Home | History | Annotate | Download | only in c2
      1 /*
      2  * CDDL HEADER START
      3  *
      4  * The contents of this file are subject to the terms of the
      5  * Common Development and Distribution License (the "License").
      6  * You may not use this file except in compliance with the License.
      7  *
      8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
      9  * or http://www.opensolaris.org/os/licensing.
     10  * See the License for the specific language governing permissions
     11  * and limitations under the License.
     12  *
     13  * When distributing Covered Code, include this CDDL HEADER in each
     14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
     15  * If applicable, add the following below this CDDL HEADER, with the
     16  * fields enclosed by brackets "[]" replaced with your own identifying
     17  * information: Portions Copyright [yyyy] [name of copyright owner]
     18  *
     19  * CDDL HEADER END
     20  */
     21 /*
     22  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
     23  * Use is subject to license terms.
     24  */
     25 
     26 /*
     27  * This file contains the declarations of the various data structures
     28  * used by the auditing module(s).
     29  */
     30 
     31 #ifndef	_BSM_AUDIT_H
     32 #define	_BSM_AUDIT_H
     33 
     34 #ifdef __cplusplus
     35 extern "C" {
     36 #endif
     37 
     38 
     39 #include <sys/shm.h>	/* for shmid_ds structure */
     40 #include <sys/sem.h>	/* for semid_ds structure */
     41 #include <sys/msg.h>	/* for msqid_ds structure */
     42 #include <sys/atomic.h>	/* using atomics */
     43 
     44 /*
     45  * Audit conditions, statements reguarding what's to be done with
     46  * audit records.  Neither AUC_ENABLED, AUC_DISABLED, nor AUC_UNSET
     47  * are returned on an auditconfig -getcond call.
     48  */
     49 /* global state */
     50 #define	AUC_DISABLED	-1	/* audit module loaded but not enabled */
     51 #define	AUC_UNSET	0	/* on/off hasn't been decided */
     52 #define	AUC_ENABLED	1	/* loaded and enabled */
     53 /* local zone state */
     54 #define	AUC_INIT_AUDIT	4	/* c2audit is ready but auditd has not run */
     55 #define	AUC_AUDITING	1	/* auditing is being done */
     56 #define	AUC_NOAUDIT	2	/* auditing is not being done */
     57 #define	AUC_NOSPACE	3	/* audit enabled, no space for audit records */
     58 
     59 /*
     60  * The user id -2 is never audited - in fact, a setauid(AU_NOAUDITID)
     61  * will turn off auditing.
     62  */
     63 #define	AU_NOAUDITID	((au_id_t)-2)
     64 
     65 /*
     66  * success/failure bits for asynchronous events
     67  */
     68 
     69 #define	AUM_SUCC	1	/* use the system success preselection mask */
     70 #define	AUM_FAIL	2	/* use the system failure preselection mask */
     71 
     72 
     73 /*
     74  * Defines for event modifier field
     75  */
     76 #define	PAD_READ	0x0001		/* object read */
     77 #define	PAD_WRITE	0x0002		/* object write */
     78 #define	PAD_NONATTR	0x4000		/* non-attributable event */
     79 #define	PAD_FAILURE	0x8000		/* fail audit event */
     80 #define	PAD_SPRIVUSE	0x0080		/* successfully used privileged */
     81 #define	PAD_FPRIVUSE	0x0100		/* failed use of privileged */
     82 
     83 /*
     84  * Some typedefs for the fundamentals
     85  */
     86 typedef uint_t au_asid_t;
     87 typedef uint_t  au_class_t;
     88 typedef ushort_t au_event_t;
     89 typedef ushort_t au_emod_t;
     90 typedef uid_t au_id_t;
     91 
     92 /*
     93  * An audit event mask.
     94  */
     95 #define	AU_MASK_ALL	0xFFFFFFFF	/* all bits on for unsigned int */
     96 #define	AU_MASK_NONE	0x0		/* all bits off = no:invalid class */
     97 
     98 struct au_mask {
     99 	unsigned int	am_success;	/* success bits */
    100 	unsigned int	am_failure;	/* failure bits */
    101 };
    102 typedef struct au_mask au_mask_t;
    103 #define	as_success am_success
    104 #define	as_failure am_failure
    105 
    106 /*
    107  * The structure of the terminal ID (ipv4)
    108  */
    109 struct au_tid {
    110 	dev_t port;
    111 	uint_t machine;
    112 };
    113 
    114 #if defined(_SYSCALL32)
    115 struct au_tid32 {
    116 	uint_t port;
    117 	uint_t machine;
    118 };
    119 
    120 typedef struct au_tid32 au_tid32_t;
    121 #endif
    122 
    123 typedef struct au_tid au_tid_t;
    124 
    125 /*
    126  * The structure of the terminal ID (ipv6)
    127  */
    128 struct au_tid_addr {
    129 	dev_t  at_port;
    130 	uint_t at_type;
    131 	uint_t at_addr[4];
    132 };
    133 
    134 struct au_port_s {
    135 	uint32_t at_major;	/* major # */
    136 	uint32_t at_minor;	/* minor # */
    137 };
    138 typedef struct au_port_s au_port_t;
    139 
    140 struct au_tid_addr64 {
    141 	au_port_t	at_port;
    142 	uint_t		at_type;
    143 	uint_t		at_addr[4];
    144 };
    145 typedef struct au_tid_addr64 au_tid64_addr_t;
    146 
    147 #if defined(_SYSCALL32)
    148 struct au_tid_addr32 {
    149 	uint_t at_port;
    150 	uint_t at_type;
    151 	uint_t at_addr[4];
    152 };
    153 
    154 typedef struct au_tid_addr32 au_tid32_addr_t;
    155 #endif
    156 
    157 typedef struct au_tid_addr au_tid_addr_t;
    158 
    159 struct au_ip {
    160 	uint16_t	at_r_port;	/* remote port */
    161 	uint16_t	at_l_port;	/* local port */
    162 	uint32_t	at_type;	/* AU_IPv4,... */
    163 	uint32_t	at_addr[4];	/* remote IP */
    164 };
    165 typedef struct au_ip au_ip_t;
    166 
    167 /*
    168  * Generic network address structure
    169  */
    170 struct au_generic_tid {
    171 	uchar_t	gt_type;	/* AU_IPADR, AU_DEVICE,... */
    172 	union {
    173 		au_ip_t		at_ip;
    174 		au_port_t	at_dev;
    175 	} gt_adr;
    176 };
    177 typedef struct au_generic_tid au_generic_tid_t;
    178 
    179 /*
    180  * au_generic_tid_t gt_type values
    181  * 0 is reserved for uninitialized data
    182  */
    183 #define	AU_IPADR	1
    184 #define	AU_ETHER	2
    185 #define	AU_DEVICE	3
    186 
    187 /*
    188  * at_type values - address length used to identify address type
    189  */
    190 #define	AU_IPv4 4	/* ipv4 type IP address */
    191 #define	AU_IPv6 16	/* ipv6 type IP address */
    192 
    193 /*
    194  * Compatability with SunOS 4.x BSM module
    195  *
    196  * New code should not contain audit_state_t,
    197  * au_state_t, nor au_termid as these types
    198  * may go away in future releases.
    199  *
    200  * typedef new-5.x-bsm-name old-4.x-bsm-name
    201  */
    202 
    203 typedef au_class_t au_state_t;
    204 typedef au_mask_t audit_state_t;
    205 typedef au_id_t auid_t;
    206 #define	ai_state ai_mask;
    207 
    208 /*
    209  * Opcodes for bsm system calls
    210  */
    211 
    212 #define	BSM_GETAUID		19
    213 #define	BSM_SETAUID		20
    214 #define	BSM_GETAUDIT		21
    215 #define	BSM_SETAUDIT		22
    216 #define	BSM_GETUSERAUDIT	23
