History log of /freebsd-current/sys/bsm/audit_internal.h
Revision Date Author Comments
# 95ee2897 16-Aug-2023 Warner Losh <imp@FreeBSD.org>

sys: Remove $FreeBSD$: two-line .h pattern

Remove /^\s*\*\n \*\s+\$FreeBSD\$$\n/


# 51369649 20-Nov-2017 Pedro F. Giffuni <pfg@FreeBSD.org>

sys: further adoption of SPDX licensing ID tags.

Mainly focus on files that use BSD 3-Clause license.

The Software Package Data Exchange (SPDX) group provides a specification
to make it easier for automated tools to detect and summarize well known
opensource licenses. We are gradually adopting the specification, noting
that the tags are considered only advisory and do not, in any way,
superceed or replace the license texts.

Special thanks to Wind River for providing access to "The Duke of
Highlander" tool: an older (2014) run over FreeBSD tree was useful as a
starting point.


# 8a0f5c0b 20-Dec-2015 Christian Brueffer <brueffer@FreeBSD.org>

Merge from contrib/openbsm to bring the kernel audit bits up to date with OpenBSM 1.2 alpha 4:

- remove $P4$
- fix a comment


# 97aa9e73 08-Dec-2015 Christian Brueffer <brueffer@FreeBSD.org>

Vendor import of OpenBSM 1.2-alpha4.


# d0c2e5bd 01-Dec-2012 Robert Watson <rwatson@FreeBSD.org>

Merge OpenBSM 1.2-alpha2 changes from contrib/openbsm to
src/sys/{bsm,security/audit}. There are a few tweaks to help with the
FreeBSD build environment that will be merged back to OpenBSM. No
significant functional changes appear on the kernel side.

Obtained from: TrustedBSD Project
Sponsored by: The FreeBSD Foundation (auditdistd)


# 399d3f65 30-Nov-2012 Robert Watson <rwatson@FreeBSD.org>

Merge a number of post-1.2-alpha2 changes to OpenBSM into the OpenBSM
vendor area; these sort out various post-release issues, largely to do
with integrating OpenBSM with the base FreeBSD build. All of these
changes will appear in a future 1.2-alpha3:

Change 219846 on 2012/11/26 by rwatson@rwatson_cinnamon

Update several instances of Apple Computer to Apple; a change made
in the FreeBSD tree some years ago but not propagated to OpenBSM.

Change 219845 on 2012/11/26 by rwatson@rwatson_cinnamon

Remove Apple acknowledgement clause from file with Christian
Peron copyright (with permission from Christian).

Change 219836 on 2012/11/23 by rwatson@rwatson_cinnamon

Replace further instances of <> with "" for local includes in
auditdistd.

Change 219834 on 2012/11/23 by rwatson@rwatson_cinnamon

For current-directory headers, use #include "" rather than #include
<>.

Change 219832 on 2012/11/23 by rwatson@rwatson_cinnamon

Be more consistent with the remainder of OpenBSM and include
config/config.h rather than config.h.

Don't include config.h from synch.h, which is included only from
.c files that already include config.h.

Change 219831 on 2012/11/23 by pjd@pjd_anger

Add Xref to auditdistd(8).

Suggested by: rwatson

Obtained from: TrustedBSD Project
Sponsored by: The FreeBSD Foundation (auditdistd)


# a7d5f7eb 19-Oct-2010 Jamie Gritton <jamie@FreeBSD.org>

A new jail(8) with a configuration file, to replace the work currently done
by /etc/rc.d/jail.


