1*0Sstevel@tonic-gate /* 2*0Sstevel@tonic-gate * CDDL HEADER START 3*0Sstevel@tonic-gate * 4*0Sstevel@tonic-gate * The contents of this file are subject to the terms of the 5*0Sstevel@tonic-gate * Common Development and Distribution License, Version 1.0 only 6*0Sstevel@tonic-gate * (the "License"). You may not use this file except in compliance 7*0Sstevel@tonic-gate * with the License. 8*0Sstevel@tonic-gate * 9*0Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 10*0Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing. 11*0Sstevel@tonic-gate * See the License for the specific language governing permissions 12*0Sstevel@tonic-gate * and limitations under the License. 13*0Sstevel@tonic-gate * 14*0Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each 15*0Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 16*0Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the 17*0Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying 18*0Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner] 19*0Sstevel@tonic-gate * 20*0Sstevel@tonic-gate * CDDL HEADER END 21*0Sstevel@tonic-gate */ 22*0Sstevel@tonic-gate /* 23*0Sstevel@tonic-gate * Copyright 2004 Sun Microsystems, Inc. All rights reserved. 24*0Sstevel@tonic-gate * Use is subject to license terms. 25*0Sstevel@tonic-gate */ 26*0Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI" 27*0Sstevel@tonic-gate 28*0Sstevel@tonic-gate #include <netdb.h> 29*0Sstevel@tonic-gate #include <netinet/in.h> 30*0Sstevel@tonic-gate #include <pwd.h> 31*0Sstevel@tonic-gate #include <sys/errno.h> 32*0Sstevel@tonic-gate #include <sys/mutex.h> 33*0Sstevel@tonic-gate #include <sys/param.h> 34*0Sstevel@tonic-gate #include <sys/socket.h> 35*0Sstevel@tonic-gate #include <sys/stat.h> 36*0Sstevel@tonic-gate #include <sys/types.h> 37*0Sstevel@tonic-gate #include <string.h> 38*0Sstevel@tonic-gate #include <unistd.h> 39*0Sstevel@tonic-gate #include <stdlib.h> 40*0Sstevel@tonic-gate #include <bsm/audit.h> 41*0Sstevel@tonic-gate #include <bsm/libbsm.h> 42*0Sstevel@tonic-gate #include <bsm/audit_uevents.h> 43*0Sstevel@tonic-gate #include <bsm/audit_record.h> 44*0Sstevel@tonic-gate 45*0Sstevel@tonic-gate #define AUC_NEVER -2 /* audit module not loaded */ 46*0Sstevel@tonic-gate 47*0Sstevel@tonic-gate /* Private Functions */ 48*0Sstevel@tonic-gate static int selected(au_event_t, au_mask_t *, int); 49*0Sstevel@tonic-gate 50*0Sstevel@tonic-gate int aug_selected(); 51*0Sstevel@tonic-gate int aug_na_selected(); 52*0Sstevel@tonic-gate 53*0Sstevel@tonic-gate /* Global Variables */ 54*0Sstevel@tonic-gate static au_id_t aug_auid; /* auid of user writing audit record */ 55*0Sstevel@tonic-gate static uid_t aug_uid; /* uid of user writing audit record */ 56*0Sstevel@tonic-gate static uid_t aug_euid; /* euid of user writing audit record */ 57*0Sstevel@tonic-gate static gid_t aug_gid; /* gid of user writing audit record */ 58*0Sstevel@tonic-gate static gid_t aug_egid; /* euid of user writing audit record */ 59*0Sstevel@tonic-gate