#include <bsm/libbsm.h>
BSD / POSIX › Audit (BSM)

bsm/libbsm.h

NB: definitions, etc., marked with "OpenSSH compatibility" were introduced solely to allow OpenSSH to compile; Darwin/Apple code should not use them.
includes: sys/types.h, sys/cdefs.h, inttypes.h, time.h, bsm/audit.h, bsm/audit_record.h, stdio.h, mach/mach.h, os/availability.h, sys/appleapiopts.h
107 functions · 54 structs · 54 typedefs · 43 macros · 1 enum

macroAUDIT_MAX_ARGS

Size parsed token vectors for execve(2) arguments and environmental variables. Note: changing these sizes affects the ABI of the token structure, and as the token structure is often placed in the caller stack, this is undesirable.
#define AUDIT_MAX_ARGS 128

macroAUDIT_MAX_ENV

#define AUDIT_MAX_ENV 128

macroAUDIT_MAX_CERT_HASH

#define AUDIT_MAX_CERT_HASH 32

macroAUDIT_MAX_KRB5_PRINCIPAL

#define AUDIT_MAX_KRB5_PRINCIPAL 32

macroAU_PRS_USECACHE

Arguments to au_preselect(3).
#define AU_PRS_USECACHE 0

macroAU_PRS_REREAD

#define AU_PRS_REREAD 1

macroAU_PRS_SUCCESS

#define AU_PRS_SUCCESS 1

macroAU_PRS_FAILURE

#define AU_PRS_FAILURE 2

macroAU_PRS_BOTH

#define AU_PRS_BOTH (AU_PRS_SUCCESS|AU_PRS_FAILURE)

macroAUDIT_EVENT_FILE

#define AUDIT_EVENT_FILE "/etc/security/audit_event"

macroAUDIT_CLASS_FILE

#define AUDIT_CLASS_FILE "/etc/security/audit_class"

macroAUDIT_CONTROL_FILE

#define AUDIT_CONTROL_FILE "/etc/security/audit_control"

macroAUDIT_USER_FILE

#define AUDIT_USER_FILE "/etc/security/audit_user"

macroDIR_CONTROL_ENTRY

#define DIR_CONTROL_ENTRY "dir"

macroMINFREE_CONTROL_ENTRY

#define MINFREE_CONTROL_ENTRY "minfree"

macroFILESZ_CONTROL_ENTRY

#define FILESZ_CONTROL_ENTRY "filesz"

macroFLAGS_CONTROL_ENTRY

#define FLAGS_CONTROL_ENTRY "flags"

macroNA_CONTROL_ENTRY

#define NA_CONTROL_ENTRY "naflags"

macroPOLICY_CONTROL_ENTRY

#define POLICY_CONTROL_ENTRY "policy"

macroAUDIT_HOST_CONTROL_ENTRY

#define AUDIT_HOST_CONTROL_ENTRY "host"

macroEXPIRE_AFTER_CONTROL_ENTRY

#define EXPIRE_AFTER_CONTROL_ENTRY "expire-after"

macroAU_CLASS_NAME_MAX

#define AU_CLASS_NAME_MAX 8

macroAU_CLASS_DESC_MAX

#define AU_CLASS_DESC_MAX 72

macroAU_EVENT_NAME_MAX

#define AU_EVENT_NAME_MAX 30

macroAU_EVENT_DESC_MAX

#define AU_EVENT_DESC_MAX 50

macroAU_USER_NAME_MAX

#define AU_USER_NAME_MAX 50

macroAU_LINE_MAX

#define AU_LINE_MAX 256

macroMAX_AUDITSTRING_LEN

#define MAX_AUDITSTRING_LEN 256

macroBSM_TEXTBUFSZ

#define BSM_TEXTBUFSZ MAX_AUDITSTRING_LEN
OpenSSH compatibility

macroAU_TO_NO_WRITE

Arguments to au_close(3).
#define AU_TO_NO_WRITE 0
Abandon audit record.

macroAU_TO_WRITE

#define AU_TO_WRITE 1
Commit audit record.

macroAU_OFLAG_NONE

Output format flags for au_print_flags_tok().
#define AU_OFLAG_NONE 0x0000
Default form.

macroAU_OFLAG_RAW

#define AU_OFLAG_RAW 0x0001
Raw, numeric form.

macroAU_OFLAG_SHORT

#define AU_OFLAG_SHORT 0x0002
Short form.

macroAU_OFLAG_XML

#define AU_OFLAG_XML 0x0004
XML form.

macroAU_OFLAG_NORESOLVE

#define AU_OFLAG_NORESOLVE 0x0008
No user/group name resolution.

structau_event_ent

size 32, align 8
au_event_tae_number
char *ae_name
char *ae_desc
au_class_tae_class

typedefau_event_ent_t

typedef struct au_event_ent au_event_ent_t

structau_class_ent

size 24, align 8
char *ac_name
au_class_tac_class
char *ac_desc

typedefau_class_ent_t

typedef struct au_class_ent au_class_ent_t

structau_user_ent

size 24, align 8
char *au_name
au_mask_tau_always
au_mask_tau_never

typedefau_user_ent_t

typedef struct au_user_ent au_user_ent_t

macroADD_TO_MASK

#define ADD_TO_MASK(m, c, sel) do {
	if (sel & AU_PRS_SUCCESS)
		(m)->am_success |= c;
	if (sel & AU_PRS_FAILURE)
		(m)->am_failure |= c;
} while (0)

macroSUB_FROM_MASK

#define SUB_FROM_MASK(m, c, sel) do {
	if (sel & AU_PRS_SUCCESS)
		(m)->am_success &= ((m)->am_success ^ c);
	if (sel & AU_PRS_FAILURE)
		(m)->am_failure &= ((m)->am_failure ^ c);
} while (0)

macroADDMASK

#define ADDMASK(m, v) do {
	(m)->am_success |= (v)->am_success;
	(m)->am_failure |= (v)->am_failure;
} while(0)

macroSUBMASK

#define SUBMASK(m, v) do {
	(m)->am_success &= ((m)->am_success ^ (v)->am_success);
	(m)->am_failure &= ((m)->am_failure ^ (v)->am_failure);
} while(0)

structau_tid32

size 8, align 4
u_int32_tport
u_int32_taddr

typedefau_tid32_t

typedef struct au_tid32 au_tid32_t;

structau_tid64

size 16, align 8
u_int64_tport
u_int32_taddr

typedefau_tid64_t

typedef struct au_tid64 au_tid64_t;

