#include <bsm/audit.h>

bsm/audit.h

includes: sys/param.h, sys/types.h, Availability.h, Availability.h, mach/port.h

92 macros · 21 typedefs · 13 structs · 12 functions · 1 enum

macroAUDIT_RECORD_MAGIC

#define AUDIT_RECORD_MAGIC 0x828a0f1b

macroMAX_AUDIT_RECORDS

#define MAX_AUDIT_RECORDS 20

macroMAXAUDITDATA

#define MAXAUDITDATA (0x8000 - 1)

macroMAX_AUDIT_RECORD_SIZE

#define MAX_AUDIT_RECORD_SIZE MAXAUDITDATA

macroMIN_AUDIT_FILE_SIZE

#define MIN_AUDIT_FILE_SIZE (512 * 1024)

macroAUDIT_HARD_LIMIT_FREE_BLOCKS

Minimum noumber of free blocks on the filesystem containing the audit log necessary to avoid a hard log rotation. DO NOT SET THIS VALUE TO 0 as the kernel does an unsigned compare, plus we want to leave a few blocks free so userspace can terminate the log, etc.

#define AUDIT_HARD_LIMIT_FREE_BLOCKS 4

macroAUDIT_TRIGGER_MIN

Triggers for the audit daemon.

#define AUDIT_TRIGGER_MIN 1

macroAUDIT_TRIGGER_LOW_SPACE

#define AUDIT_TRIGGER_LOW_SPACE 1

Below low watermark.

macroAUDIT_TRIGGER_ROTATE_KERNEL

#define AUDIT_TRIGGER_ROTATE_KERNEL 2

Kernel requests rotate.

macroAUDIT_TRIGGER_READ_FILE

#define AUDIT_TRIGGER_READ_FILE 3

Re-read config file.

macroAUDIT_TRIGGER_CLOSE_AND_DIE

#define AUDIT_TRIGGER_CLOSE_AND_DIE 4

Terminate audit.

macroAUDIT_TRIGGER_NO_SPACE

#define AUDIT_TRIGGER_NO_SPACE 5

Below min free space.

macroAUDIT_TRIGGER_ROTATE_USER

#define AUDIT_TRIGGER_ROTATE_USER 6

User requests rotate.

macroAUDIT_TRIGGER_INITIALIZE

#define AUDIT_TRIGGER_INITIALIZE 7

User initialize of auditd.

macroAUDIT_TRIGGER_EXPIRE_TRAILS

#define AUDIT_TRIGGER_EXPIRE_TRAILS 8

User expiration of trails.

macroAUDIT_TRIGGER_MAX

#define AUDIT_TRIGGER_MAX 8

macroAUDITDEV_FILENAME

The special device filename (FreeBSD).

#define AUDITDEV_FILENAME "audit"

macroAUDIT_TRIGGER_FILE

#define AUDIT_TRIGGER_FILE ("/dev/" AUDITDEV_FILENAME)

macroAU_DEFAUDITID

Pre-defined audit IDs

#define AU_DEFAUDITID (uid_t)(-1)

macroAU_DEFAUDITSID

#define AU_DEFAUDITSID 0

macroAU_ASSIGN_ASID

#define AU_ASSIGN_ASID -1

macroAT_IPC_MSG

IPC types.

#define AT_IPC_MSG ((unsigned char)1)

Message IPC id.

macroAT_IPC_SEM

#define AT_IPC_SEM ((unsigned char)2)

Semaphore IPC id.

macroAT_IPC_SHM

#define AT_IPC_SHM ((unsigned char)3)

Shared mem IPC id.

macroAUC_UNSET

Audit conditions.

#define AUC_UNSET 0

macroAUC_AUDITING

#define AUC_AUDITING 1

macroAUC_NOAUDIT

#define AUC_NOAUDIT 2

macroAUC_DISABLED

#define AUC_DISABLED -1

macroA_OLDGETPOLICY

auditon(2) commands.

