auditd_lib.h revision 293161 
1/*-
2 * Copyright (c) 2008 Apple Inc.
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1.  Redistributions of source code must retain the above copyright
9 *     notice, this list of conditions and the following disclaimer.
10 * 2.  Redistributions in binary form must reproduce the above copyright
11 *     notice, this list of conditions and the following disclaimer in the
12 *     documentation and/or other materials provided with the distribution.
13 * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
14 *     its contributors may be used to endorse or promote products derived
15 *     from this software without specific prior written permission.
16 *
17 * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND
18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20 * ARE DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR
21 * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
25 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
26 * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
27 * POSSIBILITY OF SUCH DAMAGE.
28 */
29
30#ifndef _BSM_AUDITD_LIB_H_
31#define	_BSM_AUDITD_LIB_H_
32
33/*
34 * Lengths for audit trail file components.
35 */
36#define	NOT_TERMINATED		"not_terminated"
37#define	CRASH_RECOVERY		"crash_recovery"
38#define	PREFIX_LEN	(sizeof("YYYYMMDDhhmmss") - 1)
39#define	POSTFIX_LEN	PREFIX_LEN
40#define	FILENAME_LEN	(PREFIX_LEN + 1 + POSTFIX_LEN)
41#define	TIMESTAMP_LEN	POSTFIX_LEN
42
43/*
44 * Macro to generate the timestamp string for trail file.
45 */
46#define	getTSstr(t, b, l)						\
47	( (((t) = time(0)) == (time_t)-1 ) ||				\
48	    !strftime((b), (l), "%Y%m%d%H%M%S", gmtime(&(t)) ) ) ? -1 : 0
49
50/*
51 * The symbolic link to the currently active audit trail file.
52 */
53#define	AUDIT_CURRENT_LINK	"/var/audit/current"
54
55/*
56 * Path of auditd plist file for launchd.
57 */
58#define	AUDITD_PLIST_FILE 	\
59	    "/System/Library/LaunchDaemons/com.apple.auditd.plist"
60
61/*
62 * Error return codes for auditd_lib functions.
63 */
64#define	ADE_NOERR	  0	/* No Error or Success. */
65#define	ADE_PARSE	 -1	/* Error parsing audit_control(5). */
66#define	ADE_AUDITON	 -2	/* auditon(2) call failed. */
67#define	ADE_NOMEM	 -3	/* Error allocating memory. */
68#define	ADE_SOFTLIM	 -4	/* All audit log directories over soft limit. */
69#define	ADE_HARDLIM	 -5	/* All audit log directories over hard limit. */
70#define	ADE_STRERR	 -6	/* Error creating file name string. */
71#define	ADE_AU_OPEN	 -7	/* au_open(3) failed. */
72#define	ADE_AU_CLOSE	 -8	/* au_close(3) failed. */
73#define	ADE_SETAUDIT	 -9	/* setaudit(2) or setaudit_addr(2) failed. */
74#define	ADE_ACTL	-10	/* "Soft" error with auditctl(2). */
75#define	ADE_ACTLERR	-11	/* "Hard" error with auditctl(2). */
76#define	ADE_SWAPERR	-12	/* The audit trail file could not be swap. */
77#define	ADE_RENAME	-13	/* Error renaming crash recovery file. */
78#define	ADE_READLINK	-14	/* Error reading 'current' link. */
79#define	ADE_SYMLINK	-15	/* Error creating 'current' link. */
80#define	ADE_INVAL	-16	/* Invalid argument. */
81#define	ADE_GETADDR	-17	/* Error resolving address from hostname. */
82#define	ADE_ADDRFAM	-18	/* Address family not supported. */
83#define	ADE_EXPIRE	-19	/* Error expiring audit trail files. */
84
85/*
86 * auditd_lib functions.
87 */
88const char *auditd_strerror(int errcode);
89int auditd_set_minfree(void);
90int auditd_expire_trails(int (*warn_expired)(char *));
91int auditd_read_dirs(int (*warn_soft)(char *), int (*warn_hard)(char *));
92void auditd_close_dirs(void);
93int auditd_set_dist(void);
94int auditd_set_evcmap(void);
95int auditd_set_namask(void);
96int auditd_set_policy(void);
97int auditd_set_fsize(void);
98int auditd_set_host(void);
99int auditd_swap_trail(char *TS, char **newfile, gid_t gid,
100    int (*warn_getacdir)(char *));
101int auditd_prevent_audit(void);
102int auditd_gen_record(int event, char *path);
103int auditd_new_curlink(char *curfile);
104int auditd_rename(const char *fromname, const char *toname);
105int audit_quick_start(void);
106int audit_quick_stop(void);
107
108#endif /* !_BSM_AUDITD_LIB_H_ */
109