structau_tidaddr32

size 24, align 4
u_int32_tport
u_int32_ttype
u_int32_t[4]addr

typedefau_tidaddr32_t

typedef struct au_tidaddr32 au_tidaddr32_t;

structau_tidaddr64

size 32, align 8
u_int64_tport
u_int32_ttype
u_int32_t[4]addr

typedefau_tidaddr64_t

typedef struct au_tidaddr64 au_tidaddr64_t;

structau_arg32_t

argument # 1 byte argument value 4 bytes/8 bytes (32-bit/64-bit value) text length 2 bytes text N bytes + 1 terminating NULL byte
size 24, align 8
u_charno
u_int32_tval
u_int16_tlen
char *text

typedefau_arg32_t

typedef struct au_arg32_t au_arg32_t;

structau_arg64_t

size 32, align 8
u_charno
u_int64_tval
u_int16_tlen
char *text

typedefau_arg64_t

typedef struct au_arg64_t au_arg64_t;

structau_arb_t

how to print 1 byte basic unit 1 byte unit count 1 byte data items (depends on basic unit)
size 16, align 8
u_charhowtopr
u_charbu
u_charuc
u_char *data

typedefau_arb_t

typedef struct au_arb_t au_arb_t;

structau_attr32_t

file access mode 4 bytes owner user ID 4 bytes owner group ID 4 bytes file system ID 4 bytes node ID 8 bytes device 4 bytes/8 bytes (32-bit/64-bit)
size 32, align 8
u_int32_tmode
u_int32_tuid
u_int32_tgid
u_int32_tfsid
u_int64_tnid
u_int32_tdev

typedefau_attr32_t

typedef struct au_attr32_t au_attr32_t;

typedefau_attr64_t

typedef struct au_attr64_t au_attr64_t;

structau_execarg_t

count 4 bytes text count null-terminated string(s)
size 1032, align 8
u_int32_tcount
char *[128]text

typedefau_execarg_t

typedef struct au_execarg_t au_execarg_t;

structau_execenv_t

count 4 bytes text count null-terminated string(s)
size 1032, align 8
u_int32_tcount
char *[128]text

typedefau_execenv_t

typedef struct au_execenv_t au_execenv_t;

structau_cert_hash_t

count 4 bytes text count null-terminated string(s)
size 264, align 8
u_int32_tcount
char *[32]text

typedefau_cert_hash_t

typedef struct au_cert_hash_t au_cert_hash_t;

structau_krb5_principal_t

count 4 bytes text count null-terminated string(s)
size 264, align 8
u_int32_tcount
char *[32]text

typedefau_krb5_principal_t

typedef struct au_krb5_principal_t au_krb5_principal_t;

structau_exit_t

status 4 bytes return value 4 bytes
size 8, align 4
u_int32_tstatus
u_int32_tret

typedefau_exit_t

typedef struct au_exit_t au_exit_t;

structau_file_t

seconds of time 4 bytes milliseconds of time 4 bytes file name length 2 bytes file pathname N bytes + 1 terminating NULL byte
size 24, align 8
u_int32_ts
u_int32_tms
u_int16_tlen
char *name

typedefau_file_t

typedef struct au_file_t au_file_t;

structau_groups_t

number groups 2 bytes group list N * 4 bytes
size 68, align 4
u_int16_tno
u_int32_t[16]list

typedefau_groups_t

typedef struct au_groups_t au_groups_t;

structau_header32_t

record byte count 4 bytes version # 1 byte [2] event type 2 bytes event modifier 2 bytes seconds of time 4 bytes/8 bytes (32-bit/64-bit value) milliseconds of time 4 bytes/8 bytes (32-bit/64-bit value)
size 20, align 4
u_int32_tsize
u_charversion
u_int16_te_type
u_int16_te_mod
u_int32_ts
u_int32_tms

typedefau_header32_t

typedef struct au_header32_t au_header32_t;

structau_header32_ex_t

record byte count 4 bytes version # 1 byte [2] event type 2 bytes event modifier 2 bytes address type/length 1 byte (XXX: actually, 4 bytes) machine address 4 bytes/16 bytes (IPv4/IPv6 address) seconds of time 4 bytes/8 bytes (32/64-bits) nanoseconds of time 4 bytes/8 bytes (32/64-bits)
size 40, align 4
u_int32_tsize
u_charversion
u_int16_te_type
u_int16_te_mod
u_int32_tad_type
u_int32_t[4]addr
u_int32_ts
u_int32_tms

typedefau_header32_ex_t

typedef struct au_header32_ex_t au_header32_ex_t;

structau_header64_t

size 32, align 8
u_int32_tsize
u_charversion
u_int16_te_type
u_int16_te_mod
u_int64_ts
u_int64_tms

typedefau_header64_t

typedef struct au_header64_t au_header64_t;

structau_header64_ex_t

size 48, align 8
u_int32_tsize
u_charversion
u_int16_te_type
u_int16_te_mod
u_int32_tad_type
u_int32_t[4]addr
u_int64_ts
u_int64_tms

typedefau_header64_ex_t

typedef struct au_header64_ex_t au_header64_ex_t;

structau_inaddr_t

internet address 4 bytes
size 4, align 4
u_int32_taddr

typedefau_inaddr_t

typedef struct au_inaddr_t au_inaddr_t;

structau_inaddr_ex_t

type 4 bytes internet address 16 bytes
size 20, align 4
u_int32_ttype
u_int32_t[4]addr

typedefau_inaddr_ex_t

typedef struct au_inaddr_ex_t au_inaddr_ex_t;

structau_ip_t

version and ihl 1 byte type of service 1 byte length 2 bytes id 2 bytes offset 2 bytes ttl 1 byte protocol 1 byte checksum 2 bytes source address 4 bytes destination address 4 bytes
size 20, align 4
u_charversion
u_chartos
u_int16_tlen
u_int16_tid
u_int16_toffset
u_charttl
u_charprot
u_int16_tchksm
u_int32_tsrc
u_int32_tdest

typedefau_ip_t

typedef struct au_ip_t au_ip_t;

structau_ipc_t

object ID type 1 byte object ID 4 bytes
size 8, align 4
u_chartype
u_int32_tid

typedefau_ipc_t

typedef struct au_ipc_t au_ipc_t;

