Home | History | Annotate | Download | only in c2
      1 /*
      2  * CDDL HEADER START
      3  *
      4  * The contents of this file are subject to the terms of the
      5  * Common Development and Distribution License (the "License").
      6  * You may not use this file except in compliance with the License.
      7  *
      8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
      9  * or http://www.opensolaris.org/os/licensing.
     10  * See the License for the specific language governing permissions
     11  * and limitations under the License.
     12  *
     13  * When distributing Covered Code, include this CDDL HEADER in each
     14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
     15  * If applicable, add the following below this CDDL HEADER, with the
     16  * fields enclosed by brackets "[]" replaced with your own identifying
     17  * information: Portions Copyright [yyyy] [name of copyright owner]
     18  *
     19  * CDDL HEADER END
     20  */
     21 /*
     22  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
     23  * Use is subject to license terms.
     24  */
     25 
     26 #ifndef _BSM_AUDIT_RECORD_H
     27 #define	_BSM_AUDIT_RECORD_H
     28 
     29 
     30 #ifdef _KERNEL
     31 #include <sys/priv.h>
     32 #else
     33 #include <priv.h>
     34 #endif
     35 #include <sys/socket.h>
     36 #include <sys/acl.h>
     37 
     38 #include <sys/tsol/label.h>
     39 
     40 #ifdef __cplusplus
     41 extern "C" {
     42 #endif
     43 
     44 /*
     45  * Version of audit attributes
     46  *
     47  * OS Release      Version Number    Comments
     48  * ==========      ==============    ========
     49  * SunOS 5.1              2        Unbundled Package
     50  * SunOS 5.3              2        Bundled into the base OS
     51  * SunOS 5.4-5.x          2
     52  * Trusted Solaris 2.5    3        To distinguish potential new tokens
     53  * Trusted Solaris 7-8    4        Redefine X tokens that overlap with
     54  *                                 SunOS 5.7
     55  */
     56 
     57 #define	TOKEN_VERSION   2
     58 
     59 /*
     60  * Audit record token type codes
     61  */
     62 
     63 /*
     64  * Control token types
     65  */
     66 
     67 #define	AUT_INVALID		((char)0x00)
     68 #define	AUT_OTHER_FILE		((char)0x11)
     69 #define	AUT_OTHER_FILE32	AUT_OTHER_FILE
     70 #define	AUT_OHEADER		((char)0x12)
     71 #define	AUT_TRAILER		((char)0x13)
     72 #define	AUT_HEADER		((char)0x14)
     73 #define	AUT_HEADER32		AUT_HEADER
     74 #define	AUT_HEADER32_EX		((char)0x15)
     75 #define	AUT_TRAILER_MAGIC	((short)0xB105)
     76 
     77 /*
     78  * Data token types
     79  */
     80 
     81 #define	AUT_FMRI		((char)0x20)
     82 #define	AUT_DATA		((char)0x21)
     83 #define	AUT_IPC			((char)0x22)
     84 #define	AUT_PATH		((char)0x23)
     85 #define	AUT_SUBJECT		((char)0x24)
     86 #define	AUT_SUBJECT32		AUT_SUBJECT
     87 #define	AUT_XATPATH		((char)0x25)
     88 #define	AUT_PROCESS		((char)0x26)
     89 #define	AUT_PROCESS32		AUT_PROCESS
     90 #define	AUT_RETURN		((char)0x27)
     91 #define	AUT_RETURN32		AUT_RETURN
     92 #define	AUT_TEXT		((char)0x28)
