bsd/bsm/audit_klib.h

   1 /*
   2  * @APPLE_LICENSE_HEADER_START@
   3  *
   4  * This file contains Original Code and/or Modifications of Original Code
   5  * as defined in and that are subject to the Apple Public Source License
   6  * Version 2.0 (the 'License'). You may not use this file except in
   7  * compliance with the License. Please obtain a copy of the License at
   8  * http://www.opensource.apple.com/apsl/ and read it before using this
   9  * file.
  10  *
  11  * The Original Code and all software distributed under the License are
  12  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  13  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  14  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  15  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  16  * Please see the License for the specific language governing rights and
  17  * limitations under the License.
  18  *
  19  * @APPLE_LICENSE_HEADER_END@
  20  */
  21
  22 #ifndef _BSM_AUDIT_KLIB_H_
  23 #define _BSM_AUDIT_KLIB_H_
  24
  25 #define AU_PRS_SUCCESS  1
  26 #define AU_PRS_FAILURE  2
  27 #define AU_PRS_BOTH     (AU_PRS_SUCCESS|AU_PRS_FAILURE)
  28
  29 #ifdef KERNEL
  30 #include <bsm/audit_kernel.h>
  31 /*
  32  * Some of the BSM tokenizer functions take different parameters in the
  33  * kernel implementations in order to save the copying of large kernel
  34  * data structures. The prototypes of these functions are declared here.
  35  */
  36 token_t *kau_to_socket(struct socket_au_info *soi);
  37 token_t *kau_to_attr32(struct vnode_au_info *vni);
  38 token_t *kau_to_attr64(struct vnode_au_info *vni);
  39 int auditon_command_event(int cmd);
  40 int au_preselect(au_event_t event, au_mask_t *mask_p, int sorf);
  41 au_event_t flags_and_error_to_openevent(int oflags, int error);
  42 au_event_t ctlname_to_sysctlevent(int name[], uint64_t valid_arg);
  43 au_event_t msgctl_to_event(int cmd);
  44 au_event_t semctl_to_event(int cmd);
  45 void au_evclassmap_init(void);
  46 void au_evclassmap_insert(au_event_t event, au_class_t class);
  47 au_class_t au_event_class(au_event_t event);
  48
  49 int canon_path(struct proc *p, char *path, char *cpath);
  50
  51
  52
  53
  54 /*
  55  * Define a system call to audit event mapping table.
  56  */
  57 extern au_event_t sys_au_event[];
  58 extern int nsys_au_event;       /* number of entries in this table */
  59
  60 #endif /*KERNEL*/
  61
  62 #endif /* ! _BSM_AUDIT_KLIB_H_ */