Manual Reference Pages - AU_CLOSE_BUFFER (3)
- create and commit audit records
au_write int d token_t *tok
au_close int d int keep short event
au_close_buffer int d short event u_char *buffer size_t *buflen
au_close_token token_t *tok u_char *buffer size_t *buflen
These interfaces allow applications to allocate audit records, construct a
record using a series of tokens, and commit the audit record to the system
An extension API is also provided to commit the record to an in-memory
buffer rather than the system audit log.
interface allocates a new audit record descriptor.
interface adds a token to an allocated audit descriptor.
When a token has been successfully added to a record, the caller no longer
owns the token memory, and does not need to free it directly via a call to
function is used to commit an audit record to the system audit log, or
abandon the record.
In either cases, all resources associated with the record will be released.
argument determines the behavior: a value of
causes the record to be committed; a value of
causes it to be abandoned.
When the audit record is committed, a BSM header will be inserted before
tokens added to the record, using the event identifier passed via
and a trailer added to the end.
Committing a record to the system audit log requires privilege.
function writes the resulting record to an in-memory buffer of size
it will write back the filled buffer length into the same variable.
is the event identifier to use in the record header.
function generates the BSM stream output for a single token,
in the passed buffer
The initial buffer size and resulting data size are passed via
will free the token before returning.
returns a non-negative audit record descriptor number on success, or a
negative value on failure, along with error information in
return 0 on success, or a negative value on failure, along with error
The OpenBSM implementation was created by McAfee Research, the security
division of McAfee Inc., under contract to Apple Computer, Inc., in 2004.
It was subsequently adopted by the TrustedBSD Project as the foundation for
the OpenBSM distribution.
This software was created by
.An Robert Watson ,
.An Wayne Salamon ,
.An Suresh Krishnaswamy
for McAfee Research, the security research division of McAfee,
Inc., under contract to Apple Computer, Inc.
The Basic Security Module (BSM) interface to audit records and audit event
stream format were defined by Sun Microsystems.
does not reserve kernel resources necessary to commit the record to the
trail; on systems supporting
the call will block until resources are available to commit the record.
However, this leads to the possibility of an action being permitted without
the record being guaranteed to go to disk.
would reserve resources necessary to commit any submitted record, releasing
Visit the GSP FreeBSD Man Page Interface.
Output converted with manServer 1.07.