src/sys/security/audit/audit.c
/*
 * Construct an audit record for the passed thread.
 */
Construct an audit record for the passed thread.
Construct an audit record for the passed thread .
static int
audit_record_ctor(void *mem, int size, void *arg, int flags)
{
	struct kaudit_record *ar;
	struct thread *td;
	struct ucred *cred;
	struct prison *pr;
	KASSERT(sizeof(*ar) == size, ("audit_record_ctor: wrong size"));
	td = arg;
	ar = mem;
	bzero(ar, sizeof(*ar));
	ar->k_ar.ar_magic = AUDIT_RECORD_MAGIC;
	nanotime(&ar->k_ar.ar_starttime);
	cred = td->td_ucred;
	cru2x(cred, &ar->k_ar.ar_subj_cred);
	ar->k_ar.ar_subj_ruid = cred->cr_ruid;
	ar->k_ar.ar_subj_rgid = cred->cr_rgid;
	ar->k_ar.ar_subj_egid = cred->cr_groups[0];
	ar->k_ar.ar_subj_auid = cred->cr_audit.ai_auid;
	ar->k_ar.ar_subj_asid = cred->cr_audit.ai_asid;
	ar->k_ar.ar_subj_pid = td->td_proc->p_pid;
	ar->k_ar.ar_subj_amask = cred->cr_audit.ai_mask;
	ar->k_ar.ar_subj_term_addr = cred->cr_audit.ai_termid;
	if (jailed(cred)) {
		pr = cred->cr_prison;
		(void) strlcpy(ar->k_ar.ar_jailname, pr->pr_name,
		    sizeof(ar->k_ar.ar_jailname));
	} else
		ar->k_ar.ar_jailname[0] = '\0';
	return (0);
}
static int audit_record_ctor ( void * mem , int size , void * arg , int flags ) { struct kaudit_record * ar ; struct thread * td ; struct ucred * cred ; struct prison * pr ; KASSERT ( sizeof ( * ar ) == size , ( " " ) ) ; td = arg ; ar = mem ; bzero ( ar , sizeof ( * ar ) ) ; ar -> k_ar . ar_magic = AUDIT_RECORD_MAGIC ; nanotime ( & ar -> k_ar . ar_starttime ) ; cred = td -> td_ucred ; cru2x ( cred , & ar -> k_ar . ar_subj_cred ) ; ar -> k_ar . ar_subj_ruid = cred -> cr_ruid ; ar -> k_ar . ar_subj_rgid = cred -> cr_rgid ; ar -> k_ar . ar_subj_egid = cred -> cr_groups [ 0 ] ; ar -> k_ar . ar_subj_auid = cred -> cr_audit . ai_auid ; ar -> k_ar . ar_subj_asid = cred -> cr_audit . ai_asid ; ar -> k_ar . ar_subj_pid = td -> td_proc -> p_pid ; ar -> k_ar . ar_subj_amask = cred -> cr_audit . ai_mask ; ar -> k_ar . ar_subj_term_addr = cred -> cr_audit . ai_termid ; if ( jailed ( cred ) ) { pr = cred -> cr_prison ; ( void ) strlcpy ( ar -> k_ar . ar_jailname , pr -> pr_name , sizeof ( ar -> k_ar . ar_jailname ) ) ; } else ar -> k_ar . ar_jailname [ 0 ] = ' \0 ' ; return ( 0 ) ; }
Construct an audit record for the passed thread.
Construct an audit record for the passed thread .
/*
	 * Export the subject credential.
	 */ /*
	 * If this process is jailed, make sure we capture the name of the
	 * jail so we can use it to generate a zonename token when we covert
	 * this record to BSM.
	 */