Update src/sys/bsm include files to match OpenBSM (albeit with a
couple of FreeBSD-specific modifications that may be merged out later). These include files define the basic audit data structures, types, and definitions use by the kernel, or shared by the kernel and user space. Obtained from: TrustedBSD Project, Apple Computer, Inc.
This commit is contained in:
parent
3182fc7b3e
commit
a5081e077b
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=155191
356
sys/bsm/audit.h
356
sys/bsm/audit.h
@ -1,39 +1,345 @@
|
||||
/*-
|
||||
* Copyright (c) 2005 Robert N. M. Watson
|
||||
/*
|
||||
* Copyright (c) 2005 Apple Computer, Inc.
|
||||
* All rights reserved.
|
||||
*
|
||||
* @APPLE_BSD_LICENSE_HEADER_START@
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
* 3. Neither the name of Apple Computer, Inc. ("Apple") nor the names of
|
||||
* its contributors may be used to endorse or promote products derived
|
||||
* from this software without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
|
||||
* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
|
||||
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
|
||||
* DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
|
||||
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
|
||||
* (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
|
||||
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
|
||||
* ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
||||
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
|
||||
* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
*
|
||||
* @APPLE_BSD_LICENSE_HEADER_END@
|
||||
*
|
||||
* $P4: //depot/projects/trustedbsd/audit3/sys/bsm/audit.h#22 $
|
||||
* $FreeBSD$
|
||||
*/
|
||||
|
||||
#ifndef _BSM_AUDIT_H_
|
||||
#define _BSM_AUDIT_H_
|
||||
#ifndef _BSM_AUDIT_H
|
||||
#define _BSM_AUDIT_H
|
||||
|
||||
#include <sys/param.h>
|
||||
#include <sys/cdefs.h>
|
||||
#include <sys/queue.h>
|
||||
|
||||
#define AUDIT_RECORD_MAGIC 0x828a0f1b
|
||||
#define MAX_AUDIT_RECORDS 20
|
||||
#define MAX_AUDIT_RECORD_SIZE 4096
|
||||
#define MIN_AUDIT_FILE_SIZE (512 * 1024)
|
||||
|
||||
/*
|
||||
* This is a place-holder include file that defines only the minimal BSM
|
||||
* types to allow the system call table to contain stub event identifiers.
|
||||
* Additional types and defines will be introduced later.
|
||||
* Minimum noumber of free blocks on the filesystem containing the audit
|
||||
* log necessary to avoid a hard log rotation. DO NOT SET THIS VALUE TO 0
|
||||
* as the kernel does an unsigned compare, plus we want to leave a few blocks
|
||||
* free so userspace can terminate the log, etc.
|
||||
*/
|
||||
typedef u_int16_t au_event_t;
|
||||
#define AUDIT_HARD_LIMIT_FREE_BLOCKS 4
|
||||
|
||||
#endif /* !_BSM_AUDIT_H_ */
|
||||
/*
|
||||
* Triggers for the audit daemon
|
||||
*/
|
||||
#define AUDIT_TRIGGER_MIN 1
|
||||
#define AUDIT_TRIGGER_LOW_SPACE 1
|
||||
#define AUDIT_TRIGGER_OPEN_NEW 2
|
||||
#define AUDIT_TRIGGER_READ_FILE 3
|
||||
#define AUDIT_TRIGGER_CLOSE_AND_DIE 4
|
||||
#define AUDIT_TRIGGER_NO_SPACE 5
|
||||
#define AUDIT_TRIGGER_MAX 5
|
||||
|
||||
/*
|
||||
* File that will be read for trigger events from the kernel.
|
||||
*/
|
||||
#define AUDIT_TRIGGER_FILE "/dev/audit"
|
||||
|
||||
/*
|
||||
* The special device filename.
|
||||
*/
|
||||
#define AUDITDEV_FILENAME "audit"
|
||||
|
||||
/*
|
||||
* Pre-defined audit IDs
|
||||
*/
|
||||
#define AU_DEFAUDITID -1
|
||||
|
||||
/*
|
||||
* Define the masks for the classes of audit events.
|
||||
*/
|
||||
#define AU_NULL 0x00000000
|
||||
#define AU_FREAD 0x00000001
|
||||
#define AU_FWRITE 0x00000002
|
||||
#define AU_FACCESS 0x00000004
|
||||
#define AU_FMODIFY 0x00000008
|
||||
#define AU_FCREATE 0x00000010
|
||||
#define AU_FDELETE 0x00000020
|
||||
#define AU_CLOSE 0x00000040
|
||||
#define AU_PROCESS 0x00000080
|
||||
#define AU_NET 0x00000100
|
||||
#define AU_IPC 0x00000200
|
||||
#define AU_NONAT 0x00000400
|
||||
#define AU_ADMIN 0x00000800
|
||||
#define AU_LOGIN 0x00001000
|
||||
#define AU_TFM 0x00002000
|
||||
#define AU_APPL 0x00004000
|
||||
#define AU_SETL 0x00008000
|
||||
#define AU_IFLOAT 0x00010000
|
||||
#define AU_PRIV 0x00020000
|
||||
#define AU_MAC_RW 0x00040000
|
||||
#define AU_XCONN 0x00080000
|
||||
#define AU_XCREATE 0x00100000
|
||||
#define AU_XDELETE 0x00200000
|
||||
#define AU_XIFLOAT 0x00400000
|
||||
#define AU_XPRIVS 0x00800000
|
||||
#define AU_XPRIVF 0x01000000
|
||||
#define AU_XMOVE 0x02000000
|
||||
#define AU_XDACF 0x04000000
|
||||
#define AU_XMACF 0x08000000
|
||||
#define AU_XSECATTR 0x10000000
|
||||
#define AU_IOCTL 0x20000000
|
||||
#define AU_EXEC 0x40000000
|
||||
#define AU_OTHER 0x80000000
|
||||
#define AU_ALL 0xffffffff
|
||||
|
||||
/*
|
||||
* IPC types
|
||||
*/
|
||||
#define AT_IPC_MSG ((u_char)1) /* Message IPC id. */
|
||||
#define AT_IPC_SEM ((u_char)2) /* Semaphore IPC id. */
|
||||
#define AT_IPC_SHM ((u_char)3) /* Shared mem IPC id. */
|
||||
|
||||
/*
|
||||
* Audit conditions.
|
||||
*/
|
||||
#define AUC_UNSET 0
|
||||
#define AUC_AUDITING 1
|
||||
#define AUC_NOAUDIT 2
|
||||
#define AUC_DISABLED -1
|
||||
|
||||
/*
|
||||
* auditon(2) commands.
|
||||
*/
|
||||
#define A_GETPOLICY 2
|
||||
#define A_SETPOLICY 3
|
||||
#define A_GETKMASK 4
|
||||
#define A_SETKMASK 5
|
||||
#define A_GETQCTRL 6
|
||||
#define A_SETQCTRL 7
|
||||
#define A_GETCWD 8
|
||||
#define A_GETCAR 9
|
||||
#define A_GETSTAT 12
|
||||
#define A_SETSTAT 13
|
||||
#define A_SETUMASK 14
|
||||
#define A_SETSMASK 15
|
||||
#define A_GETCOND 20
|
||||
#define A_SETCOND 21
|
||||
#define A_GETCLASS 22
|
||||
#define A_SETCLASS 23
|
||||
#define A_GETPINFO 24
|
||||
#define A_SETPMASK 25
|
||||
#define A_SETFSIZE 26
|
||||
#define A_GETFSIZE 27
|
||||
#define A_GETPINFO_ADDR 28
|
||||
#define A_GETKAUDIT 29
|
||||
#define A_SETKAUDIT 30
|
||||
#define A_SENDTRIGGER 31
|
||||
|
||||
/*
|
||||
* Audit policy controls.
|
||||
*/
|
||||
#define AUDIT_CNT 0x0001
|
||||
#define AUDIT_AHLT 0x0002
|
||||
#define AUDIT_ARGV 0x0004
|
||||
#define AUDIT_ARGE 0x0008
|
||||
#define AUDIT_PASSWD 0x0010
|
||||
#define AUDIT_SEQ 0x0020
|
||||
#define AUDIT_WINDATA 0x0040
|
||||
#define AUDIT_USER 0x0080
|
||||
#define AUDIT_GROUP 0x0100
|
||||
#define AUDIT_TRAIL 0x0200
|
||||
#define AUDIT_PATH 0x0400
|
||||
|
||||
/*
|
||||
* Audit queue control parameters
|
||||
*/
|
||||
#define AQ_HIWATER 100
|
||||
#define AQ_MAXHIGH 10000
|
||||
#define AQ_LOWATER 10
|
||||
#define AQ_BUFSZ 1024
|
||||
#define AQ_MAXBUFSZ 1048576
|
||||
|
||||
/*
|
||||
* Default minimum percentage free space on file system.
