Heads up: OpenBSM 1.0a6, per-auditpipe preselection imported to CVS

From: Robert Watson <rwatson_at_FreeBSD.org>
Date: Mon, 5 Jun 2006 17:01:04 +0100 (BST)
This is a heads up to current_at_ users regarding two moderate sized sets of 
changes that entered FreeBSD CVS today:

(1) I imported OpenBSM 1.0 alpha 6.
(2) I imported support for per-auditpipe preselection.

Detailed commit messages are below.

Robert N M Watson

---------- Forwarded message ----------
Date: Mon, 5 Jun 2006 10:52:14 +0000 (UTC)
From: Robert Watson <rwatson_at_FreeBSD.org>
To: src-committers_at_FreeBSD.org, cvs-src_at_FreeBSD.org, cvs-all_at_FreeBSD.org
Subject: cvs commit: src/contrib/openbsm - Imported sources

rwatson     2006-06-05 10:52:14 UTC

   FreeBSD src repository

   src/contrib/openbsm - Imported sources
   Update of /home/ncvs/src/contrib/openbsm
   In directory repoman.freebsd.org:/tmp/cvs-serv59860

   Log Message:
   Vendor branch import of TrustedBSD OpenBSM 1.0 alpha 6:

   - Use AU_TO_WRITE and AU_NO_TO_WRITE for the 'keep' argument to au_close();
     previously we used hard-coded 0 and 1 values.
   - Add man page for au_open(), au_write(), au_close(), and
     au_close_buffer().
   - Support a more complete range of data types for the arbitrary data token:
     add AUR_CHAR (alias to AUR_BYTE), remove AUR_LONG, add AUR_INT32 (alias
     to AUR_INT), add AUR_INT64.
   - Add au_close_token(), which allows writing a single token_t to a memory
     buffer.  Not likely to be used much by applications, but useful for
     writing test tools.
   - Modify au_to_file() so that it accepts a timeval in user space, not just
     kernel -- this is not a Solaris BSM API so can be modified without
     causing compatibility issues.
   - Define a new API, au_to_header32_tm(), which adds a struct timeval
     argument to the ordinary au_to_header32(), which is now implemented by
     wrapping au_to_header32_tm() and calling gettimeofday().  #ifndef KERNEL
     the APIs that invoke gettimeofday(), rather than having a variable
     definition.  Don't try to retrieve time zone information using
     gettimeofday(), as it's not needed, and introduces possible failure
     modes.
   - Don't perform byte order transformations on the addr/machine fields of
     the terminal ID that appears in the process32/subject32 tokens.  These
     are assumed to be IP addresses, and as such, to be in network byte
     order.
   - Universally, APIs now assume that IP addresses and ports are provided
     in network byte order.  APIs now generally provide these types in
     network byte order when decoding.
   - Beginnings of an OpenBSM test framework can now be found in openbsm/test.
     This code is not built or installed by default.
   - auditd now assigns more appropriate syslog levels to its debugging and
     error information.
   - Support for audit filters introduced: audit filters are dynamically
     loaded shared objects that run in the context of a new daemon,
     auditfilterd.  The daemon reads from an audit pipe and feeds both BSM and
     parsed versions of records to shared objects using a module API.  This
     will provide a framework for the writing of intrusion detection services.
   - New utility API, audit_submit(), added to capture common elements of audit
     record submission for many applications.

   Obtained from:	TrustedBSD Project

   Status:

