Lines Matching refs:ar
66 static void audit_sys_auditon(struct audit_record *ar,
200 if (ar->ar_vnode1_mac_labels != NULL && \
201 strlen(ar->ar_vnode1_mac_labels) != 0) { \
202 tok = au_to_text(ar->ar_vnode1_mac_labels); \
208 if (ar->ar_vnode2_mac_labels != NULL && \
209 strlen(ar->ar_vnode2_mac_labels) != 0) { \
210 tok = au_to_text(ar->ar_vnode2_mac_labels); \
220 tok = au_to_path(ar->ar_arg_upath1); \
227 tok = au_to_path(ar->ar_arg_upath2); \
234 tok = au_to_path(ar->ar_arg_kpath2); \
241 tok = au_to_path(ar->ar_arg_kpath1); \
245 tok = au_to_attr32(&ar->ar_arg_vnode1); \
253 tok = au_to_path(ar->ar_arg_upath1); \
257 tok = au_to_path(ar->ar_arg_kpath1); \
261 tok = au_to_attr32(&ar->ar_arg_vnode1); \
269 tok = au_to_attr32(&ar->ar_arg_vnode2); \
277 tok = au_to_path(ar->ar_arg_kpath2); \
281 tok = au_to_attr32(&ar->ar_arg_vnode2); \
290 tok = au_to_path(ar->ar_arg_kpath1); \
294 tok = au_to_arg32(1, "fd", ar->ar_arg_fd); \
298 tok = au_to_attr32(&ar->ar_arg_vnode1); \
303 ar->ar_arg_fd); \
311 if ((ar->ar_arg_pid > 0) /* Reference a single process */ \
313 tok = au_to_process32_ex(ar->ar_arg_auid, \
314 ar->ar_arg_euid, ar->ar_arg_egid, \
315 ar->ar_arg_ruid, ar->ar_arg_rgid, \
316 ar->ar_arg_pid, ar->ar_arg_asid, \
317 &ar->ar_arg_termid_addr); \
320 tok = au_to_arg32(argn, "process", ar->ar_arg_pid); \
327 switch (ar->ar_arg_value32) { \
336 ar->ar_arg_value32); \
343 tok = au_to_text(ar->ar_arg_text); \
351 tok = au_to_opaque(ar->ar_arg_opaque, \
352 ar->ar_arg_opq_size); \
356 tok = au_to_arg32(n+2, "mode", ar->ar_arg_mode);\
360 tok = au_to_arg32(n+1, "gid", ar->ar_arg_gid); \
364 tok = au_to_arg32(n, "uid", ar->ar_arg_uid); \
370 if (ar->ar_valid_arg & ARG_MAC_STRING) { \
371 tok = au_to_text(ar->ar_arg_mac_string); \
382 audit_sys_auditon(struct audit_record *ar, struct au_record *rec) in audit_sys_auditon() argument
386 switch (ar->ar_arg_cmd) { in audit_sys_auditon()
388 if (ar->ar_arg_len > sizeof(int)) { in audit_sys_auditon()
389 tok = au_to_arg32(3, "length", ar->ar_arg_len); in audit_sys_auditon()
392 ar->ar_arg_auditon.au_policy64); in audit_sys_auditon()
398 tok = au_to_arg32(3, "length", ar->ar_arg_len); in audit_sys_auditon()
400 tok = au_to_arg32(2, "policy", ar->ar_arg_auditon.au_policy); in audit_sys_auditon()
405 tok = au_to_arg32(3, "length", ar->ar_arg_len); in audit_sys_auditon()
408 ar->ar_arg_auditon.au_mask.am_success); in audit_sys_auditon()
411 ar->ar_arg_auditon.au_mask.am_failure); in audit_sys_auditon()
416 if (ar->ar_arg_len > sizeof(au_qctrl_t)) { in audit_sys_auditon()
