From owner-trustedbsd-cvs@FreeBSD.ORG Tue Sep 19 13:00:53 2006 Return-Path: X-Original-To: trustedbsd-cvs@freebsd.org Delivered-To: trustedbsd-cvs@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id B68EB16A407 for ; Tue, 19 Sep 2006 13:00:53 +0000 (UTC) (envelope-from owner-perforce@freebsd.org) Received: from cyrus.watson.org (cyrus.watson.org [209.31.154.42]) by mx1.FreeBSD.org (Postfix) with ESMTP id 34A3943D45 for ; Tue, 19 Sep 2006 13:00:53 +0000 (GMT) (envelope-from owner-perforce@freebsd.org) Received: from mx2.freebsd.org (mx2.freebsd.org [216.136.204.119]) by cyrus.watson.org (Postfix) with ESMTP id C7E3146D3C for ; Tue, 19 Sep 2006 09:00:52 -0400 (EDT) Received: from hub.freebsd.org (hub.freebsd.org [216.136.204.18]) by mx2.freebsd.org (Postfix) with ESMTP id 5A76656F80; Tue, 19 Sep 2006 12:59:26 +0000 (GMT) (envelope-from owner-perforce@freebsd.org) Received: by hub.freebsd.org (Postfix, from userid 32767) id 50EB216A415; Tue, 19 Sep 2006 12:59:26 +0000 (UTC) X-Original-To: perforce@freebsd.org Delivered-To: perforce@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 152BC16A40F for ; Tue, 19 Sep 2006 12:59:26 +0000 (UTC) (envelope-from bb+lists.freebsd.perforce@cyrus.watson.org) Received: from repoman.freebsd.org (repoman.freebsd.org [216.136.204.115]) by mx1.FreeBSD.org (Postfix) with ESMTP id BF11D43D4C for ; Tue, 19 Sep 2006 12:59:25 +0000 (GMT) (envelope-from bb+lists.freebsd.perforce@cyrus.watson.org) Received: from repoman.freebsd.org (localhost [127.0.0.1]) by repoman.freebsd.org (8.13.6/8.13.6) with ESMTP id k8JCxP22049279 for ; Tue, 19 Sep 2006 12:59:25 GMT (envelope-from bb+lists.freebsd.perforce@cyrus.watson.org) Received: (from perforce@localhost) by repoman.freebsd.org (8.13.6/8.13.4/Submit) id k8JCxPtG049276 for perforce@freebsd.org; Tue, 19 Sep 2006 12:59:25 GMT (envelope-from bb+lists.freebsd.perforce@cyrus.watson.org) Date: Tue, 19 Sep 2006 12:59:25 GMT Message-Id: <200609191259.k8JCxPtG049276@repoman.freebsd.org> X-Authentication-Warning: repoman.freebsd.org: perforce set sender to bb+lists.freebsd.perforce@cyrus.watson.org using -f From: Robert Watson To: Perforce Change Reviews Cc: Subject: PERFORCE change 106338 for review X-BeenThere: trustedbsd-cvs@FreeBSD.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: TrustedBSD CVS and Perforce commit message list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 19 Sep 2006 13:00:53 -0000 http://perforce.freebsd.org/chv.cgi?CH=106338 Change 106338 by rwatson@rwatson_zoo on 2006/09/19 12:59:20 Provide a little backward compatibility safety for old audit_control files that don't contain a policy statement: set the policy to AUDIT_CNT if we can't load or parse the policy from the file. Affected files ... .. //depot/projects/trustedbsd/openbsm/bin/auditd/auditd.c#21 edit Differences ... ==== //depot/projects/trustedbsd/openbsm/bin/auditd/auditd.c#21 (text+ko) ==== @@ -30,7 +30,7 @@ * * @APPLE_BSD_LICENSE_HEADER_END@ * - * $P4: //depot/projects/trustedbsd/openbsm/bin/auditd/auditd.c#20 $ + * $P4: //depot/projects/trustedbsd/openbsm/bin/auditd/auditd.c#21 $ */ #include @@ -789,12 +789,22 @@ syslog(LOG_ERR, "Failed to obtain non-attributable event mask."); + /* + * If a policy is configured in audit_control(5), implement the + * policy. However, if one isn't defined, set AUDIT_CNT to avoid + * leaving the system in a fragile state. + */ if ((getacpol(polstr, POL_STR_SIZE) == 0) && (au_strtopol(polstr, &policy) == 0)) { if (auditon(A_SETPOLICY, &policy, sizeof(policy))) - syslog(LOG_ERR, "Failed to set audit policy."); - } else - syslog(LOG_ERR, "Failed to obtain policy flags."); + syslog(LOG_ERR, "Failed to set audit policy: %m"); + } else { + syslog(LOG_ERR, "Failed to obtain policy flags: %m"); + policy = AUDIT_CNT; + if (auditon(A_SETPOLICY, &policy, sizeof(policy))) + syslog(LOG_ERR, + "Failed to set default audit policy: %m"); + } return (0); }