   Vendor Tag:	TrustedBSD
   Release Tags:	OPENBSM_1_0_ALPHA_6

   U src/contrib/openbsm/HISTORY
   U src/contrib/openbsm/LICENSE
   U src/contrib/openbsm/Makefile.am
   U src/contrib/openbsm/Makefile.in
   U src/contrib/openbsm/README
   U src/contrib/openbsm/TODO
   U src/contrib/openbsm/VERSION
   U src/contrib/openbsm/aclocal.m4
   U src/contrib/openbsm/autogen.sh
   U src/contrib/openbsm/configure
   U src/contrib/openbsm/configure.ac
   U src/contrib/openbsm/bin/Makefile.am
   U src/contrib/openbsm/bin/Makefile.in
   U src/contrib/openbsm/bin/audit/Makefile.am
   U src/contrib/openbsm/bin/audit/Makefile.in
   U src/contrib/openbsm/bin/audit/audit.8
   U src/contrib/openbsm/bin/audit/audit.c
   U src/contrib/openbsm/bin/auditd/Makefile.am
   U src/contrib/openbsm/bin/auditd/Makefile.in
   U src/contrib/openbsm/bin/auditd/audit_warn.c
   U src/contrib/openbsm/bin/auditd/auditd.8
   U src/contrib/openbsm/bin/auditd/auditd.c
   U src/contrib/openbsm/bin/auditd/auditd.h
   N src/contrib/openbsm/bin/auditfilterd/Makefile.am
   N src/contrib/openbsm/bin/auditfilterd/Makefile.in
   N src/contrib/openbsm/bin/auditfilterd/auditfilterd.8
   N src/contrib/openbsm/bin/auditfilterd/auditfilterd.c
   N src/contrib/openbsm/bin/auditfilterd/auditfilterd.h
   N src/contrib/openbsm/bin/auditfilterd/auditfilterd_conf.c
   U src/contrib/openbsm/bin/auditreduce/Makefile.am
   U src/contrib/openbsm/bin/auditreduce/Makefile.in
   U src/contrib/openbsm/bin/auditreduce/auditreduce.1
   U src/contrib/openbsm/bin/auditreduce/auditreduce.c
   U src/contrib/openbsm/bin/auditreduce/auditreduce.h
   U src/contrib/openbsm/bin/praudit/Makefile.am
   U src/contrib/openbsm/bin/praudit/Makefile.in
   U src/contrib/openbsm/bin/praudit/praudit.1
   U src/contrib/openbsm/bin/praudit/praudit.c
   U src/contrib/openbsm/bsm/Makefile.am
   U src/contrib/openbsm/bsm/Makefile.in
   U src/contrib/openbsm/bsm/audit.h
   N src/contrib/openbsm/bsm/audit_filter.h
   U src/contrib/openbsm/bsm/audit_internal.h
   U src/contrib/openbsm/bsm/audit_kevents.h
   U src/contrib/openbsm/bsm/audit_record.h
   U src/contrib/openbsm/bsm/audit_uevents.h
   U src/contrib/openbsm/bsm/libbsm.h
   U src/contrib/openbsm/compat/endian.h
   U src/contrib/openbsm/compat/queue.h
   U src/contrib/openbsm/config/config.guess
   U src/contrib/openbsm/config/config.h.in
   U src/contrib/openbsm/config/config.sub
   U src/contrib/openbsm/config/depcomp
   U src/contrib/openbsm/config/install-sh
   U src/contrib/openbsm/config/ltmain.sh
   U src/contrib/openbsm/config/missing
   U src/contrib/openbsm/etc/audit_class
   U src/contrib/openbsm/etc/audit_control
   U src/contrib/openbsm/etc/audit_event
   N src/contrib/openbsm/etc/audit_filter
   U src/contrib/openbsm/etc/audit_user
   U src/contrib/openbsm/etc/audit_warn
   U src/contrib/openbsm/libbsm/Makefile.am
   U src/contrib/openbsm/libbsm/Makefile.in
   U src/contrib/openbsm/libbsm/au_class.3
   U src/contrib/openbsm/libbsm/au_control.3
   U src/contrib/openbsm/libbsm/au_event.3
   U src/contrib/openbsm/libbsm/au_free_token.3
   U src/contrib/openbsm/libbsm/au_io.3
   U src/contrib/openbsm/libbsm/au_mask.3
   N src/contrib/openbsm/libbsm/au_open.3
   U src/contrib/openbsm/libbsm/au_token.3
   U src/contrib/openbsm/libbsm/au_user.3
   N src/contrib/openbsm/libbsm/audit_submit.3
   U src/contrib/openbsm/libbsm/bsm_audit.c
   U src/contrib/openbsm/libbsm/bsm_class.c
   U src/contrib/openbsm/libbsm/bsm_control.c
   U src/contrib/openbsm/libbsm/bsm_event.c
   U src/contrib/openbsm/libbsm/bsm_flags.c
   U src/contrib/openbsm/libbsm/bsm_io.c
   U src/contrib/openbsm/libbsm/bsm_mask.c
   U src/contrib/openbsm/libbsm/bsm_notify.c
   U src/contrib/openbsm/libbsm/bsm_token.c
   U src/contrib/openbsm/libbsm/bsm_user.c
   U src/contrib/openbsm/libbsm/libbsm.3
   U src/contrib/openbsm/libbsm/bsm_wrappers.c
   U src/contrib/openbsm/man/Makefile.am
   U src/contrib/openbsm/man/Makefile.in
   U src/contrib/openbsm/man/audit.2
   U src/contrib/openbsm/man/audit.log.5
   U src/contrib/openbsm/man/audit_class.5
   U src/contrib/openbsm/man/audit_control.5
   U src/contrib/openbsm/man/audit_event.5
   U src/contrib/openbsm/man/audit_user.5
   U src/contrib/openbsm/man/audit_warn.5
   U src/contrib/openbsm/man/auditctl.2
   U src/contrib/openbsm/man/auditon.2
   U src/contrib/openbsm/man/getaudit.2
   U src/contrib/openbsm/man/getauid.2
   U src/contrib/openbsm/man/setaudit.2
   U src/contrib/openbsm/man/setauid.2
   N src/contrib/openbsm/modules/Makefile.am
   N src/contrib/openbsm/modules/Makefile.in
   N src/contrib/openbsm/modules/auditfilter_noop/Makefile.am
   N src/contrib/openbsm/modules/auditfilter_noop/Makefile.in
   N src/contrib/openbsm/modules/auditfilter_noop/auditfilter_noop.c
   N src/contrib/openbsm/test/Makefile.am
   N src/contrib/openbsm/test/Makefile.in
   N src/contrib/openbsm/test/bsm/Makefile.am
   N src/contrib/openbsm/test/bsm/Makefile.in
   N src/contrib/openbsm/test/bsm/generate.c
   U src/contrib/openbsm/tools/Makefile.am
   U src/contrib/openbsm/tools/Makefile.in
   U src/contrib/openbsm/tools/audump.c

