Lines Matching refs:ar

105 audit_arg_addr(struct kaudit_record *ar, user_addr_t addr)  in audit_arg_addr()  argument
109 ar->k_ar.ar_arg_addr = addr; in audit_arg_addr()
115 ARG_SET_VALID(ar, ARG_ADDR64); in audit_arg_addr()
117 ARG_SET_VALID(ar, ARG_ADDR32); in audit_arg_addr()
122 audit_arg_exit(struct kaudit_record *ar, int status, int retval) in audit_arg_exit() argument
124 ar->k_ar.ar_arg_exitstatus = status; in audit_arg_exit()
125 ar->k_ar.ar_arg_exitretval = retval; in audit_arg_exit()
126 ARG_SET_VALID(ar, ARG_EXIT); in audit_arg_exit()
130 audit_arg_len(struct kaudit_record *ar, user_size_t len) in audit_arg_len() argument
132 ar->k_ar.ar_arg_len = len; in audit_arg_len()
133 ARG_SET_VALID(ar, ARG_LEN); in audit_arg_len()
137 audit_arg_fd2(struct kaudit_record *ar, int fd) in audit_arg_fd2() argument
139 ar->k_ar.ar_arg_fd2 = fd; in audit_arg_fd2()
140 ARG_SET_VALID(ar, ARG_FD2); in audit_arg_fd2()
144 audit_arg_fd(struct kaudit_record *ar, int fd) in audit_arg_fd() argument
146 ar->k_ar.ar_arg_fd = fd; in audit_arg_fd()
147 ARG_SET_VALID(ar, ARG_FD); in audit_arg_fd()
151 audit_arg_fflags(struct kaudit_record *ar, int fflags) in audit_arg_fflags() argument
153 ar->k_ar.ar_arg_fflags = fflags; in audit_arg_fflags()
154 ARG_SET_VALID(ar, ARG_FFLAGS); in audit_arg_fflags()
158 audit_arg_gid(struct kaudit_record *ar, gid_t gid) in audit_arg_gid() argument
160 ar->k_ar.ar_arg_gid = gid; in audit_arg_gid()
161 ARG_SET_VALID(ar, ARG_GID); in audit_arg_gid()
165 audit_arg_uid(struct kaudit_record *ar, uid_t uid) in audit_arg_uid() argument
167 ar->k_ar.ar_arg_uid = uid; in audit_arg_uid()
168 ARG_SET_VALID(ar, ARG_UID); in audit_arg_uid()
172 audit_arg_egid(struct kaudit_record *ar, gid_t egid) in audit_arg_egid() argument
174 ar->k_ar.ar_arg_egid = egid; in audit_arg_egid()
175 ARG_SET_VALID(ar, ARG_EGID); in audit_arg_egid()
179 audit_arg_euid(struct kaudit_record *ar, uid_t euid) in audit_arg_euid() argument
181 ar->k_ar.ar_arg_euid = euid; in audit_arg_euid()
182 ARG_SET_VALID(ar, ARG_EUID); in audit_arg_euid()
186 audit_arg_rgid(struct kaudit_record *ar, gid_t rgid) in audit_arg_rgid() argument
188 ar->k_ar.ar_arg_rgid = rgid; in audit_arg_rgid()
189 ARG_SET_VALID(ar, ARG_RGID); in audit_arg_rgid()
193 audit_arg_ruid(struct kaudit_record *ar, uid_t ruid) in audit_arg_ruid() argument
195 ar->k_ar.ar_arg_ruid = ruid; in audit_arg_ruid()
196 ARG_SET_VALID(ar, ARG_RUID); in audit_arg_ruid()
200 audit_arg_sgid(struct kaudit_record *ar, gid_t sgid) in audit_arg_sgid() argument
202 ar->k_ar.ar_arg_sgid = sgid; in audit_arg_sgid()
203 ARG_SET_VALID(ar, ARG_SGID); in audit_arg_sgid()
207 audit_arg_suid(struct kaudit_record *ar, uid_t suid) in audit_arg_suid() argument
209 ar->k_ar.ar_arg_suid = suid; in audit_arg_suid()
210 ARG_SET_VALID(ar, ARG_SUID); in audit_arg_suid()
214 audit_arg_groupset(struct kaudit_record *ar, const gid_t *gidset, u_int gidset_size) in audit_arg_groupset() argument
