summaryrefslogtreecommitdiffstats
path: root/contrib/openbsm
diff options
context:
space:
mode:
authorrwatson <rwatson@FreeBSD.org>2006-08-26 08:04:15 +0000
committerrwatson <rwatson@FreeBSD.org>2006-08-26 08:04:15 +0000
commitd2770d13eeb1d7e4187d36a4e10d0f71ef94ece9 (patch)
treebdaf5a00273583a385d5bf06c66ed291a0a57583 /contrib/openbsm
parent8f32cfe8b131fc8cb0b9d77bd247fcd389ff8662 (diff)
parent3dabba580bd939eae90efba54984d0c4de64eb3e (diff)
downloadFreeBSD-src-d2770d13eeb1d7e4187d36a4e10d0f71ef94ece9.zip
FreeBSD-src-d2770d13eeb1d7e4187d36a4e10d0f71ef94ece9.tar.gz
This commit was generated by cvs2svn to compensate for changes in r161630,
which included commits to RCS files with non-trunk default branches.
Diffstat (limited to 'contrib/openbsm')
-rw-r--r--contrib/openbsm/HISTORY30
-rw-r--r--contrib/openbsm/README4
-rw-r--r--contrib/openbsm/VERSION2
-rw-r--r--contrib/openbsm/bin/auditd/auditd.c4
-rw-r--r--contrib/openbsm/bin/auditfilterd/auditfilterd.c24
-rw-r--r--contrib/openbsm/bin/auditfilterd/auditfilterd.h6
-rw-r--r--contrib/openbsm/bin/auditfilterd/auditfilterd_conf.c44
-rw-r--r--contrib/openbsm/bsm/audit.h31
-rw-r--r--contrib/openbsm/bsm/audit_filter.h18
-rw-r--r--contrib/openbsm/bsm/audit_internal.h18
-rw-r--r--contrib/openbsm/bsm/audit_kevents.h302
-rw-r--r--contrib/openbsm/bsm/audit_record.h27
-rw-r--r--contrib/openbsm/bsm/libbsm.h35
-rw-r--r--contrib/openbsm/config/config.h.in3
-rwxr-xr-xcontrib/openbsm/configure25
-rw-r--r--contrib/openbsm/configure.ac6
-rw-r--r--contrib/openbsm/libbsm/au_token.36
-rw-r--r--contrib/openbsm/libbsm/bsm_audit.c32
-rw-r--r--contrib/openbsm/libbsm/bsm_event.c23
-rw-r--r--contrib/openbsm/libbsm/bsm_io.c10
-rw-r--r--contrib/openbsm/libbsm/bsm_token.c22
-rw-r--r--contrib/openbsm/man/audit.log.532
-rw-r--r--contrib/openbsm/modules/auditfilter_noop/auditfilter_noop.c6
-rw-r--r--contrib/openbsm/test/bsm/generate.c101
-rw-r--r--contrib/openbsm/tools/Makefile.am8
-rw-r--r--contrib/openbsm/tools/Makefile.in26
26 files changed, 532 insertions, 313 deletions
diff --git a/contrib/openbsm/HISTORY b/contrib/openbsm/HISTORY
index 946f2ff..18b9dca 100644
--- a/contrib/openbsm/HISTORY
+++ b/contrib/openbsm/HISTORY
@@ -1,3 +1,31 @@
+OpenBSM 1.0 alpha 9
+
+- Rename many OpenBSM-specific constants and API elements containing the
+ strings "BSM" and "bsm" to "AUDIT" and "audit", observing that this is true
+ for almost all existing constants and APIs.
+- Instead of passing a per-instance cookie directly into all audit filter
+ APIs, pass in the audit filter daemon state pointer, which is then used by
+ the module using an audit_filter_{get,set}cookie() API. This will allow
+ future service APIs provided by the filter daemon to maintain their own
+ state -- for example, per-module preselection state.
+
+OpenBSM 1.0 alpha 8
+
+- Correct typo in definition of AUR_INT.
+- Adopt OpenSolaris constant values for AUDIT_* configuration flags.
+- Arguments to au_to_exec_args() and au_to_exec_env() no longer const.
+- Add kernel versions of au_to_exec_args() and au_to_exec_env().
+- Fix exec argument type that is printed for env strings from 'arg' to 'env'.
+- New OpenBSM token version number assigned, constants added for other
+ commonly seen version numbers.
+- OpenBSM-specific events assigned numbers in the 43xxx range to avoid future
+ collisions with Solaris. Darwin events renamed to AUE_DARWIN_foo, as they
+ are now deprecated numberings.
+- autoconf now detects clock_gettime(), which is not available on Darwin.
+- praudit output fixes relating to arg32 and arg64 tokens.
+- Maximum record size updated to 64k-1 to match Solaris record size limit.
+- Various style and comment cleanups in include files.
+
OpenBSM 1.0 alpha 7
- Adopted Solaris-compatible format for subject32_ex and subject64_ex
@@ -175,4 +203,4 @@ OpenBSM 1.0 alpha 1
to support reloading of kernel event table.
- Allow comments in /etc/security configuration files.
-$P4: //depot/projects/trustedbsd/openbsm/HISTORY#15 $
+$P4: //depot/projects/trustedbsd/openbsm/HISTORY#25 $
diff --git a/contrib/openbsm/README b/contrib/openbsm/README
index a938d11..636dbee 100644
--- a/contrib/openbsm/README
+++ b/contrib/openbsm/README
@@ -74,6 +74,8 @@ to the development of OpenBSM:
Olivier Houchard
Christian Peron
Martin Fong
+ Pawel Worach
+ Martin Englund
In addition, Coverity, Inc.'s Prevent(tm) static analysis tool and Gimpel
Software's FlexeLint tool were used to identify a number of bugs in the
@@ -95,4 +97,4 @@ Information on TrustedBSD may be found on the TrustedBSD home page:
http://www.TrustedBSD.org/
-$P4: //depot/projects/trustedbsd/openbsm/README#17 $
+$P4: //depot/projects/trustedbsd/openbsm/README#19 $
diff --git a/contrib/openbsm/VERSION b/contrib/openbsm/VERSION
index fe14dbb..8d3fe66 100644
--- a/contrib/openbsm/VERSION
+++ b/contrib/openbsm/VERSION
@@ -1 +1 @@
-OPENBSM_1_0_ALPHA_7
+OPENBSM_1_0_ALPHA_9
diff --git a/contrib/openbsm/bin/auditd/auditd.c b/contrib/openbsm/bin/auditd/auditd.c
index edfe6c0..3996081 100644
--- a/contrib/openbsm/bin/auditd/auditd.c
+++ b/contrib/openbsm/bin/auditd/auditd.c
@@ -30,7 +30,7 @@
*
* @APPLE_BSD_LICENSE_HEADER_END@
*
- * $P4: //depot/projects/trustedbsd/openbsm/bin/auditd/auditd.c#16 $
+ * $P4: //depot/projects/trustedbsd/openbsm/bin/auditd/auditd.c#17 $
*/
#include <sys/types.h>
@@ -88,7 +88,7 @@ fail_exit(void)
* Free our local list of directory names.
*/
static void
-free_dir_q()
+free_dir_q(void)
{
struct dir_ent *dirent;
diff --git a/contrib/openbsm/bin/auditfilterd/auditfilterd.c b/contrib/openbsm/bin/auditfilterd/auditfilterd.c
index 5128af0..2723a97 100644
--- a/contrib/openbsm/bin/auditfilterd/auditfilterd.c
+++ b/contrib/openbsm/bin/auditfilterd/auditfilterd.c
@@ -25,7 +25,16 @@
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*
- * $P4: //depot/projects/trustedbsd/openbsm/bin/auditfilterd/auditfilterd.c#6 $
+ * $P4: //depot/projects/trustedbsd/openbsm/bin/auditfilterd/auditfilterd.c#9 $
+ */
+
+/*
+ * Main file for the audit filter daemon, which presents audit records to a
+ * set of run-time registered loadable modules. This is the main event loop
+ * of the daemon, which handles starting up, waiting for records, and
+ * presenting records to configured modules. auditfilterd_conf.c handles the
+ * reading and management of the configuration, module list and module state,
+ * etc.
*/
#include <sys/types.h>
@@ -106,13 +115,13 @@ signal_handler(int signum)
* Present raw BSM to a set of registered and interested filters.
*/
static void
-present_bsmrecord(struct timespec *ts, u_char *data, u_int len)
+present_rawrecord(struct timespec *ts, u_char *data, u_int len)
{
struct auditfilter_module *am;
TAILQ_FOREACH(am, &filter_list, am_list) {
- if (am->am_bsmrecord != NULL)
- (am->am_bsmrecord)(am->am_instance, ts, data, len);
+ if (am->am_rawrecord != NULL)
+ (am->am_rawrecord)(am, ts, data, len);
}
}
@@ -140,8 +149,7 @@ present_tokens(struct timespec *ts, u_char *data, u_int len)
TAILQ_FOREACH(am, &filter_list, am_list) {
if (am->am_record != NULL)
- (am->am_record)(am->am_instance, ts, tokencount,
- tokens);
+ (am->am_record)(am, ts, tokencount, tokens);
}
}
@@ -191,7 +199,7 @@ mainloop_file(const char *conffile, const char *trailfile, FILE *trail_fp)
continue;
if (clock_gettime(CLOCK_REALTIME, &ts) < 0)
err(-1, "clock_gettime");
- present_bsmrecord(&ts, buf, reclen);
+ present_rawrecord(&ts, buf, reclen);
present_tokens(&ts, buf, reclen);
free(buf);
}
@@ -241,7 +249,7 @@ mainloop_pipe(const char *conffile, const char *pipefile, int pipe_fd)
continue;
if (clock_gettime(CLOCK_REALTIME, &ts) < 0)
err(-1, "clock_gettime");
- present_bsmrecord(&ts, record, reclen);
+ present_rawrecord(&ts, record, reclen);
present_tokens(&ts, record, reclen);
}
}
diff --git a/contrib/openbsm/bin/auditfilterd/auditfilterd.h b/contrib/openbsm/bin/auditfilterd/auditfilterd.h
index 189c21f..d55aeee 100644
--- a/contrib/openbsm/bin/auditfilterd/auditfilterd.h
+++ b/contrib/openbsm/bin/auditfilterd/auditfilterd.h
@@ -25,7 +25,7 @@
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*
- * $P4: //depot/projects/trustedbsd/openbsm/bin/auditfilterd/auditfilterd.h#3 $
+ * $P4: //depot/projects/trustedbsd/openbsm/bin/auditfilterd/auditfilterd.h#5 $
*/
#define AUDITFILTERD_CONFFILE "/etc/security/audit_filter"
@@ -53,11 +53,11 @@ struct auditfilter_module {
/*
* Fields provided by or extracted from the module.
