/*-
 * Copyright (c) 2004-2009 Apple Inc.
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1.  Redistributions of source code must retain the above copyright
 *     notice, this list of conditions and the following disclaimer.
 * 2.  Redistributions in binary form must reproduce the above copyright
 *     notice, this list of conditions and the following disclaimer in the
 *     documentation and/or other materials provided with the distribution.
 * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
 *     its contributors may be used to endorse or promote products derived
 *     from this software without specific prior written permission.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR
 * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
 * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 * POSSIBILITY OF SUCH DAMAGE.
 *
 * $P4: //depot/projects/trustedbsd/openbsm/bsm/libbsm.h#48 $
 */

#ifndef _LIBBSM_H_
#define	_LIBBSM_H_

/*
 * NB: definitions, etc., marked with "OpenSSH compatibility" were introduced
 * solely to allow OpenSSH to compile; Darwin/Apple code should not use them.
 */

#include <sys/types.h>
#include <sys/cdefs.h>

#include <inttypes.h>		/* Required for audit.h. */
#include <time.h>		/* Required for clock_t on Linux. */

#include <bsm/audit.h>
#include <bsm/audit_record.h>

#include <stdio.h>

#ifdef __APPLE__
#include <mach/mach.h>		/* audit_token_t */
#include <os/availability.h>
#endif

/*
 * Size parsed token vectors for execve(2) arguments and environmental
 * variables.  Note: changing these sizes affects the ABI of the token
 * structure, and as the token structure is often placed in the caller stack,
 * this is undesirable.
 */
#define	AUDIT_MAX_ARGS	128
#define	AUDIT_MAX_ENV	128
#define	AUDIT_MAX_CERT_HASH	32
#define	AUDIT_MAX_KRB5_PRINCIPAL	32

/*
 * Arguments to au_preselect(3).
 */
#define	AU_PRS_USECACHE	0
#define	AU_PRS_REREAD	1

#define	AU_PRS_SUCCESS	1
#define	AU_PRS_FAILURE	2
#define	AU_PRS_BOTH	(AU_PRS_SUCCESS|AU_PRS_FAILURE)

#define	AUDIT_EVENT_FILE	"/etc/security/audit_event"
#define	AUDIT_CLASS_FILE	"/etc/security/audit_class"
#define	AUDIT_CONTROL_FILE	"/etc/security/audit_control"
#define	AUDIT_USER_FILE		"/etc/security/audit_user"

#define	DIR_CONTROL_ENTRY		"dir"
#define	MINFREE_CONTROL_ENTRY		"minfree"
#define	FILESZ_CONTROL_ENTRY		"filesz"
#define	FLAGS_CONTROL_ENTRY		"flags"
#define	NA_CONTROL_ENTRY		"naflags"
#define	POLICY_CONTROL_ENTRY		"policy"
#define	AUDIT_HOST_CONTROL_ENTRY	"host"
#define	EXPIRE_AFTER_CONTROL_ENTRY	"expire-after"

#define	AU_CLASS_NAME_MAX	8
#define	AU_CLASS_DESC_MAX	72
#define	AU_EVENT_NAME_MAX	30
#define	AU_EVENT_DESC_MAX	50
#define	AU_USER_NAME_MAX	50
#define	AU_LINE_MAX		256
#define	MAX_AUDITSTRING_LEN	256
#define	BSM_TEXTBUFSZ		MAX_AUDITSTRING_LEN	/* OpenSSH compatibility */

/*
 * Arguments to au_close(3).
 */
#define	AU_TO_NO_WRITE		0	/* Abandon audit record. */
#define	AU_TO_WRITE		1	/* Commit audit record. */

/*
 * Output format flags for au_print_flags_tok().
 */
#define	AU_OFLAG_NONE		0x0000	/* Default form. */
#define	AU_OFLAG_RAW		0x0001	/* Raw, numeric form. */
#define	AU_OFLAG_SHORT		0x0002	/* Short form. */
#define	AU_OFLAG_XML		0x0004	/* XML form. */
#define	AU_OFLAG_NORESOLVE	0x0008	/* No user/group name resolution. */

__BEGIN_DECLS
struct au_event_ent {
	au_event_t	 ae_number;
	char		*ae_name;
	char		*ae_desc;
	au_class_t	 ae_class;
};
typedef struct au_event_ent au_event_ent_t;

struct au_class_ent {
	char		*ac_name;
	au_class_t	 ac_class;
	char		*ac_desc;
};
typedef struct au_class_ent au_class_ent_t;

struct au_user_ent {
	char		*au_name;
	au_mask_t	 au_always;
	au_mask_t	 au_never;
};
typedef struct au_user_ent au_user_ent_t;
__END_DECLS

#define	ADD_TO_MASK(m, c, sel) do {					\
	if (sel & AU_PRS_SUCCESS)					\
		(m)->am_success |= c;					\
	if (sel & AU_PRS_FAILURE)					\
		(m)->am_failure |= c;					\
} while (0)

#define	SUB_FROM_MASK(m, c, sel) do {					\
	if (sel & AU_PRS_SUCCESS)					\
		(m)->am_success &= ((m)->am_success ^ c);		\
	if (sel & AU_PRS_FAILURE)					\
		(m)->am_failure &= ((m)->am_failure ^ c);		\
} while (0)

#define	ADDMASK(m, v) do {						\
	(m)->am_success |= (v)->am_success;				\
	(m)->am_failure |= (v)->am_failure;				\
} while(0)

#define	SUBMASK(m, v) do {						\
	(m)->am_success &= ((m)->am_success ^ (v)->am_success);		\
	(m)->am_failure &= ((m)->am_failure ^ (v)->am_failure);		\
} while(0)

__BEGIN_DECLS

typedef struct au_tid32 {
	u_int32_t	port;
	u_int32_t	addr;
} au_tid32_t;

typedef struct au_tid64 {
	u_int64_t	port;
	u_int32_t	addr;
} au_tid64_t;

typedef struct au_tidaddr32 {
	u_int32_t	port;
	u_int32_t	type;
	u_int32_t	addr[4];
} au_tidaddr32_t;

typedef struct au_tidaddr64 {
	u_int64_t	port;
	u_int32_t	type;
	u_int32_t	addr[4];
} au_tidaddr64_t;

