Date: Thu, 12 Feb 2009 16:40:50 GMT From: Stacey Son <sson@FreeBSD.org> To: Perforce Change Reviews <perforce@FreeBSD.org> Subject: PERFORCE change 157598 for review Message-ID: <200902121640.n1CGeo8r068683@repoman.freebsd.org>
next in thread | raw e-mail | index | archive | help
http://perforce.freebsd.org/chv.cgi?CH=157598 Change 157598 by sson@sson_amd64 on 2009/02/12 16:40:16 On Mac OS X use setaudit_addr() instead of setaudit(). Affected files ... .. //depot/projects/trustedbsd/openbsm/libauditd/auditd_lib.c#5 edit Differences ... ==== //depot/projects/trustedbsd/openbsm/libauditd/auditd_lib.c#5 (text+ko) ==== @@ -26,7 +26,7 @@ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE * POSSIBILITY OF SUCH DAMAGE. * - * $P4: //depot/projects/trustedbsd/openbsm/libauditd/auditd_lib.c#4 $ + * $P4: //depot/projects/trustedbsd/openbsm/libauditd/auditd_lib.c#5 $ */ #include <sys/param.h> @@ -814,9 +814,31 @@ * ADE_NOERR on success, * ADE_SETAUDIT if setaudit(2) fails. */ +#ifdef __APPLE__ int auditd_prevent_audit(void) { + auditinfo_addr_t aia; + + /* + * To prevent event feedback cycles and avoid audit becoming stalled if + * auditing is suspended we mask this processes events from being + * audited. We allow the uid, tid, and mask fields to be implicitly + * set to zero, but do set the audit session ID to the PID. + * + * XXXRW: Is there more to it than this? + */ + bzero(&aia, sizeof(aia)); + aia.ai_asid = AU_ASSIGN_ASID; + aia.ai_termid.at_type = AU_IPv4; + if (setaudit_addr(&aia, sizeof(aia)) != 0) + return (ADE_SETAUDIT); + return (ADE_NOERR); +} +#else +int +auditd_prevent_audit(void) +{ auditinfo_t ai; /* @@ -833,6 +855,7 @@ return (ADE_SETAUDIT); return (ADE_NOERR); } +#endif /* __APPLE__ */ /* * Generate and submit audit record for audit startup or shutdown. The event
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200902121640.n1CGeo8r068683>