xref: /onnv-gate/usr/src/lib/libbsm/common/generic.c (revision 11871:62afedd2e4a5)
10Sstevel@tonic-gate /*
20Sstevel@tonic-gate  * CDDL HEADER START
30Sstevel@tonic-gate  *
40Sstevel@tonic-gate  * The contents of this file are subject to the terms of the
51676Sjpk  * Common Development and Distribution License (the "License").
61676Sjpk  * You may not use this file except in compliance with the License.
70Sstevel@tonic-gate  *
80Sstevel@tonic-gate  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
90Sstevel@tonic-gate  * or http://www.opensolaris.org/os/licensing.
100Sstevel@tonic-gate  * See the License for the specific language governing permissions
110Sstevel@tonic-gate  * and limitations under the License.
120Sstevel@tonic-gate  *
130Sstevel@tonic-gate  * When distributing Covered Code, include this CDDL HEADER in each
140Sstevel@tonic-gate  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
150Sstevel@tonic-gate  * If applicable, add the following below this CDDL HEADER, with the
160Sstevel@tonic-gate  * fields enclosed by brackets "[]" replaced with your own identifying
170Sstevel@tonic-gate  * information: Portions Copyright [yyyy] [name of copyright owner]
180Sstevel@tonic-gate  *
190Sstevel@tonic-gate  * CDDL HEADER END
200Sstevel@tonic-gate  */
210Sstevel@tonic-gate /*
22*11871SMarek.Pospisil@Sun.COM  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
230Sstevel@tonic-gate  * Use is subject to license terms.
240Sstevel@tonic-gate  */
250Sstevel@tonic-gate 
260Sstevel@tonic-gate #include <netdb.h>
270Sstevel@tonic-gate #include <netinet/in.h>
280Sstevel@tonic-gate #include <pwd.h>
290Sstevel@tonic-gate #include <sys/errno.h>
300Sstevel@tonic-gate #include <sys/mutex.h>
310Sstevel@tonic-gate #include <sys/param.h>
320Sstevel@tonic-gate #include <sys/socket.h>
330Sstevel@tonic-gate #include <sys/stat.h>
340Sstevel@tonic-gate #include <sys/types.h>
350Sstevel@tonic-gate #include <string.h>
360Sstevel@tonic-gate #include <unistd.h>
3711134SCasper.Dik@Sun.COM #include <alloca.h>
380Sstevel@tonic-gate #include <stdlib.h>
391676Sjpk #include <tsol/label.h>
400Sstevel@tonic-gate #include <bsm/audit.h>
410Sstevel@tonic-gate #include <bsm/libbsm.h>
420Sstevel@tonic-gate #include <bsm/audit_uevents.h>
430Sstevel@tonic-gate #include <bsm/audit_record.h>
440Sstevel@tonic-gate 
450Sstevel@tonic-gate #define	AUC_NEVER	-2	/* audit module not loaded */
460Sstevel@tonic-gate 
470Sstevel@tonic-gate /* Private Functions */
480Sstevel@tonic-gate static int selected(au_event_t, au_mask_t *, int);
490Sstevel@tonic-gate 
500Sstevel@tonic-gate int aug_selected();
510Sstevel@tonic-gate int aug_na_selected();
520Sstevel@tonic-gate 
530Sstevel@tonic-gate /* Global Variables */
540Sstevel@tonic-gate static au_id_t		aug_auid;	/* auid of user writing audit record */
550Sstevel@tonic-gate static uid_t		aug_uid;	/* uid of user writing audit record */
560Sstevel@tonic-gate static uid_t		aug_euid;	/* euid of user writing audit record */
570Sstevel@tonic-gate static gid_t		aug_gid;	/* gid of user writing audit record */
580Sstevel@tonic-gate static gid_t		aug_egid;	/* euid of user writing audit record */
590Sstevel@tonic-gate static pid_t		aug_pid;	/* pid of user writing audit record */
600Sstevel@tonic-gate static au_tid_addr_t	aug_tid;	/* tid of user writing audit record */
610Sstevel@tonic-gate static int		aug_na;		/* 0 if event is attributable */
620Sstevel@tonic-gate static au_mask_t	aug_namask;	/* not attributable flags */
