FreeBSD/contrib/openbsm/libauditd/auditd_lib.c
/*
 * Process the audit event file, obtaining a class mapping for each event, and
 * set that mapping into the kernel. Return:
 *	 n	number of event mappings that were successfully processed,
 *   ADE_NOMEM	if there was an error allocating memory.
 */
Process the audit event file, obtaining a class mapping for each event, and
set that mapping into the kernel. Return:
n      number of event mappings that were successfully processed,
ADE_NOMEM  if there was an error allocating memory.
Process the audit event file obtaining a class mapping for each event and set that mapping into the kernel . Return : n number of event mappings that were successfully processed ADE_NOMEM if there was an error allocating memory .
int
auditd_set_evcmap(void)
{
	au_event_ent_t ev, *evp;
	au_evclass_map_t evc_map;
	int ctr = 0;
	ev.ae_name = (char *)malloc(AU_EVENT_NAME_MAX);
	ev.ae_desc = (char *)malloc(AU_EVENT_DESC_MAX);
	if (ev.ae_name == NULL || ev.ae_desc == NULL) {
		if (ev.ae_name != NULL)
			free(ev.ae_name);
		return (ADE_NOMEM);
	}
	evp = &ev;
	setauevent();
	while ((evp = getauevent_r(evp)) != NULL) {
		evc_map.ec_number = evp->ae_number;
		evc_map.ec_class = evp->ae_class;
		if (audit_set_class(&evc_map, sizeof(evc_map)) == 0)
			ctr++;
	}
	endauevent();
	free(ev.ae_name);
	free(ev.ae_desc);
	return (ctr);
}
int auditd_set_evcmap ( void ) { au_event_ent_t ev , * evp ; au_evclass_map_t evc_map ; int ctr = 0 ; ev . ae_name = ( char * ) malloc ( AU_EVENT_NAME_MAX ) ; ev . ae_desc = ( char * ) malloc ( AU_EVENT_DESC_MAX ) ; if ( ev . ae_name == NULL || ev . ae_desc == NULL ) { if ( ev . ae_name != NULL ) free ( ev . ae_name ) ; return ( ADE_NOMEM ) ; } evp = & ev ; setauevent ( ) ; while ( ( evp = getauevent_r ( evp ) ) != NULL ) { evc_map . ec_number = evp -> ae_number ; evc_map . ec_class = evp -> ae_class ; if ( audit_set_class ( & evc_map , sizeof ( evc_map ) ) == 0 ) ctr ++ ; } endauevent ( ) ; free ( ev . ae_name ) ; free ( ev . ae_desc ) ; return ( ctr ) ; }
Process the audit event file, obtaining a class mapping for each event, and
 set that mapping into the kernel.
Process the audit event file obtaining a class mapping for each event and set that mapping into the kernel .
/*
	 * XXX There's a risk here that the BSM library will return NULL
	 * for an event when it can't properly map it to a class. In that
	 * case, we will not process any events beyond the one that failed,
	 * but should. We need a way to get a count of the events.
	 */ /*
	 * XXXRW: Currently we have no way to remove mappings from the kernel
	 * when they are removed from the file-based mappings.
	 */