summaryrefslogtreecommitdiffstats
path: root/sys/security/audit/audit.c
Commit message (Collapse)AuthorAgeFilesLines
...
* Update src/sys/security/audit for OpenBSM 1.0 alpha 5:rwatson2006-03-041-0/+1
| | | | | | | | | | | | | | | | | - Include audit_internal.h to get definition of internal audit record structures, as it's no longer in audit.h. Forward declare au_record in audit_private.h as not all audit_private.h consumers care about it. - Remove __APPLE__ compatibility bits that are subsumed by configure for user space. - Don't expose in6_addr internals (non-portable, but also cleaner looking). - Avoid nested include of audit.h in audit_private.h. Obtained from: TrustedBSD Project
* Initialize user process audit ID to AU_DEFAUDITID so that init andrwatson2006-02-111-0/+1
| | | | | | its pre-authentication children are covered by naflags. Obtained from: TrustedBSD Project
* Acquire vnode lock around call to VOP_GETATTR() in audit_record_write().rwatson2006-02-071-0/+2
| | | | | | | | In the future, we may want to acquire the lock early in the function and hold it across calls to vn_rdwr(), etc, to avoid multiple acquires. Spotted by: kris (bugmagnet) Obtained from: TrustedBSD Project
* Add support for audit pipe special devices, which allow user spacerwatson2006-02-061-0/+13
| | | | | | | | | | | | | applications to insert a "tee" in the live audit event stream. Records are inserted into a per-clone queue so that user processes can pull discreet records out of the queue. Unlike delivery to disk, audit pipes are "lossy", dropping records in low memory conditions or when the process falls behind real-time events. This mechanism is appropriate for use by live monitoring systems, host-based intrusion detection, etc, and avoids applications having to dig through active on-disk trails that are owned by the audit daemon. Obtained from: TrustedBSD Project
* Manage audit record memory with the slab allocator, turningrwatson2006-02-061-100/+85
| | | | | | | | | | | | | initialization routines into a ctor, tear-down to a dtor, cleaning up, etc. This will allow audit records to be allocated from per-cpu caches. On recent FreeBSD, dropping the audit_mtx around freeing to UMA is no longer required (at one point it was possible to acquire Giant on that path), so a mutex-free thread-local drain is no longer required. Obtained from: TrustedBSD Project
* When GC'ing a thread, assert that it has no active audit record.rwatson2006-02-051-0/+10
| | | | | | | | This should not happen, but with this assert, brueffer and I would not have spent 45 minutes trying to figure out why he wasn't seeing audit records with the audit version in CVS. Obtained from: TrustedBSD Project
* Add new fields to process-related data structures:rwatson2006-02-021-0/+10
| | | | | | | | | | | | | | | | - td_ar to struct thread, which holds the in-progress audit record during a system call. - p_au to struct proc, which holds per-process audit state, such as the audit identifier, audit terminal, and process audit masks. In the earlier implementation, td_ar was added to the zero'd section of struct thread. In order to facilitate merging to RELENG_6, it has been moved to the end of the data structure, requiring explicit initalization in the thread constructor. Much help from: wsalamon Obtained from: TrustedBSD Project
* Import kernel audit framework:rwatson2006-02-011-0/+1083
- Management of audit state on processes. - Audit system calls to configure process and system audit state. - Reliable audit record queue implementation, audit_worker kernel thread to asynchronously store records on disk. - Audit event argument. - Internal audit data structure -> BSM audit trail conversion library. - Audit event pre-selection. - Audit pseudo-device permitting kernel->user upcalls to notify auditd of kernel audit events. Much work by: wsalamon Obtained from: TrustedBSD Project, Apple Computer, Inc.
OpenPOWER on IntegriCloud