FreeBSD/sys/security/audit/audit_bsm.c
/*
 * Implement auditing for the auditon() system call. The audit tokens that
 * are generated depend on the command that was sent into the auditon()
 * system call.
 */
Implement auditing for the auditon() system call. The audit tokens that
are generated depend on the command that was sent into the auditon()
system call.
Implement auditing for the auditon () system call . The audit tokens that are generated depend on the command that was sent into the auditon () system call .
static void
audit_sys_auditon(struct audit_record *ar, struct au_record *rec)
{
	struct au_token *tok;
	tok = au_to_arg32(3, "length", ar->ar_arg_len);
	kau_write(rec, tok);
	switch (ar->ar_arg_cmd) {
	case A_OLDSETPOLICY:
		if ((size_t)ar->ar_arg_len == sizeof(int64_t)) {
			tok = au_to_arg64(2, "policy",
			    ar->ar_arg_auditon.au_policy64);
			kau_write(rec, tok);
			break;
		}
	case A_SETPOLICY:
		tok = au_to_arg32(2, "policy", ar->ar_arg_auditon.au_policy);
		kau_write(rec, tok);
		break;
	case A_SETKMASK:
		tok = au_to_arg32(2, "setkmask:as_success",
		    ar->ar_arg_auditon.au_mask.am_success);
		kau_write(rec, tok);
		tok = au_to_arg32(2, "setkmask:as_failure",
		    ar->ar_arg_auditon.au_mask.am_failure);
		kau_write(rec, tok);
		break;
	case A_OLDSETQCTRL:
		if ((size_t)ar->ar_arg_len == sizeof(au_qctrl64_t)) {
			tok = au_to_arg64(2, "setqctrl:aq_hiwater",
			    ar->ar_arg_auditon.au_qctrl64.aq64_hiwater);
			kau_write(rec, tok);
			tok = au_to_arg64(2, "setqctrl:aq_lowater",
			    ar->ar_arg_auditon.au_qctrl64.aq64_lowater);
			kau_write(rec, tok);
			tok = au_to_arg64(2, "setqctrl:aq_bufsz",
			    ar->ar_arg_auditon.au_qctrl64.aq64_bufsz);
			kau_write(rec, tok);
			tok = au_to_arg64(2, "setqctrl:aq_delay",
			    ar->ar_arg_auditon.au_qctrl64.aq64_delay);
			kau_write(rec, tok);
			tok = au_to_arg64(2, "setqctrl:aq_minfree",
			    ar->ar_arg_auditon.au_qctrl64.aq64_minfree);
			kau_write(rec, tok);
			break;
		}
	case A_SETQCTRL:
		tok = au_to_arg32(2, "setqctrl:aq_hiwater",
		    ar->ar_arg_auditon.au_qctrl.aq_hiwater);
		kau_write(rec, tok);
		tok = au_to_arg32(2, "setqctrl:aq_lowater",
		    ar->ar_arg_auditon.au_qctrl.aq_lowater);
		kau_write(rec, tok);
		tok = au_to_arg32(2, "setqctrl:aq_bufsz",
		    ar->ar_arg_auditon.au_qctrl.aq_bufsz);
		kau_write(rec, tok);
		tok = au_to_arg32(2, "setqctrl:aq_delay",
		    ar->ar_arg_auditon.au_qctrl.aq_delay);
		kau_write(rec, tok);
		tok = au_to_arg32(2, "setqctrl:aq_minfree",
		    ar->ar_arg_auditon.au_qctrl.aq_minfree);
		kau_write(rec, tok);
		break;
	case A_SETUMASK:
		tok = au_to_arg32(2, "setumask:as_success",
		    ar->ar_arg_auditon.au_auinfo.ai_mask.am_success);
		kau_write(rec, tok);
		tok = au_to_arg32(2, "setumask:as_failure",
		    ar->ar_arg_auditon.au_auinfo.ai_mask.am_failure);
		kau_write(rec, tok);
		break;
	case A_SETSMASK:
		tok = au_to_arg32(2, "setsmask:as_success",
		    ar->ar_arg_auditon.au_auinfo.ai_mask.am_success);
		kau_write(rec, tok);
		tok = au_to_arg32(2, "setsmask:as_failure",
		    ar->ar_arg_auditon.au_auinfo.ai_mask.am_failure);
		kau_write(rec, tok);
		break;
	case A_OLDSETCOND:
		if ((size_t)ar->ar_arg_len == sizeof(int64_t)) {
			tok = au_to_arg64(2, "setcond",
			    ar->ar_arg_auditon.au_cond64);
			kau_write(rec, tok);
			break;
		}
	case A_SETCOND:
		tok = au_to_arg32(2, "setcond", ar->ar_arg_auditon.au_cond);
		kau_write(rec, tok);
		break;
	case A_SETCLASS:
		kau_write(rec, tok);
		tok = au_to_arg32(2, "setclass:ec_event",
		    ar->ar_arg_auditon.au_evclass.ec_number);
		kau_write(rec, tok);
		tok = au_to_arg32(2, "setclass:ec_class",
		    ar->ar_arg_auditon.au_evclass.ec_class);
		kau_write(rec, tok);
		break;
	case A_SETPMASK:
		tok = au_to_arg32(2, "setpmask:as_success",
		    ar->ar_arg_auditon.au_aupinfo.ap_mask.am_success);
		kau_write(rec, tok);
