Common probe API - object, entity, item manipulation

Detailed Description

This file contains functions for manipulating with the S-exp representation of OVAL objects and items.

Currently object and items have the same structure and the API distinction is just formal. However, the structure can diverge in the future and the API functions for manipulating with items should be used only with items and vice versa. The most recent description of the object and item structure can be found in this file and should be used as the main source of information for implementing new API functions. In the following text, the term `element' referers to the general structure which is used to represent the various components of an OVAL document, particularly the OVAL objects, items and entities.

The basic structure of an element looks like this:

(foo_object bar)

foo_object is the element name and bar is the value of the element. There can be 0 to n values. In case the element has some attributes set the structure changes to:

((foo_object :attr1 val1) bar)

where attr1 is the name of the attribute and val1 is the attribute's value. The colon in the attribute name signals that the attribute has a value.

Data Structures
struct	_oresults
struct	probe_elmatr_t

Files
file	probe-api.c
	Probe API implmentation.

Macros
#define	PROBE_API_H
#define	probe_item_getent(item, name, n)   probe_obj_getent (item, name, n)
#define	PROBE_EINVAL   1
	Invalid type/value/format.
#define	PROBE_ENOELM   2
	Missing element OBSOLETE: use ENOENT.
#define	PROBE_ENOVAL   3
	Missing value.
#define	PROBE_ENOATTR   4
	Missing attribute.
#define	PROBE_EINIT   5
	Initialization failed.
#define	PROBE_ENOMEM   6
	No memory.
#define	PROBE_EOPNOTSUPP   7
	Not supported.
#define	PROBE_ERANGE   8
	Out of range.
#define	PROBE_EDOM   9
	Out of domain.
#define	PROBE_EFAULT   10
	Memory fault/NULL value.
#define	PROBE_EACCESS   11
	Operation not permitted.
#define	PROBE_ESETEVAL   12
	Set evaluation failed.
#define	PROBE_ENOENT   13
	Missing entity.
#define	PROBE_ENOOBJ   14
	Missing object.
#define	PROBE_ECONNABORTED   15
	Evaluation aborted.
#define	PROBE_ESYSTEM   253
	System call failure.
#define	PROBE_EFATAL   254
	Unrecoverable error.
#define	PROBE_EUNKNOWN   255
	Unknown/Unexpected error.
#define	PROBECMD_STE_FETCH   1
	State fetch command code.
#define	PROBECMD_OBJ_EVAL   2
	Object eval command code.
#define	PROBECMD_RESET   3
	Reset command code.
#define	PROBE_ENT_AREF(ent, dst, attr_name, invalid_exp)
#define	PROBE_ENT_STRVAL(ent, dst, dstlen, invalid_exp, zerolen_exp)
#define	PROBE_ENT_I32VAL(ent, dst, invalid_exp, nil_exp)

