xref: /illumos-gate/usr/src/uts/common/c2/audit_event.c (revision 241bfedf)
17c478bd9Sstevel@tonic-gate /*
27c478bd9Sstevel@tonic-gate  * CDDL HEADER START
37c478bd9Sstevel@tonic-gate  *
47c478bd9Sstevel@tonic-gate  * The contents of this file are subject to the terms of the
545916cd2Sjpk  * Common Development and Distribution License (the "License").
645916cd2Sjpk  * You may not use this file except in compliance with the License.
77c478bd9Sstevel@tonic-gate  *
87c478bd9Sstevel@tonic-gate  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
97c478bd9Sstevel@tonic-gate  * or http://www.opensolaris.org/os/licensing.
107c478bd9Sstevel@tonic-gate  * See the License for the specific language governing permissions
117c478bd9Sstevel@tonic-gate  * and limitations under the License.
127c478bd9Sstevel@tonic-gate  *
137c478bd9Sstevel@tonic-gate  * When distributing Covered Code, include this CDDL HEADER in each
147c478bd9Sstevel@tonic-gate  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
157c478bd9Sstevel@tonic-gate  * If applicable, add the following below this CDDL HEADER, with the
167c478bd9Sstevel@tonic-gate  * fields enclosed by brackets "[]" replaced with your own identifying
177c478bd9Sstevel@tonic-gate  * information: Portions Copyright [yyyy] [name of copyright owner]
187c478bd9Sstevel@tonic-gate  *
197c478bd9Sstevel@tonic-gate  * CDDL HEADER END
207c478bd9Sstevel@tonic-gate  */
21794f0adbSRoger A. Faulkner 
227c478bd9Sstevel@tonic-gate /*
234a0fa546SMarek Pospisil  * Copyright (c) 1992, 2010, Oracle and/or its affiliates. All rights reserved.
2489b43686SBayard Bell  * Copyright (c) 2011 Bayard G. Bell. All rights reserved.
2515c07adcSJohn Levon  * Copyright (c) 2018, Joyent, Inc.
267c478bd9Sstevel@tonic-gate  */
277c478bd9Sstevel@tonic-gate 
287c478bd9Sstevel@tonic-gate /*
297c478bd9Sstevel@tonic-gate  * This file contains the audit event table used to control the production
307c478bd9Sstevel@tonic-gate  * of audit records for each system call.
317c478bd9Sstevel@tonic-gate  */
327c478bd9Sstevel@tonic-gate 
337c478bd9Sstevel@tonic-gate #include <sys/policy.h>
347c478bd9Sstevel@tonic-gate #include <sys/cred.h>
357c478bd9Sstevel@tonic-gate #include <sys/types.h>
367c478bd9Sstevel@tonic-gate #include <sys/systm.h>
377c478bd9Sstevel@tonic-gate #include <sys/systeminfo.h>	/* for sysinfo auditing */
387c478bd9Sstevel@tonic-gate #include <sys/utsname.h>	/* for sysinfo auditing */
397c478bd9Sstevel@tonic-gate #include <sys/proc.h>
407c478bd9Sstevel@tonic-gate #include <sys/vnode.h>
417c478bd9Sstevel@tonic-gate #include <sys/mman.h>		/* for mmap(2) auditing etc. */
427c478bd9Sstevel@tonic-gate #include <sys/fcntl.h>
437c478bd9Sstevel@tonic-gate #include <sys/modctl.h>		/* for modctl auditing */
447c478bd9Sstevel@tonic-gate #include <sys/vnode.h>
457c478bd9Sstevel@tonic-gate #include <sys/user.h>
467c478bd9Sstevel@tonic-gate #include <sys/types.h>
477c478bd9Sstevel@tonic-gate #include <sys/processor.h>
487c478bd9Sstevel@tonic-gate #include <sys/procset.h>
497c478bd9Sstevel@tonic-gate #include <sys/acl.h>
507c478bd9Sstevel@tonic-gate #include <sys/ipc.h>
517c478bd9Sstevel@tonic-gate #include <sys/door.h>
527c478bd9Sstevel@tonic-gate #include <sys/sem.h>
537c478bd9Sstevel@tonic-gate #include <sys/msg.h>
547c478bd9Sstevel@tonic-gate #include <sys/shm.h>
557c478bd9Sstevel@tonic-gate #include <sys/kmem.h>
567c478bd9Sstevel@tonic-gate #include <sys/file.h>		/* for accept */
577c478bd9Sstevel@tonic-gate #include <sys/utssys.h>		/* for fuser */
5845916cd2Sjpk #include <sys/tsol/label.h>
5961b9bf51Srica #include <sys/tsol/tndb.h>
6061b9bf51Srica #include <sys/tsol/tsyscall.h>
617c478bd9Sstevel@tonic-gate #include <c2/audit.h>
627c478bd9Sstevel@tonic-gate #include <c2/audit_kernel.h>
637c478bd9Sstevel@tonic-gate #include <c2/audit_kevents.h>
647c478bd9Sstevel@tonic-gate #include <c2/audit_record.h>
657c478bd9Sstevel@tonic-gate #include <sys/procset.h>
667c478bd9Sstevel@tonic-gate #include <nfs/mount.h>
677c478bd9Sstevel@tonic-gate #include <sys/param.h>
687c478bd9Sstevel@tonic-gate #include <sys/debug.h>
697c478bd9Sstevel@tonic-gate #include <sys/sysmacros.h>
707c478bd9Sstevel@tonic-gate #include <sys/stream.h>
717c478bd9Sstevel@tonic-gate #include <sys/strsubr.h>
727c478bd9Sstevel@tonic-gate #include <sys/stropts.h>
737c478bd9Sstevel@tonic-gate #include <sys/tihdr.h>
747c478bd9Sstevel@tonic-gate #include <sys/socket.h>
757c478bd9Sstevel@tonic-gate #include <sys/socketvar.h>
760f1702c5SYu Xiangning #include <sys/vfs_opreg.h>
770f1702c5SYu Xiangning #include <fs/sockfs/sockcommon.h>
787c478bd9Sstevel@tonic-gate #include <netinet/in.h>
797c478bd9Sstevel@tonic-gate #include <sys/ddi.h>
80df2381bfSpraks #include <sys/port_impl.h>
81d2a70789SRichard Lowe #include <sys/secflags.h>
82df2381bfSpraks 
838fd04b83SRoger A. Faulkner static au_event_t	aui_fchownat(au_event_t);
84794f0adbSRoger A. Faulkner static au_event_t	aui_fchmodat(au_event_t);
857c478bd9Sstevel@tonic-gate static au_event_t	aui_open(au_event_t);
868fd04b83SRoger A. Faulkner static au_event_t	aui_openat(au_event_t);
878fd04b83SRoger A. Faulkner static au_event_t	aui_unlinkat(au_event_t);
888fd04b83SRoger A. Faulkner static au_event_t	aui_fstatat(au_event_t);
897c478bd9Sstevel@tonic-gate static au_event_t	aui_msgsys(au_event_t);
907c478bd9Sstevel@tonic-gate static au_event_t	aui_shmsys(au_event_t);
917c478bd9Sstevel@tonic-gate static au_event_t	aui_semsys(au_event_t);
927c478bd9Sstevel@tonic-gate static au_event_t	aui_utssys(au_event_t);
937c478bd9Sstevel@tonic-gate static au_event_t	aui_fcntl(au_event_t);
947c478bd9Sstevel@tonic-gate static au_event_t	aui_execve(au_event_t);
957c478bd9Sstevel@tonic-gate static au_event_t	aui_memcntl(au_event_t);
967c478bd9Sstevel@tonic-gate static au_event_t	aui_sysinfo(au_event_t);
97df2381bfSpraks static au_event_t	aui_portfs(au_event_t);
987c478bd9Sstevel@tonic-gate static au_event_t	aui_auditsys(au_event_t);
997c478bd9Sstevel@tonic-gate static au_event_t	aui_modctl(au_event_t);
1007c478bd9Sstevel@tonic-gate static au_event_t	aui_acl(au_event_t);
1017c478bd9Sstevel@tonic-gate static au_event_t	aui_doorfs(au_event_t);
1027c478bd9Sstevel@tonic-gate static au_event_t	aui_privsys(au_event_t);
103657b1f3dSraf static au_event_t	aui_forksys(au_event_t);
10461b9bf51Srica static au_event_t	aui_labelsys(au_event_t);
1054be8c573SJan Friedel static au_event_t	aui_setpgrp(au_event_t);
