* Check whether an event is auditable by comparing the mask of classes this * event is part of against the given mask. */
| 123 | * event is part of against the given mask. |
| 124 | */ |
| 125 | int |
| 126 | au_preselect(au_event_t event, au_class_t class, au_mask_t *mask_p, int sorf) |
| 127 | { |
| 128 | au_class_t effmask = 0; |
| 129 | |
| 130 | if (mask_p == NULL) |
| 131 | return (-1); |
| 132 | |
| 133 | /* |
| 134 | * Perform the actual check of the masks against the event. |
| 135 | */ |
| 136 | if (sorf & AU_PRS_SUCCESS) |
| 137 | effmask |= (mask_p->am_success & class); |
| 138 | |
| 139 | if (sorf & AU_PRS_FAILURE) |
| 140 | effmask |= (mask_p->am_failure & class); |
| 141 | |
| 142 | if (effmask) |
| 143 | return (1); |
| 144 | else |
| 145 | return (0); |
| 146 | } |
| 147 | |
| 148 | /* |
| 149 | * Convert sysctl names and present arguments to events. |
no outgoing calls
no test coverage detected