1.\"-
2.\" Copyright (c) 2005 Robert N. M. Watson
3.\" Copyright (c) 2005 Tom Rhodes
4.\" Copyright (c) 2005 Wayne J. Salamon
5.\" All rights reserved.
6.\"
7.\" Redistribution and use in source and binary forms, with or without
8.\" modification, are permitted provided that the following conditions
--- 11 unchanged lines hidden (view full) ---
20.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26.\" SUCH DAMAGE.
27.\"
28.\" $P4: //depot/projects/trustedbsd/openbsm/man/auditon.2#7 $
29.\"
30.Dd April 19, 2005
31.Dt AUDITON 2
32.Os
33.Sh NAME
34.Nm auditon
35.Nd "Configure system audit parameters"
36.Sh SYNOPSIS
--- 11 unchanged lines hidden (view full) ---
48.Em data
49in bytes.
50.Ft cmd
51may be any of the following:
52.Bl -tag -width ".It Dv A_GETPINFO_ADDR"
53.It Dv A_SETPOLICY
54Set audit policy flags.
55.Ft *data
56must point to a long value set to one of the audit
57policy control values defined in
58.Pa audit.h .
59Currently, only
60.Dv AUDIT_CNT
61and
62.Dv AUDIT_AHLT
63are implemented.
64In the
65.Dv AUDIT_CNT
66case, the action will continue regardless if
--- 12 unchanged lines hidden (view full) ---
79.Ft *data
80must point to a
81.Ft au_mask_t
82structure containing the mask values.
83These masks are used for non-attributable audit event preselection.
84.It Dv A_SETQCTRL
85Set kernel audit queue parameters.
86.Ft *data
87must point to a
88.Ft au_qctrl_t
89structure containing the
90kernel audit queue control settings:
91.Va high water ,
92.Va low water ,
93.Va output buffer size ,
94.Va percent min free disk space ,
95and
--- 6 unchanged lines hidden (view full) ---
102Return
103.Er ENOSYS .
104.It Dv A_SETSMASK
105Return
106.Er ENOSYS .
107.It Dv A_SETCOND
108Set the current auditing condition.
109.Ft *data
110must point to a long value containing the new
111audit condition, one of
112.Dv AUC_AUDITING ,
113.Dv AUC_NOAUDIT ,
114or
115.Dv AUC_DISABLED .
116.It Dv A_SETCLASS
117Set the event class preselection mask for an audit event.
118.Ft *data
119must point to a
120.Ft au_evclass_map_t
121structure containing the audit event and mask.
122.It Dv A_SETPMASK
123Set the preselection masks for a process.
124.Ft *data
125must point to a
126.Ft auditpinfo_t
127structure that contains the given process's audit
128preselection masks for both success and failure.
129.It Dv A_SETFSIZE
130Set the maximum size of the audit log file.
131.Ft *data
132must point to a
133.Ft au_fstat_t
--- 29 unchanged lines hidden (view full) ---
163.Ft *data
164must point to a
165.Ft au_mask_t
166structure which will be set to
167the current kernel preselection masks for non-attributable events.
168.It Dv A_GETPOLICY
169Return the current audit policy setting.
170.Ft *data
171must point to a long value which will be set to
172one of the current audit policy flags.
173Currently, only
174.Dv AUDIT_CNT
175and
176.Dv AUDIT_AHLT
177are implemented.
178.It Dv A_GETQCTRL
179Return the current kernel audit queue control parameters.
--- 4 unchanged lines hidden (view full) ---
184kernel audit queue control parameters.
185.It Dv A_GETFSIZE
186Returns the maximum size of the audit log file.
187.Ft *data
188must point to a
189.Ft au_fstat_t
190structure. The
191.Ft af_filesz
192field will be set to the maximum audit log file size.
193A value of 0 indicates no limit to the size.
194The
195.Ft af_filesz
196will be set to the current audit log file size.
197.It Dv A_GETCWD
198.\" [COMMENTED OUT]: Valid description, not yet implemented.
199.\" Return the current working directory as stored in the audit subsystem.
200Return
201.Er ENOSYS .
--- 21 unchanged lines hidden (view full) ---
223.Fr *data
224must point to a long value set to one of the acceptable
225trigger values:
226.Dv AUDIT_TRIGGER_LOW_SPACE
227(low disk space where the audit log resides),
228.Dv AUDIT_TRIGGER_OPEN_NEW
229(open a new audit log file),
230.Dv AUDIT_TRIGGER_READ_FILE
231(read the
232.Pa audit_control
233file),
234.Dv AUDIT_TRIGGER_CLOSE_AND_DIE
235(close the current log file and exit),
236or
237.Dv AUDIT_TRIGGER_NO_SPACE
238(no disk space left for audit log file).