# 980b6e45 28-Dec-2008 Robert Watson <rwatson@FreeBSD.org>

Vendor import of OpenBSM 1.1 alpha4, which incorporates the following
changes since the last imported OpenBSM release:

OpenBSM 1.1 alpha 4

- With the addition of BSM error number mapping, we also need to map the
local error number passed to audit_submit(3) to a BSM error number,
rather than have the caller perform that conversion.
- Reallocate user audit events to avoid collisions with Solaris; adopt a
more formal allocation scheme, and add some events allocated in Solaris
that will be of immediate use on other platforms.
- Add an event for Calife.
- Add au_strerror(3), which allows generating strings for BSM errors
directly, rather than requiring applications to map to the local error
space, which might not be able to entirely represent the BSM error
number space.
- Major auditd rewrite for launchd(8) support. Add libauditd library
that is shared between launchd and auditd.
- Add AUDIT_TRIGGER_INITIALIZE trigger (sent via 'audit -i') for
(re)starting auditing under launchd(8) on Mac OS X.
- Add 'current' symlink to active audit trail.
- Add crash recovery of previous audit trail file when detected on audit
startup that it has not been properly terminated.
- Add the event AUE_audit_recovery to indicated when an audit trail file
has been recovered from not being properly terminated. This event is
stored in the new audit trail file and includes the path of recovered
audit trail file.
- Mac OS X and FreeBSD dependent code in auditd.c is separated into
auditd_darwin.c and auditd_fbsd.c files.
- Add an event for the posix_spawn(2) and fsgetpath(2) Mac OS X system
calls.
- For Mac OS X, we use ASL(3) instead of syslog(3) for logging.
- Add support for NOTICE level logging.

OpenBSM 1.1 alpha 3

- Add two new functions, au_bsm_to_errno() and au_errno_to_bsm(), to map
between BSM error numbers (largely the Solaris definitions) and local
errno(2) values for 32-bit and 64-bit return tokens. This is required
as operating systems don't agree on some of the values of more recent
error numbers.
- Fix a bug how au_to_exec_args(3) and au_to_exec_env(3) calculates the
total size for the token. This bug resulted in "unknown" tokens being
printed after the exec args/env tokens.
- Support for AUT_SOCKET_EX extended socket tokens, which describe a
socket using a pair of IPv4/IPv6 and port tuples.
- OpenBSM BSM file header version bumped for 1.1 release.
- Deprecated Darwin constants, such as TRAILER_PAD_MAGIC, removed.

Obtained from: TrustedBSD Project
Sponsored by: Apple Inc.


# a5c6cfa0 12-Nov-2008 Robert Watson <rwatson@FreeBSD.org>

Vendor import of OpenBSM 1.1 alpha2, which incorporates the following
changes since the last imported OpenBSM release:

OpenBSM 1.1 alpha 2

- Include files in OpenBSM are now broken out into two parts: library builds
required solely for user space, and system includes, which may also be
required for use in the kernels of systems integrating OpenBSM. Submitted
by Stacey Son.
- Configure option --with-native-includes allows forcing the use of native
include for system includes, rather than the versions bundled with OpenBSM.
This is intended specifically for platforms that ship OpenBSM, have adapted
versions of the system includes in a kernel source tree, and will use the
OpenBSM build infrastructure with an unmodified OpenBSM distribution,
allowing the customized system includes to be used with the OpenBSM build.
Submitted by Stacey Son.
- Various strcpy()'s/strcat()'s have been changed to strlcpy()'s/strlcat()'s
or asprintf(). Added compat/strlcpy.h for Linux.
- Remove compatibility defines for old Darwin token constant names; now only
BSM token names are provided and used.
- Add support for extended header tokens, which contain space for information
on the host generating the record.
- Add support for setting extended host information in the kernel, which is
used for setting host information in extended header tokens. The
audit_control file now supports a "host" parameter which can be used by
auditd to set the information; if not present, the kernel parameters won't
be set and auditd uses unextended headers for records that it generates.

OpenBSM 1.1 alpha 1

- Add option to auditreduce(1) which allows users to invert sense of
matching, such that BSM records that do not match, are selected.
- Fix bug in audit_write() where we commit an incomplete record in the
event there is an error writing the subject token. This was submitted
by Diego Giagio.
- Build support for Mac OS X 10.5.1 submitted by Eric Hall.
- Fix a bug which resulted in host XML attributes not beingguments so that const strings can be passed
as arguments to tokens. This patch was submitted by Xin LI.
- Modify the -m option so users can select more then one audit event.
- For Mac OS X, added Mach IPC support for audit trigger messages.
- Fixed a bug in getacna() which resulted in a locking problem on Mac OS X.
- Added LOG_PERROR flag to openlog when -d option is used with auditd.
- AUE events added for Mac OS X Leopard system calls.