    217 #define	BSM_SETUSERAUDIT	24
    218 #define	BSM_AUDIT		25
    219 /* 				26	OBSOLETE */
    220 /* 				27	EOL announced for Sol 10 */
    221 #define	BSM_AUDITON		28
    222 #define	BSM_AUDITCTL		29
    223 #define	BSM_GETKERNSTATE	30
    224 #define	BSM_SETKERNSTATE	31
    225 #define	BSM_GETPORTAUDIT	32
    226 #define	BSM_REVOKE		33
    227 #define	BSM_AUDITSTAT		34
    228 #define	BSM_GETAUDIT_ADDR	35
    229 #define	BSM_SETAUDIT_ADDR	36
    230 #define	BSM_AUDITDOOR		37
    231 
    232 /*
    233  * Auditctl(2) commands
    234  */
    235 #define	A_GETPOLICY	2	/* get audit policy */
    236 #define	A_SETPOLICY	3	/* set audit policy */
    237 #define	A_GETKMASK	4	/* get kernel event preselection mask */
    238 #define	A_SETKMASK	5	/* set kernel event preselection mask */
    239 #define	A_GETQCTRL	6	/* get kernel audit queue ctrl parameters */
    240 #define	A_SETQCTRL	7	/* set kernel audit queue ctrl parameters */
    241 #define	A_GETCWD	8	/* get process current working directory */
    242 #define	A_GETCAR	9	/* get process current active root */
    243 #define	A_GETSTAT	12	/* get audit statistics */
    244 #define	A_SETSTAT	13	/* (re)set audit statistics */
    245 #define	A_SETUMASK	14	/* set preselection mask for procs with auid */
    246 #define	A_SETSMASK	15	/* set preselection mask for procs with asid */
    247 #define	A_GETCOND	20	/* get audit system on/off condition */
    248 #define	A_SETCOND	21	/* set audit system on/off condition */
    249 #define	A_GETCLASS	22	/* get audit event to class mapping */
    250 #define	A_SETCLASS	23	/* set audit event to class mapping */
    251 #define	A_GETPINFO	24	/* get audit info for an arbitrary pid */
    252 #define	A_SETPMASK	25	/* set preselection mask for an given pid */
    253 #define	A_SETFSIZE	26	/* set audit file size */
    254 #define	A_GETFSIZE	27	/* get audit file size */
    255 #define	A_GETPINFO_ADDR	28	/* get audit info for an arbitrary pid */
    256 #define	A_GETKAUDIT	29	/* get kernel audit characteristics */
    257 #define	A_SETKAUDIT	30	/* set kernel audit characteristics */
    258 
    259 /*
    260  * Audit Policy parameters (32 bits)
    261  */
    262 #define	AUDIT_CNT	0x0001	/* do NOT sleep undelivered synch events */
    263 #define	AUDIT_AHLT	0x0002	/* HALT machine on undelivered async event */
    264 #define	AUDIT_ARGV	0x0004	/* include argv with execv system call events */
    265 #define	AUDIT_ARGE	0x0008	/* include arge with execv system call events */
    266 #define	AUDIT_SEQ	0x0010	/* include sequence attribute */
    267 #define	AUDIT_WINDATA	0x0020	/* include interwindow moved data */
    268 #define	AUDIT_GROUP	0x0040	/* include group attribute with each record */
    269 #define	AUDIT_TRAIL	0x0080	/* include trailer token */
    270 #define	AUDIT_PATH	0x0100	/* allow multiple paths per event */
    271 #define	AUDIT_SCNT	0x0200	/* sleep user events but not kernel events */
    272 #define	AUDIT_PUBLIC	0x0400	/* audit even "public" files */
    273 #define	AUDIT_ZONENAME	0x0800	/* emit zonename token */
    274 #define	AUDIT_PERZONE	0x1000	/* auditd and audit queue for each zone */
    275 #define	AUDIT_WINDATA_DOWN	0x2000	/* include paste downgraded data */
    276 #define	AUDIT_WINDATA_UP	0x4000	/* include paste upgraded data */
    277 
    278 /*
    279  * If AUDIT_GLOBAL changes, corresponding changes are required in
    280  * audit_syscalls.c's setpolicy().
