|
Linux Kernel
3.7.1
|
All Data Structures Namespaces Files Functions Variables Typedefs Enumerations Enumerator Macros Groups Pages
|
Linux Kernel
3.7.1
|
#include <linux/init.h>#include <asm/types.h>#include <linux/atomic.h>#include <linux/mm.h>#include <linux/export.h>#include <linux/slab.h>#include <linux/err.h>#include <linux/kthread.h>#include <linux/audit.h>#include <net/sock.h>#include <net/netlink.h>#include <linux/skbuff.h>#include <linux/netlink.h>#include <linux/freezer.h>#include <linux/tty.h>#include <linux/pid_namespace.h>#include "audit.h"Go to the source code of this file.
Data Structures | |
| struct | audit_buffer |
| struct | audit_reply |
Macros | |
| #define | AUDIT_DISABLED -1 |
| #define | AUDIT_UNINITIALIZED 0 |
| #define | AUDIT_INITIALIZED 1 |
| #define | AUDIT_OFF 0 |
| #define | AUDIT_ON 1 |
| #define | AUDIT_LOCKED 2 |
| #define | AUDIT_BUFSIZ 1024 |
| #define | AUDIT_MAXFREE (2*NR_CPUS) |
| __initcall | ( | audit_init | ) |
| __setup | ( | ) |
| void audit_log_end | ( | struct audit_buffer * | ab | ) |
| void audit_log_format | ( | struct audit_buffer * | ab, |
| const char * | fmt, | ||
| ... | |||
| ) |
audit_log_format - format a message into the audit buffer. : audit_buffer : format string ..: optional parameters matching string
All the work is done in audit_log_vformat.
| void audit_log_key | ( | struct audit_buffer * | ab, |
| char * | key | ||
| ) |
audit_log_hex - convert a buffer to hex and append it to the audit skb : the audit_buffer : buffer to convert to hex : length of to be converted
No return value; failure to expand is silently ignored.
This function will take the passed buf and convert it into a string of ascii hex digits. The new string is placed onto the skb.
audit_log_n_untrustedstring - log a string that may contain random characters : audit_buffer : length of string (not including trailing null) : string to be logged
This code will escape a string that is passed to it if the string contains a control character, unprintable character, double quote mark, or a space. Unescaped strings will start and end with a double quote mark. Strings that are escaped are printed in hex (2 digits per char).
The caller specifies the number of characters in the string to log, which may or may not be the entire string.
|
read |
audit_log_start - obtain an audit buffer : audit_context (may be NULL) : type of allocation : audit message type
Returns audit_buffer pointer on success or NULL on error.
Obtain an audit buffer. This routine does locking to obtain the audit buffer, but then no locking is required for calls to audit_log_*format. If the task (ctx) is a task that is currently in a syscall, then the syscall is marked as auditable and an audit record will be written at syscall exit. If there is no associated task, then task context (ctx) should be NULL.
| void audit_log_untrustedstring | ( | struct audit_buffer * | ab, |
| const char * | string | ||
| ) |
audit_log_untrustedstring - log a string that may contain random characters : audit_buffer : string to be logged
Same as audit_log_n_untrustedstring(), except that strlen is used to determine string length.
audit_serial - compute a serial number for the audit record
Compute a serial number for the audit record. Audit records are written to user-space as soon as they are generated, so a complete audit record may be written in several pieces. The timestamp of the record and this serial number are used by the user-space tools to determine which pieces belong to the same audit record. The (timestamp,serial) tuple is unique for each syscall and is live from syscall entry to syscall exit.
NOTE: Another possibility is to store the formatted records off the audit context (for those records that have a context), and emit them all at syscall exit. However, this could delay the reporting of significant errors until syscall exit (or never, if the system halts).
| DEFINE_MUTEX | ( | audit_cmd_mutex | ) |
| EXPORT_SYMBOL | ( | audit_log_start | ) |
| EXPORT_SYMBOL | ( | audit_log_end | ) |
| EXPORT_SYMBOL | ( | audit_log_format | ) |
| EXPORT_SYMBOL | ( | audit_log | ) |
| EXPORT_SYMBOL_GPL | ( | audit_enabled | ) |
| struct list_head audit_inode_hash[AUDIT_INODE_BUCKETS] |
| kuid_t audit_sig_uid = INVALID_UID |
1.8.2