blob: a2afe47b488547381f8cd665240bb5302a980ee0 [file] [log] [blame]
William Roberts29d238d2013-02-08 09:45:26 +09001/*
2 * Copyright 2012, Samsung Telecommunications of America
3 * Copyright (C) 2014 The Android Open Source Project
4 *
5 * Licensed under the Apache License, Version 2.0 (the "License");
6 * you may not use this file except in compliance with the License.
7 * You may obtain a copy of the License at
8 *
9 * http://www.apache.org/licenses/LICENSE-2.0
10 *
11 * Unless required by applicable law or agreed to in writing, software
12 * distributed under the License is distributed on an "AS IS" BASIS,
13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 * See the License for the specific language governing permissions and
15 * limitations under the License.
16 *
17 * Written by William Roberts <w.roberts@sta.samsung.com>
18 */
19
20#ifndef _LIBAUDIT_H_
21#define _LIBAUDIT_H_
22
23#include <stdint.h>
24#include <sys/cdefs.h>
25#include <sys/socket.h>
26#include <sys/types.h>
27
William Roberts29d238d2013-02-08 09:45:26 +090028#include <linux/audit.h>
Mark Salyzyn501c3732017-03-10 14:31:54 -080029#include <linux/netlink.h>
William Roberts29d238d2013-02-08 09:45:26 +090030
31__BEGIN_DECLS
32
Mark Salyzyn501c3732017-03-10 14:31:54 -080033#define MAX_AUDIT_MESSAGE_LENGTH 8970
William Roberts29d238d2013-02-08 09:45:26 +090034
Mark Salyzyn501c3732017-03-10 14:31:54 -080035typedef enum { GET_REPLY_BLOCKING = 0, GET_REPLY_NONBLOCKING } reply_t;
William Roberts29d238d2013-02-08 09:45:26 +090036
William Roberts29d238d2013-02-08 09:45:26 +090037/* type == AUDIT_SIGNAL_INFO */
38struct audit_sig_info {
39 uid_t uid;
40 pid_t pid;
41 char ctx[0];
42};
43
44struct audit_message {
45 struct nlmsghdr nlh;
Mark Salyzyn501c3732017-03-10 14:31:54 -080046 char data[MAX_AUDIT_MESSAGE_LENGTH];
William Roberts29d238d2013-02-08 09:45:26 +090047};
48
49/**
50 * Opens a connection to the Audit netlink socket
51 * @return
52 * A valid fd on success or < 0 on error with errno set.
53 * Returns the same errors as man 2 socket.
54 */
Mark Salyzyn247d6822017-01-03 14:00:19 -080055extern int audit_open(void);
William Roberts29d238d2013-02-08 09:45:26 +090056
57/**
58 * Closes the fd returned from audit_open()
59 * @param fd
60 * The fd to close
61 */
62extern void audit_close(int fd);
63
64/**
65 *
66 * @param fd
67 * The fd returned by a call to audit_open()
68 * @param rep
69 * The response struct to store the response in.
70 * @param block
71 * Whether or not to block on IO
72 * @param peek
73 * Whether or not we are to remove the message from
74 * the queue when we do a read on the netlink socket.
75 * @return
76 * This function returns 0 on success, else -errno.
77 */
Mark Salyzyn501c3732017-03-10 14:31:54 -080078extern int audit_get_reply(int fd, struct audit_message* rep, reply_t block,
Mark Salyzyn247d6822017-01-03 14:00:19 -080079 int peek);
William Roberts29d238d2013-02-08 09:45:26 +090080
81/**
Mark Salyzyn247d6822017-01-03 14:00:19 -080082 * Sets a pid to receive audit netlink events from the kernel
William Roberts29d238d2013-02-08 09:45:26 +090083 * @param fd
84 * The fd returned by a call to audit_open()
85 * @param pid
Mark Salyzyn247d6822017-01-03 14:00:19 -080086 * The pid whom to set as the receiver of audit messages
William Roberts29d238d2013-02-08 09:45:26 +090087 * @return
88 * This function returns 0 on success, -errno on error.
89 */
Mark Salyzyn247d6822017-01-03 14:00:19 -080090extern int audit_setup(int fd, pid_t pid);
91
92/**
93 * Sets the rate limit to receive audit netlink events from the kernel
94 * @param fd
95 * The fd returned by a call to audit_open()
96 * @param max_rate
97 * The cap of the maximum number of audit messages a second
98 * @return
99 * This function returns 0 on success, -errno on error.
100 */
101
102/* Guidelines to follow for dynamic rate_limit */
103#define AUDIT_RATE_LIMIT_DEFAULT 20 /* acceptable burst rate */
104#define AUDIT_RATE_LIMIT_BURST_DURATION 10 /* number of seconds of burst */
Mark Salyzyn501c3732017-03-10 14:31:54 -0800105#define AUDIT_RATE_LIMIT_MAX 5 /* acceptable sustained rate */
Mark Salyzyn247d6822017-01-03 14:00:19 -0800106
107extern int audit_rate_limit(int fd, unsigned rate_limit);
William Roberts29d238d2013-02-08 09:45:26 +0900108
109__END_DECLS
110
111#endif