Date: Mon, 17 Oct 2005 19:38:03 GMT From: Robert Watson <rwatson@FreeBSD.org> To: Perforce Change Reviews <perforce@freebsd.org> Subject: PERFORCE change 85462 for review Message-ID: <200510171938.j9HJc3CV097856@repoman.freebsd.org>
next in thread | raw e-mail | index | archive | help
http://perforce.freebsd.org/chv.cgi?CH=85462 Change 85462 by rwatson@rwatson_peppercorn on 2005/10/17 19:37:34 For kill() and okillpg(), audit the target process (if just one), or the pid if it's a broadcast. Note that we might want to audit okillpg() as AUE_KILL, and if so, we'll need to negate the argument. Affected files ... .. //depot/projects/trustedbsd/audit3/sys/kern/kern_sig.c#7 edit Differences ... ==== //depot/projects/trustedbsd/audit3/sys/kern/kern_sig.c#7 (text+ko) ==== @@ -1399,12 +1399,14 @@ if ((p = zpfind(uap->pid)) == NULL) return (ESRCH); } + AUDIT_ARG(process, p); error = p_cansignal(td, p, uap->signum); if (error == 0 && uap->signum) psignal(p, uap->signum); PROC_UNLOCK(p); return (error); } + AUDIT_ARG(pid, uap->pid); switch (uap->pid) { case -1: /* broadcast signal */ return (killpg1(td, uap->signum, 0, 1)); @@ -1433,7 +1435,13 @@ register struct okillpg_args *uap; { + /* + * XXXAUDIT: We might want to use AUE_KILL and -uap->pgid instead of + * this here. That would avoid using a non-BSM audit event type + * without losing much information. + */ AUDIT_ARG(signum, uap->signum); + AUDIT_ARG(pid, uap->pgid); if ((u_int)uap->signum > _SIG_MAXSIG) return (EINVAL);
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200510171938.j9HJc3CV097856>