1 files changed, 189 insertions, 0 deletions
diff --git a/private/ntos/se/adt.h b/private/ntos/se/adt.h
new file mode 100644
index 000000000..9292b07d6
--- /dev/null
+++ b/private/ntos/se/adt.h
@@ -0,0 +1,189 @@
+/*++
+
+Copyright (c) 1991  Microsoft Corporation
+
+Module Name:
+
+    adt.h
+
+Abstract:
+
+    Auditing - Defines, Fuction Prototypes and Macro Functions.
+               These are public to the Security Component only.
+
+Author:
+
+    Scott Birrell       (ScottBi)       January 17, 1991
+
+Environment:
+
+Revision History:
+
+--*/
+
+#include <ntlsa.h>
+
+
+//////////////////////////////////////////////////////////////////////////////
+//                                                                          //
+// Auditing Routines visible to rest of Security Component outside Auditing //
+// subcomponent.                                                            //
+//                                                                          //
+//////////////////////////////////////////////////////////////////////////////
+
+
+/*++
+
+BOOLEAN
+SepAdtEventOnSuccess(
+    IN POLICY_AUDIT_EVENT_TYPE AuditEventType
+    )
+
+Routine Description:
+
+    This macro function checks if a given Audit Event Type is enabled for
+    Auditing of successful occurrences of the Event.
+
+Arguments:
+
+    AuditEventType - Specifies the type of the Audit Event to be checked.
+
+Return Value:
+
+    BOOLEAN - TRUE if the event type is enabled for auditing of successful
+        occurrences of the event, else FALSE
+--*/
+
+#define SepAdtEventOnSuccess(AuditEventType)                               \
+            (SepAdtState.EventAuditingOptions[AuditEventType] &            \
+                POLICY_AUDIT_EVENT_SUCCESS)
+
+
+/*++
+
+BOOLEAN
+SepAdtEventOnFailure(
+    IN POLICY_AUDIT_EVENT_TYPE AuditEventType
+    )
+
+Routine Description:
+
+    This macro function checks if a given Audit Event Type is enabled for
+    Auditing of unsuccessful attempts to cause an event of the given type
+    to occur.
+
+Arguments:
+
+    AuditEventType - Specifies the type of the Audit Event to be checked.
+
+Return Value:
+
+    BOOLEAN - TRUE if the event type is enabled for auditing of unsuccessful
+        attempts to make the event type occur, else FALSE
+--*/
+
+#define SepAdtEventOnFailure(AuditEventType)                               \
+            (SepAdtState.EventAuditingOptions[AuditEventType] &            \
+            POLICY_AUDIT_EVENT_FAILURE)
+
+/*++
+
+BOOLEAN
+SepAdtAuditingEvent(
+    IN POLICY_AUDIT_EVENT_TYPE AuditEventType
+    )
+
+Routine Description:
+
+    This macro function checks if a given Audit Event Type is enabled for
+    Auditing.
+
+Arguments:
+
+    AuditEventType - Specifies the type of the Audit Event to be checked.
+
+Return Value:
+
+    BOOLEAN - TRUE if the event type is enabled for auditing, else FALSE.
+
+--*/
+
+#define SepAdtAuditingEvent(AuditEventType)                     \
+            (SepAdtEventOnSuccess(AuditEventType) ||            \
+            (SepAdtEventOnFailure(AuditEventType))
+
+/*++
+
+BOOLEAN
+SepAdtAuditingEnabled()
+
+Routine Description:
+
+    This macro function tests if auditing is enabled.
+
+Arguments:
+
+    None.
+
+Return Value:
+
+    BOOLEAN - TRUE if auditing is enabled, else FALSE
+
+--*/
+
+#define SepAdtAuditingEnabled() (SepAdtState.AuditingMode == TRUE)
+
+
+/*++
+
+BOOLEAN
+SepAdtAuditingDisabled()
+
+Routine Description:
+
+    This macro function tests if auditing is disabled.
+
+Arguments:
+
+    None.
+
+Return Value:
+
+    BOOLEAN - TRUE if auditing is disabled, else FALSE
+
+--*/
+
+#define SepAdtAuditingDisabled() (!SepAdtAuditingEnabled)
+
+//
+// Audit Event Information array.  Although internal to the Auditing
+// Subcomponent, this structure is exported to all of Security so that the
+// above macro functions can be used to access it efficiently from there.
+//
+
+extern POLICY_AUDIT_EVENTS_INFO SepAdtState;
+
+BOOLEAN
+SepAdtInitializePhase0();
+
+BOOLEAN
+SepAdtInitializePhase1();
+
+//VOID
+//SepAdtLogAuditRecord(
+//    IN POLICY_AUDIT_EVENT_TYPE AuditEventType,
+//    IN PVOID AuditInformation
+//    );
+
+VOID
+SepAdtLogAuditRecord(
+    IN PSE_ADT_PARAMETER_ARRAY AuditParameters
+    );
+
+NTSTATUS
+SepAdtCopyToLsaSharedMemory(
+    IN HANDLE LsaProcessHandle,
+    IN PVOID Buffer,
+    IN ULONG BufferLength,
+    OUT PVOID *LsaBufferAddress
+    );