239.El
240.Sh RETURN VALUES
241.Rv -std
--- 50 unchanged lines hidden ---
2.\" Copyright (c) 2005 Robert N. M. Watson
3.\" Copyright (c) 2005 Tom Rhodes
4.\" Copyright (c) 2005 Wayne J. Salamon
5.\" All rights reserved.
6.\"
7.\" Redistribution and use in source and binary forms, with or without
8.\" modification, are permitted provided that the following conditions
--- 11 unchanged lines hidden (view full) ---
20.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26.\" SUCH DAMAGE.
27.\"
28.\" $P4: //depot/projects/trustedbsd/openbsm/man/auditon.2#7 $
29.\"
30.Dd April 19, 2005
31.Dt AUDITON 2
32.Os
33.Sh NAME
34.Nm auditon
35.Nd "Configure system audit parameters"
36.Sh SYNOPSIS
--- 11 unchanged lines hidden (view full) ---
48.Em data
49in bytes.
50.Ft cmd
51may be any of the following:
52.Bl -tag -width ".It Dv A_GETPINFO_ADDR"
53.It Dv A_SETPOLICY
54Set audit policy flags.
55.Ft *data
56must point to a long value set to one of the audit
57policy control values defined in
58.Pa audit.h .
59Currently, only
60.Dv AUDIT_CNT
61and
62.Dv AUDIT_AHLT
63are implemented.
64In the
65.Dv AUDIT_CNT
66case, the action will continue regardless if
--- 12 unchanged lines hidden (view full) ---
79.Ft *data
80must point to a
81.Ft au_mask_t
82structure containing the mask values.
83These masks are used for non-attributable audit event preselection.
84.It Dv A_SETQCTRL
85Set kernel audit queue parameters.
86.Ft *data
87must point to a
88.Ft au_qctrl_t
89structure containing the
90kernel audit queue control settings:
91.Va high water ,
92.Va low water ,
93.Va output buffer size ,
94.Va percent min free disk space ,
95and
--- 6 unchanged lines hidden (view full) ---
102Return
103.Er ENOSYS .
104.It Dv A_SETSMASK
105Return
106.Er ENOSYS .
107.It Dv A_SETCOND
108Set the current auditing condition.
109.Ft *data
110must point to a long value containing the new
111audit condition, one of
112.Dv AUC_AUDITING ,
113.Dv AUC_NOAUDIT ,
114or
115.Dv AUC_DISABLED .
116.It Dv A_SETCLASS
117Set the event class preselection mask for an audit event.
118.Ft *data
119must point to a
120.Ft au_evclass_map_t
121structure containing the audit event and mask.
122.It Dv A_SETPMASK
123Set the preselection masks for a process.
124.Ft *data
125must point to a
126.Ft auditpinfo_t
127structure that contains the given process's audit
128preselection masks for both success and failure.
129.It Dv A_SETFSIZE
130Set the maximum size of the audit log file.
131.Ft *data
132must point to a
133.Ft au_fstat_t
--- 29 unchanged lines hidden (view full) ---
163.Ft *data
164must point to a
165.Ft au_mask_t
166structure which will be set to
167the current kernel preselection masks for non-attributable events.
168.It Dv A_GETPOLICY
169Return the current audit policy setting.
170.Ft *data
171must point to a long value which will be set to
172one of the current audit policy flags.
173Currently, only
174.Dv AUDIT_CNT
175and
176.Dv AUDIT_AHLT
177are implemented.
178.It Dv A_GETQCTRL
179Return the current kernel audit queue control parameters.
--- 4 unchanged lines hidden (view full) ---
184kernel audit queue control parameters.
185.It Dv A_GETFSIZE
186Returns the maximum size of the audit log file.
187.Ft *data
188must point to a
189.Ft au_fstat_t
190structure. The
191.Ft af_filesz
192field will be set to the maximum audit log file size.
193A value of 0 indicates no limit to the size.
194The
195.Ft af_filesz
196will be set to the current audit log file size.
197.It Dv A_GETCWD
198.\" [COMMENTED OUT]: Valid description, not yet implemented.
199.\" Return the current working directory as stored in the audit subsystem.
200Return
201.Er ENOSYS .
--- 21 unchanged lines hidden (view full) ---
223.Fr *data
224must point to a long value set to one of the acceptable
225trigger values:
226.Dv AUDIT_TRIGGER_LOW_SPACE
227(low disk space where the audit log resides),
228.Dv AUDIT_TRIGGER_OPEN_NEW
229(open a new audit log file),
230.Dv AUDIT_TRIGGER_READ_FILE
231(read the
232.Pa audit_control
233file),
234.Dv AUDIT_TRIGGER_CLOSE_AND_DIE
235(close the current log file and exit),
236or
237.Dv AUDIT_TRIGGER_NO_SPACE
238(no disk space left for audit log file).
239.El
240.Sh RETURN VALUES
241.Rv -std
--- 50 unchanged lines hidden ---