* Audit information about a file, either the file's vnode info, or its * socket address info. */
| 670 | * socket address info. |
| 671 | */ |
| 672 | void |
| 673 | audit_arg_file(struct proc *p, struct file *fp) |
| 674 | { |
| 675 | struct kaudit_record *ar; |
| 676 | struct socket *so; |
| 677 | struct inpcb *pcb; |
| 678 | struct vnode *vp; |
| 679 | |
| 680 | ar = currecord(); |
| 681 | if (ar == NULL) |
| 682 | return; |
| 683 | |
| 684 | switch (fp->f_type) { |
| 685 | case DTYPE_VNODE: |
| 686 | case DTYPE_FIFO: |
| 687 | /* |
| 688 | * XXXAUDIT: Only possibly to record as first vnode? |
| 689 | */ |
| 690 | vp = fp->f_vnode; |
| 691 | vn_lock(vp, LK_SHARED | LK_RETRY); |
| 692 | audit_arg_vnode1(vp); |
| 693 | VOP_UNLOCK(vp); |
| 694 | break; |
| 695 | |
| 696 | case DTYPE_SOCKET: |
| 697 | so = (struct socket *)fp->f_data; |
| 698 | if (INP_CHECK_SOCKAF(so, PF_INET)) { |
| 699 | SOCK_LOCK(so); |
| 700 | ar->k_ar.ar_arg_sockinfo.so_type = |
| 701 | so->so_type; |
| 702 | ar->k_ar.ar_arg_sockinfo.so_domain = |
| 703 | INP_SOCKAF(so); |
| 704 | ar->k_ar.ar_arg_sockinfo.so_protocol = |
| 705 | so->so_proto->pr_protocol; |
| 706 | SOCK_UNLOCK(so); |
| 707 | pcb = (struct inpcb *)so->so_pcb; |
| 708 | INP_RLOCK(pcb); |
| 709 | ar->k_ar.ar_arg_sockinfo.so_raddr = |
| 710 | pcb->inp_faddr.s_addr; |
| 711 | ar->k_ar.ar_arg_sockinfo.so_laddr = |
| 712 | pcb->inp_laddr.s_addr; |
| 713 | ar->k_ar.ar_arg_sockinfo.so_rport = |
| 714 | pcb->inp_fport; |
| 715 | ar->k_ar.ar_arg_sockinfo.so_lport = |
| 716 | pcb->inp_lport; |
| 717 | INP_RUNLOCK(pcb); |
| 718 | ARG_SET_VALID(ar, ARG_SOCKINFO); |
| 719 | } |
| 720 | break; |
| 721 | |
| 722 | default: |
| 723 | /* XXXAUDIT: else? */ |
| 724 | break; |
| 725 | } |
| 726 | } |
| 727 | |
| 728 | /* |
| 729 | * Store a path as given by the user process for auditing into the audit |
nothing calls this directly
no test coverage detected