getaudit(2)

NAME | SYNOPSIS | DESCRIPTION | RETURN VALUES | ERRORS | USAGE | SUMMARY OF TRUSTED SOLARIS CHANGES | SEE ALSO

NAME

getaudit, setaudit, getaudit_addr, setaudit_addr- Get and set process audit information

SYNOPSIS

cc [ flag ... ] file ... -lbsm -lsocket -lnsl -lintl [ library ... ]
#include <sys/param.h>
#include <bsm/audit.h>

int getaudit(struct auditinfo * info);
int setaudit(struct auditinfo * info);
int getaudit_addr(struct auditinfo_addr * info, int length);
int setaudit_addr(struct auditinfo_addr * info, int length);

DESCRIPTION

getaudit() gets the audit ID , the preselection mask, the terminal ID , and the audit session ID of the current process.

Note that getaudit() may fail and return an E2BIG errno if the address field in the terminal ID is larger than 32 bits. In this case, getaudit_addr() should be used.

setaudit() sets the audit ID , the preselection mask, the terminal ID , and the audit session ID for the current process.

The getaudit_addr() function returns a variable length auditinfo_addr structure that contains the audit ID , the preselection mask, the terminal ID , and the audit session ID for the current process. The terminal ID contains a size field that indicates the size of the network address.

The setaudit_addr() function sets the audit ID , the preselection mask, the terminal ID , and the audit session ID for the current process. The values are taken from the variable length struture auditinfo_addr. The terminal ID contains a size field that indicates the size of the network address.

The info structure used to pass the process audit information contains the following members:

---

au_id_t     ai_auid;        /* audit user ID */
au_mask_t   ai_mask;        /* preselection mask */
au_tid_t    ai_termid;      /* terminal ID */
au_asid_t   ai_asid;        /* audit session ID */ 

---

To execute these commands successfully, a process needs certain privileges in its set of effective privileges: for getaudit() , a process needs PRIV_SYS_AUDIT , PRIV_PROC_AUDIT_TCB , or PRIV_PROC_AUDIT_APPL ; for setaudit() , PRIV_SYS_AUDIT .

RETURN VALUES

getaudit() and setaudit() return:

0

On success.

-1

On failure, and set errno to indicate the error.

ERRORS

The getaudit() and setaudit() functions will fail if:

EFAULT

The info parameter points outside the process's allocated address space.

EPERM

The process did not have the appropriate privilege.

USAGE

Only processes with the appropriate privileges may successfully execute these calls.

SUMMARY OF TRUSTED SOLARIS CHANGES

This functionality is active only if auditing is enabled. By default, auditing is enabled in the Trusted Solaris environment. See Trusted Solaris Audit Administration for more information.

As explained in DESCRIPTION , privileges are needed to run this command successfully.

SEE ALSO

Trusted Solaris 8 Reference Manual

audit(2)

Trusted Solaris 8  Last Revised 18 Aug 1999

NAME | SYNOPSIS | DESCRIPTION | RETURN VALUES | ERRORS | USAGE | SUMMARY OF TRUSTED SOLARIS CHANGES | SEE ALSO