1/*
2 * Copyright (c) 2004 Apple Computer, Inc.
3 * All rights reserved.
4 *
5 * @APPLE_BSD_LICENSE_HEADER_START@
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
--- 16 unchanged lines hidden (view full) ---
25 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
26 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
27 * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
28 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
29 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
30 *
31 * @APPLE_BSD_LICENSE_HEADER_END@
32 *
33 * $P4: //depot/projects/trustedbsd/openbsm/bin/auditd/auditd.c#23 $
34 */
35
36#include <sys/types.h>
37#include <sys/dirent.h>
38#include <sys/mman.h>
39#include <sys/queue.h>
40#include <sys/stat.h>
41#include <sys/wait.h>
--- 116 unchanged lines hidden (view full) ---
158 /* Rename the last file -- append timestamp. */
159 if ((ptr = strstr(lastfile, NOT_TERMINATED)) != NULL) {
160 *ptr = '.';
161 strcpy(ptr+1, TS);
162 if (rename(oldname, lastfile) != 0)
163 syslog(LOG_ERR,
164 "Could not rename %s to %s: %m", oldname,
165 lastfile);
166 else {
167 syslog(LOG_INFO, "renamed %s to %s",
168 oldname, lastfile);
169 audit_warn_closefile(lastfile);
170 }
171 }
172 free(lastfile);
173 free(oldname);
174 lastfile = NULL;
175 }
176 return (0);
177}
178
--- 545 unchanged lines hidden (view full) ---
724{
725 au_event_ent_t ev, *evp;
726 au_evclass_map_t evc_map;
727 au_mask_t aumask;
728 int ctr = 0;
729 char naeventstr[NA_EVENT_STR_SIZE];
730 char polstr[POL_STR_SIZE];
731 long policy;
732 au_fstat_t au_fstat;
733 size_t filesz;
734
735 /*
736 * Process the audit event file, obtaining a class mapping for each
737 * event, and send that mapping into the kernel.
738 *
739 * XXX There's a risk here that the BSM library will return NULL
740 * for an event when it can't properly map it to a class. In that
741 * case, we will not process any events beyond the one that failed,
--- 63 unchanged lines hidden (view full) ---
805 } else {
806 syslog(LOG_ERR, "Failed to obtain policy flags: %m");
807 policy = AUDIT_CNT;
808 if (auditon(A_SETPOLICY, &policy, sizeof(policy)))
809 syslog(LOG_ERR,
810 "Failed to set default audit policy: %m");
811 }
812
813 /*
814 * Set trail rotation size.
815 */
816 if (getacfilesz(&filesz) == 0) {
817 bzero(&au_fstat, sizeof(au_fstat));
818 au_fstat.af_filesz = filesz;
819 if (auditon(A_SETFSIZE, &au_fstat, sizeof(au_fstat)) < 0)
820 syslog(LOG_ERR, "Failed to set filesz: %m");
821 } else
822 syslog(LOG_ERR, "Failed to obtain filesz: %m");
823
824 return (0);
825}
826
827static void
828setup(void)
829{
830 struct auditinfo ai;
831 auditinfo_t auinfo;
--- 106 unchanged lines hidden ---
2 * Copyright (c) 2004 Apple Computer, Inc.
3 * All rights reserved.
4 *
5 * @APPLE_BSD_LICENSE_HEADER_START@
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
--- 16 unchanged lines hidden (view full) ---
25 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
26 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
27 * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
28 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
29 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
30 *
31 * @APPLE_BSD_LICENSE_HEADER_END@
32 *
33 * $P4: //depot/projects/trustedbsd/openbsm/bin/auditd/auditd.c#23 $
34 */
35
36#include <sys/types.h>
37#include <sys/dirent.h>
38#include <sys/mman.h>
39#include <sys/queue.h>
40#include <sys/stat.h>
41#include <sys/wait.h>
--- 116 unchanged lines hidden (view full) ---
158 /* Rename the last file -- append timestamp. */
159 if ((ptr = strstr(lastfile, NOT_TERMINATED)) != NULL) {
160 *ptr = '.';
161 strcpy(ptr+1, TS);
162 if (rename(oldname, lastfile) != 0)
163 syslog(LOG_ERR,
164 "Could not rename %s to %s: %m", oldname,
165 lastfile);
166 else {
167 syslog(LOG_INFO, "renamed %s to %s",
168 oldname, lastfile);
169 audit_warn_closefile(lastfile);
170 }
171 }
172 free(lastfile);
173 free(oldname);
174 lastfile = NULL;
175 }
176 return (0);
177}
178
--- 545 unchanged lines hidden (view full) ---
724{
725 au_event_ent_t ev, *evp;
726 au_evclass_map_t evc_map;
727 au_mask_t aumask;
728 int ctr = 0;
729 char naeventstr[NA_EVENT_STR_SIZE];
730 char polstr[POL_STR_SIZE];
731 long policy;
732 au_fstat_t au_fstat;
733 size_t filesz;
734
735 /*
736 * Process the audit event file, obtaining a class mapping for each
737 * event, and send that mapping into the kernel.
738 *
739 * XXX There's a risk here that the BSM library will return NULL
740 * for an event when it can't properly map it to a class. In that
741 * case, we will not process any events beyond the one that failed,
--- 63 unchanged lines hidden (view full) ---
805 } else {
806 syslog(LOG_ERR, "Failed to obtain policy flags: %m");
807 policy = AUDIT_CNT;
808 if (auditon(A_SETPOLICY, &policy, sizeof(policy)))
809 syslog(LOG_ERR,
810 "Failed to set default audit policy: %m");
811 }
812
813 /*
814 * Set trail rotation size.
815 */
816 if (getacfilesz(&filesz) == 0) {
817 bzero(&au_fstat, sizeof(au_fstat));
818 au_fstat.af_filesz = filesz;
819 if (auditon(A_SETFSIZE, &au_fstat, sizeof(au_fstat)) < 0)
820 syslog(LOG_ERR, "Failed to set filesz: %m");
821 } else
822 syslog(LOG_ERR, "Failed to obtain filesz: %m");
823
824 return (0);
825}
826
827static void
828setup(void)
829{
830 struct auditinfo ai;
831 auditinfo_t auinfo;
--- 106 unchanged lines hidden ---