*/
- void *am_instance;
+ void *am_cookie;
audit_filter_attach_t am_attach;
audit_filter_reinit_t am_reinit;
audit_filter_record_t am_record;
- audit_filter_bsmrecord_t am_bsmrecord;
+ audit_filter_rawrecord_t am_rawrecord;
audit_filter_detach_t am_detach;
/*
diff --git a/contrib/openbsm/bin/auditfilterd/auditfilterd_conf.c b/contrib/openbsm/bin/auditfilterd/auditfilterd_conf.c
index 4e1759d..b0642fa 100644
--- a/contrib/openbsm/bin/auditfilterd/auditfilterd_conf.c
+++ b/contrib/openbsm/bin/auditfilterd/auditfilterd_conf.c
@@ -25,7 +25,7 @@
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*
- * $P4: //depot/projects/trustedbsd/openbsm/bin/auditfilterd/auditfilterd_conf.c#3 $
+ * $P4: //depot/projects/trustedbsd/openbsm/bin/auditfilterd/auditfilterd_conf.c#5 $
*/
/*
@@ -38,6 +38,12 @@
* Modules are in one of two states: attached, or detached. If attach fails,
* detach is not called because it was not attached. If a module is attached
* and a call to its reinit method fails, we will detach it.
+ *
+ * Modules are passed a (void *) reference to their configuration state so
+ * that they may pass this into any common APIs we provide which may rely on
+ * that state. Currently, the only such API is the cookie API, which allows
+ * per-instance state to be maintained by a module. In the future, this will
+ * also be used to support per-instance preselection state.
*/
#include <sys/types.h>
@@ -105,8 +111,8 @@ auditfilter_module_detach(struct auditfilter_module *am)
{
if (am->am_detach != NULL)
- am->am_detach(am->am_instance);
- am->am_instance = NULL;
+ am->am_detach(am);
+ am->am_cookie = NULL;
(void)dlclose(am->am_dlhandle);
am->am_dlhandle = NULL;
}
@@ -149,21 +155,22 @@ auditfilter_module_attach(struct auditfilter_module *am)
am->am_attach = dlsym(am->am_dlhandle, AUDIT_FILTER_ATTACH_STRING);
am->am_reinit = dlsym(am->am_dlhandle, AUDIT_FILTER_REINIT_STRING);
am->am_record = dlsym(am->am_dlhandle, AUDIT_FILTER_RECORD_STRING);
- am->am_bsmrecord = dlsym(am->am_dlhandle,
- AUDIT_FILTER_BSMRECORD_STRING);
+ am->am_rawrecord = dlsym(am->am_dlhandle,
+ AUDIT_FILTER_RAWRECORD_STRING);
am->am_detach = dlsym(am->am_dlhandle, AUDIT_FILTER_DETACH_STRING);
if (am->am_attach != NULL) {
- if (am->am_attach(&am->am_instance, am->am_argc, am->am_argv)
+ if (am->am_attach(am, am->am_argc, am->am_argv)
!= AUDIT_FILTER_SUCCESS) {
warnx("auditfilter_module_attach: %s: failed",
am->am_modulename);
dlclose(am->am_dlhandle);
am->am_dlhandle = NULL;
+ am->am_cookie = NULL;
am->am_attach = NULL;
am->am_reinit = NULL;
am->am_record = NULL;
- am->am_bsmrecord = NULL;
+ am->am_rawrecord = NULL;
am->am_detach = NULL;
return (-1);
}
@@ -184,7 +191,7 @@ auditfilter_module_reinit(struct auditfilter_module *am)
if (am->am_reinit == NULL)
return (0);
- if (am->am_reinit(&am->am_instance, am->am_argc, am->am_argv) !=
+ if (am->am_reinit(am, am->am_argc, am->am_argv) !=
AUDIT_FILTER_SUCCESS) {
warnx("auditfilter_module_reinit: %s: failed",
am->am_modulename);
@@ -483,3 +490,24 @@ auditfilterd_conf_shutdown(void)
auditfilter_module_list_detach(&filter_list);
auditfilter_module_list_free(&filter_list);
}
+
+/*
+ * APIs to allow modules to query and set their per-instance cookie.
+ */
+void
+audit_filter_getcookie(void *instance, void **cookie)
+{
+ struct auditfilter_module *am;
+
+ am = (struct auditfilter_module *)instance;
+ *cookie = am->am_cookie;
+}
+
+void
+audit_filter_setcookie(void *instance, void *cookie)
+{
+ struct auditfilter_module *am;
+
+ am = (struct auditfilter_module *)instance;
+ am->am_cookie = cookie;
+}
diff --git a/contrib/openbsm/bsm/audit.h b/contrib/openbsm/bsm/audit.h
index 1d05625..d67b853 100644
--- a/contrib/openbsm/bsm/audit.h
+++ b/contrib/openbsm/bsm/audit.h
@@ -30,7 +30,7 @@
*
* @APPLE_BSD_LICENSE_HEADER_END@
*
- * $P4: //depot/projects/trustedbsd/openbsm/bsm/audit.h#16 $
+ * $P4: //depot/projects/trustedbsd/openbsm/bsm/audit.h#19 $
*/
#ifndef _BSM_AUDIT_H
@@ -38,11 +38,12 @@
#define AUDIT_RECORD_MAGIC 0x828a0f1b
#define MAX_AUDIT_RECORDS 20
-#define MAX_AUDIT_RECORD_SIZE 4096
+#define MAXAUDITDATA (0x8000 - 1)
+#define MAX_AUDIT_RECORD_SIZE MAXAUDITDATA
#define MIN_AUDIT_FILE_SIZE (512 * 1024)
/*
- * Triggers for the audit daemon
+ * Triggers for the audit daemon.
*/
#define AUDIT_TRIGGER_MIN 1
#define AUDIT_TRIGGER_LOW_SPACE 1
@@ -53,7 +54,8 @@
#define AUDIT_TRIGGER_MAX 5
/*
- * File that will be read for trigger events from the kernel
+ * Special file that will be read for trigger events from the kernel
+ * (FreeBSD).
*/
#define AUDIT_TRIGGER_FILE "/dev/audit"
@@ -101,7 +103,7 @@
#define AU_ALL 0xffffffff
/*
- * IPC types
+ * IPC types.
*/
#define AT_IPC_MSG ((u_char)1) /* Message IPC id. */
#define AT_IPC_SEM ((u_char)2) /* Semaphore IPC id. */
@@ -150,16 +152,19 @@
#define AUDIT_AHLT 0x0002
#define AUDIT_ARGV 0x0004
#define AUDIT_ARGE 0x0008
-#define AUDIT_PASSWD 0x0010
-#define AUDIT_SEQ 0x0020
-#define AUDIT_WINDATA 0x0040
-#define AUDIT_USER 0x0080
-#define AUDIT_GROUP 0x0100
-#define AUDIT_TRAIL 0x0200
-#define AUDIT_PATH 0x0400
+#define AUDIT_SEQ 0x0010
+#define AUDIT_WINDATA 0x0020
+#define AUDIT_USER 0x0040
+#define AUDIT_GROUP 0x0080
+#define AUDIT_TRAIL 0x0100
+#define AUDIT_PATH 0x0200
+#define AUDIT_SCNT 0x0400
+#define AUDIT_PUBLIC 0x0800
+#define AUDIT_ZONENAME 0x1000
+#define AUDIT_PERZONE 0x2000
/*
- * Audit queue control parameters
+ * Audit queue control parameters.
*/
#define AQ_HIWATER 100
#define AQ_MAXHIGH 10000
diff --git a/contrib/openbsm/bsm/audit_filter.h b/contrib/openbsm/bsm/audit_filter.h
index 5b7dd4f..8a548f7 100644
--- a/contrib/openbsm/bsm/audit_filter.h
+++ b/contrib/openbsm/bsm/audit_filter.h
@@ -25,7 +25,7 @@
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*
- * $P4: //depot/projects/trustedbsd/openbsm/bsm/audit_filter.h#2 $
+ * $P4: //depot/projects/trustedbsd/openbsm/bsm/audit_filter.h#4 $
*/
#ifndef _BSM_AUDIT_FILTER_H_
@@ -38,22 +38,28 @@
* audit_filter_reinit_t - arguments to module have changed
* audit_filter_record_t - present parsed record to filter module, with
* receipt time
- * audit_filter_bsmrecord_t - present bsm format record to filter module,
+ * audit_filter_rawrecord_t - present BSM format record to filter module,
* with receipt time
* audit_filter_destach_t - filter module is being detached
*
* There may be many instances of the same filter, identified by the instance
* void pointer maintained by the filter instance.
*/
-typedef int (*audit_filter_attach_t)(void **instance, int argc, char *argv[]);
+typedef int (*audit_filter_attach_t)(void *instance, int argc, char *argv[]);
typedef int (*audit_filter_reinit_t)(void *instance, int argc, char *argv[]);
typedef void (*audit_filter_record_t)(void *instance, struct timespec *ts,
int token_count, const tokenstr_t tok[]);
-typedef void (*audit_filter_bsmrecord_t)(void *instance, struct timespec *ts,
+typedef void (*audit_filter_rawrecord_t)(void *instance, struct timespec *ts,
void *data, u_int len);
typedef void (*audit_filter_detach_t)(void *instance);
/*
+ * APIs that may be called by audit filters.
+ */
+void audit_filter_getcookie(void *instance, void **cookie);
+void audit_filter_setcookie(void *instance, void *cookie);
+
+/*
* Values to be returned by audit_filter_init_t.
*/
#define AUDIT_FILTER_SUCCESS (0)
@@ -66,12 +72,12 @@ typedef void (*audit_filter_detach_t)(void *instance);
#define AUDIT_FILTER_ATTACH audit_filter_attach
#define AUDIT_FILTER_REINIT audit_filter_reinit
#define AUDIT_FILTER_RECORD audit_filter_record
-#define AUDIT_FILTER_BSMRECORD audit_filter_bsmrecord
+#define AUDIT_FILTER_RAWRECORD audit_filter_rawrecord
#define AUDIT_FILTER_DETACH audit_filter_detach
#define AUDIT_FILTER_ATTACH_STRING "audit_filter_attach"
#define AUDIT_FILTER_REINIT_STRING "audit_filter_reinit"
#define AUDIT_FILTER_RECORD_STRING "audit_filter_record"
-#define AUDIT_FILTER_BSMRECORD_STRING "audit_filter_bsmrecord"
+#define AUDIT_FILTER_RAWRECORD_STRING "audit_filter_rawrecord"
#define AUDIT_FILTER_DETACH_STRING "audit_filter_detach"
#endif /* !_BSM_AUDIT_FILTER_H_ */
diff --git a/contrib/openbsm/bsm/audit_internal.h b/contrib/openbsm/bsm/audit_internal.h
index 00f44bf..97bafca 100644
--- a/contrib/openbsm/bsm/audit_internal.h
+++ b/contrib/openbsm/bsm/audit_internal.h
@@ -34,7 +34,7 @@
*
* @APPLE_BSD_LICENSE_HEADER_END@
*
- * $P4: //depot/projects/trustedbsd/openbsm/bsm/audit_internal.h#13 $
+ * $P4: //depot/projects/trustedbsd/openbsm/bsm/audit_internal.h#14 $
*/
#ifndef _AUDIT_INTERNAL_H
@@ -68,15 +68,15 @@ struct au_record {
typedef struct au_record au_record_t;
-/* We could determined the header and trailer sizes by
- * defining appropriate structures. We hold off that approach
- * till we have a consistant way of using structures for all tokens.
