BSD syscall#356
svc · unix #356
setaudit
Legacy 32-bit setter for the calling process's audit information.
Prototype
int setaudit(struct auditinfo *auditinfo);Returns: int
Arguments
| Name | Type | Dir | Description |
|---|---|---|---|
| auditinfo | struct auditinfo | - |
Version history
| XNU tag | macOS | # |
|---|---|---|
| xnu-1456.1.26 | macOS 10.6 Snow Leopard | 356 |
| xnu-1699.24.8 | macOS 10.7 Lion | 356 |
| xnu-1486.2.11 | — | 356 |
| xnu-1504.15.3 | — | 356 |
| xnu-1504.3.12 | — | 356 |
| xnu-1504.7.4 | — | 356 |
| xnu-1504.9.17 | — | 356 |
| xnu-1504.9.26 | — | 356 |
| xnu-1504.9.37 | — | 356 |
| xnu-1699.22.73 | — | 356 |
| xnu-1699.22.81 | — | 356 |
| xnu-1699.24.23 | — | 356 |
| xnu-1699.26.8 | — | 356 |
| xnu-1699.32.7 | — | 356 |
Notes
Counterpart of getaudit(2); writes a struct auditinfo into the calling thread. Requires the audit_control privilege because changing the auid or asid alters how every subsequent audit record is attributed. Superseded by setaudit_addr(2); kept for binary compatibility with pre-Leopard tooling.
Detection
Emits AUE_SETAUDIT; any successful call rewriting auid from a process other than login/sshd/sudo is a strong tampering indicator.
Related APIs
setaudit_addrgetauditsetauidaudit_session_join