|
||||
*/
|
||||
#define AU_FS_MINFREE 20
|
||||
|
||||
/*
|
||||
* Type definitions used indicating the length of variable length addresses
|
||||
* in tokens containing addresses, such as header fields.
|
||||
*/
|
||||
#define AU_IPv4 4
|
||||
#define AU_IPv6 16
|
||||
|
||||
__BEGIN_DECLS
|
||||
|
||||
typedef uid_t au_id_t;
|
||||
typedef pid_t au_asid_t;
|
||||
typedef u_int16_t au_event_t;
|
||||
typedef u_int16_t au_emod_t;
|
||||
typedef u_int32_t au_class_t;
|
||||
|
||||
struct au_tid {
|
||||
dev_t port;
|
||||
u_int32_t machine;
|
||||
};
|
||||
typedef struct au_tid au_tid_t;
|
||||
|
||||
struct au_tid_addr {
|
||||
dev_t at_port;
|
||||
u_int32_t at_type;
|
||||
u_int32_t at_addr[4];
|
||||
};
|
||||
typedef struct au_tid_addr au_tid_addr_t;
|
||||
|
||||
struct au_mask {
|
||||
unsigned int am_success; /* Success bits. */
|
||||
unsigned int am_failure; /* Failure bits. */
|
||||
};
|
||||
typedef struct au_mask au_mask_t;
|
||||
|
||||
struct auditinfo {
|
||||
au_id_t ai_auid; /* Audit user ID. */
|
||||
au_mask_t ai_mask; /* Audit masks. */
|
||||
au_tid_t ai_termid; /* Terminal ID. */
|
||||
au_asid_t ai_asid; /* Audit session ID. */
|
||||
};
|
||||
typedef struct auditinfo auditinfo_t;
|
||||
|
||||
struct auditinfo_addr {
|
||||
au_id_t ai_auid; /* Audit user ID. */
|
||||
au_mask_t ai_mask; /* Audit masks. */
|
||||
au_tid_addr_t ai_termid; /* Terminal ID. */
|
||||
au_asid_t ai_asid; /* Audit session ID. */
|
||||
};
|
||||
typedef struct auditinfo_addr auditinfo_addr_t;
|
||||
|
||||
struct auditpinfo {
|
||||
pid_t ap_pid; /* ID of target process. */
|
||||
au_id_t ap_auid; /* Audit user ID. */
|
||||
au_mask_t ap_mask; /* Audit masks. */
|
||||
au_tid_t ap_termid; /* Terminal ID. */
|
||||
au_asid_t ap_asid; /* Audit session ID. */
|
||||
};
|
||||
typedef struct auditpinfo auditpinfo_t;
|
||||
|
||||
struct auditpinfo_addr {
|
||||
pid_t ap_pid; /* ID of target process. */
|
||||
au_id_t ap_auid; /* Audit user ID. */
|
||||
au_mask_t ap_mask; /* Audit masks. */
|
||||
au_tid_addr_t ap_termid; /* Terminal ID. */
|
||||
au_asid_t ap_asid; /* Audit session ID. */
|
||||
};
|
||||
typedef struct auditpinfo_addr auditpinfo_addr_t;
|
||||
|
||||
/* Token and record structures. */
|
||||
|
||||
struct au_token {
|
||||
u_char *t_data;
|
||||
size_t len;
|
||||
TAILQ_ENTRY(au_token) tokens;
|
||||
};
|
||||
typedef struct au_token token_t;
|
||||
|
||||
struct au_record {
|
||||
char used; /* Record currently in use? */
|
||||
int desc; /* Descriptor for record. */
|
||||
TAILQ_HEAD(, au_token) token_q; /* Queue of BSM tokens. */
|
||||
u_char *data;
|
||||
size_t len;
|
||||
LIST_ENTRY(au_record) au_rec_q;
|
||||
};
|
||||
typedef struct au_record au_record_t;
|
||||
|
||||
/*
|
||||
* Kernel audit queue control parameters.
|
||||
*/
|
||||
struct au_qctrl {
|
||||
size_t aq_hiwater;
|
||||
size_t aq_lowater;
|
||||
size_t aq_bufsz;
|
||||
clock_t aq_delay;
|
||||
int aq_minfree; /* Minimum filesystem percent free space. */
|
||||
};
|
||||
typedef struct au_qctrl au_qctrl_t;
|
||||
|
||||
/*
|
||||
* Structure for the audit statistics.
|
||||
*/
|
||||
struct audit_stat {
|
||||
unsigned int as_version;
|
||||
unsigned int as_numevent;
|
||||
int as_generated;
|
||||
int as_nonattring;
|
||||
int as_kernel;
|
||||
int as_audit;
|
||||
int as_auditctl;
|
||||
int as_enqueu;
|
||||
int as_written;
|
||||
int as_wblocked;
|
||||
int as_rblocked;
|
||||
int as_dropped;
|
||||
int as_totalsize;
|
||||
unsigned int as_memused;
|
||||
};
|
||||
typedef struct audit_stat au_stat_t;
|
||||
|
||||
/*
|
||||
* Structure for the audit file statistics.
|
||||
*/
|
||||
struct audit_fstat {
|
||||
u_quad_t af_filesz;
|
||||
u_quad_t af_currsz;
|
||||
};
|
||||
typedef struct audit_fstat au_fstat_t;
|
||||
|
||||
/*
|
||||
* Audit to event class mapping.
|
||||
*/
|
||||
struct au_evclass_map {
|
||||
au_event_t ec_number;
|
||||
au_class_t ec_class;
|
||||
};
|
||||
typedef struct au_evclass_map au_evclass_map_t;
|
||||
|
||||
#if !defined(_KERNEL) && !defined(KERNEL)
|
||||
int audit(const void *, int);
|
||||
int auditon(int, void *, int);
|
||||
int auditctl(const char *);
|
||||
int getauid(au_id_t *);
|
||||
int setauid(const au_id_t *);
|
||||
int getaudit(struct auditinfo *);
|
||||
int setaudit(const struct auditinfo *);
|
||||
int getaudit_addr(struct auditinfo_addr *, int);
|
||||
int setaudit_addr(const struct auditinfo_addr *, int);
|
||||
#endif /* defined(_KERNEL) || defined(KERNEL) */
|
||||
|
||||
__END_DECLS
|
||||
|
||||
#endif /* !_BSM_AUDIT_H */
|
||||
|
100
sys/bsm/audit_internal.h
Normal file
100
sys/bsm/audit_internal.h
Normal file
@ -0,0 +1,100 @@
|
||||
/*
|
||||
* Copyright (c) 2005 Apple Computer, Inc.
|
||||
* Copyright (c) 2005 SPARTA, Inc.
|
||||
* All rights reserved.
|
||||
*
|
||||
* This code was developed in part by Robert N. M. Watson, Senior Principal
|
||||
* Scientist, SPARTA, Inc.
|
||||
*
|
||||
* @APPLE_BSD_LICENSE_HEADER_START@
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
* 3. Neither the name of Apple Computer, Inc. ("Apple") nor the names of
|
||||
* its contributors may be used to endorse or promote products derived
|
||||
* from this software without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
|
||||
* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
|
||||
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
|
||||
* DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
|
||||
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
|
||||
* (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
|
||||
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
|
||||
* ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
||||
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
|
||||
* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
*
|
||||
* @APPLE_BSD_LICENSE_HEADER_END@
|
||||
*
|
||||
* $P4: //depot/projects/trustedbsd/audit3/sys/bsm/audit_internal.h#5 $
|
||||
* $FreeBSD$
|
||||
*/
|
||||
|
||||
#ifndef _LIBBSM_INTERNAL_H
|
||||
#define _LIBBSM_INTERNAL_H
|
||||
|
||||
/*
|
||||
* audit_internal.h contains private interfaces that are shared by user space
|
||||
* and the kernel for the purposes of assembling audit records. Applications
|
||||
* should not include this file or use the APIs found within, or it may be
|
||||
* broken with future releases of OpenBSM, which may delete, modify, or
|
||||
* otherwise break these interfaces or the assumptions they rely on.
|
||||
*/
|
||||
|
||||
/* We could determined the header and trailer sizes by
|
||||
* defining appropriate structures. We hold off that approach
|
||||
* till we have a consistant way of using structures for all tokens.