structau_ipcperm_t

owner user ID 4 bytes owner group ID 4 bytes creator user ID 4 bytes creator group ID 4 bytes access mode 4 bytes slot sequence # 4 bytes key 4 bytes
size 28, align 4
u_int32_tuid
u_int32_tgid
u_int32_tpuid
u_int32_tpgid
u_int32_tmode
u_int32_tseq
u_int32_tkey

typedefau_ipcperm_t

typedef struct au_ipcperm_t au_ipcperm_t;

structau_iport_t

port IP address 2 bytes
size 2, align 2
u_int16_tport

typedefau_iport_t

typedef struct au_iport_t au_iport_t;

structau_opaque_t

length 2 bytes data length bytes
size 16, align 8
u_int16_tsize
char *data

typedefau_opaque_t

typedef struct au_opaque_t au_opaque_t;

structau_path_t

path length 2 bytes path N bytes + 1 terminating NULL byte
size 16, align 8
u_int16_tlen
char *path

typedefau_path_t

typedef struct au_path_t au_path_t;

structau_proc32_t

audit ID 4 bytes effective user ID 4 bytes effective group ID 4 bytes real user ID 4 bytes real group ID 4 bytes process ID 4 bytes session ID 4 bytes terminal ID port ID 4 bytes/8 bytes (32-bit/64-bit value) machine address 4 bytes
size 36, align 4
u_int32_tauid
u_int32_teuid
u_int32_tegid
u_int32_truid
u_int32_trgid
u_int32_tpid
u_int32_tsid
au_tid32_ttid

typedefau_proc32_t

typedef struct au_proc32_t au_proc32_t;

typedefau_proc64_t

typedef struct au_proc64_t au_proc64_t;

structau_proc32ex_t

audit ID 4 bytes effective user ID 4 bytes effective group ID 4 bytes real user ID 4 bytes real group ID 4 bytes process ID 4 bytes session ID 4 bytes terminal ID port ID 4 bytes/8 bytes (32-bit/64-bit value) type 4 bytes machine address 16 bytes
size 52, align 4
u_int32_tauid
u_int32_teuid
u_int32_tegid
u_int32_truid
u_int32_trgid
u_int32_tpid
u_int32_tsid
au_tidaddr32_ttid

typedefau_proc32ex_t

typedef struct au_proc32ex_t au_proc32ex_t;

typedefau_proc64ex_t

typedef struct au_proc64ex_t au_proc64ex_t;

structau_ret32_t

error status 1 byte return value 4 bytes/8 bytes (32-bit/64-bit value)
size 8, align 4
u_charstatus
u_int32_tret

typedefau_ret32_t

typedef struct au_ret32_t au_ret32_t;

structau_ret64_t

size 16, align 8
u_charerr
u_int64_tval

typedefau_ret64_t

typedef struct au_ret64_t au_ret64_t;

structau_seq_t

sequence number 4 bytes
size 4, align 4
u_int32_tseqno

typedefau_seq_t

typedef struct au_seq_t au_seq_t;

structau_socket_t

socket type 2 bytes local port 2 bytes local Internet address 4 bytes remote port 2 bytes remote Internet address 4 bytes
size 16, align 4
u_int16_ttype
u_int16_tl_port
u_int32_tl_addr
u_int16_tr_port
u_int32_tr_addr

typedefau_socket_t

typedef struct au_socket_t au_socket_t;

structau_socket_ex32_t

socket type 2 bytes local port 2 bytes address type/length 4 bytes local Internet address 4 bytes/16 bytes (IPv4/IPv6 address) remote port 4 bytes address type/length 4 bytes remote Internet address 4 bytes/16 bytes (IPv4/IPv6 address)
size 44, align 4
u_int16_tdomain
u_int16_ttype
u_int16_tatype
u_int16_tl_port
u_int32_t[4]l_addr
u_int32_tr_port
u_int32_t[4]r_addr

typedefau_socket_ex32_t

typedef struct au_socket_ex32_t au_socket_ex32_t;

structau_socketinet_ex32_t

socket family 2 bytes local port 2 bytes socket address 4 bytes/16 bytes (IPv4/IPv6 address)
size 20, align 4
u_int16_tfamily
u_int16_tport
u_int32_t[4]addr

typedefau_socketinet_ex32_t

typedef struct au_socketinet_ex32_t au_socketinet_ex32_t;

structau_socketinet32_t

size 8, align 4
u_int16_tfamily
u_int16_tport
u_int32_taddr

typedefau_socketinet32_t

typedef struct au_socketinet32_t au_socketinet32_t;

structau_socketunix_t

socket family 2 bytes path 104 bytes
size 106, align 2
u_int16_tfamily
char[104]path

typedefau_socketunix_t

typedef struct au_socketunix_t au_socketunix_t;

structau_subject32_t

audit ID 4 bytes effective user ID 4 bytes effective group ID 4 bytes real user ID 4 bytes real group ID 4 bytes process ID 4 bytes session ID 4 bytes terminal ID port ID 4 bytes/8 bytes (32-bit/64-bit value) machine address 4 bytes
size 36, align 4
u_int32_tauid
u_int32_teuid
u_int32_tegid
u_int32_truid
u_int32_trgid
u_int32_tpid
u_int32_tsid
au_tid32_ttid

typedefau_subject32_t

typedef struct au_subject32_t au_subject32_t;

typedefau_subject64_t

typedef struct au_subject64_t au_subject64_t;

structau_subject32ex_t

audit ID 4 bytes effective user ID 4 bytes effective group ID 4 bytes real user ID 4 bytes real group ID 4 bytes process ID 4 bytes session ID 4 bytes terminal ID port ID 4 bytes/8 bytes (32-bit/64-bit value) type 4 bytes machine address 16 bytes
size 52, align 4
u_int32_tauid
u_int32_teuid
u_int32_tegid
u_int32_truid
u_int32_trgid
u_int32_tpid
u_int32_tsid
au_tidaddr32_ttid

typedefau_subject32ex_t

typedef struct au_subject32ex_t au_subject32ex_t;

typedefau_subject64ex_t

typedef struct au_subject64ex_t au_subject64ex_t;

structau_text_t

text length 2 bytes text N bytes + 1 terminating NULL byte
size 16, align 8
u_int16_tlen
char *text

typedefau_text_t

typedef struct au_text_t au_text_t;

structau_zonename_t

zonename length 2 bytes zonename text N bytes + 1 NULL terminator
size 16, align 8
u_int16_tlen
char *zonename

typedefau_zonename_t

typedef struct au_zonename_t au_zonename_t;