417 tok = au_to_arg32(3, "length", ar->ar_arg_len); in audit_sys_auditon()
420 ar->ar_arg_auditon.au_qctrl64.aq64_hiwater); in audit_sys_auditon()
423 ar->ar_arg_auditon.au_qctrl64.aq64_lowater); in audit_sys_auditon()
426 ar->ar_arg_auditon.au_qctrl64.aq64_bufsz); in audit_sys_auditon()
429 ar->ar_arg_auditon.au_qctrl64.aq64_delay); in audit_sys_auditon()
432 ar->ar_arg_auditon.au_qctrl64.aq64_minfree); in audit_sys_auditon()
438 tok = au_to_arg32(3, "length", ar->ar_arg_len); in audit_sys_auditon()
441 ar->ar_arg_auditon.au_qctrl.aq_hiwater); in audit_sys_auditon()
444 ar->ar_arg_auditon.au_qctrl.aq_lowater); in audit_sys_auditon()
447 ar->ar_arg_auditon.au_qctrl.aq_bufsz); in audit_sys_auditon()
450 ar->ar_arg_auditon.au_qctrl.aq_delay); in audit_sys_auditon()
453 ar->ar_arg_auditon.au_qctrl.aq_minfree); in audit_sys_auditon()
458 tok = au_to_arg32(3, "length", ar->ar_arg_len); in audit_sys_auditon()
461 ar->ar_arg_auditon.au_auinfo.ai_mask.am_success); in audit_sys_auditon()
464 ar->ar_arg_auditon.au_auinfo.ai_mask.am_failure); in audit_sys_auditon()
469 tok = au_to_arg32(3, "length", ar->ar_arg_len); in audit_sys_auditon()
472 ar->ar_arg_auditon.au_auinfo.ai_mask.am_success); in audit_sys_auditon()
475 ar->ar_arg_auditon.au_auinfo.ai_mask.am_failure); in audit_sys_auditon()
480 if (ar->ar_arg_len > sizeof(int)) { in audit_sys_auditon()
481 tok = au_to_arg32(3, "length", ar->ar_arg_len); in audit_sys_auditon()
484 ar->ar_arg_auditon.au_cond64); in audit_sys_auditon()
490 tok = au_to_arg32(3, "length", ar->ar_arg_len); in audit_sys_auditon()
492 tok = au_to_arg32(2, "setcond", ar->ar_arg_auditon.au_cond); in audit_sys_auditon()
497 tok = au_to_arg32(3, "length", ar->ar_arg_len); in audit_sys_auditon()
500 ar->ar_arg_auditon.au_evclass.ec_number); in audit_sys_auditon()
503 ar->ar_arg_auditon.au_evclass.ec_class); in audit_sys_auditon()
508 tok = au_to_arg32(3, "length", ar->ar_arg_len); in audit_sys_auditon()
511 ar->ar_arg_auditon.au_aupinfo.ap_mask.am_success); in audit_sys_auditon()
514 ar->ar_arg_auditon.au_aupinfo.ap_mask.am_failure); in audit_sys_auditon()
519 tok = au_to_arg32(3, "length", ar->ar_arg_len); in audit_sys_auditon()
522 ar->ar_arg_auditon.au_fstat.af_filesz); in audit_sys_auditon()
529 tok = au_to_arg32(1, "cmd", ar->ar_arg_cmd); in audit_sys_auditon()
542 struct audit_record *ar = &kar->k_ar; in audit_sys_fcntl() local
544 switch (ar->ar_arg_cmd) { in audit_sys_fcntl()
547 tok = au_to_arg32(3, "min fd", ar->ar_arg_value32); in audit_sys_fcntl()
555 ar->ar_arg_value32); in audit_sys_fcntl()
562 tok = au_to_arg32(3, "fd flags", ar->ar_arg_value32); in audit_sys_fcntl()
