Merge OpenBSM 1.1 alpha 2 from the OpenBSM vendor branch to head, both

contrib/openbsm (svn merge) and sys/{bsm,security/audit} (manual merge). - Add OpenBSM contrib tree to include paths for audit(8) and auditd(8). - Merge support for new tokens, fixes to existing token generation to audit_bsm_token.c. - Synchronize bsm includes and definitions. OpenBSM history for imported revisions below for reference. MFC after: 1 month Sponsored by: Apple Inc. Obtained from: TrustedBSD Project -- OpenBSM 1.1 alpha 2 - Include files in OpenBSM are now broken out into two parts: library builds required solely for user space, and system includes, which may also be required for use in the kernels of systems integrating OpenBSM. Submitted by Stacey Son. - Configure option --with-native-includes allows forcing the use of native include for system includes, rather than the versions bundled with OpenBSM. This is intended specifically for platforms that ship OpenBSM, have adapted versions of the system includes in a kernel source tree, and will use the OpenBSM build infrastructure with an unmodified OpenBSM distribution, allowing the customized system includes to be used with the OpenBSM build. Submitted by Stacey Son. - Various strcpy()'s/strcat()'s have been changed to strlcpy()'s/strlcat()'s or asprintf(). Added compat/strlcpy.h for Linux. - Remove compatibility defines for old Darwin token constant names; now only BSM token names are provided and used. - Add support for extended header tokens, which contain space for information on the host generating the record. - Add support for setting extended host information in the kernel, which is used for setting host information in extended header tokens. The audit_control file now supports a "host" parameter which can be used by auditd to set the information; if not present, the kernel parameters won't be set and auditd uses unextended headers for records that it generates. OpenBSM 1.1 alpha 1 - Add option to auditreduce(1) which allows users to invert sense of matching, such that BSM records that do not match, are selected. - Fix bug in audit_write() where we commit an incomplete record in the event there is an error writing the subject token. This was submitted by Diego Giagio. - Build support for Mac OS X 10.5.1 submitted by Eric Hall. - Fix a bug which resulted in host XML attributes not being arguments so that const strings can be passed as arguments to tokens. This patch was submitted by Xin LI. - Modify the -m option so users can select more then one audit event. - For Mac OS X, added Mach IPC support for audit trigger messages. - Fixed a bug in getacna() which resulted in a locking problem on Mac OS X. - Added LOG_PERROR flag to openlog when -d option is used with auditd. - AUE events added for Mac OS X Leopard system calls.
author: rwatson <rwatson@FreeBSD.org> 2008-12-02 23:26:43 +0000
committer: rwatson <rwatson@FreeBSD.org> 2008-12-02 23:26:43 +0000
commit: 0ac6f8ebdfebed8ad6c6fa1334d227524df2c013 (patch)
tree: 909e4490f5c6d4141d466ad2fdf963beeb90afca
parent: 1383cec09e16a1fb5117c67951f100e7931363e7 (diff)
parent: 208cf4160e79a64866887cc5f89f964cc899f97e (diff)
download: FreeBSD-src-0ac6f8ebdfebed8ad6c6fa1334d227524df2c013.zip
FreeBSD-src-0ac6f8ebdfebed8ad6c6fa1334d227524df2c013.tar.gz
102 files changed, 4848 insertions, 769 deletions
diff --git a/contrib/openbsm/CREDITS b/contrib/openbsm/CREDITS
new file mode 100644
index 0000000..634a625
--- /dev/null
+++ b/contrib/openbsm/CREDITS
@@ -0,0 +1,33 @@
+OpenBSM Credits
+
+The following organizations and individuals have contributed substantially to
+the development of OpenBSM:
+
+    Apple Inc.
+    McAfee Research, McAfee, Inc.
+    SPARTA, Inc.
+    Robert Watson
+    Wayne Salamon
+    Suresh Krishnaswamy
+    Kevin Van Vechten
+    Tom Rhodes
+    Wojciech Koszek
+    Chunyang Yuan
+    Poul-Henning Kamp
+    Christian Brueffer
+    Olivier Houchard
+    Christian Peron
+    Martin Fong
+    Pawel Worach
+    Martin Englund
+    Ruslan Ermilov
+    Martin Voros
+    Diego Giagio
+    Alex Samorukov
+    Eric Hall
+    Xin LI
+    Stacey Son
+
+In addition, Coverity, Inc.'s Prevent(tm) static analysis tool and Gimpel
+Software's FlexeLint tool were used to identify a number of bugs in the
+OpenBSM implementation.
diff --git a/contrib/openbsm/INSTALL b/contrib/openbsm/INSTALL
new file mode 100644
index 0000000..7afd1f9
--- /dev/null
+++ b/contrib/openbsm/INSTALL
@@ -0,0 +1,29 @@
+OpenBSM Build and Installation Instructions
+
+OpenBSM is currently built using autoconf and automake, which should allow
+for building on a range of operating systems, including FreeBSD, Mac OS X,
+and Linux.  Depending on the availability of audit facilities in the
+underlying operating system, some components that depend on kernel audit
+support are built conditionally.  Typically, build will be performed using:
+
+    ./configure
+    make
+
+To install, use:
+
+    make install
+
+You may wish to specify that the OpenBSM components not be installed in the
+base system, rather in a specific directory.  This may be done using the
+--prefix argument to configure.  If installing to a specific directory,
+remember to update your library path so that running tools from that
+directory the correct libbsm is used:
+
+    ./configure --prefix=/home/rwatson/openbsm
+    make
+    make install
+    LD_LIBRARY_PATH=/home/rwatson/openbsm/libbsm ; export LD_LIBRARY_PATH
+
+You will need to manually propagate openbsm/etc/* into /etc/security on your
+system; this is not done automatically so as to avoid disrupting the current
+configuration.  Currently, the locations of these files is not configurable.
diff --git a/contrib/openbsm/LICENSE b/contrib/openbsm/LICENSE
index 3b5d8b8..1053c5c 100644
--- a/contrib/openbsm/LICENSE
+++ b/contrib/openbsm/LICENSE
@@ -1,3 +1,5 @@
+OpenBSM Copyrights and Licensing
+
 OpenBSM is covered by a number of copyrights, with licenses being either two
 or three clause BSD licenses.  Individual file headers should be consulted
 for specific copyrights on specific components.  The TrustedBSD Project would
@@ -30,4 +32,4 @@ substantially similar licenses:
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
 
-$P4: //depot/projects/trustedbsd/openbsm/LICENSE#4 $
+$P4: //depot/projects/trustedbsd/openbsm/LICENSE#5 $
diff --git a/contrib/openbsm/Makefile.am b/contrib/openbsm/Makefile.am
index d3ca327..60fbea9 100644
--- a/contrib/openbsm/Makefile.am
+++ b/contrib/openbsm/Makefile.am
@@ -1,5 +1,5 @@
 #
-# $P4: //depot/projects/trustedbsd/openbsm/Makefile.am#2 $
+# $P4: //depot/projects/trustedbsd/openbsm/Makefile.am#3 $
 #
 
 SUBDIRS =		\
@@ -7,7 +7,8 @@ SUBDIRS =		\
 	libbsm		\
 	bin		\
 	man		\
-	modules
+	modules		\
+	sys
 
 EXTRA_DIST =		\
 	CHANGELOG	\
diff --git a/contrib/openbsm/Makefile.in b/contrib/openbsm/Makefile.in
index 37db68b..9068b4c 100644
--- a/contrib/openbsm/Makefile.in
+++ b/contrib/openbsm/Makefile.in
@@ -15,7 +15,7 @@
 @SET_MAKE@
 
 #
-# $P4: //depot/projects/trustedbsd/openbsm/Makefile.in#5 $
+# $P4: //depot/projects/trustedbsd/openbsm/Makefile.in#8 $
 #
 VPATH = @srcdir@
 pkgdatadir = $(datadir)/@PACKAGE@
@@ -38,7 +38,7 @@ host_triplet = @host@
 subdir = .
 DIST_COMMON = README $(am__configure_deps) $(srcdir)/Makefile.am \
 	$(srcdir)/Makefile.in $(top_srcdir)/config/config.h.in \
-	$(top_srcdir)/configure TODO config/config.guess \
+	$(top_srcdir)/configure INSTALL NEWS TODO config/config.guess \
 	config/config.sub config/depcomp config/install-sh \
 	config/ltmain.sh config/missing
 ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
@@ -116,6 +116,7 @@ LN_S = @LN_S@
 LTLIBOBJS = @LTLIBOBJS@
 MAINT = @MAINT@
 MAKEINFO = @MAKEINFO@
+MIG = @MIG@
 MKDIR_P = @MKDIR_P@
 OBJEXT = @OBJEXT@
 PACKAGE = @PACKAGE@
@@ -187,7 +188,8 @@ SUBDIRS = \
 	libbsm		\
 	bin		\
 	man		\
-	modules
+	modules		\
+	sys
 
 EXTRA_DIST = \
 	CHANGELOG	\
diff --git a/contrib/openbsm/HISTORY b/contrib/openbsm/NEWS
index e26ee7f..7bfe756 100644
--- a/contrib/openbsm/HISTORY
+++ b/contrib/openbsm/NEWS
@@ -1,8 +1,54 @@
+OpenBSM Version History
+
+OpenBSM 1.1 alpha 2
+
+- Include files in OpenBSM are now broken out into two parts: library builds
+  required solely for user space, and system includes, which may also be
+  required for use in the kernels of systems integrating OpenBSM.  Submitted
+  by Stacey Son.
+- Configure option --with-native-includes allows forcing the use of native
+  include for system includes, rather than the versions bundled with OpenBSM.
+  This is intended specifically for platforms that ship OpenBSM, have adapted
+  versions of the system includes in a kernel source tree, and will use the
+  OpenBSM build infrastructure with an unmodified OpenBSM distribution,
+  allowing the customized system includes to be used with the OpenBSM build.
+  Submitted by Stacey Son.
+- Various strcpy()'s/strcat()'s have been changed to strlcpy()'s/strlcat()'s
+  or asprintf().  Added compat/strlcpy.h for Linux.
+- Remove compatibility defines for old Darwin token constant names; now only
+  BSM token names are provided and used.
+- Add support for extended header tokens, which contain space for information
+  on the host generating the record.
+- Add support for setting extended host information in the kernel, which is
+  used for setting host information in extended header tokens.  The
+  audit_control file now supports a "host" parameter which can be used by
+  auditd to set the information; if not present, the kernel parameters won't
+  be set and auditd uses unextended headers for records that it generates.
+
+OpenBSM 1.1 alpha 1
+
+- Add option to auditreduce(1) which allows users to invert sense of
+  matching, such that BSM records that do not match, are selected.
+- Fix bug in audit_write() where we commit an incomplete record in the
+  event there is an error writing the subject token.  This was submitted
+  by Diego Giagio.
+- Build support for Mac OS X 10.5.1 submitted by Eric Hall.
+- Fix a bug which resulted in host XML attributes not being printed
+  while processing extended header tokens.  This patch was submitted by
+  Martin Voros.
+- Constification of function arguments so that const strings can be passed
+  as arguments to tokens.  This patch was submitted by Xin LI.
+- Modify the -m option so users can select more then one audit event.
+- For Mac OS X, added Mach IPC support for audit trigger messages.
+- Fixed a bug in getacna() which resulted in a locking problem on Mac OS X.
+- Added LOG_PERROR flag to openlog when -d option is used with auditd.
+- AUE events added for Mac OS X Leopard system calls.
+
 OpenBSM 1.0
 
-- Fix bug in auditreduce(8) which resulted in a memory fault/crash when
+- Fix bug in auditreduce(1) which resulted in a memory fault/crash when
   the user specified an event name with -m.
-- Remove AU_.* hard-coded audit class constants, as udit classes are now
+- Remove AU_.* hard-coded audit class constants, as audit classes are now
   entirely dynamically configured using /etc/security/audit_class.
 
 OpenBSM 1.0 alpha 15
@@ -13,7 +59,7 @@ OpenBSM 1.0 alpha 15
 - Synchronized audit event list to Solaris, picking up the *at(2) system call
   definitions, now required for FreeBSD and Linux.  Added additional events
   for *at(2) system calls not present in Solaris.
-- Bugs in auditreduce(8) fixed allowing partial date strings to be used in
+- Bugs in auditreduce(1) fixed allowing partial date strings to be used in
   filtering events.
 
 OpenBSM 1.0 alpha 14
@@ -94,7 +140,7 @@ OpenBSM 1.0 alpha 11
 OpenBSM 1.0 alpha 10
 
 - auditd now generates complete audit records for its events, as required for
-  application-submitted audit records in the the FreeBSD kernel audit
+  application-submitted audit records in the FreeBSD kernel audit
   implementation.
 
 OpenBSM 1.0 alpha 9
@@ -132,7 +178,7 @@ OpenBSM 1.0 alpha 7
   address storage.
 - Prefer inttypes.h to stdint.h; enhance queue.h detection to test for
   TAILQ_FOREACH_SAFE(), which is present in recent BSD queue.h's, but not
-  older ones.  OpenBSM now builds on some FreeBSD 4.x version.
+  older ones.  OpenBSM now builds on some FreeBSD 4.x versions.
 - New event types for extended attributes, ACLs, and scheduling.
 
 OpenBSM 1.0 alpha 6
@@ -245,7 +291,7 @@ OpenBSM 1.0 alpha 1
   compile in code relying on kernel-only types such as 'struct socket'.
 - Add README, including basic build documentation.
 - Compilation of Apple-specific notify and Machroutines now #ifdef __APPLE__.
-- Staticize libbsm global variables to avoid leakage into application.
+- Staticize libbsm global variables to avoid leakage into applications.
 - Add free_au_user_ent() so that au_user_ent's don't have to be leaked.
 - Clean up bogus nul-termination checks in libbsm.
 - Add libbsm API man pages: au_class.3 au_control.3 au_event.3
@@ -302,4 +348,4 @@ OpenBSM 1.0 alpha 1
   to support reloading of kernel event table.
 - Allow comments in /etc/security configuration files.
 
-$P4: //depot/projects/trustedbsd/openbsm/HISTORY#57 $
+$P4: //depot/projects/trustedbsd/openbsm/NEWS#9 $
diff --git a/contrib/openbsm/README b/contrib/openbsm/README
index aa44d0e..1ded5cd 100644
--- a/contrib/openbsm/README
+++ b/contrib/openbsm/README
@@ -1,4 +1,4 @@
-OpenBSM 1.0
+OpenBSM 1.1 alpha 1
 
   Introduction
 
@@ -16,12 +16,13 @@ may be found in the FreeBSD and Mac OS X kernels.
 OpenBSM consists of several directories:
 
     bin/           Audit-related command line tools
-    bsm/           System include files for BSM
+    bsm/           Library include files for BSM
     compat/        Compatibility code to build on various OS's
     etc/           Sample /etc/security configuration files
     libbsm/        Implementation of BSM library interfaces and man pages
     man/           System call and configuration file man pages
     modules/       Directory for auditfilterd module source
+    sys/           System include files for BSM
     test/          Test token sets and geneneration program
     tools/         Tool directory, including audump to dump databases
 
@@ -34,66 +35,9 @@ The following programs are included with OpenBSM:
     audump         Debugging tool to parse and print audit databases
     praudit        Tool to print audit trails
 
-  Building
-
-OpenBSM is currently built using autoconf and automake, which should allow
-for building on a range of operating systems, including FreeBSD, Mac OS X,
-and Linux.  Depending on the availability of audit facilities in the
-underlying operating system, some components that depend on kernel audit
-support are built conditionally.  Typically, build will be performed using:
-
-    ./configure
-    make
-
-To install, use:
-
-    make install
-
-You may wish to specify that the OpenBSM components not be installed in the
-base system, rather in a specific directory.  This may be done using the
---prefix argument to configure.  If installing to a specific directory,
-remember to update your library path so that running tools from that
-directory the correct libbsm is used:
-
-    ./configure --prefix=/home/rwatson/openbsm
-    make
-    make install
-    LD_LIBRARY_PATH=/home/rwatson/openbsm/libbsm ; export LD_LIBRARY_PATH
-
-You will need to manually propagate openbsm/etc/* into /etc on your system;
-this is not done automatically so as to avoid disrupting the current
-configuration.  Currently, the locations of these files is not configurable.
-
-  Credits
-
-The following organizations and individuals have contributed substantially to
-the development of OpenBSM:
-
-    Apple Computer, Inc.
-    McAfee Research, McAfee, Inc.
-    SPARTA, Inc.
-    Robert Watson
-    Wayne Salamon
-    Suresh Krishnaswamy
-    Kevin Van Vechten
-    Tom Rhodes
-    Wojciech Koszek
-    Chunyang Yuan
-    Poul-Henning Kamp
-    Christian Brueffer
-    Olivier Houchard
-    Christian Peron
-    Martin Fong
-    Pawel Worach
-    Martin Englund
-    Ruslan Ermilov
-    Martin Voros
-    Diego Giagio
-    Alex Samorukov
-
-In addition, Coverity, Inc.'s Prevent(tm) static analysis tool and Gimpel
-Software's FlexeLint tool were used to identify a number of bugs in the
-OpenBSM implementation.
+  Build and Installation
+
+Please see the file INSTALL for build and installation instructions.
 
   Contributions
 
@@ -111,4 +55,4 @@ Information on TrustedBSD may be found on the TrustedBSD home page:
 
     http://www.TrustedBSD.org/
 
-$P4: //depot/projects/trustedbsd/openbsm/README#24 $
+$P4: //depot/projects/trustedbsd/openbsm/README#32 $
diff --git a/contrib/openbsm/TODO b/contrib/openbsm/TODO
index ce06d5a..03cd9e1 100644
--- a/contrib/openbsm/TODO
+++ b/contrib/openbsm/TODO
@@ -1,5 +1,5 @@
-- Teach libbsm about any additional 64-bit token types that are present
-  in more recent Solaris versions.
+OpenBSM TODO
+
 - Build a regression test suite for libbsm that generates each token
   type and then compares the results with known good data.  Make sure to
   test that things work properly with respect to endianness of the local
@@ -18,5 +18,7 @@
   trailer context.
 - Put hostname in trail file name.
 - Document audit_warn event arguments.
+- Allow the path /etc/security to be configured at configure-time so that
+  alternative locations can be used.
 
-$P4: //depot/projects/trustedbsd/openbsm/TODO#9 $
+$P4: //depot/projects/trustedbsd/openbsm/TODO#11 $
diff --git a/contrib/openbsm/VERSION b/contrib/openbsm/VERSION
index c21ee6b..7f2f71c 100644
--- a/contrib/openbsm/VERSION
+++ b/contrib/openbsm/VERSION
@@ -1 +1 @@
-OPENBSM_1_0
+OPENBSM_1_1_ALPHA_2
diff --git a/contrib/openbsm/bin/Makefile.in b/contrib/openbsm/bin/Makefile.in
index 8124228..ddace58 100644
--- a/contrib/openbsm/bin/Makefile.in
+++ b/contrib/openbsm/bin/Makefile.in
@@ -15,7 +15,7 @@
 @SET_MAKE@
 
 #
-# $P4: //depot/projects/trustedbsd/openbsm/bin/Makefile.in#5 $
+# $P4: //depot/projects/trustedbsd/openbsm/bin/Makefile.in#8 $
 #
 VPATH = @srcdir@
 pkgdatadir = $(datadir)/@PACKAGE@
@@ -104,6 +104,7 @@ LN_S = @LN_S@
 LTLIBOBJS = @LTLIBOBJS@
 MAINT = @MAINT@
 MAKEINFO = @MAKEINFO@
+MIG = @MIG@
 MKDIR_P = @MKDIR_P@
 OBJEXT = @OBJEXT@
 PACKAGE = @PACKAGE@
diff --git a/contrib/openbsm/bin/audit/Makefile.am b/contrib/openbsm/bin/audit/Makefile.am
index 83094bb..ed62929 100644
--- a/contrib/openbsm/bin/audit/Makefile.am
+++ b/contrib/openbsm/bin/audit/Makefile.am
@@ -1,10 +1,23 @@
 #
-# $P4: //depot/projects/trustedbsd/openbsm/bin/audit/Makefile.am#1 $
+# $P4: //depot/projects/trustedbsd/openbsm/bin/audit/Makefile.am#4 $
 #
 
-INCLUDES = -I$(top_srcdir)
+if USE_NATIVE_INCLUDES
+INCLUDES = -I$(top_builddir) -I$(top_srcdir)
+else
+INCLUDES = -I$(top_builddir) -I$(top_srcdir) -I$(top_srcdir)/sys
+endif
 
 sbin_PROGRAMS = audit
-audit_SOURCES = audit.c
 audit_LDADD = $(top_builddir)/libbsm/libbsm.la
 man8_MANS = audit.8
+
+if USE_MACH_IPC
+audit_SOURCES = auditd_control_user.c audit.c
+CLEANFILES = auditd_control_user.c auditd_control_user.h
+
+auditd_control_user.c: $(top_srcdir)/bin/auditd/auditd_control.defs 
+	$(MIG)	-user auditd_control_user.c -header auditd_control_user.h -server /dev/null -sheader /dev/null $(top_srcdir)/bin/auditd/auditd_control.defs
+else
+audit_SOURCES = audit.c
+endif
diff --git a/contrib/openbsm/bin/audit/Makefile.in b/contrib/openbsm/bin/audit/Makefile.in
index 9f5e7bd..edaf018 100644
--- a/contrib/openbsm/bin/audit/Makefile.in
+++ b/contrib/openbsm/bin/audit/Makefile.in
@@ -15,7 +15,7 @@
 @SET_MAKE@
 
 #
-# $P4: //depot/projects/trustedbsd/openbsm/bin/audit/Makefile.in#4 $
+# $P4: //depot/projects/trustedbsd/openbsm/bin/audit/Makefile.in#9 $
 #
 
 VPATH = @srcdir@
@@ -49,7 +49,10 @@ CONFIG_CLEAN_FILES =
 am__installdirs = "$(DESTDIR)$(sbindir)" "$(DESTDIR)$(man8dir)"
 sbinPROGRAMS_INSTALL = $(INSTALL_PROGRAM)
 PROGRAMS = $(sbin_PROGRAMS)
-am_audit_OBJECTS = audit.$(OBJEXT)
+am__audit_SOURCES_DIST = audit.c auditd_control_user.c
+@USE_MACH_IPC_FALSE@am_audit_OBJECTS = audit.$(OBJEXT)
+@USE_MACH_IPC_TRUE@am_audit_OBJECTS = auditd_control_user.$(OBJEXT) \
+@USE_MACH_IPC_TRUE@	audit.$(OBJEXT)
 audit_OBJECTS = $(am_audit_OBJECTS)
 audit_DEPENDENCIES = $(top_builddir)/libbsm/libbsm.la
 DEFAULT_INCLUDES = -I. -I$(top_builddir)/config@am__isrc@
@@ -65,7 +68,7 @@ LINK = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \
 	--mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) $(AM_LDFLAGS) \
 	$(LDFLAGS) -o $@
 SOURCES = $(audit_SOURCES)
-DIST_SOURCES = $(audit_SOURCES)
+DIST_SOURCES = $(am__audit_SOURCES_DIST)
 man8dir = $(mandir)/man8
 NROFF = nroff
 MANS = $(man8_MANS)
@@ -113,6 +116,7 @@ LN_S = @LN_S@
 LTLIBOBJS = @LTLIBOBJS@
 MAINT = @MAINT@
 MAKEINFO = @MAKEINFO@
+MIG = @MIG@
 MKDIR_P = @MKDIR_P@
 OBJEXT = @OBJEXT@
 PACKAGE = @PACKAGE@
@@ -179,10 +183,13 @@ sysconfdir = @sysconfdir@
 target_alias = @target_alias@
 top_builddir = @top_builddir@
 top_srcdir = @top_srcdir@
-INCLUDES = -I$(top_srcdir)
-audit_SOURCES = audit.c
+@USE_NATIVE_INCLUDES_FALSE@INCLUDES = -I$(top_builddir) -I$(top_srcdir) -I$(top_srcdir)/sys
+@USE_NATIVE_INCLUDES_TRUE@INCLUDES = -I$(top_builddir) -I$(top_srcdir)
 audit_LDADD = $(top_builddir)/libbsm/libbsm.la
 man8_MANS = audit.8
+@USE_MACH_IPC_FALSE@audit_SOURCES = audit.c
+@USE_MACH_IPC_TRUE@audit_SOURCES = auditd_control_user.c audit.c
+@USE_MACH_IPC_TRUE@CLEANFILES = auditd_control_user.c auditd_control_user.h
 all: all-am
 
 .SUFFIXES:
@@ -255,6 +262,7 @@ distclean-compile:
 	-rm -f *.tab.c
 
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/audit.Po@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/auditd_control_user.Po@am__quote@
 
 .c.o:
 @am__fastdepCC_TRUE@	$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
@@ -426,6 +434,7 @@ install-strip:
 mostlyclean-generic:
 
 clean-generic:
+	-test -z "$(CLEANFILES)" || rm -f $(CLEANFILES)
 
 distclean-generic:
 	-test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
@@ -511,6 +520,9 @@ uninstall-man: uninstall-man8
 	tags uninstall uninstall-am uninstall-man uninstall-man8 \
 	uninstall-sbinPROGRAMS
 
+
+@USE_MACH_IPC_TRUE@auditd_control_user.c: $(top_srcdir)/bin/auditd/auditd_control.defs 
+@USE_MACH_IPC_TRUE@	$(MIG)	-user auditd_control_user.c -header auditd_control_user.h -server /dev/null -sheader /dev/null $(top_srcdir)/bin/auditd/auditd_control.defs
 # Tell versions [3.59,3.63) of GNU make to not export all variables.
 # Otherwise a system limit (for SysV at least) may be exceeded.
 .NOEXPORT:
diff --git a/contrib/openbsm/bin/audit/audit.8 b/contrib/openbsm/bin/audit/audit.8
index b735981..4aaa494 100644
--- a/contrib/openbsm/bin/audit/audit.8
+++ b/contrib/openbsm/bin/audit/audit.8
@@ -1,4 +1,4 @@
-.\" Copyright (c) 2004 Apple Computer, Inc.
+.\" Copyright (c) 2004 Apple Inc.
 .\" All rights reserved.
 .\"
 .\" Redistribution and use in source and binary forms, with or without
@@ -10,7 +10,7 @@
 .\" 2.  Redistributions in binary form must reproduce the above copyright
 .\"     notice, this list of conditions and the following disclaimer in the
 .\"     documentation and/or other materials provided with the distribution.
-.\" 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+.\" 3.  Neither the name of Apple Inc. ("Apple") nor the names of
 .\"     its contributors may be used to endorse or promote products derived
 .\"     from this software without specific prior written permission.
 .\"
@@ -25,7 +25,7 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.\" $P4: //depot/projects/trustedbsd/openbsm/bin/audit/audit.8#10 $
+.\" $P4: //depot/projects/trustedbsd/openbsm/bin/audit/audit.8#11 $
 .\"
 .Dd October 2, 2006
 .Dt AUDIT 8
diff --git a/contrib/openbsm/bin/audit/audit.c b/contrib/openbsm/bin/audit/audit.c
index 3540464..b1415a6 100644
--- a/contrib/openbsm/bin/audit/audit.c
+++ b/contrib/openbsm/bin/audit/audit.c
@@ -1,5 +1,5 @@
-/*
- * Copyright (c) 2005 Apple Computer, Inc.
+/*-
+ * Copyright (c) 2005-2008 Apple Inc.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -11,7 +11,7 @@
  * 2.  Redistributions in binary form must reproduce the above copyright
  *     notice, this list of conditions and the following disclaimer in the
  *     documentation and/or other materials provided with the distribution.
- * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
  *     its contributors may be used to endorse or promote products derived
  *     from this software without specific prior written permission.
  *
@@ -26,7 +26,7 @@
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  *
- * $P4: //depot/projects/trustedbsd/openbsm/bin/audit/audit.c#8 $
+ * $P4: //depot/projects/trustedbsd/openbsm/bin/audit/audit.c#11 $
  */
 /*
  * Program to trigger the audit daemon with a message that is either:
@@ -37,7 +37,12 @@
  */
 
 #include <sys/types.h>
+#include <config/config.h>
+#ifdef HAVE_FULL_QUEUE_H
 #include <sys/queue.h>
+#else /* !HAVE_FULL_QUEUE_H */
+#include <compat/queue.h>
+#endif /* !HAVE_FULL_QUEUE_H */
 #include <sys/uio.h>
 
 #include <bsm/libbsm.h>
@@ -47,6 +52,58 @@
 #include <stdlib.h>
 #include <unistd.h>
 
+
+static int send_trigger(unsigned int);
+
+#ifdef USE_MACH_IPC
+#include <mach/mach.h>
+#include <servers/netname.h>
+#include <mach/message.h>
+#include <mach/port.h>
+#include <mach/mach_error.h>
+#include <mach/host_special_ports.h>
+#include <servers/bootstrap.h>
+
+#include "auditd_control_user.h"
+
+static int
+send_trigger(unsigned int trigger)
+{
+	mach_port_t     serverPort;
+	kern_return_t	error;
+
+	error = host_get_audit_control_port(mach_host_self(), &serverPort);
+	if (error != KERN_SUCCESS) {
+		mach_error("Cannot get auditd_control Mach port: ", error);
+		return (-1);
+	}
+
+	error = auditd_control(serverPort, trigger);
+	if (error != KERN_SUCCESS) {
+		mach_error("Error sending trigger: ", error);
+		return (-1);
+	}
+	
+	return (0);
+}
+
+#else /* ! USE_MACH_IPC */
+
+static int
+send_trigger(unsigned int trigger)
+{
+	int error;
+
+	error = auditon(A_SENDTRIGGER, &trigger, sizeof(trigger));
+	if (error != 0) {
+		perror("Error sending trigger");
+		return (-1);
+	}
+
+	return (0);
+}
+#endif /* ! USE_MACH_IPC */
+
 static void
 usage(void)
 {
@@ -88,11 +145,9 @@ main(int argc, char **argv)
 			break;
 		}
 	}
-	if (auditon(A_SENDTRIGGER, &trigger, sizeof(trigger)) < 0) {
-		perror("Error sending trigger");
+	if (send_trigger(trigger) < 0) 
 		exit(-1);
-	} else {
-		printf("Trigger sent.\n");
-		exit (0);
-	}
+
+	printf("Trigger sent.\n");
+	exit (0);
 }
diff --git a/contrib/openbsm/bin/auditd/Makefile.am b/contrib/openbsm/bin/auditd/Makefile.am
index eecfa55..f65b155 100644
--- a/contrib/openbsm/bin/auditd/Makefile.am
+++ b/contrib/openbsm/bin/auditd/Makefile.am
@@ -1,10 +1,26 @@
 #
-# $P4: //depot/projects/trustedbsd/openbsm/bin/auditd/Makefile.am#1 $
+# $P4: //depot/projects/trustedbsd/openbsm/bin/auditd/Makefile.am#4 $
 #
 
-INCLUDES = -I$(top_srcdir)
+if USE_NATIVE_INCLUDES
+INCLUDES = -I$(top_builddir) -I$(top_srcdir)
+else
+INCLUDES = -I$(top_builddir) -I$(top_srcdir) -I$(top_srcdir)/sys
+endif
 
 sbin_PROGRAMS = auditd
-auditd_SOURCES = audit_warn.c auditd.c
 auditd_LDADD = $(top_builddir)/libbsm/libbsm.la
 man8_MANS = auditd.8
+
+if USE_MACH_IPC
+auditd_SOURCES = auditd_control_server.c audit_triggers_server.c audit_warn.c auditd.c
+CLEANFILES = auditd_control_server.c auditd_control_server.h audit_triggers_server.c audit_triggers_server.h
+
+auditd_control_server.c: auditd_control.defs
+	$(MIG) -user /dev/null -header /dev/null -server auditd_control_server.c -sheader auditd_control_server.h $(top_srcdir)/bin/auditd/auditd_control.defs
+
+audit_triggers_server.c: audit_triggers.defs
+	$(MIG) -user /dev/null -header /dev/null -server audit_triggers_server.c -sheader audit_triggers_server.h $(top_srcdir)/bin/auditd/audit_triggers.defs
+else
+auditd_SOURCES = audit_warn.c auditd.c
+endif
diff --git a/contrib/openbsm/bin/auditd/Makefile.in b/contrib/openbsm/bin/auditd/Makefile.in
index 9ff9451..731607c 100644
--- a/contrib/openbsm/bin/auditd/Makefile.in
+++ b/contrib/openbsm/bin/auditd/Makefile.in
@@ -15,7 +15,7 @@
 @SET_MAKE@
 
 #
-# $P4: //depot/projects/trustedbsd/openbsm/bin/auditd/Makefile.in#4 $
+# $P4: //depot/projects/trustedbsd/openbsm/bin/auditd/Makefile.in#9 $
 #
 
 VPATH = @srcdir@
@@ -49,7 +49,14 @@ CONFIG_CLEAN_FILES =
 am__installdirs = "$(DESTDIR)$(sbindir)" "$(DESTDIR)$(man8dir)"
 sbinPROGRAMS_INSTALL = $(INSTALL_PROGRAM)
 PROGRAMS = $(sbin_PROGRAMS)
-am_auditd_OBJECTS = audit_warn.$(OBJEXT) auditd.$(OBJEXT)
+am__auditd_SOURCES_DIST = audit_warn.c auditd.c \
+	auditd_control_server.c audit_triggers_server.c
+@USE_MACH_IPC_FALSE@am_auditd_OBJECTS = audit_warn.$(OBJEXT) \
+@USE_MACH_IPC_FALSE@	auditd.$(OBJEXT)
+@USE_MACH_IPC_TRUE@am_auditd_OBJECTS =  \
+@USE_MACH_IPC_TRUE@	auditd_control_server.$(OBJEXT) \
+@USE_MACH_IPC_TRUE@	audit_triggers_server.$(OBJEXT) \
+@USE_MACH_IPC_TRUE@	audit_warn.$(OBJEXT) auditd.$(OBJEXT)
 auditd_OBJECTS = $(am_auditd_OBJECTS)
 auditd_DEPENDENCIES = $(top_builddir)/libbsm/libbsm.la
 DEFAULT_INCLUDES = -I. -I$(top_builddir)/config@am__isrc@
@@ -65,7 +72,7 @@ LINK = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \
 	--mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) $(AM_LDFLAGS) \
 	$(LDFLAGS) -o $@
 SOURCES = $(auditd_SOURCES)
-DIST_SOURCES = $(auditd_SOURCES)
+DIST_SOURCES = $(am__auditd_SOURCES_DIST)
 man8dir = $(mandir)/man8
 NROFF = nroff
 MANS = $(man8_MANS)
@@ -113,6 +120,7 @@ LN_S = @LN_S@
 LTLIBOBJS = @LTLIBOBJS@
 MAINT = @MAINT@
 MAKEINFO = @MAKEINFO@
+MIG = @MIG@
 MKDIR_P = @MKDIR_P@
 OBJEXT = @OBJEXT@
 PACKAGE = @PACKAGE@
@@ -179,10 +187,13 @@ sysconfdir = @sysconfdir@
 target_alias = @target_alias@
 top_builddir = @top_builddir@
 top_srcdir = @top_srcdir@
-INCLUDES = -I$(top_srcdir)
-auditd_SOURCES = audit_warn.c auditd.c
+@USE_NATIVE_INCLUDES_FALSE@INCLUDES = -I$(top_builddir) -I$(top_srcdir) -I$(top_srcdir)/sys
+@USE_NATIVE_INCLUDES_TRUE@INCLUDES = -I$(top_builddir) -I$(top_srcdir)
 auditd_LDADD = $(top_builddir)/libbsm/libbsm.la
 man8_MANS = auditd.8
+@USE_MACH_IPC_FALSE@auditd_SOURCES = audit_warn.c auditd.c
+@USE_MACH_IPC_TRUE@auditd_SOURCES = auditd_control_server.c audit_triggers_server.c audit_warn.c auditd.c
+@USE_MACH_IPC_TRUE@CLEANFILES = auditd_control_server.c auditd_control_server.h audit_triggers_server.c audit_triggers_server.h
 all: all-am
 
 .SUFFIXES:
@@ -254,8 +265,10 @@ mostlyclean-compile:
 distclean-compile:
 	-rm -f *.tab.c
 
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/audit_triggers_server.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/audit_warn.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/auditd.Po@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/auditd_control_server.Po@am__quote@
 
 .c.o:
 @am__fastdepCC_TRUE@	$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
@@ -427,6 +440,7 @@ install-strip:
 mostlyclean-generic:
 
 clean-generic:
+	-test -z "$(CLEANFILES)" || rm -f $(CLEANFILES)
 
 distclean-generic:
 	-test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
@@ -512,6 +526,12 @@ uninstall-man: uninstall-man8
 	tags uninstall uninstall-am uninstall-man uninstall-man8 \
 	uninstall-sbinPROGRAMS
 
+
+@USE_MACH_IPC_TRUE@auditd_control_server.c: auditd_control.defs
+@USE_MACH_IPC_TRUE@	$(MIG) -user /dev/null -header /dev/null -server auditd_control_server.c -sheader auditd_control_server.h $(top_srcdir)/bin/auditd/auditd_control.defs
+
+@USE_MACH_IPC_TRUE@audit_triggers_server.c: audit_triggers.defs
+@USE_MACH_IPC_TRUE@	$(MIG) -user /dev/null -header /dev/null -server audit_triggers_server.c -sheader audit_triggers_server.h $(top_srcdir)/bin/auditd/audit_triggers.defs
 # Tell versions [3.59,3.63) of GNU make to not export all variables.
 # Otherwise a system limit (for SysV at least) may be exceeded.
 .NOEXPORT:
diff --git a/contrib/openbsm/bin/auditd/audit_triggers.defs b/contrib/openbsm/bin/auditd/audit_triggers.defs
new file mode 100644
index 0000000..f5b394d
--- /dev/null
+++ b/contrib/openbsm/bin/auditd/audit_triggers.defs
@@ -0,0 +1,5 @@
+/*
+ * $P4: //depot/projects/trustedbsd/openbsm/bin/auditd/audit_triggers.defs#1 $
+ */
+
+#include <mach/audit_triggers.defs>
diff --git a/contrib/openbsm/bin/auditd/audit_warn.c b/contrib/openbsm/bin/auditd/audit_warn.c
index ef3de52..7bc7a14 100644
--- a/contrib/openbsm/bin/auditd/audit_warn.c
+++ b/contrib/openbsm/bin/auditd/audit_warn.c
@@ -1,5 +1,5 @@
-/*
- * Copyright (c) 2005 Apple Computer, Inc.
+/*-
+ * Copyright (c) 2005 Apple Inc.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -11,7 +11,7 @@
  * 2.  Redistributions in binary form must reproduce the above copyright
  *     notice, this list of conditions and the following disclaimer in the
  *     documentation and/or other materials provided with the distribution.
- * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
  *     its contributors may be used to endorse or promote products derived
  *     from this software without specific prior written permission.
  *
@@ -26,7 +26,7 @@
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  *
- * $P4: //depot/projects/trustedbsd/openbsm/bin/auditd/audit_warn.c#8 $
+ * $P4: //depot/projects/trustedbsd/openbsm/bin/auditd/audit_warn.c#9 $
  */
 
 #include <sys/types.h>
diff --git a/contrib/openbsm/bin/auditd/auditd.8 b/contrib/openbsm/bin/auditd/auditd.8
index ec6b99a..199b9cc 100644
--- a/contrib/openbsm/bin/auditd/auditd.8
+++ b/contrib/openbsm/bin/auditd/auditd.8
@@ -1,4 +1,4 @@
-.\" Copyright (c) 2004 Apple Computer, Inc.
+.\" Copyright (c) 2004 Apple Inc.
 .\" All rights reserved.
 .\"
 .\" Redistribution and use in source and binary forms, with or without
@@ -10,7 +10,7 @@
 .\" 2.  Redistributions in binary form must reproduce the above copyright
 .\"     notice, this list of conditions and the following disclaimer in the
 .\"     documentation and/or other materials provided with the distribution.
-.\" 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+.\" 3.  Neither the name of Apple Inc. ("Apple") nor the names of
 .\"     its contributors may be used to endorse or promote products derived
 .\"     from this software without specific prior written permission.
 .\"
@@ -25,7 +25,7 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.\" $P4: //depot/projects/trustedbsd/openbsm/bin/auditd/auditd.8#13 $
+.\" $P4: //depot/projects/trustedbsd/openbsm/bin/auditd/auditd.8#14 $
 .\"
 .Dd October 2, 2006
 .Dt AUDITD 8
diff --git a/contrib/openbsm/bin/auditd/auditd.c b/contrib/openbsm/bin/auditd/auditd.c
index fb6fbd5..e0c03d0 100644
--- a/contrib/openbsm/bin/auditd/auditd.c
+++ b/contrib/openbsm/bin/auditd/auditd.c
@@ -1,5 +1,5 @@
-/*
- * Copyright (c) 2004 Apple Computer, Inc.
+/*-
+ * Copyright (c) 2004-2008 Apple Inc.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -11,7 +11,7 @@
  * 2.  Redistributions in binary form must reproduce the above copyright
  *     notice, this list of conditions and the following disclaimer in the
  *     documentation and/or other materials provided with the distribution.
- * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
  *     its contributors may be used to endorse or promote products derived
  *     from this software without specific prior written permission.
  *
@@ -26,13 +26,21 @@
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  *
- * $P4: //depot/projects/trustedbsd/openbsm/bin/auditd/auditd.c#26 $
+ * $P4: //depot/projects/trustedbsd/openbsm/bin/auditd/auditd.c#39 $
  */
 
-#include <sys/types.h>
+#include <sys/param.h>
+
+#include <config/config.h>
+
 #include <sys/dirent.h>
 #include <sys/mman.h>
+#include <sys/socket.h>
+#ifdef HAVE_FULL_QUEUE_H
 #include <sys/queue.h>
+#else /* !HAVE_FULL_QUEUE_H */
+#include <compat/queue.h>
+#endif /* !HAVE_FULL_QUEUE_H */
 #include <sys/stat.h>
 #include <sys/wait.h>
 
@@ -40,6 +48,8 @@
 #include <bsm/audit_uevents.h>
 #include <bsm/libbsm.h>
 
+#include <netinet/in.h>
+
 #include <err.h>
 #include <errno.h>
 #include <fcntl.h>
@@ -51,19 +61,46 @@
 #include <signal.h>
 #include <string.h>
 #include <syslog.h>
+#include <netdb.h>
 
 #include "auditd.h"
+#ifdef USE_MACH_IPC
+#include <notify.h>
+#include <mach/port.h>
+#include <mach/mach_error.h>
+#include <mach/mach_traps.h>
+#include <mach/mach.h>
+#include <mach/host_special_ports.h>
+
+#include "auditd_control_server.h"
+#include "audit_triggers_server.h"
+#endif /* USE_MACH_IPC */
+
+#ifndef HAVE_STRLCPY
+#include <compat/strlcpy.h>
+#endif
 
 #define	NA_EVENT_STR_SIZE	25
 #define	POL_STR_SIZE		128
-
 static int	 ret, minval;
 static char	*lastfile = NULL;
 static int	 allhardcount = 0;
-static int	 triggerfd = 0;
 static int	 sigchlds, sigchlds_handled;
 static int	 sighups, sighups_handled;
+#ifndef USE_MACH_IPC
 static int	 sigterms, sigterms_handled;
+static int	 triggerfd = 0;
+
+#else /* USE_MACH_IPC */
+
+static mach_port_t      control_port = MACH_PORT_NULL;
+static mach_port_t      signal_port = MACH_PORT_NULL;
+static mach_port_t      port_set = MACH_PORT_NULL;
+
+#ifndef __BSM_INTERNAL_NOTIFY_KEY
+#define	__BSM_INTERNAL_NOTIFY_KEY "com.apple.audit.change"
+#endif /* __BSM_INTERNAL_NOTIFY_KEY */
+#endif /* USE_MACH_IPC */
 
 static TAILQ_HEAD(, dir_ent)	dir_q;
 
@@ -120,19 +157,17 @@ getTSstr(char *buf, int len)
 static char *
 affixdir(char *name, struct dir_ent *dirent)
 {
-	char *fn;
-	char *curdir;
-	const char *sep = "/";
+	char *fn = NULL;
 
-	curdir = dirent->dirname;
 	syslog(LOG_DEBUG, "dir = %s", dirent->dirname);
-
-	fn = malloc(strlen(curdir) + strlen(sep) + (2 * POSTFIX_LEN) + 1);
-	if (fn == NULL)
+	/* 
+	 * Sanity check on file name.
+	 */
+	if (strlen(name) != (FILENAME_LEN - 1)) {
+		syslog(LOG_ERR, "Invalid file name: %s", name);
 		return (NULL);
-	strcpy(fn, curdir);
-	strcat(fn, sep);
-	strcat(fn, name);
+	}
+	asprintf(&fn, "%s/%s", dirent->dirname, name);
 	return (fn);
 }
 
@@ -144,17 +179,18 @@ close_lastfile(char *TS)
 {
 	char *ptr;
 	char *oldname;
+	size_t len;
 
 	if (lastfile != NULL) {
-		oldname = (char *)malloc(strlen(lastfile) + 1);
+		len = strlen(lastfile) + 1;
+		oldname = (char *)malloc(len);
 		if (oldname == NULL)
 			return (-1);
-		strcpy(oldname, lastfile);
+		strlcpy(oldname, lastfile, len);
 
 		/* Rename the last file -- append timestamp. */
 		if ((ptr = strstr(lastfile, NOT_TERMINATED)) != NULL) {
-			*ptr = '.';
-			strcpy(ptr+1, TS);
+			strlcpy(ptr, TS, TIMESTAMP_LEN);
 			if (rename(oldname, lastfile) != 0)
 				syslog(LOG_ERR,
 				    "Could not rename %s to %s: %m", oldname,
@@ -164,7 +200,9 @@ close_lastfile(char *TS)
 				    oldname, lastfile);
 				audit_warn_closefile(lastfile);
 			}
-		}
+		} else 
+			syslog(LOG_ERR, "Could not rename %s to %s", oldname,
+			    lastfile);
 		free(lastfile);
 		free(oldname);
 		lastfile = NULL;
@@ -206,9 +244,9 @@ open_trail(const char *fname)
 static int
 swap_audit_file(void)
 {
-	char timestr[2 * POSTFIX_LEN];
+	char timestr[FILENAME_LEN];
 	char *fn;
-	char TS[POSTFIX_LEN];
+	char TS[TIMESTAMP_LEN];
 	struct dir_ent *dirent;
 #ifdef AUDIT_REVIEW_GROUP
 	struct group *grp;
@@ -217,11 +255,10 @@ swap_audit_file(void)
 #endif
 	int error, fd;
 
-	if (getTSstr(TS, POSTFIX_LEN) != 0)
+	if (getTSstr(TS, TIMESTAMP_LEN) != 0)
 		return (-1);
 
-	strcpy(timestr, TS);
-	strcat(timestr, NOT_TERMINATED);
+	snprintf(timestr, FILENAME_LEN, "%s.%s", TS, NOT_TERMINATED);
 
 #ifdef AUDIT_REVIEW_GROUP
 	/*
@@ -268,6 +305,14 @@ swap_audit_file(void)
 				close(fd);
 			} else {
 				/* Success. */
+#ifdef USE_MACH_IPC
+				/* 
+			 	 * auditctl() potentially changes the audit
+				 * state so post that the audit config (may
+				 * have) changed. 
+			 	 */
+				notify_post(__BSM_INTERNAL_NOTIFY_KEY);
+#endif
 				close_lastfile(TS);
 				lastfile = fn;
 				close(fd);
@@ -321,7 +366,7 @@ read_control_file(void)
 			free(dirent);
 			return (-1);
 		}
-		strcpy(dirent->dirname, cur_dir);
+		strlcpy(dirent->dirname, cur_dir, MAXNAMLEN);
 		TAILQ_INSERT_TAIL(&dir_q, dirent, dirs);
 	}
 
@@ -367,7 +412,7 @@ close_all(void)
 {
 	struct auditinfo ai;
 	int err_ret = 0;
-	char TS[POSTFIX_LEN];
+	char TS[TIMESTAMP_LEN];
 	int aufd;
 	token_t *tok;
 	long cond;
@@ -402,7 +447,13 @@ close_all(void)
 		    strerror(errno));
 		err_ret = 1;
 	}
-	if (getTSstr(TS, POSTFIX_LEN) == 0)
+#ifdef USE_MACH_IPC
+	/* 
+	 * Post a notification that the audit config changed. 
+	 */
+	notify_post(__BSM_INTERNAL_NOTIFY_KEY);
+#endif
+	if (getTSstr(TS, TIMESTAMP_LEN) == 0)
 		close_lastfile(TS);
 	if (lastfile != NULL)
 		free(lastfile);
@@ -415,8 +466,10 @@ close_all(void)
 	}
 	endac();
 
