summaryrefslogtreecommitdiffstats
path: root/share/man/man4/auditpipe.4
diff options
context:
space:
mode:
authorru <ru@FreeBSD.org>2006-09-30 15:14:49 +0000
committerru <ru@FreeBSD.org>2006-09-30 15:14:49 +0000
commit02f942de1f0ea8f1c26b9ffe2abc02ac35ebb597 (patch)
treed27e95126f4cd8198120e290722ee68d707b4044 /share/man/man4/auditpipe.4
parente0ee4f3488ff48a4f216cfe799739aff244b745f (diff)
downloadFreeBSD-src-02f942de1f0ea8f1c26b9ffe2abc02ac35ebb597.zip
FreeBSD-src-02f942de1f0ea8f1c26b9ffe2abc02ac35ebb597.tar.gz
Revise markup.
Diffstat (limited to 'share/man/man4/auditpipe.4')
-rw-r--r--share/man/man4/auditpipe.482
1 files changed, 43 insertions, 39 deletions
diff --git a/share/man/man4/auditpipe.4 b/share/man/man4/auditpipe.4
index 9f77481..3a639dc 100644
--- a/share/man/man4/auditpipe.4
+++ b/share/man/man4/auditpipe.4
@@ -29,7 +29,7 @@
.Dt AUDITPIPE 4
.Sh NAME
.Nm auditpipe
-.Nd Pseudo-device for live audit event tracking
+.Nd "pseudo-device for live audit event tracking"
.Sh SYNOPSIS
.Cd "options AUDIT"
.Sh DESCRIPTION
@@ -50,7 +50,7 @@ direct access to live BSM audit data for the purposes of real-time
monitoring.
Audit pipes are available via a clonable special device,
.Pa /dev/auditpipe ,
-subject to the permissions on the device node, and provide a
+subject to the permissions on the device node, and provide a
.Qq tee
of the audit event stream.
As the device is clonable, more than one instance of the device may be opened
@@ -64,7 +64,9 @@ Unlike audit data written to the audit trail, the reliability of record
delivery is not guaranteed.
In particular, when an audit pipe queue fills, records will be dropped.
Audit pipe devices are blocking by default, but support non-blocking I/O,
-asynchronous I/O using SIGIO, and polled operation via
+asynchronous I/O using
+.Dv SIGIO ,
+and polled operation via
.Xr select 2
and
.Xr poll 2 .
@@ -74,28 +76,28 @@ preselection parameters independent of the global audit trail parameters.
.Ss Audit Pipe Queue Ioctls
The following ioctls retrieve and set various audit pipe record queue
properties:
-.Bl -tag -width AUDITPIPE_GET_MAXAUDITDATA
-.It AUDITPIPE_GET_QLEN
+.Bl -tag -width ".Dv AUDITPIPE_GET_MAXAUDITDATA"
+.It Dv AUDITPIPE_GET_QLEN
Query the current number of records available for reading on the pipe.
-.It AUDITPIPE_GET_QLIMIT
+.It Dv AUDITPIPE_GET_QLIMIT
Retrieve the current maximum number of records that may be queued for reading
on the pipe.
-.It AUDITPIPE_SET_QLIMIT
+.It Dv AUDITPIPE_SET_QLIMIT
Set the current maximum number of records that may be queued for reading on
the pipe.
The new limit must fall between the queue limit minimum and queue limit
maximum queryable using the following two ioctls.
-.It AUDITPIPE_GET_QLIMIT_MIN
+.It Dv AUDITPIPE_GET_QLIMIT_MIN
Query the lowest possible maximum number of records that may be queued for
reading on the pipe.
-.It AUDITPIPE_GET_QLIMIT_MAX
+.It Dv AUDITPIPE_GET_QLIMIT_MAX
Query the highest possible maximum number of records that may be queued for
reading on the pipe.
-.It AUDITPIPE_FLUSH
+.It Dv AUDITPIPE_FLUSH
Flush all outstanding records on the audit pipe; useful after setting initial
preselection properties to delete records queued during the configuration
process which may not match the interests of the user process.
-.It AUDITPIPE_GET_MAXAUDITDATA
+.It Dv AUDITPIPE_GET_MAXAUDITDATA
Query the maximum size of an audit record, which is a useful minimum size for
a user space buffer intended to hold audit records read from the audit pipe.
.El
@@ -111,23 +113,23 @@ trail, as well as limit records presented to those of specific interest to
the application.
.Pp
The following ioctls configure the preselection mode on an audit pipe:
-.Bl -tag -width AUDITPIPE_GET_PRESELECT_MODE
-.It AUDITPIPE_GET_PRESELECT_MODE
+.Bl -tag -width ".Dv AUDITPIPE_GET_PRESELECT_MODE"
+.It Dv AUDITPIPE_GET_PRESELECT_MODE
Return the current preselect mode on the audit pipe.
The ioctl argument should be of type
.Vt int .
-.It AUDITPIPE_SET_PRESELECT_MODE
+.It Dv AUDITPIPE_SET_PRESELECT_MODE
Set the current preselection mode on the audit pipe.
The ioctl argument should be of type
.Vt int .
