• Update the format specifier to %#lx instead of 0x%x

Revert back to meta message

Lots of changes

• Non-blocking sockets not needed anymore, make them all default
• Remove check_readfs() functions [Since socket is blocking by default, read() will actually block till it receives a message]
• Eliminate client from the whole test program, since I never actually need it.
• Remove all unused, uninitialized variables, specially from failure test cases
• Improvements in comments an formatting
• Remove redundant header imports

Verify the audit of hex(request) in the ioctl(2)'s audit record

Instead of passing allocated and unitialized memory as the length for {get/set}audit_addr, simply pass the sizeof(auditinfo) as it is supposed to be used.

Replace readbuff with retval since it is a simple return value instead of a buffer
i.e return value of extattr_delete_{file/fd/link}

Remove (int)addr from regex it is not required (We already have the shmid to match against)

Replace int with intptr_t for ATF_REQUIRE statements of shmat(2) and shmdt(2)

Changes as suggested in the review

@asomers It was passing for me.

Setting file attributes is not required for listin them

Update the Makefile

Use UF_OFFLINE instead of SF_IMMUTABLE for easy cleanup

Add auclass in lchflags(2) test cases

Tweak in the msgstr_t variables' initialization

• Reduce the timeout to 2 seconds

• s/maximun/maximum at 3 places

Update the test-program to send only the initialized data using msgsnd(2)

No @asomers, praudit -p never spins the CPU in normal invocation. (Apologies if my earlier statement was unclear)
This is the observation:

Correct the regex for socket_failure test-case

No @asomers ,
In its current form it passes smoothly:

praudit_test:praudit_sync_to_next_record  ->  passed  [0.027s]

Update the test case description

Update the tests with regards to above comments

Add a description on the intent of testing the -p option

Add the network source file which was accidentally missed in previous revision

Rebase after rS335145

Correct Makefile:

ATF_TESTS_C= file-attribute-modify   -> ATF_TESTS_C+= file-attribute-modify

@asomers, I'm adding these tests on top of already existing tests in file-attribute-access. Why would updating the Makefile be necessary here?

Replace uninitialized buffers with NULL for the failure cases

Remove the normal praudit atf_check assertion in the praudit_sync_to_next_record test-case

Replace F_DUPFD with F_GETFL as the cmd
Note: This eliminates the need of LOWEST_FD

Correct formatting of open(2) test-case generator macro

Include missing headers and struct statfs declaration

Close file descriptor for statfs(2) and fstatfs(2) success case

Invert the closing of file descriptors for open and openat following LIFO rule

Update praudit_sync_to_next_record test case

Update praudit's flag '-p': Earlier the tests were failing

Add a test case for -p option which is used with tail(1)

• I had missed the corrupted record earlier

Add a test case for -p option which is used with tail(1)

Remove backslash formatting from open(2)'s test program macro
[Unrelated to this revision]

@asomers can this be landed? I've confirmed the successful regression test for ptrace(2) after changing the bit value and rebuilding the kernel. (Rest of the syscalls you mentioned are not auditable in FreeBSD)

@asomers I'll rebase this file after D15782 is committed. Since both revisions change the file: file-attribute-access.

Remove ATF_REQUIRE_EQ assertion from close() statements (and the comments)

• Replace the audit startup trail with socket(2) trail
• Improvements in the raw_short_exclusive description

Update the praudit_raw_short_exclusive's description

• Add a test for praudit exclusivity for 'r' and 's' arguments
• Separate the test cases from one another

Replace regex with extregex

I was thinking of adding these system calls in batches. Currently there are about 25 system calls in this class, so as to ease the process of reviewing, I included only the stat family to get the process started.

Remove the typo corrections from this review.

Place the initialisation of ar_errno and ar_retval in audit.c instead of audit_bsm.c
Also, move the typo corrections to D15702

Typo correction in audit.c: covert -> convert

Update the test case description format

Stringify the 'flag' macro argument using # preprocessing operator

• Correct the format specifier of flag in test case description

No functional change

• Formatting corrections

• Include the specific regexes for individual audit events