src/core/audit-fd.c

   1 /***
   2   This file is part of systemd.
   3
   4   Copyright 2012 Lennart Poettering
   5
   6   systemd is free software; you can redistribute it and/or modify it
   7   under the terms of the GNU Lesser General Public License as published by
   8   the Free Software Foundation; either version 2.1 of the License, or
   9   (at your option) any later version.
  10
  11   systemd is distributed in the hope that it will be useful, but
  12   WITHOUT ANY WARRANTY; without even the implied warranty of
  13   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  14   Lesser General Public License for more details.
  15
  16   You should have received a copy of the GNU Lesser General Public License
  17   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  18 ***/
  19
  20
  21 #include <errno.h>
  22
  23 #include "audit-fd.h"
  24
  25 #ifdef HAVE_AUDIT
  26
  27 #include <libaudit.h>
  28 #include <stdbool.h>
  29
  30 #include "capability-util.h"
  31 #include "fd-util.h"
  32 #include "log.h"
  33 #include "util.h"
  34
  35 static bool initialized = false;
  36 static int audit_fd;
  37
  38 int get_audit_fd(void) {
  39
  40         if (!initialized) {
  41                 if (have_effective_cap(CAP_AUDIT_WRITE) == 0) {
  42                         audit_fd = -EPERM;
  43                         initialized = true;
  44
  45                         return audit_fd;
  46                 }
  47
  48                 audit_fd = audit_open();
  49
  50                 if (audit_fd < 0) {
  51                         if (!IN_SET(errno, EAFNOSUPPORT, EPROTONOSUPPORT))
  52                                 log_error_errno(errno, "Failed to connect to audit log: %m");
  53
  54                         audit_fd = errno ? -errno : -EINVAL;
  55                 }
  56
  57                 initialized = true;
  58         }
  59
  60         return audit_fd;
  61 }
  62
  63 void close_audit_fd(void) {
  64
  65         if (initialized && audit_fd >= 0)
  66                 safe_close(audit_fd);
  67
  68         initialized = true;
  69         audit_fd = -ECONNRESET;
  70 }
  71
  72 #else
  73
  74 int get_audit_fd(void) {
  75         return -EAFNOSUPPORT;
  76 }
  77
  78 void close_audit_fd(void) {
  79 }
  80
  81 #endif