From owner-freebsd-security@FreeBSD.ORG  Thu Oct  2 12:19:11 2008
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id A33E91065686
	for <freebsd-security@freebsd.org>;
	Thu,  2 Oct 2008 12:19:11 +0000 (UTC)
	(envelope-from rwatson@FreeBSD.org)
Received: from cyrus.watson.org (cyrus.watson.org [65.122.17.42])
	by mx1.freebsd.org (Postfix) with ESMTP id 7E2AF8FC13
	for <freebsd-security@freebsd.org>;
	Thu,  2 Oct 2008 12:19:11 +0000 (UTC)
	(envelope-from rwatson@FreeBSD.org)
Received: from fledge.watson.org (fledge.watson.org [65.122.17.41])
	by cyrus.watson.org (Postfix) with ESMTP id 18C0C46B03;
	Thu,  2 Oct 2008 08:19:11 -0400 (EDT)
Date: Thu, 2 Oct 2008 13:19:11 +0100 (BST)
From: Robert Watson <rwatson@FreeBSD.org>
X-X-Sender: robert@fledge.watson.org
To: Attila Nagy <bra@fsn.hu>
In-Reply-To: <48DB7CA4.80609@fsn.hu>
Message-ID: <alpine.BSF.1.10.0810021317530.9076@fledge.watson.org>
References: <48DB7CA4.80609@fsn.hu>
User-Agent: Alpine 1.10 (BSF 962 2008-03-14)
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed
Cc: freebsd-security@freebsd.org
Subject: Re: Missing /dev/auditpipe
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: "Security issues \[members-only posting\]"
	<freebsd-security.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>, 
	<mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>, 
	<mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 02 Oct 2008 12:19:11 -0000


On Thu, 25 Sep 2008, Attila Nagy wrote:

> Running RELENG_7 (and HEAD too), and I can't find the auditpipe device. Is 
> there anything which should be set in order to make it useable?
>
> auditd runs and logs to /var/audit, which I can read with praudit.

(Following up to the list because Attila and I exchanged e-mail offline)

The problem here was that /dev/auditpipe is cloning, so it doesn't exist until 
you try to open it.  In FreeBSD 8.x, and possibly 7.2, we're moving to the new 
per-cdev private data so that /dev/auditpipe will always exist supporting 
multiple session, and there won't be a series of dynamicall created devices, 
but that's not ready to hit a release yet.

Robert N M Watson
Computer Laboratory
University of Cambridge