aboutsummaryrefslogtreecommitdiff
path: root/contrib/openbsm
Commit message (Collapse)AuthorAgeFilesLines
* close_range: add audit supportAlex Richardson2021-02-232-0/+4
| | | | | | | | | | | | | This fixes the closefrom test in sys/audit. Includes cherry-picks of the following commits from openbsm: https://github.com/openbsm/openbsm/commit/4dfc628aafe589d68848f7033f3d3488c4d979e0 https://github.com/openbsm/openbsm/commit/99ff6fe32aebc5a4b8d40d60062b8574697df557 https://github.com/openbsm/openbsm/commit/da48a0399e95448693d3fa2be48454ca564c1be8 Reviewed By: kevans Differential Revision: https://reviews.freebsd.org/D28388
* Fixup some incorrect information and some comments. These changesChristian S.J. Peron2020-07-2812-17/+21
| | | | | | | | | | | | | | were cherry picked up the upstream OpenBSD repository. At some point we will look at doing another import, but the diffs are substantial and will require some careful testing. Differential Revision: https://reviews.freebsd.org/D25021 MFC after: 2 weeks Submitted by: gbe Reviewed by: myself, bcr Notes: svn path=/head/; revision=363655
* libauditd: make it a PRIVATELIBAlan Somers2020-04-191-2/+1
| | | | | | | | | | | | | | According to the upstream man page (which we don't install), none of libauditd's symbols are intended to be public. Also, I can't find any evidence for a port that uses libauditd. Therefore, we should treat it like other such libraries and use PRIVATELIB. Reported by: phk Reviewed by: cem, emaste MFC after: 2 weeks Notes: svn path=/head/; revision=360088
* MFV r359401: OpenBSM: import ee79d73e8df5: auditreduce: add a zone filterKyle Evans2020-03-283-2/+37
|\ | | | | | | | | | | | | | | | | | | This allows one to select audit records that match a -z zone glob. MFC after: 1 week Sponsored by: Modirum MDPay, Klara Systems Notes: svn path=/head/; revision=359402
* | auditd(8): fix long-standing uninitialized memory use bugConrad Meyer2019-11-281-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The bogus use could lead to an infinite loop depending on how fast the audit_warn script to execute. By fixing read(2) interruptibility, d060887 (r335899) revealed another bug in auditd_wait_for_events. When read is interrupted by SIGCHLD, auditd_reap_children will always return with errno set to ECHILD. But auditd_wait_for_events checks errno after that point, expecting it to be unchanged since read. As a result, it calls auditd_handle_trigger with bogus stack garbage. The result is the error message "Got unknown trigger 48." Fix by simply ignoring errno at that point; there's only one value it could've possibly had, thanks to the check up above. The best part is we've had a fix for this for like 18 months and just never merged it. Merge it now. PR: 234209 Reported by: Marie Helene Kvello-Aune <freebsd AT mhka.no> (2018-12) Submitted by: asomers (2018-07) Reviewed by: me (in OpenBSM) Obtained from: OpenBSM X-MFC-With: r335899 Security: ¯\_(ツ)_/¯ Differential Revision: https://github.com/openbsm/openbsm/pull/45 Notes: svn path=/head/; revision=355155
* | Jail and capability mode for shm_rename; add audit support for shm_renameDavid Bright2019-11-182-6/+26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Co-mingling two things here: * Addressing some feedback from Konstantin and Kyle re: jail, capability mode, and a few other things * Adding audit support as promised. The audit support change includes a partial refresh of OpenBSM from upstream, where the change to add shm_rename has already been accepted. Matthew doesn't plan to work on refreshing anything else to support audit for those new event types. Submitted by: Matthew Bryan <matthew.bryan@isilon.com> Reviewed by: kib Relnotes: Yes Sponsored by: Dell EMC Isilon Differential Revision: https://reviews.freebsd.org/D22083 Notes: svn path=/head/; revision=354808
* | Create new EINTEGRITY error with message "Integrity check failed".Kirk McKusick2019-01-172-0/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | An integrity check such as a check-hash or a cross-correlation failed. The integrity error falls between EINVAL that identifies errors in parameters to a system call and EIO that identifies errors with the underlying storage media. EINTEGRITY is typically raised by intermediate kernel layers such as a filesystem or an in-kernel GEOM subsystem when they detect inconsistencies. Uses include allowing the mount(8) command to return a different exit value to automate the running of fsck(8) during a system boot. These changes make no use of the new error, they just add it. Later commits will be made for the use of the new error number and it will be added to additional manual pages as appropriate. Reviewed by: gnn, dim, brueffer, imp Discussed with: kib, cem, emaste, ed, jilles Differential Revision: https://reviews.freebsd.org/D18765 Notes: svn path=/head/; revision=343111
