svc · unix #350
audit
Soumet un enregistrement d'audit BSM préformaté à la file d'audit du noyau.
Prototype
int audit(void *record, int length);Retour: int
Arguments
| Name | Type | Dir | Description |
|---|---|---|---|
| record | void | - | |
| length | int | - |
Historique des versions
| XNU tag | macOS | # |
|---|---|---|
| xnu-1456.1.26 | macOS 10.6 Snow Leopard | 350 |
| xnu-1699.24.8 | macOS 10.7 Lion | 350 |
| xnu-2050.18.24 | macOS 10.8 Mountain Lion | 350 |
| xnu-2422.115.4 | macOS 10.9 Mavericks | 350 |
| xnu-2782.40.9 | macOS 10.10 Yosemite | 350 |
| xnu-3247.1.106 | macOS 10.11 El Capitan | 350 |
| xnu-3789.1.32 | macOS 10.12 Sierra | 350 |
| xnu-4570.1.46 | macOS 10.13 High Sierra | 350 |
| xnu-4903.221.2 | macOS 10.14 Mojave | 350 |
| xnu-6153.11.26 | macOS 10.15 Catalina | 350 |
| xnu-7195.50.7.100.1 | macOS 11.0 Big Sur | 350 |
| xnu-8019.41.5 | macOS 12.0 Monterey | 350 |
| xnu-8792.41.9 | macOS 13.0 Ventura | 350 |
| xnu-10002.1.13 | macOS 14.0 Sonoma | 350 |
| xnu-11215.1.10 | macOS 15.0 Sequoia | 350 |
| xnu-11417.101.15 | macOS 15.4 Sequoia | 350 |
| xnu-12377.1.9 | macOS 26.0 Tahoe | 350 |
| xnu-10002.41.9 | — | 350 |
| xnu-10002.61.3 | — | 350 |
| xnu-10002.81.5 | — | 350 |
| xnu-10063.101.15 | — | 350 |
| xnu-10063.121.3 | — | 350 |
| xnu-10063.141.1 | — | 350 |
| xnu-11215.41.3 | — | 350 |
| xnu-11215.61.5 | — | 350 |
| xnu-11215.81.4 | — | 350 |
| xnu-11417.121.6 | — | 350 |
| xnu-11417.140.69 | — | 350 |
| xnu-12377.101.15 | — | 350 |
| xnu-12377.41.6 | — | 350 |
| xnu-12377.61.12 | — | 350 |
| xnu-12377.81.4 | — | 350 |
| xnu-1486.2.11 | — | 350 |
| xnu-1504.15.3 | — | 350 |
| xnu-1504.3.12 | — | 350 |
| xnu-1504.7.4 | — | 350 |
| xnu-1504.9.17 | — | 350 |
| xnu-1504.9.26 | — | 350 |
| xnu-1504.9.37 | — | 350 |
| xnu-1699.22.73 | — | 350 |
| xnu-1699.22.81 | — | 350 |
| xnu-1699.24.23 | — | 350 |
| xnu-1699.26.8 | — | 350 |
| xnu-1699.32.7 | — | 350 |
| xnu-2050.22.13 | — | 350 |
| xnu-2050.24.15 | — | 350 |
| xnu-2050.48.11 | — | 350 |
| xnu-2050.7.9 | — | 350 |
| xnu-2050.9.2 | — | 350 |
| xnu-2422.1.72 | — | 350 |
| xnu-2422.100.13 | — | 350 |
| xnu-2422.110.17 | — | 350 |
| xnu-2422.90.20 | — | 350 |
| xnu-2782.1.97 | — | 350 |
| xnu-2782.10.72 | — | 350 |
| xnu-2782.20.48 | — | 350 |
| xnu-2782.30.5 | — | 350 |
| xnu-3247.10.11 | — | 350 |
| xnu-3248.20.55 | — | 350 |
| xnu-3248.30.4 | — | 350 |
| xnu-3248.40.184 | — | 350 |
| xnu-3248.50.21 | — | 350 |
| xnu-3248.60.10 | — | 350 |
| xnu-3789.21.4 | — | 350 |
| xnu-3789.31.2 | — | 350 |
| xnu-3789.41.3 | — | 350 |
| xnu-3789.51.2 | — | 350 |
| xnu-3789.60.24 | — | 350 |
| xnu-3789.70.16 | — | 350 |
| xnu-4570.20.62 | — | 350 |
| xnu-4570.31.3 | — | 350 |
| xnu-4570.41.2 | — | 350 |
| xnu-4570.51.1 | — | 350 |
| xnu-4570.61.1 | — | 350 |
| xnu-4570.71.2 | — | 350 |
| xnu-4903.231.4 | — | 350 |
| xnu-4903.241.1 | — | 350 |
| xnu-4903.270.47 | — | 350 |
| xnu-6153.101.6 | — | 350 |
| xnu-6153.121.1 | — | 350 |
| xnu-6153.141.1 | — | 350 |
| xnu-6153.41.3 | — | 350 |
| xnu-6153.61.1 | — | 350 |
| xnu-6153.81.5 | — | 350 |
| xnu-7195.101.1 | — | 350 |
| xnu-7195.121.3 | — | 350 |
| xnu-7195.141.2 | — | 350 |
| xnu-7195.60.75 | — | 350 |
| xnu-7195.81.3 | — | 350 |
| xnu-8019.61.5 | — | 350 |
| xnu-8019.80.24 | — | 350 |
| xnu-8020.101.4 | — | 350 |
| xnu-8020.121.3 | — | 350 |
| xnu-8020.140.41 | — | 350 |
| xnu-8792.61.2 | — | 350 |
| xnu-8792.81.2 | — | 350 |
| xnu-8796.101.5 | — | 350 |
| xnu-8796.121.2 | — | 350 |
| xnu-8796.141.3 | — | 350 |
Notes
audit(2) est le point d'entrée userspace utilisé par les processus de confiance (auditd, login, sshd) pour injecter leurs propres jetons BSM dans la piste d'audit du noyau. Restreint aux processus disposant du privilège audit_control, il est largement vestigial sur macOS moderne depuis la dépréciation d'auditd en macOS 11 au profit d'Endpoint Security. Le tampon doit déjà être une séquence valide de jetons BSM — le noyau ne vérifie que l'en-tête et la longueur.
Détection
Observable via l'événement d'audit AUE_AUDIT lui-même ; pour détecter une manipulation du pipeline d'audit, surveiller les PIDs autres qu'auditd appelant audit() ou les coupures soudaines dans /var/audit/. La sonde DTrace audit:::commit capture chaque enregistrement soumis.