diff options
Diffstat (limited to 'contrib/openbsm/bsm')
-rw-r--r-- | contrib/openbsm/bsm/audit_kevents.h | 27 | ||||
-rw-r--r-- | contrib/openbsm/bsm/audit_record.h | 6 | ||||
-rw-r--r-- | contrib/openbsm/bsm/libbsm.h | 54 |
3 files changed, 79 insertions, 8 deletions
diff --git a/contrib/openbsm/bsm/audit_kevents.h b/contrib/openbsm/bsm/audit_kevents.h index 434452a..eb615d3 100644 --- a/contrib/openbsm/bsm/audit_kevents.h +++ b/contrib/openbsm/bsm/audit_kevents.h @@ -30,7 +30,7 @@ * * @APPLE_BSD_LICENSE_HEADER_END@ * - * $P4: //depot/projects/trustedbsd/openbsm/bsm/audit_kevents.h#43 $ + * $P4: //depot/projects/trustedbsd/openbsm/bsm/audit_kevents.h#47 $ */ #ifndef _BSM_AUDIT_KEVENTS_H_ @@ -474,6 +474,28 @@ #define AUE_READDIR 43118 /* Linux. */ #define AUE_IOPL 43119 /* Linux. */ #define AUE_VM86 43120 /* Linux. */ +#define AUE_MAC_GET_PROC 43121 /* FreeBSD. */ +#define AUE_MAC_SET_PROC 43122 /* FreeBSD. */ +#define AUE_MAC_GET_FD 43123 /* FreeBSD. */ +#define AUE_MAC_GET_FILE 43124 /* FreeBSD. */ +#define AUE_MAC_SET_FD 43125 /* FreeBSD. */ +#define AUE_MAC_SET_FILE 43126 /* FreeBSD. */ +#define AUE_MAC_SYSCALL 43127 /* FreeBSD. */ +#define AUE_MAC_GET_PID 43128 /* FreeBSD. */ +#define AUE_MAC_GET_LINK 43129 /* FreeBSD. */ +#define AUE_MAC_SET_LINK 43130 /* FreeBSD. */ +#define AUE_MAC_EXECVE 43131 /* FreeBSD. */ +#define AUE_GETPATH_FROMFD 43132 /* FreeBSD. */ +#define AUE_GETPATH_FROMADDR 43133 /* FreeBSD. */ +#define AUE_MQ_OPEN 43134 /* FreeBSD. */ +#define AUE_MQ_SETATTR 43135 /* FreeBSD. */ +#define AUE_MQ_TIMEDRECEIVE 43136 /* FreeBSD. */ +#define AUE_MQ_TIMEDSEND 43137 /* FreeBSD. */ +#define AUE_MQ_NOTIFY 43138 /* FreeBSD. */ +#define AUE_MQ_UNLINK 43139 /* FreeBSD. */ +#define AUE_LISTEN 43140 /* FreeBSD/Darwin/Linux. */ +#define AUE_MLOCKALL 43141 /* FreeBSD. */ +#define AUE_MUNLOCKALL 43142 /* FreeBSD. */ /* * Darwin BSM uses a number of AUE_O_* definitions, which are aliased to the @@ -571,16 +593,13 @@ #define AUE_GETSOCKOPT AUE_NULL #define AUE_GTSOCKOPT AUE_GETSOCKOPT /* XXX: Typo in Darwin. */ #define AUE_ISSETUGID AUE_NULL -#define AUE_LISTEN AUE_NULL #define AUE_LSTATV AUE_NULL #define AUE_MADVISE AUE_NULL #define AUE_MINCORE AUE_NULL #define AUE_MKCOMPLEX AUE_NULL -#define AUE_MLOCKALL AUE_NULL #define AUE_MODWATCH AUE_NULL #define AUE_MSGCL AUE_NULL #define AUE_MSYNC AUE_NULL -#define AUE_MUNLOCKALL AUE_NULL #define AUE_PREAD AUE_NULL #define AUE_PWRITE AUE_NULL #define AUE_PREADV AUE_NULL diff --git a/contrib/openbsm/bsm/audit_record.h b/contrib/openbsm/bsm/audit_record.h index 79d13c3..c15d620 100644 --- a/contrib/openbsm/bsm/audit_record.h +++ b/contrib/openbsm/bsm/audit_record.h @@ -30,7 +30,7 @@ * * @APPLE_BSD_LICENSE_HEADER_END@ * - * $P4: //depot/projects/trustedbsd/openbsm/bsm/audit_record.h#23 $ + * $P4: //depot/projects/trustedbsd/openbsm/bsm/audit_record.h#25 $ */ #ifndef _BSM_AUDIT_RECORD_H_ @@ -85,6 +85,7 @@ /* XXXRW: Additional X11 tokens not defined? */ #define AUT_CMD 0x51 #define AUT_EXIT 0x52 +#define AUT_ZONENAME 0x60 /* XXXRW: OpenBSM AUT_HOST 0x70? */ #define AUT_ARG64 0x71 #define AUT_RETURN64 0x72 @@ -246,6 +247,8 @@ token_t *au_to_file(char *file, struct timeval tm); token_t *au_to_header32_tm(int rec_size, au_event_t e_type, au_emod_t e_mod, struct