Skip to content

Commit fdd4538

Browse files
stevegrubbstevegrubb
committed
add the new man pages
1 parent 25d5fea commit fdd4538

File tree

7 files changed

+183
-0
lines changed

7 files changed

+183
-0
lines changed

‎docs/audit_can_read.3‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
.TH "AUDIT_CAN_CONTROL" "3" "July 2025" "Red Hat" "Linux Audit API"
2+
.SH NAME
3+
audit_can_control, audit_can_write, audit_can_read \- test audit related capabilities
4+
.SH SYNOPSIS
5+
.B #include <libaudit.h>
6+
.sp
7+
.BI "int audit_can_control(void);"
8+
.br
9+
.BI "int audit_can_write(void);"
10+
.br
11+
.BI "int audit_can_read(void);"
12+
.SH DESCRIPTION
13+
.BR audit_can_control ()
14+
returns 1 if the calling process possesses the
15+
.BR CAP_AUDIT_CONTROL
16+
capability, otherwise 0.
17+
.BR audit_can_write ()
18+
returns 1 if
19+
.BR CAP_AUDIT_WRITE
20+
is available.
21+
.BR audit_can_read ()
22+
returns 1 if
23+
.BR CAP_AUDIT_READ
24+
is present. When libcap-ng support is not available these functions return 1 only when the effective UID is 0.
25+
.SH RETURN VALUE
26+
These functions return 1 when the capability is present and 0 otherwise.
27+
.SH SEE ALSO
28+
.BR audit_open (3).
29+
.SH AUTHOR
30+
Steve Grubb

‎docs/audit_get_features.3‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
.TH "AUDIT_GET_FEATURES" "3" "July 2025" "Red Hat" "Linux Audit API"
2+
.SH NAME
3+
audit_get_features, audit_set_feature \- query or change kernel audit features
4+
.SH SYNOPSIS
5+
.B #include <libaudit.h>
6+
.sp
7+
.BI "uint32_t audit_get_features(void);"
8+
.br
9+
.BI "int audit_set_feature(int " fd ", unsigned " feature ", unsigned " value ", unsigned " lock );"
10+
.SH DESCRIPTION
11+
.BR audit_get_features ()
12+
returns a bitmap describing which kernel audit features are supported. The bitmap is cached internally and retrieved from the kernel on the first call.
13+
.PP
14+
.BR audit_set_feature ()
15+
changes a feature bit for the kernel using the descriptor
16+
.I fd
17+
which must be an open audit netlink socket.
18+
.I feature
19+
selects the bit to modify. If
20+
.I value
21+
is nonzero the feature is enabled, otherwise it is disabled. If
22+
.I lock
23+
is nonzero the feature setting is locked until reboot.
24+
.PP
25+
The feature bits currently defined are:
26+
.TP
27+
.B AUDIT_FEATURE_BITMAP_BACKLOG_LIMIT
28+
Kernel supports changing the backlog queue depth.
29+
.TP
30+
.B AUDIT_FEATURE_BITMAP_BACKLOG_WAIT_TIME
31+
Kernel supports delaying syscalls when the queue is full.
32+
.TP
33+
.B AUDIT_FEATURE_BITMAP_EXECUTABLE_PATH
34+
Kernel will include the executable path on EXECVE records.
35+
.TP
36+
.B AUDIT_FEATURE_BITMAP_EXCLUDE_EXTEND
37+
Exclude rules may be used with more fields than just message type.
38+
.TP
39+
.B AUDIT_FEATURE_BITMAP_SESSIONID_FILTER
40+
Session identifier filtering is supported.
41+
.TP
42+
.B AUDIT_FEATURE_BITMAP_LOST_RESET
43+
Allows resetting the lost event counter.
44+
.TP
45+
.B AUDIT_FEATURE_BITMAP_FILTER_FS
46+
Kernel supports file system field filtering.
47+
.SH RETURN VALUE
48+
.BR audit_get_features
49+
returns the feature bitmap or 0 if feature queries are unsupported.
50+
.BR audit_set_feature
51+
returns \<= 0 on error, otherwise it is the netlink sequence id number.
52+
.SH SEE ALSO
53+
.BR audit_request_features (3),
54+
.BR audit_reset_lost (3),
55+
.BR audit_open (3).
56+
.SH AUTHOR
57+
Steve Grubb

‎docs/audit_request_features.3‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
.TH "AUDIT_REQUEST_FEATURES" "3" "July 2025" "Red Hat" "Linux Audit API"
2+
.SH NAME
3+
audit_request_features \- request audit feature bitmap
4+
.SH SYNOPSIS
5+
.B #include <libaudit.h>
6+
.sp
7+
.BI "int audit_request_features(int " fd ");"
8+
.SH DESCRIPTION
9+
.BR audit_request_features ()
10+
requests that the kernel send a structure describing supported audit features on
11+
.I fd
12+
which must be an open audit netlink socket.
13+
.SH RETURN VALUE
14+
The return value is <= 0 on error, otherwise it is the netlink sequence id number. This function can have any error that
15+
.BR sendto (2)
16+
would encounter.
17+
.SH SEE ALSO
18+
.BR audit_get_features (3),
19+
.BR audit_open (3),
20+
.BR auditd (8).
21+
.SH AUTHOR
22+
Steve Grubb

‎docs/audit_reset_backlog_wait_time_actual.3‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
.TH "AUDIT_RESET_BACKLOG_WAIT_TIME_ACTUAL" "3" "July 2025" "Red Hat" "Linux Audit API"
2+
.SH NAME
3+
audit_reset_backlog_wait_time_actual \- reset backlog wait time actual counter
4+
.SH SYNOPSIS
5+
.B #include <libaudit.h>
6+
.sp
7+
.BI "int audit_reset_backlog_wait_time_actual(int " fd ");"
8+
.SH DESCRIPTION
9+
.BR audit_reset_backlog_wait_time_actual ()
10+
resets the kernel's running total of how long system calls have waited for
11+
space in the audit event queue. The
12+
.I fd
13+
must be an open audit netlink socket. This call is useful when administrators
14+
enable backlog waiting via the
15+
.BR audit_set_backlog_wait_time (3)
16+
option to preserve events in tight memory situations. Periodically clearing
17+
the counter allows detection of renewed backlog waiting after changing the
18+
queue size or wait time. The kernel must support the
19+
.BR AUDIT_STATUS_BACKLOG_WAIT_TIME_ACTUAL
20+
field for this call to succeed.
21+
.SH RETURN VALUE
22+
The return value is <= 0 on error, otherwise it is the netlink sequence id number.
23+
.SH SEE ALSO
24+
.BR audit_set_backlog_wait_time (3),
25+
.BR audit_open (3),
26+
.BR auditctl (8).
27+
.SH AUTHOR
28+
Steve Grubb

‎docs/audit_reset_lost.3‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
.TH "AUDIT_RESET_LOST" "3" "July 2025" "Red Hat" "Linux Audit API"
2+
.SH NAME
3+
audit_reset_lost \- reset lost event counter
4+
.SH SYNOPSIS
5+
.B #include <libaudit.h>
6+
.sp
7+
.BI "int audit_reset_lost(int " fd ");"
8+
.SH DESCRIPTION
9+
.BR audit_reset_lost ()
10+
resets the kernel's lost event counter using the descriptor
11+
.I fd
12+
which must be an open audit netlink socket. This call requires that the kernel
13+
support
14+
.BR AUDIT_FEATURE_BITMAP_LOST_RESET .
15+
.SH RETURN VALUE
16+
The return value is <= 0 on error, otherwise it is the netlink sequence id number.
17+
.SH SEE ALSO
18+
.BR audit_get_features (3),
19+
.BR audit_open (3),
20+
.BR auditctl (8).
21+
.SH AUTHOR
22+
Steve Grubb

‎docs/audit_set_feature.3‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
.so man3/audit_get_features.3

‎docs/audit_set_loginuid_immutable.3‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
.TH "AUDIT_SET_LOGINUID_IMMUTABLE" "3" "July 2025" "Red Hat" "Linux Audit API"
2+
.SH NAME
3+
audit_set_loginuid_immutable \- make loginuid value immutable
4+
.SH SYNOPSIS
5+
.B #include <libaudit.h>
6+
.sp
7+
.BI "int audit_set_loginuid_immutable(int " fd );"
8+
.SH DESCRIPTION
9+
.BR audit_set_loginuid_immutable ()
10+
locks the loginuid so that it can no longer be changed. The descriptor
11+
.I fd
12+
must be an open audit netlink socket. This call is equivalent to using
13+
.BR audit_set_feature ()
14+
to enable and lock the
15+
.BR AUDIT_FEATURE_LOGINUID_IMMUTABLE
16+
bit.
17+
.SH RETURN VALUE
18+
The return value is <= 0 on error, otherwise it is the netlink sequence id number.
19+
.SH SEE ALSO
20+
.BR audit_set_feature (3),
21+
.BR audit_open (3).
22+
.SH AUTHOR
23+
Steve Grubb

0 commit comments

Comments
 (0)