#define A_OLDGETPOLICY 2

macroA_OLDSETPOLICY

#define A_OLDSETPOLICY 3

macroA_GETKMASK

#define A_GETKMASK 4

macroA_SETKMASK

#define A_SETKMASK 5

macroA_OLDGETQCTRL

#define A_OLDGETQCTRL 6

macroA_OLDSETQCTRL

#define A_OLDSETQCTRL 7

macroA_GETCWD

#define A_GETCWD 8

macroA_GETCAR

#define A_GETCAR 9

macroA_GETSTAT

#define A_GETSTAT 12

macroA_SETSTAT

#define A_SETSTAT 13

macroA_SETUMASK

#define A_SETUMASK 14

macroA_SETSMASK

#define A_SETSMASK 15

macroA_OLDGETCOND

#define A_OLDGETCOND 20

macroA_OLDSETCOND

#define A_OLDSETCOND 21

macroA_GETCLASS

#define A_GETCLASS 22

macroA_SETCLASS

#define A_SETCLASS 23

macroA_GETPINFO

#define A_GETPINFO 24

macroA_SETPMASK

#define A_SETPMASK 25

macroA_SETFSIZE

#define A_SETFSIZE 26

macroA_GETFSIZE

#define A_GETFSIZE 27

macroA_GETPINFO_ADDR

#define A_GETPINFO_ADDR 28

macroA_GETKAUDIT

#define A_GETKAUDIT 29

macroA_SETKAUDIT

#define A_SETKAUDIT 30

macroA_SENDTRIGGER

#define A_SENDTRIGGER 31

macroA_GETSINFO_ADDR

#define A_GETSINFO_ADDR 32

macroA_GETPOLICY

#define A_GETPOLICY 33

macroA_SETPOLICY

#define A_SETPOLICY 34

macroA_GETQCTRL

#define A_GETQCTRL 35

macroA_SETQCTRL

#define A_SETQCTRL 36

macroA_GETCOND

#define A_GETCOND 37

macroA_SETCOND

#define A_SETCOND 38

macroA_GETSFLAGS

#define A_GETSFLAGS 39

macroA_SETSFLAGS

#define A_SETSFLAGS 40

macroA_GETCTLMODE

#define A_GETCTLMODE 41

macroA_SETCTLMODE

#define A_SETCTLMODE 42

macroA_GETEXPAFTER

#define A_GETEXPAFTER 43

macroA_SETEXPAFTER

#define A_SETEXPAFTER 44

macroAUDIT_CNT

Audit policy controls.

#define AUDIT_CNT 0x0001

macroAUDIT_AHLT

#define AUDIT_AHLT 0x0002

macroAUDIT_ARGV

#define AUDIT_ARGV 0x0004

macroAUDIT_ARGE

#define AUDIT_ARGE 0x0008

macroAUDIT_SEQ

#define AUDIT_SEQ 0x0010

macroAUDIT_WINDATA

#define AUDIT_WINDATA 0x0020

macroAUDIT_USER

#define AUDIT_USER 0x0040

macroAUDIT_GROUP

#define AUDIT_GROUP 0x0080

macroAUDIT_TRAIL

#define AUDIT_TRAIL 0x0100

macroAUDIT_PATH

#define AUDIT_PATH 0x0200

macroAUDIT_SCNT

#define AUDIT_SCNT 0x0400

macroAUDIT_PUBLIC

#define AUDIT_PUBLIC 0x0800

macroAUDIT_ZONENAME

#define AUDIT_ZONENAME 0x1000

macroAUDIT_PERZONE

#define AUDIT_PERZONE 0x2000

macroAQ_HIWATER

Default audit queue control parameters.

#define AQ_HIWATER 100

macroAQ_MAXHIGH

#define AQ_MAXHIGH 10000

macroAQ_LOWATER

#define AQ_LOWATER 10

macroAQ_BUFSZ

#define AQ_BUFSZ MAXAUDITDATA

macroAQ_MAXBUFSZ

#define AQ_MAXBUFSZ 1048576

macroAU_FS_MINFREE

Default minimum percentage free space on file system.

#define AU_FS_MINFREE 20

macroAU_IPv4

Type definitions used indicating the length of variable length addresses in tokens containing addresses, such as header fields.

#define AU_IPv4 4

macroAU_IPv6

#define AU_IPv6 16

macroAU_CLASS_MASK_RESERVED

Reserved audit class mask indicating which classes are unable to have events added or removed by unentitled processes.

