audit_start.c revision 4a0fa5460e94a33980ceffce0ba3db8802570449
a192e900f6d2b0e1a822e3252c0dfd795ed49d76amaguire * CDDL HEADER START
a192e900f6d2b0e1a822e3252c0dfd795ed49d76amaguire * The contents of this file are subject to the terms of the
a192e900f6d2b0e1a822e3252c0dfd795ed49d76amaguire * Common Development and Distribution License (the "License").
a192e900f6d2b0e1a822e3252c0dfd795ed49d76amaguire * You may not use this file except in compliance with the License.
a192e900f6d2b0e1a822e3252c0dfd795ed49d76amaguire * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
a192e900f6d2b0e1a822e3252c0dfd795ed49d76amaguire * See the License for the specific language governing permissions
a192e900f6d2b0e1a822e3252c0dfd795ed49d76amaguire * and limitations under the License.
a192e900f6d2b0e1a822e3252c0dfd795ed49d76amaguire * When distributing Covered Code, include this CDDL HEADER in each
a192e900f6d2b0e1a822e3252c0dfd795ed49d76amaguire * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
a192e900f6d2b0e1a822e3252c0dfd795ed49d76amaguire * If applicable, add the following below this CDDL HEADER, with the
a192e900f6d2b0e1a822e3252c0dfd795ed49d76amaguire * fields enclosed by brackets "[]" replaced with your own identifying
a192e900f6d2b0e1a822e3252c0dfd795ed49d76amaguire * information: Portions Copyright [yyyy] [name of copyright owner]
a192e900f6d2b0e1a822e3252c0dfd795ed49d76amaguire * CDDL HEADER END
a192e900f6d2b0e1a822e3252c0dfd795ed49d76amaguire * Copyright (c) 1992, 2010, Oracle and/or its affiliates. All rights reserved.
a192e900f6d2b0e1a822e3252c0dfd795ed49d76amaguire * This file contains the envelope code for system call auditing.
a192e900f6d2b0e1a822e3252c0dfd795ed49d76amaguireextern uint_t num_syscall; /* size of audit_s2e table */
a192e900f6d2b0e1a822e3252c0dfd795ed49d76amaguire * Obsolete and ignored - Historically, the 'set c2audit:audit_load=1' entry
a192e900f6d2b0e1a822e3252c0dfd795ed49d76amaguire * in /etc/system enabled auditing. The No Reboot Audit project does not
a192e900f6d2b0e1a822e3252c0dfd795ed49d76amaguire * use this entry. However, to prevent the system from printing warning
a192e900f6d2b0e1a822e3252c0dfd795ed49d76amaguire * messages, the audit_load entry is being left in /etc/system. It will be
a192e900f6d2b0e1a822e3252c0dfd795ed49d76amaguire * removed when there is a small chance that the entry is used on currently
a192e900f6d2b0e1a822e3252c0dfd795ed49d76amaguire * running systems.
a192e900f6d2b0e1a822e3252c0dfd795ed49d76amaguire * Das Boot. Initialize first process. Also generate an audit record indicating
a192e900f6d2b0e1a822e3252c0dfd795ed49d76amaguire * that the system has been booted.
a192e900f6d2b0e1a822e3252c0dfd795ed49d76amaguire * Solaris Auditing module is being loaded -> change the state. The lock
a192e900f6d2b0e1a822e3252c0dfd795ed49d76amaguire * is here to prevent memory leaks caused by multiple initializations.
a192e900f6d2b0e1a822e3252c0dfd795ed49d76amaguire /* initialize memory allocators */
au_mem_init();
unsigned type,
unsigned scid,
int error,
if (error) {
* audit_start will be called again from indir() in trap.c
if (scid == 0) {
scid = 0;
(void) save_syscall_args();
unsigned type,
unsigned scid,
int error,
int flag;
unsigned int sy_flags;
AUT_UPRIV, 0));
#ifdef _SYSCALL32_IMPL
sy_flags =
if (type == 0) {
if (type == 0) {
if (type == 0) {
NULL);
if (error)
if (error == 0)
int flag = 0;
return (flag);