     93 #define	AUT_OPAQUE		((char)0x29)
     94 #define	AUT_IN_ADDR		((char)0x2A)
     95 #define	AUT_IP			((char)0x2B)
     96 #define	AUT_IPORT		((char)0x2C)
     97 #define	AUT_ARG			((char)0x2D)
     98 #define	AUT_ARG32		AUT_ARG
     99 #define	AUT_SOCKET		((char)0x2E)
    100 #define	AUT_SEQ			((char)0x2F)
    101 #define	AUT_TID			((char)0x61)
    102 
    103 /*
    104  * Modifier token types
    105  */
    106 
    107 #define	AUT_ACL			((char)0x30)
    108 #define	AUT_ATTR		((char)0x31)
    109 #define	AUT_IPC_PERM		((char)0x32)
    110 #define	AUT_LABEL		((char)0x33)
    111 #define	AUT_GROUPS		((char)0x34)
    112 #define	AUT_ACE			((char)0x35)
    113 /*
    114  * 0x36, 0x37 unused
    115  */
    116 #define	AUT_PRIV		((char)0x38)
    117 #define	AUT_UPRIV		((char)0x39)
    118 #define	AUT_LIAISON		((char)0x3A)
    119 #define	AUT_NEWGROUPS		((char)0x3B)
    120 #define	AUT_EXEC_ARGS		((char)0x3C)
    121 #define	AUT_EXEC_ENV		((char)0x3D)
    122 #define	AUT_ATTR32		((char)0x3E)
    123 #define	AUT_UAUTH		((char)0x3F)
    124 #define	AUT_ZONENAME		((char)0x60)
    125 
    126 /*
    127  * X windows token types
    128  */
    129 
    130 #define	AUT_XATOM		((char)0x40)
    131 #define	AUT_XOBJ		((char)0x41)
    132 #define	AUT_XPROTO		((char)0x42)
    133 #define	AUT_XSELECT		((char)0x43)
    134 
    135 #if	TOKEN_VERSION != 3
    136 #define	AUT_XCOLORMAP		((char)0x44)
    137 #define	AUT_XCURSOR		((char)0x45)
    138 #define	AUT_XFONT		((char)0x46)
    139 #define	AUT_XGC			((char)0x47)
    140 #define	AUT_XPIXMAP		((char)0x48)
    141 #define	AUT_XPROPERTY		((char)0x49)
    142 #define	AUT_XWINDOW		((char)0x4A)
    143 #define	AUT_XCLIENT		((char)0x4B)
    144 #else	/* TOKEN_VERSION == 3 */
    145 #define	AUT_XCOLORMAP		((char)0x74)
    146 #define	AUT_XCURSOR		((char)0x75)
    147 #define	AUT_XFONT		((char)0x76)
    148 #define	AUT_XGC			((char)0x77)
    149 #define	AUT_XPIXMAP		((char)0x78)
    150 #define	AUT_XPROPERTY		((char)0x79)
    151 #define	AUT_XWINDOW		((char)0x7A)
    152 #define	AUT_XCLIENT		((char)0x7B)
    153 #endif	/* TOKEN_VERSION != 3 */
    154 
    155 /*
    156  * Command token types
    157  */
    158 
    159 #define	AUT_CMD   		((char)0x51)
    160 #define	AUT_EXIT   		((char)0x52)
    161 
    162 /*
    163  * Miscellaneous token types
    164  */
    165 
    166 #define	AUT_HOST		((char)0x70)
    167 
    168 /*
    169  * Solaris64 token types
    170  */
    171 
    172 #define	AUT_ARG64		((char)0x71)
    173 #define	AUT_RETURN64		((char)0x72)
    174 #define	AUT_ATTR64		((char)0x73)
    175 #define	AUT_HEADER64		((char)0x74)
    176 #define	AUT_SUBJECT64		((char)0x75)
    177 #define	AUT_PROCESS64		((char)0x77)
    178 #define	AUT_OTHER_FILE64	((char)0x78)
    179 
    180 /*
    181  * Extended network address token types
    182  */
    183 
    184 #define	AUT_HEADER64_EX		((char)0x79)
    185 #define	AUT_SUBJECT32_EX	((char)0x7a)
    186 #define	AUT_PROCESS32_EX	((char)0x7b)
    187 #define	AUT_SUBJECT64_EX	((char)0x7c)
    188 #define	AUT_PROCESS64_EX	((char)0x7d)
    189 #define	AUT_IN_ADDR_EX		((char)0x7e)
    190 #define	AUT_SOCKET_EX		((char)0x7f)
    191 
    192 
    193 /*
    194  * Audit print suggestion types.