630Sstevel@tonic-gate static au_event_t	aug_event;	/* id of event being audited */
640Sstevel@tonic-gate static int 		aug_sorf;	/* success or failure of aug_event */
650Sstevel@tonic-gate static char		*aug_text;	/* misc text to be written to trail */
660Sstevel@tonic-gate static char		*aug_text1;	/* misc text to be written to trail */
670Sstevel@tonic-gate static char		*aug_text2;	/* misc text to be written to trail */
680Sstevel@tonic-gate static au_asid_t	aug_asid;	/* asid of process writing record */
690Sstevel@tonic-gate static int 		(*aug_afunc)();	/* write additional tokens if needed */
700Sstevel@tonic-gate static char		*aug_path;	/* path token */
71*11871SMarek.Pospisil@Sun.COM static uint32_t		aug_policy;	/* kernel audit policy */
720Sstevel@tonic-gate 
730Sstevel@tonic-gate /*
740Sstevel@tonic-gate  * cannot_audit:
750Sstevel@tonic-gate  *	Return 1 if audit module not loaded.
760Sstevel@tonic-gate  *	Return 0 otherwise.
770Sstevel@tonic-gate  *
780Sstevel@tonic-gate  * The argument, force, should be set to 1 for long-lived processes
790Sstevel@tonic-gate  * like some daemons.  Force should be set to 0 for most programs.
800Sstevel@tonic-gate  */
810Sstevel@tonic-gate int
cannot_audit(force)820Sstevel@tonic-gate cannot_audit(force)
830Sstevel@tonic-gate 	int force;
840Sstevel@tonic-gate {
850Sstevel@tonic-gate 	static int auc = AUC_UNSET;
860Sstevel@tonic-gate 	int cond = 0;
870Sstevel@tonic-gate 
880Sstevel@tonic-gate 	if (auc == AUC_UNSET || force) {
890Sstevel@tonic-gate 		if (auditon(A_GETCOND, (caddr_t)&cond, sizeof (cond))) {
900Sstevel@tonic-gate 			auc = AUC_NEVER;
910Sstevel@tonic-gate 		} else {
920Sstevel@tonic-gate 			auc = cond;
930Sstevel@tonic-gate 		}
940Sstevel@tonic-gate 	}
950Sstevel@tonic-gate 	return (auc == AUC_NEVER);
960Sstevel@tonic-gate }
970Sstevel@tonic-gate 
980Sstevel@tonic-gate /*
990Sstevel@tonic-gate  * aug_init():
1000Sstevel@tonic-gate  *	Initialize global variables.
1010Sstevel@tonic-gate  */
1020Sstevel@tonic-gate void
aug_init()1030Sstevel@tonic-gate aug_init()
1040Sstevel@tonic-gate {
1054321Scasper 	aug_auid = (uid_t)-1;
1064321Scasper 	aug_uid = (uid_t)-1;
1074321Scasper 	aug_euid = (uid_t)-1;
1084321Scasper 	aug_gid = (gid_t)-1;
1094321Scasper 	aug_egid = (gid_t)-1;
1100Sstevel@tonic-gate 	aug_pid = -1;
1110Sstevel@tonic-gate 	aug_tid.at_port = 0;
1120Sstevel@tonic-gate 	aug_tid.at_type = AU_IPv4;
1130Sstevel@tonic-gate 	aug_tid.at_addr[0] = 0;
1140Sstevel@tonic-gate 	aug_tid.at_addr[1] = 0;
1150Sstevel@tonic-gate 	aug_tid.at_addr[2] = 0;
1160Sstevel@tonic-gate 	aug_tid.at_addr[3] = 0;
1170Sstevel@tonic-gate 	aug_namask.am_success = AU_MASK_ALL;
1180Sstevel@tonic-gate 	aug_namask.am_failure = AU_MASK_ALL;
1190Sstevel@tonic-gate 	aug_event = 0;
1200Sstevel@tonic-gate 	aug_sorf = -2;
1210Sstevel@tonic-gate 	aug_text = NULL;
1220Sstevel@tonic-gate 	aug_text1 = NULL;
1230Sstevel@tonic-gate 	aug_text2 = NULL;
1240Sstevel@tonic-gate 	aug_na = 0;
1257753STon.Nguyen@Sun.COM 	aug_asid = (au_asid_t)(-1);
1260Sstevel@tonic-gate 	aug_afunc = NULL;
1270Sstevel@tonic-gate 	aug_path = NULL;
1280Sstevel@tonic-gate }
1290Sstevel@tonic-gate 
1300Sstevel@tonic-gate /*
1310Sstevel@tonic-gate  * aug_get_port:
1320Sstevel@tonic-gate  *	Return the raw device number of the port to which the
1330Sstevel@tonic-gate  *	current process is attached (assumed to be attached
1340Sstevel@tonic-gate  *	through file descriptor 0) or 0 if can't stat the port.
