summaryrefslogtreecommitdiffstats
path: root/sys/bsm
Commit message (Collapse)AuthorAgeFilesLines
* Add support for extended header BSM tokens. Currently we use thecsjp2008-11-112-0/+5
| | | | | | | | | | | | | | | | | | | | | | regular header tokens. The extended header tokens contain an IP or IPv6 address which makes it possible to identify which host an audit record came from when audit records are centralized. If the host information has not been specified, the system will default to the old style headers. Otherwise, audit records that are created as a result of system calls will contain host information. This implemented has been designed to be consistent with the Solaris implementation. Host information is set/retrieved using the A_GETKAUDIT and A_SETKAUDIT auditon(2) commands. These commands require that a pointer to a auditinfo_addr_t object is passed. Currently only IP and IPv6 address families are supported. The users pace bits associated with this change will follow in an openbsm import. Reviewed by: rwatson, (sson, wsalamon (older version)) MFC after: 1 month
* When MPSAFE ttys were merged, a new BSM audit event identifier wasrwatson2008-08-241-1/+1
| | | | | | | | | | | | | | allocated for posix_openpt(2). Unfortunately, that identifier conflicts with other events already allocated to other systems in OpenBSM. Assign a new globally unique identifier and conform better to the AUE_ event naming scheme. This is a stopgap until a new OpenBSM import is done with the correct identifier, so we'll maintain this as a local diff in svn until then. Discussed with: ed Obtained from: TrustedBSD Project
* Integrate the new MPSAFE TTY layer to the FreeBSD operating system.ed2008-08-201-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The last half year I've been working on a replacement TTY layer for the FreeBSD kernel. The new TTY layer was designed to improve the following: - Improved driver model: The old TTY layer has a driver model that is not abstract enough to make it friendly to use. A good example is the output path, where the device drivers directly access the output buffers. This means that an in-kernel PPP implementation must always convert network buffers into TTY buffers. If a PPP implementation would be built on top of the new TTY layer (still needs a hooks layer, though), it would allow the PPP implementation to directly hand the data to the TTY driver. - Improved hotplugging: With the old TTY layer, it isn't entirely safe to destroy TTY's from the system. This implementation has a two-step destructing design, where the driver first abandons the TTY. After all threads have left the TTY, the TTY layer calls a routine in the driver, which can be used to free resources (unit numbers, etc). The pts(4) driver also implements this feature, which means posix_openpt() will now return PTY's that are created on the fly. - Improved performance: One of the major improvements is the per-TTY mutex, which is expected to improve scalability when compared to the old Giant locking. Another change is the unbuffered copying to userspace, which is both used on TTY device nodes and PTY masters. Upgrading should be quite straightforward. Unlike previous versions, existing kernel configuration files do not need to be changed, except when they reference device drivers that are listed in UPDATING. Obtained from: //depot/projects/mpsafetty/... Approved by: philip (ex-mentor) Discussed: on the lists, at BSDCan, at the DevSummit Sponsored by: Snow B.V., the Netherlands dcons(4) fixed by: kan
* Further synchronization of copyrights, licenses, white space, etc fromrwatson2008-07-314-7/+7
| | | | | | | Apple and from the OpenBSM vendor tree. Obtained from: Apple Inc., TrustedBSD Project MFC after: 3 days
* Merge OpenBSM 1.0 changes to src/sys/bsm:rwatson2007-10-291-39/+1
| | | | | | | - Remove AU_.* hard-coded audit class constants, as udit classes are now entirely dynamically configured using /etc/security/audit_class. Obtained from: TrustedBSD Project
* Merge OpenBSM 1.0 alpha 15 changes to src/sys/bsm:rwatson2007-07-224-52/+91
| | | | | | | | | - Synchronized audit event list to Solaris, picking up the *at(2) system call definitions, now required for FreeBSD and Linux. Added additional events for *at(2) system calls not present in Solaris. Obtained from: TrustedBSD Project Approved by: re (hrs)
* Change $P4$ ID strings to P4 ID strings so that they are not auto-expandedrwatson2007-04-174-4/+4
| | | | | when integrated back into Perforce. This avoids unnecessary conflicts during the loopback of files maintained in Perforce.
* Update src/sys/bsm for OpenBSM 1.0 alpha 14 import.rwatson2007-04-164-7/+28
| | | | Add new audit event types.
* Add an entry for AUT_ZONENAME and the prototype for the au_to_zonename()csjp2007-04-151-0/+2
| | | | | function that will be implemented shortly. This is being done for the openbsm import.