static pid_t aug_pid; /* pid of user writing audit record */ 60*0Sstevel@tonic-gate static au_tid_addr_t aug_tid; /* tid of user writing audit record */ 61*0Sstevel@tonic-gate static int aug_na; /* 0 if event is attributable */ 62*0Sstevel@tonic-gate static au_mask_t aug_namask; /* not attributable flags */ 63*0Sstevel@tonic-gate static au_event_t aug_event; /* id of event being audited */ 64*0Sstevel@tonic-gate static int aug_sorf; /* success or failure of aug_event */ 65*0Sstevel@tonic-gate static char *aug_text; /* misc text to be written to trail */ 66*0Sstevel@tonic-gate static char *aug_text1; /* misc text to be written to trail */ 67*0Sstevel@tonic-gate static char *aug_text2; /* misc text to be written to trail */ 68*0Sstevel@tonic-gate static au_asid_t aug_asid; /* asid of process writing record */ 69*0Sstevel@tonic-gate static int (*aug_afunc)(); /* write additional tokens if needed */ 70*0Sstevel@tonic-gate static char *aug_path; /* path token */ 71*0Sstevel@tonic-gate static int aug_policy; /* kernel audit policy */ 72*0Sstevel@tonic-gate 73*0Sstevel@tonic-gate /* 74*0Sstevel@tonic-gate * cannot_audit: 75*0Sstevel@tonic-gate * Return 1 if audit module not loaded. 76*0Sstevel@tonic-gate * Return 0 otherwise. 77*0Sstevel@tonic-gate * 78*0Sstevel@tonic-gate * The argument, force, should be set to 1 for long-lived processes 79*0Sstevel@tonic-gate * like some daemons. Force should be set to 0 for most programs. 80*0Sstevel@tonic-gate */ 81*0Sstevel@tonic-gate int 82*0Sstevel@tonic-gate cannot_audit(force) 83*0Sstevel@tonic-gate int force; 84*0Sstevel@tonic-gate { 85*0Sstevel@tonic-gate static int auc = AUC_UNSET; 86*0Sstevel@tonic-gate int cond = 0; 87*0Sstevel@tonic-gate 88*0Sstevel@tonic-gate if (auc == AUC_UNSET || force) { 89*0Sstevel@tonic-gate if (auditon(A_GETCOND, (caddr_t)&cond, sizeof (cond))) { 90*0Sstevel@tonic-gate auc = AUC_NEVER; 91*0Sstevel@tonic-gate } else { 92*0Sstevel@tonic-gate auc = cond; 93*0Sstevel@tonic-gate } 94*0Sstevel@tonic-gate } 95*0Sstevel@tonic-gate return (auc == AUC_NEVER); 96*0Sstevel@tonic-gate } 97*0Sstevel@tonic-gate 98*0Sstevel@tonic-gate /* 99*0Sstevel@tonic-gate * aug_init(): 100*0Sstevel@tonic-gate * Initialize global variables. 101*0Sstevel@tonic-gate */ 102*0Sstevel@tonic-gate void 103*0Sstevel@tonic-gate aug_init() 104*0Sstevel@tonic-gate { 105*0Sstevel@tonic-gate aug_auid = -1; 106*0Sstevel@tonic-gate aug_uid = -1; 107*0Sstevel@tonic-gate aug_euid = -1; 108*0Sstevel@tonic-gate aug_gid = -1; 109*0Sstevel@tonic-gate aug_egid = -1; 110*0Sstevel@tonic-gate aug_pid = -1; 111*0Sstevel@tonic-gate aug_tid.at_port = 0; 112*0Sstevel@tonic-gate aug_tid.at_type = AU_IPv4; 113*0Sstevel@tonic-gate aug_tid.at_addr[0] = 0; 114*0Sstevel@tonic-gate aug_tid.at_addr[1] = 0; 115*0Sstevel@tonic-gate aug_tid.at_addr[2] = 0; 116*0Sstevel@tonic-gate aug_tid.at_addr[3] = 0; 117*0Sstevel@tonic-gate aug_namask.am_success = AU_MASK_ALL; 118*0Sstevel@tonic-gate aug_namask.am_failure = AU_MASK_ALL; 