test: adt.h Source File

Main Page | Class Hierarchy | Class List | File List | Class Members | File Members

# adt.h

Go to the documentation of this file.

    00001 /*++
    00002
    00003 Copyright (c) 1991  Microsoft Corporation
    00004
    00005 Module Name:
    00006
    00007     adt.h
    00008
    00009 Abstract:
    00010
    00011     Auditing - Defines, Fuction Prototypes and Macro Functions.
    00012                These are public to the Security Component only.
    00013
    00014 Author:
    00015
    00016     Scott Birrell       (ScottBi)       January 17, 1991
    00017
    00018 Environment:
    00019
    00020 Revision History:
    00021
    00022 --*/
    00023
    00024 #include <ntlsa.h>
    00025
    00026
    00028 //                                                                          //
    00029 // Auditing Routines visible to rest of Security Component outside Auditing //
    00030 // subcomponent.                                                            //
    00031 //                                                                          //
    00033
    00034
    00035 /*++
    00036
    00037 BOOLEAN
    00038 SepAdtEventOnSuccess(
    00039     IN POLICY_AUDIT_EVENT_TYPE AuditEventType
    00040     )
    00041
    00042 Routine Description:
    00043
    00044     This macro function checks if a given Audit Event Type is enabled for
    00045     Auditing of successful occurrences of the Event.
    00046
    00047 Arguments:
    00048
    00049     AuditEventType - Specifies the type of the Audit Event to be checked.
    00050
    00051 Return Value:
    00052
    00053     BOOLEAN - TRUE if the event type is enabled for auditing of successful
    00054         occurrences of the event, else FALSE
    00055 --*/
    00056
    00057 #define SepAdtEventOnSuccess(AuditEventType)                               \
    00058             (SepAdtState.EventAuditingOptions[AuditEventType] &            \
    00059                 POLICY_AUDIT_EVENT_SUCCESS)
    00060
    00061
    00062 /*++
    00063
    00064 BOOLEAN
    00065 SepAdtEventOnFailure(
    00066     IN POLICY_AUDIT_EVENT_TYPE AuditEventType
    00067     )
    00068
    00069 Routine Description:
    00070
    00071     This macro function checks if a given Audit Event Type is enabled for
    00072     Auditing of unsuccessful attempts to cause an event of the given type
    00073     to occur.
    00074
    00075 Arguments:
    00076
    00077     AuditEventType - Specifies the type of the Audit Event to be checked.
    00078
    00079 Return Value:
    00080
    00081     BOOLEAN - TRUE if the event type is enabled for auditing of unsuccessful
    00082         attempts to make the event type occur, else FALSE
    00083 --*/
    00084
    00085 #define SepAdtEventOnFailure(AuditEventType)                               \
    00086             (SepAdtState.EventAuditingOptions[AuditEventType] &            \
    00087             POLICY_AUDIT_EVENT_FAILURE)
    00088
    00089 /*++
    00090
    00091 BOOLEAN
    00092 SepAdtAuditingEvent(
    00093     IN POLICY_AUDIT_EVENT_TYPE AuditEventType
    00094     )
    00095
    00096 Routine Description:
    00097
    00098     This macro function checks if a given Audit Event Type is enabled for
    00099     Auditing.
    00100
    00101 Arguments:
    00102
    00103     AuditEventType - Specifies the type of the Audit Event to be checked.
    00104
    00105 Return Value:
    00106
    00107     BOOLEAN - TRUE if the event type is enabled for auditing, else FALSE.
    00108
    00109 --*/
    00110
    00111 #define SepAdtAuditingEvent(AuditEventType)                     \
    00112             (SepAdtEventOnSuccess(AuditEventType) ||            \
    00113             (SepAdtEventOnFailure(AuditEventType))
    00114
    00115 /*++
    00116
    00117 BOOLEAN
    00118 SepAdtAuditingEnabled()
    00119
    00120 Routine Description:
    00121
    00122     This macro function tests if auditing is enabled.
    00123
    00124 Arguments:
    00125
    00126     None.
    00127
    00128 Return Value:
    00129
    00130     BOOLEAN - TRUE if auditing is enabled, else FALSE
    00131
    00132 --*/
    00133
    00134 #define SepAdtAuditingEnabled() (SepAdtState.AuditingMode == TRUE)
    00135
    00136
    00137 /*++
    00138
    00139 BOOLEAN
    00140 SepAdtAuditingDisabled()
    00141
    00142 Routine Description:
    00143
    00144     This macro function tests if auditing is disabled.
    00145
    00146 Arguments:
    00147
    00148     None.
    00149
    00150 Return Value:
    00151
    00152     BOOLEAN - TRUE if auditing is disabled, else FALSE
    00153
    00154 --*/
    00155
    00156 #define SepAdtAuditingDisabled() (!SepAdtAuditingEnabled)
    00157
    00158 //
    00159 // Audit Event Information array.  Although internal to the Auditing
    00160 // Subcomponent, this structure is exported to all of Security so that the
    00161 // above macro functions can be used to access it efficiently from there.
    00162 //
    00163
    00164 extern POLICY_AUDIT_EVENTS_INFO SepAdtState;
    00165
    00166 BOOLEAN
    00167 SepAdtInitializePhase0();
    00168
    00169 BOOLEAN
    00170 SepAdtInitializePhase1();
    00171
    00172 //VOID
    00173 //SepAdtLogAuditRecord(
    00174 //    IN POLICY_AUDIT_EVENT_TYPE AuditEventType,
    00175 //    IN PVOID AuditInformation
    00176 //    );
    00177
    00178 VOID
    00179 SepAdtLogAuditRecord(
    00180     IN PSE_ADT_PARAMETER_ARRAY AuditParameters
    00181     );
    00182
    00183 NTSTATUS
    00184 SepAdtCopyToLsaSharedMemory(
    00185     IN HANDLE LsaProcessHandle,
    00186     IN PVOID Buffer,
    00187     IN ULONG BufferLength,
    00188     OUT PVOID *LsaBufferAddress
    00189     );