From b474c2f621ba09116910e2d49ff7adebaf15d2da Mon Sep 17 00:00:00 2001
From: Eric Kohl <eric.kohl@reactos.org>
Date: Sun, 20 Jul 2003 00:04:06 +0000
Subject: [PATCH] Added audit functions.

svn path=/trunk/; revision=5167
---
 reactos/lib/advapi32/advapi32.edf |  10 +--
 reactos/lib/advapi32/makefile     |   3 +-
 reactos/lib/advapi32/sec/audit.c  | 140 ++++++++++++++++++++++++++++++
 3 files changed, 147 insertions(+), 6 deletions(-)
 create mode 100644 reactos/lib/advapi32/sec/audit.c

diff --git a/reactos/lib/advapi32/advapi32.edf b/reactos/lib/advapi32/advapi32.edf
index 5486d57845e..60d59ee8257 100644
--- a/reactos/lib/advapi32/advapi32.edf
+++ b/reactos/lib/advapi32/advapi32.edf
@@ -1,4 +1,4 @@
-; $Id: advapi32.edf,v 1.20 2003/06/27 15:19:18 sedwards Exp $
+; $Id: advapi32.edf,v 1.21 2003/07/20 00:04:06 ekohl Exp $
 ;
 ; advapi32.edf
 ;
@@ -270,10 +270,10 @@ MapGenericMask=MapGenericMask@8
 ;NTAccessMaskToProvAccessRights=NTAccessMaskToProvAccessRights@12
 ;NotifyBootConfigStatus=NotifyBootConfigStatus@4
 ;NotifyChangeEventLog=NotifyChangeEventLog@8
-;ObjectCloseAuditAlarmA=ObjectCloseAuditAlarmA@12
-;ObjectCloseAuditAlarmW=ObjectCloseAuditAlarmW@12
-;ObjectDeleteAuditAlarmA=ObjectDeleteAuditAlarmA@12
-;ObjectDeleteAuditAlarmW=ObjectDeleteAuditAlarmW@12
+ObjectCloseAuditAlarmA=ObjectCloseAuditAlarmA@12
+ObjectCloseAuditAlarmW=ObjectCloseAuditAlarmW@12
+ObjectDeleteAuditAlarmA=ObjectDeleteAuditAlarmA@12
+ObjectDeleteAuditAlarmW=ObjectDeleteAuditAlarmW@12
 ;ObjectOpenAuditAlarmA=ObjectOpenAuditAlarmA@48
 ;ObjectOpenAuditAlarmW=ObjectOpenAuditAlarmW@48
 ;ObjectPrivilegeAuditAlarmA=ObjectPrivilegeAuditAlarmA@24
diff --git a/reactos/lib/advapi32/makefile b/reactos/lib/advapi32/makefile
index c949113c64d..8cd73597feb 100644
--- a/reactos/lib/advapi32/makefile
+++ b/reactos/lib/advapi32/makefile
@@ -1,4 +1,4 @@
-# $Id: makefile,v 1.27 2003/06/27 15:19:18 sedwards Exp $
+# $Id: makefile,v 1.28 2003/07/20 00:04:06 ekohl Exp $
 
 PATH_TO_TOP = ../..
 