- * This is not straightforward since these token structures may
- * contain pointers of whose contents we dont know the size
- * (e.g text tokens)
+/*
+ * We could determined the header and trailer sizes by defining appropriate
+ * structures. We hold off that approach until we have a consistant way of
+ * using structures for all tokens. This is not straightforward since these
+ * token structures may contain pointers of whose contents we dont know the
+ * size (e.g text tokens).
*/
-#define BSM_HEADER_SIZE 18
-#define BSM_TRAILER_SIZE 7
+#define AUDIT_HEADER_SIZE 18
+#define AUDIT_TRAILER_SIZE 7
/*
* BSM token streams store fields in big endian byte order, so as to be
diff --git a/contrib/openbsm/bsm/audit_kevents.h b/contrib/openbsm/bsm/audit_kevents.h
index b323692..cd55883 100644
--- a/contrib/openbsm/bsm/audit_kevents.h
+++ b/contrib/openbsm/bsm/audit_kevents.h
@@ -30,7 +30,7 @@
*
* @APPLE_BSD_LICENSE_HEADER_END@
*
- * $P4: //depot/projects/trustedbsd/openbsm/bsm/audit_kevents.h#38 $
+ * $P4: //depot/projects/trustedbsd/openbsm/bsm/audit_kevents.h#40 $
*/
#ifndef _BSM_AUDIT_KEVENTS_H_
@@ -273,134 +273,200 @@
#define AUE_NTP_ADJTIME 288
/*
- * Events not present in OpenSolaris BSM, generally derived from Apple Darwin
- * BSM or added in OpenBSM. This start a little too close to the top end of
- * the OpenSolaris event list for my comfort.
+ * Events added for Apple Darwin that potentially collide with future Solaris
+ * BSM events. These are assigned AUE_DARWIN prefixes, and are deprecated in
+ * new trails. Systems generating these events should switch to the new
+ * identifiers that avoid colliding with the Solaris identifier space.
*/
-#define AUE_GETFSSTAT 301
-#define AUE_PTRACE 302
-#define AUE_CHFLAGS 303
-#define AUE_FCHFLAGS 304
-#define AUE_PROFILE 305
-#define AUE_KTRACE 306
-#define AUE_SETLOGIN 307
+#define AUE_DARWIN_GETFSSTAT 301
+#define AUE_DARWIN_PTRACE 302
+#define AUE_DARWIN_CHFLAGS 303
+#define AUE_DARWIN_FCHFLAGS 304
+#define AUE_DARWIN_PROFILE 305
+#define AUE_DARWIN_KTRACE 306
+#define AUE_DARWIN_SETLOGIN 307
#define AUE_DARWIN_REBOOT 308 /* XXX: See AUE_REBOOT. */
-#define AUE_REVOKE 309
-#define AUE_UMASK 310
-#define AUE_MPROTECT 311
+#define AUE_DARWIN_REVOKE 309
+#define AUE_DARWIN_UMASK 310
+#define AUE_DARWIN_MPROTECT 311
#define AUE_DARWIN_SETPRIORITY 312 /* XXX: See AUE_SETPRIORITY. */
#define AUE_DARWIN_SETTIMEOFDAY 313 /* XXX: See AUE_SETTIMEOFDAY. */
#define AUE_DARWIN_FLOCK 314 /* XXX: See AUE_FLOCK. */
-#define AUE_MKFIFO 315
-#define AUE_POLL 316
+#define AUE_DARWIN_MKFIFO 315
+#define AUE_DARWIN_POLL 316
#define AUE_DARWIN_SOCKETPAIR 317 /* XXXRW: See AUE_SOCKETPAIR. */
-#define AUE_FUTIMES 318
-#define AUE_SETSID 319
-#define AUE_SETPRIVEXEC 320 /* Darwin-specific. */
+#define AUE_DARWIN_FUTIMES 318
+#define AUE_DARWIN_SETSID 319
+#define AUE_DARWIN_SETPRIVEXEC 320 /* Darwin-specific. */
#define AUE_DARWIN_NFSSVC 321 /* XXX: See AUE_NFS_SVC. */
#define AUE_DARWIN_GETFH 322 /* XXX: See AUE_NFS_GETFH. */
#define AUE_DARWIN_QUOTACTL 323 /* XXX: See AUE_QUOTACTL. */
-#define AUE_ADDPROFILE 324 /* Darwin-specific. */
-#define AUE_KDEBUGTRACE 325 /* Darwin-specific. */
-#define AUE_KDBUGTRACE AUE_KDEBUGTRACE
-#define AUE_FSTAT 326
-#define AUE_FPATHCONF 327
-#define AUE_GETDIRENTRIES 328
+#define AUE_DARWIN_ADDPROFILE 324 /* Darwin-specific. */
+#define AUE_DARWIN_KDEBUGTRACE 325 /* Darwin-specific. */
+#define AUE_DARWIN_KDBUGTRACE AUE_KDEBUGTRACE
+#define AUE_DARWIN_FSTAT 326
+#define AUE_DARWIN_FPATHCONF 327
+#define AUE_DARWIN_GETDIRENTRIES 328
#define AUE_DARWIN_TRUNCATE 329 /* XXX: See AUE_TRUNCATE. */
#define AUE_DARWIN_FTRUNCATE 330 /* XXX: See AUE_FTRUNCATE. */
-#define AUE_SYSCTL 331
-#define AUE_MLOCK 332
-#define AUE_MUNLOCK 333
-#define AUE_UNDELETE 334
-#define AUE_GETATTRLIST 335 /* Darwin-specific. */
-#define AUE_SETATTRLIST 336 /* Darwin-specific. */
-#define AUE_GETDIRENTRIESATTR 337 /* Darwin-specific. */
-#define AUE_EXCHANGEDATA 338 /* Darwin-specific. */
-#define AUE_SEARCHFS 339 /* Darwin-specific. */
-#define AUE_MINHERIT 340
-#define AUE_SEMCONFIG 341
-#define AUE_SEMOPEN 342
-#define AUE_SEMCLOSE 343
-#define AUE_SEMUNLINK 344
-#define AUE_SHMOPEN 345
-#define AUE_SHMUNLINK 346
-#define AUE_LOADSHFILE 347 /* Darwin-specific. */
-#define AUE_RESETSHFILE 348 /* Darwin-specific. */
-#define AUE_NEWSYSTEMSHREG 349 /* Darwin-specific. */
-#define AUE_PTHREADKILL 350 /* Darwin-specific. */
-#define AUE_PTHREADSIGMASK 351 /* Darwin-specific. */
-#define AUE_AUDITCTL 352
-#define AUE_RFORK 353
-#define AUE_LCHMOD 354
-#define AUE_SWAPOFF 355
-#define AUE_INITPROCESS 356 /* Darwin-specific. */
-#define AUE_MAPFD 357 /* Darwin-specific. */
-#define AUE_TASKFORPID 358 /* Darwin-specific. */
-#define AUE_PIDFORTASK 359 /* Darwin-specific. */
-#define AUE_SYSCTL_NONADMIN 360
-#define AUE_COPYFILE 361 /* Darwin-specific. */
-#define AUE_LUTIMES 362
-#define AUE_LCHFLAGS 363 /* FreeBSD-specific. */
-#define AUE_SENDFILE 364 /* BSD/Linux-specific. */
-#define AUE_USELIB 365 /* Linux-specific. */
-#define AUE_GETRESUID 366
-#define AUE_SETRESUID 367
-#define AUE_GETRESGID 368
-#define AUE_SETRESGID 369
-#define AUE_WAIT4 370 /* FreeBSD-specific. */
-#define AUE_LGETFH 371 /* FreeBSD-specific. */
-#define AUE_FHSTATFS 372 /* FreeBSD-specific. */
-#define AUE_FHOPEN 373 /* FreeBSD-specific. */
-#define AUE_FHSTAT 374 /* FreeBSD-specific. */
-#define AUE_JAIL 375 /* FreeBSD-specific. */
-#define AUE_EACCESS 376 /* FreeBSD-specific. */
-#define AUE_KQUEUE 377 /* FreeBSD-specific. */
-#define AUE_KEVENT 378 /* FreeBSD-specific. */
-#define AUE_FSYNC 379
-#define AUE_NMOUNT 380 /* FreeBSD-specific. */
-#define AUE_BDFLUSH 381 /* Linux-specific. */
-#define AUE_SETFSUID 382 /* Linux-specific. */
-#define AUE_SETFSGID 383 /* Linux-specific. */
-#define AUE_PERSONALITY 384 /* Linux-specific. */
-#define AUE_SCHED_GETSCHEDULER 385 /* POSIX.1b. */
-#define AUE_SCHED_SETSCHEDULER 386 /* POSIX.1b. */
-#define AUE_PRCTL 387 /* Linux-specific. */
-#define AUE_GETCWD 388 /* FreeBSD/Linux-specific. */
-#define AUE_CAPGET 389 /* Linux-specific. */
-#define AUE_CAPSET 390 /* Linux-specific. */
-#define AUE_PIVOT_ROOT 391 /* Linux-specific. */
-#define AUE_RTPRIO 392 /* FreeBSD-specific. */
-#define AUE_SCHED_GETPARAM 393 /* POSIX.1b. */
-#define AUE_SCHED_SETPARAM 394 /* POSIX.1b. */
-#define AUE_SCHED_GET_PRIORITY_MAX 395 /* POSIX.1b. */
-#define AUE_SCHED_GET_PRIORITY_MIN 396 /* POSIX.1b. */
-#define AUE_SCHED_RR_GET_INTERVAL 397 /* POSIX.1b. */
-#define AUE_ACL_GET_FILE 398 /* FreeBSD. */
-#define AUE_ACL_SET_FILE 399 /* FreeBSD. */
-#define AUE_ACL_GET_FD 400 /* FreeBSD. */
-#define AUE_ACL_SET_FD 401 /* FreeBSD. */
-#define AUE_ACL_DELETE_FILE 402 /* FreeBSD. */
-#define AUE_ACL_DELETE_FD 403 /* FreeBSD. */
-#define AUE_ACL_CHECK_FILE 404 /* FreeBSD. */
-#define AUE_ACL_CHECK_FD 405 /* FreeBSD. */
-#define AUE_ACL_GET_LINK 406 /* FreeBSD. */
-#define AUE_ACL_SET_LINK 407 /* FreeBSD. */
-#define AUE_ACL_DELETE_LINK 408 /* FreeBSD. */
-#define AUE_ACL_CHECK_LINK 409 /* FreeBSD. */
-#define AUE_SYSARCH 410 /* FreeBSD. */
-#define AUE_EXTATTRCTL 411 /* FreeBSD. */
-#define AUE_EXTATTR_GET_FILE 412 /* FreeBSD. */
-#define AUE_EXTATTR_SET_FILE 413 /* FreeBSD. */
-#define AUE_EXTATTR_LIST_FILE 414 /* FreeBSD. */
-#define AUE_EXTATTR_DELETE_FILE 415 /* FreeBSD. */
-#define AUE_EXTATTR_GET_FD 416 /* FreeBSD. */
-#define AUE_EXTATTR_SET_FD 417 /* FreeBSD. */
-#define AUE_EXTATTR_LIST_FD 418 /* FreeBSD. */
-#define AUE_EXTATTR_DELETE_FD 419 /* FreeBSD. */
-#define AUE_EXTATTR_GET_LINK 420 /* FreeBSD. */
-#define AUE_EXTATTR_SET_LINK 421 /* FreeBSD. */
-#define AUE_EXTATTR_LIST_LINK 422 /* FreeBSD. */
-#define AUE_EXTATTR_DELETE_LINK 423 /* FreeBSD. */
+#define AUE_DARWIN_SYSCTL 331
+#define AUE_DARWIN_MLOCK 332
+#define AUE_DARWIN_MUNLOCK 333
