Lines Matching defs:tad
95 t_audit_data_t *tad; /* current thread */
98 tad = U2A(u);
108 if (tad->tad_flag != 0 && flag == ENOENT && pvp != NULL &&
109 (tad->tad_ctrl & TAD_PUBLIC_EV) &&
116 tad->tad_ctrl |= TAD_NOAUDIT;
138 if ((tad->tad_flag == 0 && !(tad->tad_ctrl & TAD_SAVPATH)) ||
139 ((tad->tad_ctrl & TAD_PATHFND) &&
141 (tad->tad_ctrl & TAD_NOPATH)) {
145 tad->tad_ctrl |= TAD_NOPATH; /* prevent possible reentry */
154 if (tad->tad_flag) {
156 (tad->tad_scid == SYS_open ||
157 tad->tad_scid == SYS_open64 ||
158 tad->tad_scid == SYS_openat ||
159 tad->tad_scid == SYS_openat64)) {
160 tad->tad_ctrl |= TAD_TRUE_CREATE;
164 au_uwrite(au_to_path(tad->tad_aupath));
178 if (!flag && !(tad->tad_ctrl & TAD_NOATTRB))
184 if ((tad->tad_ctrl & TAD_SAVPATH) == 0) {
185 if (tad->tad_aupath != NULL) {
186 au_pathrele(tad->tad_aupath);
187 tad->tad_aupath = NULL;
190 if (tad->tad_ctrl & TAD_MLD)
191 tad->tad_ctrl |= TAD_PATHFND;
193 tad->tad_ctrl &= ~TAD_NOPATH; /* restore */
205 t_audit_data_t *tad; /* current thread */
208 tad = U2A(u);
209 ASSERT(tad != NULL);
218 if (tad->tad_aupath != NULL) {
219 pfxapp = tad->tad_aupath;
220 } else if ((tad->tad_ctrl & TAD_ATCALL) && pnp->pn_buf[0] != '/') {
221 ASSERT(tad->tad_atpath != NULL);
222 pfxapp = tad->tad_atpath;
223 } else if (tad->tad_ctrl & TAD_ABSPATH) {
232 newsect = tad->tad_ctrl & TAD_ATTPATH;
249 if (tad->tad_aupath)
250 au_pathrele(tad->tad_aupath);
251 tad->tad_aupath = newapp;
254 tad->tad_ctrl &= ~(TAD_ABSPATH | TAD_ATTPATH);
281 t_audit_data_t *tad;
283 tad = U2A(u);
302 if ((tad->tad_flag == 0 && !(tad->tad_ctrl & TAD_SAVPATH)) ||
303 ((tad->tad_ctrl & TAD_PATHFND) &&
305 (tad->tad_ctrl & TAD_NOPATH)) {
310 tad->tad_ctrl |= TAD_ABSPATH;
311 if (tad->tad_aupath != NULL) {
312 au_pathrele(tad->tad_aupath);
313 tad->tad_aupath = NULL;
350 t_audit_data_t *tad;
353 tad = U2A(u);
372 if ((tad->tad_flag == 0 &&
373 !(tad->tad_ctrl & TAD_SAVPATH)) ||
374 ((tad->tad_ctrl & TAD_PATHFND) &&
376 (tad->tad_ctrl & TAD_NOPATH)) {
455 struct t_audit_data *tad;
457 tad = U2A(u);
465 (tad->tad_ctrl & TAD_PUBLIC_EV)) {
471 * Flag it in the tad to prevent this audit at the end.