* | In r316006 the getstrfromtype_locked() function was modified to returnPawel Jakub Dawidek2019-01-091-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | an empty string, instead of NULL, if an entry is missing in the audit_control file. Because of that change the getachost() function started to return success even if the host name was not defined in the audit_control. This in turn led to auditd_hostlen always being set (for an empty host it was set to 0). If auditd_hostlen was not equal to -1 we were trying to append the host name to trail file name. All this led to situation where when host name is not defined in audit_control, auditd will create trail files with a leading '.', which breaks auditdistd as it doesn't work with longer audit trail file names. Fix this by appending host name to the trail file name only if the host name is not empty. Notes: svn path=/head/; revision=342873
* | Consider the following situation:Pawel Jakub Dawidek2018-12-071-1/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The sender has .not_terminated file. It gets disconnected. The last trail file is then terminated without adding new data (this can happen for example when auditd is being stopped on the sender). After reconnect the .not_terminated was not renamed on the receiver as it should. We were already handling similar situation where the sender crashed and the .not_terminated trail file was renamed to .crash_recovery. Extend this case to handle the situation above. Notes: svn path=/head/; revision=341675
* | MFH r338661 through r339200.Glen Barber2018-10-054-24/+50
|\ \ | | | | | | | | | | | | | | | | | | Sponsored by: The FreeBSD Foundation Notes: svn path=/projects/openssl111/; revision=339201
| * | Remove invalid comments and correct some typos.Pawel Jakub Dawidek2018-10-042-9/+2
| | | | | | | | | | | | | | | | | | | | | Approved by: re (kib) Notes: svn path=/head/; revision=339178
| * | When the adist_free list is empty and we lose connection to the receiver wePawel Jakub Dawidek2018-10-042-9/+21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | move all elements from the adist_send and adist_recv lists back onto the adist_free list, but we don't wake consumers waitings for the adist_free list to become non-empty. This can lead to the sender process stopping audit trail files distribution and waiting forever. Fix the problem by adding the missing wakeup. While here slow down spinning on CPU in case of a short race in sender_disconnect() and add an explaination when it can occur. PR: 201953 Reported by: peter Approved by: re (kib) Notes: svn path=/head/; revision=339177
| * | When we look for a new trail file there might be a race between find trailPawel Jakub Dawidek2018-10-041-6/+27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | file name and opening it. This race was not properly handled, because we were copying new name before checking for openat(2) error and when we were trying again we were starting with the next trail file. This could result in skipping distribution of such a trail file. Fix this problem by checking for ENOENT first (only for .not_terminated files) and then updating (or not) tr_filename before restarting the search. PR: 200139 Reported by: peter Approved by: re (kib) Notes: svn path=/head/; revision=339176
* | | Make auditdistd(8) buildable.Jung-uk Kim2018-09-191-2/+2
|/ / | | | | | | Notes: svn path=/projects/openssl111/; revision=338772
* | auditd(8): Log a better error when no hostname is set in audit_controlAlan Somers2018-07-221-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | Cherry-pick from https://github.com/openbsm/openbsm/commit/01ba03b Reviewed by: cem Obtained from: OpenBSM MFC after: 2 weeks Pull Request: https://github.com/openbsm/openbsm/pull/38 Notes: svn path=/head/; revision=336613
