1 | /*- |
2 | * Copyright (c) 2005-2008 Apple Inc. |
3 | * Copyright (c) 2005 SPARTA, Inc. |
4 | * All rights reserved. |
5 | * |
6 | * This code was developed in part by Robert N. M. Watson, Senior Principal |
7 | * Scientist, SPARTA, Inc. |
8 | * |
9 | * Redistribution and use in source and binary forms, with or without |
10 | * modification, are permitted provided that the following conditions |
11 | * are met: |
12 | * |
13 | * 1. Redistributions of source code must retain the above copyright |
14 | * notice, this list of conditions and the following disclaimer. |
15 | * 2. Redistributions in binary form must reproduce the above copyright |
16 | * notice, this list of conditions and the following disclaimer in the |
17 | * documentation and/or other materials provided with the distribution. |
18 | * 3. Neither the name of Apple Computer, Inc. ("Apple") nor the names of |
19 | * its contributors may be used to endorse or promote products derived |
20 | * from this software without specific prior written permission. |
21 | * |
22 | * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY |
23 | * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED |
24 | * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE |
25 | * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY |
26 | * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES |
27 | * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; |
28 | * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND |
29 | * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT |
30 | * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF |
31 | * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
32 | * |
33 | * $P4: //depot/projects/trustedbsd/openbsm/sys/bsm/audit_internal.h#5 $ |
34 | */ |
35 | |
36 | #ifndef _AUDIT_INTERNAL_H |
37 | #define _AUDIT_INTERNAL_H |
38 | |
39 | #if defined(__linux__) && !defined(__unused) |
40 | #define __unused |
41 | #endif |
42 | |
43 | /* |
44 | * audit_internal.h contains private interfaces that are shared by user space |
45 | * and the kernel for the purposes of assembling audit records. Applications |
46 | * should not include this file or use the APIs found within, or it may be |
47 | * broken with future releases of OpenBSM, which may delete, modify, or |
48 | * otherwise break these interfaces or the assumptions they rely on. |
49 | */ |
50 | struct au_token { |
51 | u_char *t_data; |
52 | size_t len; |
53 | TAILQ_ENTRY(au_token) tokens; |
54 | }; |
55 | |
56 | struct au_record { |
57 | char used; /* Record currently in use? */ |
58 | int desc; /* Descriptor for record. */ |
59 | TAILQ_HEAD(, au_token) token_q; /* Queue of BSM tokens. */ |
60 | u_char *data; |
61 | size_t len; |
62 | LIST_ENTRY(au_record) au_rec_q; |
63 | }; |
64 | typedef struct au_record au_record_t; |
65 | |
66 | |
67 | /* |
68 | * We could determined the header and trailer sizes by defining appropriate |
69 | * structures. We hold off that approach until we have a consistent way of |
70 | * using structures for all tokens. This is not straightforward since these |
71 | * token structures may contain pointers of whose contents we do not know the |
72 | * size (e.g text tokens). |
73 | */ |
74 | #define (a) ((a)->ai_termid.at_type+18+sizeof(u_int32_t)) |
75 | #define 18 |
76 | #define (5*sizeof(u_int32_t)+18) |
77 | #define AUDIT_TRAILER_SIZE 7 |
78 | #define MAX_AUDIT_IDENTITY_SIZE 179 |
79 | |
80 | /* |
81 | * BSM token streams store fields in big endian byte order, so as to be |
82 | * portable; when encoding and decoding, we must convert byte orders for |
83 | * typed values. |
84 | */ |
85 | #define ADD_U_CHAR(loc, val) \ |
86 | do { \ |
87 | *(loc) = (val); \ |
88 | (loc) += sizeof(u_char); \ |
89 | } while(0) |
90 | |
91 | |
92 | #define ADD_U_INT16(loc, val) \ |
93 | do { \ |
94 | be16enc((loc), (val)); \ |
95 | (loc) += sizeof(u_int16_t); \ |
96 | } while(0) |
97 | |
98 | #define ADD_U_INT32(loc, val) \ |
99 | do { \ |
100 | be32enc((loc), (val)); \ |
101 | (loc) += sizeof(u_int32_t); \ |
102 | } while(0) |
103 | |
104 | #define ADD_U_INT64(loc, val) \ |
105 | do { \ |
106 | be64enc((loc), (val)); \ |
107 | (loc) += sizeof(u_int64_t); \ |
108 | } while(0) |
109 | |
110 | #define ADD_MEM(loc, data, size) \ |
111 | do { \ |
112 | memcpy((loc), (data), (size)); \ |
113 | (loc) += size; \ |
114 | } while(0) |
115 | |
116 | #define ADD_STRING(loc, data, size) ADD_MEM(loc, data, size) |
117 | |
118 | #endif /* !_AUDIT_INTERNAL_H_ */ |
119 | |