1350Sstevel@tonic-gate  */
1360Sstevel@tonic-gate dev_t
aug_get_port()1370Sstevel@tonic-gate aug_get_port()
1380Sstevel@tonic-gate {
1390Sstevel@tonic-gate 	int	rc;
1400Sstevel@tonic-gate 	char	*ttyn;
1410Sstevel@tonic-gate 	struct stat sb;
1420Sstevel@tonic-gate 
1430Sstevel@tonic-gate 	ttyn = ttyname(0);
1440Sstevel@tonic-gate 	if (ttyn == 0 || *ttyn == '\0') {
1450Sstevel@tonic-gate 		return (0);
1460Sstevel@tonic-gate 	}
1470Sstevel@tonic-gate 
1480Sstevel@tonic-gate 	rc = stat(ttyn, &sb);
1490Sstevel@tonic-gate 	if (rc < 0) {
1500Sstevel@tonic-gate 		perror("stat");
1510Sstevel@tonic-gate 		return (0);
1520Sstevel@tonic-gate 	}
1530Sstevel@tonic-gate 
1540Sstevel@tonic-gate 	return ((dev_t)sb.st_rdev);
1550Sstevel@tonic-gate }
1560Sstevel@tonic-gate 
1570Sstevel@tonic-gate /*
1580Sstevel@tonic-gate  * aug_get_machine:
1590Sstevel@tonic-gate  *	Return internet address of host hostname,
1600Sstevel@tonic-gate  *	or 0 if can't do lookup.
1610Sstevel@tonic-gate  */
1620Sstevel@tonic-gate 
1630Sstevel@tonic-gate int
aug_get_machine(const char * hostname,uint32_t * buf,uint32_t * type)1640Sstevel@tonic-gate aug_get_machine(const char *hostname, uint32_t *buf, uint32_t *type)
1650Sstevel@tonic-gate {
1660Sstevel@tonic-gate 	struct addrinfo *ai;
1670Sstevel@tonic-gate 	int err;
1680Sstevel@tonic-gate 	void *p;
1690Sstevel@tonic-gate 
1700Sstevel@tonic-gate 	err = getaddrinfo(hostname, NULL, NULL, &ai);
1710Sstevel@tonic-gate 	if (err != 0)
1720Sstevel@tonic-gate 		return (0);
1730Sstevel@tonic-gate 
1740Sstevel@tonic-gate 	switch (ai->ai_family) {
1750Sstevel@tonic-gate 	case AF_INET:
1760Sstevel@tonic-gate 		/* LINTED */
1770Sstevel@tonic-gate 		p = &((struct sockaddr_in *)ai->ai_addr)->sin_addr,
17811134SCasper.Dik@Sun.COM 		    (void) memcpy(buf, p,
1790Sstevel@tonic-gate 		    sizeof (((struct sockaddr_in *)0)->sin_addr));
1800Sstevel@tonic-gate 		*type = AU_IPv4;
1810Sstevel@tonic-gate 		break;
1820Sstevel@tonic-gate 	case AF_INET6:
1830Sstevel@tonic-gate 		/* LINTED */
1840Sstevel@tonic-gate 		p = &((struct sockaddr_in6 *)ai->ai_addr)->sin6_addr,
18511134SCasper.Dik@Sun.COM 		    (void) memcpy(buf, p,
1860Sstevel@tonic-gate 		    sizeof (((struct sockaddr_in6 *)0)->sin6_addr));
1870Sstevel@tonic-gate 		*type = AU_IPv6;
1880Sstevel@tonic-gate 		break;
