1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
|
/* auplugin.h --
* Copyright 2025 Red Hat Inc.
* All Rights Reserved.
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation; either
* version 2.1 of the License, or (at your option) any later version.
*
* This library is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public License
* along with this program; see the file COPYING. If not, write to the
* Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor
* Boston, MA 02110-1335, USA.
*
* Authors:
* Steve Grubb <sgrubb@redhat.com>
*/
#ifndef _AUPLUGIN_H_
#define _AUPLUGIN_H_
#include <stddef.h>
#include <libaudit.h>
#include <auparse.h>
#ifndef __attr_access
# define __attr_access(x)
#endif
#ifndef __attr_dealloc
# define __attr_dealloc(x, y)
#endif
#ifndef __attribute_malloc__
# define __attribute_malloc__
#endif
#ifndef __wur
# define __wur
#endif
#ifdef __cplusplus
extern "C" {
#endif
#define MAX_AUDIT_EVENT_FRAME_SIZE (sizeof(struct audit_dispatcher_header) + MAX_AUDIT_MESSAGE_LENGTH)
typedef struct auplugin_fgets_state auplugin_fgets_state_t;
enum auplugin_mem {
MEM_SELF_MANAGED,
MEM_MALLOC,
MEM_MMAP,
MEM_MMAP_FILE
};
enum {
AUPLUGIN_Q_IN_MEMORY = 1 << 0,
AUPLUGIN_Q_IN_FILE = 1 << 1,
AUPLUGIN_Q_CREAT = 1 << 2,
AUPLUGIN_Q_EXCL = 1 << 3,
AUPLUGIN_Q_SYNC = 1 << 4,
AUPLUGIN_Q_RESIZE = 1 << 5,
};
/* Callback prototypes */
typedef void (*auplugin_callback_ptr)(const char *record);
typedef void (*auplugin_timer_callback_ptr)(unsigned int interval);
typedef void (*auplugin_stats_callback_ptr)(unsigned int depth,
unsigned int max_depth,
int overflow);
/* fgets family of functions prototypes */
void auplugin_fgets_clear(void);
int auplugin_fgets_eof(void);
int auplugin_fgets_more(size_t blen);
int auplugin_fgets(char *buf, size_t blen, int fd)
__attr_access ((__write_only__, 1, 2)) __wur;
int auplugin_setvbuf(void *buf, size_t buff_size, enum auplugin_mem how)
__attr_access ((__read_only__, 1, 2));
void auplugin_fgets_destroy(auplugin_fgets_state_t *st);
auplugin_fgets_state_t *auplugin_fgets_init(void)
__attribute_malloc__ __attr_dealloc (auplugin_fgets_destroy, 1);
void auplugin_fgets_clear_r(auplugin_fgets_state_t *st);
int auplugin_fgets_eof_r(auplugin_fgets_state_t *st);
int auplugin_fgets_more_r(auplugin_fgets_state_t *st, size_t blen);
int auplugin_fgets_r(auplugin_fgets_state_t *st, char *buf, size_t blen, int fd)
__attr_access ((__write_only__, 2, 3)) __wur;
int auplugin_setvbuf_r(auplugin_fgets_state_t *st, void *buf, size_t buff_size,
enum auplugin_mem how)
__attr_access ((__read_only__, 2, 3));
/* auplugin family of functions prototypes */
int auplugin_init(int inbound_fd, unsigned queue_size, int q_flags,
const char *path);
void auplugin_stop(void);
void auplugin_event_loop(auplugin_callback_ptr callback);
int auplugin_event_feed(auparse_callback_ptr callback,
unsigned int timer_interval,
auplugin_timer_callback_ptr timer_cb);
void auplugin_register_stats_callback(auplugin_stats_callback_ptr cb);
void auplugin_report_stats(void);
unsigned int auplugin_queue_depth(void);
unsigned int auplugin_queue_max_depth(void);
int auplugin_queue_overflow(void);
#ifdef __cplusplus
}
#endif
#endif
|
