#! /sbin/sh
#
# Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
# Use is subject to license terms.
#
# ident	"@(#)svc-auditd	1.2	06/09/08 SMI"

# if the audit state is "disabled" auditconfig returns
# non-zero exit status unless the c2audit module is loaded;
# if c2audit is loaded, "disabled" becomes "noaudit" early
# in the boot cycle and "auditing" only after auditd starts.

. /lib/svc/share/smf_include.sh

AUDITCONFIG=/usr/sbin/auditconfig
ZONE=`/sbin/zonename`

AUDITCOND=`$AUDITCONFIG -getcond 2> /dev/null`

if [ $? -ne 0 ]; then
	# The decision whether to start
	# auditing is driven by bsmconv / bsmunconv
	/usr/sbin/svcadm mark maintenance system/auditd
	exit $SMF_EXIT_MON_OFFLINE;
fi
	
# In a non-global zone, auditd is started only if the "perzone"
# audit policy has been set.
if [ "$ZONE" != "global" ]; then
	echo `$AUDITCONFIG -getpolicy` | grep perzone > /dev/null

	if [ $? -eq 1 ]; then
		echo "$0:  auditd is not configured to run in a local"
		echo "   zone, perzone policy not set (see auditconfig(1M))"
		/usr/sbin/svcadm disable svc:/system/auditd:default 
		sleep 5 &
		exit $SMF_EXIT_OK;
	fi		
fi

/etc/security/audit_startup
# daemon forks, parent exits when child says it's ready
exec /usr/sbin/auditd