Typedefs
typedef struct probe_ctx	probe_ctx

Functions
oval_result_t	probe_ent_cmp_binary (SEXP_t *val1, SEXP_t *val2, oval_operation_t op)
	Compare two binary values. More...
oval_result_t	probe_ent_cmp_bool (SEXP_t *val1, SEXP_t *val2, oval_operation_t op)
	Compare two boolean values. More...
oval_result_t	probe_ent_cmp_evr (SEXP_t *val1, SEXP_t *val2, oval_operation_t op)
	Compare two epoch-version-release values. More...
oval_result_t	probe_ent_cmp_debian_evr (SEXP_t *val1, SEXP_t *val2, oval_operation_t op)
	Compare two Debian epoch-version-release values. More...
oval_result_t	probe_ent_cmp_filesetrev (SEXP_t *val1, SEXP_t *val2, oval_operation_t op)
	Compare two values. More...
oval_result_t	probe_ent_cmp_float (SEXP_t *val1, SEXP_t *val2, oval_operation_t op)
	Compare two floating point values. More...
oval_result_t	probe_ent_cmp_int (SEXP_t *val1, SEXP_t *val2, oval_operation_t op)
	Compare two integer values. More...
oval_result_t	probe_ent_cmp_ios (SEXP_t *val1, SEXP_t *val2, oval_operation_t op)
	Compare two ios values. More...
oval_result_t	probe_ent_cmp_version (SEXP_t *val1, SEXP_t *val2, oval_operation_t op)
	Compare two version values. More...
oval_result_t	probe_ent_cmp_string (SEXP_t *val1, SEXP_t *val2, oval_operation_t op)
	Compare two string values. More...
oval_result_t	probe_entste_cmp (SEXP_t *ent_ste, SEXP_t *ent_itm)
	Compare state entity's content with a item entity's value. More...
oval_result_t	probe_entobj_cmp (SEXP_t *ent_obj, SEXP_t *val)
	Compare object entity's content with a value. More...
oval_result_t	probe_ent_result_bychk (SEXP_t *res_lst, oval_check_t check)
	Compute the overall result. More...
oval_result_t	probe_ent_result_byopr (SEXP_t *res_lst, oval_operator_t operator)
	Compute the overall result. More...
probe_rcache_t *	OSCAP_GSYM (pcache)
probe_ncache_t *	OSCAP_GSYM (ncache)
struct id_desc_t	OSCAP_GSYM (id_desc)
probe_option_t *	OSCAP_GSYM (probe_optdef)
size_t	OSCAP_GSYM (probe_optdef_count)
SEXP_t *	probe_item_creat (const char *name, SEXP_t *attrs,...)
	Create a new item consisting of a name, optional attributes argument and an arbitrary number of entities. More...
SEXP_t *	probe_item_new (const char *name, SEXP_t *attrs)
	Create a new item with just a name and optional attributes argument. More...
SEXP_t *	probe_item_attr_add (SEXP_t *item, const char *name, SEXP_t *val)
	Add a new attribute to an item. More...
SEXP_t *	probe_item_ent_add (SEXP_t *item, const char *name, SEXP_t *attrs, SEXP_t *val)
	Add a new entity to an item. More...
int	probe_item_setstatus (SEXP_t *obj, oval_syschar_status_t status)
	Set item's status. More...
int	probe_itement_setstatus (SEXP_t *obj, const char *name, uint32_t n, oval_syschar_status_t status)
	Set status of an item's entity. More...
void	probe_item_resetidctr (struct id_desc_t *id_desc)
	Reset the item id generator. More...
bool	probe_item_filtered (const SEXP_t *item, const SEXP_t *filters)
SEXP_t *	probe_attr_creat (const char *name, const SEXP_t *val,...)
	Create a new list of attributes. More...
SEXP_t *	probe_obj_creat (const char *name, SEXP_t *attrs,...)
	Create a new object consisting of a name, optional attributes argument and an arbitrary number of entities. More...
SEXP_t *	probe_obj_new (const char *name, SEXP_t *attrs)
	Create a new object with just a name and optional attributes argument. More...
SEXP_t *	probe_obj_getent (const SEXP_t *obj, const char *name, uint32_t n)
	Get an entity from an object. More...
SEXP_t *	probe_obj_getentval (const SEXP_t *obj, const char *name, uint32_t n)
	Get the value of an object's entity. More...
int	probe_obj_getentvals (const SEXP_t *obj, const char *name, uint32_t n, SEXP_t **res)
	Get the list of values of an object's entity. More...
oval_version_t	probe_obj_get_schema_version (const SEXP_t *obj)
oval_schema_version_t	probe_obj_get_platform_schema_version (const SEXP_t *obj)
SEXP_t *	probe_obj_getattrval (const SEXP_t *obj, const char *name)
	Get the value of an object's attribute. More...
bool	probe_obj_attrexists (const SEXP_t *obj, const char *name)
	Check whether the specified attribute exists. More...
int	probe_obj_setstatus (SEXP_t *obj, oval_syschar_status_t status)
	Set objects's status. More...
char *	probe_obj_getname (const SEXP_t *obj)
	Get the name of an object. More...
size_t	probe_obj_getname_r (const SEXP_t *obj, char *buffer, size_t buflen)
	Get the name of an object. More...
SEXP_t *	probe_cobj_new (oval_syschar_collection_flag_t flag, SEXP_t *msg_list, SEXP_t *item_list, SEXP_t *mask_list)
int	probe_cobj_add_msg (SEXP_t *cobj, const SEXP_t *msg)
SEXP_t *	probe_cobj_get_msgs (const SEXP_t *cobj)
