10Sstevel@tonic-gate /*
20Sstevel@tonic-gate * CDDL HEADER START
30Sstevel@tonic-gate *
40Sstevel@tonic-gate * The contents of this file are subject to the terms of the
51676Sjpk * Common Development and Distribution License (the "License").
61676Sjpk * You may not use this file except in compliance with the License.
70Sstevel@tonic-gate *
80Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
90Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing.
100Sstevel@tonic-gate * See the License for the specific language governing permissions
110Sstevel@tonic-gate * and limitations under the License.
120Sstevel@tonic-gate *
130Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each
140Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
150Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the
160Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying
170Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner]
180Sstevel@tonic-gate *
190Sstevel@tonic-gate * CDDL HEADER END
200Sstevel@tonic-gate */
210Sstevel@tonic-gate /*
22*11871SMarek.Pospisil@Sun.COM * Copyright 2010 Sun Microsystems, Inc. All rights reserved.
230Sstevel@tonic-gate * Use is subject to license terms.
240Sstevel@tonic-gate */
250Sstevel@tonic-gate
260Sstevel@tonic-gate #include <netdb.h>
270Sstevel@tonic-gate #include <netinet/in.h>
280Sstevel@tonic-gate #include <pwd.h>
290Sstevel@tonic-gate #include <sys/errno.h>
300Sstevel@tonic-gate #include <sys/mutex.h>
310Sstevel@tonic-gate #include <sys/param.h>
320Sstevel@tonic-gate #include <sys/socket.h>
330Sstevel@tonic-gate #include <sys/stat.h>
340Sstevel@tonic-gate #include <sys/types.h>
350Sstevel@tonic-gate #include <string.h>
360Sstevel@tonic-gate #include <unistd.h>
3711134SCasper.Dik@Sun.COM #include <alloca.h>
380Sstevel@tonic-gate #include <stdlib.h>
391676Sjpk #include <tsol/label.h>
400Sstevel@tonic-gate #include <bsm/audit.h>
410Sstevel@tonic-gate #include <bsm/libbsm.h>
420Sstevel@tonic-gate #include <bsm/audit_uevents.h>
430Sstevel@tonic-gate #include <bsm/audit_record.h>
440Sstevel@tonic-gate
450Sstevel@tonic-gate #define AUC_NEVER -2 /* audit module not loaded */
460Sstevel@tonic-gate
470Sstevel@tonic-gate /* Private Functions */
480Sstevel@tonic-gate static int selected(au_event_t, au_mask_t *, int);
490Sstevel@tonic-gate
500Sstevel@tonic-gate int aug_selected();
510Sstevel@tonic-gate int aug_na_selected();
520Sstevel@tonic-gate
530Sstevel@tonic-gate /* Global Variables */
540Sstevel@tonic-gate static au_id_t aug_auid; /* auid of user writing audit record */
550Sstevel@tonic-gate static uid_t aug_uid; /* uid of user writing audit record */
560Sstevel@tonic-gate static uid_t aug_euid; /* euid of user writing audit record */
570Sstevel@tonic-gate static gid_t aug_gid; /* gid of user writing audit record */
580Sstevel@tonic-gate static gid_t aug_egid; /* euid of user writing audit record */
590Sstevel@tonic-gate static pid_t aug_pid; /* pid of user writing audit record */
600Sstevel@tonic-gate static au_tid_addr_t aug_tid; /* tid of user writing audit record */
610Sstevel@tonic-gate static int aug_na; /* 0 if event is attributable */
620Sstevel@tonic-gate static au_mask_t aug_namask; /* not attributable flags */
630Sstevel@tonic-gate static au_event_t aug_event; /* id of event being audited */
640Sstevel@tonic-gate static int aug_sorf; /* success or failure of aug_event */
650Sstevel@tonic-gate static char *aug_text; /* misc text to be written to trail */
660Sstevel@tonic-gate static char *aug_text1; /* misc text to be written to trail */
670Sstevel@tonic-gate static char *aug_text2; /* misc text to be written to trail */
680Sstevel@tonic-gate static au_asid_t aug_asid; /* asid of process writing record */
690Sstevel@tonic-gate static int (*aug_afunc)(); /* write additional tokens if needed */
700Sstevel@tonic-gate static char *aug_path; /* path token */
71*11871SMarek.Pospisil@Sun.COM static uint32_t aug_policy; /* kernel audit policy */
720Sstevel@tonic-gate
730Sstevel@tonic-gate /*
740Sstevel@tonic-gate * cannot_audit:
750Sstevel@tonic-gate * Return 1 if audit module not loaded.
