Merge OpenBSM 1.1 alpha 2 from the OpenBSM vendor branch to head, both

contrib/openbsm (svn merge) and sys/{bsm,security/audit} (manual merge).

- Add OpenBSM contrib tree to include paths for audit(8) and auditd(8).
- Merge support for new tokens, fixes to existing token generation to
  audit_bsm_token.c.
- Synchronize bsm includes and definitions.

OpenBSM history for imported revisions below for reference.

MFC after:      1 month
Sponsored by:   Apple Inc.
Obtained from:  TrustedBSD Project

--

OpenBSM 1.1 alpha 2

- Include files in OpenBSM are now broken out into two parts: library builds
  required solely for user space, and system includes, which may also be
  required for use in the kernels of systems integrating OpenBSM.  Submitted
  by Stacey Son.
- Configure option --with-native-includes allows forcing the use of native
  include for system includes, rather than the versions bundled with OpenBSM.
  This is intended specifically for platforms that ship OpenBSM, have adapted
  versions of the system includes in a kernel source tree, and will use the
  OpenBSM build infrastructure with an unmodified OpenBSM distribution,
  allowing the customized system includes to be used with the OpenBSM build.
  Submitted by Stacey Son.
- Various strcpy()'s/strcat()'s have been changed to strlcpy()'s/strlcat()'s
  or asprintf().  Added compat/strlcpy.h for Linux.
- Remove compatibility defines for old Darwin token constant names; now only
  BSM token names are provided and used.
- Add support for extended header tokens, which contain space for information
  on the host generating the record.
- Add support for setting extended host information in the kernel, which is
  used for setting host information in extended header tokens.  The
  audit_control file now supports a "host" parameter which can be used by
  auditd to set the information; if not present, the kernel parameters won't
  be set and auditd uses unextended headers for records that it generates.

OpenBSM 1.1 alpha 1

- Add option to auditreduce(1) which allows users to invert sense of
  matching, such that BSM records that do not match, are selected.
- Fix bug in audit_write() where we commit an incomplete record in the
  event there is an error writing the subject token.  This was submitted
  by Diego Giagio.
- Build support for Mac OS X 10.5.1 submitted by Eric Hall.
- Fix a bug which resulted in host XML attributes not being arguments so
  that const strings can be passed as arguments to tokens.  This patch was
  submitted by Xin LI.
- Modify the -m option so users can select more then one audit event.
- For Mac OS X, added Mach IPC support for audit trigger messages.
- Fixed a bug in getacna() which resulted in a locking problem on Mac OS X.
- Added LOG_PERROR flag to openlog when -d option is used with auditd.
- AUE events added for Mac OS X Leopard system calls.

1 files changed, 49 insertions, 12 deletions

diff --git a/sys/bsm/audit_kevents.h b/sys/bsm/audit_kevents.h
index 6e073d4..a881d78 100644
--- a/sys/bsm/audit_kevents.h
+++ b/sys/bsm/audit_kevents.h
@@ -1,4 +1,4 @@
-/*
+/*-
  * Copyright (c) 2005 Apple Inc.
  * All rights reserved.
  *
@@ -26,7 +26,7 @@
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  *
- * P4: //depot/projects/trustedbsd/audit3/sys/bsm/audit_kevents.h#34
+ * P4: //depot/projects/trustedbsd/openbsm/sys/bsm/audit_kevents.h#3
  * $FreeBSD$
  */
 
@@ -308,6 +308,7 @@
 #define	AUE_PF_POLICY_FLIP	298	/* Solaris-specific. */
 #define	AUE_PF_POLICY_FLUSH	299	/* Solaris-specific. */
 #define	AUE_PF_POLICY_ALGS	300	/* Solaris-specific. */
+#define	AUE_PORTFS		301	/* Solaris-specific. */
 