#define AU_CLASS_MASK_RESERVED 0x10000000

macroAUDIT_CTLMODE_NORMAL

Audit control modes

#define AUDIT_CTLMODE_NORMAL ((unsigned char)1)

macroAUDIT_CTLMODE_EXTERNAL

#define AUDIT_CTLMODE_EXTERNAL ((unsigned char)2)

macroAUDIT_EXPIRE_OP_AND

Audit file expire_after op modes

#define AUDIT_EXPIRE_OP_AND ((unsigned char)0)

macroAUDIT_EXPIRE_OP_OR

#define AUDIT_EXPIRE_OP_OR ((unsigned char)1)

typedefau_id_t

typedef uid_t au_id_t

typedefau_asid_t

typedef pid_t au_asid_t

typedefau_event_t

typedef u_int16_t au_event_t

typedefau_emod_t

typedef u_int16_t au_emod_t

typedefau_class_t

typedef u_int32_t au_class_t

typedefau_asflgs_t

typedef u_int64_t au_asflgs_t

typedefau_ctlmode_t

typedef unsigned char au_ctlmode_t

structau_tid

size 8, align 4

dev_t	port
u_int32_t	machine

typedefau_tid_t

typedef struct au_tid au_tid_t

structau_tid_addr

size 24, align 4

dev_t	at_port
u_int32_t	at_type
u_int32_t[4]	at_addr

typedefau_tid_addr_t

typedef struct au_tid_addr au_tid_addr_t

structau_mask

size 8, align 4

unsigned int	am_success	Success bits.
unsigned int	am_failure	Failure bits.

typedefau_mask_t

typedef struct au_mask au_mask_t

structauditinfo

size 24, align 4

au_id_t	ai_auid	Audit user ID.
au_mask_t	ai_mask	Audit masks.
au_tid_t	ai_termid	Terminal ID.
au_asid_t	ai_asid	Audit session ID.

typedefauditinfo_t

typedef struct auditinfo auditinfo_t

structauditinfo_addr

size 48, align 8

au_id_t	ai_auid	Audit user ID.
au_mask_t	ai_mask	Audit masks.
au_tid_addr_t	ai_termid	Terminal ID.
au_asid_t	ai_asid	Audit session ID.
au_asflgs_t	ai_flags	Audit session flags.

typedefauditinfo_addr_t

typedef struct auditinfo_addr auditinfo_addr_t

structauditpinfo

size 28, align 4

pid_t	ap_pid	ID of target process.
au_id_t	ap_auid	Audit user ID.
au_mask_t	ap_mask	Audit masks.
au_tid_t	ap_termid	Terminal ID.
au_asid_t	ap_asid	Audit session ID.

typedefauditpinfo_t

typedef struct auditpinfo auditpinfo_t

structauditpinfo_addr

size 56, align 8

pid_t	ap_pid	ID of target process.
au_id_t	ap_auid	Audit user ID.
au_mask_t	ap_mask	Audit masks.
au_tid_addr_t	ap_termid	Terminal ID.
au_asid_t	ap_asid	Audit session ID.
au_asflgs_t	ap_flags	Audit session flags.

typedefauditpinfo_addr_t

typedef struct auditpinfo_addr auditpinfo_addr_t

structau_session

size 16, align 8

auditinfo_addr_t *	as_aia_p	Ptr to full audit info.
au_mask_t	as_mask	Process Audit Masks.

typedefau_session_t

typedef struct au_session au_session_t

structau_expire_after

size 24, align 8

time_t	age	Age after which trail files should be expired
size_t	size	Aggregate trail size when files should be expired
unsigned char	op_type	Operator used with the above values to determine when files should be expired

typedefau_expire_after_t

typedef struct au_expire_after au_expire_after_t

typedeftoken_t

Contents of token_t are opaque outside of libbsm.

typedef struct au_token token_t

structau_qctrl

Kernel audit queue control parameters: Default: Maximum: aq_hiwater: AQ_HIWATER (100) AQ_MAXHIGH (10000) aq_lowater: AQ_LOWATER (10) <aq_hiwater aq_bufsz: AQ_BUFSZ (32767) AQ_MAXBUFSZ (1048576) aq_delay: 20 20000 (not used)

size 20, align 4

int	aq_hiwater	Max # of audit recs in queue when
int	aq_lowater	# of audit recs in queue when
int	aq_bufsz	Max size of audit record for audit(2).
int	aq_delay	Queue delay (not used).
int	aq_minfree	Minimum filesystem percent free space.