+#define AUE_DARWIN_UNDELETE 334
+#define AUE_DARWIN_GETATTRLIST 335 /* Darwin-specific. */
+#define AUE_DARWIN_SETATTRLIST 336 /* Darwin-specific. */
+#define AUE_DARWIN_GETDIRENTRIESATTR 337 /* Darwin-specific. */
+#define AUE_DARWIN_EXCHANGEDATA 338 /* Darwin-specific. */
+#define AUE_DARWIN_SEARCHFS 339 /* Darwin-specific. */
+#define AUE_DARWIN_MINHERIT 340
+#define AUE_DARWIN_SEMCONFIG 341
+#define AUE_DARWIN_SEMOPEN 342
+#define AUE_DARWIN_SEMCLOSE 343
+#define AUE_DARWIN_SEMUNLINK 344
+#define AUE_DARWIN_SHMOPEN 345
+#define AUE_DARWIN_SHMUNLINK 346
+#define AUE_DARWIN_LOADSHFILE 347 /* Darwin-specific. */
+#define AUE_DARWIN_RESETSHFILE 348 /* Darwin-specific. */
+#define AUE_DARWIN_NEWSYSTEMSHREG 349 /* Darwin-specific. */
+#define AUE_DARWIN_PTHREADKILL 350 /* Darwin-specific. */
+#define AUE_DARWIN_PTHREADSIGMASK 351 /* Darwin-specific. */
+#define AUE_DARWIN_AUDITCTL 352
+#define AUE_DARWIN_RFORK 353
+#define AUE_DARWIN_LCHMOD 354
+#define AUE_DARWIN_SWAPOFF 355
+#define AUE_DARWIN_INITPROCESS 356 /* Darwin-specific. */
+#define AUE_DARWIN_MAPFD 357 /* Darwin-specific. */
+#define AUE_DARWIN_TASKFORPID 358 /* Darwin-specific. */
+#define AUE_DARWIN_PIDFORTASK 359 /* Darwin-specific. */
+#define AUE_DARWIN_SYSCTL_NONADMIN 360
+#define AUE_DARWIN_COPYFILE 361 /* Darwin-specific. */
+
+/*
+ * Audit event identifiers added as part of OpenBSM, generally corresponding
+ * to events in FreeBSD, Darwin, and Linux that were not present in Solaris.
+ * These often duplicate events added to the Solaris set by Darwin, but use
+ * event identifiers in a higher range in order to avoid colliding with
+ * future Solaris additions.
+ */
+#define AUE_GETFSSTAT 43001
+#define AUE_PTRACE 43002
+#define AUE_CHFLAGS 43003
+#define AUE_FCHFLAGS 43004
+#define AUE_PROFILE 43005
+#define AUE_KTRACE 43006
+#define AUE_SETLOGIN 43007
+#define AUE_REVOKE 43008
+#define AUE_UMASK 43009
+#define AUE_MPROTECT 43010
+#define AUE_MKFIFO 43011
+#define AUE_POLL 43012
+#define AUE_FUTIMES 43013
+#define AUE_SETSID 43014
+#define AUE_SETPRIVEXEC 43015 /* Darwin-specific. */
+#define AUE_ADDPROFILE 43016 /* Darwin-specific. */
+#define AUE_KDEBUGTRACE 43017 /* Darwin-specific. */
+#define AUE_KDBUGTRACE AUE_KDEBUGTRACE
+#define AUE_FSTAT 43018
+#define AUE_FPATHCONF 43019
+#define AUE_GETDIRENTRIES 43020
+#define AUE_SYSCTL 43021
+#define AUE_MLOCK 43022
+#define AUE_MUNLOCK 43023
+#define AUE_UNDELETE 43024
+#define AUE_GETATTRLIST 43025 /* Darwin-specific. */
+#define AUE_SETATTRLIST 43026 /* Darwin-specific. */
+#define AUE_GETDIRENTRIESATTR 43027 /* Darwin-specific. */
+#define AUE_EXCHANGEDATA 43028 /* Darwin-specific. */
+#define AUE_SEARCHFS 43029 /* Darwin-specific. */
+#define AUE_MINHERIT 43030
+#define AUE_SEMCONFIG 43031
+#define AUE_SEMOPEN 43032
+#define AUE_SEMCLOSE 43033
+#define AUE_SEMUNLINK 43034
+#define AUE_SHMOPEN 43035
+#define AUE_SHMUNLINK 43036
+#define AUE_LOADSHFILE 43037 /* Darwin-specific. */
+#define AUE_RESETSHFILE 43038 /* Darwin-specific. */
+#define AUE_NEWSYSTEMSHREG 43039 /* Darwin-specific. */
+#define AUE_PTHREADKILL 43040 /* Darwin-specific. */
+#define AUE_PTHREADSIGMASK 43041 /* Darwin-specific. */
+#define AUE_AUDITCTL 43042
+#define AUE_RFORK 43043
+#define AUE_LCHMOD 43044
+#define AUE_SWAPOFF 43045
+#define AUE_INITPROCESS 43046 /* Darwin-specific. */
+#define AUE_MAPFD 43047 /* Darwin-specific. */
+#define AUE_TASKFORPID 43048 /* Darwin-specific. */
+#define AUE_PIDFORTASK 43049 /* Darwin-specific. */
+#define AUE_SYSCTL_NONADMIN 43050
+#define AUE_COPYFILE 43051 /* Darwin-specific. */
+
+/*
+ * Events added to OpenBSM for FreeBSD and Linux; may also be used by Darwin
+ * in the future.
+ */
+#define AUE_LUTIMES 43052
+#define AUE_LCHFLAGS 43053 /* FreeBSD-specific. */
+#define AUE_SENDFILE 43054 /* BSD/Linux-specific. */
+#define AUE_USELIB 43055 /* Linux-specific. */
+#define AUE_GETRESUID 43056
+#define AUE_SETRESUID 43057
+#define AUE_GETRESGID 43058
+#define AUE_SETRESGID 43059
+#define AUE_WAIT4 43060 /* FreeBSD-specific. */
+#define AUE_LGETFH 43061 /* FreeBSD-specific. */
+#define AUE_FHSTATFS 43062 /* FreeBSD-specific. */
+#define AUE_FHOPEN 43063 /* FreeBSD-specific. */
+#define AUE_FHSTAT 43064 /* FreeBSD-specific. */
+#define AUE_JAIL 43065 /* FreeBSD-specific. */
+#define AUE_EACCESS 43066 /* FreeBSD-specific. */
+#define AUE_KQUEUE 43067 /* FreeBSD-specific. */
+#define AUE_KEVENT 43068 /* FreeBSD-specific. */
+#define AUE_FSYNC 43069
+#define AUE_NMOUNT 43070 /* FreeBSD-specific. */
+#define AUE_BDFLUSH 43071 /* Linux-specific. */
+#define AUE_SETFSUID 43072 /* Linux-specific. */
+#define AUE_SETFSGID 43073 /* Linux-specific. */
+#define AUE_PERSONALITY 43074 /* Linux-specific. */
+#define AUE_SCHED_GETSCHEDULER 43075 /* POSIX.1b. */
+#define AUE_SCHED_SETSCHEDULER 43076 /* POSIX.1b. */
+#define AUE_PRCTL 43077 /* Linux-specific. */
+#define AUE_GETCWD 43078 /* FreeBSD/Linux-specific. */
+#define AUE_CAPGET 43079 /* Linux-specific. */
+#define AUE_CAPSET 43080 /* Linux-specific. */
+#define AUE_PIVOT_ROOT 43081 /* Linux-specific. */
+#define AUE_RTPRIO 43082 /* FreeBSD-specific. */
+#define AUE_SCHED_GETPARAM 43083 /* POSIX.1b. */
+#define AUE_SCHED_SETPARAM 43084 /* POSIX.1b. */
+#define AUE_SCHED_GET_PRIORITY_MAX 43085 /* POSIX.1b. */
+#define AUE_SCHED_GET_PRIORITY_MIN 43086 /* POSIX.1b. */
+#define AUE_SCHED_RR_GET_INTERVAL 43087 /* POSIX.1b. */
+#define AUE_ACL_GET_FILE 43088 /* FreeBSD. */
+#define AUE_ACL_SET_FILE 43089 /* FreeBSD. */
+#define AUE_ACL_GET_FD 43090 /* FreeBSD. */
+#define AUE_ACL_SET_FD 43091 /* FreeBSD. */
+#define AUE_ACL_DELETE_FILE 43092 /* FreeBSD. */
+#define AUE_ACL_DELETE_FD 43093 /* FreeBSD. */
+#define AUE_ACL_CHECK_FILE 43094 /* FreeBSD. */
+#define AUE_ACL_CHECK_FD 43095 /* FreeBSD. */
+#define AUE_ACL_GET_LINK 43096 /* FreeBSD. */
+#define AUE_ACL_SET_LINK 43097 /* FreeBSD. */
+#define AUE_ACL_DELETE_LINK 43098 /* FreeBSD. */
+#define AUE_ACL_CHECK_LINK 43099 /* FreeBSD. */
+#define AUE_SYSARCH 43100 /* FreeBSD. */
+#define AUE_EXTATTRCTL 43101 /* FreeBSD. */
+#define AUE_EXTATTR_GET_FILE 43102 /* FreeBSD. */
+#define AUE_EXTATTR_SET_FILE 43103 /* FreeBSD. */
+#define AUE_EXTATTR_LIST_FILE 43104 /* FreeBSD. */
+#define AUE_EXTATTR_DELETE_FILE 43105 /* FreeBSD. */
+#define AUE_EXTATTR_GET_FD 43106 /* FreeBSD. */
+#define AUE_EXTATTR_SET_FD 43107 /* FreeBSD. */
+#define AUE_EXTATTR_LIST_FD 43108 /* FreeBSD. */
+#define AUE_EXTATTR_DELETE_FD 43109 /* FreeBSD. */
+#define AUE_EXTATTR_GET_LINK 43110 /* FreeBSD. */
+#define AUE_EXTATTR_SET_LINK 43111 /* FreeBSD. */
+#define AUE_EXTATTR_LIST_LINK 43112 /* FreeBSD. */
+#define AUE_EXTATTR_DELETE_LINK 43113 /* FreeBSD. */
/*
* Darwin BSM uses a number of AUE_O_* definitions, which are aliased to the
diff --git a/contrib/openbsm/bsm/audit_record.h b/contrib/openbsm/bsm/audit_record.h
index f9c0288..79d13c3 100644
--- a/contrib/openbsm/bsm/audit_record.h
+++ b/contrib/openbsm/bsm/audit_record.h
@@ -30,7 +30,7 @@
*
* @APPLE_BSD_LICENSE_HEADER_END@
*
- * $P4: //depot/projects/trustedbsd/openbsm/bsm/audit_record.h#19 $
+ * $P4: //depot/projects/trustedbsd/openbsm/bsm/audit_record.h#23 $
*/
#ifndef _BSM_AUDIT_RECORD_H_
@@ -184,7 +184,7 @@
#define AUR_CHAR AUR_BYTE
#define AUR_SHORT 1
#define AUR_INT32 2
-#define AUR_INT AUR_INT
+#define AUR_INT AUR_INT32
#define AUR_INT64 3
/* ... and their sizes */
@@ -199,9 +199,19 @@
#define PAD_NOTATTR 0x4000 /* nonattributable event */
#define PAD_FAILURE 0x8000 /* fail audit event */
+#define AUDIT_MAX_GROUPS 16
-#define BSM_MAX_GROUPS 16
-#define HEADER_VERSION 1
+/*
+ * A number of BSM versions are floating around and defined. Here are
+ * constants for them. OpenBSM uses the same token types, etc, used in the
+ * Solaris BSM version, but has a separate version number in order to
+ * identify a potentially different event identifier name space.