219 ar->k_ar.ar_arg_groups.gidset[i] = gidset[i]; in audit_arg_groupset()
221 ar->k_ar.ar_arg_groups.gidset_size = gidset_size; in audit_arg_groupset()
222 ARG_SET_VALID(ar, ARG_GROUPSET); in audit_arg_groupset()
226 audit_arg_login(struct kaudit_record *ar, const char *login) in audit_arg_login() argument
228 strlcpy(ar->k_ar.ar_arg_login, login, MAXLOGNAME); in audit_arg_login()
229 ARG_SET_VALID(ar, ARG_LOGIN); in audit_arg_login()
233 audit_arg_ctlname(struct kaudit_record *ar, const int *name, int namelen) in audit_arg_ctlname() argument
235 bcopy(name, &ar->k_ar.ar_arg_ctlname, namelen * sizeof(int)); in audit_arg_ctlname()
236 ar->k_ar.ar_arg_len = namelen; in audit_arg_ctlname()
237 ARG_SET_VALID(ar, ARG_CTLNAME | ARG_LEN); in audit_arg_ctlname()
241 audit_arg_mask(struct kaudit_record *ar, int mask) in audit_arg_mask() argument
243 ar->k_ar.ar_arg_mask = mask; in audit_arg_mask()
244 ARG_SET_VALID(ar, ARG_MASK); in audit_arg_mask()
248 audit_arg_mode(struct kaudit_record *ar, mode_t mode) in audit_arg_mode() argument
250 ar->k_ar.ar_arg_mode = mode; in audit_arg_mode()
251 ARG_SET_VALID(ar, ARG_MODE); in audit_arg_mode()
255 audit_arg_value32(struct kaudit_record *ar, uint32_t value32) in audit_arg_value32() argument
257 ar->k_ar.ar_arg_value32 = value32; in audit_arg_value32()
258 ARG_SET_VALID(ar, ARG_VALUE32); in audit_arg_value32()
262 audit_arg_value64(struct kaudit_record *ar, uint64_t value64) in audit_arg_value64() argument
264 ar->k_ar.ar_arg_value64 = value64; in audit_arg_value64()
265 ARG_SET_VALID(ar, ARG_VALUE64); in audit_arg_value64()
269 audit_arg_owner(struct kaudit_record *ar, uid_t uid, gid_t gid) in audit_arg_owner() argument
271 ar->k_ar.ar_arg_uid = uid; in audit_arg_owner()
272 ar->k_ar.ar_arg_gid = gid; in audit_arg_owner()
273 ARG_SET_VALID(ar, ARG_UID | ARG_GID); in audit_arg_owner()
277 audit_arg_pid(struct kaudit_record *ar, pid_t pid) in audit_arg_pid() argument
279 ar->k_ar.ar_arg_pid = pid; in audit_arg_pid()
280 ARG_SET_VALID(ar, ARG_PID); in audit_arg_pid()
284 audit_arg_process(struct kaudit_record *ar, proc_t p) in audit_arg_process() argument
295 ar->k_ar.ar_arg_auid = my_cred->cr_audit.as_aia_p->ai_auid; in audit_arg_process()
296 ar->k_ar.ar_arg_asid = my_cred->cr_audit.as_aia_p->ai_asid; in audit_arg_process()
298 &ar->k_ar.ar_arg_termid_addr, sizeof(au_tid_addr_t)); in audit_arg_process()
299 ar->k_ar.ar_arg_euid = kauth_cred_getuid(my_cred); in audit_arg_process()
300 ar->k_ar.ar_arg_egid = kauth_cred_getgid(my_cred); in audit_arg_process()
301 ar->k_ar.ar_arg_ruid = kauth_cred_getruid(my_cred); in audit_arg_process()
302 ar->k_ar.ar_arg_rgid = kauth_cred_getrgid(my_cred); in audit_arg_process()
304 ar->k_ar.ar_arg_pid = proc_getpid(p); in audit_arg_process()
305 ARG_SET_VALID(ar, ARG_AUID | ARG_EUID | ARG_EGID | ARG_RUID | in audit_arg_process()