    281  */
    282 #define	AUDIT_GLOBAL	(AUDIT_AHLT | AUDIT_PERZONE)
    283 #define	AUDIT_LOCAL	(AUDIT_CNT | AUDIT_ARGV | AUDIT_ARGE |\
    284 			AUDIT_SEQ | AUDIT_WINDATA |\
    285 			AUDIT_GROUP | AUDIT_TRAIL | AUDIT_PATH |\
    286 			AUDIT_PUBLIC | AUDIT_SCNT | AUDIT_ZONENAME |\
    287 			AUDIT_WINDATA_DOWN | AUDIT_WINDATA_UP)
    288 
    289 /*
    290  * Kernel audit queue control parameters
    291  *
    292  *	audit record recording blocks at hiwater # undelived records
    293  *	audit record recording resumes at lowwater # undelivered audit records
    294  *	bufsz determines how big the data xfers will be to the audit trail
    295  */
    296 struct au_qctrl {
    297 	size_t	aq_hiwater;	/* kernel audit queue, high water mark */
    298 	size_t	aq_lowater;	/* kernel audit queue, low  water mark */
    299 	size_t	aq_bufsz;	/* kernel audit queue, write size to trail */
    300 	clock_t	aq_delay;	/* delay before flushing audit queue */
    301 };
    302 
    303 #if defined(_SYSCALL32)
    304 struct au_qctrl32 {
    305 	size32_t	aq_hiwater;
    306 	size32_t	aq_lowater;
    307 	size32_t	aq_bufsz;
    308 	clock32_t	aq_delay;
    309 };
    310 #endif
    311 
    312 
    313 /*
    314  * default values of hiwater and lowater (note hi > lo)
    315  */
    316 #define	AQ_HIWATER  100
    317 #define	AQ_MAXHIGH  100000
    318 #define	AQ_LOWATER  10
    319 #define	AQ_BUFSZ    8192
    320 #define	AQ_MAXBUFSZ 1048576
    321 #define	AQ_DELAY    20
    322 #define	AQ_MAXDELAY 20000
    323 
    324 struct auditinfo {
    325 	au_id_t		ai_auid;
    326 	au_mask_t	ai_mask;
    327 	au_tid_t	ai_termid;
    328 	au_asid_t	ai_asid;
    329 };
    330 
    331 #if defined(_SYSCALL32)
    332 struct auditinfo32 {
    333 	au_id_t		ai_auid;
    334 	au_mask_t	ai_mask;
    335 	au_tid32_t	ai_termid;
    336 	au_asid_t	ai_asid;
    337 };
    338 
    339 typedef struct auditinfo32 auditinfo32_t;
    340 #endif
    341 
    342 typedef struct auditinfo auditinfo_t;
    343 
    344 struct auditinfo_addr {
    345 	au_id_t		ai_auid;
    346 	au_mask_t	ai_mask;
    347 	au_tid_addr_t	ai_termid;
    348 	au_asid_t	ai_asid;
    349 };
    350 
    351 struct auditinfo_addr64 {
    352 	au_id_t		ai_auid;
    353 	au_mask_t	ai_mask;
    354 	au_tid64_addr_t	ai_termid;
    355 	au_asid_t	ai_asid;
    356 };
    357 typedef struct auditinfo_addr64 auditinfo64_addr_t;
    358 
    359 #if defined(_SYSCALL32)
    360 struct auditinfo_addr32 {
    361 	au_id_t		ai_auid;
    362 	au_mask_t	ai_mask;
    363 	au_tid32_addr_t	ai_termid;
    364 	au_asid_t	ai_asid;
    365 };
    366 
    367 typedef struct auditinfo_addr32 auditinfo32_addr_t;
    368 #endif
    369 
    370 typedef struct auditinfo_addr auditinfo_addr_t;
    371 
    372 struct auditpinfo {
    373 	pid_t		ap_pid;
    374 	au_id_t		ap_auid;
    375 	au_mask_t	ap_mask;
    376 	au_tid_t	ap_termid;
    377 	au_asid_t	ap_asid;
    378 };
    379 
    380 #if defined(_SYSCALL32)
    381 struct auditpinfo32 {
    382 	pid_t		ap_pid;
    383 	au_id_t		ap_auid;
    384 	au_mask_t	ap_mask;
    385 	au_tid32_t	ap_termid;
    386 	au_asid_t	ap_asid;
    387 };
    388 #endif
    389 
    390 
    391 struct auditpinfo_addr {
    392 	pid_t		ap_pid;
    393 	au_id_t		ap_auid;
    394 	au_mask_t	ap_mask;
    395 	au_tid_addr_t	ap_termid;
    396 	au_asid_t	ap_asid;
    397 };
    398 
    399 #if defined(_SYSCALL32)
    400 struct auditpinfo_addr32 {
    401 	pid_t		ap_pid;
    402 	au_id_t		ap_auid;
    403 	au_mask_t	ap_mask;
    404 	au_tid32_addr_t	ap_termid;
    405 	au_asid_t	ap_asid;
    406 };
    407 #endif
    408 
    409 
    410 struct au_evclass_map {
    411 	au_event_t	ec_number;