1067c478bd9Sstevel@tonic-gate 
107d2a70789SRichard Lowe 
108cb49a9fdSMarek Pospisil static void	aus_exit(struct t_audit_data *);
1097c478bd9Sstevel@tonic-gate static void	aus_open(struct t_audit_data *);
1108fd04b83SRoger A. Faulkner static void	aus_openat(struct t_audit_data *);
1117c478bd9Sstevel@tonic-gate static void	aus_acl(struct t_audit_data *);
1127c478bd9Sstevel@tonic-gate static void	aus_acct(struct t_audit_data *);
1137c478bd9Sstevel@tonic-gate static void	aus_chown(struct t_audit_data *);
1147c478bd9Sstevel@tonic-gate static void	aus_fchown(struct t_audit_data *);
1157c478bd9Sstevel@tonic-gate static void	aus_lchown(struct t_audit_data *);
1168fd04b83SRoger A. Faulkner static void	aus_fchownat(struct t_audit_data *);
1177c478bd9Sstevel@tonic-gate static void	aus_chmod(struct t_audit_data *);
1187c478bd9Sstevel@tonic-gate static void	aus_facl(struct t_audit_data *);
1197c478bd9Sstevel@tonic-gate static void	aus_fchmod(struct t_audit_data *);
120794f0adbSRoger A. Faulkner static void	aus_fchmodat(struct t_audit_data *);
1217c478bd9Sstevel@tonic-gate static void	aus_fcntl(struct t_audit_data *);
1227c478bd9Sstevel@tonic-gate static void	aus_mkdir(struct t_audit_data *);
123794f0adbSRoger A. Faulkner static void	aus_mkdirat(struct t_audit_data *);
1247c478bd9Sstevel@tonic-gate static void	aus_mknod(struct t_audit_data *);
125794f0adbSRoger A. Faulkner static void	aus_mknodat(struct t_audit_data *);
1267c478bd9Sstevel@tonic-gate static void	aus_mount(struct t_audit_data *);
1277c478bd9Sstevel@tonic-gate static void	aus_umount2(struct t_audit_data *);
1287c478bd9Sstevel@tonic-gate static void	aus_msgsys(struct t_audit_data *);
1297c478bd9Sstevel@tonic-gate static void	aus_semsys(struct t_audit_data *);
1307c478bd9Sstevel@tonic-gate static void	aus_close(struct t_audit_data *);
1317c478bd9Sstevel@tonic-gate static void	aus_fstatfs(struct t_audit_data *);
1327c478bd9Sstevel@tonic-gate static void	aus_setgid(struct t_audit_data *);
1334be8c573SJan Friedel static void	aus_setpgrp(struct t_audit_data *);
1347c478bd9Sstevel@tonic-gate static void	aus_setuid(struct t_audit_data *);
1357c478bd9Sstevel@tonic-gate static void	aus_shmsys(struct t_audit_data *);
1367c478bd9Sstevel@tonic-gate static void	aus_doorfs(struct t_audit_data *);
1377c478bd9Sstevel@tonic-gate static void	aus_ioctl(struct t_audit_data *);
1387c478bd9Sstevel@tonic-gate static void	aus_memcntl(struct t_audit_data *);
1397c478bd9Sstevel@tonic-gate static void	aus_mmap(struct t_audit_data *);
1407c478bd9Sstevel@tonic-gate static void	aus_munmap(struct t_audit_data *);
1417c478bd9Sstevel@tonic-gate static void	aus_priocntlsys(struct t_audit_data *);
1427c478bd9Sstevel@tonic-gate static void	aus_setegid(struct t_audit_data *);
1437c478bd9Sstevel@tonic-gate static void	aus_setgroups(struct t_audit_data *);
1447c478bd9Sstevel@tonic-gate static void	aus_seteuid(struct t_audit_data *);
1457c478bd9Sstevel@tonic-gate static void	aus_putmsg(struct t_audit_data *);
1467c478bd9Sstevel@tonic-gate static void	aus_putpmsg(struct t_audit_data *);
1477c478bd9Sstevel@tonic-gate static void	aus_getmsg(struct t_audit_data *);
1487c478bd9Sstevel@tonic-gate static void	aus_getpmsg(struct t_audit_data *);
1497c478bd9Sstevel@tonic-gate static void	aus_auditsys(struct t_audit_data *);
1507c478bd9Sstevel@tonic-gate static void	aus_sysinfo(struct t_audit_data *);
1517c478bd9Sstevel@tonic-gate static void	aus_modctl(struct t_audit_data *);
1527c478bd9Sstevel@tonic-gate static void	aus_kill(struct t_audit_data *);
1537c478bd9Sstevel@tonic-gate static void	aus_setregid(struct t_audit_data *);
1547c478bd9Sstevel@tonic-gate static void	aus_setreuid(struct t_audit_data *);
15561b9bf51Srica static void	aus_labelsys(struct t_audit_data *);
1567c478bd9Sstevel@tonic-gate 
1577c478bd9Sstevel@tonic-gate static void	auf_mknod(struct t_audit_data *, int, rval_t *);
158794f0adbSRoger A. Faulkner static void	auf_mknodat(struct t_audit_data *, int, rval_t *);
1597c478bd9Sstevel@tonic-gate static void	auf_msgsys(struct t_audit_data *, int, rval_t *);
1607c478bd9Sstevel@tonic-gate static void	auf_semsys(struct t_audit_data *, int, rval_t *);
1617c478bd9Sstevel@tonic-gate static void	auf_shmsys(struct t_audit_data *, int, rval_t *);
1627c478bd9Sstevel@tonic-gate static void	auf_read(struct t_audit_data *, int, rval_t *);
1637c478bd9Sstevel@tonic-gate static void	auf_write(struct t_audit_data *, int, rval_t *);
1647c478bd9Sstevel@tonic-gate 
1657c478bd9Sstevel@tonic-gate static void	aus_sigqueue(struct t_audit_data *);
1667c478bd9Sstevel@tonic-gate static void	aus_p_online(struct t_audit_data *);
1677c478bd9Sstevel@tonic-gate static void	aus_processor_bind(struct t_audit_data *);
1687c478bd9Sstevel@tonic-gate static void	aus_inst_sync(struct t_audit_data *);
1699acbbeafSnn static void	aus_brandsys(struct t_audit_data *);
1707c478bd9Sstevel@tonic-gate 
1717c478bd9Sstevel@tonic-gate static void	auf_accept(struct t_audit_data *, int, rval_t *);
1727c478bd9Sstevel@tonic-gate 
1737c478bd9Sstevel@tonic-gate static void	auf_bind(struct t_audit_data *, int, rval_t *);
1747c478bd9Sstevel@tonic-gate static void	auf_connect(struct t_audit_data *, int, rval_t *);
1757c478bd9Sstevel@tonic-gate static void	aus_shutdown(struct t_audit_data *);
1767c478bd9Sstevel@tonic-gate static void	auf_setsockopt(struct t_audit_data *, int, rval_t *);
1777c478bd9Sstevel@tonic-gate static void	aus_sockconfig(struct t_audit_data *);
1787c478bd9Sstevel@tonic-gate static void	auf_recv(struct t_audit_data *, int, rval_t *);
1797c478bd9Sstevel@tonic-gate static void	auf_recvmsg(struct t_audit_data *, int, rval_t *);
1807c478bd9Sstevel@tonic-gate static void	auf_send(struct t_audit_data *, int, rval_t *);
1817c478bd9Sstevel@tonic-gate static void	auf_sendmsg(struct t_audit_data *, int, rval_t *);
1827c478bd9Sstevel@tonic-gate static void	auf_recvfrom(struct t_audit_data *, int, rval_t *);
1837c478bd9Sstevel@tonic-gate static void	auf_sendto(struct t_audit_data *, int, rval_t *);
1847c478bd9Sstevel@tonic-gate static void	aus_socket(struct t_audit_data *);
1857c478bd9Sstevel@tonic-gate /*
1867c478bd9Sstevel@tonic-gate  * This table contains mapping information for converting system call numbers
1877c478bd9Sstevel@tonic-gate  * to audit event IDs. In several cases it is necessary to map a single system
1887c478bd9Sstevel@tonic-gate  * call to several events.
