git: d0d4b9b9df2a - main - sys: add AUE_PDRFORK

The branch main has been updated by kib:

URL: https://cgit.FreeBSD.org/src/commit/?id=d0d4b9b9df2ade9085b6318e3fdbc9b67b3f666c

commit d0d4b9b9df2ade9085b6318e3fdbc9b67b3f666c
Author:     Konstantin Belousov <kib@FreeBSD.org>
AuthorDate: 2026-01-08 01:07:52 +0000
Commit:     Konstantin Belousov <kib@FreeBSD.org>
CommitDate: 2026-01-25 15:53:02 +0000

    sys: add AUE_PDRFORK
    
    Reviewed by:    asomers, markj
    Tested by:      pho
    Sponsored by:   The FreeBSD Foundation
    MFC after:      1 week
    Differential revision:  https://reviews.freebsd.org/D54592
---
 sys/bsm/audit_kevents.h        |  1 +
 sys/security/audit/audit_bsm.c | 18 ++++++++++++++++++
 2 files changed, 19 insertions(+)

diff --git a/sys/bsm/audit_kevents.h b/sys/bsm/audit_kevents.h
index 9381396f247c..ac6f5d69f07d 100644
--- a/sys/bsm/audit_kevents.h
+++ b/sys/bsm/audit_kevents.h
@@ -664,6 +664,7 @@
 #define	AUE_TIMERFD		43270	/* FreeBSD/Linux. */
 #define	AUE_SETCRED		43271	/* FreeBSD-specific. */
 #define	AUE_INOTIFY		43272	/* FreeBSD/Linux. */
+#define	AUE_PDRFORK		43273	/* FreeBSD-specific. */
 
 /*
  * Darwin BSM uses a number of AUE_O_* definitions, which are aliased to the
diff --git a/sys/security/audit/audit_bsm.c b/sys/security/audit/audit_bsm.c
index 2cd1511b2296..0b6802f3194f 100644
--- a/sys/security/audit/audit_bsm.c
+++ b/sys/security/audit/audit_bsm.c
@@ -1365,6 +1365,24 @@ kaudit_to_bsm(struct kaudit_record *kar, struct au_record **pau)
 			kau_write(rec, tok);
 		}
 		break;
+	case AUE_PDRFORK:
+		if (ARG_IS_VALID(kar, ARG_PID)) {
+			tok = au_to_arg32(0, "child PID", ar->ar_arg_pid);
+			kau_write(rec, tok);
+		}
+		if (ARG_IS_VALID(kar, ARG_CMD)) {
+			tok = au_to_arg32(2, "fflags", ar->ar_arg_cmd);
+			kau_write(rec, tok);
+		}
+		if (ARG_IS_VALID(kar, ARG_FFLAGS)) {
+			tok = au_to_arg32(2, "flags", ar->ar_arg_fflags);
+			kau_write(rec, tok);
+		}
+		if (ARG_IS_VALID(kar, ARG_FD)) {
+			tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
+			kau_write(rec, tok);
+		}
+		break;
 	case AUE_PDGETPID:
 		if (ARG_IS_VALID(kar, ARG_FD)) {
 			tok = au_to_arg32(1, "fd", ar->ar_arg_fd);