1890Sstevel@tonic-gate 	default:
1900Sstevel@tonic-gate 		return (0);
1910Sstevel@tonic-gate 	}
1920Sstevel@tonic-gate 
1930Sstevel@tonic-gate 	freeaddrinfo(ai);
1940Sstevel@tonic-gate 
1950Sstevel@tonic-gate 	return (1);
1960Sstevel@tonic-gate }
1970Sstevel@tonic-gate 
1980Sstevel@tonic-gate void
aug_save_auid(au_id_t id)1990Sstevel@tonic-gate aug_save_auid(au_id_t id)
2000Sstevel@tonic-gate {
2010Sstevel@tonic-gate 	aug_auid = id;
2020Sstevel@tonic-gate }
2030Sstevel@tonic-gate 
2040Sstevel@tonic-gate void
aug_save_uid(uid_t id)2050Sstevel@tonic-gate aug_save_uid(uid_t id)
2060Sstevel@tonic-gate {
2070Sstevel@tonic-gate 	aug_uid = id;
2080Sstevel@tonic-gate }
2090Sstevel@tonic-gate 
2100Sstevel@tonic-gate void
aug_save_euid(uid_t id)2110Sstevel@tonic-gate aug_save_euid(uid_t id)
2120Sstevel@tonic-gate {
2130Sstevel@tonic-gate 	aug_euid = id;
2140Sstevel@tonic-gate }
2150Sstevel@tonic-gate 
2160Sstevel@tonic-gate void
aug_save_gid(gid_t id)2170Sstevel@tonic-gate aug_save_gid(gid_t id)
2180Sstevel@tonic-gate {
2190Sstevel@tonic-gate 	aug_gid = id;
2200Sstevel@tonic-gate }
2210Sstevel@tonic-gate 
2220Sstevel@tonic-gate void
aug_save_egid(gid_t id)2230Sstevel@tonic-gate aug_save_egid(gid_t id)
2240Sstevel@tonic-gate {
2250Sstevel@tonic-gate 	aug_egid = id;
2260Sstevel@tonic-gate }
2270Sstevel@tonic-gate 
2280Sstevel@tonic-gate void
aug_save_pid(pid_t id)2290Sstevel@tonic-gate aug_save_pid(pid_t id)
2300Sstevel@tonic-gate {
2310Sstevel@tonic-gate 	aug_pid = id;
2320Sstevel@tonic-gate }
2330Sstevel@tonic-gate 
2340Sstevel@tonic-gate void
aug_save_asid(au_asid_t id)2350Sstevel@tonic-gate aug_save_asid(au_asid_t id)
2360Sstevel@tonic-gate {
2370Sstevel@tonic-gate 	aug_asid = id;
2380Sstevel@tonic-gate }
2390Sstevel@tonic-gate 
2400Sstevel@tonic-gate void
aug_save_afunc(int (* afunc)())2410Sstevel@tonic-gate aug_save_afunc(int (*afunc)())
2420Sstevel@tonic-gate {
2430Sstevel@tonic-gate 	aug_afunc = afunc;
2440Sstevel@tonic-gate }
2450Sstevel@tonic-gate 
2460Sstevel@tonic-gate void
aug_save_tid(dev_t port,int machine)2470Sstevel@tonic-gate aug_save_tid(dev_t port, int machine)
2480Sstevel@tonic-gate {
2490Sstevel@tonic-gate 	aug_tid.at_port = port;
2500Sstevel@tonic-gate 	aug_tid.at_type = AU_IPv4;
2510Sstevel@tonic-gate 	aug_tid.at_addr[0] = machine;
2520Sstevel@tonic-gate }
