* Construct an audit record for the passed thread. */
| 260 | * Construct an audit record for the passed thread. |
| 261 | */ |
| 262 | static int |
| 263 | audit_record_ctor(void *mem, int size, void *arg, int flags) |
| 264 | { |
| 265 | struct kaudit_record *ar; |
| 266 | struct thread *td; |
| 267 | struct ucred *cred; |
| 268 | struct prison *pr; |
| 269 | |
| 270 | KASSERT(sizeof(*ar) == size, ("audit_record_ctor: wrong size")); |
| 271 | |
| 272 | td = arg; |
| 273 | ar = mem; |
| 274 | bzero(ar, sizeof(*ar)); |
| 275 | ar->k_ar.ar_magic = AUDIT_RECORD_MAGIC; |
| 276 | nanotime(&ar->k_ar.ar_starttime); |
| 277 | |
| 278 | /* |
| 279 | * Export the subject credential. |
| 280 | */ |
| 281 | cred = td->td_ucred; |
| 282 | cru2x(cred, &ar->k_ar.ar_subj_cred); |
| 283 | ar->k_ar.ar_subj_ruid = cred->cr_ruid; |
| 284 | ar->k_ar.ar_subj_rgid = cred->cr_rgid; |
| 285 | ar->k_ar.ar_subj_egid = cred->cr_groups[0]; |
| 286 | ar->k_ar.ar_subj_auid = cred->cr_audit.ai_auid; |
| 287 | ar->k_ar.ar_subj_asid = cred->cr_audit.ai_asid; |
| 288 | ar->k_ar.ar_subj_pid = td->td_proc->p_pid; |
| 289 | ar->k_ar.ar_subj_amask = cred->cr_audit.ai_mask; |
| 290 | ar->k_ar.ar_subj_term_addr = cred->cr_audit.ai_termid; |
| 291 | /* |
| 292 | * If this process is jailed, make sure we capture the name of the |
| 293 | * jail so we can use it to generate a zonename token when we covert |
| 294 | * this record to BSM. |
| 295 | */ |
| 296 | if (jailed(cred)) { |
| 297 | pr = cred->cr_prison; |
| 298 | (void) strlcpy(ar->k_ar.ar_jailname, pr->pr_name, |
| 299 | sizeof(ar->k_ar.ar_jailname)); |
| 300 | } else |
| 301 | ar->k_ar.ar_jailname[0] = '\0'; |
| 302 | return (0); |
| 303 | } |
| 304 | |
| 305 | static void |
| 306 | audit_record_dtor(void *mem, int size, void *arg) |