NAME
audswitch — suspend or resume auditing on the current process
SYNOPSIS
#include <sys/audit.h>
int audswitch(int aflag);
DESCRIPTION
audswitch()
suspends or resumes auditing within the current process.
This call is restricted to superusers.
One of the following
aflags
must be used:
- AUD_SUSPEND
Suspend auditing on the current process.
- AUD_RESUME
Resume auditing on the current process.
audswitch()
can be used in self-auditing privileged processes
to temporarily suspend auditing during intervals
where auditing is to be handled by the process itself.
Auditing is suspended by a call to
audswitch()
with the
AUD_SUSPEND
parameter and resumed later by a call to
audswitch()
with the
AUD_RESUME
parameter.
An
audswitch()
call to resume auditing serves only to reverse the action of a previous
audswitch()
call to suspend auditing.
A call to
audswitch()
to resume auditing when auditing is not suspended has no effect.
audswitch()
affects only the current process.
For example,
audswitch()
cannot suspend auditing for processes
exec'ed
from the current process.
(Use
setaudproc
(see
setaudproc(2))
to enable or disable auditing for a process and its children).
RETURN VALUE
Upon successful completion,
audswitch()
returns
0.
If an error occurs,
-1
is returned and the global variable
errno
is set to indicate the error.
ERRORS
audswitch()
fails if one of the following is true:
- [EPERM]
The user is not a superuser.
- [EINVAL]
The input parameter is neither
AUD_RESUME
nor
AUD_SUSPEND.
AUTHOR
audswitch()
was developed by HP.
