#include <bsm/audit_session.h>
bsm/audit_session.h
Required for audit.h.
macroAUDIT_SDEV_PATH
#define AUDIT_SDEV_PATH "/dev/auditsessions"
enumau_sdev_open_flags
au_sdev_open() flags
| AU_SDEVF_NONBLOCK | 1 | Set audit session device to not to block on reads. |
| AU_SDEVF_ALLSESSIONS | 65536 | Allow process to monitor all session. (Requires privilege.) |
structau_sdev_handle
Audit session device handle.
| FILE * | ash_fp | |
| u_char * | ash_buf | |
| int | ash_reclen | |
| int | ash_bytesread |
typedefau_sdev_handle_t
typedef struct au_sdev_handle au_sdev_handle_t;
functionau_sdev_open
API_AVAILABLE(macos(10.8)) API_UNAVAILABLE(ios, watchos, tvos) au_sdev_handle_t *au_sdev_open(int flags)
au_sdev_open()
@summary - Open the audit session pseudo device.
@param flags - Flags that change the behavior of the device. The flags
specified are formed by or'ing the following flag: AU_SDEVF_NONBLOCK for
non-blocking I/O and AU_SDEF_ALLSESSIONS for monitoring all the sessions
and not just the session of the current process.
@return Upon success returns the audit session device handle. Otherwise,
NULL is returned and the errno is set to indicate the error.
functionau_sdev_close
API_AVAILABLE(macos(10.8)) API_UNAVAILABLE(ios, watchos, tvos) int au_sdev_close(au_sdev_handle_t *ash)
au_sdev_close()
@summary - Close the audit session pseudo device.
@param ash - Audit session device handle.
@return Upon successful completion 0 is returned. Otherwise, errno is set
to indicate the error.
functionau_sdev_fd
API_AVAILABLE(macos(10.8)) API_UNAVAILABLE(ios, watchos, tvos) int au_sdev_fd(au_sdev_handle_t *ash)
au_sdev_fd()
@summary - Get the file descriptor for the audit session device.
@param ash - Audit session device handle.
@return File descriptor of the audit session device.
functionau_sdev_read_aia
API_AVAILABLE(macos(10.8)) API_UNAVAILABLE(ios, watchos, tvos) int au_sdev_read_aia(au_sdev_handle_t *ash, int *event, auditinfo_addr_t *aia_p)
au_sdev_read_aia()
@summary - Read a session event and an auditinfo_addr record from kernel.
@param ash - Audit session device handle.
@param event - A pointer to an integer that will contain the event type:
AUE_SESSION_START (start of a new session), AUE_SESSION_UPDATE (the
session information has been changed), AUE_SESSION_END (all the processes in
the session have exited), and AUE_SESSION_CLOSE (the session record has been
removed from the kernel).
@param aia_p - A pointer to an auditinfo_addr structure that will contain the
audit session information on a successful return. The audit masks fields
(ai_mask), however, does not currently contain correct informaiton.
@return Upon sucessful completetion 0 is returned and the event and aia_p
parameters will be populated. Otherwise, errno is set to indicate the error.