目录

SecurityAudit

Provides unified security audit data subscription and unsubscription APIs for apps to obtain security audit data on a device to support the audit service.

Since: 5.0.0(12)

Modules to Import

import { securityAudit } from '@kit.DeviceSecurityKit';

AuditEventInfo

Request parameter of the subscription or unsubscription API.

Model restriction: This API can be used only in the stage model.

System capability: SystemCapability.Security.SecurityAudit

Since: 5.0.0(12)

Name Type Read-Only Optional Description
eventId number No No

Audit event ID, which specifies the security audit data to be obtained. Example: 0x810800800.

The value range of the audit event ID is [0, 0xFFFFFFFFF].

AuditEvent

Security audit data.

Model restriction: This API can be used only in the stage model.

System capability: SystemCapability.Security.SecurityAudit

Since: 5.0.0(12)

Name Type Read-Only Optional Description
eventId number No No Audit event ID, which is the same as that in the request.
version string No Yes Audit event version number.
timestamp string No Yes Time when an audit event occurs. The value is in YYYYMMDDHHMMSS format.
content string No Yes Audit event content. Different audit events have different contents. The value is a JSON string, for example, {"type": 1}.
userId number No Yes Sign-in user ID when an audit event occurs.
deviceId string No Yes ID of the device where an audit event occurs.
metadata string No Yes

Audit event metadata, including the event version number, time when an event is received, device ID, and user ID.

Since: 6.0.0(20)

NotifyEvent

Enumerates notification events.

Model restriction: This API can be used only in the stage model.

System capability: SystemCapability.Security.SecurityAudit

Since: 6.0.0(20)

Name Value Description
PASTEBOARD 0x27000000 Clipboard copy or paste event.
FILE 0x1C000007 File event.
FILE_INTERCEPTED 0x1C001100 File access rule violation event.
ACCOUNT 0x10000100 Sign-in or sign-out event.
WINDOW 0x07000000 Screenshot, screen recording, or screen projection event.
VOLUME 0x0F000000 Insertion or removal event of a removable storage device.
PRINTER 0x2E000000 Printer event.
PROCESS 0x1C000008 Process creation or exit event.
NETWORK_TRAFFIC 0x1C00000E Network traffic event.
NETWORK_CONN 0x1C00000F Network connection event.
CAMERA 0x2D000000 Camera event.
APP 0x10000000 App event.
EDM 0x11000000 Enterprise device management event.
CERT 0x12003000 Certificate operation event.
KIA_CREATE 0x1C00000B KIA file creation event.
KIA_READ 0x1C000012 KIA file read event.
KIA_VARIANT 0x1C00000C KIA file variation event.
KIA_INTERCEPT 0x1C00000A KIA file interception event.
PERMISSION 0x0B000000 App permission change event.
DNS 0x03000001 DNS audit event.
APP_INSTALL_INTERCEPTED 0x18000100 App installation interception event.
APP_UNINSTALL_INTERCEPTED 0x18000101 App uninstallation interception event.
APP_UPDATE_INTERCEPTED 0x18000102 App update interception event.
APP_RECOVER_INTERCEPTED 0x18000103 App recovery interception event.
APP_START_INTERCEPTED 0x18000104 App startup interception event.
USB_ACCESS_INTERCEPTED 0x30000000 USB access interception event.
SMB_FILE_SEND 0x0F000001

SMB (Samba) outgoing event.

Since: 6.1.0(23)
KIA_PRE_OPEN 0x1C000014

KIA file quick-open event.

Since: 6.1.0(23)
HDC_DEBUG 0x27000100

HarmonyOS Device Connector (HDC) debugging file event.

Since: 6.1.0(23)
HDC_DEBUG_INTERCEPTED 0x27000101

HDC debugging interception event.

Since: 6.1.0(23)
USER_SPACE_DATA_TRANSFER 0x2F000000

Multi-user space data transfer event.

Since: 6.1.0(23)
USER_SPACE_DATA_TRANSFER_POLICY 0x2F000001

Multi-user space exchange review policy event.

Since: 6.1.0(23)
SERIAL_PORT_ACCESS 0x30000100

Serial port access audit event.

Since: 6.1.0(23)
NETWORK_INTERCEPTED 0x03000002

Network interception event.

Since: 6.1.0(23)
WIFI_INTERCEPTED 0x03000100

Wi-Fi interception event.

Since: 6.1.0(23)
PRINT_INTERCEPTED 0x2E000001

Print interception event.

Since: 6.1.0(23)
CS_VERIFY_NULL 0x12001081

App code not signed.

Since: 6.1.1(24)
CS_VERIFY_ABNORMAL 0x12001082

App code signature verification error.

Since: 6.1.1(24)
FS_MOUNT_ABNORMAL 0x1C001102

Abnormal system directory mounting.

Since: 6.1.1(24)
DRIVER_CS_ABNORMAL 0x1C001200

Driver code signature verification error.

Since: 6.1.1(24)
DRIVER_MMAP_ABNORMAL 0x1C001201

Driver illegally mapping kernel memory.

Since: 6.1.1(24)
KERNEL_MEMORY_ABNORMAL 0x1C001300

Kernel memory abnormal usage.

Since: 6.1.1(24)
PROCESS_DEBUG_ABNORMAL 0x1C001401

Process debugging error.

Since: 6.1.1(24)
PROCESS_CRASH_ABNORMAL 0x1C001402

Process crash.

Since: 6.1.1(24)
PROCESS_PRIVILEGE_ESCALATION 0x1C001403

Process privilege escalation.

Since: 6.1.1(24)
FILE_SHARE 0x0F000002

File share event.

Since: 26.0.0
DATA_DRAG 0x0F000003

Data drag event.

Since: 26.0.0
DLP_FILE_ACCESS 0x0F000006

DLP file access event.

Since: 26.0.0
FILE_CREATE 0x1C001104

File create event.

Since: 26.0.0
FILE_OPEN 0x1C001105

File open event.

Since: 26.0.0
FILE_CLOSE 0x1C001106

File close event.

Since: 26.0.0
FILE_DELETE 0x1C001107

File delete event.

Since: 26.0.0
FILE_RENAME 0x1C001108

File rename event.

Since: 26.0.0
FILE_COPY 0x1C001109

File copy event.

Since: 26.0.0
FILE_SETOWNER 0x1C00110A

File owner change event.

Since: 26.0.0
FILE_SETMODE 0x1C00110B

File mode change event.

Since: 26.0.0
FILE_SETEXTATTR 0x1C00110C

File extended attribute setting event.

Since: 26.0.0
FILE_DELETEEXTATTR 0x1C00110D

File extended attribute deletion event.

Since: 26.0.0
FILE_WRITE 0x1C00110E

File write event.

Since: 26.0.0
BLUETOOTH_INTERCEPTED 0x03000200

Bluetooth interception event.

