From owner-freebsd-hackers@FreeBSD.ORG  Thu Nov  8 20:08:13 2012
Return-Path: <owner-freebsd-hackers@FreeBSD.ORG>
Delivered-To: freebsd-hackers@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52])
 by hub.freebsd.org (Postfix) with ESMTP id 4F041A31
 for <freebsd-hackers@freebsd.org>; Thu,  8 Nov 2012 20:08:13 +0000 (UTC)
 (envelope-from rwatson@FreeBSD.org)
Received: from cyrus.watson.org (cyrus.watson.org [65.122.17.42])
 by mx1.freebsd.org (Postfix) with ESMTP id 22C098FC08
 for <freebsd-hackers@freebsd.org>; Thu,  8 Nov 2012 20:08:13 +0000 (UTC)
Received: from fledge.watson.org (fledge.watson.org [65.122.17.41])
 by cyrus.watson.org (Postfix) with ESMTPS id 2854146B2E;
 Thu,  8 Nov 2012 15:08:12 -0500 (EST)
Date: Thu, 8 Nov 2012 20:08:12 +0000 (GMT)
From: Robert Watson <rwatson@FreeBSD.org>
X-X-Sender: robert@fledge.watson.org
To: dave jones <s.dave.jones@gmail.com>
Subject: Re: A question about creating a system call
In-Reply-To: <CANf5e8Y_zGCHmZfmCbNAx3=4+NzinyyVUMgndv+pzqvxK4gzxA@mail.gmail.com>
Message-ID: <alpine.BSF.2.00.1211082007540.59157@fledge.watson.org>
References: <CANf5e8Y_zGCHmZfmCbNAx3=4+NzinyyVUMgndv+pzqvxK4gzxA@mail.gmail.com>
User-Agent: Alpine 2.00 (BSF 1167 2008-08-23)
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed
Cc: freebsd-hackers@freebsd.org
X-BeenThere: freebsd-hackers@freebsd.org
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: Technical Discussions relating to FreeBSD
 <freebsd-hackers.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/freebsd-hackers>, 
 <mailto:freebsd-hackers-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-hackers>
List-Post: <mailto:freebsd-hackers@freebsd.org>
List-Help: <mailto:freebsd-hackers-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-hackers>,
 <mailto:freebsd-hackers-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 08 Nov 2012 20:08:13 -0000

Hi Dave:

This wiki page may be of value:

 	http://wiki.freebsd.org/AddingAuditEvents

Robert N M Watson
Computer Laboratory
University of Cambridge

On Thu, 8 Nov 2012, dave jones wrote:

> Hello,
>
> I know how to create system calls, but I'm a bit confused about
> sys/kern/syscalls.master file explained. For example, if I have a
> foo system call, following code is added:
>
> 532     AUE_NULL        STD     { int foo(char *str); }
>
> The question is in column two AUE_NULL, can I replace it with AUE_FOO?
> How to determine the system call should be audit or not? Thank you.
>
> Regards,
> Dave.
> _______________________________________________
> freebsd-hackers@freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-hackers
> To unsubscribe, send any mail to "freebsd-hackers-unsubscribe@freebsd.org"
>