Re: audit_send function in netlink socket

[Steve Grubb <sgrubb@redhat.com>]

On Wednesday, January 19, 2011 05:30:15 am Ashok Kumar J wrote:
>           I saw the function audit_send in the file netlink.c. But i did
> not get any man pages for this. I want to know the description of this
> structure.

If you look in lib/private.h
extern int audit_send(int fd, int type, const void *data, unsigned int size)
        hidden;

Its a hidden function that is not part of the public API and that is why there is no 
man page. What it sends to the kernel is:

struct audit_message {
        struct nlmsghdr nlh;
        char   data[MAX_AUDIT_MESSAGE_LENGTH];
};

The data format varies with each kind of command sent. The commands are found in 
/usr/include/linux/audit.h with a numeric value between 1000 and 1099. Some commands 
have lots of data, such as the ADD_RULE command. However, some have no data, such as 
the LIST_RULES command.

This is not documented in man pages because the logic is embodied in the library and 
it was never anticpated that the audit system be operated without at least libaudit.

-Steve