1 /*-
16  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
34 #include <atf-c.h>
66 	ATF_REQUIRE((reclen = au_read_rec(pipestream, &buff)) != -1);  in get_records()
73 		if (au_fetch_tok(&token, buff + bytes, reclen - bytes) == -1) {  in get_records()
90  * Override the system-wide audit mask settings in /etc/security/audit_control
107 	/* Set local preselection flag for non-attributable audit_events */  in set_preselect_mode()
113 		atf_tc_fail("Query max-limit: %s", strerror(errno));  in set_preselect_mode()
117 		atf_tc_fail("Set max-qlimit: %s", strerror(errno));  in set_preselect_mode()
125  * Get the corresponding audit_mask for class-name "name" then set the
135 	fmask.am_success = class->ac_class;  in get_audit_mask()
136 	fmask.am_failure = class->ac_class;  in get_audit_mask()
145 check_auditpipe(struct pollfd fd[], const char *auditregex, FILE *pipestream)  in check_auditpipe()  argument
164 		switch (ppoll(fd, 1, &timeout, NULL)) {  in check_auditpipe()
167 			if (fd[0].revents & POLLIN) {  in check_auditpipe()
172 				"unknown event %#x", fd[0].revents);  in check_auditpipe()
183 		case -1:  in check_auditpipe()
197 check_audit_startup(struct pollfd fd[], const char *auditrgx, FILE *pipestream){  in check_audit_startup()  argument
198 	check_auditpipe(fd, auditrgx, pipestream);  in check_audit_startup()
202 check_audit(struct pollfd fd[], const char *auditrgx, FILE *pipestream) {  in check_audit()  argument
203 	check_auditpipe(fd, auditrgx, pipestream);  in check_audit()
205 	/* Teardown: /dev/auditpipe's instance opened for this test-suite */  in check_audit()
216 	 * skip tests that use extattrs. To detect this we can check whether  in skip_if_extattr_not_supported()
220 	if (result == -1 && errno == EOPNOTSUPP) {  in skip_if_extattr_not_supported()
232 	 * AUDIT_TRIGGER_INITIALIZE is a no-op message on FreeBSD and can  in is_auditd_running()
257 setup(struct pollfd fd[], const char *name)  in setup()  argument
262 	nomask = get_audit_mask("no");  in setup()
264 	ATF_REQUIRE((fd[0].fd = open("/dev/auditpipe", O_RDONLY)) != -1);  in setup()
265 	ATF_REQUIRE((pipestream = fdopen(fd[0].fd, "r")) != NULL);  in setup()
266 	fd[0].events = POLLIN;  in setup()
271 	 * can store buffered data in user-space unbeknown to ppoll(2), which  in setup()
276 	/* Set local preselection audit_class as "no" for audit startup */  in setup()
277 	set_preselect_mode(fd[0].fd, &nomask);  in setup()
283 		 * there since service can return before auditd(8) has  in setup()
285 		 * and this can cause check_audit_startup() to fail sometimes.  in setup()
291 		 * To avoid this problem (and as a nice side-effect this speeds  in setup()
302 		check_audit_startup(fd, "audit startup", pipestream);  in setup()
313 	set_preselect_mode(fd[0].fd, &fmask);  in setup()