760Sstevel@tonic-gate * Return 0 otherwise.
770Sstevel@tonic-gate *
780Sstevel@tonic-gate * The argument, force, should be set to 1 for long-lived processes
790Sstevel@tonic-gate * like some daemons. Force should be set to 0 for most programs.
800Sstevel@tonic-gate */
810Sstevel@tonic-gate int
cannot_audit(force)820Sstevel@tonic-gate cannot_audit(force)
830Sstevel@tonic-gate int force;
840Sstevel@tonic-gate {
850Sstevel@tonic-gate static int auc = AUC_UNSET;
860Sstevel@tonic-gate int cond = 0;
870Sstevel@tonic-gate
880Sstevel@tonic-gate if (auc == AUC_UNSET || force) {
890Sstevel@tonic-gate if (auditon(A_GETCOND, (caddr_t)&cond, sizeof (cond))) {
900Sstevel@tonic-gate auc = AUC_NEVER;
910Sstevel@tonic-gate } else {
920Sstevel@tonic-gate auc = cond;
930Sstevel@tonic-gate }
940Sstevel@tonic-gate }
950Sstevel@tonic-gate return (auc == AUC_NEVER);
960Sstevel@tonic-gate }
970Sstevel@tonic-gate
980Sstevel@tonic-gate /*
990Sstevel@tonic-gate * aug_init():
1000Sstevel@tonic-gate * Initialize global variables.
1010Sstevel@tonic-gate */
1020Sstevel@tonic-gate void
aug_init()1030Sstevel@tonic-gate aug_init()
1040Sstevel@tonic-gate {
1054321Scasper aug_auid = (uid_t)-1;
1064321Scasper aug_uid = (uid_t)-1;
1074321Scasper aug_euid = (uid_t)-1;
1084321Scasper aug_gid = (gid_t)-1;
1094321Scasper aug_egid = (gid_t)-1;
1100Sstevel@tonic-gate aug_pid = -1;
1110Sstevel@tonic-gate aug_tid.at_port = 0;
1120Sstevel@tonic-gate aug_tid.at_type = AU_IPv4;
1130Sstevel@tonic-gate aug_tid.at_addr[0] = 0;
1140Sstevel@tonic-gate aug_tid.at_addr[1] = 0;
1150Sstevel@tonic-gate aug_tid.at_addr[2] = 0;
1160Sstevel@tonic-gate aug_tid.at_addr[3] = 0;
1170Sstevel@tonic-gate aug_namask.am_success = AU_MASK_ALL;
1180Sstevel@tonic-gate aug_namask.am_failure = AU_MASK_ALL;
1190Sstevel@tonic-gate aug_event = 0;
1200Sstevel@tonic-gate aug_sorf = -2;
1210Sstevel@tonic-gate aug_text = NULL;
1220Sstevel@tonic-gate aug_text1 = NULL;
1230Sstevel@tonic-gate aug_text2 = NULL;
1240Sstevel@tonic-gate aug_na = 0;
1257753STon.Nguyen@Sun.COM aug_asid = (au_asid_t)(-1);
1260Sstevel@tonic-gate aug_afunc = NULL;
1270Sstevel@tonic-gate aug_path = NULL;
1280Sstevel@tonic-gate }
1290Sstevel@tonic-gate
1300Sstevel@tonic-gate /*
1310Sstevel@tonic-gate * aug_get_port:
1320Sstevel@tonic-gate * Return the raw device number of the port to which the
1330Sstevel@tonic-gate * current process is attached (assumed to be attached
1340Sstevel@tonic-gate * through file descriptor 0) or 0 if can't stat the port.
