From owner-p4-projects@FreeBSD.ORG Fri Oct 19 14:04:31 2007 Return-Path: Delivered-To: p4-projects@freebsd.org Received: by hub.freebsd.org (Postfix, from userid 32767) id 80C9B16A46C; Fri, 19 Oct 2007 14:04:31 +0000 (UTC) Delivered-To: perforce@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 3A63916A421 for ; Fri, 19 Oct 2007 14:04:31 +0000 (UTC) (envelope-from rwatson@FreeBSD.org) Received: from cyrus.watson.org (cyrus.watson.org [209.31.154.42]) by mx1.freebsd.org (Postfix) with ESMTP id E160513C458 for ; Fri, 19 Oct 2007 14:04:30 +0000 (UTC) (envelope-from rwatson@FreeBSD.org) Received: from fledge.watson.org (fledge.watson.org [209.31.154.41]) by cyrus.watson.org (Postfix) with ESMTP id 5175947245; Fri, 19 Oct 2007 09:48:53 -0400 (EDT) Date: Fri, 19 Oct 2007 14:48:53 +0100 (BST) From: Robert Watson X-X-Sender: robert@fledge.watson.org To: "Andrew R. Reiter" In-Reply-To: <20071019075904.F32470@fledge.watson.org> Message-ID: <20071019144713.F29035@fledge.watson.org> References: <200710191100.l9JB06KB005138@repoman.freebsd.org> <20071019075904.F32470@fledge.watson.org> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed Cc: Perforce Change Reviews Subject: Re: PERFORCE change 127769 for review X-BeenThere: p4-projects@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: p4 projects tree changes List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 Oct 2007 14:04:31 -0000 On Fri, 19 Oct 2007, Andrew R. Reiter wrote: > Just curious -- how come openbsm removed AU_ class masks; isnt that needed > for log analysis? or at least *better* log analysis? I think these definitions were largely historical -- the class masks are also defined in /etc/security/audit_class, and customizable for each system they are installed on. The hard-coded mask definitions below were never used, with with the exception of AU_NULL (no bits set). Likewise, they probably shouldn't be used, on the basis that they are compile-time rather than run-time, and may conflict with run-time settings -- i.e., for hosts where a different set of classes have been defined. Robert N M Watson Computer Laboratory University of Cambridge > > Cheers, > Andrew > > -- > Andrew R. Reiter > arr@watson.org > 858 245 3682 > > On Fri, 19 Oct 2007, Robert Watson wrote: > >> http://perforce.freebsd.org/chv.cgi?CH=127769 >> >> Change 127769 by rwatson@rwatson_zoo on 2007/10/19 10:59:33 >> >> Integrate OpenBSM changes into audit3 kernel. >> >> Affected files ... >> >> .. //depot/projects/trustedbsd/audit3/sys/bsm/audit.h#40 integrate >> >> Differences ... >> >> ==== //depot/projects/trustedbsd/audit3/sys/bsm/audit.h#40 (text+ko) ==== >> >> @@ -26,7 +26,7 @@ >> * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF >> * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. >> * >> - * $P4: //depot/projects/trustedbsd/audit3/sys/bsm/audit.h#39 $ >> + * $P4: //depot/projects/trustedbsd/audit3/sys/bsm/audit.h#40 $ >> * $FreeBSD: src/sys/bsm/audit.h,v 1.9 2007/07/22 12:28:12 rwatson Exp $ >> */ >> >> @@ -75,44 +75,6 @@ >> #define AU_DEFAUDITID -1 >> >> /* >> - * Define the masks for the classes of audit events. >> - */ >> -#define AU_NULL 0x00000000 >> -#define AU_FREAD 0x00000001 >> -#define AU_FWRITE 0x00000002 >> -#define AU_FACCESS 0x00000004 >> -#define AU_FMODIFY 0x00000008 >> -#define AU_FCREATE 0x00000010 >> -#define AU_FDELETE 0x00000020 >> -#define AU_CLOSE 0x00000040 >> -#define AU_PROCESS 0x00000080 >> -#define AU_NET 0x00000100 >> -#define AU_IPC 0x00000200 >> -#define AU_NONAT 0x00000400 >> -#define AU_ADMIN 0x00000800 >> -#define AU_LOGIN 0x00001000 >> -#define AU_TFM 0x00002000 >> -#define AU_APPL 0x00004000 >> -#define AU_SETL 0x00008000 >> -#define AU_IFLOAT 0x00010000 >> -#define AU_PRIV 0x00020000 >> -#define AU_MAC_RW 0x00040000 >> -#define AU_XCONN 0x00080000 >> -#define AU_XCREATE 0x00100000 >> -#define AU_XDELETE 0x00200000 >> -#define AU_XIFLOAT 0x00400000 >> -#define AU_XPRIVS 0x00800000 >> -#define AU_XPRIVF 0x01000000 >> -#define AU_XMOVE 0x02000000 >> -#define AU_XDACF 0x04000000 >> -#define AU_XMACF 0x08000000 >> -#define AU_XSECATTR 0x10000000 >> -#define AU_IOCTL 0x20000000 >> -#define AU_EXEC 0x40000000 >> -#define AU_OTHER 0x80000000 >> -#define AU_ALL 0xffffffff >> - >> -/* >> * IPC types. >> */ >> #define AT_IPC_MSG ((u_char)1) /* Message IPC id. */ >> >> >