119*0Sstevel@tonic-gate aug_event = 0; 120*0Sstevel@tonic-gate aug_sorf = -2; 121*0Sstevel@tonic-gate aug_text = NULL; 122*0Sstevel@tonic-gate aug_text1 = NULL; 123*0Sstevel@tonic-gate aug_text2 = NULL; 124*0Sstevel@tonic-gate aug_na = 0; 125*0Sstevel@tonic-gate aug_asid = -1; 126*0Sstevel@tonic-gate aug_afunc = NULL; 127*0Sstevel@tonic-gate aug_path = NULL; 128*0Sstevel@tonic-gate } 129*0Sstevel@tonic-gate 130*0Sstevel@tonic-gate /* 131*0Sstevel@tonic-gate * aug_get_port: 132*0Sstevel@tonic-gate * Return the raw device number of the port to which the 133*0Sstevel@tonic-gate * current process is attached (assumed to be attached 134*0Sstevel@tonic-gate * through file descriptor 0) or 0 if can't stat the port. 135*0Sstevel@tonic-gate */ 136*0Sstevel@tonic-gate dev_t 137*0Sstevel@tonic-gate aug_get_port() 138*0Sstevel@tonic-gate { 139*0Sstevel@tonic-gate int rc; 140*0Sstevel@tonic-gate char *ttyn; 141*0Sstevel@tonic-gate struct stat sb; 142*0Sstevel@tonic-gate 143*0Sstevel@tonic-gate ttyn = ttyname(0); 144*0Sstevel@tonic-gate if (ttyn == 0 || *ttyn == '\0') { 145*0Sstevel@tonic-gate return (0); 146*0Sstevel@tonic-gate } 147*0Sstevel@tonic-gate 148*0Sstevel@tonic-gate rc = stat(ttyn, &sb); 149*0Sstevel@tonic-gate if (rc < 0) { 150*0Sstevel@tonic-gate perror("stat"); 151*0Sstevel@tonic-gate return (0); 152*0Sstevel@tonic-gate } 153*0Sstevel@tonic-gate 154*0Sstevel@tonic-gate return ((dev_t)sb.st_rdev); 155*0Sstevel@tonic-gate } 156*0Sstevel@tonic-gate 157*0Sstevel@tonic-gate /* 158*0Sstevel@tonic-gate * aug_get_machine: 159*0Sstevel@tonic-gate * Return internet address of host hostname, 160*0Sstevel@tonic-gate * or 0 if can't do lookup. 161*0Sstevel@tonic-gate */ 162*0Sstevel@tonic-gate 163*0Sstevel@tonic-gate int 164*0Sstevel@tonic-gate aug_get_machine(const char *hostname, uint32_t *buf, uint32_t *type) 165*0Sstevel@tonic-gate { 166*0Sstevel@tonic-gate struct addrinfo *ai; 167*0Sstevel@tonic-gate int err; 168*0Sstevel@tonic-gate void *p; 169*0Sstevel@tonic-gate 170*0Sstevel@tonic-gate err = getaddrinfo(hostname, NULL, NULL, &ai); 171*0Sstevel@tonic-gate if (err != 0) 172*0Sstevel@tonic-gate return (0); 173*0Sstevel@tonic-gate 174*0Sstevel@tonic-gate switch (ai->ai_family) { 175*0Sstevel@tonic-gate case AF_INET: 176*0Sstevel@tonic-gate /* LINTED */ 177*0Sstevel@tonic-gate p = &((struct sockaddr_in *)ai->ai_addr)->sin_addr, 178*0Sstevel@tonic-gate (void) memcpy(buf, p, 179*0Sstevel@tonic-gate sizeof (((struct sockaddr_in *)0)->sin_addr)); 180*0Sstevel@tonic-gate *type = AU_IPv4; 181*0Sstevel@tonic-gate break; 182*0Sstevel@tonic-gate case AF_INET6: 183*0Sstevel@tonic-gate /* LINTED */ 184*0Sstevel@tonic-gate p = &((struct sockaddr_in6 *)ai->ai_addr)->sin6_addr, 185*0Sstevel@tonic-gate (void) memcpy(buf, p, 186*0Sstevel@tonic-gate sizeof (((struct sockaddr_in6 *)0)->sin6_addr)); 187*0Sstevel@tonic-gate *type = AU_IPv6; 188*0Sstevel@tonic-gate break; 189*0Sstevel@tonic-gate default: 190*0Sstevel@tonic-gate return (0); 