+#ifndef USE_MACH_IPC
 	if (close(triggerfd) != 0)
 		syslog(LOG_ERR, "Error closing control file");
+#endif
 	syslog(LOG_INFO, "Finished");
 	return (0);
 }
@@ -427,6 +480,22 @@ close_all(void)
  * main servicing loop to do proper handling from a non-signal-handler
  * context.
  */
+#ifdef USE_MACH_IPC
+static void
+relay_signal(int signal)
+{
+	mach_msg_empty_send_t msg;
+
+	msg.header.msgh_id = signal;
+	msg.header.msgh_remote_port = signal_port;
+	msg.header.msgh_local_port = MACH_PORT_NULL;
+	msg.header.msgh_bits = MACH_MSGH_BITS(MACH_MSG_TYPE_MAKE_SEND, 0);
+	mach_msg(&(msg.header), MACH_SEND_MSG|MACH_SEND_TIMEOUT, sizeof(msg),
+	    0, MACH_PORT_NULL, MACH_MSG_TIMEOUT_NONE, MACH_PORT_NULL);
+}
+
+#else /* ! USE_MACH_IPC */
+
 static void
 relay_signal(int signal)
 {
@@ -438,6 +507,7 @@ relay_signal(int signal)
 	if (signal == SIGCHLD)
 		sigchlds++;
 }
+#endif /* ! USE_MACH_IPC */
 
 /*
  * Registering the daemon.
@@ -492,6 +562,48 @@ register_daemon(void)
 	return (0);
 }
 
+#ifdef USE_MACH_IPC
+/*
+ * Implementation of the auditd_control() MIG simpleroutine.
+ *
+ * React to input from the audit(1) tool.
+ */
+
+/* ARGSUSED */
+kern_return_t
+auditd_control(mach_port_t __unused auditd_port, int trigger)
+{
+	int err_ret = 0;
+
+	switch (trigger) {
+
+	case AUDIT_TRIGGER_ROTATE_USER:
+		/*
+		 * Create a new file and swap with the one
+		 * being used in kernel.
+		 */
+		if (swap_audit_file() == -1)
+			syslog(LOG_ERR, "Error swapping audit file");
+		break;
+
+	case AUDIT_TRIGGER_READ_FILE:
+		if (read_control_file() == -1)
+			syslog(LOG_ERR, "Error in audit control file");
+		 break;
+
+	case AUDIT_TRIGGER_CLOSE_AND_DIE:
+		err_ret = close_all();
+		exit (err_ret);
+		break;
+
+	default:
+		break;
+	}
+
+	return (KERN_SUCCESS);
+}
+#endif /* USE_MACH_IPC */
+
 /*
  * Handle the audit trigger event.
  *
@@ -503,8 +615,18 @@ register_daemon(void)
  * not be retransmitted, and the log file will grow in an unbounded fashion.
  */
 #define	DUPLICATE_INTERVAL	30
-static void
+#ifdef USE_MACH_IPC
+#define	AT_SUCCESS	KERN_SUCCESS
+
+/* ARGSUSED */
+kern_return_t
+audit_triggers(mach_port_t __unused audit_port, int trigger)
+#else
+#define	AT_SUCCESS	0
+
+static int
 handle_audit_trigger(int trigger)
+#endif
 {
 	static int last_trigger, last_warning;
 	static time_t last_time;
@@ -533,7 +655,7 @@ handle_audit_trigger(int trigger)
 					syslog(LOG_INFO,
 					    "Suppressing duplicate trigger %d",
 					    trigger);
-				return;
+				return (AT_SUCCESS);
 			}
 			last_warning = tt;
 			break;
@@ -634,8 +756,12 @@ handle_audit_trigger(int trigger)
 		syslog(LOG_ERR, "Got unknown trigger %d", trigger);
 		break;
 	}
+
+	return (AT_SUCCESS);
 }
 
+#undef	AT_SUCCESS
+
 static void
 handle_sighup(void)
 {
@@ -644,6 +770,69 @@ handle_sighup(void)
 	config_audit_controls();
 }
 
+static int
+config_audit_host(void)
+{
+	char hoststr[MAXHOSTNAMELEN];
+	struct sockaddr_in6 *sin6;
+	struct sockaddr_in *sin;
+	struct addrinfo *res;
+	struct auditinfo_addr aia;
+	int error;
+
+	if (getachost(hoststr, MAXHOSTNAMELEN) != 0) {
+		syslog(LOG_WARNING,
+		    "warning: failed to read 'host' param in control file");
+		/*
+		 * To maintain reverse compatability with older audit_control
+		 * files, simply drop a warning if the host parameter has not
+		 * been set.  However, we will explicitly disable the
+		 * generation of extended audit header by passing in a zeroed
+		 * termid structure.
+		 */
+		bzero(&aia, sizeof(aia));
+		aia.ai_termid.at_type = AU_IPv4;
+		error = auditon(A_SETKAUDIT, &aia, sizeof(aia));
+		if (error < 0 && errno == ENOSYS)
+			return (0);
+		else if (error < 0) {
+			syslog(LOG_ERR,
+			    "Failed to set audit host info");
+			return (-1);
+		}
+		return (0);
+	}
+	error = getaddrinfo(hoststr, NULL, NULL, &res);
+	if (error) {
+		syslog(LOG_ERR, "Failed to lookup hostname: %s",  hoststr);
+		return (-1);
+	}
+	switch (res->ai_family) {
+	case PF_INET6:
+		sin6 = (struct sockaddr_in6 *) res->ai_addr;
+		bcopy(&sin6->sin6_addr.s6_addr,
+		    &aia.ai_termid.at_addr[0], sizeof(struct in6_addr));
+		aia.ai_termid.at_type = AU_IPv6;
+		break;
+	case PF_INET:
+		sin = (struct sockaddr_in *) res->ai_addr;
+		bcopy(&sin->sin_addr.s_addr,
+		    &aia.ai_termid.at_addr[0], sizeof(struct in_addr));
+		aia.ai_termid.at_type = AU_IPv4;
+		break;
+	default:
+		syslog(LOG_ERR,
+		    "Un-supported address family in host parameter");
+		return (-1);
+	}
+	if (auditon(A_SETKAUDIT, &aia, sizeof(aia)) < 0) {
+		syslog(LOG_ERR,
+		    "auditon: failed to set audit host information");
+		return (-1);
+	}
+	return (0);
+}
+
 /*
  * Reap our children.
  */
@@ -675,6 +864,61 @@ handle_sigchld(void)
 /*
  * Read the control file for triggers/signals and handle appropriately.
  */
+#ifdef USE_MACH_IPC
+#define	MAX_MSG_SIZE	4096
+
+static boolean_t
+auditd_combined_server(mach_msg_header_t *InHeadP,
+    mach_msg_header_t *OutHeadP)
+{
+	mach_port_t local_port = InHeadP->msgh_local_port;
+
+	if (local_port == signal_port) {
+		int signo = InHeadP->msgh_id;
+		int ret;
+
+		switch(signo) {
+		case SIGTERM:
+			ret = close_all();
+			exit(ret);
+
+		case SIGCHLD:
+			handle_sigchld();
+			return (TRUE);
+
+		case SIGHUP:
+			handle_sighup();
+			return (TRUE);
+
+		default:
+			syslog(LOG_INFO, "Received signal %d", signo);
+			return (TRUE);
+		}
+	} else if (local_port == control_port) {
+		boolean_t result;
+
+		result = audit_triggers_server(InHeadP, OutHeadP);
+		if (!result)
+			result = auditd_control_server(InHeadP, OutHeadP);
+			return (result);
+	}
+	syslog(LOG_INFO, "Recevied msg on bad port 0x%x.", local_port);
+	return (FALSE);
+}
+
+static int
+wait_for_events(void)
+{
+	kern_return_t   result;
+
+	result = mach_msg_server(auditd_combined_server, MAX_MSG_SIZE,
+	    port_set, MACH_MSG_OPTION_NONE);
+	syslog(LOG_ERR, "abnormal exit\n");
+	return (close_all());
+}
+
+#else /* ! USE_MACH_IPC */
+
 static int
 wait_for_events(void)
 {
@@ -706,10 +950,11 @@ wait_for_events(void)
 		if (trigger == AUDIT_TRIGGER_CLOSE_AND_DIE)
 			break;
 		else
-			handle_audit_trigger(trigger);
+			(void)handle_audit_trigger(trigger);
 	}
 	return (close_all());
 }
+#endif /* ! USE_MACH_IPC */
 
 /*
  * Configure the audit controls in the kernel: the event to class mapping,
@@ -817,9 +1062,62 @@ config_audit_controls(void)
 	} else
 		syslog(LOG_ERR, "Failed to obtain filesz: %m");
 
-	return (0);
+	return (config_audit_host());
 }
 
+#ifdef USE_MACH_IPC
+static void
+mach_setup(void)
+{
+	mach_msg_type_name_t poly;
+
+	/*
+	 * Allocate a port set
+	 */
+	if (mach_port_allocate(mach_task_self(), MACH_PORT_RIGHT_PORT_SET,
+	    &port_set) != KERN_SUCCESS)  {
+		syslog(LOG_ERR, "Allocation of port set failed");
+		fail_exit();
+	}
+
+	/*
+	 * Allocate a signal reflection port
+	 */
+	if (mach_port_allocate(mach_task_self(), MACH_PORT_RIGHT_RECEIVE,
+	    &signal_port) != KERN_SUCCESS ||
+	    mach_port_move_member(mach_task_self(), signal_port, port_set) !=
+	    KERN_SUCCESS)  {
+		syslog(LOG_ERR, "Allocation of signal port failed");
+		fail_exit();
+	}
+
+	/*
+	 * Allocate a trigger port
+	 */
+	if (mach_port_allocate(mach_task_self(), MACH_PORT_RIGHT_RECEIVE,
+	    &control_port) != KERN_SUCCESS ||
+	    mach_port_move_member(mach_task_self(), control_port, port_set)
+	    != KERN_SUCCESS)
+		syslog(LOG_ERR, "Allocation of trigger port failed");
+
+        /*
+	 * Create a send right on our trigger port.
+	 */
+	mach_port_extract_right(mach_task_self(), control_port,
+	    MACH_MSG_TYPE_MAKE_SEND, &control_port, &poly);
+
+        /*
+	 * Register the trigger port with the kernel.
+	 */
+	if (host_set_audit_control_port(mach_host_self(), control_port) != 
+	    KERN_SUCCESS) {
+		syslog(LOG_ERR, "Cannot set Mach control port");
+		fail_exit();
+	} else
+		syslog(LOG_DEBUG, "Mach control port registered");
+}
+#endif /* USE_MACH_IPC */
+
 static void
 setup(void)
 {
@@ -828,13 +1126,17 @@ setup(void)
 	int aufd;
 	token_t *tok;
 
+#ifdef USE_MACH_IPC
+	mach_setup();
+#else
 	if ((triggerfd = open(AUDIT_TRIGGER_FILE, O_RDONLY, 0)) < 0) {
 		syslog(LOG_ERR, "Error opening trigger file");
 		fail_exit();
 	}
+#endif
 
 	/*
-	 * To provide event feedback cycles and avoid auditd becoming
+	 * To prevent event feedback cycles and avoid auditd becoming
 	 * stalled if auditing is suspended, auditd and its children run
 	 * without their events being audited.  We allow the uid, tid, and
 	 * mask fields to be implicitly set to zero, but do set the pid.  We
@@ -890,7 +1192,7 @@ main(int argc, char **argv)
 {
 	int ch;
 	int debug = 0;
-	int rc;
+	int rc, logopts;
 
 	while ((ch = getopt(argc, argv, "d")) != -1) {
 		switch(ch) {
@@ -907,10 +1209,14 @@ main(int argc, char **argv)
 		}
 	}
 
+	logopts = LOG_CONS | LOG_PID;
+	if (debug != 0)
+		logopts |= LOG_PERROR;
+
 #ifdef LOG_SECURITY
-	openlog("auditd", LOG_CONS | LOG_PID, LOG_SECURITY);
+	openlog("auditd", logopts, LOG_SECURITY);
 #else
-	openlog("auditd", LOG_CONS | LOG_PID, LOG_AUTH);
+	openlog("auditd", logopts, LOG_AUTH);
 #endif
 	syslog(LOG_INFO, "starting...");
 
diff --git a/contrib/openbsm/bin/auditd/auditd.h b/contrib/openbsm/bin/auditd/auditd.h
index 8b2416a..688aea3 100644
--- a/contrib/openbsm/bin/auditd/auditd.h
+++ b/contrib/openbsm/bin/auditd/auditd.h
@@ -1,5 +1,5 @@
-/*
- * Copyright (c) 2005 Apple Computer, Inc.
+/*-
+ * Copyright (c) 2005 Apple Inc.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -11,7 +11,7 @@
  * 2.  Redistributions in binary form must reproduce the above copyright
  *     notice, this list of conditions and the following disclaimer in the
  *     documentation and/or other materials provided with the distribution.
- * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
  *     its contributors may be used to endorse or promote products derived
  *     from this software without specific prior written permission.
  *
@@ -26,7 +26,7 @@
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  *
- * $P4: //depot/projects/trustedbsd/openbsm/bin/auditd/auditd.h#8 $
+ * $P4: //depot/projects/trustedbsd/openbsm/bin/auditd/auditd.h#11 $
  */
 
 #ifndef _AUDITD_H_
@@ -46,8 +46,10 @@
  */
 #define	AUDIT_REVIEW_GROUP	"audit"
 
-#define	POSTFIX_LEN		16
-#define	NOT_TERMINATED	".not_terminated"
+#define	NOT_TERMINATED		"not_terminated"
+#define	POSTFIX_LEN	(sizeof("YYYYMMDDhhmmss") - 1)
+#define	FILENAME_LEN	((2 * POSTFIX_LEN) + 2)
+#define	TIMESTAMP_LEN	(POSTFIX_LEN + 1)	
 
 struct dir_ent {
 	char			*dirname;
diff --git a/contrib/openbsm/bin/auditd/auditd_control.defs b/contrib/openbsm/bin/auditd/auditd_control.defs
new file mode 100644
index 0000000..f06fe01
--- /dev/null
+++ b/contrib/openbsm/bin/auditd/auditd_control.defs
@@ -0,0 +1,49 @@
+/*-
+ * Copyright (c) 1999-2007 Apple Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR
+ * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ *
+ * $P4: //depot/projects/trustedbsd/openbsm/bin/auditd/auditd_control.defs#2 $
+ */
+
+/*
+ * Exported client calls to the auditd facility.
+ */
+
+Subsystem
+	KernelUser
+	auditd_control 	456;
+
+#ifndef __MigTypeCheck
+#define 	__MigTypeCheck	1
+#endif
+
+#include <mach/std_types.defs>
+#include <mach/mach_types.defs>
+
+simpleroutine auditd_control(
+			auditd_port	:	mach_port_t; 
+		in	trigger		:	int);
diff --git a/contrib/openbsm/bin/auditfilterd/Makefile.am b/contrib/openbsm/bin/auditfilterd/Makefile.am
index b8d96a4..83399f1 100644
--- a/contrib/openbsm/bin/auditfilterd/Makefile.am
+++ b/contrib/openbsm/bin/auditfilterd/Makefile.am
@@ -1,8 +1,12 @@
 #
-# $P4: //depot/projects/trustedbsd/openbsm/bin/auditfilterd/Makefile.am#1 $
+# $P4: //depot/projects/trustedbsd/openbsm/bin/auditfilterd/Makefile.am#3 $
 #
 
-INCLUDES = -I$(top_srcdir)
+if USE_NATIVE_INCLUDES
+INCLUDES = -I$(top_builddir) -I$(top_srcdir)
+else
+INCLUDES = -I$(top_builddir) -I$(top_srcdir) -I$(top_srcdir)/sys
+endif
 
 sbin_PROGRAMS = auditfilterd
 auditfilterd_SOURCES = auditfilterd_conf.c auditfilterd.c
diff --git a/contrib/openbsm/bin/auditfilterd/Makefile.in b/contrib/openbsm/bin/auditfilterd/Makefile.in
index 11741f3..874e106 100644
--- a/contrib/openbsm/bin/auditfilterd/Makefile.in
+++ b/contrib/openbsm/bin/auditfilterd/Makefile.in
@@ -15,7 +15,7 @@
 @SET_MAKE@
 
 #
-# $P4: //depot/projects/trustedbsd/openbsm/bin/auditfilterd/Makefile.in#2 $
+# $P4: //depot/projects/trustedbsd/openbsm/bin/auditfilterd/Makefile.in#6 $
 #
 
 VPATH = @srcdir@
@@ -114,6 +114,7 @@ LN_S = @LN_S@
 LTLIBOBJS = @LTLIBOBJS@
 MAINT = @MAINT@
 MAKEINFO = @MAKEINFO@
+MIG = @MIG@
 MKDIR_P = @MKDIR_P@
 OBJEXT = @OBJEXT@
 PACKAGE = @PACKAGE@
@@ -180,7 +181,8 @@ sysconfdir = @sysconfdir@
 target_alias = @target_alias@
 top_builddir = @top_builddir@
 top_srcdir = @top_srcdir@
-INCLUDES = -I$(top_srcdir)
+@USE_NATIVE_INCLUDES_FALSE@INCLUDES = -I$(top_builddir) -I$(top_srcdir) -I$(top_srcdir)/sys
+@USE_NATIVE_INCLUDES_TRUE@INCLUDES = -I$(top_builddir) -I$(top_srcdir)
 auditfilterd_SOURCES = auditfilterd_conf.c auditfilterd.c
 auditfilterd_LDADD = $(top_builddir)/libbsm/libbsm.la
 man8_MANS = auditfilterd.8
diff --git a/contrib/openbsm/bin/auditfilterd/auditfilterd.c b/contrib/openbsm/bin/auditfilterd/auditfilterd.c
index 110b7cf..ba42834 100644
--- a/contrib/openbsm/bin/auditfilterd/auditfilterd.c
+++ b/contrib/openbsm/bin/auditfilterd/auditfilterd.c
@@ -25,7 +25,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $P4: //depot/projects/trustedbsd/openbsm/bin/auditfilterd/auditfilterd.c#11 $
+ * $P4: //depot/projects/trustedbsd/openbsm/bin/auditfilterd/auditfilterd.c#13 $
  */
 
 /*
@@ -54,6 +54,7 @@
 
 #include <bsm/libbsm.h>
 #include <bsm/audit_filter.h>
+#include <bsm/audit_internal.h>
 
 #include <err.h>
 #include <fcntl.h>
@@ -216,7 +217,7 @@ mainloop_file(const char *conffile, const char *trailfile, FILE *trail_fp)
  * from a file stream.
  */
 static void
-mainloop_pipe(const char *conffile, const char *pipefile, int pipe_fd)
+mainloop_pipe(const char *conffile, const char *pipefile __unused, int pipe_fd)
 {
 	u_char record[MAX_AUDIT_RECORD_SIZE];
 	struct timespec ts;
diff --git a/contrib/openbsm/bin/auditreduce/Makefile.am b/contrib/openbsm/bin/auditreduce/Makefile.am
index cce29a6..8cd4b62 100644
--- a/contrib/openbsm/bin/auditreduce/Makefile.am
+++ b/contrib/openbsm/bin/auditreduce/Makefile.am
@@ -1,8 +1,12 @@
 #
-# $P4: //depot/projects/trustedbsd/openbsm/bin/auditreduce/Makefile.am#1 $
+# $P4: //depot/projects/trustedbsd/openbsm/bin/auditreduce/Makefile.am#3 $
 #
 
-INCLUDES = -I$(top_srcdir)
+if USE_NATIVE_INCLUDES
+INCLUDES = -I$(top_builddir) -I$(top_srcdir)
+else
+INCLUDES = -I$(top_builddir) -I$(top_srcdir) -I$(top_srcdir)/sys
+endif
 
 sbin_PROGRAMS = auditreduce
 auditreduce_SOURCES = auditreduce.c
diff --git a/contrib/openbsm/bin/auditreduce/Makefile.in b/contrib/openbsm/bin/auditreduce/Makefile.in
index 7dae162..b18513f 100644
--- a/contrib/openbsm/bin/auditreduce/Makefile.in
+++ b/contrib/openbsm/bin/auditreduce/Makefile.in
@@ -15,7 +15,7 @@
 @SET_MAKE@
 
 #
-# $P4: //depot/projects/trustedbsd/openbsm/bin/auditreduce/Makefile.in#4 $
+# $P4: //depot/projects/trustedbsd/openbsm/bin/auditreduce/Makefile.in#8 $
 #
 
 VPATH = @srcdir@
@@ -113,6 +113,7 @@ LN_S = @LN_S@
 LTLIBOBJS = @LTLIBOBJS@
 MAINT = @MAINT@
 MAKEINFO = @MAKEINFO@
+MIG = @MIG@
 MKDIR_P = @MKDIR_P@
 OBJEXT = @OBJEXT@
 PACKAGE = @PACKAGE@
@@ -179,7 +180,8 @@ sysconfdir = @sysconfdir@
 target_alias = @target_alias@
 top_builddir = @top_builddir@
 top_srcdir = @top_srcdir@
-INCLUDES = -I$(top_srcdir)
+@USE_NATIVE_INCLUDES_FALSE@INCLUDES = -I$(top_builddir) -I$(top_srcdir) -I$(top_srcdir)/sys
+@USE_NATIVE_INCLUDES_TRUE@INCLUDES = -I$(top_builddir) -I$(top_srcdir)
 auditreduce_SOURCES = auditreduce.c
 auditreduce_LDADD = $(top_builddir)/libbsm/libbsm.la
 man1_MANS = auditreduce.1
diff --git a/contrib/openbsm/bin/auditreduce/auditreduce.1 b/contrib/openbsm/bin/auditreduce/auditreduce.1
index 1f900f9..6151f6e 100644
--- a/contrib/openbsm/bin/auditreduce/auditreduce.1
+++ b/contrib/openbsm/bin/auditreduce/auditreduce.1
@@ -1,4 +1,4 @@
-.\" Copyright (c) 2004 Apple Computer, Inc.
+.\" Copyright (c) 2004 Apple Inc.
 .\" All rights reserved.
 .\"
 .\" Redistribution and use in source and binary forms, with or without
@@ -9,7 +9,7 @@
 .\" 2.  Redistributions in binary form must reproduce the above copyright
 .\"     notice, this list of conditions and the following disclaimer in the
 .\"     documentation and/or other materials provided with the distribution.
-.\" 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+.\" 3.  Neither the name of Apple Inc. ("Apple") nor the names of
 .\"     its contributors may be used to endorse or promote products derived
 .\"     from this software without specific prior written permission.
 .\"
@@ -25,7 +25,7 @@
 .\" IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 .\" POSSIBILITY OF SUCH DAMAGE.
 .\"
-.\" $P4: //depot/projects/trustedbsd/openbsm/bin/auditreduce/auditreduce.1#14 $
+.\" $P4: //depot/projects/trustedbsd/openbsm/bin/auditreduce/auditreduce.1#17 $
 .\"
 .Dd January 24, 2004
 .Dt AUDITREDUCE 1
@@ -48,6 +48,7 @@
 .Op Fl o Ar object Ns = Ns Ar value
 .Op Fl r Ar ruid
 .Op Fl u Ar auid
+.Op Fl v
 .Op Ar
 .Sh DESCRIPTION
 The
@@ -93,7 +94,8 @@ Select records with the given real group ID or name.
 .It Fl j Ar id
 Select records having a subject token with matching ID.
 .It Fl m Ar event
-Select records with the given event name or number.
+Select records with the given event name or number. This option can
+be used more then once to select records of multiple event types.
 See
 .Xr audit_event 5
 for a description of audit event names and numbers.
@@ -127,6 +129,8 @@ Select records containing the given shared memory ID.
 Select records with the given real user ID or name.
 .It Fl u Ar auid
 Select records with the given audit ID.
+.It Fl v
+Invert sense of matching, to select records that do not match.
 .El
 .Sh EXAMPLES
 To select all records associated with effective user ID root from the audit
diff --git a/contrib/openbsm/bin/auditreduce/auditreduce.c b/contrib/openbsm/bin/auditreduce/auditreduce.c
index c647bc9..f22f454 100644
--- a/contrib/openbsm/bin/auditreduce/auditreduce.c
+++ b/contrib/openbsm/bin/auditreduce/auditreduce.c
@@ -1,5 +1,5 @@
-/*
- * Copyright (c) 2004 Apple Computer, Inc.
+/*-
+ * Copyright (c) 2004-2008 Apple Inc.
  * All rights reserved.
  * 
  * Redistribution and use in source and binary forms, with or without
@@ -10,7 +10,7 @@
  * 2.  Redistributions in binary form must reproduce the above copyright
  *     notice, this list of conditions and the following disclaimer in the
  *     documentation and/or other materials provided with the distribution. 
- * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
  *     its contributors may be used to endorse or promote products derived
  *     from this software without specific prior written permission. 
  * 
@@ -26,7 +26,7 @@
  * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  * POSSIBILITY OF SUCH DAMAGE.
  *
- * $P4: //depot/projects/trustedbsd/openbsm/bin/auditreduce/auditreduce.c#20 $
+ * $P4: //depot/projects/trustedbsd/openbsm/bin/auditreduce/auditreduce.c#28 $
  */
 
 /* 
@@ -61,6 +61,10 @@
 #include <regex.h>
 #include <errno.h>
 
+#ifndef HAVE_STRLCPY
+#include <compat/strlcpy.h>
+#endif
+
 #include "auditreduce.h"
 
 static TAILQ_HEAD(tailhead, re_entry) re_head =
@@ -72,7 +76,6 @@ extern int		 optind, optopt, opterr,optreset;
 static au_mask_t	 maskp;		/* Class. */
 static time_t		 p_atime;	/* Created after this time. */
 static time_t		 p_btime;	/* Created before this time. */
-static uint16_t		 p_evtype;	/* Event that we are searching for. */
 static int		 p_auid;	/* Audit id. */ 
 static int		 p_euid;	/* Effective user id. */
 static int		 p_egid;	/* Effective group id. */ 
@@ -81,6 +84,13 @@ static int		 p_ruid;	/* Real user id. */
 static int		 p_subid;	/* Subject id. */
 
 /*
+ * Maintain a dynamically sized array of events for -m
+ */
+static uint16_t		*p_evec;	/* Event type list */
+static int		 p_evec_used;	/* Number of events used */
+static int		 p_evec_alloc;	/* Number of events allocated */
+
+/*
  * Following are the objects (-o option) that we can select upon.
  */
 static char	*p_fileobj = NULL;
@@ -105,7 +115,7 @@ parse_regexp(char *re_string)
 	for (nstrs = 0, i = 0; i < len; i++) {
 		if (copy[i] == ',' && i > 0) {
 			if (copy[i - 1] == '\\')
-				strcpy(&copy[i - 1], &copy[i]);
+				strlcpy(&copy[i - 1], &copy[i], len);
 			else {
 				nstrs++;
 				copy[i] = '\0';
@@ -163,6 +173,7 @@ usage(const char *msg)
 	fprintf(stderr, "\t\t shmid=<ID>\n");
 	fprintf(stderr, "\t-r <uid|name> : real user\n");
 	fprintf(stderr, "\t-u <uid|name> : audit user\n");
+	fprintf(stderr, "\t-v : select non-matching records\n");
 	exit(EX_USAGE);
 }
 
@@ -265,7 +276,7 @@ select_pidobj(uint32_t pid)
 {
 
 	if (ISOPTSET(opttochk, OPT_op)) {
-		if (pid != strtol(p_pidobj, (char **)NULL, 10))
+		if (pid != (uint32_t)strtol(p_pidobj, (char **)NULL, 10))
 			return (0);
 	} 
 	return (1);
@@ -282,21 +293,22 @@ select_ipcobj(u_char type, uint32_t id, uint32_t *optchkd)
 	if (type == AT_IPC_MSG) {
 		SETOPT((*optchkd), OPT_om);
 		if (ISOPTSET(opttochk, OPT_om)) {
-			if (id != strtol(p_msgqobj, (char **)NULL, 10))
+			if (id != (uint32_t)strtol(p_msgqobj, (char **)NULL,
+			    10))
 				return (0);
 		}
 		return (1);
 	} else if (type == AT_IPC_SEM) {
 		SETOPT((*optchkd), OPT_ose);
 		if (ISOPTSET(opttochk, OPT_ose)) {
-			if (id != strtol(p_semobj, (char **)NULL, 10))
+			if (id != (uint32_t)strtol(p_semobj, (char **)NULL, 10))
 				return (0);
 		}
 		return (1);
 	} else if (type == AT_IPC_SHM) {
 		SETOPT((*optchkd), OPT_osh);
 		if (ISOPTSET(opttochk, OPT_osh)) {
-			if (id != strtol(p_shmobj, (char **)NULL, 10))
+			if (id != (uint32_t)strtol(p_shmobj, (char **)NULL, 10))
 				return (0);
 		}
 		return (1);
@@ -345,8 +357,10 @@ select_filepath(char *path, uint32_t *optchkd)
 static int
 select_hdr32(tokenstr_t tok, uint32_t *optchkd)
 {
+	uint16_t *ev;
+	int match;
 
-	SETOPT((*optchkd), (OPT_A | OPT_a | OPT_b | OPT_c | OPT_m));
+	SETOPT((*optchkd), (OPT_A | OPT_a | OPT_b | OPT_c | OPT_m | OPT_v));
 
 	/* The A option overrides a, b and d. */
 	if (!ISOPTSET(opttochk, OPT_A)) {
@@ -377,7 +391,11 @@ select_hdr32(tokenstr_t tok, uint32_t *optchkd)
 
 	/* Check if event matches. */
 	if (ISOPTSET(opttochk, OPT_m)) {
-		if (tok.tt.hdr32.e_type != p_evtype)
+		match = 0;
+		for (ev = p_evec; ev < &p_evec[p_evec_used]; ev++)
+			if (tok.tt.hdr32.e_type == *ev)
+				match = 1;
+		if (match == 0)
 			return (0);
 	}
 		
@@ -476,6 +494,7 @@ select_records(FILE *fp)
 	int bytesread;
 	int selected;
 	uint32_t optchkd;
+	int print;
 
 	int err = 0;
 	while ((reclen = au_read_rec(fp, &buf)) != -1) {
@@ -495,75 +514,50 @@ select_records(FILE *fp)
 			 * selection criteria.
 			 */
 			switch(tok.id) {
-			case AU_HEADER_32_TOKEN:
+			case AUT_HEADER32:
 					selected = select_hdr32(tok,
 					    &optchkd);
 					bcopy(&tok, &tok_hdr32_copy,
 					    sizeof(tok));
 					break;
 
-			case AU_PROCESS_32_TOKEN:
+			case AUT_PROCESS32:
 					selected = select_proc32(tok,
 					    &optchkd);
 					break;
 
-			case AU_SUBJECT_32_TOKEN:
+			case AUT_SUBJECT32:
 					selected = select_subj32(tok,
 					    &optchkd);
 					break;
 
-			case AU_IPC_TOKEN:
+			case AUT_IPC:
 					selected = select_ipcobj(
 					    tok.tt.ipc.type, tok.tt.ipc.id,
 					    &optchkd); 
 					break;
 
-			case AU_FILE_TOKEN:
-					selected = select_filepath(
-					    tok.tt.file.name, &optchkd);
-					break;
-
-			case AU_PATH_TOKEN:
+			case AUT_PATH:
 					selected = select_filepath(
 					    tok.tt.path.path, &optchkd);
 					break;	
 
-			case AU_RETURN_32_TOKEN:
+			case AUT_RETURN32:
 				selected = select_return32(tok,
 				    tok_hdr32_copy, &optchkd);
 				break;
 
-			/* 
-			 * The following tokens dont have any relevant
-			 * attributes that we can select upon.
-			 */
-			case AU_TRAILER_TOKEN:
-			case AU_ARG32_TOKEN:
-			case AU_ATTR32_TOKEN:
-			case AU_EXIT_TOKEN:
-			case AU_NEWGROUPS_TOKEN:
-			case AU_IN_ADDR_TOKEN:
-			case AU_IP_TOKEN:
-			case AU_IPCPERM_TOKEN:
-			case AU_IPORT_TOKEN:
-			case AU_OPAQUE_TOKEN:
-			case AU_SEQ_TOKEN:
-			case AU_TEXT_TOKEN:
-			case AU_ARB_TOKEN:
-			case AU_SOCK_TOKEN:
 			default:
 				break;
 			}
 			bytesread += tok.len;
 		}
-		if ((selected == 1) && (!err)) {
-			/* Check if all the options were matched. */
-			if (!(opttochk & ~optchkd)) {
-				/* XXX Write this record to the output file. */
-				/* default to stdout */
-				fwrite(buf, 1, reclen, stdout);
-			}
-		}
+		/* Check if all the options were matched. */
+		print = ((selected == 1) && (!err) && (!(opttochk & ~optchkd)));
+		if (ISOPTSET(opttochk, OPT_v))
+			print = !print;
+		if (print)
+			(void) fwrite(buf, 1, reclen, stdout);
 		free(buf);
 	}
 	return (0);
@@ -615,10 +609,11 @@ main(int argc, char **argv)
 	int ch;
 	char timestr[128];
 	char *fname;
+	uint16_t *etp;
 
 	converr = NULL;
 
-	while ((ch = getopt(argc, argv, "Aa:b:c:d:e:f:g:j:m:o:r:u:")) != -1) {
+	while ((ch = getopt(argc, argv, "Aa:b:c:d:e:f:g:j:m:o:r:u:v")) != -1) {
 		switch(ch) {
 		case 'A':
 			SETOPT(opttochk, OPT_A);
@@ -715,13 +710,26 @@ main(int argc, char **argv)
 			break;
 
 		case 'm':
-			p_evtype = strtol(optarg, (char **)NULL, 10);
-			if (p_evtype == 0) {
+			if (p_evec == NULL) {
+				p_evec_alloc = 32;
+				p_evec = malloc(sizeof(*etp) * p_evec_alloc);
+				if (p_evec == NULL)
+					err(1, "malloc");
+			} else if (p_evec_alloc == p_evec_used) {
+				p_evec_alloc <<= 1;
+				p_evec = realloc(p_evec,
+				    sizeof(*p_evec) * p_evec_alloc);
+				if (p_evec == NULL)
+					err(1, "realloc");
+			}
+			etp = &p_evec[p_evec_used++];
+			*etp = strtol(optarg, (char **)NULL, 10);
+			if (*etp == 0) {
 				/* Could be the string representation. */
 				n = getauevnonam(optarg);
 				if (n == NULL)
 					usage("Incorrect event name");
-				p_evtype = *n;
+				*etp = *n;
 			}
 			SETOPT(opttochk, OPT_m);
 			break;
@@ -755,6 +763,10 @@ main(int argc, char **argv)
 			SETOPT(opttochk, OPT_u);
 			break;
 
+		case 'v':
+			SETOPT(opttochk, OPT_v);
+			break;
+
 		case '?':
 		default:
 			usage("Unknown option");
diff --git a/contrib/openbsm/bin/auditreduce/auditreduce.h b/contrib/openbsm/bin/auditreduce/auditreduce.h
index f69dc16..5f54893 100644
--- a/contrib/openbsm/bin/auditreduce/auditreduce.h
+++ b/contrib/openbsm/bin/auditreduce/auditreduce.h
@@ -1,5 +1,5 @@
-/*
- * Copyright (c) 2004 Apple Computer, Inc.
+/*-
+ * Copyright (c) 2004 Apple Inc.
  * All rights reserved.
  * 
  * Redistribution and use in source and binary forms, with or without
@@ -10,7 +10,7 @@
  * 2.  Redistributions in binary form must reproduce the above copyright
  *     notice, this list of conditions and the following disclaimer in the
  *     documentation and/or other materials provided with the distribution. 
- * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
  *     its contributors may be used to endorse or promote products derived
  *     from this software without specific prior written permission. 
  * 
@@ -26,7 +26,7 @@
  * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  * POSSIBILITY OF SUCH DAMAGE.
  *
- * $P4: //depot/projects/trustedbsd/openbsm/bin/auditreduce/auditreduce.h#5 $
+ * $P4: //depot/projects/trustedbsd/openbsm/bin/auditreduce/auditreduce.h#7 $
  */
 
 #ifndef _AUDITREDUCE_H_
@@ -58,6 +58,7 @@ struct re_entry {
 #define OPT_r	0x00008000
 #define OPT_u	0x00010000
 #define OPT_A	0x00020000
+#define OPT_v	0x00040000
 
 #define FILEOBJ "file"
 #define MSGQIDOBJ "msgqid"
diff --git a/contrib/openbsm/bin/praudit/Makefile.am b/contrib/openbsm/bin/praudit/Makefile.am
index 317567f..a362cea 100644
--- a/contrib/openbsm/bin/praudit/Makefile.am
+++ b/contrib/openbsm/bin/praudit/Makefile.am
@@ -1,8 +1,12 @@
 #
-# $P4: //depot/projects/trustedbsd/openbsm/bin/praudit/Makefile.am#1 $
+# $P4: //depot/projects/trustedbsd/openbsm/bin/praudit/Makefile.am#3 $
 #
 
-INCLUDES = -I$(top_srcdir)
+if USE_NATIVE_INCLUDES
+INCLUDES = -I$(top_builddir) -I$(top_srcdir)
+else
+INCLUDES = -I$(top_builddir) -I$(top_srcdir) -I$(top_srcdir)/sys
+endif
 
 sbin_PROGRAMS = praudit
 praudit_SOURCES = praudit.c
diff --git a/contrib/openbsm/bin/praudit/Makefile.in b/contrib/openbsm/bin/praudit/Makefile.in
index b2c01b3..4472757 100644
--- a/contrib/openbsm/bin/praudit/Makefile.in
+++ b/contrib/openbsm/bin/praudit/Makefile.in
@@ -15,7 +15,7 @@
 @SET_MAKE@
 
 #
-# $P4: //depot/projects/trustedbsd/openbsm/bin/praudit/Makefile.in#4 $
+# $P4: //depot/projects/trustedbsd/openbsm/bin/praudit/Makefile.in#8 $
 #
 
 VPATH = @srcdir@
@@ -113,6 +113,7 @@ LN_S = @LN_S@
 LTLIBOBJS = @LTLIBOBJS@
 MAINT = @MAINT@
 MAKEINFO = @MAKEINFO@
+MIG = @MIG@
 MKDIR_P = @MKDIR_P@
 OBJEXT = @OBJEXT@
 PACKAGE = @PACKAGE@
@@ -179,7 +180,8 @@ sysconfdir = @sysconfdir@
 target_alias = @target_alias@
 top_builddir = @top_builddir@
 top_srcdir = @top_srcdir@
-INCLUDES = -I$(top_srcdir)
+@USE_NATIVE_INCLUDES_FALSE@INCLUDES = -I$(top_builddir) -I$(top_srcdir) -I$(top_srcdir)/sys
+@USE_NATIVE_INCLUDES_TRUE@INCLUDES = -I$(top_builddir) -I$(top_srcdir)
 praudit_SOURCES = praudit.c
 praudit_LDADD = $(top_builddir)/libbsm/libbsm.la
 man1_MANS = praudit.1
diff --git a/contrib/openbsm/bin/praudit/praudit.1 b/contrib/openbsm/bin/praudit/praudit.1
index c32c37c..6a4fef0 100644
--- a/contrib/openbsm/bin/praudit/praudit.1
+++ b/contrib/openbsm/bin/praudit/praudit.1
@@ -1,4 +1,4 @@
-.\" Copyright (c) 2004 Apple Computer, Inc.
+.\" Copyright (c) 2004 Apple Inc.
 .\" All rights reserved.
 .\"
 .\" Redistribution and use in source and binary forms, with or without
@@ -9,7 +9,7 @@
 .\" 2.  Redistributions in binary form must reproduce the above copyright
 .\"     notice, this list of conditions and the following disclaimer in the
 .\"     documentation and/or other materials provided with the distribution.
-.\" 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+.\" 3.  Neither the name of Apple Inc. ("Apple") nor the names of
 .\"     its contributors may be used to endorse or promote products derived
 .\"     from this software without specific prior written permission.
 .\"
@@ -25,7 +25,7 @@
 .\" IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 .\" POSSIBILITY OF SUCH DAMAGE.
 .\"
-.\" $P4: //depot/projects/trustedbsd/openbsm/bin/praudit/praudit.1#12 $
+.\" $P4: //depot/projects/trustedbsd/openbsm/bin/praudit/praudit.1#13 $
 .\"
 .Dd November 5, 2006
 .Dt PRAUDIT 1
diff --git a/contrib/openbsm/bin/praudit/praudit.c b/contrib/openbsm/bin/praudit/praudit.c
index 42f7383..a1dbf9d 100644
--- a/contrib/openbsm/bin/praudit/praudit.c
+++ b/contrib/openbsm/bin/praudit/praudit.c
@@ -1,5 +1,5 @@
-/*
- * Copyright (c) 2004 Apple Computer, Inc.
+/*-
+ * Copyright (c) 2004-2008 Apple Inc.
  * Copyright (c) 2006 Martin Voros
  * All rights reserved.
  *
@@ -27,7 +27,7 @@
  * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  * POSSIBILITY OF SUCH DAMAGE.
  *
- * $P4: //depot/projects/trustedbsd/openbsm/bin/praudit/praudit.c#12 $
+ * $P4: //depot/projects/trustedbsd/openbsm/bin/praudit/praudit.c#14 $
  */
 
 /*
@@ -80,7 +80,7 @@ print_tokens(FILE *fp)
 		/* Record must begin with a header token. */
 		do {
 			type = fgetc(fp);
-		} while(type != AU_HEADER_32_TOKEN);
+		} while(type != AUT_HEADER32);
 		ungetc(type, fp);
 	}
 
diff --git a/contrib/openbsm/bsm/Makefile.am b/contrib/openbsm/bsm/Makefile.am
index 8287789..cad4115 100644
--- a/contrib/openbsm/bsm/Makefile.am
+++ b/contrib/openbsm/bsm/Makefile.am
@@ -1,15 +1,11 @@
 #
-# $P4: //depot/projects/trustedbsd/openbsm/bsm/Makefile.am#2 $
+# $P4: //depot/projects/trustedbsd/openbsm/bsm/Makefile.am#3 $
 #
 
 openbsmdir = $(includedir)/bsm
 
 openbsm_HEADERS =		\
-	audit.h			\
 	audit_filter.h		\
-	audit_internal.h	\
-	audit_kevents.h		\
-	audit_record.h		\
 	audit_uevents.h		\
 	libbsm.h
 
diff --git a/contrib/openbsm/bsm/Makefile.in b/contrib/openbsm/bsm/Makefile.in
index a5ae086..ed82a3b 100644
--- a/contrib/openbsm/bsm/Makefile.in
+++ b/contrib/openbsm/bsm/Makefile.in
@@ -15,7 +15,7 @@
 @SET_MAKE@
 
 #
-# $P4: //depot/projects/trustedbsd/openbsm/bsm/Makefile.in#5 $
+# $P4: //depot/projects/trustedbsd/openbsm/bsm/Makefile.in#8 $
 #
 
 VPATH = @srcdir@
@@ -101,6 +101,7 @@ LN_S = @LN_S@
 LTLIBOBJS = @LTLIBOBJS@
 MAINT = @MAINT@
 MAKEINFO = @MAKEINFO@
+MIG = @MIG@
 MKDIR_P = @MKDIR_P@
 OBJEXT = @OBJEXT@
 PACKAGE = @PACKAGE@
@@ -169,11 +170,7 @@ top_builddir = @top_builddir@
 top_srcdir = @top_srcdir@
 openbsmdir = $(includedir)/bsm
 openbsm_HEADERS = \
-	audit.h			\
 	audit_filter.h		\
-	audit_internal.h	\
-	audit_kevents.h		\
-	audit_record.h		\
 	audit_uevents.h		\
 	libbsm.h
 
diff --git a/contrib/openbsm/bsm/audit_uevents.h b/contrib/openbsm/bsm/audit_uevents.h
index 0493e31..03d0f9b 100644
--- a/contrib/openbsm/bsm/audit_uevents.h
+++ b/contrib/openbsm/bsm/audit_uevents.h
@@ -1,5 +1,5 @@
-/*
- * Copyright (c) 2004 Apple Computer, Inc.
+/*-
+ * Copyright (c) 2004 Apple Inc.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -10,7 +10,7 @@
  * 2.  Redistributions in binary form must reproduce the above copyright
  *     notice, this list of conditions and the following disclaimer in the
  *     documentation and/or other materials provided with the distribution.
- * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
  *     its contributors may be used to endorse or promote products derived
  *     from this software without specific prior written permission.
  *
@@ -26,7 +26,7 @@
  * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  * POSSIBILITY OF SUCH DAMAGE.
  *
- * $P4: //depot/projects/trustedbsd/openbsm/bsm/audit_uevents.h#7 $
+ * $P4: //depot/projects/trustedbsd/openbsm/bsm/audit_uevents.h#8 $
  */
 
 #ifndef _BSM_AUDIT_UEVENTS_H_
diff --git a/contrib/openbsm/bsm/libbsm.h b/contrib/openbsm/bsm/libbsm.h
index b1a9731..97b9530 100644
--- a/contrib/openbsm/bsm/libbsm.h
+++ b/contrib/openbsm/bsm/libbsm.h
@@ -1,5 +1,5 @@
-/*
- * Copyright (c) 2004 Apple Computer, Inc.
+/*-
+ * Copyright (c) 2004 Apple Inc.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -10,7 +10,7 @@
  * 2.  Redistributions in binary form must reproduce the above copyright
  *     notice, this list of conditions and the following disclaimer in the
  *     documentation and/or other materials provided with the distribution.
- * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
  *     its contributors may be used to endorse or promote products derived
  *     from this software without specific prior written permission.
  *
@@ -26,7 +26,7 @@
  * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  * POSSIBILITY OF SUCH DAMAGE.
  *
- * $P4: //depot/projects/trustedbsd/openbsm/bsm/libbsm.h#33 $
+ * $P4: //depot/projects/trustedbsd/openbsm/bsm/libbsm.h#35 $
  */
 
 #ifndef _LIBBSM_H_
@@ -82,6 +82,7 @@
 #define	FLAGS_CONTROL_ENTRY	"flags"
 #define	NA_CONTROL_ENTRY	"naflags"
 #define	POLICY_CONTROL_ENTRY	"policy"
+#define	AUDIT_HOST_CONTROL_ENTRY	"host"
 
 #define	AU_CLASS_NAME_MAX	8
 #define	AU_CLASS_DESC_MAX	72
@@ -764,6 +765,7 @@ int			 getacfilesz(size_t *size_val);
 int			 getacflg(char *auditstr, int len);
 int			 getacna(char *auditstr, int len);
 int			 getacpol(char *auditstr, size_t len);
+int			 getachost(char *auditstr, size_t len);
 int			 getauditflagsbin(char *auditstr, au_mask_t *masks);
 int			 getauditflagschar(char *auditstr, au_mask_t *masks,
 			    int verbose);
diff --git a/contrib/openbsm/compat/clock_gettime.h b/contrib/openbsm/compat/clock_gettime.h
index fe6a806..ad9315f 100644
--- a/contrib/openbsm/compat/clock_gettime.h
+++ b/contrib/openbsm/compat/clock_gettime.h
@@ -23,7 +23,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $P4: //depot/projects/trustedbsd/openbsm/compat/clock_gettime.h#2 $
+ * $P4: //depot/projects/trustedbsd/openbsm/compat/clock_gettime.h#3 $
  */
 
 /*
diff --git a/contrib/openbsm/compat/strlcat.h b/contrib/openbsm/compat/strlcat.h
index ba836f8..f10109b 100644
--- a/contrib/openbsm/compat/strlcat.h
+++ b/contrib/openbsm/compat/strlcat.h
@@ -1,4 +1,4 @@
-/*
+/*-
  * Copyright (c) 1998 Todd C. Miller <Todd.Miller@courtesan.com>
  * All rights reserved.
  *
@@ -25,6 +25,7 @@
  * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  *
  * dollar OpenBSD: strlcat.c,v 1.2 1999/06/17 16:28:58 millert Exp dollar
+ * $P4: //depot/projects/trustedbsd/openbsm/compat/strlcat.h#3 $
  */
 
 /*
diff --git a/contrib/openbsm/compat/strlcpy.h b/contrib/openbsm/compat/strlcpy.h
new file mode 100644
index 0000000..2f6455d
--- /dev/null
+++ b/contrib/openbsm/compat/strlcpy.h
@@ -0,0 +1,63 @@
+/*
+ * Copyright (c) 1998 Todd C. Miller <Todd.Miller@courtesan.com>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. The name of the author may not be used to endorse or promote products
+ *    derived from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL
+ * THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
+ * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+ * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
+ * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
+ * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * dollar OpenBSD: strlcpy.c,v 1.4 1999/05/01 18:56:41 millert Exp dollar
+ * $P4: //depot/projects/trustedbsd/openbsm/compat/strlcpy.h#1 $
+ */
+
+/*
+ * Copy src to string dst of size siz.  At most siz-1 characters
+ * will be copied.  Always NUL terminates (unless siz == 0).
+ * Returns strlen(src); if retval >= siz, truncation occurred.
+ */
+static size_t
+strlcpy(dst, src, siz)
+	char *dst;
+	const char *src;
+	size_t siz;
+{
+	char *d = dst;
+	const char *s = src;
+	size_t n = siz;
+
+	/* Copy as many bytes as will fit */
+	if (n != 0 && --n != 0) {
+		do {
+			if ((*d++ = *s++) == 0)
+				break;
+		} while (--n != 0);
+	}
+
+	/* Not enough room in dst, add NUL and traverse rest of src */
+	if (n == 0) {
+		if (siz != 0)
+			*d = '\0';		/* NUL-terminate dst */
+		while (*s++)
+			;
+	}
+
+	return(s - src - 1);	/* count does not include NUL */
+}
diff --git a/contrib/openbsm/config/config.h b/contrib/openbsm/config/config.h
index ac6c6ab..b750910 100644
--- a/contrib/openbsm/config/config.h
+++ b/contrib/openbsm/config/config.h
@@ -41,6 +41,12 @@
 /* Define to 1 if you have the <inttypes.h> header file. */
 #define HAVE_INTTYPES_H 1
 
+/* Define if ipc_perm._key instead of key */
+/* #undef HAVE_IPC_PERM__KEY */
+
+/* Define if ipc_perm._seq instead of seq */
+/* #undef HAVE_IPC_PERM__SEQ */
+
 /* Define if ipc_perm.__key instead of key */
 /* #undef HAVE_IPC_PERM___KEY */
 
@@ -91,6 +97,9 @@
 /* Define to 1 if you have the `strlcat' function. */
 #define HAVE_STRLCAT 1
 
+/* Define to 1 if you have the `strlcpy' function. */
+#define HAVE_STRLCPY 1
+
 /* Define to 1 if you have the `strrchr' function. */
 #define HAVE_STRRCHR 1
 
@@ -150,13 +159,13 @@
 #define PACKAGE_NAME "OpenBSM"
 
 /* Define to the full name and version of this package. */
-#define PACKAGE_STRING "OpenBSM 1.0"
+#define PACKAGE_STRING "OpenBSM 1.1alpha2"
 
 /* Define to the one symbol short name of this package. */
 #define PACKAGE_TARNAME "openbsm"
 
 /* Define to the version of this package. */
-#define PACKAGE_VERSION "1.0"
+#define PACKAGE_VERSION "1.1alpha2"
 
 /* Define as the return type of signal handlers (`int' or `void'). */
 #define RETSIGTYPE void
@@ -170,8 +179,14 @@
 /* Define to 1 if your <sys/time.h> declares `struct tm'. */
 /* #undef TM_IN_SYS_TIME */
 
+/* Define if uses Mach IPC for Triggers messages */
+/* #undef USE_MACH_IPC */
+
+/* Define to use native include files */
+#define USE_NATIVE_INCLUDES 
+
 /* Version number of package */
-#define VERSION "1.0"
+#define VERSION "1.1alpha2"
 
 /* Define to empty if `const' does not conform to ANSI C. */
 /* #undef const */
diff --git a/contrib/openbsm/config/config.h.in b/contrib/openbsm/config/config.h.in
index 46fe85b..5ac71ab 100644
--- a/contrib/openbsm/config/config.h.in
+++ b/contrib/openbsm/config/config.h.in
@@ -39,6 +39,12 @@
 /* Define to 1 if you have the <inttypes.h> header file. */
 #undef HAVE_INTTYPES_H
 
+/* Define if ipc_perm._key instead of key */
+#undef HAVE_IPC_PERM__KEY
+
+/* Define if ipc_perm._seq instead of seq */
+#undef HAVE_IPC_PERM__SEQ
+
 /* Define if ipc_perm.__key instead of key */
 #undef HAVE_IPC_PERM___KEY
 
@@ -89,6 +95,9 @@
 /* Define to 1 if you have the `strlcat' function. */
 #undef HAVE_STRLCAT
 
+/* Define to 1 if you have the `strlcpy' function. */
+#undef HAVE_STRLCPY
+
 /* Define to 1 if you have the `strrchr' function. */
 #undef HAVE_STRRCHR
 
@@ -168,6 +177,12 @@
 /* Define to 1 if your <sys/time.h> declares `struct tm'. */
 #undef TM_IN_SYS_TIME
 
+/* Define if uses Mach IPC for Triggers messages */
+#undef USE_MACH_IPC
+
+/* Define to use native include files */
+#undef USE_NATIVE_INCLUDES
+
 /* Version number of package */
 #undef VERSION
 
diff --git a/contrib/openbsm/configure b/contrib/openbsm/configure
index e6056ae..e6cb1ce 100755
--- a/contrib/openbsm/configure
+++ b/contrib/openbsm/configure
@@ -1,7 +1,7 @@
 #! /bin/sh
-# From configure.ac P4: //depot/projects/trustedbsd/openbsm/configure.ac#35 .
+# From configure.ac P4: //depot/projects/trustedbsd/openbsm/configure.ac#41 .
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.61 for OpenBSM 1.0.
+# Generated by GNU Autoconf 2.61 for OpenBSM 1.1alpha2.
 #
 # Report bugs to <trustedbsd-audit@TrustesdBSD.org>.
 #
@@ -729,8 +729,8 @@ SHELL=${CONFIG_SHELL-/bin/sh}
 # Identity of this package.
 PACKAGE_NAME='OpenBSM'
 PACKAGE_TARNAME='openbsm'
-PACKAGE_VERSION='1.0'
-PACKAGE_STRING='OpenBSM 1.0'
+PACKAGE_VERSION='1.1alpha2'
+PACKAGE_STRING='OpenBSM 1.1alpha2'
 PACKAGE_BUGREPORT='trustedbsd-audit@TrustesdBSD.org'
 
 ac_unique_file="bin/auditreduce/auditreduce.c"
@@ -812,6 +812,9 @@ target_alias
 MAINTAINER_MODE_TRUE
 MAINTAINER_MODE_FALSE
 MAINT
+USE_NATIVE_INCLUDES_TRUE
+USE_NATIVE_INCLUDES_FALSE
+MIG
 CC
 CFLAGS
 LDFLAGS
@@ -880,6 +883,8 @@ am__fastdepCXX_FALSE
 LIBOBJS
 HAVE_AUDIT_SYSCALLS_TRUE
 HAVE_AUDIT_SYSCALLS_FALSE
+USE_MACH_IPC_TRUE
+USE_MACH_IPC_FALSE
 LTLIBOBJS'
 ac_subst_files=''
       ac_precious_vars='build_alias
@@ -1399,7 +1404,7 @@ if test "$ac_init_help" = "long"; then
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-\`configure' configures OpenBSM 1.0 to adapt to many kinds of systems.
+\`configure' configures OpenBSM 1.1alpha2 to adapt to many kinds of systems.
 