    195  */
    196 
    197 #define	AUP_BINARY	((char)0)
    198 #define	AUP_OCTAL	((char)1)
    199 #define	AUP_DECIMAL	((char)2)
    200 #define	AUP_HEX		((char)3)
    201 #define	AUP_STRING	((char)4)
    202 
    203 /*
    204  * Audit data member types.
    205  */
    206 
    207 #define	AUR_BYTE	((char)0)
    208 #define	AUR_CHAR	((char)0)
    209 #define	AUR_SHORT	((char)1)
    210 #define	AUR_INT		((char)2)
    211 #define	AUR_INT32	((char)2)
    212 #define	AUR_INT64	((char)3)
    213 
    214 /*
    215  * Adr structures
    216  */
    217 
    218 struct adr_s {
    219 	char *adr_stream;	/* The base of the stream */
    220 	char *adr_now;		/* The location within the stream */
    221 };
    222 
    223 typedef struct adr_s adr_t;
    224 
    225 
    226 #ifdef _KERNEL
    227 
    228 #include <sys/param.h>
    229 #include <sys/systm.h>		/* for rval */
    230 #include <sys/time.h>
    231 #include <sys/types.h>
    232 #include <sys/vnode.h>
    233 #include <sys/mode.h>
    234 #include <sys/user.h>
    235 #include <sys/session.h>
    236 #include <sys/ipc_impl.h>
    237 #include <netinet/in_systm.h>
    238 #include <netinet/in.h>
    239 #include <netinet/ip.h>
    240 #include <sys/socket.h>
    241 #include <net/route.h>
    242 #include <netinet/in_pcb.h>
    243 
    244 /*
    245  * au_close flag arguments
    246  */
    247 
    248 #define	AU_OK		0x1	/* Good audit record */
    249 #define	AU_DONTBLOCK	0x2	/* Don't block or discard if queue full */
    250 #define	AU_DEFER	0x4	/* Defer record queueing to syscall end */
    251 
    252 /*
    253  * Audit token type is really an au_membuf pointer
    254  */
    255 typedef au_buff_t token_t;
    256 /*
    257  * token generation functions
    258  */
    259 token_t *au_append_token(token_t *, token_t *);
    260 token_t *au_set(caddr_t, uint_t);
    261 
    262 void au_free_rec(au_buff_t *);
    263 
    264 #define	au_getclr()		((token_t *)au_get_buff())
    265 #define	au_toss_token(tok)	(au_free_rec((au_buff_t *)(tok)))
    266 
    267 token_t *au_to_acl();
    268 token_t *au_to_ace();
    269 token_t *au_to_attr(struct vattr *);
    270 token_t *au_to_data(char, char, char, char *);
    271 token_t *au_to_header(int, au_event_t, au_emod_t);
    272 token_t *au_to_header_ex(int, au_event_t, au_emod_t);
    273 token_t *au_to_ipc(char, int);
    274 token_t *au_to_ipc_perm(kipc_perm_t *);
    275 token_t *au_to_iport(ushort_t);
    276 token_t *au_to_in_addr(struct in_addr *);
    277 token_t *au_to_in_addr_ex(int32_t *);
    278 token_t *au_to_ip(struct ip *);
    279 token_t *au_to_groups(const gid_t *, uint_t);
    280 token_t *au_to_path(struct audit_path *);
    281 token_t *au_to_seq();
    282 token_t *au_to_process(uid_t, gid_t, uid_t, gid_t, pid_t,
    283 			au_id_t, au_asid_t, const au_tid_addr_t *);
    284 token_t *au_to_subject(uid_t, gid_t, uid_t, gid_t, pid_t,
    285 			au_id_t, au_asid_t, const au_tid_addr_t *);
    286 token_t *au_to_return32(int, int32_t);
    287 token_t *au_to_return64(int, int64_t);
    288 token_t *au_to_text(const char *);
    289 /* token_t *au_to_tid(au_generic_tid_t *);  no kernel implementation */
    290 token_t *au_to_trailer(int);
    291 token_t *au_to_uauth(char *);
    292 size_t	au_zonename_length(zone_t *);
    293 token_t *au_to_zonename(size_t, zone_t *);
    294 token_t *au_to_arg32(char, char *, uint32_t);
    295 token_t *au_to_arg64(char, char *, uint64_t);
