- Remove AU_.* hard-coded audit class constants, as udit classes are now
entirely dynamically configured using /etc/security/audit_class.
Obtained from: TrustedBSD Project
- Synchronized audit event list to Solaris, picking up the *at(2) system call
definitions, now required for FreeBSD and Linux. Added additional events
for *at(2) system calls not present in Solaris.
Obtained from: TrustedBSD Project
Approved by: re (hrs)
Add the argument auditing functions for argv and env.
Add kernel-specific versions of the tokenizer functions for the
arg and env represented as a char array.
Implement the AUDIT_ARGV and AUDIT_ARGE audit policy commands to
enable/disable argv/env auditing.
Call the argument auditing from the exec system calls.
Obtained from: TrustedBSD Project
Approved by: rwatson (mentor)
- Cleanup of AUR_ data types.
- Comment fixes.
- au_close_token() definition.
- Break out of kernel vs. user space token interfaces for headers.
Note: this may briefly break the kernel build until other kernel files are
updated to match.
Obtained from: TrustedBSD Project
- Add new comments.
- Move private data structures from public audit.h to audit_internal.h to
avoid exposing queue.h macros to undesiring consumers.
Obtained from: TrustedBSD Project
to sys/bsm:
- Correct error in definition of audit event for Linux setfsgid().
- Add audit event identifier for sysarch().
Obtained from: TrustedBSD Project
couple of FreeBSD-specific modifications that may be merged out
later). These include files define the basic audit data
structures, types, and definitions use by the kernel, or shared
by the kernel and user space.
Obtained from: TrustedBSD Project, Apple Computer, Inc.
in order to modify the system call table to include event identifiers.
The full audit.h will be merged at a later date.
Obtained from: TrustedBSD Project
AUE_NULL. This is a place-holder to allow other audit infrastructure
to be introduced, such as an updated syscalls.master file format,
while the license on the real audit_kevents.h is fixed.
