MCPcopy Create free account
hub / github.com/F-Stack/f-stack / audit_arg_file

Function audit_arg_file

freebsd/security/audit/audit_arg.c:672–726  ·  view source on GitHub ↗

* Audit information about a file, either the file's vnode info, or its * socket address info. */

Source from the content-addressed store, hash-verified

670 * socket address info.
671 */
672void
673audit_arg_file(struct proc *p, struct file *fp)
674{
675 struct kaudit_record *ar;
676 struct socket *so;
677 struct inpcb *pcb;
678 struct vnode *vp;
679
680 ar = currecord();
681 if (ar == NULL)
682 return;
683
684 switch (fp->f_type) {
685 case DTYPE_VNODE:
686 case DTYPE_FIFO:
687 /*
688 * XXXAUDIT: Only possibly to record as first vnode?
689 */
690 vp = fp->f_vnode;
691 vn_lock(vp, LK_SHARED | LK_RETRY);
692 audit_arg_vnode1(vp);
693 VOP_UNLOCK(vp);
694 break;
695
696 case DTYPE_SOCKET:
697 so = (struct socket *)fp->f_data;
698 if (INP_CHECK_SOCKAF(so, PF_INET)) {
699 SOCK_LOCK(so);
700 ar->k_ar.ar_arg_sockinfo.so_type =
701 so->so_type;
702 ar->k_ar.ar_arg_sockinfo.so_domain =
703 INP_SOCKAF(so);
704 ar->k_ar.ar_arg_sockinfo.so_protocol =
705 so->so_proto->pr_protocol;
706 SOCK_UNLOCK(so);
707 pcb = (struct inpcb *)so->so_pcb;
708 INP_RLOCK(pcb);
709 ar->k_ar.ar_arg_sockinfo.so_raddr =
710 pcb->inp_faddr.s_addr;
711 ar->k_ar.ar_arg_sockinfo.so_laddr =
712 pcb->inp_laddr.s_addr;
713 ar->k_ar.ar_arg_sockinfo.so_rport =
714 pcb->inp_fport;
715 ar->k_ar.ar_arg_sockinfo.so_lport =
716 pcb->inp_lport;
717 INP_RUNLOCK(pcb);
718 ARG_SET_VALID(ar, ARG_SOCKINFO);
719 }
720 break;
721
722 default:
723 /* XXXAUDIT: else? */
724 break;
725 }
726}
727
728/*
729 * Store a path as given by the user process for auditing into the audit

Callers

nothing calls this directly

Calls 3

currecordFunction · 0.85
vn_lockFunction · 0.85
audit_arg_vnode1Function · 0.85

Tested by

no test coverage detected