 Usage: $0 [OPTION]... [VAR=VALUE]...
 
@@ -1469,7 +1474,7 @@ fi
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of OpenBSM 1.0:";;
+     short | recursive ) echo "Configuration of OpenBSM 1.1alpha2:";;
    esac
   cat <<\_ACEOF
 
@@ -1489,6 +1494,8 @@ Optional Features:
 Optional Packages:
   --with-PACKAGE[=ARG]    use PACKAGE [ARG=yes]
   --without-PACKAGE       do not use PACKAGE (same as --with-PACKAGE=no)
+  --with-native-includes  Use the system native include files instead of those
+                          included with openbsm.
   --with-gnu-ld           assume the C compiler uses GNU ld [default=no]
   --with-pic              try to use only PIC/non-PIC objects [default=use
                           both]
@@ -1573,7 +1580,7 @@ fi
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-OpenBSM configure 1.0
+OpenBSM configure 1.1alpha2
 generated by GNU Autoconf 2.61
 
 Copyright (C) 1992, 1993, 1994, 1995, 1996, 1998, 1999, 2000, 2001,
@@ -1587,7 +1594,7 @@ cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by OpenBSM $as_me 1.0, which was
+It was created by OpenBSM $as_me 1.1alpha2, which was
 generated by GNU Autoconf 2.61.  Invocation command line was
 
   $ $0 $@
@@ -2001,6 +2008,77 @@ fi
 
 
 
+# --with-native-includes forces the use of the system bsm headers.
+
+# Check whether --with-native-includes was given.
+if test "${with_native_includes+set}" = set; then
+  withval=$with_native_includes;
+
+cat >>confdefs.h <<\_ACEOF
+#define USE_NATIVE_INCLUDES
+_ACEOF
+
+use_native_includes=true
+
+else
+  use_native_includes=false
+fi
+
+ if $use_native_includes; then
+  USE_NATIVE_INCLUDES_TRUE=
+  USE_NATIVE_INCLUDES_FALSE='#'
+else
+  USE_NATIVE_INCLUDES_TRUE='#'
+  USE_NATIVE_INCLUDES_FALSE=
+fi
+
+
+for ac_prog in mig
+do
+  # Extract the first word of "$ac_prog", so it can be a program name with args.
+set dummy $ac_prog; ac_word=$2
+{ echo "$as_me:$LINENO: checking for $ac_word" >&5
+echo $ECHO_N "checking for $ac_word... $ECHO_C" >&6; }
+if test "${ac_cv_path_MIG+set}" = set; then
+  echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+  case $MIG in
+  [\\/]* | ?:[\\/]*)
+  ac_cv_path_MIG="$MIG" # Let the user override the test with a path.
+  ;;
+  *)
+  as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
+for as_dir in $PATH
+do
+  IFS=$as_save_IFS
+  test -z "$as_dir" && as_dir=.
+  for ac_exec_ext in '' $ac_executable_extensions; do
+  if { test -f "$as_dir/$ac_word$ac_exec_ext" && $as_test_x "$as_dir/$ac_word$ac_exec_ext"; }; then
+    ac_cv_path_MIG="$as_dir/$ac_word$ac_exec_ext"
+    echo "$as_me:$LINENO: found $as_dir/$ac_word$ac_exec_ext" >&5
+    break 2
+  fi
+done
+done
+IFS=$as_save_IFS
+
+  ;;
+esac
+fi
+MIG=$ac_cv_path_MIG
+if test -n "$MIG"; then
+  { echo "$as_me:$LINENO: result: $MIG" >&5
+echo "${ECHO_T}$MIG" >&6; }
+else
+  { echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6; }
+fi
+
+
+  test -n "$MIG" && break
+done
+
+
 # Checks for programs.
 ac_ext=c
 ac_cpp='$CPP $CPPFLAGS'
@@ -3809,7 +3887,7 @@ ia64-*-hpux*)
   ;;
 *-*-irix6*)
   # Find out which ABI we are using.
-  echo '#line 3812 "configure"' > conftest.$ac_ext
+  echo '#line 3890 "configure"' > conftest.$ac_ext
   if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5
   (eval $ac_compile) 2>&5
   ac_status=$?
@@ -6443,11 +6521,11 @@ else
    -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
    -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
    -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:6446: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:6524: $lt_compile\"" >&5)
    (eval "$lt_compile" 2>conftest.err)
    ac_status=$?
    cat conftest.err >&5
-   echo "$as_me:6450: \$? = $ac_status" >&5
+   echo "$as_me:6528: \$? = $ac_status" >&5
    if (exit $ac_status) && test -s "$ac_outfile"; then
      # The compiler can only warn and ignore the option if not recognized
      # So say no if there are warnings other than the usual output.
@@ -6733,11 +6811,11 @@ else
    -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
    -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
    -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:6736: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:6814: $lt_compile\"" >&5)
    (eval "$lt_compile" 2>conftest.err)
    ac_status=$?
    cat conftest.err >&5
-   echo "$as_me:6740: \$? = $ac_status" >&5
+   echo "$as_me:6818: \$? = $ac_status" >&5
    if (exit $ac_status) && test -s "$ac_outfile"; then
      # The compiler can only warn and ignore the option if not recognized
      # So say no if there are warnings other than the usual output.
@@ -6837,11 +6915,11 @@ else
    -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
    -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
    -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:6840: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:6918: $lt_compile\"" >&5)
    (eval "$lt_compile" 2>out/conftest.err)
    ac_status=$?
    cat out/conftest.err >&5
-   echo "$as_me:6844: \$? = $ac_status" >&5
+   echo "$as_me:6922: \$? = $ac_status" >&5
    if (exit $ac_status) && test -s out/conftest2.$ac_objext
    then
      # The compiler can only warn and ignore the option if not recognized
@@ -9186,7 +9264,7 @@ else
   lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
   lt_status=$lt_dlunknown
   cat > conftest.$ac_ext <<EOF
-#line 9189 "configure"
+#line 9267 "configure"
 #include "confdefs.h"
 
 #if HAVE_DLFCN_H
@@ -9286,7 +9364,7 @@ else
   lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
   lt_status=$lt_dlunknown
   cat > conftest.$ac_ext <<EOF
-#line 9289 "configure"
+#line 9367 "configure"
 #include "confdefs.h"
 
 #if HAVE_DLFCN_H
@@ -11706,11 +11784,11 @@ else
    -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
    -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
    -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:11709: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:11787: $lt_compile\"" >&5)
    (eval "$lt_compile" 2>conftest.err)
    ac_status=$?
    cat conftest.err >&5
-   echo "$as_me:11713: \$? = $ac_status" >&5
+   echo "$as_me:11791: \$? = $ac_status" >&5
    if (exit $ac_status) && test -s "$ac_outfile"; then
      # The compiler can only warn and ignore the option if not recognized
      # So say no if there are warnings other than the usual output.
@@ -11810,11 +11888,11 @@ else
    -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
    -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
    -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:11813: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:11891: $lt_compile\"" >&5)
    (eval "$lt_compile" 2>out/conftest.err)
    ac_status=$?
    cat out/conftest.err >&5
-   echo "$as_me:11817: \$? = $ac_status" >&5
+   echo "$as_me:11895: \$? = $ac_status" >&5
    if (exit $ac_status) && test -s out/conftest2.$ac_objext
    then
      # The compiler can only warn and ignore the option if not recognized
@@ -13372,11 +13450,11 @@ else
    -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
    -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
    -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:13375: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:13453: $lt_compile\"" >&5)
    (eval "$lt_compile" 2>conftest.err)
    ac_status=$?
    cat conftest.err >&5
-   echo "$as_me:13379: \$? = $ac_status" >&5
+   echo "$as_me:13457: \$? = $ac_status" >&5
    if (exit $ac_status) && test -s "$ac_outfile"; then
      # The compiler can only warn and ignore the option if not recognized
      # So say no if there are warnings other than the usual output.
@@ -13476,11 +13554,11 @@ else
    -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
    -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
    -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:13479: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:13557: $lt_compile\"" >&5)
    (eval "$lt_compile" 2>out/conftest.err)
    ac_status=$?
    cat out/conftest.err >&5
-   echo "$as_me:13483: \$? = $ac_status" >&5
+   echo "$as_me:13561: \$? = $ac_status" >&5
    if (exit $ac_status) && test -s out/conftest2.$ac_objext
    then
      # The compiler can only warn and ignore the option if not recognized
@@ -15663,11 +15741,11 @@ else
    -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
    -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
    -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:15666: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:15744: $lt_compile\"" >&5)
    (eval "$lt_compile" 2>conftest.err)
    ac_status=$?
    cat conftest.err >&5
-   echo "$as_me:15670: \$? = $ac_status" >&5
+   echo "$as_me:15748: \$? = $ac_status" >&5
    if (exit $ac_status) && test -s "$ac_outfile"; then
      # The compiler can only warn and ignore the option if not recognized
      # So say no if there are warnings other than the usual output.
@@ -15953,11 +16031,11 @@ else
    -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
    -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
    -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:15956: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:16034: $lt_compile\"" >&5)
    (eval "$lt_compile" 2>conftest.err)
    ac_status=$?
    cat conftest.err >&5
-   echo "$as_me:15960: \$? = $ac_status" >&5
+   echo "$as_me:16038: \$? = $ac_status" >&5
    if (exit $ac_status) && test -s "$ac_outfile"; then
      # The compiler can only warn and ignore the option if not recognized
      # So say no if there are warnings other than the usual output.
@@ -16057,11 +16135,11 @@ else
    -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
    -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
    -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:16060: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:16138: $lt_compile\"" >&5)
    (eval "$lt_compile" 2>out/conftest.err)
    ac_status=$?
    cat out/conftest.err >&5
-   echo "$as_me:16064: \$? = $ac_status" >&5
+   echo "$as_me:16142: \$? = $ac_status" >&5
    if (exit $ac_status) && test -s out/conftest2.$ac_objext
    then
      # The compiler can only warn and ignore the option if not recognized
@@ -18998,7 +19076,7 @@ fi
 
 # Define the identity of the package.
  PACKAGE=OpenBSM
- VERSION=1.0
+ VERSION=1.1alpha2
 
 
 cat >>confdefs.h <<_ACEOF
@@ -20403,6 +20481,116 @@ _ACEOF
 fi
 
 
+{ echo "$as_me:$LINENO: checking for struct ipc_perm._key" >&5
+echo $ECHO_N "checking for struct ipc_perm._key... $ECHO_C" >&6; }
+if test "${ac_cv_member_struct_ipc_perm__key+set}" = set; then
+  echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+  cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h.  */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h.  */
+
+#include <sys/types.h>
+#include <sys/ipc.h>
+
+
+int
+main ()
+{
+static struct ipc_perm ac_aggr;
+if (ac_aggr._key)
+return 0;
+  ;
+  return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+  *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+  (eval "$ac_compile") 2>conftest.er1
+  ac_status=$?
+  grep -v '^ *+' conftest.er1 >conftest.err
+  rm -f conftest.er1
+  cat conftest.err >&5
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); } && {
+	 test -z "$ac_c_werror_flag" ||
+	 test ! -s conftest.err
+       } && test -s conftest.$ac_objext; then
+  ac_cv_member_struct_ipc_perm__key=yes
+else
+  echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+	cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h.  */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h.  */
+
+#include <sys/types.h>
+#include <sys/ipc.h>
+
+
+int
+main ()
+{
+static struct ipc_perm ac_aggr;
+if (sizeof ac_aggr._key)
+return 0;
+  ;
+  return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+  *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+  (eval "$ac_compile") 2>conftest.er1
+  ac_status=$?
+  grep -v '^ *+' conftest.er1 >conftest.err
+  rm -f conftest.er1
+  cat conftest.err >&5
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); } && {
+	 test -z "$ac_c_werror_flag" ||
+	 test ! -s conftest.err
+       } && test -s conftest.$ac_objext; then
+  ac_cv_member_struct_ipc_perm__key=yes
+else
+  echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+	ac_cv_member_struct_ipc_perm__key=no
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_member_struct_ipc_perm__key" >&5
+echo "${ECHO_T}$ac_cv_member_struct_ipc_perm__key" >&6; }
+if test $ac_cv_member_struct_ipc_perm__key = yes; then
+
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_IPC_PERM__KEY
+_ACEOF
+
+fi
+
+
 { echo "$as_me:$LINENO: checking for struct ipc_perm.__seq" >&5
 echo $ECHO_N "checking for struct ipc_perm.__seq... $ECHO_C" >&6; }
 if test "${ac_cv_member_struct_ipc_perm___seq+set}" = set; then
@@ -20513,6 +20701,116 @@ _ACEOF
 fi
 
 
+{ echo "$as_me:$LINENO: checking for struct ipc_perm._seq" >&5
+echo $ECHO_N "checking for struct ipc_perm._seq... $ECHO_C" >&6; }
+if test "${ac_cv_member_struct_ipc_perm__seq+set}" = set; then
+  echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+  cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h.  */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h.  */
+
+#include <sys/types.h>
+#include <sys/ipc.h>
+
+
+int
+main ()
+{
+static struct ipc_perm ac_aggr;
+if (ac_aggr._seq)
+return 0;
+  ;
+  return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+  *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+  (eval "$ac_compile") 2>conftest.er1
+  ac_status=$?
+  grep -v '^ *+' conftest.er1 >conftest.err
+  rm -f conftest.er1
+  cat conftest.err >&5
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); } && {
+	 test -z "$ac_c_werror_flag" ||
+	 test ! -s conftest.err
+       } && test -s conftest.$ac_objext; then
+  ac_cv_member_struct_ipc_perm__seq=yes
+else
+  echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+	cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h.  */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h.  */
+
+#include <sys/types.h>
+#include <sys/ipc.h>
+
+
+int
+main ()
+{
+static struct ipc_perm ac_aggr;
+if (sizeof ac_aggr._seq)
+return 0;
+  ;
+  return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+  *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+  (eval "$ac_compile") 2>conftest.er1
+  ac_status=$?
+  grep -v '^ *+' conftest.er1 >conftest.err
+  rm -f conftest.er1
+  cat conftest.err >&5
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); } && {
+	 test -z "$ac_c_werror_flag" ||
+	 test ! -s conftest.err
+       } && test -s conftest.$ac_objext; then
+  ac_cv_member_struct_ipc_perm__seq=yes
+else
+  echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+	ac_cv_member_struct_ipc_perm__seq=no
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_member_struct_ipc_perm__seq" >&5
+echo "${ECHO_T}$ac_cv_member_struct_ipc_perm__seq" >&6; }
+if test $ac_cv_member_struct_ipc_perm__seq = yes; then
+
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_IPC_PERM__SEQ
+_ACEOF
+
+fi
+
+
 { echo "$as_me:$LINENO: checking whether time.h and sys/time.h may both be included" >&5
 echo $ECHO_N "checking whether time.h and sys/time.h may both be included... $ECHO_C" >&6; }
 if test "${ac_cv_header_time+set}" = set; then
@@ -22503,7 +22801,8 @@ done
 
 
 
-for ac_func in bzero clock_gettime ftruncate gettimeofday inet_ntoa memset strchr strerror strlcat strrchr strstr strtol strtoul
+
+for ac_func in bzero clock_gettime ftruncate gettimeofday inet_ntoa memset strchr strerror strlcat strlcpy strrchr strstr strtol strtoul
 do
 as_ac_var=`echo "ac_cv_func_$ac_func" | $as_tr_sh`
 { echo "$as_me:$LINENO: checking for $ac_func" >&5
@@ -22732,7 +23031,50 @@ else
 fi
 
 
-ac_config_files="$ac_config_files Makefile bin/Makefile bin/audit/Makefile bin/auditd/Makefile bin/auditfilterd/Makefile bin/auditreduce/Makefile bin/praudit/Makefile bsm/Makefile libbsm/Makefile modules/Makefile modules/auditfilter_noop/Makefile man/Makefile test/Makefile test/bsm/Makefile tools/Makefile"
+# Check to see if Mach IPC is used for trigger messages.  If so, use Mach IPC
+# instead of the default for sending trigger messages to the audit components.
+{ echo "$as_me:$LINENO: checking for /usr/include/mach/audit_triggers.defs" >&5
+echo $ECHO_N "checking for /usr/include/mach/audit_triggers.defs... $ECHO_C" >&6; }
+if test "${ac_cv_file__usr_include_mach_audit_triggers_defs+set}" = set; then
+  echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+  test "$cross_compiling" = yes &&
+  { { echo "$as_me:$LINENO: error: cannot check for file existence when cross compiling" >&5
+echo "$as_me: error: cannot check for file existence when cross compiling" >&2;}
+   { (exit 1); exit 1; }; }
+if test -r "/usr/include/mach/audit_triggers.defs"; then
+  ac_cv_file__usr_include_mach_audit_triggers_defs=yes
+else
+  ac_cv_file__usr_include_mach_audit_triggers_defs=no
+fi
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_file__usr_include_mach_audit_triggers_defs" >&5
+echo "${ECHO_T}$ac_cv_file__usr_include_mach_audit_triggers_defs" >&6; }
+if test $ac_cv_file__usr_include_mach_audit_triggers_defs = yes; then
+
+
+cat >>confdefs.h <<\_ACEOF
+#define USE_MACH_IPC
+_ACEOF
+
+use_mach_ipc=true
+
+else
+
+use_mach_ipc=false
+
+fi
+
+ if $use_mach_ipc; then
+  USE_MACH_IPC_TRUE=
+  USE_MACH_IPC_FALSE='#'
+else
+  USE_MACH_IPC_TRUE='#'
+  USE_MACH_IPC_FALSE=
+fi
+
+
+ac_config_files="$ac_config_files Makefile bin/Makefile bin/audit/Makefile bin/auditd/Makefile bin/auditfilterd/Makefile bin/auditreduce/Makefile bin/praudit/Makefile bsm/Makefile libbsm/Makefile modules/Makefile modules/auditfilter_noop/Makefile man/Makefile sys/Makefile sys/bsm/Makefile test/Makefile test/bsm/Makefile tools/Makefile"
 
 
 cat >confcache <<\_ACEOF
@@ -22838,6 +23180,13 @@ echo "$as_me: error: conditional \"MAINTAINER_MODE\" was never defined.
 Usually this means the macro was only invoked conditionally." >&2;}
    { (exit 1); exit 1; }; }
 fi
+if test -z "${USE_NATIVE_INCLUDES_TRUE}" && test -z "${USE_NATIVE_INCLUDES_FALSE}"; then
+  { { echo "$as_me:$LINENO: error: conditional \"USE_NATIVE_INCLUDES\" was never defined.
+Usually this means the macro was only invoked conditionally." >&5
+echo "$as_me: error: conditional \"USE_NATIVE_INCLUDES\" was never defined.
+Usually this means the macro was only invoked conditionally." >&2;}
+   { (exit 1); exit 1; }; }
+fi
 if test -z "${AMDEP_TRUE}" && test -z "${AMDEP_FALSE}"; then
   { { echo "$as_me:$LINENO: error: conditional \"AMDEP\" was never defined.
 Usually this means the macro was only invoked conditionally." >&5
@@ -22866,6 +23215,13 @@ echo "$as_me: error: conditional \"HAVE_AUDIT_SYSCALLS\" was never defined.
 Usually this means the macro was only invoked conditionally." >&2;}
    { (exit 1); exit 1; }; }
 fi
+if test -z "${USE_MACH_IPC_TRUE}" && test -z "${USE_MACH_IPC_FALSE}"; then
+  { { echo "$as_me:$LINENO: error: conditional \"USE_MACH_IPC\" was never defined.
+Usually this means the macro was only invoked conditionally." >&5
+echo "$as_me: error: conditional \"USE_MACH_IPC\" was never defined.
+Usually this means the macro was only invoked conditionally." >&2;}
+   { (exit 1); exit 1; }; }
+fi
 
 : ${CONFIG_STATUS=./config.status}
 ac_clean_files_save=$ac_clean_files
@@ -23166,7 +23522,7 @@ exec 6>&1
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by OpenBSM $as_me 1.0, which was
+This file was extended by OpenBSM $as_me 1.1alpha2, which was
 generated by GNU Autoconf 2.61.  Invocation command line was
 
   CONFIG_FILES    = $CONFIG_FILES
@@ -23219,7 +23575,7 @@ Report bugs to <bug-autoconf@gnu.org>."
 _ACEOF
 cat >>$CONFIG_STATUS <<_ACEOF
 ac_cs_version="\\
-OpenBSM config.status 1.0
+OpenBSM config.status 1.1alpha2
 configured by $0, generated by GNU Autoconf 2.61,
   with options \\"`echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`\\"
 
@@ -23347,6 +23703,8 @@ do
     "modules/Makefile") CONFIG_FILES="$CONFIG_FILES modules/Makefile" ;;
     "modules/auditfilter_noop/Makefile") CONFIG_FILES="$CONFIG_FILES modules/auditfilter_noop/Makefile" ;;
     "man/Makefile") CONFIG_FILES="$CONFIG_FILES man/Makefile" ;;
+    "sys/Makefile") CONFIG_FILES="$CONFIG_FILES sys/Makefile" ;;
+    "sys/bsm/Makefile") CONFIG_FILES="$CONFIG_FILES sys/bsm/Makefile" ;;
     "test/Makefile") CONFIG_FILES="$CONFIG_FILES test/Makefile" ;;
     "test/bsm/Makefile") CONFIG_FILES="$CONFIG_FILES test/bsm/Makefile" ;;
     "tools/Makefile") CONFIG_FILES="$CONFIG_FILES tools/Makefile" ;;
@@ -23452,6 +23810,9 @@ target_alias!$target_alias$ac_delim
 MAINTAINER_MODE_TRUE!$MAINTAINER_MODE_TRUE$ac_delim
 MAINTAINER_MODE_FALSE!$MAINTAINER_MODE_FALSE$ac_delim
 MAINT!$MAINT$ac_delim
+USE_NATIVE_INCLUDES_TRUE!$USE_NATIVE_INCLUDES_TRUE$ac_delim
+USE_NATIVE_INCLUDES_FALSE!$USE_NATIVE_INCLUDES_FALSE$ac_delim
+MIG!$MIG$ac_delim
 CC!$CC$ac_delim
 CFLAGS!$CFLAGS$ac_delim
 LDFLAGS!$LDFLAGS$ac_delim
@@ -23506,9 +23867,6 @@ AMTAR!$AMTAR$ac_delim
 am__tar!$am__tar$ac_delim
 am__untar!$am__untar$ac_delim
 DEPDIR!$DEPDIR$ac_delim
-am__include!$am__include$ac_delim
-am__quote!$am__quote$ac_delim
-AMDEP_TRUE!$AMDEP_TRUE$ac_delim
 _ACEOF
 
   if test `sed -n "s/.*$ac_delim\$/X/p" conf$$subs.sed | grep -c X` = 97; then
@@ -23550,6 +23908,9 @@ _ACEOF
 ac_delim='%!_!# '
 for ac_last_try in false false false false false :; do
   cat >conf$$subs.sed <<_ACEOF
+am__include!$am__include$ac_delim
+am__quote!$am__quote$ac_delim
+AMDEP_TRUE!$AMDEP_TRUE$ac_delim
 AMDEP_FALSE!$AMDEP_FALSE$ac_delim
 AMDEPBACKSLASH!$AMDEPBACKSLASH$ac_delim
 CCDEPMODE!$CCDEPMODE$ac_delim
@@ -23561,10 +23922,12 @@ am__fastdepCXX_FALSE!$am__fastdepCXX_FALSE$ac_delim
 LIBOBJS!$LIBOBJS$ac_delim
 HAVE_AUDIT_SYSCALLS_TRUE!$HAVE_AUDIT_SYSCALLS_TRUE$ac_delim
 HAVE_AUDIT_SYSCALLS_FALSE!$HAVE_AUDIT_SYSCALLS_FALSE$ac_delim
+USE_MACH_IPC_TRUE!$USE_MACH_IPC_TRUE$ac_delim
+USE_MACH_IPC_FALSE!$USE_MACH_IPC_FALSE$ac_delim
 LTLIBOBJS!$LTLIBOBJS$ac_delim
 _ACEOF
 
-  if test `sed -n "s/.*$ac_delim\$/X/p" conf$$subs.sed | grep -c X` = 12; then
+  if test `sed -n "s/.*$ac_delim\$/X/p" conf$$subs.sed | grep -c X` = 17; then
     break
   elif $ac_last_try; then
     { { echo "$as_me:$LINENO: error: could not make $CONFIG_STATUS" >&5
diff --git a/contrib/openbsm/configure.ac b/contrib/openbsm/configure.ac
index 83d692b7..1da42cd 100644
--- a/contrib/openbsm/configure.ac
+++ b/contrib/openbsm/configure.ac
@@ -2,13 +2,26 @@
 # Process this file with autoconf to produce a configure script.
 
 AC_PREREQ(2.59)
-AC_INIT([OpenBSM], [1.0], [trustedbsd-audit@TrustesdBSD.org],[openbsm])
-AC_REVISION([$P4: //depot/projects/trustedbsd/openbsm/configure.ac#36 $])
+AC_INIT([OpenBSM], [1.1alpha2], [trustedbsd-audit@TrustesdBSD.org],[openbsm])
+AC_REVISION([$P4: //depot/projects/trustedbsd/openbsm/configure.ac#42 $])
 AC_CONFIG_SRCDIR([bin/auditreduce/auditreduce.c])
 AC_CONFIG_AUX_DIR(config)
 AC_CONFIG_HEADER([config/config.h])
 AM_MAINTAINER_MODE
 
+# --with-native-includes forces the use of the system bsm headers.
+AC_ARG_WITH([native-includes],
+[AS_HELP_STRING([--with-native-includes],
+[Use the system native include files instead of those included with openbsm.])],
+[
+AC_DEFINE(USE_NATIVE_INCLUDES,, Define to use native include files)
+use_native_includes=true
+],
+[use_native_includes=false])
+AM_CONDITIONAL(USE_NATIVE_INCLUDES, $use_native_includes)
+
+AC_PATH_PROGS(MIG, mig)
+
 # Checks for programs.
 AC_PROG_CC
 AC_PROG_INSTALL
@@ -38,6 +51,13 @@ AC_CHECK_MEMBER([struct ipc_perm.__key],
 #include <sys/ipc.h>
 ])
 
+AC_CHECK_MEMBER([struct ipc_perm._key],
+[AC_DEFINE(HAVE_IPC_PERM__KEY,, Define if ipc_perm._key instead of key)],
+[],[
+#include <sys/types.h>
+#include <sys/ipc.h>
+])
+
 AC_CHECK_MEMBER([struct ipc_perm.__seq],
 [AC_DEFINE(HAVE_IPC_PERM___SEQ,, Define if ipc_perm.__seq instead of seq)],
 [],[
@@ -45,6 +65,13 @@ AC_CHECK_MEMBER([struct ipc_perm.__seq],
 #include <sys/ipc.h>
 ])
 
+AC_CHECK_MEMBER([struct ipc_perm._seq],
+[AC_DEFINE(HAVE_IPC_PERM__SEQ,, Define if ipc_perm._seq instead of seq)],
+[],[
+#include <sys/types.h>
+#include <sys/ipc.h>
+])
+
 AC_HEADER_TIME
 AC_STRUCT_TM
 
@@ -56,7 +83,7 @@ AC_FUNC_MKTIME
 AC_TYPE_SIGNAL
 AC_FUNC_STAT
 AC_FUNC_STRFTIME
-AC_CHECK_FUNCS([bzero clock_gettime ftruncate gettimeofday inet_ntoa memset strchr strerror strlcat strrchr strstr strtol strtoul])
+AC_CHECK_FUNCS([bzero clock_gettime ftruncate gettimeofday inet_ntoa memset strchr strerror strlcat strlcpy strrchr strstr strtol strtoul])
 
 # sys/queue.h exists on most systems, but its capabilities vary a great deal.
 # test for LIST_FIRST and TAILQ_FOREACH_SAFE, which appears to not exist in
@@ -94,6 +121,16 @@ have_audit_syscalls=false
 ])
 AM_CONDITIONAL(HAVE_AUDIT_SYSCALLS, $have_audit_syscalls)
 
+# Check to see if Mach IPC is used for trigger messages.  If so, use Mach IPC
+# instead of the default for sending trigger messages to the audit components.
+AC_CHECK_FILE([/usr/include/mach/audit_triggers.defs], [
+AC_DEFINE(USE_MACH_IPC,, Define if uses Mach IPC for Triggers messages)
+use_mach_ipc=true
+], [
+use_mach_ipc=false
+])
+AM_CONDITIONAL(USE_MACH_IPC, $use_mach_ipc)
+
 AC_CONFIG_FILES([Makefile
                  bin/Makefile
                  bin/audit/Makefile
@@ -106,6 +143,8 @@ AC_CONFIG_FILES([Makefile
                  modules/Makefile
                  modules/auditfilter_noop/Makefile
                  man/Makefile
+                 sys/Makefile
+                 sys/bsm/Makefile
                  test/Makefile
                  test/bsm/Makefile
                  tools/Makefile])
diff --git a/contrib/openbsm/etc/audit_event b/contrib/openbsm/etc/audit_event
index 2b11824..20e585c 100644
--- a/contrib/openbsm/etc/audit_event
+++ b/contrib/openbsm/etc/audit_event
@@ -1,8 +1,8 @@
 #
-# $P4: //depot/projects/trustedbsd/openbsm/etc/audit_event#26 $
+# $P4: //depot/projects/trustedbsd/openbsm/etc/audit_event#30 $
 # $FreeBSD$
 #
-# The mapping between event identifiers and values is also hard-codedd in
+# The mapping between event identifiers and values is also hard-coded in
 # audit_kevents.h and audit_uevents.h, so changes must occur in both places,
 # and programs, such as the kernel, may need to be recompiled to recognize
 # those changes.  It is advisable not to change the numbering or naming of
@@ -277,9 +277,10 @@
 298:AUE_PF_POLICY_FLIP:Flip IPsec policy:ad
 299:AUE_PF_POLICY_FLUSH:Flush IPsec policy rules:ad
 300:AUE_PF_POLICY_ALGS:Update IPsec algorithms:ad
+301:AUE_PORTFS:portfs:fa
 #
-# What follows are deprecated Darwin event numbers that may soon conflict
-# with Solaris events.
+# What follows are deprecated Darwin event numbers that may soon^H^H^H^Hnow
+# conflict with Solaris events.
 #
 301:AUE_DARWIN_GETFSSTAT:getfsstat(2):fa
 302:AUE_DARWIN_PTRACE:ptrace(2):pc
@@ -497,6 +498,43 @@
 43150:AUE_MKNODAT:mknodat(2):fc
 43151:AUE_READLINKAT:readlinkat(2):fr
 43152:AUE_SYMLINKAT:symlinkat(2):fc
+43153:AUE_MAC_GETFSSTAT:mac_getfsstat(2):fa
+43154:AUE_MAC_GET_MOUNT:mac_get_mount(2):fa
+43155:AUE_MAC_GET_LCID:mac_get_lcid(2):pc
+43156:AUE_MAC_GET_LCTX:mac_get_lctx(2):pc
+43157:AUE_MAC_SET_LCTX:mac_set_lctx(2):pc
+43158:AUE_MAC_MOUNT:mac_mount(2):ad
+43159:AUE_GETLCID:getlcid(2):pc
+43160:AUE_SETLCID:setlcid(2):pc
+43161:AUE_TASKNAMEFORPID:taskname_for_pid():pc
+43162:AUE_ACCESS_EXTENDED:access_extended(2):fa
+43163:AUE_CHMOD_EXTENDED:chmod_extended(2):fm
+43164:AUE_FCHMOD_EXTENDED:fchmod_extended(2):fm
+43165:AUE_FSTAT_EXTENDED:fstat_extended(2):fa
+43166:AUE_LSTAT_EXTENDED:lstat_extended(2):fa
+43167:AUE_MKDIR_EXTENDED:mkdir_extended(2):fc
+43168:AUE_MKFIFO_EXTENDED:mkfifo_extended(2):fc
+43169:AUE_OPEN_EXTENDED:open_extended(2) - attr only:fa
+43170:AUE_OPEN_EXTENDED_R:open_extended(2) - read:fr
+43171:AUE_OPEN_EXTENDED_RC:open_extended(2) - read,creat:fc,fr,fa,fm
+43172:AUE_OPEN_EXTENDED_RT:open_extended(2) - read,trunc:fd,fr,fa,fm
+43173:AUE_OPEN_EXTENDED_RTC:open_extended(2) - read,creat,trunc:fc,fd,fr,fa,fm
+43174:AUE_OPEN_EXTENDED_W:open_extended(2) - write:fw
+43175:AUE_OPEN_EXTENDED_WC:open_extended(2) - write,creat:fc,fw,fa,fm
+43176:AUE_OPEN_EXTENDED_WT:open_extended(2) - write,trunc:fd,fw,fa,fm
+43177:AUE_OPEN_EXTENDED_WTC:open_extended(2) - write,creat,trunc:fc,fd,fw,fa,fm
+43178:AUE_OPEN_EXTENDED_RW:open_extended(2) - read,write:fr,fw
+43179:AUE_OPEN_EXTENDED_RWC:open_extended(2) - read,write,creat:fc,fw,fr,fa,fm
+43180:AUE_OPEN_EXTENDED_RWT:open_extended(2) - read,write,trunc:fd,fr,fw,fa,fm
+43181:AUE_OPEN_EXTENDED_RWTC:open_extended(2) - read,write,creat,trunc:fc,fd,fw,fr,fa,fm
+43182:AUE_STAT_EXTENDED:stat_extended(2):fa
+43183:AUE_UMASK_EXTENDED:umask_extended(2):pc
+43184:AUE_OPENAT:openat(2) - attr only:fa
+43185:AUE_POSIX_OPENPT:posix_openpt(2):ip
+43186:AUE_CAP_NEW:cap_new(2):fm
+43187:AUE_CAP_GETRIGHTS:cap_getrights(2):fm
+43188:AUE_CAP_ENTER:cap_enter(2):pc
+43189:AUE_CAP_GETMODE:cap_getmode(2):pc
 #
 # User space system events.
 #
diff --git a/contrib/openbsm/libbsm/Makefile.am b/contrib/openbsm/libbsm/Makefile.am
index 5e4a317..d4e31fe 100644
--- a/contrib/openbsm/libbsm/Makefile.am
+++ b/contrib/openbsm/libbsm/Makefile.am
@@ -1,8 +1,12 @@
 #
-# $P4: //depot/projects/trustedbsd/openbsm/libbsm/Makefile.am#3 $
+# $P4: //depot/projects/trustedbsd/openbsm/libbsm/Makefile.am#5 $
 #
 
-INCLUDES = -I$(top_srcdir)
+if USE_NATIVE_INCLUDES
+INCLUDES = -I$(top_builddir) -I$(top_srcdir)
+else
+INCLUDES = -I$(top_builddir) -I$(top_srcdir) -I$(top_srcdir)/sys
+endif
 
 lib_LTLIBRARIES = libbsm.la
 
diff --git a/contrib/openbsm/libbsm/Makefile.in b/contrib/openbsm/libbsm/Makefile.in
index d9da623..dd09ce0 100644
--- a/contrib/openbsm/libbsm/Makefile.in
+++ b/contrib/openbsm/libbsm/Makefile.in
@@ -15,7 +15,7 @@
 @SET_MAKE@
 
 #
-# $P4: //depot/projects/trustedbsd/openbsm/libbsm/Makefile.in#5 $
+# $P4: //depot/projects/trustedbsd/openbsm/libbsm/Makefile.in#9 $
 #
 
 VPATH = @srcdir@
@@ -129,6 +129,7 @@ LN_S = @LN_S@
 LTLIBOBJS = @LTLIBOBJS@
 MAINT = @MAINT@
 MAKEINFO = @MAKEINFO@
+MIG = @MIG@
 MKDIR_P = @MKDIR_P@
 OBJEXT = @OBJEXT@
 PACKAGE = @PACKAGE@
@@ -195,7 +196,8 @@ sysconfdir = @sysconfdir@
 target_alias = @target_alias@
 top_builddir = @top_builddir@
 top_srcdir = @top_srcdir@
-INCLUDES = -I$(top_srcdir)
+@USE_NATIVE_INCLUDES_FALSE@INCLUDES = -I$(top_builddir) -I$(top_srcdir) -I$(top_srcdir)/sys
+@USE_NATIVE_INCLUDES_TRUE@INCLUDES = -I$(top_builddir) -I$(top_srcdir)
 lib_LTLIBRARIES = libbsm.la
 libbsm_la_SOURCES = bsm_audit.c bsm_class.c bsm_control.c bsm_event.c \
 	bsm_flags.c bsm_io.c bsm_mask.c bsm_token.c bsm_user.c \
diff --git a/contrib/openbsm/libbsm/au_class.3 b/contrib/openbsm/libbsm/au_class.3
index d270b52..a3f200f 100644
--- a/contrib/openbsm/libbsm/au_class.3
+++ b/contrib/openbsm/libbsm/au_class.3
@@ -23,7 +23,7 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\" $P4: //depot/projects/trustedbsd/openbsm/libbsm/au_class.3#6 $
+.\" $P4: //depot/projects/trustedbsd/openbsm/libbsm/au_class.3#7 $
 .\"
 .Dd April 19, 2005
 .Dt AU_CLASS 3
diff --git a/contrib/openbsm/libbsm/au_free_token.3 b/contrib/openbsm/libbsm/au_free_token.3
index 7ce109a..223d50a 100644
--- a/contrib/openbsm/libbsm/au_free_token.3
+++ b/contrib/openbsm/libbsm/au_free_token.3
@@ -1,5 +1,5 @@
 .\"-
-.\" Copyright (c) 2004 Apple Computer, Inc.
+.\" Copyright (c) 2004 Apple Inc.
 .\" Copyright (c) 2005 Robert N. M. Watson
 .\" All rights reserved.
 .\"
@@ -11,7 +11,7 @@
 .\" 2. Redistributions in binary form must reproduce the above copyright
 .\"    notice, this list of conditions and the following disclaimer in the
 .\"    documentation and/or other materials provided with the distribution.
-.\" 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+.\" 3.  Neither the name of Apple Inc. ("Apple") nor the names of
 .\"     its contributors may be used to endorse or promote products derived
 .\"     from this software without specific prior written permission.
 .\"
@@ -27,7 +27,7 @@
 .\" IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 .\" POSSIBILITY OF SUCH DAMAGE.
 .\"
-.\" $P4: //depot/projects/trustedbsd/openbsm/libbsm/au_free_token.3#6 $
+.\" $P4: //depot/projects/trustedbsd/openbsm/libbsm/au_free_token.3#7 $
 .\"
 .Dd April 19, 2005
 .Dt AU_FREE_TOKEN 3
diff --git a/contrib/openbsm/libbsm/au_token.3 b/contrib/openbsm/libbsm/au_token.3
index e4ea65f..cb8ef70 100644
--- a/contrib/openbsm/libbsm/au_token.3
+++ b/contrib/openbsm/libbsm/au_token.3
@@ -23,7 +23,7 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\" $P4: //depot/projects/trustedbsd/openbsm/libbsm/au_token.3#13 $
+.\" $P4: //depot/projects/trustedbsd/openbsm/libbsm/au_token.3#15 $
 .\"
 .Dd April 19, 2005
 .Dt AU_TOKEN 3
@@ -72,6 +72,8 @@
 .Nm au_to_header ,
 .Nm au_to_header32 ,
 .Nm au_to_header64 ,
+.Nm au_to_header_ex ,
+.Nm au_to_header32_ex ,
 .Nm au_to_trailer ,
 .Nm au_to_zonename
 .Nd "routines for generating BSM audit tokens"
@@ -80,11 +82,11 @@
 .Sh SYNOPSIS
 .In bsm/libbsm.h
 .Ft "token_t *"
-.Fn au_to_arg32 "char n" "char *text" "u_int32_t v"
+.Fn au_to_arg32 "char n" "const char *text" "u_int32_t v"
 .Ft "token_t *"
-.Fn au_to_arg64 "char n" "char *text" "u_int64_t v"
+.Fn au_to_arg64 "char n" "const char *text" "u_int64_t v"
 .Ft "token_t *"
-.Fn au_to_arg "char n" "char *text" "u_int32_t v"
+.Fn au_to_arg "char n" "const char *text" "u_int32_t v"
 .Ft "token_t *"
 .Fn au_to_attr32 "struct vattr *attr"
 .Ft "token_t *"
@@ -92,7 +94,7 @@
 .Ft "token_t *"
 .Fn au_to_attr "struct vattr *attr"
 .Ft "token_t *"
-.Fn au_to_data "char unit_print" "char unit_type" "char unit_count" "char *p"
+.Fn au_to_data "char unit_print" "char unit_type" "char unit_count" "const char *p"
 .Ft "token_t *"
 .Fn au_to_exit "int retval" "int err"
 .Ft "token_t *"
@@ -112,13 +114,13 @@
 .Ft "token_t *"
 .Fn au_to_iport "u_int16_t iport"
 .Ft "token_t *"
-.Fn au_to_opaque "char *data" "u_int16_t bytes"
+.Fn au_to_opaque "const char *data" "u_int16_t bytes"
 .Ft "token_t *"
-.Fn au_to_file "char *file" "struct timeval tm"
+.Fn au_to_file "const char *file" "struct timeval tm"
 .Ft "token_t *"
-.Fn au_to_text "char *text"
+.Fn au_to_text "const char *text"
 .Ft "token_t *"
-.Fn au_to_path "char *text"
+.Fn au_to_path "const char *text"
 .Ft "token_t *"
 .Fo au_to_process32
 .Fa "au_id_t auid" "uid_t euid" "gid_t egid" "uid_t ruid"
@@ -196,9 +198,13 @@
 .Ft "token_t *"
 .Fn au_to_header64 "int rec_size" "au_event_t e_type" "au_emod_t e_mod"
 .Ft "token_t *"
+.Fn au_to_header_ex "int rec_size" "au_event_t e_type" "au_emod_t e_mod"
+.Ft "token_t *"
+.Fn au_to_header32_ex "int rec_size" "au_event_t e_type" "au_emod_t e_mod"
+.Ft "token_t *"
 .Fn au_to_trailer "int rec_size"
 .Ft "token_t *"
-.Fn au_to_zonename "char *zonename"
+.Fn au_to_zonename "const char *zonename"
 .Sh DESCRIPTION
 These interfaces support the allocation of BSM audit tokens, represented by
 .Vt token_t ,
diff --git a/contrib/openbsm/libbsm/audit_submit.3 b/contrib/openbsm/libbsm/audit_submit.3
index 609468c..6a61d99 100644
--- a/contrib/openbsm/libbsm/audit_submit.3
+++ b/contrib/openbsm/libbsm/audit_submit.3
@@ -27,9 +27,9 @@
 .\" IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 .\" POSSIBILITY OF SUCH DAMAGE.
 .\"
-.\" $P4: //depot/projects/trustedbsd/openbsm/libbsm/audit_submit.3#12 $
+.\" $P4: //depot/projects/trustedbsd/openbsm/libbsm/audit_submit.3#14 $
 .\"
-.Dd May 29, 2006
+.Dd January 18, 2008
 .Dt audit_submit 3
 .Os
 .Sh NAME
@@ -53,7 +53,7 @@ return token, and a trailer.
 The header will contain the event class specified by
 .Fa au_event .
 The subject token will be generated based on
-.Fa au_ctx .
+.Fa auid .
 The return token is dependent on the
 .Fa status
 and
diff --git a/contrib/openbsm/libbsm/bsm_audit.c b/contrib/openbsm/libbsm/bsm_audit.c
index 2f6df41..2fd9466 100644
--- a/contrib/openbsm/libbsm/bsm_audit.c
+++ b/contrib/openbsm/libbsm/bsm_audit.c
@@ -1,5 +1,5 @@
-/*
- * Copyright (c) 2004 Apple Computer, Inc.
+/*-
+ * Copyright (c) 2004 Apple Inc.
  * Copyright (c) 2005 SPARTA, Inc.
  * All rights reserved.
  *
@@ -30,7 +30,7 @@
  * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  * POSSIBILITY OF SUCH DAMAGE.
  *
- * $P4: //depot/projects/trustedbsd/openbsm/libbsm/bsm_audit.c#28 $
+ * $P4: //depot/projects/trustedbsd/openbsm/libbsm/bsm_audit.c#31 $
  */
 
