HowTo Add a New Message List to adt_ Interfaces

HowTo Add a New Message List to adt_ Interfaces

Overview

libbsm(3LIB)'s adt_ interface enables to predefine a set of apriori known strings used in the text token so that you do not have to use those strings in an application directly. These are defined in adt.xml file.

Adding a New Message List

1. Define new msg_list in $SRC/lib/libbsm/common/adt.xml. msg_list tag has an attribute start which is used by adt_ interfaces to select right message list based on the message id you pass in your application. IDs of all messages in all message lists must not overlap (internaly they are represented by C unions with values of indexes into message list arrays). Feel free to have a rather big step in the start of you message list, eg. 1000 more than start of the last list.
2. Edit $SRC/lib/libbsm/common/adt_xlate.h and add your list ID to the enum adt_msg_list. List ID in adt_msg_list is ADT_LIST_<<ID>> where ID is upper case of what you defined in adt.xml.
3. Use message ids in your code when using adt_ interfaces.

Practical Example

uadmin(1M) binary generates audit events which contain text token fcn of type message list uadmin_fcn. uadmin_fcn list contains several messages specifying which action will be performed, eg. AD_BOOT for rebooting the system. Message list ID in adt_msg_list is ADT_LIST_UADMIN_FCN and AD_BOOT message can be referenced in the code as ADT_UADMIN_FCN_AD_BOOT.

Following pseudocode shows message lists in action:

	...
 	adt_event_data_t *event = NULL;
	enum adt_uadmin_fcn fcn_id;
	au_event_t event_id;
	...
	event_id = ADT_uadmin_reboot;
	fcn_id = ADT_UADMIN_FCN_AD_BOOT;
	event->adt_uadmin_reboot.fcn = fcn_id;
	...
	adt_put_event(event, ADT_SUCCESS, 0);