/*
 * argument #              1 byte
 * argument value          4 bytes/8 bytes (32-bit/64-bit value)
 * text length             2 bytes
 * text                    N bytes + 1 terminating NULL byte
 */
typedef struct {
	u_char		 no;
	u_int32_t	 val;
	u_int16_t	 len;
	char		*text;
} au_arg32_t;

typedef struct {
	u_char		 no;
	u_int64_t	 val;
	u_int16_t	 len;
	char		*text;
} au_arg64_t;

/*
 * how to print            1 byte
 * basic unit              1 byte
 * unit count              1 byte
 * data items              (depends on basic unit)
 */
typedef struct {
	u_char	 howtopr;
	u_char	 bu;
	u_char	 uc;
	u_char	*data;
} au_arb_t;

/*
 * file access mode        4 bytes
 * owner user ID           4 bytes
 * owner group ID          4 bytes
 * file system ID          4 bytes
 * node ID                 8 bytes
 * device                  4 bytes/8 bytes (32-bit/64-bit)
 */
typedef struct {
	u_int32_t	mode;
   	u_int32_t	uid;
	u_int32_t	gid;
	u_int32_t	fsid;
	u_int64_t	nid;
	u_int32_t	dev;
} au_attr32_t;

typedef struct {
	u_int32_t	mode;
   	u_int32_t	uid;
	u_int32_t	gid;
	u_int32_t	fsid;
	u_int64_t	nid;
	u_int64_t	dev;
} au_attr64_t;

/*
 * count                   4 bytes
 * text                    count null-terminated string(s)
 */
typedef struct {
	u_int32_t	 count;
	char		*text[AUDIT_MAX_ARGS];
} au_execarg_t;

/*
 * count                   4 bytes
 * text                    count null-terminated string(s)
 */
typedef struct {
	u_int32_t	 count;
	char		*text[AUDIT_MAX_ENV];
} au_execenv_t;

/*
 * count                   4 bytes
 * text                    count null-terminated string(s)
 */
typedef struct {
	u_int32_t	 count;
	char		*text[AUDIT_MAX_CERT_HASH];
} au_cert_hash_t;

/*
 * count                   4 bytes
 * text                    count null-terminated string(s)
 */
typedef struct {
	u_int32_t	 count;
	char		*text[AUDIT_MAX_KRB5_PRINCIPAL];
} au_krb5_principal_t;

/*
 * status                  4 bytes
 * return value            4 bytes
 */
typedef struct {
	u_int32_t	status;
	u_int32_t	ret;
} au_exit_t;

/*
 * seconds of time         4 bytes
 * milliseconds of time    4 bytes
 * file name length        2 bytes
 * file pathname           N bytes + 1 terminating NULL byte
 */
typedef struct {
	u_int32_t	 s;
	u_int32_t	 ms;
	u_int16_t	 len;
	char		*name;
} au_file_t;


/*
 * number groups           2 bytes
 * group list              N * 4 bytes
 */
typedef struct {
	u_int16_t	no;
	u_int32_t	list[AUDIT_MAX_GROUPS];
} au_groups_t;

/*
 * record byte count       4 bytes
 * version #               1 byte    [2]
 * event type              2 bytes
 * event modifier          2 bytes
 * seconds of time         4 bytes/8 bytes (32-bit/64-bit value)
 * milliseconds of time    4 bytes/8 bytes (32-bit/64-bit value)
 */
typedef struct {
	u_int32_t	size;
	u_char		version;
	u_int16_t	e_type;
	u_int16_t	e_mod;
	u_int32_t	s;
	u_int32_t	ms;
} au_header32_t;

/*
 * record byte count       4 bytes
 * version #               1 byte     [2]
 * event type              2 bytes
 * event modifier          2 bytes
 * address type/length     1 byte (XXX: actually, 4 bytes)
 * machine address         4 bytes/16 bytes (IPv4/IPv6 address)
 * seconds of time         4 bytes/8 bytes  (32/64-bits)
 * nanoseconds of time     4 bytes/8 bytes  (32/64-bits)
 */
typedef struct {
	u_int32_t	size;
	u_char		version;
	u_int16_t	e_type;
	u_int16_t	e_mod;
	u_int32_t	ad_type;
	u_int32_t	addr[4];
	u_int32_t	s;
	u_int32_t	ms;
} au_header32_ex_t;

typedef struct {
	u_int32_t	size;
	u_char		version;
	u_int16_t	e_type;
	u_int16_t	e_mod;
	u_int64_t	s;
	u_int64_t	ms;
} au_header64_t;

typedef struct {
	u_int32_t	size;
	u_char		version;
	u_int16_t	e_type;
	u_int16_t	e_mod;
	u_int32_t	ad_type;
	u_int32_t	addr[4];
	u_int64_t	s;
	u_int64_t	ms;
} au_header64_ex_t;

/*
 * internet address        4 bytes
 */
typedef struct {
	u_int32_t	addr;
} au_inaddr_t;

/*
 * type                 4 bytes
 * internet address     16 bytes
 */
typedef struct {
	u_int32_t	type;
	u_int32_t	addr[4];
} au_inaddr_ex_t;

/*
 * version and ihl         1 byte
 * type of service         1 byte
 * length                  2 bytes
 * id                      2 bytes
 * offset                  2 bytes
 * ttl                     1 byte
 * protocol                1 byte
 * checksum                2 bytes
 * source address          4 bytes
 * destination address     4 bytes
 */
typedef struct {
	u_char		version;
	u_char		tos;
	u_int16_t	len;
	u_int16_t	id;
	u_int16_t	offset;
	u_char		ttl;
	u_char		prot;
	u_int16_t	chksm;
	u_int32_t	src;
	u_int32_t	dest;
} au_ip_t;

/*
 * object ID type          1 byte
 * object ID               4 bytes
 */
typedef struct {
	u_char		type;
	u_int32_t	id;
} au_ipc_t;

/*
 * owner user ID           4 bytes
 * owner group ID          4 bytes
 * creator user ID         4 bytes
 * creator group ID        4 bytes
 * access mode             4 bytes
 * slot sequence #         4 bytes
 * key                     4 bytes
 */
typedef struct {
	u_int32_t	uid;
	u_int32_t	gid;
	u_int32_t	puid;
	u_int32_t	pgid;
	u_int32_t	mode;
	u_int32_t	seq;
	u_int32_t	key;
} au_ipcperm_t;

/*
 * port IP address         2 bytes
 */
typedef struct {
	u_int16_t	port;
} au_iport_t;

/*
 * length		2 bytes
 * data			length bytes
 */
typedef struct {
	u_int16_t	 size;
	char		*data;
} au_opaque_t;