+ */
+#define AUDIT_HEADER_VERSION_OLDDARWIN 1 /* In retrospect, a mistake. */
+#define AUDIT_HEADER_VERSION_SOLARIS 2
+#define AUDIT_HEADER_VERSION_TSOL25 3
+#define AUDIT_HEADER_VERSION_TSOL 4
+#define AUDIT_HEADER_VERSION_OPENBSM 10
/*
* BSM define is AUT_TRAILER_MAGIC; Apple BSM define is TRAILER_PAD_MAGIC; we
@@ -308,8 +318,13 @@ token_t *au_to_subject32_ex(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
gid_t rgid, pid_t pid, au_asid_t sid, au_tid_addr_t *tid);
token_t *au_to_subject64_ex(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
gid_t rgid, pid_t pid, au_asid_t sid, au_tid_addr_t *tid);
-token_t *au_to_exec_args(const char **);
-token_t *au_to_exec_env(const char **);
+#if defined(_KERNEL) || defined(KERNEL)
+token_t *au_to_exec_args(char *args, int argc);
+token_t *au_to_exec_env(char *envs, int envc);
+#else
+token_t *au_to_exec_args(char **argv);
+token_t *au_to_exec_env(char **envp);
+#endif
token_t *au_to_text(char *text);
token_t *au_to_kevent(struct kevent *kev);
token_t *au_to_trailer(int rec_size);
diff --git a/contrib/openbsm/bsm/libbsm.h b/contrib/openbsm/bsm/libbsm.h
index 2efdace..5fea48c 100644
--- a/contrib/openbsm/bsm/libbsm.h
+++ b/contrib/openbsm/bsm/libbsm.h
@@ -26,7 +26,7 @@
* IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*
- * $P4: //depot/projects/trustedbsd/openbsm/bsm/libbsm.h#21 $
+ * $P4: //depot/projects/trustedbsd/openbsm/bsm/libbsm.h#27 $
*/
#ifndef _LIBBSM_H_
@@ -37,8 +37,8 @@
* solely to allow OpenSSH to compile; Darwin/Apple code should not use them.
*/
-#define MAX_ARGS 10
-#define MAX_ENV 10
+#define AUDIT_MAX_ARGS 10
+#define AUDIT_MAX_ENV 10
#include <sys/types.h>
#include <sys/cdefs.h>
@@ -82,11 +82,10 @@
#define BSM_TEXTBUFSZ MAX_AUDITSTRING_LEN /* OpenSSH compatibility */
/*
- * These are referenced in Solaris 9 au_open(3BSM); values are guesses.
- * Provided for OpenSSH compatibility.
+ * Arguments to au_close(3).
*/
-#define AU_TO_NO_WRITE 0
-#define AU_TO_WRITE 1
+#define AU_TO_NO_WRITE 0 /* Abandon audit record. */
+#define AU_TO_WRITE 1 /* Commit audit record. */
__BEGIN_DECLS
struct au_event_ent {
@@ -138,15 +137,6 @@ __END_DECLS
__BEGIN_DECLS
-/*
- * Internal representation of audit user in libnsl.
- */
-typedef struct au_user_str_s {
- char *au_name;
- char *au_always;
- char *au_never;
-} au_user_str_t;
-
typedef struct au_tid32 {
u_int32_t port;
u_int32_t addr;
@@ -228,7 +218,7 @@ typedef struct {
*/
typedef struct {
u_int32_t count;
- char *text[MAX_ARGS];
+ char *text[AUDIT_MAX_ARGS];
} au_execarg_t;
/*
@@ -237,7 +227,7 @@ typedef struct {
*/
typedef struct {
u_int32_t count;
- char *text[MAX_ENV];
+ char *text[AUDIT_MAX_ENV];
} au_execenv_t;
/*
@@ -269,7 +259,7 @@ typedef struct {
*/
typedef struct {
u_int16_t no;
- u_int32_t list[BSM_MAX_GROUPS];
+ u_int32_t list[AUDIT_MAX_GROUPS];
} au_groups_t;
/*
@@ -729,8 +719,6 @@ int au_preselect(au_event_t event, au_mask_t *mask_p,
/*
* Functions relating to querying audit event information.
- *
- * XXXRW: getauevnonam() has no _r version?
*/
void setauevent(void);
void endauevent(void);
@@ -770,6 +758,11 @@ void au_print_tok(FILE *outfp, tokenstr_t *tok,
char *del, char raw, char sfrm);
__END_DECLS
+/*
+ * The remaining APIs are associated with Apple's BSM implementation, in
+ * particular as relates to Mach IPC auditing and triggers passed via Mach
+ * IPC.
+ */
#ifdef __APPLE__
#include <sys/appleapiopts.h>
diff --git a/contrib/openbsm/config/config.h.in b/contrib/openbsm/config/config.h.in
index 59615b4..bc53efc 100644
--- a/contrib/openbsm/config/config.h.in
+++ b/contrib/openbsm/config/config.h.in
@@ -12,6 +12,9 @@
/* Define to 1 if your system has a working `chown' function. */
#undef HAVE_CHOWN
+/* Define to 1 if you have the `clock_gettime' function. */
+#undef HAVE_CLOCK_GETTIME
+
/* Define to 1 if you have the <dlfcn.h> header file. */
#undef HAVE_DLFCN_H
diff --git a/contrib/openbsm/configure b/contrib/openbsm/configure
index c73a001..c7e1c35 100755
--- a/contrib/openbsm/configure
+++ b/contrib/openbsm/configure
@@ -1,7 +1,7 @@
#! /bin/sh
-# From configure.ac P4: //depot/projects/trustedbsd/openbsm/configure.ac#23 .
+# From configure.ac P4: //depot/projects/trustedbsd/openbsm/configure.ac#27 .
# Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.59 for OpenBSM 1.0a7.
+# Generated by GNU Autoconf 2.59 for OpenBSM 1.0a9.
#
# Report bugs to <trustedbsd-audit@TrustesdBSD.org>.
#
@@ -424,8 +424,8 @@ SHELL=${CONFIG_SHELL-/bin/sh}
# Identity of this package.
PACKAGE_NAME='OpenBSM'
PACKAGE_TARNAME='openbsm'
-PACKAGE_VERSION='1.0a7'
-PACKAGE_STRING='OpenBSM 1.0a7'
+PACKAGE_VERSION='1.0a9'
+PACKAGE_STRING='OpenBSM 1.0a9'
PACKAGE_BUGREPORT='trustedbsd-audit@TrustesdBSD.org'
ac_unique_file="bin/auditreduce/auditreduce.c"
@@ -955,7 +955,7 @@ if test "$ac_init_help" = "long"; then
# Omit some internal or obsolete options to make the list less imposing.
# This message is too long to be a string in the A/UX 3.1 sh.
cat <<_ACEOF
-\`configure' configures OpenBSM 1.0a7 to adapt to many kinds of systems.
+\`configure' configures OpenBSM 1.0a9 to adapt to many kinds of systems.
Usage: $0 [OPTION]... [VAR=VALUE]...
@@ -1021,7 +1021,7 @@ fi
if test -n "$ac_init_help"; then
case $ac_init_help in
- short | recursive ) echo "Configuration of OpenBSM 1.0a7:";;
+ short | recursive ) echo "Configuration of OpenBSM 1.0a9:";;
esac
cat <<\_ACEOF
@@ -1162,7 +1162,7 @@ fi
test -n "$ac_init_help" && exit 0
if $ac_init_version; then
cat <<\_ACEOF
-OpenBSM configure 1.0a7
+OpenBSM configure 1.0a9
generated by GNU Autoconf 2.59
Copyright (C) 2003 Free Software Foundation, Inc.
@@ -1176,7 +1176,7 @@ cat >&5 <<_ACEOF
This file contains any messages produced by compilers while
running configure, to aid debugging if configure makes a mistake.
