xnu-3789.60.24.tar.gz

[apple/xnu.git] / bsd / security / audit / audit_private.h

diff --git a/bsd/security/audit/audit_private.h b/bsd/security/audit/audit_private.h
index 803a2b93659e7a2c4eabc4340c709337d397423b..8a5a556d8df98db0ca69725a71279b4b004b503d 100644 (file)
--- a/bsd/security/audit/audit_private.h
+++ b/bsd/security/audit/audit_private.h
@@ -1,5 +1,5 @@
 /*-
 /*-

- * Copyright (c) 1999-2009 Apple Inc.
+ * Copyright (c) 1999-2016 Apple Inc.

  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without


@@ -113,6 +113,8 @@ extern au_class_t           audit_kevent_mask;
 #define        AR_PRESELECT_USER_TRAIL 0x00004000U
 #define        AR_PRESELECT_USER_PIPE  0x00008000U
 
 #define        AR_PRESELECT_USER_TRAIL 0x00004000U
 #define        AR_PRESELECT_USER_PIPE  0x00008000U
 

+#define        AR_PRESELECT_FILTER     0x00010000U
+

 #define        AR_DRAIN_QUEUE          0x80000000U
 
 /*
 #define        AR_DRAIN_QUEUE          0x80000000U
 
 /*


@@ -171,6 +173,7 @@ union auditon_udata {
        int                     au_trigger;
        au_evclass_map_t        au_evclass;
        au_mask_t               au_mask;
        int                     au_trigger;
        au_evclass_map_t        au_evclass;
        au_mask_t               au_mask;

+       au_asflgs_t             au_flags;

        auditinfo_t             au_auinfo;
        auditpinfo_t            au_aupinfo;
        auditpinfo_addr_t       au_aupinfo_addr;
        auditinfo_t             au_auinfo;
        auditpinfo_t            au_aupinfo;
        auditpinfo_addr_t       au_aupinfo_addr;


@@ -271,6 +274,7 @@ struct audit_record {
        int                     ar_arg_exitstatus;
        int                     ar_arg_exitretval;
        struct sockaddr_storage ar_arg_sockaddr;
        int                     ar_arg_exitstatus;
        int                     ar_arg_exitretval;
        struct sockaddr_storage ar_arg_sockaddr;

+       int                     ar_arg_fd2;

 
 #if CONFIG_MACF
        /*
 
 #if CONFIG_MACF
        /*


@@ -386,6 +390,10 @@ au_event_t  audit_ctlname_to_sysctlevent(int name[], uint64_t valid_arg);
 au_event_t      audit_flags_and_error_to_openevent(int oflags, int error);
 au_event_t      audit_flags_and_error_to_openextendedevent(int oflags,
                    int error);
 au_event_t      audit_flags_and_error_to_openevent(int oflags, int error);
 au_event_t      audit_flags_and_error_to_openextendedevent(int oflags,
                    int error);

+au_event_t      audit_flags_and_error_to_openatevent(int oflags,
+                   int error);
+au_event_t      audit_flags_and_error_to_openbyidevent(int oflags,
+                   int error);

 au_event_t      audit_msgctl_to_event(int cmd);
 au_event_t      audit_semctl_to_event(int cmr);
 int             audit_canon_path(struct vnode *cwd_vp, char *path,
 au_event_t      audit_msgctl_to_event(int cmd);
 au_event_t      audit_semctl_to_event(int cmr);
 int             audit_canon_path(struct vnode *cwd_vp, char *path,


@@ -440,7 +448,7 @@ int audit_mac_syscall_exit(unsigned short code, struct uthread *uthread,
  * Audit Session.
  */
 void   audit_session_init(void);
  * Audit Session.
  */
 void   audit_session_init(void);

-int    audit_session_setaia(proc_t p, auditinfo_addr_t *aia_p, int newprocess);
+int    audit_session_setaia(proc_t p, auditinfo_addr_t *aia_p);

 auditinfo_addr_t *audit_session_update(auditinfo_addr_t *new_aia);
 int    audit_session_lookup(au_asid_t asid, auditinfo_addr_t *ret_aia);
 
 auditinfo_addr_t *audit_session_update(auditinfo_addr_t *new_aia);
 int    audit_session_lookup(au_asid_t asid, auditinfo_addr_t *ret_aia);