569 tok = au_to_arg32(3, "pid", ar->ar_arg_value32); in audit_sys_fcntl()
577 tok = au_to_arg64(3, "offset", ar->ar_arg_value64); in audit_sys_fcntl()
586 tok = au_to_text(ar->ar_arg_text); in audit_sys_fcntl()
595 tok = au_to_arg32(2, "cmd", au_fcntl_cmd_to_bsm(ar->ar_arg_cmd)); in audit_sys_fcntl()
615 struct audit_record *ar; in kaudit_to_bsm() local
623 ar = &kar->k_ar; in kaudit_to_bsm()
629 switch (ar->ar_subj_term_addr.at_type) { in kaudit_to_bsm()
631 tid.port = ar->ar_subj_term_addr.at_port; in kaudit_to_bsm()
632 tid.machine = ar->ar_subj_term_addr.at_addr[0]; in kaudit_to_bsm()
633 subj_tok = au_to_subject32(ar->ar_subj_auid, /* audit ID */ in kaudit_to_bsm()
634 ar->ar_subj_cred.cr_uid, /* eff uid */ in kaudit_to_bsm()
635 ar->ar_subj_egid, /* eff group id */ in kaudit_to_bsm()
636 ar->ar_subj_ruid, /* real uid */ in kaudit_to_bsm()
637 ar->ar_subj_rgid, /* real group id */ in kaudit_to_bsm()
638 ar->ar_subj_pid, /* process id */ in kaudit_to_bsm()
639 ar->ar_subj_asid, /* session ID */ in kaudit_to_bsm()
643 subj_tok = au_to_subject32_ex(ar->ar_subj_auid, in kaudit_to_bsm()
644 ar->ar_subj_cred.cr_uid, in kaudit_to_bsm()
645 ar->ar_subj_egid, in kaudit_to_bsm()
646 ar->ar_subj_ruid, in kaudit_to_bsm()
647 ar->ar_subj_rgid, in kaudit_to_bsm()
648 ar->ar_subj_pid, in kaudit_to_bsm()
649 ar->ar_subj_asid, in kaudit_to_bsm()
650 &ar->ar_subj_term_addr); in kaudit_to_bsm()
654 subj_tok = au_to_subject32(ar->ar_subj_auid, in kaudit_to_bsm()
655 ar->ar_subj_cred.cr_uid, in kaudit_to_bsm()
656 ar->ar_subj_egid, in kaudit_to_bsm()
657 ar->ar_subj_ruid, in kaudit_to_bsm()
658 ar->ar_subj_rgid, in kaudit_to_bsm()
659 ar->ar_subj_pid, in kaudit_to_bsm()
660 ar->ar_subj_asid, in kaudit_to_bsm()
670 switch (ar->ar_event) { in kaudit_to_bsm()
674 tok = au_to_arg32(2, "sd", ar->ar_arg_value32); in kaudit_to_bsm()
690 tok = au_to_arg32(1, "fd", ar->ar_arg_fd); in kaudit_to_bsm()
695 &ar->ar_arg_sockaddr); in kaudit_to_bsm()
700 &ar->ar_arg_sockaddr); in kaudit_to_bsm()
706 &ar->ar_arg_sockaddr); in kaudit_to_bsm()
715 au_domain_to_bsm(ar->ar_arg_sockinfo.sai_domain)); in kaudit_to_bsm()
718 au_socket_type_to_bsm(ar->ar_arg_sockinfo.sai_type)); in kaudit_to_bsm()
721 ar->ar_arg_sockinfo.sai_protocol); in kaudit_to_bsm()
729 tok = au_to_arg32(1, "fd", ar->ar_arg_fd); in kaudit_to_bsm()
745 tok = au_to_arg32(2, "setauid", ar->ar_arg_auid); in kaudit_to_bsm()
756 ar->ar_arg_auid); in kaudit_to_bsm()
759 ar->ar_arg_termid.port); in kaudit_to_bsm()
762 ar->ar_arg_termid.machine); in kaudit_to_bsm()