Since: 26.0.0
DISC_BURNING 0x0F000004

Disc burning event.

Since: 26.0.0
MEDIA_FILE_ACCESS 0x0F000005

Media file access event.

Since: 26.0.0
ACCOUNT_MANAGEMENT 0x10000103

Account management event.

Since: 26.0.0
DEVICE_POWER_ON 0x16000001

Device power-on event.

Since: 26.0.0
DEVICE_POWER_OFF 0x16000002

Device power-off event.

Since: 26.0.0
AUDIO_INTERFACE_ACCESS 0x1A000001

Audio interface access event.

Since: 26.0.0
VIDEO_INTERFACE_ACCESS 0x1A000002

Video interface access event.

Since: 26.0.0
SERIAL_PORT_INTERCEPTED 0x30000101

Serial port interception event.

Since: 26.0.0

FilterType

Enumerates event filter types.

Model restriction: This API can be used only in the stage model.

System capability: SystemCapability.Security.SecurityAudit

Since: 6.0.0(20)

Name Value Description
EVENT_TYPE_EQUAL 0x00000100 Event type filter.
EVENT_SUBTYPE_EQUAL 0x00000200 Event subtype filter.
FILE_PATH_EQUAL 0x00010000 File path filter.
FILE_PATH_PREFIX 0x00010001 File path prefix filter.
FILE_PATH_SUFFIX 0x00010002 File path suffix filter.
FILE_PATH_REGULAR 0x00010003

Filtering type of the file path regular expression.

Since: 26.0.0
PROCESS_UID_EQUAL 0x00020000 Process UID filter.
PROCESS_PID_EQUAL 0x00020100 Process ID filter.
PROCESS_NAME_EQUAL 0x00020200 Process name filter.
PROCESS_NAME_PREFIX 0x00020201 Process name prefix filter.
PROCESS_NAME_SUFFIX 0x00020202 Process name suffix filter.

AuthEvent

Enumerates authentication events.

Model restriction: This API can be used only in the stage model.

System capability: SystemCapability.Security.SecurityAudit

Since: 6.0.0(20)

Name Value Description
FILE_CREATE 0x1C801100 File creation authentication event.
FILE_OPEN 0x1C801101 File opening authentication event.
FILE_RENAME 0x1C801102 File renaming authentication event.
FILE_DELETE 0x1C801103 File deletion authentication event.
FILE_SETEXTATTR 0x1C801104 Authentication event for extended file attribute setting.
FILE_DELETEEXTATTR 0x1C801105 Authentication event for extended file attribute deletion.
FILE_READ_END 0x1C801106

File read completion authentication event.

Since: 26.0.0
PROCESS_EXEC 0x1C801400

Process execution authentication event.

Since: 26.0.0

AuthResult

Enumerates authentication results.

Model restriction: This API can be used only in the stage model.

System capability: SystemCapability.Security.SecurityAudit

Since: 6.0.0(20)

Name Value Description
ALLOW 0 Allows an authentication event.
DENY 1 Denies an authentication event.

on('auditEventOccur')

on(type: 'auditEventOccur', auditEventInfo: AuditEventInfo, callback: Callback<AuditEvent>): void

Subscribes to security audit data.

Model restriction: This API can be used only in the stage model.

Required permission: ohos.permission.QUERY_AUDIT_EVENT

System capability: SystemCapability.Security.SecurityAudit

Since: 5.0.0(12)

Parameters:

Name Type Mandatory Description
type string Yes Event type to subscribe to. This parameter has a fixed value of auditEventOccur, indicating audit events.
auditEventInfo AuditEventInfo Yes Subscribed audit data.
callback Callback<AuditEvent> Yes Callback function for receiving audit events.

Error codes:

For details about the error codes, please refer to Universal Error Codes and SecurityAudit Error Codes.

ID Error Message
201 check permission fail.

Example:

import { securityAudit } from '@kit.DeviceSecurityKit';
import { BusinessError } from '@kit.BasicServicesKit';
import { hilog } from '@kit.PerformanceAnalysisKit';

const TAG = 'SecurityAuditAuditJsTest';
const callback = (event: securityAudit.AuditEvent) => {
  hilog.info(0x0000, TAG, '%{public}s', 'Security_SecurityAudit_JsApi_Func eventId= ' + event.eventId);
  hilog.info(0x0000, TAG, '%{public}s', 'Security_SecurityAudit_JsApi_Func version= ' + event.version);
  hilog.info(0x0000, TAG, '%{public}s', 'Security_SecurityAudit_JsApi_Func content= ' + event.content);
  hilog.info(0x0000, TAG, '%{public}s', 'Security_SecurityAudit_JsApi_Func timestamp= ' + event.timestamp);
  hilog.info(0x0000, TAG, '%{public}s', 'Security_SecurityAudit_JsApi_Func userId= ' + event.userId);
  hilog.info(0x0000, TAG, '%{public}s', 'Security_SecurityAudit_JsApi_Func deviceId= ' + event.deviceId);
};
let auditEventInfo: securityAudit.AuditEventInfo = {
   eventId: 0x810800800
};

try {
  hilog.info(0x0000, TAG, 'on begin.');
  securityAudit.on('auditEventOccur', auditEventInfo, callback);
  hilog.info(0x0000, TAG, 'Succeeded in on.');
} catch (err) {
  let e: BusinessError = err as BusinessError;
  hilog.error(0x0000, TAG, 'on failed: %{public}d %{public}s', e.code, e.message);
}

off('auditEventOccur')

off(type: 'auditEventOccur', auditEventInfo: AuditEventInfo, callback?: Callback<AuditEvent>): void

Unsubscribes from security audit data.

Model restriction: This API can be used only in the stage model.

Required permission: ohos.permission.QUERY_AUDIT_EVENT

System capability: SystemCapability.Security.SecurityAudit

Since: 5.0.0(12)

Parameters:

Name Type Mandatory Description
type string Yes Event type to unsubscribe from. This parameter has a fixed value of auditEventOccur, indicating audit events.
auditEventInfo AuditEventInfo Yes Unsubscribed audit data.
callback Callback<AuditEvent> No Callback function for receiving audit data. If a callback is passed, the subscription to this callback is canceled. If no callback is passed, subscriptions to all callbacks are canceled.

Error codes:

For details about the error codes, please refer to Universal Error Codes and SecurityAudit Error Codes.

ID Error Message
201 check permission fail.

Example:

import { securityAudit } from '@kit.DeviceSecurityKit';
import { BusinessError } from '@kit.BasicServicesKit';
import { hilog } from '@kit.PerformanceAnalysisKit';

const TAG = 'SecurityAuditAuditJsTest';
let auditEventInfo: securityAudit.AuditEventInfo = {
   eventId: 0x810800800
};

try {
  hilog.info(0x0000, TAG, 'off begin.');
  securityAudit.off('auditEventOccur', auditEventInfo);
  hilog.info(0x0000, TAG, 'Succeeded in off.');
} catch (err) {
  let e: BusinessError = err as BusinessError;
  hilog.error(0x0000, TAG, 'off failed: %{public}d %{public}s', e.code, e.message);
}

Filter

Filter information provided by you.

