1 /* 2 * Copyright 2012, Samsung Telecommunications of America 3 * Copyright (C) 2014 The Android Open Source Project 4 * 5 * Licensed under the Apache License, Version 2.0 (the "License"); 6 * you may not use this file except in compliance with the License. 7 * You may obtain a copy of the License at 8 * 9 * http://www.apache.org/licenses/LICENSE-2.0 10 * 11 * Unless required by applicable law or agreed to in writing, software 12 * distributed under the License is distributed on an "AS IS" BASIS, 13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 14 * See the License for the specific language governing permissions and 15 * limitations under the License. 16 * 17 * Written by William Roberts <w.roberts (at) sta.samsung.com> 18 */ 19 20 #ifndef _LIBAUDIT_H_ 21 #define _LIBAUDIT_H_ 22 23 #include <stdint.h> 24 #include <sys/cdefs.h> 25 #include <sys/socket.h> 26 #include <sys/types.h> 27 28 #include <linux/netlink.h> 29 #include <linux/audit.h> 30 31 __BEGIN_DECLS 32 33 #define MAX_AUDIT_MESSAGE_LENGTH 8970 34 35 typedef enum { 36 GET_REPLY_BLOCKING=0, 37 GET_REPLY_NONBLOCKING 38 } reply_t; 39 40 typedef enum { 41 WAIT_NO, 42 WAIT_YES 43 } rep_wait_t; 44 45 /* type == AUDIT_SIGNAL_INFO */ 46 struct audit_sig_info { 47 uid_t uid; 48 pid_t pid; 49 char ctx[0]; 50 }; 51 52 struct audit_message { 53 struct nlmsghdr nlh; 54 char data[MAX_AUDIT_MESSAGE_LENGTH]; 55 }; 56 57 /** 58 * Opens a connection to the Audit netlink socket 59 * @return 60 * A valid fd on success or < 0 on error with errno set. 61 * Returns the same errors as man 2 socket. 62 */ 63 extern int audit_open(void); 64 65 /** 66 * Closes the fd returned from audit_open() 67 * @param fd 68 * The fd to close 69 */ 70 extern void audit_close(int fd); 71 72 /** 73 * 74 * @param fd 75 * The fd returned by a call to audit_open() 76 * @param rep 77 * The response struct to store the response in. 78 * @param block 79 * Whether or not to block on IO 80 * @param peek 81 * Whether or not we are to remove the message from 82 * the queue when we do a read on the netlink socket. 83 * @return 84 * This function returns 0 on success, else -errno. 85 */ 86 extern int audit_get_reply(int fd, struct audit_message *rep, reply_t block, 87 int peek); 88 89 /** 90 * Sets a pid to recieve audit netlink events from the kernel 91 * @param fd 92 * The fd returned by a call to audit_open() 93 * @param pid 94 * The pid whom to set as the reciever of audit messages 95 * @param wmode 96 * Whether or not to block on the underlying socket io calls. 97 * @return 98 * This function returns 0 on success, -errno on error. 99 */ 100 extern int audit_set_pid(int fd, uint32_t pid, rep_wait_t wmode); 101 102 __END_DECLS 103 104 #endif 105