310 audit_arg_signum(struct kaudit_record *ar, u_int signum) in audit_arg_signum() argument
312 ar->k_ar.ar_arg_signum = signum; in audit_arg_signum()
313 ARG_SET_VALID(ar, ARG_SIGNUM); in audit_arg_signum()
317 audit_arg_socket(struct kaudit_record *ar, int sodomain, int sotype, in audit_arg_socket() argument
320 ar->k_ar.ar_arg_sockinfo.sai_domain = sodomain; in audit_arg_socket()
321 ar->k_ar.ar_arg_sockinfo.sai_type = sotype; in audit_arg_socket()
322 ar->k_ar.ar_arg_sockinfo.sai_protocol = soprotocol; in audit_arg_socket()
323 ARG_SET_VALID(ar, ARG_SOCKINFO); in audit_arg_socket()
334 audit_arg_sockaddr(struct kaudit_record *ar, struct vnode *cwd_vp, in audit_arg_sockaddr() argument
347 if (sa->sa_len > sizeof(ar->k_ar.ar_arg_sockaddr)) { in audit_arg_sockaddr()
348 bcopy(sa, &ar->k_ar.ar_arg_sockaddr, sizeof(ar->k_ar.ar_arg_sockaddr)); in audit_arg_sockaddr()
350 bcopy(sa, &ar->k_ar.ar_arg_sockaddr, sa->sa_len); in audit_arg_sockaddr()
355 ARG_SET_VALID(ar, ARG_SADDRINET); in audit_arg_sockaddr()
359 ARG_SET_VALID(ar, ARG_SADDRINET6); in audit_arg_sockaddr()
371 audit_arg_upath(ar, cwd_vp, path, ARG_UPATH1); in audit_arg_sockaddr()
373 ARG_SET_VALID(ar, ARG_SADDRUNIX); in audit_arg_sockaddr()
380 audit_arg_auid(struct kaudit_record *ar, uid_t auid) in audit_arg_auid() argument
382 ar->k_ar.ar_arg_auid = auid; in audit_arg_auid()
383 ARG_SET_VALID(ar, ARG_AUID); in audit_arg_auid()
387 audit_arg_auditinfo(struct kaudit_record *ar, const struct auditinfo *au_info) in audit_arg_auditinfo() argument
389 ar->k_ar.ar_arg_auid = au_info->ai_auid; in audit_arg_auditinfo()
390 ar->k_ar.ar_arg_asid = au_info->ai_asid; in audit_arg_auditinfo()
391 ar->k_ar.ar_arg_amask.am_success = au_info->ai_mask.am_success; in audit_arg_auditinfo()
392 ar->k_ar.ar_arg_amask.am_failure = au_info->ai_mask.am_failure; in audit_arg_auditinfo()
393 ar->k_ar.ar_arg_termid.port = au_info->ai_termid.port; in audit_arg_auditinfo()
394 ar->k_ar.ar_arg_termid.machine = au_info->ai_termid.machine; in audit_arg_auditinfo()
395 ARG_SET_VALID(ar, ARG_AUID | ARG_ASID | ARG_AMASK | ARG_TERMID); in audit_arg_auditinfo()
399 audit_arg_auditinfo_addr(struct kaudit_record *ar, in audit_arg_auditinfo_addr() argument
402 ar->k_ar.ar_arg_auid = au_info->ai_auid; in audit_arg_auditinfo_addr()
403 ar->k_ar.ar_arg_asid = au_info->ai_asid; in audit_arg_auditinfo_addr()
404 ar->k_ar.ar_arg_amask.am_success = au_info->ai_mask.am_success; in audit_arg_auditinfo_addr()
405 ar->k_ar.ar_arg_amask.am_failure = au_info->ai_mask.am_failure; in audit_arg_auditinfo_addr()
406 ar->k_ar.ar_arg_termid_addr.at_type = au_info->ai_termid.at_type; in audit_arg_auditinfo_addr()
407 ar->k_ar.ar_arg_termid_addr.at_port = au_info->ai_termid.at_port; in audit_arg_auditinfo_addr()
408 ar->k_ar.ar_arg_termid_addr.at_addr[0] = au_info->ai_termid.at_addr[0]; in audit_arg_auditinfo_addr()
