Robert Watson 09daf1c828 Add support for audit pipe special devices, which allow user space ... applications to insert a "tee" in the live audit event stream. Records are inserted into a per-clone queue so that user processes can pull discreet records out of the queue. Unlike delivery to disk, audit pipes are "lossy", dropping records in low memory conditions or when the process falls behind real-time events. This mechanism is appropriate for use by live monitoring systems, host-based intrusion detection, etc, and avoids applications having to dig through active on-disk trails that are owned by the audit daemon. Obtained from: TrustedBSD Project		2006-02-06 22:50:39 +00:00
..
audit_arg.c	Fix INVARIANTS build on amd64; (unsigned unsigned long) != u_int64_t.	2006-02-03 23:50:26 +00:00
audit_bsm_klib.c
audit_bsm_token.c
audit_bsm.c	Cast pointers to (uintptr_t) before down-casting to (int). This avoids	2006-02-04 00:14:06 +00:00
audit_pipe.c	Add support for audit pipe special devices, which allow user space	2006-02-06 22:50:39 +00:00
audit_private.h	Add support for audit pipe special devices, which allow user space	2006-02-06 22:50:39 +00:00
audit_syscalls.c
audit_trigger.c
audit.c	Add support for audit pipe special devices, which allow user space	2006-02-06 22:50:39 +00:00
audit.h	When GC'ing a thread, assert that it has no active audit record.	2006-02-05 21:06:09 +00:00