Commit Graph

122025 Commits

Author SHA1 Message Date
rwatson
3011a662a5 Merge OpenBSM 1.0 alpha 3 include file changes from contrib/openbsm/bsm
to sys/bsm:

- Correct error in definition of audit event for Linux setfsgid().
- Add audit event identifier for sysarch().

Obtained from:	TrustedBSD Project
2006-02-06 01:12:46 +00:00
wsalamon
d0c0ad5594 Audit the arguments (user/group IDs) for the system calls that set these IDs.
Obtained from: TrustedBSD Project
Approved by: rwatson (mentor)
2006-02-06 00:32:33 +00:00
wsalamon
c41a486364 Audit the args to rfork(), and the child PID for all fork system calls.
Obtained from: TrustedBSD Project
Approved by: rwatson (mentor)
2006-02-06 00:28:50 +00:00
wsalamon
88c7ad2392 Audit the pid being requested in wait4().
Obtained from: TrustedBSD Project
Approved by: rwatson (mentor)
2006-02-06 00:19:09 +00:00
ceri
961deee05e Another update for reality: "dangerously dedicated" mode is now
achieved by hitting 'F', which is no longer undocumented.

PR:		bin/92533
Submitted by:	Rudolf Cejka <cejkar at fit.vutbr dot cz>
2006-02-06 00:06:39 +00:00
rwatson
6d05b5ade5 This commit was generated by cvs2svn to compensate for changes in r155364,
which included commits to RCS files with non-trunk default branches.
2006-02-06 00:06:04 +00:00
rwatson
4fae3f6a4a Vendor branch import of OpenBSM 1.0 alpha 3:
- Man page formatting, cross reference, mlinks, and accuracy improvements.
- auditd and tools now compile and run on FreeBSD/arm.
- auditd will now fchown() the trail file to the audit review group, if
  defined at compile-time.
- Added AUE_SYSARCH for FreeBSD.
- Definition of AUE_SETFSGID fixed for Linux.

Many thanks to:	brueffer, cognet
Obtained from:	TrustedBSD Project
2006-02-06 00:06:04 +00:00
rwatson
57234d7f8c Correct typo in sample CVS import line: must specify full path to the
CVS repository on repoman.
2006-02-06 00:03:39 +00:00
wsalamon
645740538d Add auditing of arguments to the close() and fstat() system calls. Much more
argument auditing yet to come, for remaining system calls in this file.

Obtained from: TrustedBSD Project
Approved by: rwatson (mentor)
2006-02-05 23:57:32 +00:00
rwatson
e04cb6becd Regenerate. 2006-02-05 23:28:46 +00:00
rwatson
a31938806b Assign audit event identfiers to Xenix system calls. Note: AUE_EACCESS
is assigned to xenix_eaccess() instead of AUE_ACCESS, as that is the
intended meaning of the system call.  xenix_eaccess() should be
reimplemented using our native eaccess() implementation so that it
works as intended.

Obtained from:	TrustedBSD Project
2006-02-05 23:28:01 +00:00
rwatson
7b3f1796f8 Correct help line: list targets, not names of files generated by targets
when no argument is provided to make.

MFC after:	1 week
2006-02-05 23:25:19 +00:00
rwatson
5570c55a29 Regenerate (accidentally also committed in commit that updated
syscalls.isc).
2006-02-05 23:16:20 +00:00
rwatson
ee99b2f3a5 Assign audit event identifiers to ibcs2 ISC system calls.
Obtained from:	TrustedBSD Project
2006-02-05 23:15:22 +00:00
mlaier
1bebb42407 pflog is a separate module now.
Submitted by:	Antoine Brodin
PR:		kern/88271
MFC after:	1 week
2006-02-05 22:38:08 +00:00
cognet
2d37c104ef Backout rev 1.12. It would have been a good thing, if gcc was smart enough
not to generate bad code.
2006-02-05 22:06:12 +00:00
rwatson
4cd971d35d On process exit, audit the return value of the process, and commit the
record immediately, as this system call never returns.

Obtained from:	TrustedBSD Project
2006-02-05 21:08:25 +00:00
rwatson
8b356bb2d7 When GC'ing a thread, assert that it has no active audit record.
This should not happen, but with this assert, brueffer and I would
not have spent 45 minutes trying to figure out why he wasn't
seeing audit records with the audit version in CVS.