@@ -30,6 +30,7 @@ REGISTRY_OBJECTS=\
 
 SECURITY_OBJECTS=\
 	sec/ac.o	\
+	sec/audit.o	\
 	sec/lsa.o	\
 	sec/misc.o	\
 	sec/sec.o	\
diff --git a/reactos/lib/advapi32/sec/audit.c b/reactos/lib/advapi32/sec/audit.c
new file mode 100644
index 00000000000..3b44ff51b9b
--- /dev/null
+++ b/reactos/lib/advapi32/sec/audit.c
@@ -0,0 +1,140 @@
+/* $Id: audit.c,v 1.1 2003/07/20 00:03:40 ekohl Exp $
+ *
+ * COPYRIGHT:       See COPYING in the top level directory
+ * PROJECT:         ReactOS system libraries
+ * FILE:            lib/advapi32/sec/audit.c
+ * PURPOSE:         Audit functions
+ * PROGRAMMER:      Eric Kohl (ekohl@rz-online.de)
+ * UPDATE HISTORY:
+ *                  Created 07/19/2003
+ */
+
+/* INCLUDES *****************************************************************/
+
+#define NTOS_MODE_USER
+#include <ntos.h>
+#include <windows.h>
+
+
+/* FUNCTIONS ****************************************************************/
+
+/*
+ * @implemented
+ */
+BOOL STDCALL
+ObjectCloseAuditAlarmA (LPCSTR SubsystemName,
+			LPVOID HandleId,
+			BOOL GenerateOnClose)
+{
+  UNICODE_STRING Name;
+  NTSTATUS Status;
+
+  Status = RtlCreateUnicodeStringFromAsciiz (&Name,
+					     (PCHAR)SubsystemName);
+  if (!NT_SUCCESS (Status))
+    {
+      SetLastError (RtlNtStatusToDosError (Status));
+      return FALSE;
+    }
+
+  Status = NtCloseObjectAuditAlarm (&Name,
+				    HandleId,
+				    GenerateOnClose);
+  RtlFreeUnicodeString(&Name);
+  if (!NT_SUCCESS (Status))
+    {
+      SetLastError (RtlNtStatusToDosError (Status));
+      return FALSE;
+    }
+
+  return TRUE;
+}
+
+/*
+ * @implemented
+ */
+BOOL STDCALL
+ObjectCloseAuditAlarmW (LPCWSTR SubsystemName,
+			LPVOID HandleId,
+			BOOL GenerateOnClose)
+{
+  UNICODE_STRING Name;
+  NTSTATUS Status;
+
+  RtlInitUnicodeString (&Name,
+			(PWSTR)SubsystemName);
+
+  Status = NtCloseObjectAuditAlarm (&Name,
+				    HandleId,
+				    GenerateOnClose);
+  if (!NT_SUCCESS (Status))
+    {
+      SetLastError (RtlNtStatusToDosError (Status));
+      return FALSE;
+    }
+
+  return TRUE;
+}
+
+
+/*
+ * @implemented
+ */
+BOOL STDCALL
+ObjectDeleteAuditAlarmA (LPCSTR SubsystemName,
+			 LPVOID HandleId,
+			 BOOL GenerateOnClose)
+{
+  UNICODE_STRING Name;
+  NTSTATUS Status;
+
+  Status = RtlCreateUnicodeStringFromAsciiz (&Name,
+					     (PCHAR)SubsystemName);
+  if (!NT_SUCCESS (Status))
+    {
+      SetLastError (RtlNtStatusToDosError (Status));
+      return FALSE;
+    }
+
+  Status = NtDeleteObjectAuditAlarm (&Name,
+				     HandleId,
+				     GenerateOnClose);
+  RtlFreeUnicodeString(&Name);
+  if (!NT_SUCCESS (Status))
+    {
+      SetLastError (RtlNtStatusToDosError (Status));
+      return FALSE;
+    }
+
+  return TRUE;
+}
+
+
+/*
+ * @implemented
+ */
+BOOL STDCALL
+ObjectDeleteAuditAlarmW (LPCWSTR SubsystemName,
+			 LPVOID HandleId,
+			 BOOL GenerateOnClose)
+{
+  UNICODE_STRING Name;
+  NTSTATUS Status;
+
+  RtlInitUnicodeString (&Name,
+			(PWSTR)SubsystemName);
+
+  Status = NtDeleteObjectAuditAlarm (&Name,
+				     HandleId,
+				     GenerateOnClose);
+  if (!NT_SUCCESS (Status))
+    {
+      SetLastError (RtlNtStatusToDosError (Status));
+      return FALSE;
+    }
+
+  return TRUE;
+}
+
+
+/* EOF */