191*0Sstevel@tonic-gate } 192*0Sstevel@tonic-gate 193*0Sstevel@tonic-gate freeaddrinfo(ai); 194*0Sstevel@tonic-gate 195*0Sstevel@tonic-gate return (1); 196*0Sstevel@tonic-gate } 197*0Sstevel@tonic-gate 198*0Sstevel@tonic-gate void 199*0Sstevel@tonic-gate aug_save_auid(au_id_t id) 200*0Sstevel@tonic-gate { 201*0Sstevel@tonic-gate aug_auid = id; 202*0Sstevel@tonic-gate } 203*0Sstevel@tonic-gate 204*0Sstevel@tonic-gate void 205*0Sstevel@tonic-gate aug_save_uid(uid_t id) 206*0Sstevel@tonic-gate { 207*0Sstevel@tonic-gate aug_uid = id; 208*0Sstevel@tonic-gate } 209*0Sstevel@tonic-gate 210*0Sstevel@tonic-gate void 211*0Sstevel@tonic-gate aug_save_euid(uid_t id) 212*0Sstevel@tonic-gate { 213*0Sstevel@tonic-gate aug_euid = id; 214*0Sstevel@tonic-gate } 215*0Sstevel@tonic-gate 216*0Sstevel@tonic-gate void 217*0Sstevel@tonic-gate aug_save_gid(gid_t id) 218*0Sstevel@tonic-gate { 219*0Sstevel@tonic-gate aug_gid = id; 220*0Sstevel@tonic-gate } 221*0Sstevel@tonic-gate 222*0Sstevel@tonic-gate void 223*0Sstevel@tonic-gate aug_save_egid(gid_t id) 224*0Sstevel@tonic-gate { 225*0Sstevel@tonic-gate aug_egid = id; 226*0Sstevel@tonic-gate } 227*0Sstevel@tonic-gate 228*0Sstevel@tonic-gate void 229*0Sstevel@tonic-gate aug_save_pid(pid_t id) 230*0Sstevel@tonic-gate { 231*0Sstevel@tonic-gate aug_pid = id; 232*0Sstevel@tonic-gate } 233*0Sstevel@tonic-gate 234*0Sstevel@tonic-gate void 235*0Sstevel@tonic-gate aug_save_asid(au_asid_t id) 236*0Sstevel@tonic-gate { 237*0Sstevel@tonic-gate aug_asid = id; 238*0Sstevel@tonic-gate } 239*0Sstevel@tonic-gate 240*0Sstevel@tonic-gate void 241*0Sstevel@tonic-gate aug_save_afunc(int (*afunc)()) 242*0Sstevel@tonic-gate { 243*0Sstevel@tonic-gate aug_afunc = afunc; 244*0Sstevel@tonic-gate } 245*0Sstevel@tonic-gate 246*0Sstevel@tonic-gate void 247*0Sstevel@tonic-gate aug_save_tid(dev_t port, int machine) 248*0Sstevel@tonic-gate { 249*0Sstevel@tonic-gate aug_tid.at_port = port; 250*0Sstevel@tonic-gate aug_tid.at_type = AU_IPv4; 251*0Sstevel@tonic-gate aug_tid.at_addr[0] = machine; 252*0Sstevel@tonic-gate } 253*0Sstevel@tonic-gate 254*0Sstevel@tonic-gate void 255*0Sstevel@tonic-gate aug_save_tid_ex(dev_t port, uint32_t *machine, uint32_t type) 256*0Sstevel@tonic-gate { 257*0Sstevel@tonic-gate int i; 258*0Sstevel@tonic-gate 259*0Sstevel@tonic-gate aug_tid.at_port = port; 260*0Sstevel@tonic-gate if ((type != AU_IPv4) && (type != AU_IPv6)) 261*0Sstevel@tonic-gate type = AU_IPv4; 262*0Sstevel@tonic-gate 263*0Sstevel@tonic-gate aug_tid.at_type = type; 264*0Sstevel@tonic-gate for (i = 0; i < (type/4); i++) 265*0Sstevel@tonic-gate aug_tid.at_addr[i] = machine[i]; 266*0Sstevel@tonic-gate } 267*0Sstevel@tonic-gate 268*0Sstevel@tonic-gate int 269*0Sstevel@tonic-gate aug_save_me(void) 270*0Sstevel@tonic-gate { 271*0Sstevel@tonic-gate auditinfo_addr_t ai; 272*0Sstevel@tonic-gate 273*0Sstevel@tonic-gate if (getaudit_addr(&ai, sizeof (ai))) 274*0Sstevel@tonic-gate return (-1); 275*0Sstevel@tonic-gate 276*0Sstevel@tonic-gate aug_save_auid(ai.ai_auid); 