473 tad->tad_ctrl |= TAD_NOAUDIT;
494 struct t_audit_data *tad;
495 tad = U2A(u);
501 if (tad->tad_scid == SYS_exit) {
506 if (tad->tad_flag && tad->tad_event == AUE_EXIT)
514 if (tad->tad_flag) {
516 audit_finish(0, tad->tad_scid, 0, 0);
538 t_audit_data_t *tad;
541 tad = U2A(u);
543 ASSERT(tad != (t_audit_data_t *)0);
545 ASSERT(tad->tad_scid == 0);
546 ASSERT(tad->tad_event == 0);
547 ASSERT(tad->tad_evmod == 0);
548 ASSERT(tad->tad_ctrl == 0);
549 ASSERT(tad->tad_flag == 0);
550 ASSERT(tad->tad_aupath == NULL);
558 if ((tad->tad_flag = auditme(kctx, tad, estate)) == 0)
562 tad->tad_ctrl = TAD_CORE;
563 tad->tad_scid = 0;
570 tad->tad_flag = 0;
571 tad->tad_ctrl = 0;
575 tad->tad_event = event;
576 tad->tad_evmod = 0;
578 ASSERT(tad->tad_ad == NULL);
597 t_audit_data_t *tad;
600 tad = U2A(u);
602 ASSERT(tad != (t_audit_data_t *)0);
604 if ((flag = tad->tad_flag) == 0) {
605 tad->tad_event = 0;
606 tad->tad_evmod = 0;
607 tad->tad_ctrl = 0;
608 ASSERT(tad->tad_aupath == NULL);
611 tad->tad_flag = 0;
616 if (flag = audit_success(kctx, tad, 0, NULL)) {
629 add_return_token((caddr_t *)&(u_ad), tad->tad_scid, 0, 0);
636 au_close(kctx, &(u_ad), flag, tad->tad_event, tad->tad_evmod, NULL);
639 if (tad->tad_aupath != NULL) {
640 au_pathrele(tad->tad_aupath);
641 tad->tad_aupath = NULL;
643 tad->tad_event = 0;
644 tad->tad_evmod = 0;
645 tad->tad_ctrl = 0;
655 t_audit_data_t *tad = U2A(u);
657 ASSERT(tad != (t_audit_data_t *)0);
665 if (!tad->tad_flag) {
685 t_audit_data_t *tad = U2A(u);
687 ASSERT(tad != (t_audit_data_t *)0);
695 if (!tad->tad_flag) {
732 t_audit_data_t *tad;
747 tad = U2A(u);
751 if (tad->tad_event == AUE_CLOSE) {
753 tad->tad_evmod |= (au_emod_t)fad->fad_flags;
758 auditing = (tad->tad_audit == AUC_UNSET) ?
759 kctx->auk_auditstate : tad->tad_audit;
814 add_return_token((caddr_t *)&(ad), tad->tad_scid, 0, 0);
846 t_audit_data_t *tad;
851 tad = T2A(curthread);
854 if (!(tad->tad_scid == SYS_open ||
855 tad->tad_scid == SYS_open64 ||
856 tad->tad_scid == SYS_openat ||
857 tad->tad_scid == SYS_openat64))
861 if (tad->tad_aupath == 0)
866 * use tad hold
868 fad->fad_aupath = tad->tad_aupath;
869 tad->tad_aupath = NULL;
871 if (!(tad->tad_ctrl & TAD_TRUE_CREATE)) {
873 switch (tad->tad_event) {
875 tad->tad_event = AUE_OPEN_R;
876 tad->tad_ctrl |= TAD_PUBLIC_EV;
879 tad->tad_event = AUE_OPEN_RT;
882 tad->tad_event = AUE_OPEN_W;
885 tad->tad_event = AUE_OPEN_WT;
888 tad->tad_event = AUE_OPEN_RW;
891 tad->tad_event = AUE_OPEN_RWT;
962 t_audit_data_t *tad;
965 tad = U2A(u);
968 if (tad->tad_flag == 0)
972 if (flag = audit_success(kctx, tad, 0, NULL)) {
985 add_return_token((caddr_t *)&(u_ad), tad->tad_scid, 0, 0);
1000 tad->tad_event, tad->tad_evmod, NULL);
1009 t_audit_data_t *tad;
1025 tad = U2A(u);
1026 ASSERT(tad != NULL);
1028 switch (tad->tad_scid) {
1061 if (tad->tad_atpath != NULL) {
1062 au_pathrele(tad->tad_atpath);
1063 tad->tad_atpath = NULL;
1067 tad->tad_ctrl |= TAD_ATCALL;
1069 if (tad->tad_scid == SYS_openat ||
1070 tad->tad_scid == SYS_openat64) {
1073 tad->tad_ctrl |= TAD_ATTPATH;
1078 tad->tad_ctrl |= TAD_NOPATH;
1084 tad->tad_ctrl |= TAD_NOPATH;
1089 tad->tad_atpath = fad->fad_aupath;
1092 if (tad->tad_scid == SYS_open ||
1093 tad->tad_scid == SYS_open64) {
1096 tad->tad_ctrl |= TAD_ATTPATH;
1103 tad->tad_atpath = pad->pad_cwd;