765 ar->ar_arg_amask.am_success); in kaudit_to_bsm()
768 ar->ar_arg_amask.am_failure); in kaudit_to_bsm()
771 ar->ar_arg_asid); in kaudit_to_bsm()
782 ar->ar_arg_auid); in kaudit_to_bsm()
785 ar->ar_arg_amask.am_success); in kaudit_to_bsm()
788 ar->ar_arg_amask.am_failure); in kaudit_to_bsm()
791 ar->ar_arg_asid); in kaudit_to_bsm()
794 ar->ar_arg_termid_addr.at_type); in kaudit_to_bsm()
797 ar->ar_arg_termid_addr.at_port); in kaudit_to_bsm()
799 switch (ar->ar_arg_termid_addr.at_type) { in kaudit_to_bsm()
802 &ar->ar_arg_termid_addr.at_addr[0]); in kaudit_to_bsm()
807 &ar->ar_arg_termid_addr.at_addr[0]); in kaudit_to_bsm()
819 tok = au_to_arg32(1, "cmd", ar->ar_arg_cmd); in kaudit_to_bsm()
841 audit_sys_auditon(ar, rec); in kaudit_to_bsm()
851 tok = au_to_exit(ar->ar_arg_exitretval, in kaudit_to_bsm()
852 ar->ar_arg_exitstatus); in kaudit_to_bsm()
889 tok = au_to_arg32(2, "mode", ar->ar_arg_mode); in kaudit_to_bsm()
901 tok = au_to_opaque(ar->ar_arg_opaque, in kaudit_to_bsm()
902 ar->ar_arg_opq_size); in kaudit_to_bsm()
910 tok = au_to_data(AUP_DECIMAL, ar->ar_arg_data_type, in kaudit_to_bsm()
911 ar->ar_arg_data_count, ar->ar_arg_data); in kaudit_to_bsm()
945 tok = au_to_arg32(2, "flags", ar->ar_arg_fflags); in kaudit_to_bsm()
954 ar->ar_arg_mode); in kaudit_to_bsm()
963 tok = au_to_arg32(2, "new file uid", ar->ar_arg_uid); in kaudit_to_bsm()
967 tok = au_to_arg32(3, "new file gid", ar->ar_arg_gid); in kaudit_to_bsm()
980 tok = au_to_arg32(2, "fd", ar->ar_arg_fd); in kaudit_to_bsm()
988 tok = au_to_arg32(0, "signal", ar->ar_arg_signum); in kaudit_to_bsm()
996 tok = au_to_arg32(0, "child PID", ar->ar_arg_pid); in kaudit_to_bsm()
1003 tok = au_to_exec_args(ar->ar_arg_argv, in kaudit_to_bsm()
1004 ar->ar_arg_argc); in kaudit_to_bsm()
1008 tok = au_to_exec_env(ar->ar_arg_envv, in kaudit_to_bsm()
1009 ar->ar_arg_envc); in kaudit_to_bsm()
1015 tok = au_to_data(AUP_HEX, ar->ar_arg_data_type, in kaudit_to_bsm()
1016 ar->ar_arg_data_count, ar->ar_arg_data); in kaudit_to_bsm()
1029 ar->ar_arg_mode); in kaudit_to_bsm()
1036 tok = au_to_arg32(1, "request", ar->ar_arg_cmd); in kaudit_to_bsm()
1038 if (ar->ar_valid_arg & (ARG_KPATH1 | ARG_UPATH1)) { in kaudit_to_bsm()
1073 tok = au_to_arg32(2, "new file uid", ar->ar_arg_uid); in kaudit_to_bsm()
1077 tok = au_to_arg32(3, "new file gid", ar->ar_arg_gid); in kaudit_to_bsm()
1092 tok = au_to_arg32(4, "options", ar->ar_arg_value32); in kaudit_to_bsm()
1096 tok = au_to_arg32(2, "cmd", ar->ar_arg_cmd); in kaudit_to_bsm()
1104 tok = au_to_arg32(4, "options", ar->ar_arg_value32); in kaudit_to_bsm()
