Section 3: library functions
NAME auparse_first_field – reposition field cursor SYNOPSIS #include <auparse.h> int auparse_first_field(auparse_state_t *au); DESCRIPTION auparse_first_field repositions the library’s internal cursor to point to the first field of the current record in the current event. RETURN VALUE Returns 0 if there is no event data; otherwise, 1 for success. SEE ALSO auparse_next_field(3). AUTHOR Steve Grubb Index
NAME auparse_find_field_next – find next occurrence of field name SYNOPSIS #include <auparse.h> const char *auparse_find_field_next(auparse_state_t *au); DESCRIPTION auparse_find_field_next finds the next occurrence of the previously stored field name. It will scan until it reaches the last record of the current event. RETURN VALUE Returns NULL field not found. If an error occurs errno will be…
NAME auparse_find_field – search for field name SYNOPSIS #include <auparse.h> const char *auparse_find_field(auparse_state_t *au, const char *name); DESCRIPTION auparse_find_field will scan all records in an event to find the first occurrence of the field name passed to it. Searching begins from the cursor’s current position. The field name is stored for subsequent searching. RETURN VALUE…
NAME auparse_feed_has_data – check if there is any data accumulating that might need flushing. SYNOPSIS #include <auparse.h> int auparse_feed_has_data(const auparse_state_t *au); DESCRIPTION auparse_feed_has_data may be called to determine if there is any records that are accumulating but not yet ready to emit. RETURN VALUE Returns 1 if any records are accumulating otherwise 0 if empty….
NAME auparse_feed_age_events – check events for complete based on time. SYNOPSIS #include <auparse.h> void auparse_feed_age_events(auparse_state_t *au); DESCRIPTION auparse_feed_age_events should be called to see if any events are complete based on the current clock time. Any newly complete events will be passed to the callback function. RETURN VALUE None. SEE ALSO auparse_feed(3), auparse_flush_feed(3), auparse_feed_has_data(3) AUTHOR Steve…
NAME auparse_feed – feed data into parser SYNOPSIS #include <auparse.h> int auparse_feed(auparse_state_t *au, const char *data, size_t data_len); au The audit parse state data a buffer of data to feed into the parser, it is data_len bytes long. The data is copied in the parser, upon return the caller may free or reuse the data…
NAME auparse_destroy – release instance of parser SYNOPSIS #include <auparse.h> void auparse_destroy (auparse_state_t *au); void auparse_destroy_ext (auparse_state_t *au, auparse_destroy_what_t what); DESCRIPTION auparse_destroy frees all data structures and closes file descriptors. auparse_destroy_ext frees data structures based on what. What can be AUPARSE_DESTROY_ALL to release everything or AUPARSE_DESTROY_COMMON to release everything but the uid and gid lookup…
NAME auparse_add_callback – add a callback handler for notifications SYNOPSIS #include <auparse.h> void auparse_add_callback(auparse_state_t *au, auparse_callback_ptr callback, void *user_data, user_destroy user_destroy_func); DESCRIPTION auparse_add_callback adds a callback function to the parse state which is invoked to notify the application of parsing events. This is part of the event feed API. The signature of the callback is:…
NAME audit_update_watch_perms – update permissions field of watch command SYNOPSIS #include <libaudit.h> int audit_update_watch_perms(struct audit_rule_data *rule, int perms); DESCRIPTION audit_update_watch_perms adds the permission checks to a watch command that is being built. The perms are a bitwise or’ing of: AUDIT_PERM_EXEC, AUDIT_PERM_WRITE, AUDIT_PERM_READ, AUDIT_PERM_ATTR. RETURN VALUE Returns a number < 0 if an error occurs; otherwise,…
NAME audit_setloginuid – Set a program’s loginuid value SYNOPSIS #include <libaudit.h> int audit_setloginuid(uid_t uid); DESCRIPTION This function sets the task attribute loginuid with the value of uid. The loginuid value may only be set by programs with the CAP_AUDIT_CONTROL capability. This normally means the root account. The loginuid value is part of the task structure…
NAME audit_set_rate_limit – Set audit rate limit SYNOPSIS #include <libaudit.h> int audit_set_rate_limit (int fd, int limit); DESCRIPTION audit_set_rate_limit will set the maximum number of messages that the kernel will send per second. This can be used to throttle the rate if systems become unresponsive. Of course the trade off is that events will be dropped….
NAME audit_set_pid – Set audit daemon process ID SYNOPSIS #include <libaudit.h> int audit_set_pid (int fd, int pid); DESCRIPTION audit_set_pid tells the kernel what the pid is of the audit daemon. When the pid is set to 0, the kernel will log all events to syslog. Otherwise it will try to send events to the netlink…
NAME audit_set_failure – Set audit failure flag SYNOPSIS #include <libaudit.h> int audit_set_failure(int fd, int failure); DESCRIPTION audit_set_failure sets the action that the kernel will perform when the backlog limit is reached or when it encounters an error and cannot proceed. Possible values are: 0 – AUDIT_FAIL_SILENT Do nothing, report nothing, skip logging the record and…
NAME audit_set_enabled – Enable or disable auditing SYNOPSIS #include <libaudit.h> int audit_set_enabled (int fd, int enabled); DESCRIPTION audit_set_enabled is used to control whether or not the audit system is active. When the audit system is enabled (enabled set to 1), every syscall will pass through the audit system to collect information and potentially trigger an…
NAME audit_set_backlog_wait_time – Set the audit backlog wait time SYNOPSIS #include <libaudit.h> int audit_set_backlog_wait_time (int fd, int wait_time); DESCRIPTION audit_set_backlog_wait_time sets the time that the kernel will wait before attempting to send more audit events to be transferred to the audit daemon when the backlog_limit is reached. This gives the audit daemon a chance to…
NAME audit_set_backlog_limit – Set the audit backlog limit SYNOPSIS #include <libaudit.h> int audit_set_backlog_limit (int fd, int limit); DESCRIPTION audit_set_backlog_limit sets the queue length for audit events awaiting transfer to the audit daemon. The default value is 64 which can potentially be overrun by bursts of activity. When the backlog limit is reached, the kernel consults…
NAME audit_request_status – Request status of the audit system SYNOPSIS #include <libaudit.h> int audit_request_status (int fd); DESCRIPTION audit_request_status requests that the kernel send status structure describing various settings. The audit_status structure is as follows: struct audit_status { __u32 mask; /* Bit mask for valid entries */ __u32 enabled; /* 1 = enabled, 0 = disabled…
NAME audit_request_signal_info – Request signal info for the audit system SYNOPSIS #include <libaudit.h> int audit_request_signal_info(int fd); DESCRIPTION audit_request_signal_info requests that the kernel send information about the sender of a signal to the audit daemon. The sinal info structure is as follows: struct audit_sig_info { uid_t uid; pid_t pid; char ctx[0]; }; This function is likely…
NAME audit_request_rules_list_data – Request list of current audit rules SYNOPSIS #include <libaudit.h> int audit_request_rules_list_data (int fd); DESCRIPTION audit_request_rules_list_data sends a request to the kernel to list the current audit rules. The rules are sent back one after another after this request is issued. RETURN VALUE The return value is <= 0 on error, otherwise it…
NAME audit_open – Open a audit netlink socket connection SYNOPSIS #include <libaudit.h> int audit_open (void); DESCRIPTION audit_open creates a NETLINK_AUDIT socket for communication with the kernel part of the Linux Audit Subsystem. The audit system uses the ACK feature of netlink. This means that every message to the kernel will return a netlink status packet…