    296 token_t *au_to_socket(struct socket *);
    297 token_t *au_to_socket_ex(short, short, char *, char *);
    298 token_t *au_to_sock_inet(struct sockaddr_in *);
    299 token_t *au_to_exec_args(const char *, ssize_t);
    300 token_t *au_to_exec_env(const char *, ssize_t);
    301 token_t	*au_to_label(bslabel_t *);
    302 token_t	*au_to_privset(const char *, const priv_set_t *, char, int);
    303 
    304 void	au_uwrite();
    305 void	au_close(au_kcontext_t *, caddr_t *, int, au_event_t, au_emod_t);
    306 void	au_close_defer(token_t *, int, au_event_t, au_emod_t);
    307 void	au_close_time(au_kcontext_t *, token_t *, int, au_event_t, au_emod_t,
    308 	    timestruc_t *);
    309 void	au_free_rec(au_buff_t *);
    310 void	au_write(caddr_t *, token_t *);
    311 void	au_mem_init(void);
    312 void	au_zone_setup();
    313 void	au_enqueue(au_kcontext_t *, au_buff_t *, adr_t *, adr_t *, int, int);
    314 int	au_doorio(au_kcontext_t *);
    315 int	au_doormsg(au_kcontext_t *, uint32_t, void *);
    316 int	au_token_size(token_t *);
    317 int	au_append_rec(au_buff_t *, au_buff_t *, int);
    318 int	au_append_buf(const char *, int, au_buff_t *);
    319 
    320 #else /* !_KERNEL */
    321 
    322 #include <limits.h>
    323 #include <sys/types.h>
    324 #include <sys/vnode.h>
    325 #include <netinet/in_systm.h>
    326 #include <netinet/in.h>
    327 #include <netinet/ip.h>
    328 #include <sys/ipc.h>
    329 
    330 struct token_s {
    331 	struct token_s	*tt_next;	/* Next in the list	*/
    332 	short		tt_size;	/* Size of data		*/
    333 	char		*tt_data;	/* The data		*/
    334 };
    335 typedef struct token_s token_t;
    336 
    337 struct au_arg32_tok {
    338 	uchar_t num;
    339 	uint32_t val;
    340 	ushort_t length;
    341 	char *data;
    342 };
    343 typedef struct au_arg32_tok au_arg32_tok_t;
    344 
    345 struct au_acl_tok {
    346 	ulong_t type;
    347 	ulong_t id;
    348 	ulong_t mode;
    349 };
    350 typedef struct au_acl_tok au_acl_tok_t;
    351 
    352 struct au_arg64_tok {
    353 	uchar_t num;
    354 	uint64_t val;
    355 	ushort_t length;
    356 	char *data;
    357 };
    358 typedef struct au_arg64_tok au_arg64_tok_t;
    359 
    360 struct au_attr_tok {
    361 	uint_t mode;
    362 	uint_t uid;
    363 	uint_t gid;
    364 	int fs;
    365 	int32_t node;
    366 	uint32_t dev;
    367 };
    368 typedef struct au_attr_tok au_attr_tok_t;
    369 
    370 struct au_attr32_tok {
    371 	uint_t mode;
    372 	uint_t uid;
    373 	uint_t gid;
    374 	int fs;
    375 	int64_t node;
    376 	uint32_t dev;
    377 };
    378 typedef struct au_attr32_tok au_attr32_tok_t;
    379 
    380 struct au_attr64_tok {
    381 	uint_t mode;
    382 	uint_t uid;
    383 	uint_t gid;
    384 	int fs;
    385 	int64_t node;
    386 	uint64_t dev;
    387 };
    388 typedef struct au_attr64_tok au_attr64_tok_t;
    389 
    390 struct au_data_tok {
    391 	uchar_t pfmt;
    392 	uchar_t size;
    393 	uchar_t number;
    394 	char *data;
    395 };
    396 typedef struct au_data_tok au_data_tok_t;
    397 
    398 struct au_exit_tok {
    399 	int status;
    400 	int retval;
    401 };
    402 typedef struct au_exit_tok au_exit_tok_t;
    403 
    404 struct au_file32_tok {
    405 	/* really struct timeval from gettimeofday() */
    406 	int32_t sec;		/* seconds since epoc */
    407 	int32_t usec;		/* microseconds */
    408 	ushort_t length;
