FreeBSD/contrib/openbsm/libauditd/auditd_lib.c
/*
 * Shut down auditing quickly.  Assumes that is only called on system shutdown.
 * Returns:
 *	 0	on success,
 *	-1	on failure.
 */
Shut down auditing quickly.  Assumes that is only called on system shutdown.
Returns:
0      on success,
-1      on failure.
Shut down auditing quickly . Assumes that is only called on system shutdown . Returns : 0 on success - 1 on failure .
int
audit_quick_stop(void)
{
	int len;
	int cond;
	char *ptr;
	time_t tt;
	char oldname[MAXPATHLEN];
	char newname[MAXPATHLEN];
	char TS[TIMESTAMP_LEN + 1];
	if (audit_get_cond(&cond) != 0)
		return (-1);
	if (cond == AUC_NOAUDIT)
		return (0);
	(void) auditd_gen_record(AUE_audit_shutdown, NULL);
	cond = AUC_DISABLED;
	if (audit_set_cond(&cond) != 0)
		return (-1);
#ifdef	__BSM_INTERNAL_NOTIFY_KEY
	notify_post(__BSM_INTERNAL_NOTIFY_KEY);
#endif
	len = readlink(AUDIT_CURRENT_LINK, oldname, sizeof(oldname) - 1);
	if (len < 0)
		return (-1);
	oldname[len++] = '\0';
	if (getTSstr(tt, TS, sizeof(TS)) != 0)
		return (-1);
	strlcpy(newname, oldname, sizeof(newname));
	if ((ptr = strstr(newname, NOT_TERMINATED)) != NULL) {
		memcpy(ptr, TS, POSTFIX_LEN);
		if (auditd_rename(oldname, newname) != 0)
			return (-1);
	} else
		return (-1);
	(void) unlink(AUDIT_CURRENT_LINK);
	return (0);
}
int audit_quick_stop ( void ) { int len ; int cond ; char * ptr ; time_t tt ; char oldname [ MAXPATHLEN ] ; char newname [ MAXPATHLEN ] ; char TS [ TIMESTAMP_LEN + 1 ] ; if ( audit_get_cond ( & cond ) != 0 ) return ( -1 ) ; if ( cond == AUC_NOAUDIT ) return ( 0 ) ; ( void ) auditd_gen_record ( AUE_audit_shutdown , NULL ) ; cond = AUC_DISABLED ; if ( audit_set_cond ( & cond ) != 0 ) return ( -1 ) ; #ifdef __BSM_INTERNAL_NOTIFY_KEY notify_post ( __BSM_INTERNAL_NOTIFY_KEY ) ; #endif len = readlink ( AUDIT_CURRENT_LINK , oldname , sizeof ( oldname ) - 1 ) ; if ( len < 0 ) return ( -1 ) ; oldname [ len ++ ] = ' \0 ' ; if ( getTSstr ( tt , TS , sizeof ( TS ) ) != 0 ) return ( -1 ) ; strlcpy ( newname , oldname , sizeof ( newname ) ) ; if ( ( ptr = strstr ( newname , NOT_TERMINATED ) ) != NULL ) { memcpy ( ptr , TS , POSTFIX_LEN ) ; if ( auditd_rename ( oldname , newname ) != 0 ) return ( -1 ) ; } else return ( -1 ) ; ( void ) unlink ( AUDIT_CURRENT_LINK ) ; return ( 0 ) ; }
Shut down auditing quickly.
Shut down auditing quickly .
/*
	 * Auditing already disabled?
	 */ /*
	 *  Generate audit shutdown record.
	 */ /*
	 * Shutdown auditing in the kernel.
	 */ /*
	 * Rename last audit trail and remove 'current' link.
	 */