Re: audit_send function in netlink socket
On Wednesday, January 19, 2011 05:30:15 am Ashok Kumar J wrote:
I saw the function audit_send in the file netlink.c. But i
did
not get any man pages for this. I want to know the description of this
structure.
If you look in lib/private.h
extern int audit_send(int fd, int type, const void *data, unsigned int size)
hidden;
Its a hidden function that is not part of the public API and that is why there is no
man page. What it sends to the kernel is:
struct audit_message {
struct nlmsghdr nlh;
char data[MAX_AUDIT_MESSAGE_LENGTH];
};
The data format varies with each kind of command sent. The commands are found in
/usr/include/linux/audit.h with a numeric value between 1000 and 1099. Some commands
have lots of data, such as the ADD_RULE command. However, some have no data, such as
the LIST_RULES command.
This is not documented in man pages because the logic is embodied in the library and
it was never anticpated that the audit system be operated without at least libaudit.
-Steve