		tok = au_to_arg32(2, "setpmask:as_failure",
		    ar->ar_arg_auditon.au_aupinfo.ap_mask.am_failure);
		kau_write(rec, tok);
		break;
	case A_SETFSIZE:
		tok = au_to_arg32(2, "setfsize:filesize",
		    ar->ar_arg_auditon.au_fstat.af_filesz);
		kau_write(rec, tok);
		break;
	default:
		break;
	}
}
static void audit_sys_auditon ( struct audit_record * ar , struct au_record * rec ) { struct au_token * tok ; tok = au_to_arg32 ( 3 , " " , ar -> ar_arg_len ) ; kau_write ( rec , tok ) ; switch ( ar -> ar_arg_cmd ) { case A_OLDSETPOLICY : if ( ( size_t ) ar -> ar_arg_len == sizeof ( int64_t ) ) { tok = au_to_arg64 ( 2 , " " , ar -> ar_arg_auditon . au_policy64 ) ; kau_write ( rec , tok ) ; break ; } case A_SETPOLICY : tok = au_to_arg32 ( 2 , " " , ar -> ar_arg_auditon . au_policy ) ; kau_write ( rec , tok ) ; break ; case A_SETKMASK : tok = au_to_arg32 ( 2 , " " , ar -> ar_arg_auditon . au_mask . am_success ) ; kau_write ( rec , tok ) ; tok = au_to_arg32 ( 2 , " " , ar -> ar_arg_auditon . au_mask . am_failure ) ; kau_write ( rec , tok ) ; break ; case A_OLDSETQCTRL : if ( ( size_t ) ar -> ar_arg_len == sizeof ( au_qctrl64_t ) ) { tok = au_to_arg64 ( 2 , " " , ar -> ar_arg_auditon . au_qctrl64 . aq64_hiwater ) ; kau_write ( rec , tok ) ; tok = au_to_arg64 ( 2 , " " , ar -> ar_arg_auditon . au_qctrl64 . aq64_lowater ) ; kau_write ( rec , tok ) ; tok = au_to_arg64 ( 2 , " " , ar -> ar_arg_auditon . au_qctrl64 . aq64_bufsz ) ; kau_write ( rec , tok ) ; tok = au_to_arg64 ( 2 , " " , ar -> ar_arg_auditon . au_qctrl64 . aq64_delay ) ; kau_write ( rec , tok ) ; tok = au_to_arg64 ( 2 , " " , ar -> ar_arg_auditon . au_qctrl64 . aq64_minfree ) ; kau_write ( rec , tok ) ; break ; } case A_SETQCTRL : tok = au_to_arg32 ( 2 , " " , ar -> ar_arg_auditon . au_qctrl . aq_hiwater ) ; kau_write ( rec , tok ) ; tok = au_to_arg32 ( 2 , " " , ar -> ar_arg_auditon . au_qctrl . aq_lowater ) ; kau_write ( rec , tok ) ; tok = au_to_arg32 ( 2 , " " , ar -> ar_arg_auditon . au_qctrl . aq_bufsz ) ; kau_write ( rec , tok ) ; tok = au_to_arg32 ( 2 , " " , ar -> ar_arg_auditon . au_qctrl . aq_delay ) ; kau_write ( rec , tok ) ; tok = au_to_arg32 ( 2 , " " , ar -> ar_arg_auditon . au_qctrl . aq_minfree ) ; kau_write ( rec , tok ) ; break ; case A_SETUMASK : tok = au_to_arg32 ( 2 , " " , ar -> ar_arg_auditon . au_auinfo . ai_mask . am_success ) ; kau_write ( rec , tok ) ; tok = au_to_arg32 ( 2 , " " , ar -> ar_arg_auditon . au_auinfo . ai_mask . am_failure ) ; kau_write ( rec , tok ) ; break ; case A_SETSMASK : tok = au_to_arg32 ( 2 , " " , ar -> ar_arg_auditon . au_auinfo . ai_mask . am_success ) ; kau_write ( rec , tok ) ; tok = au_to_arg32 ( 2 , " " , ar -> ar_arg_auditon . au_auinfo . ai_mask . am_failure ) ; kau_write ( rec , tok ) ; break ; case A_OLDSETCOND : if ( ( size_t ) ar -> ar_arg_len == sizeof ( int64_t ) ) { tok = au_to_arg64 ( 2 , " " , ar -> ar_arg_auditon . au_cond64 ) ; kau_write ( rec , tok ) ; break ; } case A_SETCOND : tok = au_to_arg32 ( 2 , " " , ar -> ar_arg_auditon . au_cond ) ; kau_write ( rec , tok ) ; break ; case A_SETCLASS : kau_write ( rec , tok ) ; tok = au_to_arg32 ( 2 , " " , ar -> ar_arg_auditon . au_evclass . ec_number ) ; kau_write ( rec , tok ) ; tok = au_to_arg32 ( 2 , " " , ar -> ar_arg_auditon . au_evclass . ec_class ) ; kau_write ( rec , tok ) ; break ; case A_SETPMASK : tok = au_to_arg32 ( 2 , " " , ar -> ar_arg_auditon . au_aupinfo . ap_mask . am_success ) ; kau_write ( rec , tok ) ; tok = au_to_arg32 ( 2 , " " , ar -> ar_arg_auditon . au_aupinfo . ap_mask . am_failure ) ; kau_write ( rec , tok ) ; break ; case A_SETFSIZE : tok = au_to_arg32 ( 2 , " " , ar -> ar_arg_auditon . au_fstat . af_filesz ) ; kau_write ( rec , tok ) ; break ; default : break ; } }
Implement auditing for the auditon() system call.
Implement auditing for the auditon () system call .
/* FALLTHROUGH */ /* FALLTHROUGH */ /* FALLTHROUGH */