You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This function will log a message to the audit system using a predefined message format. It should be used for all account manipulation operations. The function
13
11
parameters are as follows:
14
12
15
13
.RS
16
14
.TP
17
-
audit_fd - The fd returned by audit_open
15
+
\fIaudit_fd\fP - The fd returned by audit_open
18
16
.TP
19
-
type - type of message: AUDIT_USER_CHAUTHTOK for changing any account attributes.
17
+
\fItype\fP - type of message: AUDIT_USER_CHAUTHTOK for changing any account attributes.
20
18
.TP
21
-
pgname - program's name, if NULL will attempt to figure out
19
+
\fIpgname\fP - program's name, if NULL will attempt to figure out
22
20
.TP
23
21
op - operation. Ex: "adding-user", "changing-finger-info", "deleting-group". This value should have a dash or underscore between the words so that report parsers group them together.
24
22
.TP
25
-
name - user's account or group name. If not available use NULL.
23
+
\fIname\fP - user's account or group name. If not available use NULL.
26
24
.TP
27
25
id - uid or gid that the operation is being performed on. If the user is unknown, pass a \-1 and fill in the name parameter. This is used only when user is NULL.
28
26
.TP
29
-
host - The hostname if known. If not available pass a NULL.
27
+
\fIhost\fP - The hostname if known. If not available pass a NULL.
30
28
.TP
31
-
addr - The network address of the user. If not available pass a NULL.
29
+
\fIaddr\fP - The network address of the user. If not available pass a NULL.
32
30
.TP
33
31
tty - The tty of the user, if NULL will attempt to figure out
This function will log a message to the audit system using a predefined message format. This function should be used by all apps that are SE Linux object managers. The function parameters are as follows:
13
12
14
13
.nf
15
-
audit_fd - The fd returned by audit_open
16
-
type - type of message, ex: AUDIT_USER_AVC
17
-
message - the message being sent
18
-
hostname - the hostname if known
19
-
addr - The network address of the user
20
-
tty - The tty of the user, if NULL will attempt to figure out
21
-
auid - The auid of the person related to the avc message
14
+
\fIaudit_fd\fP - The fd returned by audit_open
15
+
\fItype\fP - type of message, ex: AUDIT_USER_AVC
16
+
\fImessage\fP - the message being sent
17
+
\fIhostname\fP - the hostname if known
18
+
\fIaddr\fP - The network address of the user
19
+
\fItty\fP - The tty of the user, if NULL will attempt to figure out
20
+
\fIauid\fP - The auid of the person related to the avc message
22
21
.fi
23
22
24
23
These values should correspond to who the message is about.
This function will log a message to the audit system using a predefined message format. This function should be used by all non-ELF console apps that do not manipulate accounts, groups, or need to log execution of a script. An example would be a Python script recording an event. The function parameters are as follows:
13
11
14
12
.nf
15
-
audit_fd - The fd returned by audit_open
16
-
type - type of message, ex: AUDIT_USYS_CONFIG, AUDIT_USER_LOGIN
17
-
message - the message text being sent
18
-
comm - the program command line name, NULL if unknown
19
-
hostname - the hostname if known, NULL if unknown
20
-
addr - The network address of the user, NULL if unknown
21
-
tty - The tty of the user, if NULL will attempt to figure out
22
-
result - 1 is "success" and 0 is "failed"
13
+
\fIaudit_fd\fP - The fd returned by audit_open
14
+
\fItype\fP - type of message, ex: AUDIT_USYS_CONFIG, AUDIT_USER_LOGIN
15
+
\fImessage\fP - the message text being sent
16
+
\fIcomm\fP - the program command line name, NULL if unknown
17
+
\fIhostname\fP - the hostname if known, NULL if unknown
18
+
\fIaddr\fP - The network address of the user, NULL if unknown
19
+
\fItty\fP - The tty of the user, if NULL will attempt to figure out
This function will log a command to the audit system using a predefined message format. It encodes the command as the audit system expects for untrusted strings. This function should be used by all apps need to record commands. The function parameters are as follows:
11
11
12
12
.nf
13
-
audit_fd - The fd returned by audit_open
14
-
type - type of message, ex: AUDIT_USYS_CONFIG, AUDIT_USER_LOGIN
15
-
command - the command being logged
16
-
tty - The tty of the user, if NULL will attempt to figure out
17
-
result - 1 is "success" and 0 is "failed"
13
+
\fIaudit_fd\fP - The fd returned by audit_open
14
+
\fItype\fP - type of message, ex: AUDIT_USYS_CONFIG, AUDIT_USER_LOGIN
15
+
\fIcommand\fP - the command being logged
16
+
\fItty\fP - The tty of the user, if NULL will attempt to figure out
0 commit comments