security/audit/audit_worker.c

57 #include <bsm/audit.h>
61 #include <security/audit/audit.h>
62 #include <security/audit/audit_bsd.h>
63 #include <security/audit/audit_private.h>
88  * active audit trail.  They are protected by audit_worker_sl, which will be
108  * The audit_q_draining flag is set when audit is disabled and the audit
114  * The special kernel audit record, audit_drain_kar, is used to mark the end of
125  * Write an audit record to a file, performed as the last stage after both
130  * the audit daemon, since the message is asynchronous anyway.
156 	 * First, gather statistics on the audit log file and file system so
176 	 *   in the kernel notifying the audit daemon of low space.
178 	 * - An audit trail size limit, which when gone above, results in the
179 	 *   kernel notifying the audit daemon that rotation is desired.
181 	 * - The total depth of the kernel audit record exceeding free space,
227 	 * If the estimated amount of audit data in the audit event queue
229 	 * of free space on the disk, then we need to go into an audit fail
231 	 * any new audit records.  We continue to process records but don't
243 				    "below size of audit queue, failing "
310  * Given a kernel audit record, process as required.  Kernel audit records
312  * there is a user audit record present also.  Kernel records need be
314  * written to disk, and audit pipes.
341 	 * and audit pipes as selected.
442 		 * If there are records in the global audit record queue,
479  * both should be NULL, and this is used to indicate that audit is being
499 		 * audit worker thread is draining the audit record queue.
505 		 * end of the queue and waiting for the audit worker thread
507 		 * we close the audit trail.
517 	/* If the audit queue is draining then wait here until it's done. */
546 			    "audit file.\n");