|
||||
* This is not straightforward since these token structures may
|
||||
* contain pointers of whose contents we dont know the size
|
||||
* (e.g text tokens)
|
||||
*/
|
||||
#define BSM_HEADER_SIZE 18
|
||||
#define BSM_TRAILER_SIZE 7
|
||||
|
||||
/*
|
||||
* BSM token streams store fields in big endian byte order, so as to be
|
||||
* portable; when encoding and decoding, we must convert byte orders for
|
||||
* typed values.
|
||||
*/
|
||||
#define ADD_U_CHAR(loc, val) \
|
||||
do { \
|
||||
*(loc) = (val); \
|
||||
(loc) += sizeof(u_char); \
|
||||
} while(0)
|
||||
|
||||
|
||||
#define ADD_U_INT16(loc, val) \
|
||||
do { \
|
||||
be16enc((loc), (val)); \
|
||||
(loc) += sizeof(u_int16_t); \
|
||||
} while(0)
|
||||
|
||||
#define ADD_U_INT32(loc, val) \
|
||||
do { \
|
||||
be32enc((loc), (val)); \
|
||||
(loc) += sizeof(u_int32_t); \
|
||||
} while(0)
|
||||
|
||||
#define ADD_U_INT64(loc, val) \
|
||||
do { \
|
||||
be64enc((loc), (val)); \
|
||||
(loc) += sizeof(u_int64_t); \
|
||||
} while(0)
|
||||
|
||||
#define ADD_MEM(loc, data, size) \
|
||||
do { \
|
||||
memcpy((loc), (data), (size)); \
|
||||
(loc) += size; \
|
||||
} while(0)
|
||||
|
||||
#define ADD_STRING(loc, data, size) ADD_MEM(loc, data, size)
|
||||
|
||||
#endif /* !_LIBBSM_INTERNAL_H_ */
|
@ -1,28 +1,36 @@
|
||||
/*-
|
||||
* Copyright (c) 2005 Robert N. M. Watson
|
||||
/*
|
||||
* Copyright (c) 2005 Apple Computer, Inc.
|
||||
* All rights reserved.
|
||||
*
|
||||
* @APPLE_BSD_LICENSE_HEADER_START@
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
* 3. Neither the name of Apple Computer, Inc. ("Apple") nor the names of
|
||||
* its contributors may be used to endorse or promote products derived
|
||||
* from this software without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
|
||||
* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
|
||||
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
|
||||
* DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
|
||||
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
|
||||
* (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
|
||||
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
|
||||
* ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
||||
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
|
||||
* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
*
|
||||
* @APPLE_BSD_LICENSE_HEADER_END@
|
||||
*
|
||||
* $P4: //depot/projects/trustedbsd/audit3/sys/bsm/audit_kevents.h#15 $
|
||||
* $FreeBSD$
|
||||
*/
|
||||
|
||||
@ -30,9 +38,458 @@
|
||||
#define _BSM_AUDIT_KEVENTS_H_
|
||||
|
||||
/*
|
||||
* This is a place-holder include file that defines exactly one audit event:
|
||||
* the null event. The real list of audit events will be introduced later.
|
||||
* Values marked as AUE_NULL are not required to be audited as per CAPP.
|
||||
*
|
||||
* Some conflicts exist in the assignment of name to event number mappings
|
||||
* between BSM implementations. In general, we prefer the OpenSolaris
|
||||
* definition as we consider Solaris BSM to be authoritative. _DARWIN_ has
|
||||
* been inserted for the Darwin variants. If necessary, other tags will be
|
||||
* added in the future.
|
||||
*/
|
||||
#define AUE_NULL 0
|
||||
|
||||
#define AUE_NULL 0
|
||||
#define AUE_EXIT 1
|
||||
#define AUE_FORK 2
|
||||
#define AUE_OPEN 3
|
||||
#define AUE_CREAT 4
|
||||
#define AUE_LINK 5
|
||||
#define AUE_UNLINK 6
|
||||
#define AUE_DELETE AUE_UNLINK
|
||||
#define AUE_EXEC 7
|
||||
#define AUE_CHDIR 8
|
||||
#define AUE_MKNOD 9
|
||||
#define AUE_CHMOD 10
|
||||
#define AUE_CHOWN 11
|
||||
#define AUE_UMOUNT 12
|
||||
#define AUE_JUNK 13 /* Solaris-specific. */
|
||||
#define AUE_ACCESS 14
|
||||
#define AUE_CHECKUSERACCESS AUE_ACCESS
|
||||
#define AUE_KILL 15
|
||||
#define AUE_STAT 16
|
||||
#define AUE_LSTAT 17
|
||||
#define AUE_ACCT 18
|
||||
#define AUE_MCTL 19 /* Solaris-specific. */
|
||||
#define AUE_REBOOT 20 /* XXX: Darwin conflict. */
|
||||
#define AUE_SYMLINK 21
|
||||
#define AUE_READLINK 22
|
||||
#define AUE_EXECVE 23
|
||||
#define AUE_CHROOT 24
|
||||
#define AUE_VFORK 25
|
||||
#define AUE_SETGROUPS 26
|
||||
#define AUE_SETPGRP 27
|
||||
#define AUE_SWAPON 28
|
||||
#define AUE_SETHOSTNAME 29 /* XXX: Darwin conflict. */
|
||||
#define AUE_FCNTL 30
|
||||
#define AUE_SETPRIORITY 31 /* XXX: Darwin conflict. */
|
||||
#define AUE_CONNECT 32
|
||||
#define AUE_ACCEPT 33
|
||||
#define AUE_BIND 34
|
||||
#define AUE_SETSOCKOPT 35
|
||||
#define AUE_VTRACE 36 /* Solaris-specific. */
|
||||
#define AUE_SETTIMEOFDAY 37 /* XXX: Darwin conflict. */
|
||||
#define AUE_FCHOWN 38
|
||||
#define AUE_FCHMOD 39
|
||||
#define AUE_SETREUID 40
|
||||
#define AUE_SETREGID 41
|
||||
#define AUE_RENAME 42
|
||||
#define AUE_TRUNCATE 43 /* XXX: Darwin conflict. */
|
||||
#define AUE_FTRUNCATE 44 /* XXX: Darwin conflict. */
|
||||
#define AUE_FLOCK 45 /* XXX: Darwin conflict. */
|
||||
#define AUE_SHUTDOWN 46
|
||||
#define AUE_MKDIR 47
|
||||
#define AUE_RMDIR 48
|
||||
#define AUE_UTIMES 49
|
||||
#define AUE_ADJTIME 50
|
||||
#define AUE_SETRLIMIT 51
|
||||
#define AUE_KILLPG 52
|
||||
#define AUE_NFS_SVC 53 /* XXX: Darwin conflict. */
|
||||
#define AUE_STATFS 54
|
||||
#define AUE_FSTATFS 55
|
||||
#define AUE_UNMOUNT 56 /* XXX: Darwin conflict. */
|
||||
#define AUE_ASYNC_DAEMON 57
|
||||
#define AUE_NFS_GETFH 58 /* XXX: Darwin conflict. */
|
||||
#define AUE_SETDOMAINNAME 59
|
||||
#define AUE_QUOTACTL 60 /* XXX: Darwin conflict. */
|
||||
#define AUE_EXPORTFS 61
|
||||
#define AUE_MOUNT 62
|
||||
#define AUE_SEMSYS 63
|
||||
#define AUE_MSGSYS 64
|
||||
#define AUE_SHMSYS 65
|
||||
#define AUE_BSMSYS 66 /* Solaris-specific. */
|
||||
#define AUE_RFSSYS 67 /* Solaris-specific. */
|
||||
#define AUE_FCHDIR 68
|
||||
#define AUE_FCHROOT 69
|
||||
#define AUE_VPIXSYS 70 /* Solaris-specific. */
|
||||
#define AUE_PATHCONF 71
|
||||
#define AUE_OPEN_R 72
|
||||
#define AUE_OPEN_RC 73
|
||||
#define AUE_OPEN_RT 74
|
||||
#define AUE_OPEN_RTC 75
|
||||
#define AUE_OPEN_W 76
|
||||
#define AUE_OPEN_WC 77
|
||||
#define AUE_OPEN_WT 78
|
||||
#define AUE_OPEN_WTC 79
|
||||
#define AUE_OPEN_RW 80
|
||||