SEXP_t *	probe_cobj_get_mask (const SEXP_t *cobj)
int	probe_cobj_add_item (SEXP_t *cobj, const SEXP_t *item)
SEXP_t *	probe_cobj_get_items (const SEXP_t *cobj)
void	probe_cobj_set_flag (SEXP_t *cobj, oval_syschar_collection_flag_t flag)
oval_syschar_collection_flag_t	probe_cobj_get_flag (const SEXP_t *cobj)
oval_syschar_collection_flag_t	probe_cobj_combine_flags (oval_syschar_collection_flag_t f1, oval_syschar_collection_flag_t f2, oval_setobject_operation_t op)
oval_syschar_collection_flag_t	probe_cobj_compute_flag (SEXP_t *cobj)
SEXP_t *	probe_msg_creat (oval_message_level_t level, char *message)
	Create a new message that can be added to a collected object. More...
SEXP_t *	probe_msg_creatf (oval_message_level_t level, const char *fmt,...) __attribute__((format(printf
	Create a new message that can be added to a collected object. More...
SEXP_t *	probe_ent_creat (const char *name, SEXP_t *attrs, SEXP_t *val,...)
	Create a new list of entities. More...
SEXP_t *	probe_ent_creat1 (const char *name, SEXP_t *attrs, SEXP_t *val)
	Create a new entity. More...
SEXP_t *	probe_ent_attr_add (SEXP_t *ent, const char *name, SEXP_t *val)
	Add a new attribute to an entity. More...
int	probe_ent_getvals (const SEXP_t *ent, SEXP_t **res)
	Get the list of values of an entity. More...
SEXP_t *	probe_ent_getval (const SEXP_t *ent)
	Get the value of an entity. More...
SEXP_t *	probe_ent_getattrval (const SEXP_t *ent, const char *name)
	Get the value of an entity's attribute. More...
bool	probe_ent_attrexists (const SEXP_t *ent, const char *name)
	Check whether the specified attribute exists. More...
int	probe_ent_setdatatype (SEXP_t *ent, oval_datatype_t type)
	Set the OVAL data type of an entity. More...
oval_datatype_t	probe_ent_getdatatype (const SEXP_t *ent)
	Get the OVAL data type of an entity. More...
int	probe_ent_setmask (SEXP_t *ent, bool mask)
	Set entity's mask. More...
bool	probe_ent_getmask (const SEXP_t *ent)
	Get entity's mask. More...
int	probe_ent_setstatus (SEXP_t *ent, oval_syschar_status_t status)
	Set entity's status. More...
oval_syschar_status_t	probe_ent_getstatus (const SEXP_t *ent)
	Get entity status. More...
char *	probe_ent_getname (const SEXP_t *ent)
	Get the name of an entity. More...
size_t	probe_ent_getname_r (const SEXP_t *ent, char *buffer, size_t buflen)
	Get the name of an entity. More...
void	probe_free (SEXP_t *obj)
	Free the memory allocated by the probe_* functions. More...
void	probe_filebehaviors_canonicalize (SEXP_t **behaviors)
	Set all of the missing attributes of the 'behaviors' entity to default values. More...
void	probe_tfc54behaviors_canonicalize (SEXP_t **behaviors)
	Set all of the missing attributes of the 'behaviors' entity to default values. More...
SEXP_t *	probe_item_create (oval_subtype_t item_subtype, probe_elmatr_t *item_attributes[],...)
	The order of (value_name, value_type, *value) argument tuples passed as e.g. More...
oval_operation_t	probe_ent_getoperation (SEXP_t *entity, oval_operation_t default_op)
int	probe_item_add_msg (SEXP_t *item, oval_message_level_t msglvl, char *msgfmt,...)
SEXP_t *	probe_entval_from_cstr (oval_datatype_t type, const char *value, size_t vallen)
SEXP_t *	probe_ent_from_cstr (const char *name, oval_datatype_t type, const char *value, size_t vallen)
SEXP_t *	probe_obj_getmask (SEXP_t *obj)
	Get object entity mask. More...
SEXP_t *	probe_item_build (const char *fmt,...)
	Build a new item according to the specified format. More...
SEXP_t *	probe_item_newid (struct id_desc_t *id_desc)
	Get a new unique id (within a probe) for an item. More...
SEXP_t *	probe_obj_build (const char *fmt,...)
	Build a new object according to the specified format. More...
int	probe_objent_setstatus (SEXP_t *obj, const char *name, uint32_t n, oval_syschar_status_t status)
	Set status of an object's entity. More...
SEXP_t	nonnull (2)))
int	probe_offline_mode_supported (void)
	In this function can be set supported type of offline mode.
void	probe_preload (void)
	Dummy probe_preload function. More...
void *	probe_init (void) __attribute__((unused))
	Dummy probe_fini function.
void	probe_fini (void *) __attribute__((unused))
	Dummy probe_fini function.
int	probe_main (probe_ctx *, void *) __attribute__((nonnull(1)))
int	probe_result_additem (SEXP_t *result, SEXP_t *item)
int	probe_item_collect (probe_ctx *ctx, SEXP_t *item)
	Collect generated item (i.e. More...
SEXP_t *	probe_ctx_getobject (probe_ctx *ctx)
	Return reference to the input object. More...
SEXP_t *	probe_ctx_getresult (probe_ctx *ctx)
	Return reference to the output object (aka collected object). More...