* | auditd(8): register signal handlers interrutiblyAlan Somers2018-07-031-4/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | auditd_wait_for_events() relies on read(2) being interrupted by signals, but it registers signal handlers with signal(3), which sets SA_RESTART. That breaks asynchronous signal handling. It means that signals don't actually get handled until after an audit(8) trigger is received. Symptoms include: * Sending SIGTERM to auditd doesn't kill it right away; you must send SIGTERM and then send a trigger with auditon(2). * Same with SIGHUP * Zombie child processes don't get reaped until auditd receives a trigger sent by auditon. This includes children created by expiring audit trails at auditd startup. Fix by using sigaction(2) instead of signal(3). Cherry pick https://github.com/openbsm/openbsm/commit/d060887 PR: 229381 Reviewed by: cem Obtained from: OpenBSM MFC after: 2 weeks Differential Revision: https://github.com/openbsm/openbsm/pull/36 Notes: svn path=/head/; revision=335899
* | praudit(1): return 0 on successAlan Somers2018-06-172-2/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Cherry pick https://github.com/openbsm/openbsm/commit/ed83bb3 Submitted by: aniketp Reviewed by: rwatson, 0mp Obtained from: OpenBSM MFC after: 2 weeks Sponsored by: Google, Inc. (GSoC 2018) Pull Request: https://github.com/openbsm/openbsm/pull/32 Notes: svn path=/head/; revision=335287
* | au_read_rec(3): correct return value in man pageAlan Somers2018-05-301-7/+7
| | | | | | | | | | | | | | | | | | | | | | Submitted by: aniketp Reviewed by: csjp (earlier version) MFC after: 2 weeks Sponsored by: Google, Inc. (GSoC 2018) Differential Revision: https://reviews.freebsd.org/D15618 Notes: svn path=/head/; revision=334390
* | Fix OpenBSM with GCC with -Wredundant-declsAlan Somers2018-05-301-15/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Upstream change ed47534 consciously added some redundant functional declarations, and I'm not sure why. AFAICT they were never required. On FreeBSD, they break the build with GCC (but not Clang) for any program including libbsm.h with WARNS=6. Fix by cherry-picking upstream change https://github.com/openbsm/openbsm/commit/0553c27 Reported by: emaste Reviewed by: cem Obtained from: OpenBSM MFC after: 2 weeks Pull Request: https://github.com/openbsm/openbsm/pull/31 Notes: svn path=/head/; revision=334388
* | Commit the 64-bit inode project.Konstantin Belousov2017-05-231-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Extend the ino_t, dev_t, nlink_t types to 64-bit ints. Modify struct dirent layout to add d_off, increase the size of d_fileno to 64-bits, increase the size of d_namlen to 16-bits, and change the required alignment. Increase struct statfs f_mntfromname[] and f_mntonname[] array length MNAMELEN to 1024. ABI breakage is mitigated by providing compatibility using versioned symbols, ingenious use of the existing padding in structures, and by employing other tricks. Unfortunately, not everything can be fixed, especially outside the base system. For instance, third-party APIs which pass struct stat around are broken in backward and forward incompatible ways. Kinfo sysctl MIBs ABI is changed in backward-compatible way, but there is no general mechanism to handle other sysctl MIBS which return structures where the layout has changed. It was considered that the breakage is either in the management interfaces, where we usually allow ABI slip, or is not important. Struct xvnode changed layout, no compat shims are provided. For struct xtty, dev_t tty device member was reduced to uint32_t. It was decided that keeping ABI compat in this case is more useful than reporting 64-bit dev_t, for the sake of pstat. Update note: strictly follow the instructions in UPDATING. Build and install the new kernel with COMPAT_FREEBSD11 option enabled, then reboot, and only then install new world. Credits: The 64-bit inode project, also known as ino64, started life many years ago as a project by Gleb Kurtsou (gleb). Kirk McKusick (mckusick) then picked up and updated the patch, and acted as a flag-waver. Feedback, suggestions, and discussions were carried by Ed Maste (emaste), John Baldwin (jhb), Jilles Tjoelker (jilles), and Rick Macklem (rmacklem). Kris Moore (kris) performed an initial ports investigation followed by an exp-run by Antoine Brodin (antoine). Essential and all-embracing testing was done by Peter Holm (pho). The heavy lifting of coordinating all these efforts and bringing the project to completion were done by Konstantin Belousov (kib). Sponsored by: The FreeBSD Foundation (emaste, kib) Differential revision: https://reviews.freebsd.org/D10439 Notes: svn path=/head/; revision=318736
* | Merge OpenBSM 1.2-alpha5 from vendor branch to FreeBSD -CURRENT:Robert Watson2017-03-2658-14992/+10953
