freebsd-skq/etc/rc.d/auditd

#!/bin/sh
#
# $FreeBSD$
#
# Start up for the Audit daemon.
#

# PROVIDE: auditd
# REQUIRE: syslogd
# BEFORE:  DAEMON
# KEYWORD: nojail shutdown

. /etc/rc.subr

name="auditd"
stop_cmd="auditd_stop"
command="/usr/sbin/${name}"
rcvar="auditd_enable"
command_args="${auditd_flags}"
required_files="/etc/security/audit_class /etc/security/audit_control
		/etc/security/audit_event /etc/security/audit_user
		/etc/security/audit_warn"

auditd_stop()
{

	/usr/sbin/audit -t
	sleep 1
}

load_rc_config $name
run_rc_command "$1"
Add auditd rc.d script. Submitted by: trhodes Obtained from: TrustedBSD Project 2006-02-02 10:02:55 +00:00			`#!/bin/sh`
			`#`
			`# $FreeBSD$`
			`#`
			`# Start up for the Audit daemon.`
			`#`

			`# PROVIDE: auditd`
			`# REQUIRE: syslogd`
			`# BEFORE: DAEMON`
Add 'nojail' keyword as auditd(8) can't really do anything useful when inside a jail. Discussed with: rwatson MFC after: 1 week 2012-01-06 14:00:31 +00:00			`# KEYWORD: nojail shutdown`
Add auditd rc.d script. Submitted by: trhodes Obtained from: TrustedBSD Project 2006-02-02 10:02:55 +00:00
			`. /etc/rc.subr`

			`name="auditd"`
			`stop_cmd="auditd_stop"`
			`command="/usr/sbin/${name}"`
			`rcvar="auditd_enable"`
			`command_args="${auditd_flags}"`
			`required_files="/etc/security/audit_class /etc/security/audit_control`
			`/etc/security/audit_event /etc/security/audit_user`
			`/etc/security/audit_warn"`

			`auditd_stop()`
			`{`

Sync to p4: o Add shutdown KEYWORD; o Remove PID check; o Stop auditd with '-t' o General cleanup. 2006-06-06 17:22:55 +00:00			`/usr/sbin/audit -t`
Sleep for one second after calling audit -t to give the audit daemon a chance to actually terminate the audit service and exit. Otherwise, on an rc.d/auditd restart, the new audit daemon instance may try to start auditing while the previous session is still running. Likewise, this ensures a chance for auditd to terminate the audit trail at system shutdown. Perhaps more ideally, the script would wait synchronously for auditd to exit rather than for an arbitrary but short period of time. MFC after: 3 days Obtained from: TrustedBSD Project 2006-09-24 17:31:04 +00:00			`sleep 1`
Add auditd rc.d script. Submitted by: trhodes Obtained from: TrustedBSD Project 2006-02-02 10:02:55 +00:00			`}`

			`load_rc_config $name`
			`run_rc_command "$1"`