1897c478bd9Sstevel@tonic-gate  */
1907c478bd9Sstevel@tonic-gate 
191f9d0e028Sgww #define	aui_null	NULL	/* NULL initialize function */
192f9d0e028Sgww #define	aus_null	NULL	/* NULL start function */
193f9d0e028Sgww #define	auf_null	NULL	/* NULL finish function */
194f9d0e028Sgww 
1957c478bd9Sstevel@tonic-gate struct audit_s2e audit_s2e[] =
1967c478bd9Sstevel@tonic-gate {
1977c478bd9Sstevel@tonic-gate /*
1980f48f68dSToomas Soome  * ----------	----------	----------	----------
1997c478bd9Sstevel@tonic-gate  * INITIAL	AUDIT		START		SYSTEM
2007c478bd9Sstevel@tonic-gate  * PROCESSING	EVENT		PROCESSING	CALL
2017c478bd9Sstevel@tonic-gate  * ----------	----------	----------	-----------
2027c478bd9Sstevel@tonic-gate  *		FINISH		EVENT
2037c478bd9Sstevel@tonic-gate  *		PROCESSING	CONTROL
2047c478bd9Sstevel@tonic-gate  * ----------------------------------------------------------
2057c478bd9Sstevel@tonic-gate  */
2067c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 0 unused (indirect) */
2077c478bd9Sstevel@tonic-gate 		auf_null,	0,
208cb49a9fdSMarek Pospisil aui_null,	AUE_EXIT,	aus_exit,	/* 1 exit */
2097c478bd9Sstevel@tonic-gate 		auf_null,	S2E_NPT,
210d2a70789SRichard Lowe aui_null,	AUE_PSECFLAGS,	aus_null,	/* 2 psecflags */
2117c478bd9Sstevel@tonic-gate 		auf_null,	0,
2127c478bd9Sstevel@tonic-gate aui_null,	AUE_READ,	aus_null,	/* 3 read */
2137c478bd9Sstevel@tonic-gate 		auf_read,	S2E_PUB,
2147c478bd9Sstevel@tonic-gate aui_null,	AUE_WRITE,	aus_null,	/* 4 write */
2157c478bd9Sstevel@tonic-gate 		auf_write,	0,
2167c478bd9Sstevel@tonic-gate aui_open,	AUE_OPEN,	aus_open,	/* 5 open */
2177c478bd9Sstevel@tonic-gate 		auf_null,	S2E_SP,
2187c478bd9Sstevel@tonic-gate aui_null,	AUE_CLOSE,	aus_close,	/* 6 close */
2197c478bd9Sstevel@tonic-gate 		auf_null,	0,
220794f0adbSRoger A. Faulkner aui_null,	AUE_LINK,	aus_null,	/* 7 linkat */
2218fd04b83SRoger A. Faulkner 		auf_null,	0,
2228fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 8 (loadable) was creat */
2237c478bd9Sstevel@tonic-gate 		auf_null,	0,
2247c478bd9Sstevel@tonic-gate aui_null,	AUE_LINK,	aus_null,	/* 9 link */
2257c478bd9Sstevel@tonic-gate 		auf_null,	0,
2267c478bd9Sstevel@tonic-gate aui_null,	AUE_UNLINK,	aus_null,	/* 10 unlink */
2277c478bd9Sstevel@tonic-gate 		auf_null,	0,
228794f0adbSRoger A. Faulkner aui_null,	AUE_SYMLINK,	aus_null,	/* 11 symlinkat */
2298fd04b83SRoger A. Faulkner 		auf_null,	0,
2307c478bd9Sstevel@tonic-gate aui_null,	AUE_CHDIR,	aus_null,	/* 12 chdir */
2317c478bd9Sstevel@tonic-gate 		auf_null,	S2E_SP,
2327c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 13 time */
2337c478bd9Sstevel@tonic-gate 		auf_null,	0,
2347c478bd9Sstevel@tonic-gate aui_null,	AUE_MKNOD,	aus_mknod,	/* 14 mknod */
235794f0adbSRoger A. Faulkner 		auf_mknod,	S2E_MLD,
2367c478bd9Sstevel@tonic-gate aui_null,	AUE_CHMOD,	aus_chmod,	/* 15 chmod */
2377c478bd9Sstevel@tonic-gate 		auf_null,	0,
2387c478bd9Sstevel@tonic-gate aui_null,	AUE_CHOWN,	aus_chown,	/* 16 chown */
2397c478bd9Sstevel@tonic-gate 		auf_null,	0,
2407c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 17 brk */
2417c478bd9Sstevel@tonic-gate 		auf_null,	0,
2427c478bd9Sstevel@tonic-gate aui_null,	AUE_STAT,	aus_null,	/* 18 stat */
2437c478bd9Sstevel@tonic-gate 		auf_null,	S2E_PUB,
2447c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 19 lseek */
2457c478bd9Sstevel@tonic-gate 		auf_null,	0,
2467c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 20 getpid */
2477c478bd9Sstevel@tonic-gate 		auf_null,	0,
2487c478bd9Sstevel@tonic-gate aui_null,	AUE_MOUNT,	aus_mount,	/* 21 mount */
2497c478bd9Sstevel@tonic-gate 		auf_null,	S2E_MLD,
250794f0adbSRoger A. Faulkner aui_null,	AUE_READLINK,	aus_null,	/* 22 readlinkat */
251794f0adbSRoger A. Faulkner 		auf_null,	S2E_PUB,
2527c478bd9Sstevel@tonic-gate aui_null,	AUE_SETUID,	aus_setuid,	/* 23 setuid */
2537c478bd9Sstevel@tonic-gate 		auf_null,	0,
2547c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 24 getuid */
2557c478bd9Sstevel@tonic-gate 		auf_null,	0,
2567c478bd9Sstevel@tonic-gate aui_null,	AUE_STIME,	aus_null,	/* 25 stime */
2577c478bd9Sstevel@tonic-gate 		auf_null,	0,
2588fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 26 pcsample */
2597c478bd9Sstevel@tonic-gate 		auf_null,	0,
2607c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 27 alarm */
2617c478bd9Sstevel@tonic-gate 		auf_null,	0,
2627c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 28 fstat */
2637c478bd9Sstevel@tonic-gate 		auf_null,	0,
2647c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 29 pause */
2657c478bd9Sstevel@tonic-gate 		auf_null,	0,
2668fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 30 (loadable) was utime */
2677c478bd9Sstevel@tonic-gate 		auf_null,	0,
2687c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 31 stty (TIOCSETP-audit?) */
2697c478bd9Sstevel@tonic-gate 		auf_null,	0,
2707c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 32 gtty */
2717c478bd9Sstevel@tonic-gate 		auf_null,	0,
2727c478bd9Sstevel@tonic-gate aui_null,	AUE_ACCESS,	aus_null,	/* 33 access */
2737c478bd9Sstevel@tonic-gate 		auf_null,	S2E_PUB,
2747c478bd9Sstevel@tonic-gate aui_null,	AUE_NICE,	aus_null,	/* 34 nice */
2757c478bd9Sstevel@tonic-gate 		auf_null,	0,
2767c478bd9Sstevel@tonic-gate aui_null,	AUE_STATFS,	aus_null,	/* 35 statfs */
2777c478bd9Sstevel@tonic-gate 		auf_null,	S2E_PUB,
2787c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 36 sync */
2797c478bd9Sstevel@tonic-gate 		auf_null,	0,
2807c478bd9Sstevel@tonic-gate aui_null,	AUE_KILL,	aus_kill,	/* 37 kill */
2817c478bd9Sstevel@tonic-gate 		auf_null,	0,
2827c478bd9Sstevel@tonic-gate aui_null,	AUE_FSTATFS,	aus_fstatfs,	/* 38 fstatfs */
2837c478bd9Sstevel@tonic-gate 		auf_null,	S2E_PUB,
2844be8c573SJan Friedel aui_setpgrp,	AUE_SETPGRP,	aus_setpgrp,	/* 39 setpgrp */
2857c478bd9Sstevel@tonic-gate 		auf_null,	0,
2869acbbeafSnn aui_null,	AUE_NULL,	aus_null,	/* 40 uucopystr */
2877c478bd9Sstevel@tonic-gate 		auf_null,	0,
2888fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 41 (loadable) was dup */
2897c478bd9Sstevel@tonic-gate 		auf_null,	0,
2908fd04b83SRoger A. Faulkner aui_null,	AUE_PIPE,	aus_null,	/* 42 (loadable) pipe */
2917c478bd9Sstevel@tonic-gate 		auf_null,	0,
2927c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 43 times */
2937c478bd9Sstevel@tonic-gate 		auf_null,	0,
2947c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 44 profil */
2957c478bd9Sstevel@tonic-gate 		auf_null,	0,
2968fd04b83SRoger A. Faulkner aui_null,	AUE_ACCESS,	aus_null,	/* 45 faccessat */
297c4d3e299SBrent Paulson 		auf_null,	S2E_PUB,
2987c478bd9Sstevel@tonic-gate aui_null,	AUE_SETGID,	aus_setgid,	/* 46 setgid */
2997c478bd9Sstevel@tonic-gate 		auf_null,	0,
3007c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 47 getgid */
3017c478bd9Sstevel@tonic-gate 		auf_null,	0,
302794f0adbSRoger A. Faulkner aui_null,	AUE_MKNOD,	aus_mknodat,	/* 48 mknodat */
303794f0adbSRoger A. Faulkner 		auf_mknodat,	S2E_MLD,
3048fd04b83SRoger A. Faulkner aui_msgsys,	AUE_MSGSYS,	aus_msgsys,	/* 49 (loadable) msgsys */
3057c478bd9Sstevel@tonic-gate 		auf_msgsys,	0,
3067c478bd9Sstevel@tonic-gate #if defined(__x86)
3077c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 50 sysi86 */
3087c478bd9Sstevel@tonic-gate 		auf_null,	0,
3097c478bd9Sstevel@tonic-gate #else
3107c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 50 (loadable) was sys3b */
3117c478bd9Sstevel@tonic-gate 		auf_null,	0,
3127c478bd9Sstevel@tonic-gate #endif /* __x86 */
3138fd04b83SRoger A. Faulkner aui_null,	AUE_ACCT,	aus_acct,	/* 51 (loadable) sysacct */
3147c478bd9Sstevel@tonic-gate 		auf_null,	0,