Obtained from:	TrustedBSD Project
2006-02-05 21:06:09 +00:00
bmah
29de4be4fa Add some new release notes for 2006 security advisories:
SA-06:{01,02,03,04,05,06,07}.

(SA-06:08 does not appear to apply to CURRENT.)

Bump copyright date while here.
2006-02-05 20:54:53 +00:00
rwatson
a6de13a9ec Assign gid 77 to audit instead of gid 73. The ports group list did not
include '73', which was assigned in a ports passwd entry to ircservices.

Pointed out by:	ceri
2006-02-05 19:34:09 +00:00
ceri
c06055baa8 The rpc.pcnfsd server was in the base for a little over seven minutes
back in 1994.  Change the example entry to point at the port, as per
the entries for uucpd et al.
2006-02-05 19:23:05 +00:00
ceri
697a8c4b0d Correct a user-visible typo. 2006-02-05 18:57:01 +00:00
ceri
ddacd8231e Gratuitous "typo in comment" fix. 2006-02-05 18:49:52 +00:00
ceri
3ee3d3c21a Bring these files somewhat into the present.
Perform some rewording while here.

Remove register.hlp, since the code that deals with it was removed
nearly 7 years ago.
2006-02-05 18:46:46 +00:00
rwatson
3926af01b2 Change group for /var/audit to audit, so that audit review can be
delegated to non-administrators.

Obtained from:	TrustedBSD Project
2006-02-05 18:22:56 +00:00
rwatson
da1aa8f5a8 Allocate an 'audit' group, membership in which will grant the audit
review right by virtue of read file permission on /var/audit and its
contents.

Obtained from:	TrustedBSD Project
2006-02-05 18:04:39 +00:00
netchild
363262abcc Convert NULL checks into KASSERT (and move them before the first
dereferencing) since a NULL value would be a bug here.

Note: Both affected functions look very similar. A refactoring may
be beneficial.

CID:		483, 485
Found with:	Coverity Prevent(tm)
Discussed with:	ariff
MFC after:	5 days
2006-02-05 17:47:26 +00:00
imp
98ba0aaf4b an driver not endian clean, so don't enable on sparc64 2006-02-05 17:38:28 +00:00
netchild
930a45b561 forced commit: previous commit was CID 429 2006-02-05 17:35:13 +00:00
netchild
88beeba9e3 forced commit: previous commit was CID 483 2006-02-05 17:34:13 +00:00
netchild
cc33bd5ae6 A pointer was checked for NULL after dereferencing it. The check is not
needed here, except there's a bug which results in detaching the device
twice.

Move the NULL pointer check to the beginning of the function and convert
it into a KASSERT.

CID:		420
Found with:	Coverity Prevent(tm)
Discussed with:	ariff
MFC after:	5 days
2006-02-05 17:33:18 +00:00
mlaier
0c9bbeed73 Make pflog a seperate module. As a result pflog_packet() becomes a function
pointer that is declared in pf_ioctl.c

Requested by:	yar (as part of the module build reorg)
MFC after:	1 week
X-MFC with:	yar's module reorg
2006-02-05 17:17:32 +00:00
netchild
d249843f8b Fix memory leak in some failure cases.
CID:		420
Found with:	Coverity Prevent(tm)
2006-02-05 17:10:52 +00:00
rwatson
62220258e1 Add AUDITVNODE[12] flags to namei(), which cause namei() to audit path
and vnode attribute information for looked up vnodes during the lookup
operation.  This will allow consumers of namei() to specify that this
information be added to the in-process audit record.

Submitted by:	wsalamon
Obtained from:	TrustedBSD Project
2006-02-05 15:42:01 +00:00
ume
e1e7fa68be shut up strict-aliasing rules warning. 2006-02-05 09:52:40 +00:00
kensmith
92ff892e7e Move asr driver from global NOTES to i386-specific NOTES. Requestor
reports it is neither endian-clean or 64-bit clean.  :-)

