Robert Watson 1daa6feb45 When we drop an audit record going to and audit pipe because the audit ...

pipe has overflowed, drop the newest, rather than oldest, record.  This
makes overflow drop behavior consistent with memory allocation failure
leading to drop, avoids touching the consumer end of the queue from a
producer, and lowers the CPU overhead of dropping a record by dropping
before memory allocation and copying.

Obtained from:	Apple, Inc.
MFC after:	2 months

2008-10-30 23:09:19 +00:00

..

audit_arg.c

Decontextualize the couplet VOP_GETATTR / VOP_SETATTR as the passed thread

2008-08-28 15:23:18 +00:00

audit_bsm_klib.c

Protect the event->class lookup database using an rwlock instead of a

2008-10-30 17:47:57 +00:00

audit_bsm_token.c

Further synchronization of copyrights, licenses, white space, etc from

2008-07-31 09:54:35 +00:00

audit_bsm.c

More fully audit fexecve(2) and its arguments.

2008-08-25 13:50:01 +00:00

audit_ioctl.h

Don't expose #ifdef NOTYET parts to userspace via audit_ioctl.h, just

2007-04-29 16:20:32 +00:00

audit_pipe.c

When we drop an audit record going to and audit pipe because the audit

2008-10-30 23:09:19 +00:00

audit_private.h

Further synchronization of copyrights, licenses, white space, etc from

2008-07-31 09:54:35 +00:00

audit_syscalls.c

Unbreak the build.

2008-09-04 13:06:36 +00:00

audit_trigger.c

Generally avoid <space><tab> as a white space anomoly.

2008-07-22 16:44:48 +00:00

audit_worker.c

Decontextualize the couplet VOP_GETATTR / VOP_SETATTR as the passed thread

2008-08-28 15:23:18 +00:00

audit.c

Make sure we check the preselection masks present for all audit pipes.

2008-08-11 20:14:56 +00:00

audit.h

Further synchronization of copyrights, licenses, white space, etc from

2008-07-31 09:54:35 +00:00