timeval tm); +token_t *au_to_header64_tm(int rec_size, au_event_t e_type, au_emod_t e_mod, + struct timeval tm); #if !defined(KERNEL) && !defined(_KERNEL) token_t *au_to_header(int rec_size, au_event_t e_type, au_emod_t e_mod); token_t *au_to_header32(int rec_size, au_event_t e_type, au_emod_t e_mod); @@ -328,6 +331,7 @@ token_t *au_to_exec_env(char **envp); token_t *au_to_text(char *text); token_t *au_to_kevent(struct kevent *kev); token_t *au_to_trailer(int rec_size); +token_t *au_to_zonename(char *zonename); __END_DECLS diff --git a/contrib/openbsm/bsm/libbsm.h b/contrib/openbsm/bsm/libbsm.h index 2d76c39..b1a9731 100644 --- a/contrib/openbsm/bsm/libbsm.h +++ b/contrib/openbsm/bsm/libbsm.h @@ -26,7 +26,7 @@ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE * POSSIBILITY OF SUCH DAMAGE. * - * $P4: //depot/projects/trustedbsd/openbsm/bsm/libbsm.h#30 $ + * $P4: //depot/projects/trustedbsd/openbsm/bsm/libbsm.h#33 $ */ #ifndef _LIBBSM_H_ @@ -164,6 +164,12 @@ typedef struct au_tidaddr32 { u_int32_t addr[4]; } au_tidaddr32_t; +typedef struct au_tidaddr64 { + u_int64_t port; + u_int32_t type; + u_int32_t addr[4]; +} au_tidaddr64_t; + /* * argument # 1 byte * argument value 4 bytes/8 bytes (32-bit/64-bit value) @@ -483,6 +489,17 @@ typedef struct { au_tidaddr32_t tid; } au_proc32ex_t; +typedef struct { + u_int32_t auid; + u_int32_t euid; + u_int32_t egid; + u_int32_t ruid; + u_int32_t rgid; + u_int32_t pid; + u_int32_t sid; + au_tidaddr64_t tid; +} au_proc64ex_t; + /* * error status 1 byte * return value 4 bytes/8 bytes (32-bit/64-bit value) @@ -616,6 +633,17 @@ typedef struct { au_tidaddr32_t tid; } au_subject32ex_t; +typedef struct { + u_int32_t auid; + u_int32_t euid; + u_int32_t egid; + u_int32_t ruid; + u_int32_t rgid; + u_int32_t pid; + u_int32_t sid; + au_tidaddr64_t tid; +} au_subject64ex_t; + /* * text length 2 bytes * text N bytes + 1 terminating NULL byte @@ -625,6 +653,15 @@ typedef struct { char *text; } au_text_t; +/* + * zonename length 2 bytes + * zonename text N bytes + 1 NULL terminator + */ +typedef struct { + u_int16_t len; + char *zonename; +} au_zonename_t; + typedef struct { u_int32_t ident; u_int16_t filter; @@ -675,8 +712,9 @@ struct tokenstr { au_opaque_t opaque; au_path_t path; au_proc32_t proc32; - au_proc64_t proc64; au_proc32ex_t proc32_ex; + au_proc64_t proc64; + au_proc64ex_t proc64_ex; au_ret32_t ret32; au_ret64_t ret64; au_seq_t seq; @@ -685,12 +723,14 @@ struct tokenstr { au_socketinet32_t sockinet32; au_socketunix_t sockunix; au_subject32_t subj32; - au_subject64_t subj64; au_subject32ex_t subj32_ex; + au_subject64_t subj64; + au_subject64ex_t subj64_ex; au_text_t text; au_kevent_t kevent; au_invalid_t invalid; au_trailer_t trail; + au_zonename_t zonename; } tt; /* The token is one of the above types */ }; @@ -771,6 +811,14 @@ int au_fetch_tok(tokenstr_t *tok, u_char *buf, int len); //XXX The following interface has different prototype from BSM void au_print_tok(FILE *outfp, tokenstr_t *tok, char *del, char raw, char sfrm); +void au_print_tok_xml(FILE *outfp, tokenstr_t *tok, + char *del, char raw, char sfrm); + +/* + * Functions relating to XML output. + */ +void au_print_xml_header(FILE *outfp); +void au_print_xml_footer(FILE *outfp); __END_DECLS /* |