#include <bsm/audit_filter.h>

bsm/audit_filter.h

12 macros · 5 typedefs

typedefaudit_filter_attach_t

Module interface for audit filter modules. audit_filter_attach_t - filter module is being attached with arguments audit_filter_reinit_t - arguments to module have changed audit_filter_record_t - present parsed record to filter module, with receipt time audit_filter_rawrecord_t - present BSM format record to filter module, with receipt time audit_filter_destach_t - filter module is being detached There may be many instances of the same filter, identified by the instance void pointer maintained by the filter instance.

typedef int (*audit_filter_attach_t)(void *instance, int argc, char *argv[])

typedefaudit_filter_reinit_t

typedef int (*audit_filter_reinit_t)(void *instance, int argc, char *argv[])

typedefaudit_filter_record_t

typedef void (*)(void *, struct timespec *, int, const tokenstr_t *) audit_filter_record_t;

typedefaudit_filter_rawrecord_t

typedef void (*)(void *, struct timespec *, void *, u_int) audit_filter_rawrecord_t;

typedefaudit_filter_detach_t

typedef void (*audit_filter_detach_t)(void *instance)

macroAUDIT_FILTER_SUCCESS

Values to be returned by audit_filter_init_t.

#define AUDIT_FILTER_SUCCESS (0)

macroAUDIT_FILTER_FAILURE

#define AUDIT_FILTER_FAILURE (-1)

macroAUDIT_FILTER_ATTACH

Standard name for filter module initialization functions, which will be found using dlsym().

#define AUDIT_FILTER_ATTACH audit_filter_attach

macroAUDIT_FILTER_REINIT

#define AUDIT_FILTER_REINIT audit_filter_reinit

macroAUDIT_FILTER_RECORD

#define AUDIT_FILTER_RECORD audit_filter_record

macroAUDIT_FILTER_RAWRECORD

#define AUDIT_FILTER_RAWRECORD audit_filter_rawrecord

macroAUDIT_FILTER_DETACH

#define AUDIT_FILTER_DETACH audit_filter_detach

macroAUDIT_FILTER_ATTACH_STRING

#define AUDIT_FILTER_ATTACH_STRING "audit_filter_attach"

macroAUDIT_FILTER_REINIT_STRING

#define AUDIT_FILTER_REINIT_STRING "audit_filter_reinit"

macroAUDIT_FILTER_RECORD_STRING

#define AUDIT_FILTER_RECORD_STRING "audit_filter_record"

macroAUDIT_FILTER_RAWRECORD_STRING

#define AUDIT_FILTER_RAWRECORD_STRING "audit_filter_rawrecord"

macroAUDIT_FILTER_DETACH_STRING

#define AUDIT_FILTER_DETACH_STRING "audit_filter_detach"