Requested by:	scottl
2006-02-05 05:06:04 +00:00
scottl
df4109839c Squash a couple more invalid long casts. 2006-02-05 05:05:27 +00:00
davidxu
08b1c5c928 Now, thread name is stored in kernel, userland no longer has to keep it. 2006-02-05 03:04:54 +00:00
davidxu
118990614c use syscall thr_set_name to implement pthread_set_name_np. 2006-02-05 02:26:17 +00:00
davidxu
4b1239a63f Regenerate. 2006-02-05 02:23:41 +00:00
davidxu
7ef206e1a8 Implement thr_set_name to set a name for thread.
Reviewed by: julian
2006-02-05 02:18:46 +00:00
imp
f2384c93e3 Import support for the Atmel AT91RM9200 CPU/Microcontroller. This SoC
is a ARM920T based CPU with a bunch of built-in peripherals.  The
inital import supports the SPI bus, the TWI bus (although iicbus
integration is not complete), the uarts, the system timer and the
onboard ethernet.  Support for the Kwikbyte KB9202
(http://www.kwikbyte.com) board is also included, although there's no
reason why the 9200 and the 9201 wouldn't also work.  Primitive
support for running under the skyeye emulator is also provided
(although skyeye's support for the AT91RM9200 is a little weak).

The code has been structured so that other members of Atmel's arm family can
be supported in the future.  The AT91SAM9260 is not presently supported
due to lack of hardware.  The arm7tdmi families are also not supported
becasue they lack an MMU.

Many thanks to cognet@ for his help and assistance in bringing up this
board.  He did much of the vm work and wrote parts of the uart and
system timer code as well as the bus space implementation.

The system boots to single user w/o problem, although the serial
console is a little slow and the ethernet driver is still in flux.

This work was sponsored by Timing Solutions, Corporation.  I am
grateful to their support of the FreeBSD project in this manner.
2006-02-04 23:32:13 +00:00
marius
d83080f6ae Enable getty(8) on ttyu2 by default in order to get machines that use a
RSC (Remote System Control) connected via uart2 as console working out
of the box. On machines that use uart2 to connect a keyboard and thus
the ttyu2 node doesn't exist this will trigger a warning from getty(8)
but cause no real harm.

MFC after:	1 week
2006-02-04 23:30:09 +00:00
marius
d8dc7b1b43 - Add support for using LOM (Lights Out Management) and RSC (Remote System
Control) devices as console. These are microcontrollers which are either
  on-board or part of an add-on card and provide terminal server, remote
  power switch and monitoring functionality. For console usage these are
  connected to the rest of the system via a SCC or an UART. This commit adds
  support for the following variants (corresponds to what 'input-device' and
  'output-device' have to be set to):
  rsc		found on-board in E250 and supposedly some Netra, connected
		via a SAB82532, com. parameters can be determined via OFW
  rsc-console	RSC card found in E280R, Fire V4x0, Fire V8x0, connected
		via a NS16550, hardwired to 115200 8N1
  lom-console	LOMlite2 card found in Netra 20/T4, connected via a NS16550,
		hardwired to 9600 8N1

- Add my copyright to uart_cpu_sparc64.c as I've rewritten about one third
  of that file over time.

Tested on:	E250, E280R
Thanks to:	dwhite@ for providing access to an E280R
OK'ed by:	marcel
MFC after:	1 week
2006-02-04 23:27:16 +00:00
imp
677f6ed4ce Silence the strict-alias warnings. Make a trip through (void *) when
casting a structure to a uint32_t *.  Many drivers in the tree do this, but
I'll not update them until these changes can be reviewed by the pedantic
standards folks.
2006-02-04 22:51:03 +00:00
alc
83970835a0 Remove an unnecessary call to pmap_remove_all(). The given page is not
mapped because its contents are invalid.
2006-02-04 22:37:10 +00:00
imp
2b542ec878 Type of overrun_buf doesn't matter to this code, but does to gcc.
Make it a void *.
2006-02-04 22:33:08 +00:00
ceri
3f00bfdb42 Perform minor rewording and grammatical improvement. Add a missing Xr. 2006-02-04 22:17:38 +00:00
imp
df0be51131 Use void * for pointer rather than u_int8_t *, since it doesn't
matter.  Well it does for type punning warnings.
2006-02-04 22:14:20 +00:00
imp
5ca8d6a336 Now that TUNABLE_ULONG is in the tree, and has been for a while, use it.
This also avoids typepunning.
2006-02-04 21:56:14 +00:00