From owner-cvs-all@FreeBSD.ORG Sun Sep 24 11:51:08 2006 Return-Path: X-Original-To: cvs-all@FreeBSD.org Delivered-To: cvs-all@FreeBSD.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 394BB16A640; Sun, 24 Sep 2006 11:51:08 +0000 (UTC) (envelope-from rwatson@FreeBSD.org) Received: from repoman.freebsd.org (repoman.freebsd.org [216.136.204.115]) by mx1.FreeBSD.org (Postfix) with ESMTP id A4A3243D60; Sun, 24 Sep 2006 11:51:02 +0000 (GMT) (envelope-from rwatson@FreeBSD.org) Received: from repoman.freebsd.org (localhost [127.0.0.1]) by repoman.freebsd.org (8.13.6/8.13.6) with ESMTP id k8OBp2Un011941; Sun, 24 Sep 2006 11:51:02 GMT (envelope-from rwatson@repoman.freebsd.org) Received: (from rwatson@localhost) by repoman.freebsd.org (8.13.6/8.13.4/Submit) id k8OBp2Im011937; Sun, 24 Sep 2006 11:51:02 GMT (envelope-from rwatson) Message-Id: <200609241151.k8OBp2Im011937@repoman.freebsd.org> From: Robert Watson Date: Sun, 24 Sep 2006 11:50:57 +0000 (UTC) To: doc-committers@FreeBSD.org, cvs-doc@FreeBSD.org, cvs-all@FreeBSD.org X-FreeBSD-CVS-Branch: HEAD Cc: Subject: cvs commit: doc/en_US.ISO8859-1/books/handbook/audit chapter.sgml X-BeenThere: cvs-all@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: CVS commit messages for the entire tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 24 Sep 2006 11:51:08 -0000 rwatson 2006-09-24 11:50:57 UTC FreeBSD doc repository Modified files: en_US.ISO8859-1/books/handbook/audit chapter.sgml Log: Update the audit handbook chapter in a number of ways to reflect recent changes and improvements: - Rephrase synposis now that we've merged audit support to 6.x. Resort to push all warnings to the end so that it reads more clearly. Add reviewing and reducing the audit trail to list of things learned, since it is covered. - Simplify class definition, as some of this content can appear in new definitions for selection expression, preselection, and reduction. The selection expression definition replaces the existing prefix definition, and "selection expression" is now used consistently throughout the document to refer to the previously unnamed matching strings. - Since audit support is part of the base system, remove comments about checking for configuration files, they will be present. Add note about starting auditd with the rc.d script once the new kernel is loaded. - When describing audit_event file, mention that that is where the class mappings live. - Since audit_warn will shortly learn to notify of rotation events, mention that. - Rename "Audit File Syntax" section to "Event Selection Expressions", since that's what the section talks about, and these expressions are used in more than one file. Correct an error in the prefix list, which was also present in the man page (and will be fixed in the next OpenBSM import). Include an example in this section. - Don't go into selection expression details in the audit_control section, as that's now earlier int he document. - Talk in more detail about audit_user fields. I had to check the source to make sure I understood this first! - Don't mention a special audit user, it's not a configuration we currently want to encourage. The audit group now fills this role. - Create a new sect2 section on viewing and reducing trails from the existing sect1 introduction for administering the audit subsystem, as it's a sufficiently detailed and independent set of text that it makes sense. Clarify some points regarding what you might use auditreduce for. Use -u instead of -e to match the user in the example. - Consistently say "audit trail file" instead of "audit log file", except when introducing the trail concept in the glossary. - Clarify notion of the audit group some more. - A number of rephrasings and simplifications. - Add myself as an author. Some new features from OpenBSM 1.0a12 are not yet described here, such as the filesz and policy entries in audit_control, and once that is merged, I will further update the document, which should clean up the trail rotation section. Obtained from: TrustedBSD Project Revision Changes Path 1.15 +236 -226 doc/en_US.ISO8859-1/books/handbook/audit/chapter.sgml