William Roberts | 210c584 | 2013-02-08 09:45:26 +0900 | [diff] [blame] | 1 | /* |
| 2 | * Copyright 2012, Samsung Telecommunications of America |
| 3 | * Copyright (C) 2014 The Android Open Source Project |
| 4 | * |
| 5 | * Licensed under the Apache License, Version 2.0 (the "License"); |
| 6 | * you may not use this file except in compliance with the License. |
| 7 | * You may obtain a copy of the License at |
| 8 | * |
| 9 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 10 | * |
| 11 | * Unless required by applicable law or agreed to in writing, software |
| 12 | * distributed under the License is distributed on an "AS IS" BASIS, |
| 13 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 14 | * See the License for the specific language governing permissions and |
| 15 | * limitations under the License. |
| 16 | * |
| 17 | * Written by William Roberts <w.roberts@sta.samsung.com> |
| 18 | */ |
| 19 | |
| 20 | #ifndef _LIBAUDIT_H_ |
| 21 | #define _LIBAUDIT_H_ |
| 22 | |
| 23 | #include <stdint.h> |
| 24 | #include <sys/cdefs.h> |
| 25 | #include <sys/socket.h> |
| 26 | #include <sys/types.h> |
| 27 | |
William Roberts | 210c584 | 2013-02-08 09:45:26 +0900 | [diff] [blame] | 28 | #include <linux/audit.h> |
Mark Salyzyn | 6505953 | 2017-03-10 14:31:54 -0800 | [diff] [blame] | 29 | #include <linux/netlink.h> |
William Roberts | 210c584 | 2013-02-08 09:45:26 +0900 | [diff] [blame] | 30 | |
| 31 | __BEGIN_DECLS |
| 32 | |
Mark Salyzyn | 6505953 | 2017-03-10 14:31:54 -0800 | [diff] [blame] | 33 | #define MAX_AUDIT_MESSAGE_LENGTH 8970 |
William Roberts | 210c584 | 2013-02-08 09:45:26 +0900 | [diff] [blame] | 34 | |
Mark Salyzyn | 6505953 | 2017-03-10 14:31:54 -0800 | [diff] [blame] | 35 | typedef enum { GET_REPLY_BLOCKING = 0, GET_REPLY_NONBLOCKING } reply_t; |
William Roberts | 210c584 | 2013-02-08 09:45:26 +0900 | [diff] [blame] | 36 | |
William Roberts | 210c584 | 2013-02-08 09:45:26 +0900 | [diff] [blame] | 37 | /* type == AUDIT_SIGNAL_INFO */ |
| 38 | struct audit_sig_info { |
| 39 | uid_t uid; |
| 40 | pid_t pid; |
| 41 | char ctx[0]; |
| 42 | }; |
| 43 | |
| 44 | struct audit_message { |
| 45 | struct nlmsghdr nlh; |
Mark Salyzyn | 6505953 | 2017-03-10 14:31:54 -0800 | [diff] [blame] | 46 | char data[MAX_AUDIT_MESSAGE_LENGTH]; |
William Roberts | 210c584 | 2013-02-08 09:45:26 +0900 | [diff] [blame] | 47 | }; |
| 48 | |
| 49 | /** |
| 50 | * Opens a connection to the Audit netlink socket |
| 51 | * @return |
| 52 | * A valid fd on success or < 0 on error with errno set. |
| 53 | * Returns the same errors as man 2 socket. |
| 54 | */ |
Mark Salyzyn | ec9b9ad | 2017-01-03 14:00:19 -0800 | [diff] [blame] | 55 | extern int audit_open(void); |
William Roberts | 210c584 | 2013-02-08 09:45:26 +0900 | [diff] [blame] | 56 | |
| 57 | /** |
| 58 | * Closes the fd returned from audit_open() |
| 59 | * @param fd |
| 60 | * The fd to close |
| 61 | */ |
| 62 | extern void audit_close(int fd); |
| 63 | |
| 64 | /** |
| 65 | * |
| 66 | * @param fd |
| 67 | * The fd returned by a call to audit_open() |
| 68 | * @param rep |
| 69 | * The response struct to store the response in. |
| 70 | * @param block |
| 71 | * Whether or not to block on IO |
| 72 | * @param peek |
| 73 | * Whether or not we are to remove the message from |
| 74 | * the queue when we do a read on the netlink socket. |
| 75 | * @return |
| 76 | * This function returns 0 on success, else -errno. |
| 77 | */ |
Mark Salyzyn | 6505953 | 2017-03-10 14:31:54 -0800 | [diff] [blame] | 78 | extern int audit_get_reply(int fd, struct audit_message* rep, reply_t block, |
Mark Salyzyn | ec9b9ad | 2017-01-03 14:00:19 -0800 | [diff] [blame] | 79 | int peek); |
William Roberts | 210c584 | 2013-02-08 09:45:26 +0900 | [diff] [blame] | 80 | |
| 81 | /** |
Mark Salyzyn | ec9b9ad | 2017-01-03 14:00:19 -0800 | [diff] [blame] | 82 | * Sets a pid to receive audit netlink events from the kernel |
William Roberts | 210c584 | 2013-02-08 09:45:26 +0900 | [diff] [blame] | 83 | * @param fd |
| 84 | * The fd returned by a call to audit_open() |
| 85 | * @param pid |
Mark Salyzyn | ec9b9ad | 2017-01-03 14:00:19 -0800 | [diff] [blame] | 86 | * The pid whom to set as the receiver of audit messages |
William Roberts | 210c584 | 2013-02-08 09:45:26 +0900 | [diff] [blame] | 87 | * @return |
| 88 | * This function returns 0 on success, -errno on error. |
| 89 | */ |
Mark Salyzyn | ec9b9ad | 2017-01-03 14:00:19 -0800 | [diff] [blame] | 90 | extern int audit_setup(int fd, pid_t pid); |
| 91 | |
Nick Kralevich | 8c8fd2f | 2019-04-09 10:59:39 -0700 | [diff] [blame] | 92 | /** |
| 93 | * Throttle kernel messages at the provided rate |
| 94 | * @param fd |
| 95 | * The fd returned by a call to audit_open() |
| 96 | * @param rate |
| 97 | * The rate, in messages per second, above which the kernel |
| 98 | * should drop audit messages. |
| 99 | * @return |
| 100 | * This function returns 0 on success, -errno on error. |
| 101 | */ |
| 102 | extern int audit_rate_limit(int fd, uint32_t limit); |
William Roberts | 210c584 | 2013-02-08 09:45:26 +0900 | [diff] [blame] | 103 | |
| 104 | __END_DECLS |
| 105 | |
| 106 | #endif |