/*
 * path length             2 bytes
 * path                    N bytes + 1 terminating NULL byte
 */
typedef struct {
	u_int16_t	 len;
	char		*path;
} au_path_t;

/*
 * audit ID                4 bytes
 * effective user ID       4 bytes
 * effective group ID      4 bytes
 * real user ID            4 bytes
 * real group ID           4 bytes
 * process ID              4 bytes
 * session ID              4 bytes
 * terminal ID
 * port ID               4 bytes/8 bytes (32-bit/64-bit value)
 * machine address       4 bytes
 */
typedef struct {
	u_int32_t	auid;
	u_int32_t	euid;
	u_int32_t	egid;
	u_int32_t	ruid;
	u_int32_t	rgid;
	u_int32_t	pid;
	u_int32_t	sid;
	au_tid32_t	tid;
} au_proc32_t;

typedef struct {
	u_int32_t	auid;
	u_int32_t	euid;
	u_int32_t	egid;
	u_int32_t	ruid;
	u_int32_t	rgid;
	u_int32_t	pid;
	u_int32_t	sid;
	au_tid64_t	tid;
} au_proc64_t;

/*
 * audit ID                4 bytes
 * effective user ID       4 bytes
 * effective group ID      4 bytes
 * real user ID            4 bytes
 * real group ID           4 bytes
 * process ID              4 bytes
 * session ID              4 bytes
 * terminal ID
 * port ID               4 bytes/8 bytes (32-bit/64-bit value)
 * type                  4 bytes
 * machine address       16 bytes
 */
typedef struct {
	u_int32_t	auid;
	u_int32_t	euid;
	u_int32_t	egid;
	u_int32_t	ruid;
	u_int32_t	rgid;
	u_int32_t	pid;
	u_int32_t	sid;
	au_tidaddr32_t	tid;
} au_proc32ex_t;

typedef struct {
	u_int32_t	auid;
	u_int32_t	euid;
	u_int32_t	egid;
	u_int32_t	ruid;
	u_int32_t	rgid;
	u_int32_t	pid;
	u_int32_t	sid;
	au_tidaddr64_t	tid;
} au_proc64ex_t;

/*
 * error status            1 byte
 * return value            4 bytes/8 bytes (32-bit/64-bit value)
 */
typedef struct {
	u_char		status;
	u_int32_t	ret;
} au_ret32_t;

typedef struct {
	u_char		err;
	u_int64_t	val;
} au_ret64_t;

/*
 * sequence number         4 bytes
 */
typedef struct {
	u_int32_t	seqno;
} au_seq_t;

/*
 * socket type             2 bytes
 * local port              2 bytes
 * local Internet address  4 bytes
 * remote port             2 bytes
 * remote Internet address 4 bytes
 */
typedef struct {
	u_int16_t	type;
	u_int16_t	l_port;
	u_int32_t	l_addr;
	u_int16_t	r_port;
	u_int32_t	r_addr;
} au_socket_t;

/*
 * socket type             2 bytes
 * local port              2 bytes
 * address type/length     4 bytes
 * local Internet address  4 bytes/16 bytes (IPv4/IPv6 address)
 * remote port             4 bytes
 * address type/length     4 bytes
 * remote Internet address 4 bytes/16 bytes (IPv4/IPv6 address)
 */
typedef struct {
	u_int16_t	domain;
	u_int16_t	type;
	u_int16_t	atype;
	u_int16_t	l_port;
	u_int32_t	l_addr[4];
	u_int32_t	r_port;
	u_int32_t	r_addr[4];
} au_socket_ex32_t;

/*
 * socket family           2 bytes
 * local port              2 bytes
 * socket address          4 bytes/16 bytes (IPv4/IPv6 address)
 */
typedef struct {
	u_int16_t	family;
	u_int16_t	port;
	u_int32_t	addr[4];
} au_socketinet_ex32_t;

typedef struct {
	u_int16_t	family;
	u_int16_t	port;
	u_int32_t	addr;
} au_socketinet32_t;

/*
 * socket family           2 bytes
 * path                    104 bytes
 */
typedef struct {
	u_int16_t	family;
	char		path[104];
} au_socketunix_t;

/*
 * audit ID                4 bytes
 * effective user ID       4 bytes
 * effective group ID      4 bytes
 * real user ID            4 bytes
 * real group ID           4 bytes
 * process ID              4 bytes
 * session ID              4 bytes
 * terminal ID
 * 	port ID               4 bytes/8 bytes (32-bit/64-bit value)
 * 	machine address       4 bytes
 */
typedef struct {
	u_int32_t	auid;
	u_int32_t	euid;
	u_int32_t	egid;
	u_int32_t	ruid;
	u_int32_t	rgid;
	u_int32_t	pid;
	u_int32_t	sid;
	au_tid32_t	tid;
} au_subject32_t;

typedef struct {
	u_int32_t	auid;
	u_int32_t	euid;
	u_int32_t	egid;
	u_int32_t	ruid;
	u_int32_t	rgid;
	u_int32_t	pid;
	u_int32_t	sid;
	au_tid64_t	tid;
} au_subject64_t;

/*
 * audit ID                4 bytes
 * effective user ID       4 bytes
 * effective group ID      4 bytes
 * real user ID            4 bytes
 * real group ID           4 bytes
 * process ID              4 bytes
 * session ID              4 bytes
 * terminal ID
 * port ID               4 bytes/8 bytes (32-bit/64-bit value)
 * type                  4 bytes
 * machine address       16 bytes
 */
typedef struct {
	u_int32_t	auid;
	u_int32_t	euid;
	u_int32_t	egid;
	u_int32_t	ruid;
	u_int32_t	rgid;
	u_int32_t	pid;
	u_int32_t	sid;
	au_tidaddr32_t	tid;
} au_subject32ex_t;

typedef struct {
	u_int32_t	auid;
	u_int32_t	euid;
	u_int32_t	egid;
	u_int32_t	ruid;
	u_int32_t	rgid;
	u_int32_t	pid;
	u_int32_t	sid;
	au_tidaddr64_t	tid;
} au_subject64ex_t;

/*
 * text length             2 bytes
 * text                    N bytes + 1 terminating NULL byte
 */
typedef struct {
	u_int16_t	 len;
	char		*text;
} au_text_t;