1108 tok = au_to_arg32(2, "cmd", ar->ar_arg_cmd); in kaudit_to_bsm()
1117 tok = au_to_arg32(2, "flags", ar->ar_arg_fflags); in kaudit_to_bsm()
1125 tok = au_to_arg32(2, "operation", ar->ar_arg_cmd); in kaudit_to_bsm()
1134 tok = au_to_arg32(0, "child PID", ar->ar_arg_pid); in kaudit_to_bsm()
1141 tok = au_to_arg32(1, "pid", (u_int32_t)ar->ar_arg_pid); in kaudit_to_bsm()
1148 tok = au_to_arg32(1, "pid", (u_int32_t)ar->ar_arg_pid); in kaudit_to_bsm()
1153 (u_int32_t)ar->ar_arg_value32); in kaudit_to_bsm()
1160 tok = au_to_arg32(2, "cmd", ar->ar_arg_cmd); in kaudit_to_bsm()
1164 tok = au_to_arg64(2, "cmd", ar->ar_arg_value64); in kaudit_to_bsm()
1168 tok = au_to_arg64(3, "arg", ar->ar_arg_addr); in kaudit_to_bsm()
1172 (u_int32_t)ar->ar_arg_addr); in kaudit_to_bsm()
1180 ar->ar_arg_sockinfo.sai_domain, in kaudit_to_bsm()
1181 ar->ar_arg_sockinfo.sai_type, in kaudit_to_bsm()
1183 &ar->ar_arg_sockinfo.sai_laddr, in kaudit_to_bsm()
1185 &ar->ar_arg_sockinfo.sai_faddr); in kaudit_to_bsm()
1190 ar->ar_arg_fd); in kaudit_to_bsm()
1199 tok = au_to_arg32(2, "signal", ar->ar_arg_signum); in kaudit_to_bsm()
1221 tok = au_to_arg32(2, "mode", ar->ar_arg_mode); in kaudit_to_bsm()
1229 tok = au_to_arg32(2, "mode", ar->ar_arg_mode); in kaudit_to_bsm()
1233 tok = au_to_arg32(3, "dev", ar->ar_arg_value32); in kaudit_to_bsm()
1246 tok = au_to_arg64(1, "addr", ar->ar_arg_addr); in kaudit_to_bsm()
1250 (u_int32_t)ar->ar_arg_addr); in kaudit_to_bsm()
1254 tok = au_to_arg64(2, "len", ar->ar_arg_len); in kaudit_to_bsm()
1257 if (ar->ar_event == AUE_MMAP) { in kaudit_to_bsm()
1260 if (ar->ar_event == AUE_MPROTECT) { in kaudit_to_bsm()
1263 ar->ar_arg_value32); in kaudit_to_bsm()
1267 if (ar->ar_event == AUE_MINHERIT) { in kaudit_to_bsm()
1270 ar->ar_arg_value32); in kaudit_to_bsm()
1284 tok = au_to_arg32(3, "flags", ar->ar_arg_fflags); in kaudit_to_bsm()
1288 tok = au_to_text(ar->ar_arg_text); in kaudit_to_bsm()
1299 tok = au_to_arg32(2, "dir fd", ar->ar_arg_fd); in kaudit_to_bsm()
1303 tok = au_to_arg32(3, "flags", ar->ar_arg_fflags); in kaudit_to_bsm()
1307 tok = au_to_text(ar->ar_arg_text); in kaudit_to_bsm()
1313 ar->ar_event = audit_msgctl_to_event(ar->ar_arg_svipc_cmd); in kaudit_to_bsm()
1318 tok = au_to_arg32(1, "msg ID", ar->ar_arg_svipc_id); in kaudit_to_bsm()
1320 if (ar->ar_errno != EINVAL) { in kaudit_to_bsm()
1321 tok = au_to_ipc(AT_IPC_MSG, ar->ar_arg_svipc_id); in kaudit_to_bsm()
1327 if (ar->ar_errno == 0) { in kaudit_to_bsm()
1330 ar->ar_arg_svipc_id); in kaudit_to_bsm()
1344 tok = au_to_arg32(2, "flags", ar->ar_arg_fflags); in kaudit_to_bsm()
