2 * Copyright (c) 2004 Apple Inc.
3 * Copyright (c) 2006 Robert N. M. Watson
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in the
13 * documentation and/or other materials provided with the distribution.
14 * 3. Neither the name of Apple Inc. ("Apple") nor the names of
15 * its contributors may be used to endorse or promote products derived
16 * from this software without specific prior written permission.
18 * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND
19 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21 * ARE DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR
22 * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
23 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
24 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
25 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
26 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
27 * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
28 * POSSIBILITY OF SUCH DAMAGE.
30 * $P4: //depot/projects/trustedbsd/openbsm/libbsm/bsm_event.c#17 $
33 #include <config/config.h>
35 #include <bsm/libbsm.h>
38 #ifdef HAVE_PTHREAD_MUTEX_LOCK
45 #include <compat/strlcpy.h>
50 * Parse the contents of the audit_event file to return
51 * au_event_ent entries
53 static FILE *fp = NULL;
54 static char linestr[AU_LINE_MAX];
55 static const char *eventdelim = ":";
57 #ifdef HAVE_PTHREAD_MUTEX_LOCK
58 static pthread_mutex_t mutex = PTHREAD_MUTEX_INITIALIZER;
62 * Parse one line from the audit_event file into the au_event_ent structure.
64 static struct au_event_ent *
65 eventfromstr(char *str, struct au_event_ent *e)
67 char *evno, *evname, *evdesc, *evclass;
68 struct au_mask evmask;
71 evno = strtok_r(str, eventdelim, &last);
72 evname = strtok_r(NULL, eventdelim, &last);
73 evdesc = strtok_r(NULL, eventdelim, &last);
74 evclass = strtok_r(NULL, eventdelim, &last);
76 if ((evno == NULL) || (evname == NULL))
79 if (strlen(evname) >= AU_EVENT_NAME_MAX)
82 strlcpy(e->ae_name, evname, AU_EVENT_NAME_MAX);
84 if (strlen(evdesc) >= AU_EVENT_DESC_MAX)
86 strlcpy(e->ae_desc, evdesc, AU_EVENT_DESC_MAX);
88 strlcpy(e->ae_desc, "", AU_EVENT_DESC_MAX);
90 e->ae_number = atoi(evno);
93 * Find out the mask that corresponds to the given list of classes.
95 if (evclass != NULL) {
96 if (getauditflagsbin(evclass, &evmask) != 0)
99 e->ae_class = evmask.am_success;
107 * Rewind the audit_event file.
110 setauevent_locked(void)
114 fseek(fp, 0, SEEK_SET);
121 #ifdef HAVE_PTHREAD_MUTEX_LOCK
122 pthread_mutex_lock(&mutex);
125 #ifdef HAVE_PTHREAD_MUTEX_LOCK
126 pthread_mutex_unlock(&mutex);
131 * Close the open file pointers.
137 #ifdef HAVE_PTHREAD_MUTEX_LOCK
138 pthread_mutex_lock(&mutex);
144 #ifdef HAVE_PTHREAD_MUTEX_LOCK
145 pthread_mutex_unlock(&mutex);
150 * Enumerate the au_event_ent entries.
152 static struct au_event_ent *
153 getauevent_r_locked(struct au_event_ent *e)
157 if ((fp == NULL) && ((fp = fopen(AUDIT_EVENT_FILE, "r")) == NULL))
161 if (fgets(linestr, AU_LINE_MAX, fp) == NULL)
164 /* Remove new lines. */
165 if ((nl = strrchr(linestr, '\n')) != NULL)
169 if (linestr[0] == '#')
172 /* Get the next event structure. */
173 if (eventfromstr(linestr, e) == NULL)
181 struct au_event_ent *
182 getauevent_r(struct au_event_ent *e)
184 struct au_event_ent *ep;
186 #ifdef HAVE_PTHREAD_MUTEX_LOCK
187 pthread_mutex_lock(&mutex);
189 ep = getauevent_r_locked(e);
190 #ifdef HAVE_PTHREAD_MUTEX_LOCK
191 pthread_mutex_unlock(&mutex);
196 struct au_event_ent *
199 static char event_ent_name[AU_EVENT_NAME_MAX];
200 static char event_ent_desc[AU_EVENT_DESC_MAX];
201 static struct au_event_ent e;
203 bzero(&e, sizeof(e));
204 bzero(event_ent_name, sizeof(event_ent_name));
205 bzero(event_ent_desc, sizeof(event_ent_desc));
206 e.ae_name = event_ent_name;
207 e.ae_desc = event_ent_desc;
208 return (getauevent_r(&e));
212 * Search for an audit event structure having the given event name.