    409 	char *fname;
    410 };
    411 typedef struct au_file32_tok au_file32_tok_t;
    412 
    413 struct au_file64_tok {
    414 	/* really struct timeval */
    415 	int64_t sec;		/* seconds since epoc */
    416 	int64_t usec;		/* microseconds */
    417 	ushort_t length;
    418 	char *fname;
    419 };
    420 typedef struct au_file64_tok au_file64_tok_t;
    421 
    422 
    423 struct au_groups_tok {
    424 	gid_t groups[NGROUPS_MAX];
    425 };
    426 typedef struct au_groups_tok au_groups_tok_t;
    427 
    428 struct au_header32_tok {
    429 	uint_t length;
    430 	uchar_t version;
    431 	au_event_t event;
    432 	au_emod_t emod;
    433 	/* really timestruct_t (struct timespec) from hrestime */
    434 	int32_t sec;		/* seconds since epoc */
    435 	int32_t nsec;		/* nanoseconds */
    436 };
    437 typedef struct au_header32_tok au_header32_tok_t;
    438 
    439 struct au_header64_tok {
    440 	uint_t length;
    441 	uchar_t version;
    442 	au_event_t event;
    443 	au_emod_t emod;
    444 	/* really timestruct_t (struct timespec) from hrestime */
    445 	int64_t sec;		/* seconds since epoc */
    446 	int64_t nsec;		/* nanoseconds */
    447 };
    448 typedef struct au_header64_tok au_header64_tok_t;
    449 
    450 struct au_inaddr_tok {
    451 	struct in_addr ia;
    452 };
    453 typedef struct au_inaddr_tok au_inaddr_tok_t;
    454 
    455 struct au_ip_tok {
    456 	uchar_t version;
    457 	struct ip ip;
    458 };
    459 typedef struct au_ip_tok au_ip_tok_t;
    460 
    461 struct au_ipc_tok {
    462 	key_t id;
    463 };
    464 typedef struct au_ipc_tok au_ipc_tok_t;
    465 
    466 struct au_ipc_perm_tok {
    467 	struct ipc_perm ipc_perm;
    468 };
    469 typedef struct au_ipc_perm_tok au_ipc_perm_tok_t;
    470 
    471 struct au_iport_tok {
    472 	ushort_t iport;
    473 };
    474 typedef struct au_iport_tok au_iport_tok_t;
    475 
    476 struct au_invalid_tok {
    477 	ushort_t length;
    478 	char *data;
    479 };
    480 typedef struct au_invalid_tok au_invalid_tok_t;
    481 
    482 struct au_opaque_tok {
    483 	ushort_t length;
    484 	char *data;
    485 };
    486 typedef struct au_opaque_tok au_opaque_tok_t;
    487 
    488 struct au_path_tok {
    489 	ushort_t length;
    490 	char *name;
    491 };
    492 typedef struct au_path_tok au_path_tok_t;
    493 
    494 struct au_tid32 {
    495 	uint32_t port;
    496 	uint32_t machine;
    497 };
    498 typedef struct au_tid32 au_tid32_t;
    499 
    500 struct au_tid64 {
    501 	uint64_t port;
    502 	uint32_t machine;
    503 };
    504 typedef struct au_tid64 au_tid64_t;
    505 
    506 struct au_proc32_tok {
    507 	au_id_t auid;
    508 	uid_t euid;
    509 	gid_t egid;
    510 	uid_t ruid;
    511 	gid_t rgid;
    512 	pid_t pid;
    513 	pid_t sid;
    514 	au_tid32_t tid;
    515 };
    516 typedef struct au_proc32_tok au_proc32_tok_t;
    517 
    518 struct au_proc64_tok {
    519 	au_id_t auid;
    520 	uid_t euid;
    521 	gid_t egid;
    522 	uid_t ruid;
    523 	gid_t rgid;
    524 	pid_t pid;
    525 	pid_t sid;
    526 	au_tid64_t tid;
    527 };
    528 typedef struct au_proc64_tok au_proc64_tok_t;
    529 
    530 struct au_ret32_tok {
    531 	uchar_t error;
    532 	uint32_t retval;
    533 };
    534 typedef struct au_ret32_tok au_ret32_tok_t;
    535 
    536 struct au_ret64_tok {
    537 	uchar_t error;
    538 	uint64_t retval;
    539 };