    412 	au_class_t	ec_class;
    413 };
    414 typedef struct au_evclass_map au_evclass_map_t;
    415 
    416 /*
    417  * Audit stat structures (used to be in audit_stat.h
    418  */
    419 
    420 struct audit_stat {
    421 	unsigned int as_version;	/* version of kernel audit code */
    422 	unsigned int as_numevent;	/* number of kernel audit events */
    423 	uint32_t as_generated;		/* # records processed */
    424 	uint32_t as_nonattrib;		/* # non-attributed records produced */
    425 	uint32_t as_kernel;		/* # records produced by kernel */
    426 	uint32_t as_audit;		/* # records processed by audit(2) */
    427 	uint32_t as_auditctl;		/* # records processed by auditctl(2) */
    428 	uint32_t as_enqueue;		/* # records put onto audit queue */
    429 	uint32_t as_written;		/* # records written to audit trail */
    430 	uint32_t as_wblocked;		/* # times write blked on audit queue */
    431 	uint32_t as_rblocked;		/* # times read blked on audit queue */
    432 	uint32_t as_dropped;		/* # of dropped audit records */
    433 	uint32_t as_totalsize;		/* total number bytes of audit data */
    434 	uint32_t as_memused;		/* no longer used */
    435 };
    436 typedef struct audit_stat au_stat_t;
    437 
    438 /*
    439  * Secondary stat structure for file size stuff.  The stat structure was
    440  * not combined to preserve the semantics of the 5.1 - 5.3 A_GETSTAT call
    441  */
    442 struct audit_fstat {
    443 	unsigned int af_filesz;
    444 	unsigned int af_currsz;
    445 };
    446 typedef struct audit_fstat au_fstat_t;
    447 
    448 /* get kernel audit context dependent on AUDIT_PERZONE policy */
    449 #define	GET_KCTX_PZ	(audit_policy & AUDIT_PERZONE) ?\
    450 			    curproc->p_zone->zone_audit_kctxt :\
    451 			    global_zone->zone_audit_kctxt
    452 /* get kernel audit context of global zone */
    453 #define	GET_KCTX_GZ	global_zone->zone_audit_kctxt
    454 /* get kernel audit context of non-global zone */
    455 #define	GET_KCTX_NGZ	curproc->p_zone->zone_audit_kctxt
    456 
    457 #define	AS_INC(a, b, c) atomic_add_32(&(c->auk_statistics.a), (b))
    458 #define	AS_DEC(a, b, c) atomic_add_32(&(c->auk_statistics.a), -(b))
    459 
    460 /*
    461  * audit token IPC types (shm, sem, msg) [for ipc attribute]
    462  */
    463 
    464 #define	AT_IPC_MSG	((char)1)		/* message IPC id */
    465 #define	AT_IPC_SEM	((char)2)		/* semaphore IPC id */
    466 #define	AT_IPC_SHM	((char)3)		/* shared memory IPC id */
    467 
    468 #if defined(_KERNEL)
    469 
    470 #ifdef __cplusplus
    471 }
    472 #endif
    473 
    474 #include <sys/types.h>
    475 #include <sys/model.h>
    476 #include <sys/proc.h>
    477 #include <sys/stream.h>
    478 #include <sys/stropts.h>
    479 #include <sys/file.h>
    480 #include <sys/pathname.h>
    481 #include <sys/vnode.h>
    482 #include <sys/systm.h>
    483 #include <netinet/in.h>
    484 #include <c2/audit_door_infc.h>
    485 #include <sys/crypto/ioctladmin.h>
    486 #include <sys/netstack.h>
    487 
    488 #ifdef __cplusplus
    489 extern "C" {
    490 #endif
    491 
    492 struct fcntla;
    493 struct t_audit_data;
    494 struct audit_path;
    495 struct priv_set;
    496 struct devplcysys;
    497 
    498 struct auditcalls {
    499 	long	code;
    500 	long	a1;
    501 	long	a2;
    502 	long	a3;
    503 	long	a4;
    504 	long	a5;
    505 };
    506 
    507 int	audit(caddr_t, int);
    508 int	_audit(caddr_t, int);
    509 int	auditsys(struct auditcalls *, union rval *); /* fake stub */
    510 int	_auditsys(struct auditcalls *, union rval *); /* real deal */
    511 void	audit_cryptoadm(int, char *, crypto_mech_name_t *,