214 * XXXRW: Why accept NULL name?
216 static struct au_event_ent *
217 getauevnam_r_locked(struct au_event_ent *e, const char *name)
224 /* Rewind to beginning of the file. */
227 if ((fp == NULL) && ((fp = fopen(AUDIT_EVENT_FILE, "r")) == NULL))
230 while (fgets(linestr, AU_LINE_MAX, fp) != NULL) {
231 /* Remove new lines. */
232 if ((nl = strrchr(linestr, '\n')) != NULL)
235 if (eventfromstr(linestr, e) != NULL) {
236 if (strcmp(name, e->ae_name) == 0)
244 struct au_event_ent *
245 getauevnam_r(struct au_event_ent *e, const char *name)
247 struct au_event_ent *ep;
249 #ifdef HAVE_PTHREAD_MUTEX_LOCK
250 pthread_mutex_lock(&mutex);
252 ep = getauevnam_r_locked(e, name);
253 #ifdef HAVE_PTHREAD_MUTEX_LOCK
254 pthread_mutex_unlock(&mutex);
259 struct au_event_ent *
260 getauevnam(const char *name)
262 static char event_ent_name[AU_EVENT_NAME_MAX];
263 static char event_ent_desc[AU_EVENT_DESC_MAX];
264 static struct au_event_ent e;
266 bzero(&e, sizeof(e));
267 bzero(event_ent_name, sizeof(event_ent_name));
268 bzero(event_ent_desc, sizeof(event_ent_desc));
269 e.ae_name = event_ent_name;
270 e.ae_desc = event_ent_desc;
271 return (getauevnam_r(&e, name));
275 * Search for an audit event structure having the given event number.
277 static struct au_event_ent *
278 getauevnum_r_locked(struct au_event_ent *e, au_event_t event_number)
282 /* Rewind to beginning of the file. */
285 if ((fp == NULL) && ((fp = fopen(AUDIT_EVENT_FILE, "r")) == NULL))
288 while (fgets(linestr, AU_LINE_MAX, fp) != NULL) {
289 /* Remove new lines. */
290 if ((nl = strrchr(linestr, '\n')) != NULL)
293 if (eventfromstr(linestr, e) != NULL) {
294 if (event_number == e->ae_number)
302 struct au_event_ent *
303 getauevnum_r(struct au_event_ent *e, au_event_t event_number)
305 struct au_event_ent *ep;
307 #ifdef HAVE_PTHREAD_MUTEX_LOCK
308 pthread_mutex_lock(&mutex);
310 ep = getauevnum_r_locked(e, event_number);
311 #ifdef HAVE_PTHREAD_MUTEX_LOCK
312 pthread_mutex_unlock(&mutex);
317 struct au_event_ent *
318 getauevnum(au_event_t event_number)
320 static char event_ent_name[AU_EVENT_NAME_MAX];
321 static char event_ent_desc[AU_EVENT_DESC_MAX];
322 static struct au_event_ent e;
324 bzero(&e, sizeof(e));
325 bzero(event_ent_name, sizeof(event_ent_name));
326 bzero(event_ent_desc, sizeof(event_ent_desc));
327 e.ae_name = event_ent_name;
328 e.ae_desc = event_ent_desc;
329 return (getauevnum_r(&e, event_number));
333 * Search for an audit_event entry with a given event_name and returns the
334 * corresponding event number.
337 getauevnonam_r(au_event_t *ev, const char *event_name)
339 static char event_ent_name[AU_EVENT_NAME_MAX];
340 static char event_ent_desc[AU_EVENT_DESC_MAX];
341 static struct au_event_ent e, *ep;
343 bzero(event_ent_name, sizeof(event_ent_name));
344 bzero(event_ent_desc, sizeof(event_ent_desc));
345 bzero(&e, sizeof(e));
346 e.ae_name = event_ent_name;
347 e.ae_desc = event_ent_desc;
349 ep = getauevnam_r(&e, event_name);
358 getauevnonam(const char *event_name)
360 static au_event_t event;
362 return (getauevnonam_r(&event, event_name));