    540 typedef struct au_ret64_tok au_ret64_tok_t;
    541 
    542 struct au_seq_tok {
    543 	uint_t num;
    544 };
    545 typedef struct au_seq_tok au_seq_tok_t;
    546 
    547 struct au_socket_tok {
    548 	short type;
    549 	ushort_t lport;
    550 	struct in_addr laddr;
    551 	ushort_t fport;
    552 	struct in_addr faddr;
    553 };
    554 typedef struct au_socket_tok au_socket_tok_t;
    555 
    556 struct au_subj32_tok {
    557 	au_id_t auid;
    558 	uid_t euid;
    559 	gid_t egid;
    560 	uid_t ruid;
    561 	gid_t rgid;
    562 	pid_t pid;
    563 	pid_t sid;
    564 	au_tid32_t tid;
    565 };
    566 typedef struct au_subj32_tok au_subj32_tok_t;
    567 
    568 struct au_subj64_tok {
    569 	au_id_t auid;
    570 	uid_t euid;
    571 	gid_t egid;
    572 	uid_t ruid;
    573 	gid_t rgid;
    574 	pid_t pid;
    575 	pid_t sid;
    576 	au_tid64_t tid;
    577 };
    578 typedef struct au_subj64_tok au_subj64_tok_t;
    579 
    580 struct au_server_tok {
    581 	au_id_t auid;
    582 	uid_t euid;
    583 	uid_t ruid;
    584 	gid_t egid;
    585 	pid_t pid;
    586 };
    587 typedef struct au_server_tok au_server_tok_t;
    588 
    589 struct au_text_tok {
    590 	ushort_t length;
    591 	char *data;
    592 };
    593 typedef struct au_text_tok au_text_tok_t;
    594 
    595 struct au_trailer_tok {
    596 	ushort_t magic;
    597 	uint_t length;
    598 };
    599 typedef struct au_trailer_tok au_trailer_tok_t;
    600 
    601 struct au_uauth_tok {
    602 	ushort_t length;
    603 	char *data;
    604 };
    605 typedef struct au_uauth_tok au_uauth_tok_t;
    606 
    607 struct au_token {
    608 	char id;
    609 	struct au_token *next;
    610 	struct au_token *prev;
    611 	char *data;
    612 	ushort_t size;
    613 	union {
    614 		au_arg32_tok_t arg32;
    615 		au_arg64_tok_t arg64;
    616 		au_acl_tok_t acl;
    617 		au_attr32_tok_t attr32;
    618 		au_attr64_tok_t attr64;
    619 		au_data_tok_t data;
    620 		au_exit_tok_t exit;
    621 		au_file32_tok_t file32;
    622 		au_file64_tok_t file64;
    623 		au_groups_tok_t groups;
    624 		au_header32_tok_t header32;
    625 		au_header64_tok_t header64;
    626 		au_inaddr_tok_t inaddr;
    627 		au_ip_tok_t ip;
    628 		au_ipc_perm_tok_t ipc_perm;
    629 		au_ipc_tok_t ipc;
    630 		au_iport_tok_t iport;
    631 		au_invalid_tok_t invalid;
    632 		au_opaque_tok_t opaque;
    633 		au_path_tok_t path;
    634 		au_proc32_tok_t proc32;
    635 		au_proc64_tok_t proc64;
    636 		au_ret32_tok_t ret32;
    637 		au_ret64_tok_t ret64;
    638 		au_server_tok_t server;
    639 		au_seq_tok_t seq;
    640 		au_socket_tok_t socket;
    641 		au_subj32_tok_t subj32;
    642 		au_subj64_tok_t subj64;
    643 		au_text_tok_t text;
    644 		au_trailer_tok_t trailer;
    645 		au_uauth_tok_t useofauth;
    646 	} un;
    647 };
    648 typedef struct au_token au_token_t;
    649 
    650 
    651 /*
    652  *	Old socket structure definition, formerly in <sys/socketvar.h>
    653  */
    654 struct oldsocket {
    655 	short	so_type;		/* generic type, see socket.h */
    656 	short	so_options;		/* from socket call, see socket.h */
    657 	short	so_linger;		/* time to linger while closing */
    658 	short	so_state;		/* internal state flags SS_*, below */
    659 	struct inpcb	*so_pcb;	/* protocol control block */
    660 	struct	protosw *so_proto;	/* protocol handle */
    661 /*
    662  * Variables for connection queueing.