-It was created by OpenBSM $as_me 1.0a7, which was
+It was created by OpenBSM $as_me 1.0a9, which was
generated by GNU Autoconf 2.59. Invocation command line was
$ $0 $@
@@ -19278,7 +19278,7 @@ fi
# Define the identity of the package.
PACKAGE=OpenBSM
- VERSION=1.0a7
+ VERSION=1.0a9
cat >>confdefs.h <<_ACEOF
@@ -22833,7 +22833,8 @@ done
-for ac_func in bzero ftruncate gettimeofday inet_ntoa memset strchr strerror strrchr strstr strtol strtoul
+
+for ac_func in bzero clock_gettime ftruncate gettimeofday inet_ntoa memset strchr strerror strrchr strstr strtol strtoul
do
as_ac_var=`echo "ac_cv_func_$ac_func" | $as_tr_sh`
echo "$as_me:$LINENO: checking for $ac_func" >&5
@@ -23477,7 +23478,7 @@ _ASBOX
} >&5
cat >&5 <<_CSEOF
-This file was extended by OpenBSM $as_me 1.0a7, which was
+This file was extended by OpenBSM $as_me 1.0a9, which was
generated by GNU Autoconf 2.59. Invocation command line was
CONFIG_FILES = $CONFIG_FILES
@@ -23540,7 +23541,7 @@ _ACEOF
cat >>$CONFIG_STATUS <<_ACEOF
ac_cs_version="\\
-OpenBSM config.status 1.0a7
+OpenBSM config.status 1.0a9
configured by $0, generated by GNU Autoconf 2.59,
with options \\"`echo "$ac_configure_args" | sed 's/[\\""\`\$]/\\\\&/g'`\\"
diff --git a/contrib/openbsm/configure.ac b/contrib/openbsm/configure.ac
index 48dd95e..9302b2a 100644
--- a/contrib/openbsm/configure.ac
+++ b/contrib/openbsm/configure.ac
@@ -2,8 +2,8 @@
# Process this file with autoconf to produce a configure script.
AC_PREREQ(2.59)
-AC_INIT([OpenBSM], [1.0a7], [trustedbsd-audit@TrustesdBSD.org],[openbsm])
-AC_REVISION([$P4: //depot/projects/trustedbsd/openbsm/configure.ac#24 $])
+AC_INIT([OpenBSM], [1.0a9], [trustedbsd-audit@TrustesdBSD.org],[openbsm])
+AC_REVISION([$P4: //depot/projects/trustedbsd/openbsm/configure.ac#28 $])
AC_CONFIG_SRCDIR([bin/auditreduce/auditreduce.c])
AC_CONFIG_AUX_DIR(config)
AC_CONFIG_HEADER([config/config.h])
@@ -56,7 +56,7 @@ AC_FUNC_MKTIME
AC_TYPE_SIGNAL
AC_FUNC_STAT
AC_FUNC_STRFTIME
-AC_CHECK_FUNCS([bzero ftruncate gettimeofday inet_ntoa memset strchr strerror strrchr strstr strtol strtoul])
+AC_CHECK_FUNCS([bzero clock_gettime ftruncate gettimeofday inet_ntoa memset strchr strerror strrchr strstr strtol strtoul])
# sys/queue.h exists on most systems, but its capabilities vary a great deal.
# test for LIST_FIRST and TAILQ_FOREACH_SAFE, which appears to not exist in
diff --git a/contrib/openbsm/libbsm/au_token.3 b/contrib/openbsm/libbsm/au_token.3
index 5b2ad30..384a5b8 100644
--- a/contrib/openbsm/libbsm/au_token.3
+++ b/contrib/openbsm/libbsm/au_token.3
@@ -23,7 +23,7 @@
.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
.\" SUCH DAMAGE.
.\"
-.\" $P4: //depot/projects/trustedbsd/openbsm/libbsm/au_token.3#7 $
+.\" $P4: //depot/projects/trustedbsd/openbsm/libbsm/au_token.3#8 $
.\"
.Dd April 19, 2005
.Dt AU_TOKEN 3
@@ -155,9 +155,9 @@
.Ft token_t *
.Fn au_to_me "void"
.Ft token_t *
-.Fn au_to_exec_args "const char **args"
+.Fn au_to_exec_args "char **argv"
.Ft token_t *
-.Fn au_to_exec_env "const char **env"
+.Fn au_to_exec_env "char **envp"
.Ft token_t *
.Fn au_to_header "int rec_size" "au_event_t e_type" "au_emod_t emod"
.Ft token_t *
diff --git a/contrib/openbsm/libbsm/bsm_audit.c b/contrib/openbsm/libbsm/bsm_audit.c
index d959a30..2f6df41 100644
--- a/contrib/openbsm/libbsm/bsm_audit.c
+++ b/contrib/openbsm/libbsm/bsm_audit.c
@@ -30,7 +30,7 @@
* IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*
- * $P4: //depot/projects/trustedbsd/openbsm/libbsm/bsm_audit.c#26 $
+ * $P4: //depot/projects/trustedbsd/openbsm/libbsm/bsm_audit.c#28 $
*/
#include <sys/types.h>
@@ -54,14 +54,14 @@
static au_record_t *open_desc_table[MAX_AUDIT_RECORDS];
/* The current number of active record descriptors */
-static int bsm_rec_count = 0;
+static int audit_rec_count = 0;
/*
* Records that can be recycled are maintained in the list given below. The
* maximum number of elements that can be present in this list is bounded by
* MAX_AUDIT_RECORDS. Memory allocated for these records are never freed.
*/
-static LIST_HEAD(, au_record) bsm_free_q;
+static LIST_HEAD(, au_record) audit_free_q;
static pthread_mutex_t mutex = PTHREAD_MUTEX_INITIALIZER;
@@ -93,15 +93,15 @@ au_open(void)
pthread_mutex_lock(&mutex);
- if (bsm_rec_count == 0)
- LIST_INIT(&bsm_free_q);
+ if (audit_rec_count == 0)
+ LIST_INIT(&audit_free_q);
/*
* Find an unused descriptor, remove it from the free list, mark as
* used.
*/
- if (!LIST_EMPTY(&bsm_free_q)) {
- rec = LIST_FIRST(&bsm_free_q);
+ if (!LIST_EMPTY(&audit_free_q)) {
+ rec = LIST_FIRST(&audit_free_q);
rec->used = 1;
LIST_REMOVE(rec, au_rec_q);
}
@@ -125,7 +125,7 @@ au_open(void)
pthread_mutex_lock(&mutex);
- if (bsm_rec_count == MAX_AUDIT_RECORDS) {
+ if (audit_rec_count == MAX_AUDIT_RECORDS) {
pthread_mutex_unlock(&mutex);
free(rec->data);
free(rec);
@@ -134,9 +134,9 @@ au_open(void)
errno = ENOMEM;
return (-1);
}
- rec->desc = bsm_rec_count;
- open_desc_table[bsm_rec_count] = rec;
- bsm_rec_count++;
+ rec->desc = audit_rec_count;
+ open_desc_table[audit_rec_count] = rec;
+ audit_rec_count++;
pthread_mutex_unlock(&mutex);
@@ -174,7 +174,7 @@ au_write(int d, token_t *tok)
return (-1); /* Invalid descriptor */
}
- if (rec->len + tok->len + BSM_TRAILER_SIZE > MAX_AUDIT_RECORD_SIZE) {
+ if (rec->len + tok->len + AUDIT_TRAILER_SIZE > MAX_AUDIT_RECORD_SIZE) {
errno = ENOMEM;
return (-1);
}
@@ -208,7 +208,7 @@ au_assemble(au_record_t *rec, short event)
u_char *dptr;
int error;
- tot_rec_size = rec->len + BSM_HEADER_SIZE + BSM_TRAILER_SIZE;
+ tot_rec_size = rec->len + AUDIT_HEADER_SIZE + AUDIT_TRAILER_SIZE;
header = au_to_header32(tot_rec_size, event, 0);
if (header == NULL)
return (-1);
@@ -257,7 +257,7 @@ au_teardown(au_record_t *rec)
pthread_mutex_lock(&mutex);
/* Add the record to the freelist tail */
- LIST_INSERT_HEAD(&bsm_free_q, rec, au_rec_q);
+ LIST_INSERT_HEAD(&audit_free_q, rec, au_rec_q);
pthread_mutex_unlock(&mutex);
}
@@ -285,7 +285,7 @@ au_close(int d, int keep, short event)
goto cleanup;
}
- tot_rec_size = rec->len + BSM_HEADER_SIZE + BSM_TRAILER_SIZE;
+ tot_rec_size = rec->len + AUDIT_HEADER_SIZE + AUDIT_TRAILER_SIZE;
if (tot_rec_size > MAX_AUDIT_RECORD_SIZE) {
/*
@@ -335,7 +335,7 @@ au_close_buffer(int d, short event, u_char *buffer, size_t *buflen)
}
retval = 0;
- tot_rec_size = rec->len + BSM_HEADER_SIZE + BSM_TRAILER_SIZE;
+ tot_rec_size = rec->len + AUDIT_HEADER_SIZE + AUDIT_TRAILER_SIZE;
if ((tot_rec_size > MAX_AUDIT_RECORD_SIZE) ||
(tot_rec_size > *buflen)) {
/*
diff --git a/contrib/openbsm/libbsm/bsm_event.c b/contrib/openbsm/libbsm/bsm_event.c
index 6e22e4c..6dd4db4 100644
--- a/contrib/openbsm/libbsm/bsm_event.c
+++ b/contrib/openbsm/libbsm/bsm_event.c
@@ -27,7 +27,7 @@
* IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*
- * $P4: //depot/projects/trustedbsd/openbsm/libbsm/bsm_event.c#11 $
+ * $P4: //depot/projects/trustedbsd/openbsm/libbsm/bsm_event.c#12 $
*/
#include <bsm/libbsm.h>
@@ -62,27 +62,32 @@ eventfromstr(char *str, struct au_event_ent *e)
evdesc = strtok_r(NULL, eventdelim, &last);
evclass = strtok_r(NULL, eventdelim, &last);
- if ((evno == NULL) || (evname == NULL) || (evdesc == NULL) ||
- (evclass == NULL))
+ if ((evno == NULL) || (evname == NULL))
return (NULL);
if (strlen(evname) >= AU_EVENT_NAME_MAX)
return (NULL);
strcpy(e->ae_name, evname);
- if (strlen(evdesc) >= AU_EVENT_DESC_MAX)
- return (NULL);
- strcpy(e->ae_desc, evdesc);
+ if (evdesc != NULL) {
+ if (strlen(evdesc) >= AU_EVENT_DESC_MAX)
+ return (NULL);
+ strcpy(e->ae_desc, evdesc);
+ } else
+ strcpy(e->ae_desc, "");
e->ae_number = atoi(evno);
/*
* Find out the mask that corresponds to the given list of classes.
