Merge OpenBSM 1.1 beta 1 from OpenBSM vendor branch to head, both

contrib/openbsm (svn merge) and src/sys/{bsm,security/audit} (manual
merge).

OpenBSM history for imported revision below for reference.

MFC after:      1 month
Sponsored by:   Apple, Inc.
Obtained from:  TrustedBSD Project

OpenBSM 1.1 beta 1

- The filesz parameter in audit_control(5) now accepts suffixes: 'B' for
  Bytes, 'K' for Kilobytes, 'M' for Megabytes, and 'G' for Gigabytes.
  For legacy support no suffix defaults to bytes.
- Audit trail log expiration support added.  It is configured in
  audit_control(5) with the expire-after parameter.  If there is no
  expire-after parameter in audit_control(5), the default, then the audit
  trail files are not expired and removed.  See audit_control(5) for
  more information.
- Change defaults in audit_control: warn at 5% rather than 20% free for audit
  partitions, rotate automatically at 2mb, and set the default policy to
  cnt,argv rather than cnt so that execve(2) arguments are captured if
  AUE_EXECVE events are audited.  These may provide more usable defaults for
  many users.
- Use au_domain_to_bsm(3) and au_socket_type_to_bsm(3) to convert
  au_to_socket_ex(3) arguments to BSM format.
- Fix error encoding AUT_IPC_PERM tokens.

2 files changed, 10 insertions, 19 deletions

diff --git a/sys/bsm/audit.h b/sys/bsm/audit.h
index 53eeadb167ff..24cc583984cb 100644
--- a/sys/bsm/audit.h
+++ b/sys/bsm/audit.h
@@ -26,7 +26,7 @@
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  *
- * P4: //depot/projects/trustedbsd/openbsm/sys/bsm/audit.h#4
+ * P4: //depot/projects/trustedbsd/openbsm/sys/bsm/audit.h#5
  * $FreeBSD$
  */
 
@@ -66,8 +66,9 @@
 #define	AUDIT_TRIGGER_CLOSE_AND_DIE	4	/* Terminate audit. */
 #define	AUDIT_TRIGGER_NO_SPACE		5	/* Below min free space. */
 #define	AUDIT_TRIGGER_ROTATE_USER	6	/* User requests rotate. */
-#define	AUDIT_TRIGGER_INITIALIZE	7	/* Initialize audit. */
-#define	AUDIT_TRIGGER_MAX		7
+#define	AUDIT_TRIGGER_INITIALIZE	7	/* User initialize of auditd. */
+#define	AUDIT_TRIGGER_EXPIRE_TRAILS	8	/* User expiration of trails. */
+#define	AUDIT_TRIGGER_MAX		8
 
 /*
  * The special device filename (FreeBSD).
diff --git a/sys/bsm/audit_kevents.h b/sys/bsm/audit_kevents.h
index 3276cacd4cea..40aec777b901 100644
--- a/sys/bsm/audit_kevents.h
+++ b/sys/bsm/audit_kevents.h
@@ -26,7 +26,7 @@
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  *
- * P4: //depot/projects/trustedbsd/openbsm/sys/bsm/audit_kevents.h#4
+ * P4: //depot/projects/trustedbsd/openbsm/sys/bsm/audit_kevents.h#5
  * $FreeBSD$
  */
 
@@ -587,6 +587,8 @@
 #define	AUE_CAP_GETMODE		43189	/* TrustedBSD. */
 #define	AUE_POSIX_SPAWN		43190	/* Darwin. */
 #define	AUE_FSGETPATH		43191	/* Darwin. */
+#define	AUE_PREAD		43192	/* Darwin/FreeBSD. */
+#define	AUE_PWRITE		43193	/* Darwin/FreeBSD. */
 