    663  * Socket where accepts occur is so_head in all subsidiary sockets.
    664  * If so_head is 0, socket is not related to an accept.
    665  * For head socket so_q0 queues partially completed connections,
    666  * while so_q is a queue of connections ready to be accepted.
    667  * If a connection is aborted and it has so_head set, then
    668  * it has to be pulled out of either so_q0 or so_q.
    669  * We allow connections to queue up based on current queue lengths
    670  * and limit on number of queued connections for this socket.
    671  */
    672 	struct	oldsocket *so_head;	/* back pointer to accept socket */
    673 	struct	oldsocket *so_q0;	/* queue of partial connections */
    674 	struct	oldsocket *so_q;	/* queue of incoming connections */
    675 	short	so_q0len;		/* partials on so_q0 */
    676 	short	so_qlen;		/* number of connections on so_q */
    677 	short	so_qlimit;		/* max number queued connections */
    678 	short	so_timeo;		/* connection timeout */
    679 	ushort_t so_error;		/* error affecting connection */
    680 	short	so_pgrp;		/* pgrp for signals */
    681 	ulong_t	so_oobmark;		/* chars to oob mark */
    682 /*
    683  * Variables for socket buffering.
    684  */
    685 	struct	sockbuf {
    686 		ulong_t	sb_cc;		/* actual chars in buffer */
    687 		ulong_t	sb_hiwat;	/* max actual char count */
    688 		ulong_t	sb_mbcnt;	/* chars of mbufs used */
    689 		ulong_t	sb_mbmax;	/* max chars of mbufs to use */
    690 		ulong_t	sb_lowat;	/* low water mark (not used yet) */
    691 		struct	mbuf *sb_mb;	/* the mbuf chain */
    692 		struct	proc *sb_sel;	/* process selecting read/write */
    693 		short	sb_timeo;	/* timeout (not used yet) */
    694 		short	sb_flags;	/* flags, see below */
    695 	} so_rcv, so_snd;
    696 /*
    697  * Hooks for alternative wakeup strategies.
    698  * These are used by kernel subsystems wishing to access the socket
    699  * abstraction.  If so_wupfunc is nonnull, it is called in place of
    700  * wakeup any time that wakeup would otherwise be called with an
    701  * argument whose value is an address lying within a socket structure.