2530Sstevel@tonic-gate 
2540Sstevel@tonic-gate void
aug_save_tid_ex(dev_t port,uint32_t * machine,uint32_t type)2550Sstevel@tonic-gate aug_save_tid_ex(dev_t port, uint32_t *machine, uint32_t type)
2560Sstevel@tonic-gate {
2570Sstevel@tonic-gate 	int i;
2580Sstevel@tonic-gate 
2590Sstevel@tonic-gate 	aug_tid.at_port = port;
2600Sstevel@tonic-gate 	if ((type != AU_IPv4) && (type != AU_IPv6))
2610Sstevel@tonic-gate 		type = AU_IPv4;
2620Sstevel@tonic-gate 
2630Sstevel@tonic-gate 	aug_tid.at_type = type;
2640Sstevel@tonic-gate 	for (i = 0; i < (type/4); i++)
2650Sstevel@tonic-gate 		aug_tid.at_addr[i] = machine[i];
2660Sstevel@tonic-gate }
2670Sstevel@tonic-gate 
2680Sstevel@tonic-gate int
aug_save_me(void)2690Sstevel@tonic-gate aug_save_me(void)
2700Sstevel@tonic-gate {
2710Sstevel@tonic-gate 	auditinfo_addr_t ai;
2720Sstevel@tonic-gate 
2730Sstevel@tonic-gate 	if (getaudit_addr(&ai, sizeof (ai)))
2740Sstevel@tonic-gate 		return (-1);
2750Sstevel@tonic-gate 
2760Sstevel@tonic-gate 	aug_save_auid(ai.ai_auid);
2770Sstevel@tonic-gate 	aug_save_euid(geteuid());
2780Sstevel@tonic-gate 	aug_save_egid(getegid());
2790Sstevel@tonic-gate 	aug_save_uid(getuid());
2800Sstevel@tonic-gate 	aug_save_gid(getgid());
2810Sstevel@tonic-gate 	aug_save_pid(getpid());
2820Sstevel@tonic-gate 	aug_save_asid(ai.ai_asid);
2830Sstevel@tonic-gate 	aug_save_tid_ex(ai.ai_termid.at_port,
28411134SCasper.Dik@Sun.COM 	    ai.ai_termid.at_addr,
28511134SCasper.Dik@Sun.COM 	    ai.ai_termid.at_type);
2860Sstevel@tonic-gate 	return (0);
2870Sstevel@tonic-gate }
2880Sstevel@tonic-gate 
2890Sstevel@tonic-gate /*
2900Sstevel@tonic-gate  * aug_save_namask():
2910Sstevel@tonic-gate  *	Save the namask using the naflags entry in the audit_control file.
2920Sstevel@tonic-gate  *	Return 0 if successful.
2930Sstevel@tonic-gate  *	Return -1, and don't change the namask, if failed.
2940Sstevel@tonic-gate  *	Side Effect: Sets aug_na to -1 if error, 1 if successful.
2950Sstevel@tonic-gate  */
2960Sstevel@tonic-gate int
aug_save_namask()2970Sstevel@tonic-gate aug_save_namask()
2980Sstevel@tonic-gate {
2990Sstevel@tonic-gate 	au_mask_t mask;
3000Sstevel@tonic-gate 
3010Sstevel@tonic-gate 	aug_na = -1;
3020Sstevel@tonic-gate 
3030Sstevel@tonic-gate 	/*
3040Sstevel@tonic-gate 	 * get non-attributable system event mask from kernel.