Macro Definition Documentation

#define PROBE_ENT_AREF	(		ent,
			dst,
			attr_name,
			invalid_exp
	)

Value:

do {                                                            \
                if (((dst) = probe_ent_getattrval(ent, attr_name)) == NULL) { \
                        dE("Attribute `%s' is missing!", attr_name);    \
                        invalid_exp                                     \
                }                                                       \
        } while(0)

#define PROBE_ENT_I32VAL	(		ent,
			dst,
			invalid_exp,
			nil_exp
	)

Value:

do {                                                    \
                SEXP_t *___r;                                   \
                                                                \
                if ((___r = probe_ent_getval(ent)) == NULL) {   \
                        dW("Entity has no value!");             \
                        nil_exp;                                \
                } else {                                        \
                        if (!SEXP_numberp(___r)) {              \
                                dE("Invalid type");             \
                                SEXP_free(___r);                \
                                invalid_exp;                    \
                        } else {                                \
                                dst = SEXP_number_geti_32(___r);        \
                                SEXP_free(___r);                        \
                        }                                               \
                }                                                       \
        } while (0)

#define PROBE_ENT_STRVAL	(		ent,
			dst,
			dstlen,
			invalid_exp,
			zerolen_exp
	)

Value:

do {                                                    \
                SEXP_t *___r;                                   \
                                                                \
                if ((___r = probe_ent_getval(ent)) == NULL) {   \
                        dW("Entity has no value!");             \
                        invalid_exp                             \
                } else {                                        \
                        if (!SEXP_stringp(___r)) {              \
                                dE("Invalid type");             \
                                SEXP_free(___r);                \
                                invalid_exp                     \
                        }                                       \
                        else if (SEXP_string_length(___r) == 0) { \
                                SEXP_free(___r);                \
                                zerolen_exp                     \
                        } else {                                \
				SEXP_string_cstr_r(___r, dst, dstlen); \
                                SEXP_free(___r);                \
                        }                                       \
                }                                               \
        } while (0)

Function Documentation

SEXP_t * probe_attr_creat	(	const char *	name,
		const SEXP_t *	val,
			...
	)

Create a new list of attributes.

