From owner-svn-src-all@freebsd.org Tue Oct 2 17:22:13 2018 Return-Path: Delivered-To: svn-src-all@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 407AF10A5CA4; Tue, 2 Oct 2018 17:22:13 +0000 (UTC) (envelope-from asomers@gmail.com) Received: from mail-lf1-f47.google.com (mail-lf1-f47.google.com [209.85.167.47]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id CB57274247; Tue, 2 Oct 2018 17:22:12 +0000 (UTC) (envelope-from asomers@gmail.com) Received: by mail-lf1-f47.google.com with SMTP id y10-v6so2039669lfj.1; Tue, 02 Oct 2018 10:22:12 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=oU/h9dv1mLRSKNzPHrIE1vg5SudAts3iLbf/jCzJhlw=; b=hRFf95EDSzsme+JNrZeNNjY6vcULTf8XNDBIfB1mgNrNrwLZLMWksNNxISP0+DZ1fP rzYC0Xt8ge1MKn6B4q/z0/FB0rKoW4RRICiB8vDAsrg1I1Yyz1OqliPA7aO3W5A/QPP3 98CN9ixoLX5wO0Qta136h97eZd90TmkD/CiQK0PavpnuCN7ShUY+C6SHG/cVqjfj4j1D YLvIf4WRrWePwyb95EFbzqe6XV+IDL4iAi45XThZLn0+lFOfVbhXSRAhIItsOFDQpNKJ DRrqWrxGqadX5cjuOmTDoXLeOHNfEjyml/iSm98+14IORUnNqbKfhl0dShHlFH4sz9Tz +wJw== X-Gm-Message-State: ABuFfoilMypD00DoOAO84w3IU+ykJICCNfuZ0K649IowHKHU31msm0VD xde7g0cs2v+X9guSw0v3jdQJbKudTZq1e7z0BgkaZYk9 X-Google-Smtp-Source: ACcGV62vUTSdloGbpMK/k2hG4U5l17O5A2tMhwnYSvu7R+ywFz8KR8z3B2+P3Mbx9geMgdhBwnHER0Tevbp1CFuhyt8= X-Received: by 2002:a19:d8d1:: with SMTP id r78-v6mr7087050lfi.146.1538500549317; Tue, 02 Oct 2018 10:15:49 -0700 (PDT) MIME-Version: 1.0 References: <201810021558.w92FwHBp025418@repo.freebsd.org> In-Reply-To: <201810021558.w92FwHBp025418@repo.freebsd.org> From: Alan Somers Date: Tue, 2 Oct 2018 11:15:37 -0600 Message-ID: Subject: Re: svn commit: r339085 - head/sys/security/audit To: Robert Watson Cc: src-committers , svn-src-all , svn-src-head Content-Type: text/plain; charset="UTF-8" X-Content-Filtered-By: Mailman/MimeDel 2.1.27 X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 02 Oct 2018 17:22:13 -0000 On Tue, Oct 2, 2018 at 9:58 AM Robert Watson wrote: > Author: rwatson > Date: Tue Oct 2 15:58:17 2018 > New Revision: 339085 > URL: https://svnweb.freebsd.org/changeset/base/339085 > > Log: > Rework the logic around quick checks for auditing that take place at > system-call entry and whenever audit arguments or return values are > captured: > > 1. Expose a single global, audit_syscalls_enabled, which controls > whether the audit framework is entered, rather than exposing > components of the policy -- e.g., if the trail is enabled, > suspended, etc. > > 2. Introduce a new function audit_syscalls_enabled_update(), which is > called to update audit_syscalls_enabled whenever an aspect of the > policy changes, so that the value can be updated. > > 3. Remove a check of trail enablement/suspension from audit_new() -- > at the point where this function has been entered, we believe that > system-call auditing is already in force, or we wouldn't get here, > so simply proceed to more expensive policy checks. > > 4. Use an audit-provided global, audit_dtrace_enabled, rather than a > dtaudit-provided global, to provide policy indicating whether > dtaudit would like system calls to be audited. > > 5. Do some minor cosmetic renaming to clarify what various variables > are for. > > These changes collectively arrange it so that traditional audit > (trail, pipes) or the DTrace audit provider can enable system-call > probes without the other configured. Otherwise, dtaudit cannot > capture system-call data without auditd(8) started. > > Reviewed by: gnn > Sponsored by: DARPA, AFRL > Approved by: re (gjb) > Differential Revision: https://reviews.freebsd.org/D17348 > > Modified: > head/sys/security/audit/audit.c > head/sys/security/audit/audit.h > head/sys/security/audit/audit_dtrace.c > head/sys/security/audit/audit_private.h > head/sys/security/audit/audit_syscalls.c > head/sys/security/audit/audit_worker.c > Did you check the logic around audit_proc_coredump too? I think this change will cause AUE_CORE events to be emitted even when auditing is disabled. -Alan