| 788 | } |
| 789 | |
| 790 | void |
| 791 | audit_proc_coredump(struct thread *td, char *path, int errcode) |
| 792 | { |
| 793 | struct kaudit_record *ar; |
| 794 | struct au_mask *aumask; |
| 795 | struct ucred *cred; |
| 796 | au_class_t class; |
| 797 | int ret, sorf; |
| 798 | char **pathp; |
| 799 | au_id_t auid; |
| 800 | |
| 801 | ret = 0; |
| 802 | |
| 803 | /* |
| 804 | * Make sure we are using the correct preselection mask. |
| 805 | */ |
| 806 | cred = td->td_ucred; |
| 807 | auid = cred->cr_audit.ai_auid; |
| 808 | if (auid == AU_DEFAUDITID) |
| 809 | aumask = &audit_nae_mask; |
| 810 | else |
| 811 | aumask = &cred->cr_audit.ai_mask; |
| 812 | /* |
| 813 | * It's possible for coredump(9) generation to fail. Make sure that |
| 814 | * we handle this case correctly for preselection. |
| 815 | */ |
| 816 | if (errcode != 0) |
| 817 | sorf = AU_PRS_FAILURE; |
| 818 | else |
| 819 | sorf = AU_PRS_SUCCESS; |
| 820 | class = au_event_class(AUE_CORE); |
| 821 | if (au_preselect(AUE_CORE, class, aumask, sorf) == 0 && |
| 822 | audit_pipe_preselect(auid, AUE_CORE, class, sorf, 0) == 0) |
| 823 | return; |
| 824 | |
| 825 | /* |
| 826 | * If we are interested in seeing this audit record, allocate it. |
| 827 | * Where possible coredump records should contain a pathname and arg32 |
| 828 | * (signal) tokens. |
| 829 | */ |
| 830 | ar = audit_new(AUE_CORE, td); |
| 831 | if (ar == NULL) |
| 832 | return; |
| 833 | if (path != NULL) { |
| 834 | pathp = &ar->k_ar.ar_arg_upath1; |
| 835 | *pathp = malloc(MAXPATHLEN, M_AUDITPATH, M_WAITOK); |
| 836 | audit_canon_path(td, AT_FDCWD, path, *pathp); |
| 837 | ARG_SET_VALID(ar, ARG_UPATH1); |
| 838 | } |
| 839 | ar->k_ar.ar_arg_signum = td->td_proc->p_sig; |
| 840 | ARG_SET_VALID(ar, ARG_SIGNUM); |
| 841 | if (errcode != 0) |
| 842 | ret = 1; |
| 843 | audit_commit(ar, errcode, ret); |
| 844 | } |
no test coverage detected