AU_MASK(3)

✨ AU_MASK(3) ✨

okay bestie, this is a page from the Library Functions Manual, and it's about au_mask(3) — the audit mask girlies 💅. Buckle up, she's niche but she's iconic.

---

🌸 NAME 🌸

au_preselect, getauditflagsbin, getauditflagschar — the trio that converts between string and numeric values of audit masks. literally the translators of the audit world 🫶

---

🎀 LIBRARY 🎀

Basic Security Module Library (libbsm, -lbsm). yes she comes with her own lib, she's that girl 💖

---

🦋 SYNOPSIS 🦋

#include <bsm/libbsm.h>

int
au_preselect(au_event_t event, au_mask_t *mask_p, int sorf, int flag);

int
getauditflagsbin(char *auditstr, au_mask_t *masks);

int
getauditflagschar(char *auditstr, au_mask_t *masks, int verbose);

---

⭐ DESCRIPTION ⭐

so these interfaces support processing of an audit mask, which is represented by type au_mask_t — and they handle conversion between numeric and text formats, plus computing whether or not an event is matched by a mask. multitasking queen 👑

The au_preselect() function calculates whether or not the audit event passed via event is matched by the audit mask passed via mask_p. The sorf argument tells it whether to consider the event as a success (if the AU_PRS_SUCCESS flag is set) or as a failure (if the AU_PRS_FAILURE flag is set). The flag argument accepts extra arguments that influence the behavior of au_preselect(), including AU_PRS_REREAD — which causes the event to be re-looked up rather than read from the cache — or AU_PRS_USECACHE, which forces use of the cache. no cap, that's the whole vibe check 🔥

The getauditflagsbin() function converts a string representation of an audit mask — passed via a character string pointed to by auditstr — and returns the resulting mask, if valid, via *masks. converting from girl-code to numbers, slay ✨

The getauditflagschar() function takes the audit event mask passed via *masks and converts it to a character string in a buffer pointed to by auditstr. ⚠️ see the “BUGS” section for more on how to provide a buffer of sufficient size — this is the part where you pay attention, bestie. If the verbose flag is set, the class description string retrieved from audit_class(5) will be used; otherwise, the two-character class name is used.

---

💜 IMPLEMENTATION NOTES 💜

The au_preselect() function makes implicit use of various audit database routines, and may influence the behavior of simultaneous or interleaved processing of those databases by other code. so like… she's sharing the aux cord with other code, and she might change the song on you 😭

---

🌈 RETURN VALUES 🌈

The au_preselect() function returns 0 on success, or returns -1 if there is a failure looking up the event type or other database access — in which case errno will be set to indicate the error. It returns 1 if the event is matched; 0 if not. yes those numbers are doing different things depending on where you look, that's the drama of it 💀

The getauditflagsbin() and getauditflagschar() functions return the value 0 if successful; otherwise the value -1 is returned and the global variable errno is set to indicate the error.

---

👀 SEE ALSO 👀

• libbsm(3)
• audit_class(5)

go read those next, iykyk 📚

---

🕰️ HISTORY 🕰️

The OpenBSM implementation was created by McAfee Research — the security division of McAfee Inc. — under contract to Apple Computer, Inc., in 2004. It was subsequently adopted by the TrustedBSD Project as the foundation for the OpenBSM distribution. a whole origin story, honestly 🧚

---

👑 AUTHORS 👑

This software was created by Robert Watson, Wayne Salamon, and Suresh Krishnaswamy for McAfee Research, the security research division of McAfee, Inc., under contract to Apple Computer, Inc. legends only 🫶

The Basic Security Module (BSM) interface to audit records and audit event stream format were defined by Sun Microsystems. respect the OGs 🌸

---

💀 BUGS 💀

okay bestie, sit down, this is the messy part 🍓

• The errno variable may not always be properly set in the event of an error. like, sometimes she just doesn't tell you what went wrong. rude.
• The getauditflagschar() function does not provide a way to indicate how long the character buffer is, in order to detect overflow. 🚨 As a result, the caller must always provide a buffer of sufficient length for any possible mask, which may be calculated as three times the number of non-zero bits in the mask argument in the event non-verbose class names are used, and is not trivially predictable for verbose class names. This API should be replaced with a more robust one.

fr fr, do the math on your buffer size or you're gonna have a bad time. overflow is not the vibe check you want. 🙈

---

and that's the page, bestie ✨💖🎀

this lil' diva lives on Debian, dated April 19, 2005 — vintage but still serving 💅 see u in the next manpage 🦋