*/
- if (getauditflagsbin(evclass, &evmask) != 0)
+ if (evclass != NULL) {
+ if (getauditflagsbin(evclass, &evmask) != 0)
+ e->ae_class = AU_NULL;
+ else
+ e->ae_class = evmask.am_success;
+ } else
e->ae_class = AU_NULL;
- else
- e->ae_class = evmask.am_success;
return (e);
}
diff --git a/contrib/openbsm/libbsm/bsm_io.c b/contrib/openbsm/libbsm/bsm_io.c
index 5f678fb..30639e6 100644
--- a/contrib/openbsm/libbsm/bsm_io.c
+++ b/contrib/openbsm/libbsm/bsm_io.c
@@ -31,7 +31,7 @@
* IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*
- * $P4: //depot/projects/trustedbsd/openbsm/libbsm/bsm_io.c#37 $
+ * $P4: //depot/projects/trustedbsd/openbsm/libbsm/bsm_io.c#40 $
*/
#include <sys/types.h>
@@ -820,7 +820,7 @@ print_arg32_tok(FILE *fp, tokenstr_t *tok, char *del, char raw,
print_delim(fp, del);
print_1_byte(fp, tok->tt.arg32.no, "%u");
print_delim(fp, del);
- print_4_bytes(fp, tok->tt.arg32.val, "%#x");
+ print_4_bytes(fp, tok->tt.arg32.val, "0x%x");
print_delim(fp, del);
print_string(fp, tok->tt.arg32.text, tok->tt.arg32.len);
}
@@ -859,7 +859,7 @@ print_arg64_tok(FILE *fp, tokenstr_t *tok, char *del, char raw,
print_delim(fp, del);
print_1_byte(fp, tok->tt.arg64.no, "%u");
print_delim(fp, del);
- print_8_bytes(fp, tok->tt.arg64.val, "%#llx");
+ print_8_bytes(fp, tok->tt.arg64.val, "0x%llx");
print_delim(fp, del);
print_string(fp, tok->tt.arg64.text, tok->tt.arg64.len);
}
@@ -1259,7 +1259,7 @@ print_execenv_tok(FILE *fp, tokenstr_t *tok, char *del, char raw,
{
int i;
- print_tok_type(fp, tok->id, "exec arg", raw);
+ print_tok_type(fp, tok->id, "exec env", raw);
for (i = 0; i< tok->tt.execenv.count; i++) {
print_delim(fp, del);
print_string(fp, tok->tt.execenv.text[i],
@@ -2448,7 +2448,7 @@ fetch_invalid_tok(tokenstr_t *tok, char *buf, int len)
int err = 0;
int recoversize;
- recoversize = len - (tok->len + BSM_TRAILER_SIZE);
+ recoversize = len - (tok->len + AUDIT_TRAILER_SIZE);
if (recoversize <= 0)
return (-1);
diff --git a/contrib/openbsm/libbsm/bsm_token.c b/contrib/openbsm/libbsm/bsm_token.c
index 7512c42..f90cbc9 100644
--- a/contrib/openbsm/libbsm/bsm_token.c
+++ b/contrib/openbsm/libbsm/bsm_token.c
@@ -30,7 +30,7 @@
* IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*
- * $P4: //depot/projects/trustedbsd/openbsm/libbsm/bsm_token.c#48 $
+ * $P4: //depot/projects/trustedbsd/openbsm/libbsm/bsm_token.c#51 $
*/
#include <sys/types.h>
@@ -309,7 +309,7 @@ token_t *
au_to_groups(int *groups)
{
- return (au_to_newgroups(BSM_MAX_GROUPS, groups));
+ return (au_to_newgroups(AUDIT_MAX_GROUPS, groups));
}
/*
@@ -1055,7 +1055,7 @@ au_to_me(void)
* text count null-terminated strings
*/
token_t *
-au_to_exec_args(const char **args)
+au_to_exec_args(char **argv)
{
token_t *t;
u_char *dptr = NULL;
@@ -1063,7 +1063,7 @@ au_to_exec_args(const char **args)
int i, count = 0;
size_t totlen = 0;
- nextarg = *args;
+ nextarg = *argv;
while (nextarg != NULL) {
int nextlen;
@@ -1071,7 +1071,7 @@ au_to_exec_args(const char **args)
nextlen = strlen(nextarg);
totlen += nextlen + 1;
count++;
- nextarg = *(args + count);
+ nextarg = *(argv + count);
}
totlen += count * sizeof(char); /* nul terminations. */
@@ -1083,7 +1083,7 @@ au_to_exec_args(const char **args)
ADD_U_INT32(dptr, count);
for (i = 0; i < count; i++) {
- nextarg = *(args + i);
+ nextarg = *(argv + i);
ADD_MEM(dptr, nextarg, strlen(nextarg) + 1);
}
@@ -1096,7 +1096,7 @@ au_to_exec_args(const char **args)
* text count null-terminated strings
*/
token_t *
-au_to_exec_env(const char **env)
+au_to_exec_env(char **envp)
{
token_t *t;
u_char *dptr = NULL;
@@ -1104,7 +1104,7 @@ au_to_exec_env(const char **env)
size_t totlen = 0;
const char *nextenv;
- nextenv = *env;
+ nextenv = *envp;
while (nextenv != NULL) {
int nextlen;
@@ -1112,7 +1112,7 @@ au_to_exec_env(const char **env)
nextlen = strlen(nextenv);
totlen += nextlen + 1;
count++;
- nextenv = *(env + count);
+ nextenv = *(envp + count);
}
totlen += sizeof(char) * count;
@@ -1124,7 +1124,7 @@ au_to_exec_env(const char **env)
ADD_U_INT32(dptr, count);
for (i = 0; i < count; i++) {
- nextenv = *(env + i);
+ nextenv = *(envp + i);
ADD_MEM(dptr, nextenv, strlen(nextenv) + 1);
}
@@ -1155,7 +1155,7 @@ au_to_header32_tm(int rec_size, au_event_t e_type, au_emod_t e_mod,
ADD_U_CHAR(dptr, AUT_HEADER32);
ADD_U_INT32(dptr, rec_size);
- ADD_U_CHAR(dptr, HEADER_VERSION);
+ ADD_U_CHAR(dptr, AUDIT_HEADER_VERSION_OPENBSM);
ADD_U_INT16(dptr, e_type);
ADD_U_INT16(dptr, e_mod);
diff --git a/contrib/openbsm/man/audit.log.5 b/contrib/openbsm/man/audit.log.5
index b53b1fc..f6e28ab 100644
--- a/contrib/openbsm/man/audit.log.5
+++ b/contrib/openbsm/man/audit.log.5
@@ -1,5 +1,5 @@
.\"-
-.\" Copyright (c) 2005 Robert N. M. Watson
+.\" Copyright (c) 2005-2006 Robert N. M. Watson
.\" All rights reserved.
.\"
.\" Redistribution and use in source and binary forms, with or without
@@ -23,7 +23,7 @@
.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
.\" SUCH DAMAGE.
.\"
-.\" $P4: //depot/projects/trustedbsd/openbsm/man/audit.log.5#9 $
+.\" $P4: //depot/projects/trustedbsd/openbsm/man/audit.log.5#10 $
.\"
.Dd May 1, 2005
.Dt AUDIT.LOG 5
@@ -91,10 +91,14 @@ The
token is used to mark the beginning of a complete audit record, and includes
the length of the total record in bytes, a version number for the record
layout, the event type and subtype, and the time at which the event occurred.
-A
+A 32-bit
+.Dv header
+token can be created using
+.Xr au_to_header32 3 ;
+a 64-bit
.Dv header
token can be created using
-.Xr au_to_header32 3 .
+.Xr au_to_header64 3 .
.Bl -column -offset ind ".Sy Field Name Width XX" ".Sy XX Bytes XXXX" ".Sy Description"
.It Sy "Field" Ta Sy Bytes Ta Sy Description
.It Li "Token ID" Ta "1 byte" Ta "Token ID"
@@ -111,11 +115,14 @@ The
token is an expanded version of the
.Dv header
token, with the addition of a machine IPv4 or IPv6 address.
-The
-.Xr libbsm 3
-API cannot currently create an
-.Dv expanded header
-token.
+A 32-bit extended
+.Dv header
+token can be created using
+.Xr au_to_header32_ex 3 ;
+a 64-bit extended
+.Dv header
+token can be created using
+.Xr au_to_header64_ex 3 .
.Bl -column -offset ind ".Sy Field Name Width XX" ".Sy XX Bytes XXXX" ".Sy Description"
.It Sy "Field" Ta Sy Bytes Ta Sy Description
.It Li "Token ID" Ta "1 byte" Ta "Token ID"
@@ -154,11 +161,10 @@ A
.Dv How to print
field is present to specify how to print the data, but interpretation of
that field is not currently defined.
-The
-.Xr libbsm 3
-API cannot currently create an
+An
.Dv arbitrary data
-token.
+token can be created using
+.Xr au_to_data 3 .
