NAME audit_set_backlog_wait_time – Set the audit backlog wait time SYNOPSIS #include <libaudit.h> int audit_set_backlog_wait_time (int fd, int wait_time); DESCRIPTION audit_set_backlog_wait_time sets the time that the kernel will wait before attempting to send more audit events to be transferred to the audit daemon when the backlog_limit is reached. This gives the audit daemon a chance to…
NAME audit_set_backlog_limit – Set the audit backlog limit SYNOPSIS #include <libaudit.h> int audit_set_backlog_limit (int fd, int limit); DESCRIPTION audit_set_backlog_limit sets the queue length for audit events awaiting transfer to the audit daemon. The default value is 64 which can potentially be overrun by bursts of activity. When the backlog limit is reached, the kernel consults…
NAME audit_request_status – Request status of the audit system SYNOPSIS #include <libaudit.h> int audit_request_status (int fd); DESCRIPTION audit_request_status requests that the kernel send status structure describing various settings. The audit_status structure is as follows: struct audit_status { __u32 mask; /* Bit mask for valid entries */ __u32 enabled; /* 1 = enabled, 0 = disabled…
NAME audit_request_signal_info – Request signal info for the audit system SYNOPSIS #include <libaudit.h> int audit_request_signal_info(int fd); DESCRIPTION audit_request_signal_info requests that the kernel send information about the sender of a signal to the audit daemon. The sinal info structure is as follows: struct audit_sig_info { uid_t uid; pid_t pid; char ctx[0]; }; This function is likely…
NAME audit_request_rules_list_data – Request list of current audit rules SYNOPSIS #include <libaudit.h> int audit_request_rules_list_data (int fd); DESCRIPTION audit_request_rules_list_data sends a request to the kernel to list the current audit rules. The rules are sent back one after another after this request is issued. RETURN VALUE The return value is <= 0 on error, otherwise it…
NAME audit_open – Open a audit netlink socket connection SYNOPSIS #include <libaudit.h> int audit_open (void); DESCRIPTION audit_open creates a NETLINK_AUDIT socket for communication with the kernel part of the Linux Audit Subsystem. The audit system uses the ACK feature of netlink. This means that every message to the kernel will return a netlink status packet…
NAME audit_log_user_semanage_message – log a semanage message SYNOPSIS #include <libaudit.h> int audit_log_user_semanage_message(int audit_fd, int type, const char *pgname, const char *op, const char *name, unsigned int id, const char *new_seuser, const char *new_role, const char *new_range, const char *old_seuser, const char *old_role, const char *old_range, const char *host, const char *addr, const char *tty, int…
NAME audit_log_user_message – log a general user message SYNOPSIS #include <libaudit.h> int audit_log_user_message(int audit_fd, int type, const char *message, const char *hostname, const char *addr, const char *tty, int result) DESCRIPTION This function will log a message to the audit system using a predefined message format. This function should be used by all ELF console…
NAME audit_log_user_command – log a user command SYNOPSIS #include <libaudit.h> int audit_log_user_command(int audit_fd, int type, const char *command, const char *tty, int result); DESCRIPTION This function will log a command to the audit system using a predefined message format. It encodes the command as the audit system expects for untrusted strings. This function should be…
NAME audit_log_user_comm_message – log a user message from a console app SYNOPSIS #include <libaudit.h> int audit_log_user_comm_message(int audit_fd, int type, const char *message, const char *comm, const char *hostname, const char *addr, const char *tty, int result) DESCRIPTION This function will log a message to the audit system using a predefined message format. This function should…
NAME audit_log_user_avc_message – log a user avc message SYNOPSIS #include <libaudit.h> int audit_log_user_avc_message(int audit_fd, int type, const char *message, const char *hostname, const char *addr, const char *tty, uid_t uid) DESCRIPTION This function will log a message to the audit system using a predefined message format. This function should be used by all apps that…
NAME audit_log_semanage_message – log a semanage message SYNOPSIS #include <libaudit.h> int audit_log_semanage_message(int audit_fd, int type, const char *pgname, const char *op, const char *name, unsigned int id, const char *new_seuser, const char *new_role, const char *new_range, const char *old_seuser, const char *old_role, const char *old_range, const char *host, const char *addr, const char *tty, int…
NAME audit_log_acct_message – log a user account message SYNOPSIS #include <libaudit.h> int audit_log_acct_message(int audit_fd, int type, const char *pgname, const char *op, const char *name, unsigned int id, const char *host, const char *addr, const char *tty, int result) DESCRIPTION This function will log a message to the audit system using a predefined message format….
NAME audit_getloginuid – Get a program’s loginuid value SYNOPSIS #include <libaudit.h> uid_t audit_getloginuid(void); DESCRIPTION This function returns the task attribute loginuid. RETURN VALUE This function returns the loginuid value if it was set. It will return a -1 if loginuid was unset. However, since uid_t is an unsigned type, you will see the converted value…
NAME audit_getloginuid – Get a program’s login session id value SYNOPSIS #include <libaudit.h> uin32_t audit_get_session(void); DESCRIPTION This function returns the task’s session id attribute. RETURN VALUE This function returns the session id value if it was set. It will return a -1 if the session id is unset. However, since uint32_t is an unsigned type,…
NAME audit_get_reply – Get the audit system’s reply SYNOPSIS #include <libaudit.h> int audit_get_reply(int fd, struct audit_reply *rep, reply_t block, int peek); DESCRIPTION This function gets the next data packet sent on the audit netlink socket. This function is usually called after sending a command to the audit system. fd should be an open file descriptor…
NAME audit_encode_nv_string – encode a name/value pair in a string SYNOPSIS #include <libaudit.h> char *audit_encode_nv_string(const char *name, const char *value, unsigned int vlen) DESCRIPTION This function is used to encode a name/value pair. This should be used on any field being logged that potentially contains a space, a double-quote, or a control character. Any value…
NAME audit_detect_machine – Detects the current machine type SYNOPSIS #include <libaudit.h> int audit_detect_machine (void); DESCRIPTION audit_detect_machine queries uname and converts the kernel machine string to an enum value defined in machine_t. The machine type is needed for any use of the audit_name_to_syscall function. RETURN VALUE Returns -1 if an error occurs; otherwise, the return value…
NAME audit_delete_rule_data – Delete audit rule SYNOPSIS #include <libaudit.h> int audit_delete_rule_data (int fd, struct audit_rule_data *rule, int flags, int action); DESCRIPTION audit_delete_rule_data is used to delete rules that are currently loaded in the kernel. To delete a rule, you must set up the rules identical to the one being deleted. See audit_add_rule_data for flag and…
NAME audit_add_watch – create a rule layout for a watch SYNOPSIS #include <libaudit.h> int audit_add_watch(struct audit_rule_data **rulep, const char *path); DESCRIPTION audit_add_watch will create a watch rule in the pointer to a pointer rulep. All that you need to pass it is the full path to a file and it will initialize the audit_rule_data structure…