 /*
  * Events added for Apple Darwin that potentially collide with future Solaris
@@ -516,17 +517,17 @@
 #define	AUE_READDIR		43118	/* Linux. */
 #define	AUE_IOPL		43119	/* Linux. */
 #define	AUE_VM86		43120	/* Linux. */
-#define	AUE_MAC_GET_PROC	43121	/* FreeBSD. */
-#define	AUE_MAC_SET_PROC	43122	/* FreeBSD. */
-#define	AUE_MAC_GET_FD		43123	/* FreeBSD. */
-#define	AUE_MAC_GET_FILE	43124	/* FreeBSD. */
-#define	AUE_MAC_SET_FD		43125	/* FreeBSD. */
-#define	AUE_MAC_SET_FILE	43126	/* FreeBSD. */
+#define	AUE_MAC_GET_PROC	43121	/* FreeBSD/Darwin. */
+#define	AUE_MAC_SET_PROC	43122	/* FreeBSD/Darwin. */
+#define	AUE_MAC_GET_FD		43123	/* FreeBSD/Darwin. */
+#define	AUE_MAC_GET_FILE	43124	/* FreeBSD/Darwin. */
+#define	AUE_MAC_SET_FD		43125	/* FreeBSD/Darwin. */
+#define	AUE_MAC_SET_FILE	43126	/* FreeBSD/Darwin. */
 #define	AUE_MAC_SYSCALL		43127	/* FreeBSD. */
-#define	AUE_MAC_GET_PID		43128	/* FreeBSD. */
-#define	AUE_MAC_GET_LINK	43129	/* FreeBSD. */
-#define	AUE_MAC_SET_LINK	43130	/* FreeBSD. */
-#define	AUE_MAC_EXECVE		43131	/* FreeBSD. */
+#define	AUE_MAC_GET_PID		43128	/* FreeBSD/Darwin. */
+#define	AUE_MAC_GET_LINK	43129	/* FreeBSD/Darwin. */
+#define	AUE_MAC_SET_LINK	43130	/* FreeBSD/Darwin. */
+#define	AUE_MAC_EXECVE		43131	/* FreeBSD/Darwin. */
 #define	AUE_GETPATH_FROMFD	43132	/* FreeBSD. */
 #define	AUE_GETPATH_FROMADDR	43133	/* FreeBSD. */
 #define	AUE_MQ_OPEN		43134	/* FreeBSD. */
@@ -548,7 +549,43 @@
 #define	AUE_MKNODAT		43150	/* FreeBSD. */
 #define	AUE_READLINKAT		43151	/* FreeBSD. */
 #define	AUE_SYMLINKAT		43152	/* FreeBSD. */
+#define	AUE_MAC_GETFSSTAT	43153	/* Darwin. */
+#define	AUE_MAC_GET_MOUNT	43154	/* Darwin. */
+#define	AUE_MAC_GET_LCID	43155	/* Darwin. */
+#define	AUE_MAC_GET_LCTX	43156	/* Darwin. */
+#define	AUE_MAC_SET_LCTX	43157	/* Darwin. */
+#define	AUE_MAC_MOUNT		43158	/* Darwin. */
+#define	AUE_GETLCID		43159	/* Darwin. */
+#define	AUE_SETLCID		43160	/* Darwin. */
+#define	AUE_TASKNAMEFORPID	43161	/* Darwin. */
+#define	AUE_ACCESS_EXTENDED	43162	/* Darwin. */
+#define	AUE_CHMOD_EXTENDED	43163	/* Darwin. */
+#define	AUE_FCHMOD_EXTENDED	43164	/* Darwin. */
+#define	AUE_FSTAT_EXTENDED	43165	/* Dariwn. */
+#define	AUE_LSTAT_EXTENDED	43166	/* Darwin. */
+#define	AUE_MKDIR_EXTENDED	43167	/* Darwin. */
+#define	AUE_MKFIFO_EXTENDED	43168	/* Darwin. */
+#define	AUE_OPEN_EXTENDED	43169	/* Darwin. */
+#define	AUE_OPEN_EXTENDED_R	43170	/* Darwin. */
+#define	AUE_OPEN_EXTENDED_RC	43171	/* Darwin. */
+#define	AUE_OPEN_EXTENDED_RT	43172	/* Darwin. */
+#define	AUE_OPEN_EXTENDED_RTC	43173	/* Darwin. */
+#define	AUE_OPEN_EXTENDED_W	43174	/* Darwin. */
+#define	AUE_OPEN_EXTENDED_WC	43175	/* Darwin. */
+#define	AUE_OPEN_EXTENDED_WT	43176	/* Darwin. */
+#define	AUE_OPEN_EXTENDED_WTC	43177	/* Darwin. */
+#define	AUE_OPEN_EXTENDED_RW	43178	/* Darwin. */
+#define	AUE_OPEN_EXTENDED_RWC	43179	/* Darwin. */
+#define	AUE_OPEN_EXTENDED_RWT	43180	/* Darwin. */
+#define	AUE_OPEN_EXTENDED_RWTC	43181	/* Darwin. */
+#define	AUE_STAT_EXTENDED	43182	/* Darwin. */
+#define	AUE_UMASK_EXTENDED	43183	/* Darwin. */
+#define	AUE_OPENAT		43184	/* FreeBSD. */
 #define	AUE_POSIX_OPENPT	43185	/* FreeBSD. */
+#define	AUE_CAP_NEW		43186	/* TrustedBSD. */
+#define	AUE_CAP_GETRIGHTS	43187	/* TrustedBSD. */
+#define	AUE_CAP_ENTER		43188	/* TrustedBSD. */
+#define	AUE_CAP_GETMODE		43189	/* TrustedBSD. */
 
 /*
  * Darwin BSM uses a number of AUE_O_* definitions, which are aliased to the