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - Add a new "qsize" parameter in audit_control and the getacqsize(3) API to query it, allowing to set the kernel's maximum audit queue length. - Add support to push a mapping between audit event names and event numbers into the kernel (where supported) using new A_GETEVENT and A_SETEVENT auditon(2) operations. - Add audit event identifiers for a number of new (and not-so-new) FreeBSD system calls including those for asynchronous I/O, thread management, SCTP, jails, multi-FIB support, and misc. POSIX interfaces such as posix_fallocate(2) and posix_fadvise(2). - On operating systems supporting Capsicum, auditreduce(1) and praudit(1) now run sandboxed. - Empty "flags" and "naflags" fields are now permitted in audit_control(5). Many thanks to Christian Brueffer for producing the OpenBSM release and importing/tagging it in the vendor branch. This release will allow improved auditing of a range of new FreeBSD functionality, as well as non-traditional events (e.g., fine-grained I/O auditing) not required by the Orange Book or Common Criteria. Obtained from: TrustedBSD Project Sponsored by: DARPA, AFRL MFC after: 3 weeks Notes: svn path=/head/; revision=316006
* | Renumber copyright clause 4Warner Losh2017-02-282-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | Renumber cluase 4 to 3, per what everybody else did when BSD granted them permission to remove clause 3. My insistance on keeping the same numbering for legal reasons is too pedantic, so give up on that point. Submitted by: Jan Schaumann <jschauma@stevens.edu> Pull Request: https://github.com/freebsd/freebsd/pull/96 Notes: svn path=/head/; revision=314436
* | auditdistd: update for sys/capability.h rename in r263232Ed Maste2016-09-201-1/+1
| | | | | | | | Notes: svn path=/head/; revision=306023
* | Regenerate config.h for OpenBSM 1.2 alpha 4.Christian Brueffer2015-12-181-4/+4
| | | | | | | | | | | | | | MFC after: 2 weeks Notes: svn path=/head/; revision=292433
* | Merge OpenBSM 1.2 alpha 4.Christian Brueffer2015-12-18160-451/+525
|\| | | | | | | | | | | | | | | MFC after: 2 weeks Relnotes: yes Notes: svn path=/head/; revision=292432
* | Fix descriptors leak.Pawel Jakub Dawidek2014-09-141-0/+5
| | | | | | | | | | | | | | | | | | PR: bin/191002 Reported by: Ryan Steinmetz Submitted by: mjg Notes: svn path=/head/; revision=271577
* | Unlock the right lock.Ed Schouten2014-08-281-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The adist_remote_lock is not held in this place, whereas the adist_recv_list_lock lock is and is picked up during the next iteration. I found this by annotating our libpthread with Clang's -Wthread-safety attributes. I will send out a patch for this in the nearby future, because it's awesome. MFC after: 2 weeks Notes: svn path=/head/; revision=270749
* | MFp4: change 1191346Christian Brueffer2014-06-141-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | In print_header32_tok(), correct printing in the XML case. This lead to invalid XML files before. PR: 176259 Submitted by: zi MFC after: 3 days Notes: svn path=/head/; revision=267478
* | Remove weirdly-named autofoo file. This is not needed for the (FreeBSD)Colin Percival2013-07-221-98/+0
| | | | | | | | | | | | | | | | | | | | | | | | build, and freebsd-update chokes on it. 9.2-RELEASE candidate. Approved by: rwatson MFC after: 3 days Notes: svn path=/head/; revision=253541
* | Work around build breakages with GCC 4.2.Jung-uk Kim2013-05-231-0/+1
| | | | | | | | | | | | | | Reported by: tinderbox Notes: svn path=/head/; revision=250926
* | Implement chflagsat(2) system call, similar to fchmodat(2), but operates onPawel Jakub Dawidek2013-03-211-0/+1
| | | | | | | | | | | | | | | | | | | | file flags. Reviewed by: kib, jilles Sponsored by: The FreeBSD Foundation Notes: svn path=/head/; revision=248599
* | - Implement two new system calls:Pawel Jakub Dawidek2013-03-021-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | int bindat(int fd, int s, const struct sockaddr *addr, socklen_t addrlen); int connectat(int fd, int s, const struct sockaddr *name, socklen_t namelen); which allow to bind and connect respectively to a UNIX domain socket with a path relative to the directory associated with the given file descriptor 'fd'. - Add manual pages for the new syscalls. - Make the new syscalls available for processes in capability mode sandbox. - Add capability rights CAP_BINDAT and CAP_CONNECTAT that has to be present on the directory descriptor for the syscalls to work. - Update audit(4) to support those two new syscalls and to handle path in sockaddr_un structure relative to the given directory descriptor. - Update procstat(1) to recognize the new capability rights. - Document the new capability rights in cap_rights_limit(2). Sponsored by: The FreeBSD Foundation Discussed with: rwatson, jilles, kib, des Notes: svn path=/head/; revision=247667