1350Sstevel@tonic-gate */
1360Sstevel@tonic-gate dev_t
aug_get_port()1370Sstevel@tonic-gate aug_get_port()
1380Sstevel@tonic-gate {
1390Sstevel@tonic-gate int rc;
1400Sstevel@tonic-gate char *ttyn;
1410Sstevel@tonic-gate struct stat sb;
1420Sstevel@tonic-gate
1430Sstevel@tonic-gate ttyn = ttyname(0);
1440Sstevel@tonic-gate if (ttyn == 0 || *ttyn == '\0') {
1450Sstevel@tonic-gate return (0);
1460Sstevel@tonic-gate }
1470Sstevel@tonic-gate
1480Sstevel@tonic-gate rc = stat(ttyn, &sb);
1490Sstevel@tonic-gate if (rc < 0) {
1500Sstevel@tonic-gate perror("stat");
1510Sstevel@tonic-gate return (0);
1520Sstevel@tonic-gate }
1530Sstevel@tonic-gate
1540Sstevel@tonic-gate return ((dev_t)sb.st_rdev);
1550Sstevel@tonic-gate }
1560Sstevel@tonic-gate
1570Sstevel@tonic-gate /*
1580Sstevel@tonic-gate * aug_get_machine:
1590Sstevel@tonic-gate * Return internet address of host hostname,
1600Sstevel@tonic-gate * or 0 if can't do lookup.
1610Sstevel@tonic-gate */
1620Sstevel@tonic-gate
1630Sstevel@tonic-gate int
aug_get_machine(const char * hostname,uint32_t * buf,uint32_t * type)1640Sstevel@tonic-gate aug_get_machine(const char *hostname, uint32_t *buf, uint32_t *type)
1650Sstevel@tonic-gate {
1660Sstevel@tonic-gate struct addrinfo *ai;
1670Sstevel@tonic-gate int err;
1680Sstevel@tonic-gate void *p;
1690Sstevel@tonic-gate
1700Sstevel@tonic-gate err = getaddrinfo(hostname, NULL, NULL, &ai);
1710Sstevel@tonic-gate if (err != 0)
1720Sstevel@tonic-gate return (0);
1730Sstevel@tonic-gate
1740Sstevel@tonic-gate switch (ai->ai_family) {
1750Sstevel@tonic-gate case AF_INET:
1760Sstevel@tonic-gate /* LINTED */
1770Sstevel@tonic-gate p = &((struct sockaddr_in *)ai->ai_addr)->sin_addr,
17811134SCasper.Dik@Sun.COM (void) memcpy(buf, p,
1790Sstevel@tonic-gate sizeof (((struct sockaddr_in *)0)->sin_addr));
1800Sstevel@tonic-gate *type = AU_IPv4;
1810Sstevel@tonic-gate break;
1820Sstevel@tonic-gate case AF_INET6:
1830Sstevel@tonic-gate /* LINTED */
1840Sstevel@tonic-gate p = &((struct sockaddr_in6 *)ai->ai_addr)->sin6_addr,
18511134SCasper.Dik@Sun.COM (void) memcpy(buf, p,
1860Sstevel@tonic-gate sizeof (((struct sockaddr_in6 *)0)->sin6_addr));
1870Sstevel@tonic-gate *type = AU_IPv6;
1880Sstevel@tonic-gate break;
1890Sstevel@tonic-gate default:
1900Sstevel@tonic-gate return (0);
1910Sstevel@tonic-gate }
1920Sstevel@tonic-gate
1930Sstevel@tonic-gate freeaddrinfo(ai);
1940Sstevel@tonic-gate
1950Sstevel@tonic-gate return (1);
1960Sstevel@tonic-gate }
1970Sstevel@tonic-gate
1980Sstevel@tonic-gate void
aug_save_auid(au_id_t id)1990Sstevel@tonic-gate aug_save_auid(au_id_t id)
2000Sstevel@tonic-gate {
2010Sstevel@tonic-gate aug_auid = id;
2020Sstevel@tonic-gate }
2030Sstevel@tonic-gate
2040Sstevel@tonic-gate void
aug_save_uid(uid_t id)2050Sstevel@tonic-gate aug_save_uid(uid_t id)
2060Sstevel@tonic-gate {
2070Sstevel@tonic-gate aug_uid = id;
2080Sstevel@tonic-gate }
2090Sstevel@tonic-gate
2100Sstevel@tonic-gate void
aug_save_euid(uid_t id)2110Sstevel@tonic-gate aug_save_euid(uid_t id)
2120Sstevel@tonic-gate {
2130Sstevel@tonic-gate aug_euid = id;
2140Sstevel@tonic-gate }
2150Sstevel@tonic-gate
