Page MenuHomeFreeBSD

auditd: Further improve signal handling
AbandonedPublic

Authored by des on Thu, Jun 4, 10:15 PM.
Tags
None
Referenced Files
Unknown Object (File)
Wed, Jun 10, 11:41 PM
Unknown Object (File)
Wed, Jun 10, 5:30 PM
Unknown Object (File)
Wed, Jun 10, 12:11 PM
Unknown Object (File)
Tue, Jun 9, 10:50 PM
Unknown Object (File)
Tue, Jun 9, 6:02 PM
Unknown Object (File)
Tue, Jun 9, 7:52 AM
Unknown Object (File)
Mon, Jun 8, 4:24 PM
Unknown Object (File)
Mon, Jun 8, 10:03 AM
Subscribers

Details

Reviewers
kevans
csjp
Summary

Rewrite the main loop to use ppoll() instead of just blocking on read,
blocking the signals we care about when we aren't polling.

I didn't bother replacing alarm() with setitimer(); the alarm code
is dead anyway since there is no way for max_idletime to acquire a
non-zero value.

MFC after: 1 week

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Skipped
Unit
Tests Skipped
Build Status
Buildable 73695
Build 70578: arc lint + arc unit

Event Timeline

des requested review of this revision.Thu, Jun 4, 10:15 PM

Looks good a couple of minor things

contrib/openbsm/bin/auditd/auditd_fbsd.c
267

minor nit but NULL instead of 0 here

280

Another minor nit: Incrementing is misleading because it implies the count matters, when it doesn't. Using = 1 makes the intent explicit: this is a flag, not a counter

This revision is now accepted and ready to land.Fri, Jun 5, 5:12 AM
This revision now requires review to proceed.Fri, Jun 5, 6:50 AM
des marked 2 inline comments as done.Fri, Jun 5, 6:50 AM
This revision is now accepted and ready to land.Fri, Jun 5, 1:22 PM
contrib/openbsm/bin/auditd/auditd_fbsd.c
218

It occurs to me that we might want audiitwarning to have the previous mask available to restore the mask in the child