audswitch.2 (2010 09)

audswitch(2) audswitch(2)

NAME

audswitch() - suspend or resume auditing on the current process

SYNOPSIS

#include <sys/audit.h>

int audswitch(int

aﬂag);

DESCRIPTION

audswitch() suspends or resumes auditing within the current process. This call is restricted to users

with the SELFAUDIT privilege.

One of the following ﬂags must be used for aﬂag:

AUD_SUSPEND Suspend auditing on the current process.

AUD_RESUME Resume auditing on the current process.

audswitch() can be used in processes with the

SELFAUDIT privilege to temporarily suspend auditing

during intervals where auditing is to be handled by the process itself. Auditing is suspended by a call to

audswitch() with the AUD_SUSPEND parameter and resumed later by a call to

audswitch() with

the

AUD_RESUME parameter.

audswitch() call to resume auditing serves only to reverse the action of a previous audswitch()

call to suspend auditing. A call to audswitch() to resume auditing when auditing is not suspended

has no effect.

audswitch() affects only the current process. For example, audswitch() cannot suspend auditing

for processes exec’ed from the current process. (Use setaudproc (see setaudproc (2)) to enable or dis-

able auditing for a process and its children).

Security Restrictions

Some or all of the actions associated with this system call require the

SELFAUDIT privilege. Processes

owned by the superuser have this privilege. Processes owned by other users may have this privilege,

depending on system conﬁguration. See privileges (5) for more information about privileged access on sys-

tems that support ﬁne-grained privileges.

RETURN VALUE

Upon successful completion,

audswitch() returns 0. If an error occurs, -1 is returned and the global

variable errno is set to indicate the error.

ERRORS

audswitch() fails if one of the following is true:

[EPERM] The user does not possess the

SELFAUDIT privilege.

[EINVAL] The input parameter is neither

AUD_RESUME nor AUD_SUSPEND.

AUTHOR

audswitch() was developed by HP.

PAGE 1
audswitch(2) audswitch(2) NAME audswitch() - suspend or resume auditing on the current process SYNOPSIS #include int audswitch(int aflag ); DESCRIPTION audswitch() suspends or resumes auditing within the current process. This call is restricted to users with the SELFAUDIT privilege. One of the following flags must be used for aflag: AUD_SUSPEND Suspend auditing on the current process. AUD_RESUME Resume auditing on the current process.
PAGE 2
(Notes) A (Notes) aA 2 Hewlett-Packard Company −1− HP-UX 11i Version 3: September 2010