1/* 2 * Copyright (c) 2004 Apple Computer, Inc. 3 * All rights reserved. 4 * 5 * @APPLE_BSD_LICENSE_HEADER_START@ 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions --- 16 unchanged lines hidden (view full) --- 25 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 26 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND 27 * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 28 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 29 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 30 * 31 * @APPLE_BSD_LICENSE_HEADER_END@ 32 * |
33 * $P4: //depot/projects/trustedbsd/openbsm/bin/auditd/auditd.c#23 $ |
34 */ 35 36#include <sys/types.h> 37#include <sys/dirent.h> 38#include <sys/mman.h> 39#include <sys/queue.h> 40#include <sys/stat.h> 41#include <sys/wait.h> --- 116 unchanged lines hidden (view full) --- 158 /* Rename the last file -- append timestamp. */ 159 if ((ptr = strstr(lastfile, NOT_TERMINATED)) != NULL) { 160 *ptr = '.'; 161 strcpy(ptr+1, TS); 162 if (rename(oldname, lastfile) != 0) 163 syslog(LOG_ERR, 164 "Could not rename %s to %s: %m", oldname, 165 lastfile); |
166 else { |
167 syslog(LOG_INFO, "renamed %s to %s", 168 oldname, lastfile); |
169 audit_warn_closefile(lastfile); 170 } |
171 } 172 free(lastfile); 173 free(oldname); 174 lastfile = NULL; 175 } 176 return (0); 177} 178 --- 545 unchanged lines hidden (view full) --- 724{ 725 au_event_ent_t ev, *evp; 726 au_evclass_map_t evc_map; 727 au_mask_t aumask; 728 int ctr = 0; 729 char naeventstr[NA_EVENT_STR_SIZE]; 730 char polstr[POL_STR_SIZE]; 731 long policy; |
732 au_fstat_t au_fstat; 733 size_t filesz; |
734 735 /* 736 * Process the audit event file, obtaining a class mapping for each 737 * event, and send that mapping into the kernel. 738 * 739 * XXX There's a risk here that the BSM library will return NULL 740 * for an event when it can't properly map it to a class. In that 741 * case, we will not process any events beyond the one that failed, --- 63 unchanged lines hidden (view full) --- 805 } else { 806 syslog(LOG_ERR, "Failed to obtain policy flags: %m"); 807 policy = AUDIT_CNT; 808 if (auditon(A_SETPOLICY, &policy, sizeof(policy))) 809 syslog(LOG_ERR, 810 "Failed to set default audit policy: %m"); 811 } 812 |
813 /* 814 * Set trail rotation size. 815 */ 816 if (getacfilesz(&filesz) == 0) { 817 bzero(&au_fstat, sizeof(au_fstat)); 818 au_fstat.af_filesz = filesz; 819 if (auditon(A_SETFSIZE, &au_fstat, sizeof(au_fstat)) < 0) 820 syslog(LOG_ERR, "Failed to set filesz: %m"); 821 } else 822 syslog(LOG_ERR, "Failed to obtain filesz: %m"); 823 |
824 return (0); 825} 826 827static void 828setup(void) 829{ 830 struct auditinfo ai; 831 auditinfo_t auinfo; --- 106 unchanged lines hidden --- |