2160Sstevel@tonic-gate void
aug_save_gid(gid_t id)2170Sstevel@tonic-gate aug_save_gid(gid_t id)
2180Sstevel@tonic-gate {
2190Sstevel@tonic-gate aug_gid = id;
2200Sstevel@tonic-gate }
2210Sstevel@tonic-gate
2220Sstevel@tonic-gate void
aug_save_egid(gid_t id)2230Sstevel@tonic-gate aug_save_egid(gid_t id)
2240Sstevel@tonic-gate {
2250Sstevel@tonic-gate aug_egid = id;
2260Sstevel@tonic-gate }
2270Sstevel@tonic-gate
2280Sstevel@tonic-gate void
aug_save_pid(pid_t id)2290Sstevel@tonic-gate aug_save_pid(pid_t id)
2300Sstevel@tonic-gate {
2310Sstevel@tonic-gate aug_pid = id;
2320Sstevel@tonic-gate }
2330Sstevel@tonic-gate
2340Sstevel@tonic-gate void
aug_save_asid(au_asid_t id)2350Sstevel@tonic-gate aug_save_asid(au_asid_t id)
2360Sstevel@tonic-gate {
2370Sstevel@tonic-gate aug_asid = id;
2380Sstevel@tonic-gate }
2390Sstevel@tonic-gate
2400Sstevel@tonic-gate void
aug_save_afunc(int (* afunc)())2410Sstevel@tonic-gate aug_save_afunc(int (*afunc)())
2420Sstevel@tonic-gate {
2430Sstevel@tonic-gate aug_afunc = afunc;
2440Sstevel@tonic-gate }
2450Sstevel@tonic-gate
2460Sstevel@tonic-gate void
aug_save_tid(dev_t port,int machine)2470Sstevel@tonic-gate aug_save_tid(dev_t port, int machine)
2480Sstevel@tonic-gate {
2490Sstevel@tonic-gate aug_tid.at_port = port;
2500Sstevel@tonic-gate aug_tid.at_type = AU_IPv4;
2510Sstevel@tonic-gate aug_tid.at_addr[0] = machine;
2520Sstevel@tonic-gate }
2530Sstevel@tonic-gate
2540Sstevel@tonic-gate void
aug_save_tid_ex(dev_t port,uint32_t * machine,uint32_t type)2550Sstevel@tonic-gate aug_save_tid_ex(dev_t port, uint32_t *machine, uint32_t type)
2560Sstevel@tonic-gate {
2570Sstevel@tonic-gate int i;
2580Sstevel@tonic-gate
2590Sstevel@tonic-gate aug_tid.at_port = port;
2600Sstevel@tonic-gate if ((type != AU_IPv4) && (type != AU_IPv6))
2610Sstevel@tonic-gate type = AU_IPv4;
2620Sstevel@tonic-gate
2630Sstevel@tonic-gate aug_tid.at_type = type;
2640Sstevel@tonic-gate for (i = 0; i < (type/4); i++)
2650Sstevel@tonic-gate aug_tid.at_addr[i] = machine[i];
2660Sstevel@tonic-gate }
2670Sstevel@tonic-gate
2680Sstevel@tonic-gate int
aug_save_me(void)2690Sstevel@tonic-gate aug_save_me(void)
2700Sstevel@tonic-gate {
2710Sstevel@tonic-gate auditinfo_addr_t ai;
2720Sstevel@tonic-gate
2730Sstevel@tonic-gate if (getaudit_addr(&ai, sizeof (ai)))
2740Sstevel@tonic-gate return (-1);
2750Sstevel@tonic-gate
2760Sstevel@tonic-gate aug_save_auid(ai.ai_auid);
2770Sstevel@tonic-gate aug_save_euid(geteuid());
2780Sstevel@tonic-gate aug_save_egid(getegid());
2790Sstevel@tonic-gate aug_save_uid(getuid());
2800Sstevel@tonic-gate aug_save_gid(getgid());
2810Sstevel@tonic-gate aug_save_pid(getpid());
2820Sstevel@tonic-gate aug_save_asid(ai.ai_asid);
2830Sstevel@tonic-gate aug_save_tid_ex(ai.ai_termid.at_port,
28411134SCasper.Dik@Sun.COM ai.ai_termid.at_addr,
28511134SCasper.Dik@Sun.COM ai.ai_termid.at_type);
2860Sstevel@tonic-gate return (0);
2870Sstevel@tonic-gate }
2880Sstevel@tonic-gate
2890Sstevel@tonic-gate /*
2900Sstevel@tonic-gate * aug_save_namask():
2910Sstevel@tonic-gate * Save the namask using the naflags entry in the audit_control file.