* | Merge Capsicum overhaul:Pawel Jakub Dawidek2013-03-021-1/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - Capability is no longer separate descriptor type. Now every descriptor has set of its own capability rights. - The cap_new(2) system call is left, but it is no longer documented and should not be used in new code. - The new syscall cap_rights_limit(2) should be used instead of cap_new(2), which limits capability rights of the given descriptor without creating a new one. - The cap_getrights(2) syscall is renamed to cap_rights_get(2). - If CAP_IOCTL capability right is present we can further reduce allowed ioctls list with the new cap_ioctls_limit(2) syscall. List of allowed ioctls can be retrived with cap_ioctls_get(2) syscall. - If CAP_FCNTL capability right is present we can further reduce fcntls that can be used with the new cap_fcntls_limit(2) syscall and retrive them with cap_fcntls_get(2). - To support ioctl and fcntl white-listing the filedesc structure was heavly modified. - The audit subsystem, kdump and procstat tools were updated to recognize new syscalls. - Capability rights were revised and eventhough I tried hard to provide backward API and ABI compatibility there are some incompatible changes that are described in detail below: CAP_CREATE old behaviour: - Allow for openat(2)+O_CREAT. - Allow for linkat(2). - Allow for symlinkat(2). CAP_CREATE new behaviour: - Allow for openat(2)+O_CREAT. Added CAP_LINKAT: - Allow for linkat(2). ABI: Reuses CAP_RMDIR bit. - Allow to be target for renameat(2). Added CAP_SYMLINKAT: - Allow for symlinkat(2). Removed CAP_DELETE. Old behaviour: - Allow for unlinkat(2) when removing non-directory object. - Allow to be source for renameat(2). Removed CAP_RMDIR. Old behaviour: - Allow for unlinkat(2) when removing directory. Added CAP_RENAMEAT: - Required for source directory for the renameat(2) syscall. Added CAP_UNLINKAT (effectively it replaces CAP_DELETE and CAP_RMDIR): - Allow for unlinkat(2) on any object. - Required if target of renameat(2) exists and will be removed by this call. Removed CAP_MAPEXEC. CAP_MMAP old behaviour: - Allow for mmap(2) with any combination of PROT_NONE, PROT_READ and PROT_WRITE. CAP_MMAP new behaviour: - Allow for mmap(2)+PROT_NONE. Added CAP_MMAP_R: - Allow for mmap(PROT_READ). Added CAP_MMAP_W: - Allow for mmap(PROT_WRITE). Added CAP_MMAP_X: - Allow for mmap(PROT_EXEC). Added CAP_MMAP_RW: - Allow for mmap(PROT_READ | PROT_WRITE). Added CAP_MMAP_RX: - Allow for mmap(PROT_READ | PROT_EXEC). Added CAP_MMAP_WX: - Allow for mmap(PROT_WRITE | PROT_EXEC). Added CAP_MMAP_RWX: - Allow for mmap(PROT_READ | PROT_WRITE | PROT_EXEC). Renamed CAP_MKDIR to CAP_MKDIRAT. Renamed CAP_MKFIFO to CAP_MKFIFOAT. Renamed CAP_MKNODE to CAP_MKNODEAT. CAP_READ old behaviour: - Allow pread(2). - Disallow read(2), readv(2) (if there is no CAP_SEEK). CAP_READ new behaviour: - Allow read(2), readv(2). - Disallow pread(2) (CAP_SEEK was also required). CAP_WRITE old behaviour: - Allow pwrite(2). - Disallow write(2), writev(2) (if there is no CAP_SEEK). CAP_WRITE new behaviour: - Allow write(2), writev(2). - Disallow pwrite(2) (CAP_SEEK was also required). Added convinient defines: #define CAP_PREAD (CAP_SEEK | CAP_READ) #define CAP_PWRITE (CAP_SEEK | CAP_WRITE) #define CAP_MMAP_R (CAP_MMAP | CAP_SEEK | CAP_READ) #define CAP_MMAP_W (CAP_MMAP | CAP_SEEK | CAP_WRITE) #define CAP_MMAP_X (CAP_MMAP | CAP_SEEK | 0x0000000000000008ULL) #define CAP_MMAP_RW (CAP_MMAP_R | CAP_MMAP_W) #define CAP_MMAP_RX (CAP_MMAP_R | CAP_MMAP_X) #define CAP_MMAP_WX (CAP_MMAP_W | CAP_MMAP_X) #define CAP_MMAP_RWX (CAP_MMAP_R | CAP_MMAP_W | CAP_MMAP_X) #define CAP_RECV CAP_READ #define CAP_SEND CAP_WRITE #define CAP_SOCK_CLIENT \ (CAP_CONNECT | CAP_GETPEERNAME | CAP_GETSOCKNAME | CAP_GETSOCKOPT | \ CAP_PEELOFF | CAP_RECV | CAP_SEND | CAP_SETSOCKOPT | CAP_SHUTDOWN) #define CAP_SOCK_SERVER \ (CAP_ACCEPT | CAP_BIND | CAP_GETPEERNAME | CAP_GETSOCKNAME | \ CAP_GETSOCKOPT | CAP_LISTEN | CAP_PEELOFF | CAP_RECV | CAP_SEND | \ CAP_SETSOCKOPT | CAP_SHUTDOWN) Added defines for backward API compatibility: #define CAP_MAPEXEC CAP_MMAP_X #define CAP_DELETE CAP_UNLINKAT #define CAP_MKDIR CAP_MKDIRAT #define CAP_RMDIR CAP_UNLINKAT #define CAP_MKFIFO CAP_MKFIFOAT #define CAP_MKNOD CAP_MKNODAT #define CAP_SOCK_ALL (CAP_SOCK_CLIENT | CAP_SOCK_SERVER) Sponsored by: The FreeBSD Foundation Reviewed by: Christoph Mallon <christoph.mallon@gmx.de> Many aspects discussed with: rwatson, benl, jonathan ABI compatibility discussed with: kib Notes: svn path=/head/; revision=247602
