<commit_before>/* libaudit.h -- 
 * Copyright 2004-2007 Red Hat Inc., Durham, North Carolina.
 * All Rights Reserved.
 *
 * This library is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public
 * License as published by the Free Software Foundation; either
 * version 2.1 of the License, or (at your option) any later version.
 *
 * This library is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public
 * License along with this library; if not, write to the Free Software
 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 * 
 * Authors:
 *	<NAME> <<EMAIL>>
 *	<NAME> <<EMAIL>>
 */
#ifndef _LIBAUDIT_H_
#define _LIBAUDIT_H_

#ifdef __cplusplus
extern "C" {
#endif


#include <asm/types.h>
#include <stdint.h>
#include <sys/socket.h>
#include <linux/netlink.h>
#include <linux/audit.h>
#include <stdarg.h>
#include <syslog.h>


/* Audit message types:
 * 1000 - 1099 are for commanding the audit system
 * 1100 - 1199 user space trusted application messages
 * 1200 - 1299 messages internal to the audit daemon
 * 1300 - 1399 audit event messages
 * 1400 - 1499 kernel SE Linux use
 * 1500 - 1599 AppArmor events
 * 1600 - 1699 kernel crypto events
 * 1700 - 1799 kernel anomaly records
 * 1800 - 1999 future kernel use (maybe integrity labels and related events)
 * 2001 - 2099 unused (kernel)
 * 2100 - 2199 user space anomaly records
 * 2200 - 2299 user space actions taken in response to anomalies
 * 2300 - 2399 user space generated LSPP events
 * 2400 - 2499 user space crypto events
 * 2500 - 2999 future user space (maybe integrity labels and related events)
 */

#define AUDIT_FIRST_USER_MSG    1100    /* First user space message */
#define AUDIT_LAST_USER_MSG     1199    /* Last user space message */
#define AUDIT_USER_AUTH         1100    /* User space authentication */
#define AUDIT_USER_ACCT         1101    /* User space acct change */
#define AUDIT_USER_MGMT         1102    /* User space acct management */
#define AUDIT_CRED_ACQ          1103    /* User space credential acquired */
#define AUDIT_CRED_DISP         1104    /* User space credential disposed */
#define AUDIT_USER_START        1105    /* User space session start */
#define AUDIT_USER_END          1106    /* User space session end */
#define AUDIT_USER_AVC          1107    /* User space avc message */
#define AUDIT_USER_CHAUTHTOK	1108	/* User space acct attr changed */
#define AUDIT_USER_ERR		1109	/* User space acct state err */
#define AUDIT_CRED_REFR         1110    /* User space credential refreshed */
#define AUDIT_USYS_CONFIG       1111    /* User space system config change */
#define AUDIT_USER_LOGIN	1112    /* User space user has logged in */
#define AUDIT_USER_LOGOUT	1113    /* User space user has logged out */
#define AUDIT_ADD_USER		1114    /* User space user account added */
#define AUDIT_DEL_USER		1115    /* User space user account deleted */
#define AUDIT_ADD_GROUP		1116    /* User space group added */
#define AUDIT_DEL_GROUP		1117    /* User space group deleted */
#define AUDIT_DAC_CHECK		1118    /* User space DAC check results */
#define AUDIT_CHGRP_ID		1119    /* User space group ID changed */
#define AUDIT_TEST		1120	/* Used for test success messages */
#define AUDIT_TRUSTED_APP	1121	/* Trusted app msg - freestyle text */
#define AUDIT_USER_SELINUX_ERR	1122	/* SE Linux user space error */
#define AUDIT_USER_CMD		1123	/* User shell command and args */
#define AUDIT_USER_TTY		1124	/* Non-ICANON TTY input meaning */
#define AUDIT_CHUSER_ID		1125	/* Changed user ID supplemental data */
#define AUDIT_GRP_AUTH		1126	/* Authentication for group password */

#define AUDIT_FIRST_DAEMON	1200
#define AUDIT_LAST_DAEMON	1299
#define AUDIT_DAEMON_RECONFIG	1204	/* Audit daemon should reconfigure */
#define AUDIT_DAEMON_ROTATE	1205	/* Audit daemon should rotate logs */
#define AUDIT_DAEMON_RESUME	1206	/* Audit daemon should resume logging */

