fp)) == NULL) {
37237c478bd9Sstevel@tonic-gate 		/*
37247c478bd9Sstevel@tonic-gate 		 * not security relevant if doing a setsockopt from non socket
37257c478bd9Sstevel@tonic-gate 		 * so no extra tokens. Should probably turn off audit record
37267c478bd9Sstevel@tonic-gate 		 * generation here.
37277c478bd9Sstevel@tonic-gate 		 */
37287c478bd9Sstevel@tonic-gate 		return;
37297c478bd9Sstevel@tonic-gate 	}
37307c478bd9Sstevel@tonic-gate 
37317c478bd9Sstevel@tonic-gate 	so_family = so->so_family;
37327c478bd9Sstevel@tonic-gate 	so_type   = so->so_type;
37337c478bd9Sstevel@tonic-gate 
37347c478bd9Sstevel@tonic-gate 	switch (so_family) {
37357c478bd9Sstevel@tonic-gate 	case AF_INET:
37367c478bd9Sstevel@tonic-gate 	case AF_INET6:
37377c478bd9Sstevel@tonic-gate 		bzero((void *)so_laddr, sizeof (so_laddr));
37387c478bd9Sstevel@tonic-gate 		bzero((void *)so_faddr, sizeof (so_faddr));
37397c478bd9Sstevel@tonic-gate 
37407c478bd9Sstevel@tonic-gate 		/* get local and foreign addresses */
37410f1702c5SYu Xiangning 		len = sizeof (so_laddr);
37420f1702c5SYu Xiangning 		(void) socket_getsockname(so, (struct sockaddr *)so_laddr,
37430f1702c5SYu Xiangning 		    &len, CRED());
37440f1702c5SYu Xiangning 		len = sizeof (so_faddr);
37450f1702c5SYu Xiangning 		(void) socket_getpeername(so, (struct sockaddr *)so_faddr,
37460f1702c5SYu Xiangning 		    &len, B_FALSE, CRED());
37477c478bd9Sstevel@tonic-gate 
37487c478bd9Sstevel@tonic-gate 		add_sock_token = 1;
37497c478bd9Sstevel@tonic-gate 
37507c478bd9Sstevel@tonic-gate 		break;
37517c478bd9Sstevel@tonic-gate 
37527c478bd9Sstevel@tonic-gate 	case AF_UNIX:
37537c478bd9Sstevel@tonic-gate 
37547c478bd9Sstevel@tonic-gate 		/* get path from file struct here */
37557c478bd9Sstevel@tonic-gate 		fad = F2A(fp);
37567c478bd9Sstevel@tonic-gate 		ASSERT(fad);
37577c478bd9Sstevel@tonic-gate 
37587c478bd9Sstevel@tonic-gate 		if (fad->fad_aupath != NULL) {
37597c478bd9Sstevel@tonic-gate 			au_uwrite(au_to_path(fad->fad_aupath));
37607c478bd9Sstevel@tonic-gate 		} else {
37617c478bd9Sstevel@tonic-gate 			au_uwrite(au_to_arg32(1, "no path: fd", fd));
37627c478bd9Sstevel@tonic-gate 		}
37637c478bd9Sstevel@tonic-gate 
37647c478bd9Sstevel@tonic-gate 		audit_attributes(fp->f_vnode);
37657c478bd9Sstevel@tonic-gate 
37667c478bd9Sstevel@tonic-gate 		break;
37677c478bd9Sstevel@tonic-gate 
37687c478bd9Sstevel@tonic-gate 	default:
37697c478bd9Sstevel@tonic-gate 		/*
37707c478bd9Sstevel@tonic-gate 		 * AF_KEY and AF_ROUTE support setsockopt. No socket token
37717c478bd9Sstevel@tonic-gate 		 * added.
37727c478bd9Sstevel@tonic-gate 		 */
37737c478bd9Sstevel@tonic-gate 		break;
37747c478bd9Sstevel@tonic-gate 	}
37757c478bd9Sstevel@tonic-gate 
37767c478bd9Sstevel@tonic-gate 	releasef(fd);
37777c478bd9Sstevel@tonic-gate 
37787c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
37797c478bd9Sstevel@tonic-gate 
37807c478bd9Sstevel@tonic-gate 	if (add_sock_token == 0) {
37817c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "family", (uint32_t)(so_family)));
37827c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "type", (uint32_t)(so_type)));
37837c478bd9Sstevel@tonic-gate 	}
37847c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(2, "level", (uint32_t)(uap->level)));
37857c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(3, "optname", (uint32_t)(uap->optname)));
37867c478bd9Sstevel@tonic-gate 
37877c478bd9Sstevel@tonic-gate 	bzero(val, sizeof (val));
37887c478bd9Sstevel@tonic-gate 	len = min(uap->optlen, sizeof (val));
37897c478bd9Sstevel@tonic-gate 	if ((len > 0) &&
37907c478bd9Sstevel@tonic-gate 	    (copyin((caddr_t)(uap->optval), (caddr_t)val, len) == 0)) {
37917c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(5, "optlen", (uint32_t)(uap->optlen)));
37927c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_data(AUP_HEX, AUR_BYTE, len, val));
37937c478bd9Sstevel@tonic-gate 	}
37947c478bd9Sstevel@tonic-gate 
37957c478bd9Sstevel@tonic-gate 	if (add_sock_token == 0)
37967c478bd9Sstevel@tonic-gate 		return;
37977c478bd9Sstevel@tonic-gate 
37987c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_socket_ex(so_family, so_type, so_laddr, so_faddr));
37997c478bd9Sstevel@tonic-gate 
38007c478bd9Sstevel@tonic-gate }
38017c478bd9Sstevel@tonic-gate 
38027c478bd9Sstevel@tonic-gate /*ARGSUSED*/
38037c478bd9Sstevel@tonic-gate static void
38047c478bd9Sstevel@tonic-gate aus_sockconfig(tad)
38057c478bd9Sstevel@tonic-gate 	struct t_audit_data *tad;
38067c478bd9Sstevel@tonic-gate {
38077c478bd9Sstevel@tonic-gate 	struct a {
38087c478bd9Sstevel@tonic-gate 		long	domain;
38097c478bd9Sstevel@tonic-gate 		long	type;
38107c478bd9Sstevel@tonic-gate 		long	protocol;
38117c478bd9Sstevel@tonic-gate 		long	devpath;
38127c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)ttolwp(curthread)->lwp_ap;
38137c478bd9Sstevel@tonic-gate 
38147c478bd9Sstevel@tonic-gate 	char	*kdevpath;
38157c478bd9Sstevel@tonic-gate 	int	kdevpathlen = MAXPATHLEN + 1;
38167c478bd9Sstevel@tonic-gate 	size_t	size;
38177c478bd9Sstevel@tonic-gate 
38187c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(1, "domain", (uint32_t)uap->domain));
38197c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(2, "type", (uint32_t)uap->type));
38207c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(3, "protocol", (uint32_t)uap->protocol));
38217c478bd9Sstevel@tonic-gate 
38227c478bd9Sstevel@tonic-gate 	if (uap->devpath == 0) {
38237c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(3, "devpath", (uint32_t)0));
38247c478bd9Sstevel@tonic-gate 	} else {
38257c478bd9Sstevel@tonic-gate 		kdevpath = kmem_alloc(kdevpathlen, KM_SLEEP);
38267c478bd9Sstevel@tonic-gate 
38277c478bd9Sstevel@tonic-gate 		if (copyinstr((caddr_t)uap->devpath, kdevpath, kdevpathlen,
38287c478bd9Sstevel@tonic-gate 			&size)) {
38297c478bd9Sstevel@tonic-gate 			kmem_free(kdevpath, kdevpathlen);
38307c478bd9Sstevel@tonic-gate 			return;
38317c478bd9Sstevel@tonic-gate 		}
38327c478bd9Sstevel@tonic-gate 
38337c478bd9Sstevel@tonic-gate 		if (size > MAXPATHLEN) {
38347c478bd9Sstevel@tonic-gate 			kmem_free(kdevpath, kdevpathlen);
38357c478bd9Sstevel@tonic-gate 			return;
38367c478bd9Sstevel@tonic-gate 		}
38377c478bd9Sstevel@tonic-gate 
38387c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_text(kdevpath));
38397c478bd9Sstevel@tonic-gate 		kmem_free(kdevpath, kdevpathlen);
38407c478bd9Sstevel@tonic-gate 	}
38417c478bd9Sstevel@tonic-gate }
38427c478bd9Sstevel@tonic-gate 
38437c478bd9Sstevel@tonic-gate /*
38447c478bd9Sstevel@tonic-gate  * only audit recvmsg when the system call represents the creation of a new
38457c478bd9Sstevel@tonic-gate  * circuit. This effectively occurs for all UDP packets and may occur for
38467c478bd9Sstevel@tonic-gate  * special TCP situations where the local host has not set a local address
38477c478bd9Sstevel@tonic-gate  * in the socket structure.
38487c478bd9Sstevel@tonic-gate  */
38497c478bd9Sstevel@tonic-gate /*ARGSUSED*/
38507c478bd9Sstevel@tonic-gate static void
38517c478bd9Sstevel@tonic-gate auf_recvmsg(
38527c478bd9Sstevel@tonic-gate 	struct t_audit_data *tad,
38537c478bd9Sstevel@tonic-gate 	int error,
38547c478bd9Sstevel@tonic-gate 	rval_t *rvp)
38557c478bd9Sstevel@tonic-gate {
38567c478bd9Sstevel@tonic-gate 	struct a {
38577c478bd9Sstevel@tonic-gate 		long	fd;
38587c478bd9Sstevel@tonic-gate 		long	msg;	/* struct msghdr */
38597c478bd9Sstevel@tonic-gate 		long	flags;
38607c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)ttolwp(curthread)->lwp_ap;
38617c478bd9Sstevel@tonic-gate 
38627c478bd9Sstevel@tonic-gate 	struct sonode	*so;
38637c478bd9Sstevel@tonic-gate 	STRUCT_DECL(msghdr, msg);
38647c478bd9Sstevel@tonic-gate 	caddr_t msg_name;
38657c478bd9Sstevel@tonic-gate 	socklen_t msg_namelen;
38667c478bd9Sstevel@tonic-gate 	int fd;
38677c478bd9Sstevel@tonic-gate 	int err;
38687c478bd9Sstevel@tonic-gate 	char so_laddr[sizeof (struct sockaddr_in6)];
38697c478bd9Sstevel@tonic-gate 	char so_faddr[sizeof (struct sockaddr_in6)];
38700f1702c5SYu Xiangning 	socklen_t len;
38717c478bd9Sstevel@tonic-gate 	file_t *fp;				/* unix domain sockets */
38727c478bd9Sstevel@tonic-gate 	struct f_audit_data *fad;		/* unix domain sockets */
38737c478bd9Sstevel@tonic-gate 	short so_family, so_type;
38747c478bd9Sstevel@tonic-gate 	int add_sock_token = 0;
38759e9e6ab8Spaulson 	au_kcontext_t	*kctx = GET_KCTX_PZ;
38767c478bd9Sstevel@tonic-gate 
38777c478bd9Sstevel@tonic-gate 	fd = (int)uap->fd;
38787c478bd9Sstevel@tonic-gate 
38797c478bd9Sstevel@tonic-gate 	/* bail if an error */
38807c478bd9Sstevel@tonic-gate 	if (error) {
38817c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
38827c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(3, "flags", (uint32_t)(uap->flags)));
38837c478bd9Sstevel@tonic-gate 		return;
38847c478bd9Sstevel@tonic-gate 	}
38857c478bd9Sstevel@tonic-gate 
3886745b2690Stz 	if ((so = getsonode(fd, &err, &fp)) == NULL) {
38877c478bd9Sstevel@tonic-gate 		/*
38887c478bd9Sstevel@tonic-gate 		 * not security relevant if doing a recvmsg from non socket
38897c478bd9Sstevel@tonic-gate 		 * so no extra tokens. Should probably turn off audit record
38907c478bd9Sstevel@tonic-gate 		 * generation here.
38917c478bd9Sstevel@tonic-gate 		 */
38927c478bd9Sstevel@tonic-gate 		return;
38937c478bd9Sstevel@tonic-gate 	}
38947c478bd9Sstevel@tonic-gate 
38957c478bd9Sstevel@tonic-gate 	so_family = so->so_family;
38967c478bd9Sstevel@tonic-gate 	so_type   = so->so_type;
38977c478bd9Sstevel@tonic-gate 
38987c478bd9Sstevel@tonic-gate 	/*
38997c478bd9Sstevel@tonic-gate 	 * only putout SOCKET_EX token if INET/INET6 family.
39007c478bd9Sstevel@tonic-gate 	 * XXX - what do we do about other families?
39017c478bd9Sstevel@tonic-gate 	 */
39027c478bd9Sstevel@tonic-gate 
39037c478bd9Sstevel@tonic-gate 	switch (so_family) {
39047c478bd9Sstevel@tonic-gate 	case AF_INET:
39057c478bd9Sstevel@tonic-gate 	case AF_INET6:
39067c478bd9Sstevel@tonic-gate 
39077c478bd9Sstevel@tonic-gate 		/*
39087c478bd9Sstevel@tonic-gate 		 * if datagram type socket, then just use what is in
39097c478bd9Sstevel@tonic-gate 		 * socket structure for local address.
39107c478bd9Sstevel@tonic-gate 		 * XXX - what do we do for other types?
39117c478bd9Sstevel@tonic-gate 		 */
39127c478bd9Sstevel@tonic-gate 		if ((so->so_type == SOCK_DGRAM) ||
39137c478bd9Sstevel@tonic-gate 		    (so->so_type == SOCK_RAW)) {
39147c478bd9Sstevel@tonic-gate 			add_sock_token = 1;
39157c478bd9Sstevel@tonic-gate 
39167c478bd9Sstevel@tonic-gate 			bzero((void *)so_laddr, sizeof (so_laddr));
39177c478bd9Sstevel@tonic-gate 			bzero((void *)so_faddr, sizeof (so_faddr));
39187c478bd9Sstevel@tonic-gate 
39197c478bd9Sstevel@tonic-gate 			/* get local address */
39200f1702c5SYu Xiangning 			len = sizeof (so_laddr);
39210f1702c5SYu Xiangning 			(void) socket_getsockname(so,
39220f1702c5SYu Xiangning 			    (struct sockaddr *)so_laddr, &len, CRED());
39237c478bd9Sstevel@tonic-gate 
39247c478bd9Sstevel@tonic-gate 			/* get peer address */
39257c478bd9Sstevel@tonic-gate 			STRUCT_INIT(msg, get_udatamodel());
39267c478bd9Sstevel@tonic-gate 
39277c478bd9Sstevel@tonic-gate 			if (copyin((caddr_t)(uap->msg),
39287c478bd9Sstevel@tonic-gate 			    (caddr_t)STRUCT_BUF(msg), STRUCT_SIZE(msg)) != 0) {
39297c478bd9Sstevel@tonic-gate 				break;
39307c478bd9Sstevel@tonic-gate 			}
39317c478bd9Sstevel@tonic-gate 			msg_name = (caddr_t)STRUCT_FGETP(msg, msg_name);
39327c478bd9Sstevel@tonic-gate 			if (msg_name == NULL) {
39337c478bd9Sstevel@tonic-gate 				break;
39347c478bd9Sstevel@tonic-gate 			}
39357c478bd9Sstevel@tonic-gate 
39367c478bd9Sstevel@tonic-gate 			/* length is value from recvmsg - sanity check */
39377c478bd9Sstevel@tonic-gate 			msg_namelen = (socklen_t)STRUCT_FGET(msg, msg_namelen);
39387c478bd9Sstevel@tonic-gate 			if (msg_namelen == 0) {
39397c478bd9Sstevel@tonic-gate 				break;
39407c478bd9Sstevel@tonic-gate 			}
39417c478bd9Sstevel@tonic-gate 			if (copyin(msg_name, so_faddr,
39427c478bd9Sstevel@tonic-gate 			    sizeof (so_faddr)) != 0) {
39437c478bd9Sstevel@tonic-gate 				break;
39447c478bd9Sstevel@tonic-gate 			}
39457c478bd9Sstevel@tonic-gate 
39467c478bd9Sstevel@tonic-gate 		} else if (so->so_type == SOCK_STREAM) {
39477c478bd9Sstevel@tonic-gate 
39487c478bd9Sstevel@tonic-gate 			/* get path from file struct here */
39497c478bd9Sstevel@tonic-gate 			fad = F2A(fp);
39507c478bd9Sstevel@tonic-gate 			ASSERT(fad);
39517c478bd9Sstevel@tonic-gate 
39527c478bd9Sstevel@tonic-gate 			/*
39537c478bd9Sstevel@tonic-gate 			 * already processed this file for read attempt
39547c478bd9Sstevel@tonic-gate 			 */
39557c478bd9Sstevel@tonic-gate 			if (fad->fad_flags & FAD_READ) {
39567c478bd9Sstevel@tonic-gate 				/* don't want to audit every recvmsg attempt */
39577c478bd9Sstevel@tonic-gate 				tad->tad_flag = 0;
39587c478bd9Sstevel@tonic-gate 				/* free any residual audit data */
39597c478bd9Sstevel@tonic-gate 				au_close(kctx, &(u_ad), 0, 0, 0);
39607c478bd9Sstevel@tonic-gate 				releasef(fd);
39617c478bd9Sstevel@tonic-gate 				return;
39627c478bd9Sstevel@tonic-gate 			}
39637c478bd9Sstevel@tonic-gate 			/*
39647c478bd9Sstevel@tonic-gate 			 * mark things so we know what happened and don't
39657c478bd9Sstevel@tonic-gate 			 * repeat things
39667c478bd9Sstevel@tonic-gate 			 */
39677c478bd9Sstevel@tonic-gate 			fad->fad_flags |= FAD_READ;
39687c478bd9Sstevel@tonic-gate 
39697c478bd9Sstevel@tonic-gate 			bzero((void *)so_laddr, sizeof (so_laddr));
39707c478bd9Sstevel@tonic-gate 			bzero((void *)so_faddr, sizeof (so_faddr));
39717c478bd9Sstevel@tonic-gate 
39720f1702c5SYu Xiangning 			/* get local and foreign addresses */
39730f1702c5SYu Xiangning 			len = sizeof (so_laddr);
39740f1702c5SYu Xiangning 			(void) socket_getsockname(so,
39750f1702c5SYu Xiangning 			    (struct sockaddr *)so_laddr, &len, CRED());
39760f1702c5SYu Xiangning 			len = sizeof (so_faddr);
39770f1702c5SYu Xiangning 			(void) socket_getpeername(so,
39780f1702c5SYu Xiangning 			    (struct sockaddr *)so_faddr, &len, B_FALSE, CRED());
39797c478bd9Sstevel@tonic-gate 
39807c478bd9Sstevel@tonic-gate 			add_sock_token = 1;
39817c478bd9Sstevel@tonic-gate 		}
39827c478bd9Sstevel@tonic-gate 
39837c478bd9Sstevel@tonic-gate 		/* XXX - what about SOCK_RDM/SOCK_SEQPACKET ??? */
39847c478bd9Sstevel@tonic-gate 
39857c478bd9Sstevel@tonic-gate 		break;
39867c478bd9Sstevel@tonic-gate 
39877c478bd9Sstevel@tonic-gate 	case AF_UNIX:
39887c478bd9Sstevel@tonic-gate 		/*
39897c478bd9Sstevel@tonic-gate 		 * first check if this is first time through. Too much
39907c478bd9Sstevel@tonic-gate 		 * duplicate code to put this in an aui_ routine.