#define AUE_OPEN_RWC 81
|
||||
#define AUE_OPEN_RWT 82
|
||||
#define AUE_OPEN_RWTC 83
|
||||
#define AUE_MSGCTL 84
|
||||
#define AUE_MSGCTL_RMID 85
|
||||
#define AUE_MSGCTL_SET 86
|
||||
#define AUE_MSGCTL_STAT 87
|
||||
#define AUE_MSGGET 88
|
||||
#define AUE_MSGRCV 89
|
||||
#define AUE_MSGSND 90
|
||||
#define AUE_SHMCTL 91
|
||||
#define AUE_SHMCTL_RMID 92
|
||||
#define AUE_SHMCTL_SET 93
|
||||
#define AUE_SHMCTL_STAT 94
|
||||
#define AUE_SHMGET 95
|
||||
#define AUE_SHMAT 96
|
||||
#define AUE_SHMDT 97
|
||||
#define AUE_SEMCTL 98
|
||||
#define AUE_SEMCTL_RMID 99
|
||||
#define AUE_SEMCTL_SET 100
|
||||
#define AUE_SEMCTL_STAT 101
|
||||
#define AUE_SEMCTL_GETNCNT 102
|
||||
#define AUE_SEMCTL_GETPID 103
|
||||
#define AUE_SEMCTL_GETVAL 104
|
||||
#define AUE_SEMCTL_GETALL 105
|
||||
#define AUE_SEMCTL_GETZCNT 106
|
||||
#define AUE_SEMCTL_SETVAL 107
|
||||
#define AUE_SEMCTL_SETALL 108
|
||||
#define AUE_SEMGET 109
|
||||
#define AUE_SEMOP 110
|
||||
#define AUE_CORE 111 /* Solaris-specific, currently. */
|
||||
#define AUE_CLOSE 112
|
||||
#define AUE_SYSTEMBOOT 113
|
||||
#define AUE_ASYNC_DAEMON_EXIT 114 /* Solaris-specific. */
|
||||
#define AUE_NFSSVC_EXIT 115 /* Solaris-specific. */
|
||||
#define AUE_WRITEL 128 /* Solaris-specific. */
|
||||
#define AUE_WRITEVL 129 /* Solaris-specific. */
|
||||
#define AUE_GETAUID 130
|
||||
#define AUE_SETAUID 131
|
||||
#define AUE_GETAUDIT 132
|
||||
#define AUE_SETAUDIT 133
|
||||
#define AUE_GETUSERAUDIT 134 /* Solaris-specific. */
|
||||
#define AUE_SETUSERAUDIT 135 /* Solaris-specific. */
|
||||
#define AUE_AUDITSVC 136 /* Solaris-specific. */
|
||||
#define AUE_AUDITUSER 137 /* Solaris-specific. */
|
||||
#define AUE_AUDITON 138
|
||||
#define AUE_AUDITON_GTERMID 139 /* Solaris-specific. */
|
||||
#define AUE_AUDITON_STERMID 140 /* Solaris-specific. */
|
||||
#define AUE_AUDITON_GPOLICY 141
|
||||
#define AUE_AUDITON_SPOLICY 142
|
||||
#define AUE_AUDITON_GQCTRL 145
|
||||
#define AUE_AUDITON_SQCTRL 146
|
||||
#define AUE_GETKERNSTATE 147 /* Solaris-specific. */
|
||||
#define AUE_SETKERNSTATE 148 /* Solaris-specific. */
|
||||
#define AUE_GETPORTAUDIT 149 /* Solaris-specific. */
|
||||
#define AUE_AUDISTAT 150 /* Solaris-specific. */
|
||||
#define AUE_ENTERPROM 153 /* Solaris-specific. */
|
||||
#define AUE_EXITPROM 154 /* Solaris-specific. */
|
||||
#define AUE_IOCTL 158
|
||||
#define AUE_SOCKET 183
|
||||
#define AUE_SENDTO 184
|
||||
#define AUE_PIPE 185
|
||||
#define AUE_SOCKETPAIR 186 /* XXX: Darwin conflict. */
|
||||
#define AUE_SEND 187
|
||||
#define AUE_SENDMSG 188
|
||||
#define AUE_RECV 189
|
||||
#define AUE_RECVMSG 190
|
||||
#define AUE_RECVFROM 191
|
||||
#define AUE_READ 192
|
||||
#define AUE_LSEEK 194
|
||||
#define AUE_WRITE 195
|
||||
#define AUE_WRITEV 196
|
||||
#define AUE_NFS 197 /* Solaris-specific. */
|
||||
#define AUE_READV 198
|
||||
/* XXXRW: XXX Solaris old stat()? */
|
||||
#define AUE_SETUID 200 /* XXXRW: Solaris old setuid? */
|
||||
#define AUE_STIME 201 /* XXXRW: Solaris old stime? */
|
||||
#define AUE_UTIME 202 /* XXXRW: Solaris old utime? */
|
||||
#define AUE_NICE 203 /* XXXRW: Solaris old nice? */
|
||||
/* XXXRW: Solaris old setpgrp? */
|
||||
#define AUE_SETGID 205 /* XXXRW: Solaris old setgid? */
|
||||
/* XXXRW: Solaris readl? */
|
||||
/* XXXRW: Solaris readvl()? */
|
||||
#define AUE_DUP2 209
|
||||
#define AUE_MMAP 210
|
||||
#define AUE_AUDIT 211
|
||||
#define AUE_PRIOCNTLSYS 212
|
||||
#define AUE_MUNMAP 213
|
||||
#define AUE_SETEGID 214
|
||||
#define AUE_SETEUID 215
|
||||
#define AUE_PUTMSG 216
|
||||
#define AUE_GETMSG 217 /* Solaris-specific. */
|
||||
#define AUE_PUTPMSG 218 /* Solaris-specific. */
|
||||
#define AUE_GETPMSG 219 /* Solaris-specific. */
|
||||
#define AUE_AUDITSYS 220 /* Solaris-specific. */
|
||||
#define AUE_AUDITON_GETKMASK 221
|
||||
#define AUE_AUDITON_SETKMASK 222
|
||||
#define AUE_AUDITON_GETCWD 223
|
||||
#define AUE_AUDITON_GETCAR 224
|
||||
#define AUE_AUDITON_GETSTAT 225
|
||||
#define AUE_AUDITON_SETSTAT 226
|
||||
#define AUE_AUDITON_SETUMASK 227
|
||||
#define AUE_AUDITON_SETSMASK 228
|
||||
#define AUE_AUDITON_GETCOND 229
|
||||
#define AUE_AUDITON_SETCOND 230
|
||||
#define AUE_AUDITON_GETCLASS 231
|
||||
#define AUE_AUDITON_SETCLASS 232
|
||||
#define AUE_UTSSYS 233 /* Solaris-specific. */
|
||||
#define AUE_STATVFS 234
|
||||
#define AUE_XSTAT 235
|
||||
#define AUE_LXSTAT 236
|
||||
#define AUE_LCHOWN 237
|
||||
#define AUE_MEMCNTL 238 /* Solaris-specific. */
|
||||
#define AUE_SYSINFO 239 /* Solaris-specific. */
|
||||
#define AUE_XMKNOD 240 /* Solaris-specific. */
|
||||
#define AUE_FORK1 241
|
||||
/* XXXRW: Solaris modctl()? */
|
||||
#define AUE_MODLOAD 243
|
||||
#define AUE_MODUNLOAD 244
|
||||
#define AUE_MODCONFIG 245 /* Solaris-specific. */
|
||||
#define AUE_MODADDMAJ 246 /* Solaris-specific. */
|
||||
#define AUE_SOCKACCEPT 247
|
||||
#define AUE_SOCKCONNECT 248
|
||||
#define AUE_SOCKSEND 249
|
||||
#define AUE_SOCKRECEIVE 250
|
||||
#define AUE_ACLSET 251
|
||||
#define AUE_FACLSET 252
|
||||
#define AUE_DOORFS_DOOR_CALL 254 /* Solaris-specific. */
|
||||
#define AUE_DOORFS_DOOR_RETURN 255 /* Solaris-specific. */
|
||||
#define AUE_DOORFS_DOOR_CREATE 256 /* Solaris-specific. */
|
||||
#define AUE_DOORFS_DOOR_REVOKE 257 /* Solaris-specific. */
|
||||
#define AUE_DOORFS_DOOR_INFO 258 /* Solaris-specific. */
|
||||
#define AUE_DOORFS_DOOR_CRED 259 /* Solaris-specific. */
|
||||
#define AUE_DOORFS_DOOR_BIND 260 /* Solaris-specific. */
|
||||
#define AUE_DOORFS_DOOR_UNBIND 261 /* Solaris-specific. */
|
||||
#define AUE_P_ONLINE 262 /* Solaris-specific. */
|
||||
#define AUE_PROCESSOR_BIND 263 /* Solaris-specific. */
|
||||
#define AUE_INST_SYNC 264 /* Solaris-specific. */
|
||||
#define AUE_SOCK_CONFIG 265 /* Solaris-specific. */
|
||||
#define AUE_SETAUDIT_ADDR 266
|
||||
#define AUE_GETAUDIT_ADDR 267
|
||||
#define AUE_CLOCK_SETTIME 287
|
||||
#define AUE_NTP_ADJTIME 288
|
||||
|
||||
/*
|
||||
* Events not present in OpenSolaris BSM, generally derived from Apple Darwin
|
||||
* BSM or added in OpenBSM. This start a little too close to the top end of
|
||||
* the OpenSolaris event list for my comfort.