#define AUDIT_FIRST_EVENT	1300
#define AUDIT_LAST_EVENT	1399
#ifndef AUDIT_KERNEL_OTHER
#define AUDIT_CWD               1307    /* Current working directory */
#define AUDIT_EXECVE            1309    /* execve arguments */
#define AUDIT_IPC_SET_PERM      1311    /* IPC new permissions record type */
#define AUDIT_MQ_OPEN           1312    /* POSIX MQ open record type */
#define AUDIT_MQ_SENDRECV       1313    /* POSIX MQ send/receive record type */
#define AUDIT_MQ_NOTIFY         1314    /* POSIX MQ notify record type */
#define AUDIT_MQ_GETSETATTR     1315    /* POSIX MQ get/set attribute record type */
#define AUDIT_KERNEL_OTHER      1316    /* For use by 3rd party modules */
#endif
#ifndef AUDIT_FD_PAIR
#define AUDIT_FD_PAIR		1317	/* audit record for pipe/socketpair */
#endif
#ifndef AUDIT_OBJ_PID
#define AUDIT_OBJ_PID		1318	/* signal or ptrace target */
#endif
#ifndef AUDIT_TTY
#define AUDIT_TTY		1319	/* Input on an administrative TTY */
#endif
#ifndef AUDIT_EOE
#define AUDIT_EOE		1320	/* End of event */
#endif
#define AUDIT_LAST_EVENT	1399

#define AUDIT_FIRST_SELINUX	1400
#define AUDIT_LAST_SELINUX	1499

/* For new kernel messages */
#ifndef AUDIT_MAC_POLICY_LOAD
#define AUDIT_MAC_POLICY_LOAD	1403    /* Policy file load */
#define AUDIT_MAC_STATUS	1404    /* Changed enforcing,permissive,off */
#define AUDIT_MAC_CONFIG_CHANGE	1405    /* Changes to booleans */
#endif
#ifndef AUDIT_MAC_UNLBL_ALLOW
#define AUDIT_MAC_UNLBL_ALLOW	1406    /* NetLabel: allow unlabeled traffic */
#define AUDIT_MAC_CIPSOV4_ADD	1407    /* NetLabel: add CIPSOv4 DOI entry */<commit_msg>remove duplicate definition of AUDIT_LAST_EVENT<commit_after>/* libaudit.h -- 
 * Copyright 2004-2007 Red Hat Inc., Durham, North Carolina.
 * All Rights Reserved.
 *
 * This library is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public
 * License as published by the Free Software Foundation; either
 * version 2.1 of the License, or (at your option) any later version.
 *
 * This library is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public
 * License along with this library; if not, write to the Free Software
 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 * 
 * Authors:
 *	<NAME> <<EMAIL>>
 *	<NAME>. (<NAME> <<EMAIL>>
 */
#ifndef _LIBAUDIT_H_
#define _LIBAUDIT_H_

#ifdef __cplusplus
extern "C" {
#endif


#include <asm/types.h>
#include <stdint.h>
#include <sys/socket.h>
#include <linux/netlink.h>
#include <linux/audit.h>
#include <stdarg.h>
#include <syslog.h>


/* Audit message types:
 * 1000 - 1099 are for commanding the audit system
 * 1100 - 1199 user space trusted application messages
 * 1200 - 1299 messages internal to the audit daemon
 * 1300 - 1399 audit event messages
 * 1400 - 1499 kernel SE Linux use
 * 1500 - 1599 AppArmor events
 * 1600 - 1699 kernel crypto events
 * 1700 - 1799 kernel anomaly records
 * 1800 - 1999 future kernel use (maybe integrity labels and related events)
 * 2001 - 2099 unused (kernel)
 * 2100 - 2199 user space anomaly records
 * 2200 - 2299 user space actions taken in response to anomalies
 * 2300 - 2399 user space generated LSPP events
 * 2400 - 2499 user space crypto events
 * 2500 - 2999 future user space (maybe integrity labels and related events)
 */