3158fd04b83SRoger A. Faulkner aui_shmsys,	AUE_SHMSYS,	aus_shmsys,	/* 52 (loadable) shmsys */
3167c478bd9Sstevel@tonic-gate 		auf_shmsys,	0,
3178fd04b83SRoger A. Faulkner aui_semsys,	AUE_SEMSYS,	aus_semsys,	/* 53 (loadable) semsys */
3187c478bd9Sstevel@tonic-gate 		auf_semsys,	0,
3197c478bd9Sstevel@tonic-gate aui_null,	AUE_IOCTL,	aus_ioctl,	/* 54 ioctl */
3207c478bd9Sstevel@tonic-gate 		auf_null,	0,
3217c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 55 uadmin */
3227c478bd9Sstevel@tonic-gate 		auf_null,	0,
3238fd04b83SRoger A. Faulkner aui_fchownat,	AUE_NULL,	aus_fchownat,	/* 56 fchownat */
324c4d3e299SBrent Paulson 		auf_null,	0,
3257c478bd9Sstevel@tonic-gate aui_utssys,	AUE_FUSERS,	aus_null,	/* 57 utssys */
3267c478bd9Sstevel@tonic-gate 		auf_null,	0,
3277c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 58 fsync */
3287c478bd9Sstevel@tonic-gate 		auf_null,	0,
3297c478bd9Sstevel@tonic-gate aui_execve,	AUE_EXECVE,	aus_null,	/* 59 exece */
3307c478bd9Sstevel@tonic-gate 		auf_null,	S2E_MLD,
3317c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 60 umask */
3327c478bd9Sstevel@tonic-gate 		auf_null,	0,
3337c478bd9Sstevel@tonic-gate aui_null,	AUE_CHROOT,	aus_null,	/* 61 chroot */
3347c478bd9Sstevel@tonic-gate 		auf_null,	S2E_SP,
3357c478bd9Sstevel@tonic-gate aui_fcntl,	AUE_FCNTL,	aus_fcntl,	/* 62 fcntl */
3367c478bd9Sstevel@tonic-gate 		auf_null,	0,
3377c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 63 ulimit */
3387c478bd9Sstevel@tonic-gate 		auf_null,	0,
3398fd04b83SRoger A. Faulkner aui_null,	AUE_RENAME,	aus_null,	/* 64 renameat */
340c4d3e299SBrent Paulson 		auf_null,	0,
3418fd04b83SRoger A. Faulkner aui_unlinkat,	AUE_NULL,	aus_null,	/* 65 unlinkat */
342c4d3e299SBrent Paulson 		auf_null,	0,
3438fd04b83SRoger A. Faulkner aui_fstatat,	AUE_NULL,	aus_null,	/* 66 fstatat */
344c4d3e299SBrent Paulson 		auf_null,	S2E_PUB,
3458fd04b83SRoger A. Faulkner aui_fstatat,	AUE_NULL,	aus_null,	/* 67 fstatat64 */
346c4d3e299SBrent Paulson 		auf_null,	S2E_PUB,
3478fd04b83SRoger A. Faulkner aui_openat,	AUE_OPEN,	aus_openat,	/* 68 openat */
348c4d3e299SBrent Paulson 		auf_null,	S2E_SP,
3498fd04b83SRoger A. Faulkner aui_openat,	AUE_OPEN,	aus_openat,	/* 69 openat64 */
350c4d3e299SBrent Paulson 		auf_null,	S2E_SP,
3518fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 70 tasksys */
3527c478bd9Sstevel@tonic-gate 		auf_null,	0,
3538fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 71 (loadable) acctctl */
3547c478bd9Sstevel@tonic-gate 		auf_null,	0,
3558fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 72 (loadable) exacct */
3567c478bd9Sstevel@tonic-gate 		auf_null,	0,
3578fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 73 getpagesizes */
3587c478bd9Sstevel@tonic-gate 		auf_null,	0,
3598fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 74 rctlsys */
3607c478bd9Sstevel@tonic-gate 		auf_null,	0,
361f48205beScasper aui_null,	AUE_NULL,	aus_null,	/* 75 sidsys */
3627c478bd9Sstevel@tonic-gate 		auf_null,	0,
3638fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 76 (loadable) was fsat */
3647c478bd9Sstevel@tonic-gate 		auf_null,	0,
3658fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 77 syslwp_park */
3667c478bd9Sstevel@tonic-gate 		auf_null,	0,
3678fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 78 sendfilev */
3687c478bd9Sstevel@tonic-gate 		auf_null,	0,
3697c478bd9Sstevel@tonic-gate aui_null,	AUE_RMDIR,	aus_null,	/* 79 rmdir */
3707c478bd9Sstevel@tonic-gate 		auf_null,	0,
3717c478bd9Sstevel@tonic-gate aui_null,	AUE_MKDIR,	aus_mkdir,	/* 80 mkdir */
3727c478bd9Sstevel@tonic-gate 		auf_null,	0,
3737c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 81 getdents */
3747c478bd9Sstevel@tonic-gate 		auf_null,	0,
3757c478bd9Sstevel@tonic-gate aui_privsys,	AUE_NULL,	aus_null,	/* 82 privsys */
3767c478bd9Sstevel@tonic-gate 		auf_null,	0,
3778fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 83 ucredsys */
3787c478bd9Sstevel@tonic-gate 		auf_null,	0,
3797c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 84 sysfs */
3807c478bd9Sstevel@tonic-gate 		auf_null,	0,
3817c478bd9Sstevel@tonic-gate aui_null,	AUE_GETMSG,	aus_getmsg,	/* 85 getmsg */
3827c478bd9Sstevel@tonic-gate 		auf_null,	0,
3837c478bd9Sstevel@tonic-gate aui_null,	AUE_PUTMSG,	aus_putmsg,	/* 86 putmsg */
3847c478bd9Sstevel@tonic-gate 		auf_null,	0,
3858fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 87 (loadable) was poll */
3867c478bd9Sstevel@tonic-gate 		auf_null,	0,
3877c478bd9Sstevel@tonic-gate aui_null,	AUE_LSTAT,	aus_null,	/* 88 lstat */
3887c478bd9Sstevel@tonic-gate 		auf_null,	S2E_PUB,
3897c478bd9Sstevel@tonic-gate aui_null,	AUE_SYMLINK,	aus_null,	/* 89 symlink */
3907c478bd9Sstevel@tonic-gate 		auf_null,	0,
3917c478bd9Sstevel@tonic-gate aui_null,	AUE_READLINK,	aus_null,	/* 90 readlink */
3927c478bd9Sstevel@tonic-gate 		auf_null,	S2E_PUB,
3937c478bd9Sstevel@tonic-gate aui_null,	AUE_SETGROUPS,	aus_setgroups,	/* 91 setgroups */
3947c478bd9Sstevel@tonic-gate 		auf_null,	0,
3957c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 92 getgroups */
3967c478bd9Sstevel@tonic-gate 		auf_null,	0,
3977c478bd9Sstevel@tonic-gate aui_null,	AUE_FCHMOD,	aus_fchmod,	/* 93 fchmod */
3987c478bd9Sstevel@tonic-gate 		auf_null,	0,
3997c478bd9Sstevel@tonic-gate aui_null,	AUE_FCHOWN,	aus_fchown,	/* 94 fchown */
4007c478bd9Sstevel@tonic-gate 		auf_null,	0,
4017c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 95 sigprocmask */
4027c478bd9Sstevel@tonic-gate 		auf_null,	0,
4037c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 96 sigsuspend */
4047c478bd9Sstevel@tonic-gate 		auf_null,	0,
4057c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 97 sigaltstack */
4067c478bd9Sstevel@tonic-gate 		auf_null,	0,
4077c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 98 sigaction */
4087c478bd9Sstevel@tonic-gate 		auf_null,	0,
4097c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 99 sigpending */
4107c478bd9Sstevel@tonic-gate 		auf_null,	0,
4117c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 100 setcontext */
4127c478bd9Sstevel@tonic-gate 		auf_null,	0,
413794f0adbSRoger A. Faulkner aui_fchmodat,	AUE_NULL,	aus_fchmodat,	/* 101 fchmodat */
4147c478bd9Sstevel@tonic-gate 		auf_null,	0,
415794f0adbSRoger A. Faulkner aui_null,	AUE_MKDIR,	aus_mkdirat,	/* 102 mkdirat */
4167c478bd9Sstevel@tonic-gate 		auf_null,	0,
4177c478bd9Sstevel@tonic-gate aui_null,	AUE_STATVFS,	aus_null,	/* 103 statvfs */
4187c478bd9Sstevel@tonic-gate 		auf_null,	S2E_PUB,
4197c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 104 fstatvfs */
4207c478bd9Sstevel@tonic-gate 		auf_null,	0,
4218fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 105 getloadavg */
4227c478bd9Sstevel@tonic-gate 		auf_null,	0,
4237c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 106 nfssys */
4247c478bd9Sstevel@tonic-gate 		auf_null,	0,
4258fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 107 waitsys */
4267c478bd9Sstevel@tonic-gate 		auf_null,	0,
4278fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 108 sigsendsys */
4287c478bd9Sstevel@tonic-gate 		auf_null,	0,
4297c478bd9Sstevel@tonic-gate #if defined(__x86)
4307c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 109 hrtsys */
4317c478bd9Sstevel@tonic-gate 		auf_null,	0,
4327c478bd9Sstevel@tonic-gate #else
4337c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 109 (loadable) */
4347c478bd9Sstevel@tonic-gate 		auf_null,	0,
4357c478bd9Sstevel@tonic-gate #endif /* __x86 */
4368fd04b83SRoger A. Faulkner aui_null,	AUE_UTIMES,	aus_null,	/* 110 utimesys */
437c4d3e299SBrent Paulson 		auf_null,	0,