Model restriction: This API can be used only in the stage model.

System capability: SystemCapability.Security.SecurityAudit

Since: 6.0.0(20)

Name Type Read-Only Optional Description
isInclude boolean No No

Filter flag, which determines whether events that meet the filter are returned to the subscriber.

true: The filter is a negative filter. Events that meet the negative filter are returned to the subscriber.

false: The filter is a positive filter. Events that meet the positive filter are not returned to the subscriber.
type FilterType No No Filter type.
values string[] No No Array of filter values.

Client

Provides conditions for a notification client.

Model restriction: This API can be used only in the stage model.

System capability: SystemCapability.Security.SecurityAudit

Since: 6.0.0(20)

You need to use newClient to construct an instance.

[h2]subscribe

subscribe(events: NotifyEvent[]): void

Subscribes to notification events.

Model restriction: This API can be used only in the stage model.

Required permission: ohos.permission.QUERY_AUDIT_EVENT

System capability: SystemCapability.Security.SecurityAudit

Since: 6.0.0(20)

Parameters:

Name Type Mandatory Description
events NotifyEvent[] Yes Notification events to be subscribed to.

Error codes:

For details about the error codes, please refer to Universal Error Codes and SecurityAudit Error Codes.

ID Error Message
201 check permission fail.
1012000001 Internal error.Possible causes: 1. IPC cross-process invoking fails. 2. System service process is faulty.

Example:

import { securityAudit } from '@kit.DeviceSecurityKit';
import { BusinessError } from '@kit.BasicServicesKit';
import { hilog } from '@kit.PerformanceAnalysisKit';

let client: securityAudit.Client | undefined = undefined;
const TAG = 'SecurityAuditJsTest';
const callback = (event: securityAudit.AuditEvent) => {
  hilog.info(0x0000, TAG, '%{public}s', 'Security_SecurityAudit_JsApi_Func eventId= ' + event.eventId);
  hilog.info(0x0000, TAG, '%{public}s', 'Security_SecurityAudit_JsApi_Func version= ' + event.version);
  hilog.info(0x0000, TAG, '%{public}s', 'Security_SecurityAudit_JsApi_Func content= ' + event.content);
  hilog.info(0x0000, TAG, '%{public}s', 'Security_SecurityAudit_JsApi_Func timestamp= ' + event.timestamp);
  hilog.info(0x0000, TAG, '%{public}s', 'Security_SecurityAudit_JsApi_Func userId= ' + event.userId);
  hilog.info(0x0000, TAG, '%{public}s', 'Security_SecurityAudit_JsApi_Func deviceId= ' + event.deviceId);
};
try {
  client = securityAudit.newClient(callback);
  client?.subscribe([0x02D000000]);
} catch (err) {
  let e: BusinessError = err as BusinessError;
  hilog.error(0x0000, TAG, 'subscribe failed: %{public}d %{public}s', e.code, e.message);
}

[h2]unsubscribe

unsubscribe(events: NotifyEvent[]): void

Unsubscribes from notification events.

Model restriction: This API can be used only in the stage model.

Required permission: ohos.permission.QUERY_AUDIT_EVENT

System capability: SystemCapability.Security.SecurityAudit

Since: 6.0.0(20)

Parameters:

Name Type Mandatory Description
events NotifyEvent[] Yes Subscribed notification events.

Error codes:

For details about the error codes, please refer to Universal Error Codes and SecurityAudit Error Codes.

ID Error Message
201 check permission fail.
1012000001 Internal error.Possible causes: 1. IPC cross-process invoking fails. 2. System service process is faulty.

Example:

import { securityAudit } from '@kit.DeviceSecurityKit';
import { BusinessError } from '@kit.BasicServicesKit';
import { hilog } from '@kit.PerformanceAnalysisKit';

let client: securityAudit.Client | undefined = undefined;
const TAG = 'SecurityAuditJsTest';
const callback = (event: securityAudit.AuditEvent) => {
  hilog.info(0x0000, TAG, '%{public}s', 'Security_SecurityAudit_JsApi_Func eventId= ' + event.eventId);
  hilog.info(0x0000, TAG, '%{public}s', 'Security_SecurityAudit_JsApi_Func version= ' + event.version);
  hilog.info(0x0000, TAG, '%{public}s', 'Security_SecurityAudit_JsApi_Func content= ' + event.content);
  hilog.info(0x0000, TAG, '%{public}s', 'Security_SecurityAudit_JsApi_Func timestamp= ' + event.timestamp);
  hilog.info(0x0000, TAG, '%{public}s', 'Security_SecurityAudit_JsApi_Func userId= ' + event.userId);
  hilog.info(0x0000, TAG, '%{public}s', 'Security_SecurityAudit_JsApi_Func deviceId= ' + event.deviceId);
};
try {
  client = securityAudit.newClient(callback);
  client?.unsubscribe([0x02D000000]);
} catch (err) {
  let e: BusinessError = err as BusinessError;
  hilog.error(0x0000, TAG, 'unsubscribe failed: %{public}d %{public}s', e.code, e.message);
}

[h2]addFilter

addFilter(event: NotifyEvent, filter: Filter): void

Adds a filter for a notification event. Whether events meeting the filter are returned to the subscriber is determined by the filter flag.

Model restriction: This API can be used only in the stage model.

Required permission: ohos.permission.QUERY_AUDIT_EVENT

System capability: SystemCapability.Security.SecurityAudit

Since: 6.0.0(20)

Parameters:

Name Type Mandatory Description
event NotifyEvent Yes Notification event ID.
filter Filter Yes Notification event filter.

Error codes:

For details about the error codes, please refer to Universal Error Codes and SecurityAudit Error Codes.

ID Error Message
201 check permission fail.
1012000001 Internal error.Possible causes: 1. IPC cross-process invoking fails. 2. System service process is faulty.
1012000004 The number of filters exceeds the upper limit.
1012000005 The event does not support the filter condition.