39917c478bd9Sstevel@tonic-gate 		 */
39927c478bd9Sstevel@tonic-gate 
39937c478bd9Sstevel@tonic-gate 		/* get path from file struct here */
39947c478bd9Sstevel@tonic-gate 		fad = F2A(fp);
39957c478bd9Sstevel@tonic-gate 		ASSERT(fad);
39967c478bd9Sstevel@tonic-gate 
39977c478bd9Sstevel@tonic-gate 		/*
39987c478bd9Sstevel@tonic-gate 		 * already processed this file for read attempt
39997c478bd9Sstevel@tonic-gate 		 */
40007c478bd9Sstevel@tonic-gate 		if (fad->fad_flags & FAD_READ) {
40017c478bd9Sstevel@tonic-gate 			releasef(fd);
40027c478bd9Sstevel@tonic-gate 			/* don't want to audit every recvmsg attempt */
40037c478bd9Sstevel@tonic-gate 			tad->tad_flag = 0;
40047c478bd9Sstevel@tonic-gate 			/* free any residual audit data */
40057c478bd9Sstevel@tonic-gate 			au_close(kctx, &(u_ad), 0, 0, 0);
40067c478bd9Sstevel@tonic-gate 			return;
40077c478bd9Sstevel@tonic-gate 		}
40087c478bd9Sstevel@tonic-gate 		/*
40097c478bd9Sstevel@tonic-gate 		 * mark things so we know what happened and don't
40107c478bd9Sstevel@tonic-gate 		 * repeat things
40117c478bd9Sstevel@tonic-gate 		 */
40127c478bd9Sstevel@tonic-gate 		fad->fad_flags |= FAD_READ;
40137c478bd9Sstevel@tonic-gate 
40147c478bd9Sstevel@tonic-gate 		if (fad->fad_aupath != NULL) {
40157c478bd9Sstevel@tonic-gate 			au_uwrite(au_to_path(fad->fad_aupath));
40167c478bd9Sstevel@tonic-gate 		} else {
40177c478bd9Sstevel@tonic-gate 			au_uwrite(au_to_arg32(1, "no path: fd", fd));
40187c478bd9Sstevel@tonic-gate 		}
40197c478bd9Sstevel@tonic-gate 
40207c478bd9Sstevel@tonic-gate 		audit_attributes(fp->f_vnode);
40217c478bd9Sstevel@tonic-gate 
40227c478bd9Sstevel@tonic-gate 		releasef(fd);
40237c478bd9Sstevel@tonic-gate 
40247c478bd9Sstevel@tonic-gate 		return;
40257c478bd9Sstevel@tonic-gate 
40267c478bd9Sstevel@tonic-gate 	default:
40277c478bd9Sstevel@tonic-gate 		break;
40287c478bd9Sstevel@tonic-gate 
40297c478bd9Sstevel@tonic-gate 	}
40307c478bd9Sstevel@tonic-gate 
40317c478bd9Sstevel@tonic-gate 	releasef(fd);
40327c478bd9Sstevel@tonic-gate 
40337c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
40347c478bd9Sstevel@tonic-gate 
40357c478bd9Sstevel@tonic-gate 	if (add_sock_token == 0) {
40367c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "family", (uint32_t)so_family));
40377c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "type", (uint32_t)so_type));
40387c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(3, "flags", (uint32_t)(uap->flags)));
40397c478bd9Sstevel@tonic-gate 		return;
40407c478bd9Sstevel@tonic-gate 	}
40417c478bd9Sstevel@tonic-gate 
40427c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(3, "flags", (uint32_t)(uap->flags)));
40437c478bd9Sstevel@tonic-gate 
40447c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_socket_ex(so_family, so_type, so_laddr, so_faddr));
40457c478bd9Sstevel@tonic-gate 
40467c478bd9Sstevel@tonic-gate }
40477c478bd9Sstevel@tonic-gate 
40487c478bd9Sstevel@tonic-gate /*ARGSUSED*/
40497c478bd9Sstevel@tonic-gate static void
40507c478bd9Sstevel@tonic-gate auf_recvfrom(
40517c478bd9Sstevel@tonic-gate 	struct t_audit_data *tad,
40527c478bd9Sstevel@tonic-gate 	int error,
40537c478bd9Sstevel@tonic-gate 	rval_t *rvp)
40547c478bd9Sstevel@tonic-gate {
40557c478bd9Sstevel@tonic-gate 
40567c478bd9Sstevel@tonic-gate 	struct a {
40577c478bd9Sstevel@tonic-gate 		long	fd;
40587c478bd9Sstevel@tonic-gate 		long	msg;	/* char */
40597c478bd9Sstevel@tonic-gate 		long	len;
40607c478bd9Sstevel@tonic-gate 		long	flags;
40617c478bd9Sstevel@tonic-gate 		long	from;	/* struct sockaddr */
40627c478bd9Sstevel@tonic-gate 		long	fromlen;
40637c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)ttolwp(curthread)->lwp_ap;
40647c478bd9Sstevel@tonic-gate 
40657c478bd9Sstevel@tonic-gate 	socklen_t	fromlen;
40667c478bd9Sstevel@tonic-gate 	struct sonode	*so;
40677c478bd9Sstevel@tonic-gate 	char so_laddr[sizeof (struct sockaddr_in6)];
40687c478bd9Sstevel@tonic-gate 	char so_faddr[sizeof (struct sockaddr_in6)];
40697c478bd9Sstevel@tonic-gate 	int		fd;
40707c478bd9Sstevel@tonic-gate 	short so_family, so_type;
40717c478bd9Sstevel@tonic-gate 	int add_sock_token = 0;
40720f1702c5SYu Xiangning 	socklen_t len;
40737c478bd9Sstevel@tonic-gate 	int err;
40747c478bd9Sstevel@tonic-gate 	struct file *fp;
40757c478bd9Sstevel@tonic-gate 	struct f_audit_data *fad;		/* unix domain sockets */
40769e9e6ab8Spaulson 	au_kcontext_t	*kctx = GET_KCTX_PZ;
40777c478bd9Sstevel@tonic-gate 
40787c478bd9Sstevel@tonic-gate 	fd = (int)uap->fd;
40797c478bd9Sstevel@tonic-gate 
40807c478bd9Sstevel@tonic-gate 	/* bail if an error */
40817c478bd9Sstevel@tonic-gate 	if (error) {
40827c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
40837c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(3, "flags", (uint32_t)(uap->flags)));
40847c478bd9Sstevel@tonic-gate 		return;
40857c478bd9Sstevel@tonic-gate 	}
40867c478bd9Sstevel@tonic-gate 
4087745b2690Stz 	if ((so = getsonode(fd, &err, &fp)) == NULL) {
40887c478bd9Sstevel@tonic-gate 		/*
40897c478bd9Sstevel@tonic-gate 		 * not security relevant if doing a recvmsg from non socket
40907c478bd9Sstevel@tonic-gate 		 * so no extra tokens. Should probably turn off audit record
40917c478bd9Sstevel@tonic-gate 		 * generation here.
40927c478bd9Sstevel@tonic-gate 		 */
40937c478bd9Sstevel@tonic-gate 		return;
40947c478bd9Sstevel@tonic-gate 	}
40957c478bd9Sstevel@tonic-gate 
40967c478bd9Sstevel@tonic-gate 	so_family = so->so_family;
40977c478bd9Sstevel@tonic-gate 	so_type   = so->so_type;
40987c478bd9Sstevel@tonic-gate 
40997c478bd9Sstevel@tonic-gate 	/*
41007c478bd9Sstevel@tonic-gate 	 * only putout SOCKET_EX token if INET/INET6 family.
41017c478bd9Sstevel@tonic-gate 	 * XXX - what do we do about other families?
41027c478bd9Sstevel@tonic-gate 	 */
41037c478bd9Sstevel@tonic-gate 
41047c478bd9Sstevel@tonic-gate 	switch (so_family) {
41057c478bd9Sstevel@tonic-gate 	case AF_INET:
41067c478bd9Sstevel@tonic-gate 	case AF_INET6:
41077c478bd9Sstevel@tonic-gate 
41087c478bd9Sstevel@tonic-gate 		/*
41097c478bd9Sstevel@tonic-gate 		 * if datagram type socket, then just use what is in
41107c478bd9Sstevel@tonic-gate 		 * socket structure for local address.
41117c478bd9Sstevel@tonic-gate 		 * XXX - what do we do for other types?
41127c478bd9Sstevel@tonic-gate 		 */
41137c478bd9Sstevel@tonic-gate 		if ((so->so_type == SOCK_DGRAM) ||
41147c478bd9Sstevel@tonic-gate 		    (so->so_type == SOCK_RAW)) {
41157c478bd9Sstevel@tonic-gate 			add_sock_token = 1;
41167c478bd9Sstevel@tonic-gate 
41177c478bd9Sstevel@tonic-gate 			/* get local address */
41180f1702c5SYu Xiangning 			len = sizeof (so_laddr);
41190f1702c5SYu Xiangning 			(void) socket_getsockname(so,
41200f1702c5SYu Xiangning 			    (struct sockaddr *)so_laddr, &len, CRED());
41217c478bd9Sstevel@tonic-gate 
41227c478bd9Sstevel@tonic-gate 			/* get peer address */
41237c478bd9Sstevel@tonic-gate 			bzero((void *)so_faddr, sizeof (so_faddr));
41247c478bd9Sstevel@tonic-gate 
41257c478bd9Sstevel@tonic-gate 			/* sanity check */
41267c478bd9Sstevel@tonic-gate 			if (uap->from == NULL)
41277c478bd9Sstevel@tonic-gate 				break;
41287c478bd9Sstevel@tonic-gate 
41297c478bd9Sstevel@tonic-gate 			/* sanity checks */
41307c478bd9Sstevel@tonic-gate 			if (uap->fromlen == 0)
41317c478bd9Sstevel@tonic-gate 				break;
41327c478bd9Sstevel@tonic-gate 
41337c478bd9Sstevel@tonic-gate 			if (copyin((caddr_t)(uap->fromlen), (caddr_t)&fromlen,
41347c478bd9Sstevel@tonic-gate 			    sizeof (fromlen)) != 0)
41357c478bd9Sstevel@tonic-gate 				break;
41367c478bd9Sstevel@tonic-gate 
41377c478bd9Sstevel@tonic-gate 			if (fromlen == 0)
41387c478bd9Sstevel@tonic-gate 				break;
41397c478bd9Sstevel@tonic-gate 
41407c478bd9Sstevel@tonic-gate 			/* enforce maximum size */
41417c478bd9Sstevel@tonic-gate 			if (fromlen > sizeof (so_faddr))
41427c478bd9Sstevel@tonic-gate 				fromlen = sizeof (so_faddr);
41437c478bd9Sstevel@tonic-gate 
41447c478bd9Sstevel@tonic-gate 			if (copyin((caddr_t)(uap->from), so_faddr,
41457c478bd9Sstevel@tonic-gate 			    fromlen) != 0)
41467c478bd9Sstevel@tonic-gate 				break;
41477c478bd9Sstevel@tonic-gate 
41487c478bd9Sstevel@tonic-gate 		} else if (so->so_type == SOCK_STREAM) {
41497c478bd9Sstevel@tonic-gate 
41507c478bd9Sstevel@tonic-gate 			/* get path from file struct here */
41517c478bd9Sstevel@tonic-gate 			fad = F2A(fp);
41527c478bd9Sstevel@tonic-gate 			ASSERT(fad);
41537c478bd9Sstevel@tonic-gate 
41547c478bd9Sstevel@tonic-gate 			/*
41557c478bd9Sstevel@tonic-gate 			 * already processed this file for read attempt
41567c478bd9Sstevel@tonic-gate 			 */
41577c478bd9Sstevel@tonic-gate 			if (fad->fad_flags & FAD_READ) {
41587c478bd9Sstevel@tonic-gate 				/* don't want to audit every recvfrom attempt */
41597c478bd9Sstevel@tonic-gate 				tad->tad_flag = 0;
41607c478bd9Sstevel@tonic-gate 				/* free any residual audit data */
41617c478bd9Sstevel@tonic-gate 				au_close(kctx, &(u_ad), 0, 0, 0);
41627c478bd9Sstevel@tonic-gate 				releasef(fd);
41637c478bd9Sstevel@tonic-gate 				return;
41647c478bd9Sstevel@tonic-gate 			}
41657c478bd9Sstevel@tonic-gate 			/*
41667c478bd9Sstevel@tonic-gate 			 * mark things so we know what happened and don't
41677c478bd9Sstevel@tonic-gate 			 * repeat things
41687c478bd9Sstevel@tonic-gate 			 */
41697c478bd9Sstevel@tonic-gate 			fad->fad_flags |= FAD_READ;
41707c478bd9Sstevel@tonic-gate 
41717c478bd9Sstevel@tonic-gate 			bzero((void *)so_laddr, sizeof (so_laddr));
41727c478bd9Sstevel@tonic-gate 			bzero((void *)so_faddr, sizeof (so_faddr));
41737c478bd9Sstevel@tonic-gate 
41740f1702c5SYu Xiangning 			/* get local and foreign addresses */
41750f1702c5SYu Xiangning 			len = sizeof (so_laddr);
41760f1702c5SYu Xiangning 			(void) socket_getsockname(so,
41770f1702c5SYu Xiangning 			    (struct sockaddr *)so_laddr, &len, CRED());
41780f1702c5SYu Xiangning 			len = sizeof (so_faddr);
41790f1702c5SYu Xiangning 			(void) socket_getpeername(so,
41800f1702c5SYu Xiangning 			    (struct sockaddr *)so_faddr, &len, B_FALSE, CRED());
41817c478bd9Sstevel@tonic-gate 
41827c478bd9Sstevel@tonic-gate 			add_sock_token = 1;
41837c478bd9Sstevel@tonic-gate 		}
41847c478bd9Sstevel@tonic-gate 
41857c478bd9Sstevel@tonic-gate 		/* XXX - what about SOCK_RDM/SOCK_SEQPACKET ??? */
41867c478bd9Sstevel@tonic-gate 
41877c478bd9Sstevel@tonic-gate 		break;
41887c478bd9Sstevel@tonic-gate 
41897c478bd9Sstevel@tonic-gate 	case AF_UNIX:
41907c478bd9Sstevel@tonic-gate 		/*
41917c478bd9Sstevel@tonic-gate 		 * first check if this is first time through. Too much
41927c478bd9Sstevel@tonic-gate 		 * duplicate code to put this in an aui_ routine.