3050Sstevel@tonic-gate 	 */
3060Sstevel@tonic-gate 	if (auditon(A_GETKMASK, (caddr_t)&mask, sizeof (mask)) != 0) {
3070Sstevel@tonic-gate 		return (-1);
3080Sstevel@tonic-gate 	}
3090Sstevel@tonic-gate 
3100Sstevel@tonic-gate 	aug_namask.am_success = mask.am_success;
3110Sstevel@tonic-gate 	aug_namask.am_failure = mask.am_failure;
3120Sstevel@tonic-gate 	aug_na = 1;
3130Sstevel@tonic-gate 	return (0);
3140Sstevel@tonic-gate }
3150Sstevel@tonic-gate 
3160Sstevel@tonic-gate void
aug_save_event(au_event_t id)3170Sstevel@tonic-gate aug_save_event(au_event_t id)
3180Sstevel@tonic-gate {
3190Sstevel@tonic-gate 	aug_event = id;
3200Sstevel@tonic-gate }
3210Sstevel@tonic-gate 
3220Sstevel@tonic-gate void
aug_save_sorf(int sorf)3230Sstevel@tonic-gate aug_save_sorf(int sorf)
3240Sstevel@tonic-gate {
3250Sstevel@tonic-gate 	aug_sorf = sorf;
3260Sstevel@tonic-gate }
3270Sstevel@tonic-gate 
3280Sstevel@tonic-gate void
aug_save_text(char * s)3290Sstevel@tonic-gate aug_save_text(char *s)
3300Sstevel@tonic-gate {
3310Sstevel@tonic-gate 	if (aug_text != NULL)
3320Sstevel@tonic-gate 		free(aug_text);
3330Sstevel@tonic-gate 	if (s == NULL)
3340Sstevel@tonic-gate 		aug_text = NULL;
3350Sstevel@tonic-gate 	else
3360Sstevel@tonic-gate 		aug_text = strdup(s);
3370Sstevel@tonic-gate }
3380Sstevel@tonic-gate 
3390Sstevel@tonic-gate void
aug_save_text1(char * s)3400Sstevel@tonic-gate aug_save_text1(char *s)
3410Sstevel@tonic-gate {
3420Sstevel@tonic-gate 	if (aug_text1 != NULL)
3430Sstevel@tonic-gate 		free(aug_text1);
3440Sstevel@tonic-gate 	if (s == NULL)
3450Sstevel@tonic-gate 		aug_text1 = NULL;
3460Sstevel@tonic-gate 	else
3470Sstevel@tonic-gate 		aug_text1 = strdup(s);
3480Sstevel@tonic-gate }
3490Sstevel@tonic-gate 
3500Sstevel@tonic-gate void
aug_save_text2(char * s)3510Sstevel@tonic-gate aug_save_text2(char *s)
3520Sstevel@tonic-gate {
3530Sstevel@tonic-gate 	if (aug_text2 != NULL)
3540Sstevel@tonic-gate 		free(aug_text2);
3550Sstevel@tonic-gate 	if (s == NULL)
3560Sstevel@tonic-gate 		aug_text2 = NULL;
3570Sstevel@tonic-gate 	else
3580Sstevel@tonic-gate 		aug_text2 = strdup(s);
3590Sstevel@tonic-gate }
3600Sstevel@tonic-gate 
3610Sstevel@tonic-gate void
aug_save_na(int flag)3620Sstevel@tonic-gate aug_save_na(int flag)
3630Sstevel@tonic-gate {
3640Sstevel@tonic-gate 	aug_na = flag;
3650Sstevel@tonic-gate }
3660Sstevel@tonic-gate 
3670Sstevel@tonic-gate void
aug_save_path(char * s)3680Sstevel@tonic-gate aug_save_path(char *s)
3690Sstevel@tonic-gate {
3700Sstevel@tonic-gate 	if (aug_path != NULL)
3710Sstevel@tonic-gate 		free(aug_path);
3720Sstevel@tonic-gate 	if (s == NULL)
3730Sstevel@tonic-gate 		aug_path = NULL;
3740Sstevel@tonic-gate 	aug_path = strdup(s);
3750Sstevel@tonic-gate }
3760Sstevel@tonic-gate 
3770Sstevel@tonic-gate int
aug_save_policy()3780Sstevel@tonic-gate aug_save_policy()
3790Sstevel@tonic-gate {
380*11871SMarek.Pospisil@Sun.COM 	uint32_t policy;
3810Sstevel@tonic-gate 
3820Sstevel@tonic-gate 	if (auditon(A_GETPOLICY, (caddr_t)&policy, sizeof (policy))) {
3830Sstevel@tonic-gate 		return (-1);
3840Sstevel@tonic-gate 	}
3850Sstevel@tonic-gate 	aug_policy = policy;
3860Sstevel@tonic-gate 	return (0);
3870Sstevel@tonic-gate }
3880Sstevel@tonic-gate 
3890Sstevel@tonic-gate /*
3900Sstevel@tonic-gate  * aug_audit:
3910Sstevel@tonic-gate  *	Cut and audit record if it is selected.
