Robert Watson 04f11621df Rather than allocating all buffer memory for the completed BSM record ... when allocating the record in the first place, allocate the final buffer when closing the BSM record. At that point, more size information is available, so a sufficiently large buffer can be allocated. This allows the kernel to generate audit records in excess of MAXAUDITDATA bytes, but is consistent with Solaris's behavior. This only comes up when auditing command line arguments, in which case we presume the administrator really does want the data as they have specified the policy flag to gather them. Obtained from: TrustedBSD Project MFC after: 3 days		2006-09-20 13:23:40 +00:00
..
audit_arg.c	Audit the argv and env vectors passed in on exec:	2006-09-01 11:45:40 +00:00
audit_bsm_klib.c	Introduce support for per-audit pipe preselection independent from the	2006-06-05 14:48:17 +00:00
audit_bsm_token.c	Add missing white space in au_to_exec_{args,env}().	2006-09-20 13:14:47 +00:00
audit_bsm.c	Rather than allocating all buffer memory for the completed BSM record	2006-09-20 13:23:40 +00:00
audit_ioctl.h	Allow the user process to query the kernel's notion of a maximum	2006-08-26 17:59:31 +00:00
audit_pipe.c	Allow the user process to query the kernel's notion of a maximum	2006-08-26 17:59:31 +00:00
audit_private.h	Correct a slight regression which was introduced with the implementation of	2006-09-17 17:52:57 +00:00
audit_syscalls.c	Correct a slight regression which was introduced with the implementation of	2006-09-17 17:52:57 +00:00
audit_trigger.c	Prefer C to C++ comments per style(9).	2006-06-08 21:55:39 +00:00
audit_worker.c	Correct a slight regression which was introduced with the implementation of	2006-09-17 17:52:57 +00:00
audit.c	Correct a slight regression which was introduced with the implementation of	2006-09-17 17:52:57 +00:00
audit.h	White space cleanup, no functional change.	2006-09-04 06:06:23 +00:00