1 /* 2 * Copyright 2012, Samsung Telecommunications of America 3 * Copyright (C) 2014 The Android Open Source Project 4 * 5 * Licensed under the Apache License, Version 2.0 (the "License"); 6 * you may not use this file except in compliance with the License. 7 * You may obtain a copy of the License at 8 * 9 * http://www.apache.org/licenses/LICENSE-2.0 10 * 11 * Unless required by applicable law or agreed to in writing, software 12 * distributed under the License is distributed on an "AS IS" BASIS, 13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 14 * See the License for the specific language governing permissions and 15 * limitations under the License. 16 * 17 * Written by William Roberts <w.roberts@sta.samsung.com> 18 */ 19 20 #ifndef _LIBAUDIT_H_ 21 #define _LIBAUDIT_H_ 22 23 #include <stdint.h> 24 #include <sys/cdefs.h> 25 #include <sys/socket.h> 26 #include <sys/types.h> 27 28 #include <linux/audit.h> 29 #include <linux/netlink.h> 30 31 __BEGIN_DECLS 32 33 #define MAX_AUDIT_MESSAGE_LENGTH 8970 34 35 typedef enum { GET_REPLY_BLOCKING = 0, GET_REPLY_NONBLOCKING } reply_t; 36 37 /* type == AUDIT_SIGNAL_INFO */ 38 struct audit_sig_info { 39 uid_t uid; 40 pid_t pid; 41 char ctx[0]; 42 }; 43 44 struct audit_message { 45 struct nlmsghdr nlh; 46 char data[MAX_AUDIT_MESSAGE_LENGTH]; 47 }; 48 49 /** 50 * Opens a connection to the Audit netlink socket 51 * @return 52 * A valid fd on success or < 0 on error with errno set. 53 * Returns the same errors as man 2 socket. 54 */ 55 extern int audit_open(void); 56 57 /** 58 * Closes the fd returned from audit_open() 59 * @param fd 60 * The fd to close 61 */ 62 extern void audit_close(int fd); 63 64 /** 65 * 66 * @param fd 67 * The fd returned by a call to audit_open() 68 * @param rep 69 * The response struct to store the response in. 70 * @param block 71 * Whether or not to block on IO 72 * @param peek 73 * Whether or not we are to remove the message from 74 * the queue when we do a read on the netlink socket. 75 * @return 76 * This function returns 0 on success, else -errno. 77 */ 78 extern int audit_get_reply(int fd, struct audit_message* rep, reply_t block, 79 int peek); 80 81 /** 82 * Sets a pid to receive audit netlink events from the kernel 83 * @param fd 84 * The fd returned by a call to audit_open() 85 * @param pid 86 * The pid whom to set as the receiver of audit messages 87 * @return 88 * This function returns 0 on success, -errno on error. 89 */ 90 extern int audit_setup(int fd, pid_t pid); 91 92 /** 93 * Throttle kernel messages at the provided rate 94 * @param fd 95 * The fd returned by a call to audit_open() 96 * @param rate 97 * The rate, in messages per second, above which the kernel 98 * should drop audit messages. 99 * @return 100 * This function returns 0 on success, -errno on error. 101 */ 102 extern int audit_rate_limit(int fd, uint32_t limit); 103 104 __END_DECLS 105 106 #endif 107