#define AUDIT_FIRST_USER_MSG    1100    /* First user space message */
#define AUDIT_LAST_USER_MSG     1199    /* Last user space message */
#define AUDIT_USER_AUTH         1100    /* User space authentication */
#define AUDIT_USER_ACCT         1101    /* User space acct change */
#define AUDIT_USER_MGMT         1102    /* User space acct management */
#define AUDIT_CRED_ACQ          1103    /* User space credential acquired */
#define AUDIT_CRED_DISP         1104    /* User space credential disposed */
#define AUDIT_USER_START        1105    /* User space session start */
#define AUDIT_USER_END          1106    /* User space session end */
#define AUDIT_USER_AVC          1107    /* User space avc message */
#define AUDIT_USER_CHAUTHTOK	1108	/* User space acct attr changed */
#define AUDIT_USER_ERR		1109	/* User space acct state err */
#define AUDIT_CRED_REFR         1110    /* User space credential refreshed */
#define AUDIT_USYS_CONFIG       1111    /* User space system config change */
#define AUDIT_USER_LOGIN	1112    /* User space user has logged in */
#define AUDIT_USER_LOGOUT	1113    /* User space user has logged out */
#define AUDIT_ADD_USER		1114    /* User space user account added */
#define AUDIT_DEL_USER		1115    /* User space user account deleted */
#define AUDIT_ADD_GROUP		1116    /* User space group added */
#define AUDIT_DEL_GROUP		1117    /* User space group deleted */
#define AUDIT_DAC_CHECK		1118    /* User space DAC check results */
#define AUDIT_CHGRP_ID		1119    /* User space group ID changed */
#define AUDIT_TEST		1120	/* Used for test success messages */
#define AUDIT_TRUSTED_APP	1121	/* Trusted app msg - freestyle text */
#define AUDIT_USER_SELINUX_ERR	1122	/* SE Linux user space error */
#define AUDIT_USER_CMD		1123	/* User shell command and args */
#define AUDIT_USER_TTY		1124	/* Non-ICANON TTY input meaning */
#define AUDIT_CHUSER_ID		1125	/* Changed user ID supplemental data */
#define AUDIT_GRP_AUTH		1126	/* Authentication for group password */

#define AUDIT_FIRST_DAEMON	1200
#define AUDIT_LAST_DAEMON	1299
#define AUDIT_DAEMON_RECONFIG	1204	/* Audit daemon should reconfigure */
#define AUDIT_DAEMON_ROTATE	1205	/* Audit daemon should rotate logs */
#define AUDIT_DAEMON_RESUME	1206	/* Audit daemon should resume logging */

#define AUDIT_FIRST_EVENT	1300
#define AUDIT_LAST_EVENT	1399
#ifndef AUDIT_KERNEL_OTHER
#define AUDIT_CWD               1307    /* Current working directory */
#define AUDIT_EXECVE            1309    /* execve arguments */
#define AUDIT_IPC_SET_PERM      1311    /* IPC new permissions record type */
#define AUDIT_MQ_OPEN           1312    /* POSIX MQ open record type */
#define AUDIT_MQ_SENDRECV       1313    /* POSIX MQ send/receive record type */
#define AUDIT_MQ_NOTIFY         1314    /* POSIX MQ notify record type */
#define AUDIT_MQ_GETSETATTR     1315    /* POSIX MQ get/set attribute record type */
#define AUDIT_KERNEL_OTHER      1316    /* For use by 3rd party modules */
#endif
#ifndef AUDIT_FD_PAIR
#define AUDIT_FD_PAIR		1317	/* audit record for pipe/socketpair */
#endif
#ifndef AUDIT_OBJ_PID
#define AUDIT_OBJ_PID		1318	/* signal or ptrace target */
#endif
#ifndef AUDIT_TTY
#define AUDIT_TTY		1319	/* Input on an administrative TTY */
#endif
#ifndef AUDIT_EOE
#define AUDIT_EOE		1320	/* End of event */
#endif

#define AUDIT_FIRST_SELINUX	1400
#define AUDIT_LAST_SELINUX	1499

/* For new kernel messages */
#ifndef AUDIT_MAC_POLICY_LOAD
#define AUDIT_MAC_POLICY_LOAD	1403    /* Policy file load */
#define AUDIT_MAC_STATUS	1404    /* Changed enforcing,permissive,off */
#define AUDIT_MAC_CONFIG_CHANGE	1405    /* Changes to booleans */
#endif
#ifndef AUDIT_MAC_UNLBL_ALLOW
#define AUDIT_MAC_UNLBL_ALLOW	1406    /* NetLabel: allow unlabeled traffic */
#define AUDIT_MAC_CIPSOV4_ADD	1407    /* NetLabel: add CIPSOv4 DOI entry */
{'fraction_non_alphanumeric': 0.07414760466119982, 'fraction_numerical': 0.06370306430729392, 'mean_word_length': 3.480278422273782, 'pattern_counts': {'":': 0, '<': 30, '<?xml version=': 0, '>': 30, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '2679392', 'n_tokens_mistral': 4310, 'n_tokens_neox': 3740, 'n_words': 1342}