2920Sstevel@tonic-gate * Return 0 if successful.
2930Sstevel@tonic-gate * Return -1, and don't change the namask, if failed.
2940Sstevel@tonic-gate * Side Effect: Sets aug_na to -1 if error, 1 if successful.
2950Sstevel@tonic-gate */
2960Sstevel@tonic-gate int
aug_save_namask()2970Sstevel@tonic-gate aug_save_namask()
2980Sstevel@tonic-gate {
2990Sstevel@tonic-gate au_mask_t mask;
3000Sstevel@tonic-gate
3010Sstevel@tonic-gate aug_na = -1;
3020Sstevel@tonic-gate
3030Sstevel@tonic-gate /*
3040Sstevel@tonic-gate * get non-attributable system event mask from kernel.
3050Sstevel@tonic-gate */
3060Sstevel@tonic-gate if (auditon(A_GETKMASK, (caddr_t)&mask, sizeof (mask)) != 0) {
3070Sstevel@tonic-gate return (-1);
3080Sstevel@tonic-gate }
3090Sstevel@tonic-gate
3100Sstevel@tonic-gate aug_namask.am_success = mask.am_success;
3110Sstevel@tonic-gate aug_namask.am_failure = mask.am_failure;
3120Sstevel@tonic-gate aug_na = 1;
3130Sstevel@tonic-gate return (0);
3140Sstevel@tonic-gate }
3150Sstevel@tonic-gate
3160Sstevel@tonic-gate void
aug_save_event(au_event_t id)3170Sstevel@tonic-gate aug_save_event(au_event_t id)
3180Sstevel@tonic-gate {
3190Sstevel@tonic-gate aug_event = id;
3200Sstevel@tonic-gate }
3210Sstevel@tonic-gate
3220Sstevel@tonic-gate void
aug_save_sorf(int sorf)3230Sstevel@tonic-gate aug_save_sorf(int sorf)
3240Sstevel@tonic-gate {
3250Sstevel@tonic-gate aug_sorf = sorf;
3260Sstevel@tonic-gate }
3270Sstevel@tonic-gate
3280Sstevel@tonic-gate void
aug_save_text(char * s)3290Sstevel@tonic-gate aug_save_text(char *s)
3300Sstevel@tonic-gate {
3310Sstevel@tonic-gate if (aug_text != NULL)
3320Sstevel@tonic-gate free(aug_text);
3330Sstevel@tonic-gate if (s == NULL)
3340Sstevel@tonic-gate aug_text = NULL;
3350Sstevel@tonic-gate else
3360Sstevel@tonic-gate aug_text = strdup(s);
3370Sstevel@tonic-gate }
3380Sstevel@tonic-gate
3390Sstevel@tonic-gate void
aug_save_text1(char * s)3400Sstevel@tonic-gate aug_save_text1(char *s)
3410Sstevel@tonic-gate {
3420Sstevel@tonic-gate if (aug_text1 != NULL)
3430Sstevel@tonic-gate free(aug_text1);
3440Sstevel@tonic-gate if (s == NULL)
3450Sstevel@tonic-gate aug_text1 = NULL;
3460Sstevel@tonic-gate else
3470Sstevel@tonic-gate aug_text1 = strdup(s);
3480Sstevel@tonic-gate }
3490Sstevel@tonic-gate
3500Sstevel@tonic-gate void
aug_save_text2(char * s)3510Sstevel@tonic-gate aug_save_text2(char *s)
3520Sstevel@tonic-gate {
3530Sstevel@tonic-gate if (aug_text2 != NULL)
3540Sstevel@tonic-gate free(aug_text2);
3550Sstevel@tonic-gate if (s == NULL)
3560Sstevel@tonic-gate aug_text2 = NULL;
3570Sstevel@tonic-gate else
3580Sstevel@tonic-gate aug_text2 = strdup(s);
3590Sstevel@tonic-gate }
3600Sstevel@tonic-gate
3610Sstevel@tonic-gate void
aug_save_na(int flag)3620Sstevel@tonic-gate aug_save_na(int flag)
3630Sstevel@tonic-gate {
