MCPcopy Create free account
hub / github.com/F-Stack/f-stack / audit_proc_coredump

Function audit_proc_coredump

freebsd/security/audit/audit.c:790–844  ·  view source on GitHub ↗

Source from the content-addressed store, hash-verified

788}
789
790void
791audit_proc_coredump(struct thread *td, char *path, int errcode)
792{
793 struct kaudit_record *ar;
794 struct au_mask *aumask;
795 struct ucred *cred;
796 au_class_t class;
797 int ret, sorf;
798 char **pathp;
799 au_id_t auid;
800
801 ret = 0;
802
803 /*
804 * Make sure we are using the correct preselection mask.
805 */
806 cred = td->td_ucred;
807 auid = cred->cr_audit.ai_auid;
808 if (auid == AU_DEFAUDITID)
809 aumask = &audit_nae_mask;
810 else
811 aumask = &cred->cr_audit.ai_mask;
812 /*
813 * It's possible for coredump(9) generation to fail. Make sure that
814 * we handle this case correctly for preselection.
815 */
816 if (errcode != 0)
817 sorf = AU_PRS_FAILURE;
818 else
819 sorf = AU_PRS_SUCCESS;
820 class = au_event_class(AUE_CORE);
821 if (au_preselect(AUE_CORE, class, aumask, sorf) == 0 &&
822 audit_pipe_preselect(auid, AUE_CORE, class, sorf, 0) == 0)
823 return;
824
825 /*
826 * If we are interested in seeing this audit record, allocate it.
827 * Where possible coredump records should contain a pathname and arg32
828 * (signal) tokens.
829 */
830 ar = audit_new(AUE_CORE, td);
831 if (ar == NULL)
832 return;
833 if (path != NULL) {
834 pathp = &ar->k_ar.ar_arg_upath1;
835 *pathp = malloc(MAXPATHLEN, M_AUDITPATH, M_WAITOK);
836 audit_canon_path(td, AT_FDCWD, path, *pathp);
837 ARG_SET_VALID(ar, ARG_UPATH1);
838 }
839 ar->k_ar.ar_arg_signum = td->td_proc->p_sig;
840 ARG_SET_VALID(ar, ARG_SIGNUM);
841 if (errcode != 0)
842 ret = 1;
843 audit_commit(ar, errcode, ret);
844}

Callers 2

corefile_openFunction · 0.85
coredumpFunction · 0.85

Calls 7

au_event_classFunction · 0.85
au_preselectFunction · 0.85
audit_newFunction · 0.85
mallocFunction · 0.85
audit_canon_pathFunction · 0.85
audit_commitFunction · 0.85
audit_pipe_preselectFunction · 0.70

Tested by

no test coverage detected