structau_kevent_t

size 16, align 4
u_int32_tident
u_int16_tfilter
u_int16_tflags
u_int32_tfflags
u_int32_tdata

typedefau_kevent_t

typedef struct au_kevent_t au_kevent_t;

structau_invalid_t

size 16, align 8
u_int16_tlength
char *data

typedefau_invalid_t

typedef struct au_invalid_t au_invalid_t;

structau_identity_t

signer type 4 bytes signing id length 2 bytes signing id N bytes + 1 terminating NULL byte signing id truncated 1 byte (true/false) team id length 2 bytes team id N bytes + 1 terminating NULL byte team id truncated 1 byte (true/false) cdhash length 2 bytes cdhash N bytes Note: This structure represents a contiguous (in-memory/on-disk) layout. Due to multiple variable length buffers it cannot be simply assigned and should only be populated via au_fetch_tok().
size 48, align 8
u_int32_tsigner_type
u_int16_tsigning_id_len
char *signing_id
u_charsigning_id_truncated
u_int16_tteam_id_len
char *team_id
u_charteam_id_truncated
u_int16_tcdhash_len
u_int8_t *cdhash

typedefau_identity_t

typedef struct au_identity_t au_identity_t;

structau_trailer_t

trailer magic number 2 bytes record byte count 4 bytes
size 8, align 4
u_int16_tmagic
u_int32_tcount

typedefau_trailer_t

typedef struct au_trailer_t au_trailer_t;

typedeftokenstr_t

typedef struct tokenstr tokenstr_t

functionaudit_submit

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
int audit_submit(
	short au_event,
	au_id_t auid,
	char status,
	int reterr,
	const char *fmt,
	...
)
deprecated
man page · January 18, 2008
audit_submit(3) — "general purpose audit record submission"

functionsetauclass

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
void setauclass(void)
deprecated
Functions relating to querying audit class information.
man page · April 19, 2005
setauclass(3) — "look up information from the audit_class database"

functionendauclass

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
void endauclass(void)
deprecated
man page · April 19, 2005
endauclass(3) — "look up information from the audit_class database"

functiongetauclassent

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
struct au_class_ent *getauclassent(void)
deprecated
man page · April 19, 2005
getauclassent(3) — "look up information from the audit_class database"

functiongetauclassent_r

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
struct au_class_ent *getauclassent_r(au_class_ent_t *class_int)
deprecated
man page · April 19, 2005
getauclassent_r(3) — "look up information from the audit_class database"

functiongetauclassnam

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
struct au_class_ent *getauclassnam(const char *name)
deprecated
man page · April 19, 2005
getauclassnam(3) — "look up information from the audit_class database"

functiongetauclassnam_r

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
struct au_class_ent *getauclassnam_r(au_class_ent_t *class_int, const char *name)
deprecated
man page · April 19, 2005
getauclassnam_r(3) — "look up information from the audit_class database"

functiongetauclassnum

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
struct au_class_ent *getauclassnum(au_class_t class_number)
deprecated

functiongetauclassnum_r

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
struct au_class_ent *getauclassnum_r(au_class_ent_t *class_int, au_class_t class_number)
deprecated

functionsetac

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
void setac(void)
deprecated
Functions relating to querying audit control information.
man page · April 19, 2005
setac(3) — "look up information from the audit_control database"

functionendac

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
void endac(void)
deprecated
man page · April 19, 2005
endac(3) — "look up information from the audit_control database"

functiongetacdir

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
int getacdir(char *name, int len)
deprecated
man page · April 19, 2005
getacdir(3) — "look up information from the audit_control database"

functiongetacmin

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
int getacmin(int *min_val)
deprecated
man page · April 19, 2005
getacmin(3) — "look up information from the audit_control database"

functiongetacfilesz

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
int getacfilesz(size_t *size_val)
deprecated
man page · April 19, 2005
getacfilesz(3) — "look up information from the audit_control database"

functiongetacflg

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
int getacflg(char *auditstr, int len)
deprecated
man page · April 19, 2005
getacflg(3) — "look up information from the audit_control database"

functiongetacna

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
int getacna(char *auditstr, int len)
deprecated
man page · April 19, 2005
getacna(3) — "look up information from the audit_control database"

functiongetacpol

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
int getacpol(char *auditstr, size_t len)
deprecated
man page · April 19, 2005
getacpol(3) — "look up information from the audit_control database"

functiongetacsflagsmask

API_DEPRECATED("no longer implemented", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
int getacsflagsmask(const char *which, char *auditstr, size_t len)
deprecated

functiongetachost

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
int getachost(char *auditstr, size_t len)
deprecated

functiongetacexpire

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
int getacexpire(int *andflg, time_t *age, size_t *size)
deprecated
man page · April 19, 2005
getacexpire(3) — "look up information from the audit_control database"

functiongetauditflagsbin

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
int getauditflagsbin(char *auditstr, au_mask_t *masks)
deprecated
man page · April 19, 2005
getauditflagsbin(3) — "convert between string and numeric values of audit masks"

functiongetauditflagschar

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
int getauditflagschar(char *auditstr, au_mask_t *masks, int verbose)
deprecated
man page · April 19, 2005
getauditflagschar(3) — "convert between string and numeric values of audit masks"

functionau_preselect

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
int au_preselect(au_event_t event, au_mask_t *mask_p, int sorf, int flag)
deprecated
man page · April 19, 2005
au_preselect(3) — "convert between string and numeric values of audit masks"

functionau_poltostr

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
ssize_t au_poltostr(int policy, size_t maxsize, char *buf)
deprecated
man page · April 19, 2005
au_poltostr(3) — "look up information from the audit_control database"

functionau_strtopol

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
int au_strtopol(const char *polstr, int *policy)
deprecated
man page · April 19, 2005
au_strtopol(3) — "look up information from the audit_control database"

functionau_sflagstostr

API_AVAILABLE(macos(10.8)) API_UNAVAILABLE(ios, watchos, tvos)
ssize_t au_sflagstostr(uint64_t flags, size_t maxsize, char *buf)
Functions relating to audit session flags.

