sys_exit AUE_NULL Record is committed, but return value and exit condition isn't audited. fork New pid is audited. read AUE_NULL write AUE_NULL open fflags audited mode audited XXX Path close fd audited wait4 AUE_NULL creat Implemented via kern_open(), so audited as open(). link XXX Path unlink XXX Path chdir XXX Path fchdir XXX path XXX fd mknod XXX mode XXX dev XXX path chmod mode audited XXX path chown uid audited gid audited XXX path obreak AUE_NULL getfsstat XXX flags lseek XXX fd XXX offset XXX whence getpid XXX why audit mount XXX type XXX dir XXX flags XXX data unmount XXX dir XXX flags setuid XXX uid getuid AUE_NULL geteuid AUE_NULL ptrace XXX request XXX pid XXX addr XXX data recvmsg XXX s XXX msg XXX flags sendmsg XXX s XXX msg XXX flags recvfrom XXX s XXX buf XXX len XXX flags XXX from XXX fromlen accept XXX s XXX addr XXX addrlen XXX return fd getpeername XXX s XXX name XXX namelen getsockname XXX s XXX name XXX namelen access XXX path XXX mode chflags XXX path flags fchflags fd audited fflags audited sync No arguments. kill XXX pid XXX sig stat XXX path sb unaudited getppid No arguments. lstat XXX path sb unaudited. dup oldd unaudited returned fd unaudited pipe returned file descriptors unaudited getegid OK unaudited? profil XXX samples XXX size XXX offset XXX scale OK unaudited? ktrace XXX tracefile XXX ops XXX trpoints XXX pid sigaction XXX sig XXX act XXX oact OK unaudited? getgid OK unaudited? sigprocmask XXX how XXX set XXX oset OK unaudited? getlogin XXX auditing or not? setlogin XXX name acct XXX file sigpending XXX set OK unaudited? sigaltstack XXX ss XXX oss OK unaudited? ioctl XXX d XXX request XXX argp (in, out, size, ...?) reboot XXX how revoke XXX path symlink XXX name1 XXX name2 readlink XXX path XXX buf XXX bufsiz execve XXX path XXX argv XXX envp umask XXX numask chroot XXX dirname fstat fd sb unaudited getkerninfo AUE_NULL getpagesize OK unaudited? msync XXX addr XXX len XXX flags OK unaudited? vfork returned pid audited sbrk XXX incr OK unaudited? sstk XXX incr Unimplemented, OK unaudited? mmap XXX addr XXX len XXX prot XXX flags XXX fd XXX offset Need only to audit fd, prot, flags? ovadvise XXX anom Unimplemented, OK unaudited? munmap XXX addr XXX len OK unaudited? mprotect XXX addr XXX len XXX prot OK unaudited? madvise XXX addr XXX len XXX behav OK unaudited? mincore XXX addr XXX len XXX vec OK unaudited? getgroups XXX gidsetlen XXX gidset OK unaudited? setgroups XXX ngroups XXX gidset getpgrp OK unaudited? setpgid XXX pid XXX pgrp setitimer XXX which XXX value XXX ovalue OK unaudited? wait XXX status XXX returned pid unaudited swapon XXX special getitimer XXX which XXX value OK unaudited? gethostname XXX name XXX namelen XXX calls userland_sysctl() -- possibly audits oid by mistake? sethostname XXX name XXX namelen XXX calls userland_sysctl() -- possibly audits oid by mistake? getdtablesize OK unaudited? dup2 fcntl select fsync setpriority socket connect accept getpriority send recv sigreturn AUE_NULL bind setsockopt listen sigvec sigblock sigsetmask sigsuspend sigstack recvmsg sendmsg gettimeofday getrusage getsockopt readv writev settimeofday fchown fchmod recvfrom setreuid setregid rename truncate ftruncate flock mkfifo sendto shutdown socketpair mkdir rmdir utimes adjtime getpeername gethostid sethostid getrlimit setrlimit killpg setsid quotactl quota getsockname nfssvc