Changeset View
Changeset View
Standalone View
Standalone View
head/contrib/openbsm/sys/bsm/audit.h
| Show All 40 Lines | |||||
| #define AUDIT_RECORD_MAGIC 0x828a0f1b | #define AUDIT_RECORD_MAGIC 0x828a0f1b | ||||
| #define MAX_AUDIT_RECORDS 20 | #define MAX_AUDIT_RECORDS 20 | ||||
| #define MAXAUDITDATA (0x8000 - 1) | #define MAXAUDITDATA (0x8000 - 1) | ||||
| #define MAX_AUDIT_RECORD_SIZE MAXAUDITDATA | #define MAX_AUDIT_RECORD_SIZE MAXAUDITDATA | ||||
| #define MIN_AUDIT_FILE_SIZE (512 * 1024) | #define MIN_AUDIT_FILE_SIZE (512 * 1024) | ||||
| /* | /* | ||||
| * Minimum noumber of free blocks on the filesystem containing the audit | * Minimum number of free blocks on the filesystem containing the audit | ||||
| * log necessary to avoid a hard log rotation. DO NOT SET THIS VALUE TO 0 | * log necessary to avoid a hard log rotation. DO NOT SET THIS VALUE TO 0 | ||||
| * as the kernel does an unsigned compare, plus we want to leave a few blocks | * as the kernel does an unsigned compare, plus we want to leave a few blocks | ||||
| * free so userspace can terminate the log, etc. | * free so userspace can terminate the log, etc. | ||||
| */ | */ | ||||
| #define AUDIT_HARD_LIMIT_FREE_BLOCKS 4 | #define AUDIT_HARD_LIMIT_FREE_BLOCKS 4 | ||||
| /* | /* | ||||
| * Triggers for the audit daemon. | * Triggers for the audit daemon. | ||||
| ▲ Show 20 Lines • Show All 186 Lines • ▼ Show 20 Lines | |||||
| /* | /* | ||||
| * Contents of token_t are opaque outside of libbsm. | * Contents of token_t are opaque outside of libbsm. | ||||
| */ | */ | ||||
| typedef struct au_token token_t; | typedef struct au_token token_t; | ||||
| /* | /* | ||||
| * Kernel audit queue control parameters: | * Kernel audit queue control parameters: | ||||
| * Default: Maximum: | * Default: Maximum: | ||||
| * aq_hiwater: AQ_HIWATER (100) AQ_MAXHIGH (10000) | * aq_hiwater: AQ_HIWATER (100) AQ_MAXHIGH (10000) | ||||
| * aq_lowater: AQ_LOWATER (10) <aq_hiwater | * aq_lowater: AQ_LOWATER (10) <aq_hiwater | ||||
| * aq_bufsz: AQ_BUFSZ (32767) AQ_MAXBUFSZ (1048576) | * aq_bufsz: AQ_BUFSZ (32767) AQ_MAXBUFSZ (1048576) | ||||
| * aq_delay: 20 20000 (not used) | * aq_delay: 20 20000 (not used) | ||||
| */ | */ | ||||
| struct au_qctrl { | struct au_qctrl { | ||||
| int aq_hiwater; /* Max # of audit recs in queue when */ | int aq_hiwater; /* Max # of audit recs in queue when */ | ||||
| /* threads with new ARs get blocked. */ | /* threads with new ARs get blocked. */ | ||||
| int aq_lowater; /* # of audit recs in queue when */ | int aq_lowater; /* # of audit recs in queue when */ | ||||
| /* blocked threads get unblocked. */ | /* blocked threads get unblocked. */ | ||||
| int aq_bufsz; /* Max size of audit record for audit(2). */ | int aq_bufsz; /* Max size of audit record for audit(2). */ | ||||
| int aq_delay; /* Queue delay (not used). */ | int aq_delay; /* Queue delay (not used). */ | ||||
| int aq_minfree; /* Minimum filesystem percent free space. */ | int aq_minfree; /* Minimum filesystem percent free space. */ | ||||
| }; | }; | ||||
| ▲ Show 20 Lines • Show All 76 Lines • Show Last 20 Lines | |||||