FreeBSD/sys/security/audit/audit.c
/*
 * audit_syscall_enter() is called on entry to each system call.  It is
 * responsible for deciding whether or not to audit the call (preselection),
 * and if so, allocating a per-thread audit record.  audit_new() will fill in
 * basic thread/credential properties.
 */
audit_syscall_enter() is called on entry to each system call.  It is
responsible for deciding whether or not to audit the call (preselection),
and if so, allocating a per-thread audit record.  audit_new() will fill in
basic thread/credential properties.
audit_syscall_enter () is called on entry to each system call . It is responsible for deciding whether or not to audit the call ( preselection ) and if so allocating a per - thread audit record . audit_new () will fill in basic thread / credential properties .
void
audit_syscall_enter(unsigned short code, struct thread *td)
{
	struct au_mask *aumask;
	au_class_t class;
	au_event_t event;
	au_id_t auid;
	KASSERT(td->td_ar == NULL, ("audit_syscall_enter: td->td_ar != NULL"));
	KASSERT((td->td_pflags & TDP_AUDITREC) == 0,
	    ("audit_syscall_enter: TDP_AUDITREC set"));
	if (code >= td->td_proc->p_sysent->sv_size)
		return;
	event = td->td_proc->p_sysent->sv_table[code].sy_auevent;
	if (event == AUE_NULL)
		return;
	auid = td->td_ucred->cr_audit.ai_auid;
	if (auid == AU_DEFAUDITID)
		aumask = &audit_nae_mask;
	else
		aumask = &td->td_ucred->cr_audit.ai_mask;
	class = au_event_class(event);
	if (au_preselect(event, class, aumask, AU_PRS_BOTH)) {
		if (audit_in_failure &&
		    priv_check(td, PRIV_AUDIT_FAILSTOP) != 0) {
			cv_wait(&audit_fail_cv, &audit_mtx);
			panic("audit_failing_stop: thread continued");
		}
		td->td_ar = audit_new(event, td);
		if (td->td_ar != NULL)
			td->td_pflags |= TDP_AUDITREC;
	} else if (audit_pipe_preselect(auid, event, class, AU_PRS_BOTH, 0)) {
		td->td_ar = audit_new(event, td);
		if (td->td_ar != NULL)
			td->td_pflags |= TDP_AUDITREC;
	} else
		td->td_ar = NULL;
}
void audit_syscall_enter ( unsigned short code , struct thread * td ) { struct au_mask * aumask ; au_class_t class ; au_event_t event ; au_id_t auid ; KASSERT ( td -> td_ar == NULL , ( " " ) ) ; KASSERT ( ( td -> td_pflags & TDP_AUDITREC ) == 0 , ( " " ) ) ; if ( code >= td -> td_proc -> p_sysent -> sv_size ) return ; event = td -> td_proc -> p_sysent -> sv_table [ code ] . sy_auevent ; if ( event == AUE_NULL ) return ; auid = td -> td_ucred -> cr_audit . ai_auid ; if ( auid == AU_DEFAUDITID ) aumask = & audit_nae_mask ; else aumask = & td -> td_ucred -> cr_audit . ai_mask ; class = au_event_class ( event ) ; if ( au_preselect ( event , class , aumask , AU_PRS_BOTH ) ) { if ( audit_in_failure && priv_check ( td , PRIV_AUDIT_FAILSTOP ) != 0 ) { cv_wait ( & audit_fail_cv , & audit_mtx ) ; panic ( " " ) ; } td -> td_ar = audit_new ( event , td ) ; if ( td -> td_ar != NULL ) td -> td_pflags |= TDP_AUDITREC ; } else if ( audit_pipe_preselect ( auid , event , class , AU_PRS_BOTH , 0 ) ) { td -> td_ar = audit_new ( event , td ) ; if ( td -> td_ar != NULL ) td -> td_pflags |= TDP_AUDITREC ; } else td -> td_ar = NULL ; }
audit_syscall_enter() is called on entry to each system call.
audit_syscall_enter () is called on entry to each system call .
/*
	 * In FreeBSD, each ABI has its own system call table, and hence
	 * mapping of system call codes to audit events.  Convert the code to
	 * an audit event identifier using the process system call table
	 * reference.  In Darwin, there's only one, so we use the global
	 * symbol for the system call table.  No audit record is generated
	 * for bad system calls, as no operation has been performed.
	 */ /*
	 * Check which audit mask to use; either the kernel non-attributable
	 * event mask or the process audit mask.
	 */ /*
	 * Allocate an audit record, if preselection allows it, and store in
	 * the thread for later use.
	 */ /*
		 * If we're out of space and need to suspend unprivileged
		 * processes, do that here rather than trying to allocate
		 * another audit record.
		 *
		 * Note: we might wish to be able to continue here in the
		 * future, if the system recovers.  That should be possible
		 * by means of checking the condition in a loop around
		 * cv_wait().  It might be desirable to reevaluate whether an
		 * audit record is still required for this event by
		 * re-calling au_preselect().
		 */