From 6d5a61563a0e58d0ce62b1fe263abb64c7369d7a Mon Sep 17 00:00:00 2001 From: Robert Watson Date: Wed, 1 Jul 2009 16:56:56 +0000 Subject: When auditing unmount(2), capture FSID arguments as regular text strings rather than as paths, which would lead to them being treated as relative pathnames and hence confusingly converted into absolute pathnames. Capture flags to unmount(2) via an argument token. Approved by: re (audit argument blanket) MFC after: 3 days --- sys/security/audit/audit_bsm.c | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'sys/security') diff --git a/sys/security/audit/audit_bsm.c b/sys/security/audit/audit_bsm.c index 1eb9679fa364..4b2b6f12104c 100644 --- a/sys/security/audit/audit_bsm.c +++ b/sys/security/audit/audit_bsm.c @@ -1070,7 +1070,15 @@ kaudit_to_bsm(struct kaudit_record *kar, struct au_record **pau) break; case AUE_UMOUNT: + if (ARG_IS_VALID(kar, ARG_VALUE)) { + tok = au_to_arg32(1, "flags", ar->ar_arg_value); + kau_write(rec, tok); + } UPATH1_VNODE1_TOKENS; + if (ARG_IS_VALID(kar, ARG_TEXT)) { + tok = au_to_text(ar->ar_arg_text); + kau_write(rec, tok); + } break; case AUE_MSGCTL: -- cgit v1.3