409 ar->k_ar.ar_arg_termid_addr.at_addr[1] = au_info->ai_termid.at_addr[1]; in audit_arg_auditinfo_addr()
410 ar->k_ar.ar_arg_termid_addr.at_addr[2] = au_info->ai_termid.at_addr[2]; in audit_arg_auditinfo_addr()
411 ar->k_ar.ar_arg_termid_addr.at_addr[3] = au_info->ai_termid.at_addr[3]; in audit_arg_auditinfo_addr()
412 ARG_SET_VALID(ar, ARG_AUID | ARG_ASID | ARG_AMASK | ARG_TERMID_ADDR); in audit_arg_auditinfo_addr()
416 audit_arg_text(struct kaudit_record *ar, const char *text) in audit_arg_text() argument
421 ar->k_ar.ar_valid_arg &= (ARG_ALL ^ ARG_TEXT); in audit_arg_text()
426 if (ar->k_ar.ar_arg_text == NULL) { in audit_arg_text()
427 ar->k_ar.ar_arg_text = zalloc(ZV_NAMEI); in audit_arg_text()
430 strlcpy(ar->k_ar.ar_arg_text, text, MAXPATHLEN); in audit_arg_text()
431 ARG_SET_VALID(ar, ARG_TEXT); in audit_arg_text()
435 audit_arg_opaque(struct kaudit_record *ar, const void *data, size_t size) in audit_arg_opaque() argument
444 if (ar->k_ar.ar_arg_opaque == NULL) { in audit_arg_opaque()
445 ar->k_ar.ar_arg_opaque = kalloc_data(size, Z_WAITOK); in audit_arg_opaque()
450 if (ar->k_ar.ar_arg_opaque == NULL) { in audit_arg_opaque()
454 memcpy(ar->k_ar.ar_arg_opaque, data, size); in audit_arg_opaque()
455 ar->k_ar.ar_arg_opq_size = (u_int16_t) size; in audit_arg_opaque()
456 ARG_SET_VALID(ar, ARG_OPAQUE); in audit_arg_opaque()
460 audit_arg_data(struct kaudit_record *ar, const void *data, size_t size, size_t number) in audit_arg_data() argument
477 if (ar->k_ar.ar_arg_data == NULL) { in audit_arg_data()
478 ar->k_ar.ar_arg_data = kalloc_data(sz, Z_WAITOK); in audit_arg_data()
483 if (ar->k_ar.ar_arg_data == NULL) { in audit_arg_data()
487 memcpy(ar->k_ar.ar_arg_data, data, sz); in audit_arg_data()
491 ar->k_ar.ar_arg_data_type = AUR_BYTE; in audit_arg_data()
495 ar->k_ar.ar_arg_data_type = AUR_SHORT; in audit_arg_data()
499 ar->k_ar.ar_arg_data_type = AUR_INT32; in audit_arg_data()
503 ar->k_ar.ar_arg_data_type = AUR_INT64; in audit_arg_data()
507 kfree_data(ar->k_ar.ar_arg_data, sz); in audit_arg_data()
508 ar->k_ar.ar_arg_data = NULL; in audit_arg_data()
512 ar->k_ar.ar_arg_data_count = (u_char)number; in audit_arg_data()
514 ARG_SET_VALID(ar, ARG_DATA); in audit_arg_data()
518 audit_arg_cmd(struct kaudit_record *ar, int cmd) in audit_arg_cmd() argument
520 ar->k_ar.ar_arg_cmd = cmd; in audit_arg_cmd()
521 ARG_SET_VALID(ar, ARG_CMD); in audit_arg_cmd()
525 audit_arg_svipc_cmd(struct kaudit_record *ar, int cmd) in audit_arg_svipc_cmd() argument
527 ar->k_ar.ar_arg_svipc_cmd = cmd; in audit_arg_svipc_cmd()
528 ARG_SET_VALID(ar, ARG_SVIPC_CMD); in audit_arg_svipc_cmd()
532 audit_arg_svipc_perm(struct kaudit_record *ar, const struct ipc_perm *perm) in audit_arg_svipc_perm() argument
534 bcopy(perm, &ar->k_ar.ar_arg_svipc_perm, in audit_arg_svipc_perm()
535 sizeof(ar->k_ar.ar_arg_svipc_perm)); in audit_arg_svipc_perm()
536 ARG_SET_VALID(ar, ARG_SVIPC_PERM); in audit_arg_svipc_perm()
