FreeBSD/sys/security/audit/bsm_token.c
/*
 * token ID                1 byte
 * audit ID                4 bytes
 * effective user ID       4 bytes
 * effective group ID      4 bytes
 * real user ID            4 bytes
 * real group ID           4 bytes
 * process ID              4 bytes
 * session ID              4 bytes
 * terminal ID
 *   port ID               4 bytes/8 bytes (32-bit/64-bit value)
 *   address type-len      4 bytes
 *   machine address      16 bytes
 */
token ID                1 byte
audit ID                4 bytes
effective user ID       4 bytes
effective group ID      4 bytes
real user ID            4 bytes
real group ID           4 bytes
process ID              4 bytes
session ID              4 bytes
terminal ID
port ID               4 bytes/8 bytes (32-bit/64-bit value)
address type-len      4 bytes
machine address      16 bytes
token ID 1 byte audit ID 4 bytes effective user ID 4 bytes effective group ID 4 bytes real user ID 4 bytes real group ID 4 bytes process ID 4 bytes session ID 4 bytes terminal ID port ID 4 bytes / 8 bytes ( 32 - bit / 64 - bit value ) address type - len 4 bytes machine address 16 bytes
token_t *
au_to_process32_ex(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
    gid_t rgid, pid_t pid, au_asid_t sid, au_tid_addr_t *tid)
{
	token_t *t;
	u_char *dptr = NULL;
	KASSERT((tid->at_type == AU_IPv4) || (tid->at_type == AU_IPv6),
	    ("au_to_process32_ex: type %u", (unsigned int)tid->at_type));
	if (tid->at_type == AU_IPv4)
		GET_TOKEN_AREA(t, dptr, sizeof(u_char) +
		    10 * sizeof(u_int32_t));
	else
		GET_TOKEN_AREA(t, dptr, sizeof(u_char) +
		    13 * sizeof(u_int32_t));
	ADD_U_CHAR(dptr, AUT_PROCESS32_EX);
	ADD_U_INT32(dptr, auid);
	ADD_U_INT32(dptr, euid);
	ADD_U_INT32(dptr, egid);
	ADD_U_INT32(dptr, ruid);
	ADD_U_INT32(dptr, rgid);
	ADD_U_INT32(dptr, pid);
	ADD_U_INT32(dptr, sid);
	ADD_U_INT32(dptr, tid->at_port);
	ADD_U_INT32(dptr, tid->at_type);
	ADD_MEM(dptr, &tid->at_addr[0], sizeof(u_int32_t));
	if (tid->at_type == AU_IPv6) {
		ADD_MEM(dptr, &tid->at_addr[1], sizeof(u_int32_t));
		ADD_MEM(dptr, &tid->at_addr[2], sizeof(u_int32_t));
		ADD_MEM(dptr, &tid->at_addr[3], sizeof(u_int32_t));
	}
	return (t);
}
token_t * au_to_process32_ex ( au_id_t auid , uid_t euid , gid_t egid , uid_t ruid , gid_t rgid , pid_t pid , au_asid_t sid , au_tid_addr_t * tid ) { token_t * t ; u_char * dptr = NULL ; KASSERT ( ( tid -> at_type == AU_IPv4 ) || ( tid -> at_type == AU_IPv6 ) , ( " " , ( unsigned int ) tid -> at_type ) ) ; if ( tid -> at_type == AU_IPv4 ) GET_TOKEN_AREA ( t , dptr , sizeof ( u_char ) + 10 * sizeof ( u_int32_t ) ) ; else GET_TOKEN_AREA ( t , dptr , sizeof ( u_char ) + 13 * sizeof ( u_int32_t ) ) ; ADD_U_CHAR ( dptr , AUT_PROCESS32_EX ) ; ADD_U_INT32 ( dptr , auid ) ; ADD_U_INT32 ( dptr , euid ) ; ADD_U_INT32 ( dptr , egid ) ; ADD_U_INT32 ( dptr , ruid ) ; ADD_U_INT32 ( dptr , rgid ) ; ADD_U_INT32 ( dptr , pid ) ; ADD_U_INT32 ( dptr , sid ) ; ADD_U_INT32 ( dptr , tid -> at_port ) ; ADD_U_INT32 ( dptr , tid -> at_type ) ; ADD_MEM ( dptr , & tid -> at_addr [ 0 ] , sizeof ( u_int32_t ) ) ; if ( tid -> at_type == AU_IPv6 ) { ADD_MEM ( dptr , & tid -> at_addr [ 1 ] , sizeof ( u_int32_t ) ) ; ADD_MEM ( dptr , & tid -> at_addr [ 2 ] , sizeof ( u_int32_t ) ) ; ADD_MEM ( dptr , & tid -> at_addr [ 3 ] , sizeof ( u_int32_t ) ) ; } return ( t ) ; }
token ID                1 byte
 audit ID                4 bytes
 effective user ID       4 bytes
 effective group ID      4 bytes
 real user ID            4 bytes
 real group ID           4 bytes
 process ID              4 bytes
 session ID              4 bytes
 terminal ID
   port ID               4 bytes/8 bytes (32-bit/64-bit value)
   address type-len      4 bytes
   machine address      16 bytes
token ID 1 byte audit ID 4 bytes effective user ID 4 bytes effective group ID 4 bytes real user ID 4 bytes real group ID 4 bytes process ID 4 bytes session ID 4 bytes terminal ID port ID 4 bytes / 8 bytes ( 32 - bit / 64 - bit value ) address type - len 4 bytes machine address 16 bytes