bsd/bsm/audit_klib.h

   1 /*
   2  * @APPLE_BSD_LICENSE_HEADER_START@
   3  *
   4  * Redistribution and use in source and binary forms, with or without
   5  * modification, are permitted provided that the following conditions
   6  * are met:
   7  *
   8  * 1.  Redistributions of source code must retain the above copyright
   9  *     notice, this list of conditions and the following disclaimer.
  10  * 2.  Redistributions in binary form must reproduce the above copyright
  11  *     notice, this list of conditions and the following disclaimer in the
  12  *     documentation and/or other materials provided with the distribution.
  13  * 3.  Neither the name of Apple Inc. ("Apple") nor the names of its
  14  *     contributors may be used to endorse or promote products derived from
  15  *     this software without specific prior written permission.
  16  *
  17  * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
  18  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
  19  * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
  20  * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
  21  * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
  22  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  23  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
  24  * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  25  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  26  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  27  *
  28  * @APPLE_BSD_LICENSE_HEADER_END@
  29  */
  30
  31 #ifndef _BSM_AUDIT_KLIB_H_
  32 #define _BSM_AUDIT_KLIB_H_
  33
  34 #define AU_PRS_SUCCESS  1
  35 #define AU_PRS_FAILURE  2
  36 #define AU_PRS_BOTH     (AU_PRS_SUCCESS|AU_PRS_FAILURE)
  37
  38 #ifdef KERNEL
  39 #include <bsm/audit_kernel.h>
  40 /*
  41  * Some of the BSM tokenizer functions take different parameters in the
  42  * kernel implementations in order to save the copying of large kernel
  43  * data structures. The prototypes of these functions are declared here.
  44  */
  45 token_t *kau_to_socket(struct socket_au_info *soi);
  46 token_t *kau_to_attr32(struct vnode_au_info *vni);
  47 token_t *kau_to_attr64(struct vnode_au_info *vni);
  48 int auditon_command_event(int cmd);
  49 int au_preselect(au_event_t event, au_mask_t *mask_p, int sorf);
  50 au_event_t flags_and_error_to_openevent(int oflags, int error);
  51 au_event_t ctlname_to_sysctlevent(int name[], uint64_t valid_arg);
  52 au_event_t msgctl_to_event(int cmd);
  53 au_event_t semctl_to_event(int cmd);
  54 void au_evclassmap_init(void);
  55 void au_evclassmap_insert(au_event_t event, au_class_t class);
  56 au_class_t au_event_class(au_event_t event);
  57
  58 int canon_path(struct proc *p, char *path, char *cpath);
  59
  60
  61
  62
  63 /*
  64  * Define a system call to audit event mapping table.
  65  */
  66 extern au_event_t sys_au_event[];
  67 extern int nsys_au_event;       /* number of entries in this table */
  68
  69 #endif /*KERNEL*/
  70
  71 #endif /* ! _BSM_AUDIT_KLIB_H_ */