fchaudit() — Change audit flags for a file by descriptor

Changes the audit flags of a file. The parameter fildes is the file descriptor for the open file whose audit flags are to be changed. flags specifies what the audit flags should be changed to:

AUDTREADFAIL

Audit failing read requests.

AUDTREADSUCC

Audit successful read requests.

AUDTWRITEFAIL

Audit failing write requests.

AUDTWRITESUCC

Audit successful write requests.

AUDTEXECFAIL

Audit failing execute or search requests.

AUDTEXECSUCC

Audit successful execute or search requests. The bitwise inclusive-OR of any or all of these can be used to set more than one type of auditing.

The parameter option specifies whether the user audit flags or the security auditor audit flags should be changed:

AUDT_USER (0)

User audit flags are changed. The user must be the file owner or have appropriate authority to change the user audit flags for a file.

AUDT_AUDITOR (1)

Security-auditor audit flags are changed. The user must have security auditor authority to change the security auditor audit flags for a file.

If unsuccessful, fchaudit() returns -1 and sets errno to one of the following values:

Error Code

Description

EBADF

fildes is not a valid open file descriptor.

EINVAL

option does not contain a 0 or 1.

EPERM

The effective user ID (UID) of the calling process does not match the owner of the file, and the calling process does not have appropriate privileges.

EROFS

fildes is associated with a file that is on a read-only file system.

CELEBF02

⁄* CELEBF02

   The following program changes the audit flags of a file.

 *⁄
#define _OPEN_SYS
#include <fcntl.h>
#include <sys⁄types.h>
#include <sys⁄stat.h>
#include <unistd.h>
#include <stdio.h>

main() {
  int fd;
  char fn[]="fchaudit.file";

  if ((fd = creat(fn, S_IRUSR|S_IWUSR)) < 0)
    perror("creat() error");
  else {
    if (fchaudit(fd, AUDTREADSUCC, AUDT_USER) != 0)
      perror("fchaudit() error");
    close(fd);
    unlink(fn);
  }
}