1 /*-
2  * Copyright (c) 2004-2009 Apple Inc.
53 #include <grp.h>
89  *		change stdio to /dev/null.
103 static gid_t	audit_review_gid = -1;
122  * Follow the 'current' symlink to get the active trail file name.
136 	len = readlink(AUDIT_CURRENT_LINK, cf, MAXPATHLEN - 1);  in get_curfile()
164 			return (-1);  in close_lastfile()
166 		/* Rename the last file -- append timestamp. */  in close_lastfile()
205 		return (-1);  in swap_audit_file()
234 			return (-1);  in swap_audit_file()
282 			return (-1);  in do_trail_file()
291 	if (swap_audit_file() == -1) {  in do_trail_file()
293 		 * XXX Faulty directory listing? - user should be given  in do_trail_file()
297 		return (-1);  in do_trail_file()
327 	if (do_trail_file() == -1) {  in audit_setup()
353 	if (unlink(AUDITD_PIDFILE) == -1 && errno != ENOENT) {  in close_misc()
455 		return (-1);  in register_daemon()
464 		return (-1);  in register_daemon()
482  * try to avoid thrashing-like behavior.  However, not all triggers can be
485  * specific concern is the rotate trigger -- if one is dropped, then it will
553 		if (do_trail_file() == -1)  in auditd_handle_trigger()
559 		if (do_trail_file() == -1)  in auditd_handle_trigger()
567 		if (au_state == AUD_STATE_ENABLED && do_trail_file() == -1)  in auditd_handle_trigger()
574 			if (auditd_config_controls() == -1)  in auditd_handle_trigger()
576 			else if (do_trail_file() == -1)  in auditd_handle_trigger()
624 	while ((child = waitpid(-1, &wstatus, WNOHANG)) > 0) {  in auditd_reap_children()
628 		    ((WIFEXITED(wstatus)) ? "exited with non-zero status" :  in auditd_reap_children()
670 		ret = -1;  in auditd_config_controls()
673 		ret = -1;  in auditd_config_controls()
678 	 * Configure non-attributable event mask in kernel.  in auditd_config_controls()
684 		ret = -1;  in auditd_config_controls()
686 		auditd_log_debug("Registered non-attributable event mask.");  in auditd_config_controls()
695 		ret = -1;  in auditd_config_controls()
706 		ret = -1;  in auditd_config_controls()
717 		ret = -1;  in auditd_config_controls()
729 		ret = -1;  in auditd_config_controls()
745 			ret = -1;  in auditd_config_controls()
801 	struct group *grp;  in main()  local
804 	while ((ch = getopt(argc, argv, "dl")) != -1) {  in main()
819 			    "usage: auditd [-d] [-l]\n");  in main()
831 	grp = getgrnam(AUDIT_REVIEW_GROUP);  in main()
832 	if (grp != NULL)  in main()
833 		audit_review_gid = grp->gr_gid;  in main()
844 	if (grp == NULL)  in main()
849 	if (debug == 0 && launchd_flag == 0 && daemon(0, 0) == -1) {  in main()
854 	if (register_daemon() == -1) {  in main()
868 	exit(-1);  in main()