1 | /*- |
2 | * Copyright (c) 2005-2008 Apple Inc. |
3 | * Copyright (c) 2005 SPARTA, Inc. |
4 | * All rights reserved. |
5 | * |
6 | * This code was developed in part by Robert N. M. Watson, Senior Principal |
7 | * Scientist, SPARTA, Inc. |
8 | * |
9 | * Redistribution and use in source and binary forms, with or without |
10 | * modification, are permitted provided that the following conditions |
11 | * are met: |
12 | * |
13 | * 1. Redistributions of source code must retain the above copyright |
14 | * notice, this list of conditions and the following disclaimer. |
15 | * 2. Redistributions in binary form must reproduce the above copyright |
16 | * notice, this list of conditions and the following disclaimer in the |
17 | * documentation and/or other materials provided with the distribution. |
18 | * 3. Neither the name of Apple Computer, Inc. ("Apple") nor the names of |
19 | * its contributors may be used to endorse or promote products derived |
20 | * from this software without specific prior written permission. |
21 | * |
22 | * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY |
23 | * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED |
24 | * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE |
25 | * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY |
26 | * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES |
27 | * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; |
28 | * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND |
29 | * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT |
30 | * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF |
31 | * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
32 | * |
33 | * $P4: //depot/projects/trustedbsd/openbsm/sys/bsm/audit_internal.h#5 $ |
34 | */ |
35 | |
36 | #ifndef _AUDIT_INTERNAL_H |
37 | #define _AUDIT_INTERNAL_H |
38 | |
39 | #if defined(__linux__) && !defined(__unused) |
40 | #define __unused |
41 | #endif |
42 | |
43 | #include <stddef.h> |
44 | #include <sys/queue.h> |
45 | #include <sys/types.h> |
46 | |
47 | /* |
48 | * audit_internal.h contains private interfaces that are shared by user space |
49 | * and the kernel for the purposes of assembling audit records. Applications |
50 | * should not include this file or use the APIs found within, or it may be |
51 | * broken with future releases of OpenBSM, which may delete, modify, or |
52 | * otherwise break these interfaces or the assumptions they rely on. |
53 | */ |
54 | struct au_token { |
55 | u_char *t_data; |
56 | size_t len; |
57 | TAILQ_ENTRY(au_token) tokens; |
58 | }; |
59 | |
60 | struct au_record { |
61 | char used; /* Record currently in use? */ |
62 | int desc; /* Descriptor for record. */ |
63 | TAILQ_HEAD(, au_token) token_q; /* Queue of BSM tokens. */ |
64 | u_char *data; |
65 | size_t len; |
66 | LIST_ENTRY(au_record) au_rec_q; |
67 | }; |
68 | typedef struct au_record au_record_t; |
69 | |
70 | |
71 | /* |
72 | * We could determined the header and trailer sizes by defining appropriate |
73 | * structures. We hold off that approach until we have a consistent way of |
74 | * using structures for all tokens. This is not straightforward since these |
75 | * token structures may contain pointers of whose contents we do not know the |
76 | * size (e.g text tokens). |
77 | */ |
78 | #define (a) ((a)->ai_termid.at_type+18+sizeof(u_int32_t)) |
79 | #define 18 |
80 | #define (5*sizeof(u_int32_t)+18) |
81 | #define AUDIT_TRAILER_SIZE 7 |
82 | #define MAX_AUDIT_IDENTITY_SIZE 179 |
83 | |
84 | /* |
85 | * BSM token streams store fields in big endian byte order, so as to be |
86 | * portable; when encoding and decoding, we must convert byte orders for |
87 | * typed values. |
88 | */ |
89 | #define ADD_U_CHAR(loc, val) \ |
90 | do { \ |
91 | *(loc) = (val); \ |
92 | (loc) += sizeof(u_char); \ |
93 | } while(0) |
94 | |
95 | |
96 | #define ADD_U_INT16(loc, val) \ |
97 | do { \ |
98 | be16enc((loc), (val)); \ |
99 | (loc) += sizeof(u_int16_t); \ |
100 | } while(0) |
101 | |
102 | #define ADD_U_INT32(loc, val) \ |
103 | do { \ |
104 | be32enc((loc), (val)); \ |
105 | (loc) += sizeof(u_int32_t); \ |
106 | } while(0) |
107 | |
108 | #define ADD_U_INT64(loc, val) \ |
109 | do { \ |
110 | be64enc((loc), (val)); \ |
111 | (loc) += sizeof(u_int64_t); \ |
112 | } while(0) |
113 | |
114 | #define ADD_MEM(loc, data, size) \ |
115 | do { \ |
116 | memcpy((loc), (data), (size)); \ |
117 | (loc) += size; \ |
118 | } while(0) |
119 | |
120 | #define ADD_STRING(loc, data, size) ADD_MEM(loc, data, size) |
121 | |
122 | #endif /* !_AUDIT_INTERNAL_H_ */ |
123 | |