svn commit: r358564 - head/sys/security/audit

[Christian S.J. Peron]

Author: csjp
Date: Tue Mar  3 01:46:35 2020
New Revision: 358564
URL: https://svnweb.freebsd.org/changeset/base/358564

Log:
  In r358471, we interrupted the case block that would eventually lead
  to the path related tokens not being processed. Restore this behavior and
  and move AUE_JAIL_SET in this block, as it may conditionally contain a
  path token.
  
  Discovered by:	kevans
  PR:	244537
  Reviewed by:	kevans
  Differential Revision:	https://reviews.freebsd.org/D23929

Modified:
  head/sys/security/audit/audit_bsm.c

Modified: head/sys/security/audit/audit_bsm.c
==============================================================================
--- head/sys/security/audit/audit_bsm.c	Tue Mar  3 00:28:37 2020	(r358563)
+++ head/sys/security/audit/audit_bsm.c	Tue Mar  3 01:46:35 2020	(r358564)
@@ -803,25 +803,26 @@ kaudit_to_bsm(struct kaudit_record *kar, struct au_rec
 		UPATH1_VNODE1_TOKENS;
 		break;
 
-	case AUE_CHDIR:
-	case AUE_CHROOT:
-	case AUE_FSTATAT:
-	case AUE_FUTIMESAT:
-	case AUE_GETATTRLIST:
-	case AUE_JAIL:
-		break;
-
 	/*
 	 * NB: We may want to verify that the appropriate
 	 * audit args are being processed here, but I think
 	 * a bit analysis is required.
+	 *
+	 * Process AUE_JAIL_SET in the next block so we can pickup any path
+	 * related tokens that might exist.
 	 */
 	case AUE_JAIL_GET:
-	case AUE_JAIL_SET:
 	case AUE_JAIL_ATTACH:
 	case AUE_JAIL_REMOVE:
 		break;
 
+	case AUE_JAIL_SET:
+	case AUE_CHDIR:
+	case AUE_CHROOT:
+	case AUE_FSTATAT:
+	case AUE_FUTIMESAT:
+	case AUE_GETATTRLIST:
+	case AUE_JAIL:
 	case AUE_LUTIMES:
 	case AUE_NFS_GETFH:
 	case AUE_LGETFH: