From 694dcf49ac5cf33f6cbf6e1a4687a1eb9a2dc0ce Mon Sep 17 00:00:00 2001 From: Robert Watson Date: Mon, 2 Mar 2009 10:46:23 +0000 Subject: Vendor import of OpenBSM 1.1 beta1, which incorporates the following changes since the last imported OpenBSM release: OpenBSM 1.1 beta 1 - The filesz parameter in audit_control(5) now accepts suffixes: 'B' for Bytes, 'K' for Kilobytes, 'M' for Megabytes, and 'G' for Gigabytes. For legacy support no suffix defaults to bytes. - Audit trail log expiration support added. It is configured in audit_control(5) with the expire-after parameter. If there is no expire-after parameter in audit_control(5), the default, then the audit trail files are not expired and removed. See audit_control(5) for more information. - Change defaults in audit_control: warn at 5% rather than 20% free for audit partitions, rotate automatically at 2mb, and set the default policy to cnt,argv rather than cnt so that execve(2) arguments are captured if AUE_EXECVE events are audited. These may provide more usable defaults for many users. - Use au_domain_to_bsm(3) and au_socket_type_to_bsm(3) to convert au_to_socket_ex(3) arguments to BSM format. - Fix error encoding AUT_IPC_PERM tokens. Obtained from: TrustedBSD Project Sponsored by: Apple Inc. --- sys/bsm/audit.h | 7 ++++--- sys/bsm/audit_kevents.h | 22 ++++++---------------- 2 files changed, 10 insertions(+), 19 deletions(-) (limited to 'sys/bsm') diff --git a/sys/bsm/audit.h b/sys/bsm/audit.h index 3b22b033635e..b39de0a6a6d4 100644 --- a/sys/bsm/audit.h +++ b/sys/bsm/audit.h @@ -26,7 +26,7 @@ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. * - * $P4: //depot/projects/trustedbsd/openbsm/sys/bsm/audit.h#4 $ + * $P4: //depot/projects/trustedbsd/openbsm/sys/bsm/audit.h#5 $ */ #ifndef _BSM_AUDIT_H @@ -65,8 +65,9 @@ #define AUDIT_TRIGGER_CLOSE_AND_DIE 4 /* Terminate audit. */ #define AUDIT_TRIGGER_NO_SPACE 5 /* Below min free space. */ #define AUDIT_TRIGGER_ROTATE_USER 6 /* User requests rotate. */ -#define AUDIT_TRIGGER_INITIALIZE 7 /* Initialize audit. */ -#define AUDIT_TRIGGER_MAX 7 +#define AUDIT_TRIGGER_INITIALIZE 7 /* User initialize of auditd. */ +#define AUDIT_TRIGGER_EXPIRE_TRAILS 8 /* User expiration of trails. */ +#define AUDIT_TRIGGER_MAX 8 /* * The special device filename (FreeBSD). diff --git a/sys/bsm/audit_kevents.h b/sys/bsm/audit_kevents.h index 57351b5ea7b9..a86621cdb8ae 100644 --- a/sys/bsm/audit_kevents.h +++ b/sys/bsm/audit_kevents.h @@ -26,7 +26,7 @@ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. * - * $P4: //depot/projects/trustedbsd/openbsm/sys/bsm/audit_kevents.h#4 $ + * $P4: //depot/projects/trustedbsd/openbsm/sys/bsm/audit_kevents.h#5 $ */ #ifndef _BSM_AUDIT_KEVENTS_H_ @@ -586,6 +586,8 @@ #define AUE_CAP_GETMODE 43189 /* TrustedBSD. */ #define AUE_POSIX_SPAWN 43190 /* Darwin. */ #define AUE_FSGETPATH 43191 /* Darwin. */ +#define AUE_PREAD 43192 /* Darwin/FreeBSD. */ +#define AUE_PWRITE 43193 /* Darwin/FreeBSD. */ /* * Darwin BSM uses a number of AUE_O_* definitions, which are aliased to the @@ -657,7 +659,6 @@ /* * Possible desired future values based on review of BSD/Darwin system calls. */ -#define AUE_ACCESSEXTENDED AUE_NULL #define AUE_ATGETMSG AUE_NULL #define AUE_ATPUTMSG AUE_NULL #define AUE_ATSOCKET AUE_NULL @@ -668,11 +669,9 @@ #define AUE_BSDTHREADCREATE AUE_NULL #define AUE_BSDTHREADTERMINATE AUE_NULL #define AUE_BSDTHREADREGISTER AUE_NULL -#define AUE_CHMODEXTENDED AUE_NULL #define AUE_CHUD AUE_NULL #define AUE_CSOPS AUE_NULL #define AUE_DUP AUE_NULL -#define AUE_FCHMODEXTENDED AUE_NULL #define AUE_FDATASYNC AUE_NULL #define AUE_FFSCTL AUE_NULL #define AUE_FGETATTRLIST AUE_NULL @@ -682,11 +681,10 @@ #define AUE_FSCTL AUE_NULL #define AUE_FSETATTRLIST AUE_NULL #define AUE_FSETXATTR AUE_NULL -#define AUE_FSTATEXTENDED AUE_NULL #define AUE_FSTATFS64 AUE_NULL #define AUE_FSTATV AUE_NULL #define AUE_FSTAT64 AUE_NULL -#define AUE_FSTAT64EXTENDED AUE_NULL +#define AUE_FSTAT64_EXTENDED AUE_NULL #define AUE_GCCONTROL AUE_NULL #define AUE_GETDIRENTRIES64 AUE_NULL #define AUE_GETDTABLESIZE AUE_NULL @@ -720,21 +718,15 @@ #define AUE_ISSETUGID AUE_NULL #define AUE_LIOLISTIO AUE_NULL #define AUE_LISTXATTR AUE_NULL -#define AUE_LSTATEXTENDED AUE_NULL #define AUE_LSTATV AUE_NULL #define AUE_LSTAT64 AUE_NULL -#define AUE_LSTAT64EXTENDED AUE_NULL +#define AUE_LSTAT64_EXTENDED AUE_NULL #define AUE_MADVISE AUE_NULL #define AUE_MINCORE AUE_NULL #define AUE_MKCOMPLEX AUE_NULL -#define AUE_MKDIREXTENDED AUE_NULL -#define AUE_MKFIFOEXTENDED AUE_NULL #define AUE_MODWATCH AUE_NULL #define AUE_MSGCL AUE_NULL #define AUE_MSYNC AUE_NULL -#define AUE_OPENEXTENDED AUE_NULL -#define AUE_PREAD AUE_NULL -#define AUE_PWRITE AUE_NULL #define AUE_PREADV AUE_NULL #define AUE_PROCINFO AUE_NULL #define AUE_PTHREADCANCELED AUE_NULL @@ -778,15 +770,13 @@ #define AUE_SIGWAIT AUE_NULL #define AUE_SSTK AUE_NULL #define AUE_STACKSNAPSHOT AUE_NULL -#define AUE_STATEXTENDED AUE_NULL #define AUE_STATFS64 AUE_NULL #define AUE_STATV AUE_NULL #define AUE_STAT64 AUE_NULL -#define AUE_STAT64EXTENDED AUE_NULL +#define AUE_STAT64_EXTENDED AUE_NULL #define AUE_SYNC AUE_NULL #define AUE_SYSCALL AUE_NULL #define AUE_TABLE AUE_NULL -#define AUE_UMASKEXTENDED AUE_NULL #define AUE_VMPRESSUREMONITOR AUE_NULL #define AUE_WAITEVENT AUE_NULL #define AUE_WAITID AUE_NULL -- cgit v1.2.3