functionau_strtosflags

API_AVAILABLE(macos(10.8)) API_UNAVAILABLE(ios, watchos, tvos)
int au_strtosflags(const char *sflagsstr, uint64_t *flags)

functionsetauevent

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
void setauevent(void)
deprecated
Functions relating to querying audit event information.
man page · April 19, 2005
setauevent(3) — "look up information from the audit_event database"

functionendauevent

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
void endauevent(void)
deprecated
man page · April 19, 2005
endauevent(3) — "look up information from the audit_event database"

functiongetauevent

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
struct au_event_ent *getauevent(void)
deprecated
man page · April 19, 2005
getauevent(3) — "look up information from the audit_event database"

functiongetauevent_r

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
struct au_event_ent *getauevent_r(struct au_event_ent *e)
deprecated
man page · April 19, 2005
getauevent_r(3) — "look up information from the audit_event database"

functiongetauevnam

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
struct au_event_ent *getauevnam(const char *name)
deprecated
man page · April 19, 2005
getauevnam(3) — "look up information from the audit_event database"

functiongetauevnam_r

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
struct au_event_ent *getauevnam_r(struct au_event_ent *e, const char *name)
deprecated
man page · April 19, 2005
getauevnam_r(3) — "look up information from the audit_event database"

functiongetauevnum

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
struct au_event_ent *getauevnum(au_event_t event_number)
deprecated
man page · April 19, 2005
getauevnum(3) — "look up information from the audit_event database"

functiongetauevnum_r

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
struct au_event_ent *getauevnum_r(struct au_event_ent *e, au_event_t event_number)
deprecated
man page · April 19, 2005
getauevnum_r(3) — "look up information from the audit_event database"

functiongetauevnonam

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
au_event_t *getauevnonam(const char *event_name)
deprecated
man page · April 19, 2005
getauevnonam(3) — "look up information from the audit_event database"

functiongetauevnonam_r

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
au_event_t *getauevnonam_r(au_event_t *ev, const char *event_name)
deprecated
man page · April 19, 2005
getauevnonam_r(3) — "look up information from the audit_event database"

functionsetauuser

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
void setauuser(void)
deprecated
Functions relating to querying audit user information.
man page · April 19, 2005
setauuser(3) — "look up information from the audit_user database"

functionendauuser

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
void endauuser(void)
deprecated
man page · April 19, 2005
endauuser(3) — "look up information from the audit_user database"

functiongetauuserent

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
struct au_user_ent *getauuserent(void)
deprecated
man page · April 19, 2005
getauuserent(3) — "look up information from the audit_user database"

functiongetauuserent_r

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
struct au_user_ent *getauuserent_r(struct au_user_ent *u)
deprecated
man page · April 19, 2005
getauuserent_r(3) — "look up information from the audit_user database"

functiongetauusernam

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
struct au_user_ent *getauusernam(const char *name)
deprecated
man page · April 19, 2005
getauusernam(3) — "look up information from the audit_user database"

functiongetauusernam_r

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
struct au_user_ent *getauusernam_r(struct au_user_ent *u, const char *name)
deprecated
man page · April 19, 2005
getauusernam_r(3) — "look up information from the audit_user database"

functionau_user_mask

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
int au_user_mask(char *username, au_mask_t *mask_p)
deprecated
man page · April 19, 2005
au_user_mask(3) — "look up information from the audit_user database"

functiongetfauditflags

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
int getfauditflags(au_mask_t *usremask, au_mask_t *usrdmask, au_mask_t *lastmask)
deprecated
man page · April 19, 2005
getfauditflags(3) — "look up information from the audit_user database"

functionau_read_rec

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
int au_read_rec(FILE *fp, u_char **buf)
deprecated
Functions for reading and printing records and tokens from audit trails.
man page · August 4, 2009
au_read_rec(3) — "perform I/O involving an audit record"

functionau_fetch_tok

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
int au_fetch_tok(tokenstr_t *tok, u_char *buf, int len)
deprecated
man page · August 4, 2009
au_fetch_tok(3) — "perform I/O involving an audit record"

functionau_print_tok

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
void au_print_tok(FILE *outfp, tokenstr_t *tok, char *del, char raw, char sfrm)
deprecated
XXX The following interface has different prototype from BSM
man page · August 4, 2009
au_print_tok(3) — "perform I/O involving an audit record"

functionau_print_flags_tok

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
void au_print_flags_tok(FILE *outfp, tokenstr_t *tok, char *del, int oflags)
deprecated
man page · August 4, 2009
au_print_flags_tok(3) — "perform I/O involving an audit record"

functionau_print_tok_xml

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
void au_print_tok_xml(FILE *outfp, tokenstr_t *tok, char *del, char raw, char sfrm)
deprecated

functionau_print_xml_header

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
void au_print_xml_header(FILE *outfp)
deprecated
Functions relating to XML output.

functionau_strerror

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
const char *au_strerror(u_char bsm_error)
deprecated
man page · December 8, 2008
au_strerror(3) — "convert between BSM and local error numbers"

macroAUDIT_OFF

au_get_state() return values XXX use AUC_* values directly instead (<bsm/audit.h>); AUDIT_OFF and AUDIT_ON are deprecated and WILL be removed.
#define AUDIT_OFF AUC_NOAUDIT

macroAUDIT_ON

#define AUDIT_ON AUC_AUDITING

enum(anonymous)

Error return codes for audit_set_terminal_id_ex(), audit_write() and its brethren. We have 255 (not including kAUNoErr) to play with. XXXRW: In Apple's bsm-8, these are marked __APPLE_API_PRIVATE.
underlying type int
kAUNoErr0
kAUBadParamErr-66049
kAUStatErr-66048
kAUSysctlErr-66047
kAUOpenErr-66046
kAUMakeSubjectTokErr-66045
kAUWriteSubjectTokErr-66044
kAUWriteCallerTokErr-66043
kAUMakeReturnTokErr-66042
kAUWriteReturnTokErr-66041
kAUCloseErr-66040
kAUMakeTextTokErr-66039
kAULastErr-66038

macroAU_UNIMPL

Error return codes for au_get_state() and/or its private support functions. These codes are designed to be compatible with the NOTIFY_STATUS_* codes defined in <notify.h> but non-overlapping. Any changes to notify(3) may cause these values to change in future. AU_UNIMPL should never happen unless you've changed your system software without rebooting. Shame on you.
#define AU_UNIMPL NOTIFY_STATUS_FAILED + 1
audit unimplemented