getdirentries statfs fstatfs lgetfh AUE_NULL getfh getdomainname setdomainname uname AUE_NULL sysarch AUE_NULL rtprio AUE_NULL semsys msgsys shmsys pread pwrite ntp_adjtime setgid setegid seteuid stat fstat lstat pathconf fpathconf getrlimit setrlimit getdirentries caddr_t mmap off_t lseek truncate ftruncate __sysctl mlock munlock undelete futimes getpgid poll __semctl semget semop msgctl msgget msgsnd msgrcv shmat shmctl shmdt shmget clock_gettime AUE_NULL clock_settime AUE_NULL clock_getres AUE_NULL nanosleep AUE_NULL ntp_gettime AUE_NULL minherit rfork openbsd_poll AUE_NULL issetugid lchown getdents lchmod lchown lutimes msync nstat AUE_NULL nfstat AUE_NULL nlstat AUE_NULL fhstatfs AUE_NULL fhopen AUE_NULL fhstat AUE_NULL modnext AUE_NULL modstat AUE_NULL modfnext AUE_NULL modfind AUE_NULL kldload kldunload kldfind AUE_NULL kldnext AUE_NULL kldstat AUE_NULL kldfirstmod AUE_NULL getsid setresuid setresgid aio_return AUE_NULL aio_suspend AUE_NULL aio_cancel AUE_NULL aio_error AUE_NULL aio_read AUE_NULL aio_write AUE_NULL lio_listio AUE_NULL yield AUE_NULL mlockall munlockall __getcwd AUE_NULL sched_setparam AUE_NULL sched_getparam AUE_NULL sched_setscheduler AUE_NULL sched_getscheduler AUE_NULL sched_yield AUE_NULL sched_get_priority_max AUE_NULL sched_get_priority_min AUE_NULL sched_rr_get_interval AUE_NULL utrace AUE_NULL sendfile kldsym AUE_NULL jail AUE_NULL sigprocmask sigsuspend sigaction sigpending sigreturn sigtimedwait AUE_NULL sigwaitinfo AUE_NULL __acl_get_file AUE_NULL __acl_set_file AUE_NULL __acl_get_fd AUE_NULL __acl_set_fd AUE_NULL __acl_delete_file AUE_NULL __acl_delete_fd AUE_NULL __acl_aclcheck_file AUE_NULL __acl_aclcheck_fd AUE_NULL extattrctl AUE_NULL extattr_set_file AUE_NULL extattr_get_file AUE_NULL extattr_delete_file AUE_NULL aio_waitcomplete AUE_NULL getresuid AUE_NULL getresgid AUE_NULL kqueue AUE_NULL kevent AUE_NULL extattr_set_fd AUE_NULL extattr_get_fd AUE_NULL extattr_delete_fd AUE_NULL __setugid AUE_NULL nfsclnt AUE_NULL eaccess AUE_NULL nmount AUE_NULL kse_exit AUE_NULL kse_wakeup AUE_NULL kse_create AUE_NULL kse_thr_interrupt AUE_NULL kse_release AUE_NULL __mac_get_proc AUE_NULL __mac_set_proc AUE_NULL __mac_get_fd AUE_NULL __mac_get_file AUE_NULL __mac_set_fd AUE_NULL __mac_set_file AUE_NULL kenv AUE_NULL lchflags uuidgen AUE_NULL sendfile mac_syscall AUE_NULL getfsstat statfs fstatfs fhstatfs AUE_NULL ksem_close AUE_NULL ksem_post AUE_NULL ksem_wait AUE_NULL ksem_trywait AUE_NULL ksem_init AUE_NULL ksem_open AUE_NULL ksem_unlink AUE_NULL ksem_getvalue AUE_NULL ksem_destroy AUE_NULL __mac_get_pid AUE_NULL __mac_get_link AUE_NULL __mac_set_link AUE_NULL extattr_set_link AUE_NULL extattr_get_link AUE_NULL extattr_delete_link AUE_NULL __mac_execve AUE_NULL sigaction sigreturn getcontext AUE_NULL setcontext AUE_NULL swapcontext AUE_NULL swapoff __acl_get_link AUE_NULL __acl_set_link AUE_NULL __acl_delete_link AUE_NULL __acl_aclcheck_link AUE_NULL sigwait thr_create AUE_NULL thr_exit AUE_NULL thr_self AUE_NULL thr_kill AUE_NULL _umtx_lock AUE_NULL _umtx_unlock AUE_NULL jail_attach AUE_NULL extattr_list_fd AUE_NULL extattr_list_file AUE_NULL extattr_list_link AUE_NULL kse_switchin AUE_NULL ksem_timedwait AUE_NULL thr_suspend AUE_NULL thr_wake AUE_NULL kldunloadf AUE_NULL audit auditon getauid setauid getaudit setaudit getaudit_addr setaudit_addr auditctl _umtx_op AUE_NULL thr_new AUE_NULL