1357 tok = au_to_arg32(3, "mode", ar->ar_arg_mode); in kaudit_to_bsm()
1361 tok = au_to_arg32(2, "flags", ar->ar_arg_fflags); in kaudit_to_bsm()
1376 tok = au_to_arg32(2, "flags", ar->ar_arg_fflags); in kaudit_to_bsm()
1390 tok = au_to_arg32(2, "flags", ar->ar_arg_fflags); in kaudit_to_bsm()
1404 tok = au_to_arg32(3, "flags", ar->ar_arg_fflags); in kaudit_to_bsm()
1408 tok = au_to_arg32(1, "dir fd", ar->ar_arg_fd); in kaudit_to_bsm()
1421 tok = au_to_arg32(4, "mode", ar->ar_arg_mode); in kaudit_to_bsm()
1425 tok = au_to_arg32(3, "flags", ar->ar_arg_fflags); in kaudit_to_bsm()
1429 tok = au_to_arg32(1, "dir fd", ar->ar_arg_fd); in kaudit_to_bsm()
1443 tok = au_to_arg32(3, "flags", ar->ar_arg_fflags); in kaudit_to_bsm()
1447 tok = au_to_arg32(1, "volfsid", ar->ar_arg_value32); in kaudit_to_bsm()
1451 tok = au_to_arg64(2, "objid", ar->ar_arg_value64); in kaudit_to_bsm()
1469 tok = au_to_arg32(1, "dir fd", ar->ar_arg_fd); in kaudit_to_bsm()
1477 tok = au_to_arg32(1, "src dir fd", ar->ar_arg_fd); in kaudit_to_bsm()
1482 tok = au_to_arg32(1, "dst dir fd", ar->ar_arg_fd2); in kaudit_to_bsm()
1487 tok = au_to_arg32(1, "flags", ar->ar_arg_value32); in kaudit_to_bsm()
1495 tok = au_to_arg32(1, "dst dir fd", ar->ar_arg_fd2); in kaudit_to_bsm()
1500 tok = au_to_arg32(1, "flags", ar->ar_arg_value32); in kaudit_to_bsm()
1507 tok = au_to_arg32(1, "request", ar->ar_arg_cmd); in kaudit_to_bsm()
1511 tok = au_to_arg64(3, "addr", ar->ar_arg_addr); in kaudit_to_bsm()
1515 (u_int32_t)ar->ar_arg_addr); in kaudit_to_bsm()
1519 tok = au_to_arg32(4, "data", ar->ar_arg_value32); in kaudit_to_bsm()
1527 tok = au_to_arg32(2, "command", ar->ar_arg_cmd); in kaudit_to_bsm()
1531 tok = au_to_arg32(3, "uid", ar->ar_arg_uid); in kaudit_to_bsm()
1539 tok = au_to_arg32(1, "howto", ar->ar_arg_cmd); in kaudit_to_bsm()
1545 ar->ar_event = audit_semctl_to_event(ar->ar_arg_svipc_cmd); in kaudit_to_bsm()
1550 tok = au_to_arg32(1, "sem ID", ar->ar_arg_svipc_id); in kaudit_to_bsm()
1552 if (ar->ar_errno != EINVAL) { in kaudit_to_bsm()
1554 ar->ar_arg_svipc_id); in kaudit_to_bsm()
1561 if (ar->ar_errno == 0) { in kaudit_to_bsm()
1564 ar->ar_arg_svipc_id); in kaudit_to_bsm()
1572 tok = au_to_arg32(1, "gid", ar->ar_arg_egid); in kaudit_to_bsm()
1579 tok = au_to_arg32(1, "uid", ar->ar_arg_euid); in kaudit_to_bsm()
1586 tok = au_to_arg32(1, "rgid", ar->ar_arg_rgid); in kaudit_to_bsm()
1590 tok = au_to_arg32(2, "egid", ar->ar_arg_egid); in kaudit_to_bsm()
1597 tok = au_to_arg32(1, "ruid", ar->ar_arg_ruid); in kaudit_to_bsm()
1601 tok = au_to_arg32(2, "euid", ar->ar_arg_euid); in kaudit_to_bsm()