3640Sstevel@tonic-gate aug_na = flag;
3650Sstevel@tonic-gate }
3660Sstevel@tonic-gate
3670Sstevel@tonic-gate void
aug_save_path(char * s)3680Sstevel@tonic-gate aug_save_path(char *s)
3690Sstevel@tonic-gate {
3700Sstevel@tonic-gate if (aug_path != NULL)
3710Sstevel@tonic-gate free(aug_path);
3720Sstevel@tonic-gate if (s == NULL)
3730Sstevel@tonic-gate aug_path = NULL;
3740Sstevel@tonic-gate aug_path = strdup(s);
3750Sstevel@tonic-gate }
3760Sstevel@tonic-gate
3770Sstevel@tonic-gate int
aug_save_policy()3780Sstevel@tonic-gate aug_save_policy()
3790Sstevel@tonic-gate {
380*11871SMarek.Pospisil@Sun.COM uint32_t policy;
3810Sstevel@tonic-gate
3820Sstevel@tonic-gate if (auditon(A_GETPOLICY, (caddr_t)&policy, sizeof (policy))) {
3830Sstevel@tonic-gate return (-1);
3840Sstevel@tonic-gate }
3850Sstevel@tonic-gate aug_policy = policy;
3860Sstevel@tonic-gate return (0);
3870Sstevel@tonic-gate }
3880Sstevel@tonic-gate
3890Sstevel@tonic-gate /*
3900Sstevel@tonic-gate * aug_audit:
3910Sstevel@tonic-gate * Cut and audit record if it is selected.
3920Sstevel@tonic-gate * Return 0, if successfully written.
3930Sstevel@tonic-gate * Return 0, if not written, and not expected to write.
3940Sstevel@tonic-gate * Return -1, if not written because of unexpected error.
3950Sstevel@tonic-gate */
3960Sstevel@tonic-gate int
aug_audit(void)3970Sstevel@tonic-gate aug_audit(void)
3980Sstevel@tonic-gate {
3990Sstevel@tonic-gate int ad;
4000Sstevel@tonic-gate
4010Sstevel@tonic-gate if (cannot_audit(0)) {
4020Sstevel@tonic-gate return (0);
4030Sstevel@tonic-gate }
4040Sstevel@tonic-gate
4050Sstevel@tonic-gate if (aug_na) {
4060Sstevel@tonic-gate if (!aug_na_selected()) {
4070Sstevel@tonic-gate return (0);
4080Sstevel@tonic-gate }
4090Sstevel@tonic-gate } else if (!aug_selected()) {
4100Sstevel@tonic-gate return (0);
4110Sstevel@tonic-gate }
4120Sstevel@tonic-gate
4130Sstevel@tonic-gate if ((ad = au_open()) == -1) {
4140Sstevel@tonic-gate return (-1);
4150Sstevel@tonic-gate }
4160Sstevel@tonic-gate
4170Sstevel@tonic-gate (void) au_write(ad, au_to_subject_ex(aug_auid, aug_euid, aug_egid,
41811134SCasper.Dik@Sun.COM aug_uid, aug_gid, aug_pid, aug_asid, &aug_tid));
4192376Sgww if (is_system_labeled())
4202376Sgww (void) au_write(ad, au_to_mylabel());
4210Sstevel@tonic-gate if (aug_policy & AUDIT_GROUP) {
4220Sstevel@tonic-gate int ng;
42311134SCasper.Dik@Sun.COM int maxgrp = getgroups(0, NULL);
42411134SCasper.Dik@Sun.COM gid_t *grplst = alloca(maxgrp * sizeof (gid_t));
4250Sstevel@tonic-gate
42611134SCasper.Dik@Sun.COM if ((ng = getgroups(maxgrp, grplst)) > 0) {
4270Sstevel@tonic-gate (void) au_write(ad, au_to_newgroups(ng, grplst));
4280Sstevel@tonic-gate }
4290Sstevel@tonic-gate }
4300Sstevel@tonic-gate if (aug_text != NULL) {
4310Sstevel@tonic-gate (void) au_write(ad, au_to_text(aug_text));
