xnu-6153.41.3.tar.gz

[apple/xnu.git] / bsd / security / audit / audit.h

diff --git a/bsd/security/audit/audit.h b/bsd/security/audit/audit.h
index 13a1b8c248a544a45757fcdd6a20661e2290596a..90309907475bb9cb227cc8f0ccfbd05ee60c1e61 100644 (file)
--- a/bsd/security/audit/audit.h
+++ b/bsd/security/audit/audit.h
@@ -1,5 +1,5 @@
 /*-
- * Copyright (c) 2004-2016 Apple Inc.
+ * Copyright (c) 2004-2019 Apple Inc.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -172,6 +172,11 @@ void    audit_syscall_exit(int error, struct proc *proc,
 void    audit_mach_syscall_enter(unsigned short audit_event);
 void    audit_mach_syscall_exit(int retval, struct uthread *uthread);
 
+void                    audit_subcall_enter(au_event_t event,
+    struct proc *proc, struct uthread *uthread);
+void                    audit_subcall_exit(int error,
+    struct uthread *uthread);
+
 extern struct auditinfo_addr *audit_default_aia_p;
 
 /*
@@ -349,6 +354,16 @@ extern au_event_t sys_au_event[];
                        audit_syscall_exit(code, error, proc, uthread); \
 } while (0)
 
+#define AUDIT_SUBCALL_ENTER(event, proc, uthread)  do {                 \
+       if (AUDIT_ENABLED())                                            \
+               audit_subcall_enter(AUE_ ## event, proc, uthread);      \
+} while (0)
+
+#define AUDIT_SUBCALL_EXIT(uthread, error)  do {                        \
+               if (AUDIT_AUDITING(uthread->uu_ar))                     \
+                       audit_subcall_exit(error, uthread);             \
+} while (0)
+
 /*
  * Wrap the audit_mach_syscall_enter() and audit_mach_syscall_exit()
  * functions in a manner similar to other system call enter/exit functions.
@@ -390,6 +405,12 @@ extern au_event_t sys_au_event[];
 #define AUDIT_SYSCALL_EXIT(code, proc, uthread, error)  do {            \
 } while (0)
 
+#define AUDIT_SUBCALL_ENTER(event, proc, uthread)    do {               \
+} while (0)
+
+#define AUDIT_SUBCALL_EXIT(uthread, error)  do {                        \
+} while (0)
+
 #define AUDIT_MACH_SYSCALL_ENTER(args...)       do {                    \
 } while (0)