* Syscall to manage audit files. */ ARGSUSED */
| 774 | */ |
| 775 | /* ARGSUSED */ |
| 776 | int |
| 777 | sys_auditctl(struct thread *td, struct auditctl_args *uap) |
| 778 | { |
| 779 | struct nameidata nd; |
| 780 | struct ucred *cred; |
| 781 | struct vnode *vp; |
| 782 | int error = 0; |
| 783 | int flags; |
| 784 | |
| 785 | if (jailed(td->td_ucred)) |
| 786 | return (ENOSYS); |
| 787 | error = priv_check(td, PRIV_AUDIT_CONTROL); |
| 788 | if (error) |
| 789 | return (error); |
| 790 | |
| 791 | vp = NULL; |
| 792 | cred = NULL; |
| 793 | |
| 794 | /* |
| 795 | * If a path is specified, open the replacement vnode, perform |
| 796 | * validity checks, and grab another reference to the current |
| 797 | * credential. |
| 798 | * |
| 799 | * On Darwin, a NULL path argument is also used to disable audit. |
| 800 | */ |
| 801 | if (uap->path == NULL) |
| 802 | return (EINVAL); |
| 803 | |
| 804 | NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF | AUDITVNODE1, |
| 805 | UIO_USERSPACE, uap->path, td); |
| 806 | flags = AUDIT_OPEN_FLAGS; |
| 807 | error = vn_open(&nd, &flags, 0, NULL); |
| 808 | if (error) |
| 809 | return (error); |
| 810 | vp = nd.ni_vp; |
| 811 | #ifdef MAC |
| 812 | error = mac_system_check_auditctl(td->td_ucred, vp); |
| 813 | VOP_UNLOCK(vp); |
| 814 | if (error) { |
| 815 | vn_close(vp, AUDIT_CLOSE_FLAGS, td->td_ucred, td); |
| 816 | return (error); |
| 817 | } |
| 818 | #else |
| 819 | VOP_UNLOCK(vp); |
| 820 | #endif |
| 821 | NDFREE(&nd, NDF_ONLY_PNBUF); |
| 822 | if (vp->v_type != VREG) { |
| 823 | vn_close(vp, AUDIT_CLOSE_FLAGS, td->td_ucred, td); |
| 824 | return (EINVAL); |
| 825 | } |
| 826 | cred = td->td_ucred; |
| 827 | crhold(cred); |
| 828 | |
| 829 | /* |
| 830 | * XXXAUDIT: Should audit_trail_suspended actually be cleared by |
| 831 | * audit_worker? |
| 832 | */ |
| 833 | audit_trail_suspended = 0; |
nothing calls this directly
no test coverage detected