audit.c File Reference

#include <ntoskrnl.h>
#include <debug.h>

Go to the source code of this file.

Defines
#define	NDEBUG
Functions
BOOLEAN NTAPI	SeDetailedAuditingWithToken (IN PTOKEN Token)
VOID NTAPI	SeAuditProcessCreate (IN PEPROCESS Process)
VOID NTAPI	SeAuditProcessExit (IN PEPROCESS Process)
NTSTATUS NTAPI	SeInitializeProcessAuditName (IN PFILE_OBJECT FileObject, IN BOOLEAN DoAudit, OUT POBJECT_NAME_INFORMATION *AuditInfo)
NTSTATUS NTAPI	SeLocateProcessImageName (IN PEPROCESS Process, OUT PUNICODE_STRING *ProcessImageName)
VOID NTAPI	SeAuditHardLinkCreation (IN PUNICODE_STRING FileName, IN PUNICODE_STRING LinkName, IN BOOLEAN bSuccess)
BOOLEAN NTAPI	SeAuditingFileEvents (IN BOOLEAN AccessGranted, IN PSECURITY_DESCRIPTOR SecurityDescriptor)
BOOLEAN NTAPI	SeAuditingFileEventsWithContext (IN BOOLEAN AccessGranted, IN PSECURITY_DESCRIPTOR SecurityDescriptor, IN PSECURITY_SUBJECT_CONTEXT SubjectSecurityContext OPTIONAL)
BOOLEAN NTAPI	SeAuditingHardLinkEvents (IN BOOLEAN AccessGranted, IN PSECURITY_DESCRIPTOR SecurityDescriptor)
BOOLEAN NTAPI	SeAuditingHardLinkEventsWithContext (IN BOOLEAN AccessGranted, IN PSECURITY_DESCRIPTOR SecurityDescriptor, IN PSECURITY_SUBJECT_CONTEXT SubjectSecurityContext OPTIONAL)
BOOLEAN NTAPI	SeAuditingFileOrGlobalEvents (IN BOOLEAN AccessGranted, IN PSECURITY_DESCRIPTOR SecurityDescriptor, IN PSECURITY_SUBJECT_CONTEXT SubjectSecurityContext)
VOID NTAPI	SeCloseObjectAuditAlarm (IN PVOID Object, IN HANDLE Handle, IN BOOLEAN PerformAction)
VOID NTAPI	SeDeleteObjectAuditAlarm (IN PVOID Object, IN HANDLE Handle)
VOID NTAPI	SeOpenObjectAuditAlarm (IN PUNICODE_STRING ObjectTypeName, IN PVOID Object OPTIONAL, IN PUNICODE_STRING AbsoluteObjectName OPTIONAL, IN PSECURITY_DESCRIPTOR SecurityDescriptor, IN PACCESS_STATE AccessState, IN BOOLEAN ObjectCreated, IN BOOLEAN AccessGranted, IN KPROCESSOR_MODE AccessMode, OUT PBOOLEAN GenerateOnClose)
VOID NTAPI	SeOpenObjectForDeleteAuditAlarm (IN PUNICODE_STRING ObjectTypeName, IN PVOID Object OPTIONAL, IN PUNICODE_STRING AbsoluteObjectName OPTIONAL, IN PSECURITY_DESCRIPTOR SecurityDescriptor, IN PACCESS_STATE AccessState, IN BOOLEAN ObjectCreated, IN BOOLEAN AccessGranted, IN KPROCESSOR_MODE AccessMode, OUT PBOOLEAN GenerateOnClose)
VOID NTAPI	SePrivilegeObjectAuditAlarm (IN HANDLE Handle, IN PSECURITY_SUBJECT_CONTEXT SubjectContext, IN ACCESS_MASK DesiredAccess, IN PPRIVILEGE_SET Privileges, IN BOOLEAN AccessGranted, IN KPROCESSOR_MODE CurrentMode)
NTSTATUS NTAPI	NtAccessCheckAndAuditAlarm (IN PUNICODE_STRING SubsystemName, IN HANDLE HandleId, IN PUNICODE_STRING ObjectTypeName, IN PUNICODE_STRING ObjectName, IN PSECURITY_DESCRIPTOR SecurityDescriptor, IN ACCESS_MASK DesiredAccess, IN PGENERIC_MAPPING GenericMapping, IN BOOLEAN ObjectCreation, OUT PACCESS_MASK GrantedAccess, OUT PNTSTATUS AccessStatus, OUT PBOOLEAN GenerateOnClose)
NTSTATUS NTAPI	NtCloseObjectAuditAlarm (IN PUNICODE_STRING SubsystemName, IN PVOID HandleId, IN BOOLEAN GenerateOnClose)
NTSTATUS NTAPI	NtDeleteObjectAuditAlarm (IN PUNICODE_STRING SubsystemName, IN PVOID HandleId, IN BOOLEAN GenerateOnClose)
NTSTATUS NTAPI	NtOpenObjectAuditAlarm (IN PUNICODE_STRING SubsystemName, IN PVOID HandleId, IN PUNICODE_STRING ObjectTypeName, IN PUNICODE_STRING ObjectName, IN PSECURITY_DESCRIPTOR SecurityDescriptor, IN HANDLE ClientToken, IN ULONG DesiredAccess, IN ULONG GrantedAccess, IN PPRIVILEGE_SET Privileges, IN BOOLEAN ObjectCreation, IN BOOLEAN AccessGranted, OUT PBOOLEAN GenerateOnClose)
NTSTATUS NTAPI	NtPrivilegedServiceAuditAlarm (IN PUNICODE_STRING SubsystemName, IN PUNICODE_STRING ServiceName, IN HANDLE ClientToken, IN PPRIVILEGE_SET Privileges, IN BOOLEAN AccessGranted)
NTSTATUS NTAPI	NtPrivilegeObjectAuditAlarm (IN PUNICODE_STRING SubsystemName, IN PVOID HandleId, IN HANDLE ClientToken, IN ULONG DesiredAccess, IN PPRIVILEGE_SET Privileges, IN BOOLEAN AccessGranted)