Example:

import { securityAudit } from '@kit.DeviceSecurityKit';
import { BusinessError } from '@kit.BasicServicesKit';
import { hilog } from '@kit.PerformanceAnalysisKit';

let client: securityAudit.Client | undefined = undefined;
const TAG = 'SecurityAuditJsTest';
const callback = (event: securityAudit.AuditEvent) => {
  hilog.info(0x0000, TAG, '%{public}s', 'Security_SecurityAudit_JsApi_Func eventId= ' + event.eventId);
  hilog.info(0x0000, TAG, '%{public}s', 'Security_SecurityAudit_JsApi_Func version= ' + event.version);
  hilog.info(0x0000, TAG, '%{public}s', 'Security_SecurityAudit_JsApi_Func content= ' + event.content);
  hilog.info(0x0000, TAG, '%{public}s', 'Security_SecurityAudit_JsApi_Func timestamp= ' + event.timestamp);
  hilog.info(0x0000, TAG, '%{public}s', 'Security_SecurityAudit_JsApi_Func userId= ' + event.userId);
  hilog.info(0x0000, TAG, '%{public}s', 'Security_SecurityAudit_JsApi_Func deviceId= ' + event.deviceId);
};
let filter : securityAudit.Filter = {
  type: 0x00000200,
  isInclude: true,
  values : ["2"]
};
try {
  client = securityAudit.newClient(callback);
  client?.addFilter(0x02D000000, filter);
} catch (err) {
  let e: BusinessError = err as BusinessError;
  hilog.error(0x0000, TAG, 'addFilter failed: %{public}d %{public}s', e.code, e.message);
}

[h2]removeFilter

removeFilter(event: NotifyEvent, filter: Filter): void

Deletes a filter of a notification event. After the deletion, events meeting the filter will no longer be processed based on the filter flag.

Model restriction: This API can be used only in the stage model.

Required permission: ohos.permission.QUERY_AUDIT_EVENT

System capability: SystemCapability.Security.SecurityAudit

Since: 6.0.0(20)

Parameters:

Name Type Mandatory Description
event NotifyEvent Yes Notification event ID.
filter Filter Yes Notification event filter.

Error codes:

For details about the error codes, please refer to Universal Error Codes and SecurityAudit Error Codes.

ID Error Message
201 check permission fail.
1012000001 Internal error.Possible causes: 1. IPC cross-process invoking fails. 2. System service process is faulty.
1012000005 The event does not support the filter condition.

Example:

import { securityAudit } from '@kit.DeviceSecurityKit';
import { BusinessError } from '@kit.BasicServicesKit';
import { hilog } from '@kit.PerformanceAnalysisKit';

let client: securityAudit.Client | undefined = undefined;
const TAG = 'SecurityAuditJsTest';
const callback = (event: securityAudit.AuditEvent) => {
  hilog.info(0x0000, TAG, '%{public}s', 'Security_SecurityAudit_JsApi_Func eventId= ' + event.eventId);
  hilog.info(0x0000, TAG, '%{public}s', 'Security_SecurityAudit_JsApi_Func version= ' + event.version);
  hilog.info(0x0000, TAG, '%{public}s', 'Security_SecurityAudit_JsApi_Func content= ' + event.content);
  hilog.info(0x0000, TAG, '%{public}s', 'Security_SecurityAudit_JsApi_Func timestamp= ' + event.timestamp);
  hilog.info(0x0000, TAG, '%{public}s', 'Security_SecurityAudit_JsApi_Func userId= ' + event.userId);
  hilog.info(0x0000, TAG, '%{public}s', 'Security_SecurityAudit_JsApi_Func deviceId= ' + event.deviceId);
};
let filter : securityAudit.Filter = {
  type: 0x00000200,
  isInclude: true,
  values : ["2"]
};
try {
  client = securityAudit.newClient(callback);
  client?.removeFilter(0x02D000000, filter);
} catch (err) {
  let e: BusinessError = err as BusinessError;
  hilog.error(0x0000, TAG, 'removeFilter failed: %{public}d %{public}s', e.code, e.message);
}

newClient

newClient(callback: Callback<AuditEvent>): Client

Creates a notification client. The methods provided by the client can be used to subscribe to and filter notification events.

Model restriction: This API can be used only in the stage model.

Required permission: ohos.permission.QUERY_AUDIT_EVENT

System capability: SystemCapability.Security.SecurityAudit

Since: 6.0.0(20)

Parameters:

Name Type Mandatory Description
callback Callback<AuditEvent> Yes Callback function for receiving audit data.

Returns:

Type Description
Client Notification client instance.

Error codes:

For details about the error codes, please refer to Universal Error Codes and SecurityAudit Error Codes.

ID Error Message
201 check permission fail.
1012000001 Internal error.Possible causes: 1. IPC cross-process invoking fails. 2. System service process is faulty.
1012000002 The number of clients exceeds the global upper limit.
1012000003 The number of clients exceeds the current process upper limit.

Example:

import { securityAudit } from '@kit.DeviceSecurityKit';
import { BusinessError } from '@kit.BasicServicesKit';
import { hilog } from '@kit.PerformanceAnalysisKit';

let client: securityAudit.Client | undefined = undefined;
const TAG = 'SecurityAuditJsTest';
const callback = (event: securityAudit.AuditEvent) => {
  hilog.info(0x0000, TAG, '%{public}s', 'Security_SecurityAudit_JsApi_Func eventId= ' + event.eventId);
  hilog.info(0x0000, TAG, '%{public}s', 'Security_SecurityAudit_JsApi_Func version= ' + event.version);
  hilog.info(0x0000, TAG, '%{public}s', 'Security_SecurityAudit_JsApi_Func content= ' + event.content);
  hilog.info(0x0000, TAG, '%{public}s', 'Security_SecurityAudit_JsApi_Func timestamp= ' + event.timestamp);
  hilog.info(0x0000, TAG, '%{public}s', 'Security_SecurityAudit_JsApi_Func userId= ' + event.userId);
  hilog.info(0x0000, TAG, '%{public}s', 'Security_SecurityAudit_JsApi_Func deviceId= ' + event.deviceId);
};
try {
  client = securityAudit.newClient(callback);
} catch (err) {
  let e: BusinessError = err as BusinessError;
  hilog.error(0x0000, TAG, 'newClient failed: %{public}d %{public}s', e.code, e.message);
}

deleteClient

deleteClient(client: Client): void

Deletes a notification client. After the deletion, the methods provided by the client can no longer be used, and the subscription and filtering information recorded by the client will be cleared.

Model restriction: This API can be used only in the stage model.

Required permission: ohos.permission.QUERY_AUDIT_EVENT

System capability: SystemCapability.Security.SecurityAudit

Since: 6.0.0(20)

Parameters:

Name Type Mandatory Description
client Client Yes Notification client information.

Error codes:

For details about the error codes, please refer to Universal Error Codes and SecurityAudit Error Codes.

ID Error Message
201 check permission fail.
1012000001 Internal error.Possible causes: 1. IPC cross-process invoking fails. 2. System service process is faulty.