* Merge OpenBSM 1.0 alpha 12 import changes into src/sys/bsm. New eventsrwatson2006-09-251-1/+5
| | | | | | | for the Linuxulator. MFC after: 3 days Obtained from: TrustedBSD Project
* Merge OpenBSM 1.0 alpha 11 changes into src/sys/bsm and src/sys/security;rwatson2006-09-214-19/+18
| | | | | | primarily, add new event identifiers and update trigger names. Obtained from: TrustedBSD Project
* Merge OpenBSM 1.0 alpha 10 changes into src/sys/bsm; comment spellingrwatson2006-09-021-2/+2
| | | | | | fixes. Obtained from: TrustedBSD Project
* Audit the argv and env vectors passed in on exec:wsalamon2006-09-011-2/+7
| | | | | | | | | | | | Add the argument auditing functions for argv and env. Add kernel-specific versions of the tokenizer functions for the arg and env represented as a char array. Implement the AUDIT_ARGV and AUDIT_ARGE audit policy commands to enable/disable argv/env auditing. Call the argument auditing from the exec system calls. Obtained from: TrustedBSD Project Approved by: rwatson (mentor)
* Update kernel OpenBSM parts, especially src/sys/bsm, for the OpenBSMrwatson2006-08-264-144/+225
| | | | | | | 1.0 alpha 9 import. See the OpenBSM import commit message for a detailed summary of changes. Obtained from: TrustedBSD Project
* Merge OpenBSM 1.0 alpha 7 new AUE_ event identifiers to kernel versionrwatson2006-07-031-2/+19
| | | | | | of audit_kevents.h. Obtained from: TrustedBSD Project
* Merge OpenBSM 1.0 alpha 7 nested time.h include to kernel version ofrwatson2006-07-031-0/+2
| | | | | | audit_record.h. Obtained from: TrustedBSD Project
* Merge OpenBSM 1.0 alpha 6 version of audit_record.h to src/sys:rwatson2006-06-051-22/+14
| | | | | | | | | | | | - Cleanup of AUR_ data types. - Comment fixes. - au_close_token() definition. - Break out of kernel vs. user space token interfaces for headers. Note: this may briefly break the kernel build until other kernel files are updated to match. Obtained from: TrustedBSD Project
* Merge OpenBSM 1.0 alpha 6 changes to bsm/audit.h into src/sys: respellrwatson2006-06-051-3/+3
| | | | | | | statistics variables. Submitted by: Martin Fong <martin dot fong at sri dot com> Obtained from: TrustedBSD Project
* Update src/sys/bsm for OpenBSM 1.0 alpha 5 changes:rwatson2006-03-042-22/+31
| | | | | | | | - Add new comments. - Move private data structures from public audit.h to audit_internal.h to avoid exposing queue.h macros to undesiring consumers. Obtained from: TrustedBSD Project
* Merge OpenBSM 1.0 alpha 3 include file changes from contrib/openbsm/bsmrwatson2006-02-061-2/+3
| | | | | | | | | to sys/bsm: - Correct error in definition of audit event for Linux setfsgid(). - Add audit event identifier for sysarch(). Obtained from: TrustedBSD Project
* Merge OpenBSM 1.0 alpha 2 kernel audit events into src/sys/bsm. Almostrwatson2006-02-041-3/+30
| | | | | | | entirely new audit event identifiers for FreeBSD, Linux, and POSIX.1b system calls. Obtained from: TrustedBSD Project
* Update src/sys/bsm include files to match OpenBSM (albeit with arwatson2006-02-014-45/+1234
| | | | | | | | | couple of FreeBSD-specific modifications that may be merged out later). These include files define the basic audit data structures, types, and definitions use by the kernel, or shared by the kernel and user space. Obtained from: TrustedBSD Project, Apple Computer, Inc.
* For consistency with more system include files, add a trailing '_' torwatson2005-05-291-3/+3
| | | | the define guards in audit_kevents.h.
* Add place-holder audit.h that defines only au_event_t, which is neededrwatson2005-05-291-0/+39
| | | | | | | in order to modify the system call table to include event identifiers. The full audit.h will be merged at a later date. Obtained from: TrustedBSD Project
* Add a stub audit_kevents.h, which defines exactly one audit event:rwatson2005-02-021-0/+38
AUE_NULL. This is a place-holder to allow other audit infrastructure to be introduced, such as an updated syscalls.master file format, while the license on the real audit_kevents.h is fixed.
OpenPOWER on IntegriCloud