|
||||
*/
|
||||
#define AUE_GETFSSTAT 301
|
||||
#define AUE_PTRACE 302
|
||||
#define AUE_CHFLAGS 303
|
||||
#define AUE_FCHFLAGS 304
|
||||
#define AUE_PROFILE 305
|
||||
#define AUE_KTRACE 306
|
||||
#define AUE_SETLOGIN 307
|
||||
#define AUE_DARWIN_REBOOT 308 /* XXX: See AUE_REBOOT. */
|
||||
#define AUE_REVOKE 309
|
||||
#define AUE_UMASK 310
|
||||
#define AUE_MPROTECT 311
|
||||
#define AUE_DARWIN_SETPRIORITY 312 /* XXX: See AUE_SETPRIORITY. */
|
||||
#define AUE_DARWIN_SETTIMEOFDAY 313 /* XXX: See AUE_SETTIMEOFDAY. */
|
||||
#define AUE_DARWIN_FLOCK 314 /* XXX: See AUE_FLOCK. */
|
||||
#define AUE_MKFIFO 315
|
||||
#define AUE_POLL 316
|
||||
#define AUE_DARWIN_SOCKETPAIR 317 /* XXXRW: See AUE_SOCKETPAIR. */
|
||||
#define AUE_FUTIMES 318
|
||||
#define AUE_SETSID 319
|
||||
#define AUE_SETPRIVEXEC 320 /* Darwin-specific. */
|
||||
#define AUE_DARWIN_NFSSVC 321 /* XXX: See AUE_NFS_SVC. */
|
||||
#define AUE_DARWIN_GETFH 322 /* XXX: See AUE_NFS_GETFH. */
|
||||
#define AUE_DARWIN_QUOTACTL 323 /* XXX: See AUE_QUOTACTL. */
|
||||
#define AUE_ADDPROFILE 324 /* Darwin-specific. */
|
||||
#define AUE_KDEBUGTRACE 325 /* Darwin-specific. */
|
||||
#define AUE_KDBUGTRACE AUE_KDEBUGTRACE
|
||||
#define AUE_FSTAT 326
|
||||
#define AUE_FPATHCONF 327
|
||||
#define AUE_GETDIRENTRIES 328
|
||||
#define AUE_DARWIN_TRUNCATE 329 /* XXX: See AUE_TRUNCATE. */
|
||||
#define AUE_DARWIN_FTRUNCATE 330 /* XXX: See AUE_FTRUNCATE. */
|
||||
#define AUE_SYSCTL 331
|
||||
#define AUE_MLOCK 332
|
||||
#define AUE_MUNLOCK 333
|
||||
#define AUE_UNDELETE 334
|
||||
#define AUE_GETATTRLIST 335 /* Darwin-specific. */
|
||||
#define AUE_SETATTRLIST 336 /* Darwin-specific. */
|
||||
#define AUE_GETDIRENTRIESATTR 337 /* Darwin-specific. */
|
||||
#define AUE_EXCHANGEDATA 338 /* Darwin-specific. */
|
||||
#define AUE_SEARCHFS 339 /* Darwin-specific. */
|
||||
#define AUE_MINHERIT 340
|
||||
#define AUE_SEMCONFIG 341
|
||||
#define AUE_SEMOPEN 342
|
||||
#define AUE_SEMCLOSE 343
|
||||
#define AUE_SEMUNLINK 344
|
||||
#define AUE_SHMOPEN 345
|
||||
#define AUE_SHMUNLINK 346
|
||||
#define AUE_LOADSHFILE 347 /* Darwin-specific. */
|
||||
#define AUE_RESETSHFILE 348 /* Darwin-specific. */
|
||||
#define AUE_NEWSYSTEMSHREG 349 /* Darwin-specific. */
|
||||
#define AUE_PTHREADKILL 350 /* Darwin-specific. */
|
||||
#define AUE_PTHREADSIGMASK 351 /* Darwin-specific. */
|
||||
#define AUE_AUDITCTL 352
|
||||
#define AUE_RFORK 353
|
||||
#define AUE_LCHMOD 354
|
||||
#define AUE_SWAPOFF 355
|
||||
#define AUE_INITPROCESS 356 /* Darwin-specific. */
|
||||
#define AUE_MAPFD 357 /* Darwin-specific. */
|
||||
#define AUE_TASKFORPID 358 /* Darwin-specific. */
|
||||
#define AUE_PIDFORTASK 359 /* Darwin-specific. */
|
||||
#define AUE_SYSCTL_NONADMIN 360
|
||||
#define AUE_COPYFILE 361 /* Darwin-specific. */
|
||||
#define AUE_LUTIMES 362
|
||||
#define AUE_LCHFLAGS 363 /* FreeBSD-specific. */
|
||||
#define AUE_SENDFILE 364 /* BSD/Linux-specific. */
|
||||
#define AUE_USELIB 365 /* Linux-specific. */
|
||||
#define AUE_GETRESUID 366
|
||||
#define AUE_SETRESUID 367
|
||||
#define AUE_GETRESGID 368
|
||||
#define AUE_SETRESGID 369
|
||||
#define AUE_WAIT4 370 /* FreeBSD-specific. */
|
||||
#define AUE_LGETFH 371 /* FreeBSD-specific. */
|
||||
#define AUE_FHSTATFS 372 /* FreeBSD-specific. */
|
||||
#define AUE_FHOPEN 373 /* FreeBSD-specific. */
|
||||
#define AUE_FHSTAT 374 /* FreeBSD-specific. */
|
||||
#define AUE_JAIL 375 /* FreeBSD-specific. */
|
||||
#define AUE_EACCESS 376 /* FreeBSD-specific. */
|
||||
#define AUE_KQUEUE 377 /* FreeBSD-specific. */
|
||||
#define AUE_KEVENT 378 /* FreeBSD-specific. */
|
||||
#define AUE_FSYNC 379
|
||||
#define AUE_NMOUNT 380 /* FreeBSD-specific. */
|
||||
|
||||
/*
|
||||
* Darwin BSM uses a number of AUE_O_* definitions, which are aliased to the
|
||||
* normal Solaris BSM identifiers. _O_ refers to it being an old, or compat
|
||||
* interface. In most cases, Darwin has never implemented these system calls
|
||||
* but picked up the fields in their system call table from their FreeBSD
|
||||
* import. Happily, these have different names than the AUE_O* definitions
|
||||
* in Solaris BSM.