Example:

import { securityAudit } from '@kit.DeviceSecurityKit';
import { BusinessError } from '@kit.BasicServicesKit';
import { hilog } from '@kit.PerformanceAnalysisKit';

let client: securityAudit.Client | undefined = undefined;
const TAG = 'SecurityAuditJsTest';
const callback = (event: securityAudit.AuditEvent) => {
  hilog.info(0x0000, TAG, '%{public}s', 'Security_SecurityAudit_JsApi_Func eventId= ' + event.eventId);
  hilog.info(0x0000, TAG, '%{public}s', 'Security_SecurityAudit_JsApi_Func version= ' + event.version);
  hilog.info(0x0000, TAG, '%{public}s', 'Security_SecurityAudit_JsApi_Func content= ' + event.content);
  hilog.info(0x0000, TAG, '%{public}s', 'Security_SecurityAudit_JsApi_Func timestamp= ' + event.timestamp);
  hilog.info(0x0000, TAG, '%{public}s', 'Security_SecurityAudit_JsApi_Func userId= ' + event.userId);
  hilog.info(0x0000, TAG, '%{public}s', 'Security_SecurityAudit_JsApi_Func deviceId= ' + event.deviceId);
};
try {
  client = securityAudit.newClient(callback);
  securityAudit.deleteClient(client);
} catch (err) {
  let e: BusinessError = err as BusinessError;
  hilog.error(0x0000, TAG, 'deleteClient failed: %{public}d %{public}s', e.code, e.message);
}

AuthClient

Provides conditions for an authentication client.

Model restriction: This API can be used only in the stage model.

System capability: SystemCapability.Security.SecurityAudit

Since: 6.0.0(20)

You need to use newAuthClient to construct an instance.

[h2]subscribe

subscribe(events: AuthEvent[]): void

Subscribes to authentication events.

Model restriction: This API can be used only in the stage model.

Required permission: ohos.permission.kernel.AUTH_AUDIT_EVENT

System capability: SystemCapability.Security.SecurityAudit

Since: 6.0.0(20)

Parameters:

Name Type Mandatory Description
events AuthEvent[] Yes Authentication events to be subscribed to.

Error codes:

For details about the error codes, please refer to Universal Error Codes and SecurityAudit Error Codes.

ID Error Message
201 check permission fail.
1012000001 Internal error.Possible causes: 1. IPC cross-process invoking fails. 2. System service process is faulty.

Example:

import { securityAudit } from '@kit.DeviceSecurityKit';
import { BusinessError } from '@kit.BasicServicesKit';
import { hilog } from '@kit.PerformanceAnalysisKit';

const TAG = 'SecurityAuditAuthJsTest';
let authClient: securityAudit.AuthClient | undefined = undefined;
const callback = (event: securityAudit.AuditEvent) => {
  hilog.info(0x0000, TAG, '%{public}s', 'Security_SecurityAudit_Auth_JsApi_Func eventId= ' + event.eventId);
  hilog.info(0x0000, TAG, '%{public}s', 'Security_SecurityAudit_Auth_JsApi_Func content= ' + event.content);
  hilog.info(0x0000, TAG, '%{public}s', 'Security_SecurityAudit_Auth_JsApi_Func metadata= ' + event.metadata);
};
try {
  authClient = securityAudit.newAuthClient(callback);
} catch (err) {
  let e: BusinessError = err as BusinessError;
  hilog.error(0x0000, TAG, 'newAuthClient failed: %{public}d %{public}s', e.code, e.message);
}
try {
  authClient?.subscribe([securityAudit.AuthEvent.FILE_CREATE]);
} catch (err) {
  let e: BusinessError = err as BusinessError;
  hilog.error(0x0000, TAG, 'subscribe failed: %{public}d %{public}s', e.code, e.message);
}

[h2]unsubscribe

unsubscribe(events: AuthEvent[]): void

Unsubscribes from authentication events.

Model restriction: This API can be used only in the stage model.

Required permission: ohos.permission.kernel.AUTH_AUDIT_EVENT

System capability: SystemCapability.Security.SecurityAudit

Since: 6.0.0(20)

Parameters:

Name Type Mandatory Description
events AuthEvent[] Yes Subscribed authentication events.

Error codes:

For details about the error codes, please refer to Universal Error Codes and SecurityAudit Error Codes.

ID Error Message
201 check permission fail.
1012000001 Internal error.Possible causes: 1. IPC cross-process invoking fails. 2. System service process is faulty.

Example:

import { securityAudit } from '@kit.DeviceSecurityKit';
import { BusinessError } from '@kit.BasicServicesKit';
import { hilog } from '@kit.PerformanceAnalysisKit';

const TAG = 'SecurityAuditAuthJsTest';
let authClient: securityAudit.AuthClient | undefined = undefined;
const callback = (event: securityAudit.AuditEvent) => {
  hilog.info(0x0000, TAG, '%{public}s', 'Security_SecurityAudit_Auth_JsApi_Func eventId= ' + event.eventId);
  hilog.info(0x0000, TAG, '%{public}s', 'Security_SecurityAudit_Auth_JsApi_Func content= ' + event.content);
  hilog.info(0x0000, TAG, '%{public}s', 'Security_SecurityAudit_Auth_JsApi_Func metadata= ' + event.metadata);
};
try {
  authClient = securityAudit.newAuthClient(callback);
} catch (err) {
  let e: BusinessError = err as BusinessError;
  hilog.error(0x0000, TAG, 'newAuthClient failed: %{public}d %{public}s', e.code, e.message);
}
try {
  authClient?.subscribe([securityAudit.AuthEvent.FILE_CREATE]);
} catch (err) {
  let e: BusinessError = err as BusinessError;
  hilog.error(0x0000, TAG, 'subscribe failed: %{public}d %{public}s', e.code, e.message);
}
try {
  authClient?.unsubscribe([securityAudit.AuthEvent.FILE_CREATE]);
} catch (err) {
  let e: BusinessError = err as BusinessError;
  hilog.error(0x0000, TAG, 'unsubscribe failed: %{public}d %{public}s', e.code, e.message);
}

[h2]addFilter

addFilter(event: AuthEvent, filter: Filter): void

Adds a filter for an authentication event. Whether events meeting the filter are returned to the subscriber is determined by the filter flag.

Model restriction: This API can be used only in the stage model.

Required permission: ohos.permission.kernel.AUTH_AUDIT_EVENT

System capability: SystemCapability.Security.SecurityAudit

Since: 6.0.0(20)

Parameters:

Name Type Mandatory Description
event AuthEvent Yes Authentication event ID.
filter Filter Yes Authentication event filter.

Error codes:

For details about the error codes, please refer to Universal Error Codes and SecurityAudit Error Codes.

ID Error Message
201 check permission fail.
1012000001 Internal error.Possible causes: 1. IPC cross-process invoking fails. 2. System service process is faulty.
1012000004 The number of filters exceeds the upper limit.
1012000005 The event does not support the filter condition.

