Date: Fri, 17 Jun 2011 13:04:44 GMT From: Ike McCreery <ihmccreery@gmail.com> To: freebsd-gnats-submit@FreeBSD.org Subject: misc/157946: 'BSM conversion requested for unknown event' generated by audit Message-ID: <201106171304.p5HD4i8q020543@red.freebsd.org> Resent-Message-ID: <201106171310.p5HDA9nF089080@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 157946 >Category: misc >Synopsis: 'BSM conversion requested for unknown event' generated by audit >Confidential: no >Severity: non-critical >Priority: medium >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Fri Jun 17 13:10:09 UTC 2011 >Closed-Date: >Last-Modified: >Originator: Ike McCreery >Release: 8.2 >Organization: Oberlin College Computer Science >Environment: FreeBSD hostname.host.extension 8.2-RELEASE FreeBSD 8.2-RELEASE #0: Thu Feb 17 02:41:51 UTC 2011 root@mason.cse.buffalo.edu:/usr/obj/usr/src/sys/GENERIC amd64 >Description: Running FreeBSD with auditing turned on, and flags and naflags both set to 'all' (in /etc/security/audit_control). I'm getting two very similar messages: BSM conversion requested for unknown event 43143 and BSM conversion requested for unknown event 43196 The first occurs whenever I ssh into the server (which succeeds), and the second crops up when doing ls -l. I and some coworkers have looked through the source, and it seems that both are occuring because syscalls are falling through in /sys/security/audit/audit_bsm.c (from the source). Neither number nor its label as defined in /etc/security/audit_event (43143=AUE_CLOSEFROM and 43196=AUE_LPATHCONF) show up in a search of audit_bsm.c. >How-To-Repeat: Configure auditing as follows in /etc/security/audit_control: dir:/var/audit flags:all minfree:5 naflags:all policy:all filesz:2M expire-after:10M Turn on auditing by running '/etc/rc.d/auditd start'. Running 'ls -l' should give an error (43196), as should ssh-ing into the machine (43143). >Fix: It seems that the source in /sys/security/audit/audit_bsm.c prints this message if an audit request falls through (to line 1585) in the big switch statement in the file. Perhaps it is missing these two cases. >Release-Note: >Audit-Trail: >Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201106171304.p5HD4i8q020543>