AU_USER(3)

💅 AU_USER(3) — the libbsm girlies' guide to the audit_user database 🎀

okay so bestie, this is a page from the Library Functions Manual (yes, the fancy one), and it's literally all about looking up info from the audit_user database. no cap, it's giving "who gets audited and how" energy.

---

✨ NAME ✨

setauuser, endauuser, getauuserent, getauuserent_r, getauusernam, getauusernam_r, au_user_mask, getfauditflags — these are the besties that look up information from the audit_user database. 🫶

---

🦋 LIBRARY 🦋

Basic Security Module Library, aka libbsm, link it with -lbsm. that's the vibe.

---

🌸 SYNOPSIS 🌸

#include <bsm/libbsm.h>

void
setauuser(void);

void
endauuser(void);

struct au_user_ent *
getauuserent(void);

struct au_user_ent *
getauuserent_r(struct au_user_ent *u);

struct au_user_ent *
getauusernam(const char *name);

struct au_user_ent *
getauusernam_r(struct au_user_ent *u, const char *name);

int
au_user_mask(char *username, au_mask_t *mask_p);

int
getfauditflags(au_mask_t *usremask, au_mask_t *usrdmask,
    au_mask_t *lastmask);

---

💖 DESCRIPTION 💖

these interfaces are how you peek into the audit_user(5) database — you know, the one that describes per-user audit configuration. iconic behavior honestly.

every audit user entry is described by an au_user_ent, and it stores three things:

• the user's name in au_name
• events to always audit in au_always
• events to never audit in au_never

periodt. that's the whole struct vibe.

---

🌈 the getters 🌈

getauuserent() returns the next user found in the audit_user(5) database — or the first one if the function hasn't been called yet. and if there are no further records available? it returns NULL. sad but true 😭

getauusernam() looks up a user by name. if no matching class can be found, NULL gets returned. (yes, the manpage says "class" — we don't make the rules, we just report them faithfully 💀)

---

🎀 the iterators 🎀

setauuser() resets the iterator through the audit_user(5) database, which makes the next call to getauuserent() start all over again from the beginning of the file. a literal reset arc, main character energy ✨

endauuser() closes the audit_user(5) database — if it's open. if it's not open, it's just chillin'. 💅

---

👑 the mask makers 👑

au_user_mask() calculates a brand new session audit mask and hands it back via mask_p for the user identified by username. if the user's audit configuration isn't found, it falls back to the default system audit properties returned by getacflg(3). the resulting mask may be set via a call to setaudit(2) or related variants. slay, that's the whole flow.

getfauditflags() generates a new process audit state by combining the audit masks passed as parameters with the system audit masks. three masks in, one state out — it's giving math but make it security 🔥

---

🌟 SEE ALSO 🌟

• setaudit(2)
• getacflg(3)
• libbsm(3)
• audit_user(5)

---

🧚 HISTORY 🧚

the OpenBSM implementation was created by McAfee Research — that's the security division of McAfee Inc. — under contract to Apple Computer, Inc., in 2004. and then it was subsequently adopted by the TrustedBSD Project as the foundation for the OpenBSM distribution. a little origin story, we love to see it 💜

---

⭐ AUTHORS ⭐

this software was created by Robert Watson, Wayne Salamon, and Suresh Krishnaswamy for McAfee Research, the security research division of McAfee, Inc., under contract to Apple Computer, Inc. absolute legends, no notes 👑

also: the Basic Security Module (BSM) interface to audit records and audit event stream format were defined by Sun Microsystems. respect the OGs. 🌈

---

💀 BUGS 💀

ngl bestie, this one's a real one: these routines cannot currently distinguish between an entry not being found and an error accessing the database. the implementation should be changed to return an error via errno when NULL is returned. so like... if you get NULL, good luck figuring out why 🙈

---

and that's the page! this came from Debian, dated April 19, 2005 — so go forth, audit responsibly, and remember: NULL is not a personality trait 🍓💅✨