1 /*
2  * Copyright 2012, Samsung Telecommunications of America
3  * Copyright (C) 2014 The Android Open Source Project
4  *
5  * Licensed under the Apache License, Version 2.0 (the "License");
6  * you may not use this file except in compliance with the License.
7  * You may obtain a copy of the License at
8  *
9  *     http://www.apache.org/licenses/LICENSE-2.0
10  *
11  * Unless required by applicable law or agreed to in writing, software
12  * distributed under the License is distributed on an "AS IS" BASIS,
13  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14  * See the License for the specific language governing permissions and
15  * limitations under the License.
16  *
17  * Written by William Roberts <w.roberts@sta.samsung.com>
18  */
19 
20 #pragma once
21 
22 #include <stdint.h>
23 #include <sys/cdefs.h>
24 #include <sys/socket.h>
25 #include <sys/types.h>
26 
27 #include <linux/audit.h>
28 #include <linux/netlink.h>
29 
30 __BEGIN_DECLS
31 
32 #define MAX_AUDIT_MESSAGE_LENGTH 8970
33 
34 typedef enum { GET_REPLY_BLOCKING = 0, GET_REPLY_NONBLOCKING } reply_t;
35 
36 /* type == AUDIT_SIGNAL_INFO */
37 struct audit_sig_info {
38     uid_t uid;
39     pid_t pid;
40     char ctx[0];
41 };
42 
43 struct audit_message {
44     struct nlmsghdr nlh;
45     char data[MAX_AUDIT_MESSAGE_LENGTH];
46 };
47 
48 /**
49  * Opens a connection to the Audit netlink socket
50  * @return
51  *  A valid fd on success or < 0 on error with errno set.
52  *  Returns the same errors as man 2 socket.
53  */
54 extern int audit_open(void);
55 
56 /**
57  * Closes the fd returned from audit_open()
58  * @param fd
59  *  The fd to close
60  */
61 extern void audit_close(int fd);
62 
63 /**
64  *
65  * @param fd
66  *  The fd returned by a call to audit_open()
67  * @param rep
68  *  The response struct to store the response in.
69  * @param block
70  *  Whether or not to block on IO
71  * @param peek
72  *  Whether or not we are to remove the message from
73  *  the queue when we do a read on the netlink socket.
74  * @return
75  *  This function returns 0 on success, else -errno.
76  */
77 extern int audit_get_reply(int fd, struct audit_message* rep, reply_t block,
78                            int peek);
79 
80 /**
81  * Sets a pid to receive audit netlink events from the kernel
82  * @param fd
83  *  The fd returned by a call to audit_open()
84  * @param pid
85  *  The pid whom to set as the receiver of audit messages
86  * @return
87  *  This function returns 0 on success, -errno on error.
88  */
89 extern int audit_setup(int fd, pid_t pid);
90 
91 /**
92  * Throttle kernel messages at the provided rate
93  * @param fd
94  *  The fd returned by a call to audit_open()
95  * @param rate
96  *  The rate, in messages per second, above which the kernel
97  *  should drop audit messages.
98  * @return
99  *  This function returns 0 on success, -errno on error.
100  */
101 extern int audit_rate_limit(int fd, uint32_t limit);
102 
103 __END_DECLS
104