1 /*
2  * Copyright 2012, Samsung Telecommunications of America
3  * Copyright (C) 2014 The Android Open Source Project
4  *
5  * Licensed under the Apache License, Version 2.0 (the "License");
6  * you may not use this file except in compliance with the License.
7  * You may obtain a copy of the License at
8  *
9  *     http://www.apache.org/licenses/LICENSE-2.0
10  *
11  * Unless required by applicable law or agreed to in writing, software
12  * distributed under the License is distributed on an "AS IS" BASIS,
13  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14  * See the License for the specific language governing permissions and
15  * limitations under the License.
16  *
17  * Written by William Roberts <w.roberts@sta.samsung.com>
18  */
19 
20 #ifndef _LIBAUDIT_H_
21 #define _LIBAUDIT_H_
22 
23 #include <stdint.h>
24 #include <sys/cdefs.h>
25 #include <sys/socket.h>
26 #include <sys/types.h>
27 
28 #include <linux/audit.h>
29 #include <linux/netlink.h>
30 
31 __BEGIN_DECLS
32 
33 #define MAX_AUDIT_MESSAGE_LENGTH 8970
34 
35 typedef enum { GET_REPLY_BLOCKING = 0, GET_REPLY_NONBLOCKING } reply_t;
36 
37 /* type == AUDIT_SIGNAL_INFO */
38 struct audit_sig_info {
39     uid_t uid;
40     pid_t pid;
41     char ctx[0];
42 };
43 
44 struct audit_message {
45     struct nlmsghdr nlh;
46     char data[MAX_AUDIT_MESSAGE_LENGTH];
47 };
48 
49 /**
50  * Opens a connection to the Audit netlink socket
51  * @return
52  *  A valid fd on success or < 0 on error with errno set.
53  *  Returns the same errors as man 2 socket.
54  */
55 extern int audit_open(void);
56 
57 /**
58  * Closes the fd returned from audit_open()
59  * @param fd
60  *  The fd to close
61  */
62 extern void audit_close(int fd);
63 
64 /**
65  *
66  * @param fd
67  *  The fd returned by a call to audit_open()
68  * @param rep
69  *  The response struct to store the response in.
70  * @param block
71  *  Whether or not to block on IO
72  * @param peek
73  *  Whether or not we are to remove the message from
74  *  the queue when we do a read on the netlink socket.
75  * @return
76  *  This function returns 0 on success, else -errno.
77  */
78 extern int audit_get_reply(int fd, struct audit_message* rep, reply_t block,
79                            int peek);
80 
81 /**
82  * Sets a pid to receive audit netlink events from the kernel
83  * @param fd
84  *  The fd returned by a call to audit_open()
85  * @param pid
86  *  The pid whom to set as the receiver of audit messages
87  * @return
88  *  This function returns 0 on success, -errno on error.
89  */
90 extern int audit_setup(int fd, pid_t pid);
91 
92 /**
93  * Sets the rate limit to receive audit netlink events from the kernel
94  * @param fd
95  *  The fd returned by a call to audit_open()
96  * @param max_rate
97  *  The cap of the maximum number of audit messages a second
98  * @return
99  *  This function returns 0 on success, -errno on error.
100  */
101 
102 /* Guidelines to follow for dynamic rate_limit */
103 #define AUDIT_RATE_LIMIT_DEFAULT 20        /* acceptable burst rate      */
104 #define AUDIT_RATE_LIMIT_BURST_DURATION 10 /* number of seconds of burst */
105 #define AUDIT_RATE_LIMIT_MAX 5             /* acceptable sustained rate  */
106 
107 extern int audit_rate_limit(int fd, unsigned rate_limit);
108 
109 __END_DECLS
110 
111 #endif
112