3920Sstevel@tonic-gate  *	Return 0, if successfully written.
3930Sstevel@tonic-gate  *	Return 0, if not written, and not expected to write.
3940Sstevel@tonic-gate  *	Return -1, if not written because of unexpected error.
3950Sstevel@tonic-gate  */
3960Sstevel@tonic-gate int
aug_audit(void)3970Sstevel@tonic-gate aug_audit(void)
3980Sstevel@tonic-gate {
3990Sstevel@tonic-gate 	int ad;
4000Sstevel@tonic-gate 
4010Sstevel@tonic-gate 	if (cannot_audit(0)) {
4020Sstevel@tonic-gate 		return (0);
4030Sstevel@tonic-gate 	}
4040Sstevel@tonic-gate 
4050Sstevel@tonic-gate 	if (aug_na) {
4060Sstevel@tonic-gate 		if (!aug_na_selected()) {
4070Sstevel@tonic-gate 			return (0);
4080Sstevel@tonic-gate 		}
4090Sstevel@tonic-gate 	} else if (!aug_selected()) {
4100Sstevel@tonic-gate 		return (0);
4110Sstevel@tonic-gate 	}
4120Sstevel@tonic-gate 
4130Sstevel@tonic-gate 	if ((ad = au_open()) == -1) {
4140Sstevel@tonic-gate 		return (-1);
4150Sstevel@tonic-gate 	}
4160Sstevel@tonic-gate 
4170Sstevel@tonic-gate 	(void) au_write(ad, au_to_subject_ex(aug_auid, aug_euid, aug_egid,
41811134SCasper.Dik@Sun.COM 	    aug_uid, aug_gid, aug_pid, aug_asid, &aug_tid));
4192376Sgww 	if (is_system_labeled())
4202376Sgww 		(void) au_write(ad, au_to_mylabel());
4210Sstevel@tonic-gate 	if (aug_policy & AUDIT_GROUP) {
4220Sstevel@tonic-gate 		int ng;
42311134SCasper.Dik@Sun.COM 		int maxgrp = getgroups(0, NULL);
42411134SCasper.Dik@Sun.COM 		gid_t *grplst = alloca(maxgrp * sizeof (gid_t));
4250Sstevel@tonic-gate 
42611134SCasper.Dik@Sun.COM 		if ((ng = getgroups(maxgrp, grplst)) > 0) {
4270Sstevel@tonic-gate 			(void) au_write(ad, au_to_newgroups(ng, grplst));
4280Sstevel@tonic-gate 		}
4290Sstevel@tonic-gate 	}
4300Sstevel@tonic-gate 	if (aug_text != NULL) {
4310Sstevel@tonic-gate 		(void) au_write(ad, au_to_text(aug_text));
4320Sstevel@tonic-gate 	}
4330Sstevel@tonic-gate 	if (aug_text1 != NULL) {
4340Sstevel@tonic-gate 		(void) au_write(ad, au_to_text(aug_text1));
4350Sstevel@tonic-gate 	}
4360Sstevel@tonic-gate 	if (aug_text2 != NULL) {
4370Sstevel@tonic-gate 		(void) au_write(ad, au_to_text(aug_text2));
4380Sstevel@tonic-gate 	}
4390Sstevel@tonic-gate 	if (aug_path != NULL) {
4400Sstevel@tonic-gate 		(void) au_write(ad, au_to_path(aug_path));
4410Sstevel@tonic-gate 	}
4420Sstevel@tonic-gate 	if (aug_afunc != NULL) {