* | When we are waiting for new trail files we may have been disconnected andPawel Jakub Dawidek2013-02-281-0/+9
| | | | | | | | | | | | | | | | | | | | reconnected in the meantime. Check if reset is set before opening next trail file, as not doing so will result in sending OPEN message with the same file name twice and this is illegal - the second OPEN is send without first closing previous trail file. Notes: svn path=/head/; revision=247442
* | Allow [] in remote address, which fixes IPv6 support.Pawel Jakub Dawidek2013-02-181-1/+1
| | | | | | | | | | | | | | Reported by: simon Notes: svn path=/head/; revision=246925
* | Merge OpenBSM 1.2-alpha3 from the vendor branch to 10-CURRENT; this versionRobert Watson2012-12-1510-35/+49
|\| | | | | | | | | | | | | | | | | | | | | included various upstreamed patches from the FreeBSD base to make OpenBSM compile more easily with bmake, higher warning levels, clang, and several other loose ends. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=244265
* | Merge OpenBSM 1.2-alpha2 from vendor branch to FreeBSD 10-CURRENT; theRobert Watson2012-12-01128-28224/+46506
|\| | | | | | | | | | | | | | | | | | | primary new feature is auditdistd. Obtained from: TrustedBSD Project Sponsored by: The FreeBSD Foundation (auditdistd) Notes: svn path=/head/; revision=243750
* | Merge a local fix to OpenBSM's libauditd to avoid a directory descriptorRobert Watson2012-04-081-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | leak when iterating over possible audit trail directories. This fix will be merged upstream in an identical form, but hasn't yet appeared in an OpenBSM release. Submitted by: guido Obtained from: TrustedBSD Project MFC after: 3 days Notes: svn path=/head/; revision=234034
* | [mdoc] Fixed .Dt call.Ruslan Ermilov2011-05-251-1/+1
| | | | | | | | Notes: svn path=/head/; revision=222286
* | Import OpenBSM 1.1p2 from vendor branch to 8-CURRENT. This patch releaseRobert Watson2009-08-028-27/+34
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | addresses several minor issues: - Fix audit_event definitions of AUE_OPENAT_RWT and AUE_OPENAT_RWTC. - Fix build on Linux. - Fix printing of class masks in the audump tool. MFC after: 3 weeks Obtained from: TrustedBSD Project Approved by: re (kib) Notes: svn path=/head/; revision=196031
* | Import OpenBSM 1.1p1 from vendor branch to 8-CURRENT, populatingRobert Watson2009-07-1714-54/+193
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | contrib/openbsm and a subset also imported into sys/security/audit. This patch release addresses several minor issues: - Fixes to AUT_SOCKUNIX token parsing. - IPv6 support for au_to_me(3). - Improved robustness in the parsing of audit_control, especially long flags/naflags strings and whitespace in all fields. - Add missing conversion of a number of FreeBSD/Mac OS X errnos to/from BSM error number space. MFC after: 3 weeks Obtained from: TrustedBSD Project Sponsored by: Apple, Inc. Approved by: re (kib) Notes: svn path=/head/; revision=195740
* | Merge OpenBSM 1.1 from OpenBSM vendor branch to head.Robert Watson2009-04-1960-2902/+4971
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | OpenBSM history for imported revision below for reference. MFC after: 2 weeks Sponsored by: Apple, Inc. Obtained from: TrustedBSD Project OpenBSM 1.1 - Change auditon(2) parameters and data structures to be 32/64-bit architecture independent. Add more information to man page about auditon(2) parameters. - Add wrapper functions for auditon(2) to use legacy commands when the new commands are not supported. - Add default for 'expire-after' in audit_control to expire trail files when the audit directory is more than 10 megabytes ('10M'). - Interface to convert between local and BSM fcntl(2) command values has been added: au_bsm_to_fcntl_cmd(3) and au_fcntl_cmd_to_bsm(3), along with definitions of constants in audit_fcntl.h. - A bug, introduced in OpenBSM 1.1 alpha 4, in which AUT_RETURN32 tokens generated by audit_submit(3) were improperly encoded has been fixed. - Fix example in audit_submit(3) man page. Also, make it clear that we want the audit ID as the argument. - A new audit event class 'aa', for post-login authentication and authorization events, has been added. Notes: svn path=/head/; revision=191273