    512 	    uint_t, uint_t, uint32_t, int);
    513 void	audit_init(void);
    514 void	audit_newproc(struct proc *);
    515 void	audit_pfree(struct proc *);
    516 void	audit_thread_create(kthread_id_t);
    517 void	audit_thread_free(kthread_id_t);
    518 int	audit_savepath(struct pathname *, struct vnode *, int, cred_t *);
    519 void	audit_addcomponent(struct pathname *);
    520 void	audit_anchorpath(struct pathname *, int);
    521 void	audit_symlink(struct pathname *, struct pathname *);
    522 void	audit_symlink_create(struct vnode *, char *, char *, int);
    523 int	file_is_public(struct vattr *);
    524 void	audit_attributes(struct vnode *);
    525 void	audit_falloc(struct file *);
    526 void	audit_unfalloc(struct file *);
    527 void	audit_exit(int, int);
    528 void	audit_core_start(int);
    529 void	audit_core_finish(int);
    530 void	audit_stropen(struct vnode *, dev_t *, int, struct cred *);
    531 void	audit_strclose(struct vnode *, int, struct cred *);
    532 void	audit_strioctl(struct vnode *, int, intptr_t, int, int, struct cred *,
    533 		int *);
    534 void	audit_strgetmsg(struct vnode *, struct strbuf *, struct strbuf *,
    535 		unsigned char *, int *, int);
    536 void	audit_strputmsg(struct vnode *, struct strbuf *, struct strbuf *,
    537 		unsigned char, int, int);
    538 void	audit_closef(struct file *);
    539 int	audit_getf(int);
    540 void	audit_setf(struct file *, int);
    541 void	audit_copen(int, struct file *, struct vnode *);
    542 void	audit_reboot(void);
    543 void	audit_vncreate_start(void);
    544 void	audit_setfsat_path(int argnum);
    545 void	audit_vncreate_finish(struct vnode *, int);
    546 void	audit_exec(const char *, const char *, ssize_t, ssize_t);
    547 void	audit_enterprom(int);
    548 void	audit_exitprom(int);
    549 void	audit_chdirec(struct vnode *, struct vnode **);
    550 void	audit_sock(int, struct queue *, struct msgb *, int);
    551 void	audit_free(void);
    552 int	audit_start(unsigned int, unsigned int, int, klwp_t *);
    553 void	audit_finish(unsigned int, unsigned int, int, union rval *);
    554 int	audit_async_start(label_t *, au_event_t, int);
    555 void	audit_async_finish(caddr_t *, au_event_t, au_emod_t);
    556 void	audit_async_discard_backend(void *);
    557 void	audit_async_done(caddr_t *, int);
    558 void	audit_async_drop(caddr_t *, int);
    559 
    560 #ifndef AUK_CONTEXT_T
    561 #define	AUK_CONTEXT_T
    562 typedef struct au_kcontext au_kcontext_t;
    563 #endif
    564 
    565 int	audit_success(au_kcontext_t *, struct t_audit_data *, int, cred_t *);
    566 int	auditme(au_kcontext_t *, struct t_audit_data *, au_state_t);
    567 void	audit_fixpath(struct audit_path *, int);
    568 void	audit_ipc(int, int, void *);
    569 void	audit_ipcget(int, void *);
    570 void	audit_lookupname();
    571 int	audit_pathcomp(struct pathname *, vnode_t *, cred_t *);
    572 void	audit_fdsend(int, struct file *, int);
    573 void	audit_fdrecv(int, struct file *);
    574 int	audit_c2_revoke(struct fcntla *, rval_t *);
    575 void	audit_priv(int, const struct priv_set *, int);
    576 void	audit_setppriv(int, int, const struct priv_set *, const cred_t *);
    577 void	audit_devpolicy(int, const struct devplcysys *);
    578 void	audit_update_context(proc_t *, cred_t *);
    579 void	audit_kssl(int, void *, int);
    580 void	audit_pf_policy(int, cred_t *, netstack_t *, char *, boolean_t, int,
    581     pid_t);
    582 void	audit_sec_attributes(caddr_t *, struct vnode *);
    583 
    584 #endif
    585 
    586 #ifdef __cplusplus
    587 }
    588 #endif
    589 
    590 #endif /* _BSM_AUDIT_H */
    591