AU_USER(3)

💖 AU_USER(3) — the audit_user glow-up guide 🎀

okay so bestie, welcome to AU_USER(3), from the Library Functions Manual — yes we're in the manual pages, yes it's giving study session, but hear me out because this one is actually so useful. ✨

🌸 NAME 🌸

setauuser, endauuser, getauuserent, getauuserent_r, getauusernam, getauusernam_r, au_user_mask, getfauditflags — literally all of these are here to look up information from the audit_user database. that's the whole vibe. 🫶

🦋 LIBRARY 🦋

Basic Security Module Library (libbsm, -lbsm). link it, love it. 💅

⭐ SYNOPSIS ⭐

#include <bsm/libbsm.h>

void
setauuser(void);

void
endauuser(void);

struct au_user_ent *
getauuserent(void);

struct au_user_ent *
getauuserent_r(struct au_user_ent *u);

struct au_user_ent *
getauusernam(const char *name);

struct au_user_ent *
getauusernam_r(struct au_user_ent *u, const char *name);

int
au_user_mask(char *username, au_mask_t *mask_p);

int
getfauditflags(au_mask_t *usremask, au_mask_t *usrdmask,
    au_mask_t *lastmask);

no cap, that's the whole cast of characters. 👑

🧚 DESCRIPTION 🧚

These interfaces are your little backstage pass to the audit_user(5) database — the file that describes per-user audit configuration. Each audit user entry is described by a au_user_ent, which stores:

• the user's name in au_name 🏷️
• the events to always audit in au_always 🔥
• the events to never audit in au_never 💀

okay so now let's meet everybody:

• getauuserent() — returns the next user found in the audit_user(5) database, or the first one if the function hasn't been called yet. it returns NULL if there are no further records available. it's giving "next slide please". ✨
• getauusernam() — looks up a user by name. NULL gets returned if no matching class can be found. 🙈
• setauuser() — resets the iterator through the audit_user(5) database, so the next call to getauuserent() starts all the way over from the beginning of the file. rewind era. ⏪
• endauuser() — closes the audit_user(5) database, if it's open. say bye, bestie. 👋
• au_user_mask() — calculates a new session audit mask, handed back to you via mask_p, for the user identified by username. if the user's audit configuration isn't found, it falls back to the default system audit properties returned by getacflg(3). and the resulting mask may be set via a call to setaudit(2) or related variants. so iconic of it. 💅
• getfauditflags() — generates a brand new process audit state by combining the audit masks you pass as parameters with the system audit masks. mashup of the year fr fr. 🎧

---

🔍 SEE ALSO 🔍

• setaudit(2)
• getacflg(3)
• libbsm(3)
• audit_user(5)

go read those too, i'm not asking, i'm telling you 🫶

🕰️ HISTORY 🕰️

The OpenBSM implementation was created by McAfee Research (the security division of McAfee Inc.) under contract to Apple Computer, Inc., in 2004. it was subsequently adopted by the TrustedBSD Project as the foundation for the OpenBSM distribution. lore drop. 📜✨

👑 AUTHORS 👑

This software was created by Robert Watson, Wayne Salamon, and Suresh Krishnaswamy for McAfee Research, the security research division of McAfee, Inc., under contract to Apple Computer, Inc.

The Basic Security Module (BSM) interface to audit records and audit event stream format were defined by Sun Microsystems. absolute legends, no notes. 🌈

💀 BUGS 💀

okay so this is the messy part, bestie: these routines cannot currently distinguish between an entry not being found and an error accessing the database 😭. The implementation should be changed to return an error via errno when NULL is returned. so until then, NULL is doing double duty and honestly that's on the implementation. 🙈

---

and that's the page!! 🎀 this one came from Debian, dated April 19, 2005 — vintage, honestly. now go audit something, slay, and don't forget to call endauuser() on your way out. 💖✨🦋