HomeFreeBSD

Merge OpenBSM 1.2-alpha5 from vendor branch to FreeBSD -CURRENT:

Description

Merge OpenBSM 1.2-alpha5 from vendor branch to FreeBSD -CURRENT:

  • Add a new "qsize" parameter in audit_control and the getacqsize(3) API to query it, allowing to set the kernel's maximum audit queue length.
  • Add support to push a mapping between audit event names and event numbers into the kernel (where supported) using new A_GETEVENT and A_SETEVENT auditon(2) operations.
  • Add audit event identifiers for a number of new (and not-so-new) FreeBSD system calls including those for asynchronous I/O, thread management, SCTP, jails, multi-FIB support, and misc. POSIX interfaces such as posix_fallocate(2) and posix_fadvise(2).
  • On operating systems supporting Capsicum, auditreduce(1) and praudit(1) now run sandboxed.
  • Empty "flags" and "naflags" fields are now permitted in audit_control(5).

Many thanks to Christian Brueffer for producing the OpenBSM release and
importing/tagging it in the vendor branch. This release will allow improved
auditing of a range of new FreeBSD functionality, as well as non-traditional
events (e.g., fine-grained I/O auditing) not required by the Orange Book or
Common Criteria.

Obtained from: TrustedBSD Project
Sponsored by: DARPA, AFRL
MFC after: 3 weeks

Details

Provenance
rwatsonAuthored on
Parents
rS316005: Revert r314907, and pull in r298713 from upstream compiler-rt trunk (by
Branches
Unknown
Tags
Unknown