FreeBSD/contrib/openbsm/libbsm/bsm_wrappers.c
/*
 * This is OK for those callers who have only one token to write.  If you have
 * multiple tokens that logically form part of the same audit record, you need
 * to use the existing au_open()/au_write()/au_close() API:
 *
 * aufd = au_open();
 * tok = au_to_random_token_1(...);
 * au_write(aufd, tok);
 * tok = au_to_random_token_2(...);
 * au_write(aufd, tok);
 * ...
 * au_close(aufd, AU_TO_WRITE, AUE_your_event_type);
 *
 * Assumes, like all wrapper calls, that the caller has previously checked
 * that auditing is enabled via the audit_get_state() call.
 *
 * XXX: Should be more robust against bad arguments.
 */
This is OK for those callers who have only one token to write.  If you have
multiple tokens that logically form part of the same audit record, you need
to use the existing au_open()/au_write()/au_close() API.



Assumes, like all wrapper calls, that the caller has previously checked
that auditing is enabled via the audit_get_state() call.

Should be more robust against bad arguments.
This is OK for those callers who have only one token to write . If you have multiple tokens that logically form part of the same audit record you need to use the existing au_open () / au_write () / au_close () API . Assumes like all wrapper calls that the caller has previously checked that auditing is enabled via the audit_get_state () call . Should be more robust against bad arguments .
int
audit_write(short event_code, token_t *subject, token_t *misctok, char retval,
    int errcode)
{
	int aufd;
	char *func = "audit_write()";
	token_t *rettok;
	if ((aufd = au_open()) == -1) {
		au_free_token(subject);
		au_free_token(misctok);
		syslog(LOG_ERR, "%s: au_open() failed", func);
		return (kAUOpenErr);
	}
	if (subject && au_write(aufd, subject) == -1) {
		au_free_token(subject);
		au_free_token(misctok);
		(void)au_close(aufd, AU_TO_NO_WRITE, event_code);
		syslog(LOG_ERR, "%s: write of subject failed", func);
		return (kAUWriteSubjectTokErr);
	}
	if (misctok && au_write(aufd, misctok) == -1) {
		au_free_token(misctok);
		(void)au_close(aufd, AU_TO_NO_WRITE, event_code);
		syslog(LOG_ERR, "%s: write of caller token failed", func);
		return (kAUWriteCallerTokErr);
	}
	if ((rettok = au_to_return32(retval, errcode)) == NULL) {
		(void)au_close(aufd, AU_TO_NO_WRITE, event_code);
		syslog(LOG_ERR, "%s: au_to_return32() failed", func);
		return (kAUMakeReturnTokErr);
	}
	if (au_write(aufd, rettok) == -1) {
		au_free_token(rettok);
		(void)au_close(aufd, AU_TO_NO_WRITE, event_code);
		syslog(LOG_ERR, "%s: write of return code failed", func);
		return (kAUWriteReturnTokErr);
	}
	if (au_close(aufd, AU_TO_WRITE, event_code) < 0) {
		syslog(LOG_ERR, "%s: au_close() failed", func);
		return (kAUCloseErr);
	}
	return (kAUNoErr);
}
int audit_write ( short event_code , token_t * subject , token_t * misctok , char retval , int errcode ) { int aufd ; char * func = " " ; token_t * rettok ; if ( ( aufd = au_open ( ) ) == -1 ) { au_free_token ( subject ) ; au_free_token ( misctok ) ; syslog ( LOG_ERR , " " , func ) ; return ( kAUOpenErr ) ; } if ( subject && au_write ( aufd , subject ) == -1 ) { au_free_token ( subject ) ; au_free_token ( misctok ) ; ( void ) au_close ( aufd , AU_TO_NO_WRITE , event_code ) ; syslog ( LOG_ERR , " " , func ) ; return ( kAUWriteSubjectTokErr ) ; } if ( misctok && au_write ( aufd , misctok ) == -1 ) { au_free_token ( misctok ) ; ( void ) au_close ( aufd , AU_TO_NO_WRITE , event_code ) ; syslog ( LOG_ERR , " " , func ) ; return ( kAUWriteCallerTokErr ) ; } if ( ( rettok = au_to_return32 ( retval , errcode ) ) == NULL ) { ( void ) au_close ( aufd , AU_TO_NO_WRITE , event_code ) ; syslog ( LOG_ERR , " " , func ) ; return ( kAUMakeReturnTokErr ) ; } if ( au_write ( aufd , rettok ) == -1 ) { au_free_token ( rettok ) ; ( void ) au_close ( aufd , AU_TO_NO_WRITE , event_code ) ; syslog ( LOG_ERR , " " , func ) ; return ( kAUWriteReturnTokErr ) ; } if ( au_close ( aufd , AU_TO_WRITE , event_code ) < 0 ) { syslog ( LOG_ERR , " " , func ) ; return ( kAUCloseErr ) ; } return ( kAUNoErr ) ; }
This is OK for those callers who have only one token to write.
This is OK for those callers who have only one token to write .
/* Save subject. */ /* Save the event-specific token. */ /* Tokenize and save the return value. */ /*
	 * We assume the caller wouldn't have bothered with this
	 * function if it hadn't already decided to keep the record.
	 */