540 audit_arg_svipc_id(struct kaudit_record *ar, int id) in audit_arg_svipc_id() argument
542 ar->k_ar.ar_arg_svipc_id = id; in audit_arg_svipc_id()
543 ARG_SET_VALID(ar, ARG_SVIPC_ID); in audit_arg_svipc_id()
547 audit_arg_svipc_addr(struct kaudit_record *ar, user_addr_t addr) in audit_arg_svipc_addr() argument
549 ar->k_ar.ar_arg_svipc_addr = addr; in audit_arg_svipc_addr()
550 ARG_SET_VALID(ar, ARG_SVIPC_ADDR); in audit_arg_svipc_addr()
554 audit_arg_posix_ipc_perm(struct kaudit_record *ar, uid_t uid, gid_t gid, in audit_arg_posix_ipc_perm() argument
557 ar->k_ar.ar_arg_pipc_perm.pipc_uid = uid; in audit_arg_posix_ipc_perm()
558 ar->k_ar.ar_arg_pipc_perm.pipc_gid = gid; in audit_arg_posix_ipc_perm()
559 ar->k_ar.ar_arg_pipc_perm.pipc_mode = mode; in audit_arg_posix_ipc_perm()
560 ARG_SET_VALID(ar, ARG_POSIX_IPC_PERM); in audit_arg_posix_ipc_perm()
564 audit_arg_auditon(struct kaudit_record *ar, const union auditon_udata *udata) in audit_arg_auditon() argument
566 bcopy((const void *)udata, &ar->k_ar.ar_arg_auditon, in audit_arg_auditon()
567 sizeof(ar->k_ar.ar_arg_auditon)); in audit_arg_auditon()
568 ARG_SET_VALID(ar, ARG_AUDITON); in audit_arg_auditon()
576 audit_arg_file(struct kaudit_record *ar, __unused proc_t p, in audit_arg_file() argument
587 audit_arg_vnpath_withref(ar, in audit_arg_file()
597 ar->k_ar.ar_arg_sockinfo.sai_type = in audit_arg_file()
599 ar->k_ar.ar_arg_sockinfo.sai_domain = SOCK_DOM(so); in audit_arg_file()
600 ar->k_ar.ar_arg_sockinfo.sai_protocol = SOCK_PROTO(so); in audit_arg_file()
603 &ar->k_ar.ar_arg_sockinfo.sai_faddr; in audit_arg_file()
607 &ar->k_ar.ar_arg_sockinfo.sai_laddr; in audit_arg_file()
610 ARG_SET_VALID(ar, ARG_SOCKINFO); in audit_arg_file()
616 ar->k_ar.ar_arg_sockinfo.sai_type = in audit_arg_file()
618 ar->k_ar.ar_arg_sockinfo.sai_domain = SOCK_DOM(so); in audit_arg_file()
619 ar->k_ar.ar_arg_sockinfo.sai_protocol = SOCK_PROTO(so); in audit_arg_file()
622 &ar->k_ar.ar_arg_sockinfo.sai_faddr; in audit_arg_file()
626 &ar->k_ar.ar_arg_sockinfo.sai_laddr; in audit_arg_file()
629 ARG_SET_VALID(ar, ARG_SOCKINFO); in audit_arg_file()
654 audit_arg_upath(struct kaudit_record *ar, struct vnode *cwd_vp, const char *upath, u_int64_t flag) in audit_arg_upath() argument
665 pathp = &ar->k_ar.ar_arg_upath1; in audit_arg_upath()
667 pathp = &ar->k_ar.ar_arg_upath2; in audit_arg_upath()
677 ARG_SET_VALID(ar, flag); in audit_arg_upath()
685 audit_arg_kpath(struct kaudit_record *ar, const char *kpath, u_int64_t flag) in audit_arg_kpath() argument
696 pathp = &ar->k_ar.ar_arg_kpath1; in audit_arg_kpath()
698 pathp = &ar->k_ar.ar_arg_kpath2; in audit_arg_kpath()
708 ARG_SET_VALID(ar, flag); in audit_arg_kpath()
730 audit_arg_vnpath(struct kaudit_record *ar, struct vnode *vp, u_int64_t flags) in audit_arg_vnpath() argument
755 ar->k_ar.ar_valid_arg &= (ARG_ALL ^ ARG_KPATH1); in audit_arg_vnpath()
756 ar->k_ar.ar_valid_arg &= (ARG_ALL ^ ARG_VNODE1); in audit_arg_vnpath()
