Changeset View
Changeset View
Standalone View
Standalone View
contrib/openbsm/sys/bsm/audit.h
Show All 40 Lines | |||||
#define AUDIT_RECORD_MAGIC 0x828a0f1b | #define AUDIT_RECORD_MAGIC 0x828a0f1b | ||||
#define MAX_AUDIT_RECORDS 20 | #define MAX_AUDIT_RECORDS 20 | ||||
#define MAXAUDITDATA (0x8000 - 1) | #define MAXAUDITDATA (0x8000 - 1) | ||||
#define MAX_AUDIT_RECORD_SIZE MAXAUDITDATA | #define MAX_AUDIT_RECORD_SIZE MAXAUDITDATA | ||||
#define MIN_AUDIT_FILE_SIZE (512 * 1024) | #define MIN_AUDIT_FILE_SIZE (512 * 1024) | ||||
/* | /* | ||||
* Minimum noumber of free blocks on the filesystem containing the audit | * Minimum number of free blocks on the filesystem containing the audit | ||||
* log necessary to avoid a hard log rotation. DO NOT SET THIS VALUE TO 0 | * log necessary to avoid a hard log rotation. DO NOT SET THIS VALUE TO 0 | ||||
* as the kernel does an unsigned compare, plus we want to leave a few blocks | * as the kernel does an unsigned compare, plus we want to leave a few blocks | ||||
* free so userspace can terminate the log, etc. | * free so userspace can terminate the log, etc. | ||||
*/ | */ | ||||
#define AUDIT_HARD_LIMIT_FREE_BLOCKS 4 | #define AUDIT_HARD_LIMIT_FREE_BLOCKS 4 | ||||
/* | /* | ||||
* Triggers for the audit daemon. | * Triggers for the audit daemon. | ||||
▲ Show 20 Lines • Show All 186 Lines • ▼ Show 20 Lines | |||||
/* | /* | ||||
* Contents of token_t are opaque outside of libbsm. | * Contents of token_t are opaque outside of libbsm. | ||||
*/ | */ | ||||
typedef struct au_token token_t; | typedef struct au_token token_t; | ||||
/* | /* | ||||
* Kernel audit queue control parameters: | * Kernel audit queue control parameters: | ||||
* Default: Maximum: | * Default: Maximum: | ||||
* aq_hiwater: AQ_HIWATER (100) AQ_MAXHIGH (10000) | * aq_hiwater: AQ_HIWATER (100) AQ_MAXHIGH (10000) | ||||
* aq_lowater: AQ_LOWATER (10) <aq_hiwater | * aq_lowater: AQ_LOWATER (10) <aq_hiwater | ||||
* aq_bufsz: AQ_BUFSZ (32767) AQ_MAXBUFSZ (1048576) | * aq_bufsz: AQ_BUFSZ (32767) AQ_MAXBUFSZ (1048576) | ||||
* aq_delay: 20 20000 (not used) | * aq_delay: 20 20000 (not used) | ||||
*/ | */ | ||||
struct au_qctrl { | struct au_qctrl { | ||||
int aq_hiwater; /* Max # of audit recs in queue when */ | int aq_hiwater; /* Max # of audit recs in queue when */ | ||||
/* threads with new ARs get blocked. */ | /* threads with new ARs get blocked. */ | ||||
int aq_lowater; /* # of audit recs in queue when */ | int aq_lowater; /* # of audit recs in queue when */ | ||||
/* blocked threads get unblocked. */ | /* blocked threads get unblocked. */ | ||||
int aq_bufsz; /* Max size of audit record for audit(2). */ | int aq_bufsz; /* Max size of audit record for audit(2). */ | ||||
int aq_delay; /* Queue delay (not used). */ | int aq_delay; /* Queue delay (not used). */ | ||||
int aq_minfree; /* Minimum filesystem percent free space. */ | int aq_minfree; /* Minimum filesystem percent free space. */ | ||||
}; | }; | ||||
▲ Show 20 Lines • Show All 76 Lines • Show Last 20 Lines |