4388fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 111 sigresend */
4397c478bd9Sstevel@tonic-gate 		auf_null,	0,
4408fd04b83SRoger A. Faulkner aui_null,	AUE_PRIOCNTLSYS, aus_priocntlsys, /* 112 priocntlsys */
4417c478bd9Sstevel@tonic-gate 		auf_null,	0,
4427c478bd9Sstevel@tonic-gate aui_null,	AUE_PATHCONF,	aus_null,	/* 113 pathconf */
4437c478bd9Sstevel@tonic-gate 		auf_null,	S2E_PUB,
4447c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 114 mincore */
4457c478bd9Sstevel@tonic-gate 		auf_null,	0,
4467c478bd9Sstevel@tonic-gate aui_null,	AUE_MMAP,	aus_mmap,	/* 115 mmap */
4477c478bd9Sstevel@tonic-gate 		auf_null,	0,
4487c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 116 mprotect */
4497c478bd9Sstevel@tonic-gate 		auf_null,	0,
4507c478bd9Sstevel@tonic-gate aui_null,	AUE_MUNMAP,	aus_munmap,	/* 117 munmap */
4517c478bd9Sstevel@tonic-gate 		auf_null,	0,
4527c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 118 fpathconf */
4537c478bd9Sstevel@tonic-gate 		auf_null,	0,
4547c478bd9Sstevel@tonic-gate aui_null,	AUE_VFORK,	aus_null,	/* 119 vfork */
4557c478bd9Sstevel@tonic-gate 		auf_null,	0,
4567c478bd9Sstevel@tonic-gate aui_null,	AUE_FCHDIR,	aus_null,	/* 120 fchdir */
4577c478bd9Sstevel@tonic-gate 		auf_null,	0,
4587c478bd9Sstevel@tonic-gate aui_null,	AUE_READ,	aus_null,	/* 121 readv */
4597c478bd9Sstevel@tonic-gate 		auf_read,	S2E_PUB,
4607c478bd9Sstevel@tonic-gate aui_null,	AUE_WRITE,	aus_null,	/* 122 writev */
4617c478bd9Sstevel@tonic-gate 		auf_write,	0,
4628fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 123 (loadable) was xstat */
4637c478bd9Sstevel@tonic-gate 		auf_null,	0,
4648fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 124 (loadable) was lxstat */
4658fd04b83SRoger A. Faulkner 		auf_null,	0,
4668fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 125 (loadable) was fxstat */
4678fd04b83SRoger A. Faulkner 		auf_null,	0,
4688fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 126 (loadable) was xmknod */
4698fd04b83SRoger A. Faulkner 		auf_null,	0,
4708fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 127 mmapobj */
4717c478bd9Sstevel@tonic-gate 		auf_null,	0,
4727c478bd9Sstevel@tonic-gate aui_null,	AUE_SETRLIMIT,	aus_null,	/* 128 setrlimit */
4737c478bd9Sstevel@tonic-gate 		auf_null,	0,
4747c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 129 getrlimit */
4757c478bd9Sstevel@tonic-gate 		auf_null,	0,
4767c478bd9Sstevel@tonic-gate aui_null,	AUE_LCHOWN,	aus_lchown,	/* 130 lchown */
4777c478bd9Sstevel@tonic-gate 		auf_null,	0,
4787c478bd9Sstevel@tonic-gate aui_memcntl,	AUE_MEMCNTL,	aus_memcntl,	/* 131 memcntl */
4797c478bd9Sstevel@tonic-gate 		auf_null,	0,
4807c478bd9Sstevel@tonic-gate aui_null,	AUE_GETPMSG,	aus_getpmsg,	/* 132 getpmsg */
4817c478bd9Sstevel@tonic-gate 		auf_null,	0,
4827c478bd9Sstevel@tonic-gate aui_null,	AUE_PUTPMSG,	aus_putpmsg,	/* 133 putpmsg */
4837c478bd9Sstevel@tonic-gate 		auf_null,	0,
4847c478bd9Sstevel@tonic-gate aui_null,	AUE_RENAME,	aus_null,	/* 134 rename */
4857c478bd9Sstevel@tonic-gate 		auf_null,	0,
4867c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 135 uname */
4877c478bd9Sstevel@tonic-gate 		auf_null,	0,
4887c478bd9Sstevel@tonic-gate aui_null,	AUE_SETEGID,	aus_setegid,	/* 136 setegid */
4897c478bd9Sstevel@tonic-gate 		auf_null,	0,
4907c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 137 sysconfig */
4917c478bd9Sstevel@tonic-gate 		auf_null,	0,
4927c478bd9Sstevel@tonic-gate aui_null,	AUE_ADJTIME,	aus_null,	/* 138 adjtime */
4937c478bd9Sstevel@tonic-gate 		auf_null,	0,
4947c478bd9Sstevel@tonic-gate aui_sysinfo,	AUE_SYSINFO,	aus_sysinfo,	/* 139 systeminfo */
4957c478bd9Sstevel@tonic-gate 		auf_null,	0,
4968fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 140 (loadable) sharefs */
4977c478bd9Sstevel@tonic-gate 		auf_null,	0,
4987c478bd9Sstevel@tonic-gate aui_null,	AUE_SETEUID,	aus_seteuid,	/* 141 seteuid */
4997c478bd9Sstevel@tonic-gate 		auf_null,	0,
500657b1f3dSraf aui_forksys,	AUE_NULL,	aus_null,	/* 142 forksys */
5017c478bd9Sstevel@tonic-gate 		auf_null,	0,
5028fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 143 (loadable) was fork1 */
5037c478bd9Sstevel@tonic-gate 		auf_null,	0,
5047c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 144 sigwait */
5057c478bd9Sstevel@tonic-gate 		auf_null,	0,
5067c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 145 lwp_info */
5077c478bd9Sstevel@tonic-gate 		auf_null,	0,
5087c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 146 yield */
5097c478bd9Sstevel@tonic-gate 		auf_null,	0,
5108fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 147 (loadable) */
5118fd04b83SRoger A. Faulkner 						/*	was lwp_sema_wait */
5127c478bd9Sstevel@tonic-gate 		auf_null,	0,
5137c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 148 lwp_sema_post */
5147c478bd9Sstevel@tonic-gate 		auf_null,	0,
5157c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 149 lwp_sema_trywait */
5167c478bd9Sstevel@tonic-gate 		auf_null,	0,
5178fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 150 lwp_detach */
5187c478bd9Sstevel@tonic-gate 		auf_null,	0,
5198fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 151 corectl */
5207c478bd9Sstevel@tonic-gate 		auf_null,	0,
5217c478bd9Sstevel@tonic-gate aui_modctl,	AUE_MODCTL,	aus_modctl,	/* 152 modctl */
5227c478bd9Sstevel@tonic-gate 		auf_null,	0,
5237c478bd9Sstevel@tonic-gate aui_null,	AUE_FCHROOT,	aus_null,	/* 153 fchroot */
5247c478bd9Sstevel@tonic-gate 		auf_null,	0,
5258fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 154 (loadable) was utimes */
5267c478bd9Sstevel@tonic-gate 		auf_null,	0,
5277c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 155 vhangup */
5287c478bd9Sstevel@tonic-gate 		auf_null,	0,
5297c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 156 gettimeofday */
5307c478bd9Sstevel@tonic-gate 		auf_null,	0,
5317c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 157 getitimer */
5327c478bd9Sstevel@tonic-gate 		auf_null,	0,
5337c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 158 setitimer */
5347c478bd9Sstevel@tonic-gate 		auf_null,	0,
5357c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 159 lwp_create */
5367c478bd9Sstevel@tonic-gate 		auf_null,	0,
5377c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 160 lwp_exit */
5387c478bd9Sstevel@tonic-gate 		auf_null,	0,
5397c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 161 lwp_suspend */
5407c478bd9Sstevel@tonic-gate 		auf_null,	0,
5417c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 162 lwp_continue */
5427c478bd9Sstevel@tonic-gate 		auf_null,	0,
5437c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 163 lwp_kill */
5447c478bd9Sstevel@tonic-gate 		auf_null,	0,
5457c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 164 lwp_self */
5467c478bd9Sstevel@tonic-gate 		auf_null,	0,
5478fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 165 lwp_sigmask */
5487c478bd9Sstevel@tonic-gate 		auf_null,	0,
5498fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 166 lwp_private */
5507c478bd9Sstevel@tonic-gate 		auf_null,	0,
5517c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 167 lwp_wait */
5527c478bd9Sstevel@tonic-gate 		auf_null,	0,
553883492d5Sraf aui_null,	AUE_NULL,	aus_null,	/* 168 lwp_mutex_wakeup  */
5547c478bd9Sstevel@tonic-gate 		auf_null,	0,
5558fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 169 (loadable) */
5568fd04b83SRoger A. Faulkner 						/*	was lwp_mutex_lock */
5577c478bd9Sstevel@tonic-gate 		auf_null,	0,
5587c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 170 lwp_cond_wait */
