Manual Pages  — AU_MASK

au_preselect, getauditflagsbin, getauditflagschar – convert between string and numeric values of audit masks

LIBRARY SYNOPSIS DESCRIPTION IMPLEMENTATION NOTES RETURN VALUES SEE ALSO HISTORY AUTHORS BUGS

Basic Security Module User Library (libbsm, -lbsm)

#include <bsm/libbsm.h>

int
au_preselect(au_event_t event, au_mask_t *mask_p, int sorf, int flag);

int
getauditflagsbin(char *auditstr, au_mask_t *masks);

int
getauditflagschar(char *auditstr, au_mask_t *masks, int verbose);

The au_preselect() function makes implicit use of various audit database routines, and may influence the behavior of simultaneous or interleaved processing of those databases by other code.

The au_preselect() function returns 0 on success, or returns -1 if there is a failure looking up the event type or other database access, in which case errno will be set to indicate the error. It returns 1 if the event is matched; 0 if not.

The getauditflagsbinand getauditflagschar functions return the value 0 if successful; otherwise the value -1 is returned and the global variable errno is set to indicate the error.

The OpenBSM implementation was created by McAfee Research, the security division of McAfee Inc., under contract to Apple Computer, Inc., in 2004. It was subsequently adopted by the TrustedBSD Project as the foundation for the OpenBSM distribution.

This software was created by Robert Watson, Wayne Salamon, and Suresh Krishnaswamy for McAfee Research, the security research division of McAfee, Inc., under contract to Apple Computer, Inc.

The Basic Security Module (BSM) interface to audit records and audit event stream format were defined by Sun Microsystems.

The errno variable may not always be properly set in the event of an error.

The getauditflagschar() function does not provide a way to indicate how long the character buffer is, in order to detect overflow. As a result, the caller must always provide a buffer of sufficient length for any possible mask, which may be calculated as three times the number of non-zero bits in the mask argument in the event non-verbose class names are used, and is not trivially predictable for verbose class names. This API should be replaced with a more robust one.