4320Sstevel@tonic-gate }
4330Sstevel@tonic-gate if (aug_text1 != NULL) {
4340Sstevel@tonic-gate (void) au_write(ad, au_to_text(aug_text1));
4350Sstevel@tonic-gate }
4360Sstevel@tonic-gate if (aug_text2 != NULL) {
4370Sstevel@tonic-gate (void) au_write(ad, au_to_text(aug_text2));
4380Sstevel@tonic-gate }
4390Sstevel@tonic-gate if (aug_path != NULL) {
4400Sstevel@tonic-gate (void) au_write(ad, au_to_path(aug_path));
4410Sstevel@tonic-gate }
4420Sstevel@tonic-gate if (aug_afunc != NULL) {
4430Sstevel@tonic-gate (*aug_afunc)(ad);
4440Sstevel@tonic-gate }
4450Sstevel@tonic-gate #ifdef _LP64
4460Sstevel@tonic-gate (void) au_write(ad, au_to_return64((aug_sorf == 0) ? 0 : -1,
4472376Sgww (int64_t)aug_sorf));
4480Sstevel@tonic-gate #else
4490Sstevel@tonic-gate (void) au_write(ad, au_to_return32((aug_sorf == 0) ? 0 : -1,
4502376Sgww (int32_t)aug_sorf));
4510Sstevel@tonic-gate #endif
4520Sstevel@tonic-gate if (au_close(ad, 1, aug_event) < 0) {
4530Sstevel@tonic-gate (void) au_close(ad, 0, 0);
4540Sstevel@tonic-gate return (-1);
4550Sstevel@tonic-gate }
4560Sstevel@tonic-gate
4570Sstevel@tonic-gate return (0);
4580Sstevel@tonic-gate }
4590Sstevel@tonic-gate
4600Sstevel@tonic-gate int
aug_na_selected()4610Sstevel@tonic-gate aug_na_selected()
4620Sstevel@tonic-gate {
4630Sstevel@tonic-gate if (aug_na == -1) {
4640Sstevel@tonic-gate return (-1);
4650Sstevel@tonic-gate }
4660Sstevel@tonic-gate
4670Sstevel@tonic-gate return (selected(aug_event, &aug_namask, aug_sorf));
4680Sstevel@tonic-gate }
4690Sstevel@tonic-gate
4700Sstevel@tonic-gate int
aug_selected()4710Sstevel@tonic-gate aug_selected()
4720Sstevel@tonic-gate {
4730Sstevel@tonic-gate auditinfo_addr_t mask;
4740Sstevel@tonic-gate
4754321Scasper if (aug_uid > MAXEPHUID) {
4760Sstevel@tonic-gate (void) aug_save_namask();
4770Sstevel@tonic-gate return (aug_na_selected());
4780Sstevel@tonic-gate }
4790Sstevel@tonic-gate if (getaudit_addr(&mask, sizeof (mask))) {
4800Sstevel@tonic-gate return (-1);
4810Sstevel@tonic-gate }
4820Sstevel@tonic-gate
4830Sstevel@tonic-gate return (selected(aug_event, &mask.ai_mask, aug_sorf));
4840Sstevel@tonic-gate }
4850Sstevel@tonic-gate
4860Sstevel@tonic-gate static int
selected(au_event_t e,au_mask_t * m,int sorf)4870Sstevel@tonic-gate selected(au_event_t e, au_mask_t *m, int sorf)
4880Sstevel@tonic-gate {
4890Sstevel@tonic-gate int prs_sorf;
4900Sstevel@tonic-gate
4910Sstevel@tonic-gate if (sorf == 0) {
4920Sstevel@tonic-gate prs_sorf = AU_PRS_SUCCESS;
4930Sstevel@tonic-gate } else if (sorf == -1) {
4940Sstevel@tonic-gate prs_sorf = AU_PRS_FAILURE;
4950Sstevel@tonic-gate } else {
4960Sstevel@tonic-gate prs_sorf = AU_PRS_BOTH;
4970Sstevel@tonic-gate }
4980Sstevel@tonic-gate
4990Sstevel@tonic-gate return (au_preselect(e, m, prs_sorf, AU_PRS_REREAD));
5000Sstevel@tonic-gate }
501