#include <bsm/audit_internal.h>

bsm/audit_internal.h

includes: stddef.h, sys/queue.h, sys/types.h

11 macros · 2 structs · 1 typedef

structau_token

audit_internal.h contains private interfaces that are shared by user space and the kernel for the purposes of assembling audit records. Applications should not include this file or use the APIs found within, or it may be broken with future releases of OpenBSM, which may delete, modify, or otherwise break these interfaces or the assumptions they rely on.

size 32, align 8

u_char *

t_data

size_t

len

unnamed struct at bsm/audit_internal.h:57:2

tokens

struct au_token *	tqe_next	next element
struct au_token **	tqe_prev	address of previous next element

structau_record

size 56, align 8

char

used

Record currently in use?

int

desc

Descriptor for record.

unnamed struct at bsm/audit_internal.h:63:2

token_q

struct au_token *	tqh_first	Queue of BSM tokens.
struct au_token **	tqh_last

u_char *

data

size_t

len

unnamed struct at bsm/audit_internal.h:66:2

au_rec_q

struct au_record *	le_next	next element
struct au_record **	le_prev	address of previous next element

typedefau_record_t

typedef struct au_record au_record_t

macroAUDIT_HEADER_EX_SIZE

We could determined the header and trailer sizes by defining appropriate structures. We hold off that approach until we have a consistent way of using structures for all tokens. This is not straightforward since these token structures may contain pointers of whose contents we do not know the size (e.g text tokens).

#define AUDIT_HEADER_EX_SIZE(a) ((a)->ai_termid.at_type+18+sizeof(u_int32_t))

macroAUDIT_HEADER_SIZE

#define AUDIT_HEADER_SIZE 18

macroMAX_AUDIT_HEADER_SIZE

#define MAX_AUDIT_HEADER_SIZE (5*sizeof(u_int32_t)+18)

macroAUDIT_TRAILER_SIZE

#define AUDIT_TRAILER_SIZE 7

macroMAX_AUDIT_IDENTITY_SIZE

#define MAX_AUDIT_IDENTITY_SIZE 179

macroADD_U_CHAR

BSM token streams store fields in big endian byte order, so as to be portable; when encoding and decoding, we must convert byte orders for typed values.

#define ADD_U_CHAR(loc, val) do {
	        *(loc) = (val);
	        (loc) += sizeof(u_char);
	} while(0)

macroADD_U_INT16

#define ADD_U_INT16(loc, val) do {
	        be16enc((loc), (val));
	        (loc) += sizeof(u_int16_t);
	} while(0)

macroADD_U_INT32

#define ADD_U_INT32(loc, val) do {
	        be32enc((loc), (val));
	        (loc) += sizeof(u_int32_t);
	} while(0)

macroADD_U_INT64

#define ADD_U_INT64(loc, val) do {
	        be64enc((loc), (val));
	        (loc) += sizeof(u_int64_t);
	} while(0)

macroADD_MEM

#define ADD_MEM(loc, data, size) do {
	        memcpy((loc), (data), (size));
	        (loc) += size;
	} while(0)

macroADD_STRING

#define ADD_STRING(loc, data, size) ADD_MEM(loc, data, size)