Lines Matching refs:audit
41 #include <c2/audit.h>
75 /* initialize the process audit data (pad) memory allocator */
78 /* initialize the zone audit context */
110 * Initialize audit context in our cred (kcred).
129 * Check for any pending changes to the audit context for the given proc.
181 * t_pre_sys is ALWAYS on when audit is enabled... due
214 p_audit_data_t *pad; /* child process audit data */
215 p_audit_data_t *opad; /* parent process audit data */
224 * copy the audit data. Note that all threads of current
229 * The audit context in the cred is "duplicated" for the new
237 pad->pad_data = opad->pad_data; /* copy parent's process audit data */
243 * If we are in the limited mode, there is nothing to audit and
244 * there could not have been anything to audit, since it is not
256 * make the audit record structure consistant).
264 * finish up audit record generation here because child process
290 /* better be a per process audit data structure */
311 * PURPOSE: allocate per-process thread audit data structure
322 t_audit_data_t *tad; /* per-thread audit data */
326 T2A(t) = tad; /* set up thread audit data ptr */
332 * PURPOSE: free the per-thread audit data structure
345 /* thread audit data must still be set */
357 /* must not have any audit record residual */
396 /* allocate per file audit structure if there a'int any */
403 fad->fad_thread = curthread; /* file audit data back ptr; DEBUG */
408 * PURPOSE: deallocate file audit data structure