NAME
audswitch() — suspend or resume auditing on the current process
SYNOPSIS
#include <sys/audit.h>
int audswitch(int aflag);
DESCRIPTION
audswitch()
suspends or resumes auditing within the current process.
This call is restricted to users with the
SELFAUDIT
privilege.
One of the following flags must be used for
aflag:
- AUD_SUSPEND
Suspend auditing on the current process.
- AUD_RESUME
Resume auditing on the current process.
audswitch()
can be used in processes with the
SELFAUDIT
privilege to temporarily suspend auditing during intervals
where auditing is to be handled by the process itself.
Auditing is suspended by a call to
audswitch()
with the
AUD_SUSPEND
parameter and resumed later by a call to
audswitch()
with the
AUD_RESUME
parameter.
An
audswitch()
call to resume auditing serves only to reverse the action of a previous
audswitch()
call to suspend auditing.
A call to
audswitch()
to resume auditing when auditing is not suspended has no effect.
audswitch()
affects only the current process.
For example,
audswitch()
cannot suspend auditing for processes
exec'ed
from the current process.
(Use
setaudproc
(see
setaudproc(2))
to enable or disable auditing for a process and its children).
Security Restrictions
Some or all of the actions associated with this system call require the
SELFAUDIT
privilege.
Processes owned by the superuser have this privilege.
Processes owned by other users may have this privilege, depending on system
configuration.
See
privileges(5)
for more information about privileged access on
systems that support fine-grained privileges.
RETURN VALUE
Upon successful completion,
audswitch()
returns
0.
If an error occurs,
-1
is returned and the global variable
errno
is set to indicate the error.
ERRORS
audswitch()
fails if one of the following is true:
- EPERM
The user does not possess the
SELFAUDIT
privilege.
- EINVAL
The input parameter is neither
AUD_RESUME
nor
AUD_SUSPEND.
AUTHOR
audswitch()
was developed by HP.
Printable version