41937c478bd9Sstevel@tonic-gate 		 */
41947c478bd9Sstevel@tonic-gate 
41957c478bd9Sstevel@tonic-gate 		/* get path from file struct here */
41967c478bd9Sstevel@tonic-gate 		fad = F2A(fp);
41977c478bd9Sstevel@tonic-gate 		ASSERT(fad);
41987c478bd9Sstevel@tonic-gate 
41997c478bd9Sstevel@tonic-gate 		/*
42007c478bd9Sstevel@tonic-gate 		 * already processed this file for read attempt
42017c478bd9Sstevel@tonic-gate 		 */
42027c478bd9Sstevel@tonic-gate 		if (fad->fad_flags & FAD_READ) {
42037c478bd9Sstevel@tonic-gate 			/* don't want to audit every recvfrom attempt */
42047c478bd9Sstevel@tonic-gate 			tad->tad_flag = 0;
42057c478bd9Sstevel@tonic-gate 			/* free any residual audit data */
42067c478bd9Sstevel@tonic-gate 			au_close(kctx, &(u_ad), 0, 0, 0);
42077c478bd9Sstevel@tonic-gate 			releasef(fd);
42087c478bd9Sstevel@tonic-gate 			return;
42097c478bd9Sstevel@tonic-gate 		}
42107c478bd9Sstevel@tonic-gate 		/*
42117c478bd9Sstevel@tonic-gate 		 * mark things so we know what happened and don't
42127c478bd9Sstevel@tonic-gate 		 * repeat things
42137c478bd9Sstevel@tonic-gate 		 */
42147c478bd9Sstevel@tonic-gate 		fad->fad_flags |= FAD_READ;
42157c478bd9Sstevel@tonic-gate 
42167c478bd9Sstevel@tonic-gate 		if (fad->fad_aupath != NULL) {
42177c478bd9Sstevel@tonic-gate 			au_uwrite(au_to_path(fad->fad_aupath));
42187c478bd9Sstevel@tonic-gate 		} else {
42197c478bd9Sstevel@tonic-gate 			au_uwrite(au_to_arg32(1, "no path: fd", fd));
42207c478bd9Sstevel@tonic-gate 		}
42217c478bd9Sstevel@tonic-gate 
42227c478bd9Sstevel@tonic-gate 		audit_attributes(fp->f_vnode);
42237c478bd9Sstevel@tonic-gate 
42247c478bd9Sstevel@tonic-gate 		releasef(fd);
42257c478bd9Sstevel@tonic-gate 
42267c478bd9Sstevel@tonic-gate 		return;
42277c478bd9Sstevel@tonic-gate 
42287c478bd9Sstevel@tonic-gate 	default:
42297c478bd9Sstevel@tonic-gate 		break;
42307c478bd9Sstevel@tonic-gate 
42317c478bd9Sstevel@tonic-gate 	}
42327c478bd9Sstevel@tonic-gate 
42337c478bd9Sstevel@tonic-gate 	releasef(fd);
42347c478bd9Sstevel@tonic-gate 
42357c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
42367c478bd9Sstevel@tonic-gate 
42377c478bd9Sstevel@tonic-gate 	if (add_sock_token == 0) {
42387c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "family", (uint32_t)so_family));
42397c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "type", (uint32_t)so_type));
42407c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(3, "flags", (uint32_t)(uap->flags)));
42417c478bd9Sstevel@tonic-gate 		return;
42427c478bd9Sstevel@tonic-gate 	}
42437c478bd9Sstevel@tonic-gate 
42447c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(3, "flags", (uint32_t)(uap->flags)));
42457c478bd9Sstevel@tonic-gate 
42467c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_socket_ex(so_family, so_type, so_laddr, so_faddr));
42477c478bd9Sstevel@tonic-gate }
42487c478bd9Sstevel@tonic-gate 
42497c478bd9Sstevel@tonic-gate /*ARGSUSED*/
42507c478bd9Sstevel@tonic-gate static void
42517c478bd9Sstevel@tonic-gate auf_sendmsg(struct t_audit_data *tad, int error, rval_t *rval)
42527c478bd9Sstevel@tonic-gate {
42537c478bd9Sstevel@tonic-gate 	struct a {
42547c478bd9Sstevel@tonic-gate 		long	fd;
42557c478bd9Sstevel@tonic-gate 		long	msg;	/* struct msghdr */
42567c478bd9Sstevel@tonic-gate 		long	flags;
42577c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)ttolwp(curthread)->lwp_ap;
42587c478bd9Sstevel@tonic-gate 
42597c478bd9Sstevel@tonic-gate 	struct sonode	*so;
42607c478bd9Sstevel@tonic-gate 	char so_laddr[sizeof (struct sockaddr_in6)];
42617c478bd9Sstevel@tonic-gate 	char so_faddr[sizeof (struct sockaddr_in6)];
42627c478bd9Sstevel@tonic-gate 	int		err;
42637c478bd9Sstevel@tonic-gate 	int		fd;
42647c478bd9Sstevel@tonic-gate 	short so_family, so_type;
42657c478bd9Sstevel@tonic-gate 	int		add_sock_token = 0;
42660f1702c5SYu Xiangning 	socklen_t	len;
42677c478bd9Sstevel@tonic-gate 	struct file	*fp;
42687c478bd9Sstevel@tonic-gate 	struct f_audit_data *fad;
42697c478bd9Sstevel@tonic-gate 	caddr_t		msg_name;
42707c478bd9Sstevel@tonic-gate 	socklen_t	msg_namelen;
42717c478bd9Sstevel@tonic-gate 	STRUCT_DECL(msghdr, msg);
42729e9e6ab8Spaulson 	au_kcontext_t	*kctx = GET_KCTX_PZ;
42737c478bd9Sstevel@tonic-gate 
42747c478bd9Sstevel@tonic-gate 	fd = (int)uap->fd;
42757c478bd9Sstevel@tonic-gate 
42767c478bd9Sstevel@tonic-gate 	/* bail if an error */
42777c478bd9Sstevel@tonic-gate 	if (error) {
42787c478bd9Sstevel@tonic-gate 		/* XXX include destination address from system call arguments */
42797c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
42807c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(3, "flags", (uint32_t)(uap->flags)));
42817c478bd9Sstevel@tonic-gate 		return;
42827c478bd9Sstevel@tonic-gate 	}
42837c478bd9Sstevel@tonic-gate 
4284745b2690Stz 	if ((so = getsonode(fd, &err, &fp)) == NULL) {
42857c478bd9Sstevel@tonic-gate 		/*
42867c478bd9Sstevel@tonic-gate 		 * not security relevant if doing a sendmsg from non socket
42877c478bd9Sstevel@tonic-gate 		 * so no extra tokens. Should probably turn off audit record
42887c478bd9Sstevel@tonic-gate 		 * generation here.
42897c478bd9Sstevel@tonic-gate 		 */
42907c478bd9Sstevel@tonic-gate 		return;
42917c478bd9Sstevel@tonic-gate 	}
42927c478bd9Sstevel@tonic-gate 
42937c478bd9Sstevel@tonic-gate 	so_family = so->so_family;
42947c478bd9Sstevel@tonic-gate 	so_type   = so->so_type;
42957c478bd9Sstevel@tonic-gate 
42967c478bd9Sstevel@tonic-gate 	switch (so_family) {
42977c478bd9Sstevel@tonic-gate 	case AF_INET:
42987c478bd9Sstevel@tonic-gate 	case AF_INET6:
42997c478bd9Sstevel@tonic-gate 		/*
43007c478bd9Sstevel@tonic-gate 		 * if datagram type socket, then just use what is in
43017c478bd9Sstevel@tonic-gate 		 * socket structure for local address.
43027c478bd9Sstevel@tonic-gate 		 * XXX - what do we do for other types?
43037c478bd9Sstevel@tonic-gate 		 */
43047c478bd9Sstevel@tonic-gate 		if ((so->so_type == SOCK_DGRAM) ||
43057c478bd9Sstevel@tonic-gate 		    (so->so_type == SOCK_RAW)) {
43067c478bd9Sstevel@tonic-gate 
43077c478bd9Sstevel@tonic-gate 			bzero((void *)so_laddr, sizeof (so_laddr));
43087c478bd9Sstevel@tonic-gate 			bzero((void *)so_faddr, sizeof (so_faddr));
43097c478bd9Sstevel@tonic-gate 
43107c478bd9Sstevel@tonic-gate 			/* get local address */
43110f1702c5SYu Xiangning 			len = sizeof (so_laddr);
43120f1702c5SYu Xiangning 			(void) socket_getsockname(so,
43130f1702c5SYu Xiangning 			    (struct sockaddr *)so_laddr, &len, CRED());
43147c478bd9Sstevel@tonic-gate 
43157c478bd9Sstevel@tonic-gate 			/* get peer address */
43167c478bd9Sstevel@tonic-gate 			STRUCT_INIT(msg, get_udatamodel());
43177c478bd9Sstevel@tonic-gate 
43187c478bd9Sstevel@tonic-gate 			if (copyin((caddr_t)(uap->msg),
43197c478bd9Sstevel@tonic-gate 			    (caddr_t)STRUCT_BUF(msg), STRUCT_SIZE(msg)) != 0) {
43207c478bd9Sstevel@tonic-gate 				break;
43217c478bd9Sstevel@tonic-gate 			}
43227c478bd9Sstevel@tonic-gate 			msg_name = (caddr_t)STRUCT_FGETP(msg, msg_name);
43237c478bd9Sstevel@tonic-gate 			if (msg_name == NULL)
43247c478bd9Sstevel@tonic-gate 				break;
43257c478bd9Sstevel@tonic-gate 
43267c478bd9Sstevel@tonic-gate 			msg_namelen = (socklen_t)STRUCT_FGET(msg, msg_namelen);
43277c478bd9Sstevel@tonic-gate 			/* length is value from recvmsg - sanity check */
43287c478bd9Sstevel@tonic-gate 			if (msg_namelen == 0)
43297c478bd9Sstevel@tonic-gate 				break;
43307c478bd9Sstevel@tonic-gate 
43317c478bd9Sstevel@tonic-gate 			if (copyin(msg_name, so_faddr,
43327c478bd9Sstevel@tonic-gate 			    sizeof (so_faddr)) != 0)
43337c478bd9Sstevel@tonic-gate 				break;
43347c478bd9Sstevel@tonic-gate 
43357c478bd9Sstevel@tonic-gate 			add_sock_token = 1;
43367c478bd9Sstevel@tonic-gate 
43377c478bd9Sstevel@tonic-gate 		} else if (so->so_type == SOCK_STREAM) {
43387c478bd9Sstevel@tonic-gate 
43397c478bd9Sstevel@tonic-gate 			/* get path from file struct here */
43407c478bd9Sstevel@tonic-gate 			fad = F2A(fp);
43417c478bd9Sstevel@tonic-gate 			ASSERT(fad);
43427c478bd9Sstevel@tonic-gate 
43437c478bd9Sstevel@tonic-gate 			/*
43447c478bd9Sstevel@tonic-gate 			 * already processed this file for write attempt
43457c478bd9Sstevel@tonic-gate 			 */
43467c478bd9Sstevel@tonic-gate 			if (fad->fad_flags & FAD_WRITE) {
43477c478bd9Sstevel@tonic-gate 				releasef(fd);
43487c478bd9Sstevel@tonic-gate 				/* don't want to audit every sendmsg attempt */
43497c478bd9Sstevel@tonic-gate 				tad->tad_flag = 0;
43507c478bd9Sstevel@tonic-gate 				/* free any residual audit data */
43517c478bd9Sstevel@tonic-gate 				au_close(kctx, &(u_ad), 0, 0, 0);
43527c478bd9Sstevel@tonic-gate 				return;
43537c478bd9Sstevel@tonic-gate 			}
43547c478bd9Sstevel@tonic-gate 
43557c478bd9Sstevel@tonic-gate 			/*
43567c478bd9Sstevel@tonic-gate 			 * mark things so we know what happened and don't
43577c478bd9Sstevel@tonic-gate 			 * repeat things
43587c478bd9Sstevel@tonic-gate 			 */
43597c478bd9Sstevel@tonic-gate 			fad->fad_flags |= FAD_WRITE;
43607c478bd9Sstevel@tonic-gate 
43617c478bd9Sstevel@tonic-gate 			bzero((void *)so_laddr, sizeof (so_laddr));
43627c478bd9Sstevel@tonic-gate 			bzero((void *)so_faddr, sizeof (so_faddr));
43637c478bd9Sstevel@tonic-gate 
43640f1702c5SYu Xiangning 			/* get local and foreign addresses */
43650f1702c5SYu Xiangning 			len = sizeof (so_laddr);
43660f1702c5SYu Xiangning 			(void) socket_getsockname(so,
43670f1702c5SYu Xiangning 			    (struct sockaddr *)so_laddr, &len, CRED());
43680f1702c5SYu Xiangning 			len = sizeof (so_faddr);
43690f1702c5SYu Xiangning 			(void) socket_getpeername(so,
43700f1702c5SYu Xiangning 			    (struct sockaddr *)so_faddr, &len, B_FALSE, CRED());
43717c478bd9Sstevel@tonic-gate 
43727c478bd9Sstevel@tonic-gate 			add_sock_token = 1;
43737c478bd9Sstevel@tonic-gate 		}
43747c478bd9Sstevel@tonic-gate 
43757c478bd9Sstevel@tonic-gate 		/* XXX - what about SOCK_RAW/SOCK_RDM/SOCK_SEQPACKET ??? */
43767c478bd9Sstevel@tonic-gate 
43777c478bd9Sstevel@tonic-gate 		break;
43787c478bd9Sstevel@tonic-gate 
43797c478bd9Sstevel@tonic-gate 	case AF_UNIX:
43807c478bd9Sstevel@tonic-gate 		/*
43817c478bd9Sstevel@tonic-gate 		 * first check if this is first time through. Too much
43827c478bd9Sstevel@tonic-gate 		 * duplicate code to put this in an aui_ routine.
