1/*
2 * Copyright 2012, Samsung Telecommunications of America
3 * Copyright (C) 2014 The Android Open Source Project
4 *
5 * Licensed under the Apache License, Version 2.0 (the "License");
6 * you may not use this file except in compliance with the License.
7 * You may obtain a copy of the License at
8 *
9 *     http://www.apache.org/licenses/LICENSE-2.0
10 *
11 * Unless required by applicable law or agreed to in writing, software
12 * distributed under the License is distributed on an "AS IS" BASIS,
13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 * See the License for the specific language governing permissions and
15 * limitations under the License.
16 *
17 * Written by William Roberts <w.roberts@sta.samsung.com>
18 */
19
20#ifndef _LIBAUDIT_H_
21#define _LIBAUDIT_H_
22
23#include <stdint.h>
24#include <sys/cdefs.h>
25#include <sys/socket.h>
26#include <sys/types.h>
27
28#include <linux/netlink.h>
29#include <linux/audit.h>
30
31__BEGIN_DECLS
32
33#define MAX_AUDIT_MESSAGE_LENGTH    8970
34
35typedef enum {
36    GET_REPLY_BLOCKING=0,
37    GET_REPLY_NONBLOCKING
38} reply_t;
39
40/* type == AUDIT_SIGNAL_INFO */
41struct audit_sig_info {
42    uid_t uid;
43    pid_t pid;
44    char ctx[0];
45};
46
47struct audit_message {
48    struct nlmsghdr nlh;
49    char   data[MAX_AUDIT_MESSAGE_LENGTH];
50};
51
52/**
53 * Opens a connection to the Audit netlink socket
54 * @return
55 *  A valid fd on success or < 0 on error with errno set.
56 *  Returns the same errors as man 2 socket.
57 */
58extern int  audit_open(void);
59
60/**
61 * Closes the fd returned from audit_open()
62 * @param fd
63 *  The fd to close
64 */
65extern void audit_close(int fd);
66
67/**
68 *
69 * @param fd
70 *  The fd returned by a call to audit_open()
71 * @param rep
72 *  The response struct to store the response in.
73 * @param block
74 *  Whether or not to block on IO
75 * @param peek
76 *  Whether or not we are to remove the message from
77 *  the queue when we do a read on the netlink socket.
78 * @return
79 *  This function returns 0 on success, else -errno.
80 */
81extern int  audit_get_reply(int fd, struct audit_message *rep, reply_t block,
82               int peek);
83
84/**
85 * Sets a pid to recieve audit netlink events from the kernel
86 * @param fd
87 *  The fd returned by a call to audit_open()
88 * @param pid
89 *  The pid whom to set as the reciever of audit messages
90 * @return
91 *  This function returns 0 on success, -errno on error.
92 */
93extern int  audit_setup(int fd, uint32_t pid);
94
95__END_DECLS
96
97#endif
98