This function increments its val argument's reference count.

Parameters

name	the name of the attribute
val	the value of the attribute
...	there can be an arbitrary number of name - value pairs

SEXP_t* probe_ctx_getobject

(

probe_ctx *

ctx

)

Return reference to the input object.

The reference counter is NOT incremented by this operation (i.e. don't call SEXP_free on the return value of this function). Implementation of this function is placed in the `' file.

SEXP_t* probe_ctx_getresult

(

probe_ctx *

ctx

)

Return reference to the output object (aka collected object).

Reference counter is NOT incremented (see the description of probe_ctx_getobject above).

SEXP_t * probe_ent_attr_add	(	SEXP_t *	ent,
		const char *	name,
		SEXP_t *	val
	)

Add a new attribute to an entity.

This function increments its val argument's reference count.

Parameters

ent	the entity to be modified
name	name of the new attribute
val	value of the new attribute

bool probe_ent_attrexists	(	const SEXP_t *	ent,
		const char *	name
	)

Check whether the specified attribute exists.

Parameters

ent	the queried entity
name	the name of the attribute

oval_result_t probe_ent_cmp_binary	(	SEXP_t *	val1,
		SEXP_t *	val2,
		oval_operation_t	op
	)

Compare two binary values.

The operation to use is specified by the operation enumeration value.

Parameters

val1	the first value
val2	the second value
op	the desired operation

oval_result_t probe_ent_cmp_bool	(	SEXP_t *	val1,
		SEXP_t *	val2,
		oval_operation_t	op
	)

Compare two boolean values.

The operation to use is specified by the operation enumeration value.

Parameters

val1	the first value
val2	the second value
op	the desired operation

oval_result_t probe_ent_cmp_debian_evr	(	SEXP_t *	val1,
		SEXP_t *	val2,
		oval_operation_t	op
	)

Compare two Debian epoch-version-release values.

The operation to use is specified by the operation enumeration value.

Parameters

val1	the first value
val2	the second value
op	the desired operation

oval_result_t probe_ent_cmp_evr	(	SEXP_t *	val1,
		SEXP_t *	val2,
		oval_operation_t	op
	)

Compare two epoch-version-release values.

The operation to use is specified by the operation enumeration value.

Parameters

val1	the first value
val2	the second value
op	the desired operation

oval_result_t probe_ent_cmp_filesetrev	(	SEXP_t *	val1,
		SEXP_t *	val2,
		oval_operation_t	op
	)

Compare two values.

The operation to use is specified by the operation enumeration value.

Parameters

val1	the first value
val2	the second value
op	the desired operation

oval_result_t probe_ent_cmp_float	(	SEXP_t *	val1,
		SEXP_t *	val2,
		oval_operation_t	op
	)

Compare two floating point values.

The operation to use is specified by the operation enumeration value.

Parameters

val1	the first value
val2	the second value
op	the desired operation

oval_result_t probe_ent_cmp_int	(	SEXP_t *	val1,
		SEXP_t *	val2,
		oval_operation_t	op
	)

Compare two integer values.

The operation to use is specified by the operation enumeration value.

Parameters

val1	the first value
val2	the second value
op	the desired operation

oval_result_t probe_ent_cmp_ios	(	SEXP_t *	val1,
		SEXP_t *	val2,
		oval_operation_t	op
	)

Compare two ios values.

The operation to use is specified by the operation enumeration value.

Parameters

val1	the first value
val2	the second value
op	the desired operation

oval_result_t probe_ent_cmp_string	(	SEXP_t *	val1,
		SEXP_t *	val2,
		oval_operation_t	op
	)

Compare two string values.

The operation to use is specified by the operation enumeration value.

Parameters

val1	the first value
val2	the second value
op	the desired operation

oval_result_t probe_ent_cmp_version	(	SEXP_t *	val1,
		SEXP_t *	val2,
		oval_operation_t	op
	)

Compare two version values.

The operation to use is specified by the operation enumeration value.