Example:

import { securityAudit } from '@kit.DeviceSecurityKit';
import { BusinessError } from '@kit.BasicServicesKit';
import { hilog } from '@kit.PerformanceAnalysisKit';

const TAG = 'SecurityAuditAuthJsTest';
let authClient: securityAudit.AuthClient | undefined = undefined;
const callback = (event: securityAudit.AuditEvent) => {
  hilog.info(0x0000, TAG, '%{public}s', 'Security_SecurityAudit_Auth_JsApi_Func eventId= ' + event.eventId);
  hilog.info(0x0000, TAG, '%{public}s', 'Security_SecurityAudit_Auth_JsApi_Func content= ' + event.content);
  hilog.info(0x0000, TAG, '%{public}s', 'Security_SecurityAudit_Auth_JsApi_Func metadata= ' + event.metadata);
};
try {
  authClient = securityAudit.newAuthClient(callback);
} catch (err) {
  let e: BusinessError = err as BusinessError;
  hilog.error(0x0000, TAG, 'newAuthClient failed: %{public}d %{public}s', e.code, e.message);
}
let filter : securityAudit.Filter = {
  type: securityAudit.FilterType.PROCESS_PID_EQUAL,
  isInclude: true,
  values : ["2"]
};
try {
  authClient?.addFilter(securityAudit.AuthEvent.FILE_CREATE, filter);
} catch (err) {
  let e: BusinessError = err as BusinessError;
  hilog.error(0x0000, TAG, 'addFilter failed: %{public}d %{public}s', e.code, e.message);
}

[h2]removeFilter

removeFilter(event: AuthEvent, filter: Filter): void

Deletes a filter of an authentication event. After the deletion, events meeting the filter will no longer be processed based on the filter flag.

Model restriction: This API can be used only in the stage model.

Required permission: ohos.permission.kernel.AUTH_AUDIT_EVENT

System capability: SystemCapability.Security.SecurityAudit

Since: 6.0.0(20)

Parameters:

Name Type Mandatory Description
event AuthEvent Yes Authentication event ID.
filter Filter Yes Authentication event filter.

Error codes:

For details about the error codes, please refer to Universal Error Codes and SecurityAudit Error Codes.

ID Error Message
201 check permission fail.
1012000001 Internal error.Possible causes: 1. IPC cross-process invoking fails. 2. System service process is faulty.
1012000005 The event does not support the filter condition.

Example:

import { securityAudit } from '@kit.DeviceSecurityKit';
import { BusinessError } from '@kit.BasicServicesKit';
import { hilog } from '@kit.PerformanceAnalysisKit';

const TAG = 'SecurityAuditAuthJsTest';
let authClient: securityAudit.AuthClient | undefined = undefined;
const callback = (event: securityAudit.AuditEvent) => {
  hilog.info(0x0000, TAG, '%{public}s', 'Security_SecurityAudit_Auth_JsApi_Func eventId= ' + event.eventId);
  hilog.info(0x0000, TAG, '%{public}s', 'Security_SecurityAudit_Auth_JsApi_Func content= ' + event.content);
  hilog.info(0x0000, TAG, '%{public}s', 'Security_SecurityAudit_Auth_JsApi_Func metadata= ' + event.metadata);
};
try {
  authClient = securityAudit.newAuthClient(callback);
} catch (err) {
  let e: BusinessError = err as BusinessError;
  hilog.error(0x0000, TAG, 'newAuthClient failed: %{public}d %{public}s', e.code, e.message);
}
let filter : securityAudit.Filter = {
  type: securityAudit.FilterType.PROCESS_PID_EQUAL,
  isInclude: true,
  values : ["2"]
};
try {
  authClient?.addFilter(securityAudit.AuthEvent.FILE_CREATE, filter);
} catch (err) {
  let e: BusinessError = err as BusinessError;
  hilog.error(0x0000, TAG, 'addFilter failed: %{public}d %{public}s', e.code, e.message);
}
try {
  authClient?.removeFilter(securityAudit.AuthEvent.FILE_CREATE, filter);
} catch (err) {
  let e: BusinessError = err as BusinessError;
  hilog.error(0x0000, TAG, 'removeFilter failed: %{public}d %{public}s', e.code, e.message);
}

[h2]auth

auth(auditEvent: AuditEvent, authResult: AuthResult): void

Sets the authentication result of an authentication event. The audit module will allow or deny an event based on the authentication result.

Model restriction: This API can be used only in the stage model.

Required permission: ohos.permission.kernel.AUTH_AUDIT_EVENT

System capability: SystemCapability.Security.SecurityAudit

Since: 6.0.0(20)

Parameters:

Name Type Mandatory Description
auditEvent AuditEvent Yes Authentication event information.
authResult AuthResult Yes Authentication result.

Error codes:

For details about the error codes, please refer to Universal Error Codes and SecurityAudit Error Codes.

ID Error Message
201 check permission fail.
1012000001 Internal error.Possible causes: 1. IPC cross-process invoking fails. 2. System service process is faulty.
1012000007 The auth event cannot be found.

Example:

import { securityAudit } from '@kit.DeviceSecurityKit';
import { BusinessError } from '@kit.BasicServicesKit';
import { hilog } from '@kit.PerformanceAnalysisKit';

const TAG = 'SecurityAuditAuthJsTest';
let authClient: securityAudit.AuthClient | undefined = undefined;
const allowEventCallback = (event: securityAudit.AuditEvent) => {
  hilog.info(0x0000, TAG, '%{public}s', 'Security_SecurityAudit_Auth_JsApi_Func eventId= ' + event.eventId);
  hilog.info(0x0000, TAG, '%{public}s', 'Security_SecurityAudit_Auth_JsApi_Func content= ' + event.content);
  hilog.info(0x0000, TAG, '%{public}s', 'Security_SecurityAudit_Auth_JsApi_Func metadata= ' + event.metadata);
  try {
    authClient?.auth(event, securityAudit.AuthResult.ALLOW);
  } catch (error) {
    let e: BusinessError = error as BusinessError;
    hilog.error(0x0000, TAG, 'allowEventCallback', 'auth error:' + e.code);
  }
};
try {
  authClient = securityAudit.newAuthClient(allowEventCallback);
} catch (err) {
  let e: BusinessError = err as BusinessError;
  hilog.error(0x0000, TAG, 'newAuthClient failed: %{public}d %{public}s', e.code, e.message);
}

newAuthClient

newAuthClient(callback: Callback<AuditEvent>): AuthClient

Creates an authentication client. The methods provided by the client can be used to subscribe to, filter, and authenticate authentication events.

Model restriction: This API can be used only in the stage model.

Required permission: ohos.permission.kernel.AUTH_AUDIT_EVENT

System capability: SystemCapability.Security.SecurityAudit

Since: 6.0.0(20)

Parameters:

Name Type Mandatory Description
callback Callback<AuditEvent> Yes Callback function for receiving audit data.

