Skip to content
Snippets Groups Projects
Select Git revision
1 result Searching

cacheinfo.c

Blame
  • Forked from André Almeida / linux
    Source project has a limited visibility.
    audit.h 25.05 KiB
    /* audit.h -- Auditing support
     *
     * Copyright 2003-2004 Red Hat Inc., Durham, North Carolina.
     * All Rights Reserved.
     *
     * This program is free software; you can redistribute it and/or modify
     * it under the terms of the GNU General Public License as published by
     * the Free Software Foundation; either version 2 of the License, or
     * (at your option) any later version.
     *
     * This program is distributed in the hope that it will be useful,
     * but WITHOUT ANY WARRANTY; without even the implied warranty of
     * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
     * GNU General Public License for more details.
     *
     * You should have received a copy of the GNU General Public License
     * along with this program; if not, write to the Free Software
     * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
     *
     * Written by Rickard E. (Rik) Faith <faith@redhat.com>
     *
     */
    
    #ifndef _LINUX_AUDIT_H_
    #define _LINUX_AUDIT_H_
    
    #include <linux/types.h>
    #include <linux/elf-em.h>
    #include <linux/ptrace.h>
    
    /* The netlink messages for the audit system is divided into blocks:
     * 1000 - 1099 are for commanding the audit system
     * 1100 - 1199 user space trusted application messages
     * 1200 - 1299 messages internal to the audit daemon
     * 1300 - 1399 audit event messages
     * 1400 - 1499 SE Linux use
     * 1500 - 1599 kernel LSPP events
     * 1600 - 1699 kernel crypto events
     * 1700 - 1799 kernel anomaly records
     * 1800 - 1899 kernel integrity events
     * 1900 - 1999 future kernel use
     * 2000 is for otherwise unclassified kernel audit messages (legacy)
     * 2001 - 2099 unused (kernel)
     * 2100 - 2199 user space anomaly records
     * 2200 - 2299 user space actions taken in response to anomalies
     * 2300 - 2399 user space generated LSPP events
     * 2400 - 2499 user space crypto events
     * 2500 - 2999 future user space (maybe integrity labels and related events)
     *
     * Messages from 1000-1199 are bi-directional. 1200-1299 & 2100 - 2999 are
     * exclusively user space. 1300-2099 is kernel --> user space 
     * communication.
     */
    #define AUDIT_GET		1000	/* Get status */
    #define AUDIT_SET		1001	/* Set status (enable/disable/auditd) */
    #define AUDIT_LIST		1002	/* List syscall rules -- deprecated */
    #define AUDIT_ADD		1003	/* Add syscall rule -- deprecated */
    #define AUDIT_DEL		1004	/* Delete syscall rule -- deprecated */
    #define AUDIT_USER		1005	/* Message from userspace -- deprecated */
    #define AUDIT_LOGIN		1006	/* Define the login id and information */
    #define AUDIT_WATCH_INS		1007	/* Insert file/dir watch entry */
    #define AUDIT_WATCH_REM		1008	/* Remove file/dir watch entry */
    #define AUDIT_WATCH_LIST	1009	/* List all file/dir watches */
    #define AUDIT_SIGNAL_INFO	1010	/* Get info about sender of signal to auditd */
    #define AUDIT_ADD_RULE		1011	/* Add syscall filtering rule */
    #define AUDIT_DEL_RULE		1012	/* Delete syscall filtering rule */
    #define AUDIT_LIST_RULES	1013	/* List syscall filtering rules */
    #define AUDIT_TRIM		1014	/* Trim junk from watched tree */
    #define AUDIT_MAKE_EQUIV	1015	/* Append to watched tree */
    #define AUDIT_TTY_GET		1016	/* Get TTY auditing status */