Parameters

val1	the first value
val2	the second value
op	the desired operation

SEXP_t * probe_ent_creat	(	const char *	name,
		SEXP_t *	attrs,
		SEXP_t *	val,
			...
	)

Create a new list of entities.

This function increments its SEXP_t arguments' reference count.

Parameters

name	the name of the entity
attrs	optional entity's attributes argument
val	the value of the entity
...	there can be an arbitrary number of name - attributes - value triples

SEXP_t * probe_ent_creat1	(	const char *	name,
		SEXP_t *	attrs,
		SEXP_t *	val
	)

Create a new entity.

This function increments its SEXP_t arguments' reference count.

Parameters

name	the name of the entity
attrs	optional entity's attributes argument
val	the value of the entity

SEXP_t * probe_ent_getattrval	(	const SEXP_t *	ent,
		const char *	name
	)

Get the value of an entity's attribute.

Parameters

ent	the queried entity
name	the name of the attribute

oval_datatype_t probe_ent_getdatatype

(

const SEXP_t *

ent

)

Get the OVAL data type of an entity.

Parameters

ent	the queried entity

bool probe_ent_getmask

(

const SEXP_t *

ent

)

Get entity's mask.

Parameters

ent	the queried entity

char * probe_ent_getname

(

const SEXP_t *

ent

)

Get the name of an entity.

Parameters

ent	the queried entity

size_t probe_ent_getname_r	(	const SEXP_t *	ent,
		char *	buffer,
		size_t	buflen
	)

Get the name of an entity.

The name is stored in the provided buffer.

Parameters

ent	the queried entity
buffer	the buffer to store the name in
buflen	the length of the buffer

oval_syschar_status_t probe_ent_getstatus

(

const SEXP_t *

ent

)

Get entity status.

Parameters

ent	the queried entity

SEXP_t * probe_ent_getval

(

const SEXP_t *

ent

)

Get the value of an entity.

The function respects the var_ref attribute and returns the currently selected value.

Parameters

ent	the queried entity

int probe_ent_getvals	(	const SEXP_t *	ent,
		SEXP_t **	res
	)

Get the list of values of an entity.

If the entity uses var_ref, there can be more than one value.

Parameters

ent	the queried entity
res	the resulting value list is stored in this argument

Returns

number of values in the list stored in the res argument

oval_result_t probe_ent_result_bychk	(	SEXP_t *	res_lst,
		oval_check_t	check
	)

Compute the overall result.

Compute the overall result from a results vector and a check enumeration parameter.

Parameters

res_lst	the results vector
check	the check enumeration value

oval_result_t probe_ent_result_byopr	(	SEXP_t *	res_lst,
		oval_operator_t	operator
	)

Compute the overall result.

Compute the overall result from a results vector and a operator enumeration parameter.

Parameters

res_lst	the results vector
check	the operator enumeration value

int probe_ent_setdatatype	(	SEXP_t *	ent,
		oval_datatype_t	type
	)

Set the OVAL data type of an entity.

Parameters

ent	the queried entity
type	the new data type

int probe_ent_setmask	(	SEXP_t *	ent,
		bool	mask
	)

Set entity's mask.

Parameters

ent	the queried entity the new mask

int probe_ent_setstatus	(	SEXP_t *	ent,
		oval_syschar_status_t	status
	)

Set entity's status.

Parameters

ent	the entity to be modified
status	the new status

oval_result_t probe_entobj_cmp	(	SEXP_t *	ent_obj,
		SEXP_t *	val
	)

Compare object entity's content with a value.

The result depends on the operation attribute and a possible var_check attribute.

Parameters

ent_obj	object entity
val	raw value

oval_result_t probe_entste_cmp	(	SEXP_t *	ent_ste,
		SEXP_t *	ent_itm
	)

Compare state entity's content with a item entity's value.

The result depends on the operation attribute, a possible var_check attribute and item entity's status.

Parameters

ent_ste	state entity
ent_itm	item entity

void probe_filebehaviors_canonicalize

(

SEXP_t **

behaviors

)

Set all of the missing attributes of the 'behaviors' entity to default values.