/*
 * zonename length	2 bytes
 * zonename text	N bytes + 1 NULL terminator
 */
typedef struct {
	u_int16_t	 len;
	char		*zonename;
} au_zonename_t;

typedef struct {
	u_int32_t	ident;
	u_int16_t	filter;
	u_int16_t	flags;
	u_int32_t	fflags;
	u_int32_t	data;
} au_kevent_t;

typedef struct {
	u_int16_t	 length;
	char		*data;
} au_invalid_t;

/*
 * signer type             4 bytes
 * signing id length       2 bytes
 * signing id              N bytes + 1 terminating NULL byte
 * signing id truncated    1 byte (true/false)
 * team id length          2 bytes
 * team id                 N bytes + 1 terminating NULL byte
 * team id truncated       1 byte (true/false)
 * cdhash length           2 bytes
 * cdhash                  N bytes
 *
 * Note: This structure represents a contiguous (in-memory/on-disk) layout.
 * Due to multiple variable length buffers it cannot be simply assigned and
 * should only be populated via au_fetch_tok().
 */
typedef struct {
	u_int32_t	signer_type;
	u_int16_t	signing_id_len;
	char		*signing_id;
	u_char		signing_id_truncated;
	u_int16_t	team_id_len;
	char		*team_id;
	u_char		team_id_truncated;
	u_int16_t	cdhash_len;
	u_int8_t	*cdhash;
} au_identity_t;

/*
 * trailer magic number    2 bytes
 * record byte count       4 bytes
 */
typedef struct {
	u_int16_t	magic;
	u_int32_t	count;
} au_trailer_t;

struct tokenstr {
	u_char	 id;
	u_char	*data;
	size_t	 len;
	union {
		au_arg32_t		arg32;
		au_arg64_t		arg64;
		au_arb_t		arb;
		au_attr32_t		attr32;
		au_attr64_t		attr64;
		au_execarg_t		execarg;
		au_execenv_t		execenv;
		au_exit_t		exit;
		au_file_t		file;
		au_groups_t		grps;
		au_header32_t		hdr32;
		au_header32_ex_t	hdr32_ex;
		au_header64_t		hdr64;
		au_header64_ex_t	hdr64_ex;
		au_inaddr_t		inaddr;
		au_inaddr_ex_t		inaddr_ex;
		au_ip_t			ip;
		au_ipc_t		ipc;
		au_ipcperm_t		ipcperm;
		au_iport_t		iport;
		au_opaque_t		opaque;
		au_path_t		path;
		au_proc32_t		proc32;
		au_proc32ex_t		proc32_ex;
		au_proc64_t		proc64;
		au_proc64ex_t		proc64_ex;
		au_ret32_t		ret32;
		au_ret64_t		ret64;
		au_seq_t		seq;
		au_socket_t		socket;
		au_socket_ex32_t	socket_ex32;
		au_socketinet_ex32_t	sockinet_ex32;
		au_socketunix_t		sockunix;
		au_subject32_t		subj32;
		au_subject32ex_t	subj32_ex;
		au_subject64_t		subj64;
		au_subject64ex_t	subj64_ex;
		au_text_t		text;
		au_kevent_t		kevent;
		au_invalid_t		invalid;
		au_trailer_t		trail;
		au_zonename_t		zonename;
		au_cert_hash_t		cert_hash;
		au_krb5_principal_t		krb5_principal;
		au_identity_t	identity;
	} tt; /* The token is one of the above types */
};

typedef struct tokenstr tokenstr_t;

int audit_submit(short au_event, au_id_t auid, char status, int reterr, const char *fmt, ...)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

/*
 * Functions relating to querying audit class information.
 */
void setauclass(void)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

void endauclass(void)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

struct au_class_ent *getauclassent(void)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

struct au_class_ent *getauclassent_r(au_class_ent_t *class_int)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

struct au_class_ent *getauclassnam(const char *name)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

struct au_class_ent *getauclassnam_r(au_class_ent_t *class_int, const char *name)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

struct au_class_ent *getauclassnum(au_class_t class_number)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

struct au_class_ent *getauclassnum_r(au_class_ent_t *class_int, au_class_t class_number)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

/*
 * Functions relating to querying audit control information.
 */
void setac(void)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

void endac(void)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

int getacdir(char *name, int len)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

int getacmin(int *min_val)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

int getacfilesz(size_t *size_val)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

int getacflg(char *auditstr, int len)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

int getacna(char *auditstr, int len)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

int getacpol(char *auditstr, size_t len)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

int getacsflagsmask(const char *which, char *auditstr, size_t len)
	API_DEPRECATED("no longer implemented", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

int getachost(char *auditstr, size_t len)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

int getacexpire(int *andflg, time_t *age, size_t *size)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

int getauditflagsbin(char *auditstr, au_mask_t *masks)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

int getauditflagschar(char *auditstr, au_mask_t *masks, int verbose)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

int au_preselect(au_event_t event, au_mask_t *mask_p, int sorf, int flag)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

ssize_t au_poltostr(int policy, size_t maxsize, char *buf)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

int au_strtopol(const char *polstr, int *policy)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

/*
 * Functions relating to audit session flags.
 */
ssize_t au_sflagstostr(uint64_t flags, size_t maxsize, char *buf)
	API_AVAILABLE(macos(10.8)) API_UNAVAILABLE(ios, watchos, tvos);

int au_strtosflags(const char *sflagsstr, uint64_t *flags)
	API_AVAILABLE(macos(10.8)) API_UNAVAILABLE(ios, watchos, tvos);

/*
 * Functions relating to querying audit event information.
 */
void setauevent(void)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

void endauevent(void)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

struct au_event_ent *getauevent(void)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

struct au_event_ent *getauevent_r(struct au_event_ent *e)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

struct au_event_ent *getauevnam(const char *name)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

struct au_event_ent *getauevnam_r(struct au_event_ent *e, const char *name)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

struct au_event_ent *getauevnum(au_event_t event_number)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

struct au_event_ent *getauevnum_r(struct au_event_ent *e, au_event_t event_number)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

au_event_t *getauevnonam(const char *event_name)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

au_event_t *getauevnonam_r(au_event_t *ev, const char *event_name)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

/*
 * Functions relating to querying audit user information.
 */
void setauuser(void)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

void endauuser(void)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

struct au_user_ent *getauuserent(void)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

struct au_user_ent *getauuserent_r(struct au_user_ent *u)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

struct au_user_ent *getauusernam(const char *name)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

struct au_user_ent *getauusernam_r(struct au_user_ent *u, const char *name)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

int au_user_mask(char *username, au_mask_t *mask_p)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

int getfauditflags(au_mask_t *usremask, au_mask_t *usrdmask, au_mask_t *lastmask)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