43837c478bd9Sstevel@tonic-gate 		 */
43847c478bd9Sstevel@tonic-gate 
43857c478bd9Sstevel@tonic-gate 		/* get path from file struct here */
43867c478bd9Sstevel@tonic-gate 		fad = F2A(fp);
43877c478bd9Sstevel@tonic-gate 		ASSERT(fad);
43887c478bd9Sstevel@tonic-gate 
43897c478bd9Sstevel@tonic-gate 		/*
43907c478bd9Sstevel@tonic-gate 		 * already processed this file for write attempt
43917c478bd9Sstevel@tonic-gate 		 */
43927c478bd9Sstevel@tonic-gate 		if (fad->fad_flags & FAD_WRITE) {
43937c478bd9Sstevel@tonic-gate 			releasef(fd);
43947c478bd9Sstevel@tonic-gate 			/* don't want to audit every sendmsg attempt */
43957c478bd9Sstevel@tonic-gate 			tad->tad_flag = 0;
43967c478bd9Sstevel@tonic-gate 			/* free any residual audit data */
43977c478bd9Sstevel@tonic-gate 			au_close(kctx, &(u_ad), 0, 0, 0);
43987c478bd9Sstevel@tonic-gate 			return;
43997c478bd9Sstevel@tonic-gate 		}
44007c478bd9Sstevel@tonic-gate 		/*
44017c478bd9Sstevel@tonic-gate 		 * mark things so we know what happened and don't
44027c478bd9Sstevel@tonic-gate 		 * repeat things
44037c478bd9Sstevel@tonic-gate 		 */
44047c478bd9Sstevel@tonic-gate 		fad->fad_flags |= FAD_WRITE;
44057c478bd9Sstevel@tonic-gate 
44067c478bd9Sstevel@tonic-gate 		if (fad->fad_aupath != NULL) {
44077c478bd9Sstevel@tonic-gate 			au_uwrite(au_to_path(fad->fad_aupath));
44087c478bd9Sstevel@tonic-gate 		} else {
44097c478bd9Sstevel@tonic-gate 			au_uwrite(au_to_arg32(1, "no path: fd", fd));
44107c478bd9Sstevel@tonic-gate 		}
44117c478bd9Sstevel@tonic-gate 
44127c478bd9Sstevel@tonic-gate 		audit_attributes(fp->f_vnode);
44137c478bd9Sstevel@tonic-gate 
44147c478bd9Sstevel@tonic-gate 		releasef(fd);
44157c478bd9Sstevel@tonic-gate 
44167c478bd9Sstevel@tonic-gate 		return;
44177c478bd9Sstevel@tonic-gate 
44187c478bd9Sstevel@tonic-gate 	default:
44197c478bd9Sstevel@tonic-gate 		break;
44207c478bd9Sstevel@tonic-gate 	}
44217c478bd9Sstevel@tonic-gate 
44227c478bd9Sstevel@tonic-gate 	releasef(fd);
44237c478bd9Sstevel@tonic-gate 
44247c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
44257c478bd9Sstevel@tonic-gate 
44267c478bd9Sstevel@tonic-gate 	if (add_sock_token == 0) {
44277c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "family", (uint32_t)so_family));
44287c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "type", (uint32_t)so_type));
44297c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(3, "flags", (uint32_t)(uap->flags)));
44307c478bd9Sstevel@tonic-gate 		return;
44317c478bd9Sstevel@tonic-gate 	}
44327c478bd9Sstevel@tonic-gate 
44337c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(3, "flags", (uint32_t)(uap->flags)));
44347c478bd9Sstevel@tonic-gate 
44357c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_socket_ex(so_family, so_type, so_laddr, so_faddr));
44367c478bd9Sstevel@tonic-gate }
44377c478bd9Sstevel@tonic-gate 
44387c478bd9Sstevel@tonic-gate /*ARGSUSED*/
44397c478bd9Sstevel@tonic-gate static void
44407c478bd9Sstevel@tonic-gate auf_sendto(struct t_audit_data *tad, int error, rval_t *rval)
44417c478bd9Sstevel@tonic-gate {
44427c478bd9Sstevel@tonic-gate 	struct a {
44437c478bd9Sstevel@tonic-gate 		long	fd;
44447c478bd9Sstevel@tonic-gate 		long	msg;	/* char */
44457c478bd9Sstevel@tonic-gate 		long	len;
44467c478bd9Sstevel@tonic-gate 		long	flags;
44477c478bd9Sstevel@tonic-gate 		long	to;	/* struct sockaddr */
44487c478bd9Sstevel@tonic-gate 		long	tolen;
44497c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)ttolwp(curthread)->lwp_ap;
44507c478bd9Sstevel@tonic-gate 
44517c478bd9Sstevel@tonic-gate 	struct sonode	*so;
44527c478bd9Sstevel@tonic-gate 	char so_laddr[sizeof (struct sockaddr_in6)];
44537c478bd9Sstevel@tonic-gate 	char so_faddr[sizeof (struct sockaddr_in6)];
44547c478bd9Sstevel@tonic-gate 	socklen_t	tolen;
44557c478bd9Sstevel@tonic-gate 	int		err;
44567c478bd9Sstevel@tonic-gate 	int		fd;
44570f1702c5SYu Xiangning 	socklen_t	len;
44587c478bd9Sstevel@tonic-gate 	short so_family, so_type;
44597c478bd9Sstevel@tonic-gate 	int		add_sock_token = 0;
44607c478bd9Sstevel@tonic-gate 	struct file	*fp;
44617c478bd9Sstevel@tonic-gate 	struct f_audit_data *fad;
44629e9e6ab8Spaulson 	au_kcontext_t	*kctx = GET_KCTX_PZ;
44637c478bd9Sstevel@tonic-gate 
44647c478bd9Sstevel@tonic-gate 	fd = (int)uap->fd;
44657c478bd9Sstevel@tonic-gate 
44667c478bd9Sstevel@tonic-gate 	/* bail if an error */
44677c478bd9Sstevel@tonic-gate 	if (error) {
44687c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
44697c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(3, "flags", (uint32_t)(uap->flags)));
44707c478bd9Sstevel@tonic-gate 		/* XXX include destination address from system call arguments */
44717c478bd9Sstevel@tonic-gate 		return;
44727c478bd9Sstevel@tonic-gate 	}
44737c478bd9Sstevel@tonic-gate 
4474745b2690Stz 	if ((so = getsonode(fd, &err, &fp)) == NULL) {
44757c478bd9Sstevel@tonic-gate 		/*
44767c478bd9Sstevel@tonic-gate 		 * not security relevant if doing a sendto using non socket
44777c478bd9Sstevel@tonic-gate 		 * so no extra tokens. Should probably turn off audit record
44787c478bd9Sstevel@tonic-gate 		 * generation here.
44797c478bd9Sstevel@tonic-gate 		 */
44807c478bd9Sstevel@tonic-gate 		return;
44817c478bd9Sstevel@tonic-gate 	}
44827c478bd9Sstevel@tonic-gate 
44837c478bd9Sstevel@tonic-gate 	so_family = so->so_family;
44847c478bd9Sstevel@tonic-gate 	so_type   = so->so_type;
44857c478bd9Sstevel@tonic-gate 
44867c478bd9Sstevel@tonic-gate 	/*
44877c478bd9Sstevel@tonic-gate 	 * only putout SOCKET_EX token if INET/INET6 family.
44887c478bd9Sstevel@tonic-gate 	 * XXX - what do we do about other families?
44897c478bd9Sstevel@tonic-gate 	 */
44907c478bd9Sstevel@tonic-gate 
44917c478bd9Sstevel@tonic-gate 	switch (so_family) {
44927c478bd9Sstevel@tonic-gate 	case AF_INET:
44937c478bd9Sstevel@tonic-gate 	case AF_INET6:
44947c478bd9Sstevel@tonic-gate 
44957c478bd9Sstevel@tonic-gate 		/*
44967c478bd9Sstevel@tonic-gate 		 * if datagram type socket, then just use what is in
44977c478bd9Sstevel@tonic-gate 		 * socket structure for local address.
44987c478bd9Sstevel@tonic-gate 		 * XXX - what do we do for other types?
44997c478bd9Sstevel@tonic-gate 		 */
45007c478bd9Sstevel@tonic-gate 		if ((so->so_type == SOCK_DGRAM) ||
45017c478bd9Sstevel@tonic-gate 		    (so->so_type == SOCK_RAW)) {
45027c478bd9Sstevel@tonic-gate 
45037c478bd9Sstevel@tonic-gate 			bzero((void *)so_laddr, sizeof (so_laddr));
45047c478bd9Sstevel@tonic-gate 			bzero((void *)so_faddr, sizeof (so_faddr));
45057c478bd9Sstevel@tonic-gate 
45067c478bd9Sstevel@tonic-gate 			/* get local address */
45070f1702c5SYu Xiangning 			len = sizeof (so_laddr);
45080f1702c5SYu Xiangning 			(void) socket_getsockname(so,
45090f1702c5SYu Xiangning 			    (struct sockaddr *)so_laddr, &len, CRED());
45107c478bd9Sstevel@tonic-gate 
45117c478bd9Sstevel@tonic-gate 			/* get peer address */
45127c478bd9Sstevel@tonic-gate 
45137c478bd9Sstevel@tonic-gate 			/* sanity check */
45147c478bd9Sstevel@tonic-gate 			if (uap->to == NULL)
45157c478bd9Sstevel@tonic-gate 				break;
45167c478bd9Sstevel@tonic-gate 
45177c478bd9Sstevel@tonic-gate 			/* sanity checks */
45187c478bd9Sstevel@tonic-gate 			if (uap->tolen == 0)
45197c478bd9Sstevel@tonic-gate 				break;
45207c478bd9Sstevel@tonic-gate 
45217c478bd9Sstevel@tonic-gate 			tolen = (socklen_t)uap->tolen;
45227c478bd9Sstevel@tonic-gate 
45237c478bd9Sstevel@tonic-gate 			/* enforce maximum size */
45247c478bd9Sstevel@tonic-gate 			if (tolen > sizeof (so_faddr))
45257c478bd9Sstevel@tonic-gate 				tolen = sizeof (so_faddr);
45267c478bd9Sstevel@tonic-gate 
45277c478bd9Sstevel@tonic-gate 			if (copyin((caddr_t)(uap->to), so_faddr, tolen) != 0)
45287c478bd9Sstevel@tonic-gate 				break;
45297c478bd9Sstevel@tonic-gate 
45307c478bd9Sstevel@tonic-gate 			add_sock_token = 1;
45317c478bd9Sstevel@tonic-gate 		} else {
45327c478bd9Sstevel@tonic-gate 			/*
45337c478bd9Sstevel@tonic-gate 			 * check if this is first time through.
45347c478bd9Sstevel@tonic-gate 			 */
45357c478bd9Sstevel@tonic-gate 
45367c478bd9Sstevel@tonic-gate 			/* get path from file struct here */
45377c478bd9Sstevel@tonic-gate 			fad = F2A(fp);
45387c478bd9Sstevel@tonic-gate 			ASSERT(fad);
45397c478bd9Sstevel@tonic-gate 
45407c478bd9Sstevel@tonic-gate 			/*
45417c478bd9Sstevel@tonic-gate 			 * already processed this file for write attempt
45427c478bd9Sstevel@tonic-gate 			 */
45437c478bd9Sstevel@tonic-gate 			if (fad->fad_flags & FAD_WRITE) {
45447c478bd9Sstevel@tonic-gate 				/* don't want to audit every sendto attempt */
45457c478bd9Sstevel@tonic-gate 				tad->tad_flag = 0;
45467c478bd9Sstevel@tonic-gate 				/* free any residual audit data */
45477c478bd9Sstevel@tonic-gate 				au_close(kctx, &(u_ad), 0, 0, 0);
45487c478bd9Sstevel@tonic-gate 				releasef(fd);
45497c478bd9Sstevel@tonic-gate 				return;
45507c478bd9Sstevel@tonic-gate 			}
45517c478bd9Sstevel@tonic-gate 			/*
45527c478bd9Sstevel@tonic-gate 			 * mark things so we know what happened and don't
45537c478bd9Sstevel@tonic-gate 			 * repeat things
45547c478bd9Sstevel@tonic-gate 			 */
45557c478bd9Sstevel@tonic-gate 			fad->fad_flags |= FAD_WRITE;
45567c478bd9Sstevel@tonic-gate 
45577c478bd9Sstevel@tonic-gate 			bzero((void *)so_laddr, sizeof (so_laddr));
45587c478bd9Sstevel@tonic-gate 			bzero((void *)so_faddr, sizeof (so_faddr));
45597c478bd9Sstevel@tonic-gate 
45600f1702c5SYu Xiangning 			/* get local and foreign addresses */
45610f1702c5SYu Xiangning 			len = sizeof (so_laddr);
45620f1702c5SYu Xiangning 			(void) socket_getsockname(so,
45630f1702c5SYu Xiangning 			    (struct sockaddr *)so_laddr, &len, CRED());
45640f1702c5SYu Xiangning 			len = sizeof (so_faddr);
45650f1702c5SYu Xiangning 			(void) socket_getpeername(so,
45660f1702c5SYu Xiangning 			    (struct sockaddr *)so_faddr, &len, B_FALSE, CRED());
45677c478bd9Sstevel@tonic-gate 
45687c478bd9Sstevel@tonic-gate 			add_sock_token = 1;
45697c478bd9Sstevel@tonic-gate 		}
45707c478bd9Sstevel@tonic-gate 
45717c478bd9Sstevel@tonic-gate 		/* XXX - what about SOCK_RDM/SOCK_SEQPACKET ??? */
45727c478bd9Sstevel@tonic-gate 
45737c478bd9Sstevel@tonic-gate 		break;
45747c478bd9Sstevel@tonic-gate 
45757c478bd9Sstevel@tonic-gate 	case AF_UNIX:
45767c478bd9Sstevel@tonic-gate 		/*
45777c478bd9Sstevel@tonic-gate 		 * first check if this is first time through. Too much
45787c478bd9Sstevel@tonic-gate 		 * duplicate code to put this in an aui_ routine.
45797c478bd9Sstevel@tonic-gate 		 */
45807c478bd9Sstevel@tonic-gate 
45817c478bd9Sstevel@tonic-gate 		/* get path from file struct here */
45827c478bd9Sstevel@tonic-gate 		fad = F2A(fp);
45837c478bd9Sstevel@tonic-gate 		ASSERT(fad);
45847c478bd9Sstevel@tonic-gate 
45857c478bd9Sstevel@tonic-gate 		/*
45867c478bd9Sstevel@tonic-gate 		 * already processed this file for write attempt
45877c478bd9Sstevel@tonic-gate 		 */
45887c478bd9Sstevel@tonic-gate 		if (fad->fad_flags & FAD_WRITE) {
45897c478bd9Sstevel@tonic-gate 			/* don't want to audit every sendto attempt */
45907c478bd9Sstevel@tonic-gate 			tad->tad_flag = 0;
45917c478bd9Sstevel@tonic-gate 			/* free any residual audit data */
45927c478bd9Sstevel@tonic-gate 			au_close(kctx, &(u_ad), 0, 0, 0);
45937c478bd9Sstevel@tonic-gate 			releasef(fd);
45947c478bd9Sstevel@tonic-gate 			return;
45957c478bd9Sstevel@tonic-gate 		}
45967c478bd9Sstevel@tonic-gate 		/*
45977c478bd9Sstevel@tonic-gate 		 * mark things so we know what happened and don't
45987c478bd9Sstevel@tonic-gate 		 * repeat things
45997c478bd9Sstevel@tonic-gate 		 */
46007c478bd9Sstevel@tonic-gate 		fad->fad_flags |= FAD_WRITE;
46017c478bd9Sstevel@tonic-gate 
46027c478bd9Sstevel@tonic-gate 		if (fad->fad_aupath != NULL) {
46037c478bd9Sstevel@tonic-gate 			au_uwrite(au_to_path(fad->fad_aupath));
46047c478bd9Sstevel@tonic-gate 		} else {
46057c478bd9Sstevel@tonic-gate 			au_uwrite(au_to_arg32(1, "no path: fd", fd));
46067c478bd9Sstevel@tonic-gate 		}
46077c478bd9Sstevel@tonic-gate 
46087c478bd9Sstevel@tonic-gate 		audit_attributes(fp->f_vnode);
46097c478bd9Sstevel@tonic-gate 
46107c478bd9Sstevel@tonic-gate 		releasef(fd);
46117c478bd9Sstevel@tonic-gate 
46127c478bd9Sstevel@tonic-gate 		return;
46137c478bd9Sstevel@tonic-gate 
46147c478bd9Sstevel@tonic-gate 	default:
46157c478bd9Sstevel@tonic-gate 		break;
46167c478bd9Sstevel@tonic-gate 
46177c478bd9Sstevel@tonic-gate 	}
46187c478bd9Sstevel@tonic-gate 
46197c478bd9Sstevel@tonic-gate 	releasef(fd);
46207c478bd9Sstevel@tonic-gate 
46217c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
46227c478bd9Sstevel@tonic-gate 
46237c478bd9Sstevel@tonic-gate 	if (add_sock_token == 0) {
46247c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "family", (uint32_t)so_family));
46257c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "type", (uint32_t)so_type));
46267c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(3, "flags", (uint32_t)(uap->flags)));
46277c478bd9Sstevel@tonic-gate 		return;
46287c478bd9Sstevel@tonic-gate 	}
46297c478bd9Sstevel@tonic-gate 
46307c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(3, "flags", (uint32_t)(uap->flags)));
46317c478bd9Sstevel@tonic-gate 
46327c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_socket_ex(so_family, so_type, so_laddr, so_faddr));
46337c478bd9Sstevel@tonic-gate 
46347c478bd9Sstevel@tonic-gate }
46357c478bd9Sstevel@tonic-gate 
46367c478bd9Sstevel@tonic-gate /*
4637da6c28aaSamw  * XXX socket(2) may be equivalent to open(2) on a unix domain
46387c478bd9Sstevel@tonic-gate  * socket. This needs investigation.
