1186545Srwatson/*- 2186545Srwatson * Copyright (c) 2008 Apple Inc. 3186545Srwatson * All rights reserved. 4186545Srwatson * 5186545Srwatson * Redistribution and use in source and binary forms, with or without 6186545Srwatson * modification, are permitted provided that the following conditions 7186545Srwatson * are met: 8186545Srwatson * 1. Redistributions of source code must retain the above copyright 9186545Srwatson * notice, this list of conditions and the following disclaimer. 10186545Srwatson * 2. Redistributions in binary form must reproduce the above copyright 11186545Srwatson * notice, this list of conditions and the following disclaimer in the 12186545Srwatson * documentation and/or other materials provided with the distribution. 13186545Srwatson * 3. Neither the name of Apple Inc. ("Apple") nor the names of 14186545Srwatson * its contributors may be used to endorse or promote products derived 15186545Srwatson * from this software without specific prior written permission. 16186545Srwatson * 17186545Srwatson * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND 18186545Srwatson * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 19186545Srwatson * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 20186545Srwatson * ARE DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR 21186545Srwatson * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 22186545Srwatson * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 23186545Srwatson * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 24186545Srwatson * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 25186545Srwatson * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING 26186545Srwatson * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 27186545Srwatson * POSSIBILITY OF SUCH DAMAGE. 28186545Srwatson * 29243750Srwatson * $P4: //depot/projects/trustedbsd/openbsm/bsm/auditd_lib.h#5 $ 30186545Srwatson */ 31186545Srwatson 32186545Srwatson#ifndef _BSM_AUDITD_LIB_H_ 33186545Srwatson#define _BSM_AUDITD_LIB_H_ 34186545Srwatson 35186545Srwatson/* 36186545Srwatson * Lengths for audit trail file components. 37186545Srwatson */ 38186545Srwatson#define NOT_TERMINATED "not_terminated" 39186545Srwatson#define CRASH_RECOVERY "crash_recovery" 40243750Srwatson#define PREFIX_LEN (sizeof("YYYYMMDDhhmmss") - 1) 41243750Srwatson#define POSTFIX_LEN PREFIX_LEN 42243750Srwatson#define FILENAME_LEN (PREFIX_LEN + 1 + POSTFIX_LEN) 43243750Srwatson#define TIMESTAMP_LEN POSTFIX_LEN 44186545Srwatson 45186545Srwatson/* 46186545Srwatson * Macro to generate the timestamp string for trail file. 47186545Srwatson */ 48186545Srwatson#define getTSstr(t, b, l) \ 49186545Srwatson ( (((t) = time(0)) == (time_t)-1 ) || \ 50186545Srwatson !strftime((b), (l), "%Y%m%d%H%M%S", gmtime(&(t)) ) ) ? -1 : 0 51186545Srwatson 52186545Srwatson/* 53186545Srwatson * The symbolic link to the currently active audit trail file. 54186545Srwatson */ 55186545Srwatson#define AUDIT_CURRENT_LINK "/var/audit/current" 56186545Srwatson 57186545Srwatson/* 58186545Srwatson * Path of auditd plist file for launchd. 59186545Srwatson */ 60186545Srwatson#define AUDITD_PLIST_FILE \ 61187214Srwatson "/System/Library/LaunchDaemons/com.apple.auditd.plist" 62186545Srwatson 63186545Srwatson/* 64186545Srwatson * Error return codes for auditd_lib functions. 65186545Srwatson */ 66186545Srwatson#define ADE_NOERR 0 /* No Error or Success. */ 67186545Srwatson#define ADE_PARSE -1 /* Error parsing audit_control(5). */ 68186545Srwatson#define ADE_AUDITON -2 /* auditon(2) call failed. */ 69186545Srwatson#define ADE_NOMEM -3 /* Error allocating memory. */ 70186545Srwatson#define ADE_SOFTLIM -4 /* All audit log directories over soft limit. */ 71186545Srwatson#define ADE_HARDLIM -5 /* All audit log directories over hard limit. */ 72186545Srwatson#define ADE_STRERR -6 /* Error creating file name string. */ 73186545Srwatson#define ADE_AU_OPEN -7 /* au_open(3) failed. */ 74186545Srwatson#define ADE_AU_CLOSE -8 /* au_close(3) failed. */ 75186545Srwatson#define ADE_SETAUDIT -9 /* setaudit(2) or setaudit_addr(2) failed. */ 76186545Srwatson#define ADE_ACTL -10 /* "Soft" error with auditctl(2). */ 77186545Srwatson#define ADE_ACTLERR -11 /* "Hard" error with auditctl(2). */ 78186545Srwatson#define ADE_SWAPERR -12 /* The audit trail file could not be swap. */ 79186545Srwatson#define ADE_RENAME -13 /* Error renaming crash recovery file. */ 80186545Srwatson#define ADE_READLINK -14 /* Error reading 'current' link. */ 81186545Srwatson#define ADE_SYMLINK -15 /* Error creating 'current' link. */ 82186545Srwatson#define ADE_INVAL -16 /* Invalid argument. */ 83186545Srwatson#define ADE_GETADDR -17 /* Error resolving address from hostname. */ 84186545Srwatson#define ADE_ADDRFAM -18 /* Address family not supported. */ 85189279Srwatson#define ADE_EXPIRE -19 /* Error expiring audit trail files. */ 86186545Srwatson 87186545Srwatson/* 88186545Srwatson * auditd_lib functions. 89186545Srwatson */ 90186545Srwatsonconst char *auditd_strerror(int errcode); 91186545Srwatsonint auditd_set_minfree(void); 92189279Srwatsonint auditd_expire_trails(int (*warn_expired)(char *)); 93186545Srwatsonint auditd_read_dirs(int (*warn_soft)(char *), int (*warn_hard)(char *)); 94186545Srwatsonvoid auditd_close_dirs(void); 95243750Srwatsonint auditd_set_dist(void); 96186545Srwatsonint auditd_set_evcmap(void); 97186545Srwatsonint auditd_set_namask(void); 98186545Srwatsonint auditd_set_policy(void); 99186545Srwatsonint auditd_set_fsize(void); 100186545Srwatsonint auditd_set_host(void); 101186545Srwatsonint auditd_swap_trail(char *TS, char **newfile, gid_t gid, 102186545Srwatson int (*warn_getacdir)(char *)); 103186545Srwatsonint auditd_prevent_audit(void); 104186545Srwatsonint auditd_gen_record(int event, char *path); 105186545Srwatsonint auditd_new_curlink(char *curfile); 106243750Srwatsonint auditd_rename(const char *fromname, const char *toname); 107186545Srwatsonint audit_quick_start(void); 108186545Srwatsonint audit_quick_stop(void); 109186545Srwatson 110186545Srwatson#endif /* !_BSM_AUDITD_LIB_H_ */ 111