From a7746f662862b6ac0a85751d8adbc897743a83e1 Mon Sep 17 00:00:00 2001
From: tz204579 <none@none>
Date: Fri, 26 Oct 2007 13:06:58 -0700
Subject: 6431736 c2audit needs to add support for auditing ZFS/NFS ACLs

---
 usr/src/lib/auditd_plugins/syslog/systoken.c | 25 ++++++++++++++++++++++++-
 1 file changed, 24 insertions(+), 1 deletion(-)

(limited to 'usr/src/lib/auditd_plugins/syslog/systoken.c')

diff --git a/usr/src/lib/auditd_plugins/syslog/systoken.c b/usr/src/lib/auditd_plugins/syslog/systoken.c
index d524b91995..f5c6117728 100644
--- a/usr/src/lib/auditd_plugins/syslog/systoken.c
+++ b/usr/src/lib/auditd_plugins/syslog/systoken.c
@@ -533,10 +533,33 @@ argument64_token(parse_context_t *ctx)
 	return (0);
 }
 
+/*
+ * Format of acl token:
+ * 	acl token id		adr_char
+ *	type			adr_u_int32
+ *	value			adr_u_int32
+ *	mode			adr_u_int32
+ */
 int
 acl_token(parse_context_t *ctx)
 {
-	ctx->adr.adr_now += 3 * sizeof (int32_t);
+	ctx->adr.adr_now += 3 * sizeof (uint32_t);
+
+	return (0);
+}
+
+/*
+ * Format of ace token:
+ * 	ace token id		adr_char
+ *	id			adr_u_int32
+ *	access_mask		adr_u_int32
+ *	flags			adr_u_short
+ *	type			adr_u_short
+ */
+int
+ace_token(parse_context_t *ctx)
+{
+	ctx->adr.adr_now += 2 * sizeof (uint32_t) + 2 * sizeof (ushort_t);
 
 	return (0);
 }
-- 
cgit v1.2.3