* audit_syscall_enter() is called on entry to each system call. It is * responsible for deciding whether or not to audit the call (preselection), * and if so, allocating a per-thread audit record. audit_new() will fill in * basic thread/credential properties. * * This function will be entered only if audit_syscalls_enabled was set in the * macro wrapper for this function. It could be clea
| 592 | * function runs, but that is an acceptable race. |
| 593 | */ |
| 594 | void |
| 595 | audit_syscall_enter(unsigned short code, struct thread *td) |
| 596 | { |
| 597 | struct au_mask *aumask; |
| 598 | #ifdef KDTRACE_HOOKS |
| 599 | void *dtaudit_state; |
| 600 | #endif |
| 601 | au_class_t class; |
| 602 | au_event_t event; |
| 603 | au_id_t auid; |
| 604 | int record_needed; |
| 605 | |
| 606 | KASSERT(td->td_ar == NULL, ("audit_syscall_enter: td->td_ar != NULL")); |
| 607 | KASSERT((td->td_pflags & TDP_AUDITREC) == 0, |
| 608 | ("audit_syscall_enter: TDP_AUDITREC set")); |
| 609 | |
| 610 | /* |
| 611 | * In FreeBSD, each ABI has its own system call table, and hence |
| 612 | * mapping of system call codes to audit events. Convert the code to |
| 613 | * an audit event identifier using the process system call table |
| 614 | * reference. In Darwin, there's only one, so we use the global |
| 615 | * symbol for the system call table. No audit record is generated |
| 616 | * for bad system calls, as no operation has been performed. |
| 617 | */ |
| 618 | if (code >= td->td_proc->p_sysent->sv_size) |
| 619 | return; |
| 620 | |
| 621 | event = td->td_proc->p_sysent->sv_table[code].sy_auevent; |
| 622 | if (event == AUE_NULL) |
| 623 | return; |
| 624 | |
| 625 | /* |
| 626 | * Check which audit mask to use; either the kernel non-attributable |
| 627 | * event mask or the process audit mask. |
| 628 | */ |
| 629 | auid = td->td_ucred->cr_audit.ai_auid; |
| 630 | if (auid == AU_DEFAUDITID) |
| 631 | aumask = &audit_nae_mask; |
| 632 | else |
| 633 | aumask = &td->td_ucred->cr_audit.ai_mask; |
| 634 | |
| 635 | /* |
| 636 | * Determine whether trail or pipe preselection would like an audit |
| 637 | * record allocated for this system call. |
| 638 | */ |
| 639 | class = au_event_class(event); |
| 640 | if (au_preselect(event, class, aumask, AU_PRS_BOTH)) { |
| 641 | /* |
| 642 | * If we're out of space and need to suspend unprivileged |
| 643 | * processes, do that here rather than trying to allocate |
| 644 | * another audit record. |
| 645 | * |
| 646 | * Note: we might wish to be able to continue here in the |
| 647 | * future, if the system recovers. That should be possible |
| 648 | * by means of checking the condition in a loop around |
| 649 | * cv_wait(). It might be desirable to reevaluate whether an |
| 650 | * audit record is still required for this event by |
| 651 | * re-calling au_preselect(). |
nothing calls this directly
no test coverage detected