4430Sstevel@tonic-gate 		(*aug_afunc)(ad);
4440Sstevel@tonic-gate 	}
4450Sstevel@tonic-gate #ifdef _LP64
4460Sstevel@tonic-gate 	(void) au_write(ad, au_to_return64((aug_sorf == 0) ? 0 : -1,
4472376Sgww 	    (int64_t)aug_sorf));
4480Sstevel@tonic-gate #else
4490Sstevel@tonic-gate 	(void) au_write(ad, au_to_return32((aug_sorf == 0) ? 0 : -1,
4502376Sgww 	    (int32_t)aug_sorf));
4510Sstevel@tonic-gate #endif
4520Sstevel@tonic-gate 	if (au_close(ad, 1, aug_event) < 0) {
4530Sstevel@tonic-gate 		(void) au_close(ad, 0, 0);
4540Sstevel@tonic-gate 		return (-1);
4550Sstevel@tonic-gate 	}
4560Sstevel@tonic-gate 
4570Sstevel@tonic-gate 	return (0);
4580Sstevel@tonic-gate }
4590Sstevel@tonic-gate 
4600Sstevel@tonic-gate int
aug_na_selected()4610Sstevel@tonic-gate aug_na_selected()
4620Sstevel@tonic-gate {
4630Sstevel@tonic-gate 	if (aug_na == -1) {
4640Sstevel@tonic-gate 		return (-1);
4650Sstevel@tonic-gate 	}
4660Sstevel@tonic-gate 
4670Sstevel@tonic-gate 	return (selected(aug_event, &aug_namask, aug_sorf));
4680Sstevel@tonic-gate }
4690Sstevel@tonic-gate 
4700Sstevel@tonic-gate int
aug_selected()4710Sstevel@tonic-gate aug_selected()
4720Sstevel@tonic-gate {
4730Sstevel@tonic-gate 	auditinfo_addr_t mask;
4740Sstevel@tonic-gate 
4754321Scasper 	if (aug_uid > MAXEPHUID) {
4760Sstevel@tonic-gate 		(void) aug_save_namask();
4770Sstevel@tonic-gate 		return (aug_na_selected());
4780Sstevel@tonic-gate 	}
4790Sstevel@tonic-gate 	if (getaudit_addr(&mask, sizeof (mask))) {
4800Sstevel@tonic-gate 		return (-1);
4810Sstevel@tonic-gate 	}
4820Sstevel@tonic-gate 
4830Sstevel@tonic-gate 	return (selected(aug_event, &mask.ai_mask, aug_sorf));
4840Sstevel@tonic-gate }
4850Sstevel@tonic-gate 
4860Sstevel@tonic-gate static int
selected(au_event_t e,au_mask_t * m,int sorf)4870Sstevel@tonic-gate selected(au_event_t e, au_mask_t *m, int sorf)
4880Sstevel@tonic-gate {
4890Sstevel@tonic-gate 	int prs_sorf;
4900Sstevel@tonic-gate 
4910Sstevel@tonic-gate 	if (sorf == 0) {
4920Sstevel@tonic-gate 		prs_sorf = AU_PRS_SUCCESS;
4930Sstevel@tonic-gate 	} else if (sorf == -1) {
4940Sstevel@tonic-gate 		prs_sorf = AU_PRS_FAILURE;
4950Sstevel@tonic-gate 	} else {
4960Sstevel@tonic-gate 		prs_sorf = AU_PRS_BOTH;
4970Sstevel@tonic-gate 	}
4980Sstevel@tonic-gate 
4990Sstevel@tonic-gate 	return (au_preselect(e, m, prs_sorf, AU_PRS_REREAD));
5000Sstevel@tonic-gate }
501