1608 tok = au_to_arg32(1, "gid", ar->ar_arg_gid); in kaudit_to_bsm()
1615 tok = au_to_arg32(1, "uid", ar->ar_arg_uid); in kaudit_to_bsm()
1622 for (uctr = 0; uctr < ar->ar_arg_groups.gidset_size; in kaudit_to_bsm()
1625 ar->ar_arg_groups.gidset[uctr]); in kaudit_to_bsm()
1633 tok = au_to_text(ar->ar_arg_text); in kaudit_to_bsm()
1640 tok = au_to_arg32(1, "which", ar->ar_arg_cmd); in kaudit_to_bsm()
1644 tok = au_to_arg32(2, "who", ar->ar_arg_uid); in kaudit_to_bsm()
1648 tok = au_to_arg32(2, "priority", ar->ar_arg_value32); in kaudit_to_bsm()
1655 tok = au_to_arg32(1, "flag", ar->ar_arg_value32); in kaudit_to_bsm()
1663 tok = au_to_arg32(1, "shmid", ar->ar_arg_svipc_id); in kaudit_to_bsm()
1666 tok = au_to_ipc(AT_IPC_SHM, ar->ar_arg_svipc_id); in kaudit_to_bsm()
1670 tok = au_to_arg64(2, "shmaddr", ar->ar_arg_svipc_addr); in kaudit_to_bsm()
1674 tok = au_to_ipc_perm(&ar->ar_arg_svipc_perm); in kaudit_to_bsm()
1681 tok = au_to_arg32(1, "shmid", ar->ar_arg_svipc_id); in kaudit_to_bsm()
1684 tok = au_to_ipc(AT_IPC_SHM, ar->ar_arg_svipc_id); in kaudit_to_bsm()
1687 switch (ar->ar_arg_svipc_cmd) { in kaudit_to_bsm()
1689 ar->ar_event = AUE_SHMCTL_STAT; in kaudit_to_bsm()
1692 ar->ar_event = AUE_SHMCTL_RMID; in kaudit_to_bsm()
1695 ar->ar_event = AUE_SHMCTL_SET; in kaudit_to_bsm()
1697 tok = au_to_ipc_perm(&ar->ar_arg_svipc_perm); in kaudit_to_bsm()
1709 (int)(uintptr_t)ar->ar_arg_svipc_addr); in kaudit_to_bsm()
1717 tok = au_to_arg32(0, "shmid", ar->ar_arg_svipc_id); in kaudit_to_bsm()
1719 tok = au_to_ipc(AT_IPC_SHM, ar->ar_arg_svipc_id); in kaudit_to_bsm()
1723 tok = au_to_ipc_perm(&ar->ar_arg_svipc_perm); in kaudit_to_bsm()
1732 tok = au_to_arg32(2, "flags", ar->ar_arg_fflags); in kaudit_to_bsm()
1736 tok = au_to_arg32(3, "mode", ar->ar_arg_mode); in kaudit_to_bsm()
1743 tok = au_to_text(ar->ar_arg_text); in kaudit_to_bsm()
1749 perm.uid = ar->ar_arg_pipc_perm.pipc_uid; in kaudit_to_bsm()
1750 perm.gid = ar->ar_arg_pipc_perm.pipc_gid; in kaudit_to_bsm()
1751 perm.cuid = ar->ar_arg_pipc_perm.pipc_uid; in kaudit_to_bsm()
1752 perm.cgid = ar->ar_arg_pipc_perm.pipc_gid; in kaudit_to_bsm()
1753 perm.mode = ar->ar_arg_pipc_perm.pipc_mode; in kaudit_to_bsm()
1763 tok = au_to_arg32(2, "flags", ar->ar_arg_fflags); in kaudit_to_bsm()
1767 tok = au_to_arg32(3, "mode", ar->ar_arg_mode); in kaudit_to_bsm()
1771 tok = au_to_arg32(4, "value", ar->ar_arg_value32); in kaudit_to_bsm()
1778 tok = au_to_text(ar->ar_arg_text); in kaudit_to_bsm()
1784 perm.uid = ar->ar_arg_pipc_perm.pipc_uid; in kaudit_to_bsm()
1785 perm.gid = ar->ar_arg_pipc_perm.pipc_gid; in kaudit_to_bsm()
