2 * Copyright (c) 2004 Apple Inc.
3 * Copyright (c) 2006 Robert N. M. Watson
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in the
13 * documentation and/or other materials provided with the distribution.
14 * 3. Neither the name of Apple Inc. ("Apple") nor the names of
15 * its contributors may be used to endorse or promote products derived
16 * from this software without specific prior written permission.
18 * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND
19 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21 * ARE DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR
22 * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
23 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
24 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
25 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
26 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
27 * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
28 * POSSIBILITY OF SUCH DAMAGE.
31 #include <config/config.h>
33 #include <bsm/libbsm.h>
36 #ifdef HAVE_PTHREAD_MUTEX_LOCK
43 #include <compat/strlcpy.h>
48 * Parse the contents of the audit_event file to return
49 * au_event_ent entries
51 static FILE *fp = NULL;
52 static char linestr[AU_LINE_MAX];
53 static const char *eventdelim = ":";
55 #ifdef HAVE_PTHREAD_MUTEX_LOCK
56 static pthread_mutex_t mutex = PTHREAD_MUTEX_INITIALIZER;
60 * Parse one line from the audit_event file into the au_event_ent structure.
62 static struct au_event_ent *
63 eventfromstr(char *str, struct au_event_ent *e)
65 char *evno, *evname, *evdesc, *evclass;
66 struct au_mask evmask;
69 evno = strtok_r(str, eventdelim, &last);
70 evname = strtok_r(NULL, eventdelim, &last);
71 evdesc = strtok_r(NULL, eventdelim, &last);
72 evclass = strtok_r(NULL, eventdelim, &last);
74 if ((evno == NULL) || (evname == NULL))
77 if (strlen(evname) >= AU_EVENT_NAME_MAX)
80 strlcpy(e->ae_name, evname, AU_EVENT_NAME_MAX);
82 if (strlen(evdesc) >= AU_EVENT_DESC_MAX)
84 strlcpy(e->ae_desc, evdesc, AU_EVENT_DESC_MAX);
86 strlcpy(e->ae_desc, "", AU_EVENT_DESC_MAX);
88 e->ae_number = atoi(evno);
91 * Find out the mask that corresponds to the given list of classes.
93 if (evclass != NULL) {
94 if (getauditflagsbin(evclass, &evmask) != 0)
97 e->ae_class = evmask.am_success;
105 * Rewind the audit_event file.
108 setauevent_locked(void)
112 fseek(fp, 0, SEEK_SET);
119 #ifdef HAVE_PTHREAD_MUTEX_LOCK
120 pthread_mutex_lock(&mutex);
123 #ifdef HAVE_PTHREAD_MUTEX_LOCK
124 pthread_mutex_unlock(&mutex);
129 * Close the open file pointers.
135 #ifdef HAVE_PTHREAD_MUTEX_LOCK
136 pthread_mutex_lock(&mutex);
142 #ifdef HAVE_PTHREAD_MUTEX_LOCK
143 pthread_mutex_unlock(&mutex);
148 * Enumerate the au_event_ent entries.
150 static struct au_event_ent *
151 getauevent_r_locked(struct au_event_ent *e)
155 if ((fp == NULL) && ((fp = fopen(AUDIT_EVENT_FILE, "r")) == NULL))
159 if (fgets(linestr, AU_LINE_MAX, fp) == NULL)
162 /* Remove new lines. */
163 if ((nl = strrchr(linestr, '\n')) != NULL)
167 if (linestr[0] == '#')
170 /* Get the next event structure. */
171 if (eventfromstr(linestr, e) == NULL)
179 struct au_event_ent *
180 getauevent_r(struct au_event_ent *e)
182 struct au_event_ent *ep;
184 #ifdef HAVE_PTHREAD_MUTEX_LOCK
185 pthread_mutex_lock(&mutex);
187 ep = getauevent_r_locked(e);
188 #ifdef HAVE_PTHREAD_MUTEX_LOCK
189 pthread_mutex_unlock(&mutex);
194 struct au_event_ent *
197 static char event_ent_name[AU_EVENT_NAME_MAX];
198 static char event_ent_desc[AU_EVENT_DESC_MAX];
199 static struct au_event_ent e;
201 bzero(&e, sizeof(e));
202 bzero(event_ent_name, sizeof(event_ent_name));
203 bzero(event_ent_desc, sizeof(event_ent_desc));
204 e.ae_name = event_ent_name;
205 e.ae_desc = event_ent_desc;
206 return (getauevent_r(&e));
210 * Search for an audit event structure having the given event name.