|
||||
*/
|
||||
#define AUE_O_CREAT AUE_OPEN_RWTC /* Darwin */
|
||||
#define AUE_O_EXECVE AUE_NULL /* Darwin */
|
||||
#define AUE_O_SBREAK AUE_NULL /* Darwin */
|
||||
#define AUE_O_LSEEK AUE_NULL /* Darwin */
|
||||
#define AUE_O_MOUNT AUE_NULL /* Darwin */
|
||||
#define AUE_O_UMOUNT AUE_NULL /* Darwin */
|
||||
#define AUE_O_STAT AUE_STAT /* Darwin */
|
||||
#define AUE_O_LSTAT AUE_LSTAT /* Darwin */
|
||||
#define AUE_O_FSTAT AUE_FSTAT /* Darwin */
|
||||
#define AUE_O_GETPAGESIZE AUE_NULL /* Darwin */
|
||||
#define AUE_O_VREAD AUE_NULL /* Darwin */
|
||||
#define AUE_O_VWRITE AUE_NULL /* Darwin */
|
||||
#define AUE_O_MMAP AUE_MMAP /* Darwin */
|
||||
#define AUE_O_VADVISE AUE_NULL /* Darwin */
|
||||
#define AUE_O_VHANGUP AUE_NULL /* Darwin */
|
||||
#define AUE_O_VLIMIT AUE_NULL /* Darwin */
|
||||
#define AUE_O_WAIT AUE_NULL /* Darwin */
|
||||
#define AUE_O_GETHOSTNAME AUE_NULL /* Darwin */
|
||||
#define AUE_O_SETHOSTNAME AUE_SYSCTL /* Darwin */
|
||||
#define AUE_O_GETDOPT AUE_NULL /* Darwin */
|
||||
#define AUE_O_SETDOPT AUE_NULL /* Darwin */
|
||||
#define AUE_O_ACCEPT AUE_NULL /* Darwin */
|
||||
#define AUE_O_SEND AUE_SENDMSG /* Darwin */
|
||||
#define AUE_O_RECV AUE_RECVMSG /* Darwin */
|
||||
#define AUE_O_VTIMES AUE_NULL /* Darwin */
|
||||
#define AUE_O_SIGVEC AUE_NULL /* Darwin */
|
||||
#define AUE_O_SIGBLOCK AUE_NULL /* Darwin */
|
||||
#define AUE_O_SIGSETMASK AUE_NULL /* Darwin */
|
||||
#define AUE_O_SIGSTACK AUE_NULL /* Darwin */
|
||||
#define AUE_O_RECVMSG AUE_RECVMSG /* Darwin */
|
||||
#define AUE_O_SENDMSG AUE_SENDMSG /* Darwin */
|
||||
#define AUE_O_VTRACE AUE_NULL /* Darwin */
|
||||
#define AUE_O_RESUBA AUE_NULL /* Darwin */
|
||||
#define AUE_O_RECVFROM AUE_RECVFROM /* Darwin */
|
||||
#define AUE_O_SETREUID AUE_SETREUID /* Darwin */
|
||||
#define AUE_O_SETREGID AUE_SETREGID /* Darwin */
|
||||
#define AUE_O_TRUNCATE AUE_TRUNCATE /* Darwin */
|
||||
#define AUE_O_FTRUNCATE AUE_FTRUNCATE /* Darwin */
|
||||
#define AUE_O_GETPEERNAME AUE_NULL /* Darwin */
|
||||
#define AUE_O_GETHOSTID AUE_NULL /* Darwin */
|
||||
#define AUE_O_SETHOSTID AUE_NULL /* Darwin */
|
||||
#define AUE_O_GETRLIMIT AUE_NULL /* Darwin */
|
||||
#define AUE_O_SETRLIMIT AUE_SETRLIMIT /* Darwin */
|
||||
#define AUE_O_KILLPG AUE_KILL /* Darwin */
|
||||
#define AUE_O_SETQUOTA AUE_NULL /* Darwin */
|
||||
#define AUE_O_QUOTA AUE_NULL /* Darwin */
|
||||
#define AUE_O_GETSOCKNAME AUE_NULL /* Darwin */
|
||||
#define AUE_O_GETDIREENTRIES AUE_GETDIREENTRIES /* Darwin */
|
||||
#define AUE_O_ASYNCDAEMON AUE_NULL /* Darwin */
|
||||
#define AUE_O_GETDOMAINNAME AUE_NULL /* Darwin */
|
||||
#define AUE_O_SETDOMAINNAME AUE_SYSCTL /* Darwin */
|
||||
#define AUE_O_PCFS_MOUNT AUE_NULL /* Darwin */
|
||||
#define AUE_O_EXPORTFS AUE_NULL /* Darwin */
|
||||
#define AUE_O_USTATE AUE_NULL /* Darwin */
|
||||
#define AUE_O_WAIT3 AUE_NULL /* Darwin */
|
||||
#define AUE_O_RPAUSE AUE_NULL /* Darwin */
|
||||
#define AUE_O_GETDENTS AUE_NULL /* Darwin */
|
||||
|
||||
/*
|
||||
* Possible desired future values based on review of BSD/Darwin system calls.
|
||||
*/
|
||||
#define AUE_DUP AUE_NULL
|
||||
#define AUE_FSCTL AUE_NULL
|
||||
#define AUE_FSTATV AUE_NULL
|
||||
#define AUE_GCCONTROL AUE_NULL
|
||||
#define AUE_GETDTABLESIZE AUE_NULL
|
||||
#define AUE_GETEGID AUE_NULL
|
||||
#define AUE_GETEUID AUE_NULL
|
||||
#define AUE_GETGID AUE_NULL
|
||||
#define AUE_GETGROUPS AUE_NULL
|
||||
#define AUE_GETITIMER AUE_NULL
|
||||
#define AUE_GETLOGIN AUE_NULL
|
||||
#define AUE_GETPEERNAME AUE_NULL
|
||||
#define AUE_GETPGID AUE_NULL
|
||||
#define AUE_GETPGRP AUE_NULL
|
||||
#define AUE_GETPID AUE_NULL
|
||||
#define AUE_GETPPID AUE_NULL
|
||||
#define AUE_GETPRIORITY AUE_NULL
|
||||
#define AUE_GETRLIMIT AUE_NULL
|
||||
#define AUE_GETRUSAGE AUE_NULL
|
||||
#define AUE_GETSID AUE_NULL
|
||||
#define AUE_GETSOCKNAME AUE_NULL
|
||||
#define AUE_GETTIMEOFDAY AUE_NULL
|
||||
#define AUE_GETUID AUE_NULL
|
||||
#define AUE_GETSOCKOPT AUE_NULL
|
||||
#define AUE_GTSOCKOPT AUE_GETSOCKOPT /* XXX: Typo in Darwin. */
|
||||
#define AUE_ISSETUGID AUE_NULL
|
||||
#define AUE_LISTEN AUE_NULL
|
||||
#define AUE_LSTATV AUE_NULL
|
||||
#define AUE_MADVISE AUE_NULL
|
||||
#define AUE_MINCORE AUE_NULL
|
||||
#define AUE_MKCOMPLEX AUE_NULL
|
||||
#define AUE_MLOCKALL AUE_NULL
|
||||
#define AUE_MODWATCH AUE_NULL
|
||||
#define AUE_MSGCL AUE_NULL
|
||||
#define AUE_MSYNC AUE_NULL
|
||||
#define AUE_MUNLOCKALL AUE_NULL
|
||||
#define AUE_PREAD AUE_NULL
|
||||
#define AUE_PWRITE AUE_NULL
|
||||
#define AUE_SBRK AUE_NULL
|
||||
#define AUE_SELECT AUE_NULL
|
||||
#define AUE_SEMDESTROY AUE_NULL
|
||||
#define AUE_SEMGETVALUE AUE_NULL
|
||||
#define AUE_SEMINIT AUE_NULL
|
||||
#define AUE_SEMPOST AUE_NULL
|
||||
#define AUE_SEMTRYWAIT AUE_NULL
|
||||
#define AUE_SEMWAIT AUE_NULL
|
||||
#define AUE_SETITIMER AUE_NULL
|
||||
#define AUE_SIGACTION AUE_NULL
|
||||
#define AUE_SIGALTSTACK AUE_NULL
|
||||
#define AUE_SIGPENDING AUE_NULL
|
||||
#define AUE_SIGPROCMASK AUE_NULL
|
||||
#define AUE_SIGRETURN AUE_NULL
|
||||
#define AUE_SIGSUSPEND AUE_NULL
|
||||
#define AUE_SIGWAIT AUE_NULL
|
||||
#define AUE_SSTK AUE_NULL
|
||||
#define AUE_STATV AUE_NULL
|
||||
#define AUE_SYNC AUE_NULL
|
||||
#define AUE_SYSCALL AUE_NULL
|
||||
#define AUE_TABLE AUE_NULL
|
||||
#define AUE_WAITEVENT AUE_NULL
|
||||
#define AUE_WATCHEVENT AUE_NULL
|
||||
|
||||
#endif /* !_BSM_AUDIT_KEVENTS_H_ */
|
||||
|
326
sys/bsm/audit_record.h
Normal file
326
sys/bsm/audit_record.h
Normal file
@ -0,0 +1,326 @@
|
||||
/*
|
||||
* Copyright (c) 2005 Apple Computer, Inc.
|
||||
* All rights reserved.
