FreeBSD/contrib/openbsm/libauditd/auditd_lib.c
/*
 * Do just what we need to quickly start auditing.  Assume no system logging or
 * notify.  Return:
 *   0	 on success,
 *  -1   on failure.
 */
Do just what we need to quickly start auditing.  Assume no system logging or
notify.  Return:
0   on success,
-1   on failure.
Do just what we need to quickly start auditing . Assume no system logging or notify . Return : 0 on success - 1 on failure .
int
audit_quick_start(void)
{
	int err;
	char *newfile = NULL;
	time_t tt;
	char TS[TIMESTAMP_LEN + 1];
	int ret = 0;
	if (auditd_prevent_audit() != 0)
		return (-1);
	err = auditd_read_dirs(NULL, NULL);
	if (err != ADE_NOERR && err != ADE_SOFTLIM)
		return (-1);
	(void) auditd_set_dist();
	if (getTSstr(tt, TS, sizeof(TS)) != 0)
		return (-1);
	err = auditd_swap_trail(TS, &newfile, getgid(), NULL);
	if (err != ADE_NOERR && err != ADE_ACTL) {
		ret = -1;
		goto out;
	}
	if (auditd_new_curlink(newfile) != 0) {
		ret = -1;
		goto out;
	}
	if (auditd_gen_record(AUE_audit_startup, NULL) != 0) {
		ret = -1;
		goto out;
	}
	(void) auditd_set_evcmap();
	(void) auditd_set_namask();
	(void) auditd_set_policy();
	(void) auditd_set_fsize();
	(void) auditd_set_minfree();
	(void) auditd_set_host();
out:
	if (newfile != NULL)
		free(newfile);
	return (ret);
}
int audit_quick_start ( void ) { int err ; char * newfile = NULL ; time_t tt ; char TS [ TIMESTAMP_LEN + 1 ] ; int ret = 0 ; if ( auditd_prevent_audit ( ) != 0 ) return ( -1 ) ; err = auditd_read_dirs ( NULL , NULL ) ; if ( err != ADE_NOERR && err != ADE_SOFTLIM ) return ( -1 ) ; ( void ) auditd_set_dist ( ) ; if ( getTSstr ( tt , TS , sizeof ( TS ) ) != 0 ) return ( -1 ) ; err = auditd_swap_trail ( TS , & newfile , getgid ( ) , NULL ) ; if ( err != ADE_NOERR && err != ADE_ACTL ) { ret = -1 ; goto out ; } if ( auditd_new_curlink ( newfile ) != 0 ) { ret = -1 ; goto out ; } if ( auditd_gen_record ( AUE_audit_startup , NULL ) != 0 ) { ret = -1 ; goto out ; } ( void ) auditd_set_evcmap ( ) ; ( void ) auditd_set_namask ( ) ; ( void ) auditd_set_policy ( ) ; ( void ) auditd_set_fsize ( ) ; ( void ) auditd_set_minfree ( ) ; ( void ) auditd_set_host ( ) ; out : if ( newfile != NULL ) free ( newfile ) ; return ( ret ) ; }
Do just what we need to quickly start auditing.
Do just what we need to quickly start auditing .
/*
	 * Mask auditing of this process.
	 */ /*
	 * Read audit_control and get log directories.
	 */ /*
	 * Setup trail file distribution.
	 */ /*
	 *  Create a new audit trail log.
	 */ /*
	 * Add the current symlink and recover from crash, if needed.
	 */ /*
	 * At this point auditing has started so generate audit start-up record.
	 */ /*
	 *  Configure the audit controls.
	 */