The branch main has been updated by kib: URL: https://cgit.FreeBSD.org/src/commit/?id=d0d4b9b9df2ade9085b6318e3fdbc9b67b3f666c
commit d0d4b9b9df2ade9085b6318e3fdbc9b67b3f666c Author: Konstantin Belousov <[email protected]> AuthorDate: 2026-01-08 01:07:52 +0000 Commit: Konstantin Belousov <[email protected]> CommitDate: 2026-01-25 15:53:02 +0000 sys: add AUE_PDRFORK Reviewed by: asomers, markj Tested by: pho Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D54592 --- sys/bsm/audit_kevents.h | 1 + sys/security/audit/audit_bsm.c | 18 ++++++++++++++++++ 2 files changed, 19 insertions(+) diff --git a/sys/bsm/audit_kevents.h b/sys/bsm/audit_kevents.h index 9381396f247c..ac6f5d69f07d 100644 --- a/sys/bsm/audit_kevents.h +++ b/sys/bsm/audit_kevents.h @@ -664,6 +664,7 @@ #define AUE_TIMERFD 43270 /* FreeBSD/Linux. */ #define AUE_SETCRED 43271 /* FreeBSD-specific. */ #define AUE_INOTIFY 43272 /* FreeBSD/Linux. */ +#define AUE_PDRFORK 43273 /* FreeBSD-specific. */ /* * Darwin BSM uses a number of AUE_O_* definitions, which are aliased to the diff --git a/sys/security/audit/audit_bsm.c b/sys/security/audit/audit_bsm.c index 2cd1511b2296..0b6802f3194f 100644 --- a/sys/security/audit/audit_bsm.c +++ b/sys/security/audit/audit_bsm.c @@ -1365,6 +1365,24 @@ kaudit_to_bsm(struct kaudit_record *kar, struct au_record **pau) kau_write(rec, tok); } break; + case AUE_PDRFORK: + if (ARG_IS_VALID(kar, ARG_PID)) { + tok = au_to_arg32(0, "child PID", ar->ar_arg_pid); + kau_write(rec, tok); + } + if (ARG_IS_VALID(kar, ARG_CMD)) { + tok = au_to_arg32(2, "fflags", ar->ar_arg_cmd); + kau_write(rec, tok); + } + if (ARG_IS_VALID(kar, ARG_FFLAGS)) { + tok = au_to_arg32(2, "flags", ar->ar_arg_fflags); + kau_write(rec, tok); + } + if (ARG_IS_VALID(kar, ARG_FD)) { + tok = au_to_arg32(1, "fd", ar->ar_arg_fd); + kau_write(rec, tok); + } + break; case AUE_PDGETPID: if (ARG_IS_VALID(kar, ARG_FD)) { tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