1111 t_audit_data_t *tad;
1114 tad = U2A(u);
1117 if (tad->tad_flag == 0)
1145 t_audit_data_t *tad;
1147 tad = U2A(u);
1148 tad->tad_ctrl |= TAD_NOATTRB;
1162 t_audit_data_t *tad;
1167 tad = U2A(u);
1170 if (tad->tad_flag == 0)
1173 if (tad->tad_ctrl & TAD_TRUE_CREATE) {
1177 if (tad->tad_ctrl & TAD_CORE) {
1179 tad->tad_ctrl &= ~TAD_CORE;
1182 if (!error && ((tad->tad_event == AUE_MKNOD) ||
1183 (tad->tad_event == AUE_MKDIR))) {
1188 tad->tad_ctrl &= ~TAD_NOATTRB;
1215 t_audit_data_t *tad;
1218 tad = U2A(u);
1221 if (!tad->tad_flag)
1232 tad->tad_event = AUE_PFEXEC;
1363 t_audit_data_t *tad = T2A(curthread);
1369 if ((tad->tad_scid == SYS_chdir) || (tad->tad_scid == SYS_chroot)) {
1370 chdir = tad->tad_scid == SYS_chdir;
1371 if (tad->tad_aupath) {
1378 /* use tad hold */
1379 *appp = tad->tad_aupath;
1380 tad->tad_aupath = NULL;
1383 } else if ((tad->tad_scid == SYS_fchdir) ||
1384 (tad->tad_scid == SYS_fchroot)) {
1385 fchdir = tad->tad_scid == SYS_fchdir;
1399 if (tad->tad_flag) {
1432 t_audit_data_t *tad;
1472 tad = U2A(u);
1477 if (!tad->tad_flag)
1502 tad->tad_event = AUE_SOCKCONNECT;
1515 tad->tad_event = AUE_SOCKACCEPT;
1528 tad->tad_event = AUE_SOCKSEND;
1541 tad->tad_event = AUE_SOCKRECEIVE;
1555 tad->tad_event = AUE_GETMSG;
1563 au_write(&(tad->tad_ad), au_to_sock_inet(sock_data));
1566 tad->tad_event = AUE_GETMSG;
1603 t_audit_data_t *tad; /* current thread */
1608 tad = U2A(u);
1609 ASSERT(tad != (t_audit_data_t *)0);
1610 if (!tad->tad_flag)
1638 t_audit_data_t *tad;
1645 tad = U2A(u);
1647 if (tad->tad_flag == 0)
1650 target = flag ? &tad->tad_sprivs : &tad->tad_fprivs;
1654 if (!(tad->tad_evmod & sbit)) {
1657 tad->tad_evmod |= sbit;
1660 /* Save the privileges in the tad */
1681 t_audit_data_t *tad;
1690 tad = U2A(u);
1692 if (tad->tad_flag == 0)
1745 t_audit_data_t *tad;
1750 tad = U2A(u);
1752 if (tad->tad_flag == 0)
1789 t_audit_data_t *tad;
1792 tad = U2A(u);
1794 if (tad->tad_flag == 0)
1816 t_audit_data_t *tad; /* current thread */
1821 tad = U2A(u);
1822 ASSERT(tad != (t_audit_data_t *)0);
1823 if (!tad->tad_flag)
1862 t_audit_data_t *tad;
1868 tad = U2A(u);
1869 if (tad == NULL)
1875 tad->tad_event = AUE_CRYPTOADM;
1877 if (audit_success(kctx, tad, error, NULL) != AU_OK)
1994 add_return_token((caddr_t *)&ad, tad->tad_scid, -1, error);
1996 add_return_token((caddr_t *)&ad, tad->tad_scid, 0, rv);
2001 au_close(kctx, (caddr_t *)&ad, AU_OK, AUE_CRYPTOADM, tad->tad_evmod,
2014 t_audit_data_t *tad;
2019 tad = U2A(u);
2024 tad->tad_event = AUE_CONFIGKSSL;
2026 if (audit_success(kctx, tad, error, NULL) != AU_OK)
2069 add_return_token((caddr_t *)&ad, tad->tad_scid, error, 0);
2074 au_close(kctx, (caddr_t *)&ad, AU_OK, AUE_CONFIGKSSL, tad->tad_evmod,
2097 t_audit_data_t *tad;
2103 tad = U2A(u);
2104 if (tad == NULL)
2118 tad->tad_event = AUE_PF_POLICY_ADDRULE;
2123 tad->tad_event = AUE_PF_POLICY_DELRULE;
2128 tad->tad_event = AUE_PF_POLICY_FLUSH;
2133 tad->tad_event = AUE_PF_POLICY_ALGS;
2138 tad->tad_event = AUE_PF_POLICY_CLONE;
2143 tad->tad_event = AUE_PF_POLICY_FLIP;
2148 tad->tad_event = AUE_NULL;
2151 tad->tad_evmod = 0;
2153 if (flag = audit_success(kctx, tad, error, cred)) {
2207 au_close(kctx, (caddr_t *)&ad, flag, tad->tad_event, tad->tad_evmod,
2214 tad->tad_scid = 0;
2215 tad->tad_event = 0;
2216 tad->tad_evmod = 0;
2217 tad->tad_ctrl = 0;