1/*
2 * Copyright 2012, Samsung Telecommunications of America
3 * Copyright (C) 2014 The Android Open Source Project
4 *
5 * Licensed under the Apache License, Version 2.0 (the "License");
6 * you may not use this file except in compliance with the License.
7 * You may obtain a copy of the License at
8 *
9 *     http://www.apache.org/licenses/LICENSE-2.0
10 *
11 * Unless required by applicable law or agreed to in writing, software
12 * distributed under the License is distributed on an "AS IS" BASIS,
13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 * See the License for the specific language governing permissions and
15 * limitations under the License.
16 *
17 * Written by William Roberts <w.roberts@sta.samsung.com>
18 */
19
20#ifndef _LIBAUDIT_H_
21#define _LIBAUDIT_H_
22
23#include <stdint.h>
24#include <sys/cdefs.h>
25#include <sys/socket.h>
26#include <sys/types.h>
27
28#include <linux/audit.h>
29#include <linux/netlink.h>
30
31__BEGIN_DECLS
32
33#define MAX_AUDIT_MESSAGE_LENGTH 8970
34
35typedef enum { GET_REPLY_BLOCKING = 0, GET_REPLY_NONBLOCKING } reply_t;
36
37/* type == AUDIT_SIGNAL_INFO */
38struct audit_sig_info {
39    uid_t uid;
40    pid_t pid;
41    char ctx[0];
42};
43
44struct audit_message {
45    struct nlmsghdr nlh;
46    char data[MAX_AUDIT_MESSAGE_LENGTH];
47};
48
49/**
50 * Opens a connection to the Audit netlink socket
51 * @return
52 *  A valid fd on success or < 0 on error with errno set.
53 *  Returns the same errors as man 2 socket.
54 */
55extern int audit_open(void);
56
57/**
58 * Closes the fd returned from audit_open()
59 * @param fd
60 *  The fd to close
61 */
62extern void audit_close(int fd);
63
64/**
65 *
66 * @param fd
67 *  The fd returned by a call to audit_open()
68 * @param rep
69 *  The response struct to store the response in.
70 * @param block
71 *  Whether or not to block on IO
72 * @param peek
73 *  Whether or not we are to remove the message from
74 *  the queue when we do a read on the netlink socket.
75 * @return
76 *  This function returns 0 on success, else -errno.
77 */
78extern int audit_get_reply(int fd, struct audit_message* rep, reply_t block,
79                           int peek);
80
81/**
82 * Sets a pid to receive audit netlink events from the kernel
83 * @param fd
84 *  The fd returned by a call to audit_open()
85 * @param pid
86 *  The pid whom to set as the receiver of audit messages
87 * @return
88 *  This function returns 0 on success, -errno on error.
89 */
90extern int audit_setup(int fd, pid_t pid);
91
92/* Max audit messages per second  */
93#define AUDIT_RATE_LIMIT 5
94
95__END_DECLS
96
97#endif
98