| 169 | } |
| 170 | |
| 171 | void |
| 172 | au_evclassmap_init(void) |
| 173 | { |
| 174 | int i; |
| 175 | |
| 176 | EVCLASS_LOCK_INIT(); |
| 177 | for (i = 0; i < EVCLASSMAP_HASH_TABLE_SIZE; i++) |
| 178 | LIST_INIT(&evclass_hash[i].head); |
| 179 | |
| 180 | /* |
| 181 | * Set up the initial event to class mapping for system calls. |
| 182 | * |
| 183 | * XXXRW: Really, this should walk all possible audit events, not all |
| 184 | * native ABI system calls, as there may be audit events reachable |
| 185 | * only through non-native system calls. It also seems a shame to |
| 186 | * frob the mutex this early. |
| 187 | */ |
| 188 | for (i = 0; i < SYS_MAXSYSCALL; i++) { |
| 189 | if (sysent[i].sy_auevent != AUE_NULL) |
| 190 | au_evclassmap_insert(sysent[i].sy_auevent, 0); |
| 191 | } |
| 192 | } |
| 193 | |
| 194 | /* |
| 195 | * Look up the name for an audit event in the event-to-name mapping table. |
no test coverage detected