|
||||
*
|
||||
* @APPLE_BSD_LICENSE_HEADER_START@
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
* 3. Neither the name of Apple Computer, Inc. ("Apple") nor the names of
|
||||
* its contributors may be used to endorse or promote products derived
|
||||
* from this software without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
|
||||
* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
|
||||
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
|
||||
* DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
|
||||
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
|
||||
* (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
|
||||
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
|
||||
* ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
||||
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
|
||||
* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
*
|
||||
* @APPLE_BSD_LICENSE_HEADER_END@
|
||||
*
|
||||
* $P4: //depot/projects/trustedbsd/audit3/sys/bsm/audit_record.h#8 $
|
||||
* $FreeBSD$
|
||||
*/
|
||||
|
||||
#ifndef _BSM_AUDIT_RECORD_H_
|
||||
#define _BSM_AUDIT_RECORD_H_
|
||||
|
||||
/* Various token id types */
|
||||
|
||||
/*
|
||||
* Values inside the comments are not documented in the BSM pages and
|
||||
* have been picked up from the header files
|
||||
*/
|
||||
|
||||
/*
|
||||
* Values marked as XXX do not have a value defined in the BSM header files
|
||||
*/
|
||||
|
||||
#define AUT_INVALID 0x00
|
||||
#define AUT_OTHER_FILE32 0x11
|
||||
#define AUT_OHEADER 0x12
|
||||
#define AUT_TRAILER 0x13
|
||||
#define AUT_HEADER32 0x14
|
||||
#define AUT_HEADER32_EX 0x15
|
||||
#define AUT_DATA 0x21
|
||||
#define AUT_IPC 0x22
|
||||
#define AUT_PATH 0x23
|
||||
#define AUT_SUBJECT32 0x24
|
||||
#define AUT_SERVER32 0x25
|
||||
#define AUT_PROCESS32 0x26
|
||||
#define AUT_RETURN32 0x27
|
||||
#define AUT_TEXT 0x28
|
||||
#define AUT_OPAQUE 0x29
|
||||
#define AUT_IN_ADDR 0x2a
|
||||
#define AUT_IP 0x2b
|
||||
#define AUT_IPORT 0x2c
|
||||
#define AUT_ARG32 0x2d
|
||||
#define AUT_SOCKET 0x2e
|
||||
#define AUT_SEQ 0x2f
|
||||
#define AUT_ACL 0x30
|
||||
#define AUT_ATTR 0x31
|
||||
#define AUT_IPC_PERM 0x32
|
||||
#define AUT_LABEL 0x33
|
||||
#define AUT_GROUPS 0x34
|
||||
#define AUT_ILABEL 0x35
|
||||
#define AUT_SLABEL 0x36
|
||||
#define AUT_CLEAR 0x37
|
||||
#define AUT_PRIV 0x38
|
||||
#define AUT_UPRIV 0x39
|
||||
#define AUT_LIAISON 0x3a
|
||||
#define AUT_NEWGROUPS 0x3b
|
||||
#define AUT_EXEC_ARGS 0x3c
|
||||
#define AUT_EXEC_ENV 0x3d
|
||||
#define AUT_ATTR32 0x3e
|
||||
/* #define AUT_???? 0x3f */
|
||||
#define AUT_XATOM 0x40
|
||||
#define AUT_XOBJ 0x41
|
||||
#define AUT_XPROTO 0x42
|
||||
#define AUT_XSELECT 0x43
|
||||
/* XXXRW: Additional X11 tokens not defined? */
|
||||
#define AUT_CMD 0x51
|
||||
#define AUT_EXIT 0x52
|
||||
/* XXXRW: OpenBSM AUT_HOST 0x70? */
|
||||
#define AUT_ARG64 0x71
|
||||
#define AUT_RETURN64 0x72
|
||||
#define AUT_ATTR64 0x73
|
||||
#define AUT_HEADER64 0x74
|
||||
#define AUT_SUBJECT64 0x75
|
||||
#define AUT_SERVER64 0x76
|
||||
#define AUT_PROCESS64 0x77
|
||||
#define AUT_OTHER_FILE64 0x78
|
||||
#define AUT_HEADER64_EX 0x79
|
||||
#define AUT_SUBJECT32_EX 0x7a
|
||||
#define AUT_PROCESS32_EX 0x7b
|
||||
#define AUT_SUBJECT64_EX 0x7c
|
||||
#define AUT_PROCESS64_EX 0x7d
|
||||
#define AUT_IN_ADDR_EX 0x7e
|
||||
#define AUT_SOCKET_EX 0x7f
|
||||
|
||||
/*
|
||||
* Pre-64-bit BSM, 32-bit tokens weren't explicitly named as '32'. We have
|
||||
* compatibility defines.
|
||||
*/
|
||||
#define AUT_HEADER AUT_HEADER32
|
||||
#define AUT_ARG AUT_ARG32
|
||||
#define AUT_RETURN AUT_RETURN32
|
||||
#define AUT_SUBJECT AUT_SUBJECT32
|
||||
#define AUT_SERVER AUT_SERVER32
|
||||
#define AUT_PROCESS AUT_PROCESS32
|
||||
#define AUT_OTHER_FILE AUT_OTHER_FILE32
|
||||
|
||||
/*
|
||||
* Darwin's bsm distribution uses the following non-BSM token name defines.
|
||||
* We provide them for a single OpenBSM release for compatibility reasons.
|
||||
*/
|
||||
#define AU_FILE_TOKEN AUT_OTHER_FILE32
|
||||
#define AU_TRAILER_TOKEN AUT_TRAILER
|
||||
#define AU_HEADER_32_TOKEN AUT_HEADER32
|
||||
#define AU_DATA_TOKEN AUT_DATA
|
||||
#define AU_ARB_TOKEN AUT_DATA
|
||||
#define AU_IPC_TOKEN AUT_IPC
|
||||
#define AU_PATH_TOKEN AUT_PATH
|
||||
#define AU_SUBJECT_32_TOKEN AUT_SUBJECT32
|
||||
#define AU_PROCESS_32_TOKEN AUT_PROCESS32
|
||||
#define AU_RETURN_32_TOKEN AUT_RETURN32
|
||||
#define AU_TEXT_TOKEN AUT_TEXT
|
||||
#define AU_OPAQUE_TOKEN AUT_OPAQUE
|
||||
#define AU_IN_ADDR_TOKEN AUT_IN_ADDR
|
||||
#define AU_IP_TOKEN AUT_IP
|
||||
#define AU_IPORT_TOKEN AUT_IPORT
|
||||
#define AU_ARG32_TOKEN AUT_ARG32
|
||||
#define AU_SOCK_TOKEN AUT_SOCKET
|
||||
#define AU_SEQ_TOKEN AUT_SEQ
|
||||
#define AU_ATTR_TOKEN AUT_ATTR
|
||||
#define AU_IPCPERM_TOKEN AUT_IPC_PERM
|
||||
#define AU_NEWGROUPS_TOKEN AUT_NEWGROUPS
|
||||
#define AU_EXEC_ARG_TOKEN AUT_EXEC_ARGS
|
||||
#define AU_EXEC_ENV_TOKEN AUT_EXEC_ENV
|
||||
#define AU_ATTR32_TOKEN AUT_ATTR32
|
||||
#define AU_CMD_TOKEN AUT_CMD
|
||||
#define AU_EXIT_TOKEN AUT_EXIT
|
||||
#define AU_ARG64_TOKEN AUT_ARG64
|
||||
#define AU_RETURN_64_TOKEN AUT_RETURN64
|
||||
#define AU_ATTR64_TOKEN AUT_ATTR64
|
||||
#define AU_HEADER_64_TOKEN AUT_HEADER64
|
||||
#define AU_SUBJECT_64_TOKEN AUT_SUBJECT64
|
||||
#define AU_PROCESS_64_TOKEN AUT_PROCESS64
|
||||
#define AU_HEADER_64_EX_TOKEN AUT_HEADER64_EX
|
||||
#define AU_SUBJECT_32_EX_TOKEN AUT_SUBJECT32_EX
|
||||
#define AU_PROCESS_32_EX_TOKEN AUT_PROCESS32_EX
|
||||
#define AU_SUBJECT_64_EX_TOKEN AUT_SUBJECT64_EX
|
||||
#define AU_PROCESS_64_EX_TOKEN AUT_PROCESS64_EX
|
||||
#define AU_IN_ADDR_EX_TOKEN AUT_IN_ADDR_EX
|
||||
#define AU_SOCK_32_EX_TOKEN AUT_SOCKET_EX
|
||||
|
||||
/*
|
||||
* The values for the following token ids are not defined by BSM.
|
||||
*
|
||||
* XXXRW: Not sure how to handle these in OpenBSM yet, but I'll give them
|
||||
* names more consistent with Sun's BSM. These originally came from Apple's
|
||||
* BSM.