    702  */
    703 	struct wupalt	*so_wupalt;
    704 };
    705 extern token_t *au_to_arg32(char, char *, uint32_t);
    706 extern token_t *au_to_arg64(char, char *, uint64_t);
    707 extern token_t *au_to_acl(struct acl *);
    708 extern token_t *au_to_attr(struct vattr *);
    709 extern token_t *au_to_cmd(uint_t, char **, char **);
    710 extern token_t *au_to_data(char, char, char, char *);
    711 extern token_t *au_to_exec_args(char **);
    712 extern token_t *au_to_exec_env(char **);
    713 extern token_t *au_to_exit(int, int);
    714 extern token_t *au_to_fmri(char *);
    715 extern token_t *au_to_groups(int *);
    716 extern token_t *au_to_newgroups(int, gid_t *);
    717 extern token_t *au_to_header(au_event_t, au_emod_t);
    718 extern token_t *au_to_header_ex(au_event_t, au_emod_t);
    719 extern token_t *au_to_in_addr(struct in_addr *);
    720 extern token_t *au_to_in_addr_ex(struct in6_addr *);
    721 extern token_t *au_to_ipc(char, int);
    722 extern token_t *au_to_ipc_perm(struct ipc_perm *);
    723 extern token_t *au_to_iport(ushort_t);
    724 extern token_t *au_to_me(void);
    725 extern token_t *au_to_mylabel(void);
    726 extern token_t *au_to_opaque(char *, short);
    727 extern token_t *au_to_path(char *);
    728 extern token_t *au_to_privset(const char *, const priv_set_t *);
    729 extern token_t *au_to_process(au_id_t, uid_t, gid_t, uid_t, gid_t,
    730 				pid_t, au_asid_t, au_tid_t *);
    731 extern token_t *au_to_process_ex(au_id_t, uid_t, gid_t, uid_t, gid_t,
    732 				pid_t, au_asid_t, au_tid_addr_t *);
    733 extern token_t *au_to_return32(char, uint32_t);
    734 extern token_t *au_to_return64(char, uint64_t);
    735 extern token_t *au_to_seq(int);
    736 extern token_t *au_to_label(m_label_t *);
    737 extern token_t *au_to_socket(struct oldsocket *);
    738 extern token_t *au_to_subject(au_id_t, uid_t, gid_t, uid_t, gid_t,
    739 				pid_t, au_asid_t, au_tid_t *);
    740 extern token_t *au_to_subject_ex(au_id_t, uid_t, gid_t, uid_t, gid_t,
    741 				pid_t, au_asid_t, au_tid_addr_t *);
    742 extern token_t *au_to_text(char *);
    743 extern token_t *au_to_tid(au_generic_tid_t *);
    744 extern token_t *au_to_trailer(void);
    745 extern token_t *au_to_uauth(char *);
    746 extern token_t *au_to_upriv(char, char *);
    747 extern token_t *au_to_xatom(char *);
    748 extern token_t *au_to_xselect(char *, char *, char *);
    749 extern token_t *au_to_xcolormap(int32_t, uid_t);
    750 extern token_t *au_to_xcursor(int32_t, uid_t);
    751 extern token_t *au_to_xfont(int32_t, uid_t);
    752 extern token_t *au_to_xgc(int32_t, uid_t);
    753 extern token_t *au_to_xpixmap(int32_t, uid_t);
    754 extern token_t *au_to_xwindow(int32_t, uid_t);
    755 extern token_t *au_to_xproperty(int32_t, uid_t, char *);
    756 extern token_t *au_to_xclient(uint32_t);
    757 extern token_t *au_to_zonename(char *);
    758 #endif /* _KERNEL */
    759 
    760 #ifdef	_KERNEL
    761 
    762 void	adr_char(adr_t *, char *, int);
    763 void	adr_int32(adr_t *, int32_t *, int);
    764 void	adr_uint32(adr_t *, uint32_t *, int);
    765 void	adr_int64(adr_t *, int64_t *, int);
    766 void	adr_uint64(adr_t *, uint64_t *, int);
    767 void	adr_short(adr_t *, short *, int);
    768 void	adr_ushort(adr_t *, ushort_t *, int);
    769 void	adr_start(adr_t *, char *);
    770 
    771 char	*adr_getchar(adr_t *, char *);
    772 char	*adr_getshort(adr_t *, short  *);
    773 char	*adr_getushort(adr_t *, ushort_t  *);
    774 char	*adr_getint32(adr_t *, int32_t *);
    775 char	*adr_getuint32(adr_t *, uint32_t *);
    776 char	*adr_getint64(adr_t *, int64_t *);
    777 char	*adr_getuint64(adr_t *, uint64_t *);
    778 
    779 int	adr_count(adr_t *);
    780 
    781 #endif	/* _KERNEL */
    782 
    783 #ifdef __cplusplus
    784 }
    785 #endif
    786 
    787 #endif /* _BSM_AUDIT_RECORD_H */
    788