1811d6bf7f
instrument security event auditing rather than relying on conventional BSM trail files or audit pipes: - Add a set of per-event 'commit' probes, which provide access to particular auditable events at the time of commit in system-call return. These probes gain access to audit data via the in-kernel audit_record data structure, providing convenient access to system-call arguments and return values in a single probe. - Add a set of per-event 'bsm' probes, which provide access to particular auditable events at the time of BSM record generation in the audit worker thread. These probes have access to the in-kernel audit_record data structure and BSM representation as would be written to a trail file or audit pipe -- i.e., asynchronously in the audit worker thread. DTrace probe arguments consist of the name of the audit event (to support future mechanisms of instrumenting multiple events via a single probe -- e.g., using classes), a pointer to the in-kernel audit record, and an optional pointer to the BSM data and its length. For human convenience, upper-case audit event names (AUE_...) are converted to lower case in DTrace. DTrace scripts can now cause additional audit-based data to be collected on system calls, and inspect internal and BSM representations of the data. They do not affect data captured in the audit trail or audit pipes configured in the system. auditd(8) must be configured and running in order to provide a database of event information, as well as other audit configuration parameters (e.g., to capture command-line arguments or environmental variables) for the provider to operate. Reviewed by: gnn, jonathan, markj Sponsored by: DARPA, AFRL MFC after: 3 weeks Differential Revision: https://reviews.freebsd.org/D10149
34 lines
676 B
Makefile
34 lines
676 B
Makefile
# $FreeBSD$
|
|
|
|
.include "Makefile.inc"
|
|
|
|
SUBDIR= dtaudit \
|
|
dtmalloc \
|
|
dtnfscl \
|
|
dtrace \
|
|
dtraceall \
|
|
dtrace_test \
|
|
profile \
|
|
prototype \
|
|
sdt \
|
|
systrace
|
|
|
|
.if ${MACHINE_CPUARCH} == "amd64" || ${MACHINE_CPUARCH} == "i386"
|
|
SUBDIR+= fasttrap fbt systrace_linux
|
|
.endif
|
|
.if ${MACHINE_CPUARCH} == "amd64"
|
|
SUBDIR+= systrace_linux32
|
|
.endif
|
|
.if ${MACHINE_CPUARCH} == "powerpc"
|
|
SUBDIR+= fbt fasttrap
|
|
.endif
|
|
.if ${MACHINE_CPUARCH} == "amd64" || ${MACHINE_ARCH} == "powerpc64"
|
|
SUBDIR+= systrace_freebsd32
|
|
.endif
|
|
.if ${MACHINE_CPUARCH} == "aarch64" || \
|
|
${MACHINE_CPUARCH} == "arm" || \
|
|
${MACHINE_CPUARCH} == "riscv"
|
|
SUBDIR+= fbt
|
|
.endif
|
|
.include <bsd.subdir.mk>
|