* | Update config.h for OpenBSM 1.1 beta1.Robert Watson2009-03-031-3/+3
| | | | | | | | | | | | | | MFC after: 1 month Notes: svn path=/head/; revision=189301
* | Merge OpenBSM 1.1 beta 1 from OpenBSM vendor branch to head, bothRobert Watson2009-03-0228-289/+890
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | contrib/openbsm (svn merge) and src/sys/{bsm,security/audit} (manual merge). OpenBSM history for imported revision below for reference. MFC after: 1 month Sponsored by: Apple, Inc. Obtained from: TrustedBSD Project OpenBSM 1.1 beta 1 - The filesz parameter in audit_control(5) now accepts suffixes: 'B' for Bytes, 'K' for Kilobytes, 'M' for Megabytes, and 'G' for Gigabytes. For legacy support no suffix defaults to bytes. - Audit trail log expiration support added. It is configured in audit_control(5) with the expire-after parameter. If there is no expire-after parameter in audit_control(5), the default, then the audit trail files are not expired and removed. See audit_control(5) for more information. - Change defaults in audit_control: warn at 5% rather than 20% free for audit partitions, rotate automatically at 2mb, and set the default policy to cnt,argv rather than cnt so that execve(2) arguments are captured if AUE_EXECVE events are audited. These may provide more usable defaults for many users. - Use au_domain_to_bsm(3) and au_socket_type_to_bsm(3) to convert au_to_socket_ex(3) arguments to BSM format. - Fix error encoding AUT_IPC_PERM tokens. Notes: svn path=/head/; revision=189279
* | Merge OpenBSM alpha 5 from OpenBSM vendor branch to head, bothRobert Watson2009-01-1493-496/+1665
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | contrib/openbsm (svn merge) and src/sys/{bsm,security/audit} (manual merge). Hook up bsm_domain.c and bsm_socket_type.c to the libbsm build along with man pages, add audit_bsm_domain.c and audit_bsm_socket_type.c to the kernel environment. OpenBSM history for imported revisions below for reference. MFC after: 1 month Sponsored by: Apple Inc. Obtained from: TrustedBSD Project OpenBSM 1.1 alpha 5 - Stub libauditd(3) man page added. - All BSM error number constants with BSM_ERRNO_. - Interfaces to convert between local and BSM socket types and protocol families have been added: au_bsm_to_domain(3), au_bsm_to_socket_type(3), au_domain_to_bsm(3), and au_socket_type_to_bsm(3), along with definitions of constants in audit_domain.h and audit_socket_type.h. This improves interoperability by converting local constant spaces, which vary by OS, to and from Solaris constants (where available) or OpenBSM constants for protocol domains not present in Solaris (a fair number). These routines should be used when generating and interpreting extended socket tokens. - Fix build warnings with full gcc warnings enabled on most supported platforms. - Don't compile error strings into bsm_errno.c when building it in the kernel environment. - When started by launchd, use the label com.apple.auditd rather than org.trustedbsd.auditd. Notes: svn path=/head/; revision=187214
* | Update config.h for OpenBSM 1.1 alpha 4.Robert Watson2008-12-311-3/+9
| | | | | | | | Notes: svn path=/head/; revision=186648
* | Merge OpenBSM alpha 4 from OpenBSM vendor branch to head, bothRobert Watson2008-12-31125-1184/+4893
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | contrib/openbsm (svn merge) and src/sys/{bsm,security/audit} (manual merge). Add libauditd build parts and add to auditd's linkage; force libbsm to build before libauditd. OpenBSM history for imported revisions below for reference. MFC after: 1 month Sponsored by: Apple Inc. Obtained from: TrustedBSD Project OpenBSM 1.1 alpha 4 - With the addition of BSM error number mapping, we also need to map the local error number passed to audit_submit(3) to a BSM error number, rather than have the caller perform that conversion. - Reallocate user audit events to avoid collisions with Solaris; adopt a more formal allocation scheme, and add some events allocated in Solaris that will be of immediate use on other platforms. - Add an event for Calife. - Add au_strerror(3), which allows generating strings for BSM errors directly, rather than requiring applications to map to the local error space, which might not be able to entirely represent the BSM error number space. - Major auditd rewrite for launchd(8) support. Add libauditd library that is shared between launchd and auditd. - Add AUDIT_TRIGGER_INITIALIZE trigger (sent via 'audit -i') for (re)starting auditing under launchd(8) on Mac OS X. - Add 'current' symlink to active audit trail. - Add