1 /*
2  * Copyright 2012, Samsung Telecommunications of America
3  * Copyright (C) 2014 The Android Open Source Project
4  *
5  * Licensed under the Apache License, Version 2.0 (the "License");
6  * you may not use this file except in compliance with the License.
7  * You may obtain a copy of the License at
8  *
9  *     http://www.apache.org/licenses/LICENSE-2.0
10  *
11  * Unless required by applicable law or agreed to in writing, software
12  * distributed under the License is distributed on an "AS IS" BASIS,
13  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14  * See the License for the specific language governing permissions and
15  * limitations under the License.
16  *
17  * Written by William Roberts <w.roberts@sta.samsung.com>
18  */
19 
20 #ifndef _LIBAUDIT_H_
21 #define _LIBAUDIT_H_
22 
23 #include <stdint.h>
24 #include <sys/cdefs.h>
25 #include <sys/socket.h>
26 #include <sys/types.h>
27 
28 #include <linux/netlink.h>
29 #include <linux/audit.h>
30 
31 __BEGIN_DECLS
32 
33 #define MAX_AUDIT_MESSAGE_LENGTH    8970
34 
35 typedef enum {
36     GET_REPLY_BLOCKING=0,
37     GET_REPLY_NONBLOCKING
38 } reply_t;
39 
40 /* type == AUDIT_SIGNAL_INFO */
41 struct audit_sig_info {
42     uid_t uid;
43     pid_t pid;
44     char ctx[0];
45 };
46 
47 struct audit_message {
48     struct nlmsghdr nlh;
49     char   data[MAX_AUDIT_MESSAGE_LENGTH];
50 };
51 
52 /**
53  * Opens a connection to the Audit netlink socket
54  * @return
55  *  A valid fd on success or < 0 on error with errno set.
56  *  Returns the same errors as man 2 socket.
57  */
58 extern int  audit_open(void);
59 
60 /**
61  * Closes the fd returned from audit_open()
62  * @param fd
63  *  The fd to close
64  */
65 extern void audit_close(int fd);
66 
67 /**
68  *
69  * @param fd
70  *  The fd returned by a call to audit_open()
71  * @param rep
72  *  The response struct to store the response in.
73  * @param block
74  *  Whether or not to block on IO
75  * @param peek
76  *  Whether or not we are to remove the message from
77  *  the queue when we do a read on the netlink socket.
78  * @return
79  *  This function returns 0 on success, else -errno.
80  */
81 extern int  audit_get_reply(int fd, struct audit_message *rep, reply_t block,
82                int peek);
83 
84 /**
85  * Sets a pid to recieve audit netlink events from the kernel
86  * @param fd
87  *  The fd returned by a call to audit_open()
88  * @param pid
89  *  The pid whom to set as the reciever of audit messages
90  * @return
91  *  This function returns 0 on success, -errno on error.
92  */
93 extern int  audit_setup(int fd, uint32_t pid);
94 
95 __END_DECLS
96 
97 #endif
98