BSD syscall#355
svc · unix #355
getaudit
Legacy 32-bit accessor for the calling process's audit information.
Prototype
int getaudit(struct auditinfo *auditinfo);Returns: int
Arguments
| Name | Type | Dir | Description |
|---|---|---|---|
| auditinfo | struct auditinfo | - |
Version history
| XNU tag | macOS | # |
|---|---|---|
| xnu-1456.1.26 | macOS 10.6 Snow Leopard | 355 |
| xnu-1699.24.8 | macOS 10.7 Lion | 355 |
| xnu-1486.2.11 | — | 355 |
| xnu-1504.15.3 | — | 355 |
| xnu-1504.3.12 | — | 355 |
| xnu-1504.7.4 | — | 355 |
| xnu-1504.9.17 | — | 355 |
| xnu-1504.9.26 | — | 355 |
| xnu-1504.9.37 | — | 355 |
| xnu-1699.22.73 | — | 355 |
| xnu-1699.22.81 | — | 355 |
| xnu-1699.24.23 | — | 355 |
| xnu-1699.26.8 | — | 355 |
| xnu-1699.32.7 | — | 355 |
Notes
getaudit(2) populates a struct auditinfo with the auid, mask, asid and a 32-bit termid. It was superseded by getaudit_addr(2), which carries a wider termid_addr capable of holding an IPv6 address, and is now stubbed to return ERANGE on hosts whose terminal id doesn't fit. New code must use getaudit_addr.
Detection
Calls from modern binaries are a portability smell rather than a security event; emits AUE_GETAUDIT.
Related APIs
getaudit_addrsetauditsetaudit_addrgetauid