Returns:

Type Description
AuthClient Authentication client instance. A maximum of two client instances can be created for a process, and a maximum of 16 client instances can be created for a device. A maximum of 256 positive filter values and 256 negative filter values can be set for a client instance.

Error codes:

For details about the error codes, please refer to Universal Error Codes and SecurityAudit Error Codes.

ID Error Message
201 check permission fail.
1012000001 Internal error.Possible causes: 1. IPC cross-process invoking fails. 2. System service process is faulty.
1012000002 The number of clients exceeds the global upper limit.
1012000003 The number of clients exceeds the current process upper limit.

Example:

import { securityAudit } from '@kit.DeviceSecurityKit';
import { BusinessError } from '@kit.BasicServicesKit';
import { hilog } from '@kit.PerformanceAnalysisKit';

const TAG = 'SecurityAuditAuthJsTest';
let authClient: securityAudit.AuthClient | undefined = undefined;
const callback = (event: securityAudit.AuditEvent) => {
  hilog.info(0x0000, TAG, '%{public}s', 'Security_SecurityAudit_Auth_JsApi_Func eventId= ' + event.eventId);
  hilog.info(0x0000, TAG, '%{public}s', 'Security_SecurityAudit_Auth_JsApi_Func content= ' + event.content);
  hilog.info(0x0000, TAG, '%{public}s', 'Security_SecurityAudit_Auth_JsApi_Func metadata= ' + event.metadata);
};
try {
  authClient = securityAudit.newAuthClient(callback);
} catch (err) {
  let e: BusinessError = err as BusinessError;
  hilog.error(0x0000, TAG, 'newAuthClient failed: %{public}d %{public}s', e.code, e.message);
}

deleteAuthClient

deleteAuthClient(client: AuthClient): void

Deletes an authentication client. After the deletion, the methods provided by the client can no longer be used, and the subscription and filtering information recorded by the client will be cleared.

Model restriction: This API can be used only in the stage model.

Required permission: ohos.permission.kernel.AUTH_AUDIT_EVENT

System capability: SystemCapability.Security.SecurityAudit

Since: 6.0.0(20)

Parameters:

Name Type Mandatory Description
client AuthClient Yes Authentication client information.

Error codes:

For details about the error codes, please refer to Universal Error Codes and SecurityAudit Error Codes.

ID Error Message
201 check permission fail.
1012000001 Internal error.Possible causes: 1. IPC cross-process invoking fails. 2. System service process is faulty.

Example:

import { securityAudit } from '@kit.DeviceSecurityKit';
import { BusinessError } from '@kit.BasicServicesKit';
import { hilog } from '@kit.PerformanceAnalysisKit';

const TAG = 'SecurityAuditAuthJsTest';
let authClient: securityAudit.AuthClient | undefined = undefined;
const callback = (event: securityAudit.AuditEvent) => {
  hilog.info(0x0000, TAG, '%{public}s', 'Security_SecurityAudit_Auth_JsApi_Func eventId= ' + event.eventId);
  hilog.info(0x0000, TAG, '%{public}s', 'Security_SecurityAudit_Auth_JsApi_Func content= ' + event.content);
  hilog.info(0x0000, TAG, '%{public}s', 'Security_SecurityAudit_Auth_JsApi_Func metadata= ' + event.metadata);
};
try {
  authClient = securityAudit.newAuthClient(callback);
} catch (err) {
  let e: BusinessError = err as BusinessError;
  hilog.error(0x0000, TAG, 'newAuthClient failed: %{public}d %{public}s', e.code, e.message);
}
try {
  securityAudit.deleteAuthClient(authClient);
} catch (err) {
  let e: BusinessError = err as BusinessError;
  hilog.error(0x0000, TAG, 'deleteAuthClient failed: %{public}d %{public}s', e.code, e.message);
}

AuthClientConfiguration

Configuration for an authentication event client.

Model restriction: This API can be used only in the stage model.

System capability: SystemCapability.Security.SecurityAudit

Since: 26.0.0

Name Type Read-Only Optional Description
timeoutAuthResult AuthResult No No

Sets the default authorization result upon authorization event response timeout.

- ALLOW: Allow upon timeout.

- DENY: Deny upon timeout.

newAuthClient

newAuthClient(callback: Callback<AuditEvent>, configuration: AuthClientConfiguration): AuthClient

Creates an authentication client (the default authentication policy upon timeout can be configured). The methods provided by the client can be used to subscribe to, filter, and authenticate authentication events.

Model restriction: This API can be used only in the stage model.

Required permission: ohos.permission.kernel.AUTH_AUDIT_EVENT

System capability: SystemCapability.Security.SecurityAudit

Since: 26.0.0

Parameters:

Name Type Mandatory Description
callback Callback<AuditEvent> Yes Callback function for receiving audit data.
configuration AuthClientConfiguration Yes Authorization client configuration items.

Returns:

Type Description
AuthClient Authentication client instance.

Error codes:

For details about the error codes, please refer to Universal Error Codes and SecurityAudit Error Codes.

ID Error Message
201 check permission fail.
1012000001 Internal error.Possible causes: 1. IPC cross-process invoking fails. 2. System service process is faulty.
1012000002 The number of clients exceeds the global upper limit.
1012000003 The number of clients exceeds the current process upper limit.

Example:

import { securityAudit } from '@kit.DeviceSecurityKit';
import { BusinessError } from '@kit.BasicServicesKit';
import { hilog } from '@kit.PerformanceAnalysisKit';

const TAG = 'SecurityAuditAuthJsTest';
let authClient: securityAudit.AuthClient | undefined = undefined;
const callback = (event: securityAudit.AuditEvent) => {
  hilog.info(0x0000, TAG, '%{public}s', 'Security_SecurityAudit_Auth_JsApi_Func eventId= ' + event.eventId);
  hilog.info(0x0000, TAG, '%{public}s', 'Security_SecurityAudit_Auth_JsApi_Func content= ' + event.content);
  hilog.info(0x0000, TAG, '%{public}s', 'Security_SecurityAudit_Auth_JsApi_Func metadata= ' + event.metadata);
};

// Configure authentication after timeout.
let config: securityAudit.AuthClientConfiguration = {
  timeoutAuthResult: securityAudit.AuthResult.DENY
};

try {
  authClient = securityAudit.newAuthClient(callback, config);
} catch (err) {
  let e: BusinessError = err as BusinessError;
  hilog.error(0x0000, TAG, 'newAuthClient failed: %{public}d %{public}s', e.code, e.message);
}

queryAllProcesses

queryAllProcesses(): string

Queries the information about all app processes.

Model restriction: This API can be used only in the stage model.

Required permission: ohos.permission.QUERY_AUDIT_EVENT

System capability: SystemCapability.Security.SecurityAudit

Since: 6.0.0(20)

Returns:

Type Description
string App process information, which is a JSON string. Example: {"1": {}}.