5597c478bd9Sstevel@tonic-gate 		auf_null,	0,
5607c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 171 lwp_cond_signal */
5617c478bd9Sstevel@tonic-gate 		auf_null,	0,
5627c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 172 lwp_cond_broadcast */
5637c478bd9Sstevel@tonic-gate 		auf_null,	0,
5647c478bd9Sstevel@tonic-gate aui_null,	AUE_READ,	aus_null,	/* 173 pread */
5657c478bd9Sstevel@tonic-gate 		auf_read,	S2E_PUB,
5667c478bd9Sstevel@tonic-gate aui_null,	AUE_WRITE,	aus_null,	/* 174 pwrite */
5677c478bd9Sstevel@tonic-gate 		auf_write,	0,
5687c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 175 llseek */
5697c478bd9Sstevel@tonic-gate 		auf_null,	0,
5708fd04b83SRoger A. Faulkner aui_null,	AUE_INST_SYNC,	aus_inst_sync,  /* 176 (loadable) inst_sync */
5717c478bd9Sstevel@tonic-gate 		auf_null,	0,
5729acbbeafSnn aui_null,	AUE_BRANDSYS,	aus_brandsys,	/* 177 brandsys */
5737c478bd9Sstevel@tonic-gate 		auf_null,	0,
5748fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 178 (loadable) kaio */
5757c478bd9Sstevel@tonic-gate 		auf_null,	0,
5768fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 179 (loadable) cpc */
5777c478bd9Sstevel@tonic-gate 		auf_null,	0,
5788fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 180 lgrpsys */
5797c478bd9Sstevel@tonic-gate 		auf_null,	0,
5808fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 181 rusagesys */
5817c478bd9Sstevel@tonic-gate 		auf_null,	0,
582df2381bfSpraks aui_portfs,	AUE_PORTFS,	aus_null,	/* 182 (loadable) portfs */
5837e309bc2SJan Friedel 		auf_null,	S2E_MLD,
5848fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 183 pollsys */
5857c478bd9Sstevel@tonic-gate 		auf_null,	0,
58661b9bf51Srica aui_labelsys,	AUE_NULL,	aus_labelsys,	/* 184 labelsys */
5877c478bd9Sstevel@tonic-gate 		auf_null,	0,
5887c478bd9Sstevel@tonic-gate aui_acl,	AUE_ACLSET,	aus_acl,	/* 185 acl */
5897c478bd9Sstevel@tonic-gate 		auf_null,	0,
5907c478bd9Sstevel@tonic-gate aui_auditsys,	AUE_AUDITSYS,	aus_auditsys,	/* 186 auditsys  */
5917c478bd9Sstevel@tonic-gate 		auf_null,	0,
5928fd04b83SRoger A. Faulkner aui_null,	AUE_PROCESSOR_BIND, aus_processor_bind, /* 187 processor_bind */
5938fd04b83SRoger A. Faulkner 		auf_null,	0,
5947c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 188 processor_info */
5957c478bd9Sstevel@tonic-gate 		auf_null,	0,
5967c478bd9Sstevel@tonic-gate aui_null,	AUE_P_ONLINE,	aus_p_online,	/* 189 p_online */
5977c478bd9Sstevel@tonic-gate 		auf_null,	0,
5987c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_sigqueue,	/* 190 sigqueue */
5997c478bd9Sstevel@tonic-gate 		auf_null,	0,
6007c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 191 clock_gettime */
6017c478bd9Sstevel@tonic-gate 		auf_null,	0,
6027c478bd9Sstevel@tonic-gate aui_null,	AUE_CLOCK_SETTIME,	aus_null,	/* 192 clock_settime */
6037c478bd9Sstevel@tonic-gate 		auf_null,	0,
6047c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 193 clock_getres */
6057c478bd9Sstevel@tonic-gate 		auf_null,	0,
6067c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 194 timer_create */
6077c478bd9Sstevel@tonic-gate 		auf_null,	0,
6087c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 195 timer_delete */
6097c478bd9Sstevel@tonic-gate 		auf_null,	0,
6107c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 196 timer_settime */
6117c478bd9Sstevel@tonic-gate 		auf_null,	0,
6127c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 197 timer_gettime */
6137c478bd9Sstevel@tonic-gate 		auf_null,	0,
6147c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 198 timer_getoverrun */
6157c478bd9Sstevel@tonic-gate 		auf_null,	0,
6167c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 199 nanosleep */
6177c478bd9Sstevel@tonic-gate 		auf_null,	0,
6187c478bd9Sstevel@tonic-gate aui_acl,	AUE_FACLSET,	aus_facl,	/* 200 facl */
6197c478bd9Sstevel@tonic-gate 		auf_null,	0,
6207c478bd9Sstevel@tonic-gate aui_doorfs,	AUE_DOORFS,	aus_doorfs,	/* 201 (loadable) doorfs */
6217c478bd9Sstevel@tonic-gate 		auf_null,	0,
6227c478bd9Sstevel@tonic-gate aui_null,	AUE_SETREUID,	aus_setreuid,	/* 202 setreuid */
6237c478bd9Sstevel@tonic-gate 		auf_null,	0,
6247c478bd9Sstevel@tonic-gate aui_null,	AUE_SETREGID,	aus_setregid,	/* 203 setregid */
6257c478bd9Sstevel@tonic-gate 		auf_null,	0,
6267c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 204 install_utrap */
6277c478bd9Sstevel@tonic-gate 		auf_null,	0,
6287c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 205 signotify */
6297c478bd9Sstevel@tonic-gate 		auf_null,	0,
6307c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 206 schedctl */
6317c478bd9Sstevel@tonic-gate 		auf_null,	0,
6327c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 207 (loadable) pset */
6337c478bd9Sstevel@tonic-gate 		auf_null,	0,
6348fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 208 sparc_utrap_install */
6357c478bd9Sstevel@tonic-gate 		auf_null,	0,
6367c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 209 resolvepath */
6377c478bd9Sstevel@tonic-gate 		auf_null,	0,
6387c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 210 lwp_mutex_timedlock */
6397c478bd9Sstevel@tonic-gate 		auf_null,	0,
6407c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 211 lwp_sema_timedwait */
6417c478bd9Sstevel@tonic-gate 		auf_null,	0,
6427c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 212 lwp_rwlock_sys */
6437c478bd9Sstevel@tonic-gate 		auf_null,	0,
6448fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 213 getdents64 */
6457c478bd9Sstevel@tonic-gate 		auf_null,	0,
6467c478bd9Sstevel@tonic-gate aui_null,	AUE_MMAP,	aus_mmap,	/* 214 mmap64 */
6477c478bd9Sstevel@tonic-gate 		auf_null,	0,
6487c478bd9Sstevel@tonic-gate aui_null,	AUE_STAT,	aus_null,	/* 215 stat64 */
6497c478bd9Sstevel@tonic-gate 		auf_null,	S2E_PUB,
6507c478bd9Sstevel@tonic-gate aui_null,	AUE_LSTAT,	aus_null,	/* 216 lstat64 */
6517c478bd9Sstevel@tonic-gate 		auf_null,	S2E_PUB,
6527c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 217 fstat64 */
6537c478bd9Sstevel@tonic-gate 		auf_null,	0,
6547c478bd9Sstevel@tonic-gate aui_null,	AUE_STATVFS,	aus_null,	/* 218 statvfs64 */
6557c478bd9Sstevel@tonic-gate 		auf_null,	S2E_PUB,
6567c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 219 fstatvfs64 */
6577c478bd9Sstevel@tonic-gate 		auf_null,	0,
6587c478bd9Sstevel@tonic-gate aui_null,	AUE_SETRLIMIT,	aus_null,	/* 220 setrlimit64 */
6597c478bd9Sstevel@tonic-gate 		auf_null,	0,
6607c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 221 getrlimit64 */
6617c478bd9Sstevel@tonic-gate 		auf_null,	0,
6627c478bd9Sstevel@tonic-gate aui_null,	AUE_READ,	aus_null,	/* 222 pread64  */
6637c478bd9Sstevel@tonic-gate 		auf_read,	S2E_PUB,
6647c478bd9Sstevel@tonic-gate aui_null,	AUE_WRITE,	aus_null,	/* 223 pwrite64 */
6657c478bd9Sstevel@tonic-gate 		auf_write,	0,
6668fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 224 (loadable) was creat64 */
6678fd04b83SRoger A. Faulkner 		auf_null,	0,
6687c478bd9Sstevel@tonic-gate aui_open,	AUE_OPEN,	aus_open,	/* 225 open64 */
6697c478bd9Sstevel@tonic-gate 		auf_null,	S2E_SP,
6707c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 226 (loadable) rpcsys */
6717c478bd9Sstevel@tonic-gate 		auf_null,	0,
6728fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 227 zone */
6737c478bd9Sstevel@tonic-gate 		auf_null,	0,
6748fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 228 (loadable) autofssys */
6757c478bd9Sstevel@tonic-gate 		auf_null,	0,
6768fd04b83SRoger A. Faulkner aui_null,	AUE_NULL,	aus_null,	/* 229 getcwd */
6777c478bd9Sstevel@tonic-gate 		auf_null,	0,
