From owner-p4-projects@FreeBSD.ORG Sat Sep 9 10:26:21 2006 Return-Path: X-Original-To: p4-projects@freebsd.org Delivered-To: p4-projects@freebsd.org Received: by hub.freebsd.org (Postfix, from userid 32767) id 62E3B16A47C; Sat, 9 Sep 2006 10:26:21 +0000 (UTC) X-Original-To: perforce@freebsd.org Delivered-To: perforce@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 10F4016A417 for ; Sat, 9 Sep 2006 10:26:21 +0000 (UTC) (envelope-from bb+lists.freebsd.perforce@cyrus.watson.org) Received: from repoman.freebsd.org (repoman.freebsd.org [216.136.204.115]) by mx1.FreeBSD.org (Postfix) with ESMTP id B246543D49 for ; Sat, 9 Sep 2006 10:26:20 +0000 (GMT) (envelope-from bb+lists.freebsd.perforce@cyrus.watson.org) Received: from repoman.freebsd.org (localhost [127.0.0.1]) by repoman.freebsd.org (8.13.6/8.13.6) with ESMTP id k89AQKmX027214 for ; Sat, 9 Sep 2006 10:26:20 GMT (envelope-from bb+lists.freebsd.perforce@cyrus.watson.org) Received: (from perforce@localhost) by repoman.freebsd.org (8.13.6/8.13.4/Submit) id k89AQK0s027211 for perforce@freebsd.org; Sat, 9 Sep 2006 10:26:20 GMT (envelope-from bb+lists.freebsd.perforce@cyrus.watson.org) Date: Sat, 9 Sep 2006 10:26:20 GMT Message-Id: <200609091026.k89AQK0s027211@repoman.freebsd.org> X-Authentication-Warning: repoman.freebsd.org: perforce set sender to bb+lists.freebsd.perforce@cyrus.watson.org using -f From: Robert Watson To: Perforce Change Reviews Cc: Subject: PERFORCE change 105888 for review X-BeenThere: p4-projects@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: p4 projects tree changes List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 09 Sep 2006 10:26:21 -0000 http://perforce.freebsd.org/chv.cgi?CH=105888 Change 105888 by rwatson@rwatson_sesame on 2006/09/09 10:25:42 Add AUE_SYSCTL_WRITE event to represent a write to a sysctl. This is slightly different than the Darwin admin/non-admin split, but likewise will allow us to categorize AUE_SYSCTL as an other event rather than an admin event, reducing its occurrence in trails for simple things like querying address space layout, etc, which otherwise litter trails of admin events. Affected files ... .. //depot/projects/trustedbsd/openbsm/bsm/audit_kevents.h#42 edit .. //depot/projects/trustedbsd/openbsm/etc/audit_event#14 edit Differences ... ==== //depot/projects/trustedbsd/openbsm/bsm/audit_kevents.h#42 (text+ko) ==== @@ -30,7 +30,7 @@ * * @APPLE_BSD_LICENSE_HEADER_END@ * - * $P4: //depot/projects/trustedbsd/openbsm/bsm/audit_kevents.h#41 $ + * $P4: //depot/projects/trustedbsd/openbsm/bsm/audit_kevents.h#42 $ */ #ifndef _BSM_AUDIT_KEVENTS_H_ @@ -469,6 +469,7 @@ #define AUE_EXTATTR_DELETE_LINK 43113 /* FreeBSD. */ #define AUE_KENV 43114 /* FreeBSD. */ #define AUE_JAIL_ATTACH 43115 /* FreeBSD. */ +#define AUE_SYSCTL_WRITE 43116 /* FreeBSD. */ /* * Darwin BSM uses a number of AUE_O_* definitions, which are aliased to the ==== //depot/projects/trustedbsd/openbsm/etc/audit_event#14 (text+ko) ==== @@ -1,5 +1,5 @@ # -# $P4: //depot/projects/trustedbsd/openbsm/etc/audit_event#13 $ +# $P4: //depot/projects/trustedbsd/openbsm/etc/audit_event#14 $ # 0:AUE_NULL:indir system call:no 1:AUE_EXIT:exit(2):pc @@ -322,7 +322,7 @@ 43018:AUE_FSTAT:fstat(2):fa 43019:AUE_FPATHCONF:fpathconf(2):fa 43020:AUE_GETDIRENTRIES:getdirentries(2):fr -43021:AUE_SYSCTL:sysctl(3):ad +43021:AUE_SYSCTL:sysctl(3):ot 43022:AUE_MLOCK:mlock(2):pc 43023:AUE_MUNLOCK:munlock(2):pc 43024:AUE_UNDELETE:undelete(2):fm @@ -417,6 +417,7 @@ 43113:AUE_EXTATTR_DELETE_LINK:extattr_delete_link(2):fm 43114:AUE_KENV:kenv(8):ad 43115:AUE_JAIL_ATTACH:jail_attach(2):ad +43116:AUE_SYSCTL_WRITE:sysctl(3):ad # # User space system events. #