757 pathp = &ar->k_ar.ar_arg_kpath1; in audit_arg_vnpath()
758 vnp = &ar->k_ar.ar_arg_vnode1; in audit_arg_vnpath()
760 vnode_mac_labelp = &ar->k_ar.ar_vnode1_mac_labels; in audit_arg_vnpath()
763 ar->k_ar.ar_valid_arg &= (ARG_ALL ^ ARG_KPATH2); in audit_arg_vnpath()
764 ar->k_ar.ar_valid_arg &= (ARG_ALL ^ ARG_VNODE2); in audit_arg_vnpath()
765 pathp = &ar->k_ar.ar_arg_kpath2; in audit_arg_vnpath()
766 vnp = &ar->k_ar.ar_arg_vnode2; in audit_arg_vnpath()
768 vnode_mac_labelp = &ar->k_ar.ar_vnode2_mac_labels; in audit_arg_vnpath()
786 ARG_SET_VALID(ar, ARG_KPATH1); in audit_arg_vnpath()
788 ARG_SET_VALID(ar, ARG_KPATH2); in audit_arg_vnpath()
832 ARG_SET_VALID(ar, ARG_VNODE1); in audit_arg_vnpath()
834 ARG_SET_VALID(ar, ARG_VNODE2); in audit_arg_vnpath()
839 audit_arg_vnpath_withref(struct kaudit_record *ar, struct vnode *vp, u_int64_t flags) in audit_arg_vnpath_withref() argument
844 audit_arg_vnpath(ar, vp, flags); in audit_arg_vnpath_withref()
849 audit_arg_mach_port1(struct kaudit_record *ar, mach_port_name_t port) in audit_arg_mach_port1() argument
851 ar->k_ar.ar_arg_mach_port1 = port; in audit_arg_mach_port1()
852 ARG_SET_VALID(ar, ARG_MACHPORT1); in audit_arg_mach_port1()
856 audit_arg_mach_port2(struct kaudit_record *ar, mach_port_name_t port) in audit_arg_mach_port2() argument
858 ar->k_ar.ar_arg_mach_port2 = port; in audit_arg_mach_port2()
859 ARG_SET_VALID(ar, ARG_MACHPORT2); in audit_arg_mach_port2()
867 audit_arg_argv(struct kaudit_record *ar, const char *argv, int argc, size_t length) in audit_arg_argv() argument
873 if (ar->k_ar.ar_arg_argv == NULL) { in audit_arg_argv()
874 ar->k_ar.ar_arg_argv = kalloc_data(length, Z_WAITOK); in audit_arg_argv()
877 if (ar->k_ar.ar_arg_argv == NULL) { in audit_arg_argv()
881 bcopy(argv, ar->k_ar.ar_arg_argv, length); in audit_arg_argv()
882 ar->k_ar.ar_arg_argc = argc; in audit_arg_argv()
883 ARG_SET_VALID(ar, ARG_ARGV); in audit_arg_argv()
890 audit_arg_envv(struct kaudit_record *ar, const char *envv, int envc, size_t length) in audit_arg_envv() argument
896 if (ar->k_ar.ar_arg_envv == NULL) { in audit_arg_envv()
897 ar->k_ar.ar_arg_envv = kalloc_data(length, Z_WAITOK); in audit_arg_envv()
900 if (ar->k_ar.ar_arg_envv == NULL) { in audit_arg_envv()
904 bcopy(envv, ar->k_ar.ar_arg_envv, length); in audit_arg_envv()
905 ar->k_ar.ar_arg_envc = envc; in audit_arg_envv()
906 ARG_SET_VALID(ar, ARG_ENVV); in audit_arg_envv()
915 audit_sysclose(struct kaudit_record *ar, proc_t p, int fd) in audit_sysclose() argument
922 audit_arg_fd(ar, fd); in audit_sysclose()
928 audit_arg_vnpath_withref(ar, (struct vnode *)fp_get_data(fp), in audit_sysclose()
1008 audit_arg_identity(struct kaudit_record *ar) in audit_arg_identity() argument
1010 audit_identity_info_construct(&ar->k_ar.ar_arg_identity); in audit_arg_identity()
1011 ARG_SET_VALID(ar, ARG_IDENTITY); in audit_arg_identity()