 #include <sys/types.h>
@@ -45,6 +45,8 @@
 #include <bsm/audit_internal.h>
 #include <bsm/libbsm.h>
 
+#include <netinet/in.h>
+
 #include <errno.h>
 #include <pthread.h>
 #include <stdlib.h>
@@ -204,12 +206,55 @@ static int
 au_assemble(au_record_t *rec, short event)
 {
 	token_t *header, *tok, *trailer;
-	size_t tot_rec_size;
+	size_t tot_rec_size, hdrsize;
 	u_char *dptr;
+	struct in6_addr *aptr;
 	int error;
+	struct auditinfo_addr aia;
+	struct timeval tm;
 
-	tot_rec_size = rec->len + AUDIT_HEADER_SIZE + AUDIT_TRAILER_SIZE;
-	header = au_to_header32(tot_rec_size, event, 0);
+#ifdef HAVE_AUDIT_SYSCALLS
+	/*
+	 * Grab the size of the address family stored in the kernel's audit
+	 * state.
+	 */
+	aia.ai_termid.at_type = AU_IPv4;
+	aia.ai_termid.at_addr[0] = INADDR_ANY;
+	if (auditon(A_GETKAUDIT, &aia, sizeof(aia)) < 0) {
+		if (errno != ENOSYS)
+			return (-1);
+#endif /* HAVE_AUDIT_SYSCALLS */
+		tot_rec_size = rec->len + AUDIT_HEADER_SIZE +
+		    AUDIT_TRAILER_SIZE;
+		header = au_to_header(tot_rec_size, event, 0);
+#ifdef HAVE_AUDIT_SYSCALLS
+	} else {
+		if (gettimeofday(&tm, NULL) < 0)
+			return (-1);
+		switch (aia.ai_termid.at_type) {
+		case AU_IPv4:
+			hdrsize = (aia.ai_termid.at_addr[0] == INADDR_ANY) ?
+			    AUDIT_HEADER_SIZE : AUDIT_HEADER_EX_SIZE(&aia);
+			break;
+		case AU_IPv6:
+			aptr = (struct in6_addr *)&aia.ai_termid.at_addr[0];
+			hdrsize =
+			    (IN6_IS_ADDR_UNSPECIFIED(aptr)) ?
+			    AUDIT_HEADER_SIZE : AUDIT_HEADER_EX_SIZE(&aia);
+			break;
+		}
+		tot_rec_size = rec->len + hdrsize + AUDIT_TRAILER_SIZE;
+		/*
+		 * A header size greater then AUDIT_HEADER_SIZE means
+		 * that we are using an extended header.
+		 */
+		if (hdrsize > AUDIT_HEADER_SIZE)
+			header = au_to_header32_ex_tm(tot_rec_size, event,
+			    0, tm, &aia);
+		else
+			header = au_to_header(tot_rec_size, event, 0);
+	}
+#endif /* HAVE_AUDIT_SYSCALLS */
 	if (header == NULL)
 		return (-1);
 
@@ -285,7 +330,7 @@ au_close(int d, int keep, short event)
 		goto cleanup;
 	}
 
-	tot_rec_size = rec->len + AUDIT_HEADER_SIZE + AUDIT_TRAILER_SIZE;
+	tot_rec_size = rec->len + MAX_AUDIT_HEADER_SIZE + AUDIT_TRAILER_SIZE;
 
 	if (tot_rec_size > MAX_AUDIT_RECORD_SIZE) {
 		/*
@@ -335,7 +380,7 @@ au_close_buffer(int d, short event, u_char *buffer, size_t *buflen)
 	}
 
 	retval = 0;
-	tot_rec_size = rec->len + AUDIT_HEADER_SIZE + AUDIT_TRAILER_SIZE;
+	tot_rec_size = rec->len + MAX_AUDIT_HEADER_SIZE + AUDIT_TRAILER_SIZE;
 	if ((tot_rec_size > MAX_AUDIT_RECORD_SIZE) ||
 	    (tot_rec_size > *buflen)) {
 		/*
diff --git a/contrib/openbsm/libbsm/bsm_class.c b/contrib/openbsm/libbsm/bsm_class.c
index 5982d7e..0acfed4 100644
--- a/contrib/openbsm/libbsm/bsm_class.c
+++ b/contrib/openbsm/libbsm/bsm_class.c
@@ -1,5 +1,5 @@
-/*
- * Copyright (c) 2004 Apple Computer, Inc.
+/*-
+ * Copyright (c) 2004 Apple Inc.
  * Copyright (c) 2006 Robert N. M. Watson
  * All rights reserved.
  *
@@ -27,9 +27,11 @@
  * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  * POSSIBILITY OF SUCH DAMAGE.
  *
- * $P4: //depot/projects/trustedbsd/openbsm/libbsm/bsm_class.c#11 $
+ * $P4: //depot/projects/trustedbsd/openbsm/libbsm/bsm_class.c#14 $
  */
 
+#include <config/config.h>
+
 #include <bsm/libbsm.h>
 
 #include <string.h>
@@ -37,6 +39,10 @@
 #include <stdio.h>
 #include <stdlib.h>
 
+#ifndef HAVE_STRLCPY
+#include <compat/strlcpy.h>
+#endif
+
 /*
  * Parse the contents of the audit_class file to return struct au_class_ent
  * entries.
@@ -70,15 +76,14 @@ classfromstr(char *str, struct au_class_ent *c)
 	 */
 	if (strlen(classname) >= AU_CLASS_NAME_MAX)
 		return (NULL);
-
-	strcpy(c->ac_name, classname);
+	strlcpy(c->ac_name, classname, AU_CLASS_NAME_MAX);
 
 	/*
 	 * Check for very large class description.
 	 */
 	if (strlen(classdesc) >= AU_CLASS_DESC_MAX)
 		return (NULL);
-	strcpy(c->ac_desc, classdesc);
+	strlcpy(c->ac_desc, classdesc, AU_CLASS_DESC_MAX);
 	c->ac_class = strtoul(classflag, (char **) NULL, 0);
 
 	return (c);
diff --git a/contrib/openbsm/libbsm/bsm_control.c b/contrib/openbsm/libbsm/bsm_control.c
index dd901b7..96cbc23 100644
--- a/contrib/openbsm/libbsm/bsm_control.c
+++ b/contrib/openbsm/libbsm/bsm_control.c
@@ -1,5 +1,5 @@
-/*
- * Copyright (c) 2004 Apple Computer, Inc.
+/*-
+ * Copyright (c) 2004 Apple Inc.
  * Copyright (c) 2006 Robert N. M. Watson
  * All rights reserved.
  *
@@ -11,7 +11,7 @@
  * 2.  Redistributions in binary form must reproduce the above copyright
  *     notice, this list of conditions and the following disclaimer in the
  *     documentation and/or other materials provided with the distribution.
- * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
  *     its contributors may be used to endorse or promote products derived
  *     from this software without specific prior written permission.
  *
@@ -27,9 +27,11 @@
  * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  * POSSIBILITY OF SUCH DAMAGE.
  *
- * $P4: //depot/projects/trustedbsd/openbsm/libbsm/bsm_control.c#16 $
+ * $P4: //depot/projects/trustedbsd/openbsm/libbsm/bsm_control.c#23 $
  */
 
+#include <config/config.h>
+
 #include <bsm/libbsm.h>
 
 #include <errno.h>
@@ -38,10 +40,12 @@
 #include <stdio.h>
 #include <stdlib.h>
 
-#include <config/config.h>
 #ifndef HAVE_STRLCAT
 #include <compat/strlcat.h>
 #endif
+#ifndef HAVE_STRLCPY
+#include <compat/strlcpy.h>
+#endif
 
 /*
  * Parse the contents of the audit_control file to return the audit control
@@ -363,11 +367,11 @@ getacdir(char *name, int len)
 		pthread_mutex_unlock(&mutex);
 		return (-1);
 	}
-	if (strlen(dir) >= len) {
+	if (strlen(dir) >= (size_t)len) {
 		pthread_mutex_unlock(&mutex);
 		return (-3);
 	}
-	strcpy(name, dir);
+	strlcpy(name, dir, len);
 	pthread_mutex_unlock(&mutex);
 	return (ret);
 }
@@ -453,11 +457,11 @@ getacflg(char *auditstr, int len)
 		pthread_mutex_unlock(&mutex);
 		return (1);
 	}
-	if (strlen(str) >= len) {
+	if (strlen(str) >= (size_t)len) {
 		pthread_mutex_unlock(&mutex);
 		return (-3);
 	}
-	strcpy(auditstr, str);
+	strlcpy(auditstr, str, len);
 	pthread_mutex_unlock(&mutex);
 	return (0);
 }
@@ -480,11 +484,12 @@ getacna(char *auditstr, int len)
 		pthread_mutex_unlock(&mutex);
 		return (1);
 	}
-	if (strlen(str) >= len) {
+	if (strlen(str) >= (size_t)len) {
 		pthread_mutex_unlock(&mutex);
 		return (-3);
 	}
-	strcpy(auditstr, str);
+	strlcpy(auditstr, str, len);
+	pthread_mutex_unlock(&mutex);
 	return (0);
 }
 
@@ -510,6 +515,30 @@ getacpol(char *auditstr, size_t len)
 		pthread_mutex_unlock(&mutex);
 		return (-3);
 	}
+	strlcpy(auditstr, str, len);
+	pthread_mutex_unlock(&mutex);
+	return (0);
+}
+
+int
+getachost(char *auditstr, size_t len)
+{
+	char *str;
+
+	pthread_mutex_lock(&mutex);
+	setac_locked();
+	if (getstrfromtype_locked(AUDIT_HOST_CONTROL_ENTRY, &str) < 0) {
+		pthread_mutex_unlock(&mutex);
+		return (-2);
+	}
+	if (str == NULL) {
+		pthread_mutex_unlock(&mutex);
+		return (1);
+	}
+	if (strlen(str) >= len) {
+		pthread_mutex_unlock(&mutex);
+		return (-3);
+	}
 	strcpy(auditstr, str);
 	pthread_mutex_unlock(&mutex);
 	return (0);
diff --git a/contrib/openbsm/libbsm/bsm_event.c b/contrib/openbsm/libbsm/bsm_event.c
index 092d176..695e617c 100644
--- a/contrib/openbsm/libbsm/bsm_event.c
+++ b/contrib/openbsm/libbsm/bsm_event.c
@@ -1,5 +1,5 @@
-/*
- * Copyright (c) 2004 Apple Computer, Inc.
+/*-
+ * Copyright (c) 2004 Apple Inc.
  * Copyright (c) 2006 Robert N. M. Watson
  * All rights reserved.
  *
@@ -11,7 +11,7 @@
  * 2.  Redistributions in binary form must reproduce the above copyright
  *     notice, this list of conditions and the following disclaimer in the
  *     documentation and/or other materials provided with the distribution.
- * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
  *     its contributors may be used to endorse or promote products derived
  *     from this software without specific prior written permission.
  *
@@ -27,9 +27,11 @@
  * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  * POSSIBILITY OF SUCH DAMAGE.
  *
- * $P4: //depot/projects/trustedbsd/openbsm/libbsm/bsm_event.c#13 $
+ * $P4: //depot/projects/trustedbsd/openbsm/libbsm/bsm_event.c#16 $
  */
 
+#include <config/config.h>
+
 #include <bsm/libbsm.h>
 
 #include <string.h>
@@ -37,6 +39,11 @@
 #include <stdio.h>
 #include <stdlib.h>
 
+#ifndef HAVE_STRLCPY
+#include <compat/strlcpy.h>
+#endif
+
+
 /*
  * Parse the contents of the audit_event file to return
  * au_event_ent entries
@@ -68,13 +75,13 @@ eventfromstr(char *str, struct au_event_ent *e)
 	if (strlen(evname) >= AU_EVENT_NAME_MAX)
 		return (NULL);
 
-	strcpy(e->ae_name, evname);
+	strlcpy(e->ae_name, evname, AU_EVENT_NAME_MAX);
 	if (evdesc != NULL) {
 		if (strlen(evdesc) >= AU_EVENT_DESC_MAX)
 			return (NULL);
-		strcpy(e->ae_desc, evdesc);
+		strlcpy(e->ae_desc, evdesc, AU_EVENT_DESC_MAX);
 	} else
-		strcpy(e->ae_desc, "");
+		strlcpy(e->ae_desc, "", AU_EVENT_DESC_MAX);
 
 	e->ae_number = atoi(evno);
 
diff --git a/contrib/openbsm/libbsm/bsm_flags.c b/contrib/openbsm/libbsm/bsm_flags.c
index e514c86..c87ae84 100644
--- a/contrib/openbsm/libbsm/bsm_flags.c
+++ b/contrib/openbsm/libbsm/bsm_flags.c
@@ -1,5 +1,5 @@
-/*
- * Copyright (c) 2004 Apple Computer, Inc.
+/*-
+ * Copyright (c) 2004 Apple Inc.
  * Copyright (c) 2006 Robert N. M. Watson
  * All rights reserved.
  *
@@ -11,7 +11,7 @@
  * 2.  Redistributions in binary form must reproduce the above copyright
  *     notice, this list of conditions and the following disclaimer in the
  *     documentation and/or other materials provided with the distribution.
- * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
  *     its contributors may be used to endorse or promote products derived
  *     from this software without specific prior written permission.
  *
@@ -27,15 +27,21 @@
  * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  * POSSIBILITY OF SUCH DAMAGE.
  *
- * $P4: //depot/projects/trustedbsd/openbsm/libbsm/bsm_flags.c#13 $
+ * $P4: //depot/projects/trustedbsd/openbsm/libbsm/bsm_flags.c#16 $
  */
 
+#include <config/config.h>
+
 #include <bsm/libbsm.h>
 
 #include <errno.h>
 #include <stdio.h>
 #include <string.h>
 
+#ifndef HAVE_STRLCPY
+#include <compat/strlcpy.h>
+#endif
+
 static const char	*flagdelim = ",";
 
 /*
@@ -157,10 +163,10 @@ getauditflagschar(char *auditstr, au_mask_t *masks, int verbose)
 
 		if (sel != 0) {
 			if (verbose) {
-				strcpy(strptr, c.ac_desc);
+				strlcpy(strptr, c.ac_desc, AU_CLASS_DESC_MAX);
 				strptr += strlen(c.ac_desc);
 			} else {
-				strcpy(strptr, c.ac_name);
+				strlcpy(strptr, c.ac_name, AU_CLASS_NAME_MAX);
 				strptr += strlen(c.ac_name);
 			}
 			*strptr = ','; /* delimiter */
diff --git a/contrib/openbsm/libbsm/bsm_io.c b/contrib/openbsm/libbsm/bsm_io.c
index 29fdc87..989fd8b 100644
--- a/contrib/openbsm/libbsm/bsm_io.c
+++ b/contrib/openbsm/libbsm/bsm_io.c
@@ -1,5 +1,5 @@
-/*
- * Copyright (c) 2004 Apple Computer, Inc.
+/*-
+ * Copyright (c) 2004 Apple Inc.
  * Copyright (c) 2005 SPARTA, Inc.
  * Copyright (c) 2006 Robert N. M. Watson
  * Copyright (c) 2006 Martin Voros
@@ -32,7 +32,7 @@
  * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  * POSSIBILITY OF SUCH DAMAGE.
  *
- * $P4: //depot/projects/trustedbsd/openbsm/libbsm/bsm_io.c#50 $
+ * $P4: //depot/projects/trustedbsd/openbsm/libbsm/bsm_io.c#55 $
  */
 
 #include <sys/types.h>
@@ -77,48 +77,48 @@
 #include <bsm/audit_internal.h>
 
 #define	READ_TOKEN_BYTES(buf, len, dest, size, bytesread, err) do {	\
-	if (bytesread + size > len) {					\
-		err = 1;						\
+	if ((bytesread) + (size) > (u_int32_t)(len)) {			\
+		(err) = 1;						\
 	} else {							\
-		memcpy(dest, buf + bytesread, size);			\
+		memcpy((dest), (buf) + (bytesread), (size));		\
 		bytesread += size;					\
 	}								\
 } while (0)
 
 #define	READ_TOKEN_U_CHAR(buf, len, dest, bytesread, err) do {		\
-	if (bytesread + sizeof(u_char) <= len) {			\
-		dest = buf[bytesread];					\
-		bytesread += sizeof(u_char);				\
+	if ((bytesread) + sizeof(u_char) <= (u_int32_t)(len)) {		\
+		(dest) = buf[(bytesread)];				\
+		(bytesread) += sizeof(u_char);				\
 	} else								\
-		err = 1;						\
+		(err) = 1;						\
 } while (0)
 
 #define	READ_TOKEN_U_INT16(buf, len, dest, bytesread, err) do {		\
-	if (bytesread + sizeof(u_int16_t) <= len) {			\
-		dest = be16dec(buf + bytesread);			\
-		bytesread += sizeof(u_int16_t);				\
+	if ((bytesread) + sizeof(u_int16_t) <= (u_int32_t)(len)) {	\
+		(dest) = be16dec((buf) + (bytesread));			\
+		(bytesread) += sizeof(u_int16_t);			\
 	} else								\
-		err = 1;						\
+		(err) = 1;						\
 } while (0)
 
 #define	READ_TOKEN_U_INT32(buf, len, dest, bytesread, err) do {		\
-	if (bytesread + sizeof(u_int32_t) <= len) {			\
-		dest = be32dec(buf + bytesread);			\
-		bytesread += sizeof(u_int32_t);				\
+	if ((bytesread) + sizeof(u_int32_t) <= (u_int32_t)(len)) {	\
+		(dest) = be32dec((buf) + (bytesread));			\
+		(bytesread) += sizeof(u_int32_t);			\
 	} else								\
-		err = 1; 						\
+		(err) = 1; 						\
 } while (0)
 
 #define	READ_TOKEN_U_INT64(buf, len, dest, bytesread, err) do {		\
-	if (bytesread + sizeof(u_int64_t) <= len) {			\
-		dest = be64dec(buf + bytesread);			\
-		bytesread += sizeof(u_int64_t);				\
+	if ((bytesread) + sizeof(u_int64_t) <= (u_int32_t)(len)) {	\
+		dest = be64dec((buf) + (bytesread));			\
+		(bytesread) += sizeof(u_int64_t);			\
 	} else								\
-		err = 1; 						\
+		(err) = 1; 						\
 } while (0)
 
 #define	SET_PTR(buf, len, ptr, size, bytesread, err) do {		\
-	if ((bytesread) + (size) > (len))				\
+	if ((bytesread) + (size) > (u_int32_t)(len))			\
 		(err) = 1;						\
 	else {								\
 		(ptr) = (buf) + (bytesread);				\
@@ -188,7 +188,7 @@ print_8_bytes(FILE *fp, u_int64_t val, const char *format)
 static void
 print_mem(FILE *fp, u_char *data, size_t len)
 {
-	int i;
+	u_int32_t i;
 
 	if (len > 0) {
 		fprintf(fp, "0x");
@@ -203,7 +203,7 @@ print_mem(FILE *fp, u_char *data, size_t len)
 static void
 print_string(FILE *fp, const char *str, size_t len)
 {
-	int i;
+	u_int32_t i;
 
 	if (len > 0) {
 		for (i = 0; i < len; i++) {
@@ -996,12 +996,10 @@ print_header32_ex_tok(FILE *fp, tokenstr_t *tok, char *del, char raw,
 		open_attr(fp, "modifier");
 		print_evmod(fp, tok->tt.hdr32_ex.e_mod, raw);
 		close_attr(fp);
-		/*
-		 * No attribute for additional types.
-		 *
+		open_attr(fp, "host");
 		print_ip_ex_address(fp, tok->tt.hdr32_ex.ad_type,
 		    tok->tt.hdr32_ex.addr);
-		 */
+		close_attr(fp);
 		open_attr(fp, "time");
 		print_sec32(fp, tok->tt.hdr32_ex.s, raw);
 		close_attr(fp);
@@ -1188,12 +1186,10 @@ print_header64_ex_tok(FILE *fp, tokenstr_t *tok, char *del, char raw,
 		open_attr(fp, "modifier");
 		print_evmod(fp, tok->tt.hdr64_ex.e_mod, raw);
 		close_attr(fp);
-		/*
-		 * No attribute for additional types.
-		 *
+		open_attr(fp, "host");
 		print_ip_ex_address(fp, tok->tt.hdr64_ex.ad_type,
 		    tok->tt.hdr64_ex.addr);
-		 */
+		close_attr(fp);
 		open_attr(fp, "time");
 		print_sec64(fp, tok->tt.hdr64_ex.s, raw);
 		close_attr(fp);
@@ -1478,7 +1474,7 @@ print_arb_tok(FILE *fp, tokenstr_t *tok, char *del, char raw,
 		size = AUR_BYTE_SIZE;
 		if (xml) {
 			open_attr(fp, "type");
-			fprintf(fp, "%u", size);
+			fprintf(fp, "%zu", size);
 			close_attr(fp);
 			open_attr(fp, "count");
 			print_1_byte(fp, tok->tt.arb.uc, "%u");
@@ -1504,7 +1500,7 @@ print_arb_tok(FILE *fp, tokenstr_t *tok, char *del, char raw,
 		size = AUR_SHORT_SIZE;
 		if (xml) {
 			open_attr(fp, "type");
-			fprintf(fp, "%u", size);
+			fprintf(fp, "%zu", size);
 			close_attr(fp);
 			open_attr(fp, "count");
 			print_1_byte(fp, tok->tt.arb.uc, "%u");
@@ -1533,7 +1529,7 @@ print_arb_tok(FILE *fp, tokenstr_t *tok, char *del, char raw,
 		size = AUR_INT32_SIZE;
 		if (xml) {
 			open_attr(fp, "type");
-			fprintf(fp, "%u", size);
+			fprintf(fp, "%zu", size);
 			close_attr(fp);
 			open_attr(fp, "count");
 			print_1_byte(fp, tok->tt.arb.uc, "%u");
@@ -1561,7 +1557,7 @@ print_arb_tok(FILE *fp, tokenstr_t *tok, char *del, char raw,
 		size = AUR_INT64_SIZE;
 		if (xml) {
 			open_attr(fp, "type");
-			fprintf(fp, "%u", size);
+			fprintf(fp, "%zu", size);
 			close_attr(fp);
 			open_attr(fp, "count");
 			print_1_byte(fp, tok->tt.arb.uc, "%u");
@@ -1803,7 +1799,7 @@ static int
 fetch_execarg_tok(tokenstr_t *tok, u_char *buf, int len)
 {
 	int err = 0;
-	int i;
+	u_int32_t i;
 	u_char *bptr;
 
 	READ_TOKEN_U_INT32(buf, len, tok->tt.execarg.count, tok->len, err);
@@ -1817,7 +1813,7 @@ fetch_execarg_tok(tokenstr_t *tok, u_char *buf, int len)
 
 		/* Look for a null terminated string. */
 		while (bptr && (*bptr != '\0')) {
-			if (++tok->len >=len)
+			if (++tok->len >= (u_int32_t)len)
 				return (-1);
 			bptr = buf + tok->len;
 		}
@@ -1835,7 +1831,7 @@ static void
 print_execarg_tok(FILE *fp, tokenstr_t *tok, char *del, char raw,
     __unused char sfrm, int xml)
 {
-	int i;
+	u_int32_t i;
 
 	print_tok_type(fp, tok->id, "exec arg", raw, xml);
 	for (i = 0; i < tok->tt.execarg.count; i++) {
@@ -1862,7 +1858,7 @@ static int
 fetch_execenv_tok(tokenstr_t *tok, u_char *buf, int len)
 {
 	int err = 0;
-	int i;
+	u_int32_t i;
 	u_char *bptr;
 
 	READ_TOKEN_U_INT32(buf, len, tok->tt.execenv.count, tok->len, err);
@@ -1876,7 +1872,7 @@ fetch_execenv_tok(tokenstr_t *tok, u_char *buf, int len)
 
 		/* Look for a null terminated string. */
 		while (bptr && (*bptr != '\0')) {
-			if (++tok->len >=len)
+			if (++tok->len >= (u_int32_t)len)
 				return (-1);
 			bptr = buf + tok->len;
 		}
@@ -1894,7 +1890,7 @@ static void
 print_execenv_tok(FILE *fp, tokenstr_t *tok, char *del, char raw,
     __unused char sfrm, int xml)
 {
-	int i;
+	u_int32_t i;
 
 	print_tok_type(fp, tok->id, "exec env", raw, xml);
 	for (i = 0; i< tok->tt.execenv.count; i++) {
@@ -3817,7 +3813,7 @@ print_socketex32_tok(FILE *fp, tokenstr_t *tok, char *del, char raw,
 		print_ip_address(fp, tok->tt.socket_ex32.r_addr);
 		close_attr(fp);
 		open_attr(fp, "fport");
-		print_2_bytes(fp, tok->tt.socket_ex32.type, "%#x");
+		print_2_bytes(fp, ntohs(tok->tt.socket_ex32.r_port), "%#x");
 		close_attr(fp);
 		close_tag(fp, tok->id);
 	} else {
diff --git a/contrib/openbsm/libbsm/bsm_mask.c b/contrib/openbsm/libbsm/bsm_mask.c
index 4914dd3..07d3da3 100644
--- a/contrib/openbsm/libbsm/bsm_mask.c
+++ b/contrib/openbsm/libbsm/bsm_mask.c
@@ -1,5 +1,5 @@
-/*
- * Copyright (c) 2004 Apple Computer, Inc.
+/*-
+ * Copyright (c) 2004 Apple Inc.
  * Copyright (c) 2005 Robert N. M. Watson
  * All rights reserved.
  *
@@ -11,7 +11,7 @@
  * 2.  Redistributions in binary form must reproduce the above copyright
  *     notice, this list of conditions and the following disclaimer in the
  *     documentation and/or other materials provided with the distribution.
- * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
  *     its contributors may be used to endorse or promote products derived
  *     from this software without specific prior written permission.
  *
@@ -27,7 +27,7 @@
  * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  * POSSIBILITY OF SUCH DAMAGE.
  *
- * $P4: //depot/projects/trustedbsd/openbsm/libbsm/bsm_mask.c#13 $
+ * $P4: //depot/projects/trustedbsd/openbsm/libbsm/bsm_mask.c#14 $
  */
 
 #include <sys/types.h>
diff --git a/contrib/openbsm/libbsm/bsm_notify.c b/contrib/openbsm/libbsm/bsm_notify.c
index e7d3ea2..72458aa 100644
--- a/contrib/openbsm/libbsm/bsm_notify.c
+++ b/contrib/openbsm/libbsm/bsm_notify.c
@@ -1,5 +1,5 @@
-/*
- * Copyright (c) 2004 Apple Computer, Inc.
+/*-
+ * Copyright (c) 2004 Apple Inc.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -10,7 +10,7 @@
  * 2.  Redistributions in binary form must reproduce the above copyright
  *     notice, this list of conditions and the following disclaimer in the
  *     documentation and/or other materials provided with the distribution.
- * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
  *     its contributors may be used to endorse or promote products derived
  *     from this software without specific prior written permission.
  *
@@ -26,7 +26,7 @@
  * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  * POSSIBILITY OF SUCH DAMAGE.
  *
- * $P4: //depot/projects/trustedbsd/openbsm/libbsm/bsm_notify.c#13 $
+ * $P4: //depot/projects/trustedbsd/openbsm/libbsm/bsm_notify.c#15 $
  */
 
 /*
@@ -165,7 +165,7 @@ cannot_audit(int val __unused)
 #ifdef __APPLE__
 	return (!(au_get_state() == AUC_AUDITING));
 #else
-	unsigned long au_cond;
+	long au_cond;
 
 	if (auditon(A_GETCOND, &au_cond, sizeof(long)) < 0) {
 		if (errno != ENOSYS) {
diff --git a/contrib/openbsm/libbsm/bsm_token.c b/contrib/openbsm/libbsm/bsm_token.c
index c660895..f9692d1 100644
--- a/contrib/openbsm/libbsm/bsm_token.c
+++ b/contrib/openbsm/libbsm/bsm_token.c
@@ -1,5 +1,5 @@
-/*
- * Copyright (c) 2004 Apple Computer, Inc.
+/*-
+ * Copyright (c) 2004-2008 Apple Inc.
  * Copyright (c) 2005 SPARTA, Inc.
  * All rights reserved.
  *
@@ -14,7 +14,7 @@
  * 2.  Redistributions in binary form must reproduce the above copyright
  *     notice, this list of conditions and the following disclaimer in the
  *     documentation and/or other materials provided with the distribution.
- * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
  *     its contributors may be used to endorse or promote products derived
  *     from this software without specific prior written permission.
  *
@@ -30,7 +30,7 @@
  * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  * POSSIBILITY OF SUCH DAMAGE.
  *
- * $P4: //depot/projects/trustedbsd/openbsm/libbsm/bsm_token.c#63 $
+ * $P4: //depot/projects/trustedbsd/openbsm/libbsm/bsm_token.c#72 $
  */
 
 #include <sys/types.h>
@@ -87,7 +87,7 @@
 			memset((dptr), 0, (length));			\
 	} else								\
 		(dptr) = NULL;						\
-	assert(t == NULL || dptr != NULL);				\
+	assert((t) == NULL || (dptr) != NULL);				\
 } while (0)
 
 /*
@@ -98,7 +98,7 @@
  * text                    N bytes + 1 terminating NULL byte
  */
 token_t *
-au_to_arg32(char n, char *text, u_int32_t v)
+au_to_arg32(char n, const char *text, u_int32_t v)
 {
 	token_t *t;
 	u_char *dptr = NULL;
@@ -119,11 +119,10 @@ au_to_arg32(char n, char *text, u_int32_t v)
 	ADD_STRING(dptr, text, textlen);
 
 	return (t);
-
 }
 
 token_t *
-au_to_arg64(char n, char *text, u_int64_t v)
+au_to_arg64(char n, const char *text, u_int64_t v)
 {
 	token_t *t;
 	u_char *dptr = NULL;
@@ -144,11 +143,10 @@ au_to_arg64(char n, char *text, u_int64_t v)
 	ADD_STRING(dptr, text, textlen);
 
 	return (t);
-
 }
 
 token_t *
-au_to_arg(char n, char *text, u_int32_t v)
+au_to_arg(char n, const char *text, u_int32_t v)
 {
 
 	return (au_to_arg32(n, text, v));
@@ -180,8 +178,8 @@ au_to_attr32(struct vnode_au_info *vni)
 	ADD_U_CHAR(dptr, AUT_ATTR32);
 
 	/*
-	 * Darwin defines the size for the file mode
-	 * as 2 bytes; BSM defines 4 so pad with 0
+	 * Darwin defines the size for the file mode as 2 bytes; BSM defines
+	 * 4 so pad with 0.
 	 */
 	ADD_U_INT16(dptr, pad0_16);
 	ADD_U_INT16(dptr, vni->vn_mode);
@@ -191,7 +189,7 @@ au_to_attr32(struct vnode_au_info *vni)
 	ADD_U_INT32(dptr, vni->vn_fsid);
 
 	/*
-	 * Some systems use 32-bit file ID's, other's use 64-bit file IDs.
+	 * Some systems use 32-bit file ID's, others use 64-bit file IDs.
 	 * Attempt to handle both, and let the compiler sort it out.  If we
 	 * could pick this out at compile-time, it would be better, so as to
 	 * avoid the else case below.
@@ -225,8 +223,8 @@ au_to_attr64(struct vnode_au_info *vni)
 	ADD_U_CHAR(dptr, AUT_ATTR64);
 
 	/*
-	 * Darwin defines the size for the file mode
-	 * as 2 bytes; BSM defines 4 so pad with 0
+	 * Darwin defines the size for the file mode as 2 bytes; BSM defines
+	 * 4 so pad with 0.
 	 */
 	ADD_U_INT16(dptr, pad0_16);
 	ADD_U_INT16(dptr, vni->vn_mode);
@@ -270,7 +268,7 @@ au_to_attr(struct vnode_au_info *vni)
  * data items              (depends on basic unit)
  */
 token_t *
-au_to_data(char unit_print, char unit_type, char unit_count, char *p)
+au_to_data(char unit_print, char unit_type, char unit_count, const char *p)
 {
 	token_t *t;
 	u_char *dptr = NULL;
@@ -298,7 +296,7 @@ au_to_data(char unit_print, char unit_type, char unit_count, char *p)
 
 	default:
 		errno = EINVAL;
- 		return (NULL);
+		return (NULL);
 	}
 
 	totdata = datasize * unit_count;
@@ -345,7 +343,7 @@ token_t *
 au_to_groups(int *groups)
 {
 
-	return (au_to_newgroups(AUDIT_MAX_GROUPS, (gid_t*)groups));
+	return (au_to_newgroups(AUDIT_MAX_GROUPS, (gid_t *)groups));
 }
 
 /*
@@ -396,7 +394,7 @@ au_to_in_addr(struct in_addr *internet_addr)
 /*
  * token ID                1 byte
  * address type/length     4 bytes
- * Address                16 bytes
+ * address                16 bytes
  */
 token_t *
 au_to_in_addr_ex(struct in6_addr *internet_addr)
@@ -484,8 +482,8 @@ au_to_ipc_perm(struct ipc_perm *perm)
 	ADD_U_CHAR(dptr, AUT_IPC_PERM);
 
 	/*
-	 * Darwin defines the sizes for ipc_perm members
-	 * as 2 bytes; BSM defines 4 so pad with 0
+	 * Darwin defines the sizes for ipc_perm members as 2 bytes; BSM
+	 * defines 4 so pad with 0.
 	 */
 	ADD_U_INT16(dptr, pad0);
 	ADD_U_INT16(dptr, perm->uid);
@@ -506,15 +504,23 @@ au_to_ipc_perm(struct ipc_perm *perm)
 
 #ifdef HAVE_IPC_PERM___SEQ
 	ADD_U_INT16(dptr, perm->__seq);
-#else
+#else	/* HAVE_IPC_PERM___SEQ */
+#ifdef  HAVE_IPC_PERM__SEQ
+	ADD_U_INT16(dptr, perm->_seq);
+#else	/* HAVE_IPC_PERM__SEQ */
 	ADD_U_INT16(dptr, perm->seq);
-#endif
+#endif	/* HAVE_IPC_PERM__SEQ */
+#endif	/* HAVE_IPC_PERM___SEQ */
 
 #ifdef HAVE_IPC_PERM___KEY
 	ADD_U_INT32(dptr, perm->__key);
-#else
+#else	/* HAVE_IPC_PERM___KEY */
+#ifdef  HAVE_IPC_PERM__KEY
+	ADD_U_INT32(dptr, perm->_key);
+#else	/* HAVE_IPC_PERM__KEY */
 	ADD_U_INT32(dptr, perm->key);
-#endif
+#endif	/* HAVE_IPC_PERM__KEY */
+#endif	/* HAVE_IPC_PERM___KEY */
 
 	return (t);
 }
@@ -545,7 +551,7 @@ au_to_iport(u_int16_t iport)
  * data                    size bytes
  */
 token_t *
-au_to_opaque(char *data, u_int16_t bytes)
+au_to_opaque(const char *data, u_int16_t bytes)
 {
 	token_t *t;
 	u_char *dptr = NULL;
@@ -569,7 +575,7 @@ au_to_opaque(char *data, u_int16_t bytes)
  * file pathname           N bytes + 1 terminating NULL byte
  */
 token_t *
-au_to_file(char *file, struct timeval tm)
+au_to_file(const char *file, struct timeval tm)
 {
 	token_t *t;
 	u_char *dptr = NULL;
@@ -601,7 +607,7 @@ au_to_file(char *file, struct timeval tm)
  * text                    N bytes + 1 terminating NULL byte
  */
 token_t *
-au_to_text(char *text)
+au_to_text(const char *text)
 {
 	token_t *t;
 	u_char *dptr = NULL;
@@ -627,7 +633,7 @@ au_to_text(char *text)
  * path                    N bytes + 1 terminating NULL byte
  */
 token_t *
-au_to_path(char *text)
+au_to_path(const char *text)
 {
 	token_t *t;
 	u_char *dptr = NULL;
@@ -906,7 +912,7 @@ au_to_sock_unix(struct sockaddr_un *so)
 	if (t == NULL)
 		return (NULL);
 
-	ADD_U_CHAR(dptr, AU_SOCK_UNIX_TOKEN);
+	ADD_U_CHAR(dptr, AUT_SOCKUNIX);
 	/* BSM token has two bytes for family */
 	ADD_U_CHAR(dptr, 0);
 	ADD_U_CHAR(dptr, so->sun_family);
@@ -943,14 +949,13 @@ au_to_sock_inet32(struct sockaddr_in *so)
 	 *
 	 * XXXRW: Should a name space conversion be taking place on the value
 	 * of sin_family?
- 	 */
+	 */
 	family = so->sin_family;
 	ADD_U_INT16(dptr, family);
 	ADD_MEM(dptr, &so->sin_port, sizeof(uint16_t));
 	ADD_MEM(dptr, &so->sin_addr.s_addr, sizeof(uint32_t));
 
 	return (t);
-
 }
 
 token_t *
@@ -967,8 +972,8 @@ au_to_sock_inet128(struct sockaddr_in6 *so)
 	ADD_U_CHAR(dptr, AUT_SOCKINET128);
 	/*
 	 * In Darwin, sin6_family is one octet, but BSM defines the token
- 	 * to store two. So we copy in a 0 first.
- 	 */
+	 * to store two. So we copy in a 0 first.
+	 */
 	ADD_U_CHAR(dptr, 0);
 	ADD_U_CHAR(dptr, so->sin6_family);
 
@@ -976,7 +981,6 @@ au_to_sock_inet128(struct sockaddr_in6 *so)
 	ADD_MEM(dptr, &so->sin6_addr, 4 * sizeof(uint32_t));
 
 	return (t);
-
 }
 
 token_t *
@@ -1162,8 +1166,8 @@ au_to_subject_ex(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
 
 #if !defined(_KERNEL) && !defined(KERNEL) && defined(HAVE_AUDIT_SYSCALLS)
 /*
- * Collects audit information for the current process
- * and creates a subject token from it
+ * Collects audit information for the current process and creates a subject
+ * token from it.
  */
 token_t *
 au_to_me(void)
@@ -1225,7 +1229,7 @@ au_to_exec_args(char **argv)
  * zonename                N bytes + 1 terminating NULL byte
  */
 token_t *
-au_to_zonename(char *zonename)
+au_to_zonename(const char *zonename)
 {
 	u_char *dptr = NULL;
 	u_int16_t textlen;
@@ -1317,6 +1321,53 @@ au_to_header32_tm(int rec_size, au_event_t e_type, au_emod_t e_mod,
 	return (t);
 }
 
+/*
+ * token ID                1 byte
+ * record byte count       4 bytes
+ * version #               1 byte    [2]
+ * event type              2 bytes
+ * event modifier          2 bytes
+ * address type/length     4 bytes
+ * machine address         4 bytes/16 bytes (IPv4/IPv6 address)
+ * seconds of time         4 bytes/8 bytes (32-bit/64-bit value)
+ * milliseconds of time    4 bytes/8 bytes (32-bit/64-bit value)
+ */
+token_t *
+au_to_header32_ex_tm(int rec_size, au_event_t e_type, au_emod_t e_mod,
+    struct timeval tm, struct auditinfo_addr *aia)
+{
+	token_t *t;
+	u_char *dptr = NULL;
+	u_int32_t timems, hostid;
+	au_tid_addr_t *tid = &aia->ai_termid;
+
+	if (tid->at_type != AU_IPv4 && tid->at_type != AU_IPv6)
+		return (NULL);
+	GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int32_t) +
+	    sizeof(u_char) + 2 * sizeof(u_int16_t) + 3 *
+	    sizeof(u_int32_t) + tid->at_type);
+	if (t == NULL) 
+		return (NULL);
+
+	ADD_U_CHAR(dptr, AUT_HEADER32_EX);
+	ADD_U_INT32(dptr, rec_size);
+	ADD_U_CHAR(dptr, AUDIT_HEADER_VERSION_OPENBSM);
+	ADD_U_INT16(dptr, e_type);
+	ADD_U_INT16(dptr, e_mod);
+
+	ADD_U_INT32(dptr, tid->at_type);
+	if (tid->at_type == AU_IPv6)
+		ADD_MEM(dptr, &tid->at_addr[0], 4 * sizeof(u_int32_t));
+	else
+		ADD_MEM(dptr, &tid->at_addr[0], sizeof(u_int32_t));
+	timems = tm.tv_usec/1000;
+	/* Add the timestamp */
+	ADD_U_INT32(dptr, tm.tv_sec);
+	ADD_U_INT32(dptr, timems);      /* We need time in ms. */
+
+	return (t);   
+}
+
 token_t *
 au_to_header64_tm(int rec_size, au_event_t e_type, au_emod_t e_mod,
     struct timeval tm)
@@ -1345,6 +1396,24 @@ au_to_header64_tm(int rec_size, au_event_t e_type, au_emod_t e_mod,
 }
 
 #if !defined(KERNEL) && !defined(_KERNEL)
+#ifdef HAVE_AUDIT_SYSCALLS
+token_t *
+au_to_header32_ex(int rec_size, au_event_t e_type, au_emod_t e_mod)
+{
+	struct timeval tm;
+	struct auditinfo_addr aia;
+
+	if (gettimeofday(&tm, NULL) == -1)
+		return (NULL);
+	if (auditon(A_GETKAUDIT, &aia, sizeof(aia)) < 0) {
+		if (errno != ENOSYS)
+			return (NULL);
+		return (au_to_header32_tm(rec_size, e_type, e_mod, tm));
+	}
+	return (au_to_header32_ex_tm(rec_size, e_type, e_mod, tm, &aia));
+}
+#endif /* HAVE_AUDIT_SYSCALLS */
+
 token_t *
 au_to_header32(int rec_size, au_event_t e_type, au_emod_t e_mod)
 {
@@ -1372,7 +1441,16 @@ au_to_header(int rec_size, au_event_t e_type, au_emod_t e_mod)
 
 	return (au_to_header32(rec_size, e_type, e_mod));
 }
-#endif
+
+#ifdef HAVE_AUDIT_SYSCALLS
+token_t *
+au_to_header_ex(int rec_size, au_event_t e_type, au_emod_t e_mod)
+{
+
+	return (au_to_header32_ex(rec_size, e_type, e_mod));
+}
+#endif /* HAVE_AUDIT_SYSCALLS */
+#endif /* !defined(KERNEL) && !defined(_KERNEL) */
 
 /*
  * token ID                1 byte
diff --git a/contrib/openbsm/libbsm/bsm_user.c b/contrib/openbsm/libbsm/bsm_user.c
index c00d139..5266fdf 100644
--- a/contrib/openbsm/libbsm/bsm_user.c
+++ b/contrib/openbsm/libbsm/bsm_user.c
@@ -1,5 +1,5 @@
-/*
- * Copyright (c) 2004 Apple Computer, Inc.
+/*-
+ * Copyright (c) 2004 Apple Inc.
  * Copyright (c) 2006 Robert N. M. Watson
  * All rights reserved.
  *
@@ -11,7 +11,7 @@
  * 2.  Redistributions in binary form must reproduce the above copyright
  *     notice, this list of conditions and the following disclaimer in the
  *     documentation and/or other materials provided with the distribution.
- * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
  *     its contributors may be used to endorse or promote products derived
  *     from this software without specific prior written permission.
  *
@@ -27,9 +27,11 @@
  * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  * POSSIBILITY OF SUCH DAMAGE.
  *
- * $P4: //depot/projects/trustedbsd/openbsm/libbsm/bsm_user.c#15 $
+ * $P4: //depot/projects/trustedbsd/openbsm/libbsm/bsm_user.c#18 $
  */
 
+#include <config/config.h>
+
 #include <bsm/libbsm.h>
 
 #include <string.h>
@@ -37,6 +39,10 @@
 #include <stdio.h>
 #include <stdlib.h>
 
+#ifndef HAVE_STRLCPY
+#include <compat/strlcpy.h>
+#endif
+
 /*
  * Parse the contents of the audit_user file into au_user_ent structures.
  */
@@ -66,7 +72,7 @@ userfromstr(char *str, struct au_user_ent *u)
 	if (strlen(username) >= AU_USER_NAME_MAX)
 		return (NULL);
 
-	strcpy(u->au_name, username);
+	strlcpy(u->au_name, username, AU_USER_NAME_MAX);
 	if (getauditflagsbin(always, &(u->au_always)) == -1)
 		return (NULL);
 
diff --git a/contrib/openbsm/libbsm/bsm_wrappers.c b/contrib/openbsm/libbsm/bsm_wrappers.c
index f001e5f..f818f1d 100644
--- a/contrib/openbsm/libbsm/bsm_wrappers.c
+++ b/contrib/openbsm/libbsm/bsm_wrappers.c
@@ -1,5 +1,5 @@
-/*
- * Copyright (c) 2004 Apple Computer, Inc.
+/*-
+ * Copyright (c) 2004 Apple Inc.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -10,7 +10,7 @@
  * 2.  Redistributions in binary form must reproduce the above copyright
  *     notice, this list of conditions and the following disclaimer in the
  *     documentation and/or other materials provided with the distribution.
- * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
  *     its contributors may be used to endorse or promote products derived
  *     from this software without specific prior written permission.
  *
@@ -26,7 +26,7 @@
  * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  * POSSIBILITY OF SUCH DAMAGE.
  *
- * $P4: //depot/projects/trustedbsd/openbsm/libbsm/bsm_wrappers.c#24 $
+ * $P4: //depot/projects/trustedbsd/openbsm/libbsm/bsm_wrappers.c#26 $
  */
 
 #ifdef __APPLE__
@@ -285,7 +285,7 @@ audit_write(short event_code, token_t *subject, token_t *misctok, char retval,
 	if (subject && au_write(aufd, subject) == -1) {
 		au_free_token(subject);
 		au_free_token(misctok);
-		(void)au_close(aufd, AU_TO_WRITE, event_code);
+		(void)au_close(aufd, AU_TO_NO_WRITE, event_code);
 		syslog(LOG_ERR, "%s: write of subject failed", func);
 		return (kAUWriteSubjectTokErr);
 	}
diff --git a/contrib/openbsm/man/Makefile.in b/contrib/openbsm/man/Makefile.in
index 13a0d76..a24804a 100644
--- a/contrib/openbsm/man/Makefile.in
+++ b/contrib/openbsm/man/Makefile.in
@@ -15,7 +15,7 @@
 @SET_MAKE@
 
 #
-# $P4: //depot/projects/trustedbsd/openbsm/man/Makefile.in#4 $
+# $P4: //depot/projects/trustedbsd/openbsm/man/Makefile.in#7 $
 #
 VPATH = @srcdir@
 pkgdatadir = $(datadir)/@PACKAGE@
@@ -93,6 +93,7 @@ LN_S = @LN_S@
 LTLIBOBJS = @LTLIBOBJS@
 MAINT = @MAINT@
 MAKEINFO = @MAKEINFO@
+MIG = @MIG@
 MKDIR_P = @MKDIR_P@
 OBJEXT = @OBJEXT@
 PACKAGE = @PACKAGE@
diff --git a/contrib/openbsm/man/audit.2 b/contrib/openbsm/man/audit.2
index a9cd143..1ee61b9 100644
--- a/contrib/openbsm/man/audit.2
+++ b/contrib/openbsm/man/audit.2
@@ -24,7 +24,7 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\" $P4: //depot/projects/trustedbsd/openbsm/man/audit.2#8 $
+.\" $P4: //depot/projects/trustedbsd/openbsm/man/audit.2#9 $
 .\"
 .Dd April 19, 2005
 .Dt AUDIT 2
diff --git a/contrib/openbsm/man/audit.log.5 b/contrib/openbsm/man/audit.log.5
index d0f85ff..dac0067 100644
--- a/contrib/openbsm/man/audit.log.5
+++ b/contrib/openbsm/man/audit.log.5
@@ -23,7 +23,7 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\" $P4: //depot/projects/trustedbsd/openbsm/man/audit.log.5#16 $
+.\" $P4: //depot/projects/trustedbsd/openbsm/man/audit.log.5#19 $
 .\"
 .Dd November 5, 2006
 .Dt AUDIT.LOG 5
@@ -176,29 +176,27 @@ token can be created using
 .Ss in_addr Token
 The
 .Dq in_addr
-token holds a network byte order IPv4 or IPv6 address.
+token holds a network byte order IPv4 address.
 An
 .Dq in_addr
 token can be created using
 .Xr au_to_in_addr 3
-for an IPv4 address, or
-.Xr au_to_in_addr_ex 3
-for an IPv6 address.
-.Pp
-See the
-.Sx BUGS
-section for information on the storage of this token.
+for an IPv4 address.
 .Pp
 .Bl -column -offset 3n ".No Terminal Address Type/Length" ".No N bytes + 1 NUL"
 .It Sy "Field	Bytes	Description"
 .It "Token ID	1 byte	Token ID"
-.It "IP Address Type	1 byte	Type of address"
-.It "IP Address	4/16 bytes	IPv4 or IPv6 address"
+.It "IP Address	4 bytes	IPv4 address"
 .El
 .Ss Expanded in_addr Token
 The
-.Dq expanded in_addr
-token ...
+.Dq in_addr_ex
+token holds a network byte order IPv4 or IPv6 address.
+An
+.Dq in_addr_ex
+token can be created using
+.Xr au_to_in_addr_ex 3
+for an IPv6 address.
 .Pp
 See the
 .Sx BUGS
@@ -206,7 +204,8 @@ section for information on the storage of this token.
 .Bl -column -offset 3n ".No Terminal Address Type/Length" ".No N bytes + 1 NUL"
 .It Sy "Field	Bytes	Description"
 .It "Token ID	1 byte	Token ID"
-.It XXXX
+.It "IP Address Type	1 byte	Type of address"
+.It "IP Address	4/16 bytes	IPv4 or IPv6 address"
 .El
 .Ss ip Token
 The
@@ -230,15 +229,6 @@ token can be created using
 .It "Source Address	4 bytes	IPv4 source address"
 .It "Destination Address	4 bytes	IPv4 destination address"
 .El
-.Ss Expanded ip Token
-The
-.Dq expanded ip
-token ...
-.Bl -column -offset 3n ".No Terminal Address Type/Length" ".No N bytes + 1 NUL"
-.It Sy "Field	Bytes	Description"
-.It "Token ID	1 byte	Token ID"
-.It XXXX
-.El
 .Ss iport Token
 The
 .Dq iport
@@ -556,13 +546,14 @@ token can be created using
 .Ss Socket Token
 The
 .Dq socket
-token contains informations about UNIX domain and Internet sockets.
+token contains information about UNIX domain and Internet sockets.
 Each token has four or eight fields.
-Depend on type of socket a socket token may be created using
+Depending on the type of socket, a socket token may be created using
 .Xr au_to_sock_unix 3 ,
-.Xr au_to_sock_inet32 3 or
+.Xr au_to_sock_inet32 3 
+or
 .Xr au_to_sock_inet128 3 .
-.Bl -column -offset ind ".Sy Field Name Width XX" ".Sy XX Bytes XXXX" ".Sy Description"
+.Bl -column -offset 3n ".Sy Field Name Width XX" ".Sy XX Bytes XXXX" ".Sy Description"
 .It Sy "Field" Ta Sy Bytes Ta Sy Description
 .It Li "Token ID" Ta "1 byte" Ta "Token ID"
 .It Li "Socket family" Ta "2 bytes" Ta "Socket family"
@@ -572,18 +563,18 @@ Depend on type of socket a socket token may be created using
 .Bl -column -offset 3n ".No Terminal Address Type/Length" ".No N bytes + 1 NUL"
 .It Sy "Field	Bytes	Description"
 .It "Token ID	1 byte	Token ID"
-+.It Li "Socket domain" Ta "4 bytes" Ta "Socket domain"
-+.It Li "Socket family" Ta "2 bytes" Ta "Socket family"
-+.It Li "Address type" Ta "1 byte" Ta "Address type (IPv4/IPv6)"
-+.It Li "Local port" Ta "2 bytes" Ta "Local port"
-+.It Li "Local IP address" Ta "4/16 bytes" Ta "Local IP address"
-+.It Li "Remote port" Ta "2 bytes" Ta "Remote port"
-+.It Li "Remote IP address" Ta "4/16 bytes" Ta "Remote IP address"
+.It Li "Socket domain" Ta "4 bytes" Ta "Socket domain"
+.It Li "Socket family" Ta "2 bytes" Ta "Socket family"
+.It Li "Address type" Ta "1 byte" Ta "Address type (IPv4/IPv6)"
+.It Li "Local port" Ta "2 bytes" Ta "Local port"
+.It Li "Local IP address" Ta "4/16 bytes" Ta "Local IP address"
+.It Li "Remote port" Ta "2 bytes" Ta "Remote port"
+.It Li "Remote IP address" Ta "4/16 bytes" Ta "Remote IP address"
 .El
 .Ss Expanded Socket Token
 The
 .Dq expanded socket
-token ...
+token contains information about IPv4 and IPv6 sockets.
 .Bl -column -offset 3n ".No Terminal Address Type/Length" ".No N bytes + 1 NUL"
 .It Sy "Field	Bytes	Description"
 .It "Token ID	1 byte	Token ID"
@@ -639,11 +630,18 @@ token ...
 .Ss Zonename Token
 The
 .Dq zonename
-token ...
+token holds a NUL-terminated string with the name of the zone or jail from
+which the record originated.
+A
+.Dz zonename
+token can be created using
+.Xr au_to_zonename 3 .
+.Pp
 .Bl -column -offset 3n ".No Terminal Address Type/Length" ".No N bytes + 1 NUL"
 .It Sy "Field	Bytes	Description"
 .It "Token ID	1 byte	Token ID"
-.It XXXXX
+.It "Zonename length	2 bytes	Length of zonename string including NUL"
+.It "Zonename	N bytes + 1 NUL	Zonename string including NUL"
 .El
 .Sh SEE ALSO
 .Xr auditreduce 1 ,
@@ -676,7 +674,5 @@ and
 .Dq in_addr_ex
 token layout documented here appears to be in conflict with the
 .Xr libbsm 3
-implementations of
-.Xr au_to_in_addr 3
-and
+implementation of
 .Xr au_to_in_addr_ex 3 .
diff --git a/contrib/openbsm/man/audit_class.5 b/contrib/openbsm/man/audit_class.5
index cc5b122f..c92f57f 100644
--- a/contrib/openbsm/man/audit_class.5
+++ b/contrib/openbsm/man/audit_class.5
@@ -1,4 +1,4 @@
-.\" Copyright (c) 2004 Apple Computer, Inc.
+.\" Copyright (c) 2004 Apple Inc.
 .\" All rights reserved.
 .\"
 .\" Redistribution and use in source and binary forms, with or without
@@ -9,7 +9,7 @@
 .\" 2.  Redistributions in binary form must reproduce the above copyright
 .\"     notice, this list of conditions and the following disclaimer in the
 .\"     documentation and/or other materials provided with the distribution.
-.\" 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+.\" 3.  Neither the name of Apple Inc. ("Apple") nor the names of
 .\"     its contributors may be used to endorse or promote products derived
 .\"     from this software without specific prior written permission.
 .\"
@@ -25,7 +25,7 @@
 .\" IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 .\" POSSIBILITY OF SUCH DAMAGE.
 .\"
-.\" $P4: //depot/projects/trustedbsd/openbsm/man/audit_class.5#10 $
+.\" $P4: //depot/projects/trustedbsd/openbsm/man/audit_class.5#11 $
 .\"
 .Dd January 24, 2004
 .Dt AUDIT_CLASS 5
diff --git a/contrib/openbsm/man/audit_control.5 b/contrib/openbsm/man/audit_control.5
index a91f504..be89a12 100644
--- a/contrib/openbsm/man/audit_control.5
+++ b/contrib/openbsm/man/audit_control.5
@@ -1,4 +1,4 @@
-.\" Copyright (c) 2004 Apple Computer, Inc.
+.\" Copyright (c) 2004 Apple Inc.
 .\" Copyright (c) 2006 Robert N. M. Watson
 .\" All rights reserved.
 .\"
@@ -10,7 +10,7 @@
 .\" 2.  Redistributions in binary form must reproduce the above copyright
 .\"     notice, this list of conditions and the following disclaimer in the
 .\"     documentation and/or other materials provided with the distribution.
-.\" 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+.\" 3.  Neither the name of Apple Inc. ("Apple") nor the names of
 .\"     its contributors may be used to endorse or promote products derived
 .\"     from this software without specific prior written permission.
 .\"
@@ -26,7 +26,7 @@
 .\" IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 .\" POSSIBILITY OF SUCH DAMAGE.
 .\"
-.\" $P4: //depot/projects/trustedbsd/openbsm/man/audit_control.5#17 $
+.\" $P4: //depot/projects/trustedbsd/openbsm/man/audit_control.5#20 $
 .\"
 .Dd January 4, 2006
 .Dt AUDIT_CONTROL 5
@@ -57,13 +57,26 @@ Specifies which audit event classes are audited for all users.
 .Xr audit_user 5
 describes how to audit events for individual users.
 See the information below for the format of the audit flags.
+.It Va host
+Specify the hostname or IP address to be used when setting the local
+systems's audit host information.
+This hostname will be converted into an IP or IPv6 address and will
+be included in the header of each audit record.
+Due to the possibility of transient errors coupled with the
+security issues in the DNS protocol itself, the use of DNS
+should be avoided.
+Instead, it is strongly recommended that the hostname be
+specified in the /etc/hosts file.
+For more information see
+.Xr hosts 5 .
 .It Va naflags
 Contains the audit flags that define what classes of events are audited when
 an action cannot be attributed to a specific user.
 .It Va minfree
 The minimum free space required on the file system audit logs are being written to.
 When the free space falls below this limit a warning will be issued.
-Not currently used as the value of 20 percent is chosen by the kernel.
+If no value for the minimum free space is set, the default of 20 percent is
+applied by the kernel.
 .It Va policy
 A list of global audit policy flags specifying various behaviors, such as
 fail stop, auditing of paths and arguments, etc.
@@ -185,6 +198,7 @@ file size.
 .It Pa /etc/security/audit_control
 .El
 .Sh SEE ALSO
+.Xr auditon 2 ,
 .Xr audit 4 ,
 .Xr audit_class 5 ,
 .Xr audit_event 5 ,
diff --git a/contrib/openbsm/man/audit_event.5 b/contrib/openbsm/man/audit_event.5
index 75e67aa..184a82d 100644
--- a/contrib/openbsm/man/audit_event.5
+++ b/contrib/openbsm/man/audit_event.5
@@ -1,4 +1,4 @@
-.\" Copyright (c) 2004 Apple Computer, Inc.
+.\" Copyright (c) 2004 Apple Inc.
 .\" All rights reserved.
 .\"
 .\" Redistribution and use in source and binary forms, with or without
@@ -9,7 +9,7 @@
 .\" 2.  Redistributions in binary form must reproduce the above copyright
 .\"     notice, this list of conditions and the following disclaimer in the
 .\"     documentation and/or other materials provided with the distribution.
-.\" 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+.\" 3.  Neither the name of Apple Inc. ("Apple") nor the names of
 .\"     its contributors may be used to endorse or promote products derived
 .\"     from this software without specific prior written permission.
 .\"
@@ -25,7 +25,7 @@
 .\" IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 .\" POSSIBILITY OF SUCH DAMAGE.
 .\"
-.\" $P4: //depot/projects/trustedbsd/openbsm/man/audit_event.5#11 $
+.\" $P4: //depot/projects/trustedbsd/openbsm/man/audit_event.5#12 $
 .\"
 .Dd January 24, 2004
 .Dt AUDIT_EVENT 5
diff --git a/contrib/openbsm/man/audit_user.5 b/contrib/openbsm/man/audit_user.5
index 1779941..947f5c8 100644
--- a/contrib/openbsm/man/audit_user.5
+++ b/contrib/openbsm/man/audit_user.5
@@ -1,4 +1,4 @@
-.\" Copyright (c) 2004 Apple Computer, Inc.
+.\" Copyright (c) 2004 Apple Inc.
 .\" All rights reserved.
 .\"
 .\" Redistribution and use in source and binary forms, with or without
@@ -9,7 +9,7 @@
 .\" 2.  Redistributions in binary form must reproduce the above copyright
 .\"     notice, this list of conditions and the following disclaimer in the
 .\"     documentation and/or other materials provided with the distribution.
-.\" 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+.\" 3.  Neither the name of Apple Inc. ("Apple") nor the names of
 .\"     its contributors may be used to endorse or promote products derived
 .\"     from this software without specific prior written permission.
 .\"
@@ -25,7 +25,7 @@
 .\" IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 .\" POSSIBILITY OF SUCH DAMAGE.
 .\"
-.\" $P4: //depot/projects/trustedbsd/openbsm/man/audit_user.5#12 $
+.\" $P4: //depot/projects/trustedbsd/openbsm/man/audit_user.5#13 $
 .\"
 .Dd February 5, 2006
 .Dt AUDIT_USER 5
diff --git a/contrib/openbsm/man/audit_warn.5 b/contrib/openbsm/man/audit_warn.5
index d7b20b6..c53f163 100644
--- a/contrib/openbsm/man/audit_warn.5
+++ b/contrib/openbsm/man/audit_warn.5
@@ -1,4 +1,4 @@
-.\" Copyright (c) 2004 Apple Computer, Inc.
+.\" Copyright (c) 2004 Apple Inc.
 .\" All rights reserved.
 .\"
 .\" Redistribution and use in source and binary forms, with or without
@@ -9,7 +9,7 @@
 .\" 2.  Redistributions in binary form must reproduce the above copyright
 .\"     notice, this list of conditions and the following disclaimer in the
 .\"     documentation and/or other materials provided with the distribution.
-.\" 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+.\" 3.  Neither the name of Apple Inc. ("Apple") nor the names of
 .\"     its contributors may be used to endorse or promote products derived
 .\"     from this software without specific prior written permission.
 .\"
@@ -25,7 +25,7 @@
 .\" IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 .\" POSSIBILITY OF SUCH DAMAGE.
 .\"
-.\" $P4: //depot/projects/trustedbsd/openbsm/man/audit_warn.5#9 $
+.\" $P4: //depot/projects/trustedbsd/openbsm/man/audit_warn.5#10 $
 .\"
 .Dd March 17, 2004
 .Dt AUDIT_WARN 5
diff --git a/contrib/openbsm/man/auditctl.2 b/contrib/openbsm/man/auditctl.2
index ac3c41a..a5346fb 100644
--- a/contrib/openbsm/man/auditctl.2
+++ b/contrib/openbsm/man/auditctl.2
@@ -1,5 +1,6 @@
 .\"-
 .\" Copyright (c) 2005-2006 Robert N. M. Watson
+.\" Copyright (c) 2008 Apple Inc. 
 .\" All rights reserved.
 .\"
 .\" Redistribution and use in source and binary forms, with or without
@@ -23,7 +24,7 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\" $P4: //depot/projects/trustedbsd/openbsm/man/auditctl.2#7 $
+.\" $P4: //depot/projects/trustedbsd/openbsm/man/auditctl.2#9 $
 .\"
 .Dd April 19, 2005
 .Dt AUDITCTL 2
@@ -40,20 +41,25 @@ The
 .Fn auditctl
 system call directs the kernel to open a new audit trail log file.
 It requires an appropriate privilege.
-In the
-.Fx
-implementation,
+The
 .Fn auditctl
+system call
 opens new files, but
 .Xr auditon 2
 is used to disable the audit log.
-In the Mac OS X implementation, passing
-.Dv NULL
-to
-.Fn auditctl
-will disable the audit log.
 .Sh RETURN VALUES
 .Rv -std
+.Sh ERRORS
+The
+.Fn auditctl
+system call will fail if:
+.Bl -tag -width Er
+.It Bq Er EINVAL
+The path is invalid.
+.It Bq Er EPERM
+The process does not have sufficient permission to complete the
+operation.
+.El
 .Sh SEE ALSO
 .Xr auditon 2 ,
 .Xr libbsm 3 ,
diff --git a/contrib/openbsm/man/auditon.2 b/contrib/openbsm/man/auditon.2
index 953484c..e47bbb8 100644
--- a/contrib/openbsm/man/auditon.2
+++ b/contrib/openbsm/man/auditon.2
@@ -25,9 +25,9 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\" $P4: //depot/projects/trustedbsd/openbsm/man/auditon.2#11 $
+.\" $P4: //depot/projects/trustedbsd/openbsm/man/auditon.2#14 $
 .\"
-.Dd April 19, 2005
+.Dd July 10, 2008
 .Dt AUDITON 2
 .Os
 .Sh NAME
@@ -63,27 +63,38 @@ The
 argument
 must point to a
 .Vt long
-value set to one of the audit
-policy control values defined in
-.In bsm/audit.h .
-Currently, only
-.Dv AUDIT_CNT
+value set to one or more the following audit
+policy control values bitwise OR'ed together:
+.Dv AUDIT_CNT ,
+.Dv AUDIT_AHLT ,
+.Dv AUDIT_ARGV ,
 and
-.Dv AUDIT_AHLT
-are implemented.
-In the
-.Dv AUDIT_CNT
-case, the action will continue regardless if
-an event will not be audited.
-In the
-.Dv AUDIT_AHLT
-case, a
+.Dv AUDIT_ARGE .
+If
+.Dv AUDIT_CNT is set, the system will continue even if it becomes low
+on space and discontinue logging events until the low space condition is 
+remedied.
+If it is not set, audited events will block until the low space 
+condition is remedied.
+Unaudited events, however, are unaffected.
+If 
+.Dv AUDIT_AHLT is set, a 
 .Xr panic 9
-will result if an event will not be written to the
-audit log file.
+if it cannot write an event to the global audit log file.
+If 
+.Dv AUDIT_ARGV
+is set, then the argument list passed to the 
+.Xr execve 2 
+system call will be audited.  If
+.Dv AUDIT_ARGE
+is set, then the environment variables passed to the
+.Xr execve 2
+system call will be audited.  The default policy is none of the audit policy
+control flags set. 
 .It Dv A_SETKAUDIT
 Return
 .Er ENOSYS .
+(Not implemented.)
 .It Dv A_SETKMASK
 Set the kernel preselection masks (success and failure).
 The
@@ -91,8 +102,19 @@ The
 argument
 must point to a
 .Vt au_mask_t
-structure containing the mask values.
-These masks are used for non-attributable audit event preselection.
+structure containing the mask values as defined in 
+.In bsm/audit.h .
+These masks are used for non-attributable audit event preselection. 
+The field
+.Fa am_success
+specifies which classes of successful audit events are to be logged to the
+audit trail. The field
+.Fa am_failure
+specifies which classes of failed audit events are to be logged. The value of
+both fields is the bitwise OR'ing of the audit event classes specified in
+.Fa bsm/audit.h .
+The various audit classes are described more fully in
+.Xr audit_class 5 .
 .It Dv A_SETQCTRL
 Set kernel audit queue parameters.
 The
@@ -100,24 +122,51 @@ The
 argument
 must point to a
 .Vt au_qctrl_t
-structure containing the
-kernel audit queue control settings:
-.Dq "high water" ,
-.Dq "low water" ,
-.Dq "output buffer size" ,
-.Dq "percent min free disk space" ,
+structure (defined in
+.In bsm/audit.h )
+containing the kernel audit queue control settings:
+.Fa aq_hiwater ,
+.Fa aq_lowater ,
+.Fa aq_bufsz ,
+.Fa aq_delay ,
 and
-.Dq delay
-(not currently used).
+.Fa aq_minfree .
+The field
+.Fa aq_hiwater
+defines the maximum number of audit record entries in the queue used to store
+the audit records ready for delivery to disk.
+New records are inserted at the tail of the queue and removed from the head.
+For new records which would exceed the
+high water mark, the calling thread is inserted into the wait queue, waiting
+for the audit queue to have enough space available as defined with the field
+.Fa aq_lowater .
+The field
+.Fa aq_bufsz
+defines the maximum length of the audit record that can be supplied with
+.Xr audit 2 .
+The field
+.Fa aq_delay
+is unused.
+The field
+.Fa aq_minfree
+specifies the minimum amount of free blocks on the disk device used to store
+audit records.
+If the value of free blocks falls below the configured
+minimum amount, the kernel informs the audit daemon about low disk space.
+The value is to be specified in percent of free file system blocks.
+A value of 0 results in a disabling of the check.
 .It Dv A_SETSTAT
 Return
 .Er ENOSYS .
+(Not implemented.)
 .It Dv A_SETUMASK
 Return
 .Er ENOSYS .
+(Not implemented.)
 .It Dv A_SETSMASK
 Return
 .Er ENOSYS .
+(Not implemented.)
 .It Dv A_SETCOND
 Set the current auditing condition.
 The
@@ -131,6 +180,14 @@ audit condition, one of
 .Dv AUC_NOAUDIT ,
 or
 .Dv AUC_DISABLED .
+If 
+.Dv AUC_NOAUDIT 
+is set, then auditing is temporarily suspended. If 
+.Dv AUC_AUDITING
+is set, auditing is resumed. If 
+.Dv AUC_DISABLED 
+is set, the auditing system will
+shutdown, draining all audit records and closing out the audit trail file. 
 .It Dv A_SETCLASS
 Set the event class preselection mask for an audit event.
 The
@@ -139,6 +196,13 @@ argument
 must point to a
 .Vt au_evclass_map_t
 structure containing the audit event and mask.
+The field
+.Fa ec_number
+is the audit event and 
+.Fa ec_class
+is the audit class mask. See
+.Xr audit_event 5
+for more information on audit event to class mapping.
 .It Dv A_SETPMASK
 Set the preselection masks for a process.
 The
@@ -148,6 +212,16 @@ must point to a
 .Vt auditpinfo_t
 structure that contains the given process's audit
 preselection masks for both success and failure.
+The field
+.Fa ap_pid
+is the process id of the target process.
+The field
+.Fa ap_mask
+must point to a
+.Fa au_mask_t
+structure which holds the preselection masks as described in the
+.Da A_SETKMASK
+section above.
 .It Dv A_SETFSIZE
 Set the maximum size of the audit log file.
 The
@@ -163,6 +237,7 @@ indicates no limit to the size.
 .It Dv A_SETKAUDIT
 Return
 .Er ENOSYS .
+(Not implemented.)
 .It Dv A_GETCLASS
 Return the event to class mapping for the designated audit event.
 The
@@ -170,10 +245,13 @@ The
 argument
 must point to a
 .Vt au_evclass_map_t
-structure.
+structure. See the
+.Dv A_SETCLASS 
+section above for more information.
 .It Dv A_GETKAUDIT
 Return
 .Er ENOSYS .
+(Not implemented.)
 .It Dv A_GETPINFO
 Return the audit settings for a process.
 The
@@ -182,11 +260,47 @@ argument
 must point to a
 .Vt auditpinfo_t
 structure which will be set to contain
-the audit ID, preselection mask, terminal ID, and audit session
-ID of the given process.
+.Fa ap_auid 
+(the audit ID), 
+.Fa ap_mask
+(the preselection mask),
+.Fa ap_termid
+(the terminal ID), and
+.Fa ap_asid 
+(the audit session ID)
+of the given target process.
+The process ID of the target process is passed 
+into the kernel using the
+.Fa ap_pid
+field.
+See the section
+.Dv A_SETPMASK
+above and 
+.Xr getaudit 2 
+for more information.
 .It Dv A_GETPINFO_ADDR
-Return
-.Er ENOSYS .
+Return the extended audit settings for a process.
+The
+.Fa data
+argument
+must point to a
+.Vt auditpinfo_addr_t
+structure which is similar to the 
+.Vt auditpinfo_addr_t
+structure described above. 
+The exception is the 
+.Fa ap_termid
+(the terminal ID) field which points to a
+.Vt au_tid_addr_t 
+structure can hold much a larger terminal address and an address type. 
+The process ID of the target process is passed into the kernel using the
+.Fa ap_pid
+field.
+See the section 
+.Dv A_SETPMASK
+above and 
+.Xr getaudit 2
+for more information.
 .It Dv A_GETKMASK
 Return the current kernel preselection masks.
 The
@@ -205,11 +319,10 @@ must point to a
 .Vt long
 value which will be set to
 one of the current audit policy flags.
-Currently, only
-.Dv AUDIT_CNT
-and
-.Dv AUDIT_AHLT
-are implemented.
+The audit policy flags are
+described in the 
+.Dv A_SETPOLICY 
+section above.
 .It Dv A_GETQCTRL
 Return the current kernel audit queue control parameters.
 The
@@ -219,6 +332,9 @@ must point to a
 .Vt au_qctrl_t
 structure which will be set to the current
 kernel audit queue control parameters.
+See the
+.Dv A_SETQCTL
+section above for more information.
 .It Dv A_GETFSIZE
 Returns the maximum size of the audit log file.
 The
@@ -240,17 +356,20 @@ will be set to the current audit log file size.
 .\" Return the current working directory as stored in the audit subsystem.
 Return
 .Er ENOSYS .
+(Not implemented.)
 .It Dv A_GETCAR
 .\" [COMMENTED OUT]: Valid description, not yet implemented.
 .\"Stores and returns the current active root as stored in the audit
 .\"subsystem.
 Return
 .Er ENOSYS .
+(Not implemented.)
 .It Dv A_GETSTAT
 .\" [COMMENTED OUT]: Valid description, not yet implemented.
 .\"Return the statistics stored in the audit system.
 Return
 .Er ENOSYS .
+(Not implemented.)
 .It Dv A_GETCOND
 Return the current auditing condition.
 The
@@ -259,10 +378,14 @@ argument
 must point to a
 .Vt long
 value which will be set to
-the current audit condition, either
-.Dv AUC_AUDITING
+the current audit condition, one of 
+.Dv AUC_AUDITING ,
+.Dv AUC_NOAUDIT 
 or
-.Dv AUC_NOAUDIT .
+.Dv AUC_DISABLED .
+See the 
+.Dv A_SETCOND
+section above for more information.
 .It Dv A_SENDTRIGGER
 Send a trigger to the audit daemon.
 The
diff --git a/contrib/openbsm/man/getaudit.2 b/contrib/openbsm/man/getaudit.2
index 0592721..77a0f8e 100644
--- a/contrib/openbsm/man/getaudit.2
+++ b/contrib/openbsm/man/getaudit.2
@@ -1,5 +1,6 @@
 .\"-
 .\" Copyright (c) 2005 Robert N. M. Watson
+.\" Copyright (c) 2008 Apple Inc.
 .\" All rights reserved.
 .\"
 .\" Redistribution and use in source and binary forms, with or without
@@ -23,9 +24,9 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\" $P4: //depot/projects/trustedbsd/openbsm/man/getaudit.2#7 $
+.\" $P4: //depot/projects/trustedbsd/openbsm/man/getaudit.2#10 $
 .\"
-.Dd April 19, 2005
+.Dd October 19, 2008
 .Dt GETAUDIT 2
 .Os
 .Sh NAME
@@ -54,9 +55,111 @@ retrieves extended state via
 and
 .Fa length .
 .Pp
+The
+.Fa auditinfo_t
+data structure is defined as follows:
+.Bd -literal -offset indent
+struct auditinfo {
+	au_id_t        ai_auid;         /* Audit user ID */
+	au_mask_t      ai_mask;         /* Audit masks */
+	au_tid_t       ai_termid;       /* Terminal ID */
+	au_asid_t      ai_asid;         /* Audit session ID */
+};
+typedef struct auditinfo        auditinfo_t;
+.Ed
+.Pp
+The
+.Fa ai_auid
+variable contains the audit identifier which is recorded in the audit log for
+each event the process caused.
+.Pp
+The
+.Fa au_mask_t
+data structure defines the bit mask for auditing successful and failed events
+out of the predefined list of event classes.
+It is defined as follows:
+.Bd -literal -offset indent
+struct au_mask {
+	unsigned int    am_success;     /* success bits */
+	unsigned int    am_failure;     /* failure bits */
+};
+typedef struct au_mask  au_mask_t;
+.Ed
+.Pp
+The
+.Fa au_termid_t
+data structure defines the Terminal ID recorded with every event caused by the
+process.
+It is defined as follows:
+.Bd -literal -offset indent
+struct au_tid {
+	dev_t           port;
+	u_int32_t       machine;
+};
+typedef struct au_tid   au_tid_t;
+.Ed
+.Pp
+The
+.Fa ai_asid
+variable contains the audit session ID which is recorded with every event
+caused by the process.
+.Pp
+The
+.Fn getaudit_addr
+system call
+uses the expanded
+.Fa auditinfo_addr_t
+data structure and supports Terminal IDs with larger addresses
+such as those used in IP version 6.
+It is defined as follows:
+.Bd -literal -offset indent
+struct auditinfo_addr {
+	au_id_t         ai_auid;        /* Audit user ID. */
+	au_mask_t       ai_mask;        /* Audit masks. */
+	au_tid_addr_t   ai_termid;      /* Terminal ID. */
+	au_asid_t       ai_asid;        /* Audit session ID. */
+};
+typedef struct auditinfo_addr   auditinfo_addr_t;
+.Ed
+.Pp
+The
+.Fa au_tid_addr_t
+data structure which includes a larger address storage field and an additional
+field with the type of address stored:
+.Bd -literal -offset indent
+struct au_tid_addr {
+	dev_t           at_port;
+	u_int32_t       at_type;
+	u_int32_t       at_addr[4];
+};
+typedef struct au_tid_addr      au_tid_addr_t;
+.Ed
+.Pp
 These system calls require an appropriate privilege to complete.
 .Sh RETURN VALUES
 .Rv -std getaudit getaudit_addr
+.Sh ERRORS
+The
+.Fn getaudit
+function will fail if:
+.Bl -tag -width Er
+.It Bq Er EFAULT
+A failure occurred while data transferred to or from
+the kernel failed.
+.It Bq Er EINVAL
+Illegal argument was passed by a system call.
+.It Bq Er EPERM
+The process does not have sufficient permission to complete
+the operation.
+.It Bq Er EOVERFLOW
+The
+.Fa length
+argument indicates an overflow condition will occur.
+.It Bq Er E2BIG
+The address is too big and, therefore, 
+.Fn getaudit_addr
+should be used instead.
+.El
 .Sh SEE ALSO
 .Xr audit 2 ,
 .Xr auditon 2 ,
diff --git a/contrib/openbsm/man/getauid.2 b/contrib/openbsm/man/getauid.2
index 2624f1e..dc6ae0a 100644
--- a/contrib/openbsm/man/getauid.2
+++ b/contrib/openbsm/man/getauid.2
@@ -1,5 +1,6 @@
 .\"-
 .\" Copyright (c) 2005 Robert N. M. Watson
+.\" Copyright (c) 2008 Apple Inc.
 .\" All rights reserved.
 .\"
 .\" Redistribution and use in source and binary forms, with or without
@@ -23,7 +24,7 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\" $P4: //depot/projects/trustedbsd/openbsm/man/getauid.2#7 $
+.\" $P4: //depot/projects/trustedbsd/openbsm/man/getauid.2#9 $
 .\"
 .Dd April 19, 2005
 .Dt GETAUID 2
@@ -47,6 +48,18 @@ pointed to by
 This system call requires an appropriate privilege to complete.
 .Sh RETURN VALUES
 .Rv -std
+.Sh ERRORS
+The
+.Fn getauid
+function will fail if:
+.Bl -tag -width Er
+.It Bq Er EFAULT
+A failure occurred while data transferred from
+the kernel failed.
+.It Bq Er EPERM
+The process does not have sufficient permission to complete
+the operation.
+.El
 .Sh SEE ALSO
 .Xr audit 2 ,
 .Xr auditon 2 ,
diff --git a/contrib/openbsm/man/setaudit.2 b/contrib/openbsm/man/setaudit.2
index 22e2192..5426c87 100644
--- a/contrib/openbsm/man/setaudit.2
+++ b/contrib/openbsm/man/setaudit.2
@@ -1,5 +1,6 @@
 .\"-
 .\" Copyright (c) 2005 Robert N. M. Watson
+.\" Copyright (c) 2008 Apple Inc.
 .\" All rights reserved.
 .\"
 .\" Redistribution and use in source and binary forms, with or without
@@ -23,7 +24,7 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\" $P4: //depot/projects/trustedbsd/openbsm/man/setaudit.2#7 $
+.\" $P4: //depot/projects/trustedbsd/openbsm/man/setaudit.2#10 $
 .\"
 .Dd April 19, 2005
 .Dt SETAUDIT 2
@@ -54,9 +55,115 @@ sets extended state via
 and
 .Fa length .
 .Pp
+The
+.Fa auditinfo_t
+data structure is defined as follows:
+.nf
+.in +4n
+
+struct auditinfo {
+	au_id_t        ai_auid;         /* Audit user ID */
+	au_mask_t      ai_mask;         /* Audit masks */
+	au_tid_t       ai_termid;       /* Terminal ID */
+	au_asid_t      ai_asid;         /* Audit session ID */
+};
+typedef struct auditinfo        auditinfo_t;
+.in
+.fi
+.Pp
+The
+.Fa ai_auid
+variable contains the audit identifier which is recorded in the audit log for 
+each event the process caused.
+.PP
+
+The
+.Fa au_mask_t
+data structure defines the bit mask for auditing successful and failed events 
+out of the predefined list of event classes. It is defined as follows:
+.nf
+.in +4n
+
+struct au_mask {
+	unsigned int    am_success;     /* success bits */
+	unsigned int    am_failure;     /* failure bits */
+};
+typedef struct au_mask  au_mask_t;
+.in
+.fi
+.PP
+
+The
+.Fa au_termid_t
+data structure defines the Terminal ID recorded with every event caused by the 
+process. It is defined as follows:
+.nf
+.in +4n
+
+struct au_tid {
+	dev_t           port;
+	u_int32_t       machine;
+};
+typedef struct au_tid   au_tid_t;
+
+.in
+.fi
+.PP
+The
+.Fa ai_asid
+variable contains the audit session ID which is recorded with every event 
+caused by the process.
+.Pp
+The
+.Fn setaudit_addr
+system call
+uses the expanded
+.Fa auditinfo_addr_t 
+data structure supports Terminal IDs with larger addresses such as those used
+in IP version 6.  It is defined as follows:
+.nf
+.in +4n
+
+struct auditinfo_addr {
+	au_id_t         ai_auid;        /* Audit user ID. */
+	au_mask_t       ai_mask;        /* Audit masks. */
+	au_tid_addr_t   ai_termid;      /* Terminal ID. */
+	au_asid_t       ai_asid;        /* Audit session ID. */
+};
+typedef struct auditinfo_addr   auditinfo_addr_t;
+.in
+.fi
+.Pp
+The 
+.Fa au_tid_addr_t
+data structure which includes a larger address storage field and an additional 
+field with the type of address stored:
+.nf
+.in +4n
+
+struct au_tid_addr {
+	dev_t           at_port;
+	u_int32_t       at_type;
+	u_int32_t       at_addr[4];
+};
+typedef struct au_tid_addr      au_tid_addr_t;
+.in
+.fi
+.Pp
 These system calls require an appropriate privilege to complete.
 .Sh RETURN VALUES
 .Rv -std setaudit setaudit_addr
+.Sh ERRORS
+.Bl -tag -width Er
+.It Bq Er EFAULT
+A failure occurred while data transferred to or from
+the kernel failed.
+.It Bq Er EINVAL
+Illegal argument was passed by a system call.
+.It Bq Er EPERM
+The process does not have sufficient permission to complete
+the operation.
+.El
 .Sh SEE ALSO
 .Xr audit 2 ,
 .Xr auditon 2 ,
diff --git a/contrib/openbsm/man/setauid.2 b/contrib/openbsm/man/setauid.2
index a736a34..770c32b 100644
--- a/contrib/openbsm/man/setauid.2
+++ b/contrib/openbsm/man/setauid.2
@@ -1,5 +1,6 @@
 .\"-
 .\" Copyright (c) 2005 Robert N. M. Watson
+.\" Copyright (c) 2008 Apple Inc.
 .\" All rights reserved.
 .\"
 .\" Redistribution and use in source and binary forms, with or without
@@ -23,7 +24,7 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\" $P4: //depot/projects/trustedbsd/openbsm/man/setauid.2#7 $
+.\" $P4: //depot/projects/trustedbsd/openbsm/man/setauid.2#9 $
 .\"
 .Dd April 19, 2005
 .Dt SETAUID 2
@@ -47,6 +48,18 @@ pointed to by
 This system call requires an appropriate privilege to complete.
 .Sh RETURN VALUES
 .Rv -std
+.Sh ERRORS
+The
+.Fn setauid
+function will fail if:
+.Bl -tag -width Er
+.It Bq Er EFAULT
+A failure occurred while data transferred to
+the kernel failed.
+.It Bq Er EPERM
+The process does not have sufficient permission to complete
+the operation.
+.El
 .Sh SEE ALSO
 .Xr audit 2 ,
 .Xr auditon 2 ,
diff --git a/contrib/openbsm/modules/Makefile.in b/contrib/openbsm/modules/Makefile.in
index 3a3af9f..39b942a 100644
--- a/contrib/openbsm/modules/Makefile.in
+++ b/contrib/openbsm/modules/Makefile.in
@@ -15,7 +15,7 @@
 @SET_MAKE@
 
 #
-# $P4: //depot/projects/trustedbsd/openbsm/modules/Makefile.in#2 $
+# $P4: //depot/projects/trustedbsd/openbsm/modules/Makefile.in#5 $
 #
 VPATH = @srcdir@
 pkgdatadir = $(datadir)/@PACKAGE@
@@ -100,6 +100,7 @@ LN_S = @LN_S@
 LTLIBOBJS = @LTLIBOBJS@
 MAINT = @MAINT@
 MAKEINFO = @MAKEINFO@
+MIG = @MIG@
 MKDIR_P = @MKDIR_P@
 OBJEXT = @OBJEXT@
 PACKAGE = @PACKAGE@
diff --git a/contrib/openbsm/modules/auditfilter_noop/Makefile.am b/contrib/openbsm/modules/auditfilter_noop/Makefile.am
index e4b7a5a..1d0775b 100644
--- a/contrib/openbsm/modules/auditfilter_noop/Makefile.am
+++ b/contrib/openbsm/modules/auditfilter_noop/Makefile.am
@@ -1,8 +1,12 @@
 #
-# $P4: //depot/projects/trustedbsd/openbsm/modules/auditfilter_noop/Makefile.am#1 $
+# $P4: //depot/projects/trustedbsd/openbsm/modules/auditfilter_noop/Makefile.am#3 $
 #
 
-INCLUDES = -I$(top_srcdir)
+if USE_NATIVE_INCLUDES
+INCLUDES = -I$(top_builddir) -I$(top_srcdir)
+else
+INCLUDES = -I$(top_builddir) -I$(top_srcdir) -I$(top_srcdir)/sys
+endif
 
 lib_LTLIBRARIES = auditfilter_noop.la
 
diff --git a/contrib/openbsm/modules/auditfilter_noop/Makefile.in b/contrib/openbsm/modules/auditfilter_noop/Makefile.in
index d654236..6d39c48 100644
--- a/contrib/openbsm/modules/auditfilter_noop/Makefile.in
+++ b/contrib/openbsm/modules/auditfilter_noop/Makefile.in
@@ -15,7 +15,7 @@
 @SET_MAKE@
 
 #
-# $P4: //depot/projects/trustedbsd/openbsm/modules/auditfilter_noop/Makefile.in#2 $
+# $P4: //depot/projects/trustedbsd/openbsm/modules/auditfilter_noop/Makefile.in#6 $
 #
 
 VPATH = @srcdir@
@@ -118,6 +118,7 @@ LN_S = @LN_S@
 LTLIBOBJS = @LTLIBOBJS@
 MAINT = @MAINT@
 MAKEINFO = @MAKEINFO@
+MIG = @MIG@
 MKDIR_P = @MKDIR_P@
 OBJEXT = @OBJEXT@
 PACKAGE = @PACKAGE@
@@ -184,7 +185,8 @@ sysconfdir = @sysconfdir@
 target_alias = @target_alias@
 top_builddir = @top_builddir@
 top_srcdir = @top_srcdir@
-INCLUDES = -I$(top_srcdir)
+@USE_NATIVE_INCLUDES_FALSE@INCLUDES = -I$(top_builddir) -I$(top_srcdir) -I$(top_srcdir)/sys
+@USE_NATIVE_INCLUDES_TRUE@INCLUDES = -I$(top_builddir) -I$(top_srcdir)
 lib_LTLIBRARIES = auditfilter_noop.la
 auditfilter_noop_la_SOURCE = auditfilter_noop.c
 auditfilter_noop_la_LDFLAGS = -module
diff --git a/contrib/openbsm/modules/auditfilter_noop/auditfilter_noop.c b/contrib/openbsm/modules/auditfilter_noop/auditfilter_noop.c
index 1db9856..79834d4 100644
--- a/contrib/openbsm/modules/auditfilter_noop/auditfilter_noop.c
+++ b/contrib/openbsm/modules/auditfilter_noop/auditfilter_noop.c
@@ -25,7 +25,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $P4: //depot/projects/trustedbsd/openbsm/modules/auditfilter_noop/auditfilter_noop.c#4 $
+ * $P4: //depot/projects/trustedbsd/openbsm/modules/auditfilter_noop/auditfilter_noop.c#6 $
  */
 
 /*
@@ -38,36 +38,42 @@
 #include <bsm/libbsm.h>
 #include <bsm/audit_filter.h>
 
+#ifndef __unused
+#define __unused
+#endif
+
 int
-AUDIT_FILTER_ATTACH(void *instance, int argc, char *argv[])
+AUDIT_FILTER_ATTACH(void *instance __unused, int argc __unused, 
+    char *argv[] __unused)
 {
 
 	return (0);
 }
 
 int
-AUDIT_FILTER_REINIT(void *instance, int argc, char *argv[])
+AUDIT_FILTER_REINIT(void *instance __unused, int argc __unused, 
+    char *argv[] __unused)
 {
 
 	return (0);
 }
 
 void
-AUDIT_FILTER_RECORD(void *instance, struct timespec *ts, int token_count,
-    const tokenstr_t *tok[])
+AUDIT_FILTER_RECORD(void *instance __unused, struct timespec *ts __unused,
+    int token_count __unused, const tokenstr_t *tok[] __unused)
 {
 
 }
 
 void
-AUDIT_FILTER_RAWRECORD(void *instance, struct timespec *ts, u_char *data,
-    u_int len)
+AUDIT_FILTER_RAWRECORD(void *instance __unused, struct timespec *ts __unused,
+    u_char *data __unused, u_int len __unused)
 {
 
 }
 
 void
-AUDIT_FILTER_DETACH(void *instance)
+AUDIT_FILTER_DETACH(void *instance __unused)
 {
 
 }
diff --git a/contrib/openbsm/sys/Makefile.am b/contrib/openbsm/sys/Makefile.am
new file mode 100644
index 0000000..ed94c4e
--- /dev/null
+++ b/contrib/openbsm/sys/Makefile.am
@@ -0,0 +1,7 @@
+#
+# $P4: //depot/projects/trustedbsd/openbsm/sys/Makefile.am#1 $
+#
+
+SUBDIRS =		\
+	bsm
+
diff --git a/contrib/openbsm/sys/Makefile.in b/contrib/openbsm/sys/Makefile.in
new file mode 100644
index 0000000..7c090bd
--- /dev/null
+++ b/contrib/openbsm/sys/Makefile.in
@@ -0,0 +1,488 @@
+# Makefile.in generated by automake 1.10 from Makefile.am.
+# @configure_input@
+
+# Copyright (C) 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002,
+# 2003, 2004, 2005, 2006  Free Software Foundation, Inc.
+# This Makefile.in is free software; the Free Software Foundation
+# gives unlimited permission to copy and/or distribute it,
+# with or without modifications, as long as this notice is preserved.
+
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY, to the extent permitted by law; without
+# even the implied warranty of MERCHANTABILITY or FITNESS FOR A
+# PARTICULAR PURPOSE.
+
+@SET_MAKE@
+
+#
+# $P4: //depot/projects/trustedbsd/openbsm/sys/Makefile.in#2 $
+#
+VPATH = @srcdir@
+pkgdatadir = $(datadir)/@PACKAGE@
+pkglibdir = $(libdir)/@PACKAGE@
+pkgincludedir = $(includedir)/@PACKAGE@
+am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd
+install_sh_DATA = $(install_sh) -c -m 644
+install_sh_PROGRAM = $(install_sh) -c
+install_sh_SCRIPT = $(install_sh) -c
+INSTALL_HEADER = $(INSTALL_DATA)
+transform = $(program_transform_name)
+NORMAL_INSTALL = :
+PRE_INSTALL = :
+POST_INSTALL = :
+NORMAL_UNINSTALL = :
+PRE_UNINSTALL = :
+POST_UNINSTALL = :
+build_triplet = @build@
+host_triplet = @host@
+subdir = sys
+DIST_COMMON = $(srcdir)/Makefile.am $(srcdir)/Makefile.in
+ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
+am__aclocal_m4_deps = $(top_srcdir)/configure.ac
+am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
+	$(ACLOCAL_M4)
+mkinstalldirs = $(install_sh) -d
+CONFIG_HEADER = $(top_builddir)/config/config.h
+CONFIG_CLEAN_FILES =
+SOURCES =
+DIST_SOURCES =
+RECURSIVE_TARGETS = all-recursive check-recursive dvi-recursive \
+	html-recursive info-recursive install-data-recursive \
+	install-dvi-recursive install-exec-recursive \
+	install-html-recursive install-info-recursive \
+	install-pdf-recursive install-ps-recursive install-recursive \
+	installcheck-recursive installdirs-recursive pdf-recursive \
+	ps-recursive uninstall-recursive
+RECURSIVE_CLEAN_TARGETS = mostlyclean-recursive clean-recursive	\
+  distclean-recursive maintainer-clean-recursive
+ETAGS = etags
+CTAGS = ctags
+DIST_SUBDIRS = $(SUBDIRS)
+DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
+ACLOCAL = @ACLOCAL@
+AMTAR = @AMTAR@
+AR = @AR@
+AUTOCONF = @AUTOCONF@
+AUTOHEADER = @AUTOHEADER@
+AUTOMAKE = @AUTOMAKE@
+AWK = @AWK@
+CC = @CC@
+CCDEPMODE = @CCDEPMODE@
+CFLAGS = @CFLAGS@
+CPP = @CPP@
+CPPFLAGS = @CPPFLAGS@
+CXX = @CXX@
+CXXCPP = @CXXCPP@
+CXXDEPMODE = @CXXDEPMODE@
+CXXFLAGS = @CXXFLAGS@
+CYGPATH_W = @CYGPATH_W@
+DEFS = @DEFS@
+DEPDIR = @DEPDIR@
+ECHO = @ECHO@
+ECHO_C = @ECHO_C@
+ECHO_N = @ECHO_N@
+ECHO_T = @ECHO_T@
+EGREP = @EGREP@
+EXEEXT = @EXEEXT@
+F77 = @F77@
+FFLAGS = @FFLAGS@
+GREP = @GREP@
+INSTALL = @INSTALL@
+INSTALL_DATA = @INSTALL_DATA@
+INSTALL_PROGRAM = @INSTALL_PROGRAM@
+INSTALL_SCRIPT = @INSTALL_SCRIPT@
+INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
+LDFLAGS = @LDFLAGS@
+LIBOBJS = @LIBOBJS@
+LIBS = @LIBS@
+LIBTOOL = @LIBTOOL@
+LN_S = @LN_S@
+LTLIBOBJS = @LTLIBOBJS@
+MAINT = @MAINT@
+MAKEINFO = @MAKEINFO@
+MIG = @MIG@
+MKDIR_P = @MKDIR_P@
+OBJEXT = @OBJEXT@
+PACKAGE = @PACKAGE@
+PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@
+PACKAGE_NAME = @PACKAGE_NAME@
+PACKAGE_STRING = @PACKAGE_STRING@
+PACKAGE_TARNAME = @PACKAGE_TARNAME@
+PACKAGE_VERSION = @PACKAGE_VERSION@
+PATH_SEPARATOR = @PATH_SEPARATOR@
+RANLIB = @RANLIB@
+SED = @SED@
+SET_MAKE = @SET_MAKE@
+SHELL = @SHELL@
+STRIP = @STRIP@
+VERSION = @VERSION@
+abs_builddir = @abs_builddir@
+abs_srcdir = @abs_srcdir@
+abs_top_builddir = @abs_top_builddir@
+abs_top_srcdir = @abs_top_srcdir@
+ac_ct_CC = @ac_ct_CC@
+ac_ct_CXX = @ac_ct_CXX@
+ac_ct_F77 = @ac_ct_F77@
+am__include = @am__include@
+am__leading_dot = @am__leading_dot@
+am__quote = @am__quote@
+am__tar = @am__tar@
+am__untar = @am__untar@
+bindir = @bindir@
+build = @build@
+build_alias = @build_alias@
+build_cpu = @build_cpu@
+build_os = @build_os@
+build_vendor = @build_vendor@
+builddir = @builddir@
+datadir = @datadir@
+datarootdir = @datarootdir@
+docdir = @docdir@
+dvidir = @dvidir@
+exec_prefix = @exec_prefix@
+host = @host@
+host_alias = @host_alias@
+host_cpu = @host_cpu@
+host_os = @host_os@
+host_vendor = @host_vendor@
+htmldir = @htmldir@
+includedir = @includedir@
+infodir = @infodir@
+install_sh = @install_sh@
+libdir = @libdir@
+libexecdir = @libexecdir@
+localedir = @localedir@
+localstatedir = @localstatedir@
+mandir = @mandir@
+mkdir_p = @mkdir_p@
+oldincludedir = @oldincludedir@
+pdfdir = @pdfdir@
+prefix = @prefix@
+program_transform_name = @program_transform_name@
+psdir = @psdir@
+sbindir = @sbindir@
+sharedstatedir = @sharedstatedir@
+srcdir = @srcdir@
+sysconfdir = @sysconfdir@
+target_alias = @target_alias@
+top_builddir = @top_builddir@
+top_srcdir = @top_srcdir@
+SUBDIRS = \
+	bsm
+
+all: all-recursive
+
+.SUFFIXES:
+$(srcdir)/Makefile.in: @MAINTAINER_MODE_TRUE@ $(srcdir)/Makefile.am  $(am__configure_deps)
+	@for dep in $?; do \
+	  case '$(am__configure_deps)' in \
+	    *$$dep*) \
+	      cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh \
+		&& exit 0; \
+	      exit 1;; \
+	  esac; \
+	done; \
+	echo ' cd $(top_srcdir) && $(AUTOMAKE) --foreign  sys/Makefile'; \
+	cd $(top_srcdir) && \
+	  $(AUTOMAKE) --foreign  sys/Makefile
+.PRECIOUS: Makefile
+Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
+	@case '$?' in \
+	  *config.status*) \
+	    cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \
+	  *) \
+	    echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \
+	    cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \
+	esac;
+
+$(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES)
+	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+
+$(top_srcdir)/configure: @MAINTAINER_MODE_TRUE@ $(am__configure_deps)
+	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+$(ACLOCAL_M4): @MAINTAINER_MODE_TRUE@ $(am__aclocal_m4_deps)
+	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+
+mostlyclean-libtool:
+	-rm -f *.lo
+
+clean-libtool:
+	-rm -rf .libs _libs
+
+# This directory's subdirectories are mostly independent; you can cd
+# into them and run `make' without going through this Makefile.
+# To change the values of `make' variables: instead of editing Makefiles,
+# (1) if the variable is set in `config.status', edit `config.status'
+#     (which will cause the Makefiles to be regenerated when you run `make');
+# (2) otherwise, pass the desired values on the `make' command line.
+$(RECURSIVE_TARGETS):
+	@failcom='exit 1'; \
+	for f in x $$MAKEFLAGS; do \
+	  case $$f in \
+	    *=* | --[!k]*);; \
+	    *k*) failcom='fail=yes';; \
+	  esac; \
+	done; \
+	dot_seen=no; \
+	target=`echo $@ | sed s/-recursive//`; \
+	list='$(SUBDIRS)'; for subdir in $$list; do \
+	  echo "Making $$target in $$subdir"; \
+	  if test "$$subdir" = "."; then \
+	    dot_seen=yes; \
+	    local_target="$$target-am"; \
+	  else \
+	    local_target="$$target"; \
+	  fi; \
+	  (cd $$subdir && $(MAKE) $(AM_MAKEFLAGS) $$local_target) \
+	  || eval $$failcom; \
+	done; \
+	if test "$$dot_seen" = "no"; then \
+	  $(MAKE) $(AM_MAKEFLAGS) "$$target-am" || exit 1; \
+	fi; test -z "$$fail"
+
+$(RECURSIVE_CLEAN_TARGETS):
+	@failcom='exit 1'; \
+	for f in x $$MAKEFLAGS; do \
+	  case $$f in \
+	    *=* | --[!k]*);; \
+	    *k*) failcom='fail=yes';; \
+	  esac; \
+	done; \
+	dot_seen=no; \
+	case "$@" in \
+	  distclean-* | maintainer-clean-*) list='$(DIST_SUBDIRS)' ;; \
+	  *) list='$(SUBDIRS)' ;; \
+	esac; \
+	rev=''; for subdir in $$list; do \
+	  if test "$$subdir" = "."; then :; else \
+	    rev="$$subdir $$rev"; \
+	  fi; \
+	done; \
+	rev="$$rev ."; \
+	target=`echo $@ | sed s/-recursive//`; \
+	for subdir in $$rev; do \
+	  echo "Making $$target in $$subdir"; \
+	  if test "$$subdir" = "."; then \
+	    local_target="$$target-am"; \
+	  else \
+	    local_target="$$target"; \
+	  fi; \
+	  (cd $$subdir && $(MAKE) $(AM_MAKEFLAGS) $$local_target) \
+	  || eval $$failcom; \
+	done && test -z "$$fail"
+tags-recursive:
+	list='$(SUBDIRS)'; for subdir in $$list; do \
+	  test "$$subdir" = . || (cd $$subdir && $(MAKE) $(AM_MAKEFLAGS) tags); \
+	done
+ctags-recursive:
+	list='$(SUBDIRS)'; for subdir in $$list; do \
+	  test "$$subdir" = . || (cd $$subdir && $(MAKE) $(AM_MAKEFLAGS) ctags); \
+	done
+
+ID: $(HEADERS) $(SOURCES) $(LISP) $(TAGS_FILES)
+	list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
+	unique=`for i in $$list; do \
+	    if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
+	  done | \
+	  $(AWK) '    { files[$$0] = 1; } \
+	       END { for (i in files) print i; }'`; \
+	mkid -fID $$unique
+tags: TAGS
+
+TAGS: tags-recursive $(HEADERS) $(SOURCES)  $(TAGS_DEPENDENCIES) \
+		$(TAGS_FILES) $(LISP)
+	tags=; \
+	here=`pwd`; \
+	if ($(ETAGS) --etags-include --version) >/dev/null 2>&1; then \
+	  include_option=--etags-include; \
+	  empty_fix=.; \
+	else \
+	  include_option=--include; \
+	  empty_fix=; \
+	fi; \
+	list='$(SUBDIRS)'; for subdir in $$list; do \
+	  if test "$$subdir" = .; then :; else \
+	    test ! -f $$subdir/TAGS || \
+	      tags="$$tags $$include_option=$$here/$$subdir/TAGS"; \
+	  fi; \
+	done; \
+	list='$(SOURCES) $(HEADERS)  $(LISP) $(TAGS_FILES)'; \
+	unique=`for i in $$list; do \
+	    if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
+	  done | \
+	  $(AWK) '    { files[$$0] = 1; } \
+	       END { for (i in files) print i; }'`; \
+	if test -z "$(ETAGS_ARGS)$$tags$$unique"; then :; else \
+	  test -n "$$unique" || unique=$$empty_fix; \
+	  $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+	    $$tags $$unique; \
+	fi
+ctags: CTAGS
+CTAGS: ctags-recursive $(HEADERS) $(SOURCES)  $(TAGS_DEPENDENCIES) \
+		$(TAGS_FILES) $(LISP)
+	tags=; \
+	here=`pwd`; \
+	list='$(SOURCES) $(HEADERS)  $(LISP) $(TAGS_FILES)'; \
+	unique=`for i in $$list; do \
+	    if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
+	  done | \
+	  $(AWK) '    { files[$$0] = 1; } \
+	       END { for (i in files) print i; }'`; \
+	test -z "$(CTAGS_ARGS)$$tags$$unique" \
+	  || $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \
+	     $$tags $$unique
+
+GTAGS:
+	here=`$(am__cd) $(top_builddir) && pwd` \
+	  && cd $(top_srcdir) \
+	  && gtags -i $(GTAGS_ARGS) $$here
+
+distclean-tags:
+	-rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags
+
+distdir: $(DISTFILES)
+	@srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
+	topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
+	list='$(DISTFILES)'; \
+	  dist_files=`for file in $$list; do echo $$file; done | \
+	  sed -e "s|^$$srcdirstrip/||;t" \
+	      -e "s|^$$topsrcdirstrip/|$(top_builddir)/|;t"`; \
+	case $$dist_files in \
+	  */*) $(MKDIR_P) `echo "$$dist_files" | \
+			   sed '/\//!d;s|^|$(distdir)/|;s,/[^/]*$$,,' | \
+			   sort -u` ;; \
+	esac; \
+	for file in $$dist_files; do \
+	  if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \
+	  if test -d $$d/$$file; then \
+	    dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \
+	    if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \
+	      cp -pR $(srcdir)/$$file $(distdir)$$dir || exit 1; \
+	    fi; \
+	    cp -pR $$d/$$file $(distdir)$$dir || exit 1; \
+	  else \
+	    test -f $(distdir)/$$file \
+	    || cp -p $$d/$$file $(distdir)/$$file \
+	    || exit 1; \
+	  fi; \
+	done
+	list='$(DIST_SUBDIRS)'; for subdir in $$list; do \
+	  if test "$$subdir" = .; then :; else \
+	    test -d "$(distdir)/$$subdir" \
+	    || $(MKDIR_P) "$(distdir)/$$subdir" \
+	    || exit 1; \
+	    distdir=`$(am__cd) $(distdir) && pwd`; \
+	    top_distdir=`$(am__cd) $(top_distdir) && pwd`; \
+	    (cd $$subdir && \
+	      $(MAKE) $(AM_MAKEFLAGS) \
+	        top_distdir="$$top_distdir" \
+	        distdir="$$distdir/$$subdir" \
+		am__remove_distdir=: \
+		am__skip_length_check=: \
+	        distdir) \
+	      || exit 1; \
+	  fi; \
+	done
+check-am: all-am
+check: check-recursive
+all-am: Makefile
+installdirs: installdirs-recursive
+installdirs-am:
+install: install-recursive
+install-exec: install-exec-recursive
+install-data: install-data-recursive
+uninstall: uninstall-recursive
+
+install-am: all-am
+	@$(MAKE) $(AM_MAKEFLAGS) install-exec-am install-data-am
+
+installcheck: installcheck-recursive
+install-strip:
+	$(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \
+	  install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \
+	  `test -z '$(STRIP)' || \
+	    echo "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'"` install
+mostlyclean-generic:
+
+clean-generic:
+
+distclean-generic:
+	-test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
+
+maintainer-clean-generic:
+	@echo "This command is intended for maintainers to use"
+	@echo "it deletes files that may require special tools to rebuild."
+clean: clean-recursive
+
+clean-am: clean-generic clean-libtool mostlyclean-am
+
+distclean: distclean-recursive
+	-rm -f Makefile
+distclean-am: clean-am distclean-generic distclean-tags
+
+dvi: dvi-recursive
+
+dvi-am:
+
+html: html-recursive
+
+info: info-recursive
+
+info-am:
+
+install-data-am:
+
+install-dvi: install-dvi-recursive
+
+install-exec-am:
+
+install-html: install-html-recursive
+
+install-info: install-info-recursive
+
+install-man:
+
+install-pdf: install-pdf-recursive
+
+install-ps: install-ps-recursive
+
+installcheck-am:
+
+maintainer-clean: maintainer-clean-recursive
+	-rm -f Makefile
+maintainer-clean-am: distclean-am maintainer-clean-generic
+
+mostlyclean: mostlyclean-recursive
+
+mostlyclean-am: mostlyclean-generic mostlyclean-libtool
+
+pdf: pdf-recursive
+
+pdf-am:
+
+ps: ps-recursive
+
+ps-am:
+
+uninstall-am:
+
+.MAKE: $(RECURSIVE_CLEAN_TARGETS) $(RECURSIVE_TARGETS) install-am \
+	install-strip
+
+.PHONY: $(RECURSIVE_CLEAN_TARGETS) $(RECURSIVE_TARGETS) CTAGS GTAGS \
+	all all-am check check-am clean clean-generic clean-libtool \
+	ctags ctags-recursive distclean distclean-generic \
+	distclean-libtool distclean-tags distdir dvi dvi-am html \
+	html-am info info-am install install-am install-data \
+	install-data-am install-dvi install-dvi-am install-exec \
+	install-exec-am install-html install-html-am install-info \
+	install-info-am install-man install-pdf install-pdf-am \
+	install-ps install-ps-am install-strip installcheck \
+	installcheck-am installdirs installdirs-am maintainer-clean \
+	maintainer-clean-generic mostlyclean mostlyclean-generic \
+	mostlyclean-libtool pdf pdf-am ps ps-am tags tags-recursive \
+	uninstall uninstall-am
+
+# Tell versions [3.59,3.63) of GNU make to not export all variables.
+# Otherwise a system limit (for SysV at least) may be exceeded.
+.NOEXPORT:
diff --git a/contrib/openbsm/sys/bsm/Makefile.am b/contrib/openbsm/sys/bsm/Makefile.am
new file mode 100644
index 0000000..b3c7805
--- /dev/null
+++ b/contrib/openbsm/sys/bsm/Makefile.am
@@ -0,0 +1,14 @@
+#
+# $P4: //depot/projects/trustedbsd/openbsm/sys/bsm/Makefile.am#1 $
+#
+
+
+if ! USE_NATIVE_INCLUDES 
+openbsmdir = $(includedir)/bsm
+
+openbsm_HEADERS =		\
+	audit.h			\
+	audit_internal.h	\
+	audit_kevents.h		\
+	audit_record.h
+endif
diff --git a/contrib/openbsm/sys/bsm/Makefile.in b/contrib/openbsm/sys/bsm/Makefile.in
new file mode 100644
index 0000000..34cb9e6
--- /dev/null
+++ b/contrib/openbsm/sys/bsm/Makefile.in
@@ -0,0 +1,412 @@
+# Makefile.in generated by automake 1.10 from Makefile.am.
+# @configure_input@
+
+# Copyright (C) 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002,
+# 2003, 2004, 2005, 2006  Free Software Foundation, Inc.
+# This Makefile.in is free software; the Free Software Foundation
+# gives unlimited permission to copy and/or distribute it,
+# with or without modifications, as long as this notice is preserved.
+
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY, to the extent permitted by law; without
+# even the implied warranty of MERCHANTABILITY or FITNESS FOR A
+# PARTICULAR PURPOSE.
+
+@SET_MAKE@
+
+#
+# $P4: //depot/projects/trustedbsd/openbsm/sys/bsm/Makefile.in#2 $
+#
+
+VPATH = @srcdir@
+pkgdatadir = $(datadir)/@PACKAGE@
+pkglibdir = $(libdir)/@PACKAGE@
+pkgincludedir = $(includedir)/@PACKAGE@
+am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd
+install_sh_DATA = $(install_sh) -c -m 644
+install_sh_PROGRAM = $(install_sh) -c
+install_sh_SCRIPT = $(install_sh) -c
+INSTALL_HEADER = $(INSTALL_DATA)
+transform = $(program_transform_name)
+NORMAL_INSTALL = :
+PRE_INSTALL = :
+POST_INSTALL = :
+NORMAL_UNINSTALL = :
+PRE_UNINSTALL = :
+POST_UNINSTALL = :
+build_triplet = @build@
+host_triplet = @host@
+subdir = sys/bsm
+DIST_COMMON = $(am__openbsm_HEADERS_DIST) $(srcdir)/Makefile.am \
+	$(srcdir)/Makefile.in
+ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
+am__aclocal_m4_deps = $(top_srcdir)/configure.ac
+am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
+	$(ACLOCAL_M4)
+mkinstalldirs = $(install_sh) -d
+CONFIG_HEADER = $(top_builddir)/config/config.h
+CONFIG_CLEAN_FILES =
+SOURCES =
+DIST_SOURCES =
+am__openbsm_HEADERS_DIST = audit.h audit_internal.h audit_kevents.h \
+	audit_record.h
+am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`;
+am__vpath_adj = case $$p in \
+    $(srcdir)/*) f=`echo "$$p" | sed "s|^$$srcdirstrip/||"`;; \
+    *) f=$$p;; \
+  esac;
+am__strip_dir = `echo $$p | sed -e 's|^.*/||'`;
+am__installdirs = "$(DESTDIR)$(openbsmdir)"
+openbsmHEADERS_INSTALL = $(INSTALL_HEADER)
+HEADERS = $(openbsm_HEADERS)
+ETAGS = etags
+CTAGS = ctags
+DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
+ACLOCAL = @ACLOCAL@
+AMTAR = @AMTAR@
+AR = @AR@
+AUTOCONF = @AUTOCONF@
+AUTOHEADER = @AUTOHEADER@
+AUTOMAKE = @AUTOMAKE@
+AWK = @AWK@
+CC = @CC@
+CCDEPMODE = @CCDEPMODE@
+CFLAGS = @CFLAGS@
+CPP = @CPP@
+CPPFLAGS = @CPPFLAGS@
+CXX = @CXX@
+CXXCPP = @CXXCPP@
+CXXDEPMODE = @CXXDEPMODE@
+CXXFLAGS = @CXXFLAGS@
+CYGPATH_W = @CYGPATH_W@
+DEFS = @DEFS@
+DEPDIR = @DEPDIR@
+ECHO = @ECHO@
+ECHO_C = @ECHO_C@
+ECHO_N = @ECHO_N@
+ECHO_T = @ECHO_T@
+EGREP = @EGREP@
+EXEEXT = @EXEEXT@
+F77 = @F77@
+FFLAGS = @FFLAGS@
+GREP = @GREP@
+INSTALL = @INSTALL@
+INSTALL_DATA = @INSTALL_DATA@
+INSTALL_PROGRAM = @INSTALL_PROGRAM@
+INSTALL_SCRIPT = @INSTALL_SCRIPT@
+INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
+LDFLAGS = @LDFLAGS@
+LIBOBJS = @LIBOBJS@
+LIBS = @LIBS@
+LIBTOOL = @LIBTOOL@
+LN_S = @LN_S@
+LTLIBOBJS = @LTLIBOBJS@
+MAINT = @MAINT@
+MAKEINFO = @MAKEINFO@
+MIG = @MIG@
+MKDIR_P = @MKDIR_P@
+OBJEXT = @OBJEXT@
+PACKAGE = @PACKAGE@
+PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@
+PACKAGE_NAME = @PACKAGE_NAME@
+PACKAGE_STRING = @PACKAGE_STRING@
+PACKAGE_TARNAME = @PACKAGE_TARNAME@
+PACKAGE_VERSION = @PACKAGE_VERSION@
+PATH_SEPARATOR = @PATH_SEPARATOR@
+RANLIB = @RANLIB@
+SED = @SED@
+SET_MAKE = @SET_MAKE@
+SHELL = @SHELL@
+STRIP = @STRIP@
+VERSION = @VERSION@
+abs_builddir = @abs_builddir@
+abs_srcdir = @abs_srcdir@
+abs_top_builddir = @abs_top_builddir@
+abs_top_srcdir = @abs_top_srcdir@
+ac_ct_CC = @ac_ct_CC@
+ac_ct_CXX = @ac_ct_CXX@
+ac_ct_F77 = @ac_ct_F77@
+am__include = @am__include@
+am__leading_dot = @am__leading_dot@
+am__quote = @am__quote@
+am__tar = @am__tar@
+am__untar = @am__untar@
+bindir = @bindir@
+build = @build@
+build_alias = @build_alias@
+build_cpu = @build_cpu@
+build_os = @build_os@
+build_vendor = @build_vendor@
+builddir = @builddir@
+datadir = @datadir@
+datarootdir = @datarootdir@
+docdir = @docdir@
+dvidir = @dvidir@
+exec_prefix = @exec_prefix@
+host = @host@
+host_alias = @host_alias@
+host_cpu = @host_cpu@
+host_os = @host_os@
+host_vendor = @host_vendor@
+htmldir = @htmldir@
+includedir = @includedir@
+infodir = @infodir@
+install_sh = @install_sh@
+libdir = @libdir@
+libexecdir = @libexecdir@
+localedir = @localedir@
+localstatedir = @localstatedir@
+mandir = @mandir@
+mkdir_p = @mkdir_p@
+oldincludedir = @oldincludedir@
+pdfdir = @pdfdir@
+prefix = @prefix@
+program_transform_name = @program_transform_name@
+psdir = @psdir@
+sbindir = @sbindir@
+sharedstatedir = @sharedstatedir@
+srcdir = @srcdir@
+sysconfdir = @sysconfdir@
+target_alias = @target_alias@
+top_builddir = @top_builddir@
+top_srcdir = @top_srcdir@
+@USE_NATIVE_INCLUDES_FALSE@openbsmdir = $(includedir)/bsm
+@USE_NATIVE_INCLUDES_FALSE@openbsm_HEADERS = \
+@USE_NATIVE_INCLUDES_FALSE@	audit.h			\
+@USE_NATIVE_INCLUDES_FALSE@	audit_internal.h	\
+@USE_NATIVE_INCLUDES_FALSE@	audit_kevents.h		\
+@USE_NATIVE_INCLUDES_FALSE@	audit_record.h
+
+all: all-am
+
+.SUFFIXES:
+$(srcdir)/Makefile.in: @MAINTAINER_MODE_TRUE@ $(srcdir)/Makefile.am  $(am__configure_deps)
+	@for dep in $?; do \
+	  case '$(am__configure_deps)' in \
+	    *$$dep*) \
+	      cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh \
+		&& exit 0; \
+	      exit 1;; \
+	  esac; \
+	done; \
+	echo ' cd $(top_srcdir) && $(AUTOMAKE) --foreign  sys/bsm/Makefile'; \
+	cd $(top_srcdir) && \
+	  $(AUTOMAKE) --foreign  sys/bsm/Makefile
+.PRECIOUS: Makefile
+Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
+	@case '$?' in \
+	  *config.status*) \
+	    cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \
+	  *) \
+	    echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \
+	    cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \
+	esac;
+
+$(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES)
+	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+
+$(top_srcdir)/configure: @MAINTAINER_MODE_TRUE@ $(am__configure_deps)
+	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+$(ACLOCAL_M4): @MAINTAINER_MODE_TRUE@ $(am__aclocal_m4_deps)
+	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+
+mostlyclean-libtool:
+	-rm -f *.lo
+
+clean-libtool:
+	-rm -rf .libs _libs
+install-openbsmHEADERS: $(openbsm_HEADERS)
+	@$(NORMAL_INSTALL)
+	test -z "$(openbsmdir)" || $(MKDIR_P) "$(DESTDIR)$(openbsmdir)"
+	@list='$(openbsm_HEADERS)'; for p in $$list; do \
+	  if test -f "$$p"; then d=; else d="$(srcdir)/"; fi; \
+	  f=$(am__strip_dir) \
+	  echo " $(openbsmHEADERS_INSTALL) '$$d$$p' '$(DESTDIR)$(openbsmdir)/$$f'"; \
+	  $(openbsmHEADERS_INSTALL) "$$d$$p" "$(DESTDIR)$(openbsmdir)/$$f"; \
+	done
+
+uninstall-openbsmHEADERS:
+	@$(NORMAL_UNINSTALL)
+	@list='$(openbsm_HEADERS)'; for p in $$list; do \
+	  f=$(am__strip_dir) \
+	  echo " rm -f '$(DESTDIR)$(openbsmdir)/$$f'"; \
+	  rm -f "$(DESTDIR)$(openbsmdir)/$$f"; \
+	done
+
+ID: $(HEADERS) $(SOURCES) $(LISP) $(TAGS_FILES)
+	list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
+	unique=`for i in $$list; do \
+	    if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
+	  done | \
+	  $(AWK) '    { files[$$0] = 1; } \
+	       END { for (i in files) print i; }'`; \
+	mkid -fID $$unique
+tags: TAGS
+
+TAGS:  $(HEADERS) $(SOURCES)  $(TAGS_DEPENDENCIES) \
+		$(TAGS_FILES) $(LISP)
+	tags=; \
+	here=`pwd`; \
+	list='$(SOURCES) $(HEADERS)  $(LISP) $(TAGS_FILES)'; \
+	unique=`for i in $$list; do \
+	    if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
+	  done | \
+	  $(AWK) '    { files[$$0] = 1; } \
+	       END { for (i in files) print i; }'`; \
+	if test -z "$(ETAGS_ARGS)$$tags$$unique"; then :; else \
+	  test -n "$$unique" || unique=$$empty_fix; \
+	  $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+	    $$tags $$unique; \
+	fi
+ctags: CTAGS
+CTAGS:  $(HEADERS) $(SOURCES)  $(TAGS_DEPENDENCIES) \
+		$(TAGS_FILES) $(LISP)
+	tags=; \
+	here=`pwd`; \
+	list='$(SOURCES) $(HEADERS)  $(LISP) $(TAGS_FILES)'; \
+	unique=`for i in $$list; do \
+	    if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
+	  done | \
+	  $(AWK) '    { files[$$0] = 1; } \
+	       END { for (i in files) print i; }'`; \
+	test -z "$(CTAGS_ARGS)$$tags$$unique" \
+	  || $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \
+	     $$tags $$unique
+
+GTAGS:
+	here=`$(am__cd) $(top_builddir) && pwd` \
+	  && cd $(top_srcdir) \
+	  && gtags -i $(GTAGS_ARGS) $$here
+
+distclean-tags:
+	-rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags
+
+distdir: $(DISTFILES)
+	@srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
+	topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
+	list='$(DISTFILES)'; \
+	  dist_files=`for file in $$list; do echo $$file; done | \
+	  sed -e "s|^$$srcdirstrip/||;t" \
+	      -e "s|^$$topsrcdirstrip/|$(top_builddir)/|;t"`; \
+	case $$dist_files in \
+	  */*) $(MKDIR_P) `echo "$$dist_files" | \
+			   sed '/\//!d;s|^|$(distdir)/|;s,/[^/]*$$,,' | \
+			   sort -u` ;; \
+	esac; \
+	for file in $$dist_files; do \
+	  if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \
+	  if test -d $$d/$$file; then \
+	    dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \
+	    if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \
+	      cp -pR $(srcdir)/$$file $(distdir)$$dir || exit 1; \
+	    fi; \
+	    cp -pR $$d/$$file $(distdir)$$dir || exit 1; \
+	  else \
+	    test -f $(distdir)/$$file \
+	    || cp -p $$d/$$file $(distdir)/$$file \
+	    || exit 1; \
+	  fi; \
+	done
+check-am: all-am
+check: check-am
+all-am: Makefile $(HEADERS)
+installdirs:
+	for dir in "$(DESTDIR)$(openbsmdir)"; do \
+	  test -z "$$dir" || $(MKDIR_P) "$$dir"; \
+	done
+install: install-am
+install-exec: install-exec-am
+install-data: install-data-am
+uninstall: uninstall-am
+
+install-am: all-am
+	@$(MAKE) $(AM_MAKEFLAGS) install-exec-am install-data-am
+
+installcheck: installcheck-am
+install-strip:
+	$(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \
+	  install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \
+	  `test -z '$(STRIP)' || \
+	    echo "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'"` install
+mostlyclean-generic:
+
+clean-generic:
+
+distclean-generic:
+	-test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
+
+maintainer-clean-generic:
+	@echo "This command is intended for maintainers to use"
+	@echo "it deletes files that may require special tools to rebuild."
+clean: clean-am
+
+clean-am: clean-generic clean-libtool mostlyclean-am
+
+distclean: distclean-am
+	-rm -f Makefile
+distclean-am: clean-am distclean-generic distclean-tags
+
+dvi: dvi-am
+
+dvi-am:
+
+html: html-am
+
+info: info-am
+
+info-am:
+
+install-data-am: install-openbsmHEADERS
+
+install-dvi: install-dvi-am
+
+install-exec-am:
+
+install-html: install-html-am
+
+install-info: install-info-am
+
+install-man:
+
+install-pdf: install-pdf-am
+
+install-ps: install-ps-am
+
+installcheck-am:
+
+maintainer-clean: maintainer-clean-am
+	-rm -f Makefile
+maintainer-clean-am: distclean-am maintainer-clean-generic
+
+mostlyclean: mostlyclean-am
+
+mostlyclean-am: mostlyclean-generic mostlyclean-libtool
+
+pdf: pdf-am
+
+pdf-am:
+
+ps: ps-am
+
+ps-am:
+
+uninstall-am: uninstall-openbsmHEADERS
+
+.MAKE: install-am install-strip
+
+.PHONY: CTAGS GTAGS all all-am check check-am clean clean-generic \
+	clean-libtool ctags distclean distclean-generic \
+	distclean-libtool distclean-tags distdir dvi dvi-am html \
+	html-am info info-am install install-am install-data \
+	install-data-am install-dvi install-dvi-am install-exec \
+	install-exec-am install-html install-html-am install-info \
+	install-info-am install-man install-openbsmHEADERS install-pdf \
+	install-pdf-am install-ps install-ps-am install-strip \
+	installcheck installcheck-am installdirs maintainer-clean \
+	maintainer-clean-generic mostlyclean mostlyclean-generic \
+	mostlyclean-libtool pdf pdf-am ps ps-am tags uninstall \
+	uninstall-am uninstall-openbsmHEADERS
+
+# Tell versions [3.59,3.63) of GNU make to not export all variables.
+# Otherwise a system limit (for SysV at least) may be exceeded.
+.NOEXPORT:
diff --git a/contrib/openbsm/sys/bsm/audit.h b/contrib/openbsm/sys/bsm/audit.h
new file mode 100644
index 0000000..ebb84da
--- /dev/null
+++ b/contrib/openbsm/sys/bsm/audit.h
@@ -0,0 +1,280 @@
+/*-
+ * Copyright (c) 2005 Apple Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * $P4: //depot/projects/trustedbsd/openbsm/sys/bsm/audit.h#1 $
+ */
+
+#ifndef _BSM_AUDIT_H
+#define	_BSM_AUDIT_H
+
+#define	AUDIT_RECORD_MAGIC	0x828a0f1b
+#define	MAX_AUDIT_RECORDS	20
+#define	MAXAUDITDATA		(0x8000 - 1)
+#define	MAX_AUDIT_RECORD_SIZE	MAXAUDITDATA
+#define	MIN_AUDIT_FILE_SIZE	(512 * 1024)
+
+/*
+ * Triggers for the audit daemon.
+ */
+#define	AUDIT_TRIGGER_MIN		1
+#define	AUDIT_TRIGGER_LOW_SPACE		1	/* Below low watermark. */
+#define	AUDIT_TRIGGER_ROTATE_KERNEL	2	/* Kernel requests rotate. */
+#define	AUDIT_TRIGGER_READ_FILE		3	/* Re-read config file. */
+#define	AUDIT_TRIGGER_CLOSE_AND_DIE	4	/* Terminate audit. */
+#define	AUDIT_TRIGGER_NO_SPACE		5	/* Below min free space. */
+#define	AUDIT_TRIGGER_ROTATE_USER	6	/* User requests roate. */
+#define	AUDIT_TRIGGER_MAX		6
+
+/*
+ * The special device filename (FreeBSD).
+ */
+#define	AUDITDEV_FILENAME	"audit"
+#define	AUDIT_TRIGGER_FILE	("/dev/" AUDITDEV_FILENAME)
+
+/*
+ * Pre-defined audit IDs
+ */
+#define	AU_DEFAUDITID	-1
+
+/*
+ * IPC types.
+ */
+#define	AT_IPC_MSG	((u_char)1)	/* Message IPC id. */
+#define	AT_IPC_SEM	((u_char)2)	/* Semaphore IPC id. */
+#define	AT_IPC_SHM	((u_char)3)	/* Shared mem IPC id. */
+
+/*
+ * Audit conditions.
+ */
+#define	AUC_UNSET		0
+#define	AUC_AUDITING		1
+#define	AUC_NOAUDIT		2
+#define	AUC_DISABLED		-1
+
+/*
+ * auditon(2) commands.
+ */
+#define	A_GETPOLICY	2
+#define	A_SETPOLICY	3
+#define	A_GETKMASK	4
+#define	A_SETKMASK	5
+#define	A_GETQCTRL	6
+#define	A_SETQCTRL	7
+#define	A_GETCWD	8
+#define	A_GETCAR	9
+#define	A_GETSTAT	12
+#define	A_SETSTAT	13
+#define	A_SETUMASK	14
+#define	A_SETSMASK	15
+#define	A_GETCOND	20
+#define	A_SETCOND	21
+#define	A_GETCLASS	22
+#define	A_SETCLASS	23
+#define	A_GETPINFO	24
+#define	A_SETPMASK	25
+#define	A_SETFSIZE	26
+#define	A_GETFSIZE	27
+#define	A_GETPINFO_ADDR	28
+#define	A_GETKAUDIT	29
+#define	A_SETKAUDIT	30
+#define	A_SENDTRIGGER	31
+
+/*
+ * Audit policy controls.
+ */
+#define	AUDIT_CNT	0x0001
+#define	AUDIT_AHLT	0x0002
+#define	AUDIT_ARGV	0x0004
+#define	AUDIT_ARGE	0x0008
+#define	AUDIT_SEQ	0x0010
+#define	AUDIT_WINDATA	0x0020
+#define	AUDIT_USER	0x0040
+#define	AUDIT_GROUP	0x0080
+#define	AUDIT_TRAIL	0x0100
+#define	AUDIT_PATH	0x0200
+#define	AUDIT_SCNT	0x0400
+#define	AUDIT_PUBLIC	0x0800
+#define	AUDIT_ZONENAME	0x1000
+#define	AUDIT_PERZONE	0x2000
+
+/*
+ * Default audit queue control parameters.
+ */
+#define	AQ_HIWATER	100
+#define	AQ_MAXHIGH	10000
+#define	AQ_LOWATER	10
+#define	AQ_BUFSZ	MAXAUDITDATA
+#define	AQ_MAXBUFSZ	1048576
+
+/*
+ * Default minimum percentage free space on file system.
+ */
+#define	AU_FS_MINFREE	20
+
+/*
+ * Type definitions used indicating the length of variable length addresses
+ * in tokens containing addresses, such as header fields.
+ */
+#define	AU_IPv4		4
+#define	AU_IPv6		16
+
+__BEGIN_DECLS
+
+typedef	uid_t		au_id_t;
+typedef	pid_t		au_asid_t;
+typedef	u_int16_t	au_event_t;
+typedef	u_int16_t	au_emod_t;
+typedef	u_int32_t	au_class_t;
+
+struct au_tid {
+	dev_t		port;
+	u_int32_t	machine;
+};
+typedef	struct au_tid	au_tid_t;
+
+struct au_tid_addr {
+	dev_t		at_port;
+	u_int32_t	at_type;
+	u_int32_t	at_addr[4];
+};
+typedef	struct au_tid_addr	au_tid_addr_t;
+
+struct au_mask {
+	unsigned int    am_success;     /* Success bits. */
+	unsigned int    am_failure;     /* Failure bits. */
+};
+typedef	struct au_mask	au_mask_t;
+
+struct auditinfo {
+	au_id_t		ai_auid;	/* Audit user ID. */
+	au_mask_t	ai_mask;	/* Audit masks. */
+	au_tid_t	ai_termid;	/* Terminal ID. */
+	au_asid_t	ai_asid;	/* Audit session ID. */
+};
+typedef	struct auditinfo	auditinfo_t;
+
+struct auditinfo_addr {
+	au_id_t		ai_auid;	/* Audit user ID. */
+	au_mask_t	ai_mask;	/* Audit masks. */
+	au_tid_addr_t	ai_termid;	/* Terminal ID. */
+	au_asid_t	ai_asid;	/* Audit session ID. */
+};
+typedef	struct auditinfo_addr	auditinfo_addr_t;
+
+struct auditpinfo {
+	pid_t		ap_pid;		/* ID of target process. */
+	au_id_t		ap_auid;	/* Audit user ID. */
+	au_mask_t	ap_mask;	/* Audit masks. */
+	au_tid_t	ap_termid;	/* Terminal ID. */
+	au_asid_t	ap_asid;	/* Audit session ID. */
+};
+typedef	struct auditpinfo	auditpinfo_t;
+
+struct auditpinfo_addr {
+	pid_t		ap_pid;		/* ID of target process. */
+	au_id_t		ap_auid;	/* Audit user ID. */
+	au_mask_t	ap_mask;	/* Audit masks. */
+	au_tid_addr_t	ap_termid;	/* Terminal ID. */
+	au_asid_t	ap_asid;	/* Audit session ID. */
+};
+typedef	struct auditpinfo_addr	auditpinfo_addr_t;
+
+/*
+ * Contents of token_t are opaque outside of libbsm.
+ */
+typedef	struct au_token	token_t;
+
+/*
+ * Kernel audit queue control parameters.
+ */
+struct au_qctrl {
+	size_t	aq_hiwater;
+	size_t	aq_lowater;
+	size_t	aq_bufsz;
+	clock_t	aq_delay;
+	int	aq_minfree;	/* Minimum filesystem percent free space. */
+};
+typedef	struct au_qctrl	au_qctrl_t;
+
+/*
+ * Structure for the audit statistics.
+ */
+struct audit_stat {
+	unsigned int	as_version;
+	unsigned int	as_numevent;
+	int		as_generated;
+	int		as_nonattrib;
+	int		as_kernel;
+	int		as_audit;
+	int		as_auditctl;
+	int		as_enqueue;
+	int		as_written;
+	int		as_wblocked;
+	int		as_rblocked;
+	int		as_dropped;
+	int		as_totalsize;
+	unsigned int	as_memused;
+};
+typedef	struct audit_stat	au_stat_t;
+
+/*
+ * Structure for the audit file statistics.
+ */
+struct audit_fstat {
+	u_quad_t	af_filesz;
+	u_quad_t	af_currsz;
+};
+typedef	struct audit_fstat	au_fstat_t;
+
+/*
+ * Audit to event class mapping.
+ */
+struct au_evclass_map {
+	au_event_t	ec_number;
+	au_class_t	ec_class;
+};
+typedef	struct au_evclass_map	au_evclass_map_t;
+
+/*
+ * Audit system calls.
+ */
+#if !defined(_KERNEL) && !defined(KERNEL)
+int	audit(const void *, int);
+int	auditon(int, void *, int);
+int	auditctl(const char *);
+int	getauid(au_id_t *);
+int	setauid(const au_id_t *);
+int	getaudit(struct auditinfo *);
+int	setaudit(const struct auditinfo *);
+int	getaudit_addr(struct auditinfo_addr *, int);
+int	setaudit_addr(const struct auditinfo_addr *, int);
+#endif /* defined(_KERNEL) || defined(KERNEL) */
+
+__END_DECLS
+
+#endif /* !_BSM_AUDIT_H */
diff --git a/contrib/openbsm/sys/bsm/audit_internal.h b/contrib/openbsm/sys/bsm/audit_internal.h
new file mode 100644
index 0000000..d3482b3
--- /dev/null
+++ b/contrib/openbsm/sys/bsm/audit_internal.h
@@ -0,0 +1,117 @@
+/*-
+ * Copyright (c) 2005 Apple Inc.
+ * Copyright (c) 2005 SPARTA, Inc.
+ * All rights reserved.
+ *
+ * This code was developed in part by Robert N. M. Watson, Senior Principal
+ * Scientist, SPARTA, Inc.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * $P4: //depot/projects/trustedbsd/openbsm/sys/bsm/audit_internal.h#2 $
+ */
+
+#ifndef _AUDIT_INTERNAL_H
+#define	_AUDIT_INTERNAL_H
+
+#if defined(__linux__) && !defined(__unused)
+#define	__unused
+#endif
+
+/*
+ * audit_internal.h contains private interfaces that are shared by user space
+ * and the kernel for the purposes of assembling audit records.  Applications
+ * should not include this file or use the APIs found within, or it may be
+ * broken with future releases of OpenBSM, which may delete, modify, or
+ * otherwise break these interfaces or the assumptions they rely on.
+ */
+struct au_token {
+	u_char			*t_data;
+	size_t			 len;
+	TAILQ_ENTRY(au_token)	 tokens;
+};
+
+struct au_record {
+	char			 used;		/* Record currently in use? */
+	int			 desc;		/* Descriptor for record. */
+	TAILQ_HEAD(, au_token)	 token_q;	/* Queue of BSM tokens. */
+	u_char			*data;
+	size_t			 len;
+	LIST_ENTRY(au_record)	 au_rec_q;
+};
+typedef	struct au_record	au_record_t;
+
+
+/*
+ * We could determined the header and trailer sizes by defining appropriate
+ * structures.  We hold off that approach until we have a consistent way of
+ * using structures for all tokens.  This is not straightforward since these
+ * token structures may contain pointers of whose contents we do not know the
+ * size (e.g text tokens).
+ */
+#define	AUDIT_HEADER_EX_SIZE(a)	((a)->ai_termid.at_type+18+sizeof(u_int32_t))
+#define	AUDIT_HEADER_SIZE	18
+#define	MAX_AUDIT_HEADER_SIZE	(5*sizeof(u_int32_t)+18)
+#define	AUDIT_TRAILER_SIZE	7
+
+/*
+ * BSM token streams store fields in big endian byte order, so as to be
+ * portable; when encoding and decoding, we must convert byte orders for
+ * typed values.
+ */
+#define	ADD_U_CHAR(loc, val)						\
+	do {								\
+		*(loc) = (val);						\
+		(loc) += sizeof(u_char);				\
+	} while(0)
+
+
+#define	ADD_U_INT16(loc, val)						\
+	do {								\
+		be16enc((loc), (val));					\
+		(loc) += sizeof(u_int16_t);				\
+	} while(0)
+
+#define	ADD_U_INT32(loc, val)						\
+	do {								\
+		be32enc((loc), (val));					\
+		(loc) += sizeof(u_int32_t);				\
+	} while(0)
+
+#define	ADD_U_INT64(loc, val)						\
+	do {								\
+		be64enc((loc), (val));					\
+		(loc) += sizeof(u_int64_t); 				\
+	} while(0)
+
+#define	ADD_MEM(loc, data, size)					\
+	do {								\
+		memcpy((loc), (data), (size));				\
+		(loc) += size;						\
+	} while(0)
+
+#define	ADD_STRING(loc, data, size)	ADD_MEM(loc, data, size)
+
+#endif /* !_AUDIT_INTERNAL_H_ */
diff --git a/contrib/openbsm/sys/bsm/audit_kevents.h b/contrib/openbsm/sys/bsm/audit_kevents.h
new file mode 100644
index 0000000..34cf545
--- /dev/null
+++ b/contrib/openbsm/sys/bsm/audit_kevents.h
@@ -0,0 +1,720 @@
+/*-
+ * Copyright (c) 2005 Apple Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * $P4: //depot/projects/trustedbsd/openbsm/sys/bsm/audit_kevents.h#3 $
+ */
+
+#ifndef _BSM_AUDIT_KEVENTS_H_
+#define	_BSM_AUDIT_KEVENTS_H_
+
+/*
+ * Values marked as AUE_NULL are not required to be audited as per CAPP.
+ *
+ * Some conflicts exist in the assignment of name to event number mappings
+ * between BSM implementations.  In general, we prefer the OpenSolaris
+ * definition as we consider Solaris BSM to be authoritative.  _DARWIN_ has
+ * been inserted for the Darwin variants.  If necessary, other tags will be
+ * added in the future.
+ */
+#define	AUE_NULL		0
+#define	AUE_EXIT		1
+#define	AUE_FORK		2
+#define	AUE_FORKALL		AUE_FORK	/* Solaris-specific. */
+#define	AUE_OPEN		3
+#define	AUE_CREAT		4
+#define	AUE_LINK		5
+#define	AUE_UNLINK		6
+#define	AUE_DELETE		AUE_UNLINK	/* Darwin-specific. */
+#define	AUE_EXEC		7
+#define	AUE_CHDIR		8
+#define	AUE_MKNOD		9
+#define	AUE_CHMOD		10
+#define	AUE_CHOWN		11
+#define	AUE_UMOUNT		12
+#define	AUE_JUNK		13	/* Solaris-specific. */
+#define	AUE_ACCESS		14
+#define	AUE_CHECKUSERACCESS	AUE_ACCESS	/* Darwin-specific. */
+#define	AUE_KILL		15
+#define	AUE_STAT		16
+#define	AUE_LSTAT		17
+#define	AUE_ACCT		18
+#define	AUE_MCTL		19	/* Solaris-specific. */
+#define	AUE_REBOOT		20	/* XXX: Darwin conflict. */
+#define	AUE_SYMLINK		21
+#define	AUE_READLINK		22
+#define	AUE_EXECVE		23
+#define	AUE_CHROOT		24
+#define	AUE_VFORK		25
+#define	AUE_SETGROUPS		26
+#define	AUE_SETPGRP		27
+#define	AUE_SWAPON		28
+#define	AUE_SETHOSTNAME		29	/* XXX: Darwin conflict. */
+#define	AUE_FCNTL		30
+#define	AUE_SETPRIORITY		31	/* XXX: Darwin conflict. */
+#define	AUE_CONNECT		32
+#define	AUE_ACCEPT		33
+#define	AUE_BIND		34
+#define	AUE_SETSOCKOPT		35
+#define	AUE_VTRACE		36	/* Solaris-specific. */
+#define	AUE_SETTIMEOFDAY	37	/* XXX: Darwin conflict. */
+#define	AUE_FCHOWN		38
+#define	AUE_FCHMOD		39
+#define	AUE_SETREUID		40
+#define	AUE_SETREGID		41
+#define	AUE_RENAME		42
+#define	AUE_TRUNCATE		43	/* XXX: Darwin conflict. */
+#define	AUE_FTRUNCATE		44	/* XXX: Darwin conflict. */
+#define	AUE_FLOCK		45	/* XXX: Darwin conflict. */
+#define	AUE_SHUTDOWN		46
+#define	AUE_MKDIR		47
+#define	AUE_RMDIR		48
+#define	AUE_UTIMES		49
+#define	AUE_ADJTIME		50
+#define	AUE_SETRLIMIT		51
+#define	AUE_KILLPG		52
+#define	AUE_NFS_SVC		53	/* XXX: Darwin conflict. */
+#define	AUE_STATFS		54
+#define	AUE_FSTATFS		55
+#define	AUE_UNMOUNT		56	/* XXX: Darwin conflict. */
+#define	AUE_ASYNC_DAEMON	57
+#define	AUE_NFS_GETFH		58	/* XXX: Darwin conflict. */
+#define	AUE_SETDOMAINNAME	59
+#define	AUE_QUOTACTL		60	/* XXX: Darwin conflict. */
+#define	AUE_EXPORTFS		61
+#define	AUE_MOUNT		62
+#define	AUE_SEMSYS		63
+#define	AUE_MSGSYS		64
+#define	AUE_SHMSYS		65
+#define	AUE_BSMSYS		66	/* Solaris-specific. */
+#define	AUE_RFSSYS		67	/* Solaris-specific. */
+#define	AUE_FCHDIR		68
+#define	AUE_FCHROOT		69
+#define	AUE_VPIXSYS		70	/* Solaris-specific. */
+#define	AUE_PATHCONF		71
+#define	AUE_OPEN_R		72
+#define	AUE_OPEN_RC		73
+#define	AUE_OPEN_RT		74
+#define	AUE_OPEN_RTC		75
+#define	AUE_OPEN_W		76
+#define	AUE_OPEN_WC		77
+#define	AUE_OPEN_WT		78
+#define	AUE_OPEN_WTC		79
+#define	AUE_OPEN_RW		80
+#define	AUE_OPEN_RWC		81
+#define	AUE_OPEN_RWT		82
+#define	AUE_OPEN_RWTC		83
+#define	AUE_MSGCTL		84
+#define	AUE_MSGCTL_RMID		85
+#define	AUE_MSGCTL_SET		86
+#define	AUE_MSGCTL_STAT		87
+#define	AUE_MSGGET		88
+#define	AUE_MSGRCV		89
+#define	AUE_MSGSND		90
+#define	AUE_SHMCTL		91
+#define	AUE_SHMCTL_RMID		92
+#define	AUE_SHMCTL_SET		93
+#define	AUE_SHMCTL_STAT		94
+#define	AUE_SHMGET		95
+#define	AUE_SHMAT		96
+#define	AUE_SHMDT		97
+#define	AUE_SEMCTL		98
+#define	AUE_SEMCTL_RMID		99
+#define	AUE_SEMCTL_SET		100
+#define	AUE_SEMCTL_STAT		101
+#define	AUE_SEMCTL_GETNCNT	102
+#define	AUE_SEMCTL_GETPID	103
+#define	AUE_SEMCTL_GETVAL	104
+#define	AUE_SEMCTL_GETALL	105
+#define	AUE_SEMCTL_GETZCNT	106
+#define	AUE_SEMCTL_SETVAL	107
+#define	AUE_SEMCTL_SETALL	108
+#define	AUE_SEMGET		109
+#define	AUE_SEMOP		110
+#define	AUE_CORE		111	/* Solaris-specific, currently. */
+#define	AUE_CLOSE		112
+#define	AUE_SYSTEMBOOT		113	/* Solaris-specific. */
+#define	AUE_ASYNC_DAEMON_EXIT	114	/* Solaris-specific. */
+#define	AUE_NFSSVC_EXIT		115	/* Solaris-specific. */
+#define	AUE_WRITEL		128	/* Solaris-specific. */
+#define	AUE_WRITEVL		129	/* Solaris-specific. */
+#define	AUE_GETAUID		130
+#define	AUE_SETAUID		131
+#define	AUE_GETAUDIT		132
+#define	AUE_SETAUDIT		133
+#define	AUE_GETUSERAUDIT	134	/* Solaris-specific. */
+#define	AUE_SETUSERAUDIT	135	/* Solaris-specific. */
+#define	AUE_AUDITSVC		136	/* Solaris-specific. */
+#define	AUE_AUDITUSER		137	/* Solaris-specific. */
+#define	AUE_AUDITON		138
+#define	AUE_AUDITON_GTERMID	139	/* Solaris-specific. */
+#define	AUE_AUDITON_STERMID	140	/* Solaris-specific. */
+#define	AUE_AUDITON_GPOLICY	141
+#define	AUE_AUDITON_SPOLICY	142
+#define	AUE_AUDITON_GQCTRL	145
+#define	AUE_AUDITON_SQCTRL	146
+#define	AUE_GETKERNSTATE	147	/* Solaris-specific. */
+#define	AUE_SETKERNSTATE	148	/* Solaris-specific. */
+#define	AUE_GETPORTAUDIT	149	/* Solaris-specific. */
+#define	AUE_AUDITSTAT		150	/* Solaris-specific. */
+#define	AUE_REVOKE		151
+#define	AUE_MAC			152	/* Solaris-specific. */
+#define	AUE_ENTERPROM		153	/* Solaris-specific. */
+#define	AUE_EXITPROM		154	/* Solaris-specific. */
+#define	AUE_IFLOAT		155	/* Solaris-specific. */
+#define	AUE_PFLOAT		156	/* Solaris-specific. */
+#define	AUE_UPRIV		157	/* Solaris-specific. */
+#define	AUE_IOCTL		158
+#define	AUE_SOCKET		183
+#define	AUE_SENDTO		184
+#define	AUE_PIPE		185
+#define	AUE_SOCKETPAIR		186	/* XXX: Darwin conflict. */
+#define	AUE_SEND		187
+#define	AUE_SENDMSG		188
+#define	AUE_RECV		189
+#define	AUE_RECVMSG		190
+#define	AUE_RECVFROM		191
+#define	AUE_READ		192
+#define	AUE_GETDENTS		193
+#define	AUE_LSEEK		194
+#define	AUE_WRITE		195
+#define	AUE_WRITEV		196
+#define	AUE_NFS			197	/* Solaris-specific. */
+#define	AUE_READV		198
+#define	AUE_OSTAT		199	/* Solaris-specific. */
+#define	AUE_SETUID		200	/* XXXRW: Solaris old setuid? */
+#define	AUE_STIME		201	/* XXXRW: Solaris old stime? */
+#define	AUE_UTIME		202	/* XXXRW: Solaris old utime? */
+#define	AUE_NICE		203	/* XXXRW: Solaris old nice? */
+#define	AUE_OSETPGRP		204	/* Solaris-specific. */
+#define	AUE_SETGID		205
+#define	AUE_READL		206	/* Solaris-specific. */
+#define	AUE_READVL		207	/* Solaris-specific. */
+#define	AUE_FSTAT		208
+#define	AUE_DUP2		209
+#define	AUE_MMAP		210
+#define	AUE_AUDIT		211
+#define	AUE_PRIOCNTLSYS		212	/* Solaris-specific. */
+#define	AUE_MUNMAP		213
+#define	AUE_SETEGID		214
+#define	AUE_SETEUID		215
+#define	AUE_PUTMSG		216	/* Solaris-specific. */
+#define	AUE_GETMSG		217	/* Solaris-specific. */
+#define	AUE_PUTPMSG		218	/* Solaris-specific. */
+#define	AUE_GETPMSG		219	/* Solaris-specific. */
+#define	AUE_AUDITSYS		220	/* Solaris-specific. */
+#define	AUE_AUDITON_GETKMASK	221
+#define	AUE_AUDITON_SETKMASK	222
+#define	AUE_AUDITON_GETCWD	223
+#define	AUE_AUDITON_GETCAR	224
+#define	AUE_AUDITON_GETSTAT	225
+#define	AUE_AUDITON_SETSTAT	226
+#define	AUE_AUDITON_SETUMASK	227
+#define	AUE_AUDITON_SETSMASK	228
+#define	AUE_AUDITON_GETCOND	229
+#define	AUE_AUDITON_SETCOND	230
+#define	AUE_AUDITON_GETCLASS	231
+#define	AUE_AUDITON_SETCLASS	232
+#define	AUE_FUSERS		233	/* Solaris-specific; also UTSSYS? */
+#define	AUE_STATVFS		234
+#define	AUE_XSTAT		235	/* Solaris-specific. */
+#define	AUE_LXSTAT		236	/* Solaris-specific. */
+#define	AUE_LCHOWN		237
+#define	AUE_MEMCNTL		238	/* Solaris-specific. */
+#define	AUE_SYSINFO		239	/* Solaris-specific. */
+#define	AUE_XMKNOD		240	/* Solaris-specific. */
+#define	AUE_FORK1		241
+#define	AUE_MODCTL		242	/* Solaris-specific. */
+#define	AUE_MODLOAD		243
+#define	AUE_MODUNLOAD		244
+#define	AUE_MODCONFIG		245	/* Solaris-specific. */
+#define	AUE_MODADDMAJ		246	/* Solaris-specific. */
+#define	AUE_SOCKACCEPT		247	/* Solaris-specific. */
+#define	AUE_SOCKCONNECT		248	/* Solaris-specific. */
+#define	AUE_SOCKSEND		249	/* Solaris-specific. */
+#define	AUE_SOCKRECEIVE		250	/* Solaris-specific. */
+#define	AUE_ACLSET		251
+#define	AUE_FACLSET		252
+#define	AUE_DOORFS		253	/* Solaris-specific. */
+#define	AUE_DOORFS_DOOR_CALL	254	/* Solaris-specific. */
+#define	AUE_DOORFS_DOOR_RETURN	255	/* Solaris-specific. */
+#define	AUE_DOORFS_DOOR_CREATE	256	/* Solaris-specific. */
+#define	AUE_DOORFS_DOOR_REVOKE	257	/* Solaris-specific. */
+#define	AUE_DOORFS_DOOR_INFO	258	/* Solaris-specific. */
+#define	AUE_DOORFS_DOOR_CRED	259	/* Solaris-specific. */
+#define	AUE_DOORFS_DOOR_BIND	260	/* Solaris-specific. */
+#define	AUE_DOORFS_DOOR_UNBIND	261	/* Solaris-specific. */
+#define	AUE_P_ONLINE		262	/* Solaris-specific. */
+#define	AUE_PROCESSOR_BIND	263	/* Solaris-specific. */
+#define	AUE_INST_SYNC		264	/* Solaris-specific. */
+#define	AUE_SOCKCONFIG		265	/* Solaris-specific. */
+#define	AUE_SETAUDIT_ADDR	266
+#define	AUE_GETAUDIT_ADDR	267
+#define	AUE_UMOUNT2		268	/* Solaris-specific. */
+#define	AUE_FSAT		269	/* Solaris-specific. */
+#define	AUE_OPENAT_R		270
+#define	AUE_OPENAT_RC		271
+#define	AUE_OPENAT_RT		272
+#define	AUE_OPENAT_RTC		273
+#define	AUE_OPENAT_W		274
+#define	AUE_OPENAT_WC		275
+#define	AUE_OPENAT_WT		276
+#define	AUE_OPENAT_WTC		277
+#define	AUE_OPENAT_RW		278
+#define	AUE_OPENAT_RWC		279
+#define	AUE_OPENAT_RWT		280
+#define	AUE_OPENAT_RWTC		281
+#define	AUE_RENAMEAT		282
+#define	AUE_FSTATAT		283
+#define	AUE_FCHOWNAT		284
+#define	AUE_FUTIMESAT		285
+#define	AUE_UNLINKAT		286
+#define	AUE_CLOCK_SETTIME	287
+#define	AUE_NTP_ADJTIME		288
+#define	AUE_SETPPRIV		289	/* Solaris-specific. */
+#define	AUE_MODDEVPLCY		290	/* Solaris-specific. */
+#define	AUE_MODADDPRIV		291	/* Solaris-specific. */
+#define	AUE_CRYPTOADM		292	/* Solaris-specific. */
+#define	AUE_CONFIGKSSL		293	/* Solaris-specific. */
+#define	AUE_BRANDSYS		294	/* Solaris-specific. */
+#define	AUE_PF_POLICY_ADDRULE	295	/* Solaris-specific. */
+#define	AUE_PF_POLICY_DELRULE	296	/* Solaris-specific. */
+#define	AUE_PF_POLICY_CLONE	297	/* Solaris-specific. */
+#define	AUE_PF_POLICY_FLIP	298	/* Solaris-specific. */
+#define	AUE_PF_POLICY_FLUSH	299	/* Solaris-specific. */
+#define	AUE_PF_POLICY_ALGS	300	/* Solaris-specific. */
+#define	AUE_PORTFS		301	/* Solaris-specific. */
+
+/*
+ * Events added for Apple Darwin that potentially collide with future Solaris
+ * BSM events.  These are assigned AUE_DARWIN prefixes, and are deprecated in
+ * new trails.  Systems generating these events should switch to the new
+ * identifiers that avoid colliding with the Solaris identifier space.
+ */
+#define	AUE_DARWIN_GETFSSTAT	301
+#define	AUE_DARWIN_PTRACE	302
+#define	AUE_DARWIN_CHFLAGS	303
+#define	AUE_DARWIN_FCHFLAGS	304
+#define	AUE_DARWIN_PROFILE	305
+#define	AUE_DARWIN_KTRACE	306
+#define	AUE_DARWIN_SETLOGIN	307
+#define	AUE_DARWIN_REBOOT	308
+#define	AUE_DARWIN_REVOKE	309
+#define	AUE_DARWIN_UMASK	310
+#define	AUE_DARWIN_MPROTECT	311
+#define	AUE_DARWIN_SETPRIORITY	312
+#define	AUE_DARWIN_SETTIMEOFDAY	313
+#define	AUE_DARWIN_FLOCK	314
+#define	AUE_DARWIN_MKFIFO	315
+#define	AUE_DARWIN_POLL		316
+#define	AUE_DARWIN_SOCKETPAIR	317
+#define	AUE_DARWIN_FUTIMES	318
+#define	AUE_DARWIN_SETSID	319
+#define	AUE_DARWIN_SETPRIVEXEC	320	/* Darwin-specific. */
+#define	AUE_DARWIN_NFSSVC	321
+#define	AUE_DARWIN_GETFH	322
+#define	AUE_DARWIN_QUOTACTL	323
+#define	AUE_DARWIN_ADDPROFILE	324	/* Darwin-specific. */
+#define	AUE_DARWIN_KDEBUGTRACE	325	/* Darwin-specific. */
+#define	AUE_DARWIN_KDBUGTRACE	AUE_KDEBUGTRACE
+#define	AUE_DARWIN_FSTAT	326
+#define	AUE_DARWIN_FPATHCONF	327
+#define	AUE_DARWIN_GETDIRENTRIES	328
+#define	AUE_DARWIN_TRUNCATE	329
+#define	AUE_DARWIN_FTRUNCATE	330
+#define	AUE_DARWIN_SYSCTL	331
+#define	AUE_DARWIN_MLOCK	332
+#define	AUE_DARWIN_MUNLOCK	333
+#define	AUE_DARWIN_UNDELETE	334
+#define	AUE_DARWIN_GETATTRLIST	335	/* Darwin-specific. */
+#define	AUE_DARWIN_SETATTRLIST	336	/* Darwin-specific. */
+#define	AUE_DARWIN_GETDIRENTRIESATTR	337	/* Darwin-specific. */
+#define	AUE_DARWIN_EXCHANGEDATA	338	/* Darwin-specific. */
+#define	AUE_DARWIN_SEARCHFS	339	/* Darwin-specific. */
+#define	AUE_DARWIN_MINHERIT	340
+#define	AUE_DARWIN_SEMCONFIG	341
+#define	AUE_DARWIN_SEMOPEN	342
+#define	AUE_DARWIN_SEMCLOSE	343
+#define	AUE_DARWIN_SEMUNLINK	344
+#define	AUE_DARWIN_SHMOPEN	345
+#define	AUE_DARWIN_SHMUNLINK	346
+#define	AUE_DARWIN_LOADSHFILE	347	/* Darwin-specific. */
+#define	AUE_DARWIN_RESETSHFILE	348	/* Darwin-specific. */
+#define	AUE_DARWIN_NEWSYSTEMSHREG	349	/* Darwin-specific. */
+#define	AUE_DARWIN_PTHREADKILL	350	/* Darwin-specific. */
+#define	AUE_DARWIN_PTHREADSIGMASK	351	/* Darwin-specific. */
+#define	AUE_DARWIN_AUDITCTL	352
+#define	AUE_DARWIN_RFORK	353
+#define	AUE_DARWIN_LCHMOD	354
+#define	AUE_DARWIN_SWAPOFF	355
+#define	AUE_DARWIN_INITPROCESS	356	/* Darwin-specific. */
+#define	AUE_DARWIN_MAPFD	357	/* Darwin-specific. */
+#define	AUE_DARWIN_TASKFORPID	358	/* Darwin-specific. */
+#define	AUE_DARWIN_PIDFORTASK	359	/* Darwin-specific. */
+#define	AUE_DARWIN_SYSCTL_NONADMIN	360
+#define	AUE_DARWIN_COPYFILE	361	/* Darwin-specific. */
+
+/*
+ * Audit event identifiers added as part of OpenBSM, generally corresponding
+ * to events in FreeBSD, Darwin, and Linux that were not present in Solaris.
+ * These often duplicate events added to the Solaris set by Darwin, but use
+ * event identifiers in a higher range in order to avoid colliding with
+ * future Solaris additions.
+ *
+ * If an event in this section is later added to Solaris, we prefer the
+ * Solaris event identifier, and add _OPENBSM_ to the OpenBSM-specific
+ * identifier so that old trails can still be processed, but new trails use
+ * the Solaris identifier.
+ */
+#define	AUE_GETFSSTAT		43001
+#define	AUE_PTRACE		43002
+#define	AUE_CHFLAGS		43003
+#define	AUE_FCHFLAGS		43004
+#define	AUE_PROFILE		43005
+#define	AUE_KTRACE		43006
+#define	AUE_SETLOGIN		43007
+#define	AUE_OPENBSM_REVOKE	43008	/* Solaris event now preferred. */
+#define	AUE_UMASK		43009
+#define	AUE_MPROTECT		43010
+#define	AUE_MKFIFO		43011
+#define	AUE_POLL		43012
+#define	AUE_FUTIMES		43013
+#define	AUE_SETSID		43014
+#define	AUE_SETPRIVEXEC		43015	/* Darwin-specific. */
+#define	AUE_ADDPROFILE		43016	/* Darwin-specific. */
+#define	AUE_KDEBUGTRACE		43017	/* Darwin-specific. */
+#define	AUE_KDBUGTRACE		AUE_KDEBUGTRACE
+#define	AUE_OPENBSM_FSTAT	43018	/* Solaris event now preferred. */
+#define	AUE_FPATHCONF		43019
+#define	AUE_GETDIRENTRIES	43020
+#define	AUE_SYSCTL		43021
+#define	AUE_MLOCK		43022
+#define	AUE_MUNLOCK		43023
+#define	AUE_UNDELETE		43024
+#define	AUE_GETATTRLIST		43025	/* Darwin-specific. */
+#define	AUE_SETATTRLIST		43026	/* Darwin-specific. */
+#define	AUE_GETDIRENTRIESATTR	43027	/* Darwin-specific. */
+#define	AUE_EXCHANGEDATA	43028	/* Darwin-specific. */
+#define	AUE_SEARCHFS		43029	/* Darwin-specific. */
+#define	AUE_MINHERIT		43030
+#define	AUE_SEMCONFIG		43031
+#define	AUE_SEMOPEN		43032
+#define	AUE_SEMCLOSE		43033
+#define	AUE_SEMUNLINK		43034
+#define	AUE_SHMOPEN		43035
+#define	AUE_SHMUNLINK		43036
+#define	AUE_LOADSHFILE		43037	/* Darwin-specific. */
+#define	AUE_RESETSHFILE		43038	/* Darwin-specific. */
+#define	AUE_NEWSYSTEMSHREG	43039	/* Darwin-specific. */
+#define	AUE_PTHREADKILL		43040	/* Darwin-specific. */
+#define	AUE_PTHREADSIGMASK	43041	/* Darwin-specific. */
+#define	AUE_AUDITCTL		43042
+#define	AUE_RFORK		43043
+#define	AUE_LCHMOD		43044
+#define	AUE_SWAPOFF		43045
+#define	AUE_INITPROCESS		43046	/* Darwin-specific. */
+#define	AUE_MAPFD		43047	/* Darwin-specific. */
+#define	AUE_TASKFORPID		43048	/* Darwin-specific. */
+#define	AUE_PIDFORTASK		43049	/* Darwin-specific. */
+#define	AUE_SYSCTL_NONADMIN	43050
+#define	AUE_COPYFILE		43051	/* Darwin-specific. */
+
+/*
+ * Events added to OpenBSM for FreeBSD and Linux; may also be used by Darwin
+ * in the future.
+ */
+#define	AUE_LUTIMES		43052
+#define	AUE_LCHFLAGS		43053	/* FreeBSD-specific. */
+#define	AUE_SENDFILE		43054	/* BSD/Linux-specific. */
+#define	AUE_USELIB		43055	/* Linux-specific. */
+#define	AUE_GETRESUID		43056
+#define	AUE_SETRESUID		43057
+#define	AUE_GETRESGID		43058
+#define	AUE_SETRESGID		43059
+#define	AUE_WAIT4		43060	/* FreeBSD-specific. */
+#define	AUE_LGETFH		43061	/* FreeBSD-specific. */
+#define	AUE_FHSTATFS		43062	/* FreeBSD-specific. */
+#define	AUE_FHOPEN		43063	/* FreeBSD-specific. */
+#define	AUE_FHSTAT		43064	/* FreeBSD-specific. */
+#define	AUE_JAIL		43065	/* FreeBSD-specific. */
+#define	AUE_EACCESS		43066	/* FreeBSD-specific. */
+#define	AUE_KQUEUE		43067	/* FreeBSD-specific. */
+#define	AUE_KEVENT		43068	/* FreeBSD-specific. */
+#define	AUE_FSYNC		43069
+#define	AUE_NMOUNT		43070	/* FreeBSD-specific. */
+#define	AUE_BDFLUSH		43071	/* Linux-specific. */
+#define	AUE_SETFSUID		43072	/* Linux-specific. */
+#define	AUE_SETFSGID		43073	/* Linux-specific. */
+#define	AUE_PERSONALITY		43074	/* Linux-specific. */
+#define	AUE_SCHED_GETSCHEDULER	43075	/* POSIX.1b. */
+#define	AUE_SCHED_SETSCHEDULER	43076	/* POSIX.1b. */
+#define	AUE_PRCTL		43077	/* Linux-specific. */
+#define	AUE_GETCWD		43078	/* FreeBSD/Linux-specific. */
+#define	AUE_CAPGET		43079	/* Linux-specific. */
+#define	AUE_CAPSET		43080	/* Linux-specific. */
+#define	AUE_PIVOT_ROOT		43081	/* Linux-specific. */
+#define	AUE_RTPRIO		43082	/* FreeBSD-specific. */
+#define	AUE_SCHED_GETPARAM	43083	/* POSIX.1b. */
+#define	AUE_SCHED_SETPARAM	43084	/* POSIX.1b. */
+#define	AUE_SCHED_GET_PRIORITY_MAX	43085	/* POSIX.1b. */
+#define	AUE_SCHED_GET_PRIORITY_MIN	43086	/* POSIX.1b. */
+#define	AUE_SCHED_RR_GET_INTERVAL	43087	/* POSIX.1b. */
+#define	AUE_ACL_GET_FILE	43088	/* FreeBSD. */
+#define	AUE_ACL_SET_FILE	43089	/* FreeBSD. */
+#define	AUE_ACL_GET_FD		43090	/* FreeBSD. */
+#define	AUE_ACL_SET_FD		43091	/* FreeBSD. */
+#define	AUE_ACL_DELETE_FILE	43092	/* FreeBSD. */
+#define	AUE_ACL_DELETE_FD	43093	/* FreeBSD. */
+#define	AUE_ACL_CHECK_FILE	43094	/* FreeBSD. */
+#define	AUE_ACL_CHECK_FD	43095	/* FreeBSD. */
+#define	AUE_ACL_GET_LINK	43096	/* FreeBSD. */
+#define	AUE_ACL_SET_LINK	43097	/* FreeBSD. */
+#define	AUE_ACL_DELETE_LINK	43098	/* FreeBSD. */
+#define	AUE_ACL_CHECK_LINK	43099	/* FreeBSD. */
+#define	AUE_SYSARCH		43100	/* FreeBSD. */
+#define	AUE_EXTATTRCTL		43101	/* FreeBSD. */
+#define	AUE_EXTATTR_GET_FILE	43102	/* FreeBSD. */
+#define	AUE_EXTATTR_SET_FILE	43103	/* FreeBSD. */
+#define	AUE_EXTATTR_LIST_FILE	43104	/* FreeBSD. */
+#define	AUE_EXTATTR_DELETE_FILE	43105	/* FreeBSD. */
+#define	AUE_EXTATTR_GET_FD	43106	/* FreeBSD. */
+#define	AUE_EXTATTR_SET_FD	43107	/* FreeBSD. */
+#define	AUE_EXTATTR_LIST_FD	43108	/* FreeBSD. */
+#define	AUE_EXTATTR_DELETE_FD	43109	/* FreeBSD. */
+#define	AUE_EXTATTR_GET_LINK	43110	/* FreeBSD. */
+#define	AUE_EXTATTR_SET_LINK	43111	/* FreeBSD. */
+#define	AUE_EXTATTR_LIST_LINK	43112	/* FreeBSD. */
+#define	AUE_EXTATTR_DELETE_LINK	43113	/* FreeBSD. */
+#define	AUE_KENV		43114	/* FreeBSD. */
+#define	AUE_JAIL_ATTACH		43115	/* FreeBSD. */
+#define	AUE_SYSCTL_WRITE	43116	/* FreeBSD. */
+#define	AUE_IOPERM		43117	/* Linux. */
+#define	AUE_READDIR		43118	/* Linux. */
+#define	AUE_IOPL		43119	/* Linux. */
+#define	AUE_VM86		43120	/* Linux. */
+#define	AUE_MAC_GET_PROC	43121	/* FreeBSD/Darwin. */
+#define	AUE_MAC_SET_PROC	43122	/* FreeBSD/Darwin. */
+#define	AUE_MAC_GET_FD		43123	/* FreeBSD/Darwin. */
+#define	AUE_MAC_GET_FILE	43124	/* FreeBSD/Darwin. */
+#define	AUE_MAC_SET_FD		43125	/* FreeBSD/Darwin. */
+#define	AUE_MAC_SET_FILE	43126	/* FreeBSD/Darwin. */
+#define	AUE_MAC_SYSCALL		43127	/* FreeBSD. */
+#define	AUE_MAC_GET_PID		43128	/* FreeBSD/Darwin. */
+#define	AUE_MAC_GET_LINK	43129	/* FreeBSD/Darwin. */
+#define	AUE_MAC_SET_LINK	43130	/* FreeBSD/Darwin. */
+#define	AUE_MAC_EXECVE		43131	/* FreeBSD/Darwin. */
+#define	AUE_GETPATH_FROMFD	43132	/* FreeBSD. */
+#define	AUE_GETPATH_FROMADDR	43133	/* FreeBSD. */
+#define	AUE_MQ_OPEN		43134	/* FreeBSD. */
+#define	AUE_MQ_SETATTR		43135	/* FreeBSD. */
+#define	AUE_MQ_TIMEDRECEIVE	43136	/* FreeBSD. */
+#define	AUE_MQ_TIMEDSEND	43137	/* FreeBSD. */
+#define	AUE_MQ_NOTIFY		43138	/* FreeBSD. */
+#define	AUE_MQ_UNLINK		43139	/* FreeBSD. */
+#define	AUE_LISTEN		43140	/* FreeBSD/Darwin/Linux. */
+#define	AUE_MLOCKALL		43141	/* FreeBSD. */
+#define	AUE_MUNLOCKALL		43142	/* FreeBSD. */
+#define	AUE_CLOSEFROM		43143	/* FreeBSD. */
+#define	AUE_FEXECVE		43144	/* FreeBSD. */
+#define	AUE_FACCESSAT		43145	/* FreeBSD. */
+#define	AUE_FCHMODAT		43146	/* FreeBSD. */
+#define	AUE_LINKAT		43147	/* FreeBSD. */
+#define	AUE_MKDIRAT		43148	/* FreeBSD. */
+#define	AUE_MKFIFOAT		43149	/* FreeBSD. */
+#define	AUE_MKNODAT		43150	/* FreeBSD. */
+#define	AUE_READLINKAT		43151	/* FreeBSD. */
+#define	AUE_SYMLINKAT		43152	/* FreeBSD. */
+#define	AUE_MAC_GETFSSTAT	43153	/* Darwin. */
+#define	AUE_MAC_GET_MOUNT	43154	/* Darwin. */
+#define	AUE_MAC_GET_LCID	43155	/* Darwin. */
+#define	AUE_MAC_GET_LCTX	43156	/* Darwin. */
+#define	AUE_MAC_SET_LCTX	43157	/* Darwin. */
+#define	AUE_MAC_MOUNT		43158	/* Darwin. */
+#define	AUE_GETLCID		43159	/* Darwin. */
+#define	AUE_SETLCID		43160	/* Darwin. */
+#define	AUE_TASKNAMEFORPID	43161	/* Darwin. */
+#define	AUE_ACCESS_EXTENDED	43162	/* Darwin. */
+#define	AUE_CHMOD_EXTENDED	43163	/* Darwin. */
+#define	AUE_FCHMOD_EXTENDED	43164	/* Darwin. */
+#define	AUE_FSTAT_EXTENDED	43165	/* Dariwn. */
+#define	AUE_LSTAT_EXTENDED	43166	/* Darwin. */
+#define	AUE_MKDIR_EXTENDED	43167	/* Darwin. */
+#define	AUE_MKFIFO_EXTENDED	43168	/* Darwin. */
+#define	AUE_OPEN_EXTENDED	43169	/* Darwin. */
+#define	AUE_OPEN_EXTENDED_R	43170	/* Darwin. */
+#define	AUE_OPEN_EXTENDED_RC	43171	/* Darwin. */
+#define	AUE_OPEN_EXTENDED_RT	43172	/* Darwin. */
+#define	AUE_OPEN_EXTENDED_RTC	43173	/* Darwin. */
+#define	AUE_OPEN_EXTENDED_W	43174	/* Darwin. */
+#define	AUE_OPEN_EXTENDED_WC	43175	/* Darwin. */
+#define	AUE_OPEN_EXTENDED_WT	43176	/* Darwin. */
+#define	AUE_OPEN_EXTENDED_WTC	43177	/* Darwin. */
+#define	AUE_OPEN_EXTENDED_RW	43178	/* Darwin. */
+#define	AUE_OPEN_EXTENDED_RWC	43179	/* Darwin. */
+#define	AUE_OPEN_EXTENDED_RWT	43180	/* Darwin. */
+#define	AUE_OPEN_EXTENDED_RWTC	43181	/* Darwin. */
+#define	AUE_STAT_EXTENDED	43182	/* Darwin. */
+#define	AUE_UMASK_EXTENDED	43183	/* Darwin. */
+#define	AUE_OPENAT		43184	/* FreeBSD. */
+#define	AUE_POSIX_OPENPT	43185	/* FreeBSD. */
+#define	AUE_CAP_NEW		43186	/* TrustedBSD. */
+#define	AUE_CAP_GETRIGHTS	43187	/* TrustedBSD. */
+#define	AUE_CAP_ENTER		43188	/* TrustedBSD. */
+#define	AUE_CAP_GETMODE		43189	/* TrustedBSD. */
+
+/*
+ * Darwin BSM uses a number of AUE_O_* definitions, which are aliased to the
+ * normal Solaris BSM identifiers.  _O_ refers to it being an old, or compat
+ * interface.  In most cases, Darwin has never implemented these system calls
+ * but picked up the fields in their system call table from their FreeBSD
+ * import.  Happily, these have different names than the AUE_O* definitions
+ * in Solaris BSM.
+ */
+#define	AUE_O_CREAT		AUE_OPEN_RWTC	/* Darwin */
+#define	AUE_O_EXECVE		AUE_NULL	/* Darwin */
+#define	AUE_O_SBREAK		AUE_NULL	/* Darwin */
+#define	AUE_O_LSEEK		AUE_NULL	/* Darwin */
+#define	AUE_O_MOUNT		AUE_NULL	/* Darwin */
+#define	AUE_O_UMOUNT		AUE_NULL	/* Darwin */
+#define	AUE_O_STAT		AUE_STAT	/* Darwin */
+#define	AUE_O_LSTAT		AUE_LSTAT	/* Darwin */
+#define	AUE_O_FSTAT		AUE_FSTAT	/* Darwin */
+#define	AUE_O_GETPAGESIZE	AUE_NULL	/* Darwin */
+#define	AUE_O_VREAD		AUE_NULL	/* Darwin */
+#define	AUE_O_VWRITE		AUE_NULL	/* Darwin */
+#define	AUE_O_MMAP		AUE_MMAP	/* Darwin */
+#define	AUE_O_VADVISE		AUE_NULL	/* Darwin */
+#define	AUE_O_VHANGUP		AUE_NULL	/* Darwin */
+#define	AUE_O_VLIMIT		AUE_NULL	/* Darwin */
+#define	AUE_O_WAIT		AUE_NULL	/* Darwin */
+#define	AUE_O_GETHOSTNAME	AUE_NULL	/* Darwin */
+#define	AUE_O_SETHOSTNAME	AUE_SYSCTL	/* Darwin */
+#define	AUE_O_GETDOPT		AUE_NULL	/* Darwin */
+#define	AUE_O_SETDOPT		AUE_NULL	/* Darwin */
+#define	AUE_O_ACCEPT		AUE_NULL	/* Darwin */
+#define	AUE_O_SEND		AUE_SENDMSG	/* Darwin */
+#define	AUE_O_RECV		AUE_RECVMSG	/* Darwin */
+#define	AUE_O_VTIMES		AUE_NULL	/* Darwin */
+#define	AUE_O_SIGVEC		AUE_NULL	/* Darwin */
+#define	AUE_O_SIGBLOCK		AUE_NULL	/* Darwin */
+#define	AUE_O_SIGSETMASK	AUE_NULL	/* Darwin */
+#define	AUE_O_SIGSTACK		AUE_NULL	/* Darwin */
+#define	AUE_O_RECVMSG		AUE_RECVMSG	/* Darwin */
+#define	AUE_O_SENDMSG		AUE_SENDMSG	/* Darwin */
+#define	AUE_O_VTRACE		AUE_NULL	/* Darwin */
+#define	AUE_O_RESUBA		AUE_NULL	/* Darwin */
+#define	AUE_O_RECVFROM		AUE_RECVFROM	/* Darwin */
+#define	AUE_O_SETREUID		AUE_SETREUID	/* Darwin */
+#define	AUE_O_SETREGID		AUE_SETREGID	/* Darwin */
+#define	AUE_O_GETDIRENTRIES	AUE_GETDIRENTRIES	/* Darwin */
+#define	AUE_O_TRUNCATE		AUE_TRUNCATE	/* Darwin */
+#define	AUE_O_FTRUNCATE		AUE_FTRUNCATE	/* Darwin */
+#define	AUE_O_GETPEERNAME	AUE_NULL	/* Darwin */
+#define	AUE_O_GETHOSTID		AUE_NULL	/* Darwin */
+#define	AUE_O_SETHOSTID		AUE_NULL	/* Darwin */
+#define	AUE_O_GETRLIMIT		AUE_NULL	/* Darwin */
+#define	AUE_O_SETRLIMIT		AUE_SETRLIMIT	/* Darwin */
+#define	AUE_O_KILLPG		AUE_KILL	/* Darwin */
+#define	AUE_O_SETQUOTA		AUE_NULL	/* Darwin */
+#define	AUE_O_QUOTA		AUE_NULL	/* Darwin */
+#define	AUE_O_GETSOCKNAME	AUE_NULL	/* Darwin */
+#define	AUE_O_GETDIREENTRIES	AUE_GETDIREENTRIES	/* Darwin */
+#define	AUE_O_ASYNCDAEMON	AUE_NULL	/* Darwin */
+#define	AUE_O_GETDOMAINNAME	AUE_NULL	/* Darwin */
+#define	AUE_O_SETDOMAINNAME	AUE_SYSCTL	/* Darwin */
+#define	AUE_O_PCFS_MOUNT	AUE_NULL	/* Darwin */
+#define	AUE_O_EXPORTFS		AUE_NULL	/* Darwin */
+#define	AUE_O_USTATE		AUE_NULL	/* Darwin */
+#define	AUE_O_WAIT3		AUE_NULL	/* Darwin */
+#define	AUE_O_RPAUSE		AUE_NULL	/* Darwin */
+#define	AUE_O_GETDENTS		AUE_NULL	/* Darwin */
+
+/*
+ * Possible desired future values based on review of BSD/Darwin system calls.
+ */
+#define	AUE_DUP			AUE_NULL
+#define	AUE_FSCTL		AUE_NULL
+#define	AUE_FSTATV		AUE_NULL
+#define	AUE_GCCONTROL		AUE_NULL
+#define	AUE_GETDTABLESIZE	AUE_NULL
+#define	AUE_GETEGID		AUE_NULL
+#define	AUE_GETEUID		AUE_NULL
+#define	AUE_GETGID		AUE_NULL
+#define	AUE_GETGROUPS		AUE_NULL
+#define	AUE_GETITIMER		AUE_NULL
+#define	AUE_GETLOGIN		AUE_NULL
+#define	AUE_GETPEERNAME		AUE_NULL
+#define	AUE_GETPGID		AUE_NULL
+#define	AUE_GETPGRP		AUE_NULL
+#define	AUE_GETPID		AUE_NULL
+#define	AUE_GETPPID		AUE_NULL
+#define	AUE_GETPRIORITY		AUE_NULL
+#define	AUE_GETRLIMIT		AUE_NULL
+#define	AUE_GETRUSAGE		AUE_NULL
+#define	AUE_GETSID		AUE_NULL
+#define	AUE_GETSOCKNAME		AUE_NULL
+#define	AUE_GETTIMEOFDAY	AUE_NULL
+#define	AUE_GETUID		AUE_NULL
+#define	AUE_GETSOCKOPT		AUE_NULL
+#define	AUE_GTSOCKOPT		AUE_GETSOCKOPT	/* XXX: Typo in Darwin. */
+#define	AUE_ISSETUGID		AUE_NULL
+#define	AUE_LSTATV		AUE_NULL
+#define	AUE_MADVISE		AUE_NULL
+#define	AUE_MINCORE		AUE_NULL
+#define	AUE_MKCOMPLEX		AUE_NULL
+#define	AUE_MODWATCH		AUE_NULL
+#define	AUE_MSGCL		AUE_NULL
+#define	AUE_MSYNC		AUE_NULL
+#define	AUE_PREAD		AUE_NULL
+#define	AUE_PWRITE		AUE_NULL
+#define	AUE_PREADV		AUE_NULL
+#define	AUE_PWRITEV		AUE_NULL
+#define	AUE_SBRK		AUE_NULL
+#define	AUE_SELECT		AUE_NULL
+#define	AUE_SEMDESTROY		AUE_NULL
+#define	AUE_SEMGETVALUE		AUE_NULL
+#define	AUE_SEMINIT		AUE_NULL
+#define	AUE_SEMPOST		AUE_NULL
+#define	AUE_SEMTRYWAIT		AUE_NULL
+#define	AUE_SEMWAIT		AUE_NULL
+#define	AUE_SETITIMER		AUE_NULL
+#define	AUE_SIGACTION		AUE_NULL
+#define	AUE_SIGALTSTACK		AUE_NULL
+#define	AUE_SIGPENDING		AUE_NULL
+#define	AUE_SIGPROCMASK		AUE_NULL
+#define	AUE_SIGRETURN		AUE_NULL
+#define	AUE_SIGSUSPEND		AUE_NULL
+#define	AUE_SIGWAIT		AUE_NULL
+#define	AUE_SSTK		AUE_NULL
+#define	AUE_STATV		AUE_NULL
+#define	AUE_SYNC		AUE_NULL
+#define	AUE_SYSCALL		AUE_NULL
+#define	AUE_TABLE		AUE_NULL
+#define	AUE_WAITEVENT		AUE_NULL
+#define	AUE_WATCHEVENT		AUE_NULL
+
+#endif /* !_BSM_AUDIT_KEVENTS_H_ */
diff --git a/contrib/openbsm/sys/bsm/audit_record.h b/contrib/openbsm/sys/bsm/audit_record.h
new file mode 100644
index 0000000..ccca15b
--- /dev/null
+++ b/contrib/openbsm/sys/bsm/audit_record.h
@@ -0,0 +1,293 @@
+/*-
+ * Copyright (c) 2005-2008 Apple Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * $P4: //depot/projects/trustedbsd/openbsm/sys/bsm/audit_record.h#3 $
+ */
+
+#ifndef _BSM_AUDIT_RECORD_H_
+#define _BSM_AUDIT_RECORD_H_
+
+#include <sys/time.h>			/* struct timeval */
+
+/*
+ * Token type identifiers.
+ */
+#define	AUT_INVALID		0x00
+#define	AUT_OTHER_FILE32	0x11
+#define	AUT_OHEADER		0x12
+#define	AUT_TRAILER		0x13
+#define	AUT_HEADER32		0x14
+#define	AUT_HEADER32_EX		0x15
+#define	AUT_DATA		0x21
+#define	AUT_IPC			0x22
+#define	AUT_PATH		0x23
+#define	AUT_SUBJECT32		0x24
+#define	AUT_XATPATH		0x25
+#define	AUT_PROCESS32		0x26
+#define	AUT_RETURN32		0x27
+#define	AUT_TEXT		0x28
+#define	AUT_OPAQUE		0x29
+#define	AUT_IN_ADDR		0x2a
+#define	AUT_IP			0x2b
+#define	AUT_IPORT		0x2c
+#define	AUT_ARG32		0x2d
+#define	AUT_SOCKET		0x2e
+#define	AUT_SEQ			0x2f
+#define	AUT_ACL			0x30
+#define	AUT_ATTR		0x31
+#define	AUT_IPC_PERM		0x32
+#define	AUT_LABEL		0x33
+#define	AUT_GROUPS		0x34
+#define	AUT_ACE			0x35
+#define	AUT_PRIV		0x38
+#define	AUT_UPRIV		0x39
+#define	AUT_LIAISON		0x3a
+#define	AUT_NEWGROUPS		0x3b
+#define	AUT_EXEC_ARGS		0x3c
+#define	AUT_EXEC_ENV		0x3d
+#define	AUT_ATTR32		0x3e
+#define	AUT_UNAUTH		0x3f
+#define	AUT_XATOM		0x40
+#define	AUT_XOBJ		0x41
+#define	AUT_XPROTO		0x42
+#define	AUT_XSELECT		0x43
+#define	AUT_XCOLORMAP		0x44
+#define	AUT_XCURSOR		0x45
+#define	AUT_XFONT		0x46
+#define	AUT_XGC			0x47
+#define	AUT_XPIXMAP		0x48
+#define	AUT_XPROPERTY		0x49
+#define	AUT_XWINDOW		0x4a
+#define	AUT_XCLIENT		0x4b
+#define	AUT_CMD			0x51
+#define	AUT_EXIT		0x52
+#define	AUT_ZONENAME		0x60
+#define	AUT_HOST		0x70
+#define	AUT_ARG64		0x71
+#define	AUT_RETURN64		0x72
+#define	AUT_ATTR64		0x73
+#define	AUT_HEADER64		0x74
+#define	AUT_SUBJECT64		0x75
+#define	AUT_PROCESS64		0x77
+#define	AUT_OTHER_FILE64	0x78
+#define	AUT_HEADER64_EX		0x79
+#define	AUT_SUBJECT32_EX	0x7a
+#define	AUT_PROCESS32_EX	0x7b
+#define	AUT_SUBJECT64_EX	0x7c
+#define	AUT_PROCESS64_EX	0x7d
+#define	AUT_IN_ADDR_EX		0x7e
+#define	AUT_SOCKET_EX		0x7f
+
+/*
+ * Pre-64-bit BSM, 32-bit tokens weren't explicitly named as '32'.  We have
+ * compatibility defines.
+ */
+#define	AUT_HEADER		AUT_HEADER32
+#define	AUT_ARG			AUT_ARG32
+#define	AUT_RETURN		AUT_RETURN32
+#define	AUT_SUBJECT		AUT_SUBJECT32
+#define	AUT_PROCESS		AUT_PROCESS32
+#define	AUT_OTHER_FILE		AUT_OTHER_FILE32
+
+/*
+ * The values for the following token ids are not defined by BSM.
+ *
+ * XXXRW: Not sure how to handle these in OpenBSM yet, but I'll give them
+ * names more consistent with Sun's BSM.  These originally came from Apple's
+ * BSM.
+ */
+#define	AUT_SOCKINET32		0x80		/* XXX */
+#define	AUT_SOCKINET128		0x81		/* XXX */
+#define	AUT_SOCKUNIX		0x82		/* XXX */
+
+/* print values for the arbitrary token */
+#define AUP_BINARY      0
+#define AUP_OCTAL       1
+#define AUP_DECIMAL     2
+#define AUP_HEX         3
+#define AUP_STRING      4
+
+/* data-types for the arbitrary token */
+#define AUR_BYTE        0
+#define AUR_CHAR        AUR_BYTE
+#define AUR_SHORT       1
+#define AUR_INT32       2
+#define AUR_INT         AUR_INT32
+#define AUR_INT64       3
+
+/* ... and their sizes */
+#define AUR_BYTE_SIZE       sizeof(u_char)
+#define AUR_CHAR_SIZE       AUR_BYTE_SIZE
+#define AUR_SHORT_SIZE      sizeof(uint16_t)
+#define AUR_INT32_SIZE      sizeof(uint32_t)
+#define AUR_INT_SIZE        AUR_INT32_SIZE
+#define AUR_INT64_SIZE      sizeof(uint64_t)
+
+/* Modifiers for the header token */
+#define PAD_NOTATTR  0x4000   /* nonattributable event */
+#define PAD_FAILURE  0x8000   /* fail audit event */
+
+#define AUDIT_MAX_GROUPS      16
+
+/*
+ * A number of BSM versions are floating around and defined.  Here are
+ * constants for them.  OpenBSM uses the same token types, etc, used in the
+ * Solaris BSM version, but has a separate version number in order to
+ * identify a potentially different event identifier name space.
+ */
+#define	AUDIT_HEADER_VERSION_OLDDARWIN	1	/* In retrospect, a mistake. */
+#define	AUDIT_HEADER_VERSION_SOLARIS	2
+#define	AUDIT_HEADER_VERSION_TSOL25	3
+#define	AUDIT_HEADER_VERSION_TSOL	4
+#define	AUDIT_HEADER_VERSION_OPENBSM	10
+
+/*
+ * BSM define is AUT_TRAILER_MAGIC; Apple BSM define is TRAILER_PAD_MAGIC; we
+ * split the difference, will remove the Apple define for the next release.
+ */
+#define	AUT_TRAILER_MAGIC	0xb105
+#define	TRAILER_PAD_MAGIC	AUT_TRAILER_MAGIC
+
+/* BSM library calls */
+
+__BEGIN_DECLS
+
+struct in_addr;
+struct in6_addr;
+struct ip;
+struct ipc_perm;
+struct kevent;
+struct sockaddr_in;
+struct sockaddr_in6;
+struct sockaddr_un;
+#if defined(_KERNEL) || defined(KERNEL)
+struct vnode_au_info;
+#endif
+
+int	 au_open(void);
+int	 au_write(int d, token_t *m);
+int	 au_close(int d, int keep, short event);
+int	 au_close_buffer(int d, short event, u_char *buffer, size_t *buflen);
+int	 au_close_token(token_t *tok, u_char *buffer, size_t *buflen);
+
+token_t	*au_to_file(const char *file, struct timeval tm);
+
+token_t	*au_to_header32_tm(int rec_size, au_event_t e_type, au_emod_t e_mod,
+	    struct timeval tm);
+token_t	*au_to_header32_ex_tm(int rec_size, au_event_t e_type, au_emod_t e_mod,
+	    struct timeval tm, struct auditinfo_addr *aia);
+token_t	*au_to_header64_tm(int rec_size, au_event_t e_type, au_emod_t e_mod,
+	    struct timeval tm);
+#if !defined(KERNEL) && !defined(_KERNEL)
+token_t	*au_to_header(int rec_size, au_event_t e_type, au_emod_t e_mod);
+token_t	*au_to_header_ex(int rec_size, au_event_t e_type, au_emod_t e_mod);
+token_t	*au_to_header32(int rec_size, au_event_t e_type, au_emod_t e_mod);
+token_t	*au_to_header64(int rec_size, au_event_t e_type, au_emod_t e_mod);
+#endif
+
+token_t	*au_to_me(void);
+token_t	*au_to_arg(char n, const char *text, uint32_t v);
+token_t	*au_to_arg32(char n, const char *text, uint32_t v);
+token_t	*au_to_arg64(char n, const char *text, uint64_t v);
+
+#if defined(_KERNEL) || defined(KERNEL)
+token_t	*au_to_attr(struct vnode_au_info *vni);
+token_t	*au_to_attr32(struct vnode_au_info *vni);
+token_t	*au_to_attr64(struct vnode_au_info *vni);
+#endif
+
+token_t	*au_to_data(char unit_print, char unit_type, char unit_count,
+	    const char *p);
+token_t	*au_to_exit(int retval, int err);
+token_t	*au_to_groups(int *groups);
+token_t	*au_to_newgroups(uint16_t n, gid_t *groups);
+token_t	*au_to_in_addr(struct in_addr *internet_addr);
+token_t	*au_to_in_addr_ex(struct in6_addr *internet_addr);
+token_t	*au_to_ip(struct ip *ip);
+token_t	*au_to_ipc(char type, int id);
+token_t	*au_to_ipc_perm(struct ipc_perm *perm);
+token_t	*au_to_iport(uint16_t iport);
+token_t	*au_to_opaque(const char *data, uint16_t bytes);
+token_t	*au_to_path(const char *path);
+token_t	*au_to_process(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
+	    gid_t rgid, pid_t pid, au_asid_t sid, au_tid_t *tid);
+token_t	*au_to_process32(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
+	    gid_t rgid, pid_t pid, au_asid_t sid, au_tid_t *tid);
+token_t	*au_to_process64(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
+	    gid_t rgid, pid_t pid, au_asid_t sid, au_tid_t *tid);
+token_t	*au_to_process_ex(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
+	    gid_t rgid, pid_t pid, au_asid_t sid, au_tid_addr_t *tid);
+token_t	*au_to_process32_ex(au_id_t auid, uid_t euid, gid_t egid,
+	    uid_t ruid, gid_t rgid, pid_t pid, au_asid_t sid,
+	    au_tid_addr_t *tid);
+token_t	*au_to_process64_ex(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
+	    gid_t rgid, pid_t pid, au_asid_t sid, au_tid_addr_t *tid);
+token_t	*au_to_return(char status, uint32_t ret);
+token_t	*au_to_return32(char status, uint32_t ret);
+token_t	*au_to_return64(char status, uint64_t ret);
+token_t	*au_to_seq(long audit_count);
+
+#if defined(_KERNEL) || defined(KERNEL)
+token_t	*au_to_socket(struct socket *so);
+token_t	*au_to_socket_ex_32(uint16_t lp, uint16_t rp, struct sockaddr *la,
+	    struct sockaddr *ta);
+token_t	*au_to_socket_ex_128(uint16_t lp, uint16_t rp, struct sockaddr *la,
+	    struct sockaddr *ta);
+#endif
+
+token_t	*au_to_sock_inet(struct sockaddr_in *so);
+token_t	*au_to_sock_inet32(struct sockaddr_in *so);
+token_t	*au_to_sock_inet128(struct sockaddr_in6 *so);
+token_t	*au_to_sock_unix(struct sockaddr_un *so);
+token_t	*au_to_subject(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
+	    gid_t rgid, pid_t pid, au_asid_t sid, au_tid_t *tid);
+token_t	*au_to_subject32(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
+	    gid_t rgid, pid_t pid, au_asid_t sid, au_tid_t *tid);
+token_t	*au_to_subject64(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
+	    gid_t rgid, pid_t pid, au_asid_t sid, au_tid_t *tid);
+token_t	*au_to_subject_ex(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
+	    gid_t rgid, pid_t pid, au_asid_t sid, au_tid_addr_t *tid);
+token_t	*au_to_subject32_ex(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
+	    gid_t rgid, pid_t pid, au_asid_t sid, au_tid_addr_t *tid);
+token_t	*au_to_subject64_ex(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
+	    gid_t rgid, pid_t pid, au_asid_t sid, au_tid_addr_t *tid);
+#if defined(_KERNEL) || defined(KERNEL)
+token_t	*au_to_exec_args(const char *args, int argc);
+token_t	*au_to_exec_env(const char *envs, int envc);
+#else
+token_t	*au_to_exec_args(char **argv);
+token_t	*au_to_exec_env(char **envp);
+#endif
+token_t	*au_to_text(const char *text);
+token_t	*au_to_kevent(struct kevent *kev);
+token_t	*au_to_trailer(int rec_size);
+token_t	*au_to_zonename(const char *zonename);
+
+__END_DECLS
+
+#endif /* ! _BSM_AUDIT_RECORD_H_ */
diff --git a/contrib/openbsm/test/Makefile.am b/contrib/openbsm/test/Makefile.am
index e52150c..8f20eb5 100644
--- a/contrib/openbsm/test/Makefile.am
+++ b/contrib/openbsm/test/Makefile.am
@@ -1,5 +1,5 @@
 #
-# $P4: //depot/projects/trustedbsd/openbsm/test/Makefile.am#1 $
+# $P4: //depot/projects/trustedbsd/openbsm/test/Makefile.am#2 $
 #
 