 /*
  * Darwin BSM uses a number of AUE_O_* definitions, which are aliased to the
@@ -658,7 +660,6 @@
 /*
  * Possible desired future values based on review of BSD/Darwin system calls.
  */
-#define	AUE_ACCESSEXTENDED	AUE_NULL
 #define	AUE_ATGETMSG		AUE_NULL
 #define	AUE_ATPUTMSG		AUE_NULL
 #define	AUE_ATSOCKET		AUE_NULL
@@ -669,11 +670,9 @@
 #define	AUE_BSDTHREADCREATE	AUE_NULL
 #define	AUE_BSDTHREADTERMINATE	AUE_NULL
 #define	AUE_BSDTHREADREGISTER	AUE_NULL
-#define	AUE_CHMODEXTENDED	AUE_NULL
 #define	AUE_CHUD		AUE_NULL
 #define	AUE_CSOPS		AUE_NULL
 #define	AUE_DUP			AUE_NULL
-#define	AUE_FCHMODEXTENDED	AUE_NULL
 #define	AUE_FDATASYNC		AUE_NULL
 #define	AUE_FFSCTL		AUE_NULL
 #define	AUE_FGETATTRLIST	AUE_NULL
@@ -683,11 +682,10 @@
 #define	AUE_FSCTL		AUE_NULL
 #define	AUE_FSETATTRLIST	AUE_NULL
 #define	AUE_FSETXATTR		AUE_NULL
-#define	AUE_FSTATEXTENDED	AUE_NULL
 #define	AUE_FSTATFS64		AUE_NULL
 #define	AUE_FSTATV		AUE_NULL
 #define	AUE_FSTAT64		AUE_NULL
-#define	AUE_FSTAT64EXTENDED	AUE_NULL
+#define	AUE_FSTAT64_EXTENDED	AUE_NULL
 #define	AUE_GCCONTROL		AUE_NULL
 #define	AUE_GETDIRENTRIES64	AUE_NULL
 #define	AUE_GETDTABLESIZE	AUE_NULL
@@ -721,21 +719,15 @@
 #define	AUE_ISSETUGID		AUE_NULL
 #define	AUE_LIOLISTIO		AUE_NULL
 #define	AUE_LISTXATTR		AUE_NULL
-#define	AUE_LSTATEXTENDED	AUE_NULL
 #define	AUE_LSTATV		AUE_NULL
 #define	AUE_LSTAT64		AUE_NULL
-#define	AUE_LSTAT64EXTENDED	AUE_NULL
+#define	AUE_LSTAT64_EXTENDED	AUE_NULL
 #define	AUE_MADVISE		AUE_NULL
 #define	AUE_MINCORE		AUE_NULL
 #define	AUE_MKCOMPLEX		AUE_NULL
-#define	AUE_MKDIREXTENDED	AUE_NULL
-#define	AUE_MKFIFOEXTENDED	AUE_NULL
 #define	AUE_MODWATCH		AUE_NULL
 #define	AUE_MSGCL		AUE_NULL
 #define	AUE_MSYNC		AUE_NULL
-#define	AUE_OPENEXTENDED	AUE_NULL
-#define	AUE_PREAD		AUE_NULL
-#define	AUE_PWRITE		AUE_NULL
 #define	AUE_PREADV		AUE_NULL
 #define	AUE_PROCINFO		AUE_NULL
 #define	AUE_PTHREADCANCELED	AUE_NULL
@@ -779,15 +771,13 @@
 #define	AUE_SIGWAIT		AUE_NULL
 #define	AUE_SSTK		AUE_NULL
 #define	AUE_STACKSNAPSHOT	AUE_NULL
-#define	AUE_STATEXTENDED	AUE_NULL
 #define	AUE_STATFS64		AUE_NULL
 #define	AUE_STATV		AUE_NULL
 #define	AUE_STAT64		AUE_NULL
-#define	AUE_STAT64EXTENDED	AUE_NULL
+#define	AUE_STAT64_EXTENDED	AUE_NULL
 #define	AUE_SYNC		AUE_NULL
 #define	AUE_SYSCALL		AUE_NULL
 #define	AUE_TABLE		AUE_NULL
-#define	AUE_UMASKEXTENDED	AUE_NULL
 #define	AUE_VMPRESSUREMONITOR	AUE_NULL
 #define	AUE_WAITEVENT		AUE_NULL
 #define	AUE_WAITID		AUE_NULL