/*
 * Functions for reading and printing records and tokens from audit trails.
 */
int au_read_rec(FILE *fp, u_char **buf)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

int au_fetch_tok(tokenstr_t *tok, u_char *buf, int len)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

//XXX The following interface has different prototype from BSM
void au_print_tok(FILE *outfp, tokenstr_t *tok, char *del, char raw, char sfrm)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

void au_print_flags_tok(FILE *outfp, tokenstr_t *tok, char *del, int oflags)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

void au_print_tok_xml(FILE *outfp, tokenstr_t *tok, char *del, char raw, char sfrm)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

/* 
 * Functions relating to XML output.
 */
void au_print_xml_header(FILE *outfp)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

void au_print_xml_footer(FILE *outfp)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);


const char *au_strerror(u_char bsm_error)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

__END_DECLS

/*
 * The remaining APIs are associated with Apple's BSM implementation, in
 * particular as relates to Mach IPC auditing and triggers passed via Mach
 * IPC.
 */
#ifdef __APPLE__
#include <sys/appleapiopts.h>

/**************************************************************************
 **************************************************************************
 ** The following definitions, functions, etc., are NOT officially
 ** supported: they may be changed or removed in the future.  Do not use
 ** them unless you are prepared to cope with that eventuality.
 **************************************************************************
 **************************************************************************/

#ifdef __APPLE_API_PRIVATE
#define	__BSM_INTERNAL_NOTIFY_KEY	"com.apple.audit.change"
#endif /* __APPLE_API_PRIVATE */

/*
 * au_get_state() return values
 * XXX  use AUC_* values directly instead (<bsm/audit.h>); AUDIT_OFF and
 * AUDIT_ON are deprecated and WILL be removed.
 */
#ifdef __APPLE_API_PRIVATE
#define	AUDIT_OFF	AUC_NOAUDIT
#define	AUDIT_ON	AUC_AUDITING
#endif /* __APPLE_API_PRIVATE */
#endif /* !__APPLE__ */

/*
 * Error return codes for audit_set_terminal_id_ex(), audit_write() and its
 * brethren.  We have 255 (not including kAUNoErr) to play with.
 *
 * XXXRW: In Apple's bsm-8, these are marked __APPLE_API_PRIVATE.
 */
enum {
	kAUNoErr			= 0,
	kAUBadParamErr			= -66049,
	kAUStatErr,
	kAUSysctlErr,
	kAUOpenErr,
	kAUMakeSubjectTokErr,
	kAUWriteSubjectTokErr,
	kAUWriteCallerTokErr,
	kAUMakeReturnTokErr,
	kAUWriteReturnTokErr,
	kAUCloseErr,
	kAUMakeTextTokErr,
	kAULastErr
};

#ifdef __APPLE__
/*
 * Error return codes for au_get_state() and/or its private support
 * functions.  These codes are designed to be compatible with the
 * NOTIFY_STATUS_* codes defined in <notify.h> but non-overlapping.
 * Any changes to notify(3) may cause these values to change in future.
 *
 * AU_UNIMPL should never happen unless you've changed your system software
 * without rebooting.  Shame on you.
 */
#ifdef __APPLE_API_PRIVATE
#define	AU_UNIMPL	NOTIFY_STATUS_FAILED + 1	/* audit unimplemented */
#endif /* __APPLE_API_PRIVATE */
#endif /* !__APPLE__ */

__BEGIN_DECLS
/*
 * XXX  This prototype should be in audit_record.h
 *
 * au_free_token()
 *
 * @summary - au_free_token() deallocates a token_t created by any of
 * the au_to_*() BSM API functions.
 *
 * The BSM API generally manages deallocation of token_t objects.  However,
 * if au_write() is passed a bad audit descriptor, the token_t * parameter
 * will be left untouched.  In that case, the caller can deallocate the
 * token_t using au_free_token() if desired.  This is, in fact, what
 * audit_write() does, in keeping with the existing memory management model
 * of the BSM API.
 *
 * @param tok - A token_t * generated by one of the au_to_*() BSM API
 * calls.  For convenience, tok may be NULL, in which case
 * au_free_token() returns immediately.
 *
 * XXXRW: In Apple's bsm-8, these are marked __APPLE_API_PRIVATE.
 */
void au_free_token(token_t *tok)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

/*
 * Lightweight check to determine if auditing is enabled.  If a client
 * wants to use this to govern whether an entire series of audit calls
 * should be made--as in the common case of a caller building a set of
 * tokens, then writing them--it should cache the audit status in a local
 * variable.  This call always returns the current state of auditing.
 *
 * @return - AUC_AUDITING or AUC_NOAUDIT if no error occurred.
 * Otherwise the function can return any of the errno values defined for
 * setaudit(2), or AU_UNIMPL if audit does not appear to be supported by
 * the system.
 *
 * XXXRW: In Apple's bsm-8, these are marked __APPLE_API_PRIVATE.
 */
int au_get_state(void)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

/*
 * Initialize the audit notification.  If it has not already been initialized
 * it will automatically on the first call of au_get_state().
 */
uint32_t au_notify_initialize(void)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

/*
 * Cancel audit notification and free the resources associated with it.
 * Responsible code that no longer needs to use au_get_state() should call
 * this.
 */
int au_notify_terminate(void)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

__END_DECLS

/* OpenSSH compatibility */
int cannot_audit(int)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

__BEGIN_DECLS
/*
 * audit_set_terminal_id_ex()
 * audit_set_terminal_id()
 *
 * @summary - audit_set_terminal_id_ex() fills in an au_tid_addr_t struct,
 * which is used in audit session initialization by processes like
 * /usr/bin/login.  audit_set_terminal_id() does the same but for the
 * au_tid_t structure.  Note that audit_set_terminal_id_ex() is preferred
 * since it can store longer terminal addresses like those used in IP
 * version 6.  Neither audit_set_terminal_id() nor audit_set_terminal_id_ex()
 * should be used if the terminal connection is a remote one and the remote IP
 * address and port is known, however.  These wrapper functions populate the
 * au_tid_t or au_tid_addr_t stuctures with local terminal information only.
 *
 * @param tid - A pointer to an au_tid_addr_t or au_tid_t struct.
 *
 * @return - kAUNoErr on success; kAUBadParamErr if tid is NULL, kAUStatErr
 * or kAUSysctlErr if one of the underlying system calls fails (a message
 * is sent to the system log in those cases).
 *
 * XXXRW: In Apple's bsm-8, these are marked __APPLE_API_PRIVATE.
 */
int audit_set_terminal_id_ex(au_tid_addr_t *tid)
	API_AVAILABLE(macos(10.8)) API_UNAVAILABLE(ios, watchos, tvos);

int audit_set_terminal_id(au_tid_t *tid)
	API_AVAILABLE(macos(10.8)) API_UNAVAILABLE(ios, watchos, tvos);