46397c478bd9Sstevel@tonic-gate  */
46407c478bd9Sstevel@tonic-gate 
46417c478bd9Sstevel@tonic-gate /*ARGSUSED*/
46427c478bd9Sstevel@tonic-gate static void
46437c478bd9Sstevel@tonic-gate aus_socket(struct t_audit_data *tad)
46447c478bd9Sstevel@tonic-gate {
46457c478bd9Sstevel@tonic-gate 	struct a {
46467c478bd9Sstevel@tonic-gate 		long	domain;
46477c478bd9Sstevel@tonic-gate 		long	type;
46487c478bd9Sstevel@tonic-gate 		long	protocol;
46497c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)ttolwp(curthread)->lwp_ap;
46507c478bd9Sstevel@tonic-gate 
46517c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(1, "domain", (uint32_t)uap->domain));
46527c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(2, "type", (uint32_t)uap->type));
46537c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(3, "protocol", (uint32_t)uap->protocol));
46547c478bd9Sstevel@tonic-gate }
46557c478bd9Sstevel@tonic-gate 
46567c478bd9Sstevel@tonic-gate /*ARGSUSED*/
46577c478bd9Sstevel@tonic-gate static void
46587c478bd9Sstevel@tonic-gate aus_sigqueue(struct t_audit_data *tad)
46597c478bd9Sstevel@tonic-gate {
46607c478bd9Sstevel@tonic-gate 	struct a {
46617c478bd9Sstevel@tonic-gate 		long	pid;
46627c478bd9Sstevel@tonic-gate 		long	signo;
46637c478bd9Sstevel@tonic-gate 		long	*val;
46647c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)ttolwp(curthread)->lwp_ap;
46657c478bd9Sstevel@tonic-gate 	struct proc *p;
46667c478bd9Sstevel@tonic-gate 	uid_t uid, ruid;
46677c478bd9Sstevel@tonic-gate 	gid_t gid, rgid;
46687c478bd9Sstevel@tonic-gate 	pid_t pid;
46697c478bd9Sstevel@tonic-gate 	const auditinfo_addr_t *ainfo;
46707c478bd9Sstevel@tonic-gate 	cred_t *cr;
46717c478bd9Sstevel@tonic-gate 
46727c478bd9Sstevel@tonic-gate 	pid = (pid_t)uap->pid;
46737c478bd9Sstevel@tonic-gate 
46747c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(2, "signal", (uint32_t)uap->signo));
46757c478bd9Sstevel@tonic-gate 	if (pid > 0) {
46767c478bd9Sstevel@tonic-gate 		mutex_enter(&pidlock);
46777c478bd9Sstevel@tonic-gate 		if ((p = prfind(pid)) == (struct proc *)0) {
46787c478bd9Sstevel@tonic-gate 			mutex_exit(&pidlock);
46797c478bd9Sstevel@tonic-gate 			return;
46807c478bd9Sstevel@tonic-gate 		}
46817c478bd9Sstevel@tonic-gate 		mutex_enter(&p->p_lock); /* so process doesn't go away */
46827c478bd9Sstevel@tonic-gate 		mutex_exit(&pidlock);
46837c478bd9Sstevel@tonic-gate 
46847c478bd9Sstevel@tonic-gate 		mutex_enter(&p->p_crlock);
46857c478bd9Sstevel@tonic-gate 		crhold(cr = p->p_cred);
46867c478bd9Sstevel@tonic-gate 		mutex_exit(&p->p_crlock);
46877c478bd9Sstevel@tonic-gate 		mutex_exit(&p->p_lock);
46887c478bd9Sstevel@tonic-gate 
46897c478bd9Sstevel@tonic-gate 		ainfo = crgetauinfo(cr);
46907c478bd9Sstevel@tonic-gate 		if (ainfo == NULL) {
46917c478bd9Sstevel@tonic-gate 			crfree(cr);
46927c478bd9Sstevel@tonic-gate 			return;
46937c478bd9Sstevel@tonic-gate 		}
46947c478bd9Sstevel@tonic-gate 
46957c478bd9Sstevel@tonic-gate 		uid  = crgetuid(cr);
46967c478bd9Sstevel@tonic-gate 		gid  = crgetgid(cr);
46977c478bd9Sstevel@tonic-gate 		ruid = crgetruid(cr);
46987c478bd9Sstevel@tonic-gate 		rgid = crgetrgid(cr);
46997c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_process(uid, gid, ruid, rgid, pid,
47007c478bd9Sstevel@tonic-gate 		    ainfo->ai_auid, ainfo->ai_asid, &ainfo->ai_termid));
47017c478bd9Sstevel@tonic-gate 		crfree(cr);
47027c478bd9Sstevel@tonic-gate 	}
47037c478bd9Sstevel@tonic-gate 	else
47047c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "process ID", (uint32_t)pid));
47057c478bd9Sstevel@tonic-gate }
47067c478bd9Sstevel@tonic-gate 
47077c478bd9Sstevel@tonic-gate /*ARGSUSED*/
47087c478bd9Sstevel@tonic-gate static void
47097c478bd9Sstevel@tonic-gate aus_inst_sync(struct t_audit_data *tad)
47107c478bd9Sstevel@tonic-gate {
47117c478bd9Sstevel@tonic-gate 	struct a {
47127c478bd9Sstevel@tonic-gate 		long	name;	/* char */
47137c478bd9Sstevel@tonic-gate 		long	flags;
47147c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)ttolwp(curthread)->lwp_ap;
47157c478bd9Sstevel@tonic-gate 
47167c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(2, "flags", (uint32_t)uap->flags));
47177c478bd9Sstevel@tonic-gate }
47187c478bd9Sstevel@tonic-gate 
47199acbbeafSnn /*ARGSUSED*/
47209acbbeafSnn static void
47219acbbeafSnn aus_brandsys(struct t_audit_data *tad)
47229acbbeafSnn {
47239acbbeafSnn 	klwp_t *clwp = ttolwp(curthread);
47249acbbeafSnn 
47259acbbeafSnn 	struct a {
47269acbbeafSnn 		long	cmd;
47279acbbeafSnn 		long	arg1;
47289acbbeafSnn 		long	arg2;
47299acbbeafSnn 		long	arg3;
47309acbbeafSnn 		long	arg4;
47319acbbeafSnn 		long	arg5;
47329acbbeafSnn 		long	arg6;
47339acbbeafSnn 	} *uap = (struct a *)clwp->lwp_ap;
47349acbbeafSnn 
47359acbbeafSnn 	au_uwrite(au_to_arg32(1, "cmd", (uint_t)uap->cmd));
47369acbbeafSnn #ifdef _LP64
47379acbbeafSnn 	au_uwrite(au_to_arg64(2, "arg1", (uint64_t)uap->arg1));
47389acbbeafSnn 	au_uwrite(au_to_arg64(3, "arg2", (uint64_t)uap->arg2));
47399acbbeafSnn 	au_uwrite(au_to_arg64(4, "arg3", (uint64_t)uap->arg3));
47409acbbeafSnn 	au_uwrite(au_to_arg64(5, "arg4", (uint64_t)uap->arg4));
47419acbbeafSnn 	au_uwrite(au_to_arg64(6, "arg5", (uint64_t)uap->arg5));
47429acbbeafSnn 	au_uwrite(au_to_arg64(7, "arg6", (uint64_t)uap->arg6));
47439acbbeafSnn #else
47449acbbeafSnn 	au_uwrite(au_to_arg32(2, "arg1", (uint32_t)uap->arg1));
47459acbbeafSnn 	au_uwrite(au_to_arg32(3, "arg2", (uint32_t)uap->arg2));
47469acbbeafSnn 	au_uwrite(au_to_arg32(4, "arg3", (uint32_t)uap->arg3));
47479acbbeafSnn 	au_uwrite(au_to_arg32(5, "arg4", (uint32_t)uap->arg4));
47489acbbeafSnn 	au_uwrite(au_to_arg32(6, "arg5", (uint32_t)uap->arg5));
47499acbbeafSnn 	au_uwrite(au_to_arg32(7, "arg6", (uint32_t)uap->arg6));
47509acbbeafSnn #endif
47519acbbeafSnn }
47529acbbeafSnn 
47537c478bd9Sstevel@tonic-gate /*ARGSUSED*/
47547c478bd9Sstevel@tonic-gate static void
47557c478bd9Sstevel@tonic-gate aus_p_online(struct t_audit_data *tad)
47567c478bd9Sstevel@tonic-gate {
47577c478bd9Sstevel@tonic-gate 	struct a {
47587c478bd9Sstevel@tonic-gate 		long	processor_id;
47597c478bd9Sstevel@tonic-gate 		long	flag;
47607c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)ttolwp(curthread)->lwp_ap;
47617c478bd9Sstevel@tonic-gate 
47627c478bd9Sstevel@tonic-gate 	struct flags {
47637c478bd9Sstevel@tonic-gate 			int	flag;
47647c478bd9Sstevel@tonic-gate 			char	*cflag;
47657c478bd9Sstevel@tonic-gate 	} aflags[6] = {
47667c478bd9Sstevel@tonic-gate 			{ P_ONLINE, "P_ONLINE"},
47677c478bd9Sstevel@tonic-gate 			{ P_OFFLINE, "P_OFFLINE"},
47687c478bd9Sstevel@tonic-gate 			{ P_NOINTR, "P_NOINTR"},
47697c478bd9Sstevel@tonic-gate 			{ P_SPARE, "P_SPARE"},
47707c478bd9Sstevel@tonic-gate 			{ P_FAULTED, "P_FAULTED"},
47717c478bd9Sstevel@tonic-gate 			{ P_STATUS, "P_STATUS"}
47727c478bd9Sstevel@tonic-gate 	};
47737c478bd9Sstevel@tonic-gate 	int i;
47747c478bd9Sstevel@tonic-gate 	char *cflag;
47757c478bd9Sstevel@tonic-gate 
47767c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(1, "processor ID", (uint32_t)uap->processor_id));
47777c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(2, "flag", (uint32_t)uap->flag));
47787c478bd9Sstevel@tonic-gate 
47797c478bd9Sstevel@tonic-gate 	for (i = 0; i < 6; i++) {
47807c478bd9Sstevel@tonic-gate 		if (aflags[i].flag == uap->flag)
47817c478bd9Sstevel@tonic-gate 			break;
47827c478bd9Sstevel@tonic-gate 	}
47837c478bd9Sstevel@tonic-gate 	cflag = (i == 6) ? "bad flag":aflags[i].cflag;
47847c478bd9Sstevel@tonic-gate 
47857c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_text(cflag));
47867c478bd9Sstevel@tonic-gate }
47877c478bd9Sstevel@tonic-gate 
47887c478bd9Sstevel@tonic-gate /*ARGSUSED*/
47897c478bd9Sstevel@tonic-gate static void
47907c478bd9Sstevel@tonic-gate aus_processor_bind(struct t_audit_data *tad)
47917c478bd9Sstevel@tonic-gate {
47927c478bd9Sstevel@tonic-gate 	struct a {
47937c478bd9Sstevel@tonic-gate 		long	id_type;
47947c478bd9Sstevel@tonic-gate 		long	id;
47957c478bd9Sstevel@tonic-gate 		long	processor_id;
47967c478bd9Sstevel@tonic-gate 		long	obind;
47977c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)ttolwp(curthread)->lwp_ap;
47987c478bd9Sstevel@tonic-gate 
47997c478bd9Sstevel@tonic-gate 	struct proc *p;
48007c478bd9Sstevel@tonic-gate 	int lwpcnt;
48017c478bd9Sstevel@tonic-gate 	uid_t uid, ruid;
48027c478bd9Sstevel@tonic-gate 	gid_t gid, rgid;
48037c478bd9Sstevel@tonic-gate 	pid_t pid;
48047c478bd9Sstevel@tonic-gate 	const auditinfo_addr_t *ainfo;
48057c478bd9Sstevel@tonic-gate 	cred_t *cr;
48067c478bd9Sstevel@tonic-gate 
48077c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(1, "ID type", (uint32_t)uap->id_type));
48087c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(2, "ID", (uint32_t)uap->id));
48097c478bd9Sstevel@tonic-gate 	if (uap->processor_id == PBIND_NONE)
48107c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_text("PBIND_NONE"));
48117c478bd9Sstevel@tonic-gate 	else
48127c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(3, "processor_id",
4813745b2690Stz 		    (uint32_t)uap->processor_id));
48147c478bd9Sstevel@tonic-gate 
48157c478bd9Sstevel@tonic-gate 	switch (uap->id_type) {
48167c478bd9Sstevel@tonic-gate 	case P_MYID:
48177c478bd9Sstevel@tonic-gate 	case P_LWPID:
48187c478bd9Sstevel@tonic-gate 		mutex_enter(&pidlock);
48197c478bd9Sstevel@tonic-gate 		p = ttoproc(curthread);
48207c478bd9Sstevel@tonic-gate 		if (p == NULL || p->p_as == &kas) {
48217c478bd9Sstevel@tonic-gate 			mutex_exit(&pidlock);
48227c478bd9Sstevel@tonic-gate 			return;
48237c478bd9Sstevel@tonic-gate 		}
48247c478bd9Sstevel@tonic-gate 		mutex_enter(&p->p_lock);
48257c478bd9Sstevel@tonic-gate 		mutex_exit(&pidlock);
48267c478bd9Sstevel@tonic-gate 		lwpcnt = p->p_lwpcnt;
48277c478bd9Sstevel@tonic-gate 		pid  = p->p_pid;
48287c478bd9Sstevel@tonic-gate 
48297c478bd9Sstevel@tonic-gate 		mutex_enter(&p->p_crlock);
48307c478bd9Sstevel@tonic-gate 		crhold(cr = p->p_cred);
48317c478bd9Sstevel@tonic-gate 		mutex_exit(&p->p_crlock);
48327c478bd9Sstevel@tonic-gate 		mutex_exit(&p->p_lock);
48337c478bd9Sstevel@tonic-gate 
48347c478bd9Sstevel@tonic-gate 		ainfo = crgetauinfo(cr);
48357c478bd9Sstevel@tonic-gate 		if (ainfo == NULL) {
48367c478bd9Sstevel@tonic-gate 			crfree(cr);
48377c478bd9Sstevel@tonic-gate 			return;
48387c478bd9Sstevel@tonic-gate 		}
48397c478bd9Sstevel@tonic-gate 
48407c478bd9Sstevel@tonic-gate 		uid  = crgetuid(cr);
48417c478bd9Sstevel@tonic-gate 		gid  = crgetgid(cr);
48427c478bd9Sstevel@tonic-gate 		ruid = crgetruid(cr);
48437c478bd9Sstevel@tonic-gate 		rgid = crgetrgid(cr);
48447c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_process(uid, gid, ruid, rgid, pid,
48457c478bd9Sstevel@tonic-gate 		    ainfo->ai_auid, ainfo->ai_asid, &ainfo->ai_termid));
48467c478bd9Sstevel@tonic-gate 		crfree(cr);
48477c478bd9Sstevel@tonic-gate 		break;
48487c478bd9Sstevel@tonic-gate 	case P_PID:
48497c478bd9Sstevel@tonic-gate 		mutex_enter(&pidlock);
48507c478bd9Sstevel@tonic-gate 		p = prfind(uap->id);
48517c478bd9Sstevel@tonic-gate 		if (p == NULL || p->p_as == &kas) {
48527c478bd9Sstevel@tonic-gate 			mutex_exit(&pidlock);
48537c478bd9Sstevel@tonic-gate 			return;
48547c478bd9Sstevel@tonic-gate 		}
48557c478bd9Sstevel@tonic-gate 		mutex_enter(&p->p_lock);
