]> git.saurik.com Git - apple/xnu.git/blame - bsd/man/man2/audit.2
xnu-1228.9.59.tar.gz
[apple/xnu.git] / bsd / man / man2 / audit.2
CommitLineData
2d21ac55
A
1.\"
2.\" Copyright (c) 2007 Apple Inc. All rights reserved.
3.\"
4.\" @APPLE_LICENSE_HEADER_START@
5.\"
6.\" This file contains Original Code and/or Modifications of Original Code
7.\" as defined in and that are subject to the Apple Public Source License
8.\" Version 2.0 (the 'License'). You may not use this file except in
9.\" compliance with the License. Please obtain a copy of the License at
10.\" http://www.opensource.apple.com/apsl/ and read it before using this
11.\" file.
12.\"
13.\" The Original Code and all software distributed under the License are
14.\" distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
15.\" EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
16.\" INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
17.\" FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
18.\" Please see the License for the specific language governing rights and
19.\" limitations under the License.
20.\"
21.\" @APPLE_LICENSE_HEADER_END@
22.\"
23.Dd July 30, 2007
24.Dt AUDIT 2
25.Os Darwin
26.Sh NAME
27.Nm audit
28.Nd submit a record to the kernel for auditing
29.Sh SYNOPSIS
30.Fd #include <bsm/audit.h>
31.Ft int
32.Fn audit "const void * record" "int length"
33.Sh DESCRIPTION
34The
35.Fn audit
36function submits a record to the kernel for inclusion in the global audit
37trail. The record must already be in BSM format. To protect the integrity
38of the audit trail, this system call must be made with sufficient privileges.
39.Fa Libbsm
40can be used to create and manipulate BSM data.
41.Fa Length
42is the length in bytes of the BSM record and
43.Fa record
44points to the data.
45.Sh RETURN VALUES
46Upon successful completion a value of 0 is returned.
47Otherwise, a value of -1 is returned and
48.Va errno
49is set to indicate the error.
50.Sh ERRORS
51.Bl -tag -width Er
52The
53.Fn audit
54system call will fail if:
55.\" ===========
56.It Bq Er EINVAL
57.Fa Length
58is greater than MAX_AUDIT_RECORD_SIZE, less than zero, greater than the
59internal buffer size, or the record fails verification.
60.\" ===========
61.It Bq Er ENOTSUP
62The security auditing service is not available.
63.\" ===========
64.It Bq Er EPERM
65The call was made with insufficient privileges to complete.
66.\" ===========
67.El
68.Sh SEE ALSO
69.Xr auditon 2 ,
70.Xr auditctl 2 ,
71.Xr getauid 2 ,
72.Xr setauid 2 ,
73.Xr getaudit 2 ,
74.Xr setaudit 2
75.Sh HISTORY
76The
77.Fn audit
78function call first appeared in Mac OS X 10.3 (Panther).