FreeBSD/sys/security/audit/audit_bsm_klib.c
/*
 * Convert sysctl names and present arguments to events.
 */
Convert sysctl names and present arguments to events.
Convert sysctl names and present arguments to events .
au_event_t
audit_ctlname_to_sysctlevent(int name[], uint64_t valid_arg)
{
	if ((valid_arg & (ARG_CTLNAME | ARG_LEN)) != (ARG_CTLNAME | ARG_LEN))
		return (AUE_SYSCTL);
	switch (name[0]) {
	case KERN_OSTYPE:
	case KERN_OSRELEASE:
	case KERN_OSREV:
	case KERN_VERSION:
	case KERN_ARGMAX:
	case KERN_CLOCKRATE:
	case KERN_BOOTTIME:
	case KERN_POSIX1:
	case KERN_NGROUPS:
	case KERN_JOB_CONTROL:
	case KERN_SAVED_IDS:
	case KERN_OSRELDATE:
	case KERN_DUMMY:
		return (AUE_SYSCTL_NONADMIN);
	case KERN_MAXVNODES:
	case KERN_MAXPROC:
	case KERN_MAXFILES:
	case KERN_MAXPROCPERUID:
	case KERN_MAXFILESPERPROC:
	case KERN_HOSTID:
	case KERN_SECURELVL:
	case KERN_HOSTNAME:
	case KERN_VNODE:
	case KERN_PROC:
	case KERN_FILE:
	case KERN_PROF:
	case KERN_NISDOMAINNAME:
	case KERN_UPDATEINTERVAL:
	case KERN_NTP_PLL:
	case KERN_BOOTFILE:
	case KERN_DUMPDEV:
	case KERN_IPC:
	case KERN_PS_STRINGS:
	case KERN_USRSTACK:
	case KERN_LOGSIGEXIT:
	case KERN_IOV_MAX:
		return ((valid_arg & ARG_VALUE) ?
		    AUE_SYSCTL : AUE_SYSCTL_NONADMIN);
	default:
		return (AUE_SYSCTL);
	}
}
au_event_t audit_ctlname_to_sysctlevent ( int name [ ] , uint64_t valid_arg ) { if ( ( valid_arg & ( ARG_CTLNAME | ARG_LEN ) ) != ( ARG_CTLNAME | ARG_LEN ) ) return ( AUE_SYSCTL ) ; switch ( name [ 0 ] ) { case KERN_OSTYPE : case KERN_OSRELEASE : case KERN_OSREV : case KERN_VERSION : case KERN_ARGMAX : case KERN_CLOCKRATE : case KERN_BOOTTIME : case KERN_POSIX1 : case KERN_NGROUPS : case KERN_JOB_CONTROL : case KERN_SAVED_IDS : case KERN_OSRELDATE : case KERN_DUMMY : return ( AUE_SYSCTL_NONADMIN ) ; case KERN_MAXVNODES : case KERN_MAXPROC : case KERN_MAXFILES : case KERN_MAXPROCPERUID : case KERN_MAXFILESPERPROC : case KERN_HOSTID : case KERN_SECURELVL : case KERN_HOSTNAME : case KERN_VNODE : case KERN_PROC : case KERN_FILE : case KERN_PROF : case KERN_NISDOMAINNAME : case KERN_UPDATEINTERVAL : case KERN_NTP_PLL : case KERN_BOOTFILE : case KERN_DUMPDEV : case KERN_IPC : case KERN_PS_STRINGS : case KERN_USRSTACK : case KERN_LOGSIGEXIT : case KERN_IOV_MAX : return ( ( valid_arg & ARG_VALUE ) ? AUE_SYSCTL : AUE_SYSCTL_NONADMIN ) ; default : return ( AUE_SYSCTL ) ; } }
Convert sysctl names and present arguments to events.
Convert sysctl names and present arguments to events .
/* can't parse it - so return the worst case */ /* non-admin "lookups" treat them special */ /* only treat the changeable controls as admin */ /* NOTREACHED */