48567c478bd9Sstevel@tonic-gate 		mutex_exit(&pidlock);
48577c478bd9Sstevel@tonic-gate 		lwpcnt = p->p_lwpcnt;
48587c478bd9Sstevel@tonic-gate 		pid  = p->p_pid;
48597c478bd9Sstevel@tonic-gate 
48607c478bd9Sstevel@tonic-gate 		mutex_enter(&p->p_crlock);
48617c478bd9Sstevel@tonic-gate 		crhold(cr = p->p_cred);
48627c478bd9Sstevel@tonic-gate 		mutex_exit(&p->p_crlock);
48637c478bd9Sstevel@tonic-gate 		mutex_exit(&p->p_lock);
48647c478bd9Sstevel@tonic-gate 
48657c478bd9Sstevel@tonic-gate 		ainfo = crgetauinfo(cr);
48667c478bd9Sstevel@tonic-gate 		if (ainfo == NULL) {
48677c478bd9Sstevel@tonic-gate 			crfree(cr);
48687c478bd9Sstevel@tonic-gate 			return;
48697c478bd9Sstevel@tonic-gate 		}
48707c478bd9Sstevel@tonic-gate 
48717c478bd9Sstevel@tonic-gate 		uid  = crgetuid(cr);
48727c478bd9Sstevel@tonic-gate 		gid  = crgetgid(cr);
48737c478bd9Sstevel@tonic-gate 		ruid = crgetruid(cr);
48747c478bd9Sstevel@tonic-gate 		rgid = crgetrgid(cr);
48757c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_process(uid, gid, ruid, rgid, pid,
48767c478bd9Sstevel@tonic-gate 		    ainfo->ai_auid, ainfo->ai_asid, &ainfo->ai_termid));
48777c478bd9Sstevel@tonic-gate 		crfree(cr);
48787c478bd9Sstevel@tonic-gate 
48797c478bd9Sstevel@tonic-gate 		break;
48807c478bd9Sstevel@tonic-gate 	default:
48817c478bd9Sstevel@tonic-gate 		return;
48827c478bd9Sstevel@tonic-gate 	}
48837c478bd9Sstevel@tonic-gate 
48847c478bd9Sstevel@tonic-gate 	if (uap->processor_id == PBIND_NONE &&
48857c478bd9Sstevel@tonic-gate 	    (!(uap->id_type == P_LWPID && lwpcnt > 1)))
48867c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_text("PBIND_NONE for process"));
48877c478bd9Sstevel@tonic-gate 	else
48887c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(3, "processor_id",
4889745b2690Stz 		    (uint32_t)uap->processor_id));
48907c478bd9Sstevel@tonic-gate }
48917c478bd9Sstevel@tonic-gate 
48927c478bd9Sstevel@tonic-gate /*ARGSUSED*/
48937c478bd9Sstevel@tonic-gate static au_event_t
48947c478bd9Sstevel@tonic-gate aui_doorfs(au_event_t e)
48957c478bd9Sstevel@tonic-gate {
48967c478bd9Sstevel@tonic-gate 	uint32_t code;
48977c478bd9Sstevel@tonic-gate 
48987c478bd9Sstevel@tonic-gate 	struct a {		/* doorfs */
48997c478bd9Sstevel@tonic-gate 		long	a1;
49007c478bd9Sstevel@tonic-gate 		long	a2;
49017c478bd9Sstevel@tonic-gate 		long	a3;
49027c478bd9Sstevel@tonic-gate 		long	a4;
49037c478bd9Sstevel@tonic-gate 		long	a5;
49047c478bd9Sstevel@tonic-gate 		long	code;
49057c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)ttolwp(curthread)->lwp_ap;
49067c478bd9Sstevel@tonic-gate 
49077c478bd9Sstevel@tonic-gate 	/*
49087c478bd9Sstevel@tonic-gate 	 *	audit formats for several of the
49097c478bd9Sstevel@tonic-gate 	 *	door calls have not yet been determined
49107c478bd9Sstevel@tonic-gate 	 */
49117c478bd9Sstevel@tonic-gate 	code = (uint32_t)uap->code;
49127c478bd9Sstevel@tonic-gate 	switch (code) {
49137c478bd9Sstevel@tonic-gate 	case DOOR_CALL:
49147c478bd9Sstevel@tonic-gate 		e = AUE_DOORFS_DOOR_CALL;
49157c478bd9Sstevel@tonic-gate 		break;
49167c478bd9Sstevel@tonic-gate 	case DOOR_RETURN:
49177c478bd9Sstevel@tonic-gate 		e = AUE_NULL;
49187c478bd9Sstevel@tonic-gate 		break;
49197c478bd9Sstevel@tonic-gate 	case DOOR_CREATE:
49207c478bd9Sstevel@tonic-gate 		e = AUE_DOORFS_DOOR_CREATE;
49217c478bd9Sstevel@tonic-gate 		break;
49227c478bd9Sstevel@tonic-gate 	case DOOR_REVOKE:
49237c478bd9Sstevel@tonic-gate 		e = AUE_DOORFS_DOOR_REVOKE;
49247c478bd9Sstevel@tonic-gate 		break;
49257c478bd9Sstevel@tonic-gate 	case DOOR_INFO:
49267c478bd9Sstevel@tonic-gate 		e = AUE_NULL;
49277c478bd9Sstevel@tonic-gate 		break;
49287c478bd9Sstevel@tonic-gate 	case DOOR_UCRED:
49297c478bd9Sstevel@tonic-gate 		e = AUE_NULL;
49307c478bd9Sstevel@tonic-gate 		break;
49317c478bd9Sstevel@tonic-gate 	case DOOR_BIND:
49327c478bd9Sstevel@tonic-gate 		e = AUE_NULL;
49337c478bd9Sstevel@tonic-gate 		break;
49347c478bd9Sstevel@tonic-gate 	case DOOR_UNBIND:
49357c478bd9Sstevel@tonic-gate 		e = AUE_NULL;
49367c478bd9Sstevel@tonic-gate 		break;
49377c478bd9Sstevel@tonic-gate 	case DOOR_GETPARAM:
49387c478bd9Sstevel@tonic-gate 		e = AUE_NULL;
49397c478bd9Sstevel@tonic-gate 		break;
49407c478bd9Sstevel@tonic-gate 	case DOOR_SETPARAM:
49417c478bd9Sstevel@tonic-gate 		e = AUE_NULL;
49427c478bd9Sstevel@tonic-gate 		break;
49437c478bd9Sstevel@tonic-gate 	default:	/* illegal system call */
49447c478bd9Sstevel@tonic-gate 		e = AUE_NULL;
49457c478bd9Sstevel@tonic-gate 		break;
49467c478bd9Sstevel@tonic-gate 	}
49477c478bd9Sstevel@tonic-gate 
49487c478bd9Sstevel@tonic-gate 	return (e);
49497c478bd9Sstevel@tonic-gate }
49507c478bd9Sstevel@tonic-gate 
49517c478bd9Sstevel@tonic-gate static door_node_t *
49527c478bd9Sstevel@tonic-gate au_door_lookup(int did)
49537c478bd9Sstevel@tonic-gate {
49547c478bd9Sstevel@tonic-gate 	vnode_t	*vp;
49557c478bd9Sstevel@tonic-gate 	file_t *fp;
49567c478bd9Sstevel@tonic-gate 
49577c478bd9Sstevel@tonic-gate 	if ((fp = getf(did)) == NULL)
49587c478bd9Sstevel@tonic-gate 		return (NULL);
49597c478bd9Sstevel@tonic-gate 	/*
49607c478bd9Sstevel@tonic-gate 	 * Use the underlying vnode (we may be namefs mounted)
49617c478bd9Sstevel@tonic-gate 	 */
4962da6c28aaSamw 	if (VOP_REALVP(fp->f_vnode, &vp, NULL))
49637c478bd9Sstevel@tonic-gate 		vp = fp->f_vnode;
49647c478bd9Sstevel@tonic-gate 
49657c478bd9Sstevel@tonic-gate 	if (vp == NULL || vp->v_type != VDOOR) {
49667c478bd9Sstevel@tonic-gate 		releasef(did);
49677c478bd9Sstevel@tonic-gate 		return (NULL);
49687c478bd9Sstevel@tonic-gate 	}
49697c478bd9Sstevel@tonic-gate 
49707c478bd9Sstevel@tonic-gate 	return (VTOD(vp));
49717c478bd9Sstevel@tonic-gate }
49727c478bd9Sstevel@tonic-gate 
49737c478bd9Sstevel@tonic-gate /*ARGSUSED*/
49747c478bd9Sstevel@tonic-gate static void
49757c478bd9Sstevel@tonic-gate aus_doorfs(struct t_audit_data *tad)
49767c478bd9Sstevel@tonic-gate {
49777c478bd9Sstevel@tonic-gate 
49787c478bd9Sstevel@tonic-gate 	struct a {		/* doorfs */
49797c478bd9Sstevel@tonic-gate 		long	a1;
49807c478bd9Sstevel@tonic-gate 		long	a2;
49817c478bd9Sstevel@tonic-gate 		long	a3;
49827c478bd9Sstevel@tonic-gate 		long	a4;
49837c478bd9Sstevel@tonic-gate 		long	a5;
49847c478bd9Sstevel@tonic-gate 		long	code;
49857c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)ttolwp(curthread)->lwp_ap;
49867c478bd9Sstevel@tonic-gate 
49877c478bd9Sstevel@tonic-gate 	door_node_t	*dp;
49887c478bd9Sstevel@tonic-gate 	struct proc	*p;
49897c478bd9Sstevel@tonic-gate 	uint32_t	did;
49907c478bd9Sstevel@tonic-gate 	uid_t uid, ruid;
49917c478bd9Sstevel@tonic-gate 	gid_t gid, rgid;
49927c478bd9Sstevel@tonic-gate 	pid_t pid;
49937c478bd9Sstevel@tonic-gate 	const auditinfo_addr_t *ainfo;
49947c478bd9Sstevel@tonic-gate 	cred_t *cr;
49957c478bd9Sstevel@tonic-gate 
49967c478bd9Sstevel@tonic-gate 	did = (uint32_t)uap->a1;
49977c478bd9Sstevel@tonic-gate 
49987c478bd9Sstevel@tonic-gate 	switch (tad->tad_event) {
49997c478bd9Sstevel@tonic-gate 	case AUE_DOORFS_DOOR_CALL:
50007c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "door ID", (uint32_t)did));
50017c478bd9Sstevel@tonic-gate 		if ((dp = au_door_lookup(did)) == NULL)
50027c478bd9Sstevel@tonic-gate 			break;
50037c478bd9Sstevel@tonic-gate 
50047c478bd9Sstevel@tonic-gate 		if (DOOR_INVALID(dp)) {
50057c478bd9Sstevel@tonic-gate 			releasef(did);
50067c478bd9Sstevel@tonic-gate 			break;
50077c478bd9Sstevel@tonic-gate 		}
50087c478bd9Sstevel@tonic-gate 
50097c478bd9Sstevel@tonic-gate 		if ((p = dp->door_target) == NULL) {
50107c478bd9Sstevel@tonic-gate 			releasef(did);
50117c478bd9Sstevel@tonic-gate 			break;
50127c478bd9Sstevel@tonic-gate 		}
50137c478bd9Sstevel@tonic-gate 		mutex_enter(&p->p_lock);
50147c478bd9Sstevel@tonic-gate 		releasef(did);
50157c478bd9Sstevel@tonic-gate 
50167c478bd9Sstevel@tonic-gate 		pid  = p->p_pid;
50177c478bd9Sstevel@tonic-gate 
50187c478bd9Sstevel@tonic-gate 		mutex_enter(&p->p_crlock);
50197c478bd9Sstevel@tonic-gate 		crhold(cr = p->p_cred);
50207c478bd9Sstevel@tonic-gate 		mutex_exit(&p->p_crlock);
50217c478bd9Sstevel@tonic-gate 		mutex_exit(&p->p_lock);
50227c478bd9Sstevel@tonic-gate 
50237c478bd9Sstevel@tonic-gate 		ainfo = crgetauinfo(cr);
50247c478bd9Sstevel@tonic-gate 		if (ainfo == NULL) {
50257c478bd9Sstevel@tonic-gate 			crfree(cr);
50267c478bd9Sstevel@tonic-gate 			return;
50277c478bd9Sstevel@tonic-gate 		}
50287c478bd9Sstevel@tonic-gate 		uid  = crgetuid(cr);
50297c478bd9Sstevel@tonic-gate 		gid  = crgetgid(cr);
50307c478bd9Sstevel@tonic-gate 		ruid = crgetruid(cr);
50317c478bd9Sstevel@tonic-gate 		rgid = crgetrgid(cr);
50327c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_process(uid, gid, ruid, rgid, pid,
50337c478bd9Sstevel@tonic-gate 		    ainfo->ai_auid, ainfo->ai_asid, &ainfo->ai_termid));
50347c478bd9Sstevel@tonic-gate 		crfree(cr);
50357c478bd9Sstevel@tonic-gate 		break;
50367c478bd9Sstevel@tonic-gate 	case AUE_DOORFS_DOOR_RETURN:
50377c478bd9Sstevel@tonic-gate 		/*
50387c478bd9Sstevel@tonic-gate 		 * We may want to write information about
50397c478bd9Sstevel@tonic-gate 		 * all doors (if any) which will be copied
50407c478bd9Sstevel@tonic-gate 		 * by this call to the user space
50417c478bd9Sstevel@tonic-gate 		 */
50427c478bd9Sstevel@tonic-gate 		break;
50437c478bd9Sstevel@tonic-gate 	case AUE_DOORFS_DOOR_CREATE:
50447c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(3, "door attr", (uint32_t)uap->a3));
50457c478bd9Sstevel@tonic-gate 		break;
50467c478bd9Sstevel@tonic-gate 	case AUE_DOORFS_DOOR_REVOKE:
50477c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "door ID", (uint32_t)did));
50487c478bd9Sstevel@tonic-gate 		break;
50497c478bd9Sstevel@tonic-gate 	case AUE_DOORFS_DOOR_INFO:
50507c478bd9Sstevel@tonic-gate 		break;
50517c478bd9Sstevel@tonic-gate 	case AUE_DOORFS_DOOR_CRED:
50527c478bd9Sstevel@tonic-gate 		break;
50537c478bd9Sstevel@tonic-gate 	case AUE_DOORFS_DOOR_BIND:
50547c478bd9Sstevel@tonic-gate 		break;
50557c478bd9Sstevel@tonic-gate 	case AUE_DOORFS_DOOR_UNBIND: {
50567c478bd9Sstevel@tonic-gate 		break;
50577c478bd9Sstevel@tonic-gate 	}
50587c478bd9Sstevel@tonic-gate 	default:	/* illegal system call */
50597c478bd9Sstevel@tonic-gate 		break;
50607c478bd9Sstevel@tonic-gate 	}
50617c478bd9Sstevel@tonic-gate }
50627c478bd9Sstevel@tonic-gate 
50637c478bd9Sstevel@tonic-gate /*ARGSUSED*/
50647c478bd9Sstevel@tonic-gate static au_event_t
50657c478bd9Sstevel@tonic-gate aui_acl(au_event_t e)
50667c478bd9Sstevel@tonic-gate {
50677c478bd9Sstevel@tonic-gate 	struct a {
50687c478bd9Sstevel@tonic-gate 		union {
50697c478bd9Sstevel@tonic-gate 			long	name;	/* char */
50707c478bd9Sstevel@tonic-gate 			long	fd;
50717c478bd9Sstevel@tonic-gate 		}		obj;
50727c478bd9Sstevel@tonic-gate 
50737c478bd9Sstevel@tonic-gate 		long		cmd;
50747c478bd9Sstevel@tonic-gate 		long		nentries;
50757c478bd9Sstevel@tonic-gate 		long		arg;	/* aclent_t */
50767c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)ttolwp(curthread)->lwp_ap;
50777c478bd9Sstevel@tonic-gate 
50787c478bd9Sstevel@tonic-gate 	switch (uap->cmd) {
50797c478bd9Sstevel@tonic-gate 	case SETACL:
5080a7746f66Stz 	case ACE_SETACL:
5081a7746f66Stz 		/*
5082a7746f66Stz 		 * acl(SETACL/ACE_SETACL, ...) and facl(SETACL/ACE_SETACL, ...)
5083a7746f66Stz 		 * are expected.
