2N/A * The contents of this file are subject to the terms of the 2N/A * Common Development and Distribution License (the "License"). 2N/A * You may not use this file except in compliance with the License. 2N/A * See the License for the specific language governing permissions 2N/A * and limitations under the License. 2N/A * When distributing Covered Code, include this CDDL HEADER in each 2N/A * If applicable, add the following below this CDDL HEADER, with the 2N/A * fields enclosed by brackets "[]" replaced with your own identifying 2N/A * information: Portions Copyright [yyyy] [name of copyright owner] 2N/A * Copyright (c) 1992, 2012, Oracle and/or its affiliates. All rights reserved. 2N/A#
define ALLOC_INIT (
600)
/* initially allocate ALLOC_INIT map entries */ 2N/A#
define ALLOC_INCR (
100)
/* if more map entries are needed, realloc */ 2N/A /* in ALLOC_INCR increments */ 2N/A * Keep a dynamic array of event<-->class mappings. 2N/A * Refresh the map when the value of flag is AU_PRS_REREAD. 2N/A * 0: event is not preselected. 2N/A * 1: event is normal preselected. 2N/A * 2: event is forced preselected. 2N/A * -1: There was an error: 2N/A * Couldn't allocate memory. 2N/A * Couldn't find event. 2N/A * We have just loaded the map. Disable reloading for now, no 2N/A * matter if 'flag' is AU_PRS_REREAD or not. 2N/A * Don't use the cache. Re-read the audit_event(4) db. 2N/A /* Determine what portion of the preselection mask to check. */ 2N/A /* force this event */ 2N/A return (-
1);
/* could not find event in the table */ 2N/A * Initially allocate about as many map entries as are there 2N/A * are audit events shipped with the system. For sites 2N/A * that don't add audit events, this should be enough. 2N/A * load the event<->class map into memory 2N/A * Check if audit_class(4) has changed since the last call. If 2N/A * so, refresh the forced preselection class and the event to 2N/A * class mappings even if audit_event(4) hasn't changed. 2N/A /* get the "frcp" class definition */ 2N/A * Check if audit_event(4) has changed since the last call. If not, do 2N/A * nothing as the map is up to date and there is no reason to refresh 2N/A * it. When an error occurs, we are in a "don't know" state, st remains 2N/A * zeroed and the map will be again reloaded next time we call 2N/A * load_map(), just in case. 2N/A * Skip kernel audit events (event numbers 0-2047 are reserved 2N/A * for them, actual number in use is MAX_KEVENTS) since they 2N/A * aren't needed here for userland event lookups. 2N/A /* Update the timestamp to avoid unnecessary reloads. */ 2N/A * realloc the event map in ALLOC_INCR increments