Error codes:

For details about the error codes, please refer to Universal Error Codes and SecurityAudit Error Codes.

ID Error Message
201 check permission fail.
1012000001 Internal error.Possible causes: 1. IPC cross-process invoking fails. 2. System service process is faulty.

Example:

import { securityAudit } from '@kit.DeviceSecurityKit';
import { BusinessError } from '@kit.BasicServicesKit';
import { hilog } from '@kit.PerformanceAnalysisKit';

const TAG = 'SecurityAuditJsTest';
try {
  hilog.info(0x0000, TAG, 'queryAllProcesses begin.');
  const result = securityAudit.queryAllProcesses();
  hilog.info(0x0000, TAG, 'Succeeded in queryAllProcesses.');
} catch (err) {
  let e: BusinessError = err as BusinessError;
  hilog.error(0x0000, TAG, 'queryAllProcesses failed: %{public}d %{public}s', e.code, e.message);
}

queryProcesses

queryProcesses(pids: number[]): string

Queries the information about app processes with the specified process IDs (PIDs).

Model restriction: This API can be used only in the stage model.

Required permission: ohos.permission.QUERY_AUDIT_EVENT

System capability: SystemCapability.Security.SecurityAudit

Since: 6.0.0(20)

Parameters:

Name Type Mandatory Description
pids number[] Yes IDs of the processes to be queried.

Returns:

Type Description
string App process information, which is a JSON string. Example: {"1": {}}.

Error codes:

For details about the error codes, please refer to Universal Error Codes and SecurityAudit Error Codes.

ID Error Message
201 check permission fail.
1012000001 Internal error.Possible causes: 1. IPC cross-process invoking fails. 2. System service process is faulty.
1012000006 The number of queried processes exceeds the threshold.

Example:

import { securityAudit } from '@kit.DeviceSecurityKit';
import { BusinessError } from '@kit.BasicServicesKit';
import { hilog } from '@kit.PerformanceAnalysisKit';

const TAG = 'SecurityAuditJsTest';
let pids: number[] = [1, 2];
try {
  hilog.info(0x0000, TAG, 'queryProcesses begin.');
  const result = securityAudit.queryProcesses(pids);
  hilog.info(0x0000, TAG, 'Succeeded in queryProcesses.');
} catch (err) {
  let e: BusinessError = err as BusinessError;
  hilog.error(0x0000, TAG, 'queryProcesses failed: %{public}d %{public}s', e.code, e.message);
}

acquireCodeSign

acquireCodeSign(path: string): string

Obtains the code signature information of the file specified by the input file path.

Model restriction: This API can be used only in the stage model.

Required permission: ohos.permission.QUERY_AUDIT_EVENT

System capability: SystemCapability.Security.SecurityAudit

Since: 6.1.1(24)

Parameters:

Name Type Mandatory Description
path string Yes Path of the file to be queried.

Returns:

Type Description
string Code signature, which is a JSON string. Example: {"1": {}}.

Error codes:

For details about the error codes, please refer to Universal Error Codes and SecurityAudit Error Codes.

ID Error Message
201 check permission fail.
1012000001 Internal error.Possible causes: 1. IPC cross-process invoking fails. 2. System service process is faulty.
1012000008 The file cannot be found.

Example:

import { securityAudit } from '@kit.DeviceSecurityKit';
import { BusinessError } from '@kit.BasicServicesKit';
import { hilog } from '@kit.PerformanceAnalysisKit';
 
const TAG = 'SecurityAuditJsTest';
let path = 'test';
try {
  hilog.info(0x0000, TAG, 'acquireCodeSign begin.');
  const result = securityAudit.acquireCodeSign(path);
  hilog.info(0x0000, TAG, 'Succeeded in acquireCodeSign.');
} catch (err) {
  let e: BusinessError = err as BusinessError;
  hilog.error(0x0000, TAG, 'acquireCodeSign failed: %{public}d %{public}s', e.code, e.message);
}

acquireAllClientsInfo

acquireAllClientsInfo(): string

Obtains the information of all audit event notification clients.

Model restriction: This API can be used only in the stage model.

Required permission: ohos.permission.QUERY_AUDIT_EVENT

System capability: SystemCapability.Security.SecurityAudit

Since: 26.0.0

Returns:

Type Description
string Security audit notification client information, which is a JSON string. Example: [{"procName": vps, "uid": 1000, "pid": 1000}]

Error codes:

For details about the error codes, please refer to Universal Error Codes and SecurityAudit Error Codes.

ID Error Message
201 check permission fail.
1012000001 Internal error.Possible causes: 1. IPC cross-process invoking fails. 2. System service process is faulty.

Example:

import { securityAudit } from '@kit.DeviceSecurityKit';
import { BusinessError } from '@kit.BasicServicesKit';
import { hilog } from '@kit.PerformanceAnalysisKit';

const TAG = 'SecurityAuditJsTest';
try {
  hilog.info(0x0000, TAG, 'acquireAllClientsInfo begin.');
  const result = securityAudit.acquireAllClientsInfo();
  hilog.info(0x0000, TAG, 'Succeeded in acquireAllClientsInfo.');
} catch (err) {
  let e: BusinessError = err as BusinessError;
  hilog.error(0x0000, TAG, 'acquireAllClientsInfo failed: %{public}d %{public}s', e.code, e.message);
}

acquireAllAuthClientsInfo

acquireAllAuthClientsInfo(): string

Obtains the information of all audit event authentication clients.

Model restriction: This API can be used only in the stage model.

Required permission: ohos.permission.kernel.AUTH_AUDIT_EVENT

System capability: SystemCapability.Security.SecurityAudit

Since: 26.0.0

Returns:

Type Description
string Security audit authentication client information, which is a JSON string. Example: [{"procName": vps, "uid": 1000, "pid": 1000}]

Error codes:

For details about the error codes, please refer to Universal Error Codes and SecurityAudit Error Codes.

ID Error Message
201 check permission fail.
1012000001 Internal error.Possible causes: 1. IPC cross-process invoking fails. 2. System service process is faulty.

Example:

import { securityAudit } from '@kit.DeviceSecurityKit';
import { BusinessError } from '@kit.BasicServicesKit';
import { hilog } from '@kit.PerformanceAnalysisKit';
 
const TAG = 'SecurityAuditJsTest';
try {
  hilog.info(0x0000, TAG, 'acquireAllAuthClientsInfo begin.');
  const result = securityAudit.acquireAllAuthClientsInfo();
  hilog.info(0x0000, TAG, 'Succeeded in acquireAllAuthClientsInfo.');
} catch (err) {
  let e: BusinessError = err as BusinessError;
  hilog.error(0x0000, TAG, 'acquireAllAuthClientsInfo failed: %{public}d %{public}s', e.code, e.message);
}