277*0Sstevel@tonic-gate aug_save_euid(geteuid()); 278*0Sstevel@tonic-gate aug_save_egid(getegid()); 279*0Sstevel@tonic-gate aug_save_uid(getuid()); 280*0Sstevel@tonic-gate aug_save_gid(getgid()); 281*0Sstevel@tonic-gate aug_save_pid(getpid()); 282*0Sstevel@tonic-gate aug_save_asid(ai.ai_asid); 283*0Sstevel@tonic-gate aug_save_tid_ex(ai.ai_termid.at_port, 284*0Sstevel@tonic-gate ai.ai_termid.at_addr, 285*0Sstevel@tonic-gate ai.ai_termid.at_type); 286*0Sstevel@tonic-gate return (0); 287*0Sstevel@tonic-gate } 288*0Sstevel@tonic-gate 289*0Sstevel@tonic-gate /* 290*0Sstevel@tonic-gate * aug_save_namask(): 291*0Sstevel@tonic-gate * Save the namask using the naflags entry in the audit_control file. 292*0Sstevel@tonic-gate * Return 0 if successful. 293*0Sstevel@tonic-gate * Return -1, and don't change the namask, if failed. 294*0Sstevel@tonic-gate * Side Effect: Sets aug_na to -1 if error, 1 if successful. 295*0Sstevel@tonic-gate */ 296*0Sstevel@tonic-gate int 297*0Sstevel@tonic-gate aug_save_namask() 298*0Sstevel@tonic-gate { 299*0Sstevel@tonic-gate au_mask_t mask; 300*0Sstevel@tonic-gate 301*0Sstevel@tonic-gate aug_na = -1; 302*0Sstevel@tonic-gate 303*0Sstevel@tonic-gate /* 304*0Sstevel@tonic-gate * get non-attributable system event mask from kernel. 305*0Sstevel@tonic-gate */ 306*0Sstevel@tonic-gate if (auditon(A_GETKMASK, (caddr_t)&mask, sizeof (mask)) != 0) { 307*0Sstevel@tonic-gate return (-1); 308*0Sstevel@tonic-gate } 309*0Sstevel@tonic-gate 310*0Sstevel@tonic-gate aug_namask.am_success = mask.am_success; 311*0Sstevel@tonic-gate aug_namask.am_failure = mask.am_failure; 312*0Sstevel@tonic-gate aug_na = 1; 313*0Sstevel@tonic-gate return (0); 314*0Sstevel@tonic-gate } 315*0Sstevel@tonic-gate 316*0Sstevel@tonic-gate void 317*0Sstevel@tonic-gate aug_save_event(au_event_t id) 318*0Sstevel@tonic-gate { 319*0Sstevel@tonic-gate aug_event = id; 320*0Sstevel@tonic-gate } 321*0Sstevel@tonic-gate 322*0Sstevel@tonic-gate void 323*0Sstevel@tonic-gate aug_save_sorf(int sorf) 324*0Sstevel@tonic-gate { 325*0Sstevel@tonic-gate aug_sorf = sorf; 326*0Sstevel@tonic-gate } 327*0Sstevel@tonic-gate 328*0Sstevel@tonic-gate void 329*0Sstevel@tonic-gate aug_save_text(char *s) 330*0Sstevel@tonic-gate { 331*0Sstevel@tonic-gate if (aug_text != NULL) 332*0Sstevel@tonic-gate free(aug_text); 333*0Sstevel@tonic-gate if (s == NULL) 334*0Sstevel@tonic-gate aug_text = NULL; 335*0Sstevel@tonic-gate else 336*0Sstevel@tonic-gate aug_text = strdup(s); 337*0Sstevel@tonic-gate } 338*0Sstevel@tonic-gate 339*0Sstevel@tonic-gate void 340*0Sstevel@tonic-gate aug_save_text1(char *s) 341*0Sstevel@tonic-gate { 342*0Sstevel@tonic-gate if (aug_text1 != NULL) 343*0Sstevel@tonic-gate free(aug_text1); 344*0Sstevel@tonic-gate if (s == NULL) 345*0Sstevel@tonic-gate aug_text1 = NULL; 346*0Sstevel@tonic-gate else 347*0Sstevel@tonic-gate aug_text1 = strdup(s); 348*0Sstevel@tonic-gate } 349*0Sstevel@tonic-gate 350*0Sstevel@tonic-gate void 351*0Sstevel@tonic-gate aug_save_text2(char *s) 352*0Sstevel@tonic-gate { 353*0Sstevel@tonic-gate if (aug_text2 != NULL) 354*0Sstevel@tonic-gate free(aug_text2); 355*0Sstevel@tonic-gate if (s == NULL) 356*0Sstevel@tonic-gate aug_text2 = NULL; 357*0Sstevel@tonic-gate else 358*0Sstevel@tonic-gate aug_text2 = strdup(s); 359*0Sstevel@tonic-gate } 360*0Sstevel@tonic-gate 361*0Sstevel@tonic-gate void 362*0Sstevel@tonic-gate aug_save_na(int flag) 363*0Sstevel@tonic-gate { 364*0Sstevel@tonic-gate aug_na = flag; 365*0Sstevel@tonic-gate } 366*0Sstevel@tonic-gate 367*0Sstevel@tonic-gate void 368*0Sstevel@tonic-gate aug_save_path(char *s) 369*0Sstevel@tonic-gate { 370*0Sstevel@tonic-gate if (aug_path != NULL) 371*0Sstevel@tonic-gate free(aug_path); 372*0Sstevel@tonic-gate if (s == NULL) 373*0Sstevel@tonic-gate aug_path = NULL; 374*0Sstevel@tonic-gate aug_path = strdup(s); 375*0Sstevel@tonic-gate } 376*0Sstevel@tonic-gate 377*0Sstevel@tonic-gate int 378*0Sstevel@tonic-gate aug_save_policy() 379*0Sstevel@tonic-gate { 380*0Sstevel@tonic-gate int policy; 381*0Sstevel@tonic-gate 382*0Sstevel@tonic-gate if (auditon(A_GETPOLICY, (caddr_t)&policy, sizeof (policy))) { 383*0Sstevel@tonic-gate return (-1); 384*0Sstevel@tonic-gate } 385*0Sstevel@tonic-gate aug_policy = policy; 386*0Sstevel@tonic-gate return (0); 387*0Sstevel@tonic-gate } 388*0Sstevel@tonic-gate 389*0Sstevel@tonic-gate /* 390*0Sstevel@tonic-gate * aug_audit: 391*0Sstevel@tonic-gate * Cut and audit record if it is selected. 392*0Sstevel@tonic-gate * Return 0, if successfully written. 393*0Sstevel@tonic-gate * Return 0, if not written, and not expected to write. 394*0Sstevel@tonic-gate * Return -1, if not written because of unexpected error. 395*0Sstevel@tonic-gate */ 396*0Sstevel@tonic-gate int 397*0Sstevel@tonic-gate aug_audit(void) 398*0Sstevel@tonic-gate { 399*0Sstevel@tonic-gate int ad; 400*0Sstevel@tonic-gate 401*0Sstevel@tonic-gate if (cannot_audit(0)) { 402*0Sstevel@tonic-gate return (0); 403*0Sstevel@tonic-gate } 404*0Sstevel@tonic-gate 405*0Sstevel@tonic-gate if (aug_na) { 406*0Sstevel@tonic-gate if (!aug_na_selected()) { 407*0Sstevel@tonic-gate return (0); 408*0Sstevel@tonic-gate } 409*0Sstevel@tonic-gate } else if (!aug_selected()) { 410*0Sstevel@tonic-gate return (0); 411*0Sstevel@tonic-gate } 412*0Sstevel@tonic-gate 413*0Sstevel@tonic-gate if ((ad = au_open()) == -1) { 414*0Sstevel@tonic-gate return (-1); 415*0Sstevel@tonic-gate } 416*0Sstevel@tonic-gate 417*0Sstevel@tonic-gate (void) au_write(ad, au_to_subject_ex(aug_auid, aug_euid, aug_egid, 418*0Sstevel@tonic-gate aug_uid, aug_gid, aug_pid, aug_asid, &aug_tid)); 419*0Sstevel@tonic-gate if (aug_policy & AUDIT_GROUP) { 420*0Sstevel@tonic-gate 421*0Sstevel@tonic-gate int ng; 422*0Sstevel@tonic-gate gid_t grplst[NGROUPS_MAX]; 423*0Sstevel@tonic-gate 424*0Sstevel@tonic-gate (void) memset(grplst, 0, sizeof (grplst)); 425*0Sstevel@tonic-gate if ((ng = getgroups(NGROUPS_UMAX, grplst))) { 426*0Sstevel@tonic-gate (void) au_write(ad, au_to_newgroups(ng, grplst)); 