au_fetch_tokau_print_tokau_read_rec
- perform I/O involving an audit record
LIBRARY
Lb libbsm
SYNOPSIS
#include <bsm/libbsm.h> int
au_fetch_tok (tokenstr_t *tok u_char *buf int len); void
Fo au_print_tok
Fa FILE *outfp tokenstr_t *tok char *del char raw char sfrm
Fc Ft int
au_read_rec (FILE *fp u_char **buf);
DESCRIPTION
These interfaces support input and output (I/O) involving audit records,
internalizing an audit record from a byte stream, converting a token to
either a raw or default string, and reading a single record from a file.
The
au_fetch_tok ();
function
reads a token from the passed buffer
Fa buf
of length
Fa len
bytes, and returns a pointer to the token via
Fa tok .
The
au_print_tok ();
function
prints a string form of the token
Fa tok
to the file output stream
Fa outfp ,
either in default mode, or raw mode if
Fa raw
is set non-zero.
The delimiter
Fa del
is used when printing.
The
au_read_rec ();
function
reads an audit record from the file stream
Fa fp ,
and returns an allocated memory buffer containing the record via
Fa *buf ,
which must be freed by the caller using
free(3).
A typical use of these routines might open a file with
fopen(3),
then read records from the file sequentially by calling
au_read_rec (.);
Each record would be broken down into components tokens through sequential
calls to
au_fetch_tok ();
on the buffer, and then invoking
au_print_tok ();
to print each token to an output stream such as
stdout
On completion of the processing of each record, a call to
free(3)
would be used to free the record buffer.
Finally, the source stream would be closed by a call to
fclose(3).
RETURN VALUES
The
au_fetch_tok ();
and
au_read_rec ();
functions
return 0 on success, or -1 on failure along with additional error information
returned via
errno
The OpenBSM implementation was created by McAfee Research, the security
division of McAfee Inc., under contract to Apple Computer, Inc., in 2004.
It was subsequently adopted by the TrustedBSD Project as the foundation for
the OpenBSM distribution.
AUTHORS
An -nosplit
This software was created by
An Robert Watson ,
An Wayne Salamon ,
and
An Suresh Krishnaswamy
for McAfee Research, the security research division of McAfee,
Inc., under contract to Apple Computer, Inc.
The Basic Security Module (BSM) interface to audit records and audit event
stream format were defined by Sun Microsystems.
BUGS
The
errno
variable
may not always be properly set in the event of an error.