diff options
| author | Konstantin Belousov <kib@FreeBSD.org> | 2026-01-08 01:07:52 +0000 |
|---|---|---|
| committer | Konstantin Belousov <kib@FreeBSD.org> | 2026-01-25 15:53:02 +0000 |
| commit | d0d4b9b9df2ade9085b6318e3fdbc9b67b3f666c (patch) | |
| tree | 86ab69929d95aaf9c932cef82a323b41e3208b45 | |
| parent | 7211cd2cce746972af2d60d4b5bf0c087f016731 (diff) | |
sys: add AUE_PDRFORK
Reviewed by: asomers, markj
Tested by: pho
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D54592
| -rw-r--r-- | sys/bsm/audit_kevents.h | 1 | ||||
| -rw-r--r-- | sys/security/audit/audit_bsm.c | 18 |
2 files changed, 19 insertions, 0 deletions
diff --git a/sys/bsm/audit_kevents.h b/sys/bsm/audit_kevents.h index 9381396f247c..ac6f5d69f07d 100644 --- a/sys/bsm/audit_kevents.h +++ b/sys/bsm/audit_kevents.h @@ -664,6 +664,7 @@ #define AUE_TIMERFD 43270 /* FreeBSD/Linux. */ #define AUE_SETCRED 43271 /* FreeBSD-specific. */ #define AUE_INOTIFY 43272 /* FreeBSD/Linux. */ +#define AUE_PDRFORK 43273 /* FreeBSD-specific. */ /* * Darwin BSM uses a number of AUE_O_* definitions, which are aliased to the diff --git a/sys/security/audit/audit_bsm.c b/sys/security/audit/audit_bsm.c index 2cd1511b2296..0b6802f3194f 100644 --- a/sys/security/audit/audit_bsm.c +++ b/sys/security/audit/audit_bsm.c @@ -1365,6 +1365,24 @@ kaudit_to_bsm(struct kaudit_record *kar, struct au_record **pau) kau_write(rec, tok); } break; + case AUE_PDRFORK: + if (ARG_IS_VALID(kar, ARG_PID)) { + tok = au_to_arg32(0, "child PID", ar->ar_arg_pid); + kau_write(rec, tok); + } + if (ARG_IS_VALID(kar, ARG_CMD)) { + tok = au_to_arg32(2, "fflags", ar->ar_arg_cmd); + kau_write(rec, tok); + } + if (ARG_IS_VALID(kar, ARG_FFLAGS)) { + tok = au_to_arg32(2, "flags", ar->ar_arg_fflags); + kau_write(rec, tok); + } + if (ARG_IS_VALID(kar, ARG_FD)) { + tok = au_to_arg32(1, "fd", ar->ar_arg_fd); + kau_write(rec, tok); + } + break; case AUE_PDGETPID: if (ARG_IS_VALID(kar, ARG_FD)) { tok = au_to_arg32(1, "fd", ar->ar_arg_fd); |