au_user_mask() reads the default, system wide audit classes from audit_control(4), combines them with the per-user audit classes
from the audit_user(4) database, and updates the binary preselection mask pointed to by mask_p with the combined value.
The audit flags in the flags field of the audit_control(4) database and the always-audit-flags
and never-audit-flags from the audit_user(4) database represent binary audit classes. These fields are combined by au_preselect(3BSM) as follows:
mask = ( flags + always-audit-flags) - never-audit-flags
au_user_mask() only fails if both the both the audit_control(4) and the audit_user(4) database entries could not be retrieved. This allows for flexible configurations.
|