Add tests for execve(2) and fexecve(2) in "ex" audit class

[aniketp]

Summary

The following changes introduce a new test-program exec, which contains the tests for
execve(2) and fexecve(2) system calls of ex audit class.

However, there is a certain descrepancy in the regex expression of tests for both syscalls
in success mode. Instead of the conventional return,success. The following regex has been
incorporated.

const char *regex = "fexecve.*sample-argument.*Unknown error: 201";

Reason is explained in the test-program:

fexecve(2) overlays the calling process in successful invocation.
Hence, audit(4) does not get any return value in the event token
for fexecve(2) due to which, it simply places BSM_ERRNO_UNKNOWN
as the ar->ar_errno field.
Please see: sys/security/audit/bsm_errno.c#L728

Test Plan

Execute make && make install from test/sys/audit.
Execute kyua test from /usr/tests/sys/audit. All testcases should succeed.

[asomers]

These tests are wrong. The execve's audit message is wrong. Rather than write your test to the bug, you should fix the bug instead. I think we discussed on IRC what that would require.

tests/sys/audit/exec.c

61

Line numbers change frequently. Better to point to the function name instead.

71

You need to handle the failure case too. If fork returns < 0 that means it failed, and no new process was created.

[aniketp]

tests/sys/audit/exec.c

66

@asomers, isn't this statement enough for handling the failure case of fork()?

[asomers]

tests/sys/audit/exec.c

66

Yes, I didn't see that part. But it would be more clear if it were part of the if/then/else