427*0Sstevel@tonic-gate } 428*0Sstevel@tonic-gate } 429*0Sstevel@tonic-gate if (aug_text != NULL) { 430*0Sstevel@tonic-gate (void) au_write(ad, au_to_text(aug_text)); 431*0Sstevel@tonic-gate } 432*0Sstevel@tonic-gate if (aug_text1 != NULL) { 433*0Sstevel@tonic-gate (void) au_write(ad, au_to_text(aug_text1)); 434*0Sstevel@tonic-gate } 435*0Sstevel@tonic-gate if (aug_text2 != NULL) { 436*0Sstevel@tonic-gate (void) au_write(ad, au_to_text(aug_text2)); 437*0Sstevel@tonic-gate } 438*0Sstevel@tonic-gate if (aug_path != NULL) { 439*0Sstevel@tonic-gate (void) au_write(ad, au_to_path(aug_path)); 440*0Sstevel@tonic-gate } 441*0Sstevel@tonic-gate if (aug_afunc != NULL) { 442*0Sstevel@tonic-gate (*aug_afunc)(ad); 443*0Sstevel@tonic-gate } 444*0Sstevel@tonic-gate #ifdef _LP64 445*0Sstevel@tonic-gate (void) au_write(ad, au_to_return64((aug_sorf == 0) ? 0 : -1, 446*0Sstevel@tonic-gate (int64_t)aug_sorf)); 447*0Sstevel@tonic-gate #else 448*0Sstevel@tonic-gate (void) au_write(ad, au_to_return32((aug_sorf == 0) ? 0 : -1, 449*0Sstevel@tonic-gate (int32_t)aug_sorf)); 450*0Sstevel@tonic-gate #endif 451*0Sstevel@tonic-gate if (au_close(ad, 1, aug_event) < 0) { 452*0Sstevel@tonic-gate (void) au_close(ad, 0, 0); 453*0Sstevel@tonic-gate return (-1); 454*0Sstevel@tonic-gate } 455*0Sstevel@tonic-gate 456*0Sstevel@tonic-gate return (0); 457*0Sstevel@tonic-gate } 458*0Sstevel@tonic-gate 459*0Sstevel@tonic-gate int 460*0Sstevel@tonic-gate aug_na_selected() 461*0Sstevel@tonic-gate { 462*0Sstevel@tonic-gate if (aug_na == -1) { 463*0Sstevel@tonic-gate return (-1); 464*0Sstevel@tonic-gate } 465*0Sstevel@tonic-gate 466*0Sstevel@tonic-gate return (selected(aug_event, &aug_namask, aug_sorf)); 467*0Sstevel@tonic-gate } 468*0Sstevel@tonic-gate 469*0Sstevel@tonic-gate int 470*0Sstevel@tonic-gate aug_selected() 471*0Sstevel@tonic-gate { 472*0Sstevel@tonic-gate auditinfo_addr_t mask; 473*0Sstevel@tonic-gate 474*0Sstevel@tonic-gate if (aug_uid < 0) { 475*0Sstevel@tonic-gate (void) aug_save_namask(); 476*0Sstevel@tonic-gate return (aug_na_selected()); 477*0Sstevel@tonic-gate } 478*0Sstevel@tonic-gate if (getaudit_addr(&mask, sizeof (mask))) { 479*0Sstevel@tonic-gate return (-1); 480*0Sstevel@tonic-gate } 481*0Sstevel@tonic-gate 482*0Sstevel@tonic-gate return (selected(aug_event, &mask.ai_mask, aug_sorf)); 483*0Sstevel@tonic-gate } 484*0Sstevel@tonic-gate 485*0Sstevel@tonic-gate static int 486*0Sstevel@tonic-gate selected(au_event_t e, au_mask_t *m, int sorf) 487*0Sstevel@tonic-gate { 488*0Sstevel@tonic-gate int prs_sorf; 489*0Sstevel@tonic-gate 490*0Sstevel@tonic-gate if (sorf == 0) { 491*0Sstevel@tonic-gate prs_sorf = AU_PRS_SUCCESS; 492*0Sstevel@tonic-gate } else if (sorf == -1) { 493*0Sstevel@tonic-gate prs_sorf = AU_PRS_FAILURE; 494*0Sstevel@tonic-gate } else { 495*0Sstevel@tonic-gate prs_sorf = AU_PRS_BOTH; 496*0Sstevel@tonic-gate } 497*0Sstevel@tonic-gate 498*0Sstevel@tonic-gate return (au_preselect(e, m, prs_sorf, AU_PRS_REREAD)); 499*0Sstevel@tonic-gate } 500