#
267654 |
|
19-Jun-2014 |
gjb |
Copy stable/9 to releng/9.3 as part of the 9.3-RELEASE cycle.
Approved by: re (implicit) Sponsored by: The FreeBSD Foundation |
#
244390 |
|
18-Dec-2012 |
rwatson |
Merge OpenBSM 1.2-alpha3 from head to stable/9, upgrading from the previous OpenBSM 1.1p2:
OpenBSM 1.2 alpha 3
- Various minor tweaks to the auditdistd build to make it fit the FreeBSD build environment better. - AUE_WAIT6 merged from FreeBSD 9.
OpenBSM 1.2 alpha 2
- auditdistd, a distributed audit trail management daemon, has now been merged. This allows trail files to be securely and reliably synced from audited hosts to an audit server, and employs TLS encryption. Where available, it uses Capsicum to sandbox the service. This work was contributed by Pawel Jakub Dawidek under sponsorship from the FreeBSD Foundation.
OpenBSM 1.2 alpha 1
- Add Capsicum-related error numbers for FreeBSD: ENOTCAPABLE, ECAPMODE. - Add Capsicum, process descriptor audit events for FreeBSD. - Allow 0% minspace. - Fixes from the clang static analyser. - Fix expiration of trail files when the host parameter is used. - Various typo fixes. - Support for Solaris privilege and privilege set tokens. - Documentation for getachost(), improvements for getacfilesz(). - Fix a directory descriptor leak that happened when audit trail partitions filled. - Support for more Linux distributions with a partial contemporary endian.h. - Improved escaping of XML-encapsulated BSM. - A variety of minor documentation, style, and functional.
A separate commit will merge build changes to enable auditdistd, etc.
Obtained from: TrustedBSD Project Sponsored by: The FreeBSD Foundation (auditdistd)
|
#
225736 |
|
22-Sep-2011 |
kensmith |
Copy head to stable/9 as part of 9.0-RELEASE release cycle.
Approved by: re (implicit)
|
#
191273 |
|
19-Apr-2009 |
rwatson |
Merge OpenBSM 1.1 from OpenBSM vendor branch to head.
OpenBSM history for imported revision below for reference.
MFC after: 2 weeks Sponsored by: Apple, Inc. Obtained from: TrustedBSD Project
OpenBSM 1.1
- Change auditon(2) parameters and data structures to be 32/64-bit architecture independent. Add more information to man page about auditon(2) parameters. - Add wrapper functions for auditon(2) to use legacy commands when the new commands are not supported. - Add default for 'expire-after' in audit_control to expire trail files when the audit directory is more than 10 megabytes ('10M'). - Interface to convert between local and BSM fcntl(2) command values has been added: au_bsm_to_fcntl_cmd(3) and au_fcntl_cmd_to_bsm(3), along with definitions of constants in audit_fcntl.h. - A bug, introduced in OpenBSM 1.1 alpha 4, in which AUT_RETURN32 tokens generated by audit_submit(3) were improperly encoded has been fixed. - Fix example in audit_submit(3) man page. Also, make it clear that we want the audit ID as the argument. - A new audit event class 'aa', for post-login authentication and authorization events, has been added.
|
#
189279 |
|
02-Mar-2009 |
rwatson |
Merge OpenBSM 1.1 beta 1 from OpenBSM vendor branch to head, both contrib/openbsm (svn merge) and src/sys/{bsm,security/audit} (manual merge).
OpenBSM history for imported revision below for reference.
MFC after: 1 month Sponsored by: Apple, Inc. Obtained from: TrustedBSD Project
OpenBSM 1.1 beta 1
- The filesz parameter in audit_control(5) now accepts suffixes: 'B' for Bytes, 'K' for Kilobytes, 'M' for Megabytes, and 'G' for Gigabytes. For legacy support no suffix defaults to bytes. - Audit trail log expiration support added. It is configured in audit_control(5) with the expire-after parameter. If there is no expire-after parameter in audit_control(5), the default, then the audit trail files are not expired and removed. See audit_control(5) for more information. - Change defaults in audit_control: warn at 5% rather than 20% free for audit partitions, rotate automatically at 2mb, and set the default policy to cnt,argv rather than cnt so that execve(2) arguments are captured if AUE_EXECVE events are audited. These may provide more usable defaults for many users. - Use au_domain_to_bsm(3) and au_socket_type_to_bsm(3) to convert au_to_socket_ex(3) arguments to BSM format. - Fix error encoding AUT_IPC_PERM tokens.
|
#
162626 |
|
25-Sep-2006 |
rwatson |
Resolve conflicts from OpenBSM 1.0 alpha 12 import.
Obtained from: TrustedBSD Project
|
#
162506 |
|
21-Sep-2006 |
rwatson |
Resolve conflicts from OpenBSM 1.0 alpha 11 vendor import: we have locally added $FreeBSD$ to /etc configuration files to assist mergemaster.
|
#
157137 |
|
25-Mar-2006 |
rwatson |
Take contrib/openbsm/etc configuration files off the vendor branch in order to add $FreeBSD$ tags, which helps mergemaster better manage updating them.
Requested by: several Obtained from: TrustedBSD Project
|
#
155291 |
|
04-Feb-2006 |
rwatson |
This commit was generated by cvs2svn to compensate for changes in r155290, which included commits to RCS files with non-trunk default branches.
|
#
155290 |
|
04-Feb-2006 |
rwatson |
Import OpenBSM 1.0 alpha 2, a minor update on alpha 1:
- Man page formatting improvements. - A number of new audit event identifiers for FreeBSD, Linux, and POSIX.1b events. - Remove 'tfm' class, unused in OpenBSM.
Obtained from: TrustedBSD Project
|
#
155131 |
|
31-Jan-2006 |
rwatson |
Initial vendor import of the TrustedBSD OpenBSM distribution, version 1.0 alpha 1, an implementation of the documented Sun Basic Security Module (BSM) Audit API and file format, as well as local extensions to support the Mac OS X and FreeBSD operating systems. Also included are command line tools for audit trail reduction and conversion to text, as well as documentation of the commands, file format, and APIs. This distribution is the foundation for the TrustedBSD Audit implementation, and is a pre-release.
This is the first in a series of commits to introduce support for Common Criteria CAPP security event audit support.
This software has been made possible through the generous contributions of Apple Computer, Inc., SPARTA, Inc., as well as members of the TrustedBSD Project, including Wayne Salamon <wsalamon> and Tom Rhodes <trhodes>. The original OpenBSM implementation was created by McAfee Research under contract to Apple Computer, Inc., as part of their CC CAPP security evaluation.
Many thanks to: wsalamon, trhodes Obtained from: TrustedBSD Project
|