1786 perm.cuid = ar->ar_arg_pipc_perm.pipc_uid; in kaudit_to_bsm()
1787 perm.cgid = ar->ar_arg_pipc_perm.pipc_gid; in kaudit_to_bsm()
1788 perm.mode = ar->ar_arg_pipc_perm.pipc_mode; in kaudit_to_bsm()
1798 tok = au_to_arg32(1, "sem", ar->ar_arg_fd); in kaudit_to_bsm()
1805 tok = au_to_text(ar->ar_arg_text); in kaudit_to_bsm()
1814 for (ctr = 0; ctr < (int)ar->ar_arg_len; ctr++) { in kaudit_to_bsm()
1816 ar->ar_arg_ctlname[ctr]); in kaudit_to_bsm()
1821 tok = au_to_arg32(5, "newval", ar->ar_arg_value32); in kaudit_to_bsm()
1825 tok = au_to_text(ar->ar_arg_text); in kaudit_to_bsm()
1833 tok = au_to_opaque(ar->ar_arg_opaque, in kaudit_to_bsm()
1834 ar->ar_arg_opq_size); in kaudit_to_bsm()
1841 tok = au_to_arg32(1, "new mask", ar->ar_arg_mask); in kaudit_to_bsm()
1844 tok = au_to_arg32(0, "prev mask", ar->ar_retval); in kaudit_to_bsm()
1853 tok = au_to_arg32(0, "pid", ar->ar_arg_pid); in kaudit_to_bsm()
1861 tok = au_to_arg32(3, "volfsid", ar->ar_arg_value32); in kaudit_to_bsm()
1865 tok = au_to_arg64(4, "objid", ar->ar_arg_value64); in kaudit_to_bsm()
1869 tok = au_to_text(ar->ar_arg_text); in kaudit_to_bsm()
1879 tok = au_to_arg64(1, "sflags", ar->ar_arg_value64); in kaudit_to_bsm()
1884 ar->ar_arg_amask.am_success); in kaudit_to_bsm()
1887 ar->ar_arg_amask.am_failure); in kaudit_to_bsm()
1901 (u_int32_t)ar->ar_arg_mach_port1); in kaudit_to_bsm()
1905 tok = au_to_arg32(2, "pid", (u_int32_t)ar->ar_arg_pid); in kaudit_to_bsm()
1914 (u_int32_t)ar->ar_arg_mach_port1); in kaudit_to_bsm()
1919 (u_int32_t)ar->ar_arg_mach_port2); in kaudit_to_bsm()
1928 (u_int32_t)ar->ar_arg_value32); in kaudit_to_bsm()
1940 tok = au_to_arg64(3, "va", ar->ar_arg_addr); in kaudit_to_bsm()
1944 (u_int32_t)ar->ar_arg_addr); in kaudit_to_bsm()
1969 tok = au_to_arg32(3, "call", ar->ar_arg_value32); in kaudit_to_bsm()
1981 tok = au_to_arg32(1, "pid", (u_int32_t)ar->ar_arg_pid); in kaudit_to_bsm()
1990 (u_int32_t)ar->ar_arg_value32); in kaudit_to_bsm()
2005 ar->ar_event); in kaudit_to_bsm()
2017 if (NULL != ar->ar_mac_records) { in kaudit_to_bsm()
2021 LIST_FOREACH(mar, ar->ar_mac_records, records) { in kaudit_to_bsm()
2052 if (ar->ar_cred_mac_labels != NULL && in kaudit_to_bsm()
2053 strlen(ar->ar_cred_mac_labels) != 0) { in kaudit_to_bsm()
2054 tok = au_to_text(ar->ar_cred_mac_labels); in kaudit_to_bsm()
2059 tok = au_to_return32(au_errno_to_bsm(ar->ar_errno), ar->ar_retval); in kaudit_to_bsm()
2063 struct au_identity_info *id = &ar->ar_arg_identity; in kaudit_to_bsm()
2070 rv = kau_close(rec, &ar->ar_endtime, ar->ar_event); in kaudit_to_bsm()