diff options
author | rwatson <rwatson@FreeBSD.org> | 2009-03-02 13:29:18 +0000 |
---|---|---|
committer | rwatson <rwatson@FreeBSD.org> | 2009-03-02 13:29:18 +0000 |
commit | ee5318d5431890ccd7baeb15560b4bebe982525b (patch) | |
tree | e1a5bcd2b0eca50f696afbc416858fa574e50e8d /contrib/openbsm/bsm | |
parent | 5cacf7357664a8a200d2ba7bd7b8e820b681cd06 (diff) | |
download | FreeBSD-src-ee5318d5431890ccd7baeb15560b4bebe982525b.zip FreeBSD-src-ee5318d5431890ccd7baeb15560b4bebe982525b.tar.gz |
Merge OpenBSM 1.1 beta 1 from OpenBSM vendor branch to head, both
contrib/openbsm (svn merge) and src/sys/{bsm,security/audit} (manual
merge).
OpenBSM history for imported revision below for reference.
MFC after: 1 month
Sponsored by: Apple, Inc.
Obtained from: TrustedBSD Project
OpenBSM 1.1 beta 1
- The filesz parameter in audit_control(5) now accepts suffixes: 'B' for
Bytes, 'K' for Kilobytes, 'M' for Megabytes, and 'G' for Gigabytes.
For legacy support no suffix defaults to bytes.
- Audit trail log expiration support added. It is configured in
audit_control(5) with the expire-after parameter. If there is no
expire-after parameter in audit_control(5), the default, then the audit
trail files are not expired and removed. See audit_control(5) for
more information.
- Change defaults in audit_control: warn at 5% rather than 20% free for audit
partitions, rotate automatically at 2mb, and set the default policy to
cnt,argv rather than cnt so that execve(2) arguments are captured if
AUE_EXECVE events are audited. These may provide more usable defaults for
many users.
- Use au_domain_to_bsm(3) and au_socket_type_to_bsm(3) to convert
au_to_socket_ex(3) arguments to BSM format.
- Fix error encoding AUT_IPC_PERM tokens.
Diffstat (limited to 'contrib/openbsm/bsm')
-rw-r--r-- | contrib/openbsm/bsm/auditd_lib.h | 4 | ||||
-rw-r--r-- | contrib/openbsm/bsm/libbsm.h | 18 |
2 files changed, 13 insertions, 9 deletions
diff --git a/contrib/openbsm/bsm/auditd_lib.h b/contrib/openbsm/bsm/auditd_lib.h index 7c6ab40..087cb0c 100644 --- a/contrib/openbsm/bsm/auditd_lib.h +++ b/contrib/openbsm/bsm/auditd_lib.h @@ -26,7 +26,7 @@ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE * POSSIBILITY OF SUCH DAMAGE. * - * $P4: //depot/projects/trustedbsd/openbsm/bsm/auditd_lib.h#3 $ + * $P4: //depot/projects/trustedbsd/openbsm/bsm/auditd_lib.h#4 $ */ #ifndef _BSM_AUDITD_LIB_H_ @@ -81,12 +81,14 @@ #define ADE_INVAL -16 /* Invalid argument. */ #define ADE_GETADDR -17 /* Error resolving address from hostname. */ #define ADE_ADDRFAM -18 /* Address family not supported. */ +#define ADE_EXPIRE -19 /* Error expiring audit trail files. */ /* * auditd_lib functions. */ const char *auditd_strerror(int errcode); int auditd_set_minfree(void); +int auditd_expire_trails(int (*warn_expired)(char *)); int auditd_read_dirs(int (*warn_soft)(char *), int (*warn_hard)(char *)); void auditd_close_dirs(void); int auditd_set_evcmap(void); diff --git a/contrib/openbsm/bsm/libbsm.h b/contrib/openbsm/bsm/libbsm.h index 4e74f57..8713b4a 100644 --- a/contrib/openbsm/bsm/libbsm.h +++ b/contrib/openbsm/bsm/libbsm.h @@ -1,5 +1,5 @@ /*- - * Copyright (c) 2004-2008 Apple Inc. + * Copyright (c) 2004-2009 Apple Inc. * All rights reserved. * * Redistribution and use in source and binary forms, with or without @@ -26,7 +26,7 @@ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE * POSSIBILITY OF SUCH DAMAGE. * - * $P4: //depot/projects/trustedbsd/openbsm/bsm/libbsm.h#41 $ + * $P4: //depot/projects/trustedbsd/openbsm/bsm/libbsm.h#42 $ */ #ifndef _LIBBSM_H_ @@ -76,13 +76,14 @@ #define AUDIT_CONTROL_FILE "/etc/security/audit_control" #define AUDIT_USER_FILE "/etc/security/audit_user" -#define DIR_CONTROL_ENTRY "dir" -#define MINFREE_CONTROL_ENTRY "minfree" -#define FILESZ_CONTROL_ENTRY "filesz" -#define FLAGS_CONTROL_ENTRY "flags" -#define NA_CONTROL_ENTRY "naflags" -#define POLICY_CONTROL_ENTRY "policy" +#define DIR_CONTROL_ENTRY "dir" +#define MINFREE_CONTROL_ENTRY "minfree" +#define FILESZ_CONTROL_ENTRY "filesz" +#define FLAGS_CONTROL_ENTRY "flags" +#define NA_CONTROL_ENTRY "naflags" +#define POLICY_CONTROL_ENTRY "policy" #define AUDIT_HOST_CONTROL_ENTRY "host" +#define EXPIRE_AFTER_CONTROL_ENTRY "expire-after" #define AU_CLASS_NAME_MAX 8 #define AU_CLASS_DESC_MAX 72 @@ -766,6 +767,7 @@ int getacflg(char *auditstr, int len); int getacna(char *auditstr, int len); int getacpol(char *auditstr, size_t len); int getachost(char *auditstr, size_t len); +int getacexpire(int *andflg, time_t *age, size_t *size); int getauditflagsbin(char *auditstr, au_mask_t *masks); int getauditflagschar(char *auditstr, au_mask_t *masks, int verbose); |