2  * Copyright (c) 1999-2009 Apple Inc.
3  * Copyright (c) 2005, 2016-2018 Robert N. M. Watson
8  * contract FA8650-15-C-7558 ("CADETS"), as part of the DARPA Transparent
19  * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
26  * ARE DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR
60  * Hash table functions for the audit event number to event class mask
65 	au_event_t event;  member
73 static MALLOC_DEFINE(M_AUDITEVCLASS, "audit_evclass", "Audit event class");
84  * Hash table maintaining a mapping from audit event numbers to audit event
98 static MALLOC_DEFINE(M_AUDITEVNAME, "audit_evname", "Audit event name");
109  * Look up the class for an audit event in the class mapping table.
112 au_event_class(au_event_t event)  in au_event_class()  argument
119 	evcl = &evclass_hash[event % EVCLASSMAP_HASH_TABLE_SIZE];  in au_event_class()
121 	LIST_FOREACH(evc, &evcl->head, entry) {  in au_event_class()
122 		if (evc->event == event) {  in au_event_class()
123 			class = evc->class;  in au_event_class()
133  * Insert a event to class mapping. If the event already exists in the
140 au_evclassmap_insert(au_event_t event, au_class_t class)  in au_evclassmap_insert()  argument
147 	 * Free if there is already a mapping for this event.  in au_evclassmap_insert()
152 	evcl = &evclass_hash[event % EVCLASSMAP_HASH_TABLE_SIZE];  in au_evclassmap_insert()
153 	LIST_FOREACH(evc, &evcl->head, entry) {  in au_evclassmap_insert()
154 		if (evc->event == event) {  in au_evclassmap_insert()
155 			evc->class = class;  in au_evclassmap_insert()
162 	evc->event = event;  in au_evclassmap_insert()
163 	evc->class = class;  in au_evclassmap_insert()
164 	LIST_INSERT_HEAD(&evcl->head, evc, entry);  in au_evclassmap_insert()
178 	 * Set up the initial event to class mapping for system calls.  in au_evclassmap_init()
182 	 * only through non-native system calls.  It also seems a shame to  in au_evclassmap_init()
192  * Look up the name for an audit event in the event-to-name mapping table.
195 au_event_name(au_event_t event, char *name)  in au_event_name()  argument
203 	enl = &evnamemap_hash[event % EVNAMEMAP_HASH_TABLE_SIZE];  in au_event_name()
204 	LIST_FOREACH(ene, &enl->enl_head, ene_entry) {  in au_event_name()
205 		if (ene->ene_event == event) {  in au_event_name()
206 			strlcpy(name, ene->ene_name, EVNAMEMAP_NAME_SIZE);  in au_event_name()
217  * Insert a event-to-name mapping.  If the event already exists in the
223  * XXXRW: Accepts truncated name -- but perhaps should return failure instead?
228  * way to handle name collisions, for DTrace, where probe names must be
232 au_evnamemap_insert(au_event_t event, const char *name)  in au_evnamemap_insert()  argument
239 	 * Free if there is already a mapping for this event.  in au_evnamemap_insert()
243 	enl = &evnamemap_hash[event % EVNAMEMAP_HASH_TABLE_SIZE];  in au_evnamemap_insert()
244 	LIST_FOREACH(ene, &enl->enl_head, ene_entry) {  in au_evnamemap_insert()
245 		if (ene->ene_event == event) {  in au_evnamemap_insert()
247 			(void)strlcpy(ene->ene_name, name,  in au_evnamemap_insert()
248 			    sizeof(ene->ene_name));  in au_evnamemap_insert()
256 	mtx_init(&ene->ene_lock, "au_evnamemap", NULL, MTX_DEF);  in au_evnamemap_insert()
257 	ene->ene_event = event;  in au_evnamemap_insert()
258 	(void)strlcpy(ene->ene_name, name, sizeof(ene->ene_name));  in au_evnamemap_insert()
259 	LIST_INSERT_HEAD(&enl->enl_head, ene, ene_entry);  in au_evnamemap_insert()
265  * it to build an initial set of event number<->name mappings.
289 	ptr[size - 1] = '\0';  in au_evnamemap_init_preload()
312 		 * Parse each line -- ":"-separated tuple of event number,  in au_evnamemap_init_preload()
313 		 * event name, and other material we are less interested in.  in au_evnamemap_init_preload()
317 			printf("%s: Invalid line %u - evnum strsep\n",  in au_evnamemap_init_preload()
325 			printf("%s: Invalid line %u - evnum strtol\n",  in au_evnamemap_init_preload()
332 			printf("%s: Invalid line %u - evname strsp\n",  in au_evnamemap_init_preload()
355  * event-to-name mapping table, and uses this public interface to do so.  A
369 		LIST_FOREACH(ene, &enl->enl_head, ene_entry)  in au_evnamemap_foreach()
377  * Look up an event-to-name mapping table entry by event number.  As evname
379  * lock held -- but the caller will need to lock the element mutex before
382  * NB: the event identifier in elements is stable and can be read without
386 au_evnamemap_lookup(au_event_t event)  in au_evnamemap_lookup()  argument
392 	enl = &evnamemap_hash[event % EVNAMEMAP_HASH_TABLE_SIZE];  in au_evnamemap_lookup()
393 	LIST_FOREACH(ene, &enl->enl_head, ene_entry) {  in au_evnamemap_lookup()
394 		if (ene->ene_event == event)  in au_evnamemap_lookup()