.El
.Pp
Possible preselection mode values are:
-.Bl -tag -width AUDITPIPE_PRESELECT_MODE_TRAIL
-.It AUDITPIPE_PRESELECT_MODE_TRAIL
+.Bl -tag -width ".Dv AUDITPIPE_PRESELECT_MODE_TRAIL"
+.It Dv AUDITPIPE_PRESELECT_MODE_TRAIL
Use the global audit trail preselection parameters to select records for the
audit pipe.
-.It AUDITPIPE_PRESELECT_MODE_LOCAL
+.It Dv AUDITPIPE_PRESELECT_MODE_LOCAL
Use local audit pipe preselection; this model is similar to the global audit
trail configuration model, consisting of global flags and naflags parameters,
as well as a set of per-auid masks.
@@ -143,47 +145,47 @@ The following ioctls configure the preselection parameters used when an audit
pipe is configured for the
.Dv AUDITPIPE_PRESELECT_MODE_LOCAL
preselection mode.
-.Bl -tag -width AUDITPIPE_GET_PRESELECT_NAFLAGS
-.It AUDITPIPE_GET_PRESELECT_FLAGS
+.Bl -tag -width ".Dv AUDITPIPE_GET_PRESELECT_NAFLAGS"
+.It Dv AUDITPIPE_GET_PRESELECT_FLAGS
Retrieve the current default preselection flags for attributable events on
the pipe.
These flags correspond to the
-.Dv flags
+.Va flags
field in
.Xr audit_control 5 .
The ioctl argument should be of type
.Vt u_int .
-.It AUDITPIPE_SET_PRESELECT_FLAGS
+.It Dv AUDITPIPE_SET_PRESELECT_FLAGS
Set the current default preselection flags for attributable events on the
pipe.
These flags correspond to the
-.Dv flags
+.Va flags
field in
.Xr audit_control 5 .
The ioctl argument should be of type
.Vt u_int .
-.It AUDITPIPE_GET_PRESELECT_NAFLAGS
+.It Dv AUDITPIPE_GET_PRESELECT_NAFLAGS
Retrieve the current default preselection flags for non-attributable events
on the pipe.
These flags correspond to the
-.Dv naflags
+.Va naflags
field in
.Xr audit_control 5 .
The ioctl argument should be of type
.Vt u_int .
-.It AUDITPIPE_SET_PRESELECT_NAFLAGS
+.It Dv AUDITPIPE_SET_PRESELECT_NAFLAGS
Set the current default preselection flags for non-attributable events on the
pipe.
These flags correspond to the
-.Dv naflags
+.Va naflags
field in
.Xr audit_control 5 .
The ioctl argument should be of type
.Vt u_int .
-.It AUDITPIPE_GET_PRESELECT_AUID
+.It Dv AUDITPIPE_GET_PRESELECT_AUID
Query the current preselection masks for a specific auid on the pipe.
The ioctl argument should be of type
-.Vt struct auditpipe_preselect .
+.Vt "struct auditpipe_preselect" .
The auid to query is specified via the
.Va ap_auid
field of type
@@ -192,24 +194,26 @@ the mask will be returned via
.Va ap_mask
of type
.Vt au_mask_t .
-.It AUDITPIPE_SET_PRESELECT_AUID
+.It Dv AUDITPIPE_SET_PRESELECT_AUID
Set the current preselection masks for a specific auid on the pipe.
Arguments are identical to
-.Dv AUDITPIPE_GET_PRESELECT_AUID,
+.Dv AUDITPIPE_GET_PRESELECT_AUID ,
except that the caller should properly initialize the
.Va ap_mask
field to hold the desired preselection mask.
-.It AUDITPIPE_DELETE_PRESELECT_AUID
+.It Dv AUDITPIPE_DELETE_PRESELECT_AUID
Delete the current preselection mask for a specific auid on the pipe.
Once called, events associated with the specified auid will use the default
flags mask.
The ioctl argument should be of type
.Vt au_id_t .
-.It AUDITPIPE_FLUSH_PRESELECT_AUID
+.It Dv AUDITPIPE_FLUSH_PRESELECT_AUID
Delete all auid specific preselection specifications.
.El
.Sh EXAMPLES
+The
.Xr praudit 1
+utility
may be directly executed on
.Pa /dev/auditpipe
to review the default audit trail.
@@ -220,20 +224,20 @@ to review the default audit trail.
.Xr audit_control 5 ,
.Xr audit 8 ,
.Xr auditd 8
-.Sh AUTHORS
-The audit pipe facility was designed and implemented by
-.An Robert Watson Aq rwatson@FreeBSD.org .
-.Pp
-The Basic Security Module (BSM) interface to audit records and audit event
-stream format were defined by Sun Microsystems.
.Sh HISTORY
The OpenBSM implementation was created by McAfee Research, the security
-division of McAfee Inc., under contract to Apple Computer Inc. in 2004.
+division of McAfee Inc., under contract to Apple Computer Inc.\& in 2004.
It was subsequently adopted by the TrustedBSD Project as the foundation for
the OpenBSM distribution.
.Pp
Support for kernel audit first appeared in
.Fx 6.2 .
+.Sh AUTHORS
+The audit pipe facility was designed and implemented by
+.An Robert Watson Aq rwatson@FreeBSD.org .
+.Pp
+The Basic Security Module (BSM) interface to audit records and audit event
+stream format were defined by Sun Microsystems.
.Sh BUGS
See the
.Xr audit 4
OpenPOWER on IntegriCloud