   No conflicts created by this import




---------- Forwarded message ----------
Date: Mon, 5 Jun 2006 14:48:17 +0000 (UTC)
From: Robert Watson <rwatson_at_FreeBSD.org>
To: src-committers_at_FreeBSD.org, cvs-src_at_FreeBSD.org, cvs-all_at_FreeBSD.org
Subject: cvs commit: src/sys/security/audit audit.c audit_bsm_klib.c
     audit_ioctl.h audit_pipe.c audit_private.h audit_worker.c

rwatson     2006-06-05 14:48:17 UTC

   FreeBSD src repository

   Modified files:
     sys/security/audit   audit.c audit_bsm_klib.c audit_ioctl.h
                          audit_pipe.c audit_private.h
                          audit_worker.c
   Log:
   Introduce support for per-audit pipe preselection independent from the
   global audit trail configuration.  This allows applications consuming
   audit trails to specify parameters for which audit records are of
   interest, including selecting records not required by the global trail.
   Allowing application interest specification without changing the global
   configuration allows intrusion detection systems to run without
   interfering with global auditing or each other (if multiple are
   present).  To implement this:

   - Kernel audit records now carry a flag to indicate whether they have
     been selected by the global trail or by the audit pipe subsystem,
     set during record commit, so that this information is available
     after BSM conversion when delivering the BSM to the trail and audit
     pipes in the audit worker thread asynchronously.  Preselection by
     either record target will cause the record to be kept.

   - Similar changes to preselection when the audit record is created
     when the system call is entering: consult both the global trail and
     pipes.

   - au_preselect() now accepts the class in order to avoid repeatedly
     looking up the mask for each preselection test.

   - Define a series of ioctls that allow applications to specify whether
     they want to track the global trail, or program their own
     preselection parameters: they may specify their own flags and naflags
     masks, similar to the global masks of the same name, as well as a set
     of per-auid masks.  They also set a per-pipe mode specifying whether
     they track the global trail, or user their own -- the door is left
     open for future additional modes.  A new ioctl is defined to allow a
     user process to flush the current audit pipe queue, which can be used
     after reprogramming pre-selection to make sure that only records of
     interest are received in future reads.

   - Audit pipe data structures are extended to hold the additional fields
     necessary to support preselection.  By default, audit pipes track the
     global trail, so "praudit /dev/auditpipe" will track the global audit
     trail even though praudit doesn't program the audit pipe selection
     model.

   - Comment about the complexities of potentially adding partial read
     support to audit pipes.

   By using a set of ioctls, applications can select which records are of
   interest, and toggle the preselection mode.

   Obtained from:  TrustedBSD Project

   Revision  Changes    Path
   1.15      +28 -16    src/sys/security/audit/audit.c
   1.4       +3 -6      src/sys/security/audit/audit_bsm_klib.c
   1.3       +32 -0     src/sys/security/audit/audit_ioctl.h
   1.7       +393 -13   src/sys/security/audit/audit_pipe.c
   1.9       +13 -3     src/sys/security/audit/audit_private.h
   1.8       +49 -27    src/sys/security/audit/audit_worker.c
_______________________________________________
trustedbsd-audit_at_FreeBSD.org mailing list
http://lists.freebsd.org/mailman/listinfo/trustedbsd-audit
To unsubscribe, send any mail to "trustedbsd-audit-unsubscribe_at_FreeBSD.org"
Received on Mon Jun 05 2006 - 20:43:39 UTC

This archive was generated by hypermail 2.4.0 : Wed May 19 2021 - 11:38:56 UTC