typedefau_qctrl_t

typedef struct au_qctrl au_qctrl_t

structaudit_stat

Structure for the audit statistics.

size 56, align 4

unsigned int	as_version
unsigned int	as_numevent
int	as_generated
int	as_nonattrib
int	as_kernel
int	as_audit
int	as_auditctl
int	as_enqueue
int	as_written
int	as_wblocked
int	as_rblocked
int	as_dropped
int	as_totalsize
unsigned int	as_memused

typedefau_stat_t

typedef struct audit_stat au_stat_t

structaudit_fstat

Structure for the audit file statistics.

size 16, align 8

u_int64_t	af_filesz
u_int64_t	af_currsz

typedefau_fstat_t

typedef struct audit_fstat au_fstat_t

structau_evclass_map

Audit to event class mapping.

size 8, align 4

au_event_t	ec_number
au_class_t	ec_class

typedefau_evclass_map_t

typedef struct au_evclass_map au_evclass_map_t

enumaudit_session_flags

Audit session flags for the ai_flags member of auditinfo_addr.

underlying type unsigned int

AU_SESSION_FLAG_IS_INITIAL	1	The initial session created by PID 1.
AU_SESSION_FLAG_HAS_GRAPHIC_ACCESS	16	The graphics subsystem (CoreGraphics, etc.) is available.
AU_SESSION_FLAG_HAS_TTY	32	/dev/tty is available.
AU_SESSION_FLAG_IS_REMOTE	4096	The session was created for a remote connection.
AU_SESSION_FLAG_HAS_CONSOLE_ACCESS	8192	The console and associated devices are available.
AU_SESSION_FLAG_HAS_AUTHENTICATED	16384	An active, authenticated user is associated with the session.

functionaudit

__AUDIT_API_DEPRECATED
int audit(const void *, int)

deprecated

man page · April 19, 2005

audit(2) — "commit BSM audit record to audit log"

⚠ the man page prototype differs from the current header — man: int audit(char*, unsigned) · header: int audit(void*, int)

functionauditon

__AUDIT_API_DEPRECATED
int auditon(int, void *, int)

deprecated

man page · January 29, 2009

auditon(2) — "configure system audit parameters"

⚠ the man page prototype differs from the current header — man: int auditon(int, void*, unsigned) · header: int auditon(int, void*, int)

functionauditctl

__AUDIT_API_DEPRECATED
int auditctl(const char *)

deprecated

man page · April 19, 2005

auditctl(2) — "configure system audit parameters"

functiongetauid

int getauid(au_id_t *)

man page · March 5, 2009

getauid(2) — "retrieve audit user ID"

functionsetauid

int setauid(const au_id_t *)

man page · March 21, 2009

setauid(2) — "set audit indentifier"

functiongetaudit_addr

int getaudit_addr(struct auditinfo_addr *, int)

man page · March 6, 2011

getaudit_addr(2) — "retrieve audit session state"

⚠ the man page prototype differs from the current header — man: int getaudit_addr(auditinfo_addr_t*, unsigned) · header: int getaudit_addr(struct auditinfo_addr*, int)

functionsetaudit_addr

int setaudit_addr(const struct auditinfo_addr *, int)

man page · March 4, 2011

setaudit_addr(2) — "set audit session state"

⚠ the man page prototype differs from the current header — man: int setaudit_addr(auditinfo_addr_t*, unsigned) · header: int setaudit_addr(struct auditinfo_addr*, int)

functiongetaudit

__OSX_AVAILABLE_BUT_DEPRECATED(__MAC_10_0, __MAC_10_8, __IPHONE_2_0, __IPHONE_6_0)
int getaudit(struct auditinfo *)

deprecated

functionsetaudit

__OSX_AVAILABLE_BUT_DEPRECATED(__MAC_10_0, __MAC_10_8, __IPHONE_2_0, __IPHONE_6_0)
int setaudit(const struct auditinfo *)

deprecated

functionaudit_session_self

mach_port_name_t audit_session_self(void)

functionaudit_session_join

au_asid_t audit_session_join(mach_port_name_t port)

functionaudit_session_port

int audit_session_port(au_asid_t asid, mach_port_name_t *portname)