|
||||
*/
|
||||
#define AUT_SOCKINET32 0x80 /* XXX */
|
||||
#define AUT_SOCKINET128 0x81 /* XXX */
|
||||
#define AUT_SOCKUNIX 0x82 /* XXX */
|
||||
#define AU_SOCK_INET_32_TOKEN AUT_SOCKINET32
|
||||
#define AU_SOCK_INET_128_TOKEN AUT_SOCKINET128
|
||||
#define AU_SOCK_UNIX_TOKEN AUT_SOCKUNIX
|
||||
|
||||
/* print values for the arbitrary token */
|
||||
#define AUP_BINARY 0
|
||||
#define AUP_OCTAL 1
|
||||
#define AUP_DECIMAL 2
|
||||
#define AUP_HEX 3
|
||||
#define AUP_STRING 4
|
||||
|
||||
/* data-types for the arbitrary token */
|
||||
#define AUR_BYTE 0
|
||||
#define AUR_SHORT 1
|
||||
#define AUR_LONG 2
|
||||
|
||||
/* ... and their sizes */
|
||||
#define AUR_BYTE_SIZE sizeof(u_char)
|
||||
#define AUR_SHORT_SIZE sizeof(uint16_t)
|
||||
#define AUR_LONG_SIZE sizeof(uint32_t)
|
||||
|
||||
/* Modifiers for the header token */
|
||||
#define PAD_NOTATTR 0x4000 /* nonattributable event */
|
||||
#define PAD_FAILURE 0x8000 /* fail audit event */
|
||||
|
||||
|
||||
#define BSM_MAX_GROUPS 16
|
||||
#define HEADER_VERSION 1
|
||||
|
||||
/*
|
||||
* BSM define is AUT_TRAILER_MAGIC; Apple BSM define is TRAILER_PAD_MAGIC; we
|
||||
* split the difference, will remove the Apple define for the next release.
|
||||
*/
|
||||
#define AUT_TRAILER_MAGIC 0xb105
|
||||
#define TRAILER_PAD_MAGIC AUT_TRAILER_MAGIC
|
||||
|
||||
/* BSM library calls */
|
||||
|
||||
__BEGIN_DECLS
|
||||
|
||||
struct in_addr;
|
||||
struct in6_addr;
|
||||
struct ip;
|
||||
struct ipc_perm;
|
||||
struct kevent;
|
||||
struct sockaddr_in;
|
||||
struct sockaddr_in6;
|
||||
struct sockaddr_un;
|
||||
#if defined(_KERNEL) || defined(KERNEL)
|
||||
struct vnode_au_info;
|
||||
#endif
|
||||
|
||||
int au_open(void);
|
||||
int au_write(int d, token_t *m);
|
||||
int au_close(int d, int keep, short event);
|
||||
int au_close_buffer(int d, short event, u_char *buffer, size_t *buflen);
|
||||
|
||||
#if defined(KERNEL) || defined(_KERNEL)
|
||||
token_t *au_to_file(char *file, struct timeval tm);
|
||||
#else
|
||||
token_t *au_to_file(char *file);
|
||||
#endif
|
||||
|
||||
#if defined(KERNEL) || defined(_KERNEL)
|
||||
token_t *au_to_header(int rec_size, au_event_t e_type, au_emod_t e_mod,
|
||||
struct timeval tm);
|
||||
token_t *au_to_header32(int rec_size, au_event_t e_type, au_emod_t e_mod,
|
||||
struct timeval tm);
|
||||
#else
|
||||
token_t *au_to_header(int rec_size, au_event_t e_type, au_emod_t e_mod);
|
||||
token_t *au_to_header32(int rec_size, au_event_t e_type, au_emod_t e_mod);
|
||||
#endif
|
||||
|
||||
token_t *au_to_header64(int rec_size, au_event_t e_type, au_emod_t e_mod);
|
||||
token_t *au_to_me(void);
|
||||
token_t *au_to_arg(char n, char *text, uint32_t v);
|
||||
token_t *au_to_arg32(char n, char *text, uint32_t v);
|
||||
token_t *au_to_arg64(char n, char *text, uint64_t v);
|
||||
|
||||
#if defined(_KERNEL) || defined(KERNEL)
|
||||
token_t *au_to_attr(struct vnode_au_info *vni);
|
||||
token_t *au_to_attr32(struct vnode_au_info *vni);
|
||||
token_t *au_to_attr64(struct vnode_au_info *vni);
|
||||
#endif
|
||||
|
||||
token_t *au_to_data(char unit_print, char unit_type, char unit_count,
|
||||
char *p);
|
||||
token_t *au_to_exit(int retval, int err);
|
||||
token_t *au_to_groups(int *groups);
|
||||
token_t *au_to_newgroups(uint16_t n, gid_t *groups);
|
||||
token_t *au_to_in_addr(struct in_addr *internet_addr);
|
||||
token_t *au_to_in_addr_ex(struct in6_addr *internet_addr);
|
||||
token_t *au_to_ip(struct ip *ip);
|
||||
token_t *au_to_ipc(char type, int id);
|
||||
token_t *au_to_ipc_perm(struct ipc_perm *perm);
|
||||
token_t *au_to_iport(uint16_t iport);
|
||||
token_t *au_to_opaque(char *data, uint16_t bytes);
|
||||
token_t *au_to_path(char *path);
|
||||
token_t *au_to_process(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
|
||||
gid_t rgid, pid_t pid, au_asid_t sid, au_tid_t *tid);
|
||||
token_t *au_to_process32(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
|
||||
gid_t rgid, pid_t pid, au_asid_t sid, au_tid_t *tid);
|
||||
token_t *au_to_process64(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
|
||||
gid_t rgid, pid_t pid, au_asid_t sid, au_tid_t *tid);
|
||||
token_t *au_to_process_ex(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
|
||||
gid_t rgid, pid_t pid, au_asid_t sid, au_tid_addr_t *tid);
|
||||
token_t *au_to_process32_ex(au_id_t auid, uid_t euid, gid_t egid,
|
||||
uid_t ruid, gid_t rgid, pid_t pid, au_asid_t sid,
|
||||
au_tid_addr_t *tid);
|
||||
token_t *au_to_process64_ex(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
|
||||
gid_t rgid, pid_t pid, au_asid_t sid, au_tid_addr_t *tid);
|
||||
token_t *au_to_return(char status, uint32_t ret);
|
||||
token_t *au_to_return32(char status, uint32_t ret);
|
||||
token_t *au_to_return64(char status, uint64_t ret);
|
||||
token_t *au_to_seq(long audit_count);
|
||||
|
||||
#if defined(_KERNEL) || defined(KERNEL)
|
||||
token_t *au_to_socket(struct socket *so);
|
||||
token_t *au_to_socket_ex_32(uint16_t lp, uint16_t rp, struct sockaddr *la,
|
||||
struct sockaddr *ta);
|
||||
token_t *au_to_socket_ex_128(uint16_t lp, uint16_t rp, struct sockaddr *la,
|
||||
struct sockaddr *ta);
|
||||
#endif
|
||||
|
||||
token_t *au_to_sock_inet(struct sockaddr_in *so);
|
||||
token_t *au_to_sock_inet32(struct sockaddr_in *so);
|
||||
token_t *au_to_sock_inet128(struct sockaddr_in6 *so);
|
||||
token_t *au_to_sock_unix(struct sockaddr_un *so);
|
||||
token_t *au_to_subject(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
|
||||
gid_t rgid, pid_t pid, au_asid_t sid, au_tid_t *tid);
|
||||
token_t *au_to_subject32(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
|
||||
gid_t rgid, pid_t pid, au_asid_t sid, au_tid_t *tid);
|
||||
token_t *au_to_subject64(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
|
||||
gid_t rgid, pid_t pid, au_asid_t sid, au_tid_t *tid);
|
||||
token_t *au_to_subject_ex(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
|
||||
gid_t rgid, pid_t pid, au_asid_t sid, au_tid_addr_t *tid);
|
||||
token_t *au_to_subject32_ex(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
|
||||
gid_t rgid, pid_t pid, au_asid_t sid, au_tid_addr_t *tid);
|
||||
token_t *au_to_subject64_ex(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
|
||||
gid_t rgid, pid_t pid, au_asid_t sid, au_tid_addr_t *tid);
|
||||
token_t *au_to_exec_args(const char **);
|
||||
token_t *au_to_exec_env(const char **);
|
||||
token_t *au_to_text(char *text);
|
||||
token_t *au_to_kevent(struct kevent *kev);
|
||||
token_t *au_to_trailer(int rec_size);
|
||||
|
||||
__END_DECLS
|
||||
|
||||
#endif /* ! _BSM_AUDIT_RECORD_H_ */
|
Loading…
Reference in New Issue
Block a user