If the referenced pointer contains NULL, a new entity is created and stored in the referenced pointer.

Parameters

behaviors

address of the pointer to the 'behaviors' entity, must not be NULL

void probe_free

(

SEXP_t *

obj

)

Free the memory allocated by the probe_* functions.

Parameters

obj	the object to be freed

SEXP_t * probe_item_attr_add	(	SEXP_t *	item,
		const char *	name,
		SEXP_t *	val
	)

Add a new attribute to an item.

This function increments its val argument's reference count.

Parameters

item	the item to be modified
name	name of the new attribute
val	value of the new attribute

SEXP_t* probe_item_build	(	const char *	fmt,
			...
	)

Build a new item according to the specified format.

Parameters

fmt	the desired format

int probe_item_collect	(	struct probe_ctx *	ctx,
		SEXP_t *	item
	)

Collect generated item (i.e.

add it to the collected object) The function takes ownership of the item reference and takes care of freeing the item (i.e. don't call SEXP_free(item) after calling this function). The implementation of this function is placed in the `probe/icache.c' file.

Collect generated item (i.e.

Returns: 0 ... the item was succesfully added to the collected object 1 ... the item was filtered out 2 ... the item was not added because of memory constraints and the collected object was flagged as incomplete -1 ... unexpected/internal error

The caller must not free the item, it's freed automatically by this function or by the icache worker thread.

SEXP_t * probe_item_creat	(	const char *	name,
		SEXP_t *	attrs,
			...
	)

Create a new item consisting of a name, optional attributes argument and an arbitrary number of entities.

Every entity is a triple: const char *name - name of the new entity SEXP_t attrs - optional list of entity attributes in a sexp, can be NULL SEXP_t val - value of the new entity in a sexp This function increments its SEXP_t arguments' reference count.

Parameters

name	mandatory name argument
attrs	optional item's attributes argument
...	arbitrary number of entity arguments

SEXP_t * probe_item_create	(	oval_subtype_t	item_subtype,
		probe_elmatr_t *	item_attributes[],
			...
	)

The order of (value_name, value_type, *value) argument tuples passed as e.g.

3rd to 5th arguments matters. If you change ordering of those tuples, it will have consequences.

SEXP_t * probe_item_ent_add	(	SEXP_t *	item,
		const char *	name,
		SEXP_t *	attrs,
		SEXP_t *	val
	)

Add a new entity to an item.

This function increments its attrs and val arguments' reference count.

Parameters

item	the item to be modified
name	name of the new entity
attrs	optional attributes of the new entity
val	value of the new entity

SEXP_t * probe_item_new	(	const char *	name,
		SEXP_t *	attrs
	)

Create a new item with just a name and optional attributes argument.

Parameters

name	item's name
attrs	optional attributes argument

SEXP_t* probe_item_newid

(

struct id_desc_t *

id_desc

)

Get a new unique id (within a probe) for an item.

Parameters

id_desc

pointer to a structure holding the global id context

Returns

a new id

void probe_item_resetidctr

(

struct id_desc_t *

id_desc

)

Reset the item id generator.

Parameters

id_desc

pointer to a structure holding the global id context

int probe_item_setstatus	(	SEXP_t *	obj,
		oval_syschar_status_t	status
	)

Set item's status.

Parameters

obj	the item to be modified
status	the new status

int probe_itement_setstatus	(	SEXP_t *	obj,
		const char *	name,
		uint32_t	n,
		oval_syschar_status_t	status
	)

Set status of an item's entity.

Parameters

obj	the item to be modified
name	the name of the entity
n	select the n-th occurence of an entity with the specified name
status	the new status

SEXP_t * probe_msg_creat	(	oval_message_level_t	level,
		char *	message
	)

Create a new message that can be added to a collected object.

Parameters

level	the level associated with the new message
message	the text of the new message

SEXP_t * probe_msg_creatf	(	oval_message_level_t	level,
		const char *	fmt,
			...
	)

Create a new message that can be added to a collected object.

