FreeBSD/sys/security/audit/audit_worker.c
/*
 * Given a kernel audit record, process as required.  Kernel audit records
 * are converted to one, or possibly two, BSM records, depending on whether
 * there is a user audit record present also.  Kernel records need be
 * converted to BSM before they can be written out.  Both types will be
 * written to disk, and audit pipes.
 */
Given a kernel audit record, process as required.  Kernel audit records
are converted to one, or possibly two, BSM records, depending on whether
there is a user audit record present also.  Kernel records need be
converted to BSM before they can be written out.  Both types will be
written to disk, and audit pipes.
Given a kernel audit record process as required . Kernel audit records are converted to one or possibly two BSM records depending on whether there is a user audit record present also . Kernel records need be converted to BSM before they can be written out . Both types will be written to disk and audit pipes .
static void
audit_worker_process_record(struct kaudit_record *ar)
{
	struct au_record *bsm;
	au_class_t class;
	au_event_t event;
	au_id_t auid;
	int error, sorf;
	int locked;
	if (((ar->k_ar_commit & AR_COMMIT_USER) &&
	    (ar->k_ar_commit & AR_PRESELECT_USER_TRAIL)) ||
	    (ar->k_ar_commit & AR_PRESELECT_TRAIL)) {
		AUDIT_WORKER_LOCK();
		locked = 1;
	} else
		locked = 0;
	if ((ar->k_ar_commit & AR_COMMIT_USER) &&
	    (ar->k_ar_commit & AR_PRESELECT_USER_TRAIL)) {
		AUDIT_WORKER_LOCK_ASSERT();
		audit_record_write(audit_vp, audit_cred, ar->k_udata,
		    ar->k_ulen);
	}
	if ((ar->k_ar_commit & AR_COMMIT_USER) &&
	    (ar->k_ar_commit & AR_PRESELECT_USER_PIPE))
		audit_pipe_submit_user(ar->k_udata, ar->k_ulen);
	if (!(ar->k_ar_commit & AR_COMMIT_KERNEL) ||
	    ((ar->k_ar_commit & AR_PRESELECT_PIPE) == 0 &&
	    (ar->k_ar_commit & AR_PRESELECT_TRAIL) == 0))
		goto out;
	auid = ar->k_ar.ar_subj_auid;
	event = ar->k_ar.ar_event;
	class = au_event_class(event);
	if (ar->k_ar.ar_errno == 0)
		sorf = AU_PRS_SUCCESS;
	else
		sorf = AU_PRS_FAILURE;
	error = kaudit_to_bsm(ar, &bsm);
	switch (error) {
	case BSM_NOAUDIT:
		goto out;
	case BSM_FAILURE:
		printf("audit_worker_process_record: BSM_FAILURE\n");
		goto out;
	case BSM_SUCCESS:
		break;
	default:
		panic("kaudit_to_bsm returned %d", error);
	}
	if (ar->k_ar_commit & AR_PRESELECT_TRAIL) {
		AUDIT_WORKER_LOCK_ASSERT();
		audit_record_write(audit_vp, audit_cred, bsm->data, bsm->len);
	}
	if (ar->k_ar_commit & AR_PRESELECT_PIPE)
		audit_pipe_submit(auid, event, class, sorf,
		    ar->k_ar_commit & AR_PRESELECT_TRAIL, bsm->data,
		    bsm->len);
	kau_free(bsm);
out:
	if (locked)
		AUDIT_WORKER_UNLOCK();
}
static void audit_worker_process_record ( struct kaudit_record * ar ) { struct au_record * bsm ; au_class_t class ; au_event_t event ; au_id_t auid ; int error , sorf ; int locked ; if ( ( ( ar -> k_ar_commit & AR_COMMIT_USER ) && ( ar -> k_ar_commit & AR_PRESELECT_USER_TRAIL ) ) || ( ar -> k_ar_commit & AR_PRESELECT_TRAIL ) ) { AUDIT_WORKER_LOCK ( ) ; locked = 1 ; } else locked = 0 ; if ( ( ar -> k_ar_commit & AR_COMMIT_USER ) && ( ar -> k_ar_commit & AR_PRESELECT_USER_TRAIL ) ) { AUDIT_WORKER_LOCK_ASSERT ( ) ; audit_record_write ( audit_vp , audit_cred , ar -> k_udata , ar -> k_ulen ) ; } if ( ( ar -> k_ar_commit & AR_COMMIT_USER ) && ( ar -> k_ar_commit & AR_PRESELECT_USER_PIPE ) ) audit_pipe_submit_user ( ar -> k_udata , ar -> k_ulen ) ; if ( ! ( ar -> k_ar_commit & AR_COMMIT_KERNEL ) || ( ( ar -> k_ar_commit & AR_PRESELECT_PIPE ) == 0 && ( ar -> k_ar_commit & AR_PRESELECT_TRAIL ) == 0 ) ) goto out ; auid = ar -> k_ar . ar_subj_auid ; event = ar -> k_ar . ar_event ; class = au_event_class ( event ) ; if ( ar -> k_ar . ar_errno == 0 ) sorf = AU_PRS_SUCCESS ; else sorf = AU_PRS_FAILURE ; error = kaudit_to_bsm ( ar , & bsm ) ; switch ( error ) { case BSM_NOAUDIT : goto out ; case BSM_FAILURE : printf ( " \n " ) ; goto out ; case BSM_SUCCESS : break ; default : panic ( " " , error ) ; } if ( ar -> k_ar_commit & AR_PRESELECT_TRAIL ) { AUDIT_WORKER_LOCK_ASSERT ( ) ; audit_record_write ( audit_vp , audit_cred , bsm -> data , bsm -> len ) ; } if ( ar -> k_ar_commit & AR_PRESELECT_PIPE ) audit_pipe_submit ( auid , event , class , sorf , ar -> k_ar_commit & AR_PRESELECT_TRAIL , bsm -> data , bsm -> len ) ; kau_free ( bsm ) ; out : if ( locked ) AUDIT_WORKER_UNLOCK ( ) ; }
Given a kernel audit record, process as required.
Given a kernel audit record process as required .
/*
	 * We hold the audit worker lock over both writes, if there are two,
	 * so that the two records won't be split across a rotation and end
	 * up in two different trail files.
	 */ /*
	 * First, handle the user record, if any: commit to the system trail
	 * and audit pipes as selected.
	 */