212 * XXXRW: Why accept NULL name?
214 static struct au_event_ent *
215 getauevnam_r_locked(struct au_event_ent *e, const char *name)
222 /* Rewind to beginning of the file. */
225 if ((fp == NULL) && ((fp = fopen(AUDIT_EVENT_FILE, "r")) == NULL))
228 while (fgets(linestr, AU_LINE_MAX, fp) != NULL) {
229 /* Remove new lines. */
230 if ((nl = strrchr(linestr, '\n')) != NULL)
233 if (eventfromstr(linestr, e) != NULL) {
234 if (strcmp(name, e->ae_name) == 0)
242 struct au_event_ent *
243 getauevnam_r(struct au_event_ent *e, const char *name)
245 struct au_event_ent *ep;
247 #ifdef HAVE_PTHREAD_MUTEX_LOCK
248 pthread_mutex_lock(&mutex);
250 ep = getauevnam_r_locked(e, name);
251 #ifdef HAVE_PTHREAD_MUTEX_LOCK
252 pthread_mutex_unlock(&mutex);
257 struct au_event_ent *
258 getauevnam(const char *name)
260 static char event_ent_name[AU_EVENT_NAME_MAX];
261 static char event_ent_desc[AU_EVENT_DESC_MAX];
262 static struct au_event_ent e;
264 bzero(&e, sizeof(e));
265 bzero(event_ent_name, sizeof(event_ent_name));
266 bzero(event_ent_desc, sizeof(event_ent_desc));
267 e.ae_name = event_ent_name;
268 e.ae_desc = event_ent_desc;
269 return (getauevnam_r(&e, name));
273 * Search for an audit event structure having the given event number.
275 static struct au_event_ent *
276 getauevnum_r_locked(struct au_event_ent *e, au_event_t event_number)
280 /* Rewind to beginning of the file. */
283 if ((fp == NULL) && ((fp = fopen(AUDIT_EVENT_FILE, "r")) == NULL))
286 while (fgets(linestr, AU_LINE_MAX, fp) != NULL) {
287 /* Remove new lines. */
288 if ((nl = strrchr(linestr, '\n')) != NULL)
291 if (eventfromstr(linestr, e) != NULL) {
292 if (event_number == e->ae_number)
300 struct au_event_ent *
301 getauevnum_r(struct au_event_ent *e, au_event_t event_number)
303 struct au_event_ent *ep;
305 #ifdef HAVE_PTHREAD_MUTEX_LOCK
306 pthread_mutex_lock(&mutex);
308 ep = getauevnum_r_locked(e, event_number);
309 #ifdef HAVE_PTHREAD_MUTEX_LOCK
310 pthread_mutex_unlock(&mutex);
315 struct au_event_ent *
316 getauevnum(au_event_t event_number)
318 static char event_ent_name[AU_EVENT_NAME_MAX];
319 static char event_ent_desc[AU_EVENT_DESC_MAX];
320 static struct au_event_ent e;
322 bzero(&e, sizeof(e));
323 bzero(event_ent_name, sizeof(event_ent_name));
324 bzero(event_ent_desc, sizeof(event_ent_desc));
325 e.ae_name = event_ent_name;
326 e.ae_desc = event_ent_desc;
327 return (getauevnum_r(&e, event_number));
331 * Search for an audit_event entry with a given event_name and returns the
332 * corresponding event number.
335 getauevnonam_r(au_event_t *ev, const char *event_name)
337 static char event_ent_name[AU_EVENT_NAME_MAX];
338 static char event_ent_desc[AU_EVENT_DESC_MAX];
339 static struct au_event_ent e, *ep;
341 bzero(event_ent_name, sizeof(event_ent_name));
342 bzero(event_ent_desc, sizeof(event_ent_desc));
343 bzero(&e, sizeof(e));
344 e.ae_name = event_ent_name;
345 e.ae_desc = event_ent_desc;
347 ep = getauevnam_r(&e, event_name);
356 getauevnonam(const char *event_name)
358 static au_event_t event;
360 return (getauevnonam_r(&event, event_name));