functionau_free_token

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
void au_free_token(token_t *tok)
deprecated
XXX This prototype should be in audit_record.h au_free_token() @summary - au_free_token() deallocates a token_t created by any of the au_to_*() BSM API functions. The BSM API generally manages deallocation of token_t objects. However, if au_write() is passed a bad audit descriptor, the token_t * parameter will be left untouched. In that case, the caller can deallocate the token_t using au_free_token() if desired. This is, in fact, what audit_write() does, in keeping with the existing memory management model of the BSM API. @param tok - A token_t * generated by one of the au_to_*() BSM API calls. For convenience, tok may be NULL, in which case au_free_token() returns immediately. XXXRW: In Apple's bsm-8, these are marked __APPLE_API_PRIVATE.
man page · April 19, 2005
au_free_token(3) — "deallocate a token_t created by any of the au_to_*() BSM API functions"

functionau_get_state

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
int au_get_state(void)
deprecated
Lightweight check to determine if auditing is enabled. If a client wants to use this to govern whether an entire series of audit calls should be made--as in the common case of a caller building a set of tokens, then writing them--it should cache the audit status in a local variable. This call always returns the current state of auditing. @return - AUC_AUDITING or AUC_NOAUDIT if no error occurred. Otherwise the function can return any of the errno values defined for setaudit(2), or AU_UNIMPL if audit does not appear to be supported by the system. XXXRW: In Apple's bsm-8, these are marked __APPLE_API_PRIVATE.

functionau_notify_initialize

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
uint32_t au_notify_initialize(void)
deprecated
Initialize the audit notification. If it has not already been initialized it will automatically on the first call of au_get_state().

functionau_notify_terminate

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
int au_notify_terminate(void)
deprecated
Cancel audit notification and free the resources associated with it. Responsible code that no longer needs to use au_get_state() should call this.

functioncannot_audit

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
int cannot_audit(int)
deprecated
OpenSSH compatibility

functionaudit_set_terminal_id_ex

API_AVAILABLE(macos(10.8)) API_UNAVAILABLE(ios, watchos, tvos)
int audit_set_terminal_id_ex(au_tid_addr_t *tid)
audit_set_terminal_id_ex() audit_set_terminal_id() @summary - audit_set_terminal_id_ex() fills in an au_tid_addr_t struct, which is used in audit session initialization by processes like /usr/bin/login. audit_set_terminal_id() does the same but for the au_tid_t structure. Note that audit_set_terminal_id_ex() is preferred since it can store longer terminal addresses like those used in IP version 6. Neither audit_set_terminal_id() nor audit_set_terminal_id_ex() should be used if the terminal connection is a remote one and the remote IP address and port is known, however. These wrapper functions populate the au_tid_t or au_tid_addr_t stuctures with local terminal information only. @param tid - A pointer to an au_tid_addr_t or au_tid_t struct. @return - kAUNoErr on success; kAUBadParamErr if tid is NULL, kAUStatErr or kAUSysctlErr if one of the underlying system calls fails (a message is sent to the system log in those cases). XXXRW: In Apple's bsm-8, these are marked __APPLE_API_PRIVATE.

functionaudit_set_terminal_id

API_AVAILABLE(macos(10.8)) API_UNAVAILABLE(ios, watchos, tvos)
int audit_set_terminal_id(au_tid_t *tid)

functionaudit_write

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
int audit_write(
	short event_code,
	token_t *subject,
	token_t *misctok,
	char retval,
	int errcode
)
deprecated
audit_write() @summary - audit_write() is the basis for the other audit_write_*() calls. Performs a basic write of an audit record (subject, additional info, success/failure). Note that this call only permits logging one caller-specified token; clients needing to log more flexibly must use the existing BSM API (au_open(), et al.) directly. Note on memory management: audit_write() guarantees that the token_t *s passed to it will be deallocated whether or not the underlying write to the audit log succeeded. This addresses an inconsistency in the underlying BSM API in which token_t *s are usually but not always deallocated. @param event_code - The code for the event being logged. This should be one of the AUE_ values in /usr/include/bsm/audit_uevents.h. @param subject - A token_t * generated by au_to_subject(), au_to_subject32(), au_to_subject64(), or au_to_me(). If no subject is required, subject should be NULL. @param misctok - A token_t * generated by one of the au_to_*() BSM API calls. This should correspond to the additional information required by CAPP for the event being audited. If no additional information is required, misctok should be NULL. @param retval - The return value to be logged for this event. This should be 0 (zero) for success, otherwise the value is event-specific. @param errcode - Any error code associated with the return value (e.g., errno or h_errno). If there was no error, errcode should be 0 (zero). @return - The status of the call: 0 (zero) on success, else one of the kAU*Err values defined above. XXXRW: In Apple's bsm-8, these are marked __APPLE_API_PRIVATE.

functionaudit_write_success_ex

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
int audit_write_success_ex(
	short event_code,
	token_t *misctok,
	au_id_t auid,
	uid_t euid,
	gid_t egid,
	uid_t ruid,
	gid_t rgid,
	pid_t pid,
	au_asid_t sid,
	au_tid_addr_t *tid
)
deprecated

functionaudit_write_success

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
int audit_write_success(
	short event_code,
	token_t *misctok,
	au_id_t auid,
	uid_t euid,
	gid_t egid,
	uid_t ruid,
	gid_t rgid,
	pid_t pid,
	au_asid_t sid,
	au_tid_t *tid
)
deprecated

functionaudit_write_success_self

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
int audit_write_success_self(short event_code, token_t *misctok)
deprecated
audit_write_success_self() @summary - Similar to audit_write_success_ex(), but used when the subject (process) is owned and operated by the auditable user him/herself. @param event_code - The code for the event being logged. This should be one of the AUE_ values in /usr/include/bsm/audit_uevents.h. @param misctok - A token_t * generated by one of the au_to_*() BSM API calls. This should correspond to the additional information required by CAPP for the event being audited. If no additional information is required, misctok should be NULL. @return - The status of the call: 0 (zero) on success, else one of the kAU*Err values defined above. XXXRW: In Apple's bsm-8, these are marked __APPLE_API_PRIVATE.