/*
 * BEGIN au_write() WRAPPERS
 *
 * The following calls all wrap the existing BSM API.  They use the
 * provided subject information, if any, to construct the subject token
 * required for every log message.  They use the provided return/error
 * value(s), if any, to construct the success/failure indication required
 * for every log message.  They only permit one "miscellaneous" token,
 * which should contain the event-specific logging information mandated by
 * CAPP.
 *
 * All these calls assume the caller has previously determined that
 * auditing is enabled by calling au_get_state().
 */

/*
 * audit_write()
 *
 * @summary - audit_write() is the basis for the other audit_write_*()
 * calls.  Performs a basic write of an audit record (subject, additional
 * info, success/failure).  Note that this call only permits logging one
 * caller-specified token; clients needing to log more flexibly must use
 * the existing BSM API (au_open(), et al.) directly.
 *
 * Note on memory management: audit_write() guarantees that the token_t *s
 * passed to it will be deallocated whether or not the underlying write to
 * the audit log succeeded.  This addresses an inconsistency in the
 * underlying BSM API in which token_t *s are usually but not always
 * deallocated.
 *
 * @param event_code - The code for the event being logged.  This should
 * be one of the AUE_ values in /usr/include/bsm/audit_uevents.h.
 *
 * @param subject - A token_t * generated by au_to_subject(),
 * au_to_subject32(), au_to_subject64(), or au_to_me().  If no subject is
 * required, subject should be NULL.
 *
 * @param misctok - A token_t * generated by one of the au_to_*() BSM API
 * calls.  This should correspond to the additional information required by
 * CAPP for the event being audited.  If no additional information is
 * required, misctok should be NULL.
 *
 * @param retval - The return value to be logged for this event.  This
 * should be 0 (zero) for success, otherwise the value is event-specific.
 *
 * @param errcode - Any error code associated with the return value (e.g.,
 * errno or h_errno).  If there was no error, errcode should be 0 (zero).
 *
 * @return - The status of the call: 0 (zero) on success, else one of the
 * kAU*Err values defined above.
 *
 * XXXRW: In Apple's bsm-8, these are marked __APPLE_API_PRIVATE.
 */
int audit_write(short event_code, token_t *subject, token_t *misctok, char retval, int errcode)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

/*
 * audit_write_success_ex()
 * audit_write_success()
 *
 * @summary - audit_write_success_ex() and audit_write_success() record
 * an auditable event that did not encounter an error.  The interface is
 * designed to require as little direct use of the au_to_*() API as possible.
 * It builds a subject token from the information passed in and uses that to
 * invoke audit_write(). A subject, as defined by CAPP, is a process acting
 * on the user's behalf. Preference should be given in using
 * audit_write_success_ex() since it supports longer addreses such as those
 * used for IP version 6.
 *
 * If the subject information is the same as the current process, use
 * au_write_success_self().
 *
 * @param event_code - The code for the event being logged.  This should
 * be one of the AUE_ values in /usr/include/bsm/audit_uevents.h.
 *
 * @param misctok - A token_t * generated by one of the au_to_*() BSM API
 * calls.  This should correspond to the additional information required by
 * CAPP for the event being audited.  If no additional information is
 * required, misctok should be NULL.
 *
 * @param auid - The subject's audit ID.
 *
 * @param euid - The subject's effective user ID.
 *
 * @param egid - The subject's effective group ID.
 *
 * @param ruid - The subject's real user ID.
 *
 * @param rgid - The subject's real group ID.
 *
 * @param pid - The subject's process ID.
 *
 * @param sid - The subject's session ID.
 *
 * @param tid - The subject's terminal ID.
 *
 * @return - The status of the call: 0 (zero) on success, else one of the
 * kAU*Err values defined above.
 *
 * XXXRW: In Apple's bsm-8, these are marked __APPLE_API_PRIVATE.
 */

int audit_write_success_ex(short event_code, token_t *misctok, au_id_t auid,
	uid_t euid, gid_t egid, uid_t ruid, gid_t rgid, pid_t pid,
	au_asid_t sid, au_tid_addr_t *tid)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

int audit_write_success(short event_code, token_t *misctok, au_id_t auid,
	uid_t euid, gid_t egid, uid_t ruid, gid_t rgid, pid_t pid,
	au_asid_t sid, au_tid_t *tid)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

/*
 * audit_write_success_self()
 *
 * @summary - Similar to audit_write_success_ex(), but used when the subject
 * (process) is owned and operated by the auditable user him/herself.
 *
 * @param event_code - The code for the event being logged.  This should
 * be one of the AUE_ values in /usr/include/bsm/audit_uevents.h.
 *
 * @param misctok - A token_t * generated by one of the au_to_*() BSM API
 * calls.  This should correspond to the additional information required by
 * CAPP for the event being audited.  If no additional information is
 * required, misctok should be NULL.
 *
 * @return - The status of the call: 0 (zero) on success, else one of the
 * kAU*Err values defined above.
 *
 * XXXRW: In Apple's bsm-8, these are marked __APPLE_API_PRIVATE.
 */
int audit_write_success_self(short event_code, token_t *misctok)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

