| 7493f24e | 02-Mar-2013 |
Pawel Jakub Dawidek <[email protected]> |
- Implement two new system calls:
int bindat(int fd, int s, const struct sockaddr *addr, socklen_t addrlen); int connectat(int fd, int s, const struct sockaddr *name, socklen_t namelen);
which
- Implement two new system calls:
int bindat(int fd, int s, const struct sockaddr *addr, socklen_t addrlen); int connectat(int fd, int s, const struct sockaddr *name, socklen_t namelen);
which allow to bind and connect respectively to a UNIX domain socket with a path relative to the directory associated with the given file descriptor 'fd'.
- Add manual pages for the new syscalls.
- Make the new syscalls available for processes in capability mode sandbox.
- Add capability rights CAP_BINDAT and CAP_CONNECTAT that has to be present on the directory descriptor for the syscalls to work.
- Update audit(4) to support those two new syscalls and to handle path in sockaddr_un structure relative to the given directory descriptor.
- Update procstat(1) to recognize the new capability rights.
- Document the new capability rights in cap_rights_limit(2).
Sponsored by: The FreeBSD Foundation Discussed with: rwatson, jilles, kib, des
show more ...
|
| 399d3f65 | 01-Dec-2012 |
Robert Watson <[email protected]> |
Merge a number of post-1.2-alpha2 changes to OpenBSM into the OpenBSM vendor area; these sort out various post-release issues, largely to do with integrating OpenBSM with the base FreeBSD build. All
Merge a number of post-1.2-alpha2 changes to OpenBSM into the OpenBSM vendor area; these sort out various post-release issues, largely to do with integrating OpenBSM with the base FreeBSD build. All of these changes will appear in a future 1.2-alpha3:
Change 219846 on 2012/11/26 by rwatson@rwatson_cinnamon
Update several instances of Apple Computer to Apple; a change made in the FreeBSD tree some years ago but not propagated to OpenBSM.
Change 219845 on 2012/11/26 by rwatson@rwatson_cinnamon
Remove Apple acknowledgement clause from file with Christian Peron copyright (with permission from Christian).
Change 219836 on 2012/11/23 by rwatson@rwatson_cinnamon
Replace further instances of <> with "" for local includes in auditdistd.
Change 219834 on 2012/11/23 by rwatson@rwatson_cinnamon
For current-directory headers, use #include "" rather than #include <>.
Change 219832 on 2012/11/23 by rwatson@rwatson_cinnamon
Be more consistent with the remainder of OpenBSM and include config/config.h rather than config.h.
Don't include config.h from synch.h, which is included only from .c files that already include config.h.
Change 219831 on 2012/11/23 by pjd@pjd_anger
Add Xref to auditdistd(8).
Suggested by: rwatson
Obtained from: TrustedBSD Project Sponsored by: The FreeBSD Foundation (auditdistd)
show more ...
|
| 5d171016 | 17-Jul-2009 |
Robert Watson <[email protected]> |
Vendor import of OpenBSM 1.1p1, which incorporates the following changes since the last imported OpenBSM release:
OpenBSM 1.1p1
- Fixes to AUT_SOCKUNIX token parsing. - IPv6 support for au_to_me(3)
Vendor import of OpenBSM 1.1p1, which incorporates the following changes since the last imported OpenBSM release:
OpenBSM 1.1p1
- Fixes to AUT_SOCKUNIX token parsing. - IPv6 support for au_to_me(3). - Improved robustness in the parsing of audit_control, especially long flags/naflags strings and whitespace in all fields. - Add missing conversion of a number of FreeBSD/Mac OS X errnos to/from BSM error number space.
Obtained from: TrustedBSD Project Sponsored by: Apple, Inc.
show more ...
|
| a751bb74 | 19-Apr-2009 |
Robert Watson <[email protected]> |
Vendor import of OpenBSM 1.1, which incorporates the following changes since the last imported OpenBSM release:
OpenBSM 1.1
- Change auditon(2) parameters and data structures to be 32/64-bit archit
Vendor import of OpenBSM 1.1, which incorporates the following changes since the last imported OpenBSM release:
OpenBSM 1.1
- Change auditon(2) parameters and data structures to be 32/64-bit architecture independent. Add more information to man page about auditon(2) parameters. - Add wrapper functions for auditon(2) to use legacy commands when the new commands are not supported. - Add default for 'expire-after' in audit_control to expire trail files when the audit directory is more than 10 megabytes ('10M'). - Interface to convert between local and BSM fcntl(2) command values has been added: au_bsm_to_fcntl_cmd(3) and au_fcntl_cmd_to_bsm(3), along with definitions of constants in audit_fcntl.h. - A bug, introduced in OpenBSM 1.1 alpha 4, in which AUT_RETURN32 tokens generated by audit_submit(3) were improperly encoded has been fixed. - Fix example in audit_submit(3) man page. Also, make it clear that we want the audit ID as the argument. - A new audit event class 'aa', for post-login authentication and authorization events, has been added.
Obtained from: TrustedBSD Project Sponsored by: Apple, Inc.
show more ...
|
| 694dcf49 | 02-Mar-2009 |
Robert Watson <[email protected]> |
Vendor import of OpenBSM 1.1 beta1, which incorporates the following changes since the last imported OpenBSM release:
OpenBSM 1.1 beta 1
- The filesz parameter in audit_control(5) now accepts suffi
Vendor import of OpenBSM 1.1 beta1, which incorporates the following changes since the last imported OpenBSM release:
OpenBSM 1.1 beta 1
- The filesz parameter in audit_control(5) now accepts suffixes: 'B' for Bytes, 'K' for Kilobytes, 'M' for Megabytes, and 'G' for Gigabytes. For legacy support no suffix defaults to bytes. - Audit trail log expiration support added. It is configured in audit_control(5) with the expire-after parameter. If there is no expire-after parameter in audit_control(5), the default, then the audit trail files are not expired and removed. See audit_control(5) for more information. - Change defaults in audit_control: warn at 5% rather than 20% free for audit partitions, rotate automatically at 2mb, and set the default policy to cnt,argv rather than cnt so that execve(2) arguments are captured if AUE_EXECVE events are audited. These may provide more usable defaults for many users. - Use au_domain_to_bsm(3) and au_socket_type_to_bsm(3) to convert au_to_socket_ex(3) arguments to BSM format. - Fix error encoding AUT_IPC_PERM tokens.
Obtained from: TrustedBSD Project Sponsored by: Apple Inc.
show more ...
|