Obtained from: TrustedBSD Project
Sponsored by: Apple Inc.


# ffbcef5a 11-Nov-2008 Christian S.J. Peron <csjp@FreeBSD.org>

Add support for extended header BSM tokens. Currently we use the
regular header tokens. The extended header tokens contain an IP
or IPv6 address which makes it possible to identify which host an
audit record came from when audit records are centralized.

If the host information has not been specified, the system will
default to the old style headers. Otherwise, audit records that
are created as a result of system calls will contain host information.

This implemented has been designed to be consistent with the Solaris
implementation. Host information is set/retrieved using the A_GETKAUDIT
and A_SETKAUDIT auditon(2) commands. These commands require that a
pointer to a auditinfo_addr_t object is passed. Currently only IP and
IPv6 address families are supported.

The users pace bits associated with this change will follow in an
openbsm import.

Reviewed by: rwatson, (sson, wsalamon (older version))
MFC after: 1 month


# d7f03759 19-Oct-2008 Ulf Lilleengen <lulf@FreeBSD.org>

- Import the HEAD csup code which is the basis for the cvsmode work.


# f6d4a8a7 31-Jul-2008 Robert Watson <rwatson@FreeBSD.org>

Further synchronization of copyrights, licenses, white space, etc from
Apple and from the OpenBSM vendor tree.

Obtained from: Apple Inc., TrustedBSD Project
MFC after: 3 days


# 3f3bb0d4 21-Jul-2007 Robert Watson <rwatson@FreeBSD.org>

Merge OpenBSM 1.0 alpha 15 changes to src/sys/bsm:

- Synchronized audit event list to Solaris, picking up the *at(2) system call
definitions, now required for FreeBSD and Linux. Added additional events
for *at(2) system calls not present in Solaris.

Obtained from: TrustedBSD Project
Approved by: re (hrs)


# b63c567b 16-Apr-2007 Robert Watson <rwatson@FreeBSD.org>

Change $P4$ ID strings to P4 ID strings so that they are not auto-expanded
when integrated back into Perforce. This avoids unnecessary conflicts
during the loopback of files maintained in Perforce.


# bfbc9a09 16-Apr-2007 Robert Watson <rwatson@FreeBSD.org>

Update src/sys/bsm for OpenBSM 1.0 alpha 14 import.

Add new audit event types.


# 2ecf07cb 21-Sep-2006 Robert Watson <rwatson@FreeBSD.org>

Merge OpenBSM 1.0 alpha 11 changes into src/sys/bsm and src/sys/security;
primarily, add new event identifiers and update trigger names.

Obtained from: TrustedBSD Project


# 23b7e55f 02-Sep-2006 Robert Watson <rwatson@FreeBSD.org>

Merge OpenBSM 1.0 alpha 10 changes into src/sys/bsm; comment spelling
fixes.

Obtained from: TrustedBSD Project


# 1c4d2797 26-Aug-2006 Robert Watson <rwatson@FreeBSD.org>

Update kernel OpenBSM parts, especially src/sys/bsm, for the OpenBSM
1.0 alpha 9 import. See the OpenBSM import commit message for a
detailed summary of changes.

Obtained from: TrustedBSD Project


# 70ea026a 04-Mar-2006 Robert Watson <rwatson@FreeBSD.org>

Update src/sys/bsm for OpenBSM 1.0 alpha 5 changes:

- Add new comments.
- Move private data structures from public audit.h to audit_internal.h to
avoid exposing queue.h macros to undesiring consumers.

Obtained from: TrustedBSD Project


# a5081e07 01-Feb-2006 Robert Watson <rwatson@FreeBSD.org>

Update src/sys/bsm include files to match OpenBSM (albeit with a
couple of FreeBSD-specific modifications that may be merged out
later). These include files define the basic audit data
structures, types, and definitions use by the kernel, or shared
by the kernel and user space.

Obtained from: TrustedBSD Project, Apple Computer, Inc.