functionaudit_write_failure_ex

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
int audit_write_failure_ex(
	short event_code,
	char *errmsg,
	int errret,
	au_id_t auid,
	uid_t euid,
	gid_t egid,
	uid_t ruid,
	gid_t rgid,
	pid_t pid,
	au_asid_t sid,
	au_tid_addr_t *tid
)
deprecated
audit_write_failure_ex() audit_write_failure() @summary - audit_write_failure_ex() and audit_write_failure() records an auditable event that encountered an error. The interface is designed to require as little direct use of the au_to_*() API as possible. It builds a subject token from the information passed in and uses that to invoke audit write(). A subject, as defined by CAPP, is a process acting on the user's behalf. Preference should be given in using audit_write_success_ex() since it supports longer addreses such as those used for IP version 6. If the subject information is the same as the current process, use au_write_failure_self(). @param event_code - The code for the event being logged. This should be one of the AUE_ values in /usr/include/bsm/audit_uevents.h. @param errmsg - A text message providing additional information about the event being audited. @param errret - A numerical value providing additional information about the error. This is intended to store the value of errno or h_errno if it's relevant. This can be 0 (zero) if no additional information is available. @param auid - The subject's audit ID. @param euid - The subject's effective user ID. @param egid - The subject's effective group ID. @param ruid - The subject's real user ID. @param rgid - The subject's real group ID. @param pid - The subject's process ID. @param sid - The subject's session ID. @param tid - The subject's terminal ID. @return - The status of the call: 0 (zero) on success, else one of the kAU*Err values defined above. XXXRW: In Apple's bsm-8, these are marked __APPLE_API_PRIVATE.

functionaudit_write_failure

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
int audit_write_failure(
	short event_code,
	char *errmsg,
	int errret,
	au_id_t auid,
	uid_t euid,
	gid_t egid,
	uid_t ruid,
	gid_t rgid,
	pid_t pid,
	au_asid_t sid,
	au_tid_t *tid
)
deprecated

functionaudit_write_failure_self

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
int audit_write_failure_self(short event_code, char *errmsg, int errret)
deprecated
audit_write_failure_self() @summary - Similar to audit_write_failure(), but used when the subject (process) is owned and operated by the auditable user him/herself. @param event_code - The code for the event being logged. This should be one of the AUE_ values in /usr/include/bsm/audit_uevents.h. @param errmsg - A text message providing additional information about the event being audited. @param errret - A numerical value providing additional information about the error. This is intended to store the value of errno or h_errno if it's relevant. This can be 0 (zero) if no additional information is available. @return - The status of the call: 0 (zero) on success, else one of the kAU*Err values defined above. XXXRW: In Apple's bsm-8, these are marked __APPLE_API_PRIVATE.

functionaudit_write_failure_na_ex

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
int audit_write_failure_na_ex(
	short event_code,
	char *errmsg,
	int errret,
	uid_t euid,
	gid_t egid,
	pid_t pid,
	au_tid_addr_t *tid
)
deprecated
audit_write_failure_na_ex() audit_write_failure_na() @summary - audit_write_failure_na_ex() and audit_write_failure_na() record errors during login. Such errors are implicitly non-attributable (i.e., not ascribable to any user). Preference should be given in using audit_write_failure_na_ex() since it supports longer addreses such as those used for IP version 6. @param event_code - The code for the event being logged. This should be one of the AUE_ values in /usr/include/bsm/audit_uevents.h. @param errmsg - A text message providing additional information about the event being audited. @param errret - A numerical value providing additional information about the error. This is intended to store the value of errno or h_errno if it's relevant. This can be 0 (zero) if no additional information is available. @param euid - The subject's effective user ID. @param egid - The subject's effective group ID. @param pid - The subject's process ID. @param tid - The subject's terminal ID. @return - The status of the call: 0 (zero) on success, else one of the kAU*Err values defined above. XXXRW: In Apple's bsm-8, these are marked __APPLE_API_PRIVATE.

functionaudit_write_failure_na

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
int audit_write_failure_na(
	short event_code,
	char *errmsg,
	int errret,
	uid_t euid,
	gid_t egid,
	pid_t pid,
	au_tid_t *tid
)
deprecated

functionaudit_token_to_au32

API_AVAILABLE(macos(10.8)) API_UNAVAILABLE(ios, watchos, tvos)
void audit_token_to_au32(
	audit_token_t atoken,
	uid_t *auidp,
	uid_t *euidp,
	gid_t *egidp,
	uid_t *ruidp,
	gid_t *rgidp,
	pid_t *pidp,
	au_asid_t *asidp,
	au_tid_t *tidp
)
audit_token_to_au32() (NOW DEPRECATED) @summary - Extract information from an audit_token_t, used to identify Mach tasks and senders of Mach messages as subjects to the audit system. audit_tokent_to_au32() is the only method that should be used to parse an audit_token_t, since its internal representation may change over time. A pointer parameter may be NULL if that information is not needed. audit_token_to_au32() has been deprecated because the terminal ID information is no longer saved in this token. The last parameter is actually the process ID version. The API calls audit_token_to_auid(), audit_token_to_euid(), audit_token_to_ruid(), audit_token_to_rgid(), audit_token_to_pid(), audit_token_to_asid(), and/or audit_token_to_pidversion() should be used instead. @param atoken - the audit token containing the desired information @param auidp - Pointer to a uid_t; on return will be set to the task or sender's audit user ID @param euidp - Pointer to a uid_t; on return will be set to the task or sender's effective user ID @param egidp - Pointer to a gid_t; on return will be set to the task or sender's effective group ID @param ruidp - Pointer to a uid_t; on return will be set to the task or sender's real user ID @param rgidp - Pointer to a gid_t; on return will be set to the task or sender's real group ID @param pidp - Pointer to a pid_t; on return will be set to the task or sender's process ID @param asidp - Pointer to an au_asid_t; on return will be set to the task or sender's audit session ID @param tidp - Pointer to an au_tid_t; on return will be set to the process ID version and NOT THE SENDER'S TERMINAL ID. XXXRW: In Apple's bsm-8, these are marked __APPLE_API_PRIVATE.

functionaudit_token_to_auid

API_AVAILABLE(macos(10.8)) API_UNAVAILABLE(ios, watchos, tvos)
uid_t audit_token_to_auid(audit_token_t atoken)
audit_token_to_auid() @summary - Extract the audit user ID from an audit_token_t, used to identify Mach tasks and senders of Mach messages as subjects of the audit system. @param atoken - The Mach audit token. @return - The audit user ID extracted from the Mach audit token.

functionaudit_token_to_euid

API_AVAILABLE(macos(10.8)) API_UNAVAILABLE(ios, watchos, tvos)
uid_t audit_token_to_euid(audit_token_t atoken)
audit_token_to_euid() @summary - Extract the effective user ID from an audit_token_t, used to identify Mach tasks and senders of Mach messages as subjects of the audit system. @param atoken - The Mach audit token. @return - The effective user ID extracted from the Mach audit token.