5084a7746f66Stz 		 */
50857c478bd9Sstevel@tonic-gate 		break;
50867c478bd9Sstevel@tonic-gate 	case GETACL:
50877c478bd9Sstevel@tonic-gate 	case GETACLCNT:
5088ebbb0311SJan Friedel 	case ACE_GETACL:
5089a7746f66Stz 	case ACE_GETACLCNT:
5090ebbb0311SJan Friedel 		/* do nothing for these four values. */
50917c478bd9Sstevel@tonic-gate 		e = AUE_NULL;
50927c478bd9Sstevel@tonic-gate 		break;
50937c478bd9Sstevel@tonic-gate 	default:
50947c478bd9Sstevel@tonic-gate 		/* illegal system call */
50957c478bd9Sstevel@tonic-gate 		break;
50967c478bd9Sstevel@tonic-gate 	}
50977c478bd9Sstevel@tonic-gate 
50987c478bd9Sstevel@tonic-gate 	return (e);
50997c478bd9Sstevel@tonic-gate }
51007c478bd9Sstevel@tonic-gate 
51017c478bd9Sstevel@tonic-gate static void
5102a7746f66Stz au_acl(int cmd, int nentries, caddr_t bufp)
51037c478bd9Sstevel@tonic-gate {
5104a7746f66Stz 	size_t		a_size;
5105a7746f66Stz 	aclent_t	*aclbufp;
5106a7746f66Stz 	ace_t		*acebufp;
5107a7746f66Stz 	int		i;
51087c478bd9Sstevel@tonic-gate 
5109a7746f66Stz 	switch (cmd) {
51107c478bd9Sstevel@tonic-gate 	case GETACL:
51117c478bd9Sstevel@tonic-gate 	case GETACLCNT:
51127c478bd9Sstevel@tonic-gate 		break;
51137c478bd9Sstevel@tonic-gate 	case SETACL:
5114a7746f66Stz 		if (nentries < 3)
5115745b2690Stz 			break;
51167c478bd9Sstevel@tonic-gate 
5117a7746f66Stz 		a_size = nentries * sizeof (aclent_t);
5118a7746f66Stz 
5119a7746f66Stz 		if ((aclbufp = kmem_alloc(a_size, KM_SLEEP)) == NULL)
5120a7746f66Stz 			break;
5121a7746f66Stz 		if (copyin(bufp, aclbufp, a_size)) {
51227c478bd9Sstevel@tonic-gate 			kmem_free(aclbufp, a_size);
51237c478bd9Sstevel@tonic-gate 			break;
51247c478bd9Sstevel@tonic-gate 		}
5125a7746f66Stz 		for (i = 0; i < nentries; i++) {
5126a7746f66Stz 			au_uwrite(au_to_acl(aclbufp + i));
5127a7746f66Stz 		}
5128a7746f66Stz 		kmem_free(aclbufp, a_size);
5129a7746f66Stz 		break;
5130a7746f66Stz 
5131a7746f66Stz 	case ACE_SETACL:
5132a7746f66Stz 		if (nentries < 1 || nentries > MAX_ACL_ENTRIES)
5133a7746f66Stz 			break;
5134a7746f66Stz 
5135a7746f66Stz 		a_size = nentries * sizeof (ace_t);
5136a7746f66Stz 		if ((acebufp = kmem_alloc(a_size, KM_SLEEP)) == NULL)
5137a7746f66Stz 			break;
5138a7746f66Stz 		if (copyin(bufp, acebufp, a_size)) {
5139a7746f66Stz 			kmem_free(acebufp, a_size);
5140a7746f66Stz 			break;
5141a7746f66Stz 		}
5142a7746f66Stz 		for (i = 0; i < nentries; i++) {
5143a7746f66Stz 			au_uwrite(au_to_ace(acebufp + i));
5144a7746f66Stz 		}
5145a7746f66Stz 		kmem_free(acebufp, a_size);
5146a7746f66Stz 		break;
51477c478bd9Sstevel@tonic-gate 	default:
51487c478bd9Sstevel@tonic-gate 		break;
51497c478bd9Sstevel@tonic-gate 	}
51507c478bd9Sstevel@tonic-gate }
51517c478bd9Sstevel@tonic-gate 
5152a7746f66Stz /*ARGSUSED*/
5153a7746f66Stz static void
5154a7746f66Stz aus_acl(struct t_audit_data *tad)
5155a7746f66Stz {
5156a7746f66Stz 	struct a {
5157a7746f66Stz 		long	fname;
5158a7746f66Stz 		long	cmd;
5159a7746f66Stz 		long	nentries;
5160a7746f66Stz 		long	aclbufp;
5161a7746f66Stz 	} *uap = (struct a *)ttolwp(curthread)->lwp_ap;
5162a7746f66Stz 
5163a7746f66Stz 	au_uwrite(au_to_arg32(2, "cmd", (uint32_t)uap->cmd));
5164a7746f66Stz 	au_uwrite(au_to_arg32(3, "nentries", (uint32_t)uap->nentries));
5165a7746f66Stz 
5166a7746f66Stz 	au_acl(uap->cmd, uap->nentries, (caddr_t)uap->aclbufp);
5167a7746f66Stz }
5168a7746f66Stz 
51697c478bd9Sstevel@tonic-gate /*ARGSUSED*/
51707c478bd9Sstevel@tonic-gate static void
51717c478bd9Sstevel@tonic-gate aus_facl(struct t_audit_data *tad)
51727c478bd9Sstevel@tonic-gate {
51737c478bd9Sstevel@tonic-gate 	struct a {
51747c478bd9Sstevel@tonic-gate 		long	fd;
51757c478bd9Sstevel@tonic-gate 		long	cmd;
51767c478bd9Sstevel@tonic-gate 		long	nentries;
51777c478bd9Sstevel@tonic-gate 		long	aclbufp;
51787c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)ttolwp(curthread)->lwp_ap;
51797c478bd9Sstevel@tonic-gate 	struct file  *fp;
51807c478bd9Sstevel@tonic-gate 	struct vnode *vp;
51817c478bd9Sstevel@tonic-gate 	struct f_audit_data *fad;
51827c478bd9Sstevel@tonic-gate 	int fd;
51837c478bd9Sstevel@tonic-gate 
51847c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(2, "cmd", (uint32_t)uap->cmd));
51857c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(3, "nentries", (uint32_t)uap->nentries));
51867c478bd9Sstevel@tonic-gate 
51877c478bd9Sstevel@tonic-gate 	fd = (int)uap->fd;
51887c478bd9Sstevel@tonic-gate 
51897c478bd9Sstevel@tonic-gate 	if ((fp = getf(fd)) == NULL)
51907c478bd9Sstevel@tonic-gate 		return;
51917c478bd9Sstevel@tonic-gate 
51927c478bd9Sstevel@tonic-gate 	/* get path from file struct here */
51937c478bd9Sstevel@tonic-gate 	fad = F2A(fp);
51947c478bd9Sstevel@tonic-gate 	if (fad->fad_aupath != NULL) {
51957c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_path(fad->fad_aupath));
51967c478bd9Sstevel@tonic-gate 	} else {
51977c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "no path: fd", (uint32_t)fd));
51987c478bd9Sstevel@tonic-gate 	}
51997c478bd9Sstevel@tonic-gate 
52007c478bd9Sstevel@tonic-gate 	vp = fp->f_vnode;
52017c478bd9Sstevel@tonic-gate 	audit_attributes(vp);
52027c478bd9Sstevel@tonic-gate 
52037c478bd9Sstevel@tonic-gate 	/* decrement file descriptor reference count */
52047c478bd9Sstevel@tonic-gate 	releasef(fd);
52057c478bd9Sstevel@tonic-gate 
5206a7746f66Stz 	au_acl(uap->cmd, uap->nentries, (caddr_t)uap->aclbufp);
52077c478bd9Sstevel@tonic-gate }
52087c478bd9Sstevel@tonic-gate 
52097c478bd9Sstevel@tonic-gate /*ARGSUSED*/
52107c478bd9Sstevel@tonic-gate static void
52117c478bd9Sstevel@tonic-gate auf_read(tad, error, rval)
52127c478bd9Sstevel@tonic-gate 	struct t_audit_data *tad;
52137c478bd9Sstevel@tonic-gate 	int error;
52147c478bd9Sstevel@tonic-gate 	rval_t *rval;
52157c478bd9Sstevel@tonic-gate {
52167c478bd9Sstevel@tonic-gate 	struct file *fp;
52177c478bd9Sstevel@tonic-gate 	struct f_audit_data *fad;
52187c478bd9Sstevel@tonic-gate 	int fd;
52197c478bd9Sstevel@tonic-gate 	register struct a {
52207c478bd9Sstevel@tonic-gate 		long	fd;
52217c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)ttolwp(curthread)->lwp_ap;
52229e9e6ab8Spaulson 	au_kcontext_t	*kctx = GET_KCTX_PZ;
52237c478bd9Sstevel@tonic-gate 
52247c478bd9Sstevel@tonic-gate 	fd = (int)uap->fd;
52257c478bd9Sstevel@tonic-gate 
52267c478bd9Sstevel@tonic-gate 	/*
52277c478bd9Sstevel@tonic-gate 	 * convert file pointer to file descriptor
52287c478bd9Sstevel@tonic-gate 	 *   Note: fd ref count incremented here.
52297c478bd9Sstevel@tonic-gate 	 */
52307c478bd9Sstevel@tonic-gate 	if ((fp = getf(fd)) == NULL)
52317c478bd9Sstevel@tonic-gate 		return;
52327c478bd9Sstevel@tonic-gate 
52337c478bd9Sstevel@tonic-gate 	/* get path from file struct here */
52347c478bd9Sstevel@tonic-gate 	fad = F2A(fp);
52357c478bd9Sstevel@tonic-gate 	ASSERT(fad);
52367c478bd9Sstevel@tonic-gate 
52377c478bd9Sstevel@tonic-gate 	/*
52387c478bd9Sstevel@tonic-gate 	 * already processed this file for read attempt
52397c478bd9Sstevel@tonic-gate 	 *
52407c478bd9Sstevel@tonic-gate 	 * XXX might be better to turn off auditing in a aui_read() routine.
52417c478bd9Sstevel@tonic-gate 	 */
52427c478bd9Sstevel@tonic-gate 	if (fad->fad_flags & FAD_READ) {
52437c478bd9Sstevel@tonic-gate 		/* don't really want to audit every read attempt */
52447c478bd9Sstevel@tonic-gate 		tad->tad_flag = 0;
52457c478bd9Sstevel@tonic-gate 		/* free any residual audit data */
52467c478bd9Sstevel@tonic-gate 		au_close(kctx, &(u_ad), 0, 0, 0);
52477c478bd9Sstevel@tonic-gate 		releasef(fd);
52487c478bd9Sstevel@tonic-gate 		return;
52497c478bd9Sstevel@tonic-gate 	}
52507c478bd9Sstevel@tonic-gate 	/* mark things so we know what happened and don't repeat things */
52517c478bd9Sstevel@tonic-gate 	fad->fad_flags |= FAD_READ;
52527c478bd9Sstevel@tonic-gate 
52537c478bd9Sstevel@tonic-gate 	if (fad->fad_aupath != NULL) {
52547c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_path(fad->fad_aupath));
52557c478bd9Sstevel@tonic-gate 	} else {
52567c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "no path: fd", (uint32_t)fd));
52577c478bd9Sstevel@tonic-gate 	}
52587c478bd9Sstevel@tonic-gate 
52597c478bd9Sstevel@tonic-gate 	/* include attributes */
52607c478bd9Sstevel@tonic-gate 	audit_attributes(fp->f_vnode);
52617c478bd9Sstevel@tonic-gate 
52627c478bd9Sstevel@tonic-gate 	/* decrement file descriptor reference count */
52637c478bd9Sstevel@tonic-gate 	releasef(fd);
52647c478bd9Sstevel@tonic-gate }
52657c478bd9Sstevel@tonic-gate 
52667c478bd9Sstevel@tonic-gate /*ARGSUSED*/
52677c478bd9Sstevel@tonic-gate static void
52687c478bd9Sstevel@tonic-gate auf_write(tad, error, rval)
52697c478bd9Sstevel@tonic-gate 	struct t_audit_data *tad;
52707c478bd9Sstevel@tonic-gate 	int error;
52717c478bd9Sstevel@tonic-gate 	rval_t *rval;
52727c478bd9Sstevel@tonic-gate {
52737c478bd9Sstevel@tonic-gate 	struct file *fp;
52747c478bd9Sstevel@tonic-gate 	struct f_audit_data *fad;
52757c478bd9Sstevel@tonic-gate 	int fd;
52767c478bd9Sstevel@tonic-gate 	register struct a {
52777c478bd9Sstevel@tonic-gate 		long	fd;
52787c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)ttolwp(curthread)->lwp_ap;
52799e9e6ab8Spaulson 	au_kcontext_t	*kctx = GET_KCTX_PZ;
52807c478bd9Sstevel@tonic-gate 
52817c478bd9Sstevel@tonic-gate 	fd = (int)uap->fd;
52827c478bd9Sstevel@tonic-gate 
52837c478bd9Sstevel@tonic-gate 	/*
52847c478bd9Sstevel@tonic-gate 	 * convert file pointer to file descriptor
52857c478bd9Sstevel@tonic-gate 	 *   Note: fd ref count incremented here.
52867c478bd9Sstevel@tonic-gate 	 */
52877c478bd9Sstevel@tonic-gate 	if ((fp = getf(fd)) == NULL)
52887c478bd9Sstevel@tonic-gate 		return;
52897c478bd9Sstevel@tonic-gate 
52907c478bd9Sstevel@tonic-gate 	/* get path from file struct here */
52917c478bd9Sstevel@tonic-gate 	fad = F2A(fp);
52927c478bd9Sstevel@tonic-gate 	ASSERT(fad);
52937c478bd9Sstevel@tonic-gate 
52947c478bd9Sstevel@tonic-gate 	/*
52957c478bd9Sstevel@tonic-gate 	 * already processed this file for write attempt
52967c478bd9Sstevel@tonic-gate 	 *
52977c478bd9Sstevel@tonic-gate 	 * XXX might be better to turn off auditing in a aus_write() routine.
52987c478bd9Sstevel@tonic-gate 	 */
52997c478bd9Sstevel@tonic-gate 	if (fad->fad_flags & FAD_WRITE) {
53007c478bd9Sstevel@tonic-gate 		/* don't really want to audit every write attempt */
53017c478bd9Sstevel@tonic-gate 		tad->tad_flag = 0;
53027c478bd9Sstevel@tonic-gate 		/* free any residual audit data */
53037c478bd9Sstevel@tonic-gate 		au_close(kctx, &(u_ad), 0, 0, 0);
53047c478bd9Sstevel@tonic-gate 		releasef(fd);
53057c478bd9Sstevel@tonic-gate 		return;
53067c478bd9Sstevel@tonic-gate 	}
53077c478bd9Sstevel@tonic-gate 	/* mark things so we know what happened and don't repeat things */
53087c478bd9Sstevel@tonic-gate 	fad->fad_flags |= FAD_WRITE;
53097c478bd9Sstevel@tonic-gate 
53107c478bd9Sstevel@tonic-gate 	if (fad->fad_aupath != NULL) {
53117c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_path(fad->fad_aupath));
53127c478bd9Sstevel@tonic-gate 	} else {
53137c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "no path: fd", (uint32_t)fd));
53147c478bd9Sstevel@tonic-gate 	}
53157c478bd9Sstevel@tonic-gate 
53167c478bd9Sstevel@tonic-gate 	/* include attributes */
53177c478bd9Sstevel@tonic-gate 	audit_attributes(fp->f_vnode);
53187c478bd9Sstevel@tonic-gate 
53197c478bd9Sstevel@tonic-gate 	/* decrement file descriptor reference count */
53207c478bd9Sstevel@tonic-gate 	releasef(fd);
53217c478bd9Sstevel@tonic-gate }
53227c478bd9Sstevel@tonic-gate 
53237c478bd9Sstevel@tonic-gate /*ARGSUSED*/
53247c478bd9Sstevel@tonic-gate static void
53257c478bd9Sstevel@tonic-gate auf_recv(tad, error, rval)
53267c478bd9Sstevel@tonic-gate 	struct t_audit_data *tad;
53277c478bd9Sstevel@tonic-gate 	int error;
53287c478bd9Sstevel@tonic-gate 	rval_t *rval;
53297c478bd9Sstevel@tonic-gate {
53307c478bd9Sstevel@tonic-gate 	struct sonode *so;
53317c478bd9Sstevel@tonic-gate 	char so_laddr[sizeof (struct sockaddr_in6)];
53327c478bd9Sstevel@tonic-gate 	char so_faddr[sizeof (struct sockaddr_in6)];
53337c478bd9Sstevel@tonic-gate 	struct file *fp;
53347c478bd9Sstevel@tonic-gate 	struct f_audit_data *fad;
53357c478bd9Sstevel@tonic-gate 	int fd;
53367c478bd9Sstevel@tonic-gate 	int err;
53370f1702c5SYu Xiangning 	socklen_t len;
53387c478bd9Sstevel@tonic-gate 	short so_family, so_type;
53397c478bd9Sstevel@tonic-gate 	register struct a {
53407c478bd9Sstevel@tonic-gate 		long	fd;
53417c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)ttolwp(curthread)->lwp_ap;
53429e9e6ab8Spaulson 	au_kcontext_t	*kctx = GET_KCTX_PZ;
53437c478bd9Sstevel@tonic-gate 
53447c478bd9Sstevel@tonic-gate 	/*
53457c478bd9Sstevel@tonic-gate 	 * If there was an error, then nothing to do. Only generate
53467c478bd9Sstevel@tonic-gate 	 * audit record on first successful recv.
53477c478bd9Sstevel@tonic-gate 	 */
53487c478bd9Sstevel@tonic-gate 	if (error) {
53497c478bd9Sstevel@tonic-gate 		/* Turn off audit record generation here. */
53507c478bd9Sstevel@tonic-gate 		tad->tad_flag = 0;
53517c478bd9Sstevel@tonic-gate 		/* free any residual audit data */
53527c478bd9Sstevel@tonic-gate 		au_close(kctx, &(u_ad), 0, 0, 0);
53537c478bd9Sstevel@tonic-gate 		return;
53547c478bd9Sstevel@tonic-gate 	}
53557c478bd9Sstevel@tonic-gate 
53567c478bd9Sstevel@tonic-gate 	fd = (int)uap->fd;
53577c478bd9Sstevel@tonic-gate 
5358745b2690Stz 	if ((so = getsonode(fd, &err, &fp)) == NULL) {
53597c478bd9Sstevel@tonic-gate 		/* Turn off audit record generation here. */
53607c478bd9Sstevel@tonic-gate 		tad->tad_flag = 0;
53617c478bd9Sstevel@tonic-gate 		/* free any residual audit data */
53627c478bd9Sstevel@tonic-gate 		au_close(kctx, &(u_ad), 0, 0, 0);
53637c478bd9Sstevel@tonic-gate 		return;
53647c478bd9Sstevel@tonic-gate 	}
53657c478bd9Sstevel@tonic-gate 
53667c478bd9Sstevel@tonic-gate 	/* get path from file struct here */
53677c478bd9Sstevel@tonic-gate 	fad = F2A(fp);
53687c478bd9Sstevel@tonic-gate 	ASSERT(fad);
53697c478bd9Sstevel@tonic-gate 
53707c478bd9Sstevel@tonic-gate 	/*
53717c478bd9Sstevel@tonic-gate 	 * already processed this file for read attempt
53727c478bd9Sstevel@tonic-gate 	 */
53737c478bd9Sstevel@tonic-gate 	if (fad->fad_flags & FAD_READ) {
53747c478bd9Sstevel@tonic-gate 		releasef(fd);
53757c478bd9Sstevel@tonic-gate 		/* don't really want to audit every recv call */
53767c478bd9Sstevel@tonic-gate 		tad->tad_flag = 0;
53777c478bd9Sstevel@tonic-gate 		/* free any residual audit data */
53787c478bd9Sstevel@tonic-gate 		au_close(kctx, &(u_ad), 0, 0, 0);
53797c478bd9Sstevel@tonic-gate 		return;
53807c478bd9Sstevel@tonic-gate 	}
53817c478bd9Sstevel@tonic-gate 
53827c478bd9Sstevel@tonic-gate 	/* mark things so we know what happened and don't repeat things */
53837c478bd9Sstevel@tonic-gate 	fad->fad_flags |= FAD_READ;
53847c478bd9Sstevel@tonic-gate 
53857c478bd9Sstevel@tonic-gate 	so_family = so->so_family;
53867c478bd9Sstevel@tonic-gate 	so_type   = so->so_type;
53877c478bd9Sstevel@tonic-gate 
53887c478bd9Sstevel@tonic-gate 	switch (so_family) {
53897c478bd9Sstevel@tonic-gate 	case AF_INET:
53907c478bd9Sstevel@tonic-gate 	case AF_INET6:
53917c478bd9Sstevel@tonic-gate 		/*
53927c478bd9Sstevel@tonic-gate 		 * Only for connections.
53937c478bd9Sstevel@tonic-gate 		 * XXX - do we need to worry about SOCK_DGRAM or other types???