crash recovery of previous audit trail file when detected on audit startup that it has not been properly terminated. - Add the event AUE_audit_recovery to indicated when an audit trail file has been recovered from not being properly terminated. This event is stored in the new audit trail file and includes the path of recovered audit trail file. - Mac OS X and FreeBSD dependent code in auditd.c is separated into auditd_darwin.c and auditd_fbsd.c files. - Add an event for the posix_spawn(2) and fsgetpath(2) Mac OS X system calls. - For Mac OS X, we use ASL(3) instead of syslog(3) for logging. - Add support for NOTICE level logging. OpenBSM 1.1 alpha 3 - Add two new functions, au_bsm_to_errno() and au_errno_to_bsm(), to map between BSM error numbers (largely the Solaris definitions) and local errno(2) values for 32-bit and 64-bit return tokens. This is required as operating systems don't agree on some of the values of more recent error numbers. - Fix a bug how au_to_exec_args(3) and au_to_exec_env(3) calculates the total size for the token. This buge. - Deprecated Darwin constants, such as TRAILER_PAD_MAGIC, removed. Notes: svn path=/head/; revision=186647
* | Merge OpenBSM 1.1 alpha 2 from the OpenBSM vendor branch to head, bothRobert Watson2008-12-0295-610/+4630
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | contrib/openbsm (svn merge) and sys/{bsm,security/audit} (manual merge). - Add OpenBSM contrib tree to include paths for audit(8) and auditd(8). - Merge support for new tokens, fixes to existing token generation to audit_bsm_token.c. - Synchronize bsm includes and definitions. OpenBSM history for imported revisions below for reference. MFC after: 1 month Sponsored by: Apple Inc. Obtained from: TrustedBSD Project -- OpenBSM 1.1 alpha 2 - Include files in OpenBSM are now broken out into two parts: library builds required solely for user space, and system includes, which may also be required for use in the kernels of systems integrating OpenBSM. Submitted by Stacey Son. - Configure option --with-native-includes allows forcing the use of native include for system includes, rather than the versions bundled with OpenBSM. This is intended specifically for platforms that ship OpenBSM, have adapted versions of the system includes in a kernel source tree, and will use the OpenBSM build infrastructure with an unmodified OpenBSM distribution, allowing the customized system includes to be used with the OpenBSM build. Submitted by Stacey Son. - Various strcpy()'s/strcat()'s have been changed to strlcpy()'s/strlcat()'s or asprintf(). Added compat/strlcpy.h for Linux. - Remove compatibility defines for old Darwin token constant names; now only BSM token names are provided and used. - Add support for extended header tokens, which contain space for information on the host generating the record. - Add support for setting extended host information in the kernel, which is used for setting host information in extended header tokens. The audit_control file now supports a "host" parameter which can be used by auditd to set the information; if not present, the kernel parameters won't be set and auditd uses unextended headers for records that it generates. OpenBSM 1.1 alpha 1 - Add option to auditreduce(1) which allows users to invert sense of matching, such that BSM records that do not match, are selected. - Fix bug in audit_write() where we commit an incomplete record in the event there is an error writing the subject token. This was submitted by Diego Giagio. - Build support for Mac OS X 10.5.1 submitted by Eric Hall. - Fix a bug which resulted in host XML attributes not being arguments so that const strings can be passed as arguments to tokens. This patch was submitted by Xin LI. - Modify the -m option so users can select more then one audit event. - For Mac OS X, added Mach IPC support for audit trigger messages. - Fixed a bug in getacna() which resulted in a locking problem on Mac OS X. - Added LOG_PERROR flag to openlog when -d option is used with auditd. - AUE events added for Mac OS X Leopard system calls. Notes: svn path=/head/; revision=185573
| * Flatten OpenBSM vendor tree in preparation for new OpenBSM vendorRobert Watson2008-11-12175-73781/+0
| | | | | | | | | | | | | | import. Notes: svn path=/vendor/openbsm/dist/; revision=184899
* | Regenerate config.h after import of OpenBSM 1.0.Robert Watson2007-10-291-5/+5
| | | | | | | | | | | | | | Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=173147
generated by cgit v1.2.3 (git 2.25.1) at 2024-09-19 05:33:32 +0000