functionaudit_token_to_egid

API_AVAILABLE(macos(10.8)) API_UNAVAILABLE(ios, watchos, tvos)
gid_t audit_token_to_egid(audit_token_t atoken)
audit_token_to_egid() @summary - Extract the effective group ID from an audit_token_t, used to identify Mach tasks and senders of Mach messages as subjects of the audit system. @param atoken - The Mach audit token. @return - The effective group ID extracted from the Mach audit token.

functionaudit_token_to_ruid

API_AVAILABLE(macos(10.8)) API_UNAVAILABLE(ios, watchos, tvos)
uid_t audit_token_to_ruid(audit_token_t atoken)
audit_token_to_ruid() @summary - Extract the real user ID from an audit_token_t, used to identify Mach tasks and senders of Mach messages as subjects of the audit system. @param atoken - The Mach audit token. @return - The real user ID extracted from the Mach audit token.

functionaudit_token_to_rgid

API_AVAILABLE(macos(10.8)) API_UNAVAILABLE(ios, watchos, tvos)
gid_t audit_token_to_rgid(audit_token_t atoken)
audit_token_to_rgid() @summary - Extract the real group ID from an audit_token_t, used to identify Mach tasks and senders of Mach messages as subjects of the audit system. @param atoken - The Mach audit token. @return - The real group ID extracted from the Mach audit token.

functionaudit_token_to_pid

API_AVAILABLE(macos(10.8)) API_UNAVAILABLE(ios, watchos, tvos)
pid_t audit_token_to_pid(audit_token_t atoken)
audit_token_to_pid() @summary - Extract the process ID from an audit_token_t, used to identify Mach tasks and senders of Mach messages as subjects of the audit system. @param atoken - The Mach audit token. @return - The process ID extracted from the Mach audit token.

functionaudit_token_to_asid

API_AVAILABLE(macos(10.8)) API_UNAVAILABLE(ios, watchos, tvos)
au_asid_t audit_token_to_asid(audit_token_t atoken)
audit_token_to_asid() @summary - Extract the audit session ID from an audit_token_t, used to identify Mach tasks and senders of Mach messages as subjects of the audit system. @param atoken - The Mach audit token. @return - The audit session ID extracted from the Mach audit token.

functionaudit_token_to_pidversion

API_AVAILABLE(macos(10.8)) API_UNAVAILABLE(ios, watchos, tvos)
int audit_token_to_pidversion(audit_token_t atoken)
audit_token_to_pidversion() @summary - Extract the process ID version from an audit_token_t, used to identify Mach tasks and senders of Mach messages as subjects of the audit system. @param atoken - The Mach audit token. @return - The process ID version extracted from the Mach audit token.

functionaudit_get_car

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
int audit_get_car(char *path, size_t sz)
deprecated
Wrapper functions to auditon(2).

functionaudit_get_class

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
int audit_get_class(au_evclass_map_t *evc_map, size_t sz)
deprecated

functionaudit_set_class

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
int audit_set_class(au_evclass_map_t *evc_map, size_t sz)
deprecated

functionaudit_get_cond

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
int audit_get_cond(int *cond)
deprecated

functionaudit_set_cond

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
int audit_set_cond(int *cond)
deprecated

functionaudit_get_cwd

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
int audit_get_cwd(char *path, size_t sz)
deprecated

functionaudit_get_fsize

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
int audit_get_fsize(au_fstat_t *fstat, size_t sz)
deprecated

functionaudit_set_fsize

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
int audit_set_fsize(au_fstat_t *fstat, size_t sz)
deprecated

functionaudit_get_kmask

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
int audit_get_kmask(au_mask_t *kmask, size_t sz)
deprecated

functionaudit_set_kmask

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
int audit_set_kmask(au_mask_t *kmask, size_t sz)
deprecated

functionaudit_get_kaudit

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
int audit_get_kaudit(auditinfo_addr_t *aia, size_t sz)
deprecated

functionaudit_set_kaudit

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
int audit_set_kaudit(auditinfo_addr_t *aia, size_t sz)
deprecated

functionaudit_set_pmask

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
int audit_set_pmask(auditpinfo_t *api, size_t sz)
deprecated

functionaudit_get_pinfo

API_DEPRECATED("use audit_get_pinfo_addr", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
int audit_get_pinfo(auditpinfo_t *api, size_t sz)
deprecated

functionaudit_get_pinfo_addr

API_AVAILABLE(macos(10.8)) API_UNAVAILABLE(ios, watchos, tvos)
int audit_get_pinfo_addr(auditpinfo_addr_t *apia, size_t sz)

functionaudit_get_policy

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
int audit_get_policy(int *policy)
deprecated

functionaudit_set_policy

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
int audit_set_policy(int *policy)
deprecated

functionaudit_get_qctrl

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
int audit_get_qctrl(au_qctrl_t *qctrl, size_t sz)
deprecated

functionaudit_set_qctrl

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
int audit_set_qctrl(au_qctrl_t *qctrl, size_t sz)
deprecated

functionaudit_get_sflags

API_AVAILABLE(macos(10.8)) API_UNAVAILABLE(ios, watchos, tvos)
int audit_get_sflags(uint64_t *flags)

functionaudit_set_sflags

API_AVAILABLE(macos(10.8)) API_UNAVAILABLE(ios, watchos, tvos)
int audit_set_sflags(uint64_t flags)

functionaudit_get_sflags_mask

API_DEPRECATED("no longer implemented", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
int audit_get_sflags_mask(const char *which, uint64_t *mask)
deprecated

functionaudit_set_sflags_mask

API_DEPRECATED("no longer implemented", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
int audit_set_sflags_mask(const char *which, uint64_t mask)
deprecated

functionaudit_get_sinfo_addr

API_AVAILABLE(macos(10.8)) API_UNAVAILABLE(ios, watchos, tvos)
int audit_get_sinfo_addr(auditinfo_addr_t *aia, size_t sz)

functionaudit_get_stat

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
int audit_get_stat(au_stat_t *stats, size_t sz)
deprecated

functionaudit_set_stat

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
int audit_set_stat(au_stat_t *stats, size_t sz)
deprecated

functionaudit_send_trigger

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
int audit_send_trigger(int *trigger)
deprecated

functionaudit_get_ctlmode

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
int audit_get_ctlmode(au_ctlmode_t *mode, size_t sz)
deprecated

functionaudit_get_expire_after

API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos)
int audit_get_expire_after(au_expire_after_t *expire, size_t sz)
deprecated