53947c478bd9Sstevel@tonic-gate 		 */
53957c478bd9Sstevel@tonic-gate 		if (so->so_state & SS_ISBOUND) {
53967c478bd9Sstevel@tonic-gate 
53977c478bd9Sstevel@tonic-gate 			bzero((void *)so_laddr, sizeof (so_laddr));
53987c478bd9Sstevel@tonic-gate 			bzero((void *)so_faddr, sizeof (so_faddr));
53997c478bd9Sstevel@tonic-gate 
54007c478bd9Sstevel@tonic-gate 			/* get local and foreign addresses */
54010f1702c5SYu Xiangning 			len = sizeof (so_laddr);
54020f1702c5SYu Xiangning 			(void) socket_getsockname(so,
54030f1702c5SYu Xiangning 			    (struct sockaddr *)so_laddr, &len, CRED());
54040f1702c5SYu Xiangning 			len = sizeof (so_faddr);
54050f1702c5SYu Xiangning 			(void) socket_getpeername(so,
54060f1702c5SYu Xiangning 			    (struct sockaddr *)so_faddr, &len, B_FALSE, CRED());
54077c478bd9Sstevel@tonic-gate 
54087c478bd9Sstevel@tonic-gate 			/*
54097c478bd9Sstevel@tonic-gate 			 * only way to drop out of switch. Note that we
54107c478bd9Sstevel@tonic-gate 			 * we release fd below.
54117c478bd9Sstevel@tonic-gate 			 */
54127c478bd9Sstevel@tonic-gate 
54137c478bd9Sstevel@tonic-gate 			break;
54147c478bd9Sstevel@tonic-gate 		}
54157c478bd9Sstevel@tonic-gate 
54167c478bd9Sstevel@tonic-gate 		releasef(fd);
54177c478bd9Sstevel@tonic-gate 
54187c478bd9Sstevel@tonic-gate 		/* don't really want to audit every recv call */
54197c478bd9Sstevel@tonic-gate 		tad->tad_flag = 0;
54207c478bd9Sstevel@tonic-gate 		/* free any residual audit data */
54217c478bd9Sstevel@tonic-gate 		au_close(kctx, &(u_ad), 0, 0, 0);
54227c478bd9Sstevel@tonic-gate 
54237c478bd9Sstevel@tonic-gate 		return;
54247c478bd9Sstevel@tonic-gate 
54257c478bd9Sstevel@tonic-gate 	case AF_UNIX:
54267c478bd9Sstevel@tonic-gate 
54277c478bd9Sstevel@tonic-gate 		if (fad->fad_aupath != NULL) {
54287c478bd9Sstevel@tonic-gate 			au_uwrite(au_to_path(fad->fad_aupath));
54297c478bd9Sstevel@tonic-gate 		} else {
54307c478bd9Sstevel@tonic-gate 			au_uwrite(au_to_arg32(1, "no path: fd", fd));
54317c478bd9Sstevel@tonic-gate 		}
54327c478bd9Sstevel@tonic-gate 
54337c478bd9Sstevel@tonic-gate 		audit_attributes(fp->f_vnode);
54347c478bd9Sstevel@tonic-gate 
54357c478bd9Sstevel@tonic-gate 		releasef(fd);
54367c478bd9Sstevel@tonic-gate 
54377c478bd9Sstevel@tonic-gate 		return;
54387c478bd9Sstevel@tonic-gate 
54397c478bd9Sstevel@tonic-gate 	default:
54407c478bd9Sstevel@tonic-gate 		releasef(fd);
54417c478bd9Sstevel@tonic-gate 
54427c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
54437c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "family", (uint32_t)so_family));
54447c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "type", (uint32_t)so_type));
54457c478bd9Sstevel@tonic-gate 
54467c478bd9Sstevel@tonic-gate 		return;
54477c478bd9Sstevel@tonic-gate 	}
54487c478bd9Sstevel@tonic-gate 
54497c478bd9Sstevel@tonic-gate 	releasef(fd);
54507c478bd9Sstevel@tonic-gate 
54517c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
54527c478bd9Sstevel@tonic-gate 
54537c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_socket_ex(so_family, so_type, so_laddr, so_faddr));
54547c478bd9Sstevel@tonic-gate 
54557c478bd9Sstevel@tonic-gate }
54567c478bd9Sstevel@tonic-gate 
54577c478bd9Sstevel@tonic-gate /*ARGSUSED*/
54587c478bd9Sstevel@tonic-gate static void
54597c478bd9Sstevel@tonic-gate auf_send(tad, error, rval)
54607c478bd9Sstevel@tonic-gate 	struct t_audit_data *tad;
54617c478bd9Sstevel@tonic-gate 	int error;
54627c478bd9Sstevel@tonic-gate 	rval_t *rval;
54637c478bd9Sstevel@tonic-gate {
54647c478bd9Sstevel@tonic-gate 	struct sonode *so;
54657c478bd9Sstevel@tonic-gate 	char so_laddr[sizeof (struct sockaddr_in6)];
54667c478bd9Sstevel@tonic-gate 	char so_faddr[sizeof (struct sockaddr_in6)];
54677c478bd9Sstevel@tonic-gate 	struct file *fp;
54687c478bd9Sstevel@tonic-gate 	struct f_audit_data *fad;
54697c478bd9Sstevel@tonic-gate 	int fd;
54707c478bd9Sstevel@tonic-gate 	int err;
54710f1702c5SYu Xiangning 	socklen_t len;
54727c478bd9Sstevel@tonic-gate 	short so_family, so_type;
54737c478bd9Sstevel@tonic-gate 	register struct a {
54747c478bd9Sstevel@tonic-gate 		long	fd;
54757c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)ttolwp(curthread)->lwp_ap;
54769e9e6ab8Spaulson 	au_kcontext_t	*kctx = GET_KCTX_PZ;
54777c478bd9Sstevel@tonic-gate 
54787c478bd9Sstevel@tonic-gate 	fd = (int)uap->fd;
54797c478bd9Sstevel@tonic-gate 
54807c478bd9Sstevel@tonic-gate 	/*
54817c478bd9Sstevel@tonic-gate 	 * If there was an error, then nothing to do. Only generate
54827c478bd9Sstevel@tonic-gate 	 * audit record on first successful send.
54837c478bd9Sstevel@tonic-gate 	 */
54847c478bd9Sstevel@tonic-gate 	if (error != 0) {
54857c478bd9Sstevel@tonic-gate 		/* Turn off audit record generation here. */
54867c478bd9Sstevel@tonic-gate 		tad->tad_flag = 0;
54877c478bd9Sstevel@tonic-gate 		/* free any residual audit data */
54887c478bd9Sstevel@tonic-gate 		au_close(kctx, &(u_ad), 0, 0, 0);
54897c478bd9Sstevel@tonic-gate 		return;
54907c478bd9Sstevel@tonic-gate 	}
54917c478bd9Sstevel@tonic-gate 
54927c478bd9Sstevel@tonic-gate 	fd = (int)uap->fd;
54937c478bd9Sstevel@tonic-gate 
5494745b2690Stz 	if ((so = getsonode(fd, &err, &fp)) == NULL) {
54957c478bd9Sstevel@tonic-gate 		/* Turn off audit record generation here. */
54967c478bd9Sstevel@tonic-gate 		tad->tad_flag = 0;
54977c478bd9Sstevel@tonic-gate 		/* free any residual audit data */
54987c478bd9Sstevel@tonic-gate 		au_close(kctx, &(u_ad), 0, 0, 0);
54997c478bd9Sstevel@tonic-gate 		return;
55007c478bd9Sstevel@tonic-gate 	}
55017c478bd9Sstevel@tonic-gate 
55027c478bd9Sstevel@tonic-gate 	/* get path from file struct here */
55037c478bd9Sstevel@tonic-gate 	fad = F2A(fp);
55047c478bd9Sstevel@tonic-gate 	ASSERT(fad);
55057c478bd9Sstevel@tonic-gate 
55067c478bd9Sstevel@tonic-gate 	/*
55077c478bd9Sstevel@tonic-gate 	 * already processed this file for write attempt
55087c478bd9Sstevel@tonic-gate 	 */
55097c478bd9Sstevel@tonic-gate 	if (fad->fad_flags & FAD_WRITE) {
55107c478bd9Sstevel@tonic-gate 		releasef(fd);
55117c478bd9Sstevel@tonic-gate 		/* don't really want to audit every send call */
55127c478bd9Sstevel@tonic-gate 		tad->tad_flag = 0;
55137c478bd9Sstevel@tonic-gate 		/* free any residual audit data */
55147c478bd9Sstevel@tonic-gate 		au_close(kctx, &(u_ad), 0, 0, 0);
55157c478bd9Sstevel@tonic-gate 		return;
55167c478bd9Sstevel@tonic-gate 	}
55177c478bd9Sstevel@tonic-gate 
55187c478bd9Sstevel@tonic-gate 	/* mark things so we know what happened and don't repeat things */
55197c478bd9Sstevel@tonic-gate 	fad->fad_flags |= FAD_WRITE;
55207c478bd9Sstevel@tonic-gate 
55217c478bd9Sstevel@tonic-gate 	so_family = so->so_family;
55227c478bd9Sstevel@tonic-gate 	so_type   = so->so_type;
55237c478bd9Sstevel@tonic-gate 
55247c478bd9Sstevel@tonic-gate 	switch (so_family) {
55257c478bd9Sstevel@tonic-gate 	case AF_INET:
55267c478bd9Sstevel@tonic-gate 	case AF_INET6:
55277c478bd9Sstevel@tonic-gate 		/*
55287c478bd9Sstevel@tonic-gate 		 * Only for connections.
55297c478bd9Sstevel@tonic-gate 		 * XXX - do we need to worry about SOCK_DGRAM or other types???
55307c478bd9Sstevel@tonic-gate 		 */
55317c478bd9Sstevel@tonic-gate 		if (so->so_state & SS_ISBOUND) {
55327c478bd9Sstevel@tonic-gate 
55337c478bd9Sstevel@tonic-gate 			bzero((void *)so_laddr, sizeof (so_laddr));
55347c478bd9Sstevel@tonic-gate 			bzero((void *)so_faddr, sizeof (so_faddr));
55357c478bd9Sstevel@tonic-gate 
55367c478bd9Sstevel@tonic-gate 			/* get local and foreign addresses */
55370f1702c5SYu Xiangning 			len = sizeof (so_laddr);
55380f1702c5SYu Xiangning 			(void) socket_getsockname(so,
55390f1702c5SYu Xiangning 			    (struct sockaddr *)so_laddr, &len, CRED());
55400f1702c5SYu Xiangning 			len = sizeof (so_faddr);
55410f1702c5SYu Xiangning 			(void) socket_getpeername(so,
55420f1702c5SYu Xiangning 			    (struct sockaddr *)so_faddr, &len, B_FALSE, CRED());
55437c478bd9Sstevel@tonic-gate 
55447c478bd9Sstevel@tonic-gate 			/*
55457c478bd9Sstevel@tonic-gate 			 * only way to drop out of switch. Note that we
55467c478bd9Sstevel@tonic-gate 			 * we release fd below.
55477c478bd9Sstevel@tonic-gate 			 */
55487c478bd9Sstevel@tonic-gate 
55497c478bd9Sstevel@tonic-gate 			break;
55507c478bd9Sstevel@tonic-gate 		}
55517c478bd9Sstevel@tonic-gate 
55527c478bd9Sstevel@tonic-gate 		releasef(fd);
55537c478bd9Sstevel@tonic-gate 		/* don't really want to audit every send call */
55547c478bd9Sstevel@tonic-gate 		tad->tad_flag = 0;
55557c478bd9Sstevel@tonic-gate 		/* free any residual audit data */
55567c478bd9Sstevel@tonic-gate 		au_close(kctx, &(u_ad), 0, 0, 0);
55577c478bd9Sstevel@tonic-gate 
55587c478bd9Sstevel@tonic-gate 		return;
55597c478bd9Sstevel@tonic-gate 
55607c478bd9Sstevel@tonic-gate 	case AF_UNIX:
55617c478bd9Sstevel@tonic-gate 
55627c478bd9Sstevel@tonic-gate 		if (fad->fad_aupath != NULL) {
55637c478bd9Sstevel@tonic-gate 			au_uwrite(au_to_path(fad->fad_aupath));
55647c478bd9Sstevel@tonic-gate 		} else {
55657c478bd9Sstevel@tonic-gate 			au_uwrite(au_to_arg32(1, "no path: fd", fd));
55667c478bd9Sstevel@tonic-gate 		}
55677c478bd9Sstevel@tonic-gate 
55687c478bd9Sstevel@tonic-gate 		audit_attributes(fp->f_vnode);
55697c478bd9Sstevel@tonic-gate 
55707c478bd9Sstevel@tonic-gate 		releasef(fd);
55717c478bd9Sstevel@tonic-gate 
55727c478bd9Sstevel@tonic-gate 		return;
55737c478bd9Sstevel@tonic-gate 
55747c478bd9Sstevel@tonic-gate 	default:
55757c478bd9Sstevel@tonic-gate 		releasef(fd);
55767c478bd9Sstevel@tonic-gate 
55777c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
55787c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "family", (uint32_t)so_family));
55797c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "type", (uint32_t)so_type));
55807c478bd9Sstevel@tonic-gate 
55817c478bd9Sstevel@tonic-gate 		return;
55827c478bd9Sstevel@tonic-gate 	}
55837c478bd9Sstevel@tonic-gate 
55847c478bd9Sstevel@tonic-gate 	releasef(fd);
55857c478bd9Sstevel@tonic-gate 
55867c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(1, "so", (uint32_t)fd));
55877c478bd9Sstevel@tonic-gate 
55887c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_socket_ex(so_family, so_type, so_laddr, so_faddr));
55897c478bd9Sstevel@tonic-gate }
5590657b1f3dSraf 
5591657b1f3dSraf static au_event_t
5592657b1f3dSraf aui_forksys(au_event_t e)
5593657b1f3dSraf {
5594657b1f3dSraf 	struct a {
5595657b1f3dSraf 		long	subcode;
5596657b1f3dSraf 		long	flags;
5597657b1f3dSraf 	} *uap = (struct a *)ttolwp(curthread)->lwp_ap;
5598657b1f3dSraf 
5599657b1f3dSraf 	switch ((uint_t)uap->subcode) {
5600657b1f3dSraf 	case 0:
5601657b1f3dSraf 		e = AUE_FORK1;
5602657b1f3dSraf 		break;
5603657b1f3dSraf 	case 1:
5604657b1f3dSraf 		e = AUE_FORKALL;
5605657b1f3dSraf 		break;
5606657b1f3dSraf 	case 2:
5607657b1f3dSraf 		e = AUE_VFORK;
5608657b1f3dSraf 		break;
5609657b1f3dSraf 	default:
5610657b1f3dSraf 		e = AUE_NULL;
5611657b1f3dSraf 		break;
5612657b1f3dSraf 	}
5613657b1f3dSraf 
5614657b1f3dSraf 	return (e);
5615657b1f3dSraf }
5616df2381bfSpraks 
5617df2381bfSpraks /*ARGSUSED*/
5618df2381bfSpraks static au_event_t
5619df2381bfSpraks aui_portfs(au_event_t e)
5620df2381bfSpraks {
5621df2381bfSpraks 	struct a {		/* portfs */
5622df2381bfSpraks 		long	a1;
5623df2381bfSpraks 		long	a2;
5624df2381bfSpraks 		long	a3;
5625df2381bfSpraks 	} *uap = (struct a *)ttolwp(curthread)->lwp_ap;
5626df2381bfSpraks 
5627df2381bfSpraks 	/*
5628df2381bfSpraks 	 * check opcode
5629df2381bfSpraks 	 */
5630df2381bfSpraks 	switch (((uint_t)uap->a1) & PORT_CODE_MASK) {
5631df2381bfSpraks 	case PORT_ASSOCIATE:
56328350182dSJan Friedel 		/* check source */
56338350182dSJan Friedel 		if (((uint_t)uap->a3 == PORT_SOURCE_FILE) ||
56348350182dSJan Friedel 		    ((uint_t)uap->a3 == PORT_SOURCE_FD)) {
56358350182dSJan Friedel 			e = AUE_PORTFS_ASSOCIATE;
56368350182dSJan Friedel 		} else {
56378350182dSJan Friedel 			e = AUE_NULL;
56388350182dSJan Friedel 		}
56398350182dSJan Friedel 		break;
5640df2381bfSpraks 	case PORT_DISSOCIATE:
56418350182dSJan Friedel 		/* check source */
56428350182dSJan Friedel 		if (((uint_t)uap->a3 == PORT_SOURCE_FILE) ||
56438350182dSJan Friedel 		    ((uint_t)uap->a3 == PORT_SOURCE_FD)) {
56448350182dSJan Friedel 			e = AUE_PORTFS_DISSOCIATE;
5645df2381bfSpraks 		} else {
5646df2381bfSpraks 			e = AUE_NULL;
5647df2381bfSpraks 		}
5648df2381bfSpraks 		break;
5649df2381bfSpraks 	default:
5650df2381bfSpraks 		e = AUE_NULL;
5651df2381bfSpraks 	}
5652df2381bfSpraks 	return (e);
5653df2381bfSpraks }
5654