6787c478bd9Sstevel@tonic-gate aui_null,	AUE_SOCKET,	aus_socket,	/* 230 so_socket */
6797c478bd9Sstevel@tonic-gate 		auf_null,	0,
6807c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 231 so_socketpair */
6817c478bd9Sstevel@tonic-gate 		auf_null,	0,
6827c478bd9Sstevel@tonic-gate aui_null,	AUE_BIND,	aus_null,	/* 232 bind */
6837c478bd9Sstevel@tonic-gate 		auf_bind,	0,
6847c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 233 listen */
6857c478bd9Sstevel@tonic-gate 		auf_null,	0,
6867c478bd9Sstevel@tonic-gate aui_null,	AUE_ACCEPT,	aus_null,	/* 234 accept */
6877c478bd9Sstevel@tonic-gate 		auf_accept,	0,
6887c478bd9Sstevel@tonic-gate aui_null,	AUE_CONNECT,	aus_null,	/* 235 connect */
6897c478bd9Sstevel@tonic-gate 		auf_connect,	0,
6907c478bd9Sstevel@tonic-gate aui_null,	AUE_SHUTDOWN,	aus_shutdown,	/* 236 shutdown */
6917c478bd9Sstevel@tonic-gate 		auf_null,	0,
6927c478bd9Sstevel@tonic-gate aui_null,	AUE_READ,	aus_null,	/* 237 recv */
6937c478bd9Sstevel@tonic-gate 		auf_recv,	0,
6947c478bd9Sstevel@tonic-gate aui_null,	AUE_RECVFROM,	aus_null,	/* 238 recvfrom */
6957c478bd9Sstevel@tonic-gate 		auf_recvfrom,	0,
6967c478bd9Sstevel@tonic-gate aui_null,	AUE_RECVMSG,	aus_null,	/* 239 recvmsg */
6977c478bd9Sstevel@tonic-gate 		auf_recvmsg,	0,
6987c478bd9Sstevel@tonic-gate aui_null,	AUE_WRITE,	aus_null,	/* 240 send */
6997c478bd9Sstevel@tonic-gate 		auf_send,	0,
7007c478bd9Sstevel@tonic-gate aui_null,	AUE_SENDMSG,	aus_null,	/* 241 sendmsg */
7017c478bd9Sstevel@tonic-gate 		auf_sendmsg,	0,
7027c478bd9Sstevel@tonic-gate aui_null,	AUE_SENDTO,	aus_null,	/* 242 sendto */
7037c478bd9Sstevel@tonic-gate 		auf_sendto,	0,
7047c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 243 getpeername */
7057c478bd9Sstevel@tonic-gate 		auf_null,	0,
7067c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 244 getsockname */
7077c478bd9Sstevel@tonic-gate 		auf_null,	0,
7087c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 245 getsockopt */
7097c478bd9Sstevel@tonic-gate 		auf_null,	0,
7107c478bd9Sstevel@tonic-gate aui_null,	AUE_SETSOCKOPT,	aus_null,	/* 246 setsockopt */
7117c478bd9Sstevel@tonic-gate 		auf_setsockopt,	0,
7127c478bd9Sstevel@tonic-gate aui_null,	AUE_SOCKCONFIG,	aus_sockconfig,	/* 247 sockconfig */
7137c478bd9Sstevel@tonic-gate 		auf_null,	0,
7147c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 248 ntp_gettime */
7157c478bd9Sstevel@tonic-gate 		auf_null,	0,
7168fd04b83SRoger A. Faulkner aui_null,	AUE_NTP_ADJTIME, aus_null,	/* 249 ntp_adjtime */
7177c478bd9Sstevel@tonic-gate 		auf_null,	0,
7187c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 250 lwp_mutex_unlock */
7197c478bd9Sstevel@tonic-gate 		auf_null,	0,
7207c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 251 lwp_mutex_trylock */
7217c478bd9Sstevel@tonic-gate 		auf_null,	0,
722883492d5Sraf aui_null,	AUE_NULL,	aus_null,	/* 252 lwp_mutex_register */
7237c478bd9Sstevel@tonic-gate 		auf_null,	0,
7247c478bd9Sstevel@tonic-gate aui_null,	AUE_NULL,	aus_null,	/* 253 cladm */
7257c478bd9Sstevel@tonic-gate 		auf_null,	0,
7269acbbeafSnn aui_null,	AUE_NULL,	aus_null,	/* 254 uucopy */
7277c478bd9Sstevel@tonic-gate 		auf_null,	0,
7287c478bd9Sstevel@tonic-gate aui_null,	AUE_UMOUNT2,	aus_umount2,	/* 255 umount2 */
7297c478bd9Sstevel@tonic-gate 		auf_null,	0
7307c478bd9Sstevel@tonic-gate };
7317c478bd9Sstevel@tonic-gate 
7327c478bd9Sstevel@tonic-gate uint_t num_syscall = sizeof (audit_s2e) / sizeof (struct audit_s2e);
7337c478bd9Sstevel@tonic-gate 
7347c478bd9Sstevel@tonic-gate 
735cb49a9fdSMarek Pospisil /* exit start function */
736cb49a9fdSMarek Pospisil /*ARGSUSED*/
737cb49a9fdSMarek Pospisil static void
aus_exit(struct t_audit_data * tad)738cb49a9fdSMarek Pospisil aus_exit(struct t_audit_data *tad)
739cb49a9fdSMarek Pospisil {
740cb49a9fdSMarek Pospisil 	uint32_t rval;
741cb49a9fdSMarek Pospisil 	struct a {
742cb49a9fdSMarek Pospisil 		long rval;
743cb49a9fdSMarek Pospisil 	} *uap = (struct a *)ttolwp(curthread)->lwp_ap;
744cb49a9fdSMarek Pospisil 
745cb49a9fdSMarek Pospisil 	rval = (uint32_t)uap->rval;
746cb49a9fdSMarek Pospisil 	au_uwrite(au_to_arg32(1, "exit status", rval));
747cb49a9fdSMarek Pospisil }
748cb49a9fdSMarek Pospisil 
749d2a70789SRichard Lowe 
7507c478bd9Sstevel@tonic-gate /* acct start function */
7517c478bd9Sstevel@tonic-gate /*ARGSUSED*/
7527c478bd9Sstevel@tonic-gate static void
aus_acct(struct t_audit_data * tad)7537c478bd9Sstevel@tonic-gate aus_acct(struct t_audit_data *tad)
7547c478bd9Sstevel@tonic-gate {
7557c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
7567c478bd9Sstevel@tonic-gate 	uintptr_t fname;
7577c478bd9Sstevel@tonic-gate 
7587c478bd9Sstevel@tonic-gate 	struct a {
7597c478bd9Sstevel@tonic-gate 		long	fname;		/* char * */
7607c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
7617c478bd9Sstevel@tonic-gate 
7627c478bd9Sstevel@tonic-gate 	fname = (uintptr_t)uap->fname;
7637c478bd9Sstevel@tonic-gate 
7647c478bd9Sstevel@tonic-gate 	if (fname == 0)
7657c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "accounting off", (uint32_t)0));
7667c478bd9Sstevel@tonic-gate }
7677c478bd9Sstevel@tonic-gate 
7687c478bd9Sstevel@tonic-gate /* chown start function */
7697c478bd9Sstevel@tonic-gate /*ARGSUSED*/
7707c478bd9Sstevel@tonic-gate static void
aus_chown(struct t_audit_data * tad)7717c478bd9Sstevel@tonic-gate aus_chown(struct t_audit_data *tad)
7727c478bd9Sstevel@tonic-gate {
7737c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
7747c478bd9Sstevel@tonic-gate 	uint32_t uid, gid;
7757c478bd9Sstevel@tonic-gate 
7767c478bd9Sstevel@tonic-gate 	struct a {
7777c478bd9Sstevel@tonic-gate 		long	fname;		/* char * */
7787c478bd9Sstevel@tonic-gate 		long	uid;
7797c478bd9Sstevel@tonic-gate 		long	gid;
7807c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
7817c478bd9Sstevel@tonic-gate 
7827c478bd9Sstevel@tonic-gate 	uid = (uint32_t)uap->uid;
7837c478bd9Sstevel@tonic-gate 	gid = (uint32_t)uap->gid;
7847c478bd9Sstevel@tonic-gate 
7857c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(2, "new file uid", uid));
7867c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(3, "new file gid", gid));
7877c478bd9Sstevel@tonic-gate }
7887c478bd9Sstevel@tonic-gate 
7897c478bd9Sstevel@tonic-gate /* fchown start function */
7907c478bd9Sstevel@tonic-gate /*ARGSUSED*/
7917c478bd9Sstevel@tonic-gate static void
aus_fchown(struct t_audit_data * tad)7927c478bd9Sstevel@tonic-gate aus_fchown(struct t_audit_data *tad)
7937c478bd9Sstevel@tonic-gate {
7947c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
7957c478bd9Sstevel@tonic-gate 	uint32_t uid, gid, fd;
7967c478bd9Sstevel@tonic-gate 	struct file  *fp;
7977c478bd9Sstevel@tonic-gate 	struct vnode *vp;
7987c478bd9Sstevel@tonic-gate 	struct f_audit_data *fad;
7997c478bd9Sstevel@tonic-gate 
8007c478bd9Sstevel@tonic-gate 	struct a {
8017c478bd9Sstevel@tonic-gate 		long fd;
8027c478bd9Sstevel@tonic-gate 		long uid;
8037c478bd9Sstevel@tonic-gate 		long gid;
8047c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
8057c478bd9Sstevel@tonic-gate 
8067c478bd9Sstevel@tonic-gate 	fd  = (uint32_t)uap->fd;
8077c478bd9Sstevel@tonic-gate 	uid = (uint32_t)uap->uid;
8087c478bd9Sstevel@tonic-gate 	gid = (uint32_t)uap->gid;
8097c478bd9Sstevel@tonic-gate 
8107c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(2, "new file uid", uid));
8117c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(3, "new file gid", gid));
8127c478bd9Sstevel@tonic-gate 
8137c478bd9Sstevel@tonic-gate 		/*
8147c478bd9Sstevel@tonic-gate 		 * convert file pointer to file descriptor
8157c478bd9Sstevel@tonic-gate 		 *   Note: fd ref count incremented here.