 SUBDIRS =		\
diff --git a/contrib/openbsm/test/Makefile.in b/contrib/openbsm/test/Makefile.in
index f2bfda4..9eb97fa 100644
--- a/contrib/openbsm/test/Makefile.in
+++ b/contrib/openbsm/test/Makefile.in
@@ -15,7 +15,7 @@
 @SET_MAKE@
 
 #
-# $P4: //depot/projects/trustedbsd/openbsm/test/Makefile.in#2 $
+# $P4: //depot/projects/trustedbsd/openbsm/test/Makefile.in#6 $
 #
 VPATH = @srcdir@
 pkgdatadir = $(datadir)/@PACKAGE@
@@ -100,6 +100,7 @@ LN_S = @LN_S@
 LTLIBOBJS = @LTLIBOBJS@
 MAINT = @MAINT@
 MAKEINFO = @MAKEINFO@
+MIG = @MIG@
 MKDIR_P = @MKDIR_P@
 OBJEXT = @OBJEXT@
 PACKAGE = @PACKAGE@
diff --git a/contrib/openbsm/test/bsm/Makefile.am b/contrib/openbsm/test/bsm/Makefile.am
index 8aa7934..a4f58b5 100644
--- a/contrib/openbsm/test/bsm/Makefile.am
+++ b/contrib/openbsm/test/bsm/Makefile.am
@@ -1,8 +1,12 @@
 #
-# $P4: //depot/projects/trustedbsd/openbsm/test/bsm/Makefile.am#1 $
+# $P4: //depot/projects/trustedbsd/openbsm/test/bsm/Makefile.am#3 $
 #
 
-INCLUDES = -I$(top_srcdir)
+if USE_NATIVE_INCLUDES
+INCLUDES = -I$(top_builddir) -I$(top_srcdir)
+else
+INCLUDES = -I$(top_builddir) -I$(top_srcdir) -I$(top_srcdir)/sys
+endif
 
 bin_PROGRAMS = generate
 generate_SOURCES = generate.c
diff --git a/contrib/openbsm/test/bsm/Makefile.in b/contrib/openbsm/test/bsm/Makefile.in
index a77196e..128b03d 100644
--- a/contrib/openbsm/test/bsm/Makefile.in
+++ b/contrib/openbsm/test/bsm/Makefile.in
@@ -15,7 +15,7 @@
 @SET_MAKE@
 
 #
-# $P4: //depot/projects/trustedbsd/openbsm/test/bsm/Makefile.in#2 $
+# $P4: //depot/projects/trustedbsd/openbsm/test/bsm/Makefile.in#6 $
 #
 
 VPATH = @srcdir@
@@ -110,6 +110,7 @@ LN_S = @LN_S@
 LTLIBOBJS = @LTLIBOBJS@
 MAINT = @MAINT@
 MAKEINFO = @MAKEINFO@
+MIG = @MIG@
 MKDIR_P = @MKDIR_P@
 OBJEXT = @OBJEXT@
 PACKAGE = @PACKAGE@
@@ -176,7 +177,8 @@ sysconfdir = @sysconfdir@
 target_alias = @target_alias@
 top_builddir = @top_builddir@
 top_srcdir = @top_srcdir@
-INCLUDES = -I$(top_srcdir)
+@USE_NATIVE_INCLUDES_FALSE@INCLUDES = -I$(top_builddir) -I$(top_srcdir) -I$(top_srcdir)/sys
+@USE_NATIVE_INCLUDES_TRUE@INCLUDES = -I$(top_builddir) -I$(top_srcdir)
 generate_SOURCES = generate.c
 generate_LDADD = $(top_builddir)/libbsm/libbsm.la
 all: all-am
diff --git a/contrib/openbsm/tools/Makefile.am b/contrib/openbsm/tools/Makefile.am
index 53aa1d5..60acbea 100644
--- a/contrib/openbsm/tools/Makefile.am
+++ b/contrib/openbsm/tools/Makefile.am
@@ -1,8 +1,12 @@
 #
-# $P4: //depot/projects/trustedbsd/openbsm/tools/Makefile.am#2 $
+# $P4: //depot/projects/trustedbsd/openbsm/tools/Makefile.am#4 $
 #
 
-INCLUDES = -I$(top_srcdir)
+if USE_NATIVE_INCLUDES
+INCLUDES = -I$(top_builddir) -I$(top_srcdir)
+else
+INCLUDES = -I$(top_builddir) -I$(top_srcdir) -I$(top_srcdir)/sys
+endif
 
 bin_PROGRAMS = audump
 audump_SOURCES = audump.c
diff --git a/contrib/openbsm/tools/Makefile.in b/contrib/openbsm/tools/Makefile.in
index b8cff23..d689761 100644
--- a/contrib/openbsm/tools/Makefile.in
+++ b/contrib/openbsm/tools/Makefile.in
@@ -15,7 +15,7 @@
 @SET_MAKE@
 
 #
-# $P4: //depot/projects/trustedbsd/openbsm/tools/Makefile.in#5 $
+# $P4: //depot/projects/trustedbsd/openbsm/tools/Makefile.in#9 $
 #
 
 VPATH = @srcdir@
@@ -110,6 +110,7 @@ LN_S = @LN_S@
 LTLIBOBJS = @LTLIBOBJS@
 MAINT = @MAINT@
 MAKEINFO = @MAKEINFO@
+MIG = @MIG@
 MKDIR_P = @MKDIR_P@
 OBJEXT = @OBJEXT@
 PACKAGE = @PACKAGE@
@@ -176,7 +177,8 @@ sysconfdir = @sysconfdir@
 target_alias = @target_alias@
 top_builddir = @top_builddir@
 top_srcdir = @top_srcdir@
-INCLUDES = -I$(top_srcdir)
+@USE_NATIVE_INCLUDES_FALSE@INCLUDES = -I$(top_builddir) -I$(top_srcdir) -I$(top_srcdir)/sys
+@USE_NATIVE_INCLUDES_TRUE@INCLUDES = -I$(top_builddir) -I$(top_srcdir)
 audump_SOURCES = audump.c
 audump_LDADD = $(top_builddir)/libbsm/libbsm.la
 all: all-am
diff --git a/sys/bsm/audit.h b/sys/bsm/audit.h
index bed5e73..029919f 100644
--- a/sys/bsm/audit.h
+++ b/sys/bsm/audit.h
@@ -1,4 +1,4 @@
-/*
+/*-
  * Copyright (c) 2005 Apple Inc.
  * All rights reserved.
  *
@@ -26,7 +26,7 @@
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  *
- * P4: //depot/projects/trustedbsd/audit3/sys/bsm/audit.h#40
+ * P4: //depot/projects/trustedbsd/openbsm/sys/bsm/audit.h#1
  * $FreeBSD$
  */
 
diff --git a/sys/bsm/audit_internal.h b/sys/bsm/audit_internal.h
index 19bec45..dc583ab 100644
--- a/sys/bsm/audit_internal.h
+++ b/sys/bsm/audit_internal.h
@@ -1,4 +1,4 @@
-/*
+/*-
  * Copyright (c) 2005 Apple Inc.
  * Copyright (c) 2005 SPARTA, Inc.
  * All rights reserved.
@@ -30,7 +30,7 @@
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  *
- * P4: //depot/projects/trustedbsd/audit3/sys/bsm/audit_internal.h#18
+ * P4: //depot/projects/trustedbsd/openbsm/sys/bsm/audit_internal.h#2
  * $FreeBSD$
  */
 
diff --git a/sys/bsm/audit_kevents.h b/sys/bsm/audit_kevents.h
index 6e073d4..a881d78 100644
--- a/sys/bsm/audit_kevents.h
+++ b/sys/bsm/audit_kevents.h
@@ -1,4 +1,4 @@
-/*
+/*-
  * Copyright (c) 2005 Apple Inc.
  * All rights reserved.
  *
@@ -26,7 +26,7 @@
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  *
- * P4: //depot/projects/trustedbsd/audit3/sys/bsm/audit_kevents.h#34
+ * P4: //depot/projects/trustedbsd/openbsm/sys/bsm/audit_kevents.h#3
  * $FreeBSD$
  */
 
@@ -308,6 +308,7 @@
 #define	AUE_PF_POLICY_FLIP	298	/* Solaris-specific. */
 #define	AUE_PF_POLICY_FLUSH	299	/* Solaris-specific. */
 #define	AUE_PF_POLICY_ALGS	300	/* Solaris-specific. */
+#define	AUE_PORTFS		301	/* Solaris-specific. */
 
 /*
  * Events added for Apple Darwin that potentially collide with future Solaris
@@ -516,17 +517,17 @@
 #define	AUE_READDIR		43118	/* Linux. */
 #define	AUE_IOPL		43119	/* Linux. */
 #define	AUE_VM86		43120	/* Linux. */
-#define	AUE_MAC_GET_PROC	43121	/* FreeBSD. */
-#define	AUE_MAC_SET_PROC	43122	/* FreeBSD. */
-#define	AUE_MAC_GET_FD		43123	/* FreeBSD. */
-#define	AUE_MAC_GET_FILE	43124	/* FreeBSD. */
-#define	AUE_MAC_SET_FD		43125	/* FreeBSD. */
-#define	AUE_MAC_SET_FILE	43126	/* FreeBSD. */
+#define	AUE_MAC_GET_PROC	43121	/* FreeBSD/Darwin. */
+#define	AUE_MAC_SET_PROC	43122	/* FreeBSD/Darwin. */
+#define	AUE_MAC_GET_FD		43123	/* FreeBSD/Darwin. */
+#define	AUE_MAC_GET_FILE	43124	/* FreeBSD/Darwin. */
+#define	AUE_MAC_SET_FD		43125	/* FreeBSD/Darwin. */
+#define	AUE_MAC_SET_FILE	43126	/* FreeBSD/Darwin. */
 #define	AUE_MAC_SYSCALL		43127	/* FreeBSD. */
-#define	AUE_MAC_GET_PID		43128	/* FreeBSD. */
-#define	AUE_MAC_GET_LINK	43129	/* FreeBSD. */
-#define	AUE_MAC_SET_LINK	43130	/* FreeBSD. */
-#define	AUE_MAC_EXECVE		43131	/* FreeBSD. */
+#define	AUE_MAC_GET_PID		43128	/* FreeBSD/Darwin. */
+#define	AUE_MAC_GET_LINK	43129	/* FreeBSD/Darwin. */
+#define	AUE_MAC_SET_LINK	43130	/* FreeBSD/Darwin. */
+#define	AUE_MAC_EXECVE		43131	/* FreeBSD/Darwin. */
 #define	AUE_GETPATH_FROMFD	43132	/* FreeBSD. */
 #define	AUE_GETPATH_FROMADDR	43133	/* FreeBSD. */
 #define	AUE_MQ_OPEN		43134	/* FreeBSD. */
@@ -548,7 +549,43 @@
 #define	AUE_MKNODAT		43150	/* FreeBSD. */
 #define	AUE_READLINKAT		43151	/* FreeBSD. */
 #define	AUE_SYMLINKAT		43152	/* FreeBSD. */
+#define	AUE_MAC_GETFSSTAT	43153	/* Darwin. */
+#define	AUE_MAC_GET_MOUNT	43154	/* Darwin. */
+#define	AUE_MAC_GET_LCID	43155	/* Darwin. */
+#define	AUE_MAC_GET_LCTX	43156	/* Darwin. */
+#define	AUE_MAC_SET_LCTX	43157	/* Darwin. */
+#define	AUE_MAC_MOUNT		43158	/* Darwin. */
+#define	AUE_GETLCID		43159	/* Darwin. */
+#define	AUE_SETLCID		43160	/* Darwin. */
+#define	AUE_TASKNAMEFORPID	43161	/* Darwin. */
+#define	AUE_ACCESS_EXTENDED	43162	/* Darwin. */
+#define	AUE_CHMOD_EXTENDED	43163	/* Darwin. */
+#define	AUE_FCHMOD_EXTENDED	43164	/* Darwin. */
+#define	AUE_FSTAT_EXTENDED	43165	/* Dariwn. */
+#define	AUE_LSTAT_EXTENDED	43166	/* Darwin. */
+#define	AUE_MKDIR_EXTENDED	43167	/* Darwin. */
+#define	AUE_MKFIFO_EXTENDED	43168	/* Darwin. */
+#define	AUE_OPEN_EXTENDED	43169	/* Darwin. */
+#define	AUE_OPEN_EXTENDED_R	43170	/* Darwin. */
+#define	AUE_OPEN_EXTENDED_RC	43171	/* Darwin. */
+#define	AUE_OPEN_EXTENDED_RT	43172	/* Darwin. */
+#define	AUE_OPEN_EXTENDED_RTC	43173	/* Darwin. */
+#define	AUE_OPEN_EXTENDED_W	43174	/* Darwin. */
+#define	AUE_OPEN_EXTENDED_WC	43175	/* Darwin. */
+#define	AUE_OPEN_EXTENDED_WT	43176	/* Darwin. */
+#define	AUE_OPEN_EXTENDED_WTC	43177	/* Darwin. */
+#define	AUE_OPEN_EXTENDED_RW	43178	/* Darwin. */
+#define	AUE_OPEN_EXTENDED_RWC	43179	/* Darwin. */
+#define	AUE_OPEN_EXTENDED_RWT	43180	/* Darwin. */
+#define	AUE_OPEN_EXTENDED_RWTC	43181	/* Darwin. */
+#define	AUE_STAT_EXTENDED	43182	/* Darwin. */
+#define	AUE_UMASK_EXTENDED	43183	/* Darwin. */
+#define	AUE_OPENAT		43184	/* FreeBSD. */
 #define	AUE_POSIX_OPENPT	43185	/* FreeBSD. */
+#define	AUE_CAP_NEW		43186	/* TrustedBSD. */
+#define	AUE_CAP_GETRIGHTS	43187	/* TrustedBSD. */
+#define	AUE_CAP_ENTER		43188	/* TrustedBSD. */
+#define	AUE_CAP_GETMODE		43189	/* TrustedBSD. */
 
 /*
  * Darwin BSM uses a number of AUE_O_* definitions, which are aliased to the
diff --git a/sys/bsm/audit_record.h b/sys/bsm/audit_record.h
index 4e269ea..186b4f5 100644
--- a/sys/bsm/audit_record.h
+++ b/sys/bsm/audit_record.h
@@ -1,5 +1,5 @@
-/*
- * Copyright (c) 2005 Apple Inc.
+/*-
+ * Copyright (c) 2005-2008 Apple Inc.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -26,7 +26,7 @@
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  *
- * P4: //depot/projects/trustedbsd/audit3/sys/bsm/audit_record.h#26
+ * P4: //depot/projects/trustedbsd/openbsm/sys/bsm/audit_record.h#3
  * $FreeBSD$
  */
 
@@ -48,7 +48,7 @@
 #define	AUT_IPC			0x22
 #define	AUT_PATH		0x23
 #define	AUT_SUBJECT32		0x24
-#define	AUT_SERVER32		0x25
+#define	AUT_XATPATH		0x25
 #define	AUT_PROCESS32		0x26
 #define	AUT_RETURN32		0x27
 #define	AUT_TEXT		0x28
@@ -64,9 +64,7 @@
 #define	AUT_IPC_PERM		0x32
 #define	AUT_LABEL		0x33
 #define	AUT_GROUPS		0x34
-#define	AUT_ILABEL		0x35
-#define	AUT_SLABEL		0x36
-#define	AUT_CLEAR		0x37
+#define	AUT_ACE			0x35
 #define	AUT_PRIV		0x38
 #define	AUT_UPRIV		0x39
 #define	AUT_LIAISON		0x3a
@@ -74,22 +72,28 @@
 #define	AUT_EXEC_ARGS		0x3c
 #define	AUT_EXEC_ENV		0x3d
 #define	AUT_ATTR32		0x3e
-/* #define	AUT_????	0x3f */
+#define	AUT_UNAUTH		0x3f
 #define	AUT_XATOM		0x40
 #define	AUT_XOBJ		0x41
 #define	AUT_XPROTO		0x42
 #define	AUT_XSELECT		0x43
-/* XXXRW: Additional X11 tokens not defined? */
+#define	AUT_XCOLORMAP		0x44
+#define	AUT_XCURSOR		0x45
+#define	AUT_XFONT		0x46
+#define	AUT_XGC			0x47
+#define	AUT_XPIXMAP		0x48
+#define	AUT_XPROPERTY		0x49
+#define	AUT_XWINDOW		0x4a
+#define	AUT_XCLIENT		0x4b
 #define	AUT_CMD			0x51
 #define	AUT_EXIT		0x52
 #define	AUT_ZONENAME		0x60
-/* XXXRW: OpenBSM AUT_HOST 0x70? */
+#define	AUT_HOST		0x70
 #define	AUT_ARG64		0x71
 #define	AUT_RETURN64		0x72
 #define	AUT_ATTR64		0x73
 #define	AUT_HEADER64		0x74
 #define	AUT_SUBJECT64		0x75
-#define	AUT_SERVER64		0x76
 #define	AUT_PROCESS64		0x77
 #define	AUT_OTHER_FILE64	0x78
 #define	AUT_HEADER64_EX		0x79
@@ -108,55 +112,10 @@
 #define	AUT_ARG			AUT_ARG32
 #define	AUT_RETURN		AUT_RETURN32
 #define	AUT_SUBJECT		AUT_SUBJECT32
-#define	AUT_SERVER		AUT_SERVER32
 #define	AUT_PROCESS		AUT_PROCESS32
 #define	AUT_OTHER_FILE		AUT_OTHER_FILE32
 
 /*
- * Darwin's bsm distribution uses the following non-BSM token name defines.
- * We provide them for a single OpenBSM release for compatibility reasons.
- */
-#define	AU_FILE_TOKEN		AUT_OTHER_FILE32
-#define	AU_TRAILER_TOKEN	AUT_TRAILER
-#define	AU_HEADER_32_TOKEN	AUT_HEADER32
-#define	AU_DATA_TOKEN		AUT_DATA
-#define	AU_ARB_TOKEN		AUT_DATA
-#define	AU_IPC_TOKEN		AUT_IPC
-#define	AU_PATH_TOKEN		AUT_PATH
-#define	AU_SUBJECT_32_TOKEN	AUT_SUBJECT32
-#define	AU_PROCESS_32_TOKEN	AUT_PROCESS32
-#define	AU_RETURN_32_TOKEN	AUT_RETURN32
-#define	AU_TEXT_TOKEN		AUT_TEXT
-#define	AU_OPAQUE_TOKEN		AUT_OPAQUE
-#define	AU_IN_ADDR_TOKEN	AUT_IN_ADDR
-#define	AU_IP_TOKEN		AUT_IP
-#define	AU_IPORT_TOKEN		AUT_IPORT
-#define	AU_ARG32_TOKEN		AUT_ARG32
-#define	AU_SOCK_TOKEN		AUT_SOCKET
-#define	AU_SEQ_TOKEN		AUT_SEQ
-#define	AU_ATTR_TOKEN		AUT_ATTR
-#define	AU_IPCPERM_TOKEN	AUT_IPC_PERM
-#define	AU_NEWGROUPS_TOKEN	AUT_NEWGROUPS
-#define	AU_EXEC_ARG_TOKEN	AUT_EXEC_ARGS
-#define	AU_EXEC_ENV_TOKEN	AUT_EXEC_ENV
-#define	AU_ATTR32_TOKEN		AUT_ATTR32
-#define	AU_CMD_TOKEN		AUT_CMD
-#define	AU_EXIT_TOKEN		AUT_EXIT
-#define	AU_ARG64_TOKEN		AUT_ARG64
-#define	AU_RETURN_64_TOKEN	AUT_RETURN64
-#define	AU_ATTR64_TOKEN		AUT_ATTR64
-#define	AU_HEADER_64_TOKEN	AUT_HEADER64
-#define	AU_SUBJECT_64_TOKEN	AUT_SUBJECT64
-#define	AU_PROCESS_64_TOKEN	AUT_PROCESS64
-#define	AU_HEADER_64_EX_TOKEN	AUT_HEADER64_EX
-#define	AU_SUBJECT_32_EX_TOKEN	AUT_SUBJECT32_EX
-#define	AU_PROCESS_32_EX_TOKEN	AUT_PROCESS32_EX
-#define	AU_SUBJECT_64_EX_TOKEN	AUT_SUBJECT64_EX
-#define	AU_PROCESS_64_EX_TOKEN	AUT_PROCESS64_EX
-#define	AU_IN_ADDR_EX_TOKEN	AUT_IN_ADDR_EX
-#define	AU_SOCK_32_EX_TOKEN	AUT_SOCKET_EX
-
-/*
  * The values for the following token ids are not defined by BSM.
  *
  * XXXRW: Not sure how to handle these in OpenBSM yet, but I'll give them
@@ -166,9 +125,6 @@
 #define	AUT_SOCKINET32		0x80		/* XXX */
 #define	AUT_SOCKINET128		0x81		/* XXX */
 #define	AUT_SOCKUNIX		0x82		/* XXX */
-#define	AU_SOCK_INET_32_TOKEN	AUT_SOCKINET32
-#define	AU_SOCK_INET_128_TOKEN	AUT_SOCKINET128
-#define	AU_SOCK_UNIX_TOKEN	AUT_SOCKUNIX
 
 /* print values for the arbitrary token */
 #define AUP_BINARY      0
@@ -240,7 +196,7 @@ int	 au_close(int d, int keep, short event);
 int	 au_close_buffer(int d, short event, u_char *buffer, size_t *buflen);
 int	 au_close_token(token_t *tok, u_char *buffer, size_t *buflen);
 
-token_t	*au_to_file(char *file, struct timeval tm);
+token_t	*au_to_file(const char *file, struct timeval tm);
 
 token_t	*au_to_header32_tm(int rec_size, au_event_t e_type, au_emod_t e_mod,
 	    struct timeval tm);
@@ -256,9 +212,9 @@ token_t	*au_to_header64(int rec_size, au_event_t e_type, au_emod_t e_mod);
 #endif
 
 token_t	*au_to_me(void);
-token_t	*au_to_arg(char n, char *text, uint32_t v);
-token_t	*au_to_arg32(char n, char *text, uint32_t v);
-token_t	*au_to_arg64(char n, char *text, uint64_t v);
+token_t	*au_to_arg(char n, const char *text, uint32_t v);
+token_t	*au_to_arg32(char n, const char *text, uint32_t v);
+token_t	*au_to_arg64(char n, const char *text, uint64_t v);
 
 #if defined(_KERNEL) || defined(KERNEL)
 token_t	*au_to_attr(struct vnode_au_info *vni);
@@ -267,7 +223,7 @@ token_t	*au_to_attr64(struct vnode_au_info *vni);
 #endif
 
 token_t	*au_to_data(char unit_print, char unit_type, char unit_count,
-	    char *p);
+	    const char *p);
 token_t	*au_to_exit(int retval, int err);
 token_t	*au_to_groups(int *groups);
 token_t	*au_to_newgroups(uint16_t n, gid_t *groups);
@@ -277,8 +233,8 @@ token_t	*au_to_ip(struct ip *ip);
 token_t	*au_to_ipc(char type, int id);
 token_t	*au_to_ipc_perm(struct ipc_perm *perm);
 token_t	*au_to_iport(uint16_t iport);
-token_t	*au_to_opaque(char *data, uint16_t bytes);
-token_t	*au_to_path(char *path);
+token_t	*au_to_opaque(const char *data, uint16_t bytes);
+token_t	*au_to_path(const char *path);
 token_t	*au_to_process(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
 	    gid_t rgid, pid_t pid, au_asid_t sid, au_tid_t *tid);
 token_t	*au_to_process32(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
@@ -328,10 +284,10 @@ token_t	*au_to_exec_env(char *envs, int envc);
 token_t	*au_to_exec_args(char **argv);
 token_t	*au_to_exec_env(char **envp);
 #endif
-token_t	*au_to_text(char *text);
+token_t	*au_to_text(const char *text);
 token_t	*au_to_kevent(struct kevent *kev);
 token_t	*au_to_trailer(int rec_size);
-token_t	*au_to_zonename(char *zonename);
+token_t	*au_to_zonename(const char *zonename);
 
 __END_DECLS
 
diff --git a/sys/security/audit/audit_bsm_token.c b/sys/security/audit/audit_bsm_token.c
index ad9ffcc..b1d977d 100644
--- a/sys/security/audit/audit_bsm_token.c
+++ b/sys/security/audit/audit_bsm_token.c
@@ -1,5 +1,5 @@
 /*-
- * Copyright (c) 2004 Apple Inc.
+ * Copyright (c) 2004-2008 Apple Inc.
  * Copyright (c) 2005 SPARTA, Inc.
  * All rights reserved.
  *
@@ -29,6 +29,8 @@
  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
  * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  * POSSIBILITY OF SUCH DAMAGE.
+ *
+ * P4: //depot/projects/trustedbsd/openbsm/libbsm/bsm_token.c#72
  */
 
 #include <sys/cdefs.h>
@@ -71,7 +73,7 @@ __FBSDID("$FreeBSD$");
  * text                    N bytes + 1 terminating NULL byte
  */
 token_t *
-au_to_arg32(char n, char *text, u_int32_t v)
+au_to_arg32(char n, const char *text, u_int32_t v)
 {
 	token_t *t;
 	u_char *dptr = NULL;
@@ -90,11 +92,10 @@ au_to_arg32(char n, char *text, u_int32_t v)
 	ADD_STRING(dptr, text, textlen);
 
 	return (t);
-
 }
 
 token_t *
-au_to_arg64(char n, char *text, u_int64_t v)
+au_to_arg64(char n, const char *text, u_int64_t v)
 {
 	token_t *t;
 	u_char *dptr = NULL;
@@ -113,11 +114,10 @@ au_to_arg64(char n, char *text, u_int64_t v)
 	ADD_STRING(dptr, text, textlen);
 
 	return (t);
-
 }
 
 token_t *
-au_to_arg(char n, char *text, u_int32_t v)
+au_to_arg(char n, const char *text, u_int32_t v)
 {
 
 	return (au_to_arg32(n, text, v));
@@ -147,8 +147,8 @@ au_to_attr32(struct vnode_au_info *vni)
 	ADD_U_CHAR(dptr, AUT_ATTR32);
 
 	/*
-	 * Darwin defines the size for the file mode
-	 * as 2 bytes; BSM defines 4 so pad with 0
+	 * Darwin defines the size for the file mode as 2 bytes; BSM defines
+	 * 4 so pad with 0.
 	 */
 	ADD_U_INT16(dptr, pad0_16);
 	ADD_U_INT16(dptr, vni->vn_mode);
@@ -190,8 +190,8 @@ au_to_attr64(struct vnode_au_info *vni)
 	ADD_U_CHAR(dptr, AUT_ATTR64);
 
 	/*
-	 * Darwin defines the size for the file mode
-	 * as 2 bytes; BSM defines 4 so pad with 0
+	 * Darwin defines the size for the file mode as 2 bytes; BSM defines
+	 * 4 so pad with 0.
 	 */
 	ADD_U_INT16(dptr, pad0_16);
 	ADD_U_INT16(dptr, vni->vn_mode);
@@ -235,7 +235,7 @@ au_to_attr(struct vnode_au_info *vni)
  * data items              (depends on basic unit)
  */
 token_t *
-au_to_data(char unit_print, char unit_type, char unit_count, char *p)
+au_to_data(char unit_print, char unit_type, char unit_count, const char *p)
 {
 	token_t *t;
 	u_char *dptr = NULL;
@@ -305,7 +305,7 @@ token_t *
 au_to_groups(int *groups)
 {
 
-	return (au_to_newgroups(AUDIT_MAX_GROUPS, (gid_t*)groups));
+	return (au_to_newgroups(AUDIT_MAX_GROUPS, (gid_t *)groups));
 }
 
 /*
@@ -352,7 +352,7 @@ au_to_in_addr(struct in_addr *internet_addr)
 /*
  * token ID                1 byte
  * address type/length     4 bytes
- * Address                16 bytes
+ * address                16 bytes
  */
 token_t *
 au_to_in_addr_ex(struct in6_addr *internet_addr)
@@ -432,8 +432,8 @@ au_to_ipc_perm(struct ipc_perm *perm)
 	ADD_U_CHAR(dptr, AUT_IPC_PERM);
 
 	/*
-	 * Darwin defines the sizes for ipc_perm members
-	 * as 2 bytes; BSM defines 4 so pad with 0
+	 * Darwin defines the sizes for ipc_perm members as 2 bytes; BSM
+	 * defines 4 so pad with 0.
 	 */
 	ADD_U_INT16(dptr, pad0);
 	ADD_U_INT16(dptr, perm->uid);
@@ -482,7 +482,7 @@ au_to_iport(u_int16_t iport)
  * data                    size bytes
  */
 token_t *
-au_to_opaque(char *data, u_int16_t bytes)
+au_to_opaque(const char *data, u_int16_t bytes)
 {
 	token_t *t;
 	u_char *dptr = NULL;
@@ -504,7 +504,7 @@ au_to_opaque(char *data, u_int16_t bytes)
  * file pathname           N bytes + 1 terminating NULL byte
  */
 token_t *
-au_to_file(char *file, struct timeval tm)
+au_to_file(const char *file, struct timeval tm)
 {
 	token_t *t;
 	u_char *dptr = NULL;
@@ -534,7 +534,7 @@ au_to_file(char *file, struct timeval tm)
  * text                    N bytes + 1 terminating NULL byte
  */
 token_t *
-au_to_text(char *text)
+au_to_text(const char *text)
 {
 	token_t *t;
 	u_char *dptr = NULL;
@@ -558,7 +558,7 @@ au_to_text(char *text)
  * path                    N bytes + 1 terminating NULL byte
  */
 token_t *
-au_to_path(char *text)
+au_to_path(const char *text)
 {
 	token_t *t;
 	u_char *dptr = NULL;
@@ -657,7 +657,7 @@ au_to_process(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid, gid_t rgid,
  * terminal ID
  *   port ID               4 bytes/8 bytes (32-bit/64-bit value)
  *   address type-len      4 bytes
- *   machine address    4/16 bytes
+ *   machine address      16 bytes
  */
 token_t *
 au_to_process32_ex(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
@@ -668,12 +668,12 @@ au_to_process32_ex(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
 
 	KASSERT((tid->at_type == AU_IPv4) || (tid->at_type == AU_IPv6),
 	    ("au_to_process32_ex: type %u", (unsigned int)tid->at_type));
-	if (tid->at_type == AU_IPv6)
-		GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 13 *
-		    sizeof(u_int32_t));
+	if (tid->at_type == AU_IPv4)
+		GET_TOKEN_AREA(t, dptr, sizeof(u_char) +
+		    10 * sizeof(u_int32_t));
 	else
-		GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 10 *
-		    sizeof(u_int32_t));
+		GET_TOKEN_AREA(t, dptr, sizeof(u_char) +
+		    13 * sizeof(u_int32_t));
 
 	ADD_U_CHAR(dptr, AUT_PROCESS32_EX);
 	ADD_U_INT32(dptr, auid);
@@ -685,10 +685,12 @@ au_to_process32_ex(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
 	ADD_U_INT32(dptr, sid);
 	ADD_U_INT32(dptr, tid->at_port);
 	ADD_U_INT32(dptr, tid->at_type);
-        if (tid->at_type == AU_IPv6)
-                ADD_MEM(dptr, &tid->at_addr[0], 4 * sizeof(u_int32_t));
-        else
-                ADD_MEM(dptr, &tid->at_addr[0], sizeof(u_int32_t));
+	ADD_MEM(dptr, &tid->at_addr[0], sizeof(u_int32_t));
+	if (tid->at_type == AU_IPv6) {
+		ADD_MEM(dptr, &tid->at_addr[1], sizeof(u_int32_t));
+		ADD_MEM(dptr, &tid->at_addr[2], sizeof(u_int32_t));
+		ADD_MEM(dptr, &tid->at_addr[3], sizeof(u_int32_t));
+	}
 
 	return (t);
 }
@@ -831,7 +833,7 @@ kau_to_socket(struct socket_au_info *soi)
 	GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 2 * sizeof(u_int16_t) +
 	    sizeof(u_int32_t) + sizeof(u_int16_t) + sizeof(u_int32_t));
 						 
-	ADD_U_CHAR(dptr, AU_SOCK_TOKEN);
+	ADD_U_CHAR(dptr, AUT_SOCKET);
 	/* Coerce the socket type into a short value */
 	so_type = soi->so_type;
 	ADD_U_INT16(dptr, so_type);
@@ -883,7 +885,7 @@ au_to_sock_unix(struct sockaddr_un *so)
 
 	GET_TOKEN_AREA(t, dptr, 3 * sizeof(u_char) + strlen(so->sun_path) + 1);
 
-	ADD_U_CHAR(dptr, AU_SOCK_UNIX_TOKEN);
+	ADD_U_CHAR(dptr, AUT_SOCKUNIX);
 	/* BSM token has two bytes for family */
 	ADD_U_CHAR(dptr, 0);
 	ADD_U_CHAR(dptr, so->sun_family);
@@ -925,7 +927,6 @@ au_to_sock_inet32(struct sockaddr_in *so)
 	ADD_MEM(dptr, &so->sin_addr.s_addr, sizeof(uint32_t));
 
 	return (t);
-
 }
 
 token_t *
@@ -949,7 +950,6 @@ au_to_sock_inet128(struct sockaddr_in6 *so)
 	ADD_MEM(dptr, &so->sin6_addr, 4 * sizeof(uint32_t));
 
 	return (t);
-
 }
 
 token_t *
@@ -1040,7 +1040,7 @@ au_to_subject(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid, gid_t rgid,
  * terminal ID
  *   port ID               4 bytes/8 bytes (32-bit/64-bit value)
  *   address type/length   4 bytes
- *   machine address    4/16 bytes
+ *   machine address      16 bytes
  */
 token_t *
 au_to_subject32_ex(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
@@ -1051,11 +1051,12 @@ au_to_subject32_ex(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
 
 	KASSERT((tid->at_type == AU_IPv4) || (tid->at_type == AU_IPv6),
 	    ("au_to_subject32_ex: type %u", (unsigned int)tid->at_type));
-	if (tid->at_type == AU_IPv6)
-		GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 13 *
+
+	if (tid->at_type == AU_IPv4)
+		GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 10 *
 		    sizeof(u_int32_t));
 	else
-		GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 10 *
+		GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 13 *
 		    sizeof(u_int32_t));
 
 	ADD_U_CHAR(dptr, AUT_SUBJECT32_EX);
@@ -1068,9 +1069,9 @@ au_to_subject32_ex(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
 	ADD_U_INT32(dptr, sid);
 	ADD_U_INT32(dptr, tid->at_port);
 	ADD_U_INT32(dptr, tid->at_type);
-	if (tid->at_type == AU_IPv6)  
+	if (tid->at_type == AU_IPv6)
 		ADD_MEM(dptr, &tid->at_addr[0], 4 * sizeof(u_int32_t));
-	else    
+	else
 		ADD_MEM(dptr, &tid->at_addr[0], sizeof(u_int32_t));
 
 	return (t);
@@ -1083,17 +1084,17 @@ au_to_subject64_ex(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
 	token_t *t;
 	u_char *dptr = NULL;
 
+	KASSERT((tid->at_type == AU_IPv4) || (tid->at_type == AU_IPv6),
+	    ("au_to_subject64_ex: type %u", (unsigned int)tid->at_type));
+
 	if (tid->at_type == AU_IPv4)
 		GET_TOKEN_AREA(t, dptr, sizeof(u_char) +
 		    7 * sizeof(u_int32_t) + sizeof(u_int64_t) +
 		    2 * sizeof(u_int32_t));
-	else if (tid->at_type == AU_IPv6)
+	else
 		GET_TOKEN_AREA(t, dptr, sizeof(u_char) +
 		    7 * sizeof(u_int32_t) + sizeof(u_int64_t) +
 		    5 * sizeof(u_int32_t));
-	else
-		panic("au_to_subject64_ex: invalid at_type (%d)",
-		    tid->at_type);
 
 	ADD_U_CHAR(dptr, AUT_SUBJECT64_EX);
 	ADD_U_INT32(dptr, auid);
@@ -1124,8 +1125,8 @@ au_to_subject_ex(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
 
 #if !defined(_KERNEL) && !defined(KERNEL) && defined(HAVE_AUDIT_SYSCALLS)
 /*
- * Collects audit information for the current process
- * and creates a subject token from it
+ * Collects audit information for the current process and creates a subject
+ * token from it.
  */
 token_t *
 au_to_me(void)
@@ -1227,6 +1228,7 @@ au_to_exec_args(char **argv)
 
 	return (t);
 }
+#endif
 
 /*
  * token ID                1 byte
@@ -1234,7 +1236,7 @@ au_to_exec_args(char **argv)
  * zonename                N bytes + 1 terminating NULL byte
  */
 token_t *
-au_to_zonename(char *zonename)
+au_to_zonename(const char *zonename)
 {
 	u_char *dptr = NULL;
 	u_int16_t textlen;
@@ -1249,6 +1251,7 @@ au_to_zonename(char *zonename)
 	return (t);
 }
 
+#if !defined(_KERNEL) && !defined(KERNEL)
 /*
  * token ID				1 byte
  * count				4 bytes
@@ -1292,45 +1295,34 @@ au_to_exec_env(char **envp)
 /*
  * token ID                1 byte
  * record byte count       4 bytes
- * version #               1 byte
+ * version #               1 byte    [2]
  * event type              2 bytes
  * event modifier          2 bytes
- * address type/length     4 bytes
- * machine address         4 bytes/16 bytes (IPv4/IPv6 address)
- * seconds of time         4 bytes/8 bytes  (32/64-bits)
- * milliseconds of time    4 bytes/8 bytes  (32/64-bits) 
+ * seconds of time         4 bytes/8 bytes (32-bit/64-bit value)
+ * milliseconds of time    4 bytes/8 bytes (32-bit/64-bit value)
  */
 token_t *
-au_to_header32_ex_tm(int rec_size, au_event_t e_type, au_emod_t e_mod,
-    struct timeval tm, struct auditinfo_addr *aia)
+au_to_header32_tm(int rec_size, au_event_t e_type, au_emod_t e_mod,
+    struct timeval tm)
 {
-	token_t *t;  
+	token_t *t;
 	u_char *dptr = NULL;
 	u_int32_t timems;
-	struct au_tid_addr *tid;
-
-	tid = &aia->ai_termid;
-	KASSERT(tid->at_type == AU_IPv4 || tid->at_type == AU_IPv6,
-	    ("au_to_header32_ex_tm: invalid address family"));
 
 	GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int32_t) +
-	    sizeof(u_char) + 2 * sizeof(u_int16_t) + 3 * sizeof(u_int32_t) +
-	    tid->at_type);
+	    sizeof(u_char) + 2 * sizeof(u_int16_t) + 2 * sizeof(u_int32_t));
 
-	ADD_U_CHAR(dptr, AUT_HEADER32_EX);
+	ADD_U_CHAR(dptr, AUT_HEADER32);
 	ADD_U_INT32(dptr, rec_size);
 	ADD_U_CHAR(dptr, AUDIT_HEADER_VERSION_OPENBSM);
 	ADD_U_INT16(dptr, e_type);
 	ADD_U_INT16(dptr, e_mod);
-	ADD_U_INT32(dptr, tid->at_type);
-	if (tid->at_type == AU_IPv6)
-		ADD_MEM(dptr, &tid->at_addr[0], 4 * sizeof(u_int32_t));
-	else
-		ADD_MEM(dptr, &tid->at_addr[0], sizeof(u_int32_t));
-	timems = tm.tv_usec / 1000;
+
+	timems = tm.tv_usec/1000;
 	/* Add the timestamp */
 	ADD_U_INT32(dptr, tm.tv_sec);
-	ADD_U_INT32(dptr, timems);      /* We need time in ms. */
+	ADD_U_INT32(dptr, timems);	/* We need time in ms. */
+
 	return (t);
 }
 
@@ -1340,32 +1332,45 @@ au_to_header32_ex_tm(int rec_size, au_event_t e_type, au_emod_t e_mod,
  * version #               1 byte    [2]
  * event type              2 bytes
  * event modifier          2 bytes
+ * address type/length     4 bytes
+ * machine address         4 bytes/16 bytes (IPv4/IPv6 address)
  * seconds of time         4 bytes/8 bytes (32-bit/64-bit value)
  * milliseconds of time    4 bytes/8 bytes (32-bit/64-bit value)
  */
 token_t *
-au_to_header32_tm(int rec_size, au_event_t e_type, au_emod_t e_mod,
-    struct timeval tm)
+au_to_header32_ex_tm(int rec_size, au_event_t e_type, au_emod_t e_mod,
+    struct timeval tm, struct auditinfo_addr *aia)
 {
 	token_t *t;
 	u_char *dptr = NULL;
 	u_int32_t timems;
+	au_tid_addr_t *tid;
+
+	tid = &aia->ai_termid;
+	KASSERT(tid->at_type == AU_IPv4 || tid->at_type == AU_IPv6,
+	    ("au_to_header32_ex_tm: invalid address family"));
 
 	GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int32_t) +
-	    sizeof(u_char) + 2 * sizeof(u_int16_t) + 2 * sizeof(u_int32_t));
+	    sizeof(u_char) + 2 * sizeof(u_int16_t) + 3 *
+	    sizeof(u_int32_t) + tid->at_type);
 
-	ADD_U_CHAR(dptr, AUT_HEADER32);
+	ADD_U_CHAR(dptr, AUT_HEADER32_EX);
 	ADD_U_INT32(dptr, rec_size);
 	ADD_U_CHAR(dptr, AUDIT_HEADER_VERSION_OPENBSM);
 	ADD_U_INT16(dptr, e_type);
 	ADD_U_INT16(dptr, e_mod);
 
+	ADD_U_INT32(dptr, tid->at_type);
+	if (tid->at_type == AU_IPv6)
+		ADD_MEM(dptr, &tid->at_addr[0], 4 * sizeof(u_int32_t));
+	else
+		ADD_MEM(dptr, &tid->at_addr[0], sizeof(u_int32_t));
 	timems = tm.tv_usec/1000;
 	/* Add the timestamp */
 	ADD_U_INT32(dptr, tm.tv_sec);
-	ADD_U_INT32(dptr, timems);	/* We need time in ms. */
+	ADD_U_INT32(dptr, timems);      /* We need time in ms. */
 
-	return (t);
+	return (t);   
 }
 
 token_t *
@@ -1393,6 +1398,63 @@ au_to_header64_tm(int rec_size, au_event_t e_type, au_emod_t e_mod,
 	return (t);
 }
 
+#if !defined(KERNEL) && !defined(_KERNEL)
+#ifdef HAVE_AUDIT_SYSCALLS
+token_t *
+au_to_header32_ex(int rec_size, au_event_t e_type, au_emod_t e_mod)
+{
+	struct timeval tm;
+	struct auditinfo_addr aia;
+
+	if (gettimeofday(&tm, NULL) == -1)
+		return (NULL);
+	if (auditon(A_GETKAUDIT, &aia, sizeof(aia)) < 0) {
+		if (errno != ENOSYS)
+			return (NULL);
+		return (au_to_header32_tm(rec_size, e_type, e_mod, tm));
+	}
+	return (au_to_header32_ex_tm(rec_size, e_type, e_mod, tm, &aia));
+}
+#endif /* HAVE_AUDIT_SYSCALLS */
+
+token_t *
+au_to_header32(int rec_size, au_event_t e_type, au_emod_t e_mod)
+{
+	struct timeval tm;
+
+	if (gettimeofday(&tm, NULL) == -1)
+		return (NULL);
+	return (au_to_header32_tm(rec_size, e_type, e_mod, tm));
+}
+
+token_t *
+au_to_header64(__unused int rec_size, __unused au_event_t e_type,
+    __unused au_emod_t e_mod)
+{
+	struct timeval tm;
+
+	if (gettimeofday(&tm, NULL) == -1)
+		return (NULL);
+	return (au_to_header64_tm(rec_size, e_type, e_mod, tm));
+}
+
+token_t *
+au_to_header(int rec_size, au_event_t e_type, au_emod_t e_mod)
+{
+
+	return (au_to_header32(rec_size, e_type, e_mod));
+}
+
+#ifdef HAVE_AUDIT_SYSCALLS
+token_t *
+au_to_header_ex(int rec_size, au_event_t e_type, au_emod_t e_mod)
+{
+
+	return (au_to_header32_ex(rec_size, e_type, e_mod));
+}
+#endif /* HAVE_AUDIT_SYSCALLS */
+#endif /* !defined(KERNEL) && !defined(_KERNEL) */
+
 /*
  * token ID                1 byte
  * trailer magic number    2 bytes
diff --git a/usr.sbin/audit/Makefile b/usr.sbin/audit/Makefile
index ed195c0..9f31741 100644
--- a/usr.sbin/audit/Makefile
+++ b/usr.sbin/audit/Makefile
@@ -5,6 +5,8 @@
 OPENBSMDIR=${.CURDIR}/../../contrib/openbsm
 .PATH: ${OPENBSMDIR}/bin/audit
 
+CFLAGS+=	-I${OPENBSMDIR}
+
 PROG=	audit
 MAN=	audit.8
 
diff --git a/usr.sbin/auditd/Makefile b/usr.sbin/auditd/Makefile
index 7a28be2..114d89c 100644
--- a/usr.sbin/auditd/Makefile
+++ b/usr.sbin/auditd/Makefile
@@ -5,6 +5,8 @@
 OPENBSMDIR=${.CURDIR}/../../contrib/openbsm
 .PATH: ${OPENBSMDIR}/bin/auditd
 
+CFLAGS+=	-I${OPENBSMDIR}
+
 PROG=	auditd
 SRCS=	auditd.c audit_warn.c
 MAN=	auditd.8
author	rwatson <rwatson@FreeBSD.org>	2008-12-02 23:26:43 +0000
committer	rwatson <rwatson@FreeBSD.org>	2008-12-02 23:26:43 +0000
commit	0ac6f8ebdfebed8ad6c6fa1334d227524df2c013 (patch)
tree	909e4490f5c6d4141d466ad2fdf963beeb90afca
parent	1383cec09e16a1fb5117c67951f100e7931363e7 (diff)
parent	208cf4160e79a64866887cc5f89f964cc899f97e (diff)
download	FreeBSD-src-0ac6f8ebdfebed8ad6c6fa1334d227524df2c013.zip FreeBSD-src-0ac6f8ebdfebed8ad6c6fa1334d227524df2c013.tar.gz