1 /* 2 * Copyright 2012, Samsung Telecommunications of America 3 * Copyright (C) 2014 The Android Open Source Project 4 * 5 * Licensed under the Apache License, Version 2.0 (the "License"); 6 * you may not use this file except in compliance with the License. 7 * You may obtain a copy of the License at 8 * 9 * http://www.apache.org/licenses/LICENSE-2.0 10 * 11 * Unless required by applicable law or agreed to in writing, software 12 * distributed under the License is distributed on an "AS IS" BASIS, 13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 14 * See the License for the specific language governing permissions and 15 * limitations under the License. 16 * 17 * Written by William Roberts <w.roberts@sta.samsung.com> 18 */ 19 20 #pragma once 21 22 #include <stdint.h> 23 #include <sys/cdefs.h> 24 #include <sys/socket.h> 25 #include <sys/types.h> 26 27 #include <linux/audit.h> 28 #include <linux/netlink.h> 29 30 __BEGIN_DECLS 31 32 #define MAX_AUDIT_MESSAGE_LENGTH 8970 33 34 typedef enum { GET_REPLY_BLOCKING = 0, GET_REPLY_NONBLOCKING } reply_t; 35 36 /* type == AUDIT_SIGNAL_INFO */ 37 struct audit_sig_info { 38 uid_t uid; 39 pid_t pid; 40 char ctx[0]; 41 }; 42 43 struct audit_message { 44 struct nlmsghdr nlh; 45 char data[MAX_AUDIT_MESSAGE_LENGTH]; 46 }; 47 48 /** 49 * Opens a connection to the Audit netlink socket 50 * @return 51 * A valid fd on success or < 0 on error with errno set. 52 * Returns the same errors as man 2 socket. 53 */ 54 extern int audit_open(void); 55 56 /** 57 * Closes the fd returned from audit_open() 58 * @param fd 59 * The fd to close 60 */ 61 extern void audit_close(int fd); 62 63 /** 64 * 65 * @param fd 66 * The fd returned by a call to audit_open() 67 * @param rep 68 * The response struct to store the response in. 69 * @param block 70 * Whether or not to block on IO 71 * @param peek 72 * Whether or not we are to remove the message from 73 * the queue when we do a read on the netlink socket. 74 * @return 75 * This function returns 0 on success, else -errno. 76 */ 77 extern int audit_get_reply(int fd, struct audit_message* rep, reply_t block, 78 int peek); 79 80 /** 81 * Sets a pid to receive audit netlink events from the kernel 82 * @param fd 83 * The fd returned by a call to audit_open() 84 * @param pid 85 * The pid whom to set as the receiver of audit messages 86 * @return 87 * This function returns 0 on success, -errno on error. 88 */ 89 extern int audit_setup(int fd, pid_t pid); 90 91 /** 92 * Throttle kernel messages at the provided rate 93 * @param fd 94 * The fd returned by a call to audit_open() 95 * @param rate 96 * The rate, in messages per second, above which the kernel 97 * should drop audit messages. 98 * @return 99 * This function returns 0 on success, -errno on error. 100 */ 101 extern int audit_rate_limit(int fd, uint32_t limit); 102 103 __END_DECLS 104