.Bl -column -offset ind ".Sy Field Name Width XX" ".Sy XX Bytes XXXX" ".Sy Description"
.It Sy "Field" Ta Sy Bytes Ta Sy Description
.It Li "Token ID" Ta "1 byte" Ta "Token ID"
diff --git a/contrib/openbsm/modules/auditfilter_noop/auditfilter_noop.c b/contrib/openbsm/modules/auditfilter_noop/auditfilter_noop.c
index 1bac0b3..1db9856 100644
--- a/contrib/openbsm/modules/auditfilter_noop/auditfilter_noop.c
+++ b/contrib/openbsm/modules/auditfilter_noop/auditfilter_noop.c
@@ -25,7 +25,7 @@
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*
- * $P4: //depot/projects/trustedbsd/openbsm/modules/auditfilter_noop/auditfilter_noop.c#2 $
+ * $P4: //depot/projects/trustedbsd/openbsm/modules/auditfilter_noop/auditfilter_noop.c#4 $
*/
/*
@@ -39,7 +39,7 @@
#include <bsm/audit_filter.h>
int
-AUDIT_FILTER_ATTACH(void **instance, int argc, char *argv[])
+AUDIT_FILTER_ATTACH(void *instance, int argc, char *argv[])
{
return (0);
@@ -60,7 +60,7 @@ AUDIT_FILTER_RECORD(void *instance, struct timespec *ts, int token_count,
}
void
-AUDIT_FILTER_BSMRECORD(void *instance, struct timespec *ts, u_char *data,
+AUDIT_FILTER_RAWRECORD(void *instance, struct timespec *ts, u_char *data,
u_int len)
{
diff --git a/contrib/openbsm/test/bsm/generate.c b/contrib/openbsm/test/bsm/generate.c
index 12bc462..3a299b5 100644
--- a/contrib/openbsm/test/bsm/generate.c
+++ b/contrib/openbsm/test/bsm/generate.c
@@ -23,7 +23,7 @@
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*
- * $P4: //depot/projects/trustedbsd/openbsm/test/bsm/generate.c#4 $
+ * $P4: //depot/projects/trustedbsd/openbsm/test/bsm/generate.c#5 $
*/
/*
@@ -144,6 +144,17 @@ generate_file_token(const char *directory, const char *token_filename)
write_token(directory, token_filename, file_token);
}
+static void
+generate_file_record(const char *directory, const char *record_filename)
+{
+ token_t *file_token;
+
+ file_token = au_to_file("test", file_token_timeval);
+ if (file_token == NULL)
+ err(EX_UNAVAILABLE, "au_to_file");
+ write_record(directory, record_filename, file_token, AUE_NULL);
+}
+
/*
* AUT_OHEADER
*/
@@ -326,6 +337,32 @@ generate_subject32ex_token(const char *directory, const char *token_filename,
write_token(directory, buf, subject32ex_token);
}
+static void
+generate_subject32ex_record(const char *directory, const char *record_filename,
+ u_int32_t type)
+{
+ token_t *subject32ex_token;
+ char *buf;
+
+ buf = (char *)malloc(strlen(record_filename) + 6);
+ if (type == AU_IPv6) {
+ inet_pton(AF_INET6, "fe80::1", subject32_tid_addr.at_addr);
+ subject32_tid_addr.at_type = AU_IPv6;
+ sprintf(buf, "%s%s", record_filename, "-IPv6");
+ } else {
+ subject32_tid_addr.at_addr[0] = inet_addr("127.0.0.1");
+ subject32_tid_addr.at_type = AU_IPv4;
+ sprintf(buf, "%s%s", record_filename, "-IPv4");
+ }
+
+ subject32ex_token = au_to_subject32_ex(subject32_auid, subject32_euid,
+ subject32_egid, subject32_ruid, subject32_rgid, subject32_pid,
+ subject32_sid, &subject32_tid_addr);
+ if (subject32ex_token == NULL)
+ err(EX_UNAVAILABLE, "au_to_subject32_ex");
+ write_record(directory, record_filename, subject32ex_token, AUE_NULL);
+}
+
static au_id_t process32_auid = 0x12345678;
static uid_t process32_euid = 0x01234567;
static gid_t process32_egid = 0x23456789;
@@ -382,6 +419,22 @@ generate_process32ex_token(const char *directory, const char *token_filename)
write_token(directory, token_filename, process32ex_token);
}
+static void
+generate_process32ex_record(const char *directory, const char *record_filename)
+{
+ token_t *process32ex_token;
+
+ process32_tid_addr.at_addr[0] = inet_addr("127.0.0.1");
+ process32_tid_addr.at_type = AU_IPv4;
+
+ process32ex_token = au_to_process32_ex(process32_auid, process32_euid,
+ process32_egid, process32_ruid, process32_rgid, process32_pid,
+ process32_sid, &process32_tid_addr);
+ if (process32ex_token == NULL)
+ err(EX_UNAVAILABLE, "au_to_process32_ex");
+ write_record(directory, record_filename, process32ex_token, AUE_NULL);
+}
+
static char return32_status = 0xd7;
static uint32_t return32_ret = 0x12345678;
@@ -777,29 +830,29 @@ main(int argc, char *argv[])
}
if (do_records) {
- generate_file_token(directory, "file_token");
- generate_trailer_token(directory, "trailer_token");
- generate_header32_token(directory, "header32_token");
- generate_data_token(directory, "data_record");
- generate_ipc_token(directory, "ipc_record");
- generate_path_token(directory, "path_record");
- generate_subject32_token(directory, "subject32_record");
- generate_subject32ex_token(directory, "subject32ex_record", AU_IPv4);
- generate_subject32ex_token(directory, "subject32ex_record", AU_IPv6);
- generate_process32_token(directory, "process32_record");
- generate_process32ex_token(directory, "process32ex_token");
- generate_return32_token(directory, "return32_record");
- generate_text_token(directory, "text_record");
- generate_opaque_token(directory, "opaque_record");
- generate_in_addr_token(directory, "in_addr_record");
- generate_ip_token(directory, "ip_record");
- generate_iport_token(directory, "iport_record");
- generate_arg32_token(directory, "arg32_record");
- generate_seq_token(directory, "seq_record");
- generate_attr_token(directory, "attr_record");
- generate_ipc_perm_token(directory, "ipc_perm_record");
- generate_groups_token(directory, "groups_record");
- generate_attr32_token(directory, "attr32_record");
+ generate_file_record(directory, "file_record");
+ generate_data_record(directory, "data_record");
+ generate_ipc_record(directory, "ipc_record");
+ generate_path_record(directory, "path_record");
+ generate_subject32_record(directory, "subject32_record");
+ generate_subject32ex_record(directory, "subject32ex_record",
+ AU_IPv4);
+ generate_subject32ex_record(directory, "subject32ex_record",
+ AU_IPv6);
+ generate_process32_record(directory, "process32_record");
+ generate_process32ex_record(directory, "process32ex_record");
+ generate_return32_record(directory, "return32_record");
+ generate_text_record(directory, "text_record");
+ generate_opaque_record(directory, "opaque_record");
+ generate_in_addr_record(directory, "in_addr_record");
+ generate_ip_record(directory, "ip_record");
+ generate_iport_record(directory, "iport_record");
+ generate_arg32_record(directory, "arg32_record");
+ generate_seq_record(directory, "seq_record");
+ generate_attr_record(directory, "attr_record");
+ generate_ipc_perm_record(directory, "ipc_perm_record");
+ generate_groups_record(directory, "groups_record");
+ generate_attr32_record(directory, "attr32_record");
}
return (0);
diff --git a/contrib/openbsm/tools/Makefile.am b/contrib/openbsm/tools/Makefile.am
index 2ca8c75..53aa1d5 100644
--- a/contrib/openbsm/tools/Makefile.am
+++ b/contrib/openbsm/tools/Makefile.am
@@ -1,9 +1,9 @@
#
-# $P4: //depot/projects/trustedbsd/openbsm/tools/Makefile.am#1 $
+# $P4: //depot/projects/trustedbsd/openbsm/tools/Makefile.am#2 $
#
INCLUDES = -I$(top_srcdir)
-bin_PROGRAMS = autool
-autool_SOURCES = autool.c
-autool_LDADD = $(top_builddir)/libbsm/libbsm.la
+bin_PROGRAMS = audump
+audump_SOURCES = audump.c
+audump_LDADD = $(top_builddir)/libbsm/libbsm.la
diff --git a/contrib/openbsm/tools/Makefile.in b/contrib/openbsm/tools/Makefile.in
index f3d7b5c..a121149 100644
--- a/contrib/openbsm/tools/Makefile.in
+++ b/contrib/openbsm/tools/Makefile.in
@@ -15,7 +15,7 @@
@SET_MAKE@
#
-# $P4: //depot/projects/trustedbsd/openbsm/tools/Makefile.in#3 $
+# $P4: //depot/projects/trustedbsd/openbsm/tools/Makefile.in#4 $
#
srcdir = @srcdir@
@@ -40,7 +40,7 @@ PRE_UNINSTALL = :
POST_UNINSTALL = :
build_triplet = @build@
host_triplet = @host@
-bin_PROGRAMS = autool$(EXEEXT)
+bin_PROGRAMS = audump$(EXEEXT)
subdir = tools
DIST_COMMON = $(srcdir)/Makefile.am $(srcdir)/Makefile.in
ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
@@ -53,9 +53,9 @@ CONFIG_CLEAN_FILES =
am__installdirs = "$(DESTDIR)$(bindir)"
binPROGRAMS_INSTALL = $(INSTALL_PROGRAM)
PROGRAMS = $(bin_PROGRAMS)
-am_autool_OBJECTS = autool.$(OBJEXT)
-autool_OBJECTS = $(am_autool_OBJECTS)
-autool_DEPENDENCIES = $(top_builddir)/libbsm/libbsm.la
+am_audump_OBJECTS = audump.$(OBJEXT)
+audump_OBJECTS = $(am_audump_OBJECTS)
+audump_DEPENDENCIES = $(top_builddir)/libbsm/libbsm.la
DEFAULT_INCLUDES = -I. -I$(srcdir) -I$(top_builddir)/config
depcomp = $(SHELL) $(top_srcdir)/config/depcomp
am__depfiles_maybe = depfiles
@@ -67,8 +67,8 @@ LTCOMPILE = $(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) \
CCLD = $(CC)
LINK = $(LIBTOOL) --tag=CC --mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) \
$(AM_LDFLAGS) $(LDFLAGS) -o $@
-SOURCES = $(autool_SOURCES)
-DIST_SOURCES = $(autool_SOURCES)
+SOURCES = $(audump_SOURCES)
+DIST_SOURCES = $(audump_SOURCES)
ETAGS = etags
CTAGS = ctags
DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
@@ -174,8 +174,8 @@ sharedstatedir = @sharedstatedir@
sysconfdir = @sysconfdir@
target_alias = @target_alias@
INCLUDES = -I$(top_srcdir)
-autool_SOURCES = autool.c
-autool_LDADD = $(top_builddir)/libbsm/libbsm.la
+audump_SOURCES = audump.c
+audump_LDADD = $(top_builddir)/libbsm/libbsm.la
all: all-am
.SUFFIXES:
@@ -237,9 +237,9 @@ clean-binPROGRAMS:
echo " rm -f $$p $$f"; \
rm -f $$p $$f ; \
done
-autool$(EXEEXT): $(autool_OBJECTS) $(autool_DEPENDENCIES)
- @rm -f autool$(EXEEXT)
- $(LINK) $(autool_LDFLAGS) $(autool_OBJECTS) $(autool_LDADD) $(LIBS)
+audump$(EXEEXT): $(audump_OBJECTS) $(audump_DEPENDENCIES)
+ @rm -f audump$(EXEEXT)
+ $(LINK) $(audump_LDFLAGS) $(audump_OBJECTS) $(audump_LDADD) $(LIBS)
mostlyclean-compile:
-rm -f *.$(OBJEXT)
@@ -247,7 +247,7 @@ mostlyclean-compile:
distclean-compile:
-rm -f *.tab.c
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/autool.Po@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/audump.Po@am__quote@
.c.o:
@am__fastdepCC_TRUE@ if $(COMPILE) -MT $@ -MD -MP -MF "$(DEPDIR)/$*.Tpo" -c -o $@ $<; \
OpenPOWER on IntegriCloud