8167c478bd9Sstevel@tonic-gate 		 */
8177c478bd9Sstevel@tonic-gate 	if ((fp = getf(fd)) == NULL)
8187c478bd9Sstevel@tonic-gate 		return;
8197c478bd9Sstevel@tonic-gate 
8207c478bd9Sstevel@tonic-gate 	/* get path from file struct here */
8217c478bd9Sstevel@tonic-gate 	fad = F2A(fp);
8227c478bd9Sstevel@tonic-gate 	if (fad->fad_aupath != NULL) {
8237c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_path(fad->fad_aupath));
8247c478bd9Sstevel@tonic-gate 	} else {
8257c478bd9Sstevel@tonic-gate 		au_uwrite(au_to_arg32(1, "no path: fd", fd));
8267c478bd9Sstevel@tonic-gate 	}
8277c478bd9Sstevel@tonic-gate 
8287c478bd9Sstevel@tonic-gate 	vp = fp->f_vnode;
8297c478bd9Sstevel@tonic-gate 	audit_attributes(vp);
8307c478bd9Sstevel@tonic-gate 
8317c478bd9Sstevel@tonic-gate 	/* decrement file descriptor reference count */
8327c478bd9Sstevel@tonic-gate 	releasef(fd);
8337c478bd9Sstevel@tonic-gate }
8347c478bd9Sstevel@tonic-gate 
8357c478bd9Sstevel@tonic-gate /*ARGSUSED*/
8367c478bd9Sstevel@tonic-gate static void
aus_lchown(struct t_audit_data * tad)8377c478bd9Sstevel@tonic-gate aus_lchown(struct t_audit_data *tad)
8387c478bd9Sstevel@tonic-gate {
8397c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
8407c478bd9Sstevel@tonic-gate 	uint32_t uid, gid;
8417c478bd9Sstevel@tonic-gate 
8427c478bd9Sstevel@tonic-gate 
8437c478bd9Sstevel@tonic-gate 	struct a {
8447c478bd9Sstevel@tonic-gate 		long	fname;		/* char	* */
8457c478bd9Sstevel@tonic-gate 		long	uid;
8467c478bd9Sstevel@tonic-gate 		long	gid;
8477c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
8487c478bd9Sstevel@tonic-gate 
8497c478bd9Sstevel@tonic-gate 	uid = (uint32_t)uap->uid;
8507c478bd9Sstevel@tonic-gate 	gid = (uint32_t)uap->gid;
8517c478bd9Sstevel@tonic-gate 
8527c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(2, "new file uid", uid));
8537c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(3, "new file gid", gid));
8547c478bd9Sstevel@tonic-gate }
8557c478bd9Sstevel@tonic-gate 
8568fd04b83SRoger A. Faulkner static au_event_t
aui_fchownat(au_event_t e)8578fd04b83SRoger A. Faulkner aui_fchownat(au_event_t e)
8588fd04b83SRoger A. Faulkner {
8598fd04b83SRoger A. Faulkner 	klwp_t *clwp = ttolwp(curthread);
8608fd04b83SRoger A. Faulkner 
8618fd04b83SRoger A. Faulkner 	struct a {
8628fd04b83SRoger A. Faulkner 		long	fd;
8638fd04b83SRoger A. Faulkner 		long	fname;		/* char * */
8648fd04b83SRoger A. Faulkner 		long	uid;
8658fd04b83SRoger A. Faulkner 		long	gid;
8668fd04b83SRoger A. Faulkner 		long	flags;
8678fd04b83SRoger A. Faulkner 	} *uap = (struct a *)clwp->lwp_ap;
8688fd04b83SRoger A. Faulkner 
8690f48f68dSToomas Soome 	if (uap->fname == 0)
8708fd04b83SRoger A. Faulkner 		e = AUE_FCHOWN;
8718fd04b83SRoger A. Faulkner 	else if (uap->flags & AT_SYMLINK_NOFOLLOW)
8728fd04b83SRoger A. Faulkner 		e = AUE_LCHOWN;
8738fd04b83SRoger A. Faulkner 	else
8748fd04b83SRoger A. Faulkner 		e = AUE_CHOWN;
8758fd04b83SRoger A. Faulkner 
8768fd04b83SRoger A. Faulkner 	return (e);
8778fd04b83SRoger A. Faulkner }
8788fd04b83SRoger A. Faulkner 
8798fd04b83SRoger A. Faulkner /*ARGSUSED*/
8808fd04b83SRoger A. Faulkner static void
aus_fchownat(struct t_audit_data * tad)8818fd04b83SRoger A. Faulkner aus_fchownat(struct t_audit_data *tad)
8828fd04b83SRoger A. Faulkner {
8838fd04b83SRoger A. Faulkner 	klwp_t *clwp = ttolwp(curthread);
8848fd04b83SRoger A. Faulkner 	uint32_t uid, gid;
8858fd04b83SRoger A. Faulkner 
8868fd04b83SRoger A. Faulkner 	struct a {
8878fd04b83SRoger A. Faulkner 		long	fd;
8888fd04b83SRoger A. Faulkner 		long	fname;		/* char * */
8898fd04b83SRoger A. Faulkner 		long	uid;
8908fd04b83SRoger A. Faulkner 		long	gid;
8918fd04b83SRoger A. Faulkner 		long	flags;
8928fd04b83SRoger A. Faulkner 	} *uap = (struct a *)clwp->lwp_ap;
8938fd04b83SRoger A. Faulkner 
8948fd04b83SRoger A. Faulkner 	uid = (uint32_t)uap->uid;
8958fd04b83SRoger A. Faulkner 	gid = (uint32_t)uap->gid;
8968fd04b83SRoger A. Faulkner 
8978fd04b83SRoger A. Faulkner 	au_uwrite(au_to_arg32(3, "new file uid", uid));
8988fd04b83SRoger A. Faulkner 	au_uwrite(au_to_arg32(4, "new file gid", gid));
8998fd04b83SRoger A. Faulkner }
9008fd04b83SRoger A. Faulkner 
9017c478bd9Sstevel@tonic-gate /*ARGSUSED*/
9027c478bd9Sstevel@tonic-gate static void
aus_chmod(struct t_audit_data * tad)9037c478bd9Sstevel@tonic-gate aus_chmod(struct t_audit_data *tad)
9047c478bd9Sstevel@tonic-gate {
9057c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
9067c478bd9Sstevel@tonic-gate 	uint32_t fmode;
9077c478bd9Sstevel@tonic-gate 
9087c478bd9Sstevel@tonic-gate 	struct a {
9097c478bd9Sstevel@tonic-gate 		long	fname;		/* char	* */
9107c478bd9Sstevel@tonic-gate 		long	fmode;
9117c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
9127c478bd9Sstevel@tonic-gate 
9137c478bd9Sstevel@tonic-gate 	fmode = (uint32_t)uap->fmode;
9147c478bd9Sstevel@tonic-gate 
9157c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(2, "new file mode", fmode&07777));
9167c478bd9Sstevel@tonic-gate }
9177c478bd9Sstevel@tonic-gate 
9187c478bd9Sstevel@tonic-gate /*ARGSUSED*/
9197c478bd9Sstevel@tonic-gate static void
aus_fchmod(struct t_audit_data * tad)9207c478bd9Sstevel@tonic-gate aus_fchmod(struct t_audit_data *tad)
9217c478bd9Sstevel@tonic-gate {
9227c478bd9Sstevel@tonic-gate 	klwp_t *clwp = ttolwp(curthread);
9237c478bd9Sstevel@tonic-gate 	uint32_t fmode, fd;
9247c478bd9Sstevel@tonic-gate 	struct file  *fp;
9257c478bd9Sstevel@tonic-gate 	struct vnode *vp;
9267c478bd9Sstevel@tonic-gate 	struct f_audit_data *fad;
9277c478bd9Sstevel@tonic-gate 
9287c478bd9Sstevel@tonic-gate 	struct a {
9297c478bd9Sstevel@tonic-gate 		long	fd;
9307c478bd9Sstevel@tonic-gate 		long	fmode;
9317c478bd9Sstevel@tonic-gate 	} *uap = (struct a *)clwp->lwp_ap;
9327c478bd9Sstevel@tonic-gate 
9337c478bd9Sstevel@tonic-gate 	fd = (uint32_t)uap->fd;
9347c478bd9Sstevel@tonic-gate 	fmode = (uint32_t)uap->fmode;
9357c478bd9Sstevel@tonic-gate 
9367c478bd9Sstevel@tonic-gate 	au_uwrite(au_to_arg32(2, "new file mode", fmode&07777));
9377c478bd9Sstevel@tonic-gate 
938794f0adbSRoger A. Faulkner 	/*
939794f0adbSRoger A. Faulkner 	 * convert file pointer to file descriptor
940794f0adbSRoger A. Faulkner 	 *   Note: fd ref count incremented here.
941794f0adbSRoger A. Faulkner 	 */
9427c478bd9Sstevel@tonic-gate 	if ((fp = getf(fd)) == NULL)
9437c478bd9Sstevel@tonic-gate 		return;
9447c478bd9Sstevel@tonic-gate 
945794f0adbSRoger A. Faulkner 	/* get path from file struct here */
946794f0adbSRoger A. Faulkner 	fad = F2A(fp);
947794f0adbSRoger A. Faulkner 	if (fad->fad_aupath != NULL) {
948794f0adbSRoger A. Faulkner 		au_uwrite(au_to_path(fad->fad_aupath));
949794f0adbSRoger A. Faulkner 	} else {
950794f0adbSRoger A. Faulkner 		au_uwrite(au_to_arg32(1, "no path: fd", fd));
951794f0adbSRoger A. Faulkner 	}
952794f0adbSRoger A. Faulkner 
953794f0adbSRoger A. Faulkner 	vp = fp->f_vnode;
954794f0adbSRoger A. Faulkner 	audit_attributes(vp);
955794f0adbSRoger A. Faulkner 
956794f0adbSRoger A. Faulkner 	/* decrement file descriptor reference count */
957794f0adbSRoger A. Faulkner 	releasef(fd);
958794f0adbSRoger A. Faulkner }
959794f0adbSRoger A. Faulkner 
960794f0adbSRoger A. Faulkner static au_event_t
aui_fchmodat(au_event_t e)961794f0adbSRoger A. Faulkner aui_fchmodat(au_event_t e)
962794f0adbSRoger A. Faulkner {
963794f0adbSRoger A. Faulkner 	klwp_t *clwp = ttolwp(curthread);
964794f0adbSRoger A. Faulkner 
965794f0adbSRoger A. Faulkner 	struct a {
966794f0adbSRoger A. Faulkner 		long	fd;
967