/*
 * audit_write_failure_ex()
 * audit_write_failure()
 *
 * @summary - audit_write_failure_ex() and audit_write_failure() records an
 * auditable event that encountered an error.  The interface is designed to
 * require as little direct use of the au_to_*() API as possible.  It builds
 * a subject token from the information passed in and uses that to invoke audit
 * write(). A subject, as defined by CAPP, is a process acting on the user's
 * behalf. Preference should be given in using audit_write_success_ex() since
 * it supports longer addreses such as those used for IP version 6.
 *
 * If the subject information is the same as the current process, use
 * au_write_failure_self().
 *
 * @param event_code - The code for the event being logged.  This should
 * be one of the AUE_ values in /usr/include/bsm/audit_uevents.h.
 *
 * @param errmsg - A text message providing additional information about
 * the event being audited.
 *
 * @param errret - A numerical value providing additional information about
 * the error.  This is intended to store the value of errno or h_errno if
 * it's relevant.  This can be 0 (zero) if no additional information is
 * available.
 *
 * @param auid - The subject's audit ID.
 *
 * @param euid - The subject's effective user ID.
 *
 * @param egid - The subject's effective group ID.
 *
 * @param ruid - The subject's real user ID.
 *
 * @param rgid - The subject's real group ID.
 *
 * @param pid - The subject's process ID.
 *
 * @param sid - The subject's session ID.
 *
 * @param tid - The subject's terminal ID.
 *
 * @return - The status of the call: 0 (zero) on success, else one of the
 * kAU*Err values defined above.
 *
 * XXXRW: In Apple's bsm-8, these are marked __APPLE_API_PRIVATE.
 */
int audit_write_failure_ex(short event_code, char *errmsg, int errret,
	au_id_t auid, uid_t euid, gid_t egid, uid_t ruid, gid_t rgid,
	pid_t pid, au_asid_t sid, au_tid_addr_t *tid)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

int audit_write_failure(short event_code, char *errmsg, int errret,
	au_id_t auid, uid_t euid, gid_t egid, uid_t ruid, gid_t rgid,
	pid_t pid, au_asid_t sid, au_tid_t *tid)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

/*
 * audit_write_failure_self()
 *
 * @summary - Similar to audit_write_failure(), but used when the subject
 * (process) is owned and operated by the auditable user him/herself.
 *
 * @param event_code - The code for the event being logged.  This should
 * be one of the AUE_ values in /usr/include/bsm/audit_uevents.h.
 *
 * @param errmsg - A text message providing additional information about
 * the event being audited.
 *
 * @param errret - A numerical value providing additional information about
 * the error.  This is intended to store the value of errno or h_errno if
 * it's relevant.  This can be 0 (zero) if no additional information is
 * available.
 *
 * @return - The status of the call: 0 (zero) on success, else one of the
 * kAU*Err values defined above.
 *
 * XXXRW: In Apple's bsm-8, these are marked __APPLE_API_PRIVATE.
 */
int audit_write_failure_self(short event_code, char *errmsg, int errret)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

/*
 * audit_write_failure_na_ex()
 * audit_write_failure_na()
 *
 * @summary - audit_write_failure_na_ex()  and audit_write_failure_na() record
 * errors during login.  Such errors are implicitly non-attributable (i.e., not
 * ascribable to any user).  Preference should be given in using
 * audit_write_failure_na_ex() since it supports longer addreses such as those
 * used for IP version 6.
 *
 * @param event_code - The code for the event being logged.  This should
 * be one of the AUE_ values in /usr/include/bsm/audit_uevents.h.
 *
 * @param errmsg - A text message providing additional information about
 * the event being audited.
 *
 * @param errret - A numerical value providing additional information about
 * the error.  This is intended to store the value of errno or h_errno if
 * it's relevant.  This can be 0 (zero) if no additional information is
 * available.
 *
 * @param euid - The subject's effective user ID.
 *
 * @param egid - The subject's effective group ID.
 *
 * @param pid - The subject's process ID.
 *
 * @param tid - The subject's terminal ID.
 *
 * @return - The status of the call: 0 (zero) on success, else one of the
 * kAU*Err values defined above.
 *
 * XXXRW: In Apple's bsm-8, these are marked __APPLE_API_PRIVATE.
 */
int audit_write_failure_na_ex(short event_code, char *errmsg, int errret,
	uid_t euid, gid_t egid, pid_t pid, au_tid_addr_t *tid)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

int audit_write_failure_na(short event_code, char *errmsg, int errret,
	uid_t euid, gid_t egid, pid_t pid, au_tid_t *tid)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

/* END au_write() WRAPPERS */

#ifdef  __APPLE__
/*
 * audit_token_to_au32()  (NOW DEPRECATED)
 *
 * @summary - Extract information from an audit_token_t, used to identify
 * Mach tasks and senders of Mach messages as subjects to the audit system.
 * audit_tokent_to_au32() is the only method that should be used to parse
 * an audit_token_t, since its internal representation may change over
 * time.  A pointer parameter may be NULL if that information is not
 * needed.  audit_token_to_au32() has been deprecated because the terminal
 * ID information is no longer saved in this token.  The last parameter
 * is actually the process ID version.  The API calls audit_token_to_auid(),
 * audit_token_to_euid(), audit_token_to_ruid(), audit_token_to_rgid(),
 * audit_token_to_pid(), audit_token_to_asid(),  and/or
 * audit_token_to_pidversion() should be used instead.
 *
 * @param atoken - the audit token containing the desired information
 *
 * @param auidp - Pointer to a uid_t; on return will be set to the task or
 * sender's audit user ID
 *
 * @param euidp - Pointer to a uid_t; on return will be set to the task or
 * sender's effective user ID
 *
 * @param egidp - Pointer to a gid_t; on return will be set to the task or
 * sender's effective group ID
 *
 * @param ruidp - Pointer to a uid_t; on return will be set to the task or
 * sender's real user ID
 *
 * @param rgidp - Pointer to a gid_t; on return will be set to the task or
 * sender's real group ID
 *
 * @param pidp - Pointer to a pid_t; on return will be set to the task or
 * sender's process ID
 *
 * @param asidp - Pointer to an au_asid_t; on return will be set to the
 * task or sender's audit session ID
 *
 * @param tidp - Pointer to an au_tid_t; on return will be set to the
 * process ID version and NOT THE SENDER'S TERMINAL ID.
 *
 * XXXRW: In Apple's bsm-8, these are marked __APPLE_API_PRIVATE.
 */
void audit_token_to_au32(
	audit_token_t	 atoken,
	uid_t		*auidp,
	uid_t		*euidp,
	gid_t		*egidp,
	uid_t		*ruidp,
	gid_t		*rgidp,
	pid_t		*pidp,
	au_asid_t	*asidp,
	au_tid_t	*tidp)
	API_AVAILABLE(macos(10.8)) API_UNAVAILABLE(ios, watchos, tvos);

/*
 * audit_token_to_auid()
 *
 * @summary - Extract the audit user ID from an audit_token_t, used to
 * identify Mach tasks and senders of Mach messages as subjects of the audit
 * system.
 *
 * @param atoken - The Mach audit token.
 *
 * @return - The audit user ID extracted from the Mach audit token.
 */
uid_t audit_token_to_auid(audit_token_t atoken)
	API_AVAILABLE(macos(10.8)) API_UNAVAILABLE(ios, watchos, tvos);

/*
 * audit_token_to_euid()
 *
 * @summary - Extract the effective user ID from an audit_token_t, used to
 * identify Mach tasks and senders of Mach messages as subjects of the audit
 * system.
 *
 * @param atoken - The Mach audit token.
 *
 * @return - The effective user ID extracted from the Mach audit token.
 */
uid_t audit_token_to_euid(audit_token_t atoken)
	API_AVAILABLE(macos(10.8)) API_UNAVAILABLE(ios, watchos, tvos);

/*
 * audit_token_to_egid()
 *
 * @summary - Extract the effective group ID from an audit_token_t, used to
 * identify Mach tasks and senders of Mach messages as subjects of the audit
 * system.
 *
 * @param atoken - The Mach audit token.
 *
 * @return - The effective group ID extracted from the Mach audit token.
 */
gid_t audit_token_to_egid(audit_token_t atoken)
	API_AVAILABLE(macos(10.8)) API_UNAVAILABLE(ios, watchos, tvos);

/*
 * audit_token_to_ruid()
 *
 * @summary - Extract the real user ID from an audit_token_t, used to
 * identify Mach tasks and senders of Mach messages as subjects of the audit
 * system.
 *
 * @param atoken - The Mach audit token.
 *
 * @return - The real user ID extracted from the Mach audit token.
 */
uid_t audit_token_to_ruid(audit_token_t atoken)
	API_AVAILABLE(macos(10.8)) API_UNAVAILABLE(ios, watchos, tvos);

/*
 * audit_token_to_rgid()
 *
 * @summary - Extract the real group ID from an audit_token_t, used to
 * identify Mach tasks and senders of Mach messages as subjects of the audit
 * system.
 *
 * @param atoken - The Mach audit token.
 *
 * @return - The real group ID extracted from the Mach audit token.
 */
gid_t audit_token_to_rgid(audit_token_t atoken)
	API_AVAILABLE(macos(10.8)) API_UNAVAILABLE(ios, watchos, tvos);

/*
 * audit_token_to_pid()
 *
 * @summary - Extract the process ID from an audit_token_t, used to
 * identify Mach tasks and senders of Mach messages as subjects of the audit
 * system.
 *
 * @param atoken - The Mach audit token.
 *
 * @return - The process ID extracted from the Mach audit token.
 */
pid_t audit_token_to_pid(audit_token_t atoken)
	API_AVAILABLE(macos(10.8)) API_UNAVAILABLE(ios, watchos, tvos);

/*
 * audit_token_to_asid()
 *
 * @summary - Extract the audit session ID from an audit_token_t, used to
 * identify Mach tasks and senders of Mach messages as subjects of the audit
 * system.
 *
 * @param atoken - The Mach audit token.
 *
 * @return - The audit session ID extracted from the Mach audit token.
 */
au_asid_t audit_token_to_asid(audit_token_t atoken)
	API_AVAILABLE(macos(10.8)) API_UNAVAILABLE(ios, watchos, tvos);

/*
 * audit_token_to_pidversion()
 *
 * @summary - Extract the process ID version from an audit_token_t, used to
 * identify Mach tasks and senders of Mach messages as subjects of the audit
 * system.
 *
 * @param atoken - The Mach audit token.
 *
 * @return - The process ID version extracted from the Mach audit token.
 */
int audit_token_to_pidversion(audit_token_t atoken)
	API_AVAILABLE(macos(10.8)) API_UNAVAILABLE(ios, watchos, tvos);

#endif /* !__APPLE__ */

/*
 * Wrapper functions to auditon(2).
 */
int audit_get_car(char *path, size_t sz)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

int audit_get_class(au_evclass_map_t *evc_map, size_t sz)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

int audit_set_class(au_evclass_map_t *evc_map, size_t sz)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

int audit_get_cond(int *cond)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

int audit_set_cond(int *cond)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

int audit_get_cwd(char *path, size_t sz)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

int audit_get_fsize(au_fstat_t *fstat, size_t sz)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

int audit_set_fsize(au_fstat_t *fstat, size_t sz)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

int audit_get_kmask(au_mask_t *kmask, size_t sz)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

int audit_set_kmask(au_mask_t *kmask, size_t sz)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

int audit_get_kaudit(auditinfo_addr_t *aia, size_t sz)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

int audit_set_kaudit(auditinfo_addr_t *aia, size_t sz)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

int audit_set_pmask(auditpinfo_t *api, size_t sz)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

int audit_get_pinfo(auditpinfo_t *api, size_t sz)
	API_DEPRECATED("use audit_get_pinfo_addr", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

int audit_get_pinfo_addr(auditpinfo_addr_t *apia, size_t sz)
	API_AVAILABLE(macos(10.8)) API_UNAVAILABLE(ios, watchos, tvos);

int audit_get_policy(int *policy)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

int audit_set_policy(int *policy)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

int audit_get_qctrl(au_qctrl_t *qctrl, size_t sz)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

int audit_set_qctrl(au_qctrl_t *qctrl, size_t sz)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

int audit_get_sflags(uint64_t *flags)
	API_AVAILABLE(macos(10.8)) API_UNAVAILABLE(ios, watchos, tvos);

int audit_set_sflags(uint64_t flags)
	API_AVAILABLE(macos(10.8)) API_UNAVAILABLE(ios, watchos, tvos);

int audit_get_sflags_mask(const char *which, uint64_t *mask)
	API_DEPRECATED("no longer implemented", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

int audit_set_sflags_mask(const char *which, uint64_t mask)
	API_DEPRECATED("no longer implemented", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

int audit_get_sinfo_addr(auditinfo_addr_t *aia, size_t sz)
	API_AVAILABLE(macos(10.8)) API_UNAVAILABLE(ios, watchos, tvos);

int audit_get_stat(au_stat_t *stats, size_t sz)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

int audit_set_stat(au_stat_t *stats, size_t sz)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

int audit_send_trigger(int *trigger)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

int audit_get_ctlmode(au_ctlmode_t *mode, size_t sz)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

int audit_get_expire_after(au_expire_after_t *expire, size_t sz)
	API_DEPRECATED("audit is deprecated", macos(10.8, 11.0)) API_UNAVAILABLE(ios, watchos, tvos);

__END_DECLS

#endif /* !_LIBBSM_H_ */