Parameters

level	the level associated with the new message
fmt	printf-like format string that produces the text of the new message
...	arguments for the format

bool probe_obj_attrexists	(	const SEXP_t *	obj,
		const char *	name
	)

Check whether the specified attribute exists.

Parameters

obj	the queried object
name	the name of the attribute

SEXP_t* probe_obj_build	(	const char *	fmt,
			...
	)

Build a new object according to the specified format.

Parameters

fmt	the desired format

SEXP_t * probe_obj_creat	(	const char *	name,
		SEXP_t *	attrs,
			...
	)

Create a new object consisting of a name, optional attributes argument and an arbitrary number of entities.

Every entity is a triple: const char *name - name of the new entity SEXP_t attrs - optional list of entity attributes in a sexp, can be NULL SEXP_t val - value of the new entity in a sexp This function increments its SEXP_t arguments' reference count.

Parameters

name	mandatory name argument
attrs	optional object's attributes argument
...	arbitrary number of entity arguments

SEXP_t * probe_obj_getattrval	(	const SEXP_t *	obj,
		const char *	name
	)

Get the value of an object's attribute.

Parameters

obj	the queried object
name	the name of the attribute

SEXP_t * probe_obj_getent	(	const SEXP_t *	obj,
		const char *	name,
		uint32_t	n
	)

Get an entity from an object.

Parameters

obj	the queried object
name	the name of the entity
n	select the n-th occurence of an entity with the specified name

SEXP_t * probe_obj_getentval	(	const SEXP_t *	obj,
		const char *	name,
		uint32_t	n
	)

Get the value of an object's entity.

The function respects the var_ref attribute and returns the currently selected value.

Parameters

obj	the queried object
name	the name of the entity
n	select the n-th occurence of an entity with the specified name

int probe_obj_getentvals	(	const SEXP_t *	obj,
		const char *	name,
		uint32_t	n,
		SEXP_t **	res
	)

Get the list of values of an object's entity.

If the entity uses var_ref, there can be more than one value.

Parameters

obj	the queried object
name	the name of the entity
n	select the n-th occurence of an entity with the specified name
res	the resulting value list is stored in this argument

Returns

number of values in the list stored in the res argument

SEXP_t * probe_obj_getmask

(

SEXP_t *

obj

)

Get object entity mask.

Returns

a list of masked entities

char * probe_obj_getname

(

const SEXP_t *

obj

)

Get the name of an object.

Parameters

obj	the queried object

size_t probe_obj_getname_r	(	const SEXP_t *	obj,
		char *	buffer,
		size_t	buflen
	)

Get the name of an object.

The name is stored in the provided buffer.

Parameters

obj	the queried object
buffer	the buffer to store the name in
buflen	the length of the buffer

SEXP_t * probe_obj_new	(	const char *	name,
		SEXP_t *	attrs
	)

Create a new object with just a name and optional attributes argument.

This function increments its SEXP_t argument's reference count.

Parameters

name	object's name
attrs	optional attributes argument

int probe_obj_setstatus	(	SEXP_t *	obj,
		oval_syschar_status_t	status
	)

Set objects's status.

Parameters

obj	the object to be modified
status	the new status

int probe_objent_setstatus	(	SEXP_t *	obj,
		const char *	name,
		uint32_t	n,
		oval_syschar_status_t	status
	)

Set status of an object's entity.

Parameters

obj	the object to be modified
name	the name of the entity
n	select the n-th occurence of an entity with the specified name
status	the new status

void probe_preload

(

void

)

Dummy probe_preload function.

This function is called right before chroot. It should load all dynamic libraries what can by used by probe after chroot.

void probe_tfc54behaviors_canonicalize

(

SEXP_t **

behaviors

)

Set all of the missing attributes of the 'behaviors' entity to default values.

If the referenced pointer contains NULL, a new entity is created and stored in the referenced pointer.

Parameters

behaviors

address of the pointer to the 'behaviors' entity, must not be NULL