Cross Reference: /illumos-gate/usr/src/cmd/auditd/auditd.c

Lines Matching refs:audit
27  * These routines make up the audit daemon server.  This daemon, called
29  * audit records (usually one or more per buffer, potentially less than
33  * SIGALRM (quit), and SIGUSR1 (start a new audit log file). SIGTERM is also
34  * used for the child to tell the parent that audit is ready.
36  * Configuration data comes from audit service configuration
51 #include <bsm/audit.h>
112 static int	reset_list = 1;	/* 1 to re-read audit configuration */
175 	auditinfo_addr_t	as_null;	/* audit state to set */
196 	 * Set the audit host-id.
216 	 * Set the audit state flag to AUDITING.
272 	 * Set the umask so that only audit or other users in the audit group
277 	if (__logpost("")) {	/* Cannot unlink pointer to audit.log(4) file */
282 	 * Here is the main body of the audit daemon. running == 0 means that
283 	 * after flushing out the audit queue, it is time to exit in response
308 				/* continue; wait for audit -s */
324 		 * audit -n or audit -s to fix the problem.
359 			 * allow time for the audit queues in
399 			 * result will be that the audit file is not rolled
400 			 * over unless audit configuration actually changed.
402 			 * They want to reread the audit configuration from
412 			 * (audit -n)  NULL out kvlist so binfile won't
413 			 * re-read audit configuration.
458 		reset_list = 1;		/* Reread the audit configuration */
491  * (manual/unsupported) change of path property in audit service configuration
616 		DPRINT((dbfp, "audit cond = %d (1 is on)\n", acresult));
629 	DPRINT((dbfp, "auditd: reading audit configuration\n"));
772  * do_sethost - do auditon(2) to set the audit host-id.
787 	/* Get current kernel audit info, and fill in the IP address */
791 		    "audit info: %s", strerror(errno));
797 	/* Update the kernel audit info with new IP address */
801 		    "audit info: %s", strerror(errno));
845 				    gettext("Could not configure kernel audit "
867 		(void) asprintf(&msg, gettext("Unable to gather audit queue "
880 		    "audit queue controls from kernel."));
908 		    